diff --git a/.gitignore b/.gitignore
index b59fd44..73105bb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,8 @@ result
 result-*
 .direnv/
 oci-trantor/
+tailscale-tailnet/
+cloudflare-baduhaidev
 
 # Personal notes and temporary files
 todo.md
diff --git a/aspects/ai.nix b/aspects/ai.nix
new file mode 100644
index 0000000..f3eb6dd
--- /dev/null
+++ b/aspects/ai.nix
@@ -0,0 +1,19 @@
+{ ... }:
+{
+  flake.modules.nixos.ai =
+    { inputs, pkgs, ... }:
+    {
+      environment.systemPackages =
+        (with pkgs; [ ])
+        ++ (with inputs.nix-ai-tools.packages.${pkgs.stdenv.hostPlatform.system}; [
+          opencode
+        ]);
+
+      nix.settings = {
+        extra-substituters = [ "https://cache.numtide.com" ];
+        extra-trusted-public-keys = [
+          "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
+        ];
+      };
+    };
+}
diff --git a/aspects/base/bash.nix b/aspects/base/bash.nix
new file mode 100644
index 0000000..6ba97ef
--- /dev/null
+++ b/aspects/base/bash.nix
@@ -0,0 +1,16 @@
+{ ... }:
+{
+  flake.modules.homeManager.bash =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      programs.bash = {
+        enable = true;
+        historyFile = "~/.cache/bash_history";
+      };
+    };
+}
diff --git a/aspects/base/boot.nix b/aspects/base/boot.nix
new file mode 100644
index 0000000..ec8593d
--- /dev/null
+++ b/aspects/base/boot.nix
@@ -0,0 +1,23 @@
+{ ... }:
+{
+  flake.modules.nixos.boot =
+    { pkgs, ... }:
+    {
+      boot = {
+        loader = {
+          timeout = 1;
+          efi.canTouchEfiVariables = true;
+          systemd-boot = {
+            enable = true;
+            editor = false;
+            consoleMode = "max";
+            sortKey = "aa";
+            netbootxyz = {
+              enable = true;
+              sortKey = "zz";
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/aspects/base/console.nix b/aspects/base/console.nix
new file mode 100644
index 0000000..6bb7be4
--- /dev/null
+++ b/aspects/base/console.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  flake.modules.nixos.console =
+    { ... }:
+    {
+      console = {
+        useXkbConfig = true;
+        earlySetup = true;
+      };
+    };
+}
diff --git a/aspects/base/firewall.nix b/aspects/base/firewall.nix
new file mode 100644
index 0000000..68ffa6e
--- /dev/null
+++ b/aspects/base/firewall.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  flake.modules.nixos.firewall =
+    { ... }:
+    {
+      networking = {
+        firewall.enable = true;
+        nftables.enable = true;
+      };
+    };
+}
diff --git a/aspects/base/fish.nix b/aspects/base/fish.nix
new file mode 100644
index 0000000..8ed326a
--- /dev/null
+++ b/aspects/base/fish.nix
@@ -0,0 +1,47 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.fish =
+      { ... }:
+      {
+        programs.fish.enable = true;
+      };
+    homeManager.fish =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        programs.fish = {
+          enable = true;
+          interactiveShellInit = ''
+            set fish_greeting
+            ${lib.getExe pkgs.nix-your-shell} fish | source
+          '';
+          loginShellInit = "${lib.getExe pkgs.nix-your-shell} fish | source";
+          plugins = [
+            {
+              name = "bang-bang";
+              src = pkgs.fetchFromGitHub {
+                owner = "oh-my-fish";
+                repo = "plugin-bang-bang";
+                rev = "f969c618301163273d0a03d002614d9a81952c1e";
+                sha256 = "sha256-A8ydBX4LORk+nutjHurqNNWFmW6LIiBPQcxS3x4nbeQ=";
+              };
+            }
+            {
+              name = "z";
+              src = pkgs.fetchFromGitHub {
+                owner = "jethrokuan";
+                repo = "z";
+                rev = "067e867debee59aee231e789fc4631f80fa5788e";
+                sha256 = "sha256-emmjTsqt8bdI5qpx1bAzhVACkg0MNB/uffaRjjeuFxU=";
+              };
+            }
+          ];
+        };
+      };
+  };
+}
diff --git a/aspects/base/locale.nix b/aspects/base/locale.nix
new file mode 100644
index 0000000..4d0c716
--- /dev/null
+++ b/aspects/base/locale.nix
@@ -0,0 +1,24 @@
+{ ... }:
+{
+  flake.modules.nixos.locale =
+    { ... }:
+    {
+      time.timeZone = "America/Bahia";
+
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_ADDRESS = "pt_BR.utf8";
+          LC_COLLATE = "pt_BR.utf8";
+          LC_IDENTIFICATION = "pt_BR.utf8";
+          LC_MEASUREMENT = "pt_BR.utf8";
+          LC_MONETARY = "pt_BR.utf8";
+          LC_NAME = "pt_BR.utf8";
+          LC_NUMERIC = "pt_BR.utf8";
+          LC_PAPER = "pt_BR.utf8";
+          LC_TELEPHONE = "pt_BR.utf8";
+          LC_TIME = "en_IE.utf8";
+        };
+      };
+    };
+}
diff --git a/aspects/base/nix.nix b/aspects/base/nix.nix
new file mode 100644
index 0000000..2442024
--- /dev/null
+++ b/aspects/base/nix.nix
@@ -0,0 +1,51 @@
+{ ... }:
+{
+  flake.modules.nixos.nix =
+    { inputs, pkgs, ... }:
+    {
+      imports = [ inputs.nixos-cli.nixosModules.nixos-cli ];
+
+      nix = {
+        settings = {
+          auto-optimise-store = true;
+          connect-timeout = 10;
+          log-lines = 25;
+          min-free = 128000000;
+          max-free = 1000000000;
+          trusted-users = [ "@wheel" ];
+        };
+        extraOptions = "experimental-features = nix-command flakes";
+        gc = {
+          automatic = true;
+          options = "--delete-older-than 8d";
+        };
+      };
+
+      nixpkgs.config = {
+        allowUnfree = true;
+        enableParallelBuilding = true;
+        buildManPages = false;
+        buildDocs = false;
+      };
+
+      services.nixos-cli = {
+        enable = true;
+        config = {
+          use_nvd = true;
+          ignore_dirty_tree = true;
+          apply = {
+            reexec_as_root = true;
+            use_nom = true;
+          };
+          confirmation.empty = "default-yes";
+        };
+      };
+
+      environment.systemPackages = with pkgs; [
+        nix-output-monitor
+        nvd
+      ];
+
+      system.stateVersion = "22.11";
+    };
+}
diff --git a/aspects/base/security.nix b/aspects/base/security.nix
new file mode 100644
index 0000000..310e345
--- /dev/null
+++ b/aspects/base/security.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  flake.modules.nixos.security =
+    { ... }:
+    {
+      security.sudo = {
+        wheelNeedsPassword = false;
+        extraConfig = ''
+          Defaults lecture = never
+        '';
+      };
+    };
+}
diff --git a/aspects/base/ssh.nix b/aspects/base/ssh.nix
new file mode 100644
index 0000000..6569bf0
--- /dev/null
+++ b/aspects/base/ssh.nix
@@ -0,0 +1,32 @@
+{ ... }:
+
+{
+  flake.modules.nixos.ssh =
+    { ... }:
+    {
+      services.openssh = {
+        enable = true;
+        settings.PermitRootLogin = "no";
+        extraConfig = ''
+          PrintLastLog no
+        '';
+      };
+      programs = {
+        bash.interactiveShellInit = ''
+          if [ -n "$SSH_CONNECTION" ] && [ -z "$IN_NIX_SHELL" ] && [ -z "$TMUX" ]; then
+            export TERM=xterm-256color
+            clear
+            fastfetch
+          fi
+        '';
+        fish.interactiveShellInit = ''
+          set fish_greeting
+          if set -q SSH_CONNECTION; and not set -q IN_NIX_SHELL; and not set -q TMUX
+            export TERM=xterm-256color
+            clear
+            fastfetch
+          end
+        '';
+      };
+    };
+}
diff --git a/aspects/bluetooth.nix b/aspects/bluetooth.nix
new file mode 100644
index 0000000..6c7b2d8
--- /dev/null
+++ b/aspects/bluetooth.nix
@@ -0,0 +1,16 @@
+{ ... }:
+{
+  flake.modules.nixos.bluetooth =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      hardware.bluetooth = {
+        enable = true;
+        powerOnBoot = false;
+      };
+    };
+}
diff --git a/aspects/cli/btop.nix b/aspects/cli/btop.nix
new file mode 100644
index 0000000..220a462
--- /dev/null
+++ b/aspects/cli/btop.nix
@@ -0,0 +1,28 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.btop =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [ btop ];
+      };
+
+    homeManager.btop =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        programs.btop = {
+          enable = true;
+          settings = {
+            theme_background = false;
+            proc_sorting = "cpu direct";
+            update_ms = 500;
+          };
+        };
+      };
+  };
+}
diff --git a/aspects/cli/comma.nix b/aspects/cli/comma.nix
new file mode 100644
index 0000000..169144f
--- /dev/null
+++ b/aspects/cli/comma.nix
@@ -0,0 +1,16 @@
+{ ... }:
+{
+  flake.modules.homeManager.comma =
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    {
+      imports = [ inputs.nix-index-database.homeModules.nix-index ];
+
+      programs.nix-index-database.comma.enable = true;
+    };
+}
diff --git a/aspects/cli/direnv.nix b/aspects/cli/direnv.nix
new file mode 100644
index 0000000..2cfb2ef
--- /dev/null
+++ b/aspects/cli/direnv.nix
@@ -0,0 +1,16 @@
+{ ... }:
+{
+  flake.modules.homeManager.direnv =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      programs.direnv = {
+        enable = true;
+        nix-direnv.enable = true;
+      };
+    };
+}
diff --git a/aspects/cli/helix.nix b/aspects/cli/helix.nix
new file mode 100644
index 0000000..a21641a
--- /dev/null
+++ b/aspects/cli/helix.nix
@@ -0,0 +1,67 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.helix =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          helix
+        ];
+      };
+
+    homeManager.helix =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        home.sessionVariables = {
+          EDITOR = "hx";
+        };
+
+        programs.helix = {
+          enable = true;
+          settings = {
+            editor = {
+              file-picker.hidden = false;
+              idle-timeout = 0;
+              line-number = "relative";
+              cursor-shape = {
+                normal = "underline";
+                insert = "bar";
+                select = "underline";
+              };
+              soft-wrap.enable = true;
+              auto-format = true;
+              indent-guides.render = true;
+            };
+            keys.normal = {
+              space = {
+                o = "file_picker_in_current_buffer_directory";
+                esc = [
+                  "collapse_selection"
+                  "keep_primary_selection"
+                ];
+              };
+            };
+          };
+          languages = {
+            language = [
+              {
+                name = "nix";
+                auto-format = true;
+                formatter.command = "nixfmt";
+              }
+              {
+                name = "typst";
+                auto-format = true;
+                formatter.command = "typstyle -c 1000 -i";
+              }
+            ];
+          };
+        };
+      };
+  };
+}
diff --git a/aspects/cli/hm-cli.nix b/aspects/cli/hm-cli.nix
new file mode 100644
index 0000000..97d79e4
--- /dev/null
+++ b/aspects/cli/hm-cli.nix
@@ -0,0 +1,18 @@
+{ ... }:
+{
+  flake.modules.homeManager.hm-cli =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      home = {
+        packages = with pkgs; [ hm-cli ];
+        sessionVariables = {
+          HM_PATH = "/etc/nixos";
+        };
+      };
+    };
+}
diff --git a/aspects/cli/starship.nix b/aspects/cli/starship.nix
new file mode 100644
index 0000000..3ac5e4f
--- /dev/null
+++ b/aspects/cli/starship.nix
@@ -0,0 +1,48 @@
+{ ... }:
+{
+  flake.modules.homeManager.starship =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      programs.starship = {
+        enable = true;
+        enableBashIntegration = true;
+        enableFishIntegration = true;
+        settings = {
+          add_newline = false;
+          format = ''
+            $hostname$directory$git_branch$git_status$nix_shell
+            [ ❯ ](bold green)
+          '';
+          right_format = "$cmd_duration$character";
+          hostname = {
+            ssh_symbol = "󰖟 ";
+          };
+          character = {
+            error_symbol = "[](red)";
+            success_symbol = "[󱐋](green)";
+          };
+          cmd_duration = {
+            format = "[󰄉 $duration ]($style)";
+            style = "yellow";
+            min_time = 500;
+          };
+          git_branch = {
+            symbol = " ";
+            style = "purple";
+          };
+          git_status.style = "red";
+          nix_shell = {
+            format = "via [$symbol$state]($style)";
+            heuristic = true;
+            style = "blue";
+            symbol = "󱄅 ";
+          };
+        };
+      };
+    };
+}
diff --git a/aspects/cli/tmux.nix b/aspects/cli/tmux.nix
new file mode 100644
index 0000000..4937574
--- /dev/null
+++ b/aspects/cli/tmux.nix
@@ -0,0 +1,29 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.tmux =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          tmux
+        ];
+      };
+
+    homeManager.tmux =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        programs.tmux = {
+          enable = true;
+          clock24 = true;
+          terminal = "xterm-256color";
+          mouse = true;
+          keyMode = "vi";
+        };
+      };
+  };
+}
diff --git a/aspects/constants.nix b/aspects/constants.nix
new file mode 100644
index 0000000..5a82660
--- /dev/null
+++ b/aspects/constants.nix
@@ -0,0 +1,217 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  # Host submodule type
+  hostType = lib.types.submodule {
+    options = {
+      lanIP = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "LAN IP address for the host";
+      };
+      tailscaleIP = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Tailscale IP address for the host";
+      };
+    };
+  };
+
+  # Service submodule type
+  serviceType = lib.types.submodule {
+    options = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = "Service name";
+      };
+      domain = lib.mkOption {
+        type = lib.types.str;
+        description = "Domain name for the service";
+      };
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = "Host where the service runs";
+      };
+      public = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether the service is publicly accessible";
+      };
+      lanIP = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "LAN IP address (inherited from host)";
+      };
+      tailscaleIP = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Tailscale IP address (inherited from host)";
+      };
+    };
+  };
+
+  # Import shared data (also used by terranix)
+  sharedData = import ../data/services.nix;
+
+  # Enrich services with host IP information
+  enrichServices =
+    hosts: services:
+    map (
+      svc:
+      let
+        hostInfo = hosts.${svc.host} or { };
+      in
+      svc
+      // {
+        lanIP = hostInfo.lanIP or null;
+        tailscaleIP = hostInfo.tailscaleIP or null;
+      }
+    ) services;
+
+in
+{
+  options.flake = {
+    hosts = lib.mkOption {
+      type = lib.types.attrsOf hostType;
+      default = { };
+      description = "Host definitions with IP addresses";
+    };
+
+    services = lib.mkOption {
+      type = lib.types.listOf serviceType;
+      default = [ ];
+      description = "Service definitions with enriched host information";
+    };
+
+    lib = lib.mkOption {
+      type = lib.types.attrsOf lib.types.raw;
+      default = { };
+      description = "Utility functions for flake configuration";
+    };
+  };
+
+  config.flake = {
+    hosts = sharedData.hosts;
+
+    services = enrichServices config.flake.hosts sharedData.services;
+
+    lib = {
+      # Nginx virtual host utilities
+      mkNginxVHosts =
+        { domains }:
+        let
+          mkVHostConfig =
+            domain: vhostConfig:
+            lib.recursiveUpdate {
+              useACMEHost = domain;
+              forceSSL = true;
+              kTLS = true;
+            } vhostConfig;
+        in
+        lib.mapAttrs mkVHostConfig domains;
+
+      # Split DNS utilities for unbound
+      # Generates unbound view config from a list of DNS entries
+      mkSplitDNS =
+        entries:
+        let
+          tailscaleData = map (e: ''"${e.domain}. IN A ${e.tailscaleIP}"'') entries;
+          lanData = map (e: ''"${e.domain}. IN A ${e.lanIP}"'') entries;
+        in
+        [
+          {
+            name = "tailscale";
+            view-first = true;
+            local-zone = ''"baduhai.dev." transparent'';
+            local-data = tailscaleData;
+          }
+          {
+            name = "lan";
+            view-first = true;
+            local-zone = ''"baduhai.dev." transparent'';
+            local-data = lanData;
+          }
+        ];
+      # Generates flake.homeConfigurations
+      mkHomeConfiguration =
+        {
+          user,
+          hostname,
+          system ? "x86_64-linux",
+          stateVersion ? "22.05",
+          nixpkgs ? inputs.nixpkgs, # override with e.g. inputs.nixpkgs-stable
+          userModules ? [ ],
+          overlays ? [ inputs.self.overlays.default ],
+          homeManagerModules ? with inputs.self.modules.homeManager; [
+            base
+            cli
+          ],
+          userDirectory ? "/home/${user}",
+        }:
+        inputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = nixpkgs.legacyPackages.${system};
+
+          extraSpecialArgs = {
+            inherit inputs hostname;
+          };
+
+          modules = [
+            { nixpkgs.overlays = overlays; }
+            {
+              home = {
+                username = user;
+                homeDirectory = userDirectory;
+                inherit stateVersion;
+              };
+            }
+            ((inputs.import-tree.initFilter (p: lib.hasSuffix ".nix" p))
+              "/${inputs.self}/aspects/users/_${user}"
+            )
+          ]
+          ++ homeManagerModules
+          ++ userModules;
+        };
+      # Generates flake.nixosConfigurations
+      mkHost =
+        {
+          hostname,
+          system ? "x86_64-linux",
+          nixpkgs ? inputs.nixpkgs,
+          overlays ? [
+            inputs.agenix.overlays.default
+            inputs.self.overlays.default
+          ],
+          ephemeralRootDev ? null, # pass rootDevice string to enable, e.g. ephemeralephemeralRootDev = "/dev/mapper/cryptroot"
+          nixosModules ? with inputs.self.modules.nixos; [
+            base
+            cli
+            user
+            root
+          ],
+          extraModules ? [ ],
+        }:
+        nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs; };
+          modules = [
+            inputs.agenix.nixosModules.default
+            { networking.hostName = hostname; }
+            { nixpkgs.overlays = overlays; }
+            ((inputs.import-tree.initFilter (p: lib.hasSuffix ".nix" p))
+              "${inputs.self}/aspects/hosts/_${hostname}"
+            )
+          ]
+          ++ (lib.optional (ephemeralRootDev != null) (
+            inputs.self.factory.ephemeral { rootDevice = ephemeralRootDev; }
+          ))
+          ++ nixosModules
+          ++ extraModules;
+        };
+    };
+  };
+}
diff --git a/aspects/desktop/graphics.nix b/aspects/desktop/graphics.nix
new file mode 100644
index 0000000..7d1ed6d
--- /dev/null
+++ b/aspects/desktop/graphics.nix
@@ -0,0 +1,25 @@
+{ ... }:
+
+{
+  flake.modules.nixos.graphics =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        gimp
+        inkscape
+        plasticity
+      ];
+
+      services.flatpak.packages = [
+        "com.boxy_svg.BoxySVG"
+        rec {
+          appId = "io.github.softfever.OrcaSlicer";
+          sha256 = "0hdx5sg6fknj1pfnfxvlfwb5h6y1vjr6fyajbsnjph5gkp97c6p1";
+          bundle = "${pkgs.fetchurl {
+            url = "https://github.com/SoftFever/OrcaSlicer/releases/download/v2.3.0/OrcaSlicer-Linux-flatpak_V2.3.0_x86_64.flatpak";
+            inherit sha256;
+          }}";
+        }
+      ];
+    };
+}
diff --git a/aspects/desktop/media.nix b/aspects/desktop/media.nix
new file mode 100644
index 0000000..7543c0a
--- /dev/null
+++ b/aspects/desktop/media.nix
@@ -0,0 +1,29 @@
+{ ... }:
+
+{
+  flake.modules = {
+    nixos.media =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          decibels
+          loupe
+          obs-studio
+          showtime
+        ];
+      };
+
+    homeManager.media =
+      { pkgs, ... }:
+      {
+        programs.obs-studio = {
+          enable = true;
+          plugins = with pkgs.obs-studio-plugins; [
+            obs-vkcapture
+            obs-backgroundremoval
+            obs-pipewire-audio-capture
+          ];
+        };
+      };
+  };
+}
diff --git a/aspects/desktop/niri.nix b/aspects/desktop/niri.nix
new file mode 100644
index 0000000..9408097
--- /dev/null
+++ b/aspects/desktop/niri.nix
@@ -0,0 +1,246 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.niri =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        services.greetd.settings = {
+          default_session.command = "${lib.getExe pkgs.tuigreet} --user-menu --time --remember --asterisks --cmd ${config.programs.niri.package}/bin/niri-session";
+        };
+
+        programs.niri.enable = true;
+      };
+    homeManager.niri =
+      {
+        config,
+        lib,
+        pkgs,
+        inputs,
+        hostname ? null,
+        ...
+      }:
+      let
+        isRotterdam = hostname == "rotterdam";
+      in
+      {
+        imports = [ inputs.noctalia.homeModules.default ];
+
+        services.kanshi = {
+          enable = true;
+          settings = [
+            {
+              profile.name = "default";
+              profile.outputs = [
+                {
+                  criteria = "*";
+                  scale = 1.0;
+                }
+              ];
+            }
+          ];
+        };
+
+        home = {
+          packages = with pkgs; [
+            xwayland-satellite
+            inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default
+          ];
+          sessionVariables.QT_QPA_PLATFORMTHEME = "gtk3";
+        };
+
+        xdg.configFile."niri/config.kdl".text = ''
+          input {
+            keyboard {
+              xkb {
+                layout "us"
+                variant "altgr-intl"
+              }
+            }
+            touchpad {
+              tap
+              dwt
+              drag true
+              drag-lock
+              natural-scroll
+              accel-speed 0.2
+              accel-profile "flat"
+              scroll-method "two-finger"
+              middle-emulation
+            }
+            mouse {
+              natural-scroll
+              accel-speed 0.2
+              accel-profile "flat"
+            }
+            warp-mouse-to-focus mode="center-xy"
+            focus-follows-mouse
+          }
+
+          output "LG Electronics LG ULTRAWIDE 206AZFM5E459" {
+            layout {
+              preset-column-widths {
+                proportion 0.33333
+                proportion 0.5
+                proportion 0.66667
+              }
+              default-column-width { proportion 0.33333; }
+            }
+          }
+
+          layout {
+            gaps 8
+            center-focused-column "never"
+            always-center-single-column
+            empty-workspace-above-first
+            preset-column-widths {
+              proportion 0.5
+              proportion 1.0
+            }
+            default-column-width { proportion 0.5; }
+            focus-ring {
+              off
+            }
+            border {
+              width 4
+              active-color "#ffc87f"
+              inactive-color "#505050"
+              urgent-color "#9b0000"
+            }
+            tab-indicator {
+              width 4
+              gap 4
+              place-within-column
+            }
+          }
+
+          overview {
+            zoom 0.65
+          }
+
+          spawn-at-startup "noctalia-shell" "-d"
+          spawn-at-startup "${lib.getExe pkgs.niri-auto-centre}"
+          layer-rule {
+            match namespace="^noctalia-overview*"
+            place-within-backdrop true
+          }
+
+          hotkey-overlay {
+            skip-at-startup
+          }
+
+          prefer-no-csd
+          screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+          animations {
+            slowdown 0.3
+          }
+
+          window-rule {
+            match app-id="zen"
+            default-column-width { proportion ${if isRotterdam then "0.5" else "1.0"}; }
+          }
+
+          window-rule {
+            geometry-corner-radius 12
+            clip-to-geometry true
+          }
+
+          config-notification {
+            disable-failed
+          }
+
+          binds {
+            Alt+Space repeat=false { spawn "vicinae" "toggle"; }
+            XF86AudioRaiseVolume allow-when-locked=true { spawn "noctalia-shell" "ipc" "call" "volume" "increase"; }
+            XF86AudioLowerVolume allow-when-locked=true { spawn "noctalia-shell" "ipc" "call" "volume" "decrease"; }
+            XF86AudioMute allow-when-locked=true { spawn "noctalia-shell" "ipc" "call" "volume" "muteOutput"; }
+            XF86MonBrightnessUp allow-when-locked=true { spawn "noctalia-shell" "ipc" "call" "brightness" "increase"; }
+            XF86MonBrightnessDown allow-when-locked=true { spawn "noctalia-shell" "ipc" "call" "brightness" "decrease"; }
+            XF86AudioPlay        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "play-pause"; }
+            XF86AudioStop        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "stop"; }
+            XF86AudioPrev        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "previous"; }
+            XF86AudioNext        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "next"; }
+            Mod+V repeat=false { spawn "vicinae" "vicinae://extensions/vicinae/clipboard/history"; }
+            Mod+Shift+L repeat=false { spawn "noctalia-shell" "ipc" "call" "lockScreen" "lock"; }
+            Mod+Return { spawn "ghostty"; }
+            Ctrl+Alt+Shift+A allow-when-locked=true { spawn "toggleaudiosink"; }
+            Mod+W repeat=false { toggle-overview; }
+            Mod+Q { close-window; }
+            Alt+Shift+Q { close-window;}
+            Mod+Shift+Q { close-window; }
+            Alt+F4 { close-window; }
+            Mod+Left  { focus-column-left; }
+            Mod+Down  { focus-window-or-workspace-down; }
+            Mod+Up    { focus-window-or-workspace-up; }
+            Mod+Right { focus-column-right; }
+            Mod+H     { focus-column-left; }
+            Mod+L     { focus-column-right; }
+            Mod+J     { focus-window-or-workspace-down; }
+            Mod+K     { focus-window-or-workspace-up; }
+            Mod+Ctrl+Left  { move-column-left; }
+            Mod+Ctrl+Down  { move-window-down-or-to-workspace-down; }
+            Mod+Ctrl+Up    { move-window-up-or-to-workspace-up; }
+            Mod+Ctrl+Right { move-column-right; }
+            Mod+Ctrl+H     { move-column-left; }
+            Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
+            Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
+            Mod+Ctrl+L     { move-column-right; }
+            Mod+Home { focus-column-first; }
+            Mod+End  { focus-column-last; }
+            Mod+Ctrl+Home { move-column-to-first; }
+            Mod+Ctrl+End  { move-column-to-last; }
+            Mod+Alt+Left  { focus-monitor-left; }
+            Mod+Alt+Down  { focus-monitor-down; }
+            Mod+Alt+Up    { focus-monitor-up; }
+            Mod+Alt+Right { focus-monitor-right; }
+            Mod+Alt+H     { focus-monitor-left; }
+            Mod+Alt+J     { focus-monitor-down; }
+            Mod+Alt+K     { focus-monitor-up; }
+            Mod+Alt+L     { focus-monitor-right; }
+            Mod+Alt+Ctrl+Left  { move-column-to-monitor-left; }
+            Mod+Alt+Ctrl+Down  { move-column-to-monitor-down; }
+            Mod+Alt+Ctrl+Up    { move-column-to-monitor-up; }
+            Mod+Alt+Ctrl+Right { move-column-to-monitor-right; }
+            Mod+Alt+Ctrl+H     { move-column-to-monitor-left; }
+            Mod+Alt+Ctrl+J     { move-column-to-monitor-down; }
+            Mod+Alt+Ctrl+K     { move-column-to-monitor-up; }
+            Mod+Alt+Ctrl+L     { move-column-to-monitor-right; }
+            Mod+Ctrl+U         { move-workspace-down; }
+            Mod+Ctrl+I         { move-workspace-up; }
+            Mod+WheelScrollDown      cooldown-ms=150 { focus-workspace-down; }
+            Mod+WheelScrollUp        cooldown-ms=150 { focus-workspace-up; }
+            Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; }
+            Mod+Ctrl+WheelScrollUp   cooldown-ms=150 { move-column-to-workspace-up; }
+            Mod+Shift+WheelScrollDown      { focus-column-right; }
+            Mod+Shift+WheelScrollUp        { focus-column-left; }
+            Mod+Ctrl+Shift+WheelScrollDown { move-column-right; }
+            Mod+Ctrl+Shift+WheelScrollUp   { move-column-left; }
+            Mod+BracketLeft  { consume-or-expel-window-left; }
+            Mod+BracketRight { consume-or-expel-window-right; }
+            Mod+Comma  { consume-window-into-column; }
+            Mod+Period { expel-window-from-column; }
+            Mod+R { switch-preset-column-width; }
+            Mod+F { maximize-column; }
+            Mod+Ctrl+F { fullscreen-window; }
+            Mod+C { center-visible-columns; }
+            Mod+Ctrl+C { center-column; }
+            Mod+Space       { toggle-window-floating; }
+            Mod+Ctrl+Space  { switch-focus-between-floating-and-tiling; }
+            Mod+T { toggle-column-tabbed-display; }
+            Print { screenshot-screen; }
+            Mod+Print { screenshot; }
+            Ctrl+Print { screenshot-window; }
+            Mod+Backspace allow-inhibiting=false { toggle-keyboard-shortcuts-inhibit; }
+            Mod+Alt+E { spawn "noctalia-shell" "ipc" "call" "sessionMenu" "toggle"; }
+            Ctrl+Alt+Delete { spawn "noctalia-shell" "ipc" "call" "sessionMenu" "toggle"; }
+            Mod+Ctrl+P { power-off-monitors; }
+          }
+        '';
+      };
+  };
+}
diff --git a/aspects/desktop/office.nix b/aspects/desktop/office.nix
new file mode 100644
index 0000000..68d958a
--- /dev/null
+++ b/aspects/desktop/office.nix
@@ -0,0 +1,23 @@
+{ ... }:
+
+{
+  flake.modules.nixos.office =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        aspell
+        aspellDicts.de
+        aspellDicts.en
+        aspellDicts.en-computers
+        aspellDicts.pt_BR
+        glow
+        papers
+        presenterm
+        rnote
+      ];
+
+      services.flatpak.packages = [
+        "com.collabora.Office"
+      ];
+    };
+}
diff --git a/aspects/desktop/web.nix b/aspects/desktop/web.nix
new file mode 100644
index 0000000..9d6494f
--- /dev/null
+++ b/aspects/desktop/web.nix
@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  flake.modules.nixos.web =
+    {
+      inputs,
+      pkgs,
+      ...
+    }:
+    {
+      environment.systemPackages = with pkgs; [
+        inputs.zen-browser.packages."${pkgs.stdenv.hostPlatform.system}".default
+        beeper
+        bitwarden-desktop
+        fragments
+        nextcloud-client
+        tor-browser
+        ungoogled-chromium
+        vesktop
+      ];
+    };
+}
diff --git a/aspects/dev.nix b/aspects/dev.nix
new file mode 100644
index 0000000..afe9edc
--- /dev/null
+++ b/aspects/dev.nix
@@ -0,0 +1,23 @@
+{ ... }:
+{
+  flake.modules.nixos.dev =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      environment.systemPackages = with pkgs; [
+        android-tools
+        lazygit
+        fd
+        fzf
+        nixfmt
+        nix-init
+        ripgrep
+      ];
+
+      users.users.user.extraGroups = [ "adbusers" ];
+    };
+}
diff --git a/aspects/ephemeral.nix b/aspects/ephemeral.nix
new file mode 100644
index 0000000..90c03c6
--- /dev/null
+++ b/aspects/ephemeral.nix
@@ -0,0 +1,139 @@
+# Ephemeral root aspect - provides automatic btrfs root subvolume rollover
+# Exports both a base module with options and a factory function for easy configuration
+{ inputs, ... }:
+{
+  # Base module with options (for external flakes or direct use)
+  flake.modules.nixos.ephemeral =
+    { lib, config, ... }:
+    let
+      cfg = config.ephemeral;
+    in
+    {
+      options.ephemeral = {
+        enable = lib.mkEnableOption "ephemeral root with automatic rollback";
+
+        rootDevice = lib.mkOption {
+          type = lib.types.str;
+          example = "/dev/mapper/cryptroot";
+          description = "Device path for the root btrfs filesystem";
+        };
+
+        rootSubvolume = lib.mkOption {
+          type = lib.types.str;
+          default = "@root";
+          description = "Name of the root btrfs subvolume";
+        };
+
+        oldRootRetentionDays = lib.mkOption {
+          type = lib.types.int;
+          default = 30;
+          description = "Number of days to keep old root snapshots before deletion";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.initrd.systemd.services.recreate-root = {
+          description = "Rolling over and creating new filesystem root";
+          requires = [ "initrd-root-device.target" ];
+          after = [
+            "local-fs-pre.target"
+            "initrd-root-device.target"
+          ];
+          requiredBy = [ "initrd-root-fs.target" ];
+          before = [ "sysroot.mount" ];
+          unitConfig = {
+            AssertPathExists = "/etc/initrd-release";
+            DefaultDependencies = false;
+          };
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          script = ''
+            set -euo pipefail
+
+            mkdir /btrfs_tmp
+            if ! mount ${cfg.rootDevice} /btrfs_tmp; then
+              echo "ERROR: Failed to mount ${cfg.rootDevice}"
+              exit 1
+            fi
+
+            if [[ -e /btrfs_tmp/${cfg.rootSubvolume} ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/${cfg.rootSubvolume})" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/${cfg.rootSubvolume} "/btrfs_tmp/old_roots/$timestamp"
+            fi
+
+            delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                 delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+            }
+
+            for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +${toString cfg.oldRootRetentionDays}); do
+              delete_subvolume_recursively "$i"
+            done
+
+            if ! btrfs subvolume create /btrfs_tmp/${cfg.rootSubvolume}; then
+              echo "ERROR: Failed to create subvolume ${cfg.rootSubvolume}"
+              umount /btrfs_tmp
+              exit 1
+            fi
+
+            umount /btrfs_tmp
+          '';
+        };
+      };
+    };
+
+  # Factory function that generates configured modules
+  flake.factory.ephemeral =
+    {
+      rootDevice,
+      rootSubvolume ? "@root",
+      retentionDays ? 30,
+      persistentStoragePath ? "/persistent",
+      persistentFiles ? [
+        "/etc/machine-id"
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/ssh/ssh_host_ed25519_key.pub"
+        "/etc/ssh/ssh_host_rsa_key"
+        "/etc/ssh/ssh_host_rsa_key.pub"
+      ],
+      persistentDirectories ? [
+        "/etc/NetworkManager/system-connections"
+        "/etc/nixos"
+        "/var/lib/bluetooth"
+        "/var/lib/flatpak"
+        "/var/lib/lxd"
+        "/var/lib/nixos"
+        "/var/lib/systemd/coredump"
+        "/var/lib/systemd/timers"
+        "/var/lib/tailscale"
+        "/var/log"
+      ],
+    }:
+    { ... }:
+    {
+      imports = [
+        inputs.impermanence.nixosModules.impermanence
+        inputs.self.modules.nixos.ephemeral
+      ];
+
+      ephemeral = {
+        enable = true;
+        inherit rootDevice rootSubvolume;
+        oldRootRetentionDays = retentionDays;
+      };
+
+      fileSystems."/persistent".neededForBoot = true;
+
+      environment.persistence.main = {
+        inherit persistentStoragePath;
+        files = persistentFiles;
+        directories = persistentDirectories;
+      };
+    };
+}
diff --git a/aspects/fwupd.nix b/aspects/fwupd.nix
new file mode 100644
index 0000000..217f1eb
--- /dev/null
+++ b/aspects/fwupd.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  flake.modules.nixos.fwupd =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.fwupd.enable = true;
+    };
+}
diff --git a/aspects/gaming/mangohud.nix b/aspects/gaming/mangohud.nix
new file mode 100644
index 0000000..14a3df6
--- /dev/null
+++ b/aspects/gaming/mangohud.nix
@@ -0,0 +1,47 @@
+{ ... }:
+
+{
+  flake.modules = {
+    nixos.mangohud =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          mangohud
+        ];
+      };
+
+    homeManager.mangohud =
+      { config, ... }:
+      {
+        programs.mangohud = {
+          enable = true;
+          enableSessionWide = true;
+          settings = {
+            position = "top-left";
+            fps = true;
+            frametime = false;
+            frame_timing = false;
+            gpu_stats = true;
+            gpu_temp = true;
+            gpu_power = true;
+            cpu_stats = true;
+            cpu_temp = true;
+            cpu_power = true;
+            ram = true;
+            vram = true;
+            gamemode = false;
+            vkbasalt = false;
+            version = false;
+            engine_version = false;
+            vulkan_driver = false;
+            wine = false;
+            time = false;
+            fps_sampling_period = 500;
+            toggle_hud = "Shift_L+F12";
+            toggle_logging = "Ctrl_L+F2";
+            output_folder = "${config.home.homeDirectory}/.local/share/mangohud";
+          };
+        };
+      };
+  };
+}
diff --git a/aspects/gaming/steam.nix b/aspects/gaming/steam.nix
new file mode 100644
index 0000000..a10d0e4
--- /dev/null
+++ b/aspects/gaming/steam.nix
@@ -0,0 +1,24 @@
+{ ... }:
+
+{
+  flake.modules.nixos.steam =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        steam-run
+      ];
+
+      programs = {
+        steam = {
+          enable = true;
+          extraCompatPackages = [ pkgs.proton-ge-bin ];
+        };
+        gamemode.enable = true;
+      };
+
+      services.flatpak.packages = [
+        "com.steamgriddb.SGDBoop"
+        "io.github.Foldex.AdwSteamGtk"
+      ];
+    };
+}
diff --git a/hosts/alexandria/hardware-configuration.nix b/aspects/hosts/_alexandria/hardware-configuration.nix
similarity index 100%
rename from hosts/alexandria/hardware-configuration.nix
rename to aspects/hosts/_alexandria/hardware-configuration.nix
diff --git a/hosts/alexandria/jellyfin.nix b/aspects/hosts/_alexandria/jellyfin.nix
similarity index 67%
rename from hosts/alexandria/jellyfin.nix
rename to aspects/hosts/_alexandria/jellyfin.nix
index 9555c89..0b024bd 100644
--- a/hosts/alexandria/jellyfin.nix
+++ b/aspects/hosts/_alexandria/jellyfin.nix
@@ -1,7 +1,6 @@
 { lib, inputs, ... }:
 let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
 in
 {
   services.jellyfin = {
@@ -10,7 +9,6 @@ in
   };
 
   services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
     domains."jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:8096/";
   };
 }
diff --git a/hosts/alexandria/nextcloud.nix b/aspects/hosts/_alexandria/nextcloud.nix
similarity index 86%
rename from hosts/alexandria/nextcloud.nix
rename to aspects/hosts/_alexandria/nextcloud.nix
index 68d4875..cb9f2ac 100644
--- a/hosts/alexandria/nextcloud.nix
+++ b/aspects/hosts/_alexandria/nextcloud.nix
@@ -1,14 +1,12 @@
 {
-  lib,
   config,
-  pkgs,
   inputs,
+  pkgs,
   ...
 }:
 
 let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
 in
 
 {
@@ -24,7 +22,13 @@ in
       database.createLocally = true;
       maxUploadSize = "16G";
       extraApps = {
-        inherit (config.services.nextcloud.package.packages.apps) calendar contacts notes;
+        inherit (config.services.nextcloud.package.packages.apps)
+          calendar
+          contacts
+          notes
+          tasks
+          user_oidc
+          ;
       };
       extraAppsEnable = true;
       caching = {
@@ -35,6 +39,7 @@ in
         trusted_proxies = [ "127.0.0.1" ];
         default_phone_region = "BR";
         maintenance_window_start = "4";
+        allow_local_remote_servers = true;
         enabledPreviewProviders = [
           "OC\\Preview\\BMP"
           "OC\\Preview\\EMF"
@@ -71,19 +76,18 @@ in
     };
 
     nginx.virtualHosts = mkNginxVHosts {
-      acmeHost = "baduhai.dev";
       domains."cloud.baduhai.dev" = { };
     };
   };
 
   age.secrets = {
     "nextcloud-secrets.json" = {
-      file = ../../secrets/nextcloud-secrets.json.age;
+      file = "${inputs.self}/secrets/nextcloud-secrets.json.age";
       owner = "nextcloud";
       group = "nextcloud";
     };
     nextcloud-adminpass = {
-      file = ../../secrets/nextcloud-adminpass.age;
+      file = "${inputs.self}/secrets/nextcloud-adminpass.age";
       owner = "nextcloud";
       group = "nextcloud";
     };
diff --git a/aspects/hosts/_alexandria/nginx.nix b/aspects/hosts/_alexandria/nginx.nix
new file mode 100644
index 0000000..087faf4
--- /dev/null
+++ b/aspects/hosts/_alexandria/nginx.nix
@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+
+let
+  services = inputs.self.services;
+
+  # Get all unique domains from shared services that have LAN IPs (served by this host)
+  localDomains = lib.unique (map (s: s.domain) (lib.filter (s: s.host == "alexandria") services));
+
+  # Generate ACME cert configs for all local domains
+  acmeCerts = lib.genAttrs localDomains (domain: {
+    group = "nginx";
+  });
+in
+
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "baduhai@proton.me";
+      dnsResolver = "1.1.1.1:53";
+      dnsProvider = "cloudflare";
+      credentialsFile = config.age.secrets.cloudflare.path;
+    };
+    certs = acmeCerts;
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts = {
+      "_" = {
+        default = true;
+        locations."/".return = "444";
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  age.secrets.cloudflare = {
+    file = "${inputs.self}/secrets/cloudflare.age";
+    owner = "nginx";
+    group = "nginx";
+  };
+}
diff --git a/aspects/hosts/_alexandria/unbound.nix b/aspects/hosts/_alexandria/unbound.nix
new file mode 100644
index 0000000..8aedc37
--- /dev/null
+++ b/aspects/hosts/_alexandria/unbound.nix
@@ -0,0 +1,57 @@
+{ inputs, lib, ... }:
+
+let
+  services = inputs.self.services;
+in
+
+{
+  services.unbound = {
+    enable = true;
+    enableRootTrustAnchor = true;
+    settings = {
+      server = {
+        interface = [
+          "0.0.0.0"
+          "::"
+        ];
+        access-control = [
+          "127.0.0.0/8 allow"
+          "192.168.0.0/16 allow"
+          "::1/128 allow"
+        ];
+
+        num-threads = 2;
+        msg-cache-size = "50m";
+        rrset-cache-size = "100m";
+        cache-min-ttl = 300;
+        cache-max-ttl = 86400;
+        prefetch = true;
+        prefetch-key = true;
+        hide-identity = true;
+        hide-version = true;
+        so-rcvbuf = "1m";
+        so-sndbuf = "1m";
+
+        # LAN-only DNS records
+        local-zone = ''"baduhai.dev." transparent'';
+        local-data = map (e: ''"${e.domain}. IN A ${e.lanIP}"'') (lib.filter (e: e.lanIP != null) services);
+      };
+
+      forward-zone = [
+        {
+          name = ".";
+          forward-addr = [
+            "1.1.1.1@853#cloudflare-dns.com"
+            "1.0.0.1@853#cloudflare-dns.com"
+          ];
+          forward-tls-upstream = true;
+        }
+      ];
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+}
diff --git a/hosts/alexandria/vaultwarden.nix b/aspects/hosts/_alexandria/vaultwarden.nix
similarity index 80%
rename from hosts/alexandria/vaultwarden.nix
rename to aspects/hosts/_alexandria/vaultwarden.nix
index fd10d6b..8577b2d 100644
--- a/hosts/alexandria/vaultwarden.nix
+++ b/aspects/hosts/_alexandria/vaultwarden.nix
@@ -5,8 +5,7 @@
   ...
 }:
 let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
 in
 {
   services.vaultwarden = {
@@ -20,7 +19,6 @@ in
   };
 
   services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
     domains."pass.baduhai.dev".locations."/".proxyPass =
       "http://${config.services.vaultwarden.config.ROCKET_ADDRESS}:${toString config.services.vaultwarden.config.ROCKET_PORT}/";
   };
diff --git a/hosts/io/boot.nix b/aspects/hosts/_io/boot.nix
similarity index 100%
rename from hosts/io/boot.nix
rename to aspects/hosts/_io/boot.nix
diff --git a/disko/io.nix b/aspects/hosts/_io/disko.nix
similarity index 96%
rename from disko/io.nix
rename to aspects/hosts/_io/disko.nix
index 37f3160..4e6c9d5 100644
--- a/disko/io.nix
+++ b/aspects/hosts/_io/disko.nix
@@ -1,4 +1,8 @@
+{ inputs, ... }:
+
 {
+  imports = [ inputs.disko.nixosModules.default ];
+
   disko.devices.disk.main = {
     type = "disk";
     device = "/dev/disk/by-id/mmc-hDEaP3_0x1041b689";
diff --git a/hosts/io/hardware-configuration.nix b/aspects/hosts/_io/hardware-configuration.nix
similarity index 83%
rename from hosts/io/hardware-configuration.nix
rename to aspects/hosts/_io/hardware-configuration.nix
index cb114a1..8e4dae4 100644
--- a/hosts/io/hardware-configuration.nix
+++ b/aspects/hosts/_io/hardware-configuration.nix
@@ -2,15 +2,12 @@
   config,
   lib,
   modulesPath,
-  self,
+  inputs,
   ...
 }:
 
 {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    self.diskoConfigurations.io
-  ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
   boot = {
     initrd = {
diff --git a/hosts/io/programs.nix b/aspects/hosts/_io/programs.nix
similarity index 100%
rename from hosts/io/programs.nix
rename to aspects/hosts/_io/programs.nix
diff --git a/hosts/io/services.nix b/aspects/hosts/_io/services.nix
similarity index 97%
rename from hosts/io/services.nix
rename to aspects/hosts/_io/services.nix
index 90fb737..df41a6f 100644
--- a/hosts/io/services.nix
+++ b/aspects/hosts/_io/services.nix
@@ -49,6 +49,7 @@
       };
     };
     upower.enable = true;
+    power-profiles-daemon.enable = true;
   };
 
   # TODO: remove once gmodena/nix-flatpak/issues/45 fixed
diff --git a/hosts/rotterdam/boot.nix b/aspects/hosts/_rotterdam/boot.nix
similarity index 100%
rename from hosts/rotterdam/boot.nix
rename to aspects/hosts/_rotterdam/boot.nix
diff --git a/hosts/rotterdam/hardware-configuration.nix b/aspects/hosts/_rotterdam/hardware-configuration.nix
similarity index 100%
rename from hosts/rotterdam/hardware-configuration.nix
rename to aspects/hosts/_rotterdam/hardware-configuration.nix
diff --git a/hosts/rotterdam/hardware.nix b/aspects/hosts/_rotterdam/hardware.nix
similarity index 100%
rename from hosts/rotterdam/hardware.nix
rename to aspects/hosts/_rotterdam/hardware.nix
diff --git a/hosts/rotterdam/programs.nix b/aspects/hosts/_rotterdam/programs.nix
similarity index 100%
rename from hosts/rotterdam/programs.nix
rename to aspects/hosts/_rotterdam/programs.nix
diff --git a/hosts/rotterdam/services.nix b/aspects/hosts/_rotterdam/services.nix
similarity index 100%
rename from hosts/rotterdam/services.nix
rename to aspects/hosts/_rotterdam/services.nix
diff --git a/aspects/hosts/_trantor/boot.nix b/aspects/hosts/_trantor/boot.nix
new file mode 100644
index 0000000..0498818
--- /dev/null
+++ b/aspects/hosts/_trantor/boot.nix
@@ -0,0 +1,6 @@
+{
+  boot = {
+    initrd.systemd.enable = true;
+    loader.efi.efiSysMountPoint = "/boot/efi";
+  };
+}
diff --git a/disko/trantor.nix b/aspects/hosts/_trantor/disko.nix
similarity index 88%
rename from disko/trantor.nix
rename to aspects/hosts/_trantor/disko.nix
index db1397e..0e47058 100644
--- a/disko/trantor.nix
+++ b/aspects/hosts/_trantor/disko.nix
@@ -1,7 +1,11 @@
+{ inputs, ... }:
+
 {
+  imports = [ inputs.disko.nixosModules.default ];
+
   disko.devices.disk.main = {
     type = "disk";
-    device = "/dev/disk/by-id/scsi-36067d367fe184830a89bbe708c7b1066";
+    device = "/dev/disk/by-id/scsi-360b207ed25d84372a95d1ecf842f8e20";
     content = {
       type = "gpt";
       partitions = {
@@ -27,8 +31,7 @@
           name = "root";
           size = "100%";
           content = {
-            type = "filesystem";
-            format = "btrfs";
+            type = "btrfs";
             extraArgs = [ "-f" ];
             subvolumes = {
               "@root" = {
diff --git a/aspects/hosts/_trantor/fail2ban.nix b/aspects/hosts/_trantor/fail2ban.nix
new file mode 100644
index 0000000..bc05139
--- /dev/null
+++ b/aspects/hosts/_trantor/fail2ban.nix
@@ -0,0 +1,23 @@
+{ config, pkgs, ... }:
+
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "127.0.0.0/8"
+      "::1"
+      "10.0.0.0/8"
+      "172.16.0.0/12"
+      "192.168.0.0/16"
+      "100.64.0.0/10"
+    ];
+    bantime = "1h";
+    bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "10000h";
+      overalljails = true;
+    };
+  };
+}
diff --git a/aspects/hosts/_trantor/forgejo.nix b/aspects/hosts/_trantor/forgejo.nix
new file mode 100644
index 0000000..6d702e2
--- /dev/null
+++ b/aspects/hosts/_trantor/forgejo.nix
@@ -0,0 +1,76 @@
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+
+let
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
+in
+
+{
+  services = {
+    forgejo = {
+      enable = true;
+      settings = {
+        session.COOKIE_SECURE = true;
+        server = {
+          PROTOCOL = "http+unix";
+          DOMAIN = "git.baduhai.dev";
+          ROOT_URL = "https://git.baduhai.dev";
+          OFFLINE_MODE = true; # disable use of CDNs
+          SSH_DOMAIN = "git.baduhai.dev";
+          SSH_USER = "forgejo";
+          SSH_PORT = lib.head config.services.openssh.ports;
+        };
+        log.LEVEL = "Warn";
+        mailer.ENABLED = false;
+        actions.ENABLED = false;
+        service.DISABLE_REGISTRATION = true;
+        oauth2_client = {
+          ENABLE_AUTO_REGISTRATION = true;
+          UPDATE_AVATAR = true;
+          ACCOUNT_LINKING = "login";
+          USERNAME = "preferred_username";
+        };
+      };
+    };
+    nginx.virtualHosts = mkNginxVHosts {
+      domains."git.baduhai.dev".locations."/".proxyPass =
+        "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
+    };
+    fail2ban.jails.forgejo = {
+      settings = {
+        enabled = true;
+        filter = "forgejo";
+        maxretry = 3;
+        findtime = "10m";
+        bantime = "1h";
+      };
+    };
+  };
+
+  environment = {
+    etc."fail2ban/filter.d/forgejo.conf".text = ''
+      [Definition]
+      failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+      ignoreregex =
+      journalmatch = _SYSTEMD_UNIT=forgejo.service
+    '';
+
+    persistence.main.directories = [
+      {
+        directory = config.services.forgejo.stateDir;
+        inherit (config.services.forgejo) user group;
+        mode = "0700";
+      }
+    ];
+  };
+
+  # Disable PrivateMounts to allow LoadCredential to work with bind-mounted directories
+  systemd.services.forgejo.serviceConfig = {
+    PrivateMounts = lib.mkForce false;
+    ProtectSystem = lib.mkForce false;
+  };
+}
diff --git a/aspects/hosts/_trantor/hardware-configuration.nix b/aspects/hosts/_trantor/hardware-configuration.nix
new file mode 100644
index 0000000..039129e
--- /dev/null
+++ b/aspects/hosts/_trantor/hardware-configuration.nix
@@ -0,0 +1,20 @@
+{
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "usbhid"
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}
diff --git a/hosts/trantor/networking.nix b/aspects/hosts/_trantor/networking.nix
similarity index 100%
rename from hosts/trantor/networking.nix
rename to aspects/hosts/_trantor/networking.nix
diff --git a/hosts/alexandria/nginx.nix b/aspects/hosts/_trantor/nginx.nix
similarity index 57%
rename from hosts/alexandria/nginx.nix
rename to aspects/hosts/_trantor/nginx.nix
index 0a0a261..24f96c3 100644
--- a/hosts/alexandria/nginx.nix
+++ b/aspects/hosts/_trantor/nginx.nix
@@ -6,8 +6,13 @@
 }:
 
 let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
+  services = inputs.self.services;
+
+  localDomains = lib.unique (map (s: s.domain) (lib.filter (s: s.host == "trantor") services));
+
+  acmeCerts = lib.genAttrs localDomains (domain: {
+    group = "nginx";
+  });
 in
 
 {
@@ -19,9 +24,7 @@ in
       dnsProvider = "cloudflare";
       credentialsFile = config.age.secrets.cloudflare.path;
     };
-    certs."baduhai.dev" = {
-      extraDomainNames = [ "*.baduhai.dev" ];
-    };
+    certs = acmeCerts;
   };
 
   services.nginx = {
@@ -30,16 +33,23 @@ in
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    virtualHosts = mkNginxVHosts {
-      acmeHost = "baduhai.dev";
-      domains."_".locations."/".return = "444";
+    virtualHosts = {
+      "_" = {
+        default = true;
+        locations."/".return = "444";
+      };
     };
   };
 
   users.users.nginx.extraGroups = [ "acme" ];
 
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
   age.secrets.cloudflare = {
-    file = ../../secrets/cloudflare.age;
+    file = "${inputs.self}/secrets/cloudflare.age";
     owner = "nginx";
     group = "nginx";
   };
diff --git a/aspects/hosts/_trantor/openssh.nix b/aspects/hosts/_trantor/openssh.nix
new file mode 100644
index 0000000..704b3df
--- /dev/null
+++ b/aspects/hosts/_trantor/openssh.nix
@@ -0,0 +1,23 @@
+{ ... }:
+
+{
+  services = {
+    openssh = {
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+    fail2ban.jails.sshd = {
+      settings = {
+        enabled = true;
+        port = "ssh";
+        filter = "sshd";
+        logpath = "/var/log/auth.log";
+        maxretry = 3;
+        findtime = "10m";
+        bantime = "1h";
+      };
+    };
+  };
+}
diff --git a/aspects/hosts/_trantor/unbound.nix b/aspects/hosts/_trantor/unbound.nix
new file mode 100644
index 0000000..9f84228
--- /dev/null
+++ b/aspects/hosts/_trantor/unbound.nix
@@ -0,0 +1,58 @@
+{ inputs, lib, ... }:
+
+let
+  services = inputs.self.services;
+in
+
+{
+  services.unbound = {
+    enable = true;
+    enableRootTrustAnchor = true;
+    settings = {
+      server = {
+        interface = [
+          "0.0.0.0"
+          "::"
+        ];
+        access-control = [
+          "127.0.0.0/8 allow"
+          "100.64.0.0/10 allow" # Tailscale CGNAT range
+          "::1/128 allow"
+          "fd7a:115c:a1e0::/48 allow" # Tailscale IPv6
+        ];
+
+        num-threads = 2;
+        msg-cache-size = "50m";
+        rrset-cache-size = "100m";
+        cache-min-ttl = 300;
+        cache-max-ttl = 86400;
+        prefetch = true;
+        prefetch-key = true;
+        hide-identity = true;
+        hide-version = true;
+        so-rcvbuf = "1m";
+        so-sndbuf = "1m";
+
+        # Tailnet DNS records from shared services
+        local-zone = ''"baduhai.dev." transparent'';
+        local-data = map (e: ''"${e.domain}. IN A ${e.tailscaleIP}"'') services;
+      };
+
+      forward-zone = [
+        {
+          name = ".";
+          forward-addr = [
+            "1.1.1.1@853#cloudflare-dns.com"
+            "1.0.0.1@853#cloudflare-dns.com"
+          ];
+          forward-tls-upstream = true;
+        }
+      ];
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+}
diff --git a/aspects/hosts/alexandria.nix b/aspects/hosts/alexandria.nix
new file mode 100644
index 0000000..be5027e
--- /dev/null
+++ b/aspects/hosts/alexandria.nix
@@ -0,0 +1,19 @@
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
+{
+  flake.nixosConfigurations.alexandria = mkHost {
+    hostname = "alexandria";
+    nixpkgs = inputs.nixpkgs-stable;
+    extraModules = with inputs.self.modules.nixos; [
+      # base aspects
+      server
+      # other aspects
+      fwupd
+      libvirtd
+    ];
+  };
+}
diff --git a/aspects/hosts/io.nix b/aspects/hosts/io.nix
new file mode 100644
index 0000000..cf5ecec
--- /dev/null
+++ b/aspects/hosts/io.nix
@@ -0,0 +1,24 @@
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
+{
+  flake.nixosConfigurations.io = mkHost {
+    hostname = "io";
+    ephemeralRootDev = "/dev/mapper/cryptroot";
+    extraModules = with inputs.self.modules.nixos; [
+      # base aspects
+      desktop
+      # other aspects
+      ai
+      bluetooth
+      dev
+      libvirtd
+      networkmanager
+      niri
+      podman
+    ];
+  };
+}
diff --git a/aspects/hosts/rotterdam.nix b/aspects/hosts/rotterdam.nix
new file mode 100644
index 0000000..f3b6fca
--- /dev/null
+++ b/aspects/hosts/rotterdam.nix
@@ -0,0 +1,26 @@
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
+{
+  flake.nixosConfigurations.rotterdam = mkHost {
+    hostname = "rotterdam";
+    ephemeralRootDev = "/dev/mapper/cryptroot";
+    extraModules = with inputs.self.modules.nixos; [
+      # base aspects
+      desktop
+      gaming
+      # other aspects
+      ai
+      bluetooth
+      dev
+      fwupd
+      libvirtd
+      networkmanager
+      niri
+      podman
+    ];
+  };
+}
diff --git a/aspects/hosts/trantor.nix b/aspects/hosts/trantor.nix
new file mode 100644
index 0000000..14f9dd7
--- /dev/null
+++ b/aspects/hosts/trantor.nix
@@ -0,0 +1,18 @@
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
+{
+  flake.nixosConfigurations.trantor = mkHost {
+    hostname = "trantor";
+    system = "aarch64-linux";
+    nixpkgs = inputs.nixpkgs-stable;
+    ephemeralRootDev = "/dev/disk/by-id/scsi-360b207ed25d84372a95d1ecf842f8e20-part2";
+    extraModules = with inputs.self.modules.nixos; [
+      # base aspects
+      server
+    ];
+  };
+}
diff --git a/aspects/libvirtd.nix b/aspects/libvirtd.nix
new file mode 100644
index 0000000..360743d
--- /dev/null
+++ b/aspects/libvirtd.nix
@@ -0,0 +1,27 @@
+{ ... }:
+{
+  flake.modules.nixos.libvirtd =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation = {
+        libvirtd.enable = true;
+        spiceUSBRedirection.enable = true;
+      };
+
+      programs.virt-manager.enable = true;
+
+      environment.systemPackages = with pkgs; [ lima ];
+
+      networking.firewall.trustedInterfaces = [ "virbr0" ];
+
+      users.users.user.extraGroups = [
+        "libvirt"
+        "libvirtd"
+      ];
+    };
+}
diff --git a/aspects/lxc.nix b/aspects/lxc.nix
new file mode 100644
index 0000000..4225e0c
--- /dev/null
+++ b/aspects/lxc.nix
@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  flake.modules.nixos.lxc =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation = {
+        lxc = {
+          enable = true;
+          unprivilegedContainers = true;
+        };
+        incus.enable = true;
+      };
+
+      users.users.user.extraGroups = [ "incus-admin" ];
+    };
+}
diff --git a/aspects/networkmanager.nix b/aspects/networkmanager.nix
new file mode 100644
index 0000000..8bcb1f2
--- /dev/null
+++ b/aspects/networkmanager.nix
@@ -0,0 +1,18 @@
+{ ... }:
+{
+  flake.modules.nixos.networkmanager =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      networking.networkmanager = {
+        enable = true;
+        wifi.backend = "iwd";
+      };
+
+      users.users.user.extraGroups = [ "networkmanager" ];
+    };
+}
diff --git a/aspects/podman.nix b/aspects/podman.nix
new file mode 100644
index 0000000..6afa327
--- /dev/null
+++ b/aspects/podman.nix
@@ -0,0 +1,24 @@
+{ ... }:
+{
+  flake.modules.nixos.podman =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation.podman = {
+        enable = true;
+        autoPrune.enable = true;
+        extraPackages = [ pkgs.podman-compose ];
+      };
+
+      security.unprivilegedUsernsClone = true; # Needed for rootless podman
+
+      systemd = {
+        services.podman-auto-update.enable = true;
+        timers.podman-auto-update.enable = true;
+      };
+    };
+}
diff --git a/aspects/stylix.nix b/aspects/stylix.nix
new file mode 100644
index 0000000..f7eb9fa
--- /dev/null
+++ b/aspects/stylix.nix
@@ -0,0 +1,69 @@
+{ ... }:
+
+{
+  flake.modules = {
+    nixos.stylix =
+      { inputs, ... }:
+      {
+        imports = [ inputs.stylix.nixosModules.stylix ];
+      };
+
+    homeManager.stylix =
+      {
+        config,
+        inputs,
+        pkgs,
+        ...
+      }:
+      {
+        imports = [ inputs.stylix.homeModules.stylix ];
+
+        stylix = {
+          enable = true;
+          polarity = "dark";
+          base16Scheme = "${pkgs.base16-schemes}/share/themes/tokyodark.yaml";
+          cursor = {
+            package = pkgs.kdePackages.breeze;
+            name = "breeze_cursors";
+            size = 24;
+          };
+          icons = {
+            enable = true;
+            package = pkgs.morewaita-icon-theme;
+            light = "MoreWaita";
+            dark = "MoreWaita";
+          };
+          opacity = {
+            applications = 1.0;
+            desktop = 1.0;
+            popups = config.stylix.opacity.desktop;
+            terminal = 1.0;
+          };
+          fonts = {
+            serif = {
+              package = pkgs.source-serif;
+              name = "Source Serif 4 Display";
+            };
+            sansSerif = {
+              package = pkgs.inter;
+              name = "Inter";
+            };
+            monospace = {
+              package = pkgs.nerd-fonts.fira-code;
+              name = "FiraCode Nerd Font";
+            };
+            emoji = {
+              package = pkgs.noto-fonts-color-emoji;
+              name = "Noto Color Emoji";
+            };
+            sizes = {
+              applications = 10;
+              desktop = config.stylix.fonts.sizes.applications;
+              popups = config.stylix.fonts.sizes.applications;
+              terminal = 12;
+            };
+          };
+        };
+      };
+  };
+}
diff --git a/aspects/systems/base.nix b/aspects/systems/base.nix
new file mode 100644
index 0000000..fdfc525
--- /dev/null
+++ b/aspects/systems/base.nix
@@ -0,0 +1,55 @@
+{ inputs, ... }:
+{
+  flake.modules = {
+    nixos.base =
+      { lib, pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          boot
+          console
+          firewall
+          fish
+          locale
+          nix
+          security
+          ssh
+        ];
+        environment = {
+          systemPackages = with pkgs; [
+            git
+            fastfetch
+            nixos-firewall-tool
+            sysz
+            wget
+            yazi
+          ];
+          shellAliases = {
+            cat = "${lib.getExe pkgs.bat} --paging=never --style=plain";
+            ls = "${lib.getExe pkgs.eza} --git --icons --group-directories-first";
+            tree = "ls --tree";
+          };
+        };
+
+        programs.command-not-found.enable = false;
+
+        services = {
+          dbus.implementation = "broker";
+          irqbalance.enable = true;
+          fstrim.enable = true;
+          tailscale = {
+            enable = true;
+            extraUpFlags = [ "--operator=user" ];
+          };
+        };
+      };
+
+    homeManager.base =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          bash
+          fish
+        ];
+      };
+  };
+}
diff --git a/aspects/systems/cli.nix b/aspects/systems/cli.nix
new file mode 100644
index 0000000..2b95f0e
--- /dev/null
+++ b/aspects/systems/cli.nix
@@ -0,0 +1,33 @@
+{ inputs, ... }:
+
+{
+  flake.modules = {
+    nixos.cli =
+      { pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          btop
+          helix
+          tmux
+        ];
+
+        environment.systemPackages = with pkgs; [
+          p7zip
+          rclone
+        ];
+      };
+    homeManager.cli =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          btop
+          comma
+          direnv
+          helix
+          hm-cli
+          starship
+          tmux
+        ];
+      };
+  };
+}
diff --git a/aspects/systems/desktop.nix b/aspects/systems/desktop.nix
new file mode 100644
index 0000000..fb3aa1b
--- /dev/null
+++ b/aspects/systems/desktop.nix
@@ -0,0 +1,210 @@
+{
+  inputs,
+  ...
+}:
+{
+  flake.modules = {
+    nixos.desktop =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        imports = [
+          inputs.nix-flatpak.nixosModules.nix-flatpak
+        ]
+        ++ (with inputs.self.modules.nixos; [
+          graphics
+          media
+          office
+          web
+        ]);
+
+        boot = {
+          plymouth.enable = true;
+          initrd.systemd.enable = true;
+          loader.efi.efiSysMountPoint = "/boot/efi";
+          kernelPackages = pkgs.linuxPackages_xanmod_latest;
+          extraModprobeConfig = ''
+            options bluetooth disable_ertm=1
+          '';
+          kernel.sysctl = {
+            "net.ipv4.tcp_mtu_probing" = 1;
+          };
+          kernelParams = [
+            "quiet"
+            "splash"
+            "i2c-dev"
+            "i2c-piix4"
+            "loglevel=3"
+            "udev.log_priority=3"
+            "rd.udev.log_level=3"
+            "rd.systemd.show_status=false"
+          ];
+        };
+
+        nix = {
+          registry.nixpkgs.flake = inputs.nixpkgs;
+          nixPath = [
+            "nixpkgs=${inputs.nixpkgs}"
+            "/nix/var/nix/profiles/per-user/root/channels"
+          ];
+        };
+
+        environment = {
+          etc."channels/nixpkgs".source = inputs.nixpkgs.outPath;
+          sessionVariables = {
+            KDEHOME = "$XDG_CONFIG_HOME/kde4"; # Stops kde from placing a .kde4 folder in the home dir
+            NIXOS_OZONE_WL = "1"; # Forces chromium and most electron apps to run in wayland
+          };
+          systemPackages = with pkgs; [
+            adwaita-icon-theme
+            ghostty
+            gnome-disk-utility
+            junction
+            libfido2
+            mission-center
+            nautilus
+            toggleaudiosink
+            unrar
+          ];
+        };
+
+        services = {
+          printing.enable = true;
+          udev.packages = with pkgs; [ yubikey-personalization ];
+          keyd = {
+            enable = true;
+            keyboards.all = {
+              ids = [ "*" ];
+              settings.main.capslock = "overload(meta, esc)";
+            };
+          };
+          pipewire = {
+            enable = true;
+            alsa.enable = true;
+            alsa.support32Bit = true;
+            pulse.enable = true;
+            jack.enable = true;
+            wireplumber.enable = true;
+          };
+          greetd = {
+            enable = true;
+            settings.default_session.user = "greeter";
+          };
+          flatpak = {
+            enable = true;
+            packages = [
+              "com.github.tchx84.Flatseal"
+              "com.rustdesk.RustDesk"
+            ];
+            uninstallUnmanaged = true;
+            update.auto.enable = true;
+          };
+          gvfs.enable = true;
+        };
+
+        security.rtkit.enable = true; # Needed for pipewire to acquire realtime priority
+
+        users = {
+          users.greeter = {
+            isSystemUser = true;
+            group = "greeter";
+          };
+          groups.greeter = { };
+        };
+
+        programs = {
+          kdeconnect = {
+            enable = true;
+            package = pkgs.valent;
+          };
+          dconf.enable = true;
+          appimage = {
+            enable = true;
+            binfmt = true;
+          };
+        };
+
+        fonts = {
+          fontDir.enable = true;
+          packages = with pkgs; [
+            corefonts
+            inter
+            nerd-fonts.fira-code
+            noto-fonts-cjk-sans
+            noto-fonts-color-emoji
+            roboto
+          ];
+        };
+
+        xdg.portal = {
+          extraPortals = with pkgs; [
+            xdg-desktop-portal-gnome
+            xdg-desktop-portal-gtk
+          ];
+          config.common.default = "*";
+        };
+      };
+
+    homeManager.desktop =
+      {
+        config,
+        lib,
+        pkgs,
+        inputs,
+        ...
+      }:
+      {
+        imports = [
+          inputs.vicinae.homeManagerModules.default
+        ]
+        ++ (with inputs.self.modules.homeManager; [ media ]);
+
+        fonts.fontconfig.enable = true;
+
+        home = {
+          packages = with pkgs; [ xwayland-satellite ];
+          sessionVariables.TERMINAL = "ghostty";
+        };
+
+        services.vicinae = {
+          enable = true;
+          systemd = {
+            enable = true;
+            autoStart = true;
+          };
+        };
+
+        programs = {
+          ghostty = {
+            enable = true;
+            settings = {
+              cursor-style = "block";
+              shell-integration-features = "no-cursor";
+              cursor-style-blink = false;
+              custom-shader = "${builtins.fetchurl {
+                url = "https://raw.githubusercontent.com/hackr-sh/ghostty-shaders/cb6eb4b0d1a3101c869c62e458b25a826f9dcde3/cursor_blaze.glsl";
+                sha256 = "sha256:0g2lgqjdrn3c51glry7x2z30y7ml0y61arl5ykmf4yj0p85s5f41";
+              }}";
+              bell-features = "";
+              gtk-titlebar-style = "tabs";
+              keybind = [ "shift+enter=text:\\x1b\\r" ];
+            };
+          };
+
+          password-store = {
+            enable = true;
+            package = pkgs.pass-wayland;
+          };
+        };
+
+        xdg = {
+          enable = true;
+          userDirs.enable = true;
+        };
+      };
+  };
+}
diff --git a/aspects/systems/gaming.nix b/aspects/systems/gaming.nix
new file mode 100644
index 0000000..e73a6fe
--- /dev/null
+++ b/aspects/systems/gaming.nix
@@ -0,0 +1,48 @@
+{ inputs, ... }:
+
+{
+  flake.modules = {
+    nixos.gaming =
+      { pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          mangohud
+          steam
+        ];
+        hardware = {
+          xpadneo.enable = true;
+          steam-hardware.enable = true; # Allow steam client to manage controllers
+          graphics.enable32Bit = true; # For OpenGL games
+        };
+
+        services.flatpak.packages = [
+          "com.github.k4zmu2a.spacecadetpinball"
+          "io.itch.itch"
+          "io.mrarm.mcpelauncher"
+          "net.retrodeck.retrodeck"
+          "org.freedesktop.Platform.VulkanLayer.MangoHud/x86_64/25.08"
+          rec {
+            appId = "com.hypixel.HytaleLauncher";
+            sha256 = "01307s44bklc1ldcigcn9n4lm8hf8q793v9fv7w4w04xd5zyh4rv";
+            bundle = "${pkgs.fetchurl {
+              url = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-latest.flatpak";
+              inherit sha256;
+            }}";
+          }
+        ];
+
+        environment.systemPackages = with pkgs; [
+          clonehero
+          heroic
+          prismlauncher
+        ];
+      };
+    homeManager.gaming =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          mangohud
+        ];
+      };
+  };
+}
diff --git a/aspects/systems/server.nix b/aspects/systems/server.nix
new file mode 100644
index 0000000..c3c24f0
--- /dev/null
+++ b/aspects/systems/server.nix
@@ -0,0 +1,36 @@
+{ inputs, ... }:
+
+{
+  flake.modules.nixos.server =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      boot = {
+        kernelPackages = pkgs.linuxPackages_hardened;
+        kernel.sysctl = {
+          "net.ipv4.ip_forward" = 1;
+          "net.ipv6.conf.all.forwarding" = 1;
+        };
+      };
+
+      environment.etc."channels/nixpkgs".source = inputs.nixpkgs-stable.outPath;
+
+      nix = {
+        registry.nixpkgs.flake = inputs.nixpkgs-stable;
+        nixPath = [
+          "nixpkgs=/etc/channels/nixpkgs"
+          "/nix/var/nix/profiles/per-user/root/channels"
+        ];
+      };
+
+      services.tailscale = {
+        extraSetFlags = [ "--advertise-exit-node" ];
+        useRoutingFeatures = "server";
+      };
+
+    };
+}
diff --git a/users/user/git.nix b/aspects/users/_user/git.nix
similarity index 94%
rename from users/user/git.nix
rename to aspects/users/_user/git.nix
index 9c1fb20..40a5714 100644
--- a/users/user/git.nix
+++ b/aspects/users/_user/git.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   programs = {
diff --git a/aspects/users/root.nix b/aspects/users/root.nix
new file mode 100644
index 0000000..ff04c56
--- /dev/null
+++ b/aspects/users/root.nix
@@ -0,0 +1,12 @@
+{ ... }:
+
+{
+  flake.modules.nixos.root =
+    { pkgs, ... }:
+    {
+      users.users.root = {
+        shell = pkgs.fish;
+        hashedPassword = "!";
+      };
+    };
+}
diff --git a/aspects/users/user.nix b/aspects/users/user.nix
new file mode 100644
index 0000000..86bcddb
--- /dev/null
+++ b/aspects/users/user.nix
@@ -0,0 +1,55 @@
+{ inputs, ... }:
+
+let
+  mkHomeConfiguration = inputs.self.lib.mkHomeConfiguration;
+in
+
+{
+  flake = {
+    modules.nixos.user =
+      { pkgs, ... }:
+      {
+        users.users.user = {
+          isNormalUser = true;
+          shell = pkgs.fish;
+          extraGroups = [
+            "networkmanager"
+            "wheel"
+          ];
+          openssh.authorizedKeys.keys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
+          ];
+          hashedPassword = "$6$Pj7v/CpstyuWQQV0$cNujVDhfMBdwlGVEnnd8t71.kZPixbo0u25cd.874iaqLTH4V5fa1f98V5zGapjQCz5JyZmsR94xi00sUrntT0";
+        };
+      };
+    homeConfigurations = {
+      "user@rotterdam" = mkHomeConfiguration {
+        user = "user";
+        hostname = "rotterdam";
+        userModules = with inputs.self.modules.homeManager; [
+          # system aspects
+          desktop
+          gaming
+
+          # other aspects
+          stylix
+          niri
+        ];
+      };
+      "user@io" = mkHomeConfiguration {
+        user = "user";
+        hostname = "io";
+        userModules = with inputs.self.modules.homeManager; [
+          # system aspects
+          desktop
+
+          # other aspects
+          stylix
+          niri
+        ];
+      };
+    };
+  };
+}
diff --git a/data/services.nix b/data/services.nix
new file mode 100644
index 0000000..ae7395c
--- /dev/null
+++ b/data/services.nix
@@ -0,0 +1,42 @@
+# Shared service and host definitions
+# This file can be imported directly (unlike aspects which use flake-parts)
+{
+  hosts = {
+    alexandria = {
+      lanIP = "192.168.15.142";
+      tailscaleIP = "100.76.19.50";
+    };
+    trantor = {
+      tailscaleIP = "100.108.5.90";
+    };
+  };
+
+  services = [
+    {
+      name = "kanidm";
+      domain = "auth.baduhai.dev";
+      host = "alexandria";
+    }
+    {
+      name = "vaultwarden";
+      domain = "pass.baduhai.dev";
+      host = "alexandria";
+    }
+    {
+      name = "forgejo";
+      domain = "git.baduhai.dev";
+      host = "trantor";
+      public = true;
+    }
+    {
+      name = "nextcloud";
+      domain = "cloud.baduhai.dev";
+      host = "alexandria";
+    }
+    {
+      name = "jellyfin";
+      domain = "jellyfin.baduhai.dev";
+      host = "alexandria";
+    }
+  ];
+}
diff --git a/deploy.nix b/deploy.nix
deleted file mode 100644
index 187c92f..0000000
--- a/deploy.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ inputs, self, ... }:
-{
-  flake.deploy = {
-    remoteBuild = true;
-    nodes = {
-      alexandria = {
-        hostname = "alexandria";
-        profiles.system = {
-          sshUser = "user";
-          path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.alexandria;
-          user = "root";
-        };
-      };
-
-      trantor = {
-        hostname = "trantor";
-        profiles.system = {
-          sshUser = "user";
-          path = inputs.deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.trantor;
-          user = "root";
-        };
-      };
-
-      io = {
-        hostname = "io";
-        profiles = {
-          system = {
-            sshUser = "user";
-            path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.io;
-            user = "root";
-            remoteBuild = false;
-          };
-          user = {
-            sshUser = "user";
-            path = inputs.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurations."user@io";
-            user = "user";
-            remoteBuild = false;
-          };
-        };
-      };
-    };
-  };
-  perSystem =
-    { system, ... }:
-    {
-      checks = inputs.deploy-rs.lib.${system}.deployChecks self.deploy;
-    };
-}
diff --git a/diskoConfigurations.nix b/diskoConfigurations.nix
deleted file mode 100644
index 511eddc..0000000
--- a/diskoConfigurations.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ inputs, ... }:
-
-{
-  imports = [
-    inputs.disko.flakeModule
-  ];
-
-  flake.diskoConfigurations = {
-    io.modules = [ ./disko/io.nix ];
-    trantor.modules = [ ./disko/trantor.nix ];
-  };
-}
diff --git a/flake.lock b/flake.lock
index 5993cdf..a99cac7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1760836749,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -44,28 +44,28 @@
     "base16-fish": {
       "flake": false,
       "locked": {
-        "lastModified": 1754405784,
-        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       },
       "original": {
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       }
     },
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1752979451,
-        "narHash": "sha256-0CQM+FkYy0fOO/sMGhOoNL80ftsAzYCg9VhIrodqusM=",
+        "lastModified": 1760703920,
+        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "27cf1e66e50abc622fb76a3019012dc07c678fac",
+        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
         "type": "github"
       },
       "original": {
@@ -91,6 +91,28 @@
         "type": "github"
       }
     },
+    "blueprint": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-ai-tools",
+          "nixpkgs"
+        ],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1771437256,
+        "narHash": "sha256-bLqwib+rtyBRRVBWhMuBXPCL/OThfokA+j6+uH7jDGU=",
+        "owner": "numtide",
+        "repo": "blueprint",
+        "rev": "06ee7190dc2620ea98af9eb225aa9627b68b0e33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "blueprint",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -113,36 +135,16 @@
         "type": "github"
       }
     },
-    "deploy-rs": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs",
-        "utils": "utils"
-      },
-      "locked": {
-        "lastModified": 1756719547,
-        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "type": "github"
-      }
-    },
     "disko": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1761899396,
-        "narHash": "sha256-XOpKBp6HLzzMCbzW50TEuXN35zN5WGQREC7n34DcNMM=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "6f4cf5abbe318e4cd1e879506f6eeafd83f7b998",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
         "type": "github"
       },
       "original": {
@@ -154,11 +156,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1758112371,
-        "narHash": "sha256-lizRM2pj6PHrR25yimjyFn04OS4wcdbc38DCdBVa2rk=",
+        "lastModified": 1764873433,
+        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "0909cfe4a2af8d358ad13b20246a350e14c2473d",
+        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
         "type": "github"
       },
       "original": {
@@ -170,11 +172,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
@@ -204,11 +206,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
         "type": "github"
       },
       "original": {
@@ -219,17 +221,14 @@
     },
     "flake-parts_2": {
       "inputs": {
-        "nixpkgs-lib": [
-          "stylix",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -239,6 +238,27 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "terranix",
@@ -259,24 +279,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "fromYaml": {
       "flake": false,
       "locked": {
@@ -296,18 +298,20 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1748186689,
-        "narHash": "sha256-UaD7Y9f8iuLBMGHXeJlRu6U1Ggw5B9JnkFs3enZlap0=",
+        "host": "gitlab.gnome.org",
+        "lastModified": 1767737596,
+        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "8c88f917db0f1f0d80fa55206c863d3746fa18d0",
-        "type": "github"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "gitlab"
       },
       "original": {
+        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "48.2",
+        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "github"
+        "type": "gitlab"
       }
     },
     "home-manager": {
@@ -338,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760929667,
-        "narHash": "sha256-nZh6uvc71nVNaf/y+wesnjwsmJ6IZZUnP2EzpZe48To=",
+        "lastModified": 1770915843,
+        "narHash": "sha256-ZwU5wXKNqpOQvjNz6aBp1j5peiBZow1++6pLnk5VAhs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "189c21cf879669008ccf06e78a553f17e88d8ef0",
+        "rev": "6a1f7101d2c3ee87d485a87880d73b4665c6a4bd",
         "type": "github"
       },
       "original": {
@@ -353,6 +357,27 @@
       }
     },
     "home-manager_3": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_4": {
       "inputs": {
         "nixpkgs": [
           "zen-browser",
@@ -360,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752603129,
-        "narHash": "sha256-S+wmHhwNQ5Ru689L2Gu8n1OD6s9eU9n9mD827JNR+kw=",
+        "lastModified": 1769872935,
+        "narHash": "sha256-07HMIGQ/WJeAQJooA7Kkg1SDKxhAiV6eodvOwTX6WKI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e8c19a3cec2814c754f031ab3ae7316b64da085b",
+        "rev": "f4ad5068ee8e89e4a7c2e963e10dd35cd77b37b7",
         "type": "github"
       },
       "original": {
@@ -374,12 +399,16 @@
       }
     },
     "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_3",
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
         "type": "github"
       },
       "original": {
@@ -388,89 +417,48 @@
         "type": "github"
       }
     },
-    "niri": {
+    "import-tree": {
+      "locked": {
+        "lastModified": 1763762820,
+        "narHash": "sha256-ZvYKbFib3AEwiNMLsejb/CWs/OL/srFQ8AogkebEPF0=",
+        "owner": "vic",
+        "repo": "import-tree",
+        "rev": "3c23749d8013ec6daa1d7255057590e9ca726646",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vic",
+        "repo": "import-tree",
+        "type": "github"
+      }
+    },
+    "nix-ai-tools": {
       "inputs": {
+        "blueprint": "blueprint",
         "nixpkgs": "nixpkgs_3",
-        "rust-overlay": "rust-overlay"
+        "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1760963745,
-        "narHash": "sha256-FVf9YFw2wQnMAxvMxEk+vFakXhPQUSapDpGmlLzAxjg=",
-        "owner": "baduhai",
-        "repo": "niri",
-        "rev": "dd3e3d1009991ecd87ab7253c9e7696acf2bc943",
+        "lastModified": 1771816560,
+        "narHash": "sha256-q5Wsb1573qDfIPJctG9CBZP0NMniejoB7SmBLZIVAHg=",
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "rev": "db94a329058a1a37b49d3209af85708b3338559a",
         "type": "github"
       },
       "original": {
-        "owner": "baduhai",
-        "ref": "auto-center-when-space-available",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-flake": {
-      "inputs": {
-        "niri-stable": "niri-stable",
-        "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_4",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "xwayland-satellite-stable": "xwayland-satellite-stable",
-        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
-      },
-      "locked": {
-        "lastModified": 1760950171,
-        "narHash": "sha256-E2ySTu/oK7cYBdAI3tlGP9zVjF4mZgWJ1OZInBCMb00=",
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "rev": "f851a923137c0a54719412146fd63d24b3214e60",
-        "type": "github"
-      },
-      "original": {
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "type": "github"
-      }
-    },
-    "niri-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1756556321,
-        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "ref": "v25.08",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1760940149,
-        "narHash": "sha256-KbM47vD6E0cx+v4jYQZ8mD5N186AKm2CQlyh34TW58U=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "b3245b81a6ed8edfaf5388a74d2e0a23c24941e5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "repo": "niri",
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
         "type": "github"
       }
     },
     "nix-flatpak": {
       "locked": {
-        "lastModified": 1754777568,
-        "narHash": "sha256-0bBqT+3XncgF8F03RFAamw9vdf0VmaDoIJLTGkjfQZs=",
+        "lastModified": 1768656715,
+        "narHash": "sha256-Sbh037scxKFm7xL0ahgSCw+X2/5ZKeOwI2clqrYr9j4=",
         "owner": "gmodena",
         "repo": "nix-flatpak",
-        "rev": "62f636b87ef6050760a8cb325cadb90674d1e23e",
+        "rev": "123fe29340a5b8671367055b75a6e7c320d6f89a",
         "type": "github"
       },
       "original": {
@@ -487,11 +475,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760846226,
-        "narHash": "sha256-xmU8kAsRprJiTGBTaGrwmjBP3AMA9ltlrxHKFuy5JWc=",
+        "lastModified": 1770315571,
+        "narHash": "sha256-hy0gcAgAcxrnSWKGuNO+Ob0x6jQ2xkR6hoaR0qJBHYs=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "5024e1901239a76b7bf94a4cd27f3507e639d49e",
+        "rev": "2684bb8080a6f2ca5f9d494de5ef875bc1c4ecdb",
         "type": "github"
       },
       "original": {
@@ -500,39 +488,19 @@
         "type": "github"
       }
     },
-    "nix-options-doc": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_5",
-        "rust-overlay": "rust-overlay_2"
-      },
-      "locked": {
-        "lastModified": 1742115705,
-        "narHash": "sha256-RfXwJPWBoWswIU68+y/XZfTWtFHd/fK14bKvOlRmfPo=",
-        "owner": "Thunderbottom",
-        "repo": "nix-options-doc",
-        "rev": "2caa4b5756a8666d65d70122f413e295f56886e7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Thunderbottom",
-        "ref": "v0.2.0",
-        "repo": "nix-options-doc",
-        "type": "github"
-      }
-    },
     "nixos-cli": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nix-options-doc": "nix-options-doc",
-        "nixpkgs": "nixpkgs_6"
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_4",
+        "optnix": "optnix"
       },
       "locked": {
-        "lastModified": 1760856139,
-        "narHash": "sha256-N+F4n1WYE3AWc/kmdqIz67GNX7PgyKosnmGYYx8vR9k=",
+        "lastModified": 1770862985,
+        "narHash": "sha256-TFRhwVzPg3ly388J3CYYvjrma/dWjsBVpNE437bWeHk=",
         "owner": "nix-community",
         "repo": "nixos-cli",
-        "rev": "c8f5ce1fd9bf151df74328795b6b2720e2e22d75",
+        "rev": "9a2e97e8832b211df22c5cb21a55ebf1c3eb2be1",
         "type": "github"
       },
       "original": {
@@ -543,11 +511,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743014863,
-        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
+        "lastModified": 1769330179,
+        "narHash": "sha256-yxgb4AmkVHY5OOBrC79Vv6EVd4QZEotqv+6jcvA212M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
+        "rev": "48698d12cc10555a4f3e3222d9c669b884a49dfe",
         "type": "github"
       },
       "original": {
@@ -559,11 +527,26 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1754788789,
-        "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=",
+        "lastModified": 1769909678,
+        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "a73b9c743612e4244d865a2fdee11865283c04e6",
+        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -574,59 +557,43 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1760862643,
-        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1760862643,
-        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
+        "lastModified": 1770770419,
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1761880412,
-        "narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=",
-        "owner": "NixOS",
+        "lastModified": 1768564909,
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a7fc11be66bdfb5cdde611ee5ce381c183da8386",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "owner": "nixos",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1757967192,
-        "narHash": "sha256-/aA9A/OBmnuOMgwfzdsXRusqzUpd8rQnQY8jtrHK+To=",
+        "lastModified": 1771207753,
+        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0d7c15863b251a7a50265e57c1dca1a7add2e291",
+        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
         "type": "github"
       },
       "original": {
@@ -638,37 +605,21 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1760878510,
-        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
+        "lastModified": 1767151656,
+        "narHash": "sha256-ujL2AoYBnJBN262HD95yer7QYUmYp5kFZGYbyCCKxq8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
+        "rev": "f665af0cdb70ed27e1bd8f9fdfecaf451260fc55",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1740695751,
-        "narHash": "sha256-D+R+kFxy1KsheiIzkkx/6L63wEHBYX21OIwlFV8JvDs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "6313551cd05425cd5b3e63fe47dbc324eabb15e4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
       "locked": {
         "lastModified": 1759070547,
         "narHash": "sha256-JVZl8NaVRYb0+381nl7LvPE+A774/dRpif01FKLrYFQ=",
@@ -684,13 +635,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1760878510,
-        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
+        "lastModified": 1770562336,
+        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
+        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
         "type": "github"
       },
       "original": {
@@ -700,13 +651,29 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_7": {
       "locked": {
-        "lastModified": 1758690382,
-        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "lastModified": 1767767207,
+        "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
+      "locked": {
+        "lastModified": 1762111121,
+        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
         "type": "github"
       },
       "original": {
@@ -718,11 +685,11 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1755615617,
-        "narHash": "sha256-HMwfAJBdrr8wXAkbGhtcby1zGFvs+StOp19xNsbqdOg=",
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "20075955deac2583bb12f07151c2df830ef346b4",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
         "type": "github"
       },
       "original": {
@@ -736,16 +703,14 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "quickshell": "quickshell",
-        "systems": "systems_4"
+        ]
       },
       "locked": {
-        "lastModified": 1761190730,
-        "narHash": "sha256-XAs/Q4zBJIfK/bwq9KjTUkTH15A+Pe2rIilyvalEHuM=",
+        "lastModified": 1770922006,
+        "narHash": "sha256-xg40mnp5KKBepACmvlPzmn5iPyUBxktfv50saSVUn0M=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "c3439b262c7cb3d57c93197a93a3aa382582bdae",
+        "rev": "d87364964948b9d691f8363f85a5e23bee154df9",
         "type": "github"
       },
       "original": {
@@ -766,11 +731,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758998580,
-        "narHash": "sha256-VLx0z396gDCGSiowLMFz5XRO/XuNV+4EnDYjdJhHvUk=",
+        "lastModified": 1767810917,
+        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "ba8d9c98f5f4630bcb0e815ab456afd90c930728",
+        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
         "type": "github"
       },
       "original": {
@@ -779,91 +744,46 @@
         "type": "github"
       }
     },
-    "quickshell": {
+    "optnix": {
       "inputs": {
-        "nixpkgs": [
-          "noctalia",
-          "nixpkgs"
-        ]
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1753595452,
-        "narHash": "sha256-vqkSDvh7hWhPvNjMjEDV4KbSCv2jyl2Arh73ZXe274k=",
-        "ref": "refs/heads/master",
-        "rev": "a5431dd02dc23d9ef1680e67777fed00fe5f7cda",
-        "revCount": 665,
-        "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+        "lastModified": 1765418479,
+        "narHash": "sha256-33VCCXiEnEL9N2wVxo9FHLwL8KWH6qk+MNRcSThOPWs=",
+        "owner": "water-sucks",
+        "repo": "optnix",
+        "rev": "01facc3de860bf479723bf19535586564e59fe73",
+        "type": "github"
       },
       "original": {
-        "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+        "owner": "water-sucks",
+        "repo": "optnix",
+        "type": "github"
       }
     },
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "deploy-rs": "deploy-rs",
         "disko": "disko",
         "flake-parts": "flake-parts",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
-        "niri": "niri",
-        "niri-flake": "niri-flake",
+        "import-tree": "import-tree",
+        "nix-ai-tools": "nix-ai-tools",
         "nix-flatpak": "nix-flatpak",
         "nix-index-database": "nix-index-database",
         "nixos-cli": "nixos-cli",
-        "nixpkgs": "nixpkgs_7",
-        "nixpkgs-stable": "nixpkgs-stable_2",
+        "nixpkgs": "nixpkgs_6",
+        "nixpkgs-stable": "nixpkgs-stable",
         "noctalia": "noctalia",
         "stylix": "stylix",
         "terranix": "terranix",
+        "vicinae": "vicinae",
         "zen-browser": "zen-browser"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "niri",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1757989933,
-        "narHash": "sha256-9cpKYWWPCFhgwQTww8S94rTXgg8Q8ydFv9fXM6I8xQM=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "8249aa3442fb9b45e615a35f39eca2fe5510d7c3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos-cli",
-          "nix-options-doc",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1740796337,
-        "narHash": "sha256-FuoXrXZPoJEZQ3PF7t85tEpfBVID9JQIOnVKMNfTAb0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "bbac9527bc6b28b6330b13043d0e76eac11720dc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "stylix": {
       "inputs": {
         "base16": "base16",
@@ -871,11 +791,11 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_7",
         "nur": "nur",
-        "systems": "systems_5",
+        "systems": "systems_3",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -883,11 +803,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1760472212,
-        "narHash": "sha256-4C3I/ssFsq8EgaUmZP0xv5V7RV0oCHgL/Rx+MUkuE+E=",
+        "lastModified": 1770914701,
+        "narHash": "sha256-QHFYyngohNhih4w+3IqQty5DV+p1txsx1kkk6XJWar8=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "8d008296a1b3be9b57ad570f7acea00dd2fc92db",
+        "rev": "db03fed72e5ca02be34e1d24789345a943329738",
         "type": "github"
       },
       "original": {
@@ -971,35 +891,20 @@
         "type": "github"
       }
     },
-    "systems_6": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "terranix": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_6"
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1757278723,
-        "narHash": "sha256-hTMi6oGU+6VRnW9SZZ+muFcbfMEf2ajjOp7Z2KM5MMY=",
+        "lastModified": 1762472226,
+        "narHash": "sha256-iVS4sxVgGn+T74rGJjEJbzx+kjsuaP3wdQVXBNJ79A0=",
         "owner": "terranix",
         "repo": "terranix",
-        "rev": "924573fa6587ac57b0d15037fbd2d3f0fcdf17fb",
+        "rev": "3b5947a48da5694094b301a3b1ef7b22ec8b19fc",
         "type": "github"
       },
       "original": {
@@ -1044,11 +949,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1757716333,
-        "narHash": "sha256-d4km8W7w2zCUEmPAPUoLk1NlYrGODuVa3P7St+UrqkM=",
+        "lastModified": 1767710407,
+        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "317a5e10c35825a6c905d912e480dfe8e71c7559",
+        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
         "type": "github"
       },
       "original": {
@@ -1060,11 +965,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1757811970,
-        "narHash": "sha256-n5ZJgmzGZXOD9pZdAl1OnBu3PIqD+X3vEBUGbTi4JiI=",
+        "lastModified": 1767489635,
+        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "d217ba31c846006e9e0ae70775b0ee0f00aa6b1e",
+        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
         "type": "github"
       },
       "original": {
@@ -1076,11 +981,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1757811247,
-        "narHash": "sha256-4EFOUyLj85NRL3OacHoLGEo0wjiRJzfsXtR4CZWAn6w=",
+        "lastModified": 1767488740,
+        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "824fe0aacf82b3c26690d14e8d2cedd56e18404e",
+        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
         "type": "github"
       },
       "original": {
@@ -1089,68 +994,57 @@
         "type": "github"
       }
     },
-    "utils": {
+    "treefmt-nix": {
       "inputs": {
-        "systems": "systems_2"
+        "nixpkgs": [
+          "nix-ai-tools",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1770228511,
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
         "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "repo": "treefmt-nix",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
         "type": "github"
       },
       "original": {
         "owner": "numtide",
-        "repo": "flake-utils",
+        "repo": "treefmt-nix",
         "type": "github"
       }
     },
-    "xwayland-satellite-stable": {
-      "flake": false,
+    "vicinae": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_8",
+        "systems": "systems_5"
+      },
       "locked": {
-        "lastModified": 1755491097,
-        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
+        "lastModified": 1770912475,
+        "narHash": "sha256-21lurBRyHgJbVD3E0/i7Fhxi4rBUxyznGfKpdGVtEdc=",
+        "owner": "vicinaehq",
+        "repo": "vicinae",
+        "rev": "0c70267ab7e07d7972012fcf8ae58808a32a2e86",
         "type": "github"
       },
       "original": {
-        "owner": "Supreeeme",
-        "ref": "v0.7",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
-    "xwayland-satellite-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1759707084,
-        "narHash": "sha256-0pkftKs6/LReNvxw7DVTN2AJEheZVgyeK0Aarbagi70=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "a9188e70bd748118b4d56a529871b9de5adb9988",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
+        "owner": "vicinaehq",
+        "repo": "vicinae",
         "type": "github"
       }
     },
     "zen-browser": {
       "inputs": {
-        "home-manager": "home-manager_3",
+        "home-manager": "home-manager_4",
         "nixpkgs": "nixpkgs_9"
       },
       "locked": {
-        "lastModified": 1760934351,
-        "narHash": "sha256-RehxVjBRC9EiBO36EPZROLHhVVSWFe3KEROhaEapboM=",
+        "lastModified": 1771000521,
+        "narHash": "sha256-5UDaXr770MaDac9HcFvGlUjsqyOoNbFdHArmjmtHcVk=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "596c3ac14be576b93f5db9252a1b0581e453ec9f",
+        "rev": "80ce62fd26af1934454f405bcb2510ceeea8d3a2",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index c9d5076..2036828 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,49 +2,43 @@
   description = "My nix hosts";
 
   inputs = {
+    # nix tools
     flake-parts.url = "github:hercules-ci/flake-parts";
+    import-tree.url = "github:vic/import-tree";
 
+    # nixos/hm
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
-
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
     home-manager = {
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # nixos/hm functionality modules
     agenix = {
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs-stable";
     };
-
     disko.url = "github:nix-community/disko";
-
-    noctalia = {
-      url = "github:noctalia-dev/noctalia-shell";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
+    impermanence.url = "github:nix-community/impermanence";
+    nixos-cli.url = "github:nix-community/nixos-cli";
+    nix-flatpak.url = "github:gmodena/nix-flatpak/main";
     stylix.url = "github:danth/stylix";
 
-    nixos-cli.url = "github:nix-community/nixos-cli";
-
-    nix-flatpak.url = "github:gmodena/nix-flatpak/main";
-
-    zen-browser.url = "github:0xc000022070/zen-browser-flake";
-
-    impermanence.url = "github:nix-community/impermanence";
-
-    deploy-rs.url = "github:serokell/deploy-rs";
-
-    niri-flake.url = "github:sodiboo/niri-flake";
-
-    niri.url = "github:baduhai/niri/auto-center-when-space-available";
-
+    # nixos/hm program modules
+    nix-ai-tools.url = "github:numtide/llm-agents.nix";
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    noctalia = {
+      url = "github:noctalia-dev/noctalia-shell";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    vicinae.url = "github:vicinaehq/vicinae";
+    zen-browser.url = "github:0xc000022070/zen-browser-flake";
 
+    # stand-alone tools
     terranix = {
       url = "github:terranix/terranix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -52,7 +46,13 @@
   };
 
   outputs =
-    inputs@{ flake-parts, ... }:
+    inputs@{ flake-parts, import-tree, ... }:
+    let
+      aspectsModules = import-tree ./aspects;
+      packagesModules = import-tree ./packages;
+      shellsModules = import-tree ./shells;
+      terranixModules = import-tree ./terranix;
+    in
     flake-parts.lib.mkFlake { inherit inputs; } {
       systems = [
         "x86_64-linux"
@@ -60,15 +60,12 @@
       ];
 
       imports = [
-        ./deploy.nix
-        ./devShells.nix
-        ./diskoConfigurations.nix
-        ./homeConfigurations.nix
-        ./nixosConfigurations.nix
-        ./nixosModules.nix
-        ./overlays.nix
-        ./packages.nix
-        ./terranixConfigurations.nix
-      ];
+        flake-parts.flakeModules.modules
+        inputs.terranix.flakeModule
+      ]
+      ++ aspectsModules.imports
+      ++ packagesModules.imports
+      ++ shellsModules.imports
+      ++ terranixModules.imports;
     };
 }
diff --git a/homeConfigurations.nix b/homeConfigurations.nix
deleted file mode 100644
index 296abfa..0000000
--- a/homeConfigurations.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ inputs, ... }:
-
-let
-  lib = inputs.nixpkgs.lib;
-  utils = import ./utils.nix { inherit inputs lib; };
-  inherit (utils) mkHome;
-in
-
-{
-  flake.homeConfigurations = {
-    "user@rotterdam" = mkHome {
-      username = "user";
-      hostname = "rotterdam";
-      tags = [
-        "desktop"
-        "btop"
-        "comma"
-        "direnv"
-        "gaming"
-        "helix"
-        "obs-studio"
-        "starship"
-        "stylix"
-        "tmux"
-      ];
-    };
-
-    "user@io" = mkHome {
-      username = "user";
-      hostname = "io";
-      tags = [
-        "desktop"
-        "btop"
-        "comma"
-        "direnv"
-        "helix"
-        "starship"
-        "stylix"
-        "tmux"
-      ];
-    };
-  };
-}
diff --git a/hosts/alexandria/firewall.nix b/hosts/alexandria/firewall.nix
deleted file mode 100644
index f6fded2..0000000
--- a/hosts/alexandria/firewall.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  networking.firewall = {
-    allowedTCPPorts = [
-      80
-      443
-    ];
-    allowedUDPPorts = [ ];
-  };
-}
diff --git a/hosts/alexandria/forgejo.nix b/hosts/alexandria/forgejo.nix
deleted file mode 100644
index 909d1d1..0000000
--- a/hosts/alexandria/forgejo.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
-in
-{
-  services.forgejo = {
-    enable = true;
-    repositoryRoot = "/data/forgejo";
-    settings = {
-      session.COOKIE_SECURE = true;
-      server = {
-        PROTOCOL = "http+unix";
-        DOMAIN = "git.baduhai.dev";
-        ROOT_URL = "https://git.baduhai.dev";
-        OFFLINE_MODE = true; # disable use of CDNs
-        SSH_DOMAIN = "baduhai.dev";
-      };
-      log.LEVEL = "Warn";
-      mailer.ENABLED = false;
-      actions.ENABLED = false;
-    };
-  };
-
-  services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
-    domains."git.baduhai.dev".locations."/".proxyPass =
-      "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
-  };
-}
diff --git a/hosts/alexandria/librespeed.nix b/hosts/alexandria/librespeed.nix
deleted file mode 100644
index e36a81d..0000000
--- a/hosts/alexandria/librespeed.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-
-let
-  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVHosts;
-in
-
-{
-  virtualisation.oci-containers.containers."librespeed" = {
-    image = "lscr.io/linuxserver/librespeed:latest";
-    environment = {
-      TZ = "America/Bahia";
-    };
-    ports = [ "127.0.0.1:58080:80" ];
-    extraOptions = [
-      "--pull=newer"
-      "--label=io.containers.autoupdate=registry"
-    ];
-  };
-
-  services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
-    domains."speedtest.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:58080/";
-  };
-}
diff --git a/hosts/modules/bluetooth.nix b/hosts/modules/bluetooth.nix
deleted file mode 100644
index fb6a06a..0000000
--- a/hosts/modules/bluetooth.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  hardware.bluetooth.enable = true;
-}
diff --git a/hosts/modules/common/boot.nix b/hosts/modules/common/boot.nix
deleted file mode 100644
index fbba278..0000000
--- a/hosts/modules/common/boot.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-
-{
-  boot = {
-    loader = {
-      timeout = 1;
-      efi.canTouchEfiVariables = true;
-      systemd-boot = {
-        enable = true;
-        editor = false;
-        consoleMode = "max";
-        sortKey = "aa";
-        netbootxyz = {
-          enable = true;
-          sortKey = "zz";
-        };
-      };
-    };
-  };
-}
diff --git a/hosts/modules/common/console.nix b/hosts/modules/common/console.nix
deleted file mode 100644
index 9cb99d4..0000000
--- a/hosts/modules/common/console.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  console = {
-    useXkbConfig = true;
-    earlySetup = true;
-  };
-}
diff --git a/hosts/modules/common/firewall.nix b/hosts/modules/common/firewall.nix
deleted file mode 100644
index 910e803..0000000
--- a/hosts/modules/common/firewall.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  networking = {
-    firewall.enable = true;
-    nftables.enable = true;
-  };
-}
diff --git a/hosts/modules/common/locale.nix b/hosts/modules/common/locale.nix
deleted file mode 100644
index 1171a32..0000000
--- a/hosts/modules/common/locale.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  time.timeZone = "America/Bahia";
-
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    extraLocaleSettings = {
-      LC_ADDRESS = "pt_BR.utf8";
-      LC_COLLATE = "pt_BR.utf8";
-      LC_IDENTIFICATION = "pt_BR.utf8";
-      LC_MEASUREMENT = "pt_BR.utf8";
-      LC_MONETARY = "pt_BR.utf8";
-      LC_NAME = "pt_BR.utf8";
-      LC_NUMERIC = "pt_BR.utf8";
-      LC_PAPER = "pt_BR.utf8";
-      LC_TELEPHONE = "pt_BR.utf8";
-      LC_TIME = "en_IE.utf8";
-    };
-  };
-}
diff --git a/hosts/modules/common/nix.nix b/hosts/modules/common/nix.nix
deleted file mode 100644
index 5ef9c4c..0000000
--- a/hosts/modules/common/nix.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ inputs, ... }:
-
-{
-  imports = [ inputs.nixos-cli.nixosModules.nixos-cli ];
-
-  nix = {
-    settings = {
-      auto-optimise-store = true;
-      connect-timeout = 10;
-      log-lines = 25;
-      min-free = 128000000;
-      max-free = 1000000000;
-      trusted-users = [ "@wheel" ];
-    };
-    extraOptions = "experimental-features = nix-command flakes";
-    gc = {
-      automatic = true;
-      options = "--delete-older-than 8d";
-    };
-  };
-
-  nixpkgs.config = {
-    allowUnfree = true;
-    enableParallelBuilding = true;
-    buildManPages = false;
-    buildDocs = false;
-  };
-
-  services.nixos-cli = {
-    enable = true;
-    config = {
-      use_nvd = true;
-      ignore_dirty_tree = true;
-    };
-  };
-
-  system.stateVersion = "22.11";
-}
diff --git a/hosts/modules/common/openssh.nix b/hosts/modules/common/openssh.nix
deleted file mode 100644
index 63422b3..0000000
--- a/hosts/modules/common/openssh.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ ... }:
-
-{
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "no";
-  };
-  programs.fish.interactiveShellInit = ''
-    if set -q SSH_CONNECTION
-      neofetch
-    end
-  '';
-}
diff --git a/hosts/modules/common/programs.nix b/hosts/modules/common/programs.nix
deleted file mode 100644
index be57b69..0000000
--- a/hosts/modules/common/programs.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, pkgs, ... }:
-
-{
-  environment = {
-    systemPackages = with pkgs; [
-      ### Dev Tools ###
-      git
-      ### System Utilities ###
-      btop
-      fastfetch
-      helix
-      nixos-firewall-tool
-      nvd
-      sysz
-      tmux
-      wget
-      yazi
-    ];
-    shellAliases = {
-      cat = "${lib.getExe pkgs.bat} --paging=never --style=plain";
-      ls = "${lib.getExe pkgs.eza} --icons --group-directories-first";
-      tree = "ls --tree";
-    };
-  };
-
-  programs = {
-    command-not-found.enable = false;
-    fish.enable = true;
-  };
-}
diff --git a/hosts/modules/common/security.nix b/hosts/modules/common/security.nix
deleted file mode 100644
index 33d4953..0000000
--- a/hosts/modules/common/security.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ ... }:
-
-{
-  security = {
-    unprivilegedUsernsClone = true; # Needed for rootless podman
-    sudo = {
-      wheelNeedsPassword = false;
-      extraConfig = ''
-        Defaults lecture = never
-      '';
-    };
-  };
-}
diff --git a/hosts/modules/common/services.nix b/hosts/modules/common/services.nix
deleted file mode 100644
index 89ac527..0000000
--- a/hosts/modules/common/services.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  services = {
-    dbus.implementation = "broker";
-    irqbalance.enable = true;
-    fstrim.enable = true;
-  };
-}
diff --git a/hosts/modules/common/tailscale.nix b/hosts/modules/common/tailscale.nix
deleted file mode 100644
index 98bea97..0000000
--- a/hosts/modules/common/tailscale.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  services.tailscale = {
-    enable = true;
-    extraUpFlags = [ "--operator=user" ];
-  };
-}
diff --git a/hosts/modules/common/users.nix b/hosts/modules/common/users.nix
deleted file mode 100644
index 0572153..0000000
--- a/hosts/modules/common/users.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  users.users = {
-    user = {
-      isNormalUser = true;
-      shell = pkgs.fish;
-      extraGroups = [
-        "networkmanager"
-        "wheel"
-      ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
-      ];
-      hashedPassword = "$6$Pj7v/CpstyuWQQV0$cNujVDhfMBdwlGVEnnd8t71.kZPixbo0u25cd.874iaqLTH4V5fa1f98V5zGapjQCz5JyZmsR94xi00sUrntT0";
-    };
-    root = {
-      shell = pkgs.fish;
-      hashedPassword = "!";
-    };
-  };
-}
diff --git a/hosts/modules/desktop/boot.nix b/hosts/modules/desktop/boot.nix
deleted file mode 100644
index 0ac4847..0000000
--- a/hosts/modules/desktop/boot.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-
-{
-  boot = {
-    plymouth.enable = true;
-    initrd.systemd.enable = true;
-    loader.efi.efiSysMountPoint = "/boot/efi";
-    kernelPackages = pkgs.linuxPackages_xanmod_latest;
-    extraModprobeConfig = ''
-      options bluetooth disable_ertm=1
-    '';
-    kernel.sysctl = {
-      "net.ipv4.tcp_mtu_probing" = 1;
-    };
-    kernelParams = [
-      "quiet"
-      "splash"
-      "i2c-dev"
-      "i2c-piix4"
-      "loglevel=3"
-      "udev.log_priority=3"
-      "rd.udev.log_level=3"
-      "rd.systemd.show_status=false"
-    ];
-  };
-}
diff --git a/hosts/modules/desktop/desktop.nix b/hosts/modules/desktop/desktop.nix
deleted file mode 100644
index 5258442..0000000
--- a/hosts/modules/desktop/desktop.nix
+++ /dev/null
@@ -1,163 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [
-    inputs.niri-flake.nixosModules.niri
-    inputs.nix-flatpak.nixosModules.nix-flatpak
-  ];
-
-  environment = {
-    sessionVariables = {
-      KDEHOME = "$XDG_CONFIG_HOME/kde4"; # Stops kde from placing a .kde4 folder in the home dir
-      NIXOS_OZONE_WL = "1"; # Forces chromium and most electron apps to run in wayland
-    };
-    systemPackages = with pkgs; [
-      ### Web ###
-      bitwarden-desktop
-      brave
-      fragments
-      nextcloud-client
-      tor-browser
-      vesktop
-      inputs.zen-browser.packages."${system}".default
-      ### Office & Productivity ###
-      aspell
-      aspellDicts.de
-      aspellDicts.en
-      aspellDicts.en-computers
-      aspellDicts.pt_BR
-      libreoffice
-      onlyoffice-desktopeditors
-      papers
-      rnote
-      ### Graphics & Design ###
-      gimp
-      inkscape
-      plasticity
-      ### System Utilities ###
-      adwaita-icon-theme
-      ghostty
-      gnome-disk-utility
-      junction
-      libfido2
-      mission-center
-      nautilus
-      p7zip
-      rclone
-      toggleaudiosink
-      unrar
-      ### Media ###
-      decibels
-      loupe
-      obs-studio
-      showtime
-    ];
-  };
-
-  services = {
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      jack.enable = true;
-      wireplumber.enable = true;
-    };
-    greetd = {
-      enable = true;
-      settings = {
-        default_session = {
-          command = "${lib.getExe pkgs.tuigreet} --user-menu --time --remember --asterisks --cmd ${config.programs.niri.package}/bin/niri-session";
-          user = "greeter";
-        };
-      }
-      // lib.optionalAttrs (config.networking.hostName == "io") {
-        initial_session = {
-          command = "${config.programs.niri.package}/bin/niri-session";
-          user = "user";
-        };
-      };
-    };
-    flatpak = {
-      enable = true;
-      packages = [
-        ### Graphics & Design ###
-        "com.boxy_svg.BoxySVG"
-        rec {
-          appId = "io.github.softfever.OrcaSlicer";
-          sha256 = "0hdx5sg6fknj1pfnfxvlfwb5h6y1vjr6fyajbsnjph5gkp97c6p1";
-          bundle = "${pkgs.fetchurl {
-            url = "https://github.com/SoftFever/OrcaSlicer/releases/download/v2.3.0/OrcaSlicer-Linux-flatpak_V2.3.0_x86_64.flatpak";
-            inherit sha256;
-          }}";
-        }
-        ### System Utilities ###
-        "com.github.tchx84.Flatseal"
-        "com.rustdesk.RustDesk"
-      ];
-      uninstallUnmanaged = true;
-      update.auto.enable = true;
-    };
-    gvfs.enable = true;
-  };
-
-  security.rtkit.enable = true; # Needed for pipewire to acquire realtime priority
-
-  users = {
-    users.greeter = {
-      isSystemUser = true;
-      group = "greeter";
-    };
-    groups.greeter = { };
-  };
-
-  programs = {
-    niri = {
-      enable = true;
-      package = inputs.niri.packages.${pkgs.system}.niri;
-    };
-    kdeconnect = {
-      enable = true;
-      package = pkgs.valent;
-    };
-    dconf.enable = true;
-    appimage = {
-      enable = true;
-      binfmt = true;
-    };
-  };
-
-  niri-flake.cache.enable = false;
-
-  fonts = {
-    fontDir.enable = true;
-    packages = with pkgs; [
-      corefonts
-      inter
-      nerd-fonts.fira-code
-      noto-fonts-cjk-sans
-      noto-fonts-color-emoji
-      roboto
-    ];
-  };
-
-  xdg.portal = {
-    extraPortals = with pkgs; [
-      xdg-desktop-portal-gnome
-      xdg-desktop-portal-gtk
-    ];
-    config = {
-      common.default = "*";
-      niri.default = [
-        "gtk"
-        "gnome"
-      ];
-    };
-  };
-}
diff --git a/hosts/modules/desktop/nix.nix b/hosts/modules/desktop/nix.nix
deleted file mode 100644
index 54a3549..0000000
--- a/hosts/modules/desktop/nix.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ inputs, ... }:
-
-{
-  environment.etc."channels/nixpkgs".source = inputs.nixpkgs.outPath;
-
-  nix = {
-    registry.nixpkgs.flake = inputs.nixpkgs;
-    nixPath = [
-      "nixpkgs=${inputs.nixpkgs}"
-      "/nix/var/nix/profiles/per-user/root/channels"
-    ];
-  };
-}
diff --git a/hosts/modules/desktop/services.nix b/hosts/modules/desktop/services.nix
deleted file mode 100644
index 66b78f1..0000000
--- a/hosts/modules/desktop/services.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services = {
-    printing.enable = true;
-    udev.packages = with pkgs; [ yubikey-personalization ];
-    keyd = {
-      enable = true;
-      keyboards.all = {
-        ids = [ "*" ];
-        settings.main.capslock = "overload(meta, esc)";
-      };
-    };
-  };
-}
diff --git a/hosts/modules/dev.nix b/hosts/modules/dev.nix
deleted file mode 100644
index 82908f2..0000000
--- a/hosts/modules/dev.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    bat
-    claude-code
-    lazygit
-    fd
-    fzf
-    glow
-    nixfmt-rfc-style
-    nix-init
-    nix-output-monitor
-    ripgrep
-  ];
-
-  programs.adb.enable = true;
-
-  users.users.user.extraGroups = [ "adbusers" ];
-}
diff --git a/hosts/modules/ephemeral.nix b/hosts/modules/ephemeral.nix
deleted file mode 100644
index 8ed08bc..0000000
--- a/hosts/modules/ephemeral.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ config, inputs, ... }:
-
-{
-  imports = [
-    inputs.impermanence.nixosModules.impermanence
-    inputs.self.nixosModules.ephemeral
-  ];
-
-  ephemeral = {
-    enable = true;
-    rootDevice =
-      if config.networking.hostName == "trantor" then
-        "/dev/disk/by-id/scsi-36067d367fe184830a89bbe708c7b1066"
-      else
-        "/dev/mapper/cryptroot";
-    rootSubvolume = "@root";
-  };
-
-  environment.persistence.main = {
-    persistentStoragePath = "/persistent";
-    files = [
-      "/etc/machine-id"
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-      "/etc/ssh/ssh_host_rsa_key"
-      "/etc/ssh/ssh_host_rsa_key.pub"
-    ];
-    directories = [
-      "/etc/NetworkManager/system-connections"
-      "/etc/nixos"
-      "/var/lib/bluetooth"
-      "/var/lib/flatpak"
-      "/var/lib/lxd"
-      "/var/lib/nixos"
-      "/var/lib/systemd/coredump"
-      "/var/lib/systemd/timers"
-      "/var/lib/tailscale"
-      "/var/log"
-    ];
-  };
-}
diff --git a/hosts/modules/fwupd.nix b/hosts/modules/fwupd.nix
deleted file mode 100644
index 52dc13e..0000000
--- a/hosts/modules/fwupd.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  services.fwupd.enable = true;
-}
diff --git a/hosts/modules/gaming.nix b/hosts/modules/gaming.nix
deleted file mode 100644
index cf6217f..0000000
--- a/hosts/modules/gaming.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    clonehero
-    heroic
-    mangohud
-    prismlauncher
-    protonup
-    steam-run
-  ];
-
-  programs = {
-    steam = {
-      enable = true;
-      extraCompatPackages = [ pkgs.proton-ge-bin ];
-    };
-    gamemode.enable = true;
-  };
-
-  hardware = {
-    xpadneo.enable = true;
-    steam-hardware.enable = true; # Allow steam client to manage controllers
-    graphics.enable32Bit = true; # For OpenGL games
-  };
-
-  services.flatpak.packages = [
-    "com.github.k4zmu2a.spacecadetpinball"
-    "com.steamgriddb.SGDBoop"
-    "io.github.Foldex.AdwSteamGtk"
-    "io.itch.itch"
-    "io.mrarm.mcpelauncher"
-    "net.retrodeck.retrodeck"
-    "org.freedesktop.Platform.VulkanLayer.MangoHud/x86_64/24.08"
-  ];
-}
diff --git a/hosts/modules/libvirtd.nix b/hosts/modules/libvirtd.nix
deleted file mode 100644
index 41cfa27..0000000
--- a/hosts/modules/libvirtd.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ ... }:
-
-{
-  virtualisation.libvirtd.enable = true;
-
-  programs.virt-manager.enable = true;
-
-  users.users.user.extraGroups = [
-    "libvirt"
-    "libvirtd"
-  ];
-}
diff --git a/hosts/modules/networkmanager.nix b/hosts/modules/networkmanager.nix
deleted file mode 100644
index 7634116..0000000
--- a/hosts/modules/networkmanager.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  networking.networkmanager = {
-    enable = true;
-    wifi.backend = "iwd";
-  };
-
-  users.users.user.extraGroups = [ "networkmanager" ];
-}
diff --git a/hosts/modules/podman.nix b/hosts/modules/podman.nix
deleted file mode 100644
index 99018cc..0000000
--- a/hosts/modules/podman.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-
-{
-  virtualisation.podman = {
-    enable = true;
-    autoPrune.enable = true;
-    extraPackages = [ pkgs.podman-compose ];
-  };
-
-  systemd = {
-    services.podman-auto-update.enable = true;
-    timers.podman-auto-update.enable = true;
-  };
-}
diff --git a/hosts/modules/server/boot.nix b/hosts/modules/server/boot.nix
deleted file mode 100644
index 5d6e482..0000000
--- a/hosts/modules/server/boot.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ pkgs, ... }:
-
-{
-  boot.kernelPackages = pkgs.linuxPackages_hardened;
-}
diff --git a/hosts/modules/server/nix.nix b/hosts/modules/server/nix.nix
deleted file mode 100644
index af57cae..0000000
--- a/hosts/modules/server/nix.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ inputs, ... }:
-
-{
-  environment.etc."channels/nixpkgs".source = inputs.nixpkgs-stable.outPath;
-
-  nix = {
-    registry.nixpkgs.flake = inputs.nixpkgs-stable;
-    nixPath = [
-      "nixpkgs=/etc/channels/nixpkgs"
-      "/nix/var/nix/profiles/per-user/root/channels"
-    ];
-  };
-}
diff --git a/hosts/modules/server/tailscale.nix b/hosts/modules/server/tailscale.nix
deleted file mode 100644
index 1f105ba..0000000
--- a/hosts/modules/server/tailscale.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ ... }:
-
-{
-  services.tailscale = {
-    extraSetFlags = [ "--advertise-exit-node" ];
-    useRoutingFeatures = "server";
-  };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-    "net.ipv6.conf.all.forwarding" = 1;
-  };
-}
diff --git a/hosts/trantor/boot.nix b/hosts/trantor/boot.nix
deleted file mode 100644
index 67ac124..0000000
--- a/hosts/trantor/boot.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  boot.initrd.systemd.enable = true;
-}
diff --git a/hosts/trantor/hardware-configuration.nix b/hosts/trantor/hardware-configuration.nix
deleted file mode 100644
index 4a9503f..0000000
--- a/hosts/trantor/hardware-configuration.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  modulesPath,
-  self,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-    self.diskoConfigurations.trantor
-  ];
-
-  boot = {
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "usbhid"
-      ];
-      kernelModules = [ ];
-    };
-  };
-
-  networking.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}
diff --git a/modules/ephemeral.nix b/modules/ephemeral.nix
deleted file mode 100644
index 7403aac..0000000
--- a/modules/ephemeral.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{ lib, config, ... }:
-
-let
-  cfg = config.ephemeral;
-in
-{
-  options.ephemeral = {
-    enable = lib.mkEnableOption "ephemeral root with automatic rollback";
-
-    rootDevice = lib.mkOption {
-      type = lib.types.str;
-      example = "/dev/mapper/cryptroot";
-      description = "Device path for the root btrfs filesystem";
-    };
-
-    rootSubvolume = lib.mkOption {
-      type = lib.types.str;
-      example = "@root";
-      description = "Name of the root btrfs subvolume";
-    };
-
-    oldRootRetentionDays = lib.mkOption {
-      type = lib.types.int;
-      default = 30;
-      description = "Number of days to keep old root snapshots before deletion";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    boot.initrd.systemd.services.recreate-root = {
-      description = "Rolling over and creating new filesystem root";
-      requires = [ "initrd-root-device.target" ];
-      after = [
-        "local-fs-pre.target"
-        "initrd-root-device.target"
-      ];
-      requiredBy = [ "initrd-root-fs.target" ];
-      before = [ "sysroot.mount" ];
-      unitConfig = {
-        AssertPathExists = "/etc/initrd-release";
-        DefaultDependencies = false;
-      };
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-      script = ''
-        set -euo pipefail
-
-        mkdir /btrfs_tmp
-        if ! mount ${cfg.rootDevice} /btrfs_tmp; then
-          echo "ERROR: Failed to mount ${cfg.rootDevice}"
-          exit 1
-        fi
-
-        if [[ -e /btrfs_tmp/${cfg.rootSubvolume} ]]; then
-          mkdir -p /btrfs_tmp/old_roots
-          timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/${cfg.rootSubvolume})" "+%Y-%m-%-d_%H:%M:%S")
-          mv /btrfs_tmp/${cfg.rootSubvolume} "/btrfs_tmp/old_roots/$timestamp"
-        fi
-
-        delete_subvolume_recursively() {
-          IFS=$'\n'
-          for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
-             delete_subvolume_recursively "/btrfs_tmp/$i"
-          done
-          btrfs subvolume delete "$1"
-        }
-
-        for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +${toString cfg.oldRootRetentionDays}); do
-          delete_subvolume_recursively "$i"
-        done
-
-        if ! btrfs subvolume create /btrfs_tmp/${cfg.rootSubvolume}; then
-          echo "ERROR: Failed to create subvolume ${cfg.rootSubvolume}"
-          umount /btrfs_tmp
-          exit 1
-        fi
-
-        umount /btrfs_tmp
-      '';
-    };
-  };
-}
diff --git a/nixosConfigurations.nix b/nixosConfigurations.nix
deleted file mode 100644
index ced8851..0000000
--- a/nixosConfigurations.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{ inputs, ... }:
-let
-  lib = inputs.nixpkgs.lib;
-  utils = import ./utils.nix { inherit inputs lib; };
-  inherit (utils) mkHost;
-in
-{
-  flake.nixosConfigurations = {
-    rotterdam = mkHost {
-      hostname = "rotterdam";
-      tags = [
-        "desktop"
-        "bluetooth"
-        "dev"
-        "ephemeral"
-        "fwupd"
-        "gaming"
-        "libvirtd"
-        "networkmanager"
-        "podman"
-      ];
-    };
-
-    io = mkHost {
-      hostname = "io";
-      tags = [
-        "desktop"
-        "bluetooth"
-        "dev"
-        "ephemeral"
-        "networkmanager"
-        "podman"
-      ];
-    };
-
-    alexandria = mkHost {
-      hostname = "alexandria";
-      tags = [
-        # "server" TODO: uncomment when 25.11 is out.
-        "fwupd"
-        "podman"
-      ];
-    };
-
-    trantor = mkHost {
-      hostname = "trantor";
-      system = "aarch64-linux";
-      tags = [
-        "server"
-        "ephemeral"
-      ];
-    };
-  };
-}
diff --git a/nixosModules.nix b/nixosModules.nix
deleted file mode 100644
index 5fd416b..0000000
--- a/nixosModules.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  flake.nixosModules = {
-    ephemeral = import ./modules/ephemeral.nix;
-  };
-}
diff --git a/overlays.nix b/overlays.nix
deleted file mode 100644
index eab4edf..0000000
--- a/overlays.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ inputs, ... }:
-
-{
-  flake.overlays = {
-    default = final: prev: {
-      base16-schemes = inputs.self.packages.${final.system}.base16-schemes;
-      fastfetch = inputs.self.packages.${final.system}.fastfetch;
-      hm-cli = inputs.self.packages.${final.system}.hm-cli;
-      kwrite = inputs.self.packages.${final.system}.kwrite;
-      toggleaudiosink = inputs.self.packages.${final.system}.toggleaudiosink;
-    };
-  };
-}
diff --git a/packages.nix b/packages.nix
deleted file mode 100644
index 46979f8..0000000
--- a/packages.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  perSystem =
-    { pkgs, system, ... }:
-    {
-      packages = {
-        base16-schemes = pkgs.callPackage ./packages/base16-schemes.nix { };
-        fastfetch = pkgs.callPackage ./packages/fastfetch.nix { };
-        hm-cli = pkgs.callPackage ./packages/hm-cli.nix { };
-        kwrite = pkgs.callPackage ./packages/kwrite.nix { };
-        toggleaudiosink = pkgs.callPackage ./packages/toggleaudiosink.nix { };
-      };
-    };
-}
diff --git a/packages/base16-schemes.nix b/packages/base16-schemes.nix
index ffd6c04..fbb1341 100644
--- a/packages/base16-schemes.nix
+++ b/packages/base16-schemes.nix
@@ -1,32 +1,35 @@
+{ ... }:
+
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "base16-schemes";
-  version = "0-unstable-2025-06-04";
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.base16-schemes = pkgs.stdenv.mkDerivation (finalAttrs: {
+        pname = "base16-schemes";
+        version = "0-unstable-2025-06-04";
 
-  src = fetchFromGitHub {
-    owner = "tinted-theming";
-    repo = "schemes";
-    rev = "317a5e10c35825a6c905d912e480dfe8e71c7559";
-    hash = "sha256-d4km8W7w2zCUEmPAPUoLk1NlYrGODuVa3P7St+UrqkM=";
-  };
+        src = pkgs.fetchFromGitHub {
+          owner = "tinted-theming";
+          repo = "schemes";
+          rev = "317a5e10c35825a6c905d912e480dfe8e71c7559";
+          hash = "sha256-d4km8W7w2zCUEmPAPUoLk1NlYrGODuVa3P7St+UrqkM=";
+        };
 
-  installPhase = ''
-    runHook preInstall
+        installPhase = ''
+          runHook preInstall
 
-    mkdir -p $out/share/themes/
-    install base16/*.yaml $out/share/themes/
+          mkdir -p $out/share/themes/
+          install base16/*.yaml $out/share/themes/
 
-    runHook postInstall
-  '';
+          runHook postInstall
+        '';
 
-  meta = {
-    description = "All the color schemes for use in base16 packages";
-    homepage = "https://github.com/tinted-theming/schemes";
-    maintainers = [ lib.maintainers.DamienCassou ];
-    license = lib.licenses.mit;
-  };
-})
+        meta = {
+          description = "All the color schemes for use in base16 packages";
+          homepage = "https://github.com/tinted-theming/schemes";
+          maintainers = [ pkgs.lib.maintainers.DamienCassou ];
+          license = pkgs.lib.licenses.mit;
+        };
+      });
+    };
+}
diff --git a/packages/fastfetch.nix b/packages/fastfetch.nix
index fa8e0ea..aa8d616 100644
--- a/packages/fastfetch.nix
+++ b/packages/fastfetch.nix
@@ -1,81 +1,84 @@
+{ ... }:
+
 {
-  lib,
-  pkgs ? import <nixpkgs> { },
-}:
+  perSystem =
+    { pkgs, lib, ... }:
+    let
+      fastfetch-logo = pkgs.fetchurl {
+        url = "https://discourse.nixos.org/uploads/default/original/3X/3/6/36954e6d6aa32c8b00f50ca43f142d898c1ff535.png";
+        hash = "sha256-aLHz8jSAFocrn+Pb4vRq0wtkYFJpBpZRevd+VoZC/PQ=";
+      };
 
-let
-  fastfetch-logo = pkgs.fetchurl {
-    url = "https://discourse.nixos.org/uploads/default/original/3X/3/6/36954e6d6aa32c8b00f50ca43f142d898c1ff535.png";
-    hash = "sha256-aLHz8jSAFocrn+Pb4vRq0wtkYFJpBpZRevd+VoZC/PQ=";
-  };
-
-  fastfetch-config = pkgs.writeText "fastfetch-config.json" (
-    builtins.toJSON {
-      "$schema" = "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json";
-      modules = [
-        "title"
-        "separator"
-        {
-          type = "os";
-          keyWidth = 9;
+      fastfetch-config = pkgs.writeText "fastfetch-config.json" (
+        builtins.toJSON {
+          "$schema" = "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json";
+          modules = [
+            "title"
+            "separator"
+            {
+              type = "os";
+              keyWidth = 9;
+            }
+            {
+              type = "kernel";
+              keyWidth = 9;
+            }
+            {
+              type = "uptime";
+              keyWidth = 9;
+            }
+            {
+              type = "shell";
+              keyWidth = 9;
+            }
+            "break"
+            {
+              type = "cpu";
+              keyWidth = 11;
+            }
+            {
+              type = "memory";
+              keyWidth = 11;
+            }
+            {
+              type = "swap";
+              keyWidth = 11;
+            }
+            {
+              type = "disk";
+              folders = "/";
+              keyWidth = 11;
+            }
+            {
+              type = "command";
+              key = "Systemd";
+              keyWidth = 11;
+              text = "echo \"$(systemctl list-units --state=failed --no-legend | wc -l) failed units, $(systemctl list-jobs --no-legend | wc -l) queued jobs\"";
+            }
+            "break"
+            {
+              type = "command";
+              key = "Public IP";
+              keyWidth = 15;
+              text = "curl -s -4 ifconfig.me 2>/dev/null || echo 'N/A'";
+            }
+            {
+              type = "command";
+              key = "Tailscale IP";
+              keyWidth = 15;
+              text = "tailscale ip -4 2>/dev/null || echo 'N/A'";
+            }
+            {
+              type = "command";
+              key = "Local IP";
+              keyWidth = 15;
+              text = "ip -4 addr show scope global | grep inet | head -n1 | awk '{print $2}' | cut -d/ -f1";
+            }
+          ];
         }
-        {
-          type = "kernel";
-          keyWidth = 9;
-        }
-        {
-          type = "uptime";
-          keyWidth = 9;
-        }
-        {
-          type = "shell";
-          keyWidth = 9;
-        }
-        "break"
-        {
-          type = "cpu";
-          keyWidth = 11;
-        }
-        {
-          type = "memory";
-          keyWidth = 11;
-        }
-        {
-          type = "swap";
-          keyWidth = 11;
-        }
-        {
-          type = "disk";
-          folders = "/";
-          keyWidth = 11;
-        }
-        {
-          type = "command";
-          key = "Systemd";
-          keyWidth = 11;
-          text = "echo \"$(systemctl list-units --state=failed --no-legend | wc -l) failed units, $(systemctl list-jobs --no-legend | wc -l) queued jobs\"";
-        }
-        "break"
-        {
-          type = "command";
-          key = "Public IP";
-          keyWidth = 15;
-          text = "curl -s -4 ifconfig.me 2>/dev/null || echo 'N/A'";
-        }
-        {
-          type = "command";
-          key = "Tailscale IP";
-          keyWidth = 15;
-          text = "tailscale ip -4 2>/dev/null || echo 'N/A'";
-        }
-        {
-          type = "command";
-          key = "Local IP";
-          keyWidth = 15;
-          text = "ip -4 addr show scope global | grep inet | head -n1 | awk '{print $2}' | cut -d/ -f1";
-        }
-      ];
-    }
-  );
-in
-pkgs.writeShellScriptBin "fastfetch" ''exec ${lib.getExe pkgs.fastfetch} --config ${fastfetch-config} --logo-type kitty --logo ${fastfetch-logo} --logo-padding-right 1 --logo-width 36 "$@" ''
+      );
+    in
+    {
+      packages.fastfetch = pkgs.writeShellScriptBin "fastfetch" ''exec ${lib.getExe pkgs.fastfetch} --config ${fastfetch-config} --logo-type kitty --logo ${fastfetch-logo} --logo-padding-right 1 --logo-width 36 "$@" '';
+    };
+}
diff --git a/packages/hm-cli.nix b/packages/hm-cli.nix
index f6034ea..59f4b4f 100644
--- a/packages/hm-cli.nix
+++ b/packages/hm-cli.nix
@@ -1,105 +1,107 @@
+{ ... }:
+
 {
-  pkgs ? import <nixpkgs> { },
-}:
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.hm-cli = pkgs.writeShellScriptBin "hm" ''
+        HM="${pkgs.lib.getExe pkgs.home-manager}"
+        FLAKE_PATH="''${HM_PATH:-$HOME/.config/home-manager}"
+        FLAKE_OUTPUT="''${HM_USER:-$(whoami)@$(hostname)}"
 
-pkgs.writeShellScriptBin "hm" ''
-    set -e
+        show_usage() {
+          cat <<EOF
+        Usage: hm <command> [args]
 
-    HM="${pkgs.lib.getExe pkgs.home-manager}"
-    FLAKE_PATH="''${HM_PATH:-$HOME/.config/home-manager}"
-    FLAKE_OUTPUT="''${HM_USER:-$(whoami)@$(hostname)}"
+        Commands:
+          apply                       Switch to a new generation
+          generation list             List all generations
+          generation delete ID...     Delete specified generation(s)
+          generation rollback         Rollback to the previous generation
+          generation switch ID        Switch to the specified generation
+          generation cleanup          Delete all but the current generation
 
-    show_usage() {
-      cat <<EOF
-  Usage: hm <command> [args]
+        Environment Variables:
+          HM_PATH           Override default flake path (~/.config/home-manager)
+            Currently set to "''${HM_PATH:-<not set>}"
+          HM_USER           Override default user output ("$(whoami)@$(hostname)")
+            Currently set to "''${HM_USER:-<not set>}"
+        EOF
+        }
 
-  Commands:
-    apply                       Switch to a new generation
-    generation list             List all generations
-    generation delete ID...     Delete specified generation(s)
-    generation rollback         Rollback to the previous generation
-    generation switch ID        Switch to the specified generation
-    generation cleanup          Delete all but the current generation
-
-  Environment Variables:
-    HM_PATH           Override default flake path (~/.config/home-manager)
-      Currently set to "''${HM_PATH:-<not set>}"
-    HM_USER           Override default user output ("$(whoami)@$(hostname)")
-      Currently set to "''${HM_USER:-<not set>}"
-  EOF
-    }
-
-    if [[ $# -eq 0 ]]; then
-      show_usage
-      exit 1
-    fi
-
-    case "$1" in
-      apply)
-        "$HM" switch --flake "$FLAKE_PATH#$FLAKE_OUTPUT" -b bkp
-        ;;
-      generation)
-        if [[ $# -lt 2 ]]; then
-          echo "Error: generation command requires a subcommand"
+        if [[ $# -eq 0 ]]; then
           show_usage
           exit 1
         fi
 
-        case "$2" in
-          list)
-            "$HM" generations
+        case "$1" in
+          apply)
+            "$HM" switch --flake "$FLAKE_PATH#$FLAKE_OUTPUT" -b bkp
             ;;
-          delete)
-            if [[ $# -lt 3 ]]; then
-              echo "Error: delete requires at least one generation ID"
+          generation)
+            if [[ $# -lt 2 ]]; then
+              echo "Error: generation command requires a subcommand"
+              show_usage
               exit 1
             fi
-            shift 2
-            "$HM" remove-generations "$@"
-            ;;
-          rollback)
-            PREV_GEN=$("$HM" generations | \
-              sed -n 's/^[[:space:]]*id \([0-9]\+\).*/\1/p' | \
-              head -n 2 | tail -n 1)
-            if [[ -z "$PREV_GEN" ]]; then
-              echo "Error: could not determine previous generation (possibly only one generation exists)"
-              exit 1
-            fi
-            "$HM" switch --flake "$FLAKE_PATH" --switch-generation "$PREV_GEN" -b bkp
-            ;;
-          switch)
-            if [[ $# -ne 3 ]]; then
-              echo "Error: switch requires exactly one generation ID"
-              exit 1
-            fi
-            "$HM" switch --flake "$FLAKE_PATH" --switch-generation "$3" -b bkp
-            ;;
-          cleanup)
-            CURRENT_GEN=$("$HM" generations | sed -n 's/^.*id \([0-9]\+\) .* (current)$/\1/p')
-            if [[ -z "$CURRENT_GEN" ]]; then
-              echo "Error: could not determine current generation"
-              exit 1
-            fi
-            OLD_GENS=$("$HM" generations | sed -n 's/^.*id \([0-9]\+\) .*/\1/p' | grep -v "^$CURRENT_GEN$")
-            if [[ -z "$OLD_GENS" ]]; then
-              echo "No old generations to delete"
-            else
-              echo "Deleting generations: $(echo $OLD_GENS | tr '\n' ' ')"
-              echo "$OLD_GENS" | xargs "$HM" remove-generations
-              echo "Cleanup complete. Current generation $CURRENT_GEN preserved."
-            fi
+
+            case "$2" in
+              list)
+                "$HM" generations
+                ;;
+              delete)
+                if [[ $# -lt 3 ]]; then
+                  echo "Error: delete requires at least one generation ID"
+                  exit 1
+                fi
+                shift 2
+                "$HM" remove-generations "$@"
+                ;;
+              rollback)
+                PREV_GEN=$("$HM" generations | \
+                  sed -n 's/^[[:space:]]*id \([0-9]\+\).*/\1/p' | \
+                  head -n 2 | tail -n 1)
+                if [[ -z "$PREV_GEN" ]]; then
+                  echo "Error: could not determine previous generation (possibly only one generation exists)"
+                  exit 1
+                fi
+                "$HM" switch --flake "$FLAKE_PATH" --switch-generation "$PREV_GEN" -b bkp
+                ;;
+              switch)
+                if [[ $# -ne 3 ]]; then
+                  echo "Error: switch requires exactly one generation ID"
+                  exit 1
+                fi
+                "$HM" switch --flake "$FLAKE_PATH" --switch-generation "$3" -b bkp
+                ;;
+              cleanup)
+                CURRENT_GEN=$("$HM" generations | sed -n 's/^.*id \([0-9]\+\) .* (current)$/\1/p')
+                if [[ -z "$CURRENT_GEN" ]]; then
+                  echo "Error: could not determine current generation"
+                  exit 1
+                fi
+                OLD_GENS=$("$HM" generations | sed -n 's/^.*id \([0-9]\+\) .*/\1/p' | grep -v "^$CURRENT_GEN$")
+                if [[ -z "$OLD_GENS" ]]; then
+                  echo "No old generations to delete"
+                else
+                  echo "Deleting generations: $(echo $OLD_GENS | tr '\n' ' ')"
+                  echo "$OLD_GENS" | xargs "$HM" remove-generations
+                  echo "Cleanup complete. Current generation $CURRENT_GEN preserved."
+                fi
+                ;;
+              *)
+                echo "Error: unknown generation subcommand '$2'"
+                show_usage
+                exit 1
+                ;;
+            esac
             ;;
           *)
-            echo "Error: unknown generation subcommand '$2'"
+            echo "Error: unknown command '$1'"
             show_usage
             exit 1
             ;;
         esac
-        ;;
-      *)
-        echo "Error: unknown command '$1'"
-        show_usage
-        exit 1
-        ;;
-    esac
-''
+      '';
+    };
+}
diff --git a/packages/kwrite.nix b/packages/kwrite.nix
index 14ebce1..67ce69e 100644
--- a/packages/kwrite.nix
+++ b/packages/kwrite.nix
@@ -1,15 +1,21 @@
-{ pkgs }:
+{ ... }:
 
-pkgs.symlinkJoin {
-  name = "kwrite";
-  paths = [ pkgs.kdePackages.kate ];
-  postBuild = ''
-    rm -rf $out/bin/kate \
-           $out/bin/.kate-wrapped \
-           $out/share/applications/org.kde.kate.desktop \
-           $out/share/man \
-           $out/share/icons/hicolor/*/apps/kate.png \
-           $out/share/icons/hicolor/scalable/apps/kate.svg \
-           $out/share/appdata/org.kde.kate.appdata.xml
-  '';
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.kwrite = pkgs.symlinkJoin {
+        name = "kwrite";
+        paths = [ pkgs.kdePackages.kate ];
+        postBuild = ''
+          rm -rf $out/bin/kate \
+                 $out/bin/.kate-wrapped \
+                 $out/share/applications/org.kde.kate.desktop \
+                 $out/share/man \
+                 $out/share/icons/hicolor/*/apps/kate.png \
+                 $out/share/icons/hicolor/scalable/apps/kate.svg \
+                 $out/share/appdata/org.kde.kate.appdata.xml
+        '';
+      };
+    };
 }
diff --git a/packages/niri-auto-centre.nix b/packages/niri-auto-centre.nix
new file mode 100644
index 0000000..dd7b04c
--- /dev/null
+++ b/packages/niri-auto-centre.nix
@@ -0,0 +1,32 @@
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.niri-auto-centre = pkgs.writeShellApplication {
+        name = "niri-auto-centre";
+        runtimeInputs = [ pkgs.jq ];
+        text = ''
+          while true; do
+              ACTIVE_WORKSPACE=$(niri msg --json workspaces | jq -r '.[] | select(.is_active == true)')
+              WORKSPACE_ID=$(echo "$ACTIVE_WORKSPACE" | jq -r '.id')
+              OUTPUT_NAME=$(echo "$ACTIVE_WORKSPACE" | jq -r '.output')
+              
+              MONITOR_WIDTH=$(niri msg --json outputs | jq -r ".\"$OUTPUT_NAME\".logical.width")
+              
+              SUMMED_TILE_WIDTH=$(niri msg --json windows | jq --argjson wid "$WORKSPACE_ID" -r '
+                  [.[] | select(.workspace_id == $wid) | {col: .layout.pos_in_scrolling_layout[0], width: .layout.tile_size[0]}]
+                  | group_by(.col) | map(first.width) | add
+              ')
+              
+              if awk "BEGIN {exit !($SUMMED_TILE_WIDTH < $MONITOR_WIDTH)}"; then
+                  niri msg action center-visible-columns
+              fi
+              
+              sleep 0.1
+          done
+        '';
+      };
+    };
+}
diff --git a/packages/overlays.nix b/packages/overlays.nix
new file mode 100644
index 0000000..169a67b
--- /dev/null
+++ b/packages/overlays.nix
@@ -0,0 +1,23 @@
+{ inputs, ... }:
+
+let
+  packageDir = builtins.readDir ./.;
+
+  # Filter to .nix files, excluding overlays.nix
+  isPackageFile = name: name != "overlays.nix" && builtins.match ".*\\.nix$" name != null;
+
+  # Extract package name from filename (e.g., "foo-bar.nix" -> "foo-bar")
+  toPackageName = filename: builtins.head (builtins.match "(.+)\\.nix$" filename);
+
+  packageNames = map toPackageName (builtins.filter isPackageFile (builtins.attrNames packageDir));
+in
+{
+  flake.overlays.default =
+    final: prev:
+    builtins.listToAttrs (
+      map (name: {
+        inherit name;
+        value = inputs.self.packages.${final.system}.${name};
+      }) packageNames
+    );
+}
diff --git a/packages/toggleaudiosink.nix b/packages/toggleaudiosink.nix
index 623346f..22e0d44 100644
--- a/packages/toggleaudiosink.nix
+++ b/packages/toggleaudiosink.nix
@@ -1,48 +1,52 @@
+{ ... }:
+
 {
-  pkgs ? import <nixpkgs> { },
-}:
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.toggleaudiosink = pkgs.writeShellScriptBin "toggleaudiosink" ''
+        #!/usr/bin/env bash
 
-pkgs.writeShellScriptBin "toggleaudiosink" ''
-  #!/usr/bin/env bash
+        sound_server="pipewire"
 
-  sound_server="pipewire"
+        # Grab a count of how many audio sinks we have
+        sink_count=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -c "Sink #[[:digit:]]")
+        # Create an array of the actual sink IDs
+        sinks=()
+        mapfile -t sinks < <(${pkgs.pulseaudio}/bin/pactl list sinks | grep 'Sink #[[:digit:]]' | sed -n -e 's/.*Sink #\([[:digit:]]\)/\1/p')
+        # Get the ID of the active sink
+        active_sink_name=$(${pkgs.pulseaudio}/bin/pactl info | grep 'Default Sink:' | sed -n -e 's/.*Default Sink:[[:space:]]\+\(.*\)/\1/p')
+        active_sink=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -B 2 "$active_sink_name" | sed -n -e 's/Sink #\([[:digit:]]\)/\1/p' | head -n 1)
 
-  # Grab a count of how many audio sinks we have
-  sink_count=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -c "Sink #[[:digit:]]")
-  # Create an array of the actual sink IDs
-  sinks=()
-  mapfile -t sinks < <(${pkgs.pulseaudio}/bin/pactl list sinks | grep 'Sink #[[:digit:]]' | sed -n -e 's/.*Sink #\([[:digit:]]\)/\1/p')
-  # Get the ID of the active sink
-  active_sink_name=$(${pkgs.pulseaudio}/bin/pactl info | grep 'Default Sink:' | sed -n -e 's/.*Default Sink:[[:space:]]\+\(.*\)/\1/p')
-  active_sink=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -B 2 "$active_sink_name" | sed -n -e 's/Sink #\([[:digit:]]\)/\1/p' | head -n 1)
+        # Get the ID of the last sink in the array
+        final_sink=''${sinks[$((sink_count - 1))]}
 
-  # Get the ID of the last sink in the array
-  final_sink=''${sinks[$((sink_count - 1))]}
+        # Find the index of the active sink
+        for index in "''${!sinks[@]}"; do
+          if [[ "''${sinks[$index]}" == "$active_sink" ]]; then
+            active_sink_index=$index
+          fi
+        done
 
-  # Find the index of the active sink
-  for index in "''${!sinks[@]}"; do
-    if [[ "''${sinks[$index]}" == "$active_sink" ]]; then
-      active_sink_index=$index
-    fi
-  done
+        # Default to the first sink in the list
+        next_sink=''${sinks[0]}
+        next_sink_index=0
 
-  # Default to the first sink in the list
-  next_sink=''${sinks[0]}
-  next_sink_index=0
+        # If we're not at the end of the list, move up the list
+        if [[ $active_sink -ne $final_sink ]]; then
+          next_sink_index=$((active_sink_index + 1))
+          next_sink=''${sinks[$next_sink_index]}
+        fi
 
-  # If we're not at the end of the list, move up the list
-  if [[ $active_sink -ne $final_sink ]]; then
-    next_sink_index=$((active_sink_index + 1))
-    next_sink=''${sinks[$next_sink_index]}
-  fi
+        # Change the default sink
+        # Get the name of the next sink
+        next_sink_name=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -C 2 "Sink #$next_sink" | sed -n -e 's/.*Name:[[:space:]]\+\(.*\)/\1/p' | head -n 1)
+        ${pkgs.pulseaudio}/bin/pactl set-default-sink "$next_sink_name"
 
-  # Change the default sink
-  # Get the name of the next sink
-  next_sink_name=$(${pkgs.pulseaudio}/bin/pactl list sinks | grep -C 2 "Sink #$next_sink" | sed -n -e 's/.*Name:[[:space:]]\+\(.*\)/\1/p' | head -n 1)
-  ${pkgs.pulseaudio}/bin/pactl set-default-sink "$next_sink_name"
-
-  # Move all inputs to the new sink
-  for app in $(${pkgs.pulseaudio}/bin/pactl list sink-inputs | sed -n -e 's/.*Sink Input #\([[:digit:]]\)/\1/p'); do
-    ${pkgs.pulseaudio}/bin/pactl "move-sink-input $app $next_sink"
-  done
-''
+        # Move all inputs to the new sink
+        for app in $(${pkgs.pulseaudio}/bin/pactl list sink-inputs | sed -n -e 's/.*Sink Input #\([[:digit:]]\)/\1/p'); do
+          ${pkgs.pulseaudio}/bin/pactl "move-sink-input $app $next_sink"
+        done
+      '';
+    };
+}
diff --git a/readme.md b/readme.md
index 2804237..e36ccec 100644
--- a/readme.md
+++ b/readme.md
@@ -1,123 +1,73 @@
-# NixOS Configuration
+# NixOS Flake Configuration
 
-A declarative, modular NixOS/Home Manager flake configuration managing multiple systems with a tag-based architecture for maximum code reuse and flexibility.
+Modular NixOS configuration using flake-parts with the [dendritic](https://github.com/gytis-ivaskevicius/dendritic) pattern.
 
-## Hosts
-
-| Host | Type | System | Version | Description |
-|------|------|--------|---------|-------------|
-| **rotterdam** | Desktop | x86_64-linux | NixOS Unstable | Primary workstation with gaming, development |
-| **io** | Laptop | x86_64-linux | NixOS Unstable | Mobile workstation |
-| **alexandria** | Server/NAS | x86_64-linux | NixOS 25.05 | Personal server running Nextcloud, Forgejo, Jellyfin, Vaultwarden |
-| **trantor** | VPS | aarch64-linux | NixOS 25.05 | Oracle Cloud instance |
-
-## Key Features
-
-### Architecture
-- **Tag-based module system** - Compose configurations using tags instead of traditional inheritance
-- **Flake-based** - Fully reproducible builds with locked dependencies
-- **Multi-platform** - Supports both x86_64 and aarch64 architectures
-- **Deployment automation** - Remote deployment via deploy-rs
-
-### Desktop Experience
-- **Niri compositor** - Custom fork with auto-centering window columns
-- **Unified theming** - Stylix-based theming
-- **Wayland-native** - Full Wayland support
-- **Ephemeral root** - Impermanent filesystem using BTRFS for atomic rollback capability
-
-### Self-Hosted Services
-- **Nextcloud** - Cloud storage with calendar, contacts, and notes
-- **Forgejo** - Self-hosted Git server
-- **Jellyfin** - Media streaming
-- **Vaultwarden** - Password manager backend
-- **LibreSpeed** - Network speed testing
-- All services behind Nginx and Tailscale with automatic SSL via Let's Encrypt
-
-### Security
-- **Agenix** - Encrypted secrets management
-- **Tailscale** - Zero-config VPN mesh network
-- **Firewall** - Configured on all hosts
-- SSH key-based authentication
-
-## Repository Structure
+## Structure
 
 ```
 .
-├── flake.nix                    # Main flake definition
-├── utils.nix                    # Tag-based module system utilities
-├── nixosConfigurations.nix      # Host definitions with tags
-├── homeConfigurations.nix       # User configurations
-├── deploy.nix                   # Remote deployment configuration
-├── hosts/
-│   ├── alexandria/              # Server-specific config
-│   ├── io/                      # Laptop-specific config
-│   ├── rotterdam/               # Desktop-specific config
-│   ├── trantor/                 # VPS-specific config
-│   └── modules/
-│       ├── common/              # Shared base configuration
-│       ├── desktop/             # Desktop environment setup
-│       ├── server/              # Server-specific modules
-│       └── [tag].nix            # Optional feature modules
-├── users/
-│   └── modules/                 # Home Manager configurations
-│       └── [tag].nix            # Optional feature modules
-├── packages/                    # Custom package definitions
-└── secrets/                     # Encrypted secrets (agenix)
+├── aspects/           # Reusable NixOS/home-manager modules (dendritic)
+│   ├── base/          # Base system configuration
+│   ├── hosts/         # Host-specific configurations
+│   │   ├── _alexandria/
+│   │   ├── _io/
+│   │   ├── _rotterdam/
+│   │   └── _trantor/
+│   ├── systems/       # System type modules (desktop, server, cli, gaming)
+│   └── users/         # User account configurations
+├── data/              # Shared host/service definitions
+├── packages/          # Custom packages and overlays
+├── shells/            # Shell configurations
+└── terranix/          # Terraform configurations for cloud resources
 ```
 
-## Tag System
+## Hosts
 
-Configurations are composed using tags that map to modules:
+| Host | Architecture | Type | Description |
+|------|--------------|------|-------------|
+| trantor | aarch64-linux | server | ARM server running Forgejo |
+| alexandria | x86_64-linux | server | x86 server (Kanidm, Vaultwarden, Nextcloud, Jellyfin) |
+| rotterdam | x86_64-linux | desktop | Main workstation setup for gaming |
+| io | x86_64-linux | desktop | Workstation |
 
-**Common Tags** (all hosts):
-- `common` - Base system configuration (automatically applied)
+## Services
 
-**General Tags**:
-- `desktop` - *Mostly* full desktop environment with Niri WM
-- `dev` - Development tools and environments
-- `gaming` - Steam, Heroic, gamemode, controller support
-- `ephemeral` - Impermanent root filesystem
-- `networkmanager` - WiFi and network management
-- `libvirtd` - KVM/QEMU virtualization
-- `podman` - Container runtime
-- `bluetooth` - Bluetooth support
-- `fwupd` - Firmware update daemon
+- **git.baduhai.dev** (Forgejo) - Publicly accessible on trantor
 
-**Server Tags**:
-- `server` - Server-specific configuration
+Other services (LAN/Tailscale only): Vaultwarden, Nextcloud, Jellyfin
 
-## Usage
+## Features
 
-### Rebuilding a Configuration
+- **Ephemeral root**: Automatic btrfs subvolume rollover with impermanence
+- **Secrets**: Managed via agenix with age encryption
+- **Disk management**: disko for declarative disk partitioning
+- **Modular architecture**: Each aspect is a separate module imported via import-tree
+- **Dendritic pattern**: Aspects are imported as a unified flake module
+
+## Building
 
 ```bash
-# Local rebuild
-sudo nixos-rebuild switch --flake .#hostname
+# Build specific host
+nix build .#nixosConfigurations.trantor.config.system.build.toplevel
 
-# Remote deployment
-deploy .#hostname
+# Rebuild host (if using nixos-cli on the host)
+sudo nixos apply
 ```
 
-### Updating Dependencies
+## Terranix
 
-```bash
-nix flake update
-```
+Terraform configurations for cloud infrastructure managed via terranix:
 
-### Adding a New Host
+- baduhai.dev DNS on CloudFlare
+- VPS provisioning on OCI
+- Tailscale subnet routers
 
-1. Create host directory in `hosts/`
-2. Define configuration in `nixosConfigurations.nix` with appropriate tags
-3. Add deployment profile in `deploy.nix` if needed
+## Key Dependencies
 
-## Dependencies
-
-- [nixpkgs](https://github.com/NixOS/nixpkgs) - Stable (25.05) and unstable channels
-- [home-manager](https://github.com/nix-community/home-manager) - User configuration
-- [agenix](https://github.com/ryantm/agenix) - Secrets management
-- [disko](https://github.com/nix-community/disko) - Declarative disk partitioning
-- [stylix](https://github.com/danth/stylix) - System-wide theming
-- [niri-flake](https://github.com/sodiboo/niri-flake) - Wayland compositor (custom fork)
-- [impermanence](https://github.com/nix-community/impermanence) - Ephemeral filesystem support
-- [deploy-rs](https://github.com/serokell/deploy-rs) - Remote deployment
-- [nix-flatpak](https://github.com/gmodena/nix-flatpak) - Declarative Flatpak management
+- nixpkgs (nixos-unstable for workstations, nixos for servers)
+- home-manager
+- agenix
+- disko
+- impermanence
+- nix-flatpak
+- nixos-cli
diff --git a/secrets/cloudflare.age b/secrets/cloudflare.age
index 9e989ec..028e964 100644
--- a/secrets/cloudflare.age
+++ b/secrets/cloudflare.age
@@ -1,9 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 Kfdnog gEZvRtLBhGslmS97VaRqoucgExvOopsHAAne4lCmEEY
-NkIeFYuQFntDOBqd3k0/OVYMcM7h73uO0jPXaHzEcZc
--> ssh-ed25519 8YSAiw bVV4jIDbBKxsr6mQ4Tv0rP6ylrAEOJWkqjpyvXjnQRU
-6kUe5Syw7sd+aF2QEgr6Yj+fOPL5zSJN1PJvY9Kdhlg
--> ssh-ed25519 J6tVTA 4JMlJmhHAYUgjiWwB1Q278TSjJypwecALmfnosxan0s
-WIubcIFrjMV0GpyU1ZGc48YwrqOtSmJxweonw1KnR+U
---- 78A7re4LLB/0n5AXLRlVqiMNFMAQ2ZvjjK21YGRveRE
-�_�4pk
VCKm��#~kI�8Em3�k�p|�0^�tSk��s�/���΅?=�l�,�����7��~̈́�c�{�Ȟ�A�ݭ���>Z��l���GTJs�GY���/��/�B4�e��'��II��c�
,"�<�
\ No newline at end of file
+-> ssh-ed25519 Kfdnog IHXv4c5we36dCUsB1v8uEF23tIRlDQ/8WR1hX4GQ+Uc
+Cwccw64BYBdSZUdkSqKESIU7E17cLNtiAZZ3Y1xV87A
+-> ssh-ed25519 8YSAiw Ce3vdMG111ubjcFgd3+q2Qw2+7dsoUz7SiudtuLDr0Y
+JUodwFsKfOTZXxFyRrEk/4gxJ4goPkwvYeThi893M0U
+-> ssh-ed25519 J6tVTA bExFuITTGXkTvhW25nushN7zT/PJGDoezsqu7fLKemI
+4a90v0F4wgcZeqWBQ/EpqOZ9OCgT7qruwVvlGZeFmN8
+-> ssh-ed25519 Qt3Q+A j1oo46pNh1+yPEtxpgj+QPQPf5m82jL0DHGMacY8UFA
+vy52Hl1WLTdKNA8+4p7A48Sg9+QkMXbECf/uxVMCLYk
+--- 429vzgFnmFbEqDMwdvC0/EYDJlKU64YEGgE0AqPqlBs
+����b�/!8O��3Df�/��&kNQhu�r�t�%&]������uc�j�H�]�_����5�@D$�>�N8Ϧ	>�9:�Cv�Ѧ69W'X�]X^��ƻ$��}|c���/�߸={�uɳs
\ No newline at end of file
diff --git a/secrets/forgejo-root-password.age b/secrets/forgejo-root-password.age
new file mode 100644
index 0000000..90be612
Binary files /dev/null and b/secrets/forgejo-root-password.age differ
diff --git a/secrets/nextcloud-adminpass.age b/secrets/nextcloud-adminpass.age
index 3b6ff2a..b4a29fa 100644
Binary files a/secrets/nextcloud-adminpass.age and b/secrets/nextcloud-adminpass.age differ
diff --git a/secrets/nextcloud-secrets.json.age b/secrets/nextcloud-secrets.json.age
index 473f3cb..02d170d 100644
Binary files a/secrets/nextcloud-secrets.json.age and b/secrets/nextcloud-secrets.json.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index d47309f..a90cd74 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -7,7 +7,7 @@ let
 
   alexandria = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK95QueW+jp1ZmF299Xr3XkgHJ6dL7aZVsfWxqbOKVKA root@alexandria";
 
-  trantor = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkGuGLZPnYJbCGY4BhJ9uTupp6ruuR1NZ7FEYEaLPA7 root@alexandria";
+  trantor = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIh/2u5pr/iPVeavlsor5hbTtsgUfP1JpzZVco2YQAo3 root@trantor";
 in
 
 {
@@ -15,6 +15,7 @@ in
     io-user
     rotterdam-user
     alexandria
+    trantor
   ];
   "nextcloud-adminpass.age".publicKeys = [
     io-user
@@ -26,4 +27,9 @@ in
     rotterdam-user
     alexandria
   ];
+  "forgejo-root-password.age".publicKeys = [
+    io-user
+    rotterdam-user
+    trantor
+  ];
 }
diff --git a/devShells.nix b/shells/default.nix
similarity index 51%
rename from devShells.nix
rename to shells/default.nix
index 72b2695..d9eb50b 100644
--- a/devShells.nix
+++ b/shells/default.nix
@@ -1,15 +1,14 @@
-{ ... }:
+{ inputs, ... }:
 
 {
   perSystem =
-    { pkgs, ... }:
+    { pkgs, system, ... }:
     {
       devShells.default = pkgs.mkShell {
         packages = with pkgs; [
-          agenix-cli
-          deploy-rs
+          inputs.agenix.packages.${stdenv.hostPlatform.system}.default
           nil
-          nixfmt-rfc-style
+          nixfmt
         ];
       };
     };
diff --git a/terranix/baduhai.dev.nix b/terranix/baduhai.dev.nix
new file mode 100644
index 0000000..cea9f22
--- /dev/null
+++ b/terranix/baduhai.dev.nix
@@ -0,0 +1,113 @@
+# Required environment variables:
+#   CLOUDFLARE_API_TOKEN - API token with "Edit zone DNS" permissions
+#   AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
+#   AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
+
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.cloudflare-baduhaidev = {
+        terraformWrapper.package = pkgs.opentofu;
+        modules = [
+          (
+            { config, lib, ... }:
+
+            let
+              sharedData = import ../data/services.nix;
+              # Enrich services with host IPs
+              services = map (
+                svc:
+                let
+                  hostInfo = sharedData.hosts.${svc.host} or { };
+                in
+                svc
+                // {
+                  lanIP = hostInfo.lanIP or null;
+                  tailscaleIP = hostInfo.tailscaleIP or null;
+                }
+              ) sharedData.services;
+
+              # Helper to extract subdomain from full domain (e.g., "git.baduhai.dev" -> "git")
+              getSubdomain = domain: lib.head (lib.splitString "." domain);
+
+              # Generate DNS records for services
+              # Public services point to trantor's public IP
+              # Private services point to their tailscale IP
+              mkServiceRecords = lib.listToAttrs (
+                lib.imap0 (
+                  i: svc:
+                  let
+                    subdomain = getSubdomain svc.domain;
+                    targetIP =
+                      if svc.public or false then
+                        config.data.terraform_remote_state.trantor "outputs.instance_public_ip"
+                      else
+                        svc.tailscaleIP;
+                  in
+                  {
+                    name = "service_${toString i}";
+                    value = {
+                      zone_id = config.variable.zone_id.default;
+                      name = subdomain;
+                      type = "A";
+                      content = targetIP;
+                      proxied = false;
+                      ttl = 3600;
+                    };
+                  }
+                ) services
+              );
+            in
+
+            {
+              terraform.required_providers.cloudflare = {
+                source = "cloudflare/cloudflare";
+                version = "~> 5.0";
+              };
+
+              terraform.backend.s3 = {
+                bucket = "terraform-state";
+                key = "cloudflare/baduhai.dev.tfstate";
+                region = "auto";
+                endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
+                skip_credentials_validation = true;
+                skip_metadata_api_check = true;
+                skip_region_validation = true;
+                skip_requesting_account_id = true;
+                use_path_style = true;
+              };
+
+              variable = {
+                zone_id = {
+                  default = "c63a8332fdddc4a8e5612ddc54557044";
+                  type = "string";
+                };
+              };
+
+              data = {
+                terraform_remote_state.trantor = {
+                  backend = "s3";
+                  config = {
+                    bucket = "terraform-state";
+                    key = "oci/trantor.tfstate";
+                    region = "auto";
+                    endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
+                    skip_credentials_validation = true;
+                    skip_metadata_api_check = true;
+                    skip_region_validation = true;
+                    skip_requesting_account_id = true;
+                    use_path_style = true;
+                  };
+                };
+              };
+
+              resource.cloudflare_dns_record = mkServiceRecords;
+            }
+          )
+        ];
+      };
+    };
+}
diff --git a/terranix/cloudflare/baduhai.dev.nix b/terranix/cloudflare/baduhai.dev.nix
deleted file mode 100644
index e69de29..0000000
diff --git a/terranix/cloudflare/kernelpanic.space.nix b/terranix/cloudflare/kernelpanic.space.nix
deleted file mode 100644
index e69de29..0000000
diff --git a/terranix/kernelpanic.space.nix b/terranix/kernelpanic.space.nix
new file mode 100644
index 0000000..91b615e
--- /dev/null
+++ b/terranix/kernelpanic.space.nix
@@ -0,0 +1,20 @@
+# Cloudflare kernelpanic.space configuration placeholder
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.cloudflare-kernelpanicspace = {
+        terraformWrapper.package = pkgs.opentofu;
+        modules = [
+          (
+            { config, ... }:
+            {
+              # Terraform config goes here
+            }
+          )
+        ];
+      };
+    };
+}
diff --git a/terranix/oci/terminus.nix b/terranix/oci/terminus.nix
deleted file mode 100644
index e69de29..0000000
diff --git a/terranix/oci/trantor.nix b/terranix/oci/trantor.nix
deleted file mode 100644
index 37c12ae..0000000
--- a/terranix/oci/trantor.nix
+++ /dev/null
@@ -1,246 +0,0 @@
-{ config, ... }:
-
-{
-  terraform.required_providers.oci = {
-    source = "oracle/oci";
-    version = "~> 7.0";
-  };
-
-  provider.oci.region = "sa-saopaulo-1";
-
-  terraform.backend.s3 = {
-    bucket = "terraform-state";
-    key = "oci/trantor.tfstate";
-    region = "auto";
-    endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
-    skip_credentials_validation = true;
-    skip_metadata_api_check = true;
-    skip_region_validation = true;
-    skip_requesting_account_id = true;
-    use_path_style = true;
-  };
-
-  variable = {
-    tenancy_ocid = {
-      default = "ocid1.tenancy.oc1..aaaaaaaap3vfdz4piygqza6e6zqunbcuso43ddqfo3ydmpmnomidyghh7rvq";
-      type = "string";
-    };
-
-    compartment_name = {
-      default = "trantor";
-      type = "string";
-    };
-
-    vcn_cidr = {
-      default = "10.0.0.0/24";
-      type = "string";
-    };
-
-    instance_name = {
-      default = "trantor";
-      type = "string";
-    };
-
-    ssh_public_keys = {
-      default = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
-      ];
-      type = "list(string)";
-    };
-  };
-
-  data = {
-    oci_identity_availability_domains.ads = {
-      compartment_id = config.variable.tenancy_ocid.default;
-    };
-
-    oci_core_images.ubuntu_arm = {
-      compartment_id = config.variable.tenancy_ocid.default;
-      operating_system = "Canonical Ubuntu";
-      operating_system_version = "24.04";
-      shape = "VM.Standard.A1.Flex";
-      sort_by = "TIMECREATED";
-      sort_order = "DESC";
-    };
-  };
-
-  resource = {
-    oci_identity_compartment.trantor = {
-      compartment_id = config.variable.tenancy_ocid.default;
-      description = "trantor infrastructure compartment";
-      name = config.variable.compartment_name.default;
-    };
-
-    oci_core_vcn.vcn = {
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      cidr_blocks = [ config.variable.vcn_cidr.default ];
-      display_name = "trantor-vcn";
-      dns_label = "trantor";
-    };
-
-    oci_core_internet_gateway.ig = {
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      vcn_id = config.resource.oci_core_vcn.vcn "id";
-      display_name = "trantor-ig";
-      enabled = true;
-    };
-
-    oci_core_route_table.rt = {
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      vcn_id = config.resource.oci_core_vcn.vcn "id";
-      display_name = "trantor-rt";
-
-      route_rules = [
-        {
-          network_entity_id = config.resource.oci_core_internet_gateway.ig "id";
-          destination = "0.0.0.0/0";
-          destination_type = "CIDR_BLOCK";
-        }
-      ];
-    };
-
-    oci_core_security_list.sl = {
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      vcn_id = config.resource.oci_core_vcn.vcn "id";
-      display_name = "trantor-sl";
-
-      egress_security_rules = [
-        {
-          destination = "0.0.0.0/0";
-          protocol = "all";
-          stateless = false;
-        }
-      ];
-
-      ingress_security_rules = [
-        {
-          protocol = "6"; # TCP
-          source = "0.0.0.0/0";
-          stateless = false;
-          tcp_options = {
-            min = 22;
-            max = 22;
-          };
-        }
-        {
-          protocol = "6"; # TCP
-          source = "0.0.0.0/0";
-          stateless = false;
-          tcp_options = {
-            min = 80;
-            max = 80;
-          };
-        }
-        {
-          protocol = "6"; # TCP
-          source = "0.0.0.0/0";
-          stateless = false;
-          tcp_options = {
-            min = 443;
-            max = 443;
-          };
-        }
-        {
-          protocol = "6"; # TCP
-          source = "0.0.0.0/0";
-          stateless = false;
-          tcp_options = {
-            min = 25565;
-            max = 25565;
-          };
-        }
-        {
-          protocol = "6"; # TCP
-          source = "0.0.0.0/0";
-          stateless = false;
-          tcp_options = {
-            min = 19132;
-            max = 19133;
-          };
-        }
-        {
-          protocol = "17"; # UDP
-          source = "0.0.0.0/0";
-          stateless = false;
-          udp_options = {
-            min = 19132;
-            max = 19133;
-          };
-        }
-      ];
-    };
-
-    oci_core_subnet.subnet = {
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      vcn_id = config.resource.oci_core_vcn.vcn "id";
-      cidr_block = config.variable.vcn_cidr.default;
-      display_name = "trantor-subnet";
-      dns_label = "subnet";
-      route_table_id = config.resource.oci_core_route_table.rt "id";
-      security_list_ids = [ (config.resource.oci_core_security_list.sl "id") ];
-      prohibit_public_ip_on_vnic = false;
-    };
-
-    oci_core_instance.trantor = {
-      availability_domain = config.data.oci_identity_availability_domains.ads "availability_domains[0].name";
-      compartment_id = config.resource.oci_identity_compartment.trantor "id";
-      display_name = config.variable.instance_name.default;
-      shape = "VM.Standard.A1.Flex";
-
-      shape_config = {
-        ocpus = 2;
-        memory_in_gbs = 12;
-      };
-
-      source_details = {
-        source_type = "image";
-        source_id = config.data.oci_core_images.ubuntu_arm "images[0].id";
-        boot_volume_size_in_gbs = 100;
-      };
-
-      create_vnic_details = {
-        subnet_id = config.resource.oci_core_subnet.subnet "id";
-        display_name = "trantor-vnic";
-        assign_public_ip = true;
-        hostname_label = config.variable.instance_name.default;
-      };
-
-      metadata = {
-        ssh_authorized_keys = builtins.concatStringsSep "\n" config.variable.ssh_public_keys.default;
-      };
-
-      preserve_boot_volume = false;
-    };
-
-    oci_budget_budget.trantor_budget = {
-      compartment_id = config.variable.tenancy_ocid.default;
-      targets = [ (config.resource.oci_identity_compartment.trantor "id") ];
-      amount = 1;
-      reset_period = "MONTHLY";
-      display_name = "trantor-budget";
-      description = "Monthly budget for trantor compartment";
-      target_type = "COMPARTMENT";
-    };
-
-    oci_budget_alert_rule.daily_spend_alert = {
-      budget_id = config.resource.oci_budget_budget.trantor_budget "id";
-      type = "ACTUAL";
-      threshold = 5;
-      threshold_type = "PERCENTAGE";
-      display_name = "daily-spend-alert";
-      description = "Alert when daily spending exceeds $0.05";
-      message = "Daily spending has exceeded $0.05 in the trantor compartment";
-    };
-  };
-
-  output = {
-    compartment_id = {
-      value = config.resource.oci_identity_compartment.trantor "id";
-    };
-
-    instance_public_ip = {
-      value = config.resource.oci_core_instance.trantor "public_ip";
-    };
-  };
-}
diff --git a/terranix/tailnet.nix b/terranix/tailnet.nix
new file mode 100644
index 0000000..4e01ab9
--- /dev/null
+++ b/terranix/tailnet.nix
@@ -0,0 +1,57 @@
+# Required environment variables:
+#   TAILSCALE_API_KEY - Tailscale API key with appropriate permissions
+#   TAILSCALE_TAILNET - Your tailnet name (e.g., "user@example.com" or "example.org.github")
+#   AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
+#   AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
+
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.tailscale-tailnet = {
+        terraformWrapper.package = pkgs.opentofu;
+        modules = [
+          (
+            { config, ... }:
+            {
+              terraform.required_providers.tailscale = {
+                source = "tailscale/tailscale";
+                version = "~> 0.17";
+              };
+
+              terraform.backend.s3 = {
+                bucket = "terraform-state";
+                key = "tailscale/tailnet.tfstate";
+                region = "auto";
+                endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
+                skip_credentials_validation = true;
+                skip_metadata_api_check = true;
+                skip_region_validation = true;
+                skip_requesting_account_id = true;
+                use_path_style = true;
+              };
+
+              variable = {
+                trantor_tailscale_ip = {
+                  default = "100.108.5.90";
+                  type = "string";
+                };
+              };
+
+              resource = {
+                tailscale_dns_nameservers.global = {
+                  nameservers = [
+                    config.variable.trantor_tailscale_ip.default
+                    "1.1.1.1"
+                    "1.0.0.1"
+                  ];
+                };
+              };
+            }
+          )
+        ];
+      };
+    };
+}
diff --git a/terranix/tailscale/tailnet.nix b/terranix/tailscale/tailnet.nix
deleted file mode 100644
index e69de29..0000000
diff --git a/terranix/terminus.nix b/terranix/terminus.nix
new file mode 100644
index 0000000..d7689f9
--- /dev/null
+++ b/terranix/terminus.nix
@@ -0,0 +1,20 @@
+# OCI Terminus configuration placeholder
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.oci-terminus = {
+        terraformWrapper.package = pkgs.opentofu;
+        modules = [
+          (
+            { config, ... }:
+            {
+              # Terraform config goes here
+            }
+          )
+        ];
+      };
+    };
+}
diff --git a/terranix/trantor.nix b/terranix/trantor.nix
new file mode 100644
index 0000000..5f19e22
--- /dev/null
+++ b/terranix/trantor.nix
@@ -0,0 +1,272 @@
+# Required environment variables:
+#   instead of OCI variables, ~/.oci/config may also be used
+#   OCI_TENANCY_OCID - Oracle tenancy OCID (or use TF_VAR_* to override variables)
+#   OCI_USER_OCID - Oracle user OCID
+#   OCI_FINGERPRINT - API key fingerprint
+#   OCI_PRIVATE_KEY_PATH - Path to OCI API private key
+#   AWS variables are required
+#   AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
+#   AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
+
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.oci-trantor = {
+        terraformWrapper.package = pkgs.opentofu;
+        modules = [
+          (
+            { config, ... }:
+            {
+              terraform.required_providers.oci = {
+                source = "oracle/oci";
+                version = "~> 7.0";
+              };
+
+              provider.oci.region = "sa-saopaulo-1";
+
+              terraform.backend.s3 = {
+                bucket = "terraform-state";
+                key = "oci/trantor.tfstate";
+                region = "auto";
+                endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
+                skip_credentials_validation = true;
+                skip_metadata_api_check = true;
+                skip_region_validation = true;
+                skip_requesting_account_id = true;
+                use_path_style = true;
+              };
+
+              variable = {
+                tenancy_ocid = {
+                  default = "ocid1.tenancy.oc1..aaaaaaaap3vfdz4piygqza6e6zqunbcuso43ddqfo3ydmpmnomidyghh7rvq";
+                  type = "string";
+                };
+
+                compartment_name = {
+                  default = "trantor";
+                  type = "string";
+                };
+
+                vcn_cidr = {
+                  default = "10.0.0.0/24";
+                  type = "string";
+                };
+
+                instance_name = {
+                  default = "trantor";
+                  type = "string";
+                };
+
+                ssh_public_keys = {
+                  default = [
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
+                  ];
+                  type = "list(string)";
+                };
+              };
+
+              data = {
+                oci_identity_availability_domains.ads = {
+                  compartment_id = config.variable.tenancy_ocid.default;
+                };
+
+                oci_core_images.ubuntu_arm = {
+                  compartment_id = config.variable.tenancy_ocid.default;
+                  operating_system = "Canonical Ubuntu";
+                  operating_system_version = "24.04";
+                  shape = "VM.Standard.A1.Flex";
+                  sort_by = "TIMECREATED";
+                  sort_order = "DESC";
+                };
+              };
+
+              resource = {
+                oci_identity_compartment.trantor = {
+                  compartment_id = config.variable.tenancy_ocid.default;
+                  description = "trantor infrastructure compartment";
+                  name = config.variable.compartment_name.default;
+                };
+
+                oci_core_vcn.vcn = {
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  cidr_blocks = [ config.variable.vcn_cidr.default ];
+                  display_name = "trantor-vcn";
+                  dns_label = "trantor";
+                };
+
+                oci_core_internet_gateway.ig = {
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  vcn_id = config.resource.oci_core_vcn.vcn "id";
+                  display_name = "trantor-ig";
+                  enabled = true;
+                };
+
+                oci_core_route_table.rt = {
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  vcn_id = config.resource.oci_core_vcn.vcn "id";
+                  display_name = "trantor-rt";
+
+                  route_rules = [
+                    {
+                      network_entity_id = config.resource.oci_core_internet_gateway.ig "id";
+                      destination = "0.0.0.0/0";
+                      destination_type = "CIDR_BLOCK";
+                    }
+                  ];
+                };
+
+                oci_core_security_list.sl = {
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  vcn_id = config.resource.oci_core_vcn.vcn "id";
+                  display_name = "trantor-sl";
+
+                  egress_security_rules = [
+                    {
+                      destination = "0.0.0.0/0";
+                      protocol = "all";
+                      stateless = false;
+                    }
+                  ];
+
+                  ingress_security_rules = [
+                    {
+                      protocol = "6"; # TCP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      tcp_options = {
+                        min = 22;
+                        max = 22;
+                      };
+                    }
+                    {
+                      protocol = "6"; # TCP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      tcp_options = {
+                        min = 80;
+                        max = 80;
+                      };
+                    }
+                    {
+                      protocol = "6"; # TCP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      tcp_options = {
+                        min = 443;
+                        max = 443;
+                      };
+                    }
+                    {
+                      protocol = "6"; # TCP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      tcp_options = {
+                        min = 25565;
+                        max = 25565;
+                      };
+                    }
+                    {
+                      protocol = "6"; # TCP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      tcp_options = {
+                        min = 19132;
+                        max = 19133;
+                      };
+                    }
+                    {
+                      protocol = "17"; # UDP
+                      source = "0.0.0.0/0";
+                      stateless = false;
+                      udp_options = {
+                        min = 19132;
+                        max = 19133;
+                      };
+                    }
+                  ];
+                };
+
+                oci_core_subnet.subnet = {
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  vcn_id = config.resource.oci_core_vcn.vcn "id";
+                  cidr_block = config.variable.vcn_cidr.default;
+                  display_name = "trantor-subnet";
+                  dns_label = "subnet";
+                  route_table_id = config.resource.oci_core_route_table.rt "id";
+                  security_list_ids = [ (config.resource.oci_core_security_list.sl "id") ];
+                  prohibit_public_ip_on_vnic = false;
+                };
+
+                oci_core_instance.trantor = {
+                  availability_domain = config.data.oci_identity_availability_domains.ads "availability_domains[0].name";
+                  compartment_id = config.resource.oci_identity_compartment.trantor "id";
+                  display_name = config.variable.instance_name.default;
+                  shape = "VM.Standard.A1.Flex";
+
+                  shape_config = {
+                    ocpus = 2;
+                    memory_in_gbs = 12;
+                  };
+
+                  source_details = {
+                    source_type = "image";
+                    source_id = config.data.oci_core_images.ubuntu_arm "images[0].id";
+                    boot_volume_size_in_gbs = 100;
+                  };
+
+                  create_vnic_details = {
+                    subnet_id = config.resource.oci_core_subnet.subnet "id";
+                    display_name = "trantor-vnic";
+                    assign_public_ip = true;
+                    hostname_label = config.variable.instance_name.default;
+                  };
+
+                  metadata = {
+                    ssh_authorized_keys = builtins.concatStringsSep "\n" config.variable.ssh_public_keys.default;
+                  };
+
+                  preserve_boot_volume = false;
+                };
+
+                oci_budget_budget.trantor_budget = {
+                  compartment_id = config.variable.tenancy_ocid.default;
+                  targets = [ (config.resource.oci_identity_compartment.trantor "id") ];
+                  amount = 1;
+                  reset_period = "MONTHLY";
+                  display_name = "trantor-budget";
+                  description = "Monthly budget for trantor compartment";
+                  target_type = "COMPARTMENT";
+                };
+
+                oci_budget_alert_rule.daily_spend_alert = {
+                  budget_id = config.resource.oci_budget_budget.trantor_budget "id";
+                  type = "ACTUAL";
+                  threshold = 5;
+                  threshold_type = "PERCENTAGE";
+                  display_name = "daily-spend-alert";
+                  recipients = "baduhai@proton.me";
+                  description = "Alert when daily spending exceeds $0.05";
+                  message = "Daily spending has exceeded $0.05 in the trantor compartment";
+                };
+              };
+
+              output = {
+                compartment_id = {
+                  value = config.resource.oci_identity_compartment.trantor "id";
+                };
+
+                instance_public_ip = {
+                  value = config.resource.oci_core_instance.trantor "public_ip";
+                };
+              };
+            }
+          )
+        ];
+      };
+    };
+}
diff --git a/terranixConfigurations.nix b/terranixConfigurations.nix
deleted file mode 100644
index fc84f17..0000000
--- a/terranixConfigurations.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ inputs, ... }:
-
-{
-  imports = [
-    inputs.terranix.flakeModule
-  ];
-
-  perSystem =
-    { pkgs, ... }:
-
-    {
-      terranix.terranixConfigurations = {
-        oci-trantor = {
-          modules = [ ./terranix/oci/trantor.nix ];
-          terraformWrapper.package = pkgs.opentofu;
-        };
-      };
-    };
-}
diff --git a/users/modules/btop.nix b/users/modules/btop.nix
deleted file mode 100644
index c19c4bb..0000000
--- a/users/modules/btop.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.btop = {
-    enable = true;
-    settings = {
-      theme_background = false;
-      proc_sorting = "cpu direct";
-      update_ms = 500;
-    };
-  };
-}
\ No newline at end of file
diff --git a/users/modules/comma.nix b/users/modules/comma.nix
deleted file mode 100644
index 0aad530..0000000
--- a/users/modules/comma.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ inputs, ... }:
-
-{
-  imports = [ inputs.nix-index-database.homeModules.nix-index ];
-
-  programs.nix-index-database.comma.enable = true;
-}
diff --git a/users/modules/common/bash.nix b/users/modules/common/bash.nix
deleted file mode 100644
index a5a0823..0000000
--- a/users/modules/common/bash.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.bash = {
-    enable = true;
-    historyFile = "~/.cache/bash_history";
-  };
-}
\ No newline at end of file
diff --git a/users/modules/common/fish.nix b/users/modules/common/fish.nix
deleted file mode 100644
index d95db24..0000000
--- a/users/modules/common/fish.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ pkgs, lib, ... }:
-
-{
-  programs.fish = {
-    enable = true;
-    interactiveShellInit = "${lib.getExe pkgs.nix-your-shell} fish | source";
-    loginShellInit = "${lib.getExe pkgs.nix-your-shell} fish | source";
-    plugins = [
-      {
-        name = "bang-bang";
-        src = pkgs.fetchFromGitHub {
-          owner = "oh-my-fish";
-          repo = "plugin-bang-bang";
-          rev = "f969c618301163273d0a03d002614d9a81952c1e";
-          sha256 = "sha256-A8ydBX4LORk+nutjHurqNNWFmW6LIiBPQcxS3x4nbeQ=";
-        };
-      }
-      {
-        name = "z";
-        src = pkgs.fetchFromGitHub {
-          owner = "jethrokuan";
-          repo = "z";
-          rev = "067e867debee59aee231e789fc4631f80fa5788e";
-          sha256 = "sha256-emmjTsqt8bdI5qpx1bAzhVACkg0MNB/uffaRjjeuFxU=";
-        };
-      }
-    ];
-  };
-}
diff --git a/users/modules/common/hm-cli.nix b/users/modules/common/hm-cli.nix
deleted file mode 100644
index d2ed715..0000000
--- a/users/modules/common/hm-cli.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ pkgs, ... }:
-
-{
-  home = {
-    packages = with pkgs; [ hm-cli ];
-    sessionVariables = {
-      HM_PATH = "/etc/nixos";
-    };
-  };
-}
diff --git a/users/modules/desktop/desktop.nix b/users/modules/desktop/desktop.nix
deleted file mode 100644
index ba30852..0000000
--- a/users/modules/desktop/desktop.nix
+++ /dev/null
@@ -1,131 +0,0 @@
-{
-  config,
-  inputs,
-  pkgs,
-  ...
-}:
-
-{
-  fonts.fontconfig.enable = true;
-
-  home.packages = with pkgs; [ xwayland-satellite ];
-
-  programs = {
-
-    ghostty = {
-      enable = true;
-      settings = {
-        cursor-style = "block";
-        shell-integration-features = "no-cursor";
-        cursor-style-blink = false;
-        custom-shader = "${builtins.fetchurl {
-          url = "https://raw.githubusercontent.com/hackr-sh/ghostty-shaders/cb6eb4b0d1a3101c869c62e458b25a826f9dcde3/cursor_blaze.glsl";
-          sha256 = "sha256:0g2lgqjdrn3c51glry7x2z30y7ml0y61arl5ykmf4yj0p85s5f41";
-        }}";
-        bell-features = "border";
-        gtk-titlebar-style = "tabs";
-        keybind = [ "shift+enter=text:\\x1b\\r" ];
-      };
-    };
-
-    password-store = {
-      enable = true;
-      package = pkgs.pass-wayland;
-    };
-  };
-
-  xdg = {
-    enable = true;
-    userDirs.enable = true;
-    mimeApps = {
-      enable = true;
-      defaultApplications = {
-        "text/html" = [
-          "com.github.timecraft.junction.desktop"
-          "zen-browser.desktop"
-          "brave-browser.desktop"
-          "torbrowser.desktop"
-        ];
-        "x-scheme-handler/http" = [
-          "com.github.timecraft.junction.desktop"
-          "zen-browser.desktop"
-          "brave-browser.desktop"
-          "torbrowser.desktop"
-        ];
-        "x-scheme-handler/https" = [
-          "com.github.timecraft.junction.desktop"
-          "zen-browser.desktop"
-          "brave-browser.desktop"
-          "torbrowser.desktop"
-        ];
-        "x-scheme-handler/about" = [
-          "com.github.timecraft.junction.desktop"
-          "zen-browser.desktop"
-          "brave-browser.desktop"
-          "torbrowser.desktop"
-        ];
-        "x-scheme-handler/unknown" = [
-          "com.github.timecraft.junction.desktop"
-          "zen-browser.desktop"
-          "brave-browser.desktop"
-          "torbrowser.desktop"
-        ];
-        "image/jpeg" = "org.gnome.Loupe.desktop";
-        "image/png" = "org.gnome.Loupe.desktop";
-        "image/gif" = "org.gnome.Loupe.desktop";
-        "image/webp" = "org.gnome.Loupe.desktop";
-        "image/bmp" = "org.gnome.Loupe.desktop";
-        "image/svg+xml" = "org.gnome.Loupe.desktop";
-        "image/tiff" = "org.gnome.Loupe.desktop";
-        "video/mp4" = "io.bassi.Showtime.desktop";
-        "video/x-matroska" = "io.bassi.Showtime.desktop";
-        "video/webm" = "io.bassi.Showtime.desktop";
-        "video/mpeg" = "io.bassi.Showtime.desktop";
-        "video/x-msvideo" = "io.bassi.Showtime.desktop";
-        "video/quicktime" = "io.bassi.Showtime.desktop";
-        "video/x-flv" = "io.bassi.Showtime.desktop";
-        "audio/mpeg" = "io.bassi.Showtime.desktop";
-        "audio/flac" = "io.bassi.Showtime.desktop";
-        "audio/ogg" = "io.bassi.Showtime.desktop";
-        "audio/wav" = "io.bassi.Showtime.desktop";
-        "audio/mp4" = "io.bassi.Showtime.desktop";
-        "audio/x-opus+ogg" = "io.bassi.Showtime.desktop";
-        "application/pdf" = [
-          "org.gnome.Papers.desktop"
-          "zen-browser.desktop"
-        ];
-        "text/plain" = "Helix.desktop";
-        "text/markdown" = "Helix.desktop";
-        "text/x-log" = "Helix.desktop";
-        "application/x-shellscript" = "Helix.desktop";
-        "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
-          "onlyoffice-desktopeditors.desktop"; # DOCX
-        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" =
-          "onlyoffice-desktopeditors.desktop"; # XLSX
-        "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
-          "onlyoffice-desktopeditors.desktop"; # PPTX
-        "application/vnd.oasis.opendocument.text" = "onlyoffice-desktopeditors.desktop"; # ODT
-        "application/vnd.oasis.opendocument.spreadsheet" = "onlyoffice-desktopeditors.desktop"; # ODS
-        "application/vnd.oasis.opendocument.presentation" = "onlyoffice-desktopeditors.desktop"; # ODP
-        "application/msword" = "onlyoffice-desktopeditors.desktop"; # DOC
-        "application/vnd.ms-excel" = "onlyoffice-desktopeditors.desktop"; # XLS
-        "application/vnd.ms-powerpoint" = "onlyoffice-desktopeditors.desktop"; # PPT
-        "application/zip" = "org.gnome.FileRoller.desktop";
-        "application/x-tar" = "org.gnome.FileRoller.desktop";
-        "application/x-compressed-tar" = "org.gnome.FileRoller.desktop";
-        "application/x-bzip-compressed-tar" = "org.gnome.FileRoller.desktop";
-        "application/x-xz-compressed-tar" = "org.gnome.FileRoller.desktop";
-        "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
-        "application/x-rar" = "org.gnome.FileRoller.desktop";
-        "application/gzip" = "org.gnome.FileRoller.desktop";
-        "application/x-bzip" = "org.gnome.FileRoller.desktop";
-        "inode/directory" = "org.gnome.Nautilus.desktop";
-      };
-    };
-  };
-
-  # Set Ghostty as default terminal
-  home.sessionVariables = {
-    TERMINAL = "ghostty";
-  };
-}
diff --git a/users/modules/desktop/niri.nix b/users/modules/desktop/niri.nix
deleted file mode 100644
index 16955d9..0000000
--- a/users/modules/desktop/niri.nix
+++ /dev/null
@@ -1,228 +0,0 @@
-{
-  inputs,
-  lib,
-  pkgs,
-  hostname ? null,
-  ...
-}:
-
-let
-  isRotterdam = hostname == "rotterdam";
-  noctalia = "${lib.getExe inputs.noctalia.packages.${pkgs.system}.default}";
-in
-
-{
-  imports = [ inputs.noctalia.homeModules.default ];
-
-  home = {
-    packages = with pkgs; [ xwayland-satellite ];
-    sessionVariables.QT_QPA_PLATFORMTHEME = "gtk3";
-  };
-
-  xdg.configFile."niri/config.kdl".text = ''
-    output "eDP-1" {
-      scale 1.0
-    }
-    output "DP-3" {
-      scale 1.0
-    }
-
-    input {
-      keyboard {
-        xkb {
-          layout "us"
-          variant "altgr-intl"
-        }
-      }
-      touchpad {
-        tap
-        dwt
-        drag true
-        drag-lock
-        natural-scroll
-        accel-speed 0.2
-        accel-profile "flat"
-        scroll-method "two-finger"
-        middle-emulation
-      }
-      mouse {
-        natural-scroll
-        accel-speed 0.2
-        accel-profile "flat"
-      }
-      warp-mouse-to-focus mode="center-xy"
-      focus-follows-mouse
-    }
-
-    layout {
-      gaps 8
-      center-focused-column "never"
-      auto-center-when-space-available
-      preset-column-widths {
-        ${
-          if isRotterdam then
-            ''
-              proportion 0.33333
-                  proportion 0.5
-                  proportion 0.66667
-            ''
-          else
-            ''
-              proportion 0.5
-                  proportion 1.0
-            ''
-        }
-      }
-      default-column-width { proportion ${if isRotterdam then "0.33333" else "0.5"}; }
-      focus-ring {
-        off
-      }
-      border {
-        width 4
-        active-color "#ffc87f"
-        inactive-color "#505050"
-        urgent-color "#9b0000"
-      }
-        tab-indicator {
-          width 4
-          gap 4
-          place-within-column
-        }
-        ${lib.optionalString isRotterdam ''
-          struts {
-            left 8
-            right 8
-          }''}
-    }
-
-    overview {
-      zoom 0.65
-    }
-
-    spawn-at-startup "${noctalia}"
-    layer-rule {
-      match namespace="^wallpaper$"
-        place-within-backdrop true
-    }
-    layer-rule {
-      match namespace="^quickshell-overview$"
-      place-within-backdrop true
-    }
-
-    hotkey-overlay {
-      skip-at-startup
-    }
-
-    prefer-no-csd
-    screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
-
-    animations {
-      slowdown 0.3
-    }
-
-    window-rule {
-      match app-id="zen"
-      default-column-width { proportion ${if isRotterdam then "0.5" else "1.0"}; }
-    }
-
-    window-rule {
-      geometry-corner-radius 12
-      clip-to-geometry true
-    }
-
-    config-notification {
-      disable-failed
-    }
-
-    binds {
-      Alt+Space { spawn "${noctalia}" "ipc" "call" "launcher" "toggle"; }
-      XF86AudioRaiseVolume allow-when-locked=true { spawn "${noctalia}" "ipc" "call" "volume" "increase"; }
-      XF86AudioLowerVolume allow-when-locked=true { spawn "${noctalia}" "ipc" "call" "volume" "decrease"; }
-      XF86AudioMute allow-when-locked=true { spawn "${noctalia}" "ipc" "call" "volume" "muteOutput"; }
-      XF86MonBrightnessUp allow-when-locked=true { spawn "${noctalia}" "ipc" "call" "brightness" "increase"; }
-      XF86MonBrightnessDown allow-when-locked=true { spawn "${noctalia}" "ipc" "call" "brightness" "decrease"; }
-      XF86AudioPlay        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "play-pause"; }
-      XF86AudioStop        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "stop"; }
-      XF86AudioPrev        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "previous"; }
-      XF86AudioNext        allow-when-locked=true { spawn "${lib.getExe pkgs.playerctl}" "next"; }
-      Mod+V { spawn "${noctalia}" "ipc" "call" "launcher" "clipboard"; }
-      Mod+Shift+L { spawn "${noctalia}" "ipc" "call" "lockScreen" "toggle"; }
-      Mod+Return { spawn "ghostty"; }
-      Ctrl+Alt+Shift+A allow-when-locked=true { spawn "toggleaudiosink"; }
-      Mod+W repeat=false { toggle-overview; }
-      Mod+Q { close-window; }
-      Alt+Shift+Q { close-window;}
-      Mod+Shift+Q { close-window; }
-      Alt+F4 { close-window; }
-      Mod+Left  { focus-column-left; }
-      Mod+Down  { focus-window-down; }
-      Mod+Up    { focus-window-up; }
-      Mod+Right { focus-column-right; }
-      Mod+H     { focus-column-left; }
-      Mod+L     { focus-column-right; }
-      Mod+J     { focus-window-down; }
-      Mod+K     { focus-window-up; }
-      Ctrl+Alt+J    { focus-workspace-down; }
-      Ctrl+Alt+K    { focus-workspace-up; }
-      Ctrl+Alt+Down { focus-workspace-down; }
-      Ctrl+Alt+Up   { focus-workspace-up; }
-      Mod+Ctrl+Left  { move-column-left; }
-      Mod+Ctrl+Down  { move-window-down-or-to-workspace-down; }
-      Mod+Ctrl+Up    { move-window-up-or-to-workspace-up; }
-      Mod+Ctrl+Right { move-column-right; }
-      Mod+Ctrl+H     { move-column-left; }
-      Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
-      Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
-      Mod+Ctrl+L     { move-column-right; }
-      Mod+Home { focus-column-first; }
-      Mod+End  { focus-column-last; }
-      Mod+Ctrl+Home { move-column-to-first; }
-      Mod+Ctrl+End  { move-column-to-last; }
-      Mod+Alt+Left  { focus-monitor-left; }
-      Mod+Alt+Down  { focus-monitor-down; }
-      Mod+Alt+Up    { focus-monitor-up; }
-      Mod+Alt+Right { focus-monitor-right; }
-      Mod+Alt+H     { focus-monitor-left; }
-      Mod+Alt+J     { focus-monitor-down; }
-      Mod+Alt+K     { focus-monitor-up; }
-      Mod+Alt+L     { focus-monitor-right; }
-      Mod+Alt+Ctrl+Left  { move-column-to-monitor-left; }
-      Mod+Alt+Ctrl+Down  { move-column-to-monitor-down; }
-      Mod+Alt+Ctrl+Up    { move-column-to-monitor-up; }
-      Mod+Alt+Ctrl+Right { move-column-to-monitor-right; }
-      Mod+Alt+Ctrl+H     { move-column-to-monitor-left; }
-      Mod+Alt+Ctrl+J     { move-column-to-monitor-down; }
-      Mod+Alt+Ctrl+K     { move-column-to-monitor-up; }
-      Mod+Alt+Ctrl+L     { move-column-to-monitor-right; }
-      Mod+Ctrl+U         { move-workspace-down; }
-      Mod+Ctrl+I         { move-workspace-up; }
-      Mod+WheelScrollDown      cooldown-ms=150 { focus-workspace-down; }
-      Mod+WheelScrollUp        cooldown-ms=150 { focus-workspace-up; }
-      Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; }
-      Mod+Ctrl+WheelScrollUp   cooldown-ms=150 { move-column-to-workspace-up; }
-      Mod+Shift+WheelScrollDown      { focus-column-right; }
-      Mod+Shift+WheelScrollUp        { focus-column-left; }
-      Mod+Ctrl+Shift+WheelScrollDown { move-column-right; }
-      Mod+Ctrl+Shift+WheelScrollUp   { move-column-left; }
-      Mod+BracketLeft  { consume-or-expel-window-left; }
-      Mod+BracketRight { consume-or-expel-window-right; }
-      Mod+Comma  { consume-window-into-column; }
-      Mod+Period { expel-window-from-column; }
-      Mod+R { switch-preset-column-width; }
-      Mod+F { maximize-column; }
-      Mod+Ctrl+F { fullscreen-window; }
-      Mod+C { center-visible-columns; }
-      Mod+Ctrl+C { center-column; }
-      Mod+Space       { toggle-window-floating; }
-      Mod+Ctrl+Space  { switch-focus-between-floating-and-tiling; }
-      Mod+T { toggle-column-tabbed-display; }
-      Print { screenshot-screen; }
-      Mod+Print { screenshot; }
-      Ctrl+Print { screenshot-window; }
-      Mod+Backspace allow-inhibiting=false { toggle-keyboard-shortcuts-inhibit; }
-      Mod+Alt+E { spawn "${noctalia}" "ipc" "call" "sessionMenu" "toggle"; }
-      Ctrl+Alt+Delete { spawn "${noctalia}" "ipc" "call" "sessionMenu" "toggle"; }
-      Mod+Ctrl+P { power-off-monitors; }
-    }
-  '';
-}
diff --git a/users/modules/direnv.nix b/users/modules/direnv.nix
deleted file mode 100644
index c91d0af..0000000
--- a/users/modules/direnv.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.direnv = {
-    enable = true;
-    nix-direnv.enable = true;
-  };
-}
\ No newline at end of file
diff --git a/users/modules/gaming.nix b/users/modules/gaming.nix
deleted file mode 100644
index df33b11..0000000
--- a/users/modules/gaming.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-    programs.mangohud.enable = true;
-}
diff --git a/users/modules/helix.nix b/users/modules/helix.nix
deleted file mode 100644
index a72ead3..0000000
--- a/users/modules/helix.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{ pkgs, ... }:
-
-{
-  home.sessionVariables = {
-    EDITOR = "hx";
-  };
-
-  programs.helix = {
-    enable = true;
-    settings = {
-      editor = {
-        file-picker.hidden = false;
-        idle-timeout = 0;
-        line-number = "relative";
-        cursor-shape = {
-          normal = "underline";
-          insert = "bar";
-          select = "underline";
-        };
-        soft-wrap.enable = true;
-        auto-format = true;
-        indent-guides.render = true;
-      };
-      keys.normal = {
-        space = {
-          o = "file_picker_in_current_buffer_directory";
-          esc = [
-            "collapse_selection"
-            "keep_primary_selection"
-          ];
-        };
-      };
-    };
-    languages = {
-      language = [
-        {
-          name = "nix";
-          auto-format = true;
-          formatter.command = "nixfmt";
-        }
-        {
-          name = "typst";
-          auto-format = true;
-          formatter.command = "typstyle -c 1000 -i";
-        }
-      ];
-    };
-  };
-}
diff --git a/users/modules/obs-studio.nix b/users/modules/obs-studio.nix
deleted file mode 100644
index 67e3b8b..0000000
--- a/users/modules/obs-studio.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.obs-studio = {
-    enable = true;
-    plugins = [
-      pkgs.obs-studio-plugins.obs-vkcapture
-      pkgs.obs-studio-plugins.obs-backgroundremoval
-      pkgs.obs-studio-plugins.obs-pipewire-audio-capture
-    ];
-  };
-
-}
diff --git a/users/modules/starship.nix b/users/modules/starship.nix
deleted file mode 100644
index c836c51..0000000
--- a/users/modules/starship.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.starship = {
-    enable = true;
-    enableBashIntegration = true;
-    enableFishIntegration = true;
-    settings = {
-      add_newline = false;
-      format = ''
-        $hostname$directory$git_branch$git_status$nix_shell
-        [ ❯ ](bold green)
-      '';
-      right_format = "$cmd_duration$character";
-      hostname = {
-        ssh_symbol = "󰖟 ";
-      };
-      character = {
-        error_symbol = "[](red)";
-        success_symbol = "[󱐋](green)";
-      };
-      cmd_duration = {
-        format = "[󰄉 $duration ]($style)";
-        style = "yellow";
-        min_time = 500;
-      };
-      git_branch = {
-        symbol = " ";
-        style = "purple";
-      };
-      git_status.style = "red";
-      nix_shell = {
-        format = "via [$symbol$state]($style)";
-        heuristic = true;
-        style = "blue";
-        symbol = "󱄅 ";
-      };
-    };
-  };
-}
diff --git a/users/modules/stylix.nix b/users/modules/stylix.nix
deleted file mode 100644
index 13ba8b6..0000000
--- a/users/modules/stylix.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  config,
-  inputs,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [
-    inputs.stylix.homeModules.stylix
-    inputs.zen-browser.homeModules.beta
-  ];
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/tokyodark.yaml";
-    cursor = {
-      package = pkgs.kdePackages.breeze;
-      name = "breeze_cursors";
-      size = 24;
-    };
-    icons = {
-      enable = true;
-      package = pkgs.morewaita-icon-theme;
-      light = "MoreWaita";
-      dark = "MoreWaita";
-    };
-    opacity = {
-      applications = 1.0;
-      desktop = 0.8;
-      popups = config.stylix.opacity.desktop;
-      terminal = 1.0;
-    };
-    fonts = {
-      serif = {
-        package = pkgs.source-serif;
-        name = "Source Serif 4 Display";
-      };
-      sansSerif = {
-        package = pkgs.inter;
-        name = "Inter";
-      };
-      monospace = {
-        package = pkgs.nerd-fonts.fira-code;
-        name = "FiraCode Nerd Font";
-      };
-      emoji = {
-        package = pkgs.noto-fonts-emoji;
-        name = "Noto Color Emoji";
-      };
-      sizes = {
-        applications = 10;
-        desktop = config.stylix.fonts.sizes.applications;
-        popups = config.stylix.fonts.sizes.applications;
-        terminal = 12;
-      };
-    };
-    targets.zen-browser = {
-      enable = true;
-      profileNames = [ "william" ];
-    };
-  };
-
-  programs.zen-browser = {
-    enable = true;
-    profiles.william = { };
-  };
-}
diff --git a/users/modules/tmux.nix b/users/modules/tmux.nix
deleted file mode 100644
index 4268e7a..0000000
--- a/users/modules/tmux.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.tmux = {
-    enable = true;
-    clock24 = true;
-    terminal = "xterm-256color";
-    mouse = true;
-    keyMode = "vi";
-  };
-}
\ No newline at end of file
diff --git a/utils.nix b/utils.nix
deleted file mode 100644
index 38cf968..0000000
--- a/utils.nix
+++ /dev/null
@@ -1,193 +0,0 @@
-{ inputs, lib }:
-
-let
-  inherit (inputs)
-    self
-    nixpkgs
-    nixpkgs-stable
-    home-manager
-    agenix
-    ;
-in
-
-{
-  # Tag-based host configuration system
-  mkHost =
-    {
-      hostname,
-      tags ? [ ],
-      system ? "x86_64-linux",
-      extraModules ? [ ],
-    }:
-    let
-      # Validate that server and desktop tags are mutually exclusive
-      hasServer = builtins.elem "server" tags;
-      hasDesktop = builtins.elem "desktop" tags;
-
-      # Always include "common" tag implicitly
-      allTags =
-        if hasServer && hasDesktop then
-          throw "Error: 'server' and 'desktop' tags are mutually exclusive for host '${hostname}'"
-        else
-          [ "common" ] ++ tags;
-
-      # Choose nixpkgs based on server tag
-      pkgs = if builtins.elem "server" allTags then nixpkgs-stable else nixpkgs;
-
-      # Tag-specific modules: each tag can be either:
-      # 1. A file: hosts/modules/${tag}.nix
-      # 2. A directory: hosts/modules/${tag}/*.nix (all .nix files imported)
-      tagModuleFiles = builtins.concatMap (
-        tag:
-        let
-          filePath = ./hosts/modules/${tag}.nix;
-          dirPath = ./hosts/modules/${tag};
-        in
-        # Check if it's a file first
-        if builtins.pathExists filePath then
-          [ filePath ]
-        # Then check if it's a directory
-        else if builtins.pathExists dirPath then
-          let
-            entries = builtins.readDir dirPath;
-            nixFiles = pkgs.lib.filterAttrs (
-              name: type: type == "regular" && pkgs.lib.hasSuffix ".nix" name
-            ) entries;
-          in
-          map (name: dirPath + "/${name}") (builtins.attrNames nixFiles)
-        else
-          [ ]
-      ) allTags;
-
-      # Automatically import all .nix files from hosts/${hostname}/
-      hostModulePath = ./hosts/${hostname};
-      hostModuleFiles =
-        if builtins.pathExists hostModulePath then
-          let
-            entries = builtins.readDir hostModulePath;
-            nixFiles = pkgs.lib.filterAttrs (
-              name: type: type == "regular" && pkgs.lib.hasSuffix ".nix" name && name != "${hostname}.nix"
-            ) entries;
-          in
-          map (name: hostModulePath + "/${name}") (builtins.attrNames nixFiles)
-        else
-          [ ];
-
-      # Combine all modules
-      allModules = [
-        agenix.nixosModules.default
-        {
-          networking.hostName = hostname;
-          nix.nixPath = [ "nixos-config=${self.outPath}/nixosConfigurations/${hostname}" ];
-          nixpkgs.overlays = [
-            agenix.overlays.default
-            self.overlays.default
-          ];
-        }
-      ]
-      ++ tagModuleFiles
-      ++ hostModuleFiles
-      ++ extraModules;
-    in
-    pkgs.lib.nixosSystem {
-      inherit system;
-      specialArgs = {
-        inherit inputs;
-        hostTags = allTags;
-      };
-      modules = allModules;
-    };
-
-  # Tag-based user configuration system
-  mkHome =
-    {
-      username,
-      hostname ? null,
-      homeDirectory ? "/home/${username}",
-      tags ? [ ],
-      extraModules ? [ ],
-    }:
-    let
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-
-      # Always include "common" tag implicitly
-      allTags = [ "common" ] ++ tags;
-
-      # Tag-specific modules: each tag maps to users/modules/${tag}.nix if it exists
-      tagModuleFiles = builtins.concatMap (
-        tag:
-        let
-          filePath = ./users/modules/${tag}.nix;
-          dirPath = ./users/modules/${tag};
-        in
-        # Check if it's a file first
-        if builtins.pathExists filePath then
-          [ filePath ]
-        # Then check if it's a directory
-        else if builtins.pathExists dirPath then
-          let
-            entries = builtins.readDir dirPath;
-            nixFiles = pkgs.lib.filterAttrs (
-              name: type: type == "regular" && pkgs.lib.hasSuffix ".nix" name
-            ) entries;
-          in
-          map (name: dirPath + "/${name}") (builtins.attrNames nixFiles)
-        else
-          [ ]
-      ) allTags;
-
-      # Automatically import all .nix files from users/${username}/
-      userModulePath = ./users/${username};
-      userModuleFiles =
-        if builtins.pathExists userModulePath then
-          let
-            entries = builtins.readDir userModulePath;
-            nixFiles = pkgs.lib.filterAttrs (
-              name: type: type == "regular" && pkgs.lib.hasSuffix ".nix" name
-            ) entries;
-          in
-          map (name: userModulePath + "/${name}") (builtins.attrNames nixFiles)
-        else
-          [ ];
-
-      # Combine all modules
-      allModules = [
-        {
-          home = {
-            inherit username homeDirectory;
-            stateVersion = "22.05";
-          };
-        }
-      ]
-      ++ tagModuleFiles
-      ++ userModuleFiles
-      ++ extraModules;
-    in
-    home-manager.lib.homeManagerConfiguration {
-      inherit pkgs;
-      extraSpecialArgs = {
-        inherit inputs hostname;
-        userTags = allTags;
-      };
-      modules = allModules ++ [
-        {
-          nixpkgs.overlays = [ self.overlays.default ];
-        }
-      ];
-    };
-
-  # Nginx virtual host utilities
-  mkNginxVHosts =
-    {
-      acmeHost,
-      domains,
-    }:
-    let
-      commonVHostConfig = {
-        useACMEHost = acmeHost;
-        forceSSL = true;
-        kTLS = true;
-      };
-    in
-    lib.mapAttrs (_: lib.recursiveUpdate commonVHostConfig) domains;
-}