opencode from nix-ai-tools

Flake lock file updates:

• Updated input 'nix-ai-tools':
    'github:numtide/llm-agents.nix/266d4d8a55eef6dd23cd0adced301053d8fc23c9?narHash=sha256-HQXK2CXAhBuTBw99Ip018Vp9MMAPfJVywgRrkwMUgMc%3D' (2026-02-12)
  → 'github:numtide/llm-agents.nix/db94a329058a1a37b49d3209af85708b3338559a?narHash=sha256-q5Wsb1573qDfIPJctG9CBZP0NMniejoB7SmBLZIVAHg%3D' (2026-02-23)
• Updated input 'nix-ai-tools/blueprint':
    'github:numtide/blueprint/c7da5c70ad1c9b60b6f5d4f674fbe205d48d8f6c?narHash=sha256-zI%2B7cbMI4wMIR57jMjDSEsVb3grapTnURDxxJPYFIW0%3D' (2026-01-25)
  → 'github:numtide/blueprint/06ee7190dc2620ea98af9eb225aa9627b68b0e33?narHash=sha256-bLqwib%2BrtyBRRVBWhMuBXPCL/OThfokA%2Bj6%2BuH7jDGU%3D' (2026-02-18)
• Updated input 'nix-ai-tools/nixpkgs':
    'github:NixOS/nixpkgs/2343bbb58f99267223bc2aac4fc9ea301a155a16?narHash=sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8%3D' (2026-02-11)
  → 'github:NixOS/nixpkgs/d1c15b7d5806069da59e819999d70e1cec0760bf?narHash=sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE%3D' (2026-02-16)

aspects/ai.nix

@@ -1,12 +1,19 @@
 { ... }:
 {
-  flake.modules.nixos.ai = { inputs, pkgs, ... }: {
+  flake.modules.nixos.ai =
+    { inputs, pkgs, ... }:
+    {
       environment.systemPackages =
-      (with pkgs; [claude-desktop]) ++
+        (with pkgs; [ ])
-      (with inputs.nix-ai-tools.packages.${pkgs.system}; [
+        ++ (with inputs.nix-ai-tools.packages.${pkgs.stdenv.hostPlatform.system}; [
-        claude-code
-        claudebox
           opencode
         ]);
+
+      nix.settings = {
+        extra-substituters = [ "https://cache.numtide.com" ];
+        extra-trusted-public-keys = [
+          "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
+        ];
+      };
     };
 }

aspects/base/bash.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  flake.modules.homeManager.bash =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      programs.bash = {
+        enable = true;
+        historyFile = "~/.cache/bash_history";
+      };
+    };
+}

aspects/base/boot.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  flake.modules.nixos.boot =
+    { pkgs, ... }:
+    {
+      boot = {
+        loader = {
+          timeout = 1;
+          efi.canTouchEfiVariables = true;
+          systemd-boot = {
+            enable = true;
+            editor = false;
+            consoleMode = "max";
+            sortKey = "aa";
+            netbootxyz = {
+              enable = true;
+              sortKey = "zz";
+            };
+          };
+        };
+      };
+    };
+}

aspects/base/console.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  flake.modules.nixos.console =
+    { ... }:
+    {
+      console = {
+        useXkbConfig = true;
+        earlySetup = true;
+      };
+    };
+}

aspects/base/firewall.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  flake.modules.nixos.firewall =
+    { ... }:
+    {
+      networking = {
+        firewall.enable = true;
+        nftables.enable = true;
+      };
+    };
+}

aspects/base/fish.nix

@@ -0,0 +1,47 @@
+{ ... }:
+{
+  flake.modules = {
+    nixos.fish =
+      { ... }:
+      {
+        programs.fish.enable = true;
+      };
+    homeManager.fish =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        programs.fish = {
+          enable = true;
+          interactiveShellInit = ''
+            set fish_greeting
+            ${lib.getExe pkgs.nix-your-shell} fish | source
+          '';
+          loginShellInit = "${lib.getExe pkgs.nix-your-shell} fish | source";
+          plugins = [
+            {
+              name = "bang-bang";
+              src = pkgs.fetchFromGitHub {
+                owner = "oh-my-fish";
+                repo = "plugin-bang-bang";
+                rev = "f969c618301163273d0a03d002614d9a81952c1e";
+                sha256 = "sha256-A8ydBX4LORk+nutjHurqNNWFmW6LIiBPQcxS3x4nbeQ=";
+              };
+            }
+            {
+              name = "z";
+              src = pkgs.fetchFromGitHub {
+                owner = "jethrokuan";
+                repo = "z";
+                rev = "067e867debee59aee231e789fc4631f80fa5788e";
+                sha256 = "sha256-emmjTsqt8bdI5qpx1bAzhVACkg0MNB/uffaRjjeuFxU=";
+              };
+            }
+          ];
+        };
+      };
+  };
+}

aspects/base/locale.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  flake.modules.nixos.locale =
+    { ... }:
+    {
+      time.timeZone = "America/Bahia";
+
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_ADDRESS = "pt_BR.utf8";
+          LC_COLLATE = "pt_BR.utf8";
+          LC_IDENTIFICATION = "pt_BR.utf8";
+          LC_MEASUREMENT = "pt_BR.utf8";
+          LC_MONETARY = "pt_BR.utf8";
+          LC_NAME = "pt_BR.utf8";
+          LC_NUMERIC = "pt_BR.utf8";
+          LC_PAPER = "pt_BR.utf8";
+          LC_TELEPHONE = "pt_BR.utf8";
+          LC_TIME = "en_IE.utf8";
+        };
+      };
+    };
+}

aspects/base/nix.nix

@@ -0,0 +1,51 @@
+{ ... }:
+{
+  flake.modules.nixos.nix =
+    { inputs, pkgs, ... }:
+    {
+      imports = [ inputs.nixos-cli.nixosModules.nixos-cli ];
+
+      nix = {
+        settings = {
+          auto-optimise-store = true;
+          connect-timeout = 10;
+          log-lines = 25;
+          min-free = 128000000;
+          max-free = 1000000000;
+          trusted-users = [ "@wheel" ];
+        };
+        extraOptions = "experimental-features = nix-command flakes";
+        gc = {
+          automatic = true;
+          options = "--delete-older-than 8d";
+        };
+      };
+
+      nixpkgs.config = {
+        allowUnfree = true;
+        enableParallelBuilding = true;
+        buildManPages = false;
+        buildDocs = false;
+      };
+
+      services.nixos-cli = {
+        enable = true;
+        config = {
+          use_nvd = true;
+          ignore_dirty_tree = true;
+          apply = {
+            reexec_as_root = true;
+            use_nom = true;
+          };
+          confirmation.empty = "default-yes";
+        };
+      };
+
+      environment.systemPackages = with pkgs; [
+        nix-output-monitor
+        nvd
+      ];
+
+      system.stateVersion = "22.11";
+    };
+}

aspects/base/security.nix

@@ -1,6 +1,6 @@
 { ... }:
 {
-  flake.modules.nixos.common-security =
+  flake.modules.nixos.security =
     { ... }:
     {
       security.sudo = {

aspects/base/ssh.nix

@@ -0,0 +1,32 @@
+{ ... }:
+
+{
+  flake.modules.nixos.ssh =
+    { ... }:
+    {
+      services.openssh = {
+        enable = true;
+        settings.PermitRootLogin = "no";
+        extraConfig = ''
+          PrintLastLog no
+        '';
+      };
+      programs = {
+        bash.interactiveShellInit = ''
+          if [ -n "$SSH_CONNECTION" ] && [ -z "$IN_NIX_SHELL" ] && [ -z "$TMUX" ]; then
+            export TERM=xterm-256color
+            clear
+            fastfetch
+          fi
+        '';
+        fish.interactiveShellInit = ''
+          set fish_greeting
+          if set -q SSH_CONNECTION; and not set -q IN_NIX_SHELL; and not set -q TMUX
+            export TERM=xterm-256color
+            clear
+            fastfetch
+          end
+        '';
+      };
+    };
+}

aspects/bluetooth.nix

@@ -1,6 +1,16 @@
 { ... }:
 {
-  flake.modules.nixos.bluetooth = { config, lib, pkgs, ... }: {
+  flake.modules.nixos.bluetooth =
-    hardware.bluetooth.enable = true;
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      hardware.bluetooth = {
+        enable = true;
+        powerOnBoot = false;
+      };
     };
 }

aspects/cli/btop.nix

@@ -1,6 +1,20 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-btop = { config, lib, pkgs, ... }: {
+  flake.modules = {
+    nixos.btop =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [ btop ];
+      };
+
+    homeManager.btop =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
         programs.btop = {
           enable = true;
           settings = {
@@ -10,4 +24,5 @@
           };
         };
       };
+  };
 }

aspects/cli/comma.nix

@@ -1,6 +1,14 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-comma = { config, lib, pkgs, inputs, ... }: {
+  flake.modules.homeManager.comma =
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    {
       imports = [ inputs.nix-index-database.homeModules.nix-index ];
 
       programs.nix-index-database.comma.enable = true;

aspects/cli/direnv.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-direnv = { config, lib, pkgs, ... }: {
+  flake.modules.homeManager.direnv =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       programs.direnv = {
         enable = true;
         nix-direnv.enable = true;

aspects/cli/helix.nix

@@ -1,6 +1,22 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-helix = { config, lib, pkgs, ... }: {
+  flake.modules = {
+    nixos.helix =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          helix
+        ];
+      };
+
+    homeManager.helix =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
         home.sessionVariables = {
           EDITOR = "hx";
         };
@@ -47,4 +63,5 @@
           };
         };
       };
+  };
 }

aspects/cli/hm-cli.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-base = { config, lib, pkgs, ... }: {
+  flake.modules.homeManager.hm-cli =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       home = {
         packages = with pkgs; [ hm-cli ];
         sessionVariables = {

aspects/cli/starship.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-starship = { config, lib, pkgs, ... }: {
+  flake.modules.homeManager.starship =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       programs.starship = {
         enable = true;
         enableBashIntegration = true;

aspects/cli/tmux.nix

@@ -1,6 +1,22 @@
 { ... }:
 {
-  flake.modules.homeManager.cli-tmux = { config, lib, pkgs, ... }: {
+  flake.modules = {
+    nixos.tmux =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          tmux
+        ];
+      };
+
+    homeManager.tmux =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
         programs.tmux = {
           enable = true;
           clock24 = true;
@@ -9,4 +25,5 @@
           keyMode = "vi";
         };
       };
+  };
 }

aspects/common/boot.nix

@@ -1,21 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-boot = { pkgs, ... }: {
-    boot = {
-      loader = {
-        timeout = 1;
-        efi.canTouchEfiVariables = true;
-        systemd-boot = {
-          enable = true;
-          editor = false;
-          consoleMode = "max";
-          sortKey = "aa";
-          netbootxyz = {
-            enable = true;
-            sortKey = "zz";
-          };
-        };
-      };
-    };
-  };
-}

aspects/common/console.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-console = { ... }: {
-    console = {
-      useXkbConfig = true;
-      earlySetup = true;
-    };
-  };
-}

aspects/common/firewall.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-firewall = { ... }: {
-    networking = {
-      firewall.enable = true;
-      nftables.enable = true;
-    };
-  };
-}

aspects/common/locale.nix

@@ -1,22 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-locale = { ... }: {
-    time.timeZone = "America/Bahia";
-
-    i18n = {
-      defaultLocale = "en_US.UTF-8";
-      extraLocaleSettings = {
-        LC_ADDRESS = "pt_BR.utf8";
-        LC_COLLATE = "pt_BR.utf8";
-        LC_IDENTIFICATION = "pt_BR.utf8";
-        LC_MEASUREMENT = "pt_BR.utf8";
-        LC_MONETARY = "pt_BR.utf8";
-        LC_NAME = "pt_BR.utf8";
-        LC_NUMERIC = "pt_BR.utf8";
-        LC_PAPER = "pt_BR.utf8";
-        LC_TELEPHONE = "pt_BR.utf8";
-        LC_TIME = "en_IE.utf8";
-      };
-    };
-  };
-}

aspects/common/nix.nix

@@ -1,39 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-nix = { inputs, ... }: {
-    imports = [ inputs.nixos-cli.nixosModules.nixos-cli ];
-
-    nix = {
-      settings = {
-        auto-optimise-store = true;
-        connect-timeout = 10;
-        log-lines = 25;
-        min-free = 128000000;
-        max-free = 1000000000;
-        trusted-users = [ "@wheel" ];
-      };
-      extraOptions = "experimental-features = nix-command flakes";
-      gc = {
-        automatic = true;
-        options = "--delete-older-than 8d";
-      };
-    };
-
-    nixpkgs.config = {
-      allowUnfree = true;
-      enableParallelBuilding = true;
-      buildManPages = false;
-      buildDocs = false;
-    };
-
-    services.nixos-cli = {
-      enable = true;
-      config = {
-        use_nvd = true;
-        ignore_dirty_tree = true;
-      };
-    };
-
-    system.stateVersion = "22.11";
-  };
-}

aspects/common/openssh.nix

@@ -1,12 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-openssh = { ... }: {
-    services.openssh = {
-      enable = true;
-      settings.PermitRootLogin = "no";
-      extraConfig = ''
-        PrintLastLog no
-      '';
-    };
-  };
-}

aspects/common/programs.nix

@@ -1,43 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-programs =
-    { lib, pkgs, ... }:
-    {
-      environment = {
-        systemPackages = with pkgs; [
-          ### Dev Tools ###
-          git
-          ### System Utilities ###
-          btop
-          fastfetch
-          helix
-          nixos-firewall-tool
-          nvd
-          sysz
-          tmux
-          wget
-          yazi
-        ];
-        shellAliases = {
-          cat = "${lib.getExe pkgs.bat} --paging=never --style=plain";
-          ls = "${lib.getExe pkgs.eza} --git --icons --group-directories-first";
-          tree = "ls --tree";
-        };
-      };
-
-      programs = {
-        command-not-found.enable = false;
-        fish = {
-          enable = true;
-          interactiveShellInit = ''
-            set fish_greeting
-            if set -q SSH_CONNECTION
-              export TERM=xterm-256color
-              clear
-              fastfetch
-            end
-          '';
-        };
-      };
-    };
-}

aspects/common/services.nix

@@ -1,10 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-services = { ... }: {
-    services = {
-      dbus.implementation = "broker";
-      irqbalance.enable = true;
-      fstrim.enable = true;
-    };
-  };
-}

aspects/common/tailscale.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.common-tailscale = { ... }: {
-    services.tailscale = {
-      enable = true;
-      extraUpFlags = [ "--operator=user" ];
-    };
-  };
-}

aspects/constants.nix

@@ -1,4 +1,9 @@
-{ lib, config, ... }:
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
 
 let
   # Host submodule type
@@ -54,12 +59,15 @@ let
   sharedData = import ../data/services.nix;
 
   # Enrich services with host IP information
-  enrichServices = hosts: services:
+  enrichServices =
-    map (svc:
+    hosts: services:
+    map (
+      svc:
       let
         hostInfo = hosts.${svc.host} or { };
       in
-      svc // {
+      svc
+      // {
         lanIP = hostInfo.lanIP or null;
         tailscaleIP = hostInfo.tailscaleIP or null;
       }
@@ -94,9 +102,11 @@ in
 
     lib = {
       # Nginx virtual host utilities
-      mkNginxVHosts = { domains }:
+      mkNginxVHosts =
+        { domains }:
         let
-          mkVHostConfig = domain: vhostConfig:
+          mkVHostConfig =
+            domain: vhostConfig:
             lib.recursiveUpdate {
               useACMEHost = domain;
               forceSSL = true;
@@ -107,7 +117,8 @@ in
 
       # Split DNS utilities for unbound
       # Generates unbound view config from a list of DNS entries
-      mkSplitDNS = entries:
+      mkSplitDNS =
+        entries:
         let
           tailscaleData = map (e: ''"${e.domain}. IN A ${e.tailscaleIP}"'') entries;
           lanData = map (e: ''"${e.domain}. IN A ${e.lanIP}"'') entries;
@@ -126,6 +137,81 @@ in
             local-data = lanData;
           }
         ];
+      # Generates flake.homeConfigurations
+      mkHomeConfiguration =
+        {
+          user,
+          hostname,
+          system ? "x86_64-linux",
+          stateVersion ? "22.05",
+          nixpkgs ? inputs.nixpkgs, # override with e.g. inputs.nixpkgs-stable
+          userModules ? [ ],
+          overlays ? [ inputs.self.overlays.default ],
+          homeManagerModules ? with inputs.self.modules.homeManager; [
+            base
+            cli
+          ],
+          userDirectory ? "/home/${user}",
+        }:
+        inputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = nixpkgs.legacyPackages.${system};
+
+          extraSpecialArgs = {
+            inherit inputs hostname;
+          };
+
+          modules = [
+            { nixpkgs.overlays = overlays; }
+            {
+              home = {
+                username = user;
+                homeDirectory = userDirectory;
+                inherit stateVersion;
+              };
+            }
+            ((inputs.import-tree.initFilter (p: lib.hasSuffix ".nix" p))
+              "/${inputs.self}/aspects/users/_${user}"
+            )
+          ]
+          ++ homeManagerModules
+          ++ userModules;
+        };
+      # Generates flake.nixosConfigurations
+      mkHost =
+        {
+          hostname,
+          system ? "x86_64-linux",
+          nixpkgs ? inputs.nixpkgs,
+          overlays ? [
+            inputs.agenix.overlays.default
+            inputs.self.overlays.default
+          ],
+          ephemeralRootDev ? null, # pass rootDevice string to enable, e.g. ephemeralephemeralRootDev = "/dev/mapper/cryptroot"
+          nixosModules ? with inputs.self.modules.nixos; [
+            base
+            cli
+            user
+            root
+          ],
+          extraModules ? [ ],
+        }:
+        nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs; };
+          modules = [
+            inputs.agenix.nixosModules.default
+            { networking.hostName = hostname; }
+            { nixpkgs.overlays = overlays; }
+            ((inputs.import-tree.initFilter (p: lib.hasSuffix ".nix" p))
+              "${inputs.self}/aspects/hosts/_${hostname}"
+            )
+          ]
+          ++ (lib.optional (ephemeralRootDev != null) (
+            inputs.self.factory.ephemeral { rootDevice = ephemeralRootDev; }
+          ))
+          ++ nixosModules
+          ++ extraModules;
+        };
     };
   };
 }

aspects/desktop/boot.nix

@@ -1,27 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.desktop-boot = { config, lib, pkgs, ... }: {
-    boot = {
-      plymouth.enable = true;
-      initrd.systemd.enable = true;
-      loader.efi.efiSysMountPoint = "/boot/efi";
-      kernelPackages = pkgs.linuxPackages_xanmod_latest;
-      extraModprobeConfig = ''
-        options bluetooth disable_ertm=1
-      '';
-      kernel.sysctl = {
-        "net.ipv4.tcp_mtu_probing" = 1;
-      };
-      kernelParams = [
-        "quiet"
-        "splash"
-        "i2c-dev"
-        "i2c-piix4"
-        "loglevel=3"
-        "udev.log_priority=3"
-        "rd.udev.log_level=3"
-        "rd.systemd.show_status=false"
-      ];
-    };
-  };
-}

aspects/desktop/desktop.nix

@@ -1,292 +0,0 @@
-{
-  inputs,
-  ...
-}:
-{
-  flake.modules = {
-    nixos.desktop-desktop = { config, lib, pkgs, ... }: {
-      imports = [
-        inputs.niri-flake.nixosModules.niri
-        inputs.nix-flatpak.nixosModules.nix-flatpak
-      ];
-
-      environment = {
-        sessionVariables = {
-          KDEHOME = "$XDG_CONFIG_HOME/kde4"; # Stops kde from placing a .kde4 folder in the home dir
-          NIXOS_OZONE_WL = "1"; # Forces chromium and most electron apps to run in wayland
-        };
-        systemPackages = with pkgs; [
-          ### Web ###
-          bitwarden-desktop
-          fragments
-          nextcloud-client
-          tor-browser
-          vesktop
-          inputs.zen-browser.packages."${system}".default
-          ### Office & Productivity ###
-          aspell
-          aspellDicts.de
-          aspellDicts.en
-          aspellDicts.en-computers
-          aspellDicts.pt_BR
-          papers
-          presenterm
-          rnote
-          ### Graphics & Design ###
-          gimp
-          inkscape
-          plasticity
-          ### System Utilities ###
-          adwaita-icon-theme
-          ghostty
-          gnome-disk-utility
-          junction
-          libfido2
-          mission-center
-          nautilus
-          p7zip
-          rclone
-          toggleaudiosink
-          unrar
-          ### Media ###
-          decibels
-          loupe
-          obs-studio
-          showtime
-        ];
-      };
-
-      services = {
-        pipewire = {
-          enable = true;
-          alsa.enable = true;
-          alsa.support32Bit = true;
-          pulse.enable = true;
-          jack.enable = true;
-          wireplumber.enable = true;
-        };
-        greetd = {
-          enable = true;
-          settings = {
-            default_session = {
-              command = "${lib.getExe pkgs.tuigreet} --user-menu --time --remember --asterisks --cmd ${config.programs.niri.package}/bin/niri-session";
-              user = "greeter";
-            };
-          }
-          // lib.optionalAttrs (config.networking.hostName == "io") {
-            initial_session = {
-              command = "${config.programs.niri.package}/bin/niri-session";
-              user = "user";
-            };
-          };
-        };
-        flatpak = {
-          enable = true;
-          packages = [
-            ### Office & Productivity ###
-            "com.collabora.Office"
-            ### Graphics & Design ###
-            "com.boxy_svg.BoxySVG"
-            rec {
-              appId = "io.github.softfever.OrcaSlicer";
-              sha256 = "0hdx5sg6fknj1pfnfxvlfwb5h6y1vjr6fyajbsnjph5gkp97c6p1";
-              bundle = "${pkgs.fetchurl {
-                url = "https://github.com/SoftFever/OrcaSlicer/releases/download/v2.3.0/OrcaSlicer-Linux-flatpak_V2.3.0_x86_64.flatpak";
-                inherit sha256;
-              }}";
-            }
-            ### System Utilities ###
-            "com.github.tchx84.Flatseal"
-            "com.rustdesk.RustDesk"
-          ];
-          uninstallUnmanaged = true;
-          update.auto.enable = true;
-        };
-        gvfs.enable = true;
-      };
-
-      security.rtkit.enable = true; # Needed for pipewire to acquire realtime priority
-
-      users = {
-        users.greeter = {
-          isSystemUser = true;
-          group = "greeter";
-        };
-        groups.greeter = { };
-      };
-
-      programs = {
-        niri = {
-          enable = true;
-          package = inputs.niri.packages.${pkgs.system}.niri;
-        };
-        kdeconnect = {
-          enable = true;
-          package = pkgs.valent;
-        };
-        dconf.enable = true;
-        appimage = {
-          enable = true;
-          binfmt = true;
-        };
-      };
-
-      niri-flake.cache.enable = false;
-
-      fonts = {
-        fontDir.enable = true;
-        packages = with pkgs; [
-          corefonts
-          inter
-          nerd-fonts.fira-code
-          noto-fonts-cjk-sans
-          noto-fonts-color-emoji
-          roboto
-        ];
-      };
-
-      xdg.portal = {
-        extraPortals = with pkgs; [
-          xdg-desktop-portal-gnome
-          xdg-desktop-portal-gtk
-        ];
-        config = {
-          common.default = "*";
-          niri.default = [
-            "gtk"
-            "gnome"
-          ];
-        };
-      };
-    };
-
-    homeManager.desktop-desktop = { config, lib, pkgs, inputs, ... }: {
-      imports = [ inputs.vicinae.homeManagerModules.default ];
-
-      fonts.fontconfig.enable = true;
-
-      home.packages = with pkgs; [ xwayland-satellite ];
-
-      services.vicinae = {
-        enable = true;
-        systemd = {
-          enable = true;
-          autoStart = true;
-        };
-      };
-
-      programs = {
-        ghostty = {
-          enable = true;
-          settings = {
-            cursor-style = "block";
-            shell-integration-features = "no-cursor";
-            cursor-style-blink = false;
-            custom-shader = "${builtins.fetchurl {
-              url = "https://raw.githubusercontent.com/hackr-sh/ghostty-shaders/cb6eb4b0d1a3101c869c62e458b25a826f9dcde3/cursor_blaze.glsl";
-              sha256 = "sha256:0g2lgqjdrn3c51glry7x2z30y7ml0y61arl5ykmf4yj0p85s5f41";
-            }}";
-            bell-features = "";
-            gtk-titlebar-style = "tabs";
-            keybind = [ "shift+enter=text:\\x1b\\r" ];
-          };
-        };
-
-        password-store = {
-          enable = true;
-          package = pkgs.pass-wayland;
-        };
-      };
-
-      xdg = {
-        enable = true;
-        userDirs.enable = true;
-        mimeApps = {
-          enable = true;
-          defaultApplications = {
-            "text/html" = [
-              "re.sonny.Junction.desktop"
-              "zen-browser.desktop"
-              "torbrowser.desktop"
-            ];
-            "x-scheme-handler/http" = [
-              "re.sonny.Junction.desktop"
-              "zen-browser.desktop"
-              "torbrowser.desktop"
-            ];
-            "x-scheme-handler/https" = [
-              "re.sonny.Junction.desktop"
-              "zen-browser.desktop"
-              "torbrowser.desktop"
-            ];
-            "x-scheme-handler/about" = [
-              "re.sonny.Junction.desktop"
-              "zen-browser.desktop"
-              "torbrowser.desktop"
-            ];
-            "x-scheme-handler/unknown" = [
-              "re.sonny.Junction.desktop"
-              "zen-browser.desktop"
-              "torbrowser.desktop"
-            ];
-            "image/jpeg" = "org.gnome.Loupe.desktop";
-            "image/png" = "org.gnome.Loupe.desktop";
-            "image/gif" = "org.gnome.Loupe.desktop";
-            "image/webp" = "org.gnome.Loupe.desktop";
-            "image/bmp" = "org.gnome.Loupe.desktop";
-            "image/svg+xml" = "org.gnome.Loupe.desktop";
-            "image/tiff" = "org.gnome.Loupe.desktop";
-            "video/mp4" = "io.bassi.Showtime.desktop";
-            "video/x-matroska" = "io.bassi.Showtime.desktop";
-            "video/webm" = "io.bassi.Showtime.desktop";
-            "video/mpeg" = "io.bassi.Showtime.desktop";
-            "video/x-msvideo" = "io.bassi.Showtime.desktop";
-            "video/quicktime" = "io.bassi.Showtime.desktop";
-            "video/x-flv" = "io.bassi.Showtime.desktop";
-            "audio/mpeg" = "io.bassi.Showtime.desktop";
-            "audio/flac" = "io.bassi.Showtime.desktop";
-            "audio/ogg" = "io.bassi.Showtime.desktop";
-            "audio/wav" = "io.bassi.Showtime.desktop";
-            "audio/mp4" = "io.bassi.Showtime.desktop";
-            "audio/x-opus+ogg" = "io.bassi.Showtime.desktop";
-            "application/pdf" = [
-              "org.gnome.Papers.desktop"
-              "zen-browser.desktop"
-            ];
-            "text/plain" = "Helix.desktop";
-            "text/markdown" = "Helix.desktop";
-            "text/x-log" = "Helix.desktop";
-            "application/x-shellscript" = "Helix.desktop";
-            "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
-              "com.collabora.Office.desktop"; # DOCX
-            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" =
-              "com.collabora.Office.desktop"; # XLSX
-            "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
-              "com.collabora.Office.desktop"; # PPTX
-            "application/vnd.oasis.opendocument.text" = "com.collabora.Office.desktop"; # ODT
-            "application/vnd.oasis.opendocument.spreadsheet" = "com.collabora.Office.desktop"; # ODS
-            "application/vnd.oasis.opendocument.presentation" = "com.collabora.Office.desktop"; # ODP
-            "application/msword" = "com.collabora.Office.desktop"; # DOC
-            "application/vnd.ms-excel" = "com.collabora.Office.desktop"; # XLS
-            "application/vnd.ms-powerpoint" = "com.collabora.Office.desktop"; # PPT
-            "application/zip" = "org.gnome.FileRoller.desktop";
-            "application/x-tar" = "org.gnome.FileRoller.desktop";
-            "application/x-compressed-tar" = "org.gnome.FileRoller.desktop";
-            "application/x-bzip-compressed-tar" = "org.gnome.FileRoller.desktop";
-            "application/x-xz-compressed-tar" = "org.gnome.FileRoller.desktop";
-            "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
-            "application/x-rar" = "org.gnome.FileRoller.desktop";
-            "application/gzip" = "org.gnome.FileRoller.desktop";
-            "application/x-bzip" = "org.gnome.FileRoller.desktop";
-            "inode/directory" = "org.gnome.Nautilus.desktop";
-          };
-        };
-      };
-
-      # Set Ghostty as default terminal
-      home.sessionVariables = {
-        TERMINAL = "ghostty";
-      };
-    };
-  };
-}

aspects/desktop/graphics.nix

@@ -1,7 +1,7 @@
 { ... }:
 
 {
-  flake.modules.nixos.programs-graphics =
+  flake.modules.nixos.graphics =
     { pkgs, ... }:
     {
       environment.systemPackages = with pkgs; [

aspects/desktop/media.nix

@@ -2,7 +2,7 @@
 
 {
   flake.modules = {
-    nixos.programs-media =
+    nixos.media =
       { pkgs, ... }:
       {
         environment.systemPackages = with pkgs; [
@@ -13,7 +13,7 @@
         ];
       };
 
-    homeManager.programs-media =
+    homeManager.media =
       { pkgs, ... }:
       {
         programs.obs-studio = {

aspects/desktop/niri.nix

@@ -1,6 +1,29 @@
 { ... }:
 {
-  flake.modules.homeManager.desktop-niri = { config, lib, pkgs, inputs, hostname ? null, ... }:
+  flake.modules = {
+    nixos.niri =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        services.greetd.settings = {
+          default_session.command = "${lib.getExe pkgs.tuigreet} --user-menu --time --remember --asterisks --cmd ${config.programs.niri.package}/bin/niri-session";
+        };
+
+        programs.niri.enable = true;
+      };
+    homeManager.niri =
+      {
+        config,
+        lib,
+        pkgs,
+        inputs,
+        hostname ? null,
+        ...
+      }:
       let
         isRotterdam = hostname == "rotterdam";
       in
@@ -25,7 +48,7 @@
         home = {
           packages = with pkgs; [
             xwayland-satellite
-          inputs.noctalia.packages.${pkgs.system}.default
+            inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default
           ];
           sessionVariables.QT_QPA_PLATFORMTHEME = "gtk3";
         };
@@ -58,26 +81,27 @@
             focus-follows-mouse
           }
 
+          output "LG Electronics LG ULTRAWIDE 206AZFM5E459" {
             layout {
-          gaps 8
-          center-focused-column "never"
-          auto-center-when-space-available
               preset-column-widths {
-            ${
-              if isRotterdam then
-                ''
                 proportion 0.33333
                 proportion 0.5
                 proportion 0.66667
-                ''
+              }
-              else
+              default-column-width { proportion 0.33333; }
-                ''
+            }
+          }
+
+          layout {
+            gaps 8
+            center-focused-column "never"
+            always-center-single-column
+            empty-workspace-above-first
+            preset-column-widths {
               proportion 0.5
               proportion 1.0
-                ''
             }
-          }
+            default-column-width { proportion 0.5; }
-          default-column-width { proportion ${if isRotterdam then "0.33333" else "0.5"}; }
             focus-ring {
               off
             }
@@ -99,6 +123,7 @@
           }
 
           spawn-at-startup "noctalia-shell" "-d"
+          spawn-at-startup "${lib.getExe pkgs.niri-auto-centre}"
           layer-rule {
             match namespace="^noctalia-overview*"
             place-within-backdrop true
@@ -217,4 +242,5 @@
           }
         '';
       };
+  };
 }

aspects/desktop/nix.nix

@@ -1,14 +0,0 @@
-{ inputs, ... }:
-{
-  flake.modules.nixos.desktop-nix = { config, lib, pkgs, ... }: {
-    environment.etc."channels/nixpkgs".source = inputs.nixpkgs.outPath;
-
-    nix = {
-      registry.nixpkgs.flake = inputs.nixpkgs;
-      nixPath = [
-        "nixpkgs=${inputs.nixpkgs}"
-        "/nix/var/nix/profiles/per-user/root/channels"
-      ];
-    };
-  };
-}

aspects/desktop/office.nix

@@ -1,7 +1,7 @@
 { ... }:
 
 {
-  flake.modules.nixos.programs-office =
+  flake.modules.nixos.office =
     { pkgs, ... }:
     {
       environment.systemPackages = with pkgs; [
@@ -10,6 +10,7 @@
         aspellDicts.en
         aspellDicts.en-computers
         aspellDicts.pt_BR
+        glow
         papers
         presenterm
         rnote

aspects/desktop/services.nix

@@ -1,16 +0,0 @@
-{ ... }:
-{
-  flake.modules.nixos.desktop-services = { config, lib, pkgs, ... }: {
-    services = {
-      printing.enable = true;
-      udev.packages = with pkgs; [ yubikey-personalization ];
-      keyd = {
-        enable = true;
-        keyboards.all = {
-          ids = [ "*" ];
-          settings.main.capslock = "overload(meta, esc)";
-        };
-      };
-    };
-  };
-}

aspects/desktop/web.nix

@@ -1,20 +1,21 @@
 { ... }:
 
 {
-  flake.modules.nixos.programs-web =
+  flake.modules.nixos.web =
     {
       inputs,
       pkgs,
-      system,
       ...
     }:
     {
       environment.systemPackages = with pkgs; [
-        inputs.zen-browser.packages."${system}".default
+        inputs.zen-browser.packages."${pkgs.stdenv.hostPlatform.system}".default
+        beeper
         bitwarden-desktop
         fragments
         nextcloud-client
         tor-browser
+        ungoogled-chromium
         vesktop
       ];
     };

aspects/dev.nix

@@ -1,16 +1,20 @@
 { ... }:
 {
-  flake.modules.nixos.dev = { config, lib, pkgs, ... }: {
+  flake.modules.nixos.dev =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       environment.systemPackages = with pkgs; [
         android-tools
-      bat
         lazygit
         fd
         fzf
-      glow
         nixfmt
         nix-init
-      nix-output-monitor
         ripgrep
       ];
 

aspects/ephemeral.nix

@@ -3,7 +3,8 @@
 { inputs, ... }:
 {
   # Base module with options (for external flakes or direct use)
-  flake.modules.nixos.ephemeral = { lib, config, ... }:
+  flake.modules.nixos.ephemeral =
+    { lib, config, ... }:
     let
       cfg = config.ephemeral;
     in
@@ -89,18 +90,19 @@
 
   # Factory function that generates configured modules
   flake.factory.ephemeral =
-    { rootDevice
+    {
-    , rootSubvolume ? "@root"
+      rootDevice,
-    , retentionDays ? 30
+      rootSubvolume ? "@root",
-    , persistentStoragePath ? "/persistent"
+      retentionDays ? 30,
-    , persistentFiles ? [
+      persistentStoragePath ? "/persistent",
+      persistentFiles ? [
         "/etc/machine-id"
         "/etc/ssh/ssh_host_ed25519_key"
         "/etc/ssh/ssh_host_ed25519_key.pub"
         "/etc/ssh/ssh_host_rsa_key"
         "/etc/ssh/ssh_host_rsa_key.pub"
-      ]
+      ],
-    , persistentDirectories ? [
+      persistentDirectories ? [
         "/etc/NetworkManager/system-connections"
         "/etc/nixos"
         "/var/lib/bluetooth"
@@ -111,9 +113,10 @@
         "/var/lib/systemd/timers"
         "/var/lib/tailscale"
         "/var/log"
-      ]
+      ],
     }:
-    { ... }: {
+    { ... }:
+    {
       imports = [
         inputs.impermanence.nixosModules.impermanence
         inputs.self.modules.nixos.ephemeral

aspects/fwupd.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.nixos.fwupd = { config, lib, pkgs, ... }: {
+  flake.modules.nixos.fwupd =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       services.fwupd.enable = true;
     };
 }

aspects/gaming/flatpak.nix

@@ -1,23 +0,0 @@
-{ ... }:
-
-{
-  flake.modules.nixos.gaming-flatpak = { pkgs, ... }: {
-    services.flatpak.packages = [
-      "com.github.k4zmu2a.spacecadetpinball"
-      "com.steamgriddb.SGDBoop"
-      "io.github.Foldex.AdwSteamGtk"
-      "io.itch.itch"
-      "io.mrarm.mcpelauncher"
-      "net.retrodeck.retrodeck"
-      "org.freedesktop.Platform.VulkanLayer.MangoHud/x86_64/25.08"
-      rec {
-        appId = "com.hypixel.HytaleLauncher";
-        sha256 = "01307s44bklc1ldcigcn9n4lm8hf8q793v9fv7w4w04xd5zyh4rv";
-        bundle = "${pkgs.fetchurl {
-          url = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-latest.flatpak";
-          inherit sha256;
-        }}";
-      }
-    ];
-  };
-}

aspects/gaming/hardware.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  flake.modules.nixos.gaming-hardware = { ... }: {
-    hardware = {
-      xpadneo.enable = true;
-      steam-hardware.enable = true; # Allow steam client to manage controllers
-      graphics.enable32Bit = true; # For OpenGL games
-    };
-  };
-}

aspects/gaming/launchers.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  flake.modules.nixos.gaming-launchers = { pkgs, ... }: {
-    environment.systemPackages = with pkgs; [
-      clonehero
-      heroic
-      prismlauncher
-    ];
-  };
-}

aspects/gaming/mangohud.nix

@@ -2,13 +2,17 @@
 
 {
   flake.modules = {
-    nixos.gaming-mangohud = { pkgs, ... }: {
+    nixos.mangohud =
+      { pkgs, ... }:
+      {
         environment.systemPackages = with pkgs; [
           mangohud
         ];
       };
 
-    homeManager.gaming-mangohud = { config, ... }: {
+    homeManager.mangohud =
+      { config, ... }:
+      {
         programs.mangohud = {
           enable = true;
           enableSessionWide = true;

aspects/gaming/steam.nix

@@ -1,7 +1,9 @@
 { ... }:
 
 {
-  flake.modules.nixos.gaming-steam = { pkgs, ... }: {
+  flake.modules.nixos.steam =
+    { pkgs, ... }:
+    {
       environment.systemPackages = with pkgs; [
         steam-run
       ];
@@ -13,5 +15,10 @@
         };
         gamemode.enable = true;
       };
+
+      services.flatpak.packages = [
+        "com.steamgriddb.SGDBoop"
+        "io.github.Foldex.AdwSteamGtk"
+      ];
     };
 }

aspects/hosts/_alexandria/kanidm.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  ...
-}:
-
-let
-  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
-  kanidmCertDir = "/var/lib/kanidm/certs";
-in
-
-{
-  services.kanidm = {
-    enableServer = true;
-    enableClient = true;
-    package = pkgs.kanidm;
-
-    serverSettings = {
-      domain = "auth.baduhai.dev";
-      origin = "https://auth.baduhai.dev";
-      bindaddress = "127.0.0.1:8443";
-      ldapbindaddress = "127.0.0.1:636";
-      trust_x_forward_for = true;
-      # Use self-signed certificates for internal TLS
-      tls_chain = "${kanidmCertDir}/cert.pem";
-      tls_key = "${kanidmCertDir}/key.pem";
-    };
-
-    clientSettings = {
-      uri = "https://auth.baduhai.dev";
-    };
-  };
-
-  services.nginx.virtualHosts = mkNginxVHosts {
-    domains."auth.baduhai.dev" = {
-      locations."/" = {
-        proxyPass = "https://127.0.0.1:8443";
-        extraConfig = ''
-          proxy_ssl_verify off;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 636 ];
-
-  # Generate self-signed certificates for kanidm's internal TLS
-  systemd.services.kanidm-generate-certs = {
-    description = "Generate self-signed TLS certificates for Kanidm";
-    wantedBy = [ "multi-user.target" ];
-    before = [ "kanidm.service" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      mkdir -p ${kanidmCertDir}
-      if [ ! -f ${kanidmCertDir}/key.pem ]; then
-        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 \
-          -keyout ${kanidmCertDir}/key.pem \
-          -out ${kanidmCertDir}/cert.pem \
-          -days 3650 -nodes \
-          -subj "/CN=localhost" \
-          -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
-        chown -R kanidm:kanidm ${kanidmCertDir}
-        chmod 600 ${kanidmCertDir}/key.pem
-        chmod 644 ${kanidmCertDir}/cert.pem
-      fi
-    '';
-  };
-
-  # Ensure certificate generation runs before kanidm starts
-  systemd.services.kanidm = {
-    after = [ "kanidm-generate-certs.service" ];
-    wants = [ "kanidm-generate-certs.service" ];
-  };
-}

aspects/hosts/_alexandria/nextcloud.nix

@@ -1,8 +1,7 @@
 {
-  lib,
   config,
-  pkgs,
   inputs,
+  pkgs,
   ...
 }:
 
@@ -83,12 +82,12 @@ in
 
   age.secrets = {
     "nextcloud-secrets.json" = {
-      file = ../../../secrets/nextcloud-secrets.json.age;
+      file = "${inputs.self}/secrets/nextcloud-secrets.json.age";
       owner = "nextcloud";
       group = "nextcloud";
     };
     nextcloud-adminpass = {
-      file = ../../../secrets/nextcloud-adminpass.age;
+      file = "${inputs.self}/secrets/nextcloud-adminpass.age";
       owner = "nextcloud";
       group = "nextcloud";
     };

aspects/hosts/_alexandria/nginx.nix

@@ -51,7 +51,7 @@ in
   ];
 
   age.secrets.cloudflare = {
-    file = ../../../secrets/cloudflare.age;
+    file = "${inputs.self}/secrets/cloudflare.age";
     owner = "nginx";
     group = "nginx";
   };

aspects/hosts/_alexandria/unbound.nix

@@ -34,8 +34,7 @@ in
 
         # LAN-only DNS records
         local-zone = ''"baduhai.dev." transparent'';
-        local-data = map (e: ''"${e.domain}. IN A ${e.lanIP}"'')
+        local-data = map (e: ''"${e.domain}. IN A ${e.lanIP}"'') (lib.filter (e: e.lanIP != null) services);
-          (lib.filter (e: e.lanIP != null) services);
       };
 
       forward-zone = [

aspects/hosts/_trantor/forgejo.nix

@@ -21,6 +21,8 @@ in
           ROOT_URL = "https://git.baduhai.dev";
           OFFLINE_MODE = true; # disable use of CDNs
           SSH_DOMAIN = "git.baduhai.dev";
+          SSH_USER = "forgejo";
+          SSH_PORT = lib.head config.services.openssh.ports;
         };
         log.LEVEL = "Warn";
         mailer.ENABLED = false;
@@ -67,5 +69,8 @@ in
   };
 
   # Disable PrivateMounts to allow LoadCredential to work with bind-mounted directories
-  systemd.services.forgejo.serviceConfig.PrivateMounts = lib.mkForce false;
+  systemd.services.forgejo.serviceConfig = {
+    PrivateMounts = lib.mkForce false;
+    ProtectSystem = lib.mkForce false;
+  };
 }

aspects/hosts/_trantor/nginx.nix

@@ -8,12 +8,8 @@
 let
   services = inputs.self.services;
 
-  # Get all unique domains from shared services on trantor (host = "trantor")
+  localDomains = lib.unique (map (s: s.domain) (lib.filter (s: s.host == "trantor") services));
-  localDomains = lib.unique (
-    map (s: s.domain) (lib.filter (s: s.host == "trantor") services)
-  );
 
-  # Generate ACME cert configs for all local domains
   acmeCerts = lib.genAttrs localDomains (domain: {
     group = "nginx";
   });
@@ -53,7 +49,7 @@ in
   ];
 
   age.secrets.cloudflare = {
-    file = ../../../secrets/cloudflare.age;
+    file = "${inputs.self}/secrets/cloudflare.age";
     owner = "nginx";
     group = "nginx";
   };

aspects/hosts/alexandria.nix

@@ -1,50 +1,19 @@
-{ inputs, self, ... }:
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
 {
-  flake.nixosConfigurations.alexandria = inputs.nixpkgs-stable.lib.nixosSystem {
+  flake.nixosConfigurations.alexandria = mkHost {
-    system = "x86_64-linux";
+    hostname = "alexandria";
-    specialArgs = { inherit inputs; };
+    nixpkgs = inputs.nixpkgs-stable;
-    modules = [
+    extraModules = with inputs.self.modules.nixos; [
-      inputs.agenix.nixosModules.default
+      # base aspects
-      { networking.hostName = "alexandria"; }
+      server
-      {
+      # other aspects
-        nixpkgs.overlays = [
+      fwupd
-          inputs.agenix.overlays.default
+      libvirtd
-          inputs.self.overlays.default
-        ];
-      }
-
-      # Common aspects (always included)
-      inputs.self.modules.nixos.common-boot
-      inputs.self.modules.nixos.common-console
-      inputs.self.modules.nixos.common-firewall
-      inputs.self.modules.nixos.common-locale
-      inputs.self.modules.nixos.common-nix
-      inputs.self.modules.nixos.common-openssh
-      inputs.self.modules.nixos.common-programs
-      inputs.self.modules.nixos.common-security
-      inputs.self.modules.nixos.common-services
-      inputs.self.modules.nixos.common-tailscale
-
-      # User aspects
-      inputs.self.modules.nixos.user
-      inputs.self.modules.nixos.root
-
-      # Server aspects
-      inputs.self.modules.nixos.server-boot
-      inputs.self.modules.nixos.server-nix
-      inputs.self.modules.nixos.server-tailscale
-
-      # Other aspects based on tags
-      inputs.self.modules.nixos.fwupd
-
-      # Host-specific files (from _alexandria/)
-      ./_alexandria/hardware-configuration.nix
-      ./_alexandria/jellyfin.nix
-      ./_alexandria/kanidm.nix
-      ./_alexandria/nextcloud.nix
-      ./_alexandria/nginx.nix
-      ./_alexandria/unbound.nix
-      ./_alexandria/vaultwarden.nix
     ];
   };
 }

aspects/hosts/io.nix

@@ -1,59 +1,24 @@
-{ inputs, self, ... }:
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
 {
-  flake.nixosConfigurations.io = inputs.nixpkgs.lib.nixosSystem {
+  flake.nixosConfigurations.io = mkHost {
-    system = "x86_64-linux";
+    hostname = "io";
-    specialArgs = { inherit inputs; };
+    ephemeralRootDev = "/dev/mapper/cryptroot";
-    modules = [
+    extraModules = with inputs.self.modules.nixos; [
-      inputs.agenix.nixosModules.default
+      # base aspects
-      { networking.hostName = "io"; }
+      desktop
-      {
+      # other aspects
-        nixpkgs.overlays = [
+      ai
-          inputs.agenix.overlays.default
+      bluetooth
-          inputs.self.overlays.default
+      dev
-        ];
+      libvirtd
-      }
+      networkmanager
-
+      niri
-      # Common aspects (always included)
+      podman
-      inputs.self.modules.nixos.common-boot
-      inputs.self.modules.nixos.common-console
-      inputs.self.modules.nixos.common-firewall
-      inputs.self.modules.nixos.common-locale
-      inputs.self.modules.nixos.common-nix
-      inputs.self.modules.nixos.common-openssh
-      inputs.self.modules.nixos.common-programs
-      inputs.self.modules.nixos.common-security
-      inputs.self.modules.nixos.common-services
-      inputs.self.modules.nixos.common-tailscale
-
-      # User aspects
-      inputs.self.modules.nixos.user
-      inputs.self.modules.nixos.root
-
-      # Desktop aspects
-      inputs.self.modules.nixos.desktop-boot
-      inputs.self.modules.nixos.desktop-desktop
-      inputs.self.modules.nixos.desktop-nix
-      inputs.self.modules.nixos.desktop-services
-
-      # Other aspects based on tags
-      inputs.self.modules.nixos.ai
-      inputs.self.modules.nixos.bluetooth
-      inputs.self.modules.nixos.dev
-      inputs.self.modules.nixos.libvirtd
-      inputs.self.modules.nixos.networkmanager
-      inputs.self.modules.nixos.podman
-
-      # Factory-generated ephemeral module
-      (inputs.self.factory.ephemeral {
-        rootDevice = "/dev/mapper/cryptroot";
-      })
-
-      # Host-specific files (from _io/)
-      ./_io/hardware-configuration.nix
-      ./_io/disko.nix
-      ./_io/boot.nix
-      ./_io/programs.nix
-      ./_io/services.nix
     ];
   };
 }

aspects/hosts/rotterdam.nix

@@ -1,64 +1,26 @@
 { inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
 {
-  flake.nixosConfigurations.rotterdam = inputs.nixpkgs.lib.nixosSystem {
+  flake.nixosConfigurations.rotterdam = mkHost {
-    system = "x86_64-linux";
+    hostname = "rotterdam";
-    specialArgs = { inherit inputs; };
+    ephemeralRootDev = "/dev/mapper/cryptroot";
-    modules = [
+    extraModules = with inputs.self.modules.nixos; [
-      inputs.agenix.nixosModules.default
+      # base aspects
-      { networking.hostName = "rotterdam"; }
+      desktop
-      {
+      gaming
-        nixpkgs.overlays = [
+      # other aspects
-          inputs.agenix.overlays.default
+      ai
-          inputs.self.overlays.default
+      bluetooth
-        ];
+      dev
-      }
+      fwupd
-
+      libvirtd
-      # Common aspects (always included)
+      networkmanager
-      inputs.self.modules.nixos.common-boot
+      niri
-      inputs.self.modules.nixos.common-console
+      podman
-      inputs.self.modules.nixos.common-firewall
-      inputs.self.modules.nixos.common-locale
-      inputs.self.modules.nixos.common-nix
-      inputs.self.modules.nixos.common-openssh
-      inputs.self.modules.nixos.common-programs
-      inputs.self.modules.nixos.common-security
-      inputs.self.modules.nixos.common-services
-      inputs.self.modules.nixos.common-tailscale
-
-      # User aspects
-      inputs.self.modules.nixos.user
-      inputs.self.modules.nixos.root
-
-      # Desktop aspects
-      inputs.self.modules.nixos.desktop-boot
-      inputs.self.modules.nixos.desktop-desktop
-      inputs.self.modules.nixos.desktop-nix
-      inputs.self.modules.nixos.desktop-services
-
-      # Other aspects based on tags
-      inputs.self.modules.nixos.ai
-      inputs.self.modules.nixos.bluetooth
-      inputs.self.modules.nixos.dev
-      inputs.self.modules.nixos.fwupd
-      inputs.self.modules.nixos.gaming-steam
-      inputs.self.modules.nixos.gaming-hardware
-      inputs.self.modules.nixos.gaming-flatpak
-      inputs.self.modules.nixos.gaming-launchers
-      inputs.self.modules.nixos.libvirtd
-      inputs.self.modules.nixos.networkmanager
-      inputs.self.modules.nixos.podman
-
-      # Factory-generated ephemeral module
-      (inputs.self.factory.ephemeral {
-        rootDevice = "/dev/mapper/cryptroot";
-      })
-
-      # Host-specific files (from _rotterdam/)
-      ./_rotterdam/hardware-configuration.nix
-      ./_rotterdam/boot.nix
-      ./_rotterdam/hardware.nix
-      ./_rotterdam/programs.nix
-      ./_rotterdam/services.nix
     ];
   };
 }

aspects/hosts/trantor.nix

@@ -1,54 +1,18 @@
-{ inputs, self, ... }:
+{ inputs, ... }:
+
+let
+  mkHost = inputs.self.lib.mkHost;
+in
+
 {
-  flake.nixosConfigurations.trantor = inputs.nixpkgs-stable.lib.nixosSystem {
+  flake.nixosConfigurations.trantor = mkHost {
+    hostname = "trantor";
     system = "aarch64-linux";
-    specialArgs = { inherit inputs; };
+    nixpkgs = inputs.nixpkgs-stable;
-    modules = [
+    ephemeralRootDev = "/dev/disk/by-id/scsi-360b207ed25d84372a95d1ecf842f8e20-part2";
-      inputs.agenix.nixosModules.default
+    extraModules = with inputs.self.modules.nixos; [
-      { networking.hostName = "trantor"; }
+      # base aspects
-      {
+      server
-        nixpkgs.overlays = [
-          inputs.agenix.overlays.default
-          inputs.self.overlays.default
-        ];
-      }
-
-      # Common aspects (always included)
-      inputs.self.modules.nixos.common-boot
-      inputs.self.modules.nixos.common-console
-      inputs.self.modules.nixos.common-firewall
-      inputs.self.modules.nixos.common-locale
-      inputs.self.modules.nixos.common-nix
-      inputs.self.modules.nixos.common-openssh
-      inputs.self.modules.nixos.common-programs
-      inputs.self.modules.nixos.common-security
-      inputs.self.modules.nixos.common-services
-      inputs.self.modules.nixos.common-tailscale
-
-      # User aspects
-      inputs.self.modules.nixos.user
-      inputs.self.modules.nixos.root
-
-      # Server aspects
-      inputs.self.modules.nixos.server-boot
-      inputs.self.modules.nixos.server-nix
-      inputs.self.modules.nixos.server-tailscale
-
-      # Factory-generated ephemeral module
-      (inputs.self.factory.ephemeral {
-        rootDevice = "/dev/disk/by-id/scsi-360b207ed25d84372a95d1ecf842f8e20-part2";
-      })
-
-      # Host-specific files (from _trantor/)
-      ./_trantor/hardware-configuration.nix
-      ./_trantor/disko.nix
-      ./_trantor/boot.nix
-      ./_trantor/fail2ban.nix
-      ./_trantor/forgejo.nix
-      ./_trantor/networking.nix
-      ./_trantor/nginx.nix
-      ./_trantor/openssh.nix
-      ./_trantor/unbound.nix
     ];
   };
 }

aspects/libvirtd.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.nixos.libvirtd = { config, lib, pkgs, ... }: {
+  flake.modules.nixos.libvirtd =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       virtualisation = {
         libvirtd.enable = true;
         spiceUSBRedirection.enable = true;
@@ -8,6 +15,8 @@
 
       programs.virt-manager.enable = true;
 
+      environment.systemPackages = with pkgs; [ lima ];
+
       networking.firewall.trustedInterfaces = [ "virbr0" ];
 
       users.users.user.extraGroups = [

aspects/lxc.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  flake.modules.nixos.lxc =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation = {
+        lxc = {
+          enable = true;
+          unprivilegedContainers = true;
+        };
+        incus.enable = true;
+      };
+
+      users.users.user.extraGroups = [ "incus-admin" ];
+    };
+}

aspects/networkmanager.nix

@@ -1,6 +1,13 @@
 { ... }:
 {
-  flake.modules.nixos.networkmanager = { config, lib, pkgs, ... }: {
+  flake.modules.nixos.networkmanager =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       networking.networkmanager = {
         enable = true;
         wifi.backend = "iwd";

aspects/programs/utilities.nix

@@ -1,62 +0,0 @@
-{ ... }:
-
-{
-  flake.modules = {
-    nixos.programs-utilities =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          ghostty
-          gnome-disk-utility
-          mission-center
-          nautilus
-          p7zip
-          rclone
-          unrar
-          # Desktop Integration
-          adwaita-icon-theme
-          junction
-          libfido2
-          toggleaudiosink
-          # Xwayland Support
-          xwayland-satellite
-        ];
-
-        services.flatpak.packages = [
-          "com.github.tchx84.Flatseal"
-          "com.rustdesk.RustDesk"
-        ];
-      };
-
-    homeManager.programs-utilities =
-      { pkgs, ... }:
-      {
-        programs = {
-          ghostty = {
-            enable = true;
-            settings = {
-              cursor-style = "block";
-              shell-integration-features = "no-cursor";
-              cursor-style-blink = false;
-              custom-shader = "${builtins.fetchurl {
-                url = "https://raw.githubusercontent.com/hackr-sh/ghostty-shaders/cb6eb4b0d1a3101c869c62e458b25a826f9dcde3/cursor_blaze.glsl";
-                sha256 = "sha256:0g2lgqjdrn3c51glry7x2z30y7ml0y61arl5ykmf4yj0p85s5f41";
-              }}";
-              bell-features = "";
-              gtk-titlebar-style = "tabs";
-              keybind = [ "shift+enter=text:\\x1b\\r" ];
-            };
-          };
-
-          password-store = {
-            enable = true;
-            package = pkgs.pass-wayland;
-          };
-        };
-
-        home.sessionVariables = {
-          TERMINAL = "ghostty";
-        };
-      };
-  };
-}

aspects/server/boot.nix

@@ -1,7 +0,0 @@
-# aspects/server/boot.nix
-{ ... }:
-{
-  flake.modules.nixos.server-boot = { config, lib, pkgs, ... }: {
-    boot.kernelPackages = pkgs.linuxPackages_hardened;
-  };
-}

aspects/server/nix.nix

@@ -1,15 +0,0 @@
-# aspects/server/nix.nix
-{ inputs, ... }:
-{
-  flake.modules.nixos.server-nix = { config, lib, pkgs, ... }: {
-    environment.etc."channels/nixpkgs".source = inputs.nixpkgs-stable.outPath;
-
-    nix = {
-      registry.nixpkgs.flake = inputs.nixpkgs-stable;
-      nixPath = [
-        "nixpkgs=/etc/channels/nixpkgs"
-        "/nix/var/nix/profiles/per-user/root/channels"
-      ];
-    };
-  };
-}

aspects/server/tailscale.nix

@@ -1,15 +0,0 @@
-# aspects/server/tailscale.nix
-{ ... }:
-{
-  flake.modules.nixos.server-tailscale = { config, lib, pkgs, ... }: {
-    services.tailscale = {
-      extraSetFlags = [ "--advertise-exit-node" ];
-      useRoutingFeatures = "server";
-    };
-
-    boot.kernel.sysctl = {
-      "net.ipv4.ip_forward" = 1;
-      "net.ipv6.conf.all.forwarding" = 1;
-    };
-  };
-}

aspects/shell/bash.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  flake.modules.homeManager.shell-bash = { config, lib, pkgs, ... }: {
-    programs.bash = {
-      enable = true;
-      historyFile = "~/.cache/bash_history";
-    };
-  };
-}

aspects/shell/fish.nix

@@ -1,33 +0,0 @@
-{ ... }:
-{
-  flake.modules.homeManager.shell-fish = { config, lib, pkgs, ... }: {
-    programs.fish = {
-      enable = true;
-      interactiveShellInit = ''
-        set fish_greeting
-        ${lib.getExe pkgs.nix-your-shell} fish | source
-      '';
-      loginShellInit = "${lib.getExe pkgs.nix-your-shell} fish | source";
-      plugins = [
-        {
-          name = "bang-bang";
-          src = pkgs.fetchFromGitHub {
-            owner = "oh-my-fish";
-            repo = "plugin-bang-bang";
-            rev = "f969c618301163273d0a03d002614d9a81952c1e";
-            sha256 = "sha256-A8ydBX4LORk+nutjHurqNNWFmW6LIiBPQcxS3x4nbeQ=";
-          };
-        }
-        {
-          name = "z";
-          src = pkgs.fetchFromGitHub {
-            owner = "jethrokuan";
-            repo = "z";
-            rev = "067e867debee59aee231e789fc4631f80fa5788e";
-            sha256 = "sha256-emmjTsqt8bdI5qpx1bAzhVACkg0MNB/uffaRjjeuFxU=";
-          };
-        }
-      ];
-    };
-  };
-}

aspects/stylix.nix

@@ -1,4 +1,5 @@
 { ... }:
+
 {
   flake.modules = {
     nixos.stylix =
@@ -15,10 +16,7 @@
         ...
       }:
       {
-        imports = [
+        imports = [ inputs.stylix.homeModules.stylix ];
-          inputs.stylix.homeModules.stylix
-          inputs.zen-browser.homeModules.beta
-        ];
 
         stylix = {
           enable = true;
@@ -65,15 +63,6 @@
               terminal = 12;
             };
           };
-          targets.zen-browser = {
-            enable = true;
-            profileNames = [ "william" ];
-          };
-        };
-
-        programs.zen-browser = {
-          enable = true;
-          profiles.william = { };
         };
       };
   };

aspects/systems/base.nix

@@ -0,0 +1,55 @@
+{ inputs, ... }:
+{
+  flake.modules = {
+    nixos.base =
+      { lib, pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          boot
+          console
+          firewall
+          fish
+          locale
+          nix
+          security
+          ssh
+        ];
+        environment = {
+          systemPackages = with pkgs; [
+            git
+            fastfetch
+            nixos-firewall-tool
+            sysz
+            wget
+            yazi
+          ];
+          shellAliases = {
+            cat = "${lib.getExe pkgs.bat} --paging=never --style=plain";
+            ls = "${lib.getExe pkgs.eza} --git --icons --group-directories-first";
+            tree = "ls --tree";
+          };
+        };
+
+        programs.command-not-found.enable = false;
+
+        services = {
+          dbus.implementation = "broker";
+          irqbalance.enable = true;
+          fstrim.enable = true;
+          tailscale = {
+            enable = true;
+            extraUpFlags = [ "--operator=user" ];
+          };
+        };
+      };
+
+    homeManager.base =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          bash
+          fish
+        ];
+      };
+  };
+}

aspects/systems/cli.nix

@@ -0,0 +1,33 @@
+{ inputs, ... }:
+
+{
+  flake.modules = {
+    nixos.cli =
+      { pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          btop
+          helix
+          tmux
+        ];
+
+        environment.systemPackages = with pkgs; [
+          p7zip
+          rclone
+        ];
+      };
+    homeManager.cli =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          btop
+          comma
+          direnv
+          helix
+          hm-cli
+          starship
+          tmux
+        ];
+      };
+  };
+}

aspects/systems/desktop.nix

@@ -0,0 +1,210 @@
+{
+  inputs,
+  ...
+}:
+{
+  flake.modules = {
+    nixos.desktop =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        imports = [
+          inputs.nix-flatpak.nixosModules.nix-flatpak
+        ]
+        ++ (with inputs.self.modules.nixos; [
+          graphics
+          media
+          office
+          web
+        ]);
+
+        boot = {
+          plymouth.enable = true;
+          initrd.systemd.enable = true;
+          loader.efi.efiSysMountPoint = "/boot/efi";
+          kernelPackages = pkgs.linuxPackages_xanmod_latest;
+          extraModprobeConfig = ''
+            options bluetooth disable_ertm=1
+          '';
+          kernel.sysctl = {
+            "net.ipv4.tcp_mtu_probing" = 1;
+          };
+          kernelParams = [
+            "quiet"
+            "splash"
+            "i2c-dev"
+            "i2c-piix4"
+            "loglevel=3"
+            "udev.log_priority=3"
+            "rd.udev.log_level=3"
+            "rd.systemd.show_status=false"
+          ];
+        };
+
+        nix = {
+          registry.nixpkgs.flake = inputs.nixpkgs;
+          nixPath = [
+            "nixpkgs=${inputs.nixpkgs}"
+            "/nix/var/nix/profiles/per-user/root/channels"
+          ];
+        };
+
+        environment = {
+          etc."channels/nixpkgs".source = inputs.nixpkgs.outPath;
+          sessionVariables = {
+            KDEHOME = "$XDG_CONFIG_HOME/kde4"; # Stops kde from placing a .kde4 folder in the home dir
+            NIXOS_OZONE_WL = "1"; # Forces chromium and most electron apps to run in wayland
+          };
+          systemPackages = with pkgs; [
+            adwaita-icon-theme
+            ghostty
+            gnome-disk-utility
+            junction
+            libfido2
+            mission-center
+            nautilus
+            toggleaudiosink
+            unrar
+          ];
+        };
+
+        services = {
+          printing.enable = true;
+          udev.packages = with pkgs; [ yubikey-personalization ];
+          keyd = {
+            enable = true;
+            keyboards.all = {
+              ids = [ "*" ];
+              settings.main.capslock = "overload(meta, esc)";
+            };
+          };
+          pipewire = {
+            enable = true;
+            alsa.enable = true;
+            alsa.support32Bit = true;
+            pulse.enable = true;
+            jack.enable = true;
+            wireplumber.enable = true;
+          };
+          greetd = {
+            enable = true;
+            settings.default_session.user = "greeter";
+          };
+          flatpak = {
+            enable = true;
+            packages = [
+              "com.github.tchx84.Flatseal"
+              "com.rustdesk.RustDesk"
+            ];
+            uninstallUnmanaged = true;
+            update.auto.enable = true;
+          };
+          gvfs.enable = true;
+        };
+
+        security.rtkit.enable = true; # Needed for pipewire to acquire realtime priority
+
+        users = {
+          users.greeter = {
+            isSystemUser = true;
+            group = "greeter";
+          };
+          groups.greeter = { };
+        };
+
+        programs = {
+          kdeconnect = {
+            enable = true;
+            package = pkgs.valent;
+          };
+          dconf.enable = true;
+          appimage = {
+            enable = true;
+            binfmt = true;
+          };
+        };
+
+        fonts = {
+          fontDir.enable = true;
+          packages = with pkgs; [
+            corefonts
+            inter
+            nerd-fonts.fira-code
+            noto-fonts-cjk-sans
+            noto-fonts-color-emoji
+            roboto
+          ];
+        };
+
+        xdg.portal = {
+          extraPortals = with pkgs; [
+            xdg-desktop-portal-gnome
+            xdg-desktop-portal-gtk
+          ];
+          config.common.default = "*";
+        };
+      };
+
+    homeManager.desktop =
+      {
+        config,
+        lib,
+        pkgs,
+        inputs,
+        ...
+      }:
+      {
+        imports = [
+          inputs.vicinae.homeManagerModules.default
+        ]
+        ++ (with inputs.self.modules.homeManager; [ media ]);
+
+        fonts.fontconfig.enable = true;
+
+        home = {
+          packages = with pkgs; [ xwayland-satellite ];
+          sessionVariables.TERMINAL = "ghostty";
+        };
+
+        services.vicinae = {
+          enable = true;
+          systemd = {
+            enable = true;
+            autoStart = true;
+          };
+        };
+
+        programs = {
+          ghostty = {
+            enable = true;
+            settings = {
+              cursor-style = "block";
+              shell-integration-features = "no-cursor";
+              cursor-style-blink = false;
+              custom-shader = "${builtins.fetchurl {
+                url = "https://raw.githubusercontent.com/hackr-sh/ghostty-shaders/cb6eb4b0d1a3101c869c62e458b25a826f9dcde3/cursor_blaze.glsl";
+                sha256 = "sha256:0g2lgqjdrn3c51glry7x2z30y7ml0y61arl5ykmf4yj0p85s5f41";
+              }}";
+              bell-features = "";
+              gtk-titlebar-style = "tabs";
+              keybind = [ "shift+enter=text:\\x1b\\r" ];
+            };
+          };
+
+          password-store = {
+            enable = true;
+            package = pkgs.pass-wayland;
+          };
+        };
+
+        xdg = {
+          enable = true;
+          userDirs.enable = true;
+        };
+      };
+  };
+}

aspects/systems/gaming.nix

@@ -0,0 +1,48 @@
+{ inputs, ... }:
+
+{
+  flake.modules = {
+    nixos.gaming =
+      { pkgs, ... }:
+      {
+        imports = with inputs.self.modules.nixos; [
+          mangohud
+          steam
+        ];
+        hardware = {
+          xpadneo.enable = true;
+          steam-hardware.enable = true; # Allow steam client to manage controllers
+          graphics.enable32Bit = true; # For OpenGL games
+        };
+
+        services.flatpak.packages = [
+          "com.github.k4zmu2a.spacecadetpinball"
+          "io.itch.itch"
+          "io.mrarm.mcpelauncher"
+          "net.retrodeck.retrodeck"
+          "org.freedesktop.Platform.VulkanLayer.MangoHud/x86_64/25.08"
+          rec {
+            appId = "com.hypixel.HytaleLauncher";
+            sha256 = "01307s44bklc1ldcigcn9n4lm8hf8q793v9fv7w4w04xd5zyh4rv";
+            bundle = "${pkgs.fetchurl {
+              url = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-latest.flatpak";
+              inherit sha256;
+            }}";
+          }
+        ];
+
+        environment.systemPackages = with pkgs; [
+          clonehero
+          heroic
+          prismlauncher
+        ];
+      };
+    homeManager.gaming =
+      { ... }:
+      {
+        imports = with inputs.self.modules.homeManager; [
+          mangohud
+        ];
+      };
+  };
+}

aspects/systems/server.nix

@@ -0,0 +1,36 @@
+{ inputs, ... }:
+
+{
+  flake.modules.nixos.server =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      boot = {
+        kernelPackages = pkgs.linuxPackages_hardened;
+        kernel.sysctl = {
+          "net.ipv4.ip_forward" = 1;
+          "net.ipv6.conf.all.forwarding" = 1;
+        };
+      };
+
+      environment.etc."channels/nixpkgs".source = inputs.nixpkgs-stable.outPath;
+
+      nix = {
+        registry.nixpkgs.flake = inputs.nixpkgs-stable;
+        nixPath = [
+          "nixpkgs=/etc/channels/nixpkgs"
+          "/nix/var/nix/profiles/per-user/root/channels"
+        ];
+      };
+
+      services.tailscale = {
+        extraSetFlags = [ "--advertise-exit-node" ];
+        useRoutingFeatures = "server";
+      };
+
+    };
+}

aspects/users/_user/git.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   programs = {

aspects/users/user.nix

@@ -1,4 +1,8 @@
-{ inputs, self, ... }:
+{ inputs, ... }:
+
+let
+  mkHomeConfiguration = inputs.self.lib.mkHomeConfiguration;
+in
 
 {
   flake = {
@@ -20,97 +24,30 @@
           hashedPassword = "$6$Pj7v/CpstyuWQQV0$cNujVDhfMBdwlGVEnnd8t71.kZPixbo0u25cd.874iaqLTH4V5fa1f98V5zGapjQCz5JyZmsR94xi00sUrntT0";
         };
       };
-
     homeConfigurations = {
-      "user@rotterdam" = inputs.home-manager.lib.homeManagerConfiguration {
+      "user@rotterdam" = mkHomeConfiguration {
-        pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
+        user = "user";
-        extraSpecialArgs = {
-          inherit inputs;
         hostname = "rotterdam";
-        };
+        userModules = with inputs.self.modules.homeManager; [
-        modules = [
+          # system aspects
-          { nixpkgs.overlays = [ inputs.self.overlays.default ]; }
+          desktop
+          gaming
 
-          # CLI aspects (common module included)
+          # other aspects
-          inputs.self.modules.homeManager.cli-base
+          stylix
-          inputs.self.modules.homeManager.cli-btop
+          niri
-          inputs.self.modules.homeManager.cli-comma
-          inputs.self.modules.homeManager.cli-direnv
-          inputs.self.modules.homeManager.cli-helix
-          inputs.self.modules.homeManager.cli-starship
-          inputs.self.modules.homeManager.cli-tmux
-
-          # Shell
-          inputs.self.modules.homeManager.shell-fish
-          inputs.self.modules.homeManager.shell-bash
-
-          # Desktop
-          inputs.self.modules.homeManager.desktop-desktop
-          inputs.self.modules.homeManager.desktop-niri
-
-          # Gaming
-          inputs.self.modules.homeManager.gaming-mangohud
-
-          # Programs
-          inputs.self.modules.homeManager.programs-media # for obs-studio
-
-          # Stylix
-          inputs.self.modules.homeManager.stylix
-
-          # User-specific (from _user/)
-          ./_user/git.nix
-
-          # Home configuration
-          {
-            home = {
-              username = "user";
-              homeDirectory = "/home/user";
-              stateVersion = "22.05";
-            };
-          }
         ];
       };
-
+      "user@io" = mkHomeConfiguration {
-      "user@io" = inputs.home-manager.lib.homeManagerConfiguration {
+        user = "user";
-        pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs = {
-          inherit inputs;
         hostname = "io";
-        };
+        userModules = with inputs.self.modules.homeManager; [
-        modules = [
+          # system aspects
-          { nixpkgs.overlays = [ inputs.self.overlays.default ]; }
+          desktop
 
-          # CLI aspects (common module included)
+          # other aspects
-          inputs.self.modules.homeManager.cli-base
+          stylix
-          inputs.self.modules.homeManager.cli-btop
+          niri
-          inputs.self.modules.homeManager.cli-comma
-          inputs.self.modules.homeManager.cli-direnv
-          inputs.self.modules.homeManager.cli-helix
-          inputs.self.modules.homeManager.cli-starship
-          inputs.self.modules.homeManager.cli-tmux
-
-          # Shell
-          inputs.self.modules.homeManager.shell-fish
-          inputs.self.modules.homeManager.shell-bash
-
-          # Desktop
-          inputs.self.modules.homeManager.desktop-desktop
-          inputs.self.modules.homeManager.desktop-niri
-
-          # Stylix
-          inputs.self.modules.homeManager.stylix
-
-          # User-specific (from _user/)
-          ./_user/git.nix
-
-          # Home configuration
-          {
-            home = {
-              username = "user";
-              homeDirectory = "/home/user";
-              stateVersion = "22.05";
-            };
-          }
         ];
       };
     };

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1762618334,
+        "lastModified": 1770165109,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -100,11 +100,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1767386128,
+        "lastModified": 1771437256,
-        "narHash": "sha256-BJDu7dIMauO2nYRSL4aI8wDNtEm2KOb7lDKP3hxdrpo=",
+        "narHash": "sha256-bLqwib+rtyBRRVBWhMuBXPCL/OThfokA+j6+uH7jDGU=",
         "owner": "numtide",
         "repo": "blueprint",
-        "rev": "0ed984d51a3031065925ab08812a5434f40b93d4",
+        "rev": "06ee7190dc2620ea98af9eb225aa9627b68b0e33",
         "type": "github"
       },
       "original": {
@@ -140,11 +140,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1768923567,
+        "lastModified": 1769524058,
-        "narHash": "sha256-GVJ0jKsyXLuBzRMXCDY6D5J8wVdwP1DuQmmvYL/Vw/Q=",
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "00395d188e3594a1507f214a2f15d4ce5c07cb28",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
         "type": "github"
       },
       "original": {
@@ -206,11 +206,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1768135262,
+        "lastModified": 1769996383,
-        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768927746,
+        "lastModified": 1770915843,
-        "narHash": "sha256-zyMpWHqcpKVmRc1W2NEK7DAuyVJZV62Jdjqudg70b1k=",
+        "narHash": "sha256-ZwU5wXKNqpOQvjNz6aBp1j5peiBZow1++6pLnk5VAhs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "63a87808f5f9b6e4195a1d33f6ea25d23f4aa0df",
+        "rev": "6a1f7101d2c3ee87d485a87880d73b4665c6a4bd",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768434960,
+        "lastModified": 1769872935,
-        "narHash": "sha256-cJbFn17oyg6qAraLr+NVeNJrXsrzJdrudkzI4H2iTcg=",
+        "narHash": "sha256-07HMIGQ/WJeAQJooA7Kkg1SDKxhAiV6eodvOwTX6WKI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b4d88c9ac42ae1a745283f6547701da43b6e9f9b",
+        "rev": "f4ad5068ee8e89e4a7c2e963e10dd35cd77b37b7",
         "type": "github"
       },
       "original": {
@@ -404,11 +404,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1768835187,
+        "lastModified": 1769548169,
-        "narHash": "sha256-6nY0ixjGjPQCL+/sUC1B1MRiO1LOI3AkRSIywm3i3bE=",
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "0d633a69480bb3a3e2f18c080d34a8fa81da6395",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
         "type": "github"
       },
       "original": {
@@ -432,94 +432,18 @@
         "type": "github"
       }
     },
-    "niri": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1760963745,
-        "narHash": "sha256-FVf9YFw2wQnMAxvMxEk+vFakXhPQUSapDpGmlLzAxjg=",
-        "owner": "baduhai",
-        "repo": "niri",
-        "rev": "dd3e3d1009991ecd87ab7253c9e7696acf2bc943",
-        "type": "github"
-      },
-      "original": {
-        "owner": "baduhai",
-        "ref": "auto-center-when-space-available",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-flake": {
-      "inputs": {
-        "niri-stable": "niri-stable",
-        "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_4",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "xwayland-satellite-stable": "xwayland-satellite-stable",
-        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
-      },
-      "locked": {
-        "lastModified": 1768877436,
-        "narHash": "sha256-ct4qxmFJeJbaJKiOnXOZmRmVmk7TpT+lohuTgTr+kYQ=",
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "rev": "6581f5458309233622c1b73c8902dcaea7be16eb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "type": "github"
-      }
-    },
-    "niri-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1756556321,
-        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "ref": "v25.08",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1768678265,
-        "narHash": "sha256-Ub8eed4DsfIDWyg30xEe+8bSxL/z5Af/gCjmvJ0V/Hs=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "d7184a04b904e07113f4623610775ae78d32394c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
     "nix-ai-tools": {
       "inputs": {
         "blueprint": "blueprint",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_3",
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1768922080,
+        "lastModified": 1771816560,
-        "narHash": "sha256-gFoGvnW2YDWsxKD56kdiXbhh9vBPAU3yusssbXF0UMo=",
+        "narHash": "sha256-q5Wsb1573qDfIPJctG9CBZP0NMniejoB7SmBLZIVAHg=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "78f3fdc13ef903475aa5bfc0f85eeefaa36af837",
+        "rev": "db94a329058a1a37b49d3209af85708b3338559a",
         "type": "github"
       },
       "original": {
@@ -551,11 +475,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765267181,
+        "lastModified": 1770315571,
-        "narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
+        "narHash": "sha256-hy0gcAgAcxrnSWKGuNO+Ob0x6jQ2xkR6hoaR0qJBHYs=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
+        "rev": "2684bb8080a6f2ca5f9d494de5ef875bc1c4ecdb",
         "type": "github"
       },
       "original": {
@@ -568,15 +492,15 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_4",
         "optnix": "optnix"
       },
       "locked": {
-        "lastModified": 1768778579,
+        "lastModified": 1770862985,
-        "narHash": "sha256-6w1Mhg6+46LlaheCa1O/jIk02ukerZ7DdUf9GlQVGxc=",
+        "narHash": "sha256-TFRhwVzPg3ly388J3CYYvjrma/dWjsBVpNE437bWeHk=",
         "owner": "nix-community",
         "repo": "nixos-cli",
-        "rev": "5e79001c7a8b556c3c61d4ef38f0f0fa1187ee90",
+        "rev": "9a2e97e8832b211df22c5cb21a55ebf1c3eb2be1",
         "type": "github"
       },
       "original": {
@@ -587,11 +511,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768661221,
+        "lastModified": 1769330179,
-        "narHash": "sha256-MJwOjrIISfOpdI9x4C+5WFQXvHtOuj5mqLZ4TMEtk1M=",
+        "narHash": "sha256-yxgb4AmkVHY5OOBrC79Vv6EVd4QZEotqv+6jcvA212M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3327b113f2ef698d380df83fbccefad7e83d7769",
+        "rev": "48698d12cc10555a4f3e3222d9c669b884a49dfe",
         "type": "github"
       },
       "original": {
@@ -603,11 +527,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1765674936,
+        "lastModified": 1769909678,
-        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "rev": "72716169fe93074c333e8d0173151350670b824c",
         "type": "github"
       },
       "original": {
@@ -633,27 +557,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1768773494,
+        "lastModified": 1770770419,
-        "narHash": "sha256-XsM7GP3jHlephymxhDE+/TKKO1Q16phz/vQiLBGhpF4=",
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "77ef7a29d276c6d8303aece3444d61118ef71ac2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1768773494,
-        "narHash": "sha256-XsM7GP3jHlephymxhDE+/TKKO1Q16phz/vQiLBGhpF4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "77ef7a29d276c6d8303aece3444d61118ef71ac2",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
         "type": "github"
       },
       "original": {
@@ -663,38 +571,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_10": {
-      "locked": {
-        "lastModified": 1762111121,
-        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_11": {
-      "locked": {
-        "lastModified": 1768127708,
-        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1768564909,
@@ -713,11 +589,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1757967192,
+        "lastModified": 1771207753,
-        "narHash": "sha256-/aA9A/OBmnuOMgwfzdsXRusqzUpd8rQnQY8jtrHK+To=",
+        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0d7c15863b251a7a50265e57c1dca1a7add2e291",
+        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
         "type": "github"
       },
       "original": {
@@ -728,38 +604,6 @@
       }
     },
     "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1768564909,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1768783163,
-        "narHash": "sha256-tLj4KcRDLakrlpvboTJDKsrp6z2XLwyQ4Zmo+w8KsY4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "bde09022887110deb780067364a0818e89258968",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
       "locked": {
         "lastModified": 1767151656,
         "narHash": "sha256-ujL2AoYBnJBN262HD95yer7QYUmYp5kFZGYbyCCKxq8=",
@@ -775,7 +619,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1759070547,
         "narHash": "sha256-JVZl8NaVRYb0+381nl7LvPE+A774/dRpif01FKLrYFQ=",
@@ -791,13 +635,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1768564909,
+        "lastModified": 1770562336,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
         "type": "github"
       },
       "original": {
@@ -807,7 +651,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_9": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1767767207,
         "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
@@ -823,6 +667,38 @@
         "type": "github"
       }
     },
+    "nixpkgs_8": {
+      "locked": {
+        "lastModified": 1762111121,
+        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_9": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "noctalia": {
       "inputs": {
         "nixpkgs": [
@@ -830,11 +706,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768924718,
+        "lastModified": 1770922006,
-        "narHash": "sha256-T4H/VMjGwBuHEIrPYWfXQ73XV0foCuFGgH7k3SNSJDo=",
+        "narHash": "sha256-xg40mnp5KKBepACmvlPzmn5iPyUBxktfv50saSVUn0M=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "1ef5c0eb307e8a4f30dfa6bcc75cf90ae8c6af46",
+        "rev": "d87364964948b9d691f8363f85a5e23bee154df9",
         "type": "github"
       },
       "original": {
@@ -871,7 +747,7 @@
     "optnix": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
         "lastModified": 1765418479,
@@ -895,14 +771,12 @@
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
         "import-tree": "import-tree",
-        "niri": "niri",
-        "niri-flake": "niri-flake",
         "nix-ai-tools": "nix-ai-tools",
         "nix-flatpak": "nix-flatpak",
         "nix-index-database": "nix-index-database",
         "nixos-cli": "nixos-cli",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_6",
-        "nixpkgs-stable": "nixpkgs-stable_2",
+        "nixpkgs-stable": "nixpkgs-stable",
         "noctalia": "noctalia",
         "stylix": "stylix",
         "terranix": "terranix",
@@ -910,27 +784,6 @@
         "zen-browser": "zen-browser"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "niri",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1757989933,
-        "narHash": "sha256-9cpKYWWPCFhgwQTww8S94rTXgg8Q8ydFv9fXM6I8xQM=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "8249aa3442fb9b45e615a35f39eca2fe5510d7c3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "stylix": {
       "inputs": {
         "base16": "base16",
@@ -940,7 +793,7 @@
         "firefox-gnome-theme": "firefox-gnome-theme",
         "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
-        "nixpkgs": "nixpkgs_9",
+        "nixpkgs": "nixpkgs_7",
         "nur": "nur",
         "systems": "systems_3",
         "tinted-foot": "tinted-foot",
@@ -950,11 +803,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1768744881,
+        "lastModified": 1770914701,
-        "narHash": "sha256-3+h7OxqfrPIB/tRsiZXWE9sCbTm7NQN5Ie428p+S6BA=",
+        "narHash": "sha256-QHFYyngohNhih4w+3IqQty5DV+p1txsx1kkk6XJWar8=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "06684f00cfbee14da96fd4307b966884de272d3a",
+        "rev": "db03fed72e5ca02be34e1d24789345a943329738",
         "type": "github"
       },
       "original": {
@@ -1149,11 +1002,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768158989,
+        "lastModified": 1770228511,
-        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
         "type": "github"
       },
       "original": {
@@ -1164,15 +1017,15 @@
     },
     "vicinae": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10",
+        "nixpkgs": "nixpkgs_8",
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1768856963,
+        "lastModified": 1770912475,
-        "narHash": "sha256-u5bWDuwk6oieTnvm1YjNotcYK8iJSddH5+S68+X4TSc=",
+        "narHash": "sha256-21lurBRyHgJbVD3E0/i7Fhxi4rBUxyznGfKpdGVtEdc=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "934bc0ad47be6dbd6498a0dac655c4613fd0ab27",
+        "rev": "0c70267ab7e07d7972012fcf8ae58808a32a2e86",
         "type": "github"
       },
       "original": {
@@ -1181,50 +1034,17 @@
         "type": "github"
       }
     },
-    "xwayland-satellite-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1755491097,
-        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "ref": "v0.7",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
-    "xwayland-satellite-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1768765571,
-        "narHash": "sha256-C1JbyJ3ftogmN3vmLNfyPtnJw2wY64TiUTIhFtk1Leg=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "ed1cef792b4def3321ff9ab5479df09609f17a69",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
     "zen-browser": {
       "inputs": {
         "home-manager": "home-manager_4",
-        "nixpkgs": "nixpkgs_11"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
-        "lastModified": 1768919538,
+        "lastModified": 1771000521,
-        "narHash": "sha256-w10iy/aqd5LtD78NDWWG+eKGzkb+cGhAAo7PVciLbWE=",
+        "narHash": "sha256-5UDaXr770MaDac9HcFvGlUjsqyOoNbFdHArmjmtHcVk=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "37149a5b77e8fd2b5332e8cec9edf39ca5b8e8bc",
+        "rev": "80ce62fd26af1934454f405bcb2510ceeea8d3a2",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,7 +26,6 @@
     stylix.url = "github:danth/stylix";
 
     # nixos/hm program modules
-    niri-flake.url = "github:sodiboo/niri-flake";
     nix-ai-tools.url = "github:numtide/llm-agents.nix";
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
@@ -44,9 +43,6 @@
       url = "github:terranix/terranix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    # others
-    niri.url = "github:baduhai/niri/auto-center-when-space-available";
   };
 
   outputs =

packages/claude-desktop.nix

@@ -1,215 +0,0 @@
-{ inputs, ... }:
-
-{
-  perSystem =
-    { system, ... }:
-    let
-      pkgs = import inputs.nixpkgs {
-        inherit system;
-        config.allowUnfree = true;
-      };
-
-      pname = "claude-desktop";
-      version = "1.0.1768";
-
-      srcs.x86_64-linux = pkgs.fetchurl {
-        url = "https://downloads.claude.ai/releases/win32/x64/1.0.1768/Claude-67d01376d0e9d08b328455f6db9e63b0d603506a.exe";
-        hash = "sha256-x76Qav38ya3ObpWIq3dDowo79LgvVquMfaZeH8M1LUk=;";
-      };
-
-      src =
-        srcs.${pkgs.stdenv.hostPlatform.system} or (throw "Unsupported system: ${pkgs.stdenv.hostPlatform.system}");
-
-      claudeNativeStub = ''
-        // Stub implementation of claude-native using KeyboardKey enum values
-        const KeyboardKey = {
-          Backspace: 43, Tab: 280, Enter: 261, Shift: 272, Control: 61, Alt: 40,
-          CapsLock: 56, Escape: 85, Space: 276, PageUp: 251, PageDown: 250,
-          End: 83, Home: 154, LeftArrow: 175, UpArrow: 282, RightArrow: 262,
-          DownArrow: 81, Delete: 79, Meta: 187
-        };
-        Object.freeze(KeyboardKey);
-        module.exports = {
-          getWindowsVersion: () => "10.0.0",
-          setWindowEffect: () => {},
-          removeWindowEffect: () => {},
-          getIsMaximized: () => false,
-          flashFrame: () => {},
-          clearFlashFrame: () => {},
-          showNotification: () => {},
-          setProgressBar: () => {},
-          clearProgressBar: () => {},
-          setOverlayIcon: () => {},
-          clearOverlayIcon: () => {},
-          KeyboardKey
-        };
-      '';
-    in
-    {
-      packages.claude-desktop = pkgs.stdenv.mkDerivation rec {
-        inherit pname version src;
-
-        nativeBuildInputs = with pkgs; [
-          makeWrapper
-          copyDesktopItems
-          p7zip
-          unzip
-          nodejs
-          graphicsmagick
-        ];
-
-        buildInputs = [ pkgs.electron ];
-
-        desktopItems = [
-          (pkgs.makeDesktopItem {
-            name = "claude-desktop";
-            desktopName = "Claude";
-            comment = "AI assistant from Anthropic";
-            exec = "claude-desktop %u";
-            icon = "claude-desktop";
-            categories = [
-              "Network"
-              "Chat"
-              "Office"
-            ];
-            mimeTypes = [ "x-scheme-handler/claude" ];
-            startupNotify = true;
-            startupWMClass = "Claude";
-          })
-        ];
-
-        unpackPhase = ''
-          runHook preUnpack
-
-          # Extract the Windows installer - use -y to auto-overwrite
-          7z x -y $src -o./extracted
-
-          # The installer contains a NuGet package
-          if [ -f ./extracted/AnthropicClaude-*-full.nupkg ]; then
-            echo "Found NuGet package, extracting..."
-            # NuGet packages are just zip files
-            unzip -q ./extracted/AnthropicClaude-*-full.nupkg -d ./nupkg
-
-            # Extract app.asar to modify it
-            if [ -f ./nupkg/lib/net45/resources/app.asar ]; then
-              echo "Extracting app.asar..."
-              ${pkgs.asar}/bin/asar extract ./nupkg/lib/net45/resources/app.asar ./app
-
-              # Also copy the unpacked resources
-              if [ -d ./nupkg/lib/net45/resources/app.asar.unpacked ]; then
-                cp -r ./nupkg/lib/net45/resources/app.asar.unpacked/* ./app/
-              fi
-
-              # Copy additional resources
-              mkdir -p ./app/resources
-              mkdir -p ./app/resources/i18n
-              cp ./nupkg/lib/net45/resources/Tray* ./app/resources/ || true
-              cp ./nupkg/lib/net45/resources/*-*.json ./app/resources/i18n/ || true
-            fi
-          else
-            echo "NuGet package not found"
-            ls -la ./extracted/
-            exit 1
-          fi
-
-          runHook postUnpack
-        '';
-
-        buildPhase = ''
-          runHook preBuild
-
-          # Replace the Windows-specific claude-native module with a stub
-          if [ -d ./app/node_modules/claude-native ]; then
-            echo "Replacing claude-native module with Linux stub..."
-            rm -rf ./app/node_modules/claude-native/*.node
-            cat > ./app/node_modules/claude-native/index.js << 'EOF'
-          ${claudeNativeStub}
-          EOF
-          fi
-
-          # Fix the title bar detection (from aaddrick script)
-          echo "Fixing title bar detection..."
-          SEARCH_BASE="./app/.vite/renderer/main_window/assets"
-          if [ -d "$SEARCH_BASE" ]; then
-            TARGET_FILE=$(find "$SEARCH_BASE" -type f -name "MainWindowPage-*.js" | head -1)
-            if [ -n "$TARGET_FILE" ]; then
-              echo "Found target file: $TARGET_FILE"
-              # Replace patterns like 'if(!VAR1 && VAR2)' with 'if(VAR1 && VAR2)'
-              sed -i -E 's/if\(!([a-zA-Z]+)[[:space:]]*&&[[:space:]]*([a-zA-Z]+)\)/if(\1 \&\& \2)/g' "$TARGET_FILE"
-              echo "Title bar fix applied"
-            fi
-          fi
-
-          runHook postBuild
-        '';
-
-        installPhase = ''
-          runHook preInstall
-
-          mkdir -p $out/lib/claude-desktop
-
-          # Repack the modified app as app.asar
-          cd ./app
-          ${pkgs.asar}/bin/asar pack . ../app.asar
-          cd ..
-
-          # Copy resources
-          mkdir -p $out/lib/claude-desktop/resources
-          cp ./app.asar $out/lib/claude-desktop/resources/
-
-          # Create app.asar.unpacked directory with the stub
-          mkdir -p $out/lib/claude-desktop/resources/app.asar.unpacked/node_modules/claude-native
-          cat > $out/lib/claude-desktop/resources/app.asar.unpacked/node_modules/claude-native/index.js << 'EOF'
-          ${claudeNativeStub}
-          EOF
-
-          # Copy other resources
-          if [ -d ./nupkg/lib/net45/resources ]; then
-            cp ./nupkg/lib/net45/resources/*.png $out/lib/claude-desktop/resources/ 2>/dev/null || true
-            cp ./nupkg/lib/net45/resources/*.ico $out/lib/claude-desktop/resources/ 2>/dev/null || true
-            cp ./nupkg/lib/net45/resources/*.json $out/lib/claude-desktop/resources/ 2>/dev/null || true
-          fi
-
-          # Create wrapper script
-          makeWrapper ${pkgs.electron}/bin/electron $out/bin/claude-desktop \
-            --add-flags "$out/lib/claude-desktop/resources/app.asar" \
-            --set DISABLE_AUTOUPDATER 1 \
-            --set NODE_ENV production
-
-          # Extract and install icons in multiple sizes
-          if [ -f ./extracted/setupIcon.ico ]; then
-            echo "Converting and installing icons..."
-            # Count frames in the ICO file and extract each one
-            frame_count=$(gm identify ./extracted/setupIcon.ico | wc -l)
-            for i in $(seq 0 $((frame_count - 1))); do
-              gm convert "./extracted/setupIcon.ico[$i]" "./extracted/setupIcon-$i.png" 2>/dev/null || true
-            done
-
-            # Loop through converted icons and install them by size
-            for img in ./extracted/setupIcon-*.png; do
-              if [ -f "$img" ]; then
-                size=$(gm identify -format "%wx%h" "$img")
-                # Skip smallest icons (16x16 and 32x32) as they're too low quality
-                if [ "$size" != "16x16" ] && [ "$size" != "32x32" ]; then
-                  mkdir -p "$out/share/icons/hicolor/$size/apps"
-                  cp "$img" "$out/share/icons/hicolor/$size/apps/claude-desktop.png"
-                fi
-              fi
-            done
-          fi
-
-          runHook postInstall
-        '';
-
-        meta = with pkgs.lib; {
-          description = "Claude Desktop - AI assistant from Anthropic";
-          homepage = "https://claude.ai";
-          license = licenses.unfree;
-          sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-          maintainers = [ ];
-          platforms = [ "x86_64-linux" ];
-          mainProgram = "claude-desktop";
-        };
-      };
-    };
-}

packages/hm-cli.nix

@@ -5,8 +5,6 @@
     { pkgs, ... }:
     {
       packages.hm-cli = pkgs.writeShellScriptBin "hm" ''
-        set -e
-
         HM="${pkgs.lib.getExe pkgs.home-manager}"
         FLAKE_PATH="''${HM_PATH:-$HOME/.config/home-manager}"
         FLAKE_OUTPUT="''${HM_USER:-$(whoami)@$(hostname)}"

packages/niri-auto-centre.nix

@@ -0,0 +1,32 @@
+{ ... }:
+
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages.niri-auto-centre = pkgs.writeShellApplication {
+        name = "niri-auto-centre";
+        runtimeInputs = [ pkgs.jq ];
+        text = ''
+          while true; do
+              ACTIVE_WORKSPACE=$(niri msg --json workspaces | jq -r '.[] | select(.is_active == true)')
+              WORKSPACE_ID=$(echo "$ACTIVE_WORKSPACE" | jq -r '.id')
+              OUTPUT_NAME=$(echo "$ACTIVE_WORKSPACE" | jq -r '.output')
+              
+              MONITOR_WIDTH=$(niri msg --json outputs | jq -r ".\"$OUTPUT_NAME\".logical.width")
+              
+              SUMMED_TILE_WIDTH=$(niri msg --json windows | jq --argjson wid "$WORKSPACE_ID" -r '
+                  [.[] | select(.workspace_id == $wid) | {col: .layout.pos_in_scrolling_layout[0], width: .layout.tile_size[0]}]
+                  | group_by(.col) | map(first.width) | add
+              ')
+              
+              if awk "BEGIN {exit !($SUMMED_TILE_WIDTH < $MONITOR_WIDTH)}"; then
+                  niri msg action center-visible-columns
+              fi
+              
+              sleep 0.1
+          done
+        '';
+      };
+    };
+}

packages/overlays.nix

@@ -4,19 +4,20 @@ let
   packageDir = builtins.readDir ./.;
 
   # Filter to .nix files, excluding overlays.nix
-  isPackageFile = name:
+  isPackageFile = name: name != "overlays.nix" && builtins.match ".*\\.nix$" name != null;
-    name != "overlays.nix" && builtins.match ".*\\.nix$" name != null;
 
   # Extract package name from filename (e.g., "foo-bar.nix" -> "foo-bar")
-  toPackageName = filename:
+  toPackageName = filename: builtins.head (builtins.match "(.+)\\.nix$" filename);
-    builtins.head (builtins.match "(.+)\\.nix$" filename);
 
   packageNames = map toPackageName (builtins.filter isPackageFile (builtins.attrNames packageDir));
 in
 {
-  flake.overlays.default = final: prev:
+  flake.overlays.default =
-    builtins.listToAttrs (map (name: {
+    final: prev:
+    builtins.listToAttrs (
+      map (name: {
         inherit name;
         value = inputs.self.packages.${final.system}.${name};
-    }) packageNames);
+      }) packageNames
+    );
 }

readme.md

@@ -1,87 +1,73 @@
-# Nix Configuration
+# NixOS Flake Configuration
 
-My personal Nix configuration for multiple NixOS hosts, home-manager users, miscellaneous resources... too many things to list. If I could put my life in a flake I would.
+Modular NixOS configuration using flake-parts with the [dendritic](https://github.com/gytis-ivaskevicius/dendritic) pattern.
+
+## Structure
+
+```
+.
+├── aspects/           # Reusable NixOS/home-manager modules (dendritic)
+│   ├── base/          # Base system configuration
+│   ├── hosts/         # Host-specific configurations
+│   │   ├── _alexandria/
+│   │   ├── _io/
+│   │   ├── _rotterdam/
+│   │   └── _trantor/
+│   ├── systems/       # System type modules (desktop, server, cli, gaming)
+│   └── users/         # User account configurations
+├── data/              # Shared host/service definitions
+├── packages/          # Custom packages and overlays
+├── shells/            # Shell configurations
+└── terranix/          # Terraform configurations for cloud resources
+```
 
 ## Hosts
 
-### Desktop Systems
+| Host | Architecture | Type | Description |
-- **rotterdam** - Main desktop workstation (x86_64)
+|------|--------------|------|-------------|
-  - Features: Desktop, AI tools, Bluetooth, Dev environment, Gaming, Virtualization (libvirtd), Podman
+| trantor | aarch64-linux | server | ARM server running Forgejo |
-  - Storage: Ephemeral root with LUKS encryption
+| alexandria | x86_64-linux | server | x86 server (Kanidm, Vaultwarden, Nextcloud, Jellyfin) |
-
+| rotterdam | x86_64-linux | desktop | Main workstation setup for gaming |
-- **io** - Laptop workstation (x86_64)
+| io | x86_64-linux | desktop | Workstation |
-  - Features: Desktop, AI tools, Bluetooth, Dev environment, Podman
-  - Storage: Ephemeral root with LUKS encryption
-
-### Servers
-- **alexandria** - Home server (x86_64)
-  - Hosts: Nextcloud, Vaultwarden, Jellyfin, Kanidm
-
-- **trantor** - Cloud server (aarch64)
-  - Hosts: Forgejo
-  - Cloud provider: Oracle Cloud Infrastructure
-  - Storage: Ephemeral root with btrfs
-
-## Home Manager Configurations
-
-- **user@rotterdam** - Full desktop setup with gaming, OBS, and complete development environment
-- **user@io** - Lightweight desktop setup
-
-Both configurations include:
-- btop, direnv, helix, starship, tmux
-- Stylix theme management
-- Fish shell with custom configurations
-
-## Terranix Configurations
-
-Infrastructure as code using Terranix (NixOS + Terraform/OpenTofu):
-
-- **oci-trantor** - Oracle Cloud Infrastructure provisioning for Trantor server
-- **cloudflare-baduhaidev** - DNS and CDN configuration for baduhai.dev domain
-- **tailscale-tailnet** - Tailscale network ACL and device management
 
 ## Services
 
-All services are accessible via custom domains under baduhai.dev:
+- **git.baduhai.dev** (Forgejo) - Publicly accessible on trantor
 
-- **Kanidm** (auth.baduhai.dev) - Identity and access management
+Other services (LAN/Tailscale only): Vaultwarden, Nextcloud, Jellyfin
-- **Vaultwarden** (pass.baduhai.dev) - Password manager
-- **Forgejo** (git.baduhai.dev) - Git forge (publicly accessible)
-- **Nextcloud** (cloud.baduhai.dev) - File sync and collaboration
-- **Jellyfin** (jellyfin.baduhai.dev) - Media server
 
-Services are accessible via:
+## Features
-- LAN for alexandria-hosted services
-- Tailscale VPN for all services
-- Public internet for Forgejo only
 
-## Notable Features
+- **Ephemeral root**: Automatic btrfs subvolume rollover with impermanence
+- **Secrets**: Managed via agenix with age encryption
+- **Disk management**: disko for declarative disk partitioning
+- **Modular architecture**: Each aspect is a separate module imported via import-tree
+- **Dendritic pattern**: Aspects are imported as a unified flake module
 
-### Ephemeral Root
+## Building
-Rotterdam, io, and trantor use an ephemeral root filesystem that resets on every boot:
-- Root filesystem is automatically rolled back using btrfs snapshots
-- Old snapshots retained for 30 days
-- Persistent data stored in dedicated subvolumes
-- Implements truly stateless systems
 
-### Custom DNS Architecture
+```bash
-- Unbound DNS servers on both alexandria and trantor
+# Build specific host
-- Service routing based on visibility flags (public/LAN/Tailscale)
+nix build .#nixosConfigurations.trantor.config.system.build.toplevel
-- Split-horizon DNS for optimal access paths
 
-### Security
+# Rebuild host (if using nixos-cli on the host)
-- LUKS full-disk encryption on desktop systems
+sudo nixos apply
-- Fail2ban on public-facing servers
+```
-- agenix for secrets management
-- Tailscale for secure remote access
 
-### Desktop Environment
+## Terranix
-- Custom Niri window manager (Wayland compositor)
-- Using forked version with auto-centering feature
-- Stylix for consistent theming
 
-### Development Setup
+Terraform configurations for cloud infrastructure managed via terranix:
-- Nix flakes for reproducible builds
+
-- deploy-rs for automated deployments
+- baduhai.dev DNS on CloudFlare
-- Podman for containerization
+- VPS provisioning on OCI
-- Complete AI tooling integration
+- Tailscale subnet routers
+
+## Key Dependencies
+
+- nixpkgs (nixos-unstable for workstations, nixos for servers)
+- home-manager
+- agenix
+- disko
+- impermanence
+- nix-flatpak
+- nixos-cli

shells/default.nix

@@ -6,7 +6,7 @@
     {
       devShells.default = pkgs.mkShell {
         packages = with pkgs; [
-          inputs.agenix.packages.${system}.default
+          inputs.agenix.packages.${stdenv.hostPlatform.system}.default
           nil
           nixfmt
         ];

terranix/kernelpanic.space.nix

@@ -8,9 +8,12 @@
       terranix.terranixConfigurations.cloudflare-kernelpanicspace = {
         terraformWrapper.package = pkgs.opentofu;
         modules = [
-          ({ config, ... }: {
+          (
+            { config, ... }:
+            {
               # Terraform config goes here
-          })
+            }
+          )
         ];
       };
     };

terranix/terminus.nix

@@ -8,9 +8,12 @@
       terranix.terranixConfigurations.oci-terminus = {
         terraformWrapper.package = pkgs.opentofu;
         modules = [
-          ({ config, ... }: {
+          (
+            { config, ... }:
+            {
               # Terraform config goes here
-          })
+            }
+          )
         ];
       };
     };