feat(home): switch to nemo with extensions

Also add it to my Waybar config

.envrc

@@ -1,3 +1,4 @@
+# -*- mode: sh; -*-
 if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
   source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
 fi

README.md

@@ -4,14 +4,12 @@ Personal NixOS configuration for my machines, using Nix Flakes for reproducible
 
 ## Repository Structure
 
-- **flake.nix**: Main entry point for the Nix Flake, defining NixOS and home-manager configurations
-- **hosts/**: Host-specific NixOS configurations
-- **modules/**: Custom NixOS modules reusable across different hosts
-- **programs/**: System-level programs shared across hosts
-- **secrets/**: Encrypted secrets managed with sops-nix
-- **system/**: Common system-level configurations shared across hosts
-- **users/phundrak/**: Home-manager configuration for my user
-- **users/modules/**: Custom user modules reusable across configurations
+- **flake.nix**: Main entry point for the Nix Flake, defining NixOS and home-manager configurations.
+- **hosts/**: Contains the host-specific NixOS configurations.
+- **system/**: Holds system-wide configuration modules that can be shared across different hosts. This includes things like boot settings, desktop environments, hardware configurations, networking, packages, security, and system services.
+- **users/**: Manages user-specific configurations. It's split into `modules` for reusable home-manager configurations and `phundrak` for my personal configuration.
+- **keys/**: Public keys for various machines.
+- **secrets/**: Encrypted secrets managed with `sops-nix`.
 
 ## Usage
 
@@ -51,24 +49,9 @@ nh home switch
 
 Format Nix files (using Alejandra):
 ```bash
-nix fmt
+nix fmt .
 ```
 
-## Development
-
-For development, a devShell is provided with linting tools and git hooks:
-
-```bash
-nix develop
-```
-
-This will set up an environment with:
-- alejandra (formatting)
-- commitizen (commit messages)
-- deadnix (dead code detection)
-- statix (linting)
-- Other useful git hooks
-
 ## Contributing
 
 Feel free to fork this repository and make your own changes. If you have any improvements or suggestions, please open an issue or submit a pull request.

flake.lock

@@ -6,7 +6,8 @@
           "devenv"
         ],
         "flake-compat": [
-          "devenv"
+          "devenv",
+          "flake-compat"
         ],
         "git-hooks": [
           "devenv",
@@ -18,11 +19,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748883665,
-        "narHash": "sha256-R0W7uAg+BLoHjMRMQ8+oiSbTq8nkGz5RDpQ+ZfxxP3A=",
+        "lastModified": 1760971495,
+        "narHash": "sha256-IwnNtbNVrlZIHh7h4Wz6VP0Furxg9Hh0ycighvL5cZc=",
         "owner": "cachix",
         "repo": "cachix",
-        "rev": "f707778d902af4d62d8dd92c269f8e70de09acbe",
+        "rev": "c5bfd933d1033672f51a863c47303fc0e093c2d2",
         "type": "github"
       },
       "original": {
@@ -32,10 +33,32 @@
         "type": "github"
       }
     },
+    "claude-desktop": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764098187,
+        "narHash": "sha256-H6JjWXhKqxZ8QLMoqndZx9e5x0Sv5AiipSmqvIxIbgo=",
+        "owner": "k3d3",
+        "repo": "claude-desktop-linux-flake",
+        "rev": "b2b040cb68231d2118906507d9cc8fd181ca6308",
+        "type": "github"
+      },
+      "original": {
+        "owner": "k3d3",
+        "repo": "claude-desktop-linux-flake",
+        "type": "github"
+      }
+    },
     "devenv": {
       "inputs": {
         "cachix": "cachix",
         "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
         "nix": "nix",
         "nixpkgs": [
@@ -43,11 +66,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753300020,
-        "narHash": "sha256-jRO3ELwG+FfYDBTDDhBJNjGuJjB4IgziuB1JWoz6l1A=",
+        "lastModified": 1764669403,
+        "narHash": "sha256-aJCOp0CV/9KIR2LTwSbZZN3j9Avg7umYyaqDFPoOVhI=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "90266818017f7a6885edc75eb4a13b68862675ea",
+        "rev": "3f2d25e7af748127da0571266054575dd8fec5ab",
         "type": "github"
       },
       "original": {
@@ -59,11 +82,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -76,16 +99,15 @@
       "inputs": {
         "nixpkgs-lib": [
           "devenv",
-          "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1760948891,
+        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
         "type": "github"
       },
       "original": {
@@ -112,6 +134,24 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "git-hooks": {
       "inputs": {
         "flake-compat": [
@@ -125,11 +165,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "lastModified": 1760663237,
+        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
         "type": "github"
       },
       "original": {
@@ -167,11 +207,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753373145,
-        "narHash": "sha256-UhuUj46dobD/POOdVNxKvAvP3luI2T0MZPm2IXl266Y=",
+        "lastModified": 1764780230,
+        "narHash": "sha256-/hLZoLxzr2jwMStuUofB6PZm2eE3kpw91WObm66vPUs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "64796151f79e6f3834bfc55f07c5487708bb5b3f",
+        "rev": "af324afa72de6d23162f0cdcb0716afe6e626683",
         "type": "github"
       },
       "original": {
@@ -186,7 +226,10 @@
           "devenv",
           "flake-compat"
         ],
-        "flake-parts": "flake-parts",
+        "flake-parts": [
+          "devenv",
+          "flake-parts"
+        ],
         "git-hooks-nix": [
           "devenv",
           "git-hooks"
@@ -203,16 +246,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1752773918,
-        "narHash": "sha256-dOi/M6yNeuJlj88exI+7k154z+hAhFcuB8tZktiW7rg=",
+        "lastModified": 1761648602,
+        "narHash": "sha256-H97KSB/luq/aGobKRuHahOvT1r7C03BgB6D5HBZsbN8=",
         "owner": "cachix",
         "repo": "nix",
-        "rev": "031c3cf42d2e9391eee373507d8c12e0f9606779",
+        "rev": "3e5644da6830ef65f0a2f7ec22830c46285bfff6",
         "type": "github"
       },
       "original": {
         "owner": "cachix",
-        "ref": "devenv-2.30",
+        "ref": "devenv-2.30.6",
         "repo": "nix",
         "type": "github"
       }
@@ -224,11 +267,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752985182,
-        "narHash": "sha256-sX8Neff8lp3TCHai6QmgLr5AD8MdsQQX3b52C1DVXR8=",
+        "lastModified": 1764475780,
+        "narHash": "sha256-77jL5H5x51ksLiOUDjY0ZK8e2T4ZXLhj3ap8ETvknWI=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "fafdcb505ba605157ff7a7eeea452bc6d6cbc23c",
+        "rev": "5a3ff8c1a09003f399f43d5742d893c0b1ab8af0",
         "type": "github"
       },
       "original": {
@@ -239,11 +282,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753250450,
-        "narHash": "sha256-i+CQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s=",
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "fc02ee70efb805d3b2865908a13ddd4474557ecf",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
         "type": "github"
       },
       "original": {
@@ -255,7 +298,7 @@
     },
     "pumo-system-info": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -282,21 +325,22 @@
         ]
       },
       "locked": {
-        "lastModified": 1753335654,
-        "narHash": "sha256-XpegouCfuzYNECDpH0+J3UEdearlYhRkRgOZ97l16E8=",
+        "lastModified": 1764663772,
+        "narHash": "sha256-sHqLmm0wAt3PC4vczJeBozI1/f4rv9yp3IjkClHDXDs=",
         "ref": "refs/heads/master",
-        "rev": "f90bef2d994c88f075dbc2fcd81140e160351328",
-        "revCount": 654,
+        "rev": "26531fc46ef17e9365b03770edd3fb9206fcb460",
+        "revCount": 713,
         "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+        "url": "https://git.outfoxxed.me/quickshell/quickshell"
       },
       "original": {
         "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+        "url": "https://git.outfoxxed.me/quickshell/quickshell"
       }
     },
     "root": {
       "inputs": {
+        "claude-desktop": "claude-desktop",
         "devenv": "devenv",
         "home-manager": "home-manager",
         "nix-index-database": "nix-index-database",
@@ -335,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752544651,
-        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
         "type": "github"
       },
       "original": {
@@ -363,6 +407,21 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "zen-browser": {
       "inputs": {
         "nixpkgs": [
@@ -370,11 +429,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752725859,
-        "narHash": "sha256-kjpmc7Y164ajPdscAZLFQTtzXP5sEE2dR30NuHe5lQY=",
+        "lastModified": 1764648680,
+        "narHash": "sha256-B/nmawJ75/951Xs9ludSxDVd/txFY+odmcbinySqMQo=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "2276ddce91a949e0819d9e8c4b171c40ce770390",
+        "rev": "897df2f2ad4880563ce801fa29f348a4e98f0a20",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,27 +3,29 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    devenv = {
+      url = "github:cachix/devenv";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    devenv = {
-      url = "github:cachix/devenv";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     pumo-system-info = {
       url = "git+https://labs.phundrak.com/phundrak/pumo-system-info";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     quickshell = {
-      url = "git+https://git.outfoxxed.me/outfoxxed/quickshell";
+      url = "git+https://git.outfoxxed.me/quickshell/quickshell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -32,6 +34,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    claude-desktop = {
+      url = "github:k3d3/claude-desktop-linux-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -81,81 +88,54 @@
       ];
     };
 
-    homeConfigurations = {
+    homeConfigurations = let
+      extraSpecialArgs = {inherit inputs outputs system;};
+      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      defaultUserModules = [
+        inputs.sops-nix.homeManagerModules.sops
+      ];
+      withUserModules = modules: nixpkgs.lib.lists.flatten (defaultUserModules ++ [modules]);
+    in {
       "phundrak@alys" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs = {
-          inherit inputs outputs;
-          home-conf = "minimal";
-        };
-        modules = [
-          ./users/phundrak/alys.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
+        inherit extraSpecialArgs pkgs;
+        modules = withUserModules ./users/phundrak/host/alys.nix;
       };
       "phundrak@marpa" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs = {
-          inherit inputs outputs;
-          home-conf = "fullHome";
-        };
-        modules = [
-          ./users/phundrak/marpa.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
+        inherit extraSpecialArgs pkgs;
+        modules = withUserModules ./users/phundrak/host/marpa.nix;
       };
       "phundrak@gampo" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs = {
-          inherit inputs outputs;
-          home-conf = "fullHome";
-        };
-        modules = [
-          ./users/phundrak/gampo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
+        inherit extraSpecialArgs pkgs;
+        modules = withUserModules ./users/phundrak/host/gampo.nix;
       };
       "phundrak@tilo" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs = {
-          inherit inputs outputs;
-          home-conf = "minimal";
-        };
-        modules = [
-          ./users/phundrak/tilo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
+        inherit extraSpecialArgs pkgs;
+        modules = withUserModules ./users/phundrak/host/tilo.nix;
       };
     };
 
-    nixosConfigurations = {
+    nixosConfigurations = let
+      specialArgs = {inherit inputs outputs;};
+      defaultSystemModules = [
+        inputs.sops-nix.nixosModules.sops
+      ];
+      withSystemModules = modules: nixpkgs.lib.lists.flatten (defaultSystemModules ++ [modules]);
+    in {
       alys = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
-        modules = [
-          ./hosts/alys/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
+        inherit specialArgs;
+        modules = withSystemModules ./hosts/alys/configuration.nix;
       };
       gampo = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
-        modules = [
-          ./hosts/gampo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
+        inherit specialArgs;
+        modules = withSystemModules ./hosts/gampo/configuration.nix;
       };
       marpa = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
-        modules = [
-          ./hosts/marpa/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
+        inherit specialArgs;
+        modules = withSystemModules ./hosts/marpa/configuration.nix;
       };
       tilo = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
-        modules = [
-          ./hosts/tilo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
+        inherit specialArgs;
+        modules = withSystemModules ./hosts/tilo/configuration.nix;
       };
     };
   };

hosts/alys/configuration.nix

@@ -1,64 +1,41 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
+{inputs, ...}: {
   imports = [
     ./hardware-configuration.nix
-    ./host.nix
     inputs.home-manager.nixosModules.default
-    ../../modules/locale.nix
-    ../../modules/system.nix
-    ../../modules/ssh.nix
-    ../../modules/endlessh.nix
-    ../../programs/nano.nix
+    ../../system
   ];
 
-  zramSwap.enable = true;
-
-  # networking.domain = "phundrak.com";
-  system = {
-    amdgpu.enable = false;
+  mySystem = {
     boot = {
-      kernel = {
-        hardened = true;
-        cpuVendor = "amd";
-      };
+      kernel.hardened = true;
       systemd-boot = false;
-      zfs.enable = false;
+      zram = {
+        enable = true;
+        memoryMax = 512;
+      };
     };
+    dev.docker.enable = true;
     networking = {
       hostname = "alys";
       domain = "phundrak.com";
       id = "41157110";
-      firewall.openPorts = [
-        22
-      ];
     };
-    sound.enable = false;
+    packages.nix = {
+      gc.automatic = true;
+      trusted-users = ["root" "phundrak"];
+    };
+    services = {
+      endlessh.enable = true;
+      ssh = {
+        enable = true;
+        allowedUsers = ["phundrak"];
+        passwordAuthentication = false;
+      };
+    };
     users = {
       root.disablePassword = true;
-      phundrak = true;
+      phundrak.enable = true;
     };
   };
-
-  modules = {
-    ssh = {
-      enable = true;
-      allowedUsers = ["phundrak"];
-      passwordAuthentication = false;
-    };
-    endlessh.enable = false;
-  };
-
-  nixpkgs.config.allowUnfree = true;
-
-  environment.systemPackages = [pkgs.openssl];
-
-  # networking.hostName = "alys";
-  # users.users.root.openssh.authorizedKeys.keys = [
-  #   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+b7BE/gHrHVkqNVfHtp2r4OCUDdohst8hb3Bz5tYtx3gvXJQCB1rFc2hgQJf8FsVyQbidS64lnhU1rUIEbFhv7itT5FGGUnfJEYs64W30wKsnPSb5WXdFXzrNi8za48i2oNl9JA9Fj9k6isyvkTup89hB+ELbXIcfz3bM93WaAt2dIgKijXaAMAAA+tHhgWvlrHlvGlU9/KxY3ZOQSoEboPXd7TDyOf1672eAibYyb5h1HIewYZ+xv1X4dxx/c9Arh4K0s8scuB7XTQQkEbRUEYKD2YXKN83Z09jfMlMYuBAKKO8zU4CM2KTbL7kEVgNc/ArY+uCAakmC5+eS7LxMuOt86+Bi4gXTJ6o6dbfUbCGiq751ni8pg44YSfwYiI05vvZ08eIyNkowumD+X4GRW4tu0I3qK8TI7exeEeoQIwlSfLXlYHEdNB8Q3feLyhHMRkxXgUskbXwWIBexLzJyY40tyqQplZWbYGrUEmjxZ7FWmaV+o8ZjnU2GfJ8JoWyCnEYfRc6Z2ILdXNDRzZ9qYOwefMHtuaYaYYximL+zdVVrm4EZuOetmaJ6zblk4ebU3GZjYykB8DmCDFDZO9koKwzPazLKQl0OWzmQqgxVNg7Mg1NZbuRQgVAhKPelnqejaXbf2/IHAYBn5LDR1Jew5+srlstM9XuYG2whEOx84w== Lucien Cartier-Tilet <lucien@phundrak.com>"
-  #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILw9oiK8tZ5Vpz82RaRLpITU8qeJrT2hjvudGEDQu2QW lucien@phundrak.com"
-  # ];
   system.stateVersion = "23.11";
 }

hosts/alys/host.nix

@@ -1,3 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = with pkgs; [neofetch vim emacs];
-}

hosts/gampo/configuration.nix

@@ -7,55 +7,73 @@
   imports = [
     inputs.sops-nix.nixosModules.sops
     ./hardware-configuration.nix
-    ./services
-    ../../modules/opentablet.nix
-    ../../modules/sops.nix
-    ../../modules/system.nix
-    ../../programs/flatpak.nix
-    ../../programs/hyprland.nix
-    ../../programs/steam.nix
+    ../../system
   ];
 
+  mySystem = {
+    boot = {
+      plymouth.enable = true;
+      kernel = {
+        cpuVendor = "intel";
+        package = pkgs.linuxPackages;
+        modules = ["i915"];
+      };
+      systemd-boot = true;
+    };
+    desktop = {
+      hyprland.enable = true;
+      xserver = {
+        enable = true;
+        de = "gnome";
+      };
+    };
+    dev.docker = {
+      enable = true;
+      podman.enable = true;
+      autoprune.enable = true;
+    };
+    hardware = {
+      bluetooth.enable = true;
+      input = {
+        corne.allowHidAccess = true;
+        ibmTrackpoint.disable = true;
+        opentablet.enable = true;
+      };
+      sound.enable = true;
+    };
+    misc.keymap = "fr-bepo";
+    networking = {
+      hostname = "gampo";
+      id = "0630b33f";
+      hostFiles = [config.sops.secrets.extraHosts.path];
+    };
+    packages = {
+      appimage.enable = true;
+      flatpak.enable = true;
+      nix = {
+        nix-ld.enable = true;
+        trusted-users = ["root" "phundrak"];
+      };
+    };
+    programs.steam.enable = true;
+    services = {
+      fwupd.enable = true;
+      ssh.enable = true;
+    };
+    users = {
+      root.disablePassword = true;
+      phundrak.enable = true;
+    };
+  };
+
   sops.secrets.extraHosts = {
     inherit (config.users.users.root) group;
     owner = config.users.users.phundrak.name;
     mode = "0440";
   };
 
-  boot.initrd.kernelModules = ["i915"];
-
-  system = {
-    boot.plymouth.enable = true;
-    docker = {
-      enable = true;
-      autoprune.enable = true;
-      podman.enable = true;
-    };
-    networking = {
-      hostname = "gampo";
-      id = "0630b33f";
-      hostFiles = [config.sops.secrets.extraHosts.path];
-    };
-    sound.enable = true;
-  };
-
-  modules = {
-    appimage.enable = true;
-    hyprland.enable = true;
-  };
-
   security.rtkit.enable = true;
 
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-    curl
-    openssl
-    wget
-  ];
-
-  nix.settings.trusted-users = ["root" "phundrak"];
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database
   # versions on your system were taken. It‘s perfectly fine and

hosts/gampo/services/default.nix

@@ -1,15 +0,0 @@
-{
-  imports = [
-    ./gnome.nix
-  ];
-
-  services = {
-    # Enable CUPS to print documents.
-    printing.enable = true;
-    openssh.enable = true;
-    fwupd.enable = true;
-    udev.extraRules = ''
-      ATTRS{name}=="*TPPS/2 IBM TrackPoint", ENV{ID_INPUT}="", ENV{ID_INPUT_MOUSE}="", ENV{ID_INPUT_POINTINGSTICK}=""
-    '';
-  };
-}

hosts/gampo/services/gnome.nix

@@ -1,11 +0,0 @@
-{
-  services.xserver = {
-    enable = true;
-    displayManager.gdm.enable = true;
-    desktopManager.gnome.enable = true;
-    xkb = {
-      layout = "fr";
-      variant = "bepo";
-    };
-  };
-}

hosts/marpa/configuration.nix

@@ -1,42 +1,84 @@
 {
   config,
-  pkgs,
   inputs,
   ...
 }: {
   imports = [
     inputs.sops-nix.nixosModules.sops
-    ./system/hardware-configuration.nix
-    ./services
-    ../../modules/opentablet.nix
-    ../../modules/sops.nix
-    ../../modules/system.nix
-    ../../programs/flatpak.nix
-    ../../programs/hyprland.nix
-    ../../programs/steam.nix
+    ./hardware-configuration.nix
+    ../../system
   ];
 
-  sops.secrets.extraHosts = {
-    inherit (config.users.users.root) group;
-    owner = config.users.users.phundrak.name;
-    mode = "0440";
-  };
-
-  security.polkit.enable = true;
-
-  fileSystems."/games" = {
-    device = "/dev/disk/by-uuid/77d32db8-2e85-4593-b6b8-55d4f9d14e1a";
-    fsType = "ext4";
-  };
-
-  system = {
-    amdgpu.enable = true;
-    boot.plymouth.enable = true;
-    docker = {
-      enable = true;
-      podman.enable = true;
-      autoprune.enable = true;
+  fileSystems = {
+    "/home".options = [
+      "compress=zstd:3" # Good balance of compression vs speed
+      "space_cache=v2" # Better performance
+      "noatime" # Don't update access times (less writes)
+    ];
+    "/mnt/ai" = {
+      device = "/dev/disk/by-uuid/47e87286-caaa-4e43-b2fd-b9eceac90fe9";
+      fsType = "btrfs";
+      options = [
+        "compress=zstd:3" # Good balance of compression vs speed
+        "space_cache=v2" # Better performance
+        "noatime" # Don't update access times (less writes)
+      ];
     };
+    "/mnt/games" = {
+      device = "/dev/disk/by-uuid/a8453133-76dc-44bd-a825-444c3305fd9b";
+      fsType = "btrfs";
+      options = [
+        "compress=zstd:3" # Good balance of compression vs speed
+        "space_cache=v2" # Better performance
+        "noatime" # Don't update access times (less writes)
+      ];
+    };
+    "/games" = {
+      device = "/dev/disk/by-uuid/77d32db8-2e85-4593-b6b8-55d4f9d14e1a";
+      fsType = "ext4";
+    };
+  };
+
+  mySystem = {
+    boot = {
+      extraModprobeConfig = ''
+        options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+      '';
+      plymouth.enable = true;
+      kernel.cpuVendor = "amd";
+      systemd-boot = true;
+    };
+    desktop = {
+      hyprland.enable = true;
+      niri.enable = true;
+      waydroid.enable = true;
+      xserver = {
+        enable = true;
+        de = "gnome";
+      };
+    };
+    dev = {
+      docker = {
+        enable = true;
+        podman.enable = true;
+        autoprune.enable = true;
+      };
+      qemu.enable = true;
+    };
+    hardware = {
+      amdgpu.enable = true;
+      bluetooth.enable = true;
+      input = {
+        corne.allowHidAccess = true;
+        opentablet.enable = true;
+      };
+      sound = {
+        enable = true;
+        jack = true;
+        scarlett.enable = true;
+      };
+    };
+    misc.keymap = "fr-bepo";
     networking = {
       hostname = "marpa";
       id = "7EA4A111";
@@ -49,34 +91,46 @@
         }
       ];
     };
-    sound = {
-      enable = true;
-      jack = true;
+    packages = {
+      appimage.enable = true;
+      flatpak.enable = true;
+      nix = {
+        nix-ld.enable = true;
+        trusted-users = ["root" "phundrak"];
+      };
+    };
+    programs.steam.enable = true;
+    services = {
+      fwupd.enable = true;
+      printing.enable = true;
+      ssh.enable = true;
+      sunshine = {
+        enable = true;
+        autostart = true;
+      };
+      languagetool.enable = true;
+    };
+    users = {
+      root.disablePassword = true;
+      phundrak.enable = true;
     };
   };
 
-  modules = {
-    appimage.enable = true;
-    hyprland.enable = true;
+  sops.secrets.extraHosts = {
+    inherit (config.users.users.root) group;
+    owner = config.users.users.phundrak.name;
+    mode = "0440";
   };
 
-  security.rtkit.enable = true;
-
-  nix.settings.trusted-users = ["root" "phundrak"];
-
-  environment.systemPackages = with pkgs; [
-    clinfo # AMD
-    curl
-    openssl
-    wget
-    alsa-scarlett-gui
-  ];
-
-  boot.extraModprobeConfig = ''
-    options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+  services.udev.extraHwdb = ''
+    mouse:usb:047d:80a6:*
+     LIBINPUT_MIDDLE_EMULATION_ENABLED=1
   '';
 
-  programs.nix-ld.enable = true;
+  security = {
+    polkit.enable = true;
+    rtkit.enable = true;
+  };
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/marpa/services/default.nix

@@ -1,25 +1,24 @@
 {
-  imports = [
-    ./logind.nix
-    ../../../modules/ssh.nix
-    ../../../modules/sunshine.nix
-    ../../../modules/xserver.nix
-  ];
+  # imports = [
+  #   ./logind.nix
+  #   ../../../system
+  # ];
+  # imports = [
+  #   ./logind.nix
+  #   ../../../modules/ssh.nix
+  #   ../../../modules/sunshine.nix
+  # ];
 
-  modules = {
-    sunshine = {
-      enable = true;
-      autostart = true;
-    };
-    xserver = {
-      amdgpu.enable = true;
-      de = "gnome";
-    };
-  };
-  services = {
-    blueman.enable = true;
-    fwupd.enable = true;
-    printing.enable = true;
-    openssh.enable = true;
-  };
+  # modules = {
+  #   sunshine = {
+  #     enable = true;
+  #     autostart = true;
+  #   };
+  # };
+  # services = {
+  #   blueman.enable = true;
+  #   fwupd.enable = true;
+  #   printing.enable = true;
+  #   openssh.enable = true;
+  # };
 }

hosts/tilo/configuration.nix

@@ -1,24 +1,15 @@
 # Edit this configuration file to define what should be installed on your
 # system.  Help is available in the configuration.nix(5) man page and in
 # the NixOS manual (accessible by running ‘nixos-help’).
-{
-  pkgs,
-  inputs,
-  ...
-}: {
+{inputs, ...}: {
   imports = [
     ./hardware-configuration.nix
     inputs.home-manager.nixosModules.default
-    ../../modules/locale.nix
-    ../../modules/system.nix
-    ../../modules/ssh.nix
-    ../../modules/endlessh.nix
-    ../../programs/nano.nix
+    ../../system
     ./services
   ];
 
-  system = {
-    amdgpu.enable = false;
+  mySystem = {
     boot = {
       kernel = {
         hardened = true;
@@ -29,46 +20,43 @@
         pools = ["tank"];
       };
     };
-    docker.enable = true;
+    dev.docker.enable = true;
+    misc.keymap = "fr-bepo";
     networking = {
       hostname = "tilo";
       id = "7110b33f";
       firewall = {
         openPorts = [
-          22 # SSH
           80 # HTTP
           443 # HTTPS
-          2222 # endlessh
           25565 # Minecraft
         ];
-        extraCommands = ''
-          iptables -I INPUT 1 -i 172.16.0.0/12 -p tcp -d 172.17.0.1 -j ACCEPT
-          iptables -I INPUT 1 -i 172.16.0.0/12 -p tcp -d 172.17.0.1 -j ACCEPT
-        '';
       };
     };
-    nix.gc.automatic = true;
-    sound.enable = false;
+    packages.nix = {
+      gc.automatic = true;
+      trusted-users = ["root" "phundrak"];
+    };
+    services = {
+      calibre.enable = true;
+      endlessh.enable = true;
+      jellyfin.enable = true;
+      plex = {
+        enable = true;
+        dataDir = "/tank/web/stacks/plex/plex-config";
+      };
+      ssh = {
+        enable = true;
+        allowedUsers = ["phundrak"];
+        passwordAuthentication = false;
+      };
+    };
     users = {
       root.disablePassword = true;
-      phundrak = true;
+      phundrak.enable = true;
     };
-    console.keyMap = "fr-bepo";
   };
 
-  modules = {
-    ssh = {
-      enable = true;
-      allowedUsers = ["phundrak"];
-      passwordAuthentication = false;
-    };
-    endlessh.enable = true;
-  };
-
-  nixpkgs.config.allowUnfree = true;
-
-  environment.systemPackages = [pkgs.openssl];
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

keys/id_alys.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTv1lb6d99O84jeh6GdjPm8Gnt/HncSRhGhmoTq7BMK lucien@phundrak.com
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTv1lb6d99O84jeh6GdjPm8Gnt/HncSRhGhmoTq7BMK lucien@phundrak.com

modules/amdgpu.nix

@@ -1,17 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-with lib; let
-  cfg = config.modules.amdgpu;
-in {
-  options.modules.amdgpu.enable = mkEnableOption "Enables an AMD GPU configuration";
-  config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
-    ];
-    hardware.graphics.extraPackages = with pkgs; [rocmPackages.clr.icd];
-  };
-}

modules/opentablet.nix

@@ -1,6 +0,0 @@
-{
-  hardware.opentabletdriver = {
-    enable = true;
-    daemon.enable = true;
-  };
-}

modules/sunshine.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.modules.sunshine;
-in {
-  options.modules.sunshine = {
-    enable = mkEnableOption "Enables moonlight";
-    autostart = mkEnableOption "Enables autostart";
-  };
-  config.services.sunshine = mkIf cfg.enable {
-    enable = true;
-    autoStart = cfg.autostart;
-    capSysAdmin = true;
-    openFirewall = true;
-    settings = {
-      sunshine_name = "marpa";
-    };
-  };
-}

modules/system.nix

@@ -1,183 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-with lib; let
-  cfg = config.system;
-in {
-  imports = [
-    ./amdgpu.nix
-    ./appimage.nix
-    ./boot.nix
-    ./locale.nix
-    ./networking.nix
-    ./nix.nix
-    ./plymouth.nix
-    ./sound.nix
-    ./users.nix
-    ./dev/docker.nix
-  ];
-
-  options.system = with types; {
-    amdgpu.enable = mkEnableOption "Enables AMD GPU support";
-    boot = {
-      kernel = {
-        package = mkOption {
-          type = raw;
-          default = pkgs.linuxPackages_zen;
-        };
-        modules = mkOption {
-          type = listOf str;
-          default = [];
-        };
-        cpuVendor = mkOption {
-          description = "Intel or AMD?";
-          type = enum ["intel" "amd"];
-          default = "amd";
-        };
-        v4l2loopback = mkOption {
-          description = "Enables v4l2loopback";
-          type = bool;
-          default = true;
-        };
-        hardened = mkEnableOption "Enables hardened Linux kernel";
-      };
-      systemd-boot = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Does the system use systemd-boot?";
-      };
-      plymouth.enable = mkEnableOption "Enables Plymouth";
-      zfs = {
-        enable = mkEnableOption "Enables ZFS";
-        pools = mkOption {
-          type = listOf str;
-          default = [];
-        };
-      };
-    };
-    docker = {
-      enable = mkEnableOption "Enable Docker";
-      podman.enable = mkEnableOption "Enable Podman rather than Docker";
-      nvidia.enable = mkEnableOption "Activate Nvidia support";
-      autoprune.enable = mkEnableOption "Enable autoprune";
-    };
-    networking = {
-      hostname = mkOption {
-        type = str;
-        example = "gampo";
-      };
-      id = mkOption {
-        type = str;
-        example = "deadb33f";
-      };
-      domain = mkOption {
-        type = nullOr str;
-        example = "phundrak.com";
-        default = null;
-      };
-      hostFiles = mkOption {
-        type = listOf path;
-        example = [/path/to/hostFile];
-        default = [];
-      };
-      firewall = {
-        openPorts = mkOption {
-          type = listOf int;
-          example = [22 80 443];
-          default = [];
-        };
-        openPortRanges = mkOption {
-          type = listOf (attrsOf port);
-          default = [];
-          example = [
-            {
-              from = 8080;
-              to = 8082;
-            }
-          ];
-          description = ''
-            A range of TCP and UDP ports on which incoming connections are
-            accepted.
-          '';
-        };
-        extraCommands = mkOption {
-          type = nullOr lines;
-          example = "iptables -A INPUTS -p icmp -j ACCEPT";
-          default = null;
-        };
-      };
-    };
-    nix = {
-      disableSandbox = mkOption {
-        type = bool;
-        default = false;
-      };
-      gc = {
-        automatic = mkOption {
-          type = bool;
-          default = true;
-        };
-        dates = mkOption {
-          type = str;
-          default = "Monday 01:00 UTC";
-        };
-        options = mkOption {
-          type = str;
-          default = "--delete-older-than 30d";
-        };
-      };
-    };
-    sound = {
-      enable = mkEnableOption "Whether to enable sounds with Pipewire";
-      alsa = mkOption {
-        type = bool;
-        example = true;
-        default = true;
-        description = "Whether to enable ALSA support with Pipewire";
-      };
-      jack = mkOption {
-        type = bool;
-        example = true;
-        default = false;
-        description = "Whether to enable JACK support with Pipewire";
-      };
-      package = mkOption {
-        type = package;
-        example = pkgs.pulseaudio;
-        default = pkgs.pulseaudioFull;
-        description = "Which base package to use for PulseAudio";
-      };
-    };
-    users = {
-      root.disablePassword = mkEnableOption "Disables root password";
-      phundrak = mkOption {
-        type = bool;
-        default = true;
-      };
-    };
-    timezone = mkOption {
-      type = str;
-      default = "Europe/Paris";
-    };
-    console.keyMap = mkOption {
-      type = str;
-      default = "fr";
-    };
-  };
-
-  config = {
-    boot.tmp.cleanOnBoot = true;
-    time.timeZone = cfg.timezone;
-    console.keyMap = cfg.console.keyMap;
-    modules = {
-      boot = {
-        inherit (cfg) amdgpu;
-        inherit (cfg.boot) kernel systemd-boot plymouth zfs;
-      };
-      inherit (cfg) sound users networking docker amdgpu;
-    };
-  };
-}

programs/flatpak.nix

@@ -1,3 +0,0 @@
-{
-  services.flatpak.enable = true;
-}

programs/steam.nix

@@ -1,21 +0,0 @@
-{pkgs, ...}: {
-  programs = {
-    steam = {
-      enable = true;
-      protontricks.enable = true;
-      remotePlay.openFirewall = true;
-      localNetworkGameTransfers.openFirewall = true;
-      gamescopeSession.enable = true;
-      extraCompatPackages = [pkgs.proton-ge-bin];
-    };
-    gamescope = {
-      enable = true;
-      capSysNice = true;
-      args = [
-        "--rt"
-        "--expose-wayland"
-      ];
-    };
-  };
-  hardware.steam-hardware.enable = true;
-}

secrets/secrets.yaml

@@ -1,10 +1,10 @@
-extraHosts: ENC[AES256_GCM,data:nuEU+Tlj9BBEO/459B7u74WEdlDmvn3coWkk3JG5uqWXR1G4tk6H8EvQAY/xAuqcM01T4psaeqQTxZA+U626zMQ++vOsYwI8cch8m0xIkKKJ3Ztyqeip8egK2xPywdJp69Z5XhweF3RlxPBTroMcCoqHG0rFQmPuwaWrM/DJ6HQBGqKA3wmaYXAC4OLFVGNzLNLfWD85PAxK1YTJnClaerFdwsxm9tq+HNg7zEnOUVyQjm2l16MKkV1kybddNFc6SKHmm2e/XYNQ85eRm1ALq1v1WRPLaa87MsPLM6svwNy5hEMX+AQKfGBL4hLUKOw+yPktfSnGhj8uDO6IUTjySzkgdYIu37E8ozN8CZ2m+5wYDjf1NU34/yUo2p3RZISuy52qEhGE0jsIeDiC6KMPs6/dHKpxbkRVhe7ZWpZvee7dhWyAkW4lk+MA1p3OklCBdTn8JcrAlVcKf0n1+XyK5ua0q5ja6UKg1Q5Y1LGFPInt+styJ65HdvqBcdLiG7DCQYHGpWGIeSNglbAKPMCeBCablN/2gLLYOK08RXwwSAj1V5lCXAKoc3FfnX73ELRelzLwE2MNJZCn0DqnqP0vOnzXM9ftWVODCjcIEmLUX+CL7hBNLrWcp+Q3ALQcSZsAVejpP8Iajo85R/Hc+2OtqfXijoJNacaMgKCX/5ZWOFEwNUdto3xSRQXu2Ck//F4F/0Ez6yqOFux1byjdyHDbGGdFz02DTZUkOtsPVssyqz1nEHepDQM0EmAAxAR6D8hHOnZGesfqbS+5Xd3+KlfxyFC2mHDxK4WZPCHTAEsenWEiQTGfaOT+1bpbimRfUcqiRXukSUeHY2cKf/reNw0MT7t5n1mvidihP3sJuc573ViUlG+Ts8ctyZ/+tKU2aCMz3wevPzZNiIVqXsB2lC8c,iv:MnbM30XhdQFOPmc4x/a7YaDmnCDCFHS2Nm8plh+raSo=,tag:SpHUqyeSVdtf8uk4SyjmOA==,type:str]
+extraHosts: ENC[AES256_GCM,data:i2B5DEjVm7P0V77oVzGIgU08dcpmxy8EgoJz4nPuhfpOBZI1BQpRTOOoSVRZzY6SNpLQCcNDVCwvuhtS12w7NAgIFvBhSigzwJVaWZiC78qTjXanbjSW6fvT1SQqb+YOD+4qkpuuxT5pdBKkyHZvjGM6elyA0K6JzpiCE33+Ag/4SIFTyDrdhJN2HQule54aBDVObg5s7zmPnDo9bCX0XXXCbFpdOfJMKI+89c+Gfm0dJrnDwHcks3p1ZrrSfLn3NhC+Rryc8FHMCtw936WKv+TcP124XGYxXrdEFKngB/pJLhUZlzDeC4v33xtPemOdQrK7vGjO0YZ7WBbO5oXvHw6R1pqC7iMDWjKQBbPit8IB3rngXeMOPEHxbEp1W0MEHbp3bg4GH/SAnxKkfeAFxhMNMBolO12KTntaLCurTSKXhXCIn9SSxFcoWK6kIeo6cpejcHdqGbtV8eL3znZ+MXzvEDRwiy5Sofxa31aAoItwX7kK1YHbpMT95jfr8rKc4yR7tkJWmJkmU494x/lhLkyQbXj25cNcJE7v+hLtQkJ1gdHRgYxYJFxG+VbroSS5HjkRvameuLMfk5dHxg+0bifXEV1FjhKtZqM5JQNEFOHUzvrs5u8m3NKNr13onuT5soh3GKAlh8AMX7p5Etud0BpQPdU7HT5WXRyuP7JMZL5wsjRsGWRxnQaQbnV6qg1b1JP25b6iRj0DFHZJeIEEOU20wDwDQDCoXzJS8vlMbZOC0W9/NVWgwz+UAWQz/yxzRGbconWr6zUhvwcwYBtDhYb6KD0GFxn6yfB/zfMvRHZz8AFF4w00Bx4F2L3nvF4lltnkHkdy9Qql6RsshsVFpPjrhzCrABFBrP0js1OCRw==,iv:Mx7LgF/1z/aZtyvIYafELx2tg2VZ3wTpV0zI04DLxU0=,tag:ZZImkH5/6atDOIzaXJC0Bg==,type:str]
 mopidy:
     spotify: ENC[AES256_GCM,data:SaDT0iSWhsgVOi1s+Nzbr0Mur3t2Zd9z/KIUshGWtbPfkXXIoiJeJFtoZIz5NL/t5FooYsNfU1mGYgDeVYSD4BPibW8hiCYrX6L6OX+Q6ZEWXXx/1eBEs2/q0BrWGvy7frcurq/Px4R3ax0dXJe/YKbpAtU7+bQl,iv:F2zT+uMVBMnSEZqgcRmV8/fc3G/g2fKDuHuBzkyBRN0=,tag:CD8fuOQfe6QCrj4BUh0/xw==,type:str]
     bandcamp: ENC[AES256_GCM,data:diEx2fbkOR1oUav81jU5bNt/KNmbOaVzLV+G3zBUVXE7nEQpZNqVom0rgNrEVDGzH3u/IaA5eqG5ce9lE0BomeY8Z4MWI1xujhX5KsXdv21aw4UwsNgyLPuWhkN2POUMfCJlvekc/TFfFvJHyysx8aKxeI4dsg==,iv:cxx0cVkjOPG+hMD8JctJHdcICJt7ozpfRBVSCDBo6Ro=,tag:JRjwwvieGaGZJ+k56HWFaw==,type:str]
 emailPassword: ENC[AES256_GCM,data:LALAvyuNN9bfa8D6ZK1YiFXRfxLOBi9kXA0N0Kr7h18eAI4hWQ==,iv:WtidILFfWCMKylax52JP+X57GfZyYlxJtiwrC6SADik=,tag:NvOrsL3fbmxQZp06GZhUZA==,type:str]
 ssh:
-    hosts: ENC[AES256_GCM,data:X/MrxeaqJnggoL9X8Y0+15A52FoihVRFp4vBZNr/QlJAKRn0B1eH6LI4wVzNokMbPUGlmYEElShy38ce+7EehL5HJcbwpEquvgQpLN2lZ4FhMLbW7yN3Q8DdZKqv4RNsm8vjuJPGwHGEVOhdvvnyM6IVpvLvMuH7MLJg4hLSArBzX7N0i5qg8piWI3pHqoPV4yO7kysSSF7D13HXen3fX+dbpBno/n0U+Xq8gcFyUKAqN6h65frkH2pyQcxIrCYcsFoJcU2jIzUY94xCSZZT7ocItzKD5YtVRki6F4Gh0/QgFeFcCn20Z0w8B7WvkjcR98FE+i5D9128uv2iiKEyeNaB4hc14dFCG4iZWW1KcSUojBnXHpFj22aByJaxjcFVg5BIVyde8L4hEinztWjNwbRzi1d9b34qeARcEzDQ3fwSNL/XFrlTvNZp565y/rPBLceksELewpWyX4Te3fuNOOw7hQqX3cjbGfw/FNuBVI/jnkEC+acGi23HnwmnDz87KCGZ738OAQ78F5awuoHnHhePvj0bUe3DTdW9Uj8amnaq1IeIu/BBcutewgez7ZHWamIWiOuVaZUISD6wrYk4pe5KqAZieUdotxbx7eihpw0ozEzQaNU3WBwQ8YxIyEnzcnsAihXCcgbm1/8FzWxghN3elA48UqVwaa4ZHK01l8+jD5yGjuCTCcpmSkVZBg8XrH7VWm+pZMCt3FRus3vFWq/iLsapIu6YSWG+mCYCjEK5hhbZs7ELxpdIzCw6Hiqm+P4nWVwA0ddbtSA7Rhu33CTKzdc0/KIQN78U0P+AsV0tVy7oLboIEZhpsj6XXYwQv5q9d0eJw/hibsqHdRb144Zn0hJDqxe/R+vCDk2iC3OYx5pG4oFbBG8V487QC67TG4Q+ztGCL8+W8+ZoVjK+atfA2LVHVWobFWNmqAE9CbVu8cbW3BhAtWrBZGgUMW5noFi64U411QEPS88odXtaqhUoN77rMhYCtVBxSSkGMWvwY2VZn6UvY8NZTExD5rJmDU9rRHmCNHq4WaAjxUg1rzwd4VO9CDnCf2gSeF466blpf2JEky8=,iv:0laLebvzVUMrKT30Jx/HaRS426PsWD3oFTesV4tnnDg=,tag:DApK5SSAriLib00FTz+jcg==,type:str]
+    hosts: ENC[AES256_GCM,data:nuMA50lZVxi/b2Y95Om00DIXkfHV+5epXzgFJTUk1r78y71/q/1wDa0bb9bqaMhElivDrX2mzS7IplLqLry43VkGAiE00WrdT7pLM+NSDtm7VV3kake7qorkpydxczHeVg5VP/b1FMzpQ1gFoAVg6iY9tYBnfTa5MdQI3ktQBRYWU5XmVMFNquTBG10wOKxgTUdkh6smcYmU5YlDUdeM6gTt9QPSHlglOGCe/w3tuXOWkBNcNtNiwQoaKTwIkhisu8R6h/qwtOBBt0wEpOv+KtdYQ0Y9o7/KiN2mG24+/mASfAYTAhifSnCY0vDe145gkrQzFttzZDI6l4OgjYF9rIsP+hKwUChGObW90HVVKQbJ8oDoG+l9L+IxLxs8v/v1690Xtra+PPvZCgGqhXqpoqBL/OgNdR26p/G8Oid81Nb0ob8DstYLjYlcg7ZjPiruMtRwhKoa4z++pe+poepGAPHdKkLvAvzFUKwcqRfR7RNgNgZR8hFAe7Tg5m3ApF+koGWjcoKCyALgc/hP6LTBmiJuj6OySFl1cTtkKHPsYXa49St+lOB32MXCH2ysAI6860ZcJqpAFTQ1Yd2XYu+Xrbxcm381mE02Tw20+VP2OPyEYt+ida2TKAzM3aXiMGTRpSkwzkKXsRoBskVQxv3z+6c+w87I9ZmoZHqHM7dWcRAuj2bT2ZWeExPyEmUFczMjCcFFEepnlKWOYmkUZmjDfqZ1mtR3bBK271AnVHakS5jajbhhyu6VDMLYIQmBPDFpZnyCE2qgb9FbXBbqoq+qc/9w+7gCdXNnb1tDdiJ8E4k7no6oU5jrRMGHNX3UOMDs/Y9NS0vPsnqBpr7Pf+H6bxncXWoaimijoi1OxvUFMbRvT5uUgP/JNDZDGBhlY3zRiUnDhTuHF5vP8wisqsba7zwpoqIchI3hbxm+lWXt09ZTnR2A1uR3DTlEEjGUMpD5K5CWkgTalgaHYI9jh9n66rYop9evlngZlg5Cth/Lieh/34fcIUzHAQMbxUKqoRU9zHHQJ51AZIovTtegXmgPmQ8fw6F3uBQ5gg+T1CiaCqs5nUd9ERM=,iv:DNg2EEPmylLf2CqR9eqJYzngGizTraPNImIGTJwl8kI=,tag:StZ6H+1ec/i0l94Cv+AhOA==,type:str]
 sops:
     age:
         - recipient: age1ajemtm502nn2n4q7v4j8meyd5mxtcqngkkedxq2pqzuwu78zp93qnw8q48
@@ -61,7 +61,7 @@ sops:
             QmJKNDJUY0RSakhwNWlkOVpib0trc1kK0tQxD9I82pjfs54eruu+IjzVUmcVBCPw
             9mp1xKiYRRMXt3YQn6MPiyuuX3l3UB5MH0RJMNtRq0D961rs+iiS5A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-06T19:20:04Z"
-    mac: ENC[AES256_GCM,data:59Mu6RlGEXV7BsNsX0yIr/zUgl9gvk77o2moF4D7GgPwllSVFLRB8Y3LvE7+NXLIjLj19nrK6b99CiH08NmWhSBO37+xXU/eYQ/W2wIEVIxfmhVcF9ePIZPwVuegLZ707S8jZDOcYzPOQuURe9hhbxJJPgHzzPzYoh7yushYUME=,iv:h6DCciUZtRMZFGB7PMfg4xnOWxyKQS/vfnOG1tqVfrI=,tag:q65pnHbLcUG+Gxo7K3Ca1w==,type:str]
+    lastmodified: "2025-11-28T12:26:45Z"
+    mac: ENC[AES256_GCM,data:T4/aWHN9ILjaI1WAyO8VUQz87H0dmWjC3E6WnlNaRmTr5kDgpm6nYJHFGnrEEFUTPzAGluMTJzC3Sji6CqLKX7opOUtoDgUqiNHgz0oz7B28+RFGqxspo3IoCM4lJNrKBkZHnrKJFPUooYKc8aNm/goWWHQ/dL2uQ46Hvx9zK+o=,iv:Xq5XcYxkBCWMLFCgCYmkPgwBWMXpLFBPZY3iTTnXRcs=,tag:ZAPZAAv+qy4BM47aCgK89g==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0

system/boot/boot.nix

@@ -5,10 +5,16 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.boot;
+  cfg = config.mySystem.boot;
 in {
-  options.modules.boot = {
-    amdgpu.enable = mkEnableOption "Enables an AMD GPU configuration";
+  options.mySystem.boot = {
+    extraModprobeConfig = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+      '';
+    };
     kernel = {
       package = mkOption {
         type = types.raw;
@@ -45,7 +51,7 @@ in {
   };
 
   config.boot = {
-    initrd.kernelModules = lists.optional cfg.amdgpu.enable "amdgpu";
+    initrd.kernelModules = lists.optional config.mySystem.hardware.amdgpu.enable "amdgpu";
     loader = {
       systemd-boot.enable = cfg.systemd-boot;
       efi.canTouchEfiVariables = cfg.systemd-boot;

system/boot/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./boot.nix
+    ./plymouth.nix
+    ./zram.nix
+  ];
+}

system/boot/plymouth.nix

@@ -5,9 +5,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.boot.plymouth;
+  cfg = config.mySystem.boot.plymouth;
 in {
-  options.modules.boot.plymouth.enable = mkEnableOption "Enables Plymouth at system boot";
+  options.mySystem.boot.plymouth.enable = mkEnableOption "Enables Plymouth at system boot";
   config.boot = mkIf cfg.enable {
     plymouth = {
       inherit (cfg) enable;

system/boot/zram.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.boot.zram;
+in {
+  options.mySystem.boot.zram = {
+    enable = mkEnableOption "Enable ZRAM";
+    memoryMax = mkOption {
+      type = types.int;
+      example = "512";
+      description = "Maximum size allocated to ZRAM in MiB";
+    };
+  };
+  config.zramSwap = mkIf cfg.enable {
+    inherit (cfg) enable;
+    memoryMax = cfg.memoryMax * 1024 * 1024;
+  };
+}

system/default.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.misc;
+in {
+  imports = [
+    ./boot
+    ./desktop
+    ./dev
+    ./hardware
+    ./i18n
+    ./network
+    ./packages
+    ./security
+    ./services
+    ./users
+  ];
+
+  options.mySystem.misc = {
+    timezone = mkOption {
+      type = types.str;
+      default = "Europe/Paris";
+    };
+    keymap = mkOption {
+      type = types.str;
+      default = "fr";
+      example = "fr-bepo";
+      description = "Keymap to use in the TTY console";
+    };
+  };
+
+  config = {
+    boot.tmp.cleanOnBoot = true;
+    time.timeZone = cfg.timezone;
+    console.keyMap = cfg.keymap;
+    services = {
+      orca.enable = false;
+      envfs.enable = true;
+    };
+  };
+}

system/desktop/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./hyprland.nix
+    ./niri.nix
+    ./waydroid.nix
+    ./xserver.nix
+  ];
+}

system/desktop/hyprland.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.hyprland;
+  cfg = config.mySystem.desktop.hyprland;
 in {
-  options.modules.hyprland.enable = mkEnableOption "Enables Hyprland";
+  options.mySystem.desktop.hyprland.enable = mkEnableOption "Enables Hyprland";
   config.programs.hyprland = mkIf cfg.enable {
     inherit (cfg) enable;
     withUWSM = true;

system/desktop/niri.nix

@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.desktop.niri;
+in {
+  options.mySystem.desktop.niri.enable = mkEnableOption "Enables Niri";
+  config.programs.niri = mkIf cfg.enable {
+    inherit (cfg) enable;
+  };
+}

system/desktop/waydroid.nix

@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.desktop.waydroid;
+in {
+  options.mySystem.desktop.waydroid.enable = mkEnableOption "Enables Waydroid";
+  config = mkIf cfg.enable {
+    virtualisation.waydroid.enable = cfg.enable;
+    environment.systemPackages = [pkgs.waydroid-helper];
+  };
+}

system/desktop/xserver.nix

@@ -4,10 +4,10 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.xserver;
+  cfg = config.mySystem.desktop.xserver;
 in {
-  options.modules.xserver = {
-    amdgpu.enable = mkEnableOption "Enables AMD GPU support";
+  options.mySystem.desktop.xserver = {
+    enable = mkEnableOption "Enables xserver";
     de = mkOption {
       type = types.enum ["gnome" "kde"];
       default = "gnome";
@@ -15,7 +15,7 @@ in {
       description = "Which DE to enable";
     };
   };
-  config.services = {
+  config.services = mkIf cfg.enable {
     displayManager = {
       sddm.enable = mkIf (cfg.de == "kde") true;
       gdm.enable = mkIf (cfg.de == "gnome") true;
@@ -34,8 +34,8 @@ in {
     };
 
     xserver = {
-      enable = true;
-      videoDrivers = lists.optional cfg.amdgpu.enable "amdgpu";
+      inherit (cfg) enable;
+      videoDrivers = lists.optional config.mySystem.hardware.amdgpu.enable "amdgpu";
       xkb = {
         layout = "fr";
         variant = "bepo_afnor";

system/dev/default.nix

@@ -0,0 +1,3 @@
+{
+  imports = [./docker.nix ./qemu.nix];
+}

system/dev/docker.nix

@@ -1,21 +1,31 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 with lib; let
-  cfg = config.modules.docker;
+  cfg = config.mySystem.dev.docker;
 in {
-  options.modules.docker = {
+  options.mySystem.dev.docker = {
     enable = mkEnableOption "Enable Docker";
     podman.enable = mkEnableOption "Enable Podman rather than Docker";
     nvidia.enable = mkEnableOption "Activate Nvidia support";
     autoprune.enable = mkEnableOption "Enable autoprune";
   };
 
-  config = {
-    virtualisation = {
-      docker = mkIf (cfg.enable && !cfg.podman.enable) {
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs;
+      [
+        dive # A tool for exploring each layer in a docker image
+        grype # Vulnerability scanner for container images and filesystems
+      ]
+      ++ lists.optionals cfg.podman.enable [
+        podman-compose
+        podman-desktop
+      ];
+    virtualisation = mkIf cfg.enable {
+      docker = mkIf (!cfg.podman.enable) {
         enable = true;
         enableNvidia = cfg.nvidia.enable;
         autoPrune.enable = cfg.autoprune.enable;

system/dev/qemu.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.dev.qemu;
+in {
+  options.mySystem.dev.qemu = {
+    enable = mkEnableOption "Enable QEMU";
+    users = mkOption {
+      type = types.listOf types.str;
+      default = ["phundrak"];
+      example = ["user1" "user2"];
+    };
+  };
+  config = mkIf cfg.enable {
+    programs.virt-manager.enable = true;
+    users.groups.libvirtd.members = cfg.users;
+    virtualisation = {
+      libvirtd.enable = true;
+      spiceUSBRedirection.enable = true;
+    };
+    environment.systemPackages = with pkgs; [
+      qemu
+      quickemu
+      swtpm
+    ];
+    systemd.tmpfiles.rules = ["L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware"];
+    boot.binfmt.emulatedSystems = ["aarch64-linux"];
+  };
+}

system/hardware/amdgpu.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.hardware.amdgpu;
+in {
+  options.mySystem.hardware.amdgpu.enable = mkEnableOption "Enables an AMD GPU configuration";
+  config = mkIf cfg.enable {
+    hardware = {
+      graphics = {
+        enable = true;
+        enable32Bit = true;
+        extraPackages = with pkgs; [
+          mesa # Mesa drivers for AMD GPUs
+          rocmPackages.clr # common language runtime for ROCm
+          rocmPackages.clr.icd # ROCm ICD for OpenCL
+          rocmPackages.rocblas # ROCm BLAS library
+          rocmPackages.hipblas #
+          rocmPackages.rpp # High-performance computer vision library
+          nvtopPackages.amd # GPU utilization monitoring
+        ];
+      };
+      amdgpu = {
+        initrd.enable = true;
+        opencl.enable = true;
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      clinfo
+      amdgpu_top
+      nvtopPackages.amd
+    ];
+    systemd = {
+      packages = with pkgs; [lact];
+      services.lactd.wantedBy = ["multi-user.target"];
+      tmpfiles.rules = let
+        rocmEnv = pkgs.symlinkJoin {
+          name = "rocm-combined";
+          paths = with pkgs.rocmPackages; [
+            clr
+            clr.icd
+            rocblas
+            hipblas
+            rpp
+          ];
+        };
+      in [
+        "L+    /opt/rocm   -    -    -     -    ${rocmEnv}"
+      ];
+    };
+    environment.variables = {
+      ROCM_PATH = "/opt/rocm"; # Set ROCm path
+      HIP_VISIBLE_DEVICES = "1"; # Use only the eGPU (ID 1)
+      ROCM_VISIBLE_DEVICES = "1"; # Optional: ROCm equivalent for visibility
+      # LD_LIBRARY_PATH = "/opt/rocm/lib";         # Add ROCm libraries
+      HSA_OVERRIDE_GFX_VERSION = "10.3.0"; # Set GFX version override
+    };
+  };
+}

system/hardware/bluetooth.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.hardware.bluetooth;
+in {
+  options.mySystem.hardware.bluetooth.enable = mkEnableOption "Enable bluetooth";
+  config = mkIf cfg.enable {
+    hardware.bluetooth.enable = cfg.enable;
+    services.blueman.enable = cfg.enable;
+  };
+}

system/hardware/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./amdgpu.nix
+    ./bluetooth.nix
+    ./sound.nix
+    ./input
+  ];
+}

system/hardware/input/corne.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.hardware.input.corne;
+in {
+  options.mySystem.hardware.input.corne.allowHidAccess = mkEnableOption "Enable HID access to the corne keyboard";
+  config.services.udev = mkIf cfg.allowHidAccess {
+    extraRules = ''
+      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
+    '';
+  };
+}

system/hardware/input/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./corne.nix
+    ./ibm-trackpoint.nix
+    ./opentablet.nix
+    ./trackball.nix
+  ];
+}

system/hardware/input/ibm-trackpoint.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.hardware.input.ibmTrackpoint;
+in {
+  options.mySystem.hardware.input.ibmTrackpoint.disable = mkEnableOption "Disable IBM’s trackpoint on ThinkPad";
+  config.services.udev = mkIf cfg.disable {
+    extraRules = ''
+      ATTRS{name}=="*TPPS/2 IBM TrackPoint", ENV{ID_INPUT}="", ENV{ID_INPUT_MOUSE}="", ENV{ID_INPUT_POINTINGSTICK}=""
+    '';
+  };
+}

system/hardware/input/opentablet.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.hardware.input.opentablet;
+in {
+  options.mySystem.hardware.input.opentablet.enable = mkEnableOption "Enables OpenTablet drivers";
+  config.hardware.opentabletdriver = mkIf cfg.enable {
+    inherit (cfg) enable;
+    daemon.enable = true;
+  };
+}

system/hardware/input/trackball.nix

@@ -0,0 +1,3 @@
+{
+  services.libinput.mouse.middleEmulation = true;
+}

system/hardware/sound.nix

@@ -5,10 +5,11 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.sound;
+  cfg = config.mySystem.hardware.sound;
 in {
-  options.modules.sound = {
+  options.mySystem.hardware.sound = {
     enable = mkEnableOption "Whether to enable sounds with Pipewire";
+    scarlett.enable = mkEnableOption "Activate support for Scarlett sound card";
     alsa = mkOption {
       type = types.bool;
       example = true;
@@ -29,12 +30,18 @@ in {
     };
   };
 
-  config.services.pipewire = mkIf cfg.enable {
-    enable = true;
-    alsa = mkIf cfg.alsa {
-      enable = mkDefault true;
-      support32Bit = mkDefault true;
+  config = {
+    environment.systemPackages = mkIf cfg.scarlett.enable [pkgs.alsa-scarlett-gui];
+    services.pipewire = mkIf cfg.enable {
+      enable = true;
+      alsa = mkIf cfg.alsa {
+        enable = mkDefault true;
+        support32Bit = mkDefault true;
+      };
+      jack.enable = mkDefault cfg.jack;
+    };
+    programs.noisetorch = mkIf cfg.enable {
+      inherit (cfg) enable;
     };
-    jack.enable = mkDefault cfg.jack;
   };
 }

system/i18n/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./locale.nix
+  ];
+}

system/network/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./networking.nix
+    ./tailscale.nix
+  ];
+}

system/network/networking.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.networking;
+  cfg = config.mySystem.networking;
 in {
-  options.modules.networking = with types; {
+  options.mySystem.networking = with types; {
     hostname = mkOption {
       type = str;
       example = "gampo";

system/network/tailscale.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.network.tailscale;
+in {
+  options.mySystem.network.tailscale = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+    };
+  };
+  config.services.tailscale.enable = cfg.enable;
+}

system/packages/appimage.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.appimage;
+  cfg = config.mySystem.packages.appimage;
 in {
-  options.modules.appimage.enable = mkEnableOption "Enables AppImage support";
+  options.mySystem.packages.appimage.enable = mkEnableOption "Enables AppImage support";
   config.programs.appimage = mkIf cfg.enable {
     inherit (cfg) enable;
     binfmt = true;

system/packages/default.nix

@@ -0,0 +1,15 @@
+{pkgs, ...}: {
+  imports = [
+    ./appimage.nix
+    ./flatpak.nix
+    ./nano.nix
+    ./nix.nix
+    ./steam.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    curl
+    openssl
+    wget
+  ];
+}

system/packages/flatpak.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.packages.flatpak;
+in {
+  options.mySystem.packages.flatpak = {
+    enable = mkEnableOption "Enable Flatpak support";
+    builder.enable = mkEnableOption "Enable Flatpak builder";
+  };
+  config = {
+    services.flatpak = mkIf cfg.enable {
+      inherit (cfg) enable;
+    };
+    environment.systemPackages = mkIf cfg.builder.enable [
+      pkgs.flatpak-buildR
+    ];
+  };
+}

system/packages/nix.nix

@@ -4,10 +4,11 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.nix;
+  cfg = config.mySystem.packages.nix;
 in {
-  options.modules.nix = {
-    disableSandbox = mkEnableOption "Disables Nix sandbox";
+  options.mySystem.packages.nix = {
+    allowUnfree = mkEnableOption "Enable unfree packages";
+    disableSandbox = mkEnableOption "Disable Nix sandbox";
     gc = {
       automatic = mkOption {
         type = types.bool;
@@ -22,17 +23,27 @@ in {
         default = "--delete-older-than 30d";
       };
     };
+    nix-ld.enable = mkEnableOption "Enable unpatched binaries support";
+    trusted-users = mkOption {
+      type = types.listOf types.str;
+      example = ["alice" "bob"];
+      default = [];
+    };
   };
 
   config = {
     nix = {
+      inherit (cfg) gc;
       settings = {
+        inherit (cfg) trusted-users;
         sandbox = cfg.disableSandbox;
         experimental-features = ["nix-command" "flakes"];
         auto-optimise-store = true;
       };
-      inherit (cfg) gc;
     };
     nixpkgs.config.allowUnfree = true;
+    programs = {
+      inherit (cfg) nix-ld;
+    };
   };
 }

system/packages/steam.nix

@@ -0,0 +1,48 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.programs.steam;
+in {
+  options.mySystem.programs.steam.enable = mkEnableOption "Enables Steam and Steam hardware";
+  config = mkIf cfg.enable {
+    programs = {
+      steam = {
+        inherit (cfg) enable;
+        protontricks.enable = true;
+        remotePlay.openFirewall = true;
+        localNetworkGameTransfers.openFirewall = true;
+        gamescopeSession.enable = true;
+        extraCompatPackages = [pkgs.proton-ge-bin];
+        package = pkgs.steam.override {
+          extraEnv = {
+            MANGOHUD = true;
+            OBS_VKCAPTURE = true;
+            RADV_TEX_ANISO = 16;
+          };
+          extraLibraries = p: with p; [atk];
+          extraPkgs = pkgs:
+            with pkgs; [
+              qt5.qtmultimedia
+              qt5.qtbase
+              libpulseaudio
+            ];
+        };
+      };
+      gamescope = {
+        enable = true;
+        capSysNice = true;
+        args = [
+          "--rt"
+          "--expose-wayland"
+        ];
+      };
+    };
+    hardware.steam-hardware = {
+      inherit (cfg) enable;
+    };
+  };
+}

system/security/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./sops.nix
+  ];
+}

system/security/sops.nix

@@ -1,6 +1,6 @@
 {
   sops = {
-    defaultSopsFile = ../secrets/secrets.yaml;
+    defaultSopsFile = ../../secrets/secrets.yaml;
     defaultSopsFormat = "yaml";
     age = {
       # automatically import user SSH keys as age keys

system/services/calibre.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.calibre;
+in {
+  options.mySystem.services.calibre = {
+    enable = mkEnableOption "Enable Calibre Web";
+    user = mkOption {
+      type = types.str;
+      default = "phundrak";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "users";
+    };
+    dataDir = mkOption {
+      type = types.str;
+      example = "/tank/calibre/conf";
+      default = "/tank/calibre/conf";
+    };
+    library = mkOption {
+      type = types.str;
+      example = "/tank/calibre/library";
+      default = "/tank/calibre/library";
+    };
+  };
+  config.services.calibre-web = mkIf cfg.enable {
+    inherit (cfg) enable user dataDir group;
+    options = {
+      calibreLibrary = cfg.library;
+      enableBookConversion = true;
+      enableBookUploading = true;
+    };
+  };
+}

system/services/default.nix

@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./calibre.nix
+    ./endlessh.nix
+    ./fwupd.nix
+    ./jellyfin.nix
+    ./languagetool.nix
+    ./plex.nix
+    ./printing.nix
+    ./ssh.nix
+    ./sunshine.nix
+  ];
+}

system/services/endlessh.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.endlessh;
+  cfg = config.mySystem.services.endlessh;
 in {
-  options.modules.endlessh = {
+  options.mySystem.services.endlessh = {
     enable = mkEnableOption "Enables endlessh.";
     port = mkOption {
       type = types.port;

system/services/fwupd.nix

@@ -0,0 +1,13 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.fwupd;
+in {
+  options.mySystem.services.fwupd.enable = mkEnableOption "Enable fwupd";
+  config.services.fwupd = mkIf cfg.enable {
+    inherit (cfg) enable;
+  };
+}

system/services/jellyfin.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.jellyfin;
+in {
+  options.mySystem.services.jellyfin = {
+    enable = mkEnableOption "Enable Jellyfin";
+    dataDir = mkOption {
+      type = types.str;
+      default = "/tank/jellyfin/data";
+      example = "/tank/jellyfin/data";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "phundrak";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "users";
+    };
+  };
+  config.services.jellyfin = mkIf cfg.enable {
+    inherit (cfg) enable group user dataDir;
+  };
+}

system/services/languagetool.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.languagetool;
+in {
+  options.mySystem.services.languagetool = {
+    enable = mkEnableOption "Enables languagetool";
+    port = mkOption {
+      type = types.port;
+      default = 8081;
+      example = 80;
+    };
+  };
+  config.services.languagetool = mkIf cfg.enable {
+    inherit (cfg) enable port;
+  };
+}

system/services/plex.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.plex;
+in {
+  options.mySystem.services.plex = {
+    enable = mkEnableOption "Enable Plex";
+    group = mkOption {
+      type = types.str;
+      default = "users";
+      example = "users";
+      description = "Group under which Plex runs";
+    };
+    dataDir = mkOption {
+      type = types.str;
+      example = "/tank/plex-config";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "phundrak";
+    };
+  };
+  config = {
+    services.plex = mkIf cfg.enable {
+      inherit (cfg) enable user group dataDir;
+      openFirewall = cfg.enable;
+    };
+    boot.kernel.sysctl = {
+      "kernel.unprivileged_userns_clone" = 1;
+    };
+  };
+}

system/services/printing.nix

@@ -0,0 +1,13 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.printing;
+in {
+  options.mySystem.services.printing.enable = mkEnableOption "Enable printing with CUPS";
+  config.services.printing = mkIf cfg.enable {
+    inherit (cfg) enable;
+  };
+}

system/services/ssh.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.ssh;
+  cfg = config.mySystem.services.ssh;
 in {
-  options.modules.ssh = {
+  options.mySystem.services.ssh = {
     enable = mkEnableOption "Enables OpenSSH";
     allowedUsers = mkOption {
       type = types.listOf types.str;
@@ -20,7 +20,7 @@ in {
     };
   };
   config.services.openssh = mkIf cfg.enable {
-    enable = true;
+    inherit (cfg) enable;
     settings = {
       AllowUsers = cfg.allowedUsers;
       PermitRootLogin = "no";

system/services/sunshine.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.mySystem.services.sunshine;
+in {
+  options.mySystem.services.sunshine = {
+    enable = mkEnableOption "Enables Sunshine";
+    autostart = mkEnableOption "Enables autostart";
+  };
+  config.services.sunshine = mkIf cfg.enable {
+    inherit (cfg) enable;
+    autoStart = cfg.autostart;
+    capSysAdmin = true;
+    openFirewall = true;
+    settings.sunshine_name = config.mySystem.networking.hostname;
+    applications.apps = [
+      {
+        name = "Desktop";
+        image-path = "desktop.png";
+      }
+      {
+        name = "Low Res Desktop";
+        image-path = "desktop.png";
+      }
+      {
+        name = "Steam Big Picture";
+        detached = ["setsid steam steam://open/bigpicture"];
+        prep-cmd = {
+          do = "";
+          undo = "setsid steam steam://close/bigpicture";
+        };
+        image-path = "steam.png";
+      }
+      {
+        name = "OpenTTD";
+        cmd = "openttd";
+        image-path = "/home/phundrak/.config/sunshine/covers/igdb_18074.png";
+      }
+      {
+        name = "OpenMW";
+        cmd = "openmw";
+      }
+    ];
+  };
+}

system/users/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./phundrak.nix
+  ];
+}

system/users/phundrak.nix

@@ -5,14 +5,11 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.users;
+  cfg = config.mySystem.users;
 in {
-  options.modules.users = {
+  options.mySystem.users = {
     root.disablePassword = mkEnableOption "Disables root password";
-    phundrak = mkOption {
-      type = types.bool;
-      default = true;
-    };
+    phundrak.enable = mkEnableOption "Enables users phundrak";
   };
 
   config = {
@@ -21,12 +18,12 @@ in {
         hashedPassword = mkIf cfg.root.disablePassword "*";
         shell = pkgs.zsh;
       };
-      phundrak = {
+      phundrak = mkIf cfg.phundrak.enable {
         isNormalUser = true;
         description = "Lucien Cartier-Tilet";
-        extraGroups = ["networkmanager" "wheel" "docker" "dialout" "podman"];
+        extraGroups = ["networkmanager" "wheel" "docker" "dialout" "podman" "plugdev" "games" "audio" "input"];
         shell = pkgs.zsh;
-        openssh.authorizedKeys.keyFiles = lib.filesystem.listFilesRecursive ./keys;
+        openssh.authorizedKeys.keyFiles = lib.filesystem.listFilesRecursive ../../keys;
       };
     };
     programs.zsh.enable = true;

users/modules/cli/bat.nix

@@ -5,9 +5,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.bat;
+  cfg = config.home.cli.bat;
 in {
-  options.modules.bat.extras = mkEnableOption "Enables extra packages for bat.";
+  options.home.cli.bat.extras = mkEnableOption "Enables extra packages for bat.";
   config.programs.bat = {
     enable = true;
     config = {
@@ -19,7 +19,6 @@ in {
     extraPackages = mkIf cfg.extras (with pkgs.bat-extras; [
       batman
       batpipe
-      batgrep
     ]);
   };
 }

users/modules/cli/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.home.cli;
+in {
+  imports = [
+    ./bat.nix
+    ./btop.nix
+    ./direnv.nix
+    ./eza.nix
+    ./mu.nix
+    ./nh.nix
+    ./nix-index.nix
+    ./scripts
+    ./tealdeer.nix
+    ./yt-dlp.nix
+  ];
+
+  options.home.cli.fullDesktop = mkEnableOption "Enable all optional modules and options";
+  config.home.cli = {
+    bat.extras = mkDefault cfg.fullDesktop;
+    mu.enable = mkDefault cfg.fullDesktop;
+    scripts.enable = mkDefault cfg.fullDesktop;
+    yt-dlp.enable = mkDefault cfg.fullDesktop;
+  };
+}

users/modules/cli/mu.nix

@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.home.cli.mu;
+in {
+  options.home.cli.mu.enable = mkEnableOption "Enable mu";
+  config.programs.mu.enable = cfg.enable;
+}

users/modules/cli/nh.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib; let
-  cfg = config.modules.nh;
+  cfg = config.home.cli.nh;
 in {
-  options.modules.nh.flake = mkOption {
+  options.home.cli.nh.flake = mkOption {
     type = types.path;
     default = "/home/phundrak/.dotfiles";
     example = "/etc/nixos";

users/modules/cli/nix-index.nix

@@ -0,0 +1,10 @@
+{inputs, ...}: {
+  imports = [
+    inputs.nix-index-database.homeModules.nix-index
+  ];
+
+  programs = {
+    nix-index.enable = true;
+    nix-index-database.comma.enable = true;
+  };
+}

users/modules/cli/scripts/askpass.nix

@@ -0,0 +1,3 @@
+{pkgs, ...}:
+pkgs.writeShellScriptBin "askpass" ''
+  ${pkgs.rofi}/bin/rofi -dmenu -password -no-fixed-num-lines -p $(printf \"$*\" | sed 's/://')''

users/modules/cli/scripts/default.nix

@@ -0,0 +1,15 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.home.cli.scripts;
+  files = filesystem.listFilesRecursive ./.;
+  scriptFiles = builtins.filter (path: baseNameOf path != "default.nix") files;
+  scripts = map (file: (import file {inherit pkgs config;})) scriptFiles;
+in {
+  options.home.cli.scripts.enable = mkEnableOption "Add custom scripts to PATH";
+  config.home.packages = mkIf cfg.enable scripts;
+}

users/modules/cli/scripts/launch-with-emacsclient.nix

@@ -1,10 +1,10 @@
 {
   pkgs,
-  emacsPackage,
+  config,
   ...
 }:
 pkgs.writeShellScriptBin "launch-with-emacsclient" ''
   filename="$1"
   line="$2"
   column="$3"
-  ${emacsPackage}/bin/emacsclient +$line:$column "$filename"''
+  ${config.home.dev.editors.emacs.package}/bin/emacsclient +$line:$column "$filename"''

users/modules/cli/scripts/ytplay.nix

@@ -1,6 +1,6 @@
 {pkgs, ...}:
 pkgs.writeShellScriptBin "ytplay" ''
-  URL=$(${pkgs.wofi}/bin/wofi --dmenu -i -p "Video URL")
+  URL=$(rofi -dmenu -i -p "Video URL")
   if [ -z "$URL" ]; then
       echo "You need to provide a URL"
       exit 1
@@ -9,7 +9,7 @@ pkgs.writeShellScriptBin "ytplay" ''
                           grep -E "webm.*[0-9]+x[0-9]" | \
                           awk '{print $3 " " $1}' | \
                           sort -gu | \
-                          ${pkgs.wofi}/bin/wofi --dmenu -i -p "Resolution")
+                          rofi -dmenu -i -p "Resolution")
   mapfile -t RESOLUTION <<< "$RESOLUTION_CHOICE"
   RESOLUTION_CODE=''${RESOLUTION[0]}
   ${pkgs.mpv}/bin/mpv --ytdl-format="''${RESOLUTION_CODE}+bestaudio/best" "$URL"

users/modules/cli/yt-dlp.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.home.cli.yt-dlp;
+in {
+  options.home.cli.yt-dlp.enable = mkEnableOption "Enable yt-dlp";
+  config.programs.yt-dlp = mkIf cfg.enable {
+    inherit (cfg) enable;
+    settings = {
+      embed-thumbnail = true;
+      embed-subs = true;
+      sub-langs = "all";
+    };
+  };
+}

users/modules/default.nix

@@ -1,17 +1,29 @@
 {
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.home;
+in {
   imports = [
     ./basics.nix
-    ./bat.nix
-    ./btop.nix
-    ./direnv.nix
-    ./eza.nix
-    ./gpg.nix
-    ./mopidy.nix
-    ./nh.nix
-    ./nix-index.nix
+    ./cli
+    ./desktop
+    ./dev
+    ./media
+    ./services
+    ./security
     ./shell
-    ./ssh.nix
-    ./tealdeer.nix
-    ./vcs
   ];
+
+  options.home.fullDesktop = mkEnableOption "Enable most modules";
+  config.home = {
+    cli.fullDesktop = mkDefault cfg.fullDesktop;
+    desktop.fullDesktop = mkDefault cfg.fullDesktop;
+    dev.fullDesktop = mkDefault cfg.fullDesktop;
+    media.fullDesktop = mkDefault cfg.fullDesktop;
+    security.fullDesktop = mkDefault cfg.fullDesktop;
+    services.fullDesktop = mkDefault cfg.fullDesktop;
+  };
 }

users/modules/desktop/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.home.desktop;
+in {
+  imports = [
+    ./eww.nix
+    ./hyprland.nix
+    ./kdeconnect.nix
+    ./kitty.nix
+    ./obs.nix
+    ./qt.nix
+    ./rofi
+    ./swaync.nix
+    ./waybar.nix
+    ./wlr-which-key.nix
+    ./wlsunset.nix
+  ];
+
+  options.home.desktop.fullDesktop = mkEnableOption "Enable options for graphical environments";
+  config.home.desktop = {
+    eww.enable = mkDefault cfg.fullDesktop;
+    hyprland.enable = mkDefault cfg.fullDesktop;
+    kdeconnect.enable = mkDefault cfg.fullDesktop;
+    kitty.enable = mkDefault cfg.fullDesktop;
+    obs.enable = mkDefault cfg.fullDesktop;
+    qt.enable = mkDefault cfg.fullDesktop;
+    rofi.enable = mkDefault cfg.fullDesktop;
+    wlr-which-key.enable = mkDefault cfg.fullDesktop;
+  };
+}

users/modules/desktop/eww.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.home.desktop.eww;
+in {
+  options.home.desktop.eww.enable = mkEnableOption "Enable eww support";
+  config.programs.eww = mkIf cfg.enable {
+    inherit (cfg) enable;
+    configDir = ./eww-config;
+  };
+}

users/modules/desktop/hyprland.nix

@@ -0,0 +1,177 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.home.desktop.hyprland;
+  laptops = ["gampo"];
+in {
+  imports = [
+    ./swaync.nix
+    ./waybar.nix
+    ./wlsunset.nix
+    ./hyprpaper.nix
+  ];
+
+  options.home.desktop.hyprland = {
+    enable = mkEnableOption "Enables Hyprland";
+    emacsPkg = mkOption {
+      type = types.package;
+      default = config.home.dev.editors.emacs.package or pkgs.emacs;
+      example = pkgs.emacs;
+    };
+    host = mkOption {
+      type = types.enum ["gampo" "marpa"];
+      description = ''
+        Which host is Hyprland running on.
+
+        This helps determine the monitors layout and enable battery support in waybar.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.desktop = {
+      hyprpaper.enable = true;
+      rofi.enable = mkDefault true;
+      swaync.enable = mkDefault true;
+      waybar = {
+        enable = mkDefault true;
+        battery = mkDefault (builtins.elem cfg.host laptops);
+      };
+      wlsunset.enable = mkDefault true;
+    };
+    services.blueman-applet.enable = true;
+    wayland.windowManager.hyprland = {
+      enable = true;
+      xwayland.enable = true;
+      systemd.enable = false;
+      importantPrefixes = ["$left" "$right" "$up" "$down" "$menu"];
+      settings = {
+        input = {
+          kb_layout = "fr,us";
+          kb_variant = "bepo_afnor,";
+          # kb_options = "caps:ctrl_modifier";
+          numlock_by_default = true;
+          follow_mouse = 1;
+          touchpad.natural_scroll = false;
+          sensitivity = "0";
+        };
+        monitor =
+          {
+            "marpa" = [
+              "DP-1, 3440x1440@144, 1080x550, 1"
+              "DP-2, 2560x1080@60, 0x0, 1, transform, 1"
+              # "DP-2, 1366x768@60, 0x0, 1"
+              # "DP-2, 1829x1143@60, 0x0, 1"
+            ];
+            "gampo" = [];
+          }."${cfg.host}";
+        general = {
+          gaps_in = 5;
+          gaps_out = 20;
+          border_size = 2;
+          "col.active_border" = "rgb(81a1c1) rgb(a3be8c) 45deg";
+          "col.inactive_border" = "rgb(4c566a)";
+          layout = "master";
+        };
+        master = {
+          orientation = "center";
+          new_status = "inherit";
+        };
+        workspace = [
+          "10, layoutopt:orientation:bottom"
+          "1, layoutopt:orientation:bottom"
+        ];
+        decoration = {
+          rounding = 5;
+        };
+        animations = {
+          enabled = true;
+          animation = [
+            # "windows, 1, 7, myBezier"
+            "windowsOut, 1, 7, default, popin 80%"
+            "border, 1, 10, default"
+            "borderangle, 1, 8, default"
+            "fade, 1, 7, default"
+            "workspaces, 1, 6, default"
+          ];
+        };
+        dwindle = {
+          pseudotile = true;
+          preserve_split = true;
+        };
+        exec-once = [
+          "pactl load-module module-switch-on-connect"
+          "${pkgs.mpc}/bin/mpc stop"
+          "${pkgs.networkmanagerapplet}/bin/nm-applet"
+          "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"
+        ];
+      };
+      extraConfig = ''
+        $left = c
+        $right = r
+        $up = s
+        $down = t
+        $menu = rofi -combi-modi drun,calc -show combi
+
+        bind = SUPER, Return, exec, ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux
+        bind = SUPER, Space,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key
+        bind =      , Print,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key -k s
+
+        bindl = , XF86AudioPlay, exec, playerctl play-pause
+        bindl = , XF86AudioPause, exec, playerctl pause
+        bindl = , XF86AudioStop, exec, playerctl stop
+        bindl = , XF86AudioPrev, exec, playerctl previous
+        bindl = , XF86AudioNext, exec, playerctl next
+        bindl = , XF86AudioForward, exec, playerctl position +1
+        bindl = , XF86AudioRewind, exec, playerctl position -1
+        bindl = , XF86AudioRaiseVolume, exec, pamixer -i 2
+        bindl = , XF86AudioLowerVolume, exec, pamixer -d 2
+        bindl = , XF86MonBrightnessUp, exec, xbacklight -perceived -inc 2
+        bindl = , XF86MonBrightnessDown, exec, xbacklight -perceived -dec 2
+        bindl = , XF86KbdBrightnessUp, exec, xbacklight -perceived -inc 2
+        bindl = , XF86KbdBrightnessDown, exec, xbacklight -perceived -dec 2
+        bind = SUPER, a, exec, hyprctl switchxkblayout glove80-keyboard next
+        bind = SUPER, $left, movefocus, l
+        bind = SUPER, $right, movefocus, r
+        bind = SUPER, $up, movefocus, u
+        bind = SUPER, $down, movefocus, d
+        bind = SUPER_SHIFT, $left, movewindow, l
+        bind = SUPER_SHIFT, $right, movewindow, r
+        bind = SUPER_SHIFT, $up, movewindow, u
+        bind = SUPER_SHIFT, $down, movewindow, d
+        bind = SUPER_CTRL_SHIFT, $left, moveworkspacetomonitor, e+0 +1
+        bind = SUPER_CTRL_SHIFT, $right, moveworkspacetomonitor, e+0 -1
+        bind = SUPER, Tab, cyclenext,
+        bind = SUPER_SHIFT, Tab, cyclenext, prev
+        bindm = SUPER, mouse:272, movewindow
+        bindm = SUPER, mouse:273, resizewindow
+        bind = SUPER, quotedbl, workspace, 1
+        bind = SUPER, guillemotleft, workspace, 2
+        bind = SUPER, guillemotright, workspace, 3
+        bind = SUPER, parenleft, workspace, 4
+        bind = SUPER, parenright, workspace, 5
+        bind = SUPER, at, workspace, 6
+        bind = SUPER, plus, workspace, 7
+        bind = SUPER, minus, workspace, 8
+        bind = SUPER, slash, workspace, 9
+        bind = SUPER, asterisk, workspace, 10
+        bind = SUPER, mouse_down, workspace, e+1
+        bind = SUPER, mouse_up, workspace, e-1
+        bind = SUPER_SHIFT, quotedbl, movetoworkspace, 1
+        bind = SUPER_SHIFT, guillemotleft, movetoworkspace, 2
+        bind = SUPER_SHIFT, guillemotright, movetoworkspace, 3
+        bind = SUPER_SHIFT, parenleft, movetoworkspace, 4
+        bind = SUPER_SHIFT, parenright, movetoworkspace, 5
+        bind = SUPER_SHIFT, at, movetoworkspace, 6
+        bind = SUPER_SHIFT, plus, movetoworkspace, 7
+        bind = SUPER_SHIFT, minus, movetoworkspace, 8
+        bind = SUPER_SHIFT, slash, movetoworkspace, 9
+        bind = SUPER_SHIFT, asterisk, movetoworkspace, 10
+      '';
+    };
+  };
+}

users/modules/desktop/hyprpaper.nix

@@ -0,0 +1,88 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.home.desktop.hyprpaper;
+in {
+  options.home.desktop.hyprpaper = {
+    enable = mkEnableOption "Enables Hyprpaper";
+    default = mkOption {
+      type = types.str;
+      default = "/home/phundrak/Pictures/Wallpapers/nord/Nordic6.jpg";
+      example = "/home/user/image.jpg";
+    };
+    wallpapers-dir = mkOption {
+      type = types.str;
+      default = "/home/phundrak/Pictures/Wallpapers/nord/";
+      example = "/home/user/Pictures/";
+    };
+    rotation-interval = mkOption {
+      type = types.str;
+      default = "5m";
+      example = "10m";
+      description = "Interval between wallpaper rotations";
+    };
+  };
+  config = mkIf cfg.enable {
+    services.hyprpaper = {
+      inherit (cfg) enable;
+      settings = {
+        ipc = "on";
+        splash = false;
+        preload = cfg.default;
+        wallpaper = ", ${cfg.default}";
+      };
+    };
+    systemd.user = {
+      services.hyprpaper-rotation = {
+        Unit = {
+          Description = "Rotate Hyprpaper wallpaper";
+          After = "graphical-session.target";
+        };
+        Service = {
+          Type = "oneshot";
+          ExecCondition = "${pkgs.procps}/bin/pidof Hyprland";
+          ExecStart = "${config.home.homeDirectory}/.config/hypr/hyprpaper-rotate.sh";
+        };
+      };
+
+      timers.hyprpaper-rotation = {
+        Unit = {
+          Description = "Timer for rotating Hyprpaper wallpaper";
+        };
+        Timer = {
+          OnBootSec = cfg.rotation-interval;
+          OnUnitActiveSec = cfg.rotation-interval;
+        };
+        Install = {
+          WantedBy = ["timers.target"];
+        };
+      };
+    };
+    home.file.".config/hypr/hyprpaper-rotate.sh" = {
+      text = ''
+        #!/usr/bin/env bash
+        set -euo pipefail
+
+        WALLPAPER_DIR="${cfg.wallpapers-dir}"
+
+        # Find a random wallpaper
+        WP=$(find "$WALLPAPER_DIR" -type f \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" \) | shuf -n 1)
+
+        if [ -z "$WP" ]; then
+          echo "No wallpapers found in $WALLPAPER_DIR"
+          exit 1
+        fi
+
+        echo "Setting wallpaper to: $WP"
+
+        # Load and set the wallpaper
+        ${pkgs.hyprland}/bin/hyprctl hyprpaper preload "$WP" && ${pkgs.hyprland}/bin/hyprctl hyprpaper wallpaper ",$WP"
+      '';
+      executable = true;
+    };
+  };
+}