refactor: change to litterate config

Configuration is now held by the `.org` files. All `.nix` files are
tangled from the org-mode files.

.envrc

@@ -1,11 +1,7 @@
 # -*- mode: sh; -*-
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
-fi
-
 watch_file flake.nix
 watch_file flake.lock
 if ! use flake . --no-pure-eval
 then
-  echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
+  echo "dev shell could not be built. The environment was not loaded. Make the necessary changes to flake.nix and hit enter to try again." >&2
 fi

.sops.yaml

@@ -1,10 +1,14 @@
 keys:
+  - &elcafe age1tkywsvddjj6r6ukuqgz9aql92jfx85rz57dhmkkndysh6yx6p5rs0zj0qr
+  - &elcafe-host age17p69ktg7yfzgdsk00f32mupe4n4fevdpw2wsv7ft30yvpeseau6s7t0zdg
   - &gampo age1ajemtm502nn2n4q7v4j8meyd5mxtcqngkkedxq2pqzuwu78zp93qnw8q48
   - &gampo-host age197lfdanym647wdaz9uy8hrfqjwj9fs8rm7vs3fsrctceu8mr9gms2jedhz
   - &marpa age17pn6suvz2f7zmrm9zxj5hr0putvcvdamqxqt7ewhncgg6ccgmp2qr00xm2
   - &marpa-host age1cnnpnglkvgw5ffv8qpgwpqvj203lh4uwt698y9mxjwklxt8nysmsa8hepn
   - &tilo age1g68hxv73llkyc7etzh499ztcrt93pwawy0n8p93px4taqu58mehsp88vjq
   - &tilo-host age1awytvphvty4f9wmdn86xnjg9kgetqjx8qlwj5d2882t4fyyzy58s3vg5k4
+  - &NaroMk3 age1erkn7dd022e90ktyj66aux9j9xvl0uzd6ru5cmrjsvcm5rtr5pfs7q6k9h
+  - &NaroMk3-host age16crkeglm3j3f6rveylytuerptjf9mwtv3hl89ywkmnnvdkntfchsuvrsk5
 creation_rules:
   - path_regex: secrets/secrets.yaml$
     key_groups:
@@ -15,3 +19,7 @@ creation_rules:
       - *marpa-host
       - *tilo
       - *tilo-host
+      - *NaroMk3
+      - *NaroMk3-host
+      - *elcafe
+      - *elcafe-host

LICENSE.org

@@ -0,0 +1,17 @@
+* Licensing
+The source code you can find in various programming languages in this
+repository including, but not limited to, Javascript and CSS source
+code is under the [[https://www.gnu.org/licenses/agpl-3.0.html][AGPL-3.0]] licence.
+
+The creative work contained in [[https://labs.phundrak.com/phundrak/langue-phundrak-com][the main code repository]], on my [[https://github.com/Phundrak/langue-phundrak-fr/][Github
+mirror]], and on my website [[https://langue.phundrak.com][langue.phundrak.com]] is dual-licenced
+between the [[https://www.gnu.org/licenses/#FDL][GNU Free Documentation License]] ([[file:fdl-1.3.md][legal code]]) for the text
+and the /Creative Commons Attribution-NonCommercial-ShareAlike 4.0
+International/ ([[https://creativecommons.org/licenses/by-nc-sa/4.0/][CC BY-NC-SA 4.0]], [[https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode][legal code]]) license.
+
+Copies of all the mentionned licenses can be found in this code
+repository.
+
+If you wish to obtain a special license that is incompatible with the
+current ones, please contact me at [[mailto:lucien@phundrak.com][lucien@phundrak.com]] so we can
+discuss it.

README.md

@@ -1,6 +1,18 @@
-# NixOS Configuration
+<h1 align="center">NixOS Configuration</h1>
-
+<div align="center">
+ <strong>
    Personal NixOS configuration for my machines, using Nix Flakes for reproducible and shareable setups.
+ </strong>
+</div>
+<br/>
+
+<div align="center">
+  <!-- Wakapi -->
+  <img alt="Coding Time Badge" src="https://clock.phundrak.com/api/badge/phundrak/interval:any/project:.dotfiles">
+  <!-- Emacs -->
+  <a href="https://www.gnu.org/software/emacs/"><img src="https://img.shields.io/badge/Emacs-30.2-blueviolet.svg?style=flat-square&logo=GNU%20Emacs&logoColor=white" /></a>
+</div>
+
 
 ## Repository Structure
 
@@ -8,7 +20,6 @@ Personal NixOS configuration for my machines, using Nix Flakes for reproducible
 - **hosts/**: Contains the host-specific NixOS configurations.
 - **system/**: Holds system-wide configuration modules that can be shared across different hosts. This includes things like boot settings, desktop environments, hardware configurations, networking, packages, security, and system services.
 - **users/**: Manages user-specific configurations. It's split into `modules` for reusable home-manager configurations and `phundrak` for my personal configuration.
-- **keys/**: Public keys for various machines.
 - **secrets/**: Encrypted secrets managed with `sops-nix`.
 
 ## Usage

flake.lock

@@ -1,113 +1,125 @@
 {
   "nodes": {
-    "cachix": {
+    "alejandra": {
       "inputs": {
-        "devenv": [
+        "fenix": "fenix",
-          "devenv"
+        "flakeCompat": "flakeCompat",
-        ],
-        "flake-compat": [
-          "devenv",
-          "flake-compat"
-        ],
-        "git-hooks": [
-          "devenv",
-          "git-hooks"
-        ],
         "nixpkgs": [
-          "devenv",
+          "jj-cz",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1760971495,
+        "lastModified": 1744324181,
-        "narHash": "sha256-IwnNtbNVrlZIHh7h4Wz6VP0Furxg9Hh0ycighvL5cZc=",
+        "narHash": "sha256-Oi1n2ncF4/AWeY6X55o2FddIRICokbciqFYK64XorYk=",
-        "owner": "cachix",
+        "owner": "kamadorueda",
-        "repo": "cachix",
+        "repo": "alejandra",
-        "rev": "c5bfd933d1033672f51a863c47303fc0e093c2d2",
+        "rev": "3e2a85506627062313e131bf8a85315f3387c8e0",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "kamadorueda",
-        "ref": "latest",
+        "ref": "4.0.0",
-        "repo": "cachix",
+        "repo": "alejandra",
         "type": "github"
       }
     },
-    "claude-desktop": {
+    "caelestia-cli": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "caelestia-shell": [
+          "caelestia-shell"
+        ],
         "nixpkgs": [
+          "caelestia-shell",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1761825061,
+        "lastModified": 1789186140,
-        "narHash": "sha256-AeRQZKr8+1XQer+WmbwtQaQBy05UDgeNNE7YZjNLuS0=",
+        "narHash": "sha256-CEKrGzjO7Zk+BC0bsIySyu7q0vdy68V5MMq8YNKPpsk=",
-        "owner": "k3d3",
+        "owner": "caelestia-dots",
-        "repo": "claude-desktop-linux-flake",
+        "repo": "cli",
-        "rev": "791cd93cfe216ad06ab740f0fdc142119b1d6ec2",
+        "rev": "6b84ee5090ec50f36aa1a53990d57ab0013925a0",
         "type": "github"
       },
       "original": {
-        "owner": "k3d3",
+        "owner": "caelestia-dots",
-        "repo": "claude-desktop-linux-flake",
+        "repo": "cli",
         "type": "github"
       }
     },
-    "devenv": {
+    "caelestia-shell": {
       "inputs": {
-        "cachix": "cachix",
+        "caelestia-cli": "caelestia-cli",
-        "flake-compat": "flake-compat",
+        "m3shapes": "m3shapes",
-        "flake-parts": "flake-parts",
-        "git-hooks": "git-hooks",
-        "nix": "nix",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "quickshell": "quickshell"
       },
       "locked": {
-        "lastModified": 1761922975,
+        "lastModified": 1789736975,
-        "narHash": "sha256-j4EB5ku/gDm7h7W7A+k70RYj5nUiW/l9wQtXMJUD2hg=",
+        "narHash": "sha256-PVYroXR/tuQdsWjp2XAqOhgY6dV2kN5nyzH4zha6ZPs=",
-        "owner": "cachix",
+        "owner": "caelestia-dots",
-        "repo": "devenv",
+        "repo": "shell",
-        "rev": "c9f0b47815a4895fadac87812de8a4de27e0ace1",
+        "rev": "d999d4878ee4cec134168e60d913714566a8cfa6",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "caelestia-dots",
-        "repo": "devenv",
+        "ref": "stable",
+        "repo": "shell",
         "type": "github"
       }
     },
-    "flake-compat": {
+    "fenix": {
-      "flake": false,
+      "inputs": {
+        "nixpkgs": [
+          "jj-cz",
+          "alejandra",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
       "locked": {
-        "lastModified": 1761588595,
+        "lastModified": 1730615655,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "narHash": "sha256-2HBR3zLn57LXKNRtxBb+O+uDqHM4n0pz51rPayMl4cg=",
-        "owner": "edolstra",
+        "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "fenix",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "efeb50e2535b17ffd4a135e6e3e5fd60a525180c",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "flake-file": {
+      "locked": {
+        "lastModified": 1790698230,
+        "narHash": "sha256-24oUHm2evb57Dgu46X41rLY9ue/au47nxbaUTo6lJVc=",
+        "owner": "vic",
+        "repo": "flake-file",
+        "rev": "91280a19eede3b3035e3889a3523c27e8fc07886",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vic",
+        "repo": "flake-file",
         "type": "github"
       }
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "devenv",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1760948891,
+        "lastModified": 1788450739,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -152,51 +164,37 @@
         "type": "github"
       }
     },
-    "git-hooks": {
+    "flake-utils_3": {
       "inputs": {
-        "flake-compat": [
+        "systems": "systems_3"
-          "devenv",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "devenv",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1760663237,
+        "lastModified": 1731533236,
-        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "cachix",
+        "owner": "numtide",
-        "repo": "git-hooks.nix",
+        "repo": "flake-utils",
-        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "numtide",
-        "repo": "git-hooks.nix",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
-    "gitignore": {
+    "flakeCompat": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs": [
-          "devenv",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1709087332,
+        "lastModified": 1696426674,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "gitignore.nix",
+        "repo": "flake-compat",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "gitignore.nix",
+        "repo": "flake-compat",
         "type": "github"
       }
     },
@@ -207,11 +205,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761878381,
+        "lastModified": 1788229478,
-        "narHash": "sha256-lCRaipHgszaFZ1Cs8fdGJguVycCisBAf2HEFgip5+xU=",
+        "narHash": "sha256-G0F2rFORVcFkEvVdE/qWQTnYekIc77YP5/vRF9nZlxU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4ac96eb21c101a3e5b77ba105febc5641a8959aa",
+        "rev": "1dc2d1f720ab17fc7981e087346bf54b26d284b1",
         "type": "github"
       },
       "original": {
@@ -220,43 +218,64 @@
         "type": "github"
       }
     },
-    "nix": {
+    "import-tree": {
-      "inputs": {
-        "flake-compat": [
-          "devenv",
-          "flake-compat"
-        ],
-        "flake-parts": [
-          "devenv",
-          "flake-parts"
-        ],
-        "git-hooks-nix": [
-          "devenv",
-          "git-hooks"
-        ],
-        "nixpkgs": [
-          "devenv",
-          "nixpkgs"
-        ],
-        "nixpkgs-23-11": [
-          "devenv"
-        ],
-        "nixpkgs-regression": [
-          "devenv"
-        ]
-      },
       "locked": {
-        "lastModified": 1761648602,
+        "lastModified": 1788467110,
-        "narHash": "sha256-H97KSB/luq/aGobKRuHahOvT1r7C03BgB6D5HBZsbN8=",
+        "narHash": "sha256-ljEMTXP/rH0tOvDzc9gzwww6KcHRPRnEHzd9lK48V7s=",
-        "owner": "cachix",
+        "owner": "vic",
-        "repo": "nix",
+        "repo": "import-tree",
-        "rev": "3e5644da6830ef65f0a2f7ec22830c46285bfff6",
+        "rev": "eb1b52eaecc57f7c136d07ae8a93e724dfecac46",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "vic",
-        "ref": "devenv-2.30.6",
+        "repo": "import-tree",
-        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "jj-cz": {
+      "inputs": {
+        "alejandra": "alejandra",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1781867614,
+        "narHash": "sha256-GHy8hEZtToo7FLxEZm0x/pn/fjg1w9sx7ZP9hRd1fcM=",
+        "ref": "develop",
+        "rev": "d2c48605aac4ca9580d8a34aad4c65371c5a7cc1",
+        "revCount": 52,
+        "type": "git",
+        "url": "https://labs.phundrak.com/phundrak/jj-cz"
+      },
+      "original": {
+        "ref": "develop",
+        "type": "git",
+        "url": "https://labs.phundrak.com/phundrak/jj-cz"
+      }
+    },
+    "m3shapes": {
+      "inputs": {
+        "nixpkgs": [
+          "caelestia-shell",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787906858,
+        "narHash": "sha256-YZelgEZflFNwGutX4/tIzBdbOeghJgE2oDw0uWYGxns=",
+        "owner": "soramanew",
+        "repo": "m3shapes",
+        "rev": "32ad9ce328bb77ed349b40a3be10ee9ea610b8ab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "soramanew",
+        "repo": "m3shapes",
+        "rev": "32ad9ce328bb77ed349b40a3be10ee9ea610b8ab",
         "type": "github"
       }
     },
@@ -267,11 +286,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761451000,
+        "lastModified": 1788080100,
-        "narHash": "sha256-qBJL6xEIjqYq9zOcG2vf2nPTeVBppNJzvO0LuQWMwMo=",
+        "narHash": "sha256-n14luQo3F/ZLfCEHk1QieiI1nGnW92ZQZeZ0UIb0UMQ=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "ed6b293161b378a7368cda38659eb8d3d9a0dac4",
+        "rev": "dbb978fa87faf13398e90ccbc52c343d21c7dd6d",
         "type": "github"
       },
       "original": {
@@ -282,11 +301,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761907660,
+        "lastModified": 1788179007,
-        "narHash": "sha256-kJ8lIZsiPOmbkJypG+B5sReDXSD1KGu2VEPNqhRa/ew=",
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fb006b87f04c4d3bdf08cfdbc7fab9c13d94a15",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
         "type": "github"
       },
       "original": {
@@ -296,13 +315,59 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgsPinetab2Kernel": {
+      "locked": {
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "type": "github"
+      }
+    },
+    "nixpkgsStable": {
+      "locked": {
+        "lastModified": 1782847189,
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-25.11",
+        "type": "indirect"
+      }
+    },
     "pumo-system-info": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1748984111,
@@ -321,37 +386,111 @@
     "quickshell": {
       "inputs": {
         "nixpkgs": [
+          "caelestia-shell",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1761897390,
+        "lastModified": 1787994703,
-        "narHash": "sha256-er4gYrIoThYLjlsOMTysoRfn67d1Gci+ZpqDrtQxrA0=",
+        "narHash": "sha256-6SUZyyALo19heYPa/Xmu2H4zV+wvdfVX4fTcqbgHRnI=",
         "ref": "refs/heads/master",
-        "rev": "fc704e6b5d445899a1565955268c91942a4f263f",
+        "rev": "2d3b3e9c70ef380dff751b61d334dc88df016c29",
-        "revCount": 700,
+        "revCount": 856,
         "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
+        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
       },
       "original": {
         "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
+        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+      }
+    },
+    "rockchip": {
+      "inputs": {
+        "nixpkgsStable": [
+          "nixpkgsStable"
+        ],
+        "nixpkgsUnstable": [
+          "nixpkgsPinetab2Kernel"
+        ],
+        "utils": [
+          "flake-utils"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778273074,
+        "narHash": "sha256-gPbn0KjsgS2cJa/ENSMtjN0h8dIEy+2N6g8tw9915pM=",
+        "owner": "raboof",
+        "repo": "nixos-rockchip",
+        "rev": "2aab433a41cc9ba862ae73012acdd2eec3547667",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raboof",
+        "ref": "pinetab-linux-7.0",
+        "repo": "nixos-rockchip",
+        "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "claude-desktop": "claude-desktop",
+        "caelestia-shell": "caelestia-shell",
-        "devenv": "devenv",
+        "flake-file": "flake-file",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
         "home-manager": "home-manager",
+        "import-tree": "import-tree",
+        "jj-cz": "jj-cz",
         "nix-index-database": "nix-index-database",
         "nixpkgs": "nixpkgs",
+        "nixpkgsPinetab2Kernel": "nixpkgsPinetab2Kernel",
+        "nixpkgsStable": "nixpkgsStable",
         "pumo-system-info": "pumo-system-info",
-        "quickshell": "quickshell",
+        "rockchip": "rockchip",
         "sops-nix": "sops-nix",
+        "spicetify": "spicetify",
+        "srvos": "srvos",
         "zen-browser": "zen-browser"
       }
     },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730555913,
+        "narHash": "sha256-KNHZUlqsEibg3YtfUyOFQSofP8hp1HKoY+laoesBxRM=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "f17a5bbfd0969ba2e63a74505a80e55ecb174ed9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "jj-cz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779992051,
+        "narHash": "sha256-4YWGv/0NkAdtTW1MXfaLYpfC9BhpCy9k1pWkR0xI9uw=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "e93ad0df1073b2c969a8f0c1f10b84e870469d40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "pumo-system-info",
@@ -379,11 +518,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760998189,
+        "lastModified": 1786629091,
-        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
+        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
+        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
         "type": "github"
       },
       "original": {
@@ -392,6 +531,47 @@
         "type": "github"
       }
     },
+    "spicetify": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1788263070,
+        "narHash": "sha256-Mw163zYcjr59hB2JMC1iKU1Y69SNKZ2r/haXZ07UWQY=",
+        "owner": "Gerg-L",
+        "repo": "spicetify-nix",
+        "rev": "27ff19b00338052e8a504e1d1a34efad82c4bb26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Gerg-L",
+        "repo": "spicetify-nix",
+        "type": "github"
+      }
+    },
+    "srvos": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788143273,
+        "narHash": "sha256-YXleehtVHiLcH2+V0lSrl5Nmo2c+J11tI3+l4l9q3AQ=",
+        "owner": "nix-community",
+        "repo": "srvos",
+        "rev": "e4d3f8fe5f1d4246d32177315edf8d9104f1c32b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "srvos",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -422,6 +602,36 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "zen-browser": {
       "inputs": {
         "nixpkgs": [
@@ -429,11 +639,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761883599,
+        "lastModified": 1788083005,
-        "narHash": "sha256-ntnfAAqSuXI/+uqXAWUjbY5arB7sRK9cpgFbHbCZgK8=",
+        "narHash": "sha256-e6U3sXUlu/QzZyJp/+ymW8s57Jbdb7bwT9+WaTAhHfQ=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "5355c0dc6857a2aa34b126fb4a93a454ed702f52",
+        "rev": "afbbbef7c3c00f160f4a9dfdd8c6c6b8b089a33f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,158 +1,79 @@
+# DO-NOT-EDIT. This file was auto-generated using github:denful/flake-file.
+# Use `nix run .#write-flake` to regenerate it.
 {
-  description = "Home Manager configuration of phundrak";
+  description = "NixOS and Home Manager configuration of P'undrak";
 
-  inputs = {
+  outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
-    devenv = {
+  nixConfig = {
-      url = "github:cachix/devenv";
+    extra-experimental-features = [
-      inputs.nixpkgs.follows = "nixpkgs";
+      "nix-command"
+      "flakes"
+    ];
+    extra-substituters = [
+      "https://phundrak.cachix.org?priority=10"
+      "https://nix-community.cachix.org?priority=20"
+      "https://cache.nixos.org?priority=40"
+    ];
+    extra-trusted-public-keys = [
+      "phundrak.cachix.org-1:osJAkYO0ioTOPqaQCIXMfIRz1/+YYlVFkup3R2KSexk="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+    http-connections = 128;
   };
 
+  inputs = {
+    caelestia-shell = {
+      url = "github:caelestia-dots/shell?ref=stable";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    flake-file.url = "github:vic/flake-file";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    flake-utils.url = "github:numtide/flake-utils";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    import-tree.url = "github:vic/import-tree";
+    jj-cz = {
+      url = "git+https://labs.phundrak.com/phundrak/jj-cz?ref=develop";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    nixpkgsPinetab2Kernel.url = "github:nixos/nixpkgs/e73de5be04e0eff4190a1432b946d469c794e7b4";
+    nixpkgsStable.url = "nixpkgs/nixos-25.11";
     pumo-system-info = {
       url = "git+https://labs.phundrak.com/phundrak/pumo-system-info";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    rockchip = {
-    quickshell = {
+      url = "github:raboof/nixos-rockchip/pinetab-linux-7.0";
-      url = "git+https://git.outfoxxed.me/quickshell/quickshell";
+      inputs = {
-      inputs.nixpkgs.follows = "nixpkgs";
+        nixpkgsStable.follows = "nixpkgsStable";
+        nixpkgsUnstable.follows = "nixpkgsPinetab2Kernel";
+        utils.follows = "flake-utils";
+      };
     };
-
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    spicetify = {
-    claude-desktop = {
+      url = "github:Gerg-L/spicetify-nix";
-      url = "github:k3d3/claude-desktop-linux-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    srvos = {
+      url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-
-  nixConfig = {
-    extra-trusted-public-keys = "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw=";
-    extra-substituters = "https://devenv.cachix.org";
-  };
-
-  outputs = {
-    self,
-    nixpkgs,
-    home-manager,
-    devenv,
-    ...
-  } @ inputs: let
-    inherit (self) outputs;
-    system = "x86_64-linux";
-    pkgs = nixpkgs.legacyPackages.${system};
-  in {
-    formatter.${system} = pkgs.alejandra;
-
-    packages.${system} = {
-      devenv-up = self.devShells.${system}.default.config.procfileScript;
-      devenv-test = self.devShells.${system}.default.config.test;
-    };
-
-    devShells.${system}.default = devenv.lib.mkShell {
-      inherit inputs pkgs;
-      modules = [
-        (
-          {pkgs, ...}: {
-            packages = [pkgs.nh];
-            git-hooks.hooks = {
-              alejandra.enable = true;
-              commitizen.enable = true;
-              detect-private-keys.enable = true;
-              end-of-file-fixer.enable = true;
-              deadnix.enable = true;
-              ripsecrets.enable = true;
-              statix.enable = true;
-            };
-          }
-        )
-      ];
-    };
-
-    homeConfigurations = let
-      extraSpecialArgs = {inherit inputs outputs system;};
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-    in {
-      "phundrak@alys" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/alys.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@marpa" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/marpa.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@gampo" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/gampo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@tilo" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/tilo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-    };
-
-    nixosConfigurations = let
-      specialArgs = {inherit inputs outputs;};
-    in {
-      alys = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/alys/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      gampo = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/gampo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      marpa = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/marpa/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      tilo = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/tilo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-    };
-  };
 }

hosts/alys/configuration.nix

@@ -1,41 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    ./hardware-configuration.nix
-    inputs.home-manager.nixosModules.default
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      kernel.hardened = true;
-      systemd-boot = false;
-      zram = {
-        enable = true;
-        memoryMax = 512;
-      };
-    };
-    dev.docker.enable = true;
-    networking = {
-      hostname = "alys";
-      domain = "phundrak.com";
-      id = "41157110";
-    };
-    packages.nix = {
-      gc.automatic = true;
-      trusted-users = ["root" "phundrak"];
-    };
-    services = {
-      endlessh.enable = true;
-      ssh = {
-        enable = true;
-        allowedUsers = ["phundrak"];
-        passwordAuthentication = false;
-      };
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-  system.stateVersion = "23.11";
-}

hosts/alys/hardware-configuration.nix

@@ -1,28 +0,0 @@
-{
-  modulesPath,
-  lib,
-  ...
-}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-  boot = {
-    loader.grub = {
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-      device = "nodev";
-    };
-    initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-    initrd.kernelModules = ["nvme"];
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/vda1";
-      fsType = "ext4";
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/F137-8D01";
-      fsType = "vfat";
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/gampo/configuration.nix

@@ -1,85 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}: {
-  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      plymouth.enable = true;
-      kernel = {
-        cpuVendor = "intel";
-        package = pkgs.linuxPackages;
-        modules = ["i915"];
-      };
-      systemd-boot = true;
-    };
-    desktop = {
-      hyprland.enable = true;
-      xserver = {
-        enable = true;
-        de = "gnome";
-      };
-    };
-    dev.docker = {
-      enable = true;
-      podman.enable = true;
-      autoprune.enable = true;
-    };
-    hardware = {
-      bluetooth.enable = true;
-      input = {
-        corne.allowHidAccess = true;
-        ibmTrackpoint.disable = true;
-        opentablet.enable = true;
-      };
-      sound.enable = true;
-    };
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "gampo";
-      id = "0630b33f";
-      hostFiles = [config.sops.secrets.extraHosts.path];
-    };
-    packages = {
-      appimage.enable = true;
-      flatpak.enable = true;
-      nix = {
-        nix-ld.enable = true;
-        trusted-users = ["root" "phundrak"];
-      };
-    };
-    programs.steam.enable = true;
-    services = {
-      fwupd.enable = true;
-      ssh.enable = true;
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  sops.secrets.extraHosts = {
-    inherit (config.users.users.root) group;
-    owner = config.users.users.phundrak.name;
-    mode = "0440";
-  };
-
-  security.rtkit.enable = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database
-  # versions on your system were taken. It‘s perfectly fine and
-  # recommended to leave this value at the release version of the
-  # first install of this system. Before changing this value read
-  # the documentation for this option (e.g. man configuration.nix or
-  # on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-}

hosts/marpa/configuration.nix

@@ -1,117 +0,0 @@
-{
-  config,
-  inputs,
-  ...
-}: {
-  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      extraModprobeConfig = ''
-        options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
-      '';
-      plymouth.enable = true;
-      kernel.cpuVendor = "amd";
-      systemd-boot = true;
-    };
-    desktop = {
-      hyprland.enable = true;
-      niri.enable = true;
-      waydroid.enable = true;
-      xserver = {
-        enable = true;
-        de = "gnome";
-      };
-    };
-    dev = {
-      docker = {
-        enable = true;
-        podman.enable = true;
-        autoprune.enable = true;
-      };
-      qemu.enable = true;
-    };
-    hardware = {
-      amdgpu.enable = true;
-      bluetooth.enable = true;
-      input = {
-        corne.allowHidAccess = true;
-        opentablet.enable = true;
-      };
-      sound = {
-        enable = true;
-        jack = true;
-        scarlett.enable = true;
-      };
-    };
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "marpa";
-      id = "7EA4A111";
-      hostFiles = [config.sops.secrets.extraHosts.path];
-      firewall.openPortRanges = [
-        {
-          # Sunshine
-          from = 1714;
-          to = 1764;
-        }
-      ];
-    };
-    packages = {
-      appimage.enable = true;
-      flatpak.enable = true;
-      nix = {
-        nix-ld.enable = true;
-        trusted-users = ["root" "phundrak"];
-      };
-    };
-    programs.steam.enable = true;
-    services = {
-      fwupd.enable = true;
-      printing.enable = true;
-      ssh.enable = true;
-      sunshine = {
-        enable = true;
-        autostart = true;
-      };
-      languagetool.enable = true;
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  sops.secrets.extraHosts = {
-    inherit (config.users.users.root) group;
-    owner = config.users.users.phundrak.name;
-    mode = "0440";
-  };
-
-  services.udev.extraHwdb = ''
-    mouse:usb:047d:80a6:*
-     LIBINPUT_MIDDLE_EMULATION_ENABLED=1
-  '';
-
-  security = {
-    polkit.enable = true;
-    rtkit.enable = true;
-  };
-
-  fileSystems."/games" = {
-    device = "/dev/disk/by-uuid/77d32db8-2e85-4593-b6b8-55d4f9d14e1a";
-    fsType = "ext4";
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-}

hosts/marpa/services/default.nix

@@ -1,24 +0,0 @@
-{
-  # imports = [
-  #   ./logind.nix
-  #   ../../../system
-  # ];
-  # imports = [
-  #   ./logind.nix
-  #   ../../../modules/ssh.nix
-  #   ../../../modules/sunshine.nix
-  # ];
-
-  # modules = {
-  #   sunshine = {
-  #     enable = true;
-  #     autostart = true;
-  #   };
-  # };
-  # services = {
-  #   blueman.enable = true;
-  #   fwupd.enable = true;
-  #   printing.enable = true;
-  #   openssh.enable = true;
-  # };
-}

hosts/marpa/services/gnome.nix

@@ -1,11 +0,0 @@
-{
-  services.xserver = {
-    enable = true;
-    displayManager.gdm.enable = true;
-    desktopManager.gnome.enable = true;
-    xkb = {
-      layout = "fr";
-      variant = "bepo_afnor";
-    };
-  };
-}

hosts/marpa/services/logind.nix

@@ -1,6 +0,0 @@
-{
-  services.logind = {
-    powerKey = "ignore";
-    powerKeyLongPress = "ignore";
-  };
-}

hosts/tilo/configuration.nix

@@ -1,67 +0,0 @@
-# Edit this configuration file to define what should be installed on your
-# system.  Help is available in the configuration.nix(5) man page and in
-# the NixOS manual (accessible by running ‘nixos-help’).
-{inputs, ...}: {
-  imports = [
-    ./hardware-configuration.nix
-    inputs.home-manager.nixosModules.default
-    ../../system
-    ./services
-  ];
-
-  mySystem = {
-    boot = {
-      kernel = {
-        hardened = true;
-        cpuVendor = "amd";
-      };
-      zfs = {
-        enable = true;
-        pools = ["tank"];
-      };
-    };
-    dev.docker.enable = true;
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "tilo";
-      id = "7110b33f";
-      firewall = {
-        openPorts = [
-          80 # HTTP
-          443 # HTTPS
-          25565 # Minecraft
-        ];
-      };
-    };
-    packages.nix = {
-      gc.automatic = true;
-      trusted-users = ["root" "phundrak"];
-    };
-    services = {
-      calibre.enable = true;
-      endlessh.enable = true;
-      jellyfin.enable = true;
-      plex = {
-        enable = true;
-        dataDir = "/tank/web/stacks/plex/plex-config";
-      };
-      ssh = {
-        enable = true;
-        allowedUsers = ["phundrak"];
-        passwordAuthentication = false;
-      };
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
-}

hosts/tilo/services/default.nix

@@ -1,3 +0,0 @@
-{
-  imports = [./nextcloud-cron.nix];
-}

hosts/tilo/services/nextcloud-cron.nix

@@ -1,33 +0,0 @@
-{pkgs, ...}: {
-  systemd = {
-    timers."nextcloud-cron" = {
-      wantedBy = ["timers.target"];
-      timerConfig = {
-        OnBootSec = "20m";
-        OnUnitActiveSec = "20m";
-        Unit = "nextcloud-cron.service";
-      };
-    };
-    services."nextcloud-cron" = {
-      script = ''
-        CONTAINER_NAME="nextcloud-nextcloud-1"
-
-        is_container_running() {
-          ${pkgs.docker}/bin/docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null | grep -q "true"
-        }
-
-        while ! is_container_running; do
-            echo "Waiting for $CONTAINER_NAME to start..."
-            sleep 10
-        done
-
-        echo "$CONTAINER_NAME is running. Executing CRON job..."
-        ${pkgs.docker}/bin/docker exec -u www-data -it nextcloud-nextcloud-1 php /var/www/html/cron.php
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-      };
-    };
-  };
-}

keys/id_alys.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTv1lb6d99O84jeh6GdjPm8Gnt/HncSRhGhmoTq7BMK lucien@phundrak.com

modules/boot/hardened.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.nixos.hardened = {
+    boot = {
+      kernelModules = ["tcp_bbr"];
+      kernel.sysctl = {
+        "kernel.sysrq" = 0;
+        "net.ipv4.icmp_echo_ignore_broadcasts" = 1;
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default_accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        "net.ipv4.tcp_syncookies" = 1;
+        "net.ipv4.tcp_rfc1337" = 1;
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.core.default_qdisc" = "cake";
+        "net.ipv4.tcp_fastopen" = 3;
+      };
+    };
+  };
+}

modules/boot/hardened.org

@@ -0,0 +1,116 @@
+#+title: Kernel Hardening
+#+setupfile: ../headers
+
+* Kernel Hardening
+Some of my machines are exposed to the Internet, and therefore get
+their kernel hardened. First, let me declare the Nix file’s skeleton,
+with the =nixos.hardened= module.
+
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.hardened = {
+    boot = {
+      <<kernel-modules>>
+      <<kernel-options>>
+    };
+  };
+}
+#+end_src
+
+** Kernel Modules
+The very first thing to do is to load the =tcp_bbr= kernel module. It
+increases the connection speed of the system with a better congestion
+control. It is particularly interesting for my servers, as they may
+have to deal with high traffic if a crawler ever decides to explore
+all webpages offered by some websites I host. See [[https://www.cyberciti.biz/cloud-computing/increase-your-linux-server-internet-speed-with-tcp-bbr-congestion-control/][this article]] by
+Nixcraft for more details.
+#+name: kernel-modules
+#+begin_src nix
+kernelModules = ["tcp_bbr"];
+#+end_src
+
+** Kernel Options
+Next are a series of kernel options.
+#+name: kernel-options
+#+begin_src nix
+kernel.sysctl = {
+  <<sysrq-key>>
+  <<icmp>>
+  <<icmp-no-accept-redirects>>
+  <<icmp-no-send-redirects>>
+  <<ip-source-route-packets>>
+  <<syn>>
+  <<tcp-time-wait>>
+  <<bufferfloat>>
+  <<latency>>
+};
+#+end_src
+
+First, we’ll disable the magic SysRq key. Not that I expect anyone to
+have physical access to my servers, but it is a really powerful tool
+that I’d rather have off.
+#+name: sysrq-key
+#+begin_src nix
+"kernel.sysrq" = 0;
+#+end_src
+
+Next, we’ll ignore ICMP broadcasts to avoid participating in Smurf
+attacks, and we’ll also ignore ICMP errors.
+#+name: icmp
+#+begin_src nix
+"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
+"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+#+end_src
+
+Speaking of ICMP, we won’t accept ICMP redirects to prevent some MITM
+attacks.
+#+name: icmp-no-accept-redirects
+#+begin_src nix
+"net.ipv4.conf.all.accept_redirects" = 0;
+"net.ipv4.conf.default_accept_redirects" = 0;
+"net.ipv4.conf.all.secure_redirects" = 0;
+"net.ipv4.conf.default.secure_redirects" = 0;
+"net.ipv6.conf.all.accept_redirects" = 0;
+"net.ipv6.conf.default.accept_redirects" = 0;
+#+end_src
+
+And we won’t send ICMP redirects (we’re not a router).
+#+name: icmp-no-send-redirects
+#+begin_src nix
+"net.ipv4.conf.all.send_redirects" = 0;
+#+end_src
+
+We’re stil not a router, so we’ll refuse IP source route packets, both
+on IPV4 and IPV6.
+#+name: ip-source-route-packets
+#+begin_src nix
+"net.ipv4.conf.all.accept_source_route" = 0;
+"net.ipv6.conf.all.accept_source_route" = 0;
+#+end_src
+
+Now, let’s get some SYN flood protection.
+#+name: syn
+#+begin_src nix
+"net.ipv4.tcp_syncookies" = 1;
+#+end_src
+
+And protection against TCP time-wait assassination hazards.
+#+name: tcp-time-wait
+#+begin_src nix
+"net.ipv4.tcp_rfc1337" = 1;
+#+end_src
+
+We will also mitigate bufferfloat, including with BBR (hey, we enabled that above!)
+#+name: bufferfloat
+#+begin_src nix
+"net.ipv4.tcp_congestion_control" = "bbr";
+"net.core.default_qdisc" = "cake";
+#+end_src
+
+And lastly, we’ll reduce latency on IPV4.
+#+name: latency
+#+begin_src nix
+"net.ipv4.tcp_fastopen" = 3;
+#+end_src
+
+And we should be good to go!

modules/boot/kernel.nix

@@ -0,0 +1,44 @@
+{
+  flake.modules.nixos.kernel = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot.kernel;
+    in {
+      options.mySystem.boot.kernel = {
+        package = mkOption {
+          type = types.raw;
+          default = pkgs.linuxPackages_zen;
+        };
+        modules = mkOption {
+          type = types.listOf types.str;
+          default = [];
+        };
+        cpuVendor = mkOption {
+          description = "Intel or AMD?";
+          type = types.enum ["intel" "amd"];
+          default = "amd";
+        };
+        v4l2loopback.enable = mkEnableOption "Enables v4l2loopback kernel module";
+        extraModprobeConfig = mkOption {
+          type = types.lines;
+          default = "";
+          example = ''
+            options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+          '';
+        };
+      };
+      config.boot = {
+        initrd.kernelModules = ["i915"];
+        extraModprobeConfig =
+          strings.concatLines
+          ([cfg.extraModprobeConfig]
+            ++ lists.optional cfg.v4l2loopback.enable ''options v4l2loopback exclusive_caps=1 devices=1 video_nr=0 card_label="OBS Studio"'');
+        kernelPackages = cfg.package;
+        kernelModules = cfg.modules ++ ["kvm-${cfg.cpuVendor}"];
+      };
+    };
+}

modules/boot/kernel.org

@@ -0,0 +1,136 @@
+#+title: Kernel Configuration
+#+setupfile: ../headers
+
+* Kernel Configuration
+This module centralises everything related to the kernel: which
+package to boot, which extra modules to load, which KVM module the
+CPU needs, and a couple of modprobe quirks for specific devices.
+Here’s the skeleton of the =nixos.kernel= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.kernel = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot.kernel;
+    in {
+      <<options>>
+      <<config>>
+    };
+}
+#+end_src
+
+** Declaring the Options
+#+name: options
+#+begin_src nix
+options.mySystem.boot.kernel = {
+  <<opt-package>>
+  <<opt-modules>>
+  <<opt-cpu-vendor>>
+  <<opt-v4l2loopback>>
+  <<opt-extra-modprobe>>
+};
+#+end_src
+
+*** Kernel Package
+=package= picks which kernel to boot. I default to the Zen kernel for
+its desktop-tuned scheduler, but a host can override it with a
+hardened or hardware-specific kernel instead.
+#+name: opt-package
+#+begin_src nix
+package = mkOption {
+  type = types.raw;
+  default = pkgs.linuxPackages_zen;
+};
+#+end_src
+
+*** Extra Kernel Modules
+=modules= lists any extra kernel modules a host needs beyond the ones
+this module already adds on its own.
+#+name: opt-modules
+#+begin_src nix
+modules = mkOption {
+  type = types.listOf types.str;
+  default = [];
+};
+#+end_src
+
+*** CPU Vendor
+=cpuVendor= tells the module which KVM module to load, since Intel and
+AMD CPUs each need their own.
+#+name: opt-cpu-vendor
+#+begin_src nix
+cpuVendor = mkOption {
+  description = "Intel or AMD?";
+  type = types.enum ["intel" "amd"];
+  default = "amd";
+};
+#+end_src
+
+*** Virtual Webcam
+=v4l2loopback.enable= turns on a virtual video device. I feed it a
+video source, and OBS Studio picks it up as if it were a webcam.
+#+name: opt-v4l2loopback
+#+begin_src nix
+v4l2loopback.enable = mkEnableOption "Enables v4l2loopback kernel module";
+#+end_src
+
+*** Extra Modprobe Configuration
+=extraModprobeConfig= lets a host inject raw =modprobe.d= lines. The
+example below fixes a USB sound card that otherwise misconfigures
+itself on boot.
+#+name: opt-extra-modprobe
+#+begin_src nix
+extraModprobeConfig = mkOption {
+  type = types.lines;
+  default = "";
+  example = ''
+    options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+  '';
+};
+#+end_src
+
+** Wiring It All Up
+#+name: config
+#+begin_src nix
+config.boot = {
+  <<initrd-driver>>
+  <<extra-modprobe-lines>>
+  <<kernel-packages-and-modules>>
+};
+#+end_src
+
+*** Choosing the Initrd Driver
+Most of my machines have Intel graphics, so this module loads =i915=
+early, in the initrd, to keep the Plymouth splash screen from flashing
+or glitching before the proper driver takes over. Machines with an AMD
+GPU instead load =amdgpu= early; the [[file:../hardware/amdgpu.org][AMD GPU module]] handles that
+itself, so this module doesn’t need to know or care which GPU a host
+actually has.
+#+name: initrd-driver
+#+begin_src nix
+initrd.kernelModules = ["i915"];
+#+end_src
+
+*** Assembling Modprobe Configuration
+This concatenates whatever a host set through =cfg.extraModprobeConfig=
+with the v4l2loopback quirk line whenever =v4l2loopback.enable= is on.
+#+name: extra-modprobe-lines
+#+begin_src nix
+extraModprobeConfig =
+  strings.concatLines
+  ([cfg.extraModprobeConfig]
+    ++ lists.optional cfg.v4l2loopback.enable ''options v4l2loopback exclusive_caps=1 devices=1 video_nr=0 card_label="OBS Studio"'');
+#+end_src
+
+*** Kernel Package and Extra Modules
+Finally, =kernelPackages= and =kernelModules= wire the chosen package
+and modules through, appending the vendor-specific KVM module.
+#+name: kernel-packages-and-modules
+#+begin_src nix
+kernelPackages = cfg.package;
+kernelModules = cfg.modules ++ ["kvm-${cfg.cpuVendor}"];
+#+end_src

modules/boot/loader.nix

@@ -0,0 +1,31 @@
+{
+  flake.modules.nixos.loader = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+      options.mySystem.boot.systemd-boot = mkOption {
+        type = types.bool;
+        default = !cfg.grub.enable;
+        description = "Does the system use systemd-boot?";
+      };
+      options.mySystem.boot.grub = {
+        enable = mkEnableOption "Does the system use GRUB? (Disables systemd-boot)";
+        device = mkOption {
+          type = types.path;
+          description = "The GRUB device";
+        };
+      };
+
+      config.boot.loader = {
+        systemd-boot.enable = cfg.systemd-boot;
+        efi.canTouchEfiVariables = cfg.systemd-boot;
+      };
+      config.boot.loader.grub = mkIf cfg.grub.enable {
+        inherit (cfg.grub) enable device;
+      };
+    };
+}

modules/boot/loader.org

@@ -0,0 +1,73 @@
+#+title: Bootloaders and Filesystems
+#+setupfile: ../headers
+
+* Bootloaders and Filesystems
+This page sets up the bootloader of my machines. Whilst I generally
+prefer to use [[https://systemd.io/BOOT/][systemd-boot]], some of my VPS use GRUB. All that gets
+exposed with my module =nixos.loader=.
+
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.loader = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+      <<systemd-boot-options>>
+      <<grub-options>>
+
+      <<systemd-boot-config>>
+      <<grub-config>>
+    };
+}
+#+end_src
+
+By default, I want to use systemd-boot on my machines, but I need it
+to be disabled whenever I use something else. For now, this “something
+else” is only GRUB, but I’m not excluding using something else on yet
+another machine such as [[https://www.rodsbooks.com/refind/][rEFInd]]. To ensure a single source of truth
+regarding whether systemd-boot is to be used, I have an option for
+that.
+#+name: systemd-boot-options
+#+begin_src nix
+options.mySystem.boot.systemd-boot = mkOption {
+  type = types.bool;
+  default = !cfg.grub.enable;
+  description = "Does the system use systemd-boot?";
+};
+#+end_src
+
+I can now set some options depending on that, such as whether to
+enable systemd-boot itself (duh), and whether the installation process
+can touch my EFI variables.
+#+name: systemd-boot-config
+#+begin_src nix
+config.boot.loader = {
+  systemd-boot.enable = cfg.systemd-boot;
+  efi.canTouchEfiVariables = cfg.systemd-boot;
+};
+#+end_src
+
+But, I have a VPS that requires me to use GRUB. For this, I also have
+an option to enable it.
+#+name: grub-options
+#+begin_src nix
+options.mySystem.boot.grub = {
+  enable = mkEnableOption "Does the system use GRUB? (Disables systemd-boot)";
+  device = mkOption {
+    type = types.path;
+    description = "The GRUB device";
+  };
+};
+#+end_src
+
+I can no pass these options to the boot configuration of my machine.
+#+name: grub-config
+#+begin_src nix
+config.boot.loader.grub = mkIf cfg.grub.enable {
+  inherit (cfg.grub) enable device;
+};
+#+end_src

modules/boot/plymouth.nix

@@ -0,0 +1,25 @@
+{
+  flake.modules.nixos.plymouth = {pkgs, ...}: {
+    boot = {
+      plymouth = {
+        enable = true;
+        theme = "circle_hud";
+        themePackages = with pkgs; [
+          (adi1090x-plymouth-themes.override {
+            selected_themes = ["circle_hud"];
+          })
+        ];
+      };
+      kernelParams = [
+        "quiet"
+        "splash"
+        "boot.shell_on_fail"
+        "udev.log_level=3"
+        "rd.systemd.show_status=auto"
+      ];
+      consoleLogLevel = 3;
+      initrd.verbose = false;
+      loader.timeout = 0;
+    };
+  };
+}

modules/boot/plymouth.org

@@ -0,0 +1,99 @@
+#+title: Plymouth
+#+setupfile: ../headers
+
+* Plymouth
+Plymouth is a utility which shows an animation at startup or when
+powering off a device, instead of showing only terminal things. My
+Plymouth settings are set in the =nixos.plymouth= module.
+
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.plymouth = {pkgs, ...}: {
+    boot = {
+      <<plymouth>>
+      <<kernel-parameters>>
+      <<quiet-console>>
+      <<no-menu>>
+    };
+  };
+}
+#+end_src
+
+** Quieting Down the Console
+First, I need to set a few kernel parameters to make displaying
+Plymouth possible:
+#+name: kernel-parameters-list
+- =quiet= :: silences the logs in the terminal
+- =splash= :: show the splash screen (in our case, Plymouth)
+- =boot.shell_on_fail= :: sets =allowShell=1=, which permits the =fail()=
+  handler to drop an interactive rescue shell if stage-1 boot fails
+- =udev.log_level=3= :: sets udev’s log level to =err=
+- =rd.systemd.show_status=auto= :: suppress systemd status messages in
+  initrd unless boot is significantly delayed
+
+#+name: kernel-params
+#+begin_src emacs-lisp :var params=kernel-parameters-list :cache yes
+(mapconcat (lambda (param)
+             (format "\"%s\""
+                     (s-chop-suffix "=" (s-chop-prefix "=" (car (s-split " ::" param))))))
+           params
+           "\n")
+#+end_src
+
+#+RESULTS[7a824c095f2934792b4a3749e56091a8603aaacf]: kernel-params
+: "quiet"
+: "splash"
+: "boot.shell_on_fail"
+: "udev.log_level=3"
+: "rd.systemd.show_status=auto"
+
+This translates into:
+#+name: kernel-parameters
+#+begin_src nix :noweb yes
+kernelParams = [
+  <<kernel-params()>>
+];
+#+end_src
+
+To further decrease the verbosity of the booting screen, we can
+deactivate initrd’s verbosity and lower the console’s log level to
+=err=.
+#+name: quiet-console
+#+begin_src nix
+consoleLogLevel = 3;
+initrd.verbose = false;
+#+end_src
+
+And we’ll show Plymouth immediately, skipping the bootloader’s menu.
+We can hold a key to force displaying the menu, though.
+#+name: no-menu
+#+begin_src nix
+loader.timeout = 0;
+#+end_src
+
+
+** Configuring Plymouth
+Now, we can configure Plymouth proper.
+#+name: plymouth
+#+begin_src nix
+plymouth = {
+  enable = true;
+  <<plymouth-theme>>
+};
+#+end_src
+
+The only significant configuration I want to change in Plymouth is the
+animation. I really like how it looks. You can find a preview of it in
+[[https://github.com/adi1090x/plymouth-themes#previews][adi1090x's repository]], under the first pack. For this, I need to set
+a theme package and the theme name.
+#+name: plymouth-theme
+#+begin_src nix
+theme = "circle_hud";
+themePackages = with pkgs; [
+  (adi1090x-plymouth-themes.override {
+    selected_themes = ["circle_hud"];
+  })
+];
+#+end_src
+
+And we’re done!

modules/boot/zfs.nix

@@ -0,0 +1,21 @@
+{
+  flake.modules.nixos.zfs = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+      options.mySystem.boot.zfs = {
+        pools = mkOption {
+          type = types.listOf types.str;
+          default = [];
+        };
+        forceImportRoot = mkEnableOption "Force-import the ZFS root pool at boot, even if it looks already imported elsewhere";
+      };
+      config.boot.supportedFilesystems = ["zfs"];
+      config.boot.zfs.extraPools = cfg.zfs.pools;
+      config.boot.zfs.forceImportRoot = cfg.zfs.forceImportRoot;
+    };
+}

modules/boot/zfs.org

@@ -0,0 +1,62 @@
+#+title: ZFS Support
+#+setupfile: ../headers
+
+* ZFS Support
+Enabling ZFS is quite straightforward on my machines. In my module
+=nixos.zfs=, I expose two options: which ZFS pools to import, and
+whether to force-import the root pool. But first, here’s the skeleton
+of my module.
+
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.zfs = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+      <<options>>
+      <<enable>>
+      <<pools>>
+      <<force-import-root>>
+    };
+}
+#+end_src
+
+The main option is the list of pools, which I pass directly to the
+standard NixOS configuration.
+#+name: options
+#+begin_src nix
+options.mySystem.boot.zfs = {
+  pools = mkOption {
+    type = types.listOf types.str;
+    default = [];
+  };
+  forceImportRoot = mkEnableOption "Force-import the ZFS root pool at boot, even if it looks already imported elsewhere";
+};
+#+end_src
+
+Now, I can enable ZFS on the system importing the current module.
+#+name: enable
+#+begin_src nix
+config.boot.supportedFilesystems = ["zfs"];
+#+end_src
+
+And lastly, passing the list of pools to the standard NixOS option is
+quite simple.
+#+name: pools
+#+begin_src nix
+config.boot.zfs.extraPools = cfg.zfs.pools;
+#+end_src
+
+Force-importing the root pool can paper over a stale or mismatched
+host ID, but it also risks mounting a pool that’s already imported
+elsewhere and corrupting it, so NixOS is moving to disable it by
+default. I’d rather keep that safety and only turn it back on for the
+rare host (or the rare boot) that actually needs it.
+#+name: force-import-root
+#+begin_src nix
+config.boot.zfs.forceImportRoot = cfg.zfs.forceImportRoot;
+#+end_src

modules/default.nix

@@ -0,0 +1,104 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}: {
+  imports = [
+    inputs.flake-parts.flakeModules.modules
+    inputs.flake-file.flakeModules.default
+  ];
+
+  options.flake.homeConfigurations = lib.mkOption {
+    type = lib.types.lazyAttrsOf lib.types.raw;
+    default = {};
+  };
+
+  config = {
+    flake-file.inputs = {
+      flake-utils.url = "github:numtide/flake-utils";
+      nixpkgsPinetab2Kernel.url = "github:nixos/nixpkgs/e73de5be04e0eff4190a1432b946d469c794e7b4";
+      rockchip = {
+        url = "github:raboof/nixos-rockchip/pinetab-linux-7.0";
+        inputs.utils.follows = "flake-utils";
+        inputs.nixpkgsStable.follows = "nixpkgsStable";
+        inputs.nixpkgsUnstable.follows = "nixpkgsPinetab2Kernel";
+      };
+    };
+    systems = ["x86_64-linux" "aarch64-linux"];
+
+    flake.lib = {
+      mkNixos = system: name: {
+        ${name} = inputs.nixpkgs.lib.nixosSystem {
+          modules = [
+            config.flake.modules.nixos.${name}
+            {nixpkgs.hostPlatform = lib.mkDefault system;}
+          ];
+        };
+      };
+      mkHome = system: userName: hostName: {
+        "${userName}@${hostName}" = inputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = inputs.nixpkgs.legacyPackages.${system};
+          extraSpecialArgs = {
+            inherit inputs;
+            bunBaseline = config.flake.packages.${system}.bun-baseline;
+          };
+          modules = [config.flake.modules.homeManager."${userName}-${hostName}"];
+        };
+      };
+      mkPinetab = buildPlatform: variantModule: {
+        pinetab2 = inputs.nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          modules = [
+            inputs.rockchip.nixosModules.sdImageRockchip
+            inputs.rockchip.nixosModules.dtOverlayPCIeFix
+            inputs.rockchip.nixosModules.noZFS
+            config.flake.modules.nixos.pinetab2-base
+            variantModule
+            {
+              rockchip.uBoot = inputs.rockchip.packages.${buildPlatform}.uBootPineTab2;
+              boot.kernelPackages =
+                inputs.rockchip.legacyPackages.${buildPlatform}.kernel_linux_7_0_pinetab_unstable;
+              hardware.firmware = [inputs.rockchip.packages.aarch64-linux.bes2600];
+              nixpkgs.config.allowUnfreePredicate = pkg:
+                builtins.elem (inputs.nixpkgs.lib.getName pkg) ["bes2600-firmware"];
+            }
+          ];
+        };
+      };
+    };
+
+    flake.nixosConfigurations = lib.mkMerge [
+      (config.flake.lib.mkNixos "x86_64-linux" "marpa")
+      (config.flake.lib.mkNixos "x86_64-linux" "gampo")
+      (config.flake.lib.mkNixos "x86_64-linux" "tilo")
+      (config.flake.lib.mkNixos "x86_64-linux" "elcafe")
+      (config.flake.lib.mkNixos "x86_64-linux" "NaroMk3")
+      (config.flake.lib.mkPinetab "x86_64-linux" config.flake.modules.nixos.pinetab2-gnome)
+    ];
+    flake.homeConfigurations = lib.mkMerge [
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "marpa")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "gampo")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "tilo")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "elcafe")
+      (config.flake.lib.mkHome "x86_64-linux" "creug" "elcafe")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "NaroMk3")
+      (config.flake.lib.mkHome "aarch64-linux" "phundrak" "pinetab2")
+    ];
+    perSystem = {
+      pkgs,
+      system,
+      ...
+    }: {
+      formatter = pkgs.alejandra;
+      devShells.default = pkgs.mkShell {
+        buildInputs = [
+          pkgs.nh
+          pkgs.jujutsu
+          pkgs.git
+          inputs.jj-cz.packages.${system}.default
+        ];
+      };
+    };
+  };
+}

modules/desktop/hyprland-homeManager.nix

@@ -0,0 +1,185 @@
+{
+  flake.modules.homeManager.hyprland = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.hyprland;
+      laptops = ["gampo"];
+      caelestiaEnabled = config.home.desktop.caelestia.enable;
+    in {
+      options.home.desktop.hyprland = {
+        enable = mkEnableOption "Enables Hyprland";
+        emacsPkg = mkOption {
+          type = types.package;
+          default = config.home.dev.editors.emacs.package or pkgs.emacs;
+          example = pkgs.emacs;
+        };
+        host = mkOption {
+          type = types.enum ["gampo" "marpa"];
+          description = ''
+            Which host is Hyprland running on.
+
+            This helps determine the monitors layout and enable battery support in waybar.
+          '';
+        };
+      };
+
+      config = mkIf cfg.enable {
+        home.desktop = {
+          hyprpaper.enable = mkDefault (! caelestiaEnabled);
+          rofi.enable = mkDefault true;
+          swaync.enable = mkDefault (! caelestiaEnabled);
+          waybar = {
+            enable = mkDefault (! caelestiaEnabled);
+            battery = mkDefault (builtins.elem cfg.host laptops);
+          };
+          wlsunset.enable = mkDefault true;
+        };
+        services.blueman-applet.enable = ! caelestiaEnabled;
+        wayland.windowManager.hyprland = {
+          enable = true;
+          systemd.enable = false;
+          importantPrefixes = ["$left" "$right" "$up" "$down" "$menu"];
+          settings = {
+            env = [
+              "XMODIFIERS,@im=fcitx"
+              "XCURSOR_SIZE,12"
+            ];
+            input = {
+              kb_layout = "fr,us";
+              kb_variant = "bepo_afnor,";
+              numlock_by_default = true;
+              follow_mouse = 1;
+              touchpad.natural_scroll = false;
+              sensitivity = "0";
+            };
+            device = {
+              name = "wacom-usb-bamboo-pad-finger";
+              sensitivity = 0.5;
+            };
+            monitor =
+              {
+                "marpa" = [
+                  "DP-1, 3440x1440@144, 1080x550, 1"
+                  # "DP-1, 2560x1440@144, 1080x550, 1" # streaming
+                  "DP-2, 2560x1080@60, 0x0, 1, transform, 1"
+                ];
+                "gampo" = [];
+              }."${cfg.host}";
+            general = {
+              gaps_in = 5;
+              gaps_out = 20;
+              border_size = 2;
+              "col.active_border" = "rgb(81a1c1) rgb(a3be8c) 45deg";
+              "col.inactive_border" = "rgb(4c566a)";
+              layout = "master";
+            };
+            master = {
+              orientation = "center";
+              new_status = "inherit";
+            };
+            workspace = [
+              "1, layoutopt:orientation:bottom"
+              "9, layoutopt:orientation:bottom"
+              "10, layoutopt:orientation:bottom"
+            ];
+            decoration = {
+              rounding = 20;
+            };
+            animations = {
+              enabled = true;
+              animation = [
+                # "windows, 1, 7, myBezier"
+                "windowsOut, 1, 7, default, popin 80%"
+                "border, 1, 10, default"
+                "borderangle, 1, 8, default"
+                "fade, 1, 7, default"
+                "workspaces, 1, 6, default"
+              ];
+            };
+            dwindle.preserve_split = true;
+            exec-once =
+              [
+                "pactl load-module module-switch-on-connect"
+                "${pkgs.mpc}/bin/mpc stop"
+                "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"
+                "${pkgs.mozc}/lib/mozc/mozc_server"
+                "${pkgs.fcitx5}/bin/fcitx5 -d"
+              ]
+              ++ lib.lists.optional (! caelestiaEnabled) "${pkgs.networkmanagerapplet}/bin/nm-applet";
+          };
+          extraConfig = ''
+            device {
+              name = wacom-usb-bamboo-pad-finger
+              sensitivity = 0.5
+              accel_profile = adaptive
+            }
+
+            $left = c
+            $right = r
+            $up = s
+            $down = t
+            $menu = rofi -combi-modi drun,calc -show combi
+
+            bind = SUPER, Return, exec, ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux
+            bind = SUPER, Space,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key
+            bind =      , Print,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key -k s
+
+            bindl = , XF86AudioPlay, exec, playerctl play-pause
+            bindl = , XF86AudioPause, exec, playerctl pause
+            bindl = , XF86AudioStop, exec, playerctl stop
+            bindl = , XF86AudioPrev, exec, playerctl previous
+            bindl = , XF86AudioNext, exec, playerctl next
+            bindl = , XF86AudioForward, exec, playerctl position +1
+            bindl = , XF86AudioRewind, exec, playerctl position -1
+            bindl = , XF86AudioRaiseVolume, exec, pamixer -i 2
+            bindl = , XF86AudioLowerVolume, exec, pamixer -d 2
+            bindl = , XF86MonBrightnessUp, exec, xbacklight -perceived -inc 2
+            bindl = , XF86MonBrightnessDown, exec, xbacklight -perceived -dec 2
+            bindl = , XF86KbdBrightnessUp, exec, xbacklight -perceived -inc 2
+            bindl = , XF86KbdBrightnessDown, exec, xbacklight -perceived -dec 2
+            bind = SUPER, a, exec, hyprctl switchxkblayout glove80-keyboard next
+            bind = SUPER, $left, movefocus, l
+            bind = SUPER, $right, movefocus, r
+            bind = SUPER, $up, movefocus, u
+            bind = SUPER, $down, movefocus, d
+            bind = SUPER_SHIFT, $left, movewindow, l
+            bind = SUPER_SHIFT, $right, movewindow, r
+            bind = SUPER_SHIFT, $up, movewindow, u
+            bind = SUPER_SHIFT, $down, movewindow, d
+            bind = SUPER_CTRL_SHIFT, $left, moveworkspacetomonitor, e+0 +1
+            bind = SUPER_CTRL_SHIFT, $right, moveworkspacetomonitor, e+0 -1
+            bind = SUPER, Tab, cyclenext,
+            bind = SUPER_SHIFT, Tab, cyclenext, prev
+            bindm = SUPER, mouse:272, movewindow
+            bindm = SUPER, mouse:273, resizewindow
+            bind = SUPER, quotedbl, workspace, 1
+            bind = SUPER, guillemotleft, workspace, 2
+            bind = SUPER, guillemotright, workspace, 3
+            bind = SUPER, parenleft, workspace, 4
+            bind = SUPER, parenright, workspace, 5
+            bind = SUPER, at, workspace, 6
+            bind = SUPER, plus, workspace, 7
+            bind = SUPER, minus, workspace, 8
+            bind = SUPER, slash, workspace, 9
+            bind = SUPER, asterisk, workspace, 10
+            bind = SUPER, mouse_down, workspace, e+1
+            bind = SUPER, mouse_up, workspace, e-1
+            bind = SUPER_SHIFT, quotedbl, movetoworkspace, 1
+            bind = SUPER_SHIFT, guillemotleft, movetoworkspace, 2
+            bind = SUPER_SHIFT, guillemotright, movetoworkspace, 3
+            bind = SUPER_SHIFT, parenleft, movetoworkspace, 4
+            bind = SUPER_SHIFT, parenright, movetoworkspace, 5
+            bind = SUPER_SHIFT, at, movetoworkspace, 6
+            bind = SUPER_SHIFT, plus, movetoworkspace, 7
+            bind = SUPER_SHIFT, minus, movetoworkspace, 8
+            bind = SUPER_SHIFT, slash, movetoworkspace, 9
+            bind = SUPER_SHIFT, asterisk, movetoworkspace, 10
+          '';
+        };
+      };
+    };
+}

modules/desktop/hyprland-nixos.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.nixos.hyprland = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.hyprland;
+    in {
+      options.mySystem.desktop.hyprland.enable = mkEnableOption "Enables Hyprland";
+      config.programs.hyprland = mkIf cfg.enable {
+        inherit (cfg) enable;
+        withUWSM = true;
+      };
+    };
+}

modules/desktop/niri.nix

@@ -0,0 +1,15 @@
+{
+  flake.modules.nixos.niri = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.niri;
+    in {
+      options.mySystem.desktop.niri.enable = mkEnableOption "Enables Niri";
+      config.programs.niri = mkIf cfg.enable {
+        inherit (cfg) enable;
+      };
+    };
+}

modules/desktop/waydroid.nix

@@ -0,0 +1,20 @@
+{
+  flake.modules.nixos.waydroid = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.waydroid;
+    in {
+      options.mySystem.desktop.waydroid.enable = mkEnableOption "Enables Waydroid";
+      config = mkIf cfg.enable {
+        virtualisation.waydroid = {
+          enable = cfg.enable;
+          package = pkgs.waydroid-nftables;
+        };
+        environment.systemPackages = [pkgs.waydroid-helper];
+      };
+    };
+}

modules/desktop/xserver.nix

@@ -0,0 +1,53 @@
+{
+  flake.modules.nixos.xserver = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.xserver;
+    in {
+      options.mySystem.desktop.xserver = {
+        enable = mkEnableOption "Enables xserver";
+        de = mkOption {
+          type = types.enum ["gnome" "kde"];
+          default = "gnome";
+          example = "kde";
+          description = "Which DE to enable";
+        };
+        videoDrivers = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          example = ["amdgpu"];
+          description = "Extra X11 video drivers to load";
+        };
+      };
+      config.services = mkIf cfg.enable {
+        displayManager = {
+          sddm.enable = mkIf (cfg.de == "kde") true;
+          gdm.enable = mkIf (cfg.de == "gnome") true;
+        };
+        desktopManager = {
+          plasma6.enable = mkIf (cfg.de == "kde") true;
+          gnome.enable = mkIf (cfg.de == "gnome") true;
+        };
+
+        gnome = mkIf (cfg.de == "gnome") {
+          gnome-browser-connector.enable = true;
+          games.enable = false;
+          gnome-remote-desktop.enable = true;
+          gnome-online-accounts.enable = true;
+          sushi.enable = true;
+        };
+
+        xserver = {
+          inherit (cfg) enable;
+          videoDrivers = cfg.videoDrivers;
+          xkb = {
+            layout = "fr";
+            variant = "bepo_afnor";
+          };
+        };
+      };
+    };
+}

modules/dev/qemu.nix

@@ -0,0 +1,32 @@
+{
+  flake.modules.nixos.qemu = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.dev.qemu;
+    in {
+      options.mySystem.dev.qemu.users = mkOption {
+        type = types.listOf types.str;
+        default = ["phundrak"];
+        example = ["user1" "user2"];
+      };
+      config = {
+        programs.virt-manager.enable = true;
+        users.groups.libvirtd.members = cfg.users;
+        virtualisation = {
+          libvirtd.enable = true;
+          spiceUSBRedirection.enable = true;
+        };
+        environment.systemPackages = with pkgs; [
+          qemu
+          quickemu
+          swtpm
+        ];
+        systemd.tmpfiles.rules = ["L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware"];
+        boot.binfmt.emulatedSystems = ["aarch64-linux"];
+      };
+    };
+}

modules/dev/qemu.org

@@ -0,0 +1,99 @@
+#+title: QEMU
+#+setupfile: ../headers
+
+* QEMU
+On machines where I run virtual machines, I want =virt-manager=,
+=libvirtd=, and a few supporting pieces set up together. Here’s the
+skeleton of the =nixos.qemu= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.qemu = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.dev.qemu;
+    in {
+      <<options>>
+      config = {
+        <<virt-manager>>
+        <<libvirtd-group>>
+        <<virtualisation>>
+        <<packages>>
+        <<firmware-tmpfiles>>
+        <<binfmt>>
+      };
+    };
+}
+#+end_src
+
+** Declaring the Options
+=users= lists which users get added to the =libvirtd= group, so they can
+manage VMs without needing root. By default, I add myself to this
+group.
+#+name: options
+#+begin_src nix
+options.mySystem.dev.qemu.users = mkOption {
+  type = types.listOf types.str;
+  default = ["phundrak"];
+  example = ["user1" "user2"];
+};
+#+end_src
+
+This option is then passed onto the standard NixOS option.
+#+name: libvirtd-group
+#+begin_src nix
+users.groups.libvirtd.members = cfg.users;
+#+end_src
+
+** virt-manager
+This pulls in the GUI I actually use to create and manage VMs.
+#+name: virt-manager
+#+begin_src nix
+programs.virt-manager.enable = true;
+#+end_src
+
+** Virtualisation Backend
+=libvirtd= is the daemon that actually runs and manages the VMs. SPICE
+USB redirection lets me pass a USB device straight through to a guest
+without unplugging it from the host first.
+#+name: virtualisation
+#+begin_src nix
+virtualisation = {
+  libvirtd.enable = true;
+  spiceUSBRedirection.enable = true;
+};
+#+end_src
+
+** Extra Packages
+Besides =qemu= itself, =quickemu= lets me spin up a VM from a template in
+one command, and =swtpm= provides the software TPM that guests like
+Windows 11 insist on.
+#+name: packages
+#+begin_src nix
+environment.systemPackages = with pkgs; [
+  qemu
+  quickemu
+  swtpm
+];
+#+end_src
+
+** Firmware Lookup Path
+=virt-manager= and friends expect to find UEFI firmware images under
+=/var/lib/qemu/firmware=, so I symlink QEMU’s own copy there instead of
+making every tool aware of the Nix store path.
+#+name: firmware-tmpfiles
+#+begin_src nix
+systemd.tmpfiles.rules = ["L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware"];
+#+end_src
+
+** ARM Emulation
+This lets me run (and build) =aarch64-linux= binaries transparently
+through QEMU’s user-mode emulation, which comes in handy when working
+on the PineTab2 without needing actual ARM hardware on hand.
+#+name: binfmt
+#+begin_src nix
+boot.binfmt.emulatedSystems = ["aarch64-linux"];
+#+end_src

modules/hardware/amdgpu.nix

@@ -0,0 +1,50 @@
+{
+  flake.modules.nixos.amdgpu = {pkgs, ...}: {
+    hardware.graphics = {
+      enable = true;
+      enable32Bit = true;
+    };
+    hardware.amdgpu = {
+      initrd.enable = true;
+      opencl.enable = true;
+    };
+    hardware.graphics.extraPackages = with pkgs; [
+      mesa
+      rocmPackages.clr
+      rocmPackages.clr.icd
+      rocmPackages.rocblas
+      rocmPackages.hipblas
+      rocmPackages.rpp
+      nvtopPackages.amd
+    ];
+    environment.systemPackages = with pkgs; [
+      clinfo
+      amdgpu_top
+      nvtopPackages.amd
+    ];
+    systemd = {
+      packages = with pkgs; [lact];
+      services.lactd.wantedBy = ["multi-user.target"];
+      tmpfiles.rules = let
+        rocmEnv = pkgs.symlinkJoin {
+          name = "rocm-combined";
+          paths = with pkgs.rocmPackages; [
+            clr
+            clr.icd
+            rocblas
+            hipblas
+            rpp
+          ];
+        };
+      in [
+        "L+    /opt/rocm   -    -    -     -    ${rocmEnv}"
+      ];
+    };
+    environment.variables = {
+      ROCM_PATH = "/opt/rocm";
+      HIP_VISIBLE_DEVICES = "1";
+      ROCM_VISIBLE_DEVICES = "1";
+      HSA_OVERRIDE_GFX_VERSION = "10.3.0";
+    };
+  };
+}

modules/hardware/amdgpu.org

@@ -0,0 +1,147 @@
+#+title: AMD GPU support
+#+setupfile: ../headers
+#+property: header-args:emacs-lisp  :lexical t :exports none :tangle no
+
+* AMD GPU support
+Only one of my machines has an AMD GPU, but it does require some
+tweaking. First, here’s the skeleton of the =nixos.amdgpu= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.amdgpu = {pkgs, ...}: {
+    <<enable-graphics>>
+    <<enable-hardware>>
+    <<hardware-extra-packages>>
+    <<system-packages>>
+    <<lact>>
+    <<environment-variables>>
+  };
+}
+#+end_src
+
+** Enable the Hardware
+The first thing is to enable graphics in NixOS. We’ll enable 32-bit
+support while we’re at it.
+#+name: enable-graphics
+#+begin_src nix
+hardware.graphics = {
+  enable = true;
+  enable32Bit = true;
+};
+#+end_src
+
+We can now enable the hardware proper, including initrd and OpenCL
+support for the GPU. =initrd.enable= already makes NixOS load =amdgpu= as
+early as stage 1 on its own, which is why the kernel module (see
+[[file:../boot/kernel.org][Kernel Configuration]]) doesn’t need to pick between =amdgpu= and =i915=
+itself: it can simply default to =i915= and let this module handle its
+own early loading.
+#+name: enable-hardware
+#+begin_src nix
+hardware.amdgpu = {
+  initrd.enable = true;
+  opencl.enable = true;
+};
+#+end_src
+
+Some software expect some packages to be installed by default, such as
+rocblas or Hipblas. Here are these packages.
+#+name: amd-packages
+| Package Name         | Description                                                        |
+|----------------------+--------------------------------------------------------------------|
+| =mesa=                 | Mesa drivers for AMD GPUs                                          |
+| =rocmPackages.clr=     | Common Language Runtime for ROCm                                   |
+| =rocmPackages.clr.icd= | ROCm ICD for OpenCL                                                |
+| =rocmPackages.rocblas= | ROCm BLAS library                                                  |
+| =rocmPackages.hipblas= | HIP BLAS marshalling library (CUDA-compatible interface to rocBLAS) |
+| =rocmPackages.rpp=     | High-performance computer vision library                           |
+| =nvtopPackages.amd=    | Just for me, GPU utilisation monitoring                            |
+
+#+name: extra-hardware-packages
+#+begin_src emacs-lisp :var packages=amd-packages :cache yes
+(mapconcat (lambda (package) (s-chop-prefix "=" (s-chop-suffix "=" package)))
+           (mapcar #'car packages)
+           "\n")
+#+end_src
+
+#+RESULTS[28ba71596b4f184338e46c76c0ba1aa41899bba0]: extra-hardware-packages
+: mesa
+: rocmPackages.clr
+: rocmPackages.clr.icd
+: rocmPackages.rocblas
+: rocmPackages.hipblas
+: rocmPackages.rpp
+: nvtopPackages.amd
+
+#+name: hardware-extra-packages
+#+begin_src nix
+hardware.graphics.extraPackages = with pkgs; [
+  <<extra-hardware-packages()>>
+];
+#+end_src
+
+** Diagnostics and Monitoring
+Beyond what’s needed by the driver stack itself, I also want a couple
+of tools available on the command line to check on the GPU: =clinfo= to
+inspect the available OpenCL platforms and devices, =amdgpu_top= for a
+=btop=-like view of the AMD GPU’s activity, and =nvtop= (packaged for AMD
+under =nvtopPackages.amd=) for a more familiar process-oriented monitor.
+#+name: system-packages
+#+begin_src nix
+environment.systemPackages = with pkgs; [
+  clinfo
+  amdgpu_top
+  nvtopPackages.amd
+];
+#+end_src
+
+** LACT, the GPU Control Daemon
+[[https://github.com/ilya-zlobintsev/LACT][LACT]] (Linux AMDGPU Control Application) lets me tweak fan curves,
+power limits and clocks on the card, through a daemon (=lactd=) and a
+GUI that talks to it. The package ships both a systemd service
+definition and a udev rule, so all that’s left for me to do is install
+the package and make sure the daemon is started.
+
+I’m also consolidating the ROCm libraries under =/opt/rocm= via a
+=tmpfiles= rule. Some tools out there still expect to find ROCm
+installed at that standard filesystem location rather than resolved
+through the Nix store, so I build a combined derivation of the ROCm
+packages I need and symlink it into place.
+#+name: lact
+#+begin_src nix
+systemd = {
+  packages = with pkgs; [lact];
+  services.lactd.wantedBy = ["multi-user.target"];
+  tmpfiles.rules = let
+    rocmEnv = pkgs.symlinkJoin {
+      name = "rocm-combined";
+      paths = with pkgs.rocmPackages; [
+        clr
+        clr.icd
+        rocblas
+        hipblas
+        rpp
+      ];
+    };
+  in [
+    "L+    /opt/rocm   -    -    -     -    ${rocmEnv}"
+  ];
+};
+#+end_src
+
+** Environment Variables
+Finally, a handful of environment variables to point tools at that
+=/opt/rocm= prefix and to steer ROCm/HIP towards the right GPU. This
+machine exposes the AMD card as device ID =1= (the other device being an
+iGPU), so I pin both =HIP_VISIBLE_DEVICES= and =ROCM_VISIBLE_DEVICES= to
+it. The card also isn’t officially supported by ROCm, hence the
+=HSA_OVERRIDE_GFX_VERSION= override, which tells ROCm to treat it as the
+closest supported architecture instead of refusing to run.
+#+name: environment-variables
+#+begin_src nix
+environment.variables = {
+  ROCM_PATH = "/opt/rocm";
+  HIP_VISIBLE_DEVICES = "1";
+  ROCM_VISIBLE_DEVICES = "1";
+  HSA_OVERRIDE_GFX_VERSION = "10.3.0";
+};
+#+end_src

modules/hardware/bluetooth.nix

@@ -0,0 +1,6 @@
+{
+  flake.modules.nixos.bluetooth = {
+    hardware.bluetooth.enable = true;
+    services.blueman.enable = true;
+  };
+}

modules/hardware/bluetooth.org

@@ -0,0 +1,24 @@
+#+title: Bluetooth
+#+setupfile: ../headers
+
+* Bluetooth
+Not all of my machines have Bluetooth hardware worth turning on, so
+this is a plain toggle rather than something applied unconditionally.
+Here’s the skeleton of the =nixos.bluetooth= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.bluetooth = {
+    <<config>>
+  };
+}
+#+end_src
+
+** Enabling Bluetooth
+Turning the option on enables Bluetooth support at the kernel level
+and installs =blueman=, a tray applet I use to pair and manage devices
+without digging through a terminal.
+#+name: config
+#+begin_src nix
+hardware.bluetooth.enable = true;
+services.blueman.enable = true;
+#+end_src

modules/hardware/fingerprint.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.fingerprint = {
+    hardware.facter.detected.fingerprint.enable = true;
+  };
+}

modules/hardware/fingerprint.org

@@ -0,0 +1,22 @@
+#+title: Fingerprint Reader
+#+setupfile: ../headers
+
+* Fingerprint Reader
+My ThinkPad x220 has a fingerprint reader, so this is a plain toggle
+rather than something applied unconditionally. Here’s the skeleton of
+the =nixos.fingerprint= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.fingerprint = {
+    <<config>>
+  };
+}
+#+end_src
+
+** Enabling the Reader
+Rather than picking a driver myself, I let [[https://github.com/numtide/nixos-facter-modules][nixos-facter]] detect the
+reader and wire up the matching driver automatically.
+#+name: config
+#+begin_src nix
+hardware.facter.detected.fingerprint.enable = true;
+#+end_src

modules/hardware/firmware.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.firmware = {lib, ...}: {
+    hardware.enableAllFirmware = lib.mkDefault true;
+  };
+}

modules/hardware/firmware.org

@@ -0,0 +1,21 @@
+#+title: Firmware
+#+setupfile: ../headers
+
+* Firmware
+A small module to pull in the full firmware blob set, for machines
+where I’d rather not chase down which specific firmware package a
+piece of hardware needs. Here’s the =nixos.firmware= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.firmware = {lib, ...}: {
+    <<enable-all-firmware>>
+  };
+}
+#+end_src
+
+=mkDefault= keeps this overridable, in case a host needs to turn it back
+off or pin a narrower set of firmware packages itself.
+#+name: enable-all-firmware
+#+begin_src nix
+hardware.enableAllFirmware = lib.mkDefault true;
+#+end_src

modules/hardware/input/corne.nix

@@ -0,0 +1,9 @@
+{
+  flake.modules.nixos.corne = {
+    services.udev = {
+      extraRules = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
+      '';
+    };
+  };
+}

modules/hardware/input/corne.org

@@ -0,0 +1,32 @@
+#+title: Corne Keyboard
+#+setupfile: ../../headers
+
+* Corne Keyboard
+I use a Corne (=crkbd=), a small split ergonomic keyboard, flashed with
+[[https://get.vial.today/][Vial]], a QMK-based firmware that lets me remap keys live from a GUI
+instead of having to reflash the keyboard every time I want to tweak
+my layout. Here’s the skeleton of the =nixos.corne= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.corne = {
+    <<udev-rule>>
+  };
+}
+#+end_src
+
+** Granting HID Access
+By default, the =hidraw= device nodes created for the keyboard are only
+accessible to root, which means Vial can’t talk to it without running
+as root too. Instead, I add a =udev= rule matching my keyboard’s Vial
+identifier (the part after =vial:= is the keyboard’s unique unlock ID,
+burned into its firmware) and grant the =users= group read/write access
+to it, tagging it for =uaccess= / =udev-acl= so it’s also picked up by the
+logged-in session’s ACLs.
+#+name: udev-rule
+#+begin_src nix
+services.udev = {
+  extraRules = ''
+    KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
+  '';
+};
+#+end_src

modules/hardware/input/disable-ibm-trackpoint.nix

@@ -0,0 +1,7 @@
+{
+  flake.modules.nixos.disable-ibm-trackpoint = {
+    services.udev.extraRules = ''
+      ATTRS{name}=="*TPPS/2 IBM TrackPoint", ENV{ID_INPUT}="", ENV{ID_INPUT_MOUSE}="", ENV{ID_INPUT_POINTINGSTICK}=""
+    '';
+  };
+}

modules/hardware/input/disable-ibm-trackpoint.org

@@ -0,0 +1,30 @@
+#+title: Disable the IBM TrackPoint
+#+setupfile: ../../headers
+
+* Disable the IBM TrackPoint
+My ThinkPads come with IBM’s TrackPoint, the little red nub sitting
+between the =G=, =H= and =B= keys. I don’t want it active, though, it has a
+drift and I cannot fix it unless I change my keyboard. Thus, this
+module exposes a way to turn it off. Here’s the skeleton of the
+=nixos.disable-ibm-trackpoint= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.disable-ibm-trackpoint = {
+    <<udev-rule>>
+  };
+}
+#+end_src
+
+** Disabling the TrackPoint
+The TrackPoint shows up to the input stack as a regular pointer
+device, so to disable it I can’t simply blacklist a driver — libinput
+and friends would still pick it up through =evdev=. Instead, I match it
+by its device name and clear the =ID_INPUT=, =ID_INPUT_MOUSE= and
+=ID_INPUT_POINTINGSTICK= udev properties on it, which tells the input
+stack to simply ignore the device as a pointing device.
+#+name: udev-rule
+#+begin_src nix
+services.udev.extraRules = ''
+  ATTRS{name}=="*TPPS/2 IBM TrackPoint", ENV{ID_INPUT}="", ENV{ID_INPUT_MOUSE}="", ENV{ID_INPUT_POINTINGSTICK}=""
+'';
+#+end_src

modules/hardware/input/opentablet.nix

@@ -0,0 +1,9 @@
+{
+  flake.modules.nixos.opentablet = {
+    hardware.opentabletdriver = {
+      enable = true;
+      daemon.enable = true;
+    };
+    boot.kernelModules = ["wacom"];
+  };
+}

modules/hardware/input/opentablet.org

@@ -0,0 +1,30 @@
+#+title: OpenTabletDriver
+#+setupfile: ../../headers
+
+* OpenTabletDriver
+Some of my machines are hooked up to a graphics tablet, a Wacom
+Bamboo, driven by [[https://opentabletdriver.net/][OpenTabletDriver]]. I remember buying it for 15€, what
+a deal that was! Anyway, since most of my hosts don’t have a tablet
+attached, this is exposed as a regular toggle rather than enabled
+unconditionally. Here’s the skeleton of the =nixos.opentablet= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.opentablet = {
+    <<config>>
+  };
+}
+#+end_src
+
+** Enabling the Driver
+Enabling OpenTabletDriver proper is just a matter of turning on the
+module and its daemon. I also need to explicitly load the =wacom=
+kernel module, since my tablet (like most of them) identifies itself
+as a Wacom device at the hardware level regardless of brand.
+#+name: config
+#+begin_src nix
+hardware.opentabletdriver = {
+  enable = true;
+  daemon.enable = true;
+};
+boot.kernelModules = ["wacom"];
+#+end_src

modules/hardware/input/trackball.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.trackball = {
+    services.libinput.mouse.middleEmulation = true;
+  };
+}

modules/hardware/input/trackball.org

@@ -0,0 +1,22 @@
+#+title: Trackball
+#+setupfile: ../../headers
+
+* Trackball
+I use a trackball on some of my machines, and I middle-click by
+pressing the left and right buttons together rather than through a
+dedicated button. That’s the only downside of the two trackballs I
+own; otherwise, I can’t recommend one enough. Here’s the
+=nixos.trackball= module enabling this behaviour.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.trackball = {
+    <<middle-emulation>>
+  };
+}
+#+end_src
+
+Enabling middle-click emulation is simple:
+#+name: middle-emulation
+#+begin_src nix
+services.libinput.mouse.middleEmulation = true;
+#+end_src

modules/hardware/pinetab2.nix

@@ -0,0 +1,10 @@
+{
+  flake.modules.nixos.pinetab2 = {
+    boot.kernelParams = ["console=tty0" "console=ttyS2,1500000n8" "rootwait" "root=LABEL=NIXOS_SD" "rw"];
+    hardware.sensor.iio.enable = true;
+    services.avahi = {
+      enable = true;
+      openFirewall = true;
+    };
+  };
+}

modules/hardware/pinetab2.org

@@ -0,0 +1,48 @@
+#+title: PineTab2
+#+setupfile: ../headers
+
+* PineTab2
+A few tweaks are specific to my PineTab2 tablet: getting a serial
+console working at boot, exposing its sensors, and making it easy to
+find on whatever network it’s connected to. Here’s the skeleton of the
+=nixos.pinetab2= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.pinetab2 = {
+    <<kernel-params>>
+    <<sensors>>
+    <<avahi>>
+  };
+}
+#+end_src
+
+** Serial Console
+These kernel parameters get me a working serial console on the
+tablet’s UART at boot, and point the kernel at the SD card’s root
+filesystem by label rather than by a device path that can shift
+around.
+#+name: kernel-params
+#+begin_src nix
+boot.kernelParams = ["console=tty0" "console=ttyS2,1500000n8" "rootwait" "root=LABEL=NIXOS_SD" "rw"];
+#+end_src
+
+** Sensors
+Turning on the IIO (Industrial I/O) subsystem exposes the tablet’s
+accelerometer and ambient light sensor, which is what lets things like
+auto-rotate work.
+#+name: sensors
+#+begin_src nix
+hardware.sensor.iio.enable = true;
+#+end_src
+
+** Finding It on the Network
+The tablet moves between networks a lot, so Avahi lets me reach it by
+its =.local= hostname over mDNS instead of having to look up whatever IP
+it was handed.
+#+name: avahi
+#+begin_src nix
+services.avahi = {
+  enable = true;
+  openFirewall = true;
+};
+#+end_src

modules/hardware/sound.nix

@@ -0,0 +1,50 @@
+{
+  flake.modules.nixos.sound = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.sound;
+    in {
+      options.mySystem.hardware.sound = {
+        noisetorch = mkEnableOption "Whether to activate noisetorch support";
+        scarlett.enable = mkEnableOption "Activate support for Scarlett sound card";
+        alsa = mkOption {
+          type = types.bool;
+          example = true;
+          default = true;
+          description = "Whether to enable ALSA support with Pipewire";
+        };
+        jack = mkOption {
+          type = types.bool;
+          example = true;
+          default = false;
+          description = "Whether to enable JACK support with Pipewire";
+        };
+        package = mkOption {
+          type = types.package;
+          example = pkgs.pulseaudio;
+          default = pkgs.pulseaudioFull;
+          description = "Which base package to use for PulseAudio";
+        };
+      };
+
+      config = {
+        environment.systemPackages = mkIf cfg.scarlett.enable [pkgs.alsa-scarlett-gui];
+        services = {
+          pipewire = {
+            enable = true;
+            alsa = mkIf cfg.alsa {
+              enable = mkDefault true;
+              support32Bit = mkDefault true;
+            };
+            jack.enable = mkDefault cfg.jack;
+          };
+          pulseaudio.enable = false;
+        };
+        programs.noisetorch.enable = cfg.noisetorch;
+      };
+    };
+}

modules/hardware/sound.org

@@ -0,0 +1,118 @@
+#+title: Sound
+#+setupfile: ../headers
+
+* Sound
+I use Pipewire for audio on my desktop machines, with a couple of
+compatibility layers and bits of hardware-specific support switched on
+as needed. Here’s the skeleton of the =nixos.sound= module.
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.sound = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.sound;
+    in {
+      options.mySystem.hardware.sound = {
+        <<opt-noisetorch>>
+        <<opt-scarlett>>
+        <<opt-alsa>>
+        <<opt-jack>>
+        <<opt-package>>
+      };
+
+      config = {
+        <<scarlett-package>>
+        <<pipewire-config>>
+        <<noisetorch-config>>
+      };
+    };
+}
+#+end_src
+
+** Noise Suppression
+=noisetorch= toggles [[https://github.com/noisetorch/NoiseTorch][NoiseTorch]], a real-time microphone noise
+suppression tool I use for calls, so I have an option for that.
+#+name: opt-noisetorch
+#+begin_src nix
+noisetorch = mkEnableOption "Whether to activate noisetorch support";
+#+end_src
+
+Passing it to NixOS is quite simple.
+#+name: noisetorch-config
+#+begin_src nix
+programs.noisetorch.enable = cfg.noisetorch;
+#+end_src
+
+** Scarlett Sound Card
+=scarlett.enable= is for the machine =marpa= with a Focusrite Scarlett 2i2
+audio interface plugged in; it only pulls in that card’s control GUI.
+#+name: opt-scarlett
+#+begin_src nix
+scarlett.enable = mkEnableOption "Activate support for Scarlett sound card";
+#+end_src
+
+It is installed quite easily in enabled.
+#+name: scarlett-package
+#+begin_src nix
+environment.systemPackages = mkIf cfg.scarlett.enable [pkgs.alsa-scarlett-gui];
+#+end_src
+
+** Enabling Pipewire
+Enabling Pipewire also means explicitly turning PulseAudio off, since
+the two can’t run as the system’s sound server at the same time.
+#+name: pipewire-config
+#+begin_src nix
+services = {
+  pipewire = {
+    enable = true;
+    alsa = mkIf cfg.alsa {
+      enable = mkDefault true;
+      support32Bit = mkDefault true;
+    };
+    jack.enable = mkDefault cfg.jack;
+  };
+  pulseaudio.enable = false;
+};
+#+end_src
+
+** ALSA Compatibility
+=alsa= enables Pipewire’s ALSA compatibility layer, on by default since
+most of my audio software still expects ALSA.
+#+name: opt-alsa
+#+begin_src nix
+alsa = mkOption {
+  type = types.bool;
+  example = true;
+  default = true;
+  description = "Whether to enable ALSA support with Pipewire";
+};
+#+end_src
+
+** JACK Compatibility
+=jack= enables Pipewire’s JACK compatibility layer, off by default since
+only my production machine needs it.
+#+name: opt-jack
+#+begin_src nix
+jack = mkOption {
+  type = types.bool;
+  example = true;
+  default = false;
+  description = "Whether to enable JACK support with Pipewire";
+};
+#+end_src
+
+** Base Package
+=package= picks which PulseAudio package to build things on top of.
+#+name: opt-package
+#+begin_src nix
+package = mkOption {
+  type = types.package;
+  example = pkgs.pulseaudio;
+  default = pkgs.pulseaudioFull;
+  description = "Which base package to use for PulseAudio";
+};
+#+end_src

modules/headers

@@ -0,0 +1,22 @@
+# -*- mode: org -*-
+#+AUTHOR: Lucien Cartier-Tilet
+#+EMAIL: lucien@phundrak.com
+#+CREATOR: Lucien Cartier-Tilet
+#+LANGUAGE: en
+
+# ### ORG OPTIONS ##############################################################
+
+#+options: H:4 broken_links:mark email:t ^:{} tex:dvisvgm toc:nil
+#+KEYWORDS: dotfiles, linux, emacs, configuration, phundrak, drakpa
+#+startup: content align hideblocks
+#+property: header-args:emacs-lisp :noweb yes :exports none :eval yes :cache yes
+#+property: header-args:nix :exports code :tangle no :noweb no-export
+#+property: header-args:dot :dir img :exports results :eval yes :cache yes :class gentree
+
+# ### MACROS ###################################################################
+#+macro: phon @@html:/$1/@@
+#+macro: newline @@html:<br>@@
+#+macro: latex-html @@latex:$1@@@@html:$2@@
+#+macro: v @@html:<span class=vertical>$1</span>@@
+#+macro: begin-largetable @@html:<div class="largetable">@@
+#+macro: end-largetable @@html:</div>@@

modules/home/base.nix

@@ -0,0 +1,40 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.home-base = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home;
+    in {
+      imports = [
+        m.basics
+        m.cli
+        m.desktop
+        m.dev
+        m.media
+        m.my-services
+        m.security
+        m.shell
+      ];
+
+      options.home = {
+        fullDesktop = mkEnableOption "Enable most modules";
+        gpuType = mkOption {
+          type = types.nullOr (types.enum ["nvidia" "amd" "intel"]);
+          default = null;
+          example = "amd";
+        };
+      };
+      config.home = {
+        cli.fullDesktop = mkDefault cfg.fullDesktop;
+        desktop.fullDesktop = mkDefault cfg.fullDesktop;
+        dev.fullDesktop = mkDefault cfg.fullDesktop;
+        media.fullDesktop = mkDefault cfg.fullDesktop;
+        security.fullDesktop = mkDefault cfg.fullDesktop;
+        myServices.fullDesktop = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/basics.nix

@@ -0,0 +1,12 @@
+{
+  flake.modules.homeManager.basics = {
+    programs = {
+      fd.enable = true;
+      fzf.enable = true;
+      home-manager.enable = true;
+      htop.enable = true;
+      jq.enable = true;
+      ripgrep.enable = true;
+    };
+  };
+}

modules/home/cli/_scripts/launcher.nix

@@ -0,0 +1,23 @@
+{pkgs, ...}:
+pkgs.writeShellScriptBin "app-launcher" ''
+  LOG_FILE="$HOME/.local/share/app-launcher.log"
+
+  logger() {
+      local level="$1"
+      local message="$2"
+      local timestamp
+      timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+      printf "[%s] [%-7s] %s\n" "$timestamp" "''${level^^}" "$message" >> "$LOG_FILE"
+  }
+
+  CAELESTIA_ACTIVE=$(systemctl --user is-active caelestia.service)
+  logger debug "Caelestia activity: $CAELESTIA_ACTIVE"
+
+  if systemctl --user is-active caelestia.service | grep 'active' &> /dev/null ; then
+      logger info "Using Caelestia app launcher"
+       caelestia shell drawers toggle launcher || \
+          logger error "failed to launch Caelestia app launcher"
+      exit 0
+  fi
+  rofi -show drun
+''

modules/home/cli/_scripts/mp42webm.nix

@@ -1,3 +1,3 @@
 {pkgs, ...}:
 pkgs.writeShellScriptBin "mp42webm" ''
-  ${pkgs.ffmpeg}/bin/ffmpeg -i "$1" -c:v libvpx -crf 10 -b:v 1M -c:a libvorbis "$1".webm''
+  ${pkgs.ffmpeg}/bin/ffmpeg -i "$1" -c:v libvpx -crf 10 -b:v 1M -c:a -hwaccel=auto libvorbis "$1".webm''

modules/home/cli/_scripts/plock.nix

@@ -0,0 +1,40 @@
+{pkgs, ...}:
+pkgs.writeShellScriptBin "plock" ''
+  LOG_FILE="$HOME/.local/share/plock.log"
+
+  logger() {
+      local level="$1"
+      local message="$2"
+      local timestamp
+      timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+      printf "[%s] [%-7s] %s\n" "$timestamp" "''${level^^}" "$message" >> "$LOG_FILE"
+  }
+
+  CAELESTIA_ACTIVE=$(systemctl --user is-active caelestia.service)
+  logger debug "Caelestia activity: $CAELESTIA_ACTIVE"
+  if systemctl --user is-active caelestia.service | grep 'active' &> /dev/null ; then
+      logger info "locking Caelestia session"
+      caelestia shell lock lock || \
+          logger error "failed to lock Caelestia session"
+      exit 0
+  fi
+
+  TMPBG="/tmp/screen.png"
+  if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
+      logger info "wayland session detected"
+      SCREENER=${pkgs.grim}/bin/grim
+      LOCKER="${pkgs.swaylock}/bin/swaylock -feF"
+  else
+      logger info "x11 session detected"
+      SCREENER=${pkgs.scrot}/bin/scrot
+      LOCKER="${pkgs.i3lock}/bin/i3lock -ef"
+  fi
+
+  $SCREENER "$TMPBG"
+  logger info "generating lock screen image"
+  ${pkgs.corrupter}/bin/corrupter -add 0 "$TMPBG" "$TMPBG" || logger error "failed to generate lock screen image"
+  logger info "locking screen"
+  logger debug "locking screen with command `''${SCREENER}`"
+  $LOCKER -ti "$TMPBG"
+  rm "$TMPBG"
+''

modules/home/cli/bat.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.homeManager.bat = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.bat;
+    in {
+      options.home.cli.bat.extras = mkEnableOption "Enables extra packages for bat.";
+      config.programs.bat = {
+        enable = true;
+        config = {
+          theme = "Nord";
+          map-syntax = [
+            ".spacemacs*:Lisp"
+          ];
+        };
+        extraPackages = mkIf cfg.extras (with pkgs.bat-extras; [
+          batman
+          batpipe
+        ]);
+      };
+    };
+}

modules/home/cli/btop.nix

@@ -0,0 +1,36 @@
+{
+  flake.modules.homeManager.btop = {
+    pkgs,
+    config,
+    ...
+  }: let
+    inherit (config.home) gpuType;
+  in {
+    programs.btop = {
+      enable = true;
+      package =
+        if gpuType != null
+        then
+          pkgs.btop.override {
+            rocmSupport = gpuType == "amd";
+            cudaSupport = gpuType == "nvidia";
+          }
+        else pkgs.btop;
+      settings = {
+        color_theme = "${pkgs.btop}/share/btop/themes/nord.theme";
+        cpu_bottom = false;
+        cpu_sensor = "auto";
+        io_graph_combined = false;
+        io_mode = true;
+        only_physical = true;
+        proc_tree = true;
+        rounded_corners = true;
+        show_disks = true;
+        show_gpu_info = "on";
+        show_uptime = true;
+        theme_background = true;
+        vim_keys = false;
+      };
+    };
+  };
+}

modules/home/cli/cli.nix

@@ -0,0 +1,33 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.cli = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli;
+    in {
+      imports = [
+        m.bat
+        m.btop
+        m.direnv
+        m.eza
+        m.mu
+        m.nh
+        m.nix-index
+        m.scripts
+        m.tealdeer
+        m.yt-dlp
+      ];
+
+      options.home.cli.fullDesktop = mkEnableOption "Enable all optional modules and options";
+      config.home.cli = {
+        bat.extras = mkDefault cfg.fullDesktop;
+        mu.enable = mkDefault cfg.fullDesktop;
+        scripts.enable = mkDefault cfg.fullDesktop;
+        yt-dlp.enable = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/cli/direnv.nix

@@ -0,0 +1,12 @@
+{
+  flake.modules.homeManager.direnv = {
+    programs.direnv = {
+      enable = true;
+      config.global = {
+        load_dotenv = true;
+        hide_env_diff = true;
+      };
+      nix-direnv.enable = true;
+    };
+  };
+}

modules/home/cli/eza.nix

@@ -0,0 +1,10 @@
+{
+  flake.modules.homeManager.eza = {
+    programs.eza = {
+      enable = true;
+      colors = "auto";
+      icons = "auto";
+      git = true;
+    };
+  };
+}

modules/home/cli/mu.nix

@@ -0,0 +1,13 @@
+{
+  flake.modules.homeManager.mu = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.mu;
+    in {
+      options.home.cli.mu.enable = mkEnableOption "Enable mu";
+      config.programs.mu.enable = cfg.enable;
+    };
+}

modules/home/cli/nh.nix

@@ -0,0 +1,22 @@
+{
+  flake.modules.homeManager.nh = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.nh;
+    in {
+      options.home.cli.nh.flake = mkOption {
+        type = types.path;
+        default = "/home/phundrak/.dotfiles";
+        example = "/etc/nixos";
+      };
+      config.programs.nh = {
+        enable = true;
+        clean.enable = true;
+        clean.extraArgs = "--keep-since 15d --keep 5";
+        inherit (cfg) flake;
+      };
+    };
+}

modules/home/cli/nix-index.nix

@@ -0,0 +1,17 @@
+{inputs, ...}: {
+  flake-file.inputs.nix-index-database = {
+    url = "github:nix-community/nix-index-database";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.nix-index = {
+    imports = [
+      inputs.nix-index-database.homeModules.nix-index
+    ];
+
+    programs = {
+      nix-index.enable = true;
+      nix-index-database.comma.enable = true;
+    };
+  };
+}

modules/home/cli/scripts.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.homeManager.scripts = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.scripts;
+      scriptFiles = filesystem.listFilesRecursive ./_scripts;
+      scripts = map (file: (import file {inherit pkgs config;})) scriptFiles;
+    in {
+      options.home.cli.scripts.enable = mkEnableOption "Add custom scripts to PATH";
+      config.home.packages = mkIf cfg.enable scripts;
+    };
+}

modules/home/cli/tealdeer.nix

@@ -0,0 +1,8 @@
+{
+  flake.modules.homeManager.tealdeer = {
+    programs.tealdeer = {
+      enable = true;
+      enableAutoUpdates = true;
+    };
+  };
+}

modules/home/cli/yt-dlp.nix

@@ -0,0 +1,20 @@
+{
+  flake.modules.homeManager.yt-dlp = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.yt-dlp;
+    in {
+      options.home.cli.yt-dlp.enable = mkEnableOption "Enable yt-dlp";
+      config.programs.yt-dlp = mkIf cfg.enable {
+        inherit (cfg) enable;
+        settings = {
+          embed-thumbnail = true;
+          embed-subs = true;
+          sub-langs = "all";
+        };
+      };
+    };
+}

modules/home/creug/default.nix

@@ -0,0 +1,71 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.creug = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.creug;
+    in {
+      imports = [m.home-base];
+
+      options.home.creug = {
+        sshKey = {
+          content = mkOption {
+            type = types.nullOr types.str;
+            example = "ssh-ed25519 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+            default = null;
+          };
+          file = mkOption {
+            type = with types; nullOr path;
+            default = "/home/creug/.ssh/id_ed25519.pub";
+          };
+        };
+      };
+
+      config = {
+        nixpkgs.config.allowUnfree = true;
+
+        home = {
+          username = "creug";
+          homeDirectory = "/home/creug";
+          packages = [pkgs.tree pkgs.ncdu];
+          preferXdgDirectories = true;
+
+          creug.sshKey.file = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+
+          dev.vcs = {
+            name = "Creug";
+            email = "gregory.foulachon@gmail.com";
+            editor = "${pkgs.nano}/bin/nano";
+            jj = {
+              enable = true;
+              cz = {
+                enable = true;
+                alias = true;
+              };
+            };
+            git.enable = true;
+            publicKey = cfg.sshKey;
+          };
+
+          security.ssh.enable = true;
+
+          shell = {
+            bash.enable = true;
+            zsh.enable = true;
+            starship.enable = true;
+            tmux.enable = false;
+            zoxide.enable = false;
+          };
+
+          stateVersion = "24.11"; # Do not modify!
+        };
+
+        manual.manpages.enable = true;
+      };
+    };
+}

modules/home/creug/hosts/elcafe.nix

@@ -0,0 +1,13 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager."creug-elcafe" = {...}: {
+    imports = [m.creug];
+
+    home = {
+      cli.nh.flake = "/home/creug/.dotfiles";
+      dev.editors.emacs.enable = false;
+      creug.sshKey.content = builtins.readFile ../keys/id_elcafe.pub;
+    };
+  };
+}

modules/home/creug/keys/id_elcafe.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBdd4cNNhONjhuH4jWZ8Z8K1gbBmeDNqRybKRHMQEvZj gregoryfoulachon@googlemail.com

modules/home/desktop/caelestia.nix

@@ -0,0 +1,98 @@
+{inputs, ...}: {
+  flake-file.inputs.caelestia-shell = {
+    url = "github:caelestia-dots/shell?ref=stable";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.caelestia = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.caelestia;
+    in {
+      imports = [inputs.caelestia-shell.homeManagerModules.default];
+
+      options.home.desktop.caelestia = {
+        enable = mkEnableOption "Enables Caelestia Shell";
+        idleTimeout = mkOption {
+          description = "Idle duration in seconds before locking the session";
+          default = 60 * 60; # an hour
+          type = types.int;
+        };
+      };
+      config.programs.caelestia = mkIf cfg.enable {
+        inherit (cfg) enable;
+        systemd = {
+          enable = true;
+          target = "graphical-session.target";
+          environment = ["QT3_QPA_PLATFORMTHEME=gtk3"];
+        };
+        settings = {
+          paths.wallpaperDir = "~/Pictures/Wallpapers/nord";
+          general = {
+            apps = {
+              terminal = ["kitty"];
+              audio = ["pavucontrol"];
+              playback = ["mpv"];
+              explorer = ["${pkgs.nemo-with-extensions}/bin/nemo"];
+            };
+            idle = {
+              inhibitWhenAudio = true;
+              timeouts = [
+                {
+                  timeout = cfg.idleTimeout;
+                  idleAction = "lock";
+                }
+              ];
+            };
+          };
+          background = {
+            desktopClock.enabled = true;
+            visualiser.enabled = true;
+          };
+          dashboard = {
+            enabled = true;
+            showOnHover = true;
+          };
+          launcher = {
+            enabled = true;
+            showOnHover = false;
+            useFuzzy = {
+              apps = true;
+              schemes = true;
+              wallpapers = true;
+            };
+          };
+          osd.enableMicrophone = true;
+          bar = {
+            status = {
+              showAudio = true;
+              showKbLayout = false;
+            };
+            tray.compact = true;
+          };
+          services = mkIf (config.home.gpuType != null) {
+            inherit (config.home) gpuType;
+          };
+          session.commands = {
+            logout = ["uwsm" "stop"];
+            shutdown = ["systemctl" "poweroff"];
+            hibernate = ["systemctl" "hibernate"];
+            reboot = ["systemctl" "reboot"];
+          };
+          utilities.toasts = {
+            capsLockChanged = false;
+            numLockChanged = false;
+            kbLayoutChanged = false;
+          };
+        };
+        cli = {
+          enable = true;
+          settings.theme.enableGtk = true;
+        };
+      };
+    };
+}

modules/home/desktop/desktop.nix

@@ -0,0 +1,44 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.desktop = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop;
+    in {
+      imports = [
+        m.caelestia
+        m.firefox
+        m.hyprland
+        m.hyprpaper
+        m.kdeconnect
+        m.kitty
+        m.obs
+        m.rofi
+        m.spotify
+        m.swaync
+        m.theme
+        m.waybar
+        m.wl-kbptr
+        m.wlr-which-key
+        m.wlsunset
+      ];
+
+      options.home.desktop.fullDesktop = mkEnableOption "Enable options for graphical environments";
+      config.home.desktop = {
+        firefox.enable = mkDefault cfg.fullDesktop;
+        hyprland.enable = mkDefault cfg.fullDesktop;
+        kdeconnect.enable = mkDefault cfg.fullDesktop;
+        kitty.enable = mkDefault cfg.fullDesktop;
+        obs.enable = mkDefault cfg.fullDesktop;
+        rofi.enable = mkDefault cfg.fullDesktop;
+        spotify.enable = mkDefault cfg.fullDesktop;
+        spotify.spicetify.enable = mkDefault cfg.fullDesktop;
+        theme.enable = mkDefault cfg.fullDesktop;
+        wlr-which-key.enable = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/desktop/firefox.nix

@@ -0,0 +1,78 @@
+{inputs, ...}: {
+  flake-file.inputs.zen-browser = {
+    url = "github:youwen5/zen-browser-flake";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.firefox = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.firefox;
+      inherit (pkgs.stdenv.hostPlatform) system;
+      zen = inputs.zen-browser.packages.${system}.default;
+      settingsToLines = settings:
+        concatStringsSep "\n" (mapAttrsToList (name: value: "set ${name} ${toString value}") settings);
+    in {
+      options.home.desktop.firefox = {
+        enable = mkEnableOption "enable Firefox";
+        useZen = mkEnableOption "use Zen instead of Firefox";
+        tridactyl = {
+          enable = mkEnableOption "enable Tridactyl";
+          preConfig = mkOption {
+            description = "Lines to add to the beginning of tridactylrc";
+            type = types.lines;
+            default = "";
+          };
+          config = mkOption {
+            type = with types;
+              attrsOf (oneOf [
+                int
+                str
+                bool
+              ]);
+            description = "Tridactyl settings (converted to 'set key value' lines)";
+            default = {};
+            example = {
+              smoothscroll = true;
+              history = 1000;
+            };
+          };
+          extraConfig = mkOption {
+            description = "Extra lines to add to tridactylrc (for bindings, autocmds, etc)";
+            type = types.lines;
+            default = "";
+          };
+        };
+      };
+
+      config = mkIf cfg.enable {
+        home.sessionVariables.MOZ_ENABLE_WAYLAND = "1";
+        programs.firefox = {
+          inherit (cfg) enable;
+          package =
+            if cfg.useZen
+            then zen
+            else pkgs.firefox;
+          nativeMessagingHosts = lists.optional cfg.tridactyl.enable pkgs.tridactyl-native;
+          configPath = ".mozilla/firefox";
+        };
+        xdg.configFile."tridactyl/tridactylrc" = mkIf cfg.tridactyl.enable {
+          text = concatStringsSep "\n" (filter (s: s != "") [
+            cfg.tridactyl.preConfig
+            (settingsToLines (cfg.tridactyl.config
+              // {
+                browser =
+                  if cfg.useZen
+                  then "zen"
+                  else "firefox";
+              }))
+            cfg.tridactyl.extraConfig
+          ]);
+        };
+      };
+    };
+}

modules/home/desktop/hyprpaper.nix

@@ -0,0 +1,90 @@
+{
+  flake.modules.homeManager.hyprpaper = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.hyprpaper;
+    in {
+      options.home.desktop.hyprpaper = {
+        enable = mkEnableOption "Enables Hyprpaper";
+        default = mkOption {
+          type = types.str;
+          default = "/home/phundrak/Pictures/Wallpapers/nord/Nordic6.jpg";
+          example = "/home/user/image.jpg";
+        };
+        wallpapers-dir = mkOption {
+          type = types.str;
+          default = "/home/phundrak/Pictures/Wallpapers/nord/";
+          example = "/home/user/Pictures/";
+        };
+        rotation-interval = mkOption {
+          type = types.str;
+          default = "5m";
+          example = "10m";
+          description = "Interval between wallpaper rotations";
+        };
+      };
+      config = mkIf cfg.enable {
+        services.hyprpaper = {
+          inherit (cfg) enable;
+          settings = {
+            ipc = "on";
+            splash = false;
+            preload = cfg.default;
+            wallpaper = ", ${cfg.default}";
+          };
+        };
+        systemd.user = {
+          services.hyprpaper-rotation = {
+            Unit = {
+              Description = "Rotate Hyprpaper wallpaper";
+              After = "graphical-session.target";
+            };
+            Service = {
+              Type = "oneshot";
+              ExecCondition = "${pkgs.procps}/bin/pidof Hyprland";
+              ExecStart = "${config.home.homeDirectory}/.config/hypr/hyprpaper-rotate.sh";
+            };
+          };
+
+          timers.hyprpaper-rotation = {
+            Unit = {
+              Description = "Timer for rotating Hyprpaper wallpaper";
+            };
+            Timer = {
+              OnBootSec = cfg.rotation-interval;
+              OnUnitActiveSec = cfg.rotation-interval;
+            };
+            Install = {
+              WantedBy = ["timers.target"];
+            };
+          };
+        };
+        home.file.".config/hypr/hyprpaper-rotate.sh" = {
+          text = ''
+            #!/usr/bin/env bash
+            set -euo pipefail
+
+            WALLPAPER_DIR="${cfg.wallpapers-dir}"
+
+            # Find a random wallpaper
+            WP=$(find "$WALLPAPER_DIR" -type f \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" \) | shuf -n 1)
+
+            if [ -z "$WP" ]; then
+              echo "No wallpapers found in $WALLPAPER_DIR"
+              exit 1
+            fi
+
+            echo "Setting wallpaper to: $WP"
+
+            # Load and set the wallpaper
+            ${pkgs.hyprland}/bin/hyprctl hyprpaper preload "$WP" && ${pkgs.hyprland}/bin/hyprctl hyprpaper wallpaper ",$WP"
+          '';
+          executable = true;
+        };
+      };
+    };
+}

modules/home/desktop/kdeconnect.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.homeManager.kdeconnect = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.kdeconnect;
+    in {
+      options.home.desktop.kdeconnect.enable = mkEnableOption "Enable KDE Connect";
+      config.services.kdeconnect = mkIf cfg.enable {
+        enable = true;
+        indicator = true;
+      };
+    };
+}

modules/home/desktop/kitty.nix

@@ -0,0 +1,116 @@
+{
+  flake.modules.homeManager.kitty = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.kitty;
+    in {
+      options.home.desktop.kitty.enable = mkEnableOption "Enable kitty terminal";
+      config.programs.kitty = mkIf cfg.enable {
+        inherit (cfg) enable;
+        themeFile = "Nord";
+        font = {
+          package = pkgs.cascadia-code;
+          name = "Cascadia Code";
+          size = 10;
+        };
+        settings = {
+          enable_audio_bell = true;
+          visual_bell_duration = 0.1;
+          enabled_layouts = "fat,fat:mirrored=true,tall,tall:mirrored=true";
+          kitty_mod = "ctrl+shift";
+          disable_ligatures = "never";
+          font_features = "Cascadia-Mono +onum +zero";
+          cursor_shape = "block";
+          scrollback_lines = "10000";
+          mouse_hide_wait = 3.0;
+          detect_urls = true;
+          background_opacity = 0.7;
+        };
+        keybindings = let
+          prefix = "kitty_mod+space";
+        in {
+          "alt+c" = "copy_to_clipboard";
+          "kitty_mod+c" = "copy_to_clipboard";
+          "alt+v" = "paste_from_clipboard";
+          "kitty_mod+v" = "paste_from_clipboard";
+
+          "${prefix}>s>c" = "show_scrollback";
+          "${prefix}>s>down" = "scroll_line_down";
+          "${prefix}>s>t" = "scroll_line_down";
+          "${prefix}>s>up" = "scroll_line_up";
+          "${prefix}>s>s" = "scroll_line_up";
+          "${prefix}>s>end" = "scroll_end";
+          "${prefix}>s>home" = "scroll_home";
+          "${prefix}>s>page_down" = "scroll_page_down";
+          "${prefix}>s>page_up" = "scroll_page_up";
+
+          "${prefix}>enter" = "new_window";
+          "${prefix}>w>q" = "close_window";
+          "${prefix}>w>p" = "next_window";
+          "${prefix}>w>n" = "previous_window";
+          "${prefix}>w>f" = "move_window_forward";
+          "${prefix}>w>b" = "move_window_backward";
+          "${prefix}>w>t" = "move_window_to_top";
+          "${prefix}>w>r" = "start_resizing_window";
+          "${prefix}>w>1" = "first_window";
+          "${prefix}>w>2" = "second_window";
+          "${prefix}>w>3" = "third_window";
+          "${prefix}>w>4" = "fourth_window";
+          "${prefix}>w>5" = "fifth_window";
+          "${prefix}>w>6" = "sixth_window";
+          "${prefix}>w>7" = "seventh_window";
+          "${prefix}>w>8" = "eighth_window";
+          "${prefix}>w>9" = "ninth_window";
+          "${prefix}>w>0" = "tenth_window";
+
+          "${prefix}>tab>n" = "next_tab";
+          "${prefix}>tab>p" = "previous_tab";
+          "${prefix}>tab>c" = "new_tab";
+          "${prefix}>tab>q" = "close_tab";
+          "${prefix}>tab>shift+n" = "move_tab_backward";
+          "${prefix}>tab>shift+p" = "move_tab_forward";
+          "${prefix}>tab>t" = "set_tab_title";
+
+          "${prefix}>l" = "next_layout";
+
+          "${prefix}>f>equal" = "change_font_size all 0";
+          "${prefix}>f>kp_add" = "change_font_size all +2.0";
+          "${prefix}>f>plus" = "change_font_size all +2.0";
+          "${prefix}>f>kp_subtract" = "change_font_size all -2.0";
+          "${prefix}>f>minus" = "change_font_size all -2.0";
+
+          "${prefix}>shift+h" = "kitten hints";
+          "${prefix}>h>p" = "kitten hints --type path --program -";
+          "${prefix}>h>shift+p" = "kitten hints --type path";
+          "${prefix}>h>l" = "kitten hints --type line --program -";
+          "${prefix}>h>w" = "kitten hints --type word --program -";
+          "${prefix}>h>h" = "kitten hints --type hash --program -";
+          "${prefix}>h>n" = "kitten hints --type linenum";
+          "${prefix}>h>y" = "kitten hints --type hyperlink";
+
+          "${prefix}>f10" = "toggle_maximized";
+          "${prefix}>f11" = "toggle_fullscreen";
+
+          "${prefix}>a>equal" = "set_background_opacity 1";
+          "${prefix}>a>d" = "set_background_opacity default";
+          "${prefix}>a>plus" = "set_background_opacity +0.1";
+          "${prefix}>a>up" = "set_background_opacity +0.1";
+          "${prefix}>a>kp_add" = "set_background_opacity +0.1";
+          "${prefix}>a>minus" = "set_background_opacity -0.1";
+          "${prefix}>a>down" = "set_background_opacity -0.1";
+          "${prefix}>a>kp_substract" = "set_background_opacity -0.1";
+
+          "${prefix}>delete" = "clear_terminal reset active";
+          "${prefix}>escape" = "kitty_shell window";
+          "${prefix}>f2" = "edit_config_file";
+          "${prefix}>n" = "new_os_window";
+          "${prefix}>o" = "pass_selection_to_program";
+          "${prefix}>u" = "kitten unicode_input";
+        };
+      };
+    };
+}

modules/home/desktop/obs.nix

@@ -0,0 +1,29 @@
+{
+  flake.modules.homeManager.obs = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.obs;
+      obs-image-reaction = pkgs.callPackage ../../../packages/obs-image-reaction.nix {};
+    in {
+      options.home.desktop.obs.enable = mkEnableOption "Enables OBS Studio";
+      config.programs.obs-studio = mkIf cfg.enable {
+        inherit (cfg) enable;
+        plugins = with pkgs.obs-studio-plugins; [
+          input-overlay
+          obs-backgroundremoval
+          obs-markdown
+          obs-mute-filter
+          obs-pipewire-audio-capture
+          obs-scale-to-sound
+          obs-source-clone
+          obs-source-record
+          obs-tuna
+          obs-image-reaction
+        ];
+      };
+    };
+}

modules/home/desktop/rofi/rofi.nix

@@ -0,0 +1,109 @@
+{
+  flake.modules.homeManager.rofi = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.rofi;
+      inherit (config.lib.formats.rasi) mkLiteral;
+    in {
+      options.home.desktop.rofi = {
+        enable = mkEnableOption "Enable Rofi";
+      };
+      config = mkIf cfg.enable {
+        home.packages = with pkgs; [rofi-bluetooth];
+        programs.rofi = {
+          enable = true;
+          plugins = with pkgs; [
+            rofi-calc
+            rofi-emoji
+          ];
+          terminal = "${pkgs.kitty}/bin/kitty";
+          location = "center";
+          modes = ["drun" "emoji" "calc" "combi"];
+          extraConfig.show-icons = true;
+          theme = {
+            "*" = {
+              font = "Cascadia Code 14";
+              blur = true;
+              padding = mkLiteral "10px";
+              background-color = mkLiteral "transparent";
+              border-radius = mkLiteral "0px";
+            };
+            window = {
+              width = mkLiteral "1050px";
+              height = mkLiteral "625px";
+              location = mkLiteral "center";
+              blur = true;
+              border = mkLiteral "2px";
+              border-radius = mkLiteral "3px";
+              border-color = mkLiteral "#61afef";
+              background-color = mkLiteral "transparent";
+              padding = mkLiteral "0px";
+              margin = mkLiteral "30px 50px";
+            };
+            mainbox = {
+              orientation = mkLiteral "horizontal";
+              children = map mkLiteral ["borderbox"];
+              spacing = mkLiteral "0px";
+              padding = mkLiteral "0px";
+            };
+            borderbox = {
+              orientation = mkLiteral "horizontal";
+              children = map mkLiteral ["imagebox" "contentbox"];
+              padding = mkLiteral "0px";
+              spacing = mkLiteral "0px";
+              border-radius = mkLiteral "3px";
+            };
+            contentbox = {
+              orientation = mkLiteral "vertical";
+              children = map mkLiteral ["entry" "listview"];
+              spacing = mkLiteral "0px";
+              padding = mkLiteral "0px";
+              expand = true;
+            };
+            imagebox = {
+              background-image = mkLiteral "url(\"${./image.jpg}\")";
+              background-repeat = false;
+              size = mkLiteral "200px 625px";
+            };
+            element = {
+              border-radius = mkLiteral "0px";
+            };
+            "element-text, element-icon" = {
+              padding = mkLiteral "6px 8px";
+              spacing = mkLiteral "2px";
+              text-color = mkLiteral "#fab387";
+            };
+            "element selected" = {
+              background-color = mkLiteral "#191919";
+              text-color = mkLiteral "#e5c07b";
+              border-radius = mkLiteral "3px";
+            };
+            prompt = {
+              enabled = false;
+              background-color = mkLiteral "transparent";
+              text-color = mkLiteral "#61afef";
+              padding = mkLiteral "5px 10px";
+            };
+            entry = {
+              padding = mkLiteral "8px";
+              expand = false;
+              font = "Cascadia Code 14";
+              text-color = mkLiteral "#fab387";
+              border-radius = mkLiteral "0px 3px 0px 0px";
+              background-color = mkLiteral "#292e36";
+            };
+            listview = {
+              lines = mkLiteral "1";
+              background-color = mkLiteral "rgba(46, 52, 64, 0.8)";
+              border-radius = mkLiteral "0px 0px 3px 0px";
+              padding = mkLiteral "5px";
+            };
+          };
+        };
+      };
+    };
+}

modules/home/desktop/spotify.nix

@@ -0,0 +1,33 @@
+{inputs, ...}: {
+  flake-file.inputs.spicetify = {
+    url = "github:Gerg-L/spicetify-nix";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.spotify = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      inherit (pkgs.stdenv.hostPlatform) system;
+      cfg = config.home.desktop.spotify;
+      spicePkgs = inputs.spicetify.legacyPackages.${system};
+    in {
+      imports = [inputs.spicetify.homeManagerModules.default];
+
+      options.home.desktop.spotify = {
+        enable = mkEnableOption "Enable Spotify";
+        spicetify.enable = mkEnableOption "Enable Spicetify";
+      };
+      config.programs = mkIf cfg.enable {
+        spotify-player.enable = cfg.enable;
+        spicetify = mkIf cfg.spicetify.enable {
+          inherit (cfg.spicetify) enable;
+          theme = spicePkgs.themes.sleek;
+          colorScheme = "Nord";
+        };
+      };
+    };
+}

modules/home/desktop/swaync.nix

@@ -0,0 +1,17 @@
+{...}: {
+  flake.modules.homeManager.swaync = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.swaync;
+    in {
+      options.home.desktop.swaync.enable = mkEnableOption "Enables swaync";
+      config = mkIf cfg.enable {
+        services.swaync.enable = true;
+        home.packages = [pkgs.swaynotificationcenter];
+      };
+    };
+}

modules/home/desktop/theme.nix

@@ -0,0 +1,36 @@
+{
+  flake.modules.homeManager.theme = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.theme;
+    in {
+      options.home.desktop.theme.enable = mkEnableOption "Enable theme options";
+      config = mkIf cfg.enable {
+        gtk = {
+          enable = true;
+          colorScheme = "dark";
+          iconTheme = {
+            name = "Nordzy-icons";
+            package = pkgs.nordzy-icon-theme;
+          };
+          theme = {
+            package = pkgs.nordic;
+            name = "Nordic";
+          };
+          gtk4.theme = config.gtk.theme;
+        };
+        home.pointerCursor = {
+          enable = true;
+          gtk.enable = true;
+          hyprcursor.enable = config.home.desktop.hyprland.enable;
+          name = "Nordzy-cursors";
+          package = pkgs.nordzy-cursor-theme;
+        };
+        qt.enable = true;
+      };
+    };
+}

modules/home/desktop/waybar.nix

@@ -0,0 +1,156 @@
+{
+  flake.modules.homeManager.waybar = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.waybar;
+    in {
+      options.home.desktop.waybar = {
+        enable = mkEnableOption "Enables waybar.";
+        battery = mkEnableOption "Enables battery support.";
+        style = mkOption {
+          type = types.path;
+          example = ./style.css;
+        };
+      };
+      config.programs.waybar = mkIf cfg.enable {
+        inherit (cfg) enable;
+        systemd.enable = true;
+        settings = {
+          topBar = {
+            height = 24;
+            spacing = 2;
+            modules-left = ["hyprland/workspaces" "hyprland/submap" "hyprland/window"];
+            modules-center = [];
+            modules-right = [
+              "idle_inhibitor"
+              "group/audio"
+              "group/hardware"
+              "network"
+              "privacy"
+              "clock"
+              "tray"
+            ];
+
+            idle_inhibitor = {
+              format = "{icon}";
+              format-icons = {
+                activated = "";
+                deactivated = "";
+              };
+            };
+
+            mpris = {
+              dynamic-order = ["title" "artist" "album"];
+              dynamic-importance-order = ["title" "artist" "album"];
+              format = "DEFAULT: {player_icon} {dynamic}";
+              format-paused = "DEFAULT: {status_icon} <i>{dynamic}</i>";
+              player-icons = {
+                default = "▶";
+                mpv = "🎵";
+              };
+              status-icons.paused = "⏸";
+              ignored-players = [];
+            };
+
+            pulseaudio = {
+              format = "{volume}% {icon} {format_source}";
+              format-bluetooth = "{volume}% {icon} {format_source}";
+              format-bluetooth-muted = " {icon} {format_source}";
+              format-muted = " {format_source}";
+              format-source = "{volume}% ";
+              format-source-muted = "";
+              format-icons = {
+                headphone = "";
+                hands-free = "";
+                headset = "";
+                phone = "";
+                portable = "";
+                car = "";
+                default = ["" "" ""];
+              };
+              on-click = "pavucontrol";
+            };
+
+            network = {
+              format-wifi = "{essid} ({signalStrength}%) ";
+              format-ethernet = "{ipaddr}/{cidr} ";
+              tooltip-format = "{ifname} via {gwaddr} ";
+              format-linked = "{ifname} (No IP) ";
+              format-disconnected = "Disconnected ⚠";
+              format-alt = "{ifname}: {ipaddr}/{cidr}";
+            };
+
+            "group/audio" = {
+              modules = ["pulseaudio" "pulseaudio/slider" "mpris"];
+              orientation = "inherit";
+              drawer.transition-duration = 300;
+            };
+
+            "group/hardware" = {
+              modules = lists.optional cfg.battery "battery" ++ ["cpu" "memory" "disk"];
+              orientation = "inherit";
+              drawer.transition-duration = 300;
+            };
+
+            cpu = {
+              format = "{usage}% ";
+              tooltip = false;
+            };
+
+            memory.format = "{}% ";
+
+            disk = {
+              format = "{path}: {used}/{total} ({percentage_used}%)";
+              unit = "GB";
+            };
+
+            battery = {
+              states = {
+                good = 90;
+                warning = 30;
+                critical = 15;
+              };
+              format = "{capacity}% {icon}";
+              format-charging = "{capacity}% ";
+              format-plugged = "{capacity}% ";
+              format-alt = "{time} {icon}";
+              # An empty format will hide the module
+              format-good = "";
+              format-full = "";
+              format-icons = ["" "" "" "" ""];
+            };
+
+            clock = {
+              timezones = ["Europe/Paris" "Asia/Tokyo" "America/New_York" "America/Los_Angeles" "Asia/Kathmandu"];
+              tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
+              format-alt = "{:%Y-%m-%d}";
+              actions = {
+                on-click-right = "mode";
+                on-scroll-up = "tz_up";
+                on-scroll-down = "tz_down";
+              };
+              calendar = {
+                mode = "year";
+                mode-mon-col = 3;
+                weeks-pos = "right";
+                on-scroll = 1;
+                format = {
+                  months = "<span color='#eceff4'><b>{}</b></span>";
+                  days = "<span color='#5e81ac'><b>{}</b></span>";
+                  weeks = "<span color='#8fbcbb'><b>W{:%W}</b></span>";
+                  weekdays = "<span color='#d8dee9'><b>{}</b></span>";
+                  today = "<span color='#a3be8c'><b><u>{}</u></b></span>";
+                };
+              };
+            };
+
+            tray.spacing = 10;
+          };
+        };
+        style = builtins.readFile cfg.style;
+      };
+    };
+}

modules/home/desktop/wl-kbptr.nix

@@ -0,0 +1,39 @@
+{
+  flake.modules.homeManager.wl-kbptr = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      configDir = config.xdg.configHome;
+      cfg = config.home.desktop.wl-kbptr;
+      iniFormat = pkgs.formats.ini {};
+    in {
+      options.home.desktop.wl-kbptr = {
+        enable = mkEnableOption "enable wl-kbptr";
+        config = mkOption {
+          inherit (iniFormat) type;
+          default = {};
+          description = ''
+            Options to add to the {file}`config` file. See
+            <https://github.com/moverest/wl-kbptr/blob/main/config.example>
+            for options.
+          '';
+          example = {
+            general = {
+              home_row_keys = "abcd";
+            };
+          };
+        };
+      };
+      config = mkIf cfg.enable {
+        home = {
+          packages = [pkgs.wl-kbptr];
+          file."${configDir}/wl-kbptr/config" = mkIf (cfg.config != {}) {
+            source = iniFormat.generate "wl-kbptr-config" cfg.config;
+          };
+        };
+      };
+    };
+}

modules/home/desktop/wlr-which-key.nix

@@ -0,0 +1,191 @@
+{
+  flake.modules.homeManager.wlr-which-key = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    inherit
+      (lib)
+      literalExpression
+      mkIf
+      mkOption
+      mkEnableOption
+      types
+      ;
+    cfg = config.home.desktop.wlr-which-key;
+    yamlFormat = pkgs.formats.yaml {};
+
+    # Convert kebab-case to snake_case
+    toSnakeCase = str: builtins.replaceStrings ["-"] ["_"] str;
+
+    # Recursively filter out null values and convert kebab-case keys to snake_case
+    filterNulls = value:
+      if lib.isAttrs value
+      then lib.mapAttrs' (n: v: lib.nameValuePair (toSnakeCase n) (filterNulls v)) (lib.filterAttrs (_: v: v != null) value)
+      else if lib.isList value
+      then map filterNulls value
+      else value;
+    menuEntryType = types.submodule {
+      freeformType = yamlFormat.type;
+      options = with types; {
+        key = mkOption {
+          type = str;
+          example = "p";
+        };
+        desc = mkOption {
+          type = str;
+          example = "Power";
+        };
+        cmd = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "echo example";
+        };
+        keep-open = mkOption {
+          type = nullOr bool;
+          default = null;
+          example = true;
+        };
+        submenu = mkOption {
+          type = nullOr (listOf menuEntryType);
+          default = null;
+          example = literalExpression ''
+            [
+              { key = "s"; desc = "Suspend"; cmd = "systemctl suspend"; }
+              { key = "r"; desc = "Reboot"; cmd = "systemctl reboot"; }
+              { key = "o"; desc = "Poweroff"; cmd = "systemctl poweroff"; }
+            ]
+          '';
+        };
+      };
+    };
+    settingsType = types.submodule {
+      freeformType = yamlFormat.type;
+      options = with types; {
+        background = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#282828FF";
+        };
+        color = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#FBF1C7FF";
+        };
+        border = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#8EC07CFF";
+        };
+        anchor = mkOption {
+          type = nullOr (enum ["center" "top" "bottom" "left" "right" "top-left" "top-right" "bottom-left" "bottom-right"]);
+          default = null;
+          example = "top-left";
+        };
+        margin-top = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-right = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-bottom = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-left = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        font = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "monospace 10";
+        };
+        separator = mkOption {
+          type = nullOr str;
+          default = null;
+          example = " ➜ ";
+        };
+        border-width = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 4.0;
+        };
+        corder-r = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 20.0;
+        };
+        padding = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 15.0;
+        };
+        rows-per-column = mkOption {
+          type = nullOr int;
+          default = null;
+          example = 5;
+        };
+        column-padding = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 25.0;
+        };
+        inhibit-compositor-keyboard-shortcuts = mkOption {
+          type = bool;
+          default = true;
+          example = false;
+        };
+        auto_kbd_layout = mkOption {
+          type = bool;
+          default = true;
+          example = false;
+        };
+        namespace = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "wlr_which_key";
+        };
+        menu = mkOption {
+          type = listOf menuEntryType;
+          default = [];
+          example = literalExpression ''
+            [
+              {
+                key = "p";
+                desc = "Power";
+                submenu = [
+                  { key = "s"; desc = "Suspend"; cmd = "systemctl suspend"; }
+                  { key = "r"; desc = "Reboot"; cmd = "systemctl reboot"; }
+                  { key = "o"; desc = "Poweroff"; cmd = "systemctl poweroff"; }
+                ];
+              }
+            ]
+          '';
+        };
+      };
+    };
+  in {
+    options.home.desktop.wlr-which-key = {
+      enable = mkEnableOption "Enables wlr-which-key";
+      package = lib.mkPackageOption pkgs "wlr-which-key" {};
+      settings = mkOption {
+        type = settingsType;
+        default = {};
+        description = "Configuration written to {file}`$XDG_CONFIG_HOME/wlr-which-key/config.yaml`.";
+      };
+    };
+    config = mkIf cfg.enable {
+      xdg.configFile = {
+        "wlr-which-key/config.yaml".source = yamlFormat.generate "wlr-which-key-config.yml" (filterNulls cfg.settings);
+      };
+    };
+  };
+}

modules/home/desktop/wlsunset.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.homeManager.wlsunset = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.wlsunset;
+    in {
+      options.home.desktop.wlsunset = {
+        enable = mkEnableOption "Enables wlsunset";
+        latitude = mkOption {
+          type = with types; nullOr (oneOf [str ints.unsigned float]);
+          default = 48.5;
+        };
+        longitude = mkOption {
+          type = with types; nullOr (oneOf [str ints.unsigned float]);
+          default = 2.2;
+        };
+      };
+
+      config.services.wlsunset = mkIf cfg.enable {
+        inherit (cfg) enable latitude longitude;
+      };
+    };
+}

modules/home/dev/ai/ai.nix

@@ -0,0 +1,50 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.ai = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai;
+      jsonFormat = pkgs.formats.json {};
+    in {
+      imports = [
+        m.claude
+        m.ollama
+        m.opencode
+      ];
+
+      options.home.dev.ai = {
+        enable = mkEnableOption "Enables AI features";
+        lmStudio = mkOption {
+          default = cfg.enable;
+          example = true;
+          description = "Enables LM Studio. Enabled by default when AI is enabled.";
+        };
+        mcpServers = mkOption {
+          inherit (jsonFormat) type;
+          default = {};
+        };
+      };
+      config = {
+        home = mkIf cfg.enable {
+          dev.ai = {
+            claude = {
+              enable = mkDefault cfg.enable;
+              mcpServers = mkDefault cfg.mcpServers;
+            };
+            ollama.enable = mkDefault cfg.enable;
+            opencode.enable = mkDefault cfg.enable;
+          };
+          packages = lists.optional cfg.lmStudio pkgs.lmstudio;
+        };
+        programs.mcp = mkIf (cfg.mcpServers != {}) {
+          enable = true;
+          servers = cfg.mcpServers;
+        };
+      };
+    };
+}

modules/home/dev/ai/claude.nix

@@ -0,0 +1,30 @@
+{
+  flake.modules.homeManager.claude = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai.claude;
+      jsonFormat = pkgs.formats.json {};
+    in {
+      options.home.dev.ai.claude = {
+        enable = mkEnableOption "Enables Claude-related packages";
+        mcpServers = mkOption {
+          inherit (jsonFormat) type;
+          default = {};
+        };
+      };
+      config = mkIf cfg.enable {
+        home.packages = let
+          claude-jj = pkgs.writeShellScriptBin "claude-jj" ''
+            ${pkgs.claude-code}/bin/claude --append-system-prompt 'CRITICAL: This repository uses Jujutsu (jj), NOT git. Never use git commands. Use jj equivalents.' "$@"
+          '';
+        in [claude-jj pkgs.sox];
+        programs.claude-code = {
+          inherit (cfg) enable mcpServers;
+        };
+      };
+    };
+}