refactor: change to litterate config

Configuration is now held by the `.org` files. All `.nix` files are
tangled from the org-mode files.

.envrc

@@ -1,11 +1,7 @@
 # -*- mode: sh; -*-
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
-fi
-
 watch_file flake.nix
 watch_file flake.lock
 if ! use flake . --no-pure-eval
 then
-  echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
+  echo "dev shell could not be built. The environment was not loaded. Make the necessary changes to flake.nix and hit enter to try again." >&2
 fi

.sops.yaml

@@ -1,10 +1,14 @@
 keys:
+  - &elcafe age1tkywsvddjj6r6ukuqgz9aql92jfx85rz57dhmkkndysh6yx6p5rs0zj0qr
+  - &elcafe-host age17p69ktg7yfzgdsk00f32mupe4n4fevdpw2wsv7ft30yvpeseau6s7t0zdg
   - &gampo age1ajemtm502nn2n4q7v4j8meyd5mxtcqngkkedxq2pqzuwu78zp93qnw8q48
   - &gampo-host age197lfdanym647wdaz9uy8hrfqjwj9fs8rm7vs3fsrctceu8mr9gms2jedhz
   - &marpa age17pn6suvz2f7zmrm9zxj5hr0putvcvdamqxqt7ewhncgg6ccgmp2qr00xm2
   - &marpa-host age1cnnpnglkvgw5ffv8qpgwpqvj203lh4uwt698y9mxjwklxt8nysmsa8hepn
   - &tilo age1g68hxv73llkyc7etzh499ztcrt93pwawy0n8p93px4taqu58mehsp88vjq
   - &tilo-host age1awytvphvty4f9wmdn86xnjg9kgetqjx8qlwj5d2882t4fyyzy58s3vg5k4
+  - &NaroMk3 age1erkn7dd022e90ktyj66aux9j9xvl0uzd6ru5cmrjsvcm5rtr5pfs7q6k9h
+  - &NaroMk3-host age16crkeglm3j3f6rveylytuerptjf9mwtv3hl89ywkmnnvdkntfchsuvrsk5
 creation_rules:
   - path_regex: secrets/secrets.yaml$
     key_groups:
@@ -15,3 +19,7 @@ creation_rules:
       - *marpa-host
       - *tilo
       - *tilo-host
+      - *NaroMk3
+      - *NaroMk3-host
+      - *elcafe
+      - *elcafe-host

LICENSE.org

@@ -0,0 +1,17 @@
+* Licensing
+The source code you can find in various programming languages in this
+repository including, but not limited to, Javascript and CSS source
+code is under the [[https://www.gnu.org/licenses/agpl-3.0.html][AGPL-3.0]] licence.
+
+The creative work contained in [[https://labs.phundrak.com/phundrak/langue-phundrak-com][the main code repository]], on my [[https://github.com/Phundrak/langue-phundrak-fr/][Github
+mirror]], and on my website [[https://langue.phundrak.com][langue.phundrak.com]] is dual-licenced
+between the [[https://www.gnu.org/licenses/#FDL][GNU Free Documentation License]] ([[file:fdl-1.3.md][legal code]]) for the text
+and the /Creative Commons Attribution-NonCommercial-ShareAlike 4.0
+International/ ([[https://creativecommons.org/licenses/by-nc-sa/4.0/][CC BY-NC-SA 4.0]], [[https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode][legal code]]) license.
+
+Copies of all the mentionned licenses can be found in this code
+repository.
+
+If you wish to obtain a special license that is incompatible with the
+current ones, please contact me at [[mailto:lucien@phundrak.com][lucien@phundrak.com]] so we can
+discuss it.

README.md

@@ -1,6 +1,18 @@
-# NixOS Configuration
+<h1 align="center">NixOS Configuration</h1>
+<div align="center">
+ <strong>
+   Personal NixOS configuration for my machines, using Nix Flakes for reproducible and shareable setups.
+ </strong>
+</div>
+<br/>
+
+<div align="center">
+  <!-- Wakapi -->
+  <img alt="Coding Time Badge" src="https://clock.phundrak.com/api/badge/phundrak/interval:any/project:.dotfiles">
+  <!-- Emacs -->
+  <a href="https://www.gnu.org/software/emacs/"><img src="https://img.shields.io/badge/Emacs-30.2-blueviolet.svg?style=flat-square&logo=GNU%20Emacs&logoColor=white" /></a>
+</div>
 
-Personal NixOS configuration for my machines, using Nix Flakes for reproducible and shareable setups.
 
 ## Repository Structure
 
@@ -8,7 +20,6 @@ Personal NixOS configuration for my machines, using Nix Flakes for reproducible
 - **hosts/**: Contains the host-specific NixOS configurations.
 - **system/**: Holds system-wide configuration modules that can be shared across different hosts. This includes things like boot settings, desktop environments, hardware configurations, networking, packages, security, and system services.
 - **users/**: Manages user-specific configurations. It's split into `modules` for reusable home-manager configurations and `phundrak` for my personal configuration.
-- **keys/**: Public keys for various machines.
 - **secrets/**: Encrypted secrets managed with `sops-nix`.
 
 ## Usage

flake.lock

@@ -1,113 +1,124 @@
 {
   "nodes": {
-    "cachix": {
+    "alejandra": {
       "inputs": {
-        "devenv": [
+        "fenix": "fenix",
-          "devenv"
+        "flakeCompat": "flakeCompat",
-        ],
-        "flake-compat": [
-          "devenv",
-          "flake-compat"
-        ],
-        "git-hooks": [
-          "devenv",
-          "git-hooks"
-        ],
         "nixpkgs": [
-          "devenv",
+          "jj-cz",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1760971495,
+        "lastModified": 1744324181,
-        "narHash": "sha256-IwnNtbNVrlZIHh7h4Wz6VP0Furxg9Hh0ycighvL5cZc=",
+        "narHash": "sha256-Oi1n2ncF4/AWeY6X55o2FddIRICokbciqFYK64XorYk=",
-        "owner": "cachix",
+        "owner": "kamadorueda",
-        "repo": "cachix",
+        "repo": "alejandra",
-        "rev": "c5bfd933d1033672f51a863c47303fc0e093c2d2",
+        "rev": "3e2a85506627062313e131bf8a85315f3387c8e0",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "kamadorueda",
-        "ref": "latest",
+        "ref": "4.0.0",
-        "repo": "cachix",
+        "repo": "alejandra",
         "type": "github"
       }
     },
-    "claude-desktop": {
+    "caelestia-cli": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "caelestia-shell": [
+          "caelestia-shell"
+        ],
         "nixpkgs": [
+          "caelestia-shell",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1761825061,
+        "lastModified": 1787985728,
-        "narHash": "sha256-AeRQZKr8+1XQer+WmbwtQaQBy05UDgeNNE7YZjNLuS0=",
+        "narHash": "sha256-qKYq/NmpxLKn2ZcxNUGx7PgVlmxW833xKZ3Hngvvnro=",
-        "owner": "k3d3",
+        "owner": "caelestia-dots",
-        "repo": "claude-desktop-linux-flake",
+        "repo": "cli",
-        "rev": "791cd93cfe216ad06ab740f0fdc142119b1d6ec2",
+        "rev": "56f404c61dff30d698961780aefcf48bd4dd7b86",
         "type": "github"
       },
       "original": {
-        "owner": "k3d3",
+        "owner": "caelestia-dots",
-        "repo": "claude-desktop-linux-flake",
+        "repo": "cli",
         "type": "github"
       }
     },
-    "devenv": {
+    "caelestia-shell": {
       "inputs": {
-        "cachix": "cachix",
+        "caelestia-cli": "caelestia-cli",
-        "flake-compat": "flake-compat",
+        "m3shapes": "m3shapes",
-        "flake-parts": "flake-parts",
-        "git-hooks": "git-hooks",
-        "nix": "nix",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "quickshell": "quickshell"
       },
       "locked": {
-        "lastModified": 1761922975,
+        "lastModified": 1788247772,
-        "narHash": "sha256-j4EB5ku/gDm7h7W7A+k70RYj5nUiW/l9wQtXMJUD2hg=",
+        "narHash": "sha256-KJtxaK9Ws9DimBKdrZFs3iHjUHF/V1WviJx5A2zk86c=",
-        "owner": "cachix",
+        "owner": "caelestia-dots",
-        "repo": "devenv",
+        "repo": "shell",
-        "rev": "c9f0b47815a4895fadac87812de8a4de27e0ace1",
+        "rev": "065dac2957a1f31bd2d2f029cabb96f69921f72b",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "caelestia-dots",
-        "repo": "devenv",
+        "repo": "shell",
         "type": "github"
       }
     },
-    "flake-compat": {
+    "fenix": {
-      "flake": false,
+      "inputs": {
+        "nixpkgs": [
+          "jj-cz",
+          "alejandra",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
       "locked": {
-        "lastModified": 1761588595,
+        "lastModified": 1730615655,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "narHash": "sha256-2HBR3zLn57LXKNRtxBb+O+uDqHM4n0pz51rPayMl4cg=",
-        "owner": "edolstra",
+        "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "fenix",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "efeb50e2535b17ffd4a135e6e3e5fd60a525180c",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "flake-file": {
+      "locked": {
+        "lastModified": 1790698230,
+        "narHash": "sha256-24oUHm2evb57Dgu46X41rLY9ue/au47nxbaUTo6lJVc=",
+        "owner": "vic",
+        "repo": "flake-file",
+        "rev": "91280a19eede3b3035e3889a3523c27e8fc07886",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vic",
+        "repo": "flake-file",
         "type": "github"
       }
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "devenv",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1760948891,
+        "lastModified": 1788450739,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -152,51 +163,37 @@
         "type": "github"
       }
     },
-    "git-hooks": {
+    "flake-utils_3": {
       "inputs": {
-        "flake-compat": [
+        "systems": "systems_3"
-          "devenv",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "devenv",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1760663237,
+        "lastModified": 1731533236,
-        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "cachix",
+        "owner": "numtide",
-        "repo": "git-hooks.nix",
+        "repo": "flake-utils",
-        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "numtide",
-        "repo": "git-hooks.nix",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
-    "gitignore": {
+    "flakeCompat": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs": [
-          "devenv",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1709087332,
+        "lastModified": 1696426674,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "gitignore.nix",
+        "repo": "flake-compat",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "gitignore.nix",
+        "repo": "flake-compat",
         "type": "github"
       }
     },
@@ -207,11 +204,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761878381,
+        "lastModified": 1788229478,
-        "narHash": "sha256-lCRaipHgszaFZ1Cs8fdGJguVycCisBAf2HEFgip5+xU=",
+        "narHash": "sha256-G0F2rFORVcFkEvVdE/qWQTnYekIc77YP5/vRF9nZlxU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4ac96eb21c101a3e5b77ba105febc5641a8959aa",
+        "rev": "1dc2d1f720ab17fc7981e087346bf54b26d284b1",
         "type": "github"
       },
       "original": {
@@ -220,43 +217,64 @@
         "type": "github"
       }
     },
-    "nix": {
+    "import-tree": {
-      "inputs": {
-        "flake-compat": [
-          "devenv",
-          "flake-compat"
-        ],
-        "flake-parts": [
-          "devenv",
-          "flake-parts"
-        ],
-        "git-hooks-nix": [
-          "devenv",
-          "git-hooks"
-        ],
-        "nixpkgs": [
-          "devenv",
-          "nixpkgs"
-        ],
-        "nixpkgs-23-11": [
-          "devenv"
-        ],
-        "nixpkgs-regression": [
-          "devenv"
-        ]
-      },
       "locked": {
-        "lastModified": 1761648602,
+        "lastModified": 1788467110,
-        "narHash": "sha256-H97KSB/luq/aGobKRuHahOvT1r7C03BgB6D5HBZsbN8=",
+        "narHash": "sha256-ljEMTXP/rH0tOvDzc9gzwww6KcHRPRnEHzd9lK48V7s=",
-        "owner": "cachix",
+        "owner": "vic",
-        "repo": "nix",
+        "repo": "import-tree",
-        "rev": "3e5644da6830ef65f0a2f7ec22830c46285bfff6",
+        "rev": "eb1b52eaecc57f7c136d07ae8a93e724dfecac46",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "vic",
-        "ref": "devenv-2.30.6",
+        "repo": "import-tree",
-        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "jj-cz": {
+      "inputs": {
+        "alejandra": "alejandra",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1781867614,
+        "narHash": "sha256-GHy8hEZtToo7FLxEZm0x/pn/fjg1w9sx7ZP9hRd1fcM=",
+        "ref": "develop",
+        "rev": "d2c48605aac4ca9580d8a34aad4c65371c5a7cc1",
+        "revCount": 52,
+        "type": "git",
+        "url": "https://labs.phundrak.com/phundrak/jj-cz"
+      },
+      "original": {
+        "ref": "develop",
+        "type": "git",
+        "url": "https://labs.phundrak.com/phundrak/jj-cz"
+      }
+    },
+    "m3shapes": {
+      "inputs": {
+        "nixpkgs": [
+          "caelestia-shell",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787906858,
+        "narHash": "sha256-YZelgEZflFNwGutX4/tIzBdbOeghJgE2oDw0uWYGxns=",
+        "owner": "soramanew",
+        "repo": "m3shapes",
+        "rev": "32ad9ce328bb77ed349b40a3be10ee9ea610b8ab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "soramanew",
+        "repo": "m3shapes",
+        "rev": "32ad9ce328bb77ed349b40a3be10ee9ea610b8ab",
         "type": "github"
       }
     },
@@ -267,11 +285,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761451000,
+        "lastModified": 1788080100,
-        "narHash": "sha256-qBJL6xEIjqYq9zOcG2vf2nPTeVBppNJzvO0LuQWMwMo=",
+        "narHash": "sha256-n14luQo3F/ZLfCEHk1QieiI1nGnW92ZQZeZ0UIb0UMQ=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "ed6b293161b378a7368cda38659eb8d3d9a0dac4",
+        "rev": "dbb978fa87faf13398e90ccbc52c343d21c7dd6d",
         "type": "github"
       },
       "original": {
@@ -282,11 +300,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761907660,
+        "lastModified": 1788179007,
-        "narHash": "sha256-kJ8lIZsiPOmbkJypG+B5sReDXSD1KGu2VEPNqhRa/ew=",
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fb006b87f04c4d3bdf08cfdbc7fab9c13d94a15",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
         "type": "github"
       },
       "original": {
@@ -296,13 +314,59 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgsPinetab2Kernel": {
+      "locked": {
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "type": "github"
+      }
+    },
+    "nixpkgsStable": {
+      "locked": {
+        "lastModified": 1782847189,
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-25.11",
+        "type": "indirect"
+      }
+    },
     "pumo-system-info": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1748984111,
@@ -321,37 +385,111 @@
     "quickshell": {
       "inputs": {
         "nixpkgs": [
+          "caelestia-shell",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1761897390,
+        "lastModified": 1787994703,
-        "narHash": "sha256-er4gYrIoThYLjlsOMTysoRfn67d1Gci+ZpqDrtQxrA0=",
+        "narHash": "sha256-6SUZyyALo19heYPa/Xmu2H4zV+wvdfVX4fTcqbgHRnI=",
         "ref": "refs/heads/master",
-        "rev": "fc704e6b5d445899a1565955268c91942a4f263f",
+        "rev": "2d3b3e9c70ef380dff751b61d334dc88df016c29",
-        "revCount": 700,
+        "revCount": 856,
         "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
+        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
       },
       "original": {
         "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
+        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
+      }
+    },
+    "rockchip": {
+      "inputs": {
+        "nixpkgsStable": [
+          "nixpkgsStable"
+        ],
+        "nixpkgsUnstable": [
+          "nixpkgsPinetab2Kernel"
+        ],
+        "utils": [
+          "flake-utils"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778273074,
+        "narHash": "sha256-gPbn0KjsgS2cJa/ENSMtjN0h8dIEy+2N6g8tw9915pM=",
+        "owner": "raboof",
+        "repo": "nixos-rockchip",
+        "rev": "2aab433a41cc9ba862ae73012acdd2eec3547667",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raboof",
+        "ref": "pinetab-linux-7.0",
+        "repo": "nixos-rockchip",
+        "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "claude-desktop": "claude-desktop",
+        "caelestia-shell": "caelestia-shell",
-        "devenv": "devenv",
+        "flake-file": "flake-file",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
         "home-manager": "home-manager",
+        "import-tree": "import-tree",
+        "jj-cz": "jj-cz",
         "nix-index-database": "nix-index-database",
         "nixpkgs": "nixpkgs",
+        "nixpkgsPinetab2Kernel": "nixpkgsPinetab2Kernel",
+        "nixpkgsStable": "nixpkgsStable",
         "pumo-system-info": "pumo-system-info",
-        "quickshell": "quickshell",
+        "rockchip": "rockchip",
         "sops-nix": "sops-nix",
+        "spicetify": "spicetify",
+        "srvos": "srvos",
         "zen-browser": "zen-browser"
       }
     },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730555913,
+        "narHash": "sha256-KNHZUlqsEibg3YtfUyOFQSofP8hp1HKoY+laoesBxRM=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "f17a5bbfd0969ba2e63a74505a80e55ecb174ed9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "jj-cz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779992051,
+        "narHash": "sha256-4YWGv/0NkAdtTW1MXfaLYpfC9BhpCy9k1pWkR0xI9uw=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "e93ad0df1073b2c969a8f0c1f10b84e870469d40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "pumo-system-info",
@@ -379,11 +517,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760998189,
+        "lastModified": 1786629091,
-        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
+        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
+        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
         "type": "github"
       },
       "original": {
@@ -392,6 +530,47 @@
         "type": "github"
       }
     },
+    "spicetify": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1788263070,
+        "narHash": "sha256-Mw163zYcjr59hB2JMC1iKU1Y69SNKZ2r/haXZ07UWQY=",
+        "owner": "Gerg-L",
+        "repo": "spicetify-nix",
+        "rev": "27ff19b00338052e8a504e1d1a34efad82c4bb26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Gerg-L",
+        "repo": "spicetify-nix",
+        "type": "github"
+      }
+    },
+    "srvos": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788143273,
+        "narHash": "sha256-YXleehtVHiLcH2+V0lSrl5Nmo2c+J11tI3+l4l9q3AQ=",
+        "owner": "nix-community",
+        "repo": "srvos",
+        "rev": "e4d3f8fe5f1d4246d32177315edf8d9104f1c32b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "srvos",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -422,6 +601,36 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "zen-browser": {
       "inputs": {
         "nixpkgs": [
@@ -429,11 +638,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761883599,
+        "lastModified": 1788083005,
-        "narHash": "sha256-ntnfAAqSuXI/+uqXAWUjbY5arB7sRK9cpgFbHbCZgK8=",
+        "narHash": "sha256-e6U3sXUlu/QzZyJp/+ymW8s57Jbdb7bwT9+WaTAhHfQ=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "5355c0dc6857a2aa34b126fb4a93a454ed702f52",
+        "rev": "afbbbef7c3c00f160f4a9dfdd8c6c6b8b089a33f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,158 +1,79 @@
+# DO-NOT-EDIT. This file was auto-generated using github:denful/flake-file.
+# Use `nix run .#write-flake` to regenerate it.
 {
-  description = "Home Manager configuration of phundrak";
+  description = "NixOS and Home Manager configuration of phundrak";
+
+  outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
+
+  nixConfig = {
+    extra-experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    extra-substituters = [
+      "https://phundrak.cachix.org?priority=10"
+      "https://nix-community.cachix.org?priority=20"
+      "https://cache.nixos.org?priority=40"
+    ];
+    extra-trusted-public-keys = [
+      "phundrak.cachix.org-1:osJAkYO0ioTOPqaQCIXMfIRz1/+YYlVFkup3R2KSexk="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+    http-connections = 128;
+  };
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    caelestia-shell = {
-
+      url = "github:caelestia-dots/shell";
-    devenv = {
-      url = "github:cachix/devenv";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    flake-file.url = "github:vic/flake-file";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    flake-utils.url = "github:numtide/flake-utils";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    import-tree.url = "github:vic/import-tree";
+    jj-cz = {
+      url = "git+https://labs.phundrak.com/phundrak/jj-cz?ref=develop";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    nixpkgsPinetab2Kernel.url = "github:nixos/nixpkgs/e73de5be04e0eff4190a1432b946d469c794e7b4";
+    nixpkgsStable.url = "nixpkgs/nixos-25.11";
     pumo-system-info = {
       url = "git+https://labs.phundrak.com/phundrak/pumo-system-info";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    rockchip = {
-    quickshell = {
+      url = "github:raboof/nixos-rockchip/pinetab-linux-7.0";
-      url = "git+https://git.outfoxxed.me/quickshell/quickshell";
+      inputs = {
-      inputs.nixpkgs.follows = "nixpkgs";
+        nixpkgsStable.follows = "nixpkgsStable";
+        nixpkgsUnstable.follows = "nixpkgsPinetab2Kernel";
+        utils.follows = "flake-utils";
+      };
     };
-
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    spicetify = {
-    claude-desktop = {
+      url = "github:Gerg-L/spicetify-nix";
-      url = "github:k3d3/claude-desktop-linux-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    srvos = {
+      url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-
-  nixConfig = {
-    extra-trusted-public-keys = "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw=";
-    extra-substituters = "https://devenv.cachix.org";
-  };
-
-  outputs = {
-    self,
-    nixpkgs,
-    home-manager,
-    devenv,
-    ...
-  } @ inputs: let
-    inherit (self) outputs;
-    system = "x86_64-linux";
-    pkgs = nixpkgs.legacyPackages.${system};
-  in {
-    formatter.${system} = pkgs.alejandra;
-
-    packages.${system} = {
-      devenv-up = self.devShells.${system}.default.config.procfileScript;
-      devenv-test = self.devShells.${system}.default.config.test;
-    };
-
-    devShells.${system}.default = devenv.lib.mkShell {
-      inherit inputs pkgs;
-      modules = [
-        (
-          {pkgs, ...}: {
-            packages = [pkgs.nh];
-            git-hooks.hooks = {
-              alejandra.enable = true;
-              commitizen.enable = true;
-              detect-private-keys.enable = true;
-              end-of-file-fixer.enable = true;
-              deadnix.enable = true;
-              ripsecrets.enable = true;
-              statix.enable = true;
-            };
-          }
-        )
-      ];
-    };
-
-    homeConfigurations = let
-      extraSpecialArgs = {inherit inputs outputs system;};
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-    in {
-      "phundrak@alys" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/alys.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@marpa" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/marpa.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@gampo" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/gampo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-      "phundrak@tilo" = home-manager.lib.homeManagerConfiguration {
-        inherit extraSpecialArgs pkgs;
-        modules = [
-          ./users/phundrak/host/tilo.nix
-          inputs.sops-nix.homeManagerModules.sops
-        ];
-      };
-    };
-
-    nixosConfigurations = let
-      specialArgs = {inherit inputs outputs;};
-    in {
-      alys = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/alys/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      gampo = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/gampo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      marpa = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/marpa/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-      tilo = nixpkgs.lib.nixosSystem {
-        inherit specialArgs;
-        modules = [
-          ./hosts/tilo/configuration.nix
-          inputs.sops-nix.nixosModules.sops
-        ];
-      };
-    };
-  };
 }

hosts/alys/configuration.nix

@@ -1,41 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    ./hardware-configuration.nix
-    inputs.home-manager.nixosModules.default
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      kernel.hardened = true;
-      systemd-boot = false;
-      zram = {
-        enable = true;
-        memoryMax = 512;
-      };
-    };
-    dev.docker.enable = true;
-    networking = {
-      hostname = "alys";
-      domain = "phundrak.com";
-      id = "41157110";
-    };
-    packages.nix = {
-      gc.automatic = true;
-      trusted-users = ["root" "phundrak"];
-    };
-    services = {
-      endlessh.enable = true;
-      ssh = {
-        enable = true;
-        allowedUsers = ["phundrak"];
-        passwordAuthentication = false;
-      };
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-  system.stateVersion = "23.11";
-}

hosts/alys/hardware-configuration.nix

@@ -1,28 +0,0 @@
-{
-  modulesPath,
-  lib,
-  ...
-}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-  boot = {
-    loader.grub = {
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-      device = "nodev";
-    };
-    initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-    initrd.kernelModules = ["nvme"];
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/vda1";
-      fsType = "ext4";
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/F137-8D01";
-      fsType = "vfat";
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/gampo/configuration.nix

@@ -1,85 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}: {
-  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      plymouth.enable = true;
-      kernel = {
-        cpuVendor = "intel";
-        package = pkgs.linuxPackages;
-        modules = ["i915"];
-      };
-      systemd-boot = true;
-    };
-    desktop = {
-      hyprland.enable = true;
-      xserver = {
-        enable = true;
-        de = "gnome";
-      };
-    };
-    dev.docker = {
-      enable = true;
-      podman.enable = true;
-      autoprune.enable = true;
-    };
-    hardware = {
-      bluetooth.enable = true;
-      input = {
-        corne.allowHidAccess = true;
-        ibmTrackpoint.disable = true;
-        opentablet.enable = true;
-      };
-      sound.enable = true;
-    };
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "gampo";
-      id = "0630b33f";
-      hostFiles = [config.sops.secrets.extraHosts.path];
-    };
-    packages = {
-      appimage.enable = true;
-      flatpak.enable = true;
-      nix = {
-        nix-ld.enable = true;
-        trusted-users = ["root" "phundrak"];
-      };
-    };
-    programs.steam.enable = true;
-    services = {
-      fwupd.enable = true;
-      ssh.enable = true;
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  sops.secrets.extraHosts = {
-    inherit (config.users.users.root) group;
-    owner = config.users.users.phundrak.name;
-    mode = "0440";
-  };
-
-  security.rtkit.enable = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database
-  # versions on your system were taken. It‘s perfectly fine and
-  # recommended to leave this value at the release version of the
-  # first install of this system. Before changing this value read
-  # the documentation for this option (e.g. man configuration.nix or
-  # on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-}

hosts/marpa/configuration.nix

@@ -1,117 +0,0 @@
-{
-  config,
-  inputs,
-  ...
-}: {
-  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
-    ../../system
-  ];
-
-  mySystem = {
-    boot = {
-      extraModprobeConfig = ''
-        options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
-      '';
-      plymouth.enable = true;
-      kernel.cpuVendor = "amd";
-      systemd-boot = true;
-    };
-    desktop = {
-      hyprland.enable = true;
-      niri.enable = true;
-      waydroid.enable = true;
-      xserver = {
-        enable = true;
-        de = "gnome";
-      };
-    };
-    dev = {
-      docker = {
-        enable = true;
-        podman.enable = true;
-        autoprune.enable = true;
-      };
-      qemu.enable = true;
-    };
-    hardware = {
-      amdgpu.enable = true;
-      bluetooth.enable = true;
-      input = {
-        corne.allowHidAccess = true;
-        opentablet.enable = true;
-      };
-      sound = {
-        enable = true;
-        jack = true;
-        scarlett.enable = true;
-      };
-    };
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "marpa";
-      id = "7EA4A111";
-      hostFiles = [config.sops.secrets.extraHosts.path];
-      firewall.openPortRanges = [
-        {
-          # Sunshine
-          from = 1714;
-          to = 1764;
-        }
-      ];
-    };
-    packages = {
-      appimage.enable = true;
-      flatpak.enable = true;
-      nix = {
-        nix-ld.enable = true;
-        trusted-users = ["root" "phundrak"];
-      };
-    };
-    programs.steam.enable = true;
-    services = {
-      fwupd.enable = true;
-      printing.enable = true;
-      ssh.enable = true;
-      sunshine = {
-        enable = true;
-        autostart = true;
-      };
-      languagetool.enable = true;
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  sops.secrets.extraHosts = {
-    inherit (config.users.users.root) group;
-    owner = config.users.users.phundrak.name;
-    mode = "0440";
-  };
-
-  services.udev.extraHwdb = ''
-    mouse:usb:047d:80a6:*
-     LIBINPUT_MIDDLE_EMULATION_ENABLED=1
-  '';
-
-  security = {
-    polkit.enable = true;
-    rtkit.enable = true;
-  };
-
-  fileSystems."/games" = {
-    device = "/dev/disk/by-uuid/77d32db8-2e85-4593-b6b8-55d4f9d14e1a";
-    fsType = "ext4";
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
-}

hosts/marpa/services/default.nix

@@ -1,24 +0,0 @@
-{
-  # imports = [
-  #   ./logind.nix
-  #   ../../../system
-  # ];
-  # imports = [
-  #   ./logind.nix
-  #   ../../../modules/ssh.nix
-  #   ../../../modules/sunshine.nix
-  # ];
-
-  # modules = {
-  #   sunshine = {
-  #     enable = true;
-  #     autostart = true;
-  #   };
-  # };
-  # services = {
-  #   blueman.enable = true;
-  #   fwupd.enable = true;
-  #   printing.enable = true;
-  #   openssh.enable = true;
-  # };
-}

hosts/marpa/services/gnome.nix

@@ -1,11 +0,0 @@
-{
-  services.xserver = {
-    enable = true;
-    displayManager.gdm.enable = true;
-    desktopManager.gnome.enable = true;
-    xkb = {
-      layout = "fr";
-      variant = "bepo_afnor";
-    };
-  };
-}

hosts/marpa/services/logind.nix

@@ -1,6 +0,0 @@
-{
-  services.logind = {
-    powerKey = "ignore";
-    powerKeyLongPress = "ignore";
-  };
-}

hosts/tilo/configuration.nix

@@ -1,67 +0,0 @@
-# Edit this configuration file to define what should be installed on your
-# system.  Help is available in the configuration.nix(5) man page and in
-# the NixOS manual (accessible by running ‘nixos-help’).
-{inputs, ...}: {
-  imports = [
-    ./hardware-configuration.nix
-    inputs.home-manager.nixosModules.default
-    ../../system
-    ./services
-  ];
-
-  mySystem = {
-    boot = {
-      kernel = {
-        hardened = true;
-        cpuVendor = "amd";
-      };
-      zfs = {
-        enable = true;
-        pools = ["tank"];
-      };
-    };
-    dev.docker.enable = true;
-    misc.keymap = "fr-bepo";
-    networking = {
-      hostname = "tilo";
-      id = "7110b33f";
-      firewall = {
-        openPorts = [
-          80 # HTTP
-          443 # HTTPS
-          25565 # Minecraft
-        ];
-      };
-    };
-    packages.nix = {
-      gc.automatic = true;
-      trusted-users = ["root" "phundrak"];
-    };
-    services = {
-      calibre.enable = true;
-      endlessh.enable = true;
-      jellyfin.enable = true;
-      plex = {
-        enable = true;
-        dataDir = "/tank/web/stacks/plex/plex-config";
-      };
-      ssh = {
-        enable = true;
-        allowedUsers = ["phundrak"];
-        passwordAuthentication = false;
-      };
-    };
-    users = {
-      root.disablePassword = true;
-      phundrak.enable = true;
-    };
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
-}

hosts/tilo/services/default.nix

@@ -1,3 +0,0 @@
-{
-  imports = [./nextcloud-cron.nix];
-}

hosts/tilo/services/nextcloud-cron.nix

@@ -1,33 +0,0 @@
-{pkgs, ...}: {
-  systemd = {
-    timers."nextcloud-cron" = {
-      wantedBy = ["timers.target"];
-      timerConfig = {
-        OnBootSec = "20m";
-        OnUnitActiveSec = "20m";
-        Unit = "nextcloud-cron.service";
-      };
-    };
-    services."nextcloud-cron" = {
-      script = ''
-        CONTAINER_NAME="nextcloud-nextcloud-1"
-
-        is_container_running() {
-          ${pkgs.docker}/bin/docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null | grep -q "true"
-        }
-
-        while ! is_container_running; do
-            echo "Waiting for $CONTAINER_NAME to start..."
-            sleep 10
-        done
-
-        echo "$CONTAINER_NAME is running. Executing CRON job..."
-        ${pkgs.docker}/bin/docker exec -u www-data -it nextcloud-nextcloud-1 php /var/www/html/cron.php
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-      };
-    };
-  };
-}

keys/id_alys.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTv1lb6d99O84jeh6GdjPm8Gnt/HncSRhGhmoTq7BMK lucien@phundrak.com

modules/boot/hardened.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.nixos.hardened = {
+    boot = {
+      kernelModules = ["tcp_bbr"];
+      kernel.sysctl = {
+        "kernel.sysrq" = 0;
+        "net.ipv4.icmp_echo_ignore_broadcasts" = 1;
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default_accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        "net.ipv4.tcp_syncookies" = 1;
+        "net.ipv4.tcp_rfc1337" = 1;
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.core.default_qdisc" = "cake";
+        "net.ipv4.tcp_fastopen" = 3;
+      };
+    };
+  };
+}

modules/boot/hardened.org

@@ -0,0 +1,116 @@
+#+title: Kernel Hardening
+#+setupfile: ../headers
+
+* Kernel Hardening
+Some of my machines are exposed to the Internet, and therefore get
+their kernel hardened. First, let me declare the Nix file’s skeleton,
+with the =nixos.hardened= module.
+
+#+begin_src nix :tangle yes
+{
+  flake.modules.nixos.hardened = {
+    boot = {
+      <<kernel-modules>>
+      <<kernel-options>>
+    };
+  };
+}
+#+end_src
+
+** Kernel Modules
+The very first thing to do is to load the =tcp_bbr= kernel module. It
+increases the connection speed of the system with a better congestion
+control. It is particularly interesting for my servers, as they may
+have to deal with high traffic if a crawler ever decides to explore
+all webpages offered by some websites I host. See [[https://www.cyberciti.biz/cloud-computing/increase-your-linux-server-internet-speed-with-tcp-bbr-congestion-control/][this article]] by
+Nixcraft for more details.
+#+name: kernel-modules
+#+begin_src nix
+kernelModules = ["tcp_bbr"];
+#+end_src
+
+** Kernel Options
+Next are a series of kernel options.
+#+name: kernel-options
+#+begin_src nix
+kernel.sysctl = {
+  <<sysrq-key>>
+  <<icmp>>
+  <<icmp-no-accept-redirects>>
+  <<icmp-no-send-redirects>>
+  <<ip-source-route-packets>>
+  <<syn>>
+  <<tcp-time-wait>>
+  <<bufferfloat>>
+  <<latency>>
+};
+#+end_src
+
+First, we’ll disable the magic SysRq key. Not that I expect anyone to
+have physical access to my servers, but it is a really powerful tool
+that I’d rather have off.
+#+name: sysrq-key
+#+begin_src nix
+"kernel.sysrq" = 0;
+#+end_src
+
+Next, we’ll ignore ICMP broadcasts to avoid participating in Smurf
+attacks, and we’ll also ignore ICMP errors.
+#+name: icmp
+#+begin_src nix
+"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
+"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+#+end_src
+
+Speaking of ICMP, we won’t accept ICMP redirects to prevent some MITM
+attacks.
+#+name: icmp-no-accept-redirects
+#+begin_src nix
+"net.ipv4.conf.all.accept_redirects" = 0;
+"net.ipv4.conf.default_accept_redirects" = 0;
+"net.ipv4.conf.all.secure_redirects" = 0;
+"net.ipv4.conf.default.secure_redirects" = 0;
+"net.ipv6.conf.all.accept_redirects" = 0;
+"net.ipv6.conf.default.accept_redirects" = 0;
+#+end_src
+
+And we won’t send ICMP redirects (we’re not a router).
+#+name: icmp-no-send-redirects
+#+begin_src nix
+"net.ipv4.conf.all.send_redirects" = 0;
+#+end_src
+
+We’re stil not a router, so we’ll refuse IP source route packets, both
+on IPV4 and IPV6.
+#+name: ip-source-route-packets
+#+begin_src nix
+"net.ipv4.conf.all.accept_source_route" = 0;
+"net.ipv6.conf.all.accept_source_route" = 0;
+#+end_src
+
+Now, let’s get some SYN flood protection.
+#+name: syn
+#+begin_src nix
+"net.ipv4.tcp_syncookies" = 1;
+#+end_src
+
+And protection against TCP time-wait assassination hazards.
+#+name: tcp-time-wait
+#+begin_src nix
+"net.ipv4.tcp_rfc1337" = 1;
+#+end_src
+
+We will also mitigate bufferfloat, including with BBR (hey, we enabled that above!)
+#+name: bufferfloat
+#+begin_src nix
+"net.ipv4.tcp_congestion_control" = "bbr";
+"net.core.default_qdisc" = "cake";
+#+end_src
+
+And lastly, we’ll reduce latency on IPV4.
+#+name: latency
+#+begin_src nix
+"net.ipv4.tcp_fastopen" = 3;
+#+end_src
+
+And we should be good to go!

modules/boot/kernel.nix

@@ -0,0 +1,53 @@
+{config, ...}: let
+  flakeModules = config.flake.modules;
+in {
+  flake.modules.nixos.kernel = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot.kernel;
+    in {
+      imports = [flakeModules.nixos.amdgpu];
+
+      options.mySystem.boot.kernel = {
+        package = mkOption {
+          type = types.raw;
+          default = pkgs.linuxPackages_zen;
+        };
+        modules = mkOption {
+          type = types.listOf types.str;
+          default = [];
+        };
+        cpuVendor = mkOption {
+          description = "Intel or AMD?";
+          type = types.enum ["intel" "amd"];
+          default = "amd";
+        };
+        v4l2loopback.enable = mkEnableOption "Enables v4l2loopback kernel module";
+        extraModprobeConfig = mkOption {
+          type = types.lines;
+          default = "";
+          example = ''
+            options snd_usb_audio vid=0x1235 pid=0x8212 device_setup=1
+          '';
+        };
+      };
+
+      config.boot = {
+        initrd.kernelModules = lib.lists.singleton (
+          if config.mySystem.hardware.amdgpu.enable
+          then "amdgpu"
+          else "i915"
+        );
+        extraModprobeConfig =
+          strings.concatLines
+          ([cfg.extraModprobeConfig]
+            ++ lists.optional cfg.v4l2loopback.enable ''options v4l2loopback exclusive_caps=1 devices=1 video_nr=0 card_label="OBS Studio"'');
+        kernelPackages = cfg.package;
+        kernelModules = cfg.modules ++ ["kvm-${cfg.cpuVendor}"];
+      };
+    };
+}

modules/boot/loader.nix

@@ -0,0 +1,45 @@
+{
+  flake.modules.nixos.loader = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+      options.mySystem.boot = {
+        systemd-boot = mkOption {
+          type = types.bool;
+          default = !cfg.grub.enable;
+          description = "Does the system use systemd-boot?";
+        };
+        grub = {
+          enable = mkEnableOption "Does the system use GRUB? (Disables systemd-boot)";
+          device = mkOption {
+            type = types.path;
+            description = "The GRUB device";
+            default = "";
+          };
+        };
+        zfs = {
+          enable = mkEnableOption "Enables ZFS";
+          pools = mkOption {
+            type = types.listOf types.str;
+            default = [];
+          };
+        };
+      };
+
+      config.boot = {
+        loader = {
+          systemd-boot.enable = cfg.systemd-boot;
+          efi.canTouchEfiVariables = cfg.systemd-boot;
+          grub = mkIf cfg.grub.enable {
+            inherit (cfg.grub) enable device;
+          };
+        };
+        supportedFilesystems = mkIf cfg.zfs.enable ["zfs"];
+        zfs.extraPools = mkIf cfg.zfs.enable cfg.zfs.pools;
+      };
+    };
+}

modules/boot/loader.org

@@ -0,0 +1,74 @@
+#+title: Bootloaders and Filesystems
+#+setupfile: ../headers
+
+* Bootloaders and Filesystems
+This page sets up the bootloader of my machines. Whilst I generally
+prefer to use [[https://systemd.io/BOOT/][systemd-boot]], some of my VPS use GRUB, and some use ZFS.
+All that gets exposed with my module =nixos.loader=.
+
+#+begin_src nix :tangle loader.new.nix
+{
+  flake.modules.nixos.loader = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot;
+    in {
+
+    };
+}
+#+end_src
+
+** Bootloaders
+By default, I want to use systemd-boot on my machines, but I need it
+to be disabled whenever I use something else. For now, this “something
+else” is only GRUB, but I’m not excluding using something else on yet
+another machine such as [[https://www.rodsbooks.com/refind/][rEFInd]]. To ensure a single source of truth
+regarding whether systemd-boot is to be used, I have an option for
+that.
+#+name: systemd-boot-options
+#+begin_src nix
+options.mySystem.boot.systemd-boot = mkOption {
+  type = types.bool;
+  default = !cfg.grub.enable;
+  description = "Does the system use systemd-boot?";
+};
+#+end_src
+
+I can now set some options depending on that, such as whether to
+enable systemd-boot itself (duh), and whether the installation process
+can touch my EFI variables.
+#+name: systemd-boot-config
+#+begin_src nix
+config.boot.loader = {
+  systemd-boot.enable = cfg.systemd-boot;
+  efi.canTouchEfiVariables = cfg.systemd-boot;
+};
+#+end_src
+
+But, I have a VPS that requires me to use GRUB. For this, I also have
+an option to enable it.
+#+name: grub-options
+#+begin_src nix
+options.mySystem.boot.grub = {
+  enable = mkEnableOption "Does the system use GRUB? (Disables systemd-boot)";
+  device = mkOption {
+    type = types.path;
+    description = "The GRUB device";
+    default = "";
+  };
+};
+#+end_src
+
+I can no pass these options to the boot configuration of my machine.
+#+name: grub-config
+#+begin_src nix
+config.boot.loader.grub = mkIf cfg.grub.enable {
+  inherit (cfg.grub) enable device;
+};
+#+end_src
+
+** ZFS
+Now, this is where I enable

modules/boot/plymouth.nix

@@ -0,0 +1,35 @@
+{
+  flake.modules.nixos.plymouth = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.boot.plymouth;
+    in {
+      options.mySystem.boot.plymouth.enable = mkEnableOption "Enables Plymouth at system boot";
+      config.boot = mkIf cfg.enable {
+        plymouth = {
+          inherit (cfg) enable;
+          theme = "circle_hud";
+          themePackages = with pkgs; [
+            (adi1090x-plymouth-themes.override {
+              selected_themes = ["circle_hud"];
+            })
+          ];
+        };
+        consoleLogLevel = 3;
+        initrd.verbose = false;
+        kernelParams = [
+          "quiet"
+          "splash"
+          "boot.shell_on_fail"
+          "udev.log_priority=3"
+          "rd.systemd.show_status=auto"
+        ];
+        # Loader appears only if a key is pressed
+        loader.timeout = 0;
+      };
+    };
+}

modules/default.nix

@@ -0,0 +1,105 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}: {
+  imports = [
+    inputs.flake-parts.flakeModules.modules
+    inputs.flake-file.flakeModules.default
+  ];
+
+  options.flake.homeConfigurations = lib.mkOption {
+    type = lib.types.lazyAttrsOf lib.types.raw;
+    default = {};
+  };
+
+  config = {
+    flake-file.inputs = {
+      flake-utils.url = "github:numtide/flake-utils";
+      nixpkgsPinetab2Kernel.url = "github:nixos/nixpkgs/e73de5be04e0eff4190a1432b946d469c794e7b4";
+      rockchip = {
+        url = "github:raboof/nixos-rockchip/pinetab-linux-7.0";
+        inputs.utils.follows = "flake-utils";
+        inputs.nixpkgsStable.follows = "nixpkgsStable";
+        inputs.nixpkgsUnstable.follows = "nixpkgsPinetab2Kernel";
+      };
+    };
+    systems = ["x86_64-linux" "aarch64-linux"];
+
+    flake.lib = {
+      mkNixos = system: name: {
+        ${name} = inputs.nixpkgs.lib.nixosSystem {
+          modules = [
+            config.flake.modules.nixos.${name}
+            {nixpkgs.hostPlatform = lib.mkDefault system;}
+          ];
+        };
+      };
+      mkHome = system: userName: hostName: {
+        "${userName}@${hostName}" = inputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = inputs.nixpkgs.legacyPackages.${system};
+          extraSpecialArgs = {
+            inherit inputs;
+            bunBaseline = config.flake.packages.${system}.bun-baseline;
+          };
+          modules = [config.flake.modules.homeManager."${userName}-${hostName}"];
+        };
+      };
+      mkPinetab = buildPlatform: variantModule: {
+        pinetab2 = inputs.nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          modules = [
+            inputs.rockchip.nixosModules.sdImageRockchip
+            inputs.rockchip.nixosModules.dtOverlayPCIeFix
+            inputs.rockchip.nixosModules.noZFS
+            config.flake.modules.nixos.pinetab2-base
+            variantModule
+            {
+              rockchip.uBoot = inputs.rockchip.packages.${buildPlatform}.uBootPineTab2;
+              boot.kernelPackages =
+                inputs.rockchip.legacyPackages.${buildPlatform}.kernel_linux_7_0_pinetab_unstable;
+              hardware.firmware = [inputs.rockchip.packages.aarch64-linux.bes2600];
+              nixpkgs.config.allowUnfreePredicate = pkg:
+                builtins.elem (inputs.nixpkgs.lib.getName pkg) ["bes2600-firmware"];
+            }
+          ];
+        };
+      };
+    };
+
+    flake.nixosConfigurations = lib.mkMerge [
+      (config.flake.lib.mkNixos "x86_64-linux" "marpa")
+      (config.flake.lib.mkNixos "x86_64-linux" "gampo")
+      (config.flake.lib.mkNixos "x86_64-linux" "tilo")
+      (config.flake.lib.mkNixos "x86_64-linux" "elcafe")
+      (config.flake.lib.mkNixos "x86_64-linux" "NaroMk3")
+      (config.flake.lib.mkPinetab "x86_64-linux" config.flake.modules.nixos.pinetab2-gnome)
+    ];
+    
+    flake.homeConfigurations = lib.mkMerge [
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "marpa")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "gampo")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "tilo")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "elcafe")
+      (config.flake.lib.mkHome "x86_64-linux" "creug" "elcafe")
+      (config.flake.lib.mkHome "x86_64-linux" "phundrak" "NaroMk3")
+      (config.flake.lib.mkHome "aarch64-linux" "phundrak" "pinetab2")
+    ];
+    perSystem = {
+      pkgs,
+      system,
+      ...
+    }: {
+      formatter = pkgs.alejandra;
+      devShells.default = pkgs.mkShell {
+        buildInputs = [
+          pkgs.nh
+          pkgs.jujutsu
+          pkgs.git
+          inputs.jj-cz.packages.${system}.default
+        ];
+      };
+    };
+  };
+}

modules/desktop/hyprland-homeManager.nix

@@ -0,0 +1,185 @@
+{
+  flake.modules.homeManager.hyprland = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.hyprland;
+      laptops = ["gampo"];
+      caelestiaEnabled = config.home.desktop.caelestia.enable;
+    in {
+      options.home.desktop.hyprland = {
+        enable = mkEnableOption "Enables Hyprland";
+        emacsPkg = mkOption {
+          type = types.package;
+          default = config.home.dev.editors.emacs.package or pkgs.emacs;
+          example = pkgs.emacs;
+        };
+        host = mkOption {
+          type = types.enum ["gampo" "marpa"];
+          description = ''
+            Which host is Hyprland running on.
+
+            This helps determine the monitors layout and enable battery support in waybar.
+          '';
+        };
+      };
+
+      config = mkIf cfg.enable {
+        home.desktop = {
+          hyprpaper.enable = mkDefault (! caelestiaEnabled);
+          rofi.enable = mkDefault true;
+          swaync.enable = mkDefault (! caelestiaEnabled);
+          waybar = {
+            enable = mkDefault (! caelestiaEnabled);
+            battery = mkDefault (builtins.elem cfg.host laptops);
+          };
+          wlsunset.enable = mkDefault true;
+        };
+        services.blueman-applet.enable = ! caelestiaEnabled;
+        wayland.windowManager.hyprland = {
+          enable = true;
+          systemd.enable = false;
+          importantPrefixes = ["$left" "$right" "$up" "$down" "$menu"];
+          settings = {
+            env = [
+              "XMODIFIERS,@im=fcitx"
+              "XCURSOR_SIZE,12"
+            ];
+            input = {
+              kb_layout = "fr,us";
+              kb_variant = "bepo_afnor,";
+              numlock_by_default = true;
+              follow_mouse = 1;
+              touchpad.natural_scroll = false;
+              sensitivity = "0";
+            };
+            device = {
+              name = "wacom-usb-bamboo-pad-finger";
+              sensitivity = 0.5;
+            };
+            monitor =
+              {
+                "marpa" = [
+                  "DP-1, 3440x1440@144, 1080x550, 1"
+                  # "DP-1, 2560x1440@144, 1080x550, 1" # streaming
+                  "DP-2, 2560x1080@60, 0x0, 1, transform, 1"
+                ];
+                "gampo" = [];
+              }."${cfg.host}";
+            general = {
+              gaps_in = 5;
+              gaps_out = 20;
+              border_size = 2;
+              "col.active_border" = "rgb(81a1c1) rgb(a3be8c) 45deg";
+              "col.inactive_border" = "rgb(4c566a)";
+              layout = "master";
+            };
+            master = {
+              orientation = "center";
+              new_status = "inherit";
+            };
+            workspace = [
+              "1, layoutopt:orientation:bottom"
+              "9, layoutopt:orientation:bottom"
+              "10, layoutopt:orientation:bottom"
+            ];
+            decoration = {
+              rounding = 20;
+            };
+            animations = {
+              enabled = true;
+              animation = [
+                # "windows, 1, 7, myBezier"
+                "windowsOut, 1, 7, default, popin 80%"
+                "border, 1, 10, default"
+                "borderangle, 1, 8, default"
+                "fade, 1, 7, default"
+                "workspaces, 1, 6, default"
+              ];
+            };
+            dwindle.preserve_split = true;
+            exec-once =
+              [
+                "pactl load-module module-switch-on-connect"
+                "${pkgs.mpc}/bin/mpc stop"
+                "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"
+                "${pkgs.mozc}/lib/mozc/mozc_server"
+                "${pkgs.fcitx5}/bin/fcitx5 -d"
+              ]
+              ++ lib.lists.optional (! caelestiaEnabled) "${pkgs.networkmanagerapplet}/bin/nm-applet";
+          };
+          extraConfig = ''
+            device {
+              name = wacom-usb-bamboo-pad-finger
+              sensitivity = 0.5
+              accel_profile = adaptive
+            }
+
+            $left = c
+            $right = r
+            $up = s
+            $down = t
+            $menu = rofi -combi-modi drun,calc -show combi
+
+            bind = SUPER, Return, exec, ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux
+            bind = SUPER, Space,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key
+            bind =      , Print,  exec, ${pkgs.wlr-which-key}/bin/wlr-which-key -k s
+
+            bindl = , XF86AudioPlay, exec, playerctl play-pause
+            bindl = , XF86AudioPause, exec, playerctl pause
+            bindl = , XF86AudioStop, exec, playerctl stop
+            bindl = , XF86AudioPrev, exec, playerctl previous
+            bindl = , XF86AudioNext, exec, playerctl next
+            bindl = , XF86AudioForward, exec, playerctl position +1
+            bindl = , XF86AudioRewind, exec, playerctl position -1
+            bindl = , XF86AudioRaiseVolume, exec, pamixer -i 2
+            bindl = , XF86AudioLowerVolume, exec, pamixer -d 2
+            bindl = , XF86MonBrightnessUp, exec, xbacklight -perceived -inc 2
+            bindl = , XF86MonBrightnessDown, exec, xbacklight -perceived -dec 2
+            bindl = , XF86KbdBrightnessUp, exec, xbacklight -perceived -inc 2
+            bindl = , XF86KbdBrightnessDown, exec, xbacklight -perceived -dec 2
+            bind = SUPER, a, exec, hyprctl switchxkblayout glove80-keyboard next
+            bind = SUPER, $left, movefocus, l
+            bind = SUPER, $right, movefocus, r
+            bind = SUPER, $up, movefocus, u
+            bind = SUPER, $down, movefocus, d
+            bind = SUPER_SHIFT, $left, movewindow, l
+            bind = SUPER_SHIFT, $right, movewindow, r
+            bind = SUPER_SHIFT, $up, movewindow, u
+            bind = SUPER_SHIFT, $down, movewindow, d
+            bind = SUPER_CTRL_SHIFT, $left, moveworkspacetomonitor, e+0 +1
+            bind = SUPER_CTRL_SHIFT, $right, moveworkspacetomonitor, e+0 -1
+            bind = SUPER, Tab, cyclenext,
+            bind = SUPER_SHIFT, Tab, cyclenext, prev
+            bindm = SUPER, mouse:272, movewindow
+            bindm = SUPER, mouse:273, resizewindow
+            bind = SUPER, quotedbl, workspace, 1
+            bind = SUPER, guillemotleft, workspace, 2
+            bind = SUPER, guillemotright, workspace, 3
+            bind = SUPER, parenleft, workspace, 4
+            bind = SUPER, parenright, workspace, 5
+            bind = SUPER, at, workspace, 6
+            bind = SUPER, plus, workspace, 7
+            bind = SUPER, minus, workspace, 8
+            bind = SUPER, slash, workspace, 9
+            bind = SUPER, asterisk, workspace, 10
+            bind = SUPER, mouse_down, workspace, e+1
+            bind = SUPER, mouse_up, workspace, e-1
+            bind = SUPER_SHIFT, quotedbl, movetoworkspace, 1
+            bind = SUPER_SHIFT, guillemotleft, movetoworkspace, 2
+            bind = SUPER_SHIFT, guillemotright, movetoworkspace, 3
+            bind = SUPER_SHIFT, parenleft, movetoworkspace, 4
+            bind = SUPER_SHIFT, parenright, movetoworkspace, 5
+            bind = SUPER_SHIFT, at, movetoworkspace, 6
+            bind = SUPER_SHIFT, plus, movetoworkspace, 7
+            bind = SUPER_SHIFT, minus, movetoworkspace, 8
+            bind = SUPER_SHIFT, slash, movetoworkspace, 9
+            bind = SUPER_SHIFT, asterisk, movetoworkspace, 10
+          '';
+        };
+      };
+    };
+}

modules/desktop/hyprland-nixos.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.nixos.hyprland = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.hyprland;
+    in {
+      options.mySystem.desktop.hyprland.enable = mkEnableOption "Enables Hyprland";
+      config.programs.hyprland = mkIf cfg.enable {
+        inherit (cfg) enable;
+        withUWSM = true;
+      };
+    };
+}

modules/desktop/niri.nix

@@ -0,0 +1,15 @@
+{
+  flake.modules.nixos.niri = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.niri;
+    in {
+      options.mySystem.desktop.niri.enable = mkEnableOption "Enables Niri";
+      config.programs.niri = mkIf cfg.enable {
+        inherit (cfg) enable;
+      };
+    };
+}

modules/desktop/waydroid.nix

@@ -0,0 +1,20 @@
+{
+  flake.modules.nixos.waydroid = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.waydroid;
+    in {
+      options.mySystem.desktop.waydroid.enable = mkEnableOption "Enables Waydroid";
+      config = mkIf cfg.enable {
+        virtualisation.waydroid = {
+          enable = cfg.enable;
+          package = pkgs.waydroid-nftables;
+        };
+        environment.systemPackages = [pkgs.waydroid-helper];
+      };
+    };
+}

modules/desktop/xserver.nix

@@ -0,0 +1,47 @@
+{
+  flake.modules.nixos.xserver = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.desktop.xserver;
+    in {
+      options.mySystem.desktop.xserver = {
+        enable = mkEnableOption "Enables xserver";
+        de = mkOption {
+          type = types.enum ["gnome" "kde"];
+          default = "gnome";
+          example = "kde";
+          description = "Which DE to enable";
+        };
+      };
+      config.services = mkIf cfg.enable {
+        displayManager = {
+          sddm.enable = mkIf (cfg.de == "kde") true;
+          gdm.enable = mkIf (cfg.de == "gnome") true;
+        };
+        desktopManager = {
+          plasma6.enable = mkIf (cfg.de == "kde") true;
+          gnome.enable = mkIf (cfg.de == "gnome") true;
+        };
+
+        gnome = mkIf (cfg.de == "gnome") {
+          gnome-browser-connector.enable = true;
+          games.enable = false;
+          gnome-remote-desktop.enable = true;
+          gnome-online-accounts.enable = true;
+          sushi.enable = true;
+        };
+
+        xserver = {
+          inherit (cfg) enable;
+          videoDrivers = lists.optional config.mySystem.hardware.amdgpu.enable "amdgpu";
+          xkb = {
+            layout = "fr";
+            variant = "bepo_afnor";
+          };
+        };
+      };
+    };
+}

modules/dev/qemu.nix

@@ -0,0 +1,35 @@
+{
+  flake.modules.nixos.qemu = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.dev.qemu;
+    in {
+      options.mySystem.dev.qemu = {
+        enable = mkEnableOption "Enable QEMU";
+        users = mkOption {
+          type = types.listOf types.str;
+          default = ["phundrak"];
+          example = ["user1" "user2"];
+        };
+      };
+      config = mkIf cfg.enable {
+        programs.virt-manager.enable = true;
+        users.groups.libvirtd.members = cfg.users;
+        virtualisation = {
+          libvirtd.enable = true;
+          spiceUSBRedirection.enable = true;
+        };
+        environment.systemPackages = with pkgs; [
+          qemu
+          quickemu
+          swtpm
+        ];
+        systemd.tmpfiles.rules = ["L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware"];
+        boot.binfmt.emulatedSystems = ["aarch64-linux"];
+      };
+    };
+}

modules/hardware/amdgpu.nix

@@ -0,0 +1,64 @@
+{
+  flake.modules.nixos.amdgpu = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.amdgpu;
+    in {
+      options.mySystem.hardware.amdgpu.enable = mkEnableOption "Enables an AMD GPU configuration";
+      config = mkIf cfg.enable {
+        hardware = {
+          graphics = {
+            enable = true;
+            enable32Bit = true;
+            extraPackages = with pkgs; [
+              mesa # Mesa drivers for AMD GPUs
+              rocmPackages.clr # common language runtime for ROCm
+              rocmPackages.clr.icd # ROCm ICD for OpenCL
+              rocmPackages.rocblas # ROCm BLAS library
+              rocmPackages.hipblas #
+              rocmPackages.rpp # High-performance computer vision library
+              nvtopPackages.amd # GPU utilization monitoring
+            ];
+          };
+          amdgpu = {
+            initrd.enable = true;
+            opencl.enable = true;
+          };
+        };
+        environment.systemPackages = with pkgs; [
+          clinfo
+          amdgpu_top
+          nvtopPackages.amd
+        ];
+        systemd = {
+          packages = with pkgs; [lact];
+          services.lactd.wantedBy = ["multi-user.target"];
+          tmpfiles.rules = let
+            rocmEnv = pkgs.symlinkJoin {
+              name = "rocm-combined";
+              paths = with pkgs.rocmPackages; [
+                clr
+                clr.icd
+                rocblas
+                hipblas
+                rpp
+              ];
+            };
+          in [
+            "L+    /opt/rocm   -    -    -     -    ${rocmEnv}"
+          ];
+        };
+        environment.variables = {
+          ROCM_PATH = "/opt/rocm"; # Set ROCm path
+          HIP_VISIBLE_DEVICES = "1"; # Use only the eGPU (ID 1)
+          ROCM_VISIBLE_DEVICES = "1"; # Optional: ROCm equivalent for visibility
+          # LD_LIBRARY_PATH = "/opt/rocm/lib";         # Add ROCm libraries
+          HSA_OVERRIDE_GFX_VERSION = "10.3.0"; # Set GFX version override
+        };
+      };
+    };
+}

modules/hardware/bluetooth.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.nixos.bluetooth = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.bluetooth;
+    in {
+      options.mySystem.hardware.bluetooth.enable = mkEnableOption "Enable bluetooth";
+      config = mkIf cfg.enable {
+        hardware.bluetooth.enable = cfg.enable;
+        services.blueman.enable = cfg.enable;
+      };
+    };
+}

modules/hardware/fingerprint.nix

@@ -0,0 +1,15 @@
+{
+  flake.modules.nixos.fingerprint = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.fingerprint;
+    in {
+      options.mySystem.hardware.fingerprint.enable = mkEnableOption "Enable fingerprint reader";
+      config = mkIf cfg.enable {
+        hardware.facter.detected.fingerprint.enable = cfg.enable;
+      };
+    };
+}

modules/hardware/firmware.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.firmware = {lib, ...}: {
+    hardware.enableAllFirmware = lib.mkDefault true;
+  };
+}

modules/hardware/input/corne.nix

@@ -0,0 +1,17 @@
+{
+  flake.modules.nixos.corne = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.input.corne;
+    in {
+      options.mySystem.hardware.input.corne.allowHidAccess = mkEnableOption "Enable HID access to the corne keyboard";
+      config.services.udev = mkIf cfg.allowHidAccess {
+        extraRules = ''
+          KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
+        '';
+      };
+    };
+}

modules/hardware/input/ibm-trackpoint.nix

@@ -0,0 +1,17 @@
+{
+  flake.modules.nixos.ibm-trackpoint = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.input.ibmTrackpoint;
+    in {
+      options.mySystem.hardware.input.ibmTrackpoint.disable = mkEnableOption "Disable IBM’s trackpoint on ThinkPad";
+      config.services.udev = mkIf cfg.disable {
+        extraRules = ''
+          ATTRS{name}=="*TPPS/2 IBM TrackPoint", ENV{ID_INPUT}="", ENV{ID_INPUT_MOUSE}="", ENV{ID_INPUT_POINTINGSTICK}=""
+        '';
+      };
+    };
+}

modules/hardware/input/opentablet.nix

@@ -0,0 +1,19 @@
+{
+  flake.modules.nixos.opentablet = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.input.opentablet;
+    in {
+      options.mySystem.hardware.input.opentablet.enable = mkEnableOption "Enables OpenTablet drivers";
+      config = mkIf cfg.enable {
+        hardware.opentabletdriver = {
+          inherit (cfg) enable;
+          daemon.enable = true;
+        };
+        boot.kernelModules = ["wacom"];
+      };
+    };
+}

modules/hardware/input/trackball.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.trackball = {
+    services.libinput.mouse.middleEmulation = true;
+  };
+}

modules/hardware/pinetab2.nix

@@ -0,0 +1,14 @@
+{
+  flake.modules.nixos.pinetab2 = {lib, ...}:
+    with lib; {
+      options.mySystem.hardware.pinetab2.enable = mkEnableOption "Activate support for the PineTab2";
+      config = {
+        boot.kernelParams = ["console=tty0" "console=ttyS2,1500000n8" "rootwait" "root=LABEL=NIXOS_SD" "rw"];
+        hardware.sensor.iio.enable = true;
+        services.avahi = {
+          enable = true;
+          openFirewall = true;
+        };
+      };
+    };
+}

modules/hardware/sound.nix

@@ -0,0 +1,53 @@
+{
+  flake.modules.nixos.sound = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.mySystem.hardware.sound;
+    in {
+      options.mySystem.hardware.sound = {
+        enable = mkEnableOption "Whether to enable sounds with Pipewire";
+        noisetorch = mkEnableOption "Whether to activate noisetorch support";
+        scarlett.enable = mkEnableOption "Activate support for Scarlett sound card";
+        alsa = mkOption {
+          type = types.bool;
+          example = true;
+          default = true;
+          description = "Whether to enable ALSA support with Pipewire";
+        };
+        jack = mkOption {
+          type = types.bool;
+          example = true;
+          default = false;
+          description = "Whether to enable JACK support with Pipewire";
+        };
+        package = mkOption {
+          type = types.package;
+          example = pkgs.pulseaudio;
+          default = pkgs.pulseaudioFull;
+          description = "Which base package to use for PulseAudio";
+        };
+      };
+
+      config = {
+        environment.systemPackages = mkIf cfg.scarlett.enable [pkgs.alsa-scarlett-gui];
+        services = {
+          pipewire = mkIf cfg.enable {
+            enable = true;
+            alsa = mkIf cfg.alsa {
+              enable = mkDefault true;
+              support32Bit = mkDefault true;
+            };
+            jack.enable = mkDefault cfg.jack;
+          };
+          pulseaudio.enable = false;
+        };
+        programs.noisetorch = mkIf cfg.enable {
+          enable = cfg.noisetorch;
+        };
+      };
+    };
+}

modules/headers

@@ -0,0 +1,22 @@
+# -*- mode: org -*-
+#+AUTHOR: Lucien Cartier-Tilet
+#+EMAIL: lucien@phundrak.com
+#+CREATOR: Lucien Cartier-Tilet
+#+LANGUAGE: en
+
+# ### ORG OPTIONS ##############################################################
+
+#+options: H:4 broken_links:mark email:t ^:{} tex:dvisvgm toc:nil
+#+KEYWORDS: dotfiles, linux, emacs, configuration, phundrak, drakpa
+#+startup: content align hideblocks
+#+property: header-args:emacs-lisp :noweb yes :exports none :eval yes :cache yes
+#+property: header-args:nix :exports code :tangle no :noweb no-export
+#+property: header-args:dot :dir img :exports results :eval yes :cache yes :class gentree
+
+# ### MACROS ###################################################################
+#+macro: phon @@html:/$1/@@
+#+macro: newline @@html:<br>@@
+#+macro: latex-html @@latex:$1@@@@html:$2@@
+#+macro: v @@html:<span class=vertical>$1</span>@@
+#+macro: begin-largetable @@html:<div class="largetable">@@
+#+macro: end-largetable @@html:</div>@@

modules/home/base.nix

@@ -0,0 +1,40 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.home-base = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home;
+    in {
+      imports = [
+        m.basics
+        m.cli
+        m.desktop
+        m.dev
+        m.media
+        m.my-services
+        m.security
+        m.shell
+      ];
+
+      options.home = {
+        fullDesktop = mkEnableOption "Enable most modules";
+        gpuType = mkOption {
+          type = types.nullOr (types.enum ["nvidia" "amd" "intel"]);
+          default = null;
+          example = "amd";
+        };
+      };
+      config.home = {
+        cli.fullDesktop = mkDefault cfg.fullDesktop;
+        desktop.fullDesktop = mkDefault cfg.fullDesktop;
+        dev.fullDesktop = mkDefault cfg.fullDesktop;
+        media.fullDesktop = mkDefault cfg.fullDesktop;
+        security.fullDesktop = mkDefault cfg.fullDesktop;
+        myServices.fullDesktop = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/basics.nix

@@ -0,0 +1,12 @@
+{
+  flake.modules.homeManager.basics = {
+    programs = {
+      fd.enable = true;
+      fzf.enable = true;
+      home-manager.enable = true;
+      htop.enable = true;
+      jq.enable = true;
+      ripgrep.enable = true;
+    };
+  };
+}

modules/home/cli/_scripts/launcher.nix

@@ -0,0 +1,23 @@
+{pkgs, ...}:
+pkgs.writeShellScriptBin "app-launcher" ''
+  LOG_FILE="$HOME/.local/share/app-launcher.log"
+
+  logger() {
+      local level="$1"
+      local message="$2"
+      local timestamp
+      timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+      printf "[%s] [%-7s] %s\n" "$timestamp" "''${level^^}" "$message" >> "$LOG_FILE"
+  }
+
+  CAELESTIA_ACTIVE=$(systemctl --user is-active caelestia.service)
+  logger debug "Caelestia activity: $CAELESTIA_ACTIVE"
+
+  if systemctl --user is-active caelestia.service | grep 'active' &> /dev/null ; then
+      logger info "Using Caelestia app launcher"
+       caelestia shell drawers toggle launcher || \
+          logger error "failed to launch Caelestia app launcher"
+      exit 0
+  fi
+  rofi -show drun
+''

modules/home/cli/_scripts/mp42webm.nix

@@ -1,3 +1,3 @@
 {pkgs, ...}:
 pkgs.writeShellScriptBin "mp42webm" ''
-  ${pkgs.ffmpeg}/bin/ffmpeg -i "$1" -c:v libvpx -crf 10 -b:v 1M -c:a libvorbis "$1".webm''
+  ${pkgs.ffmpeg}/bin/ffmpeg -i "$1" -c:v libvpx -crf 10 -b:v 1M -c:a -hwaccel=auto libvorbis "$1".webm''

modules/home/cli/_scripts/plock.nix

@@ -0,0 +1,40 @@
+{pkgs, ...}:
+pkgs.writeShellScriptBin "plock" ''
+  LOG_FILE="$HOME/.local/share/plock.log"
+
+  logger() {
+      local level="$1"
+      local message="$2"
+      local timestamp
+      timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+      printf "[%s] [%-7s] %s\n" "$timestamp" "''${level^^}" "$message" >> "$LOG_FILE"
+  }
+
+  CAELESTIA_ACTIVE=$(systemctl --user is-active caelestia.service)
+  logger debug "Caelestia activity: $CAELESTIA_ACTIVE"
+  if systemctl --user is-active caelestia.service | grep 'active' &> /dev/null ; then
+      logger info "locking Caelestia session"
+      caelestia shell lock lock || \
+          logger error "failed to lock Caelestia session"
+      exit 0
+  fi
+
+  TMPBG="/tmp/screen.png"
+  if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
+      logger info "wayland session detected"
+      SCREENER=${pkgs.grim}/bin/grim
+      LOCKER="${pkgs.swaylock}/bin/swaylock -feF"
+  else
+      logger info "x11 session detected"
+      SCREENER=${pkgs.scrot}/bin/scrot
+      LOCKER="${pkgs.i3lock}/bin/i3lock -ef"
+  fi
+
+  $SCREENER "$TMPBG"
+  logger info "generating lock screen image"
+  ${pkgs.corrupter}/bin/corrupter -add 0 "$TMPBG" "$TMPBG" || logger error "failed to generate lock screen image"
+  logger info "locking screen"
+  logger debug "locking screen with command `''${SCREENER}`"
+  $LOCKER -ti "$TMPBG"
+  rm "$TMPBG"
+''

modules/home/cli/bat.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.homeManager.bat = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.bat;
+    in {
+      options.home.cli.bat.extras = mkEnableOption "Enables extra packages for bat.";
+      config.programs.bat = {
+        enable = true;
+        config = {
+          theme = "Nord";
+          map-syntax = [
+            ".spacemacs*:Lisp"
+          ];
+        };
+        extraPackages = mkIf cfg.extras (with pkgs.bat-extras; [
+          batman
+          batpipe
+        ]);
+      };
+    };
+}

modules/home/cli/btop.nix

@@ -0,0 +1,36 @@
+{
+  flake.modules.homeManager.btop = {
+    pkgs,
+    config,
+    ...
+  }: let
+    inherit (config.home) gpuType;
+  in {
+    programs.btop = {
+      enable = true;
+      package =
+        if gpuType != null
+        then
+          pkgs.btop.override {
+            rocmSupport = gpuType == "amd";
+            cudaSupport = gpuType == "nvidia";
+          }
+        else pkgs.btop;
+      settings = {
+        color_theme = "${pkgs.btop}/share/btop/themes/nord.theme";
+        cpu_bottom = false;
+        cpu_sensor = "auto";
+        io_graph_combined = false;
+        io_mode = true;
+        only_physical = true;
+        proc_tree = true;
+        rounded_corners = true;
+        show_disks = true;
+        show_gpu_info = "on";
+        show_uptime = true;
+        theme_background = true;
+        vim_keys = false;
+      };
+    };
+  };
+}

modules/home/cli/cli.nix

@@ -0,0 +1,33 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.cli = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli;
+    in {
+      imports = [
+        m.bat
+        m.btop
+        m.direnv
+        m.eza
+        m.mu
+        m.nh
+        m.nix-index
+        m.scripts
+        m.tealdeer
+        m.yt-dlp
+      ];
+
+      options.home.cli.fullDesktop = mkEnableOption "Enable all optional modules and options";
+      config.home.cli = {
+        bat.extras = mkDefault cfg.fullDesktop;
+        mu.enable = mkDefault cfg.fullDesktop;
+        scripts.enable = mkDefault cfg.fullDesktop;
+        yt-dlp.enable = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/cli/direnv.nix

@@ -0,0 +1,12 @@
+{
+  flake.modules.homeManager.direnv = {
+    programs.direnv = {
+      enable = true;
+      config.global = {
+        load_dotenv = true;
+        hide_env_diff = true;
+      };
+      nix-direnv.enable = true;
+    };
+  };
+}

modules/home/cli/eza.nix

@@ -0,0 +1,10 @@
+{
+  flake.modules.homeManager.eza = {
+    programs.eza = {
+      enable = true;
+      colors = "auto";
+      icons = "auto";
+      git = true;
+    };
+  };
+}

modules/home/cli/mu.nix

@@ -0,0 +1,13 @@
+{
+  flake.modules.homeManager.mu = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.mu;
+    in {
+      options.home.cli.mu.enable = mkEnableOption "Enable mu";
+      config.programs.mu.enable = cfg.enable;
+    };
+}

modules/home/cli/nh.nix

@@ -0,0 +1,22 @@
+{
+  flake.modules.homeManager.nh = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.nh;
+    in {
+      options.home.cli.nh.flake = mkOption {
+        type = types.path;
+        default = "/home/phundrak/.dotfiles";
+        example = "/etc/nixos";
+      };
+      config.programs.nh = {
+        enable = true;
+        clean.enable = true;
+        clean.extraArgs = "--keep-since 15d --keep 5";
+        inherit (cfg) flake;
+      };
+    };
+}

modules/home/cli/nix-index.nix

@@ -0,0 +1,17 @@
+{inputs, ...}: {
+  flake-file.inputs.nix-index-database = {
+    url = "github:nix-community/nix-index-database";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.nix-index = {
+    imports = [
+      inputs.nix-index-database.homeModules.nix-index
+    ];
+
+    programs = {
+      nix-index.enable = true;
+      nix-index-database.comma.enable = true;
+    };
+  };
+}

modules/home/cli/scripts.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.homeManager.scripts = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.scripts;
+      scriptFiles = filesystem.listFilesRecursive ./_scripts;
+      scripts = map (file: (import file {inherit pkgs config;})) scriptFiles;
+    in {
+      options.home.cli.scripts.enable = mkEnableOption "Add custom scripts to PATH";
+      config.home.packages = mkIf cfg.enable scripts;
+    };
+}

modules/home/cli/tealdeer.nix

@@ -0,0 +1,8 @@
+{
+  flake.modules.homeManager.tealdeer = {
+    programs.tealdeer = {
+      enable = true;
+      enableAutoUpdates = true;
+    };
+  };
+}

modules/home/cli/yt-dlp.nix

@@ -0,0 +1,20 @@
+{
+  flake.modules.homeManager.yt-dlp = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.cli.yt-dlp;
+    in {
+      options.home.cli.yt-dlp.enable = mkEnableOption "Enable yt-dlp";
+      config.programs.yt-dlp = mkIf cfg.enable {
+        inherit (cfg) enable;
+        settings = {
+          embed-thumbnail = true;
+          embed-subs = true;
+          sub-langs = "all";
+        };
+      };
+    };
+}

modules/home/creug/default.nix

@@ -0,0 +1,71 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.creug = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.creug;
+    in {
+      imports = [m.home-base];
+
+      options.home.creug = {
+        sshKey = {
+          content = mkOption {
+            type = types.nullOr types.str;
+            example = "ssh-ed25519 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+            default = null;
+          };
+          file = mkOption {
+            type = with types; nullOr path;
+            default = "/home/creug/.ssh/id_ed25519.pub";
+          };
+        };
+      };
+
+      config = {
+        nixpkgs.config.allowUnfree = true;
+
+        home = {
+          username = "creug";
+          homeDirectory = "/home/creug";
+          packages = [pkgs.tree pkgs.ncdu];
+          preferXdgDirectories = true;
+
+          creug.sshKey.file = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+
+          dev.vcs = {
+            name = "Creug";
+            email = "gregory.foulachon@gmail.com";
+            editor = "${pkgs.nano}/bin/nano";
+            jj = {
+              enable = true;
+              cz = {
+                enable = true;
+                alias = true;
+              };
+            };
+            git.enable = true;
+            publicKey = cfg.sshKey;
+          };
+
+          security.ssh.enable = true;
+
+          shell = {
+            bash.enable = true;
+            zsh.enable = true;
+            starship.enable = true;
+            tmux.enable = false;
+            zoxide.enable = false;
+          };
+
+          stateVersion = "24.11"; # Do not modify!
+        };
+
+        manual.manpages.enable = true;
+      };
+    };
+}

modules/home/creug/hosts/elcafe.nix

@@ -0,0 +1,13 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager."creug-elcafe" = {...}: {
+    imports = [m.creug];
+
+    home = {
+      cli.nh.flake = "/home/creug/.dotfiles";
+      dev.editors.emacs.enable = false;
+      creug.sshKey.content = builtins.readFile ../keys/id_elcafe.pub;
+    };
+  };
+}

modules/home/creug/keys/id_elcafe.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBdd4cNNhONjhuH4jWZ8Z8K1gbBmeDNqRybKRHMQEvZj gregoryfoulachon@googlemail.com

modules/home/desktop/caelestia.nix

@@ -0,0 +1,98 @@
+{inputs, ...}: {
+  flake-file.inputs.caelestia-shell = {
+    url = "github:caelestia-dots/shell";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.caelestia = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.caelestia;
+    in {
+      imports = [inputs.caelestia-shell.homeManagerModules.default];
+
+      options.home.desktop.caelestia = {
+        enable = mkEnableOption "Enables Caelestia Shell";
+        idleTimeout = mkOption {
+          description = "Idle duration in seconds before locking the session";
+          default = 60 * 60; # an hour
+          type = types.int;
+        };
+      };
+      config.programs.caelestia = mkIf cfg.enable {
+        inherit (cfg) enable;
+        systemd = {
+          enable = true;
+          target = "graphical-session.target";
+          environment = ["QT3_QPA_PLATFORMTHEME=gtk3"];
+        };
+        settings = {
+          paths.wallpaperDir = "~/Pictures/Wallpapers/nord";
+          general = {
+            apps = {
+              terminal = ["kitty"];
+              audio = ["pavucontrol"];
+              playback = ["mpv"];
+              explorer = ["${pkgs.nemo-with-extensions}/bin/nemo"];
+            };
+            idle = {
+              inhibitWhenAudio = true;
+              timeouts = [
+                {
+                  timeout = cfg.idleTimeout;
+                  idleAction = "lock";
+                }
+              ];
+            };
+          };
+          background = {
+            desktopClock.enabled = true;
+            visualiser.enabled = true;
+          };
+          dashboard = {
+            enabled = true;
+            showOnHover = true;
+          };
+          launcher = {
+            enabled = true;
+            showOnHover = false;
+            useFuzzy = {
+              apps = true;
+              schemes = true;
+              wallpapers = true;
+            };
+          };
+          osd.enableMicrophone = true;
+          bar = {
+            status = {
+              showAudio = true;
+              showKbLayout = false;
+            };
+            tray.compact = true;
+          };
+          services = mkIf (config.home.gpuType != null) {
+            inherit (config.home) gpuType;
+          };
+          session.commands = {
+            logout = ["uwsm" "stop"];
+            shutdown = ["systemctl" "poweroff"];
+            hibernate = ["systemctl" "hibernate"];
+            reboot = ["systemctl" "reboot"];
+          };
+          utilities.toasts = {
+            capsLockChanged = false;
+            numLockChanged = false;
+            kbLayoutChanged = false;
+          };
+        };
+        cli = {
+          enable = true;
+          settings.theme.enableGtk = true;
+        };
+      };
+    };
+}

modules/home/desktop/desktop.nix

@@ -0,0 +1,44 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.desktop = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop;
+    in {
+      imports = [
+        m.caelestia
+        m.firefox
+        m.hyprland
+        m.hyprpaper
+        m.kdeconnect
+        m.kitty
+        m.obs
+        m.rofi
+        m.spotify
+        m.swaync
+        m.theme
+        m.waybar
+        m.wl-kbptr
+        m.wlr-which-key
+        m.wlsunset
+      ];
+
+      options.home.desktop.fullDesktop = mkEnableOption "Enable options for graphical environments";
+      config.home.desktop = {
+        firefox.enable = mkDefault cfg.fullDesktop;
+        hyprland.enable = mkDefault cfg.fullDesktop;
+        kdeconnect.enable = mkDefault cfg.fullDesktop;
+        kitty.enable = mkDefault cfg.fullDesktop;
+        obs.enable = mkDefault cfg.fullDesktop;
+        rofi.enable = mkDefault cfg.fullDesktop;
+        spotify.enable = mkDefault cfg.fullDesktop;
+        spotify.spicetify.enable = mkDefault cfg.fullDesktop;
+        theme.enable = mkDefault cfg.fullDesktop;
+        wlr-which-key.enable = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/desktop/firefox.nix

@@ -0,0 +1,78 @@
+{inputs, ...}: {
+  flake-file.inputs.zen-browser = {
+    url = "github:youwen5/zen-browser-flake";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.firefox = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.firefox;
+      inherit (pkgs.stdenv.hostPlatform) system;
+      zen = inputs.zen-browser.packages.${system}.default;
+      settingsToLines = settings:
+        concatStringsSep "\n" (mapAttrsToList (name: value: "set ${name} ${toString value}") settings);
+    in {
+      options.home.desktop.firefox = {
+        enable = mkEnableOption "enable Firefox";
+        useZen = mkEnableOption "use Zen instead of Firefox";
+        tridactyl = {
+          enable = mkEnableOption "enable Tridactyl";
+          preConfig = mkOption {
+            description = "Lines to add to the beginning of tridactylrc";
+            type = types.lines;
+            default = "";
+          };
+          config = mkOption {
+            type = with types;
+              attrsOf (oneOf [
+                int
+                str
+                bool
+              ]);
+            description = "Tridactyl settings (converted to 'set key value' lines)";
+            default = {};
+            example = {
+              smoothscroll = true;
+              history = 1000;
+            };
+          };
+          extraConfig = mkOption {
+            description = "Extra lines to add to tridactylrc (for bindings, autocmds, etc)";
+            type = types.lines;
+            default = "";
+          };
+        };
+      };
+
+      config = mkIf cfg.enable {
+        home.sessionVariables.MOZ_ENABLE_WAYLAND = "1";
+        programs.firefox = {
+          inherit (cfg) enable;
+          package =
+            if cfg.useZen
+            then zen
+            else pkgs.firefox;
+          nativeMessagingHosts = lists.optional cfg.tridactyl.enable pkgs.tridactyl-native;
+          configPath = ".mozilla/firefox";
+        };
+        xdg.configFile."tridactyl/tridactylrc" = mkIf cfg.tridactyl.enable {
+          text = concatStringsSep "\n" (filter (s: s != "") [
+            cfg.tridactyl.preConfig
+            (settingsToLines (cfg.tridactyl.config
+              // {
+                browser =
+                  if cfg.useZen
+                  then "zen"
+                  else "firefox";
+              }))
+            cfg.tridactyl.extraConfig
+          ]);
+        };
+      };
+    };
+}

modules/home/desktop/hyprpaper.nix

@@ -0,0 +1,90 @@
+{
+  flake.modules.homeManager.hyprpaper = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.hyprpaper;
+    in {
+      options.home.desktop.hyprpaper = {
+        enable = mkEnableOption "Enables Hyprpaper";
+        default = mkOption {
+          type = types.str;
+          default = "/home/phundrak/Pictures/Wallpapers/nord/Nordic6.jpg";
+          example = "/home/user/image.jpg";
+        };
+        wallpapers-dir = mkOption {
+          type = types.str;
+          default = "/home/phundrak/Pictures/Wallpapers/nord/";
+          example = "/home/user/Pictures/";
+        };
+        rotation-interval = mkOption {
+          type = types.str;
+          default = "5m";
+          example = "10m";
+          description = "Interval between wallpaper rotations";
+        };
+      };
+      config = mkIf cfg.enable {
+        services.hyprpaper = {
+          inherit (cfg) enable;
+          settings = {
+            ipc = "on";
+            splash = false;
+            preload = cfg.default;
+            wallpaper = ", ${cfg.default}";
+          };
+        };
+        systemd.user = {
+          services.hyprpaper-rotation = {
+            Unit = {
+              Description = "Rotate Hyprpaper wallpaper";
+              After = "graphical-session.target";
+            };
+            Service = {
+              Type = "oneshot";
+              ExecCondition = "${pkgs.procps}/bin/pidof Hyprland";
+              ExecStart = "${config.home.homeDirectory}/.config/hypr/hyprpaper-rotate.sh";
+            };
+          };
+
+          timers.hyprpaper-rotation = {
+            Unit = {
+              Description = "Timer for rotating Hyprpaper wallpaper";
+            };
+            Timer = {
+              OnBootSec = cfg.rotation-interval;
+              OnUnitActiveSec = cfg.rotation-interval;
+            };
+            Install = {
+              WantedBy = ["timers.target"];
+            };
+          };
+        };
+        home.file.".config/hypr/hyprpaper-rotate.sh" = {
+          text = ''
+            #!/usr/bin/env bash
+            set -euo pipefail
+
+            WALLPAPER_DIR="${cfg.wallpapers-dir}"
+
+            # Find a random wallpaper
+            WP=$(find "$WALLPAPER_DIR" -type f \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" \) | shuf -n 1)
+
+            if [ -z "$WP" ]; then
+              echo "No wallpapers found in $WALLPAPER_DIR"
+              exit 1
+            fi
+
+            echo "Setting wallpaper to: $WP"
+
+            # Load and set the wallpaper
+            ${pkgs.hyprland}/bin/hyprctl hyprpaper preload "$WP" && ${pkgs.hyprland}/bin/hyprctl hyprpaper wallpaper ",$WP"
+          '';
+          executable = true;
+        };
+      };
+    };
+}

modules/home/desktop/kdeconnect.nix

@@ -0,0 +1,16 @@
+{
+  flake.modules.homeManager.kdeconnect = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.kdeconnect;
+    in {
+      options.home.desktop.kdeconnect.enable = mkEnableOption "Enable KDE Connect";
+      config.services.kdeconnect = mkIf cfg.enable {
+        enable = true;
+        indicator = true;
+      };
+    };
+}

modules/home/desktop/kitty.nix

@@ -0,0 +1,116 @@
+{
+  flake.modules.homeManager.kitty = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.kitty;
+    in {
+      options.home.desktop.kitty.enable = mkEnableOption "Enable kitty terminal";
+      config.programs.kitty = mkIf cfg.enable {
+        inherit (cfg) enable;
+        themeFile = "Nord";
+        font = {
+          package = pkgs.cascadia-code;
+          name = "Cascadia Code";
+          size = 10;
+        };
+        settings = {
+          enable_audio_bell = true;
+          visual_bell_duration = 0.1;
+          enabled_layouts = "fat,fat:mirrored=true,tall,tall:mirrored=true";
+          kitty_mod = "ctrl+shift";
+          disable_ligatures = "never";
+          font_features = "Cascadia-Mono +onum +zero";
+          cursor_shape = "block";
+          scrollback_lines = "10000";
+          mouse_hide_wait = 3.0;
+          detect_urls = true;
+          background_opacity = 0.7;
+        };
+        keybindings = let
+          prefix = "kitty_mod+space";
+        in {
+          "alt+c" = "copy_to_clipboard";
+          "kitty_mod+c" = "copy_to_clipboard";
+          "alt+v" = "paste_from_clipboard";
+          "kitty_mod+v" = "paste_from_clipboard";
+
+          "${prefix}>s>c" = "show_scrollback";
+          "${prefix}>s>down" = "scroll_line_down";
+          "${prefix}>s>t" = "scroll_line_down";
+          "${prefix}>s>up" = "scroll_line_up";
+          "${prefix}>s>s" = "scroll_line_up";
+          "${prefix}>s>end" = "scroll_end";
+          "${prefix}>s>home" = "scroll_home";
+          "${prefix}>s>page_down" = "scroll_page_down";
+          "${prefix}>s>page_up" = "scroll_page_up";
+
+          "${prefix}>enter" = "new_window";
+          "${prefix}>w>q" = "close_window";
+          "${prefix}>w>p" = "next_window";
+          "${prefix}>w>n" = "previous_window";
+          "${prefix}>w>f" = "move_window_forward";
+          "${prefix}>w>b" = "move_window_backward";
+          "${prefix}>w>t" = "move_window_to_top";
+          "${prefix}>w>r" = "start_resizing_window";
+          "${prefix}>w>1" = "first_window";
+          "${prefix}>w>2" = "second_window";
+          "${prefix}>w>3" = "third_window";
+          "${prefix}>w>4" = "fourth_window";
+          "${prefix}>w>5" = "fifth_window";
+          "${prefix}>w>6" = "sixth_window";
+          "${prefix}>w>7" = "seventh_window";
+          "${prefix}>w>8" = "eighth_window";
+          "${prefix}>w>9" = "ninth_window";
+          "${prefix}>w>0" = "tenth_window";
+
+          "${prefix}>tab>n" = "next_tab";
+          "${prefix}>tab>p" = "previous_tab";
+          "${prefix}>tab>c" = "new_tab";
+          "${prefix}>tab>q" = "close_tab";
+          "${prefix}>tab>shift+n" = "move_tab_backward";
+          "${prefix}>tab>shift+p" = "move_tab_forward";
+          "${prefix}>tab>t" = "set_tab_title";
+
+          "${prefix}>l" = "next_layout";
+
+          "${prefix}>f>equal" = "change_font_size all 0";
+          "${prefix}>f>kp_add" = "change_font_size all +2.0";
+          "${prefix}>f>plus" = "change_font_size all +2.0";
+          "${prefix}>f>kp_subtract" = "change_font_size all -2.0";
+          "${prefix}>f>minus" = "change_font_size all -2.0";
+
+          "${prefix}>shift+h" = "kitten hints";
+          "${prefix}>h>p" = "kitten hints --type path --program -";
+          "${prefix}>h>shift+p" = "kitten hints --type path";
+          "${prefix}>h>l" = "kitten hints --type line --program -";
+          "${prefix}>h>w" = "kitten hints --type word --program -";
+          "${prefix}>h>h" = "kitten hints --type hash --program -";
+          "${prefix}>h>n" = "kitten hints --type linenum";
+          "${prefix}>h>y" = "kitten hints --type hyperlink";
+
+          "${prefix}>f10" = "toggle_maximized";
+          "${prefix}>f11" = "toggle_fullscreen";
+
+          "${prefix}>a>equal" = "set_background_opacity 1";
+          "${prefix}>a>d" = "set_background_opacity default";
+          "${prefix}>a>plus" = "set_background_opacity +0.1";
+          "${prefix}>a>up" = "set_background_opacity +0.1";
+          "${prefix}>a>kp_add" = "set_background_opacity +0.1";
+          "${prefix}>a>minus" = "set_background_opacity -0.1";
+          "${prefix}>a>down" = "set_background_opacity -0.1";
+          "${prefix}>a>kp_substract" = "set_background_opacity -0.1";
+
+          "${prefix}>delete" = "clear_terminal reset active";
+          "${prefix}>escape" = "kitty_shell window";
+          "${prefix}>f2" = "edit_config_file";
+          "${prefix}>n" = "new_os_window";
+          "${prefix}>o" = "pass_selection_to_program";
+          "${prefix}>u" = "kitten unicode_input";
+        };
+      };
+    };
+}

modules/home/desktop/obs.nix

@@ -0,0 +1,29 @@
+{
+  flake.modules.homeManager.obs = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.obs;
+      obs-image-reaction = pkgs.callPackage ../../../packages/obs-image-reaction.nix {};
+    in {
+      options.home.desktop.obs.enable = mkEnableOption "Enables OBS Studio";
+      config.programs.obs-studio = mkIf cfg.enable {
+        inherit (cfg) enable;
+        plugins = with pkgs.obs-studio-plugins; [
+          input-overlay
+          obs-backgroundremoval
+          obs-markdown
+          obs-mute-filter
+          obs-pipewire-audio-capture
+          obs-scale-to-sound
+          obs-source-clone
+          obs-source-record
+          obs-tuna
+          obs-image-reaction
+        ];
+      };
+    };
+}

modules/home/desktop/rofi/rofi.nix

@@ -0,0 +1,109 @@
+{
+  flake.modules.homeManager.rofi = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.rofi;
+      inherit (config.lib.formats.rasi) mkLiteral;
+    in {
+      options.home.desktop.rofi = {
+        enable = mkEnableOption "Enable Rofi";
+      };
+      config = mkIf cfg.enable {
+        home.packages = with pkgs; [rofi-bluetooth];
+        programs.rofi = {
+          enable = true;
+          plugins = with pkgs; [
+            rofi-calc
+            rofi-emoji
+          ];
+          terminal = "${pkgs.kitty}/bin/kitty";
+          location = "center";
+          modes = ["drun" "emoji" "calc" "combi"];
+          extraConfig.show-icons = true;
+          theme = {
+            "*" = {
+              font = "Cascadia Code 14";
+              blur = true;
+              padding = mkLiteral "10px";
+              background-color = mkLiteral "transparent";
+              border-radius = mkLiteral "0px";
+            };
+            window = {
+              width = mkLiteral "1050px";
+              height = mkLiteral "625px";
+              location = mkLiteral "center";
+              blur = true;
+              border = mkLiteral "2px";
+              border-radius = mkLiteral "3px";
+              border-color = mkLiteral "#61afef";
+              background-color = mkLiteral "transparent";
+              padding = mkLiteral "0px";
+              margin = mkLiteral "30px 50px";
+            };
+            mainbox = {
+              orientation = mkLiteral "horizontal";
+              children = map mkLiteral ["borderbox"];
+              spacing = mkLiteral "0px";
+              padding = mkLiteral "0px";
+            };
+            borderbox = {
+              orientation = mkLiteral "horizontal";
+              children = map mkLiteral ["imagebox" "contentbox"];
+              padding = mkLiteral "0px";
+              spacing = mkLiteral "0px";
+              border-radius = mkLiteral "3px";
+            };
+            contentbox = {
+              orientation = mkLiteral "vertical";
+              children = map mkLiteral ["entry" "listview"];
+              spacing = mkLiteral "0px";
+              padding = mkLiteral "0px";
+              expand = true;
+            };
+            imagebox = {
+              background-image = mkLiteral "url(\"${./image.jpg}\")";
+              background-repeat = false;
+              size = mkLiteral "200px 625px";
+            };
+            element = {
+              border-radius = mkLiteral "0px";
+            };
+            "element-text, element-icon" = {
+              padding = mkLiteral "6px 8px";
+              spacing = mkLiteral "2px";
+              text-color = mkLiteral "#fab387";
+            };
+            "element selected" = {
+              background-color = mkLiteral "#191919";
+              text-color = mkLiteral "#e5c07b";
+              border-radius = mkLiteral "3px";
+            };
+            prompt = {
+              enabled = false;
+              background-color = mkLiteral "transparent";
+              text-color = mkLiteral "#61afef";
+              padding = mkLiteral "5px 10px";
+            };
+            entry = {
+              padding = mkLiteral "8px";
+              expand = false;
+              font = "Cascadia Code 14";
+              text-color = mkLiteral "#fab387";
+              border-radius = mkLiteral "0px 3px 0px 0px";
+              background-color = mkLiteral "#292e36";
+            };
+            listview = {
+              lines = mkLiteral "1";
+              background-color = mkLiteral "rgba(46, 52, 64, 0.8)";
+              border-radius = mkLiteral "0px 0px 3px 0px";
+              padding = mkLiteral "5px";
+            };
+          };
+        };
+      };
+    };
+}

modules/home/desktop/spotify.nix

@@ -0,0 +1,33 @@
+{inputs, ...}: {
+  flake-file.inputs.spicetify = {
+    url = "github:Gerg-L/spicetify-nix";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.spotify = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      inherit (pkgs.stdenv.hostPlatform) system;
+      cfg = config.home.desktop.spotify;
+      spicePkgs = inputs.spicetify.legacyPackages.${system};
+    in {
+      imports = [inputs.spicetify.homeManagerModules.default];
+
+      options.home.desktop.spotify = {
+        enable = mkEnableOption "Enable Spotify";
+        spicetify.enable = mkEnableOption "Enable Spicetify";
+      };
+      config.programs = mkIf cfg.enable {
+        spotify-player.enable = cfg.enable;
+        spicetify = mkIf cfg.spicetify.enable {
+          inherit (cfg.spicetify) enable;
+          theme = spicePkgs.themes.sleek;
+          colorScheme = "Nord";
+        };
+      };
+    };
+}

modules/home/desktop/swaync.nix

@@ -0,0 +1,17 @@
+{...}: {
+  flake.modules.homeManager.swaync = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.swaync;
+    in {
+      options.home.desktop.swaync.enable = mkEnableOption "Enables swaync";
+      config = mkIf cfg.enable {
+        services.swaync.enable = true;
+        home.packages = [pkgs.swaynotificationcenter];
+      };
+    };
+}

modules/home/desktop/theme.nix

@@ -0,0 +1,36 @@
+{
+  flake.modules.homeManager.theme = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.theme;
+    in {
+      options.home.desktop.theme.enable = mkEnableOption "Enable theme options";
+      config = mkIf cfg.enable {
+        gtk = {
+          enable = true;
+          colorScheme = "dark";
+          iconTheme = {
+            name = "Nordzy-icons";
+            package = pkgs.nordzy-icon-theme;
+          };
+          theme = {
+            package = pkgs.nordic;
+            name = "Nordic";
+          };
+          gtk4.theme = config.gtk.theme;
+        };
+        home.pointerCursor = {
+          enable = true;
+          gtk.enable = true;
+          hyprcursor.enable = config.home.desktop.hyprland.enable;
+          name = "Nordzy-cursors";
+          package = pkgs.nordzy-cursor-theme;
+        };
+        qt.enable = true;
+      };
+    };
+}

modules/home/desktop/waybar.nix

@@ -0,0 +1,156 @@
+{
+  flake.modules.homeManager.waybar = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.waybar;
+    in {
+      options.home.desktop.waybar = {
+        enable = mkEnableOption "Enables waybar.";
+        battery = mkEnableOption "Enables battery support.";
+        style = mkOption {
+          type = types.path;
+          example = ./style.css;
+        };
+      };
+      config.programs.waybar = mkIf cfg.enable {
+        inherit (cfg) enable;
+        systemd.enable = true;
+        settings = {
+          topBar = {
+            height = 24;
+            spacing = 2;
+            modules-left = ["hyprland/workspaces" "hyprland/submap" "hyprland/window"];
+            modules-center = [];
+            modules-right = [
+              "idle_inhibitor"
+              "group/audio"
+              "group/hardware"
+              "network"
+              "privacy"
+              "clock"
+              "tray"
+            ];
+
+            idle_inhibitor = {
+              format = "{icon}";
+              format-icons = {
+                activated = "";
+                deactivated = "";
+              };
+            };
+
+            mpris = {
+              dynamic-order = ["title" "artist" "album"];
+              dynamic-importance-order = ["title" "artist" "album"];
+              format = "DEFAULT: {player_icon} {dynamic}";
+              format-paused = "DEFAULT: {status_icon} <i>{dynamic}</i>";
+              player-icons = {
+                default = "▶";
+                mpv = "🎵";
+              };
+              status-icons.paused = "⏸";
+              ignored-players = [];
+            };
+
+            pulseaudio = {
+              format = "{volume}% {icon} {format_source}";
+              format-bluetooth = "{volume}% {icon} {format_source}";
+              format-bluetooth-muted = " {icon} {format_source}";
+              format-muted = " {format_source}";
+              format-source = "{volume}% ";
+              format-source-muted = "";
+              format-icons = {
+                headphone = "";
+                hands-free = "";
+                headset = "";
+                phone = "";
+                portable = "";
+                car = "";
+                default = ["" "" ""];
+              };
+              on-click = "pavucontrol";
+            };
+
+            network = {
+              format-wifi = "{essid} ({signalStrength}%) ";
+              format-ethernet = "{ipaddr}/{cidr} ";
+              tooltip-format = "{ifname} via {gwaddr} ";
+              format-linked = "{ifname} (No IP) ";
+              format-disconnected = "Disconnected ⚠";
+              format-alt = "{ifname}: {ipaddr}/{cidr}";
+            };
+
+            "group/audio" = {
+              modules = ["pulseaudio" "pulseaudio/slider" "mpris"];
+              orientation = "inherit";
+              drawer.transition-duration = 300;
+            };
+
+            "group/hardware" = {
+              modules = lists.optional cfg.battery "battery" ++ ["cpu" "memory" "disk"];
+              orientation = "inherit";
+              drawer.transition-duration = 300;
+            };
+
+            cpu = {
+              format = "{usage}% ";
+              tooltip = false;
+            };
+
+            memory.format = "{}% ";
+
+            disk = {
+              format = "{path}: {used}/{total} ({percentage_used}%)";
+              unit = "GB";
+            };
+
+            battery = {
+              states = {
+                good = 90;
+                warning = 30;
+                critical = 15;
+              };
+              format = "{capacity}% {icon}";
+              format-charging = "{capacity}% ";
+              format-plugged = "{capacity}% ";
+              format-alt = "{time} {icon}";
+              # An empty format will hide the module
+              format-good = "";
+              format-full = "";
+              format-icons = ["" "" "" "" ""];
+            };
+
+            clock = {
+              timezones = ["Europe/Paris" "Asia/Tokyo" "America/New_York" "America/Los_Angeles" "Asia/Kathmandu"];
+              tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
+              format-alt = "{:%Y-%m-%d}";
+              actions = {
+                on-click-right = "mode";
+                on-scroll-up = "tz_up";
+                on-scroll-down = "tz_down";
+              };
+              calendar = {
+                mode = "year";
+                mode-mon-col = 3;
+                weeks-pos = "right";
+                on-scroll = 1;
+                format = {
+                  months = "<span color='#eceff4'><b>{}</b></span>";
+                  days = "<span color='#5e81ac'><b>{}</b></span>";
+                  weeks = "<span color='#8fbcbb'><b>W{:%W}</b></span>";
+                  weekdays = "<span color='#d8dee9'><b>{}</b></span>";
+                  today = "<span color='#a3be8c'><b><u>{}</u></b></span>";
+                };
+              };
+            };
+
+            tray.spacing = 10;
+          };
+        };
+        style = builtins.readFile cfg.style;
+      };
+    };
+}

modules/home/desktop/wl-kbptr.nix

@@ -0,0 +1,39 @@
+{
+  flake.modules.homeManager.wl-kbptr = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      configDir = config.xdg.configHome;
+      cfg = config.home.desktop.wl-kbptr;
+      iniFormat = pkgs.formats.ini {};
+    in {
+      options.home.desktop.wl-kbptr = {
+        enable = mkEnableOption "enable wl-kbptr";
+        config = mkOption {
+          inherit (iniFormat) type;
+          default = {};
+          description = ''
+            Options to add to the {file}`config` file. See
+            <https://github.com/moverest/wl-kbptr/blob/main/config.example>
+            for options.
+          '';
+          example = {
+            general = {
+              home_row_keys = "abcd";
+            };
+          };
+        };
+      };
+      config = mkIf cfg.enable {
+        home = {
+          packages = [pkgs.wl-kbptr];
+          file."${configDir}/wl-kbptr/config" = mkIf (cfg.config != {}) {
+            source = iniFormat.generate "wl-kbptr-config" cfg.config;
+          };
+        };
+      };
+    };
+}

modules/home/desktop/wlr-which-key.nix

@@ -0,0 +1,191 @@
+{
+  flake.modules.homeManager.wlr-which-key = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    inherit
+      (lib)
+      literalExpression
+      mkIf
+      mkOption
+      mkEnableOption
+      types
+      ;
+    cfg = config.home.desktop.wlr-which-key;
+    yamlFormat = pkgs.formats.yaml {};
+
+    # Convert kebab-case to snake_case
+    toSnakeCase = str: builtins.replaceStrings ["-"] ["_"] str;
+
+    # Recursively filter out null values and convert kebab-case keys to snake_case
+    filterNulls = value:
+      if lib.isAttrs value
+      then lib.mapAttrs' (n: v: lib.nameValuePair (toSnakeCase n) (filterNulls v)) (lib.filterAttrs (_: v: v != null) value)
+      else if lib.isList value
+      then map filterNulls value
+      else value;
+    menuEntryType = types.submodule {
+      freeformType = yamlFormat.type;
+      options = with types; {
+        key = mkOption {
+          type = str;
+          example = "p";
+        };
+        desc = mkOption {
+          type = str;
+          example = "Power";
+        };
+        cmd = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "echo example";
+        };
+        keep-open = mkOption {
+          type = nullOr bool;
+          default = null;
+          example = true;
+        };
+        submenu = mkOption {
+          type = nullOr (listOf menuEntryType);
+          default = null;
+          example = literalExpression ''
+            [
+              { key = "s"; desc = "Suspend"; cmd = "systemctl suspend"; }
+              { key = "r"; desc = "Reboot"; cmd = "systemctl reboot"; }
+              { key = "o"; desc = "Poweroff"; cmd = "systemctl poweroff"; }
+            ]
+          '';
+        };
+      };
+    };
+    settingsType = types.submodule {
+      freeformType = yamlFormat.type;
+      options = with types; {
+        background = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#282828FF";
+        };
+        color = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#FBF1C7FF";
+        };
+        border = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "#8EC07CFF";
+        };
+        anchor = mkOption {
+          type = nullOr (enum ["center" "top" "bottom" "left" "right" "top-left" "top-right" "bottom-left" "bottom-right"]);
+          default = null;
+          example = "top-left";
+        };
+        margin-top = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-right = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-bottom = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        margin-left = mkOption {
+          type = nullOr int;
+          default = null;
+          example = "0";
+        };
+        font = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "monospace 10";
+        };
+        separator = mkOption {
+          type = nullOr str;
+          default = null;
+          example = " ➜ ";
+        };
+        border-width = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 4.0;
+        };
+        corder-r = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 20.0;
+        };
+        padding = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 15.0;
+        };
+        rows-per-column = mkOption {
+          type = nullOr int;
+          default = null;
+          example = 5;
+        };
+        column-padding = mkOption {
+          type = nullOr (either float int);
+          default = null;
+          example = 25.0;
+        };
+        inhibit-compositor-keyboard-shortcuts = mkOption {
+          type = bool;
+          default = true;
+          example = false;
+        };
+        auto_kbd_layout = mkOption {
+          type = bool;
+          default = true;
+          example = false;
+        };
+        namespace = mkOption {
+          type = nullOr str;
+          default = null;
+          example = "wlr_which_key";
+        };
+        menu = mkOption {
+          type = listOf menuEntryType;
+          default = [];
+          example = literalExpression ''
+            [
+              {
+                key = "p";
+                desc = "Power";
+                submenu = [
+                  { key = "s"; desc = "Suspend"; cmd = "systemctl suspend"; }
+                  { key = "r"; desc = "Reboot"; cmd = "systemctl reboot"; }
+                  { key = "o"; desc = "Poweroff"; cmd = "systemctl poweroff"; }
+                ];
+              }
+            ]
+          '';
+        };
+      };
+    };
+  in {
+    options.home.desktop.wlr-which-key = {
+      enable = mkEnableOption "Enables wlr-which-key";
+      package = lib.mkPackageOption pkgs "wlr-which-key" {};
+      settings = mkOption {
+        type = settingsType;
+        default = {};
+        description = "Configuration written to {file}`$XDG_CONFIG_HOME/wlr-which-key/config.yaml`.";
+      };
+    };
+    config = mkIf cfg.enable {
+      xdg.configFile = {
+        "wlr-which-key/config.yaml".source = yamlFormat.generate "wlr-which-key-config.yml" (filterNulls cfg.settings);
+      };
+    };
+  };
+}

modules/home/desktop/wlsunset.nix

@@ -0,0 +1,26 @@
+{
+  flake.modules.homeManager.wlsunset = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.desktop.wlsunset;
+    in {
+      options.home.desktop.wlsunset = {
+        enable = mkEnableOption "Enables wlsunset";
+        latitude = mkOption {
+          type = with types; nullOr (oneOf [str ints.unsigned float]);
+          default = 48.5;
+        };
+        longitude = mkOption {
+          type = with types; nullOr (oneOf [str ints.unsigned float]);
+          default = 2.2;
+        };
+      };
+
+      config.services.wlsunset = mkIf cfg.enable {
+        inherit (cfg) enable latitude longitude;
+      };
+    };
+}

modules/home/dev/ai/ai.nix

@@ -0,0 +1,50 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.ai = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai;
+      jsonFormat = pkgs.formats.json {};
+    in {
+      imports = [
+        m.claude
+        m.ollama
+        m.opencode
+      ];
+
+      options.home.dev.ai = {
+        enable = mkEnableOption "Enables AI features";
+        lmStudio = mkOption {
+          default = cfg.enable;
+          example = true;
+          description = "Enables LM Studio. Enabled by default when AI is enabled.";
+        };
+        mcpServers = mkOption {
+          inherit (jsonFormat) type;
+          default = {};
+        };
+      };
+      config = {
+        home = mkIf cfg.enable {
+          dev.ai = {
+            claude = {
+              enable = mkDefault cfg.enable;
+              mcpServers = mkDefault cfg.mcpServers;
+            };
+            ollama.enable = mkDefault cfg.enable;
+            opencode.enable = mkDefault cfg.enable;
+          };
+          packages = lists.optional cfg.lmStudio pkgs.lmstudio;
+        };
+        programs.mcp = mkIf (cfg.mcpServers != {}) {
+          enable = true;
+          servers = cfg.mcpServers;
+        };
+      };
+    };
+}

modules/home/dev/ai/claude.nix

@@ -0,0 +1,30 @@
+{
+  flake.modules.homeManager.claude = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai.claude;
+      jsonFormat = pkgs.formats.json {};
+    in {
+      options.home.dev.ai.claude = {
+        enable = mkEnableOption "Enables Claude-related packages";
+        mcpServers = mkOption {
+          inherit (jsonFormat) type;
+          default = {};
+        };
+      };
+      config = mkIf cfg.enable {
+        home.packages = let
+          claude-jj = pkgs.writeShellScriptBin "claude-jj" ''
+            ${pkgs.claude-code}/bin/claude --append-system-prompt 'CRITICAL: This repository uses Jujutsu (jj), NOT git. Never use git commands. Use jj equivalents.' "$@"
+          '';
+        in [claude-jj pkgs.sox];
+        programs.claude-code = {
+          inherit (cfg) enable mcpServers;
+        };
+      };
+    };
+}

modules/home/dev/ai/ollama.nix

@@ -0,0 +1,34 @@
+{
+  flake.modules.homeManager.ollama = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai.ollama;
+    in {
+      options.home.dev.ai.ollama = {
+        enable = mkEnableOption "Enables Ollama";
+        gpu = mkOption {
+          type = types.nullOr (types.enum [false "rocm" "cuda"]);
+          example = "rocm";
+          default = null;
+          description = "Which type of GPU should be used for hardware acceleration";
+        };
+      };
+
+      config = {
+        services.ollama = mkIf cfg.enable {
+          inherit (cfg) enable;
+          acceleration = cfg.gpu;
+          host = "0.0.0.0";
+          environmentVariables = {
+            OLLAMA_CONTEXT_LENGTH = "8192";
+            OLLAMA_MAX_LOADED_MODELS = "1";
+            OLLAMA_KEEP_ALIVE = "10m";
+          };
+        };
+        home.sessionVariables.OLLAMA_API_BASE = "http://${config.services.ollama.host}:11434/";
+      };
+    };
+}

modules/home/dev/ai/opencode.nix

@@ -0,0 +1,102 @@
+{
+  flake.modules.homeManager.opencode = {
+    config,
+    lib,
+    pkgs,
+    bunBaseline,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.ai.opencode;
+
+      # On x86_64-linux CPUs without AVX2, use the baseline bun variant
+      # when building opencode - the regular `bun` from nixpkgs requires
+      # AVX2 and crashes on older hardware, such as my Thinkpad x220’s
+      # Intel Core i5 2640M.
+      needsBaselineBun =
+        pkgs.stdenv.hostPlatform.isx86_64 && !pkgs.stdenv.hostPlatform.avx2Support;
+
+      defaultPackageCli =
+        if needsBaselineBun
+        then pkgs.opencode.override {bun = bunBaseline;}
+        else pkgs.opencode;
+
+      defaultPackageDesktop =
+        if needsBaselineBun
+        then pkgs.opencode-desktop.override {bun = bunBaseline;}
+        else pkgs.opencode-desktop;
+
+      corsList = domains: lists.remove "" (lists.forEach (strings.splitString "," domains) trim);
+    in {
+      options.home.dev.ai.opencode = {
+        enable = mkEnableOption "Enables OpenCode";
+        package = mkOption {
+          type = types.package;
+          default = defaultPackageCli;
+          description = "The CLI package for OpenCode";
+        };
+        settings = mkOption {
+          type = types.json;
+          default = {};
+        };
+        tui = mkOption {
+          type = types.json;
+          default = {};
+        };
+        desktop = {
+          enable = mkEnableOption "Enables the desktop app";
+          package = mkOption {
+            type = types.package;
+            default = defaultPackageDesktop;
+            description = "The desktop package for OpenCode";
+          };
+        };
+        web = {
+          enable = mkEnableOption "Enables OpenCode web";
+          extraArgs = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            example = [
+              "--hostname"
+              "0.0.0.0"
+            ];
+          };
+          cors = mkOption {
+            type = types.nullOr (types.either types.str types.path);
+            default = null;
+            example = "opencode.example.com,code.example.com";
+            description = ''
+              Either a string containing the domain allowed to connect to OpenCode’s web instance, or a file containing the target value. The latter is useful when using secret management if you don’t want to publicize the hostname of your OpenCode instance.
+
+              If you want to use multiple domains, you can separate them with a comma.
+            '';
+          };
+          mdns = {
+            enable = mkEnableOption "Enables mDNS with OpenCode";
+            hostname = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "opencode.local";
+            };
+          };
+        };
+      };
+      config.programs.opencode = mkIf cfg.enable {
+        inherit (cfg) enable tui package;
+        enableMcpIntegration = true;
+        extraPackages = with pkgs; [uv] ++ lists.optional cfg.desktop.enable cfg.desktop.package;
+        settings =
+          {
+            server = mkIf cfg.web.mdns.enable {
+              mdns = true;
+              mdnsDomain = mkIf (cfg.web.mdns.hostname != null) cfg.web.mdns.hostname;
+              cors = corsList cfg.web.cors;
+            };
+          }
+          // cfg.settings;
+        web = {
+          inherit (cfg.web) enable extraArgs;
+        };
+      };
+    };
+}

modules/home/dev/dev.nix

@@ -0,0 +1,24 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.dev = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev;
+    in {
+      imports = [
+        m.ai
+        m.editors
+        m.vcs
+      ];
+
+      options.home.dev.fullDesktop = mkEnableOption "Enables everything except AI";
+      config.home.dev = {
+        vcs.fullDesktop = mkDefault cfg.fullDesktop;
+        editors.fullDesktop = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/dev/editors/editors.nix

@@ -0,0 +1,24 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.editors = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.editors;
+    in {
+      imports = [
+        m.emacs
+      ];
+
+      options.home.dev.editors.fullDesktop = mkEnableOption "Enable all editors";
+      config.home.dev.editors.emacs = {
+        enable = mkDefault cfg.fullDesktop;
+        service = mkDefault cfg.fullDesktop;
+        mu4eMime = mkDefault cfg.fullDesktop;
+        org-protocol = mkDefault cfg.fullDesktop;
+      };
+    };
+}

modules/home/dev/editors/emacs.nix

@@ -0,0 +1,70 @@
+{
+  flake.modules.homeManager.emacs = {
+    pkgs,
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      emacsDefaultPackage = with pkgs; ((emacsPackagesFor emacs).emacsWithPackages (
+        epkgs:
+          with epkgs; [
+            mu4e
+            pdf-tools
+          ]
+      ));
+      cfg = config.home.dev.editors.emacs;
+    in {
+      options.home.dev.editors.emacs = {
+        enable = mkEnableOption "enables Emacs";
+        package = mkOption {
+          type = types.package;
+          default = emacsDefaultPackage;
+        };
+        service = mkEnableOption "enables Emacs service";
+        mu4eMime = mkEnableOption "Enables mu4e to handle mailto scheme";
+        org-protocol = mkEnableOption "Enables org-protocol";
+      };
+
+      config = {
+        home.packages = with pkgs; [
+          emacs-all-the-icons-fonts
+          emacs-lsp-booster
+        ];
+        programs.emacs = mkIf cfg.enable {
+          enable = true;
+          inherit (cfg) package;
+        };
+        services.emacs = mkIf cfg.service {
+          enable = true;
+          inherit (cfg) package;
+          defaultEditor = true;
+          startWithUserSession = "graphical";
+          client = {
+            enable = true;
+            arguments = ["-c" "-a" "${cfg.package}/bin/emacs"];
+          };
+        };
+
+        xdg.desktopEntries.mu4e = mkIf cfg.mu4eMime {
+          name = "mu4e";
+          genericName = "mu4e";
+          comment = "Maildir Utils for Emacs";
+          mimeType = ["x-scheme-handler/mailto"];
+          noDisplay = true;
+          exec = "${cfg.package}/bin/emacsclient -c -n -a ${cfg.package}/bin/emacs -e \"(browse-url-mail \\\"\\$*\\\")\"";
+          terminal = false;
+          categories = ["Network" "Email" "TextEditor" "Utility"];
+        };
+
+        xdg.desktopEntries.org-protocol = mkIf cfg.org-protocol {
+          name = "org-protocol";
+          exec = "${cfg.package}/bin/emacsclient -c -n -a ${cfg.package}/bin/emacs %u";
+          terminal = false;
+          noDisplay = true;
+          categories = ["System"];
+          mimeType = ["x-scheme-handler/org-protocol"];
+        };
+      };
+    };
+}

modules/home/dev/vcs/git.nix

@@ -0,0 +1,287 @@
+{
+  flake.modules.homeManager.git = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.vcs.git;
+    in {
+      options.home.dev.vcs.git = {
+        enable = mkEnableOption "enables git";
+        email = mkOption {
+          type = types.str;
+          default = "lucien@phundrak.com";
+        };
+        name = mkOption {
+          type = types.str;
+          default = "Lucien Cartier-Tilet";
+        };
+        cliff = mkEnableOption "enables git-cliff support";
+        sendmail = {
+          enable = mkOption {
+            type = types.bool;
+            default = true;
+          };
+          server = mkOption {
+            type = types.nullOr types.str;
+            default = "mail.phundrak.com";
+          };
+          user = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+          };
+          encryption = mkOption {
+            type = types.enum ["tls" "ssl" "none"];
+            default = "none";
+          };
+          port = mkOption {
+            type = types.nullOr types.int;
+            default = 587;
+          };
+          passwordFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            description = ''
+              Path to a file containing the password necessary for authenticating
+              against the mailserver.
+
+              This file should contain the password only, with no newline.
+            '';
+          };
+        };
+        browser = mkOption {
+          type = types.nullOr types.str;
+          example = "${pkgs.firefox}/bin/firefox";
+          default = null;
+        };
+        completeConfig = mkEnableOption "Complete configuration for workstations";
+        emacs = {
+          integration = mkOption {
+            description = "enables Emacs integration";
+            type = types.bool;
+            default = config.home.dev.editors.emacs.enable;
+          };
+          pkg = mkOption {
+            type = types.package;
+            default = pkgs.emacs;
+          };
+        };
+        mergeTool = mkOption {
+          type = types.str;
+          default = "ediff";
+        };
+        editor = mkOption {
+          type = types.str;
+          default = "${pkgs.emacs}/bin/emacsclient -c -a ${pkgs.emacs}/bin/emacs";
+        };
+        publicKeyFile = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        programs.git-cliff.enable = cfg.cliff;
+        programs.git = let
+          smtpEmail =
+            if (cfg.sendmail.user == null)
+            then cfg.email
+            else cfg.sendmail.user;
+        in {
+          enable = true;
+          ignores = [
+            ".env"
+            ".direnv/"
+
+            "*~"
+            "\#*\#"
+            "*.elc"
+            "auto-save-list"
+            ".\#*"
+            "*_flymake.*"
+            "/auto/"
+            ".projectile"
+            ".dir-locals.el"
+
+            "# Org mode files"
+            ".org-id-locations"
+            "*_archive"
+
+            "*.out"
+            "*.o"
+            "*.so"
+
+            "# Archives"
+            "*.7zz"
+            "*.dmg"
+            "*.gz"
+            "*.iso"
+            "*.jar"
+            "*.rar"
+            "*.tar"
+            "*.zip"
+
+            "*.log"
+            "*.sqlite"
+
+            "dist/"
+          ];
+          signing = {
+            format =
+              if cfg.publicKeyFile != null
+              then "ssh"
+              else "openpgp";
+            key = cfg.publicKeyFile;
+            signByDefault = true;
+          };
+          settings = {
+            user = {
+              inherit (cfg) name email;
+            };
+            color.ui = "auto";
+            column.ui = "auto";
+            tag.sort = "version:refname";
+            core = mkIf cfg.completeConfig {
+              compression = 9;
+              inherit (cfg) editor;
+              whitespace = "fix,-indent-with-non-tab,trailing-space";
+              preloadindex = true;
+            };
+            status = {
+              branch = true;
+              showStash = true;
+            };
+            diff = {
+              algorithm = "histogram";
+              colorMoved = "plain";
+              mnemonicPrefix = true;
+              renames = "copy";
+              interHunkContext = 10;
+            };
+            gpg.ssh.allowedSignersFile = "${config.home.homeDirectory}/.ssh/allowed_signers";
+            init.defaultBranch = "main";
+            pull.rebase = true;
+            push = {
+              default = "simple";
+              autoSetupRemote = true;
+              followTags = true;
+            };
+            rebase = {
+              autoSquash = true;
+              autoStash = true;
+              missingCommitsCheck = "warn";
+              updateRefs = true;
+            };
+            help.autocorrect = "prompt";
+            web.browser = mkIf (cfg.browser != null) cfg.browser;
+            sendemail = mkIf cfg.sendmail.enable {
+              smtpserver = cfg.sendmail.server;
+              smtpuser = smtpEmail;
+              smtpencryption = cfg.sendmail.encryption;
+              smtpserverport = cfg.sendmail.port;
+            };
+            credentials = mkIf (cfg.sendmail.passwordFile != null) {
+              "smtp://${smtpEmail}@${cfg.sendmail.server}:${toString cfg.sendmail.port}" = {
+                helper = "cat ${cfg.sendmail.passwordFile}";
+              };
+            };
+            magithub = mkIf cfg.emacs.integration {
+              online = true;
+              "status" = {
+                includeStatusHeader = true;
+                includePullRequestsSection = true;
+                includeIssuesSection = true;
+              };
+            };
+            merge = {
+              tool = mkIf cfg.completeConfig cfg.mergeTool;
+              conflictstyle = "zdiff3";
+            };
+            mergetool.ediff.cmd = mkIf (cfg.emacs.integration && cfg.completeConfig) "\"${cfg.emacs.pkg} --eval \" (progn (defun ediff-write-merge-buffer () (let ((file ediff-merge-store-file)) (set-buffer ediff-buffer-C) (write-region (point-min) (point-max) file) (message \\\"Merge buffer saved in: %s\\\" file) (set-buffer-modified-p nil) (sit-for 1))) (setq ediff-quit-hook 'kill-emacs ediff-quit-merge-hook 'ediff-write-merge-buffer) (ediff-merge-files-with-ancestor \\\"$LOCAL\\\" \\\"$REMOTE\\\" \\\"$BASE\\\" nil \\\"$MERGED\\\"))\"\"";
+            github.user = "phundrak";
+            url = {
+              "https://phundrak@github.com" = {
+                insteadOf = "https://github.com";
+              };
+              "https://phundrak@labs.phundrak.com" = {
+                insteadOf = "https://labs.phundrak.com";
+              };
+              "https://github.com/RustSec/advisory-db" = {
+                insteadOf = "https://github.com/RustSec/advisory-db";
+              };
+              "git@github.com:Phundrak/" = {
+                insteadOf = "pg:";
+              };
+              "git@labs.phundrak.com/phundrak:" = {
+                insteadOf = "p:";
+              };
+              "git@github.com" = {
+                insteadOf = "gh:";
+              };
+              "git@labs.phundrak.com" = {
+                insteadOf = "labs:";
+              };
+            };
+            alias = {
+              a = "add --all";
+              aca = "!git add --all && git commit --amend";
+              acan = "!git add --all && git commit --amend --no-edit";
+              ap = "add --patch";
+              b = "branch";
+              bd = "branch -d";
+              bdd = "branch -D";
+              c = "commit -S";
+              ca = "commit -Sa";
+              can = "commit -Sa --no-edit";
+              cm = "commit -Sm";
+              cam = "commit -Sam";
+              co = "checkout";
+              cob = "checkout -b";
+              cod = "checkout develop";
+              cl = "clone";
+              cl1 = "clone --depth 1";
+              f = "fetch";
+              fp = "fetch --prune";
+              ps = "push";
+              psf = "push --force-with-lease";
+              pso = "push origin";
+              psfo = "push --force-with-lease origin";
+              pushall = "!git remote \vert{} xargs -L1 git push";
+              psl = "!git remote \vert{} xargs -L1 git push";
+              pullall = "!git remote \vert{} xargs -L1 git pull";
+              pll = "!git remote \vert{} xargs -L1 git pull";
+              pl = "pull";
+              pb = "pull --rebase";
+              r = "rebase";
+              ra = "rebase --abort";
+              rc = "rebase --continue";
+              rd = "rebase develop";
+              ri = "rebase -i";
+              rmf = "rm -f";
+              rmd = "rm -r";
+              rmdf = "rm -rf";
+              sm = "submodule";
+              sms = "submodule status";
+              sma = "submodule add";
+              smu = "submodule update";
+              smui = "submodule update --init";
+              smuir = "submodule update --init --recursive";
+              st = "stash";
+              stc = "stash clear";
+              stp = "stash pop";
+              stw = "stash show";
+              u = "reset --";
+              d = "diff -w";
+              l = "log --all --oneline --graph --decorate --pretty=format':%C(magenta)%h %C(white) %an %ar%C(auto) %D%n%s%n'";
+              s = "status";
+              staged = "diff --cached";
+              upstream = "!git push -u origin HEAD";
+              unstage = "reset --";
+            };
+          };
+        };
+      };
+    };
+}

modules/home/dev/vcs/jujutsu.nix

@@ -0,0 +1,141 @@
+{inputs, ...}: {
+  flake-file.inputs.jj-cz = {
+    url = "git+https://labs.phundrak.com/phundrak/jj-cz?ref=develop";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  flake.modules.homeManager.jujutsu = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      inherit (pkgs.stdenv.hostPlatform) system;
+      cfg = config.home.dev.vcs.jj;
+      jj-cz = inputs.jj-cz.packages.${system}.default;
+    in {
+      options.home.dev.vcs.jj = {
+        enable = mkEnableOption "enables jj";
+        name = mkOption {
+          type = types.str;
+          default = "Lucien Cartier-Tilet";
+        };
+        email = mkOption {
+          type = types.str;
+          default = "lucien@phundrak.com";
+        };
+        editor = mkOption {
+          type = types.str;
+          default =
+            if config.home.dev.editors.emacs.enable
+            then "${pkgs.emacs}/bin/emacsclient -c -a ${pkgs.emacs}/bin/emacs"
+            else "${pkgs.nano}/bin/nano";
+        };
+        signing = {
+          enable = mkEnableOption "enables signing jj commits";
+          sshKey = mkOption {
+            type = with types; nullOr (either path str);
+            example = "~/.ssh/id_ed25519.pub";
+            default = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+            description = "Path to the private SSH key for signing.";
+          };
+        };
+        cz = {
+          enable = mkEnableOption "Enables jj-cz";
+          alias = mkEnableOption "Enable `jj cz` as an alias to `jj-cz`";
+        };
+        # used in my shell .nix files
+        shellCompletion = mkOption {
+          description = "Enable Jujutsu shell completion";
+          type = types.bool;
+          default = true;
+        };
+      };
+
+      config = mkIf cfg.enable {
+        home.packages = mkIf cfg.cz.enable [jj-cz];
+        programs.jujutsu = {
+          enable = true;
+          settings = {
+            user = {
+              inherit (cfg) name email;
+            };
+            ui = {
+              inherit (cfg) editor;
+              default-command = "st";
+              pager = ":builtin";
+              show-cryptographic-signatures = true;
+              diff-editor = ":builtin";
+              merge-editort = ":builtin";
+              # These are for vc-jj.el in Emacs
+              diff-formatter = ":git";
+              conflict-marker-style = "git";
+            };
+            signing = mkIf cfg.signing.enable {
+              behavior = "own";
+              backend = "ssh";
+              key = cfg.signing.sshKey;
+              backends.ssh.allowed-signers = "${config.home.homeDirectory}/.ssh/allowed_signers";
+              backends.ssh.program = "${pkgs.openssh}/bin/ssh-keygen";
+            };
+            aliases = {
+              blame = ["file" "annotate"];
+              consume = ["squash" "--into" "@" "--from"];
+              cz = mkIf cfg.cz.alias ["util" "exec" "--" "${jj-cz}/bin/jj-cz"];
+              eject = ["squash" "--from" "@" "--into"];
+              d = ["diff"];
+              dm = ["desc" "-m"];
+              gc = ["git" "clone"];
+              gcc = ["git" "clone" "--colocate"];
+              l = ["log"];
+              la = ["log" "-r" "::"];
+              lc = ["log" "-r" "(remote_bookmarks()..@)::"];
+              ll = ["log" "-T" "builtin_log_detailed"];
+              open = ["log" "-r" "open()"];
+              n = ["new"];
+              nd = ["new" "dev()"];
+              nt = ["new" "trunk()"];
+              revlog = ["evolog"];
+              s = ["show"];
+              tug = ["bookmark" "move" "--from" "heads(::@- & bookmarks())" "--to" "@-"];
+            };
+            colors.working_copy.underline = true;
+            git = {
+              private-commits = "blacklist()";
+              colocate = true;
+              subprocess = true;
+            };
+            revset-aliases = {
+              "immutable_heads()" = "present(trunk()) | tags()";
+              # Resolves by default to latest main/master remote bookmarks
+              "trunk()" = "latest((present(main) | present(master)) & remote_bookmarks())";
+              # Same as trunk() but for `dev` or `develop` bookmarks
+              "dev()" = "latest((present(dev) | present(develop)) & remote_bookmarks())";
+
+              "user(x)" = "author(x) | committer(x)";
+              "gh_pages()" = "ancestors(remote_bookmarks(exact:\"gh-pages\"))";
+
+              #Private and WIP commits that should never be pushed
+              "wip()" = "description(glob:\"wip:*\")";
+              "private()" = "description(glob:\"private:*\")";
+              "blacklist()" = "wip() | private()";
+
+              # stack(x, n) is the set of mutable commits reachable from
+              # 'x', with 'n' parents. 'n' is often useful to customize the
+              # display and return set for certain operations. 'x' can be
+              # used to target the set of 'roots' to traverse, e.g. @ is the
+              # current stack.
+              "stack()" = "ancestors(reachable(@, mutable()), 2)";
+              "stack(x)" = "ancestors(reachable(x, mutable()), 2)";
+              "stack(x, n)" = "ancestors(reachable(x, mutable()), n)";
+
+              "open()" = "stack(dev().. & mine(), 1)";
+              "ready()" = "open() ~ blacklist()::";
+            };
+            remotes.origin.auto-track-bookmarks = "*";
+          };
+        };
+      };
+    };
+}

modules/home/dev/vcs/vcs.nix

@@ -0,0 +1,61 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.vcs = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.dev.vcs;
+    in {
+      imports = [m.git m.jujutsu];
+
+      options.home.dev.vcs = {
+        fullDesktop = mkEnableOption "Enable all optional values";
+        name = mkOption {
+          type = types.str;
+          default = "Lucien Cartier-Tilet";
+        };
+        email = mkOption {
+          type = types.str;
+          default = "lucien@phundrak.com";
+        };
+        editor = mkOption {
+          type = types.str;
+          default = "${pkgs.emacs}/bin/emacsclient -c -a ${pkgs.emacs}/bin/emacs";
+        };
+        publicKey = {
+          content = mkOption {
+            type = types.nullOr types.str;
+            example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGj+J6N6SO+4P8dOZqfR1oiay2yxhhHnagH52avUqw5h";
+            default = null;
+          };
+          file = mkOption {
+            type = with types; nullOr path;
+            default = "/home/phundrak/.ssh/id_ed25519.pub";
+          };
+        };
+      };
+
+      config.home.dev.vcs = {
+        git = {
+          enable = mkDefault true;
+          inherit (cfg) name email editor;
+          publicKeyFile = cfg.publicKey.file;
+          cliff = mkDefault cfg.fullDesktop;
+          completeConfig = mkDefault cfg.fullDesktop;
+        };
+        jj = {
+          enable = mkDefault true;
+          inherit (cfg) name email editor;
+          signing.sshKey = mkDefault (cfg.publicKey.file or cfg.publicKey.content);
+          cz = {
+            enable = mkDefault true;
+            alias = mkDefault true;
+          };
+        };
+      };
+    };
+}

modules/home/media/media.nix

@@ -0,0 +1,30 @@
+{config, ...}: let
+  m = config.flake.modules.homeManager;
+in {
+  flake.modules.homeManager.media = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media;
+    in {
+      imports = [
+        m.mopidy
+        m.mpd
+        m.mpd-mpris
+        m.mpv
+        m.ncmpcpp
+        m.streamlink
+      ];
+
+      options.home.media.fullDesktop = mkEnableOption "Enables everything";
+      config.home.media = {
+        mopidy.enable = mkDefault cfg.fullDesktop;
+        mpd.enable = mkDefault (cfg.fullDesktop or cfg.mpd-mpris.enable);
+        mpv.enable = mkDefault cfg.fullDesktop;
+        ncmpcpp.enable = mkDefault config.home.media.mpd.enable;
+        streamlink.enable = mkDefault config.home.media.mpv.enable;
+      };
+    };
+}

modules/home/media/mopidy.nix

@@ -0,0 +1,48 @@
+{
+  flake.modules.homeManager.mopidy = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.mopidy;
+    in {
+      options.home.media.mopidy = {
+        enable = mkEnableOption "Enables Mopidy.";
+      };
+
+      config.services.mopidy = mkIf cfg.enable {
+        inherit (cfg) enable;
+        extensionPackages = with pkgs; [
+          mopidy-bandcamp
+          mopidy-mpd
+          mopidy-mpris
+          mopidy-muse
+          mopidy-notify
+          mopidy-spotify
+        ];
+        extraConfigFiles = [
+          config.sops.secrets."mopidy/bandcamp".path
+          config.sops.secrets."mopidy/spotify".path
+        ];
+        settings = {
+          mpd = {
+            enabled = true;
+            hostname = "::";
+            port = 6600;
+          };
+          mpris.enabled = true;
+          muse = {
+            enabled = true;
+            mopidy_host = "localhost";
+            mopidy_port = 6690;
+            mopidy_ssl = false;
+            snapcast_host = "localhost";
+            snapcast_port = 1780;
+            snapcast_ssl = false;
+          };
+        };
+      };
+    };
+}

modules/home/media/mpd-mpris.nix

@@ -0,0 +1,18 @@
+{
+  flake.modules.homeManager.mpd-mpris = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.mpd-mpris;
+      cfgMpd = config.home.media.mpd;
+    in {
+      options.home.media.mpd-mpris.enable = mkOption {
+        type = types.bool;
+        default = cfgMpd.enable;
+        example = false;
+      };
+      config.services.mpd-mpris.enable = cfg.enable;
+    };
+}

modules/home/media/mpd.nix

@@ -0,0 +1,37 @@
+{
+  flake.modules.homeManager.mpd = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.mpd;
+    in {
+      options.home.media.mpd.enable = mkEnableOption "Enables MPD";
+      config.services.mpd = mkIf cfg.enable {
+        inherit (cfg) enable;
+        musicDirectory = "${config.home.homeDirectory}/Music";
+        playlistDirectory = "${config.home.homeDirectory}/Music/playlists";
+        network.startWhenNeeded = true;
+        extraConfig = ''
+          follow_outside_symlinks "yes"
+          follow_inside_symlinks "yes"
+
+          bind_to_address "localhost"
+          auto_update "yes"
+
+          audio_output {
+            type "pipewire"
+            name "PipeWire"
+          }
+
+          audio_output {
+            type "fifo"
+            name "my_fifo"
+            path "/tmp/mpd.fifo"
+            format "44100:16:2"
+          }
+        '';
+      };
+    };
+}

modules/home/media/mpv.nix

@@ -0,0 +1,67 @@
+{
+  flake.modules.homeManager.mpv = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.mpv;
+    in {
+      options.home.media.mpv.enable = mkEnableOption "Enable MPV";
+      config.programs.mpv = mkIf cfg.enable {
+        inherit (cfg) enable;
+        config = {
+          force-window = "immediate";
+          force-seekable = true; # force streams to be seekable
+          slang = "jpn,jp,eng,en,fra,fr";
+          alang = "eng,en,fra,fr";
+          gpu-api = "auto";
+          osc = true;
+          profile = "gpu-hq";
+          # geometry = "50%x50%";
+          # autofit-larger = "90%x90%";
+
+          # Screenshots
+          screenshot-format = "png";
+          screenshot-high-bit-depth = true;
+          screenshot-png-compression = 6;
+          screenshot-directory = "${config.home.homeDirectory}/Pictures/Screenshots/mpv";
+
+          deband = true;
+          deband-iterations = 2;
+          deband-threshold = 35;
+          deband-range = 20;
+
+          dither-depth = "auto";
+
+          sub-auto = "fuzzy";
+
+          scale = "ewa_lanczossharp";
+          cscale = "ewa_lanczossharp";
+        };
+        scripts = with pkgs.mpvScripts; [
+          crop
+          encode
+          inhibit-gnome
+          mpris
+          mpv-cheatsheet-ng
+          quality-menu
+          sponsorblock
+          thumbfast
+          twitch-chat
+          youtube-chat
+          youtube-upnext
+        ];
+        bindings = {
+          Q = "quit-watch-later";
+          P = "show-progress";
+          "/" = "add volume -2";
+          "*" = "add volume 2";
+          m = "cycle mute";
+          M = "vf toggle hflip";
+          "Ctrl+r" = "cycle_values video-rotate \"90\" \"180\" \"270\" \"0\"";
+        };
+      };
+    };
+}

modules/home/media/ncmpcpp.nix

@@ -0,0 +1,89 @@
+{
+  flake.modules.homeManager.ncmpcpp = {
+    lib,
+    config,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.ncmpcpp;
+    in {
+      options.home.media.ncmpcpp.enable = mkEnableOption "Enable ncmpcpp";
+      config.programs.ncmpcpp = let
+        musicDir = config.services.mpd.musicDirectory;
+      in
+        mkIf cfg.enable {
+          inherit (cfg) enable;
+          mpdMusicDir = musicDir;
+          settings = {
+            # directories
+            ncmpcpp_directory = "${config.home.homeDirectory}/.config/ncmpcpp";
+            lyrics_directory = "${musicDir}/.lyrics";
+
+            # MPD
+            mpd_host = "localhost";
+            mpd_port = 6600;
+            mpd_connection_timeout = 5;
+            mpd_crossfade_time = 0;
+
+            # music visualizer
+            visualizer_output_name = "my_fifo";
+            visualizer_in_stereo = "yes";
+            # visualizer_type = "spectrum";
+            visualizer_look = "+|";
+            visualizer_color = "blue, cyan, green, yellow, magenta, red";
+
+            system_encoding = "UTF-8";
+
+            # song format
+            song_list_format = "(6)[]{} (23)[red]{a} (26)[yellow]{t|f} (40)[green]{b} (4)[blue]{l}";
+            now_playing_prefix = "$b";
+            now_playing_suffix = "$8$/b";
+
+            # columns settings
+            song_columns_list_format = "(6)[]{} (23)[red]{a} (26)[yellow]{t|f} (40)[green]{b} (4)[blue]{l}";
+
+            playlist_shorten_total_times = "yes";
+            playlist_display_mode = "columns";
+            browser_display_mode = "columns";
+            search_engine_display_mode = "columns";
+            playlist_editor_display_mode = "columns";
+            autocenter_mode = "yes";
+            centered_cursor = "yes";
+
+            progressbar_look = "─> ";
+            header_visibility = "no";
+            statusbar_visibility = "no";
+            titles_visibility = "no";
+            allow_for_physical_item_deletion = "yes";
+
+            lastfm_preferred_language = "en";
+            space_add_mode = "add_remove";
+
+            locked_screen_width_part = "50";
+            ask_for_locked_screen_width_part = "yes";
+            jump_to_now_playing_song_at_start = "yes";
+            ask_before_clearing_playlists = "yes";
+            clock_display_seconds = "no";
+            display_volume_level = "yes";
+            display_bitrate = "no";
+            display_remaining_time = "yes";
+            regular_expressions = "extended";
+            ignore_leading_the = "yes";
+            ignore_diacritics = "yes";
+            mouse_support = "no";
+            tags_separator = ";";
+            enable_window_title = "yes";
+            search_engine_default_search_mode = 1;
+            external_editor = "emacsclient -c";
+            use_console_editor = "yes";
+
+            # colours
+            colors_enabled = "yes";
+            volume_color = "default";
+            progressbar_color = "black";
+            progressbar_elapsed_color = "white";
+            statusbar_color = "white";
+          };
+        };
+    };
+}

modules/home/media/streamlink.nix

@@ -0,0 +1,19 @@
+{
+  flake.modules.homeManager.streamlink = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }:
+    with lib; let
+      cfg = config.home.media.streamlink;
+    in {
+      options.home.media.streamlink.enable = mkEnableOption "Enable Streamlink";
+      config.programs.streamlink = mkIf cfg.enable {
+        enable = true;
+        settings = {
+          player = "${pkgs.mpv}/bin/mpv";
+        };
+      };
+    };
+}