diff --git a/shared/home-manager/default.nix b/shared/home-manager/default.nix
index 6ba348f..f1b6b23 100644
--- a/shared/home-manager/default.nix
+++ b/shared/home-manager/default.nix
@@ -25,6 +25,7 @@ in
     ./shell
     ./sioyek.nix
     ./spicetify.nix
+    ./ssh.nix
     ./zen
   ];
 
diff --git a/shared/home-manager/shell/default.nix b/shared/home-manager/shell/default.nix
index 5ce6cfc..6e97753 100644
--- a/shared/home-manager/shell/default.nix
+++ b/shared/home-manager/shell/default.nix
@@ -5,6 +5,7 @@
     ./eza.nix
     ./fastfetch.nix
     ./fish.nix
+    ./fzf.nix
     ./yazi
     ./zoxide.nix
   ];
diff --git a/shared/home-manager/shell/fzf.nix b/shared/home-manager/shell/fzf.nix
new file mode 100644
index 0000000..4e78a30
--- /dev/null
+++ b/shared/home-manager/shell/fzf.nix
@@ -0,0 +1,13 @@
+{ theme, ... }:
+
+{
+  catppuccin.fzf = {
+    enable = true;
+    flavor = theme.flavor;
+  };
+
+  programs.fzf = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+}
diff --git a/shared/home-manager/ssh.nix b/shared/home-manager/ssh.nix
new file mode 100644
index 0000000..500c92d
--- /dev/null
+++ b/shared/home-manager/ssh.nix
@@ -0,0 +1,22 @@
+# ~/.ssh/config
+{ systemConfig, ... }:
+
+{
+  programs.ssh = {
+    enable = true;
+    matchBlocks =
+      let
+        block = hostname: {
+          port = 22;
+          user = systemConfig.username;
+          hostname = "${hostname}.dns.martials.no";
+        };
+      in
+      {
+        desktop = block "desktop";
+        homelab = block "admin"; # TODO rename to homelab
+        pi4 = block "pi4";
+        thinkpad = block "thinkpad";
+      };
+  };
+}
diff --git a/shared/secrets/secrets.yaml b/shared/secrets/secrets.yaml
index 277b432..eb9251b 100644
--- a/shared/secrets/secrets.yaml
+++ b/shared/secrets/secrets.yaml
@@ -1,30 +1,39 @@
-password: ENC[AES256_GCM,data:9sqcjpl3e+Fu6vDeoSViQ+z+AMpaL/zvdDNRsIs3APJytzvOktj4njJ4Ciign+fuehLv1jnCt4QeLh4W5bz4QOlo5VQweX2v/w==,iv:p4no6Vza6ma14Aeg6cRfJg2bbj2EeKd0MueepZCsILI=,tag:MKHDXT8G+cy4kC7r/UQVHg==,type:str]
+password: ENC[AES256_GCM,data:yc6aJ7TgEmerPVsy1SO7wY0RGwFvK8WtCRt5MI8wq/+J2gPCEORWtZkvWv7XvsjYruGmfFzdi8hgZ7kyuRnIGAx068/DF7O1Jg==,iv:99vwiYNKSvjHo4azzDGvWpbe6kfvwHVVliMLQGFRLkU=,tag:xfFZg/tI+apyksWsg44WRA==,type:str]
 sops:
   kms: []
   gcp_kms: []
   azure_kv: []
   hc_vault: []
   age:
+    - recipient: age1j66v6z6hlsgqjfv5fz7fldm5q9jay4j5v5du6ymfda6hv40nsqesg89g7p
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyMHl6emFJdE4rVGduT2V1
+        Y1hFdlRxVHJ1NlV0R2JRZm5SMVVzVmpRQlM0CjhUN0dqajNpQXg4a29Ca1VLMDJ1
+        UmpsMFRJd254TlpGNzdDV2ZQTU9icDAKLS0tIG0wSVppUmU5TVdlMHhsQ3pMNDhJ
+        TFkrWitpb3h3UDhFNUN5Yi80YXlLbjQKxdG0m3CZ+elvzSNC9+aD15AOejkT5hJR
+        hhjtn+aUF8JvAIgggLqE1qU1XYIkbzk5//TWz5FaKeszinv9x8plvA==
+        -----END AGE ENCRYPTED FILE-----
     - recipient: age1fxr5s6d6ar0xy5pr63kpq93tk7jha5k96jcxnyquj6s2mw8mmcpss8w29w
       enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TDlyZ1lYajRRMksyTFRO
-        NmNYcUdxVDdzTmdZajhKRDRJSzR1ZnFUaFFZClUwS0w0MlhNUDZBWDdDM28zUUlr
-        VFZvcWMrRTNVMVlrVnZDelZjV3piMjgKLS0tIFVlbG9Xai9hQVJ5NmZsdVR2dkJR
-        VUhNbDFUU0JjUHNKVXVJZVBJNThQaWsKyaVuPD89mvnK+6t4buocuXW7SBgO1NH9
-        CwnxdMNadQ5ZAATuBJTiL1IhDfusc6rtDl8DyrQxFv7R/0i/hFVERQ==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRGNSYjM2Qkx5M294QWVS
+        ZkJzR0VuTzdOR1FIc2c2bWx0akVPZVB0T1hvCmxuMjZWWlVmSUhKUys0QlMxMDV3
+        ZCt1ZjJNZlV5K0Zpd3NGcldhWDFDcjgKLS0tIG9mSHA1Um5Hb2NtVm5XRFdvVHVT
+        NHp1WThrcU1hOEI5RExCbVlnV2VYNlEKV4DSgHYs/zhF34h14RX2rvVXNo2uxCpD
+        uUiwU4and1T5Q09MOjqdbs2e7QM+VjKB4P/w34KkcqXTkJeR/IBF/g==
         -----END AGE ENCRYPTED FILE-----
     - recipient: age1xlnprpvshv93eerthxzg6cahklsfc4efh8dd6u8dte9u6cl0u5qsz48qlt
       enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bkhSTEpMcUNBQmhQNmdS
-        dENxbGJtUGxpZFhoR3B6WG1oM2VSOW1qcURJCjhlbUNaaktDV1RTTy9tbGlYYXdH
-        Q3c1WUNXRWJSU3QxbDVJTXEwZ3RSVncKLS0tIFpvRkpMWUFwTHJlaTlFK3g2aVgr
-        YlYvRkxWcmM2bUs1Q1p1RWZHS0EyV3cKH0PSG9KxIRbTr0bCJt9+e2a9c8ATPpYU
-        c8ncCckCCv/zmGvyRE/v7DYWN0tUutbMULle5AC7MqVdREP7zMMlXA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1c3p0N0c2RGJZMmxzcUgw
+        bHZhcnlnWlczSGJRMVJRNitqVmV6YThIRWlBCitWUzVCN25JbzhJeG9haEVORUk5
+        QmhIc0R0c0diNmNPc0dYM2YyNVdScVUKLS0tIG1waU1QYXNVMXU4bC9rNUxwUDIz
+        SGdNMnVlQlNEeVJkWmZEM1FRT2JJMGMKbZ/znJM6tFhzhHariRXMLgH/4CRZZKrb
+        YtmSdeL/Pd5YIecCpjDHDn4vQ0TBAmLaX+zVbNbRKmMZoY7777ywfA==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-04-18T13:14:40Z"
-  mac: ENC[AES256_GCM,data:ydUPxCQFAwVKf9iKnvaEcwH49w8rdK9GqqFosoErzqGFJTax7vFAFhwHgM8j4dpJhM5VM1N27Hke4h7ksO1w2XABMJyQi+f1wgiier3qiEeWE+3CeE18+nXnnHjXqrCLHCoKUUtEdK8rosOfaEXBFTs5Ihwz22UklvG5Ero0ls0=,iv:H89DPDlr/P+eEI+BgmxNY/LKgh8xtS7cfPnAFlwL1wE=,tag:TXtiza9PAPt6q4+wssHIjg==,type:str]
+  lastmodified: "2025-04-20T17:38:05Z"
+  mac: ENC[AES256_GCM,data:mb1cr7ClV5E7+JJTW2J3eoMugISzjJoqJg7djkvowR89d3Aw+4K5+g+ayEr5aETCvJ4zt1L8XvCwi0auKF9d19fAZFNo+wju+zVw7rsprcfkqhvuxYKKa3YS8MvAr3V/swzDGSQYP2Ln9Aq1f5Wl/7TJ/HLzGddH/4dxHDiJ5tU=,iv:3OAs7Y4cziDKCD+Qu7eapyJv/wD+75xuFxrqC2QCiH0=,tag:5qdswVKhEz3pPeE4W+SMrg==,type:str]
   pgp: []
   unencrypted_suffix: _unencrypted
   version: 3.9.4