✨ [pi4] Add reverse proxy for martials.no staging environment

🐛 [pi4] Fix Actual container not working
✨ [shared] Add Httpie-desktop
2025-07-10 18:47:08 +00:00 · 2025-07-10 18:47:08 +00:00 · 2025-07-03 21:50:48 +02:00 · 2025-06-23 19:18:40 +00:00 · 2025-06-23 18:17:08 +00:00 · 2025-06-23 18:07:09 +00:00
191 changed files with 1873 additions and 13455 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -1 +1 @@
-shared/secrets/* filter=git-crypt diff=git-crypt
+shared/secrets/weather-api-key filter=git-crypt diff=git-crypt
--- a/.sops.yaml
+++ b/.sops.yaml
@ -0,0 +1,11 @@
+keys:
+  - &thinkpad age1j66v6z6hlsgqjfv5fz7fldm5q9jay4j5v5du6ymfda6hv40nsqesg89g7p
+  - &desktop age1fxr5s6d6ar0xy5pr63kpq93tk7jha5k96jcxnyquj6s2mw8mmcpss8w29w
+  - &pi4 age1xlnprpvshv93eerthxzg6cahklsfc4efh8dd6u8dte9u6cl0u5qsz48qlt
+creation_rules:
+  - path_regex: shared/secrets/secrets.yaml$
+    key_groups:
+      - age:
+          - *thinkpad
+          - *desktop
+          - *pi4
--- a/README.md
+++ b/README.md
@ -1,6 +1,6 @@
 # NixOS Configurations

-My NixOS configurations with dotfiles for my desktop
+My NixOS configurations with dotfiles for my systems.

 ![Screenshot of desktop](./.gitea/assets/desktop.png)

@ -17,8 +17,6 @@ My NixOS configurations with dotfiles for my desktop
 | Runner | Rofi       |
 | Fetch  | Fastfetch  |

-Requires Nix-channel with [NixOS 24.11](https://nixos.org/)
-
 ## Commands

 First time run, will create a shell with the minimum dependencies in order to download the rest
--- a/flake.lock
+++ b/flake.lock
@ -9,11 +9,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1736090999,
-        "narHash": "sha256-B5CJuHqfJrzPa7tObK0H9669/EClSHpa/P7B9EuvElU=",
+        "lastModified": 1744557573,
+        "narHash": "sha256-XAyj0iDuI51BytJ1PwN53uLpzTDdznPDQFG4RwihlTQ=",
        "owner": "aylur",
        "repo": "ags",
-        "rev": "5527c3c07d92c11e04e7fd99d58429493dba7e3c",
+        "rev": "3ed9737bdbc8fc7a7c7ceef2165c9109f336bff6",
        "type": "github"
      },
      "original": {
@ -31,11 +31,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1735172721,
-        "narHash": "sha256-rtEAwGsHSppnkR3Qg3eRJ6Xh/F84IY9CrBBLzYabalY=",
+        "lastModified": 1742571008,
+        "narHash": "sha256-5WgfJAeBpxiKbTR/gJvxrGYfqQRge5aUDcGKmU1YZ1Q=",
        "owner": "aylur",
        "repo": "astal",
-        "rev": "6c84b64efc736e039a8a10774a4a1bf772c37aa2",
+        "rev": "dc0e5d37abe9424c53dcbd2506a4886ffee6296e",
        "type": "github"
      },
      "original": {
@ -44,16 +44,53 @@
        "type": "github"
      }
    },
+    "astal_2": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprpanel",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748416910,
+        "narHash": "sha256-FEQcs58HL8Fe4i7XlqVEUwthjxwvRvgX15gTTfW17sU=",
+        "owner": "aylur",
+        "repo": "astal",
+        "rev": "c1bd89a47c81c66ab5fc6872db5a916c0433fb89",
+        "type": "github"
+      },
+      "original": {
+        "owner": "aylur",
+        "repo": "astal",
+        "type": "github"
+      }
+    },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
    "catppuccin": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1744447794,
-        "narHash": "sha256-z5uK5BDmFg0L/0EW2XYLGr39FbQeXyNVnIEhkZrG8+Q=",
+        "lastModified": 1748080874,
+        "narHash": "sha256-sUebEzAkrY8Aq5G0GHFyRddmRNGP/a2iTtV7ISNvi/c=",
        "owner": "catppuccin",
        "repo": "nix",
-        "rev": "c44fe73ed8e5d5809eded7cc6156ca9c40044e42",
+        "rev": "0ba11b12be81f0849a89ed17ab635164ea8f0112",
        "type": "github"
      },
      "original": {
@ -62,89 +99,31 @@
        "type": "github"
      }
    },
-    "devshell": {
-      "inputs": {
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1741473158,
-        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
    "flake-compat": {
+      "flake": false,
      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "revCount": 69,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "edolstra",
+        "repo": "flake-compat",
        "type": "github"
      }
    },
    "git-hooks": {
      "inputs": {
        "flake-compat": [
-          "nixvim",
+          "simple-nixos-mailserver",
          "flake-compat"
        ],
        "gitignore": "gitignore",
        "nixpkgs": [
-          "nixvim",
+          "simple-nixos-mailserver",
          "nixpkgs"
        ]
      },
@ -165,7 +144,7 @@
    "gitignore": {
      "inputs": {
        "nixpkgs": [
-          "nixvim",
+          "simple-nixos-mailserver",
          "git-hooks",
          "nixpkgs"
        ]
@ -189,11 +168,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1744375210,
-        "narHash": "sha256-aMnp0e+oGmsZ+VC6mgrE6lUcKMjBPotLesCosejRhdw=",
+        "lastModified": 1748772835,
+        "narHash": "sha256-p/hGSN1DOU/pELQi5PTds8eL+czjmb/0RvwvLm7nGC8=",
        "owner": "rishabh5321",
        "repo": "grayjay-flake",
-        "rev": "ab754473aecde1afad07ab5a5903c9336bcb5442",
+        "rev": "998cbc285d936a45daf07414d03db3f60c133caa",
        "type": "github"
      },
      "original": {
@ -209,43 +188,21 @@
        ]
      },
      "locked": {
-        "lastModified": 1744117652,
-        "narHash": "sha256-t7dFCDl4vIOOUMhEZnJF15aAzkpaup9x4ZRGToDFYWI=",
+        "lastModified": 1748665073,
+        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "b4e98224ad1336751a2ac7493967a4c9f6d9cb3f",
+        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-25.05",
        "repo": "home-manager",
        "type": "github"
      }
    },
    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743808813,
-        "narHash": "sha256-2lDQBOmlz9ggPxcS7/GvcVdzXMIiT+PpMao6FbLJSr0=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "a9f8b3db211b4609ddd83683f9db89796c7f6ac6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.11",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_3": {
      "inputs": {
        "nixpkgs": [
          "zen-browser",
@ -269,14 +226,15 @@
    "hyprpanel": {
      "inputs": {
        "ags": "ags",
+        "astal": "astal_2",
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1744259355,
-        "narHash": "sha256-gykRJw309t5NLuYXzWw9WhJFKTc4OASmc16M9jD/Vpw=",
+        "lastModified": 1748962037,
+        "narHash": "sha256-MkrOyZ6CqTzzmlfmvkPiezy51hG96xqucrR38xQpK/0=",
        "owner": "Jas-SinghFSU",
        "repo": "HyprPanel",
-        "rev": "1d4d2dcc20ebd707d5e45c7e357acc1267a498d7",
+        "rev": "8422c6b80526f8289a30b93cb5b354d9f007141d",
        "type": "github"
      },
      "original": {
@ -285,63 +243,13 @@
        "type": "github"
      }
    },
-    "ixx": {
-      "inputs": {
-        "flake-utils": [
-          "nixvim",
-          "nuschtosSearch",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixvim",
-          "nuschtosSearch",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729958008,
-        "narHash": "sha256-EiOq8jF4Z/zQe0QYVc3+qSKxRK//CFHMB84aYrYGwEs=",
-        "owner": "NuschtOS",
-        "repo": "ixx",
-        "rev": "9fd01aad037f345350eab2cd45e1946cc66da4eb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "ref": "v0.0.6",
-        "repo": "ixx",
-        "type": "github"
-      }
-    },
-    "nix-darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743127615,
-        "narHash": "sha256-+sMGqywrSr50BGMLMeY789mSrzjkoxZiu61eWjYS/8o=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "fc843893cecc1838a59713ee3e50e9e7edc6207c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "nix-darwin-24.11",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1744098102,
-        "narHash": "sha256-tzCdyIJj9AjysC3OuKA+tMD/kDEDAF9mICPDU7ix0JA=",
+        "lastModified": 1744463964,
+        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c8cd81426f45942bb2906d5ed2fe21d2f19d95b7",
+        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
        "type": "github"
      },
      "original": {
@ -351,29 +259,45 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
+    "nixpkgs-25_05": {
      "locked": {
-        "lastModified": 1744309437,
-        "narHash": "sha256-QZnNHM823am8apCqKSPdtnzPGTy2ZB4zIXOVoBp5+W0=",
+        "lastModified": 1747610100,
+        "narHash": "sha256-rpR5ZPMkWzcnCcYYo3lScqfuzEw5Uyfh+R0EKZfroAc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f9ebe33a928b5d529c895202263a5ce46bdf12f7",
+        "rev": "ca49c4304acf0973078db0a9d200fd2bae75676d",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1748889542,
+        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1744232761,
-        "narHash": "sha256-gbl9hE39nQRpZaLjhWKmEu5ejtQsgI5TWYrIVVJn30U=",
+        "lastModified": 1748693115,
+        "narHash": "sha256-StSrWhklmDuXT93yc3GrTlb0cKSS0agTAxMGjLKAsY8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f675531bc7e6657c10a18b565cfebd8aa9e24c14",
+        "rev": "910796cabe436259a29a72e8d3f5e180fc6dfacc",
        "type": "github"
      },
      "original": {
@ -385,11 +309,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1744232761,
-        "narHash": "sha256-gbl9hE39nQRpZaLjhWKmEu5ejtQsgI5TWYrIVVJn30U=",
+        "lastModified": 1748693115,
+        "narHash": "sha256-StSrWhklmDuXT93yc3GrTlb0cKSS0agTAxMGjLKAsY8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f675531bc7e6657c10a18b565cfebd8aa9e24c14",
+        "rev": "910796cabe436259a29a72e8d3f5e180fc6dfacc",
        "type": "github"
      },
      "original": {
@ -401,11 +325,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1736344531,
-        "narHash": "sha256-8YVQ9ZbSfuUk2bUf2KRj60NRraLPKPS0Q4QFTbc+c2c=",
+        "lastModified": 1748370509,
+        "narHash": "sha256-QlL8slIgc16W5UaI3w7xHQEP+Qmv/6vSNTpoZrrSlbk=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "bffc22eb12172e6db3c5dde9e3e5628f8e3e7912",
+        "rev": "4faa5f5321320e49a78ae7848582f684d64783e9",
        "type": "github"
      },
      "original": {
@ -417,21 +341,37 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1744309437,
-        "narHash": "sha256-QZnNHM823am8apCqKSPdtnzPGTy2ZB4zIXOVoBp5+W0=",
+        "lastModified": 1748889542,
+        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f9ebe33a928b5d529c895202263a5ce46bdf12f7",
+        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1747179050,
+        "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
      "locked": {
        "lastModified": 1743448293,
        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
@ -447,58 +387,6 @@
        "type": "github"
      }
    },
-    "nixvim": {
-      "inputs": {
-        "devshell": "devshell",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "git-hooks": "git-hooks",
-        "home-manager": "home-manager_2",
-        "nix-darwin": "nix-darwin",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nuschtosSearch": "nuschtosSearch",
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1743856924,
-        "narHash": "sha256-CgCbUGd9y639PfcuzA0TrA6O5N1ICl+mB95+qTG52+E=",
-        "owner": "nix-community",
-        "repo": "nixvim",
-        "rev": "d209a04d349febe85c777078ca2eeea5e8bbc8a1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "nixos-24.11",
-        "repo": "nixvim",
-        "type": "github"
-      }
-    },
-    "nuschtosSearch": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "ixx": "ixx",
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743683223,
-        "narHash": "sha256-LdXtHFvhEC3S64dphap1pkkzwjErbW65eH1VRerCUT0=",
-        "owner": "NuschtOS",
-        "repo": "search",
-        "rev": "56a49ffef2908dad1e9a8adef1f18802bc760962",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "repo": "search",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "catppuccin": "catppuccin",
@ -508,12 +396,35 @@
        "nixpkgs": "nixpkgs_4",
        "nixpkgs-stable": "nixpkgs-stable",
        "nixpkgs-unstable": "nixpkgs-unstable",
-        "nixvim": "nixvim",
+        "simple-nixos-mailserver": "simple-nixos-mailserver",
        "sops-nix": "sops-nix",
        "spicetify-nix": "spicetify-nix",
        "zen-browser": "zen-browser"
      }
    },
+    "simple-nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_5",
+        "nixpkgs-25_05": "nixpkgs-25_05"
+      },
+      "locked": {
+        "lastModified": 1747965231,
+        "narHash": "sha256-BW3ktviEhfCN/z3+kEyzpDKAI8qFTwO7+S0NVA0C90o=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "53007af63fade28853408370c4c600a63dd97f41",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "ref": "nixos-25.05",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
@ -521,11 +432,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1744103455,
-        "narHash": "sha256-SR6+qjkPjGQG+8eM4dCcVtss8r9bre/LAxFMPJpaZeU=",
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
        "owner": "mic92",
        "repo": "sops-nix",
-        "rev": "69d5a5a4635c27dae5a742f36108beccc506c1ba",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
        "type": "github"
      },
      "original": {
@ -539,14 +450,14 @@
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
-        "systems": "systems_2"
+        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1744423915,
-        "narHash": "sha256-6Hd8VyrOlmjlDBgPpx9NwX4+/uO4gEDIyjqbQLyniwE=",
+        "lastModified": 1748752728,
+        "narHash": "sha256-en008ncPUQjVx2i3PbM4RWeZkD9DNbJwIy0epppXe2o=",
        "owner": "Gerg-L",
        "repo": "spicetify-nix",
-        "rev": "4c4b9611c71d586ea818fa5b8dcbd81129f62560",
+        "rev": "0e03de40d5128eb2ad600c98f57cf5db2cdf3240",
        "type": "github"
      },
      "original": {
@ -570,53 +481,17 @@
        "type": "github"
      }
    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743748085,
-        "narHash": "sha256-uhjnlaVTWo5iD3LXics1rp9gaKgDRQj6660+gbUU3cE=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "815e4121d6a5d504c0f96e5be2dd7f871e4fd99d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
    "zen-browser": {
      "inputs": {
-        "home-manager": "home-manager_3",
-        "nixpkgs": "nixpkgs_5"
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
-        "lastModified": 1744406237,
-        "narHash": "sha256-Xbt5m3/ZNeye4b42rCZOLbD8OhCOeJfUSEJ+FvfXwpg=",
+        "lastModified": 1748920570,
+        "narHash": "sha256-m7EshkqPxa3IxN/qwxP1LlMlRdn37aiK0hghDieho8A=",
        "owner": "0xc000022070",
        "repo": "zen-browser-flake",
-        "rev": "4d9ee0daab52a7a205e69cfddcd441ffaa09c802",
+        "rev": "ff5bf0bcf588e8c1d0f5fcd635b0c8e1cce8aee5",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -5,17 +5,17 @@
    #
    # ========= Official NixOS and HM Package Sources =========
    #
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    # The next two are for pinning to stable vs unstable regardless of what the above is set to
    # This is particularly useful when an upcoming stable release is in beta because you can effectively
    # keep 'nixpkgs-stable' set to stable for critical packages while setting 'nixpkgs' to the beta branch to
    # get a jump start on deprecation changes.
    # See also 'stable-packages' and 'unstable-packages' overlays at 'overlays/default.nix"
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";

    home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@ -28,18 +28,10 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Catppuccin theming
-    catppuccin = {
-      url = "github:catppuccin/nix";
-    };
-    # vim
-    nixvim = {
-      url = "github:nix-community/nixvim/nixos-24.11";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    catppuccin.url = "github:catppuccin/nix";
    # Bar
-    hyprpanel = {
-      url = "github:Jas-SinghFSU/HyprPanel";
-    };
+    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.05";
    # Spotify
    spicetify-nix = {
      url = "github:Gerg-L/spicetify-nix";
@ -56,6 +48,7 @@
      self,
      nixpkgs,
      home-manager,
+      simple-nixos-mailserver,
      ...
    }@inputs:
    let
@ -78,14 +71,51 @@
      lib = nixpkgs.lib.extend customLib;
      libHm = home-manager.lib.extend customLib;

-      systems = [
+      systems = builtins.map (config: defaultAttrs // config) [
        {
          hostName = "desktop";
-          system = "x86_64-linux";
+          nvidia.enable = true;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSzXyTuQyTrWsfORQbvgrqt/33+hfSUDXeMg6D1T2wz";
        }
        {
          hostName = "thinkpad";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNlHKE/BD8kKfhJD7GBk1A3whZf3gTjk9VEgGAj3qsH";
+        }
+        {
+          hostName = "pi4";
+          system = "aarch64-linux";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJE9m7YiITe1sDqSZ7Pa8luIw3WToLsypixZEqE4wCQE";
+          address.private = common.localIpAddr 188;
+        }
+        {
+          hostName = "homelab";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIARDv5nRlfPDXdV+Db4FaqeSJZ3/3MO0frYGzuVeqYAl";
+          address.private = common.localIpAddr 231;
+          address.tailnet = common.tailnetAddr "admin";
+        }
+      ];
+
+      defaultAttrs = {
+        hostName = builtins.abort "hostName is required";
        system = "x86_64-linux";
+        username = common.username;
+        version = common.system.version;
+        wayland.enable = true;
+        nvidia.enable = false;
+      };
+
+      knownSystems = [
+        {
+          # Samsung S23 FE
+          hostName = "localhost-y4maoyqm";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII7SSjiqnjif1Kko60iXVTKJ7a1/lRlR8TFNtoclNcnQ";
+        }
+        {
+          # OnePlus 8
+          hostName = "localhost-4izgka9k";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALtulVgLrUEpKnpfPFQTHjaEXTxs2Q818NC18eLx0bj";
        }
      ];

@ -105,12 +135,10 @@
          {
            hostName,
            system,
-            user ? {
-              name = common.username;
-              password = "temp";
-            },
-            version ? common.version,
-          }:
+            username,
+            ...
+          }@systemConfig:
+
          {
            name = hostName;
            value = nixpkgs.lib.nixosSystem {
@ -122,8 +150,9 @@
                  common
                  theme
                  lib
-                  hostName
-                  version
+                  systemConfig
+                  systems
+                  knownSystems
                  ;
                isDarwin = false;
              };
@ -142,11 +171,11 @@
                        common
                        theme
                        libHm
-                        hostName
-                        version
+                        systemConfig
+                        systems
                        ;
                    };
-                    users.${user.name} = import ./hosts/${hostName}/home-manager;
+                    users.${username} = import ./hosts/${hostName}/home-manager;
                  };
                }
                {
--- a/hosts/desktop/bluetooth.nix
+++ b/hosts/desktop/bluetooth.nix
@ -0,0 +1,18 @@
+{ pkgs, ... }:
+
+{
+  hardware.bluetooth = {
+    enable = true;
+    input = {
+      # Required to get PS3 controllers working
+      General = {
+        ClassicBondedOnly = false;
+        UserspaceHID = false;
+      };
+    };
+    powerOnBoot = true;
+    package = pkgs.unstable.bluez;
+  };
+
+  services.blueman.enable = true;
+}
--- a/hosts/desktop/common.nix
+++ b/hosts/desktop/common.nix
@ -0,0 +1,4 @@
+{
+  monitor1 = "DP-1";
+  monitor2 = "DP-3";
+}
--- a/hosts/desktop/default.nix
+++ b/hosts/desktop/default.nix
@ -1,70 +1,15 @@
 {
+  lib,
  pkgs,
-  inputs,
-  outputs,
-  common,
  ...
 }:

 {
-  imports = [ ./modules ];
-
-  nixpkgs.overlays = [ outputs.overlays.unstable-packages ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  # Define a user account. Don't forget to set a password with 'passwd'.
-  users.users.${common.username} = {
-    isNormalUser = true;
-    description = common.username;
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-  };
-
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-
-  environment.sessionVariables = {
-    # Tells Electron apps to use Wayland
-    NIXOS_OZONE_WL = "1";
-  };
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-    wget
-    xdg-utils
-    xdg-desktop-portal
-    xdg-desktop-portal-gtk
-    unstable.protonmail-desktop
-    stremio
-    fastfetch
-    discord
-    nix-prefetch-github # Cmd to get rev and hash from GitHub
-    gimp
-    vlc
-    vdhcoapp # TODO run "vdhcoapp install" on startup
-    onlyoffice-desktopeditors
-    inputs.grayjay.packages.${system}.grayjay
+  imports = [
+    (lib.custom.relativeToDesktop "modules")
+    ./bluetooth.nix
+    ./hardware-configuration.nix
  ];

-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  programs.kdeconnect.enable = true;
-
-  services = {
-    flatpak.enable = false;
-    xserver.enable = true;
-  };
-
-  system.stateVersion = common.system.version;
+  boot.kernelPackages = pkgs.linuxPackages_6_14;
 }
--- a/hosts/desktop/modules/hardware/hardware-configuration.nix
+++ b/hosts/desktop/modules/hardware/hardware-configuration.nix
@ -1,10 +1,6 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
  config,
  lib,
-  pkgs,
  modulesPath,
  ...
 }:
--- a/hosts/desktop/home-manager/default.nix
+++ b/hosts/desktop/home-manager/default.nix
@ -1,53 +1,14 @@
 {
-  inputs,
-  outputs,
-  common,
+  lib,
  ...
 }:
-let
-  username = common.username;
-  dir = common.dir;
-in
+
 {
  imports = [
-    inputs.catppuccin.homeModules.catppuccin
-    ./btop.nix
-    ./cava
-    ./cursors.nix
-    ./default-applications.nix
-    ./development
-    ./fastfetch.nix
-    ./fish.nix
-    ./freetube.nix
-    ./gtk.nix
-    ./gpg.nix
-    ./kitty.nix
-    ./media
-    ./nextcloud.nix
-    ./rofi
-    ./hyprland
-    ./spicetify.nix
-    ./yazi
-    ./zen
+    (lib.custom.relativeToDesktop "home-manager")
+    ./hyprpaper.nix
+    ./settings.nix
  ];

-  home = {
-    username = username;
-    homeDirectory = dir.home;
-
-    sessionVariables = {
-      XDG_PICTURES_DIR = dir.pictures; # Define the default dir for pictures
-    };
-
-    # You can update Home Manager without changing this value. See
-    # the Home Manager release notes for a list of state version
-    # changes in each release.
-    stateVersion = common.system.version;
-  };
-
-  # Adds pkgs.unstable in order to fetch packages from unstable repositories
-  nixpkgs.overlays = [ outputs.overlays.unstable-packages ];
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
+  programs.git.signing.key = "706F53DD087A91DE";
 }
--- a/hosts/desktop/home-manager/development/nixvim/default.nix
+++ b/hosts/desktop/home-manager/development/nixvim/default.nix
@ -1,77 +0,0 @@
-# Neovim configuration for Nix
-{ inputs, ... }:
-
-{
-  imports = [
-    inputs.nixvim.homeManagerModules.nixvim
-  ];
-
-  catppuccin.nvim.enable = true;
-
-  home.sessionVariables.EDITOR = "nvim";
-
-  programs.nixvim = {
-    enable = true;
-    clipboard.providers.wl-copy.enable = true;
-    colorschemes.catppuccin.enable = true;
-    defaultEditor = true;
-    vimdiffAlias = true; # Alias vimdiff to nvim -d
-
-    opts = {
-      number = true; # Show line numbers
-      relativenumber = true; # Show relative line numbers
-
-      shiftwidth = 2; # Tab width should be 2
-    };
-
-    plugins = {
-      bufferline.enable = false;
-
-      # Formatters
-      conform-nvim = {
-        enable = true;
-        # TODO use nix fmt on save
-        settings = { };
-      };
-
-      lsp = {
-        enable = true;
-        servers = {
-          nixd.enable = true;
-        };
-      };
-
-      lualine.enable = true;
-      luasnip.enable = true;
-
-      # Completions
-      cmp = {
-        enable = true;
-
-        autoEnableSources = true;
-
-        # TODO complete on <tab>
-        settings = {
-          sources = [
-            { name = "nvim-lsp"; }
-            { name = "path"; }
-            { name = "buffer"; }
-          ];
-        };
-      };
-
-      treesitter.enable = true;
-      web-devicons.enable = true;
-    };
-
-    extraConfigLua = ''
-      -- Translucent background
-      vim.cmd [[
-        highlight Normal guibg=none
-        highlight NonText guibg=none
-        highlight Normal ctermbg=none
-        highlight NonText ctermbg=none
-      ]]
-    '';
-  };
-}
--- a/hosts/desktop/home-manager/hyprpaper.nix
+++ b/hosts/desktop/home-manager/hyprpaper.nix
@ -0,0 +1,29 @@
+# Wallpapers
+{
+  lib,
+  theme,
+  ...
+}:
+
+{
+  services.hyprpaper.settings =
+    let
+      wallpaper1 = builtins.toString theme.wallpaper.monitor1;
+      wallpaper2 = builtins.toString theme.wallpaper.monitor2;
+    in
+    {
+      preload = lib.mkForce [
+        wallpaper1
+        wallpaper2
+      ];
+
+      wallpaper =
+        let
+          common = import ../common.nix;
+        in
+        lib.mkForce [
+          "${common.monitor1},${wallpaper1}"
+          "${common.monitor2},${wallpaper2}"
+        ];
+    };
+}
--- a/hosts/desktop/home-manager/settings.nix
+++ b/hosts/desktop/home-manager/settings.nix
@ -0,0 +1,12 @@
+{ lib, ... }:
+
+{
+  wayland.windowManager.hyprland.settings.monitor =
+    let
+      common = import ../common.nix;
+    in
+    lib.mkForce [
+      "${common.monitor1}, 3440x1440@175, 0x0, 1"
+      "${common.monitor2}, 3840x2160@60, 3440x0, 1.5, transform, 1"
+    ];
+}
--- a/hosts/desktop/home-manager/yazi/catppuccin-mocha.tmTheme
+++ b/hosts/desktop/home-manager/yazi/catppuccin-mocha.tmTheme
--- a/hosts/desktop/home-manager/yazi/default.nix
+++ b/hosts/desktop/home-manager/yazi/default.nix
@ -1,326 +0,0 @@
-{ lib, theme, ... }:
-let
-  batTheme = ".config/yazi/catppuccin-${theme.flavor}.tmTheme";
-in
-{
-  home.file.${batTheme}.source = ./catppuccin-mocha.tmTheme;
-
-  programs.yazi = {
-    enable = true;
-    settings = {
-      manager = {
-        ratio = [
-          2
-          4
-          2
-        ];
-        sort_by = "natural";
-        sort_sensitive = true;
-        sort_reverse = false;
-        sort_dir_first = true;
-        linemode = "none";
-        show_hidden = true;
-        show_symlink = true;
-      };
-
-      preview = {
-        image_filter = "lanczos3";
-        image_quality = 90;
-        tab_size = 1;
-        max_width = 600;
-        max_height = 900;
-        cache_dir = "";
-        ueberzug_scale = 1;
-        ueberzug_offset = [
-          0
-          0
-          0
-          0
-        ];
-      };
-
-      tasks = {
-        micro_workers = 5;
-        macro_workers = 10;
-        bizarre_retry = 5;
-      };
-    };
-    theme = lib.mkForce {
-      manager = {
-        cwd = {
-          fg = "#${theme.tealAlpha}";
-        };
-
-        hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-        preview_hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-
-        find_keyword = {
-          fg = "#${theme.yellowAlpha}";
-          italic = true;
-        };
-        find_position = {
-          fg = "#${theme.pinkAlpha}";
-          bg = "reset";
-          italic = true;
-        };
-
-        marker_copied = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        marker_cut = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        marker_marked = {
-          fg = "#${theme.tealAlpha}";
-          bg = "#${theme.tealAlpha}";
-        };
-        marker_selected = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        tab_active = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-        tab_inactive = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        tab_width = 1;
-
-        count_copied = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        count_cut = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        count_selected = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        border_symbol = "│";
-        border_style.fg = "#${theme.overlay1Alpha}";
-
-        syntect_theme = "~/${batTheme}";
-      };
-
-      mode = {
-        normal_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-          bold = true;
-        };
-        normal_alt = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        select_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-          bold = true;
-        };
-        select_alt = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        unset_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.flamingoAlpha}";
-          bold = true;
-        };
-        unset_alt = {
-          fg = "#${theme.flamingoAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-      };
-
-      status = {
-        separator_open = "";
-        separator_close = "";
-
-        progress_label = {
-          fg = "#ffffff";
-          bold = true;
-        };
-        progress_normal = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        progress_error = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-
-        perm_type = {
-          fg = "#${theme.blueAlpha}";
-        };
-        perm_read = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        perm_write = {
-          fg = "#${theme.redAlpha}";
-        };
-        perm_exec = {
-          fg = "#${theme.greenAlpha}";
-        };
-        perm_sep = {
-          fg = "#${theme.overlay1Alpha}";
-        };
-      };
-
-      input = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        value = { };
-        selected.reversed = true;
-      };
-
-      pick = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        active = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        inactive = { };
-      };
-
-      confirm = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = {
-          fg = "#${theme.blueAlpha}";
-        };
-        content = { };
-        list = { };
-        btn_yes = {
-          reversed = true;
-        };
-        btn_no = { };
-      };
-
-      completion = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-      };
-      tasks = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        hovered = {
-          underline = true;
-        };
-      };
-
-      which = {
-        mask = {
-          bg = "#${theme.surface0Alpha}";
-        };
-        cand = {
-          fg = "#${theme.tealAlpha}";
-        };
-        rest = {
-          fg = "#9399b2";
-        };
-        desc = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        separator = "  ";
-        separator_style = {
-          fg = "#${theme.surface2Alpha}";
-        };
-      };
-      help = {
-        on = {
-          fg = "#${theme.tealAlpha}";
-        };
-        run = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        desc = {
-          fg = "#9399b2";
-        };
-        hovered = {
-          bg = "#${theme.surface2Alpha}";
-          bold = true;
-        };
-        footer = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-      };
-
-      notify = {
-        title_info = {
-          fg = "#${theme.tealAlpha}";
-        };
-        title_warn = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        title_error = {
-          fg = "#${theme.redAlpha}";
-        };
-      };
-      filetype = {
-        rules = [
-          # Media
-          {
-            mime = "image/*";
-            fg = "#${theme.tealAlpha}";
-          }
-          {
-            mime = "{audio;video}/*";
-            fg = "#${theme.yellowAlpha}";
-          }
-
-          # Archives
-          {
-            mime = "application/*zip";
-            fg = "#${theme.pinkAlpha}";
-          }
-          {
-            mime = "application/x-{tar;bzip*;7z-compressed;xz;rar}";
-            fg = "#${theme.pinkAlpha}";
-          }
-
-          # Documents
-          {
-            mime = "application/{pdf;doc;rtf}";
-            fg = "#${theme.greenAlpha}";
-          }
-
-          # Fallback
-          {
-            name = "*";
-            fg = "#${theme.textAlpha}";
-          }
-          {
-            name = "*/";
-            fg = "#${theme.blueAlpha}";
-          }
-        ];
-      };
-
-      icon = import ./icons.nix;
-    };
-  };
-}
--- a/hosts/desktop/home-manager/yazi/icons.nix
+++ b/hosts/desktop/home-manager/yazi/icons.nix
--- a/hosts/desktop/home-manager/zen/default.nix
+++ b/hosts/desktop/home-manager/zen/default.nix
@ -1,12 +1,7 @@
-{ pkgs, inputs, ... }:
-
 {
-  # TODO programatically get default name
-  home = {
-    file.".zen/audtxq7n.default/chrome" = {
+  # TODO merge with shared
+  home.file.".zen/audtxq7n.default/chrome" = {
    source = ./chrome;
    recursive = true;
  };
-    packages = with pkgs; [ inputs.zen-browser.packages.${system}.default ]; # Beta
-  };
 }
--- a/hosts/desktop/modules/default.nix
+++ b/hosts/desktop/modules/default.nix
@ -1,17 +0,0 @@
-{
-  imports = [
-    ./development
-    ./fonts.nix
-    ./gaming
-    ./gnome
-    ./hardware
-    ./locale.nix
-    ./networking.nix
-    ./nix-helper.nix
-    ./hyprland
-    ./sddm.nix
-    ./security.nix
-    ./shell.nix
-    ./qt.nix
-  ];
-}
--- a/hosts/desktop/modules/development/ollama.nix
+++ b/hosts/desktop/modules/development/ollama.nix
@ -1,6 +0,0 @@
-{
-  services.ollama = {
-    enable = true;
-    acceleration = "cuda";
-  };
-}
--- a/hosts/desktop/modules/fonts.nix
+++ b/hosts/desktop/modules/fonts.nix
@ -1,19 +0,0 @@
-{ pkgs, theme, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    font-awesome # Icons
-  ];
-
-  fonts = {
-    fontconfig.enable = true;
-    packages = with pkgs; [
-      (nerdfonts.override { fonts = [ theme.nerdFont ]; })
-      jetbrains-mono
-      # The line below will replace the lines above in 25.05
-      # nerd-fonts.jetbrains-mono
-      font-awesome
-    ];
-  };
-
-}
--- a/hosts/desktop/modules/hardware/audio.nix
+++ b/hosts/desktop/modules/hardware/audio.nix
@ -1,33 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-
-    wireplumber
-    playerctl # Interaction with audioplayers and browsers
-    pavucontrol # GUI
-    spotify
-  ];
-
-  hardware.pulseaudio.enable = false; # Will be moved to services in 25.05
-
-  security.rtkit.enable = true; # Enable RealtimeKit for audio purposes
-
-  services = {
-    pipewire = {
-      enable = true;
-      alsa = {
-        enable = true;
-        support32Bit = true;
-      };
-      pulse.enable = true;
-      # Uncomment the following line if you want to use JACK applications
-      # jack.enable = true;
-    };
-    # pulseaudio.enable = false; # TODO uncommenct at 25.05
-  };
-}
--- a/hosts/desktop/modules/networking.nix
+++ b/hosts/desktop/modules/networking.nix
@ -1,22 +0,0 @@
-{ hostName, ... }:
-
-{
-  networking = {
-    networkmanager.enable = true;
-    inherit hostName;
-    # wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  };
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  programs.ssh.enableAskPassword = false;
-
-  services.tailscale.enable = true;
-}
--- a/hosts/desktop/modules/nix-helper.nix
+++ b/hosts/desktop/modules/nix-helper.nix
@ -1,12 +0,0 @@
-# Nix-Helper: github.com/viperML/nh
-{
-  programs.nh = {
-    enable = true;
-    flake = ../.;
-    clean = {
-      enable = true;
-      dates = "weekly";
-      extraArgs = "--keep-since 30d";
-    };
-  };
-}
--- a/hosts/desktop/modules/qt.nix
+++ b/hosts/desktop/modules/qt.nix
@ -1,17 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment = {
-    sessionVariables = {
-      QT_QPA_PLATFORMTHEME = "qt6ct";
-      QT_QPA_PLATFORM = "wayland"; # Enable Wayland for QT
-    };
-    systemPackages = with pkgs.kdePackages; [
-      qtwayland
-      qtsvg
-      qt6ct
-    ];
-  };
-
-  qt.enable = true;
-}
--- a/hosts/desktop/modules/sddm.nix
+++ b/hosts/desktop/modules/sddm.nix
@ -1,22 +0,0 @@
-{ pkgs, theme, ... }:
-let
-  flavor = theme.flavor;
-in
-{
-  environment.systemPackages = with pkgs; [
-    (catppuccin-sddm.override {
-      flavor = flavor;
-      font = theme.nerdFont;
-      fontSize = "9";
-      background = builtins.toString ../assets/catppuccin_high.png;
-      loginBackground = true;
-    })
-  ];
-
-  services.displayManager.sddm = {
-    enable = true;
-    theme = "catppuccin-${flavor}";
-    wayland.enable = true;
-    package = pkgs.kdePackages.sddm;
-  };
-}
--- a/hosts/pi4/actual.nix
+++ b/hosts/pi4/actual.nix
@ -0,0 +1,44 @@
+{ config, common, ... }:
+let
+  domain = "beta.budget.${common.domain}";
+  port = 8084;
+in
+{
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-*" ];
+    externalInterface = "wlan0";
+    # Lazy IPv6 connectivity for the container
+    enableIPv6 = true;
+  };
+
+  containers.actual = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.10.188";
+    localAddress = "192.168.10.11";
+    config =
+      { ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ port ];
+        services = {
+          actual = {
+            enable = true;
+            settings = {
+              inherit port;
+              loginMethod = "password";
+            };
+          };
+        };
+        system.stateVersion = common.system.version;
+      };
+  };
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${config.containers.actual.localAddress}:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}
--- a/hosts/pi4/boot.nix
+++ b/hosts/pi4/boot.nix
@ -0,0 +1,16 @@
+{ pkgs, ... }:
+
+{
+  boot = {
+    kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "usbhid"
+      "usb_storage"
+    ];
+    loader = {
+      grub.enable = false;
+      generic-extlinux-compatible.enable = true;
+    };
+  };
+}
--- a/hosts/pi4/caddy.nix
+++ b/hosts/pi4/caddy.nix
@ -0,0 +1,91 @@
+{ common, ... }:
+let
+  domain = common.domain;
+in
+{
+  services.caddy = {
+    enable = false;
+    email = "cert@${domain}";
+    virtualHosts =
+      let
+        localProxy = proxyTo "localhost";
+        homelabProxy = proxyTo "192.168.10.231";
+        proxyTo = ip: port: "reverse_proxy ${ip}:${builtins.toString port}";
+        redirect = subdomain: "redir https://${subdomain}.${domain}{uri}";
+      in
+      {
+        "beta.${domain}".extraConfig = ''
+          redir https://${domain}{uri}
+        '';
+        "git.${domain}".extraConfig = ''
+          ${redirect "code"}
+        '';
+        "kitchenowl.${domain}".extraConfig = ''
+          ${redirect "grocery"}
+        '';
+        # Gitea
+        "code.${domain}".extraConfig = ''
+          ${homelabProxy 3000}
+        '';
+        # Forgejo
+        "beta.code.${domain}".extraConfig = ''
+          ${localProxy 8001}
+        '';
+        # Nextcloud
+        "nextcloud.${domain}".extraConfig = ''
+          redir /.well-known/carddav /remote.php/dav 301
+          redir /.well-known/caldav /remote.php/dav 301
+          ${homelabProxy 11000}
+        '';
+        # Kitchenowl
+        "grocery.${domain}".extraConfig = ''
+          ${homelabProxy 800}
+        '';
+        # Actual Budget
+        "budget.${domain}".extraConfig = ''
+          ${homelabProxy 5006}
+        '';
+        # Uptime Kuma
+        "status.${domain}".extraConfig = ''
+          ${homelabProxy 3001}
+        '';
+        # Headscale
+        "vpn.${domain}".extraConfig = ''
+          reverse_proxy /web* 192.168.10.231:8084
+          reverse_proxy * 192.168.10.231:8082
+        '';
+        # Headscale SmartDNS
+        "dns.${domain}".extraConfig = ''
+          ${homelabProxy 8082}
+        '';
+        # FreshRSS
+        "rss.${domain}".extraConfig = ''
+          ${homelabProxy 8085}
+        '';
+        # Ente backend
+        "api.ente.${domain}".extraConfig = ''
+          ${homelabProxy 8083}
+        '';
+        # Ente Photos frontend
+        "ente.${domain}".extraConfig = ''
+          ${homelabProxy 3003}
+        '';
+        # Ente Auth frontend
+        "mfa.${domain}".extraConfig = ''
+          ${homelabProxy 3004}
+        '';
+        # Homepage / portfolio
+        "${domain}".extraConfig = ''
+          ${homelabProxy 4321}
+        '';
+        # Yamtrack
+        "track.${domain}".extraConfig = ''
+          ${homelabProxy 8090}
+        '';
+        # Donetick
+        "chore.${domain}".extraConfig = ''
+          ${homelabProxy 2021}
+        '';
+      };
+  };
+}
--- a/hosts/pi4/default.nix
+++ b/hosts/pi4/default.nix
@ -1,54 +1,19 @@
-{
-  pkgs,
-  hostName,
-  user,
-  version,
-  ...
-}:
+{ lib, ... }:

 {
-  boot = {
-    kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "usbhid"
-      "usb_storage"
+  imports = with lib.custom; [
+    (relativeToBase "modules")
+    ./actual.nix
+    ./boot.nix
+    ./caddy.nix
+    ./forgejo.nix
+    ./hardware.nix
+    ./headscale.nix
+    ./mailserver.nix
+    ./nextcloud.nix
+    ./nginx.nix
+    ./podman.nix
+    ./postgres.nix
+    ./security
  ];
-    loader = {
-      grub.enable = false;
-      generic-extlinux-compatible.enable = true;
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    vim
-  ];
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-      options = [ "noatime" ];
-    };
-  };
-
-  hardware.enableRedistributableFirmware = true;
-
-  networking = {
-    inherit hostName;
-    networkmanager.enable = true;
-  };
-
-  services.openssh.enable = true;
-
-  system.stateVersion = version;
-
-  users = {
-    mutableUsers = false;
-    users.${user.name} = {
-      isNormalUser = true;
-      password = user.password;
-      extraGroups = [ "wheel" ];
-    };
-  };
 }
--- a/hosts/pi4/forgejo.nix
+++ b/hosts/pi4/forgejo.nix
@ -0,0 +1,94 @@
+{
+  config,
+  pkgs,
+  lib,
+  systemConfig,
+  common,
+  ...
+}:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+  domain = "beta.code.${common.domain}";
+  passwordKey = "forgejo/admin-pass";
+  runnerTokenKey = "forgejo/runner-token";
+in
+{
+  services = {
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString srv.HTTP_PORT}";
+      serverAliases = [ "beta.git.${common.domain}" ];
+    };
+
+    forgejo = {
+      enable = true;
+      database.type = "postgres";
+      # Enable support for Git Large File Storage
+      lfs.enable = true;
+
+      secrets.mailer.PASSWD = config.sops.secrets."mailserver/password-hash".path;
+
+      settings = {
+        server = {
+          DOMAIN = domain;
+          # You need to specify this to remove the port from URLs in the web UI.
+          ROOT_URL = "https://${domain}/";
+          HTTP_PORT = 8002;
+        };
+        # You can temporarily allow registration to create an admin user.
+        service.DISABLE_REGISTRATION = true;
+        # Add support for actions, based on act: https://github.com/nektos/act
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
+        # Sending emails is completely optional
+        # You can send a test email from the web UI at:
+        # Profile Picture > Site Administration > Configuration >  Mailer Configuration
+        mailer = lib.mkIf config.mailserver.enable {
+          ENABLED = true;
+          PROTOCOL = "smtps";
+          SMTP_ADDR = config.mailserver.fqdn;
+          FROM = "noreply-forgejo@${common.domain}";
+          USER = "${systemConfig.username}@${common.domain}";
+        };
+      };
+    };
+    gitea-actions-runner = {
+      package = pkgs.forgejo-actions-runner;
+      instances.default = {
+        enable = true;
+        name = "monolith";
+        url = "https://${domain}";
+        # Obtaining the path to the runner token file may differ
+        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+        tokenFile = config.sops.secrets.${runnerTokenKey}.path;
+        labels = [
+          "docker:docker://node:20-bullseye"
+          "native:host"
+        ];
+      };
+    };
+  };
+
+  sops.secrets = {
+    ${passwordKey}.owner = "forgejo";
+    ${runnerTokenKey}.owner = "forgejo";
+  };
+
+  # Create a single admin user / update password if exists
+  systemd.services.forgejo.preStart =
+    let
+      adminCmd = "${lib.getExe config.services.forgejo.package} admin user";
+      pwd = config.sops.secrets.${passwordKey};
+      user = "martin"; # Note, Forgejo doesn't allow creation of an account named "admin"
+      email = "git@${common.domain}";
+    in
+    ''
+      ${adminCmd} create --admin --email "${email}" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+      ## Alter an existing user. Will prompt new password on login
+      # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+    '';
+}
--- a/hosts/pi4/hardware.nix
+++ b/hosts/pi4/hardware.nix
@ -0,0 +1,12 @@
+{
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+      options = [ "noatime" ];
+    };
+    # TODO mount ext hdd
+  };
+
+  hardware.enableRedistributableFirmware = true;
+}
--- a/hosts/pi4/headscale.nix
+++ b/hosts/pi4/headscale.nix
@ -0,0 +1,66 @@
+{
+  config,
+  common,
+  ...
+}:
+let
+  cfg = config.services.headscale;
+
+  domain = "beta.vpn.${common.domain}";
+  dnsDomain = "secure.${common.domain}";
+in
+{
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  services = {
+    headscale = {
+      enable = true;
+      address = "0.0.0.0";
+      port = 8083;
+      settings = {
+        database = {
+          postgres = {
+            host = "/run/postgresql";
+            name = "headscale";
+            port = config.services.postgresql.settings.port;
+            user = cfg.user;
+          };
+          type = "postgres";
+        };
+        dns = {
+          base_domain = dnsDomain;
+          magic_dns = true;
+        };
+        logtail.enabled = false;
+        server_url = "https://${domain}";
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+      };
+    };
+
+    postgresql =
+      let
+        psql = cfg.settings.database.postgres;
+      in
+      {
+        ensureDatabases = [ psql.name ];
+        ensureUsers = [
+          {
+            name = psql.user;
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+  };
+
+}
--- a/hosts/pi4/home-manager/default.nix
+++ b/hosts/pi4/home-manager/default.nix
@ -0,0 +1,9 @@
+{ lib, ... }:
+
+{
+  imports = with lib.custom; [
+    (relativeToBase "home-manager")
+  ];
+
+  programs.git.signing.key = "E3FA0E995C0D0E5E";
+}
--- a/hosts/pi4/mailserver.nix
+++ b/hosts/pi4/mailserver.nix
@ -0,0 +1,44 @@
+{
+  config,
+  inputs,
+  common,
+  systemConfig,
+  ...
+}:
+let
+  passwordHashKey = "mailserver/password-hash";
+in
+{
+  imports = [
+    inputs.simple-nixos-mailserver.nixosModule
+  ];
+
+  mailserver = {
+    enable = true;
+    # stateVersion = 1; TODO uncomment on 25.11
+    fqdn = "mail.${common.domain}";
+    domains = [
+      common.domain
+    ];
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "${systemConfig.username}@${common.domain}" = {
+        hashedPasswordFile = config.sops.secrets.${passwordHashKey}.path;
+      };
+    };
+
+    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
+    # down nginx and opens port 80.
+    certificateScheme = "acme-nginx";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    25
+    465
+    587
+  ];
+
+  sops.secrets.${passwordHashKey}.neededForUsers = true;
+}
--- a/hosts/pi4/nextcloud.nix
+++ b/hosts/pi4/nextcloud.nix
@ -0,0 +1,90 @@
+# https://mich-murphy.com/configure-nextcloud-nixos/
+{
+  pkgs,
+  config,
+  common,
+  ...
+}:
+let
+  adminPassKey = "nextcloud/admin-pass";
+  domain = "beta.nextcloud.${common.domain}";
+  dbname = "nextcloud";
+  dbuser = dbname;
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs.${config.services.nextcloud.hostName}.email = "acme@${common.domain}";
+  };
+
+  services = {
+    nextcloud = {
+      enable = true;
+
+      autoUpdateApps.enable = true;
+
+      config = {
+        adminpassFile = config.sops.secrets.${adminPassKey}.path;
+        dbtype = "pgsql";
+        dbname = dbname;
+        dbuser = dbuser;
+        # default directory for postgresql, ensures automatic setup of db
+        dbhost = "/run/postgresql";
+        adminuser = "admin";
+      };
+
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps)
+          contacts
+          deck
+          notes
+          tasks
+          ;
+      };
+      extraAppsEnable = true;
+
+      hostName = domain;
+      https = true;
+
+      maxUploadSize = "0"; # No max limit
+      package = pkgs.nextcloud31;
+
+      settings = {
+        default_phone_region = "NO";
+        trusted_domains = [
+          domain
+        ];
+      };
+    };
+
+    nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+      forceSSL = true;
+      enableACME = true;
+    };
+
+    postgresql = {
+      ensureDatabases = [ dbname ];
+      ensureUsers = [
+        {
+          name = dbuser;
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+    postgresqlBackup = {
+      enable = true;
+      location = "/data/backup/nextclouddb";
+      databases = [ dbname ];
+      # time to start backup in systemd.time format
+      startAt = "*-*-* 23:15:00";
+    };
+  };
+
+  sops.secrets.${adminPassKey}.neededForUsers = true;
+
+  # ensure postgresql db is started with nextcloud
+  systemd.services."nextcloud-setup" = {
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+  };
+}
--- a/hosts/pi4/nginx.nix
+++ b/hosts/pi4/nginx.nix
@ -0,0 +1,94 @@
+{
+  common,
+  ...
+}:
+let
+  domain = common.domain;
+  proxyTo = address: port: {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = "${address}:${builtins.toString port}";
+  };
+  proxyLocations = locations: {
+    enableACME = true;
+    forceSSL = true;
+    inherit locations;
+  };
+  homelab = "http://${common.localIpAddr 231}";
+  homelabProxy = proxyTo homelab; # TODO get homelab local ip from systems
+  redirect = subdomain: {
+    enableACME = true;
+    forceSSL = true;
+    globalRedirect = if subdomain == "" then domain else "${subdomain}.${domain}";
+  };
+in
+{
+  services.nginx = {
+    enable = true;
+    enableReload = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts = {
+      # Beta is currently stable
+      "www.${domain}" = redirect "";
+      "beta.${domain}" = redirect "";
+      "dev.${domain}" = homelabProxy 4322;
+      "git.${domain}" = redirect "code";
+      "kitchenowl.${domain}" = redirect "grocery";
+      # Gitea
+      "code.${domain}" = homelabProxy 3000;
+      # Nextcloud
+      "nextcloud.${domain}" = proxyLocations {
+        "/".proxyPass = "${homelab}:11000";
+        "/.well-known/carddav".return = "301 /remote.php/dav";
+        "/.well-known/caldav".return = "301 /remote.php/dav";
+      };
+      # Kitchenowl
+      "grocery.${domain}" = homelabProxy 800;
+      # Actual budget
+      "budget.${domain}" = homelabProxy 5006;
+      # Uptime Kuma
+      "status.${domain}" = homelabProxy 3001;
+      # Headscale
+      "vpn.${domain}" = proxyLocations {
+        "/web".proxyPass = "${homelab}:8084";
+        "/" = {
+          proxyPass = "${homelab}:8082";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_redirect http:// https://;
+            proxy_buffering off;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+          '';
+        };
+      };
+      # Headscale SmartDNS
+      "dns.${domain}" = homelabProxy 8082;
+      # FreshRSS
+      "rss.${domain}" = homelabProxy 8085;
+      # Ente backend
+      "api.ente.${domain}" = homelabProxy 8083;
+      # Ente Photos frontend
+      "ente.${domain}" = homelabProxy 3003;
+      # Ente Auth frontend
+      "mfa.${domain}" = homelabProxy 3004;
+      # Homepage / portfolio
+      "${domain}" = homelabProxy 4321;
+      # Yamtrack
+      "track.${domain}" = homelabProxy 8090;
+      # Donetick
+      "chore.${domain}" = homelabProxy 2021;
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "acme@${domain}";
+  };
+}
--- a/hosts/pi4/podman.nix
+++ b/hosts/pi4/podman.nix
@ -0,0 +1,23 @@
+{ pkgs, ... }:
+
+{
+  virtualisation = {
+    # Enable common container config files in /etc/containers
+    containers.enable = true;
+    podman = {
+      enable = true;
+
+      # Create a `docker` alias for podman, to use it as a drop-in replacement
+      dockerCompat = true;
+
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  # Useful other development tools
+  environment.systemPackages = with pkgs; [
+    podman-tui # status of containers in the terminal
+    podman-compose # start group of containers for dev
+  ];
+}
--- a/hosts/pi4/postgres.nix
+++ b/hosts/pi4/postgres.nix
@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser        auth-method
+      local all       all           trust
+    '';
+  };
+}
--- a/hosts/pi4/security/default.nix
+++ b/hosts/pi4/security/default.nix
@ -0,0 +1,7 @@
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  services.pcscd.enable = true;
+}
--- a/hosts/pi4/security/firewall.nix
+++ b/hosts/pi4/security/firewall.nix
@ -0,0 +1,17 @@
+{ common, ... }:
+
+{
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      extraInputRules = ''
+        ip saddr ${common.localIpRange} accept
+      '';
+    };
+    nftables.enable = true;
+  };
+}
--- a/hosts/thinkpad/modules/battery.nix
+++ b/hosts/thinkpad/modules/battery.nix
--- a/hosts/thinkpad/modules/bluetooth.nix
+++ b/hosts/thinkpad/modules/bluetooth.nix
--- a/hosts/thinkpad/common.nix
+++ b/hosts/thinkpad/common.nix
@ -1,25 +1,4 @@
-rec {
-  default = {
-    browser = "zen";
-    calculator = "gnome-calculator";
-    fileManager = "nautilus";
-    imageViewer = "loupe";
-    lockScreen = "hyprlock";
-    terminal = "kitty";
-  };
-
-  dir = {
-    home = "/home/${username}";
-    pictures = "${dir.home}/Pictures";
-  };
-
-  keymaps = {
-    layout = "gb,no";
-    options = "grp:alt_shift_toggle"; # Toggle using ALT + SHIFT
-  };
-
-  # Empty matches all
+{
+  # Empty matches all monitors
  monitor1 = "";
-
-  username = "martin";
 }
--- a/hosts/thinkpad/default.nix
+++ b/hosts/thinkpad/default.nix
@ -1,69 +1,23 @@
 {
  pkgs,
-  outputs,
-  common,
+  lib,
  ...
 }:

 {
-  imports = [ ./modules ];
-
-  nixpkgs.overlays = [ outputs.overlays.unstable-packages ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  # Define a user account. Don't forget to set a password with 'passwd'.
-  users.users.${common.username} = {
-    isNormalUser = true;
-    description = common.username;
-    extraGroups = [
-      "networkmanager"
-      "wheel"
+  imports = [
+    (lib.custom.relativeToDesktop "modules")
+    ./battery.nix
+    ./bluetooth.nix
+    ./hardware-configuration.nix
+    ./security.nix
  ];
-  };

-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;

-  environment.sessionVariables = {
-    # Tells Electron apps to use Wayland
-    NIXOS_OZONE_WL = "1";
-  };
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
  environment.systemPackages = with pkgs; [
    brightnessctl
-    wget
-    xdg-utils
-    xdg-desktop-portal
-    xdg-desktop-portal-gtk
-    unstable.protonmail-desktop
-    stremio
-    fastfetch
-    discord
-    nix-prefetch-github # Cmd to get rev and hash from GitHub
-    gimp
-    vlc
-    vdhcoapp
-    onlyoffice-desktopeditors
+    hyprsunset # Blue light filter
  ];

-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  programs.kdeconnect.enable = true;
-
-  services = {
-    flatpak.enable = false;
-    xserver.enable = true;
-  };
-
-  system.stateVersion = common.system.version;
 }
--- a/hosts/thinkpad/modules/hardware/hardware-configuration.nix
+++ b/hosts/thinkpad/modules/hardware/hardware-configuration.nix
--- a/hosts/thinkpad/home-manager/btop.nix
+++ b/hosts/thinkpad/home-manager/btop.nix
@ -1,9 +0,0 @@
-let
-  theme = import ../theme.nix;
-in
-{
-  catppuccin.btop = {
-    enable = true;
-    flavor = theme.flavor;
-  };
-}
--- a/hosts/thinkpad/home-manager/cava/cava.png
+++ b/hosts/thinkpad/home-manager/cava/cava.png
--- a/hosts/thinkpad/home-manager/cava/default.nix
+++ b/hosts/thinkpad/home-manager/cava/default.nix
@ -1,29 +0,0 @@
-## Audio visualizer
-{ pkgs, ... }:
-
-let
-  theme = import ../../theme.nix;
-in
-{
-  catppuccin.cava = {
-    enable = true;
-    flavor = theme.flavor;
-  };
-
-  programs.cava = {
-    enable = true;
-    package = pkgs.cava;
-  };
-
-  xdg.desktopEntries.cava = {
-    name = "Cava";
-    genericName = "Audio visualizer";
-    terminal = true;
-    exec = "${pkgs.cava}/bin/cava";
-    icon = ./cava.png;
-    categories = [
-      "Audio"
-      "AudioVideo"
-    ];
-  };
-}
--- a/hosts/thinkpad/home-manager/cursors.nix
+++ b/hosts/thinkpad/home-manager/cursors.nix
@ -1,16 +0,0 @@
-let
-  theme = import ../theme.nix;
-in
-{
-  catppuccin.cursors = {
-    enable = true;
-    flavor = theme.flavor;
-    accent = "dark";
-  };
-
-  home.pointerCursor = {
-    gtk.enable = true;
-    x11.enable = true;
-    size = 16;
-  };
-}
--- a/hosts/thinkpad/home-manager/default-applications.nix
+++ b/hosts/thinkpad/home-manager/default-applications.nix
@ -1,24 +0,0 @@
-# TODO more defaults
-{
-  xdg.mimeApps = {
-    enable = true;
-    defaultApplications =
-      let
-        browser = "zen.desktop";
-        imageViewer = "org.gnome.Loupe.desktop";
-        pdfReader = "org.gnome.Papers.desktop";
-      in
-      {
-        "text/html" = browser;
-        "x-scheme-handler/http" = browser;
-        "x-scheme-handler/https" = browser;
-        "x-scheme-handler/about" = browser;
-        "x-scheme-handler/unknown" = browser;
-        "image/jpg" = imageViewer;
-        "image/jpeg" = imageViewer;
-        "image/png" = imageViewer;
-        "image/gif" = imageViewer;
-        "application/pdf" = pdfReader;
-      };
-  };
-}
--- a/hosts/thinkpad/home-manager/default.nix
+++ b/hosts/thinkpad/home-manager/default.nix
@ -1,67 +1,14 @@
 {
-  pkgs,
-  inputs,
+  lib,
  ...
 }:
-let
-  common = import ../common.nix;
-  username = common.username;
-  dir = common.dir;
-in
+
 {
  imports = [
-    inputs.catppuccin.homeManagerModules.catppuccin
-    ./btop.nix
-    ./cava
-    ./cursors.nix
-    ./default-applications.nix
-    ./development
-    ./fastfetch.nix
-    ./fish.nix
-    ./freetube.nix
-    ./gtk.nix
-    ./kitty.nix
-    ./mpv.nix
-    ./nextcloud.nix
+    (lib.custom.relativeToDesktop "home-manager")
    ./hyprland
-    ./spicetify.nix
-    ./yazi
    ./zen
  ];

-  dconf = {
-    enable = true;
-    settings = {
-      # Prefer dark mode for all GTK apps
-      "org/gnome/desktop/interface".color-scheme = "prefer-dark";
-    };
-  };
-
-  home = {
-    username = username;
-    homeDirectory = dir.home;
-
-    sessionVariables = {
-      XDG_PICTURES_DIR = dir.pictures; # Define the default dir for pictures
-    };
-
-    # You can update Home Manager without changing this value. See
-    # the Home Manager release notes for a list of state version
-    # changes in each release.
-    stateVersion = common.system.version;
-  };
-
-  programs = {
-    btop.enable = true;
-
-    # Let Home Manager install and manage itself.
-    home-manager.enable = true;
-  };
-
-  services = {
-    gpg-agent = {
-      enable = true;
-      pinentryPackage = pkgs.pinentry-curses;
-    };
-  };
+  programs.git.signing.key = "848D71DE0590C199";
 }
--- a/hosts/thinkpad/home-manager/development/default.nix
+++ b/hosts/thinkpad/home-manager/development/default.nix
@ -1,9 +0,0 @@
-{
-  imports = [
-    ./git.nix
-    ./nixvim
-    ./zed.nix
-  ];
-  # TODO set Wayland vmOptions in Jetbrains products, Requires current installed version in path
-  # -Dawt.toolkit.name=WLToolKit
-}
--- a/hosts/thinkpad/home-manager/development/git.nix
+++ b/hosts/thinkpad/home-manager/development/git.nix
@ -1,33 +0,0 @@
-{ pkgs, ... }:
-
-{
-  home.packages = with pkgs; [ git-crypt ];
-
-  programs.git =
-    let
-      package = pkgs.git.override { withLibsecret = true; };
-    in
-    {
-      enable = true;
-      package = package;
-      userName = "Martin Berg Alstad";
-      userEmail = "git@martials.no";
-
-      aliases = {
-        amend = "commit --amend";
-        cm = "commit";
-        s = "status";
-      };
-
-      signing = {
-        signByDefault = true;
-        key = "848D71DE0590C199";
-      };
-
-      extraConfig = {
-        push.autoSetupRemote = true;
-        safe.directory = "/etc/nixos";
-        credential.helper = "${package}/bin/git-credential-libsecret";
-      };
-    };
-}
--- a/hosts/thinkpad/home-manager/development/nixvim/default.nix
+++ b/hosts/thinkpad/home-manager/development/nixvim/default.nix
@ -1,77 +0,0 @@
-# Neovim configuration for Nix
-{ inputs, ... }:
-
-{
-  imports = [
-    inputs.nixvim.homeManagerModules.nixvim
-  ];
-
-  catppuccin.nvim.enable = true;
-
-  home.sessionVariables.EDITOR = "nvim";
-
-  programs.nixvim = {
-    enable = true;
-    clipboard.providers.wl-copy.enable = true;
-    colorschemes.catppuccin.enable = true;
-    defaultEditor = true;
-    vimdiffAlias = true; # Alias vimdiff to nvim -d
-
-    opts = {
-      number = true; # Show line numbers
-      relativenumber = true; # Show relative line numbers
-
-      shiftwidth = 2; # Tab width should be 2
-    };
-
-    plugins = {
-      bufferline.enable = false;
-
-      # Formatters
-      conform-nvim = {
-        enable = true;
-        # TODO use nix fmt on save
-        settings = { };
-      };
-
-      lsp = {
-        enable = true;
-        servers = {
-          nixd.enable = true;
-        };
-      };
-
-      lualine.enable = true;
-      luasnip.enable = true;
-
-      # Completions
-      cmp = {
-        enable = true;
-
-        autoEnableSources = true;
-
-        # TODO complete on <tab>
-        settings = {
-          sources = [
-            { name = "nvim-lsp"; }
-            { name = "path"; }
-            { name = "buffer"; }
-          ];
-        };
-      };
-
-      treesitter.enable = true;
-      web-devicons.enable = true;
-    };
-
-    extraConfigLua = ''
-      -- Translucent background
-      vim.cmd [[
-        highlight Normal guibg=none
-        highlight NonText guibg=none
-        highlight Normal ctermbg=none
-        highlight NonText ctermbg=none
-      ]]
-    '';
-  };
-}
--- a/hosts/thinkpad/home-manager/development/zed.nix
+++ b/hosts/thinkpad/home-manager/development/zed.nix
@ -1,57 +0,0 @@
-{ pkgs, ... }:
-
-{
-  programs.zed-editor = {
-    enable = true;
-    package = pkgs.unstable.zed-editor;
-    extensions = [
-      "html"
-      "catppuccin"
-      "catppuccin-icons"
-      "toml"
-      "nix"
-      "git-firefly"
-      "just"
-    ];
-    userSettings =
-      let
-        theme = import ../../theme.nix;
-        font = "${theme.nerdFont} Nerd Font";
-        fontSize = 14;
-      in
-      {
-        assistant = {
-          default_model = {
-            provider = "ollama";
-            model = "deepseek-r1:8b";
-          };
-          version = "2";
-        };
-        autosave = "on_focus_change";
-        base_keymap = "JetBrains";
-        buffer_font_family = font;
-        features = {
-          edit_completion_provider = "zed";
-        };
-        icon_theme = "Catppuccin Mocha";
-        # icon_theme = { TODO replace icon theme above with below
-        #   mode = theme.mode;
-        #   light = "Catppuccin Mocha";
-        #   dark = "Catppuccin Mocha";
-        # };
-        ui_font_family = font;
-        ui_font_size = fontSize;
-        buffer_font_size = fontSize;
-        tabs = {
-          file_icons = true;
-          git_status = true;
-        };
-        theme = {
-          mode = theme.mode;
-          light = "Catppuccin Latte";
-          dark = "Catppuccin Mocha";
-        };
-        lsp.nil.initialization_options.formatting.command = [ "nixfmt" ];
-      };
-  };
-}
--- a/hosts/thinkpad/home-manager/fastfetch.nix
+++ b/hosts/thinkpad/home-manager/fastfetch.nix
@ -1,60 +0,0 @@
-{
-  programs = {
-    fish.shellAliases.fetch = "fastfetch";
-    fastfetch = {
-      enable = true;
-      settings = {
-        logo = {
-          source = "${../Catppuccin.png}";
-          type = "kitty";
-          height = 18;
-          padding.top = 2;
-        };
-        display.separator = " ";
-        modules =
-          let
-            keyColor = "34";
-            module = type: key: {
-              inherit type key keyColor;
-            };
-            formatModule = type: key: format: {
-              inherit
-                type
-                key
-                format
-                keyColor
-                ;
-            };
-          in
-          [
-            "break"
-            "break"
-            {
-              type = "title";
-              keyWidth = 10;
-            }
-            "break"
-            (module "os" " ")
-            (module "kernel" " ")
-            (formatModule "packages" " " "{} (nixpkgs)")
-            (module "shell" " ")
-            (module "terminal" " ")
-            (module "wm" " ")
-            (module "theme" " ")
-            (module "cursor" " ")
-            (module "terminalfont" " ")
-            (module "uptime" " ")
-            (formatModule "datetime" " " "{1}-{3}-{11}")
-            (module "cpu" " ")
-            (module "gpu" "󰤽 ")
-            (module "sound" " ")
-            (module "lm" " ")
-            "break"
-            "colors"
-            "break"
-            "break"
-          ];
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/fish.nix
+++ b/hosts/thinkpad/home-manager/fish.nix
@ -1,57 +0,0 @@
-{ pkgs, ... }:
-let
-  theme = import ../theme.nix;
-in
-{
-  catppuccin = {
-    fish = {
-      enable = true;
-      flavor = theme.flavor;
-    };
-    starship = {
-      enable = true;
-      flavor = theme.flavor;
-    };
-  };
-
-  programs = {
-    fish = {
-      enable = true;
-      # Start starship when creating a new shell
-      interactiveShellInit = ''
-        starship init fish | source
-        ${pkgs.fortune}/bin/fortune | ${pkgs.cowsay}/bin/cowsay -f tux
-      '';
-      plugins = [
-        {
-          # !! to get the previous command
-          # https://github.com/BrewingWeasel/fishbang
-          name = "fishbang";
-          src = pkgs.fetchFromGitHub {
-            owner = "BrewingWeasel";
-            repo = "fishbang";
-            rev = "50389667eb9ac79edcff9b987c83e1de8ac93921";
-            hash = "sha256-IneNWyfo29C7FDA5b6pTZRX3HpP6y/dRM6GXuLq2+zc=";
-          };
-        }
-      ];
-      shellAliases = {
-        nix-shell = "nix-shell --run fish"; # Start nix-shells using fishcd
-      };
-    };
-
-    starship = {
-      enable = true;
-      settings = {
-        directory.substitutions = {
-          "Documents" = "󰈙 ";
-          "Downloads" = " ";
-          "Music" = "󰓃 ";
-          "Pictures" = " ";
-          "Git" = " ";
-          "nextcloud" = " ";
-        };
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/freetube.nix
+++ b/hosts/thinkpad/home-manager/freetube.nix
@ -1,53 +0,0 @@
-{ pkgs, ... }:
-
-{
-  catppuccin.freetube.enable = true;
-
-  programs.freetube = {
-    enable = true;
-    package = pkgs.unstable.freetube;
-    settings = {
-      allowDashAv1Formats = true;
-      checkForUpdates = false;
-      currentLocale = "en-GB";
-      defaultTheatreMode = true;
-      defaultQuality = "1080";
-      displayVideoPlayButton = false;
-      region = "NO";
-      useSponsorBlock = true;
-
-      sponsorBlockSponsor = {
-        color = "CatppuccinMochaGreen";
-        skip = "autoSkip";
-      };
-      sponsorBlockSelfPromo = {
-        color = "CatppuccinMochaYellow";
-        skip = "showInSeekBar";
-      };
-      sponsorBlockInteraction = {
-        color = "CatppuccinMochaPink";
-        skip = "showInSeekBar";
-      };
-      sponsorBlockIntro = {
-        color = "CatppuccinMochaSapphire";
-        skip = "doNothing";
-      };
-      sponsorBlockOutro = {
-        color = "CatppuccinMochaBlue";
-        skip = "doNothing";
-      };
-      sponsorBlockRecap = {
-        color = "CatppuccinMochaMauve";
-        skip = "doNothing";
-      };
-      sponsorBlockMusicOffTopic = {
-        color = "CatppuccinMochaFlamingo";
-        skip = "doNothing";
-      };
-      sponsorBlockFiller = {
-        color = "CatppuccinMochaMauve";
-        skip = "doNothing";
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/gtk.nix
+++ b/hosts/thinkpad/home-manager/gtk.nix
@ -1,11 +0,0 @@
-let
-  theme = import ../theme.nix;
-in
-{
-  gtk.enable = true;
-  catppuccin.gtk = {
-    enable = true;
-    flavor = theme.flavor;
-    icon.enable = true;
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/binds.nix
+++ b/hosts/thinkpad/home-manager/hyprland/binds.nix
@ -1,103 +0,0 @@
-let
-  common = import ../../common.nix;
-  app = common.default;
-in
-{
-  # TODO binds to move focused window
-  wayland.windowManager.hyprland.settings = {
-    "$mainMod" = "SUPER";
-    "$shiftMod" = "$mainMod SHIFT";
-    "$ctrlMod" = "$mainMod CTRL";
-    "$menu" = "rofi -show drun";
-
-    bind = [
-      "$mainMod,  Q, exec, ${app.terminal}"
-      "$mainMod,  C, killactive,"
-      "$shiftMod, M, exit,"
-      "$mainMod,  E, exec, ${app.fileManager}"
-      "$mainMod,  V, togglefloating,"
-      "$mainMod,  R, exec, $menu"
-      "$mainMod,  P, pseudo," # dwindle
-      "$mainMod,  J, togglesplit," # dwindle
-      "$mainMod,  B, exec, ${app.browser}"
-      "$mainMod,  L, exec, ${app.lockScreen}"
-      "$mainMod,  K, exec, [float] ${app.calculator}"
-      "$mainMod,  ESCAPE, exec, hyprpanel t dashboardmenu"
-
-      # Move focus with mainMod + arrow keys
-      "$mainMod, left, movefocus, l"
-      "$mainMod, right, movefocus, r"
-      "$mainMod, up, movefocus, u"
-      "$mainMod, down, movefocus, d"
-
-      # Move window with ctrl + mainMod + arrow keys
-      "$ctrlMod, left, movewindow, l"
-      "$ctrlMod, right, movewindow, r"
-      "$ctrlMod, up, movewindow, u"
-      "$ctrlMod, down, movewindow, d"
-
-      # Switch workspaces with mainMod + [0-9]
-      "$mainMod, 1, workspace, 1"
-      "$mainMod, 2, workspace, 2"
-      "$mainMod, 3, workspace, 3"
-      "$mainMod, 4, workspace, 4"
-      "$mainMod, 5, workspace, 5"
-      "$mainMod, 6, workspace, 6"
-      "$mainMod, 7, workspace, 7"
-      "$mainMod, 8, workspace, 8"
-      "$mainMod, 9, workspace, 9"
-      "$mainMod, 0, workspace, 10"
-
-      # Move active window to a workspace with mainMod + SHIFT + [0-9]
-      "$shiftMod, 1, movetoworkspace, 1"
-      "$shiftMod, 2, movetoworkspace, 2"
-      "$shiftMod, 3, movetoworkspace, 3"
-      "$shiftMod, 4, movetoworkspace, 4"
-      "$shiftMod, 5, movetoworkspace, 5"
-      "$shiftMod, 6, movetoworkspace, 6"
-      "$shiftMod, 7, movetoworkspace, 7"
-      "$shiftMod, 8, movetoworkspace, 8"
-      "$shiftMod, 9, movetoworkspace, 9"
-      "$shiftMod, 0, movetoworkspace, 10"
-
-      # Example special workspace (scratchpad)
-      "$mainMod, S, togglespecialworkspace, magic"
-      "$shiftMod, S, movetoworkspace, special:magic"
-
-      # Scroll through existing workspaces with mainMod + scroll
-      "$mainMod, mouse_down, workspace, e+1"
-      "$mainMod, mouse_up, workspace, e-1"
-    ];
-
-    binde = [
-      # Resize the focused window
-      "$shiftMod, right, resizeactive, 20 0"
-      "$shiftMod, left, resizeactive, -20 0"
-      "$shiftMod, up, resizeactive, 0 -20"
-      "$shiftMod, down, resizeactive, 0 20"
-    ];
-
-    bindm = [
-      # Move/resize windows with mainMod + LMB/RMB and dragging
-      "$mainMod, mouse:272, movewindow"
-      "$mainMod, mouse:273, resizewindow"
-    ];
-
-    bindl = [
-      ", XF86AudioNext, exec, playerctl next"
-      ", XF86AudioPause, exec, playerctl play-pause"
-      ", XF86AudioPlay, exec, playerctl play-pause"
-      ", XF86AudioPrev, exec, playerctl previous"
-    ];
-
-    bindel = [
-      # Laptop multimedia keys for volume and LCD brightness
-      ",XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
-      ",XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
-      ",XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
-      ",XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"
-      ",XF86MonBrightnessUp, exec, brightnessctl s 10%+"
-      ",XF86MonBrightnessDown, exec, brightnessctl s 10%-"
-    ];
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/default.nix
+++ b/hosts/thinkpad/home-manager/hyprland/default.nix
@ -1,22 +1,8 @@
 # Home configurations for Hyprland. For system configs, see ./modules/hyprland
-{ outputs, ... }:
-
 {
  imports = [
-    ./binds.nix
-    ./hypridle
-    ./hyprlock
-    ./hyprpanel
-    ./hyprpaper.nix
-    ./hyprshot.nix
+    ./hyprlock.nix
+    ./hyprpanel.nix
    ./settings.nix
  ];
-
-  # Adds pkgs.unstable in order to fetch packages from unstable repositories
-  nixpkgs.overlays = [ outputs.overlays.unstable-packages ];
-
-  wayland.windowManager.hyprland = {
-    enable = true;
-    systemd.variables = [ "--all" ]; # Import environment into systemd
-  };
 }
--- a/hosts/thinkpad/home-manager/hyprland/hypridle/default.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hypridle/default.nix
@ -1,38 +0,0 @@
-let
-  # Time in seconds
-  lockAfter = 1200;
-  screenOffAfter = 1500;
-  suspendAfter = 7200;
-in
-{
-  services.hypridle = {
-    enable = true;
-    settings = {
-      general = {
-        before_sleep_cmd = "loginctl lock-session";
-        after_sleep_cmd = "hyprctl dispatch dpms on";
-        lock_cmd = "pidof hyprlock || hyprlock"; # Avoid running multiple instances of hyprlock
-      };
-
-      listener = [
-        # Lock
-        {
-          timeout = lockAfter;
-          on-timeout = "loginctl lock-session";
-        }
-        # Turn off screens
-        {
-          timeout = screenOffAfter;
-          on-timeout = "hyprctl dispatch dpms off";
-          on-resume = "hyprctl dispatch dpms on";
-        }
-        # Suspend
-        {
-          timeout = suspendAfter;
-          on-timeout = "systemctl suspend"; # suspend pc
-        }
-      ];
-    };
-  };
-  wayland.windowManager.hyprland.settings.exec-once = [ "hypridle" ];
-}
--- a/hosts/thinkpad/home-manager/hyprland/hyprlock.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprlock.nix
@ -0,0 +1,15 @@
+{ pkgs, lib, ... }:
+
+{
+  # TODO fingerprint prompt using $FPRINTPROMPT
+  programs.hyprlock = {
+    package = pkgs.unstable.hyprlock;
+    settings = {
+      auth."fingerprint:enabled" = true;
+      # Override removed settings shared config
+      general = lib.mkForce {
+        hide_cursor = true;
+      };
+    };
+  };
+}
--- a/hosts/thinkpad/home-manager/hyprland/hyprlock/default.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprlock/default.nix
@ -1,89 +0,0 @@
-{ lib, ... }:
-let
-  theme = import ../../../theme.nix;
-in
-{
-  programs.hyprlock = {
-    enable = true;
-    settings = {
-      "$font" = "${theme.nerdFont} Nerd Font";
-
-      background = [
-        {
-          path = "${../../../wallpapers/catppuccin_page_curl.png}";
-        }
-      ];
-
-      # GENERAL
-      general = {
-        disable_loading_bar = true;
-        hide_cursor = true;
-      };
-
-      # LAYOUT
-      label = [
-        {
-          text = "$LAYOUT";
-          color = "${theme.textRgb}";
-          font_size = 25;
-          font_family = "$font";
-          position = "30, -30";
-          halign = "left";
-          valign = "top";
-        }
-        # TIME
-        {
-          text = "$TIME";
-          color = "${theme.textRgb}";
-          font_size = 90;
-          font_family = "$font";
-          position = "-30, 0";
-          halign = "right";
-          valign = "top";
-        }
-        # DATE
-        {
-          text = "cmd[update:43200000] date +\"%A, %d %B %Y\"";
-          color = "${theme.textRgb}";
-          font_size = 25;
-          font_family = "$font";
-          position = "-30, -150";
-          halign = "right";
-          valign = "top";
-        }
-      ];
-
-      # USER AVATAR
-      image = {
-        path = "${../../face.png}";
-        size = 100;
-        border_color = "${theme.blueRgb}";
-        position = "0, 75";
-        halign = "center";
-        valign = "center";
-      };
-
-      # INPUT FIELD
-      input-field = {
-        size = "300, 60";
-        outline_thickness = 4;
-        dots_size = 0.2;
-        dots_spacing = 0.2;
-        dots_center = true;
-        outer_color = lib.mkDefault "${theme.blueRgb}";
-        inner_color = lib.mkDefault "${theme.surface0Rgb}";
-        font_color = lib.mkDefault "${theme.textRgb}";
-        fade_on_empty = false;
-        placeholder_text = "<span foreground=\"##${theme.textAlpha}\">󰌾 Logged in as <span foreground=\"##${theme.blueAlpha}\">$USER</span></span>";
-        hide_input = false;
-        check_color = lib.mkDefault "${theme.blueRgb}";
-        fail_color = lib.mkDefault "${theme.redRgb}";
-        fail_text = "<i>$FAIL <b>($ATTEMPTS)</b></i>";
-        capslock_color = lib.mkDefault "${theme.yellowRgb}";
-        position = "0, -47"; # TODO change to use % at 25.05
-        halign = "center";
-        valign = "center";
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/hyprpanel.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprpanel.nix
@ -0,0 +1,16 @@
+{
+  lib,
+  ...
+}:
+
+{
+  programs.hyprpanel.settings.layout."bar.layouts"."*".right = lib.mkForce [
+    "kbinput"
+    "volume"
+    "network"
+    "systray"
+    "clock"
+    "battery"
+    "notifications"
+  ];
+}
--- a/hosts/thinkpad/home-manager/hyprland/hyprpanel/default.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprpanel/default.nix
@ -1,123 +0,0 @@
-{
-  pkgs,
-  inputs,
-  lib,
-  ...
-}:
-let
-  common = import ../../../common.nix;
-  theme = import ../../../theme.nix;
-  loader = import ../../secretsLoader.nix lib;
-in
-{
-  imports = [ inputs.hyprpanel.homeManagerModules.hyprpanel ];
-
-  programs.hyprpanel = {
-    enable = true;
-    # Add hyprpanel to the Hyprland config 'exec-once'.
-    hyprland.enable = true;
-    # Fix the overwrite issue with HyprPanel.
-    overwrite.enable = true;
-
-    # Import a theme from './themes/*.json'.
-    theme = "";
-
-    # Override the final config with an arbitrary set.
-    # Useful for overriding colors in your selected theme.
-    # Default: {}
-    override = {
-      theme.bar.menus.text = "#123ABC";
-    };
-
-    # Configure bar layouts for monitors.
-    layout = {
-      "bar.layouts" = {
-        "*" = {
-          left = [
-            "dashboard"
-            "workspaces"
-            "windowtitle"
-          ];
-          middle = [ "media" ];
-          right = [
-            "kbinput"
-            "volume"
-            "network"
-            "systray"
-            "clock"
-            "battery"
-            "notifications"
-          ];
-        };
-      };
-    };
-
-    # Configure and theme almost all options from the GUI.
-    # Options that require '{}' or '[]' are not yet implemented,
-    # except for the layout above.
-    # See 'https://hyprpanel.com/configuration/settings.html'.
-    # Default: <same as gui>
-    settings = {
-      bar = {
-        clock.format = "%a %b %d  %H:%M";
-        customModules.kbLayout.leftClick = "hyprctl switchxkblayout keychron-keychron-k8-pro next";
-        launcher.autoDetectIcon = true;
-        network.label = false;
-        volume = {
-          scrollDown = "${pkgs.hyprpanel}/bin/hyprpanel 'vol -1'";
-          scrollUp = "${pkgs.hyprpanel}/bin/hyprpanel 'vol +1'";
-        };
-        workspaces = {
-          show_icons = false;
-          show_numbered = true;
-        };
-      };
-
-      menus = {
-        clock = {
-          time = {
-            military = true;
-            hideSeconds = true;
-          };
-          weather = {
-            unit = "metric";
-            location = "Bergen, Norway";
-            key = loader.loadSecret ../../secrets/weather-api-key;
-          };
-        };
-
-        dashboard = {
-          directories.enabled = false;
-          powermenu.avatar.image = "${../../face.png}";
-          shortcuts.left = {
-            shortcut1 = {
-              command = common.default.browser;
-              icon = ""; # TODO replace with Zen icon
-              tooltip = "Zen";
-            };
-            shortcut2 = {
-              command = "spotify";
-              icon = "";
-              tooltip = "Spotify";
-            };
-            ## shortcut3 === discord
-            ## shortcut4 === rofi -show drun
-          };
-          stats.enable_gpu = true;
-        };
-      };
-
-      scalingPriority = "hyprland";
-
-      theme = {
-        bar.transparent = true;
-        font = {
-          name = "${theme.nerdFont} NF";
-          size = "16px";
-        };
-      };
-
-      wallpaper.enable = false;
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/hyprpaper.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprpaper.nix
@ -1,33 +0,0 @@
-# Wallpapers
-{ pkgs, ... }:
-
-let
-  common = import ../../common.nix;
-in
-{
-  home.packages = with pkgs; [
-    hyprpaper
-  ];
-
-  services.hyprpaper = {
-    enable = true;
-    settings =
-      let
-        wallpaperDir = ../../wallpapers;
-        monitor1 = "${wallpaperDir}/nixos_waves.png";
-      in
-      {
-        ipc = "on";
-        splash = false;
-        splash_offset = 2.0;
-
-        preload = [
-          monitor1
-        ];
-
-        wallpaper = [
-          "${common.monitor1},${monitor1}"
-        ];
-      };
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/hyprshot.nix
+++ b/hosts/thinkpad/home-manager/hyprland/hyprshot.nix
@ -1,19 +0,0 @@
-let
-  common = import ../../common.nix;
-in
-{
-  wayland.windowManager.hyprland.settings = {
-    "$mainMod" = "SUPER";
-    "$shiftMod" = "$mainMod SHIFT";
-
-    env = [
-      "HYPRSHOT_DIR,${common.dir.pictures}/screenshots" # Store screenshots here
-    ];
-
-    bind = [
-      "$mainMod, PRINT, exec, hyprshot -m window" # Window
-      ", PRINT, exec, hyprshot -m output" # Monitor
-      "$shiftMod, PRINT, exec, hyprshot -m region" # Region
-    ];
-  };
-}
--- a/hosts/thinkpad/home-manager/hyprland/settings.nix
+++ b/hosts/thinkpad/home-manager/hyprland/settings.nix
@ -1,135 +1,33 @@
-{ lib, ... }:
-let
-  common = import ../../common.nix;
-  theme = import ../../theme.nix;
-  app = common.default;
-in
+{
+  lib,
+  ...
+}:
+
 {
  wayland.windowManager.hyprland.settings = {
-    monitor = [
+    monitor =
+      let
+        common = import ../../common.nix;
+      in
+      lib.mkForce [
        "${common.monitor1}, 1920x1080@60.05, 0x0, 1"
      ];

    # Autostart
    exec-once = [
-      app.browser
-      app.terminal
-      "systemctl --user start hyprpolkitagent"
      "hyprsunset -t 5000" # Set blue light filter
    ];

-    env = [
-      "ELECTRON_OZONE_PLATFORM_HINT,auto" # Tell Electron apps to use Wayland
-    ];
-
-    general = {
-      gaps_in = 5;
-      gaps_out = 20;
-      border_size = 2;
-      "col.active_border" = lib.mkDefault "${theme.mauveRgb} ${theme.tealRgb} 45deg";
-      "col.inactive_border" = lib.mkDefault "rgba(${theme.surface2Alpha}aa)";
-      resize_on_border = true;
-      allow_tearing = false;
-      layout = "dwindle";
-    };
-
-    decoration = {
-      rounding = 10;
-
-      # Change transparency of focused and unfocused windows
-      active_opacity = 1.0;
-      inactive_opacity = 1.0;
-
-      shadow = {
-        enabled = true;
-        range = 4;
-        render_power = 3;
-        color = lib.mkDefault theme.baseRgb;
-      };
-
-      blur = {
-        enabled = true;
-        size = 3;
-        passes = 1;
-
-        vibrancy = 0.1696;
-      };
-    };
-
-    animations = {
-      enabled = "yes, please :)";
-
-      bezier = [
-        "easeOutQuint,0.23,1,0.32,1"
-        "easeInOutCubic,0.65,0.05,0.36,1"
-        "linear,0,0,1,1"
-        "almostLinear,0.5,0.5,0.75,1.0"
-        "quick,0.15,0,0.1,1"
-      ];
-
-      animation = [
-        "global, 1, 10, default"
-        "border, 1, 5.39, easeOutQuint"
-        "windows, 1, 4.79, easeOutQuint"
-        "windowsIn, 1, 4.1, easeOutQuint, popin 87%"
-        "windowsOut, 1, 1.49, linear, popin 87%"
-        "fadeIn, 1, 1.73, almostLinear"
-        "fadeOut, 1, 1.46, almostLinear"
-        "fade, 1, 3.03, quick"
-        "layers, 1, 3.81, easeOutQuint"
-        "layersIn, 1, 4, easeOutQuint, fade"
-        "layersOut, 1, 1.5, linear, fade"
-        "fadeLayersIn, 1, 1.79, almostLinear"
-        "fadeLayersOut, 1, 1.39, almostLinear"
-        "workspaces, 1, 1.94, almostLinear, fade"
-        "workspacesIn, 1, 1.21, almostLinear, fade"
-        "workspacesOut, 1, 1.94, almostLinear, fade"
-      ];
-    };
-
-    dwindle = {
-      pseudotile = true; # Master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
-      preserve_split = true; # You probably want this
-    };
-
-    master.new_status = "master";
-
-    misc = {
-      force_default_wallpaper = 0;
-      disable_hyprland_logo = true;
-    };
-
-    debug.disable_logs = false;
-
    input = {
-      kb_layout = common.keymaps.layout;
-      kb_options = common.keymaps.options;
-      follow_mouse = 1;
-      sensitivity = 0.4; # -1.0 - 1.0, 0 means no modification.
-      touchpad.natural_scroll = true;
+      sensitivity = lib.mkForce 0.4; # -1.0 - 1.0, 0 means no modification.
+      touchpad.natural_scroll = lib.mkForce true;
    };

    gestures = {
-      workspace_swipe = true;
-      workspace_swipe_distance = 150;
-      workspace_swipe_min_speed_to_force = 0;
-      workspace_swipe_cancel_ratio = 0.5;
+      workspace_swipe = lib.mkForce true;
+      workspace_swipe_distance = lib.mkForce 150;
+      workspace_swipe_min_speed_to_force = lib.mkForce 0;
+      workspace_swipe_cancel_ratio = lib.mkForce 0.5;
    };
-
-    device = {
-      name = "logitech-g502-hero-gaming-mouse";
-      sensitivity = -0.10;
-    };
-
-    windowrulev2 = [
-      # Ignore maximize requests from apps
-      "suppressevent maximize, class:.*"
-      # Fix some dragging issues with XWayland
-      "nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0"
-      # Avoid locking in fullscreen
-      "idleinhibit fullscreen, class:^(*)$"
-      "idleinhibit fullscreen, title:^(*)$"
-      "idleinhibit fullscreen, fullscreen:1"
-    ];
  };
 }
--- a/hosts/thinkpad/home-manager/kitty.nix
+++ b/hosts/thinkpad/home-manager/kitty.nix
@ -1,25 +0,0 @@
-let
-  common = import ../common.nix;
-  theme = import ../theme.nix;
-in
-{
-  catppuccin.kitty = {
-    enable = true;
-    flavor = theme.flavor;
-  };
-
-  programs = {
-    # Transfer shell config to target device
-    fish.shellAliases.ssh = "kitty +kitten ssh";
-    kitty = {
-      enable = common.default.terminal == "kitty";
-      font.name = theme.nerdFont;
-      settings = {
-        background_blur = 5;
-        background_opacity = 0.8;
-        confirm_os_window_close = 0;
-        window_padding_width = 10;
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/mpv.nix
+++ b/hosts/thinkpad/home-manager/mpv.nix
@ -1,29 +0,0 @@
-{
-  catppuccin.mpv =
-    let
-      theme = import ../theme.nix;
-    in
-    {
-      enable = true;
-      flavor = theme.flavor;
-    };
-
-  programs = {
-    fish.shellAliases.mpvl = "mpv --profile=loop";
-    mpv = {
-      enable = true;
-      config = {
-        hwdec = "auto-safe";
-        vo = "gpu";
-        profile = "gpu-hq";
-        gpu-context = "wayland";
-      };
-      profiles = {
-        loop = {
-          loop-playlist = "inf";
-          loop-file = "inf";
-        };
-      };
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/nextcloud.nix
+++ b/hosts/thinkpad/home-manager/nextcloud.nix
@ -1,6 +0,0 @@
-{
-  services.nextcloud-client = {
-    enable = true;
-    startInBackground = true;
-  };
-}
--- a/hosts/thinkpad/home-manager/spicetify.nix
+++ b/hosts/thinkpad/home-manager/spicetify.nix
@ -1,35 +0,0 @@
-{
-  pkgs,
-  inputs,
-  lib,
-  ...
-}:
-
-{
-  imports = [ inputs.spicetify-nix.homeManagerModules.default ];
-  programs.spicetify =
-    let
-      spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};
-      theme = import ../theme.nix;
-    in
-    {
-      enable = true;
-
-      enabledExtensions = with spicePkgs.extensions; [
-        adblock
-        fullAppDisplay
-        hidePodcasts
-        shuffle # shuffle+ (special characters are sanitized out of extension names)
-      ];
-      enabledCustomApps = with spicePkgs.apps; [
-        newReleases
-        ncsVisualizer
-      ];
-      enabledSnippets = with spicePkgs.snippets; [
-        pointer
-      ];
-
-      theme = lib.mkForce spicePkgs.themes.catppuccin;
-      colorScheme = lib.mkForce theme.flavor;
-    };
-}
--- a/hosts/thinkpad/home-manager/yazi/catppuccin-mocha.tmTheme
+++ b/hosts/thinkpad/home-manager/yazi/catppuccin-mocha.tmTheme
--- a/hosts/thinkpad/home-manager/yazi/default.nix
+++ b/hosts/thinkpad/home-manager/yazi/default.nix
@ -1,327 +0,0 @@
-{ lib, ... }:
-let
-  theme = import ../../theme.nix;
-  batTheme = ".config/yazi/catppuccin-${theme.flavor}.tmTheme";
-in
-{
-  home.file.${batTheme}.source = ./catppuccin-mocha.tmTheme;
-
-  programs.yazi = {
-    enable = true;
-    settings = {
-      manager = {
-        ratio = [
-          2
-          4
-          2
-        ];
-        sort_by = "natural";
-        sort_sensitive = true;
-        sort_reverse = false;
-        sort_dir_first = true;
-        linemode = "none";
-        show_hidden = true;
-        show_symlink = true;
-      };
-
-      preview = {
-        image_filter = "lanczos3";
-        image_quality = 90;
-        tab_size = 1;
-        max_width = 600;
-        max_height = 900;
-        cache_dir = "";
-        ueberzug_scale = 1;
-        ueberzug_offset = [
-          0
-          0
-          0
-          0
-        ];
-      };
-
-      tasks = {
-        micro_workers = 5;
-        macro_workers = 10;
-        bizarre_retry = 5;
-      };
-    };
-    theme = lib.mkForce {
-      manager = {
-        cwd = {
-          fg = "#${theme.tealAlpha}";
-        };
-
-        hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-        preview_hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-
-        find_keyword = {
-          fg = "#${theme.yellowAlpha}";
-          italic = true;
-        };
-        find_position = {
-          fg = "#${theme.pinkAlpha}";
-          bg = "reset";
-          italic = true;
-        };
-
-        marker_copied = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        marker_cut = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        marker_marked = {
-          fg = "#${theme.tealAlpha}";
-          bg = "#${theme.tealAlpha}";
-        };
-        marker_selected = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        tab_active = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-        tab_inactive = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        tab_width = 1;
-
-        count_copied = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        count_cut = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        count_selected = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        border_symbol = "│";
-        border_style.fg = "#${theme.overlay1Alpha}";
-
-        syntect_theme = "~/${batTheme}";
-      };
-
-      mode = {
-        normal_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-          bold = true;
-        };
-        normal_alt = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        select_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-          bold = true;
-        };
-        select_alt = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        unset_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.flamingoAlpha}";
-          bold = true;
-        };
-        unset_alt = {
-          fg = "#${theme.flamingoAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-      };
-
-      status = {
-        separator_open = "";
-        separator_close = "";
-
-        progress_label = {
-          fg = "#ffffff";
-          bold = true;
-        };
-        progress_normal = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        progress_error = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-
-        perm_type = {
-          fg = "#${theme.blueAlpha}";
-        };
-        perm_read = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        perm_write = {
-          fg = "#${theme.redAlpha}";
-        };
-        perm_exec = {
-          fg = "#${theme.greenAlpha}";
-        };
-        perm_sep = {
-          fg = "#${theme.overlay1Alpha}";
-        };
-      };
-
-      input = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        value = { };
-        selected.reversed = true;
-      };
-
-      pick = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        active = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        inactive = { };
-      };
-
-      confirm = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = {
-          fg = "#${theme.blueAlpha}";
-        };
-        content = { };
-        list = { };
-        btn_yes = {
-          reversed = true;
-        };
-        btn_no = { };
-      };
-
-      completion = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-      };
-      tasks = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        hovered = {
-          underline = true;
-        };
-      };
-
-      which = {
-        mask = {
-          bg = "#${theme.surface0Alpha}";
-        };
-        cand = {
-          fg = "#${theme.tealAlpha}";
-        };
-        rest = {
-          fg = "#9399b2";
-        };
-        desc = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        separator = "  ";
-        separator_style = {
-          fg = "#${theme.surface2Alpha}";
-        };
-      };
-      help = {
-        on = {
-          fg = "#${theme.tealAlpha}";
-        };
-        run = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        desc = {
-          fg = "#9399b2";
-        };
-        hovered = {
-          bg = "#${theme.surface2Alpha}";
-          bold = true;
-        };
-        footer = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-      };
-
-      notify = {
-        title_info = {
-          fg = "#${theme.tealAlpha}";
-        };
-        title_warn = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        title_error = {
-          fg = "#${theme.redAlpha}";
-        };
-      };
-      filetype = {
-        rules = [
-          # Media
-          {
-            mime = "image/*";
-            fg = "#${theme.tealAlpha}";
-          }
-          {
-            mime = "{audio;video}/*";
-            fg = "#${theme.yellowAlpha}";
-          }
-
-          # Archives
-          {
-            mime = "application/*zip";
-            fg = "#${theme.pinkAlpha}";
-          }
-          {
-            mime = "application/x-{tar;bzip*;7z-compressed;xz;rar}";
-            fg = "#${theme.pinkAlpha}";
-          }
-
-          # Documents
-          {
-            mime = "application/{pdf;doc;rtf}";
-            fg = "#${theme.greenAlpha}";
-          }
-
-          # Fallback
-          {
-            name = "*";
-            fg = "#${theme.textAlpha}";
-          }
-          {
-            name = "*/";
-            fg = "#${theme.blueAlpha}";
-          }
-        ];
-      };
-
-      icon = import ./icons.nix;
-    };
-  };
-}
--- a/hosts/thinkpad/home-manager/yazi/icons.nix
+++ b/hosts/thinkpad/home-manager/yazi/icons.nix
--- a/hosts/thinkpad/home-manager/zen/default.nix
+++ b/hosts/thinkpad/home-manager/zen/default.nix
@ -1,12 +1,7 @@
-{ pkgs, inputs, ... }:
-
 {
-  # TODO programatically get default name
-  home = {
-    file.".zen/xdaxqlov.default/chrome" = {
+  # TODO merge with shared
+  home.file.".zen/xdaxqlov.default/chrome" = {
    source = ./chrome;
    recursive = true;
  };
-    packages = with pkgs; [ inputs.zen-browser.packages.${system}.default ]; # Beta
-  };
 }
--- a/hosts/thinkpad/modules/default.nix
+++ b/hosts/thinkpad/modules/default.nix
@ -1,19 +0,0 @@
-{
-  imports = [
-    ./battery.nix
-    ./bluetooth.nix
-    ./development.nix
-    ./fonts.nix
-    ./gaming
-    ./gnome
-    ./hardware
-    ./locale.nix
-    ./networking.nix
-    ./nix-helper.nix
-    ./hyprland
-    ./sddm.nix
-    ./security.nix
-    ./shell.nix
-    ./qt.nix
-  ];
-}
--- a/hosts/thinkpad/modules/development.nix
+++ b/hosts/thinkpad/modules/development.nix
@ -1,41 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    # IDEs
-    jetbrains.rust-rover
-    jetbrains.webstorm
-    jetbrains.rider
-    vscodium # TODO set up extensions
-    # Tools
-    dotnet-sdk_9
-    dotnet-aspnetcore_9
-    git
-    rustup
-    nodejs_22
-    pnpm
-    just
-    gcc # Required for C, Rust and others
-    # Language servers
-    nixd
-    nil
-    # Formatters
-    nixfmt-rfc-style
-    treefmt
-    nodePackages.prettier
-    shfmt
-  ];
-
-  virtualisation.docker = {
-    enable = true;
-    storageDriver = "btrfs";
-    rootless = {
-      enable = true;
-      setSocketVariable = true;
-    };
-  };
-
-  services.ollama = {
-    enable = true;
-  };
-}
--- a/hosts/thinkpad/modules/fonts.nix
+++ b/hosts/thinkpad/modules/fonts.nix
@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    font-awesome # Icons
-  ];
-
-  fonts =
-    let
-      theme = import ../theme.nix;
-    in
-    {
-      fontconfig.enable = true;
-      packages = with pkgs; [
-        (nerdfonts.override { fonts = [ theme.nerdFont ]; })
-        jetbrains-mono
-        # The line below will replace the lines above in 25.05
-        # nerd-fonts.jetbrains-mono
-        font-awesome
-      ];
-    };
-
-}
--- a/hosts/thinkpad/modules/gaming/steam.nix
+++ b/hosts/thinkpad/modules/gaming/steam.nix
@ -1,8 +0,0 @@
-{
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
-    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
-    localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
-  };
-}
--- a/hosts/thinkpad/modules/gnome/default.nix
+++ b/hosts/thinkpad/modules/gnome/default.nix
@ -1,28 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [
-    ./nautilus.nix
-  ];
-
-  environment.systemPackages = with pkgs; [
-    # adw-gtk3
-    glib
-    adwaita-icon-theme
-    gnomeExtensions.appindicator
-    # gnome-extension-manager
-    loupe
-    gnome-calculator
-    gnome-disk-utility
-    gnome-clocks
-    papers # PDFReader
-  ];
-
-  programs.dconf.enable = true; # Required for some gnome applications
-
-  services = {
-    gnome.gnome-keyring.enable = true;
-    gvfs.enable = true; # Gnome Virtual File-system. Required for various things in nautilus
-    udev.packages = with pkgs; [ gnome-settings-daemon ];
-  };
-}
--- a/hosts/thinkpad/modules/gnome/nautilus.nix
+++ b/hosts/thinkpad/modules/gnome/nautilus.nix
@ -1,15 +0,0 @@
-{ pkgs, ... }:
-let
-  common = import ../../common.nix;
-in
-{
-  environment.systemPackages = with pkgs; [
-    nautilus
-    ffmpegthumbnailer # Thumbnails
-  ];
-
-  programs.nautilus-open-any-terminal = {
-    enable = true;
-    terminal = common.default.terminal;
-  };
-}
--- a/hosts/thinkpad/modules/hardware/default.nix
+++ b/hosts/thinkpad/modules/hardware/default.nix
@ -1,8 +0,0 @@
-{
-  imports = [
-    ./audio.nix
-    ./graphics
-    ./hardware-configuration.nix
-    ./keyboard.nix
-  ];
-}
--- a/hosts/thinkpad/modules/hardware/graphics/default.nix
+++ b/hosts/thinkpad/modules/hardware/graphics/default.nix
@ -1,6 +0,0 @@
-{
-  imports = [ ];
-
-  # Enable OpenGL
-  hardware.graphics.enable = true;
-}
--- a/hosts/thinkpad/modules/hardware/keyboard.nix
+++ b/hosts/thinkpad/modules/hardware/keyboard.nix
@ -1,11 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    via
-  ];
-
-  hardware.keyboard.qmk.enable = true;
-
-  services.udev.packages = with pkgs; [ via ];
-}
--- a/hosts/thinkpad/modules/hyprland/default.nix
+++ b/hosts/thinkpad/modules/hyprland/default.nix
@ -1,25 +0,0 @@
-# System configurations for Hyprland. For home configs, see ./home-manager/hyprland
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    xdg-desktop-portal-hyprland
-    hyprpolkitagent # Auth deamon providing modals for password auth
-    hyprshot # Screenshots
-    hyprsunset # Blue light filter
-    unstable.hyprsysteminfo
-    unstable.hyprland-qtutils
-    unstable.hyprland-qt-support
-  ];
-
-  programs = {
-    hyprland = {
-      enable = true;
-      xwayland.enable = true;
-      withUWSM = true;
-    };
-    hyprlock.enable = true; # Lock screen
-  };
-
-  services.hypridle.enable = true; # Lock when unused
-}
--- a/hosts/thinkpad/modules/locale.nix
+++ b/hosts/thinkpad/modules/locale.nix
@ -1,37 +0,0 @@
-# TODO move locale config for hyprland here
-let
-  utf-8 = "UTF-8";
-  en = "en_GB.${utf-8}";
-  nb = "nb_NO.${utf-8}";
-  common = import ../common.nix;
-in
-{
-  # Configure console keymap
-  console.keyMap = "uk";
-
-  # Select internationalisation properties.
-  i18n = {
-    defaultLocale = en;
-    supportedLocales = [
-      "${en}/${utf-8}"
-      "${nb}/${utf-8}"
-    ];
-    extraLocaleSettings = {
-      LC_ADDRESS = nb;
-      LC_IDENTIFICATION = nb;
-      LC_MEASUREMENT = nb;
-      LC_MONETARY = nb;
-      LC_NAME = nb;
-      LC_NUMERIC = nb;
-      LC_PAPER = nb;
-      LC_TELEPHONE = nb;
-      LC_TIME = nb;
-    };
-  };
-
-  # Configure keymaps
-  services.xserver.xkb = common.keymaps;
-
-  # Set your time zone.
-  time.timeZone = "Europe/Oslo";
-}
--- a/hosts/thinkpad/modules/networking.nix
+++ b/hosts/thinkpad/modules/networking.nix
@ -1,23 +0,0 @@
-let
-  common = import ../common.nix;
-in
-{
-  networking = {
-    networkmanager.enable = true;
-    hostName = common.hostname;
-    # wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  };
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  programs.ssh.enableAskPassword = false;
-
-  services.tailscale.enable = true;
-}
--- a/hosts/thinkpad/modules/security.nix
+++ b/hosts/thinkpad/modules/security.nix
@ -1,68 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    gnupg
-    yubioath-flutter
-  ];
-
-  programs.gnupg.agent.enable = true;
-
-  security = {
-    pam = {
-      services = {
-        gdm-fingerprint.text = ''
-          auth       required                    pam_shells.so
-          auth       requisite                   pam_nologin.so
-          auth       requisite                   pam_faillock.so      preauth
-          auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
-          auth       optional                    pam_permit.so
-          auth       required                    pam_env.so
-          auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
-          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
-
-          account    include                     login
-
-          password   required                    pam_deny.so
-
-          session    include                     login
-          session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
-        '';
-        login = {
-          fprintAuth = false;
-          u2fAuth = false; # U2F and password
-        };
-        sudo.u2fAuth = true; # U2F or password
-      };
-      u2f = {
-        enable = true;
-        settings = {
-          cue = true; # Prompt: Please touch the device
-          interactive = false; # Prompt: Insert your U2F device, then press ENTER.
-        };
-      };
-    };
-  };
-
-  # Start the driver at boot
-  systemd.services.fprintd = {
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig.Type = "simple";
-  };
-
-  # Install the driver
-  services.fprintd = {
-    enable = true;
-    tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
-  };
-
-  # however for focaltech 2808:a658, use fprintd with overidden package (without tod)
-  # services.fprintd.package = pkgs.fprintd.override {
-  #   libfprint = pkgs.libfprint-focaltech-2808-a658;
-  # };
-
-  services = {
-    pcscd.enable = true; # Required for Yubikey
-    udev.packages = with pkgs; [ yubikey-personalization ];
-  };
-}
--- a/hosts/thinkpad/modules/shell.nix
+++ b/hosts/thinkpad/modules/shell.nix
@ -1,19 +0,0 @@
-# For Fish dotfiles, see: /home-manager/fish.nix
-{ pkgs, ... }:
-
-{
-  programs = {
-    bash = {
-      # Starts the OS using Bash, then starts fish if it's not running
-      interactiveShellInit = ''
-        if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
-        then
-          shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
-          exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
-        fi
-      '';
-    };
-
-    fish.enable = true;
-  };
-}
--- a/hosts/thinkpad/security.nix
+++ b/hosts/thinkpad/security.nix
@ -0,0 +1,38 @@
+{ pkgs, ... }:
+
+{
+  security = {
+    pam.services = {
+      gdm-fingerprint.text = ''
+        auth       required                    pam_shells.so
+        auth       requisite                   pam_nologin.so
+        auth       requisite                   pam_faillock.so      preauth
+        auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+        auth       optional                    pam_permit.so
+        auth       required                    pam_env.so
+        auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
+        auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
+
+        account    include                     login
+
+        password   required                    pam_deny.so
+
+        session    include                     login
+        session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
+      '';
+      login.fprintAuth = false;
+    };
+  };
+
+  # Start the driver at boot
+  systemd.services.fprintd = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.Type = "simple";
+  };
+
+  # Install the driver
+  services.fprintd = {
+    enable = true;
+    tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
+  };
+}
--- a/52
+++ b/52
@ -1,27 +1,42 @@
+# List all receipes
 default:
    @just --list

+# Format all files in repo
 fmt:
    treefmt --on-unmatched info

+# Build a specific host but don't activate it. Host must use same system as target system
+build HOST:
+    git add .
+    just fmt
+    nh os build . -H {{HOST}}
+
+# Switch to new config, but don't add to bootloader
 test *FLAGS:
    git add .
    just fmt
    nh os test . {{FLAGS}}

+# Add new configuration to bootloader, but don't activate it now
+boot *FLAGS:
+    git add .
+    just fmt
+    nh os test . {{FLAGS}}
+
+# Switch to new config and add to bootloader
 switch *FLAGS:
    git add .
    just fmt
    nh os switch . {{FLAGS}}

+# Switch to new config and add to bootloader without formatting or adding to git
 switch-now *FLAGS:
    nh os switch . {{FLAGS}}

-update-all:
-    nix-channel --update
+update-all *FLAGS:
    nix flake update
-
-    just switch
+    just switch {{FLAGS}}

 update PKG:
    nix flake update {{PKG}}
@ -34,3 +49,32 @@ lock:
 # Decrypt all files in the repo using git-crypt and the user's GPG key
 unlock:
    git-crypt unlock ~/.config/git/crypt-key
+
+# Connect to tailnet or sign-in if not registered
+start-tailscale:
+    tailscale up --login-server https://vpn.martials.no
+
+# Generate a new SSH key without passphrase
+generate-ssh:
+    ssh-keygen -t ed25519 -a 32 -f ~/.ssh/id_ed25519 -P ""
+
+# Generate a new age key from an existing ssh key (without passphrase)
+generate-age-from-ssh:
+    mkdir -p ~/.config/sops/age
+    nix run nixpkgs#ssh-to-age -- -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt
+
+# Get a public age key from an existing age private key
+get-public-age-key:
+    nix shell nixpkgs#age -c age-keygen -y ~/.config/sops/age/keys.txt
+
+# Get the public ssh key from the current user
+get-public-ssh-key:
+    cat ~/.ssh/id_ed25519.pub
+
+# Edit the SOPS secrets file
+edit-secrets:
+    nix run nixpkgs#sops -- shared/secrets/secrets.yaml
+
+# Hash a string using the mkpasswd command
+hash PASS:
+    echo "{{PASS}}" | mkpasswd -s
--- a/lib/default.nix
+++ b/lib/default.nix
@ -1,13 +1,19 @@
 # FIXME(lib.custom): Add some stuff from hmajid2301/dotfiles/lib/module/default.nix, as simplifies option declaration
 { lib, ... }:
+with builtins;

 {
+  getSecret = with lib.strings; filePath: trim (removeSuffix "\n" (readFile filePath));
+
  # use path relative to the root of the project
  relativeToRoot = lib.path.append ../.;
+  relativeToBase = lib.path.append ../shared/base;
+  relativeToDesktop = lib.path.append ../shared/desktop;
+
  scanPaths =
    path:
-    builtins.map (f: (path + "/${f}")) (
-      builtins.attrNames (
+    map (f: (path + "/${f}")) (
+      attrNames (
        lib.attrsets.filterAttrs (
          path: _type:
          (_type == "directory") # include directories
@ -15,7 +21,7 @@
            (path != "default.nix") # ignore default.nix
            && (lib.strings.hasSuffix ".nix" path) # include .nix files
          )
-        ) (builtins.readDir path)
+        ) (readDir path)
      )
    );
 }
--- a/shared/base/home-manager/default.nix
+++ b/shared/base/home-manager/default.nix
@ -0,0 +1,12 @@
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.catppuccin.homeModules.catppuccin
+    ./development
+    ./shell
+    ./gpg.nix
+    ./home-manager.nix
+    ./ssh.nix
+  ];
+}
--- a/shared/base/home-manager/development/default.nix
+++ b/shared/base/home-manager/development/default.nix
@ -0,0 +1,6 @@
+{
+  imports = [
+    ./git.nix
+    ./helix.nix
+  ];
+}
--- a/hosts/desktop/home-manager/development/git.nix
+++ b/hosts/desktop/home-manager/development/git.nix
@ -1,7 +1,10 @@
-{ pkgs, ... }:
+{ pkgs, common, ... }:

 {
-  home.packages = with pkgs; [ git-crypt ];
+  home.packages = with pkgs; [
+    git-crypt
+    gitmoji-cli
+  ];

  programs.git =
    let
@ -11,7 +14,7 @@
      enable = true;
      package = package;
      userName = "Martin Berg Alstad";
-      userEmail = "git@martials.no";
+      userEmail = "git@${common.domain}";

      aliases = {
        amend = "commit --amend";
@ -20,12 +23,10 @@
        p = "push";
      };

-      signing = {
-        signByDefault = true;
-        key = "706F53DD087A91DE";
-      };
+      signing.signByDefault = true;

      extraConfig = {
+        pull.rebase = true;
        push.autoSetupRemote = true;
        safe.directory = "/etc/nixos";
        credential.helper = "${package}/bin/git-credential-libsecret";
--- a/shared/base/home-manager/development/helix.nix
+++ b/shared/base/home-manager/development/helix.nix
@ -0,0 +1,103 @@
+{
+  pkgs,
+  lib,
+  theme,
+  ...
+}:
+
+{
+  catppuccin.helix = {
+    enable = true;
+    flavor = theme.flavor;
+  };
+
+  programs = {
+    fish.shellAliases.edit = "hx";
+    helix =
+      let
+        prettier = format: {
+          command = "prettier";
+          args = [
+            "--stdin-filepath"
+            "file.${format}"
+          ];
+        };
+      in
+      {
+        enable = true;
+        defaultEditor = true;
+        extraPackages = with pkgs; [
+          # Markdown
+          marksman
+          markdown-oxide
+          # Html, css, Json, Eslint
+          vscode-langservers-extracted
+          # Yaml
+          ansible-language-server
+          yaml-language-server
+        ];
+        settings = {
+          editor = {
+            auto-save = {
+              after-delay.enable = true;
+              focus-lost = true;
+            };
+            cursor-shape = {
+              normal = "block";
+              insert = "bar";
+              select = "underline";
+            };
+            lsp = {
+              display-inlay-hints = true;
+              display-messages = true;
+            };
+          };
+          keys.normal = {
+            C-f = ":format";
+          };
+        };
+
+        languages.language = [
+          {
+            name = "css";
+            formatter = prettier "css";
+            auto-format = true;
+          }
+          {
+            name = "json";
+            language-servers = [
+              "vscode-json-language-server"
+            ];
+            formatter = prettier "json";
+            auto-format = true;
+          }
+          {
+            name = "jsonc";
+            language-servers = [
+            ];
+            formatter = prettier "jsonc";
+            file-types = [
+              "jsonc"
+            ];
+            auto-format = true;
+          }
+          {
+            name = "markdown";
+            formatter = prettier "md";
+            auto-format = true;
+          }
+          {
+            name = "nix";
+            formatter.command = lib.getExe pkgs.nixfmt-rfc-style;
+            auto-format = true;
+          }
+          {
+            name = "yaml";
+            formatter = prettier "yaml";
+            auto-format = true;
+          }
+        ];
+
+      };
+  };
+}
--- a/hosts/desktop/home-manager/gpg.nix
+++ b/hosts/desktop/home-manager/gpg.nix
@ -1,9 +1,10 @@
 { pkgs, ... }:

 {
+  programs.gpg.enable = true;
  services.gpg-agent = {
    enable = true;
    enableFishIntegration = true;
-    pinentryPackage = pkgs.pinentry-curses;
+    pinentry.package = pkgs.pinentry-curses;
  };
 }
--- a/shared/base/home-manager/home-manager.nix
+++ b/shared/base/home-manager/home-manager.nix
@ -0,0 +1,16 @@
+{
+  systemConfig,
+  common,
+  ...
+}:
+
+{
+  home = {
+    username = systemConfig.username;
+    homeDirectory = common.dir.home;
+    stateVersion = systemConfig.version;
+  };
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Martin Berg Alstad	055c399d31	✨ [pi4] Add reverse proxy for martials.no staging environment	2025-07-10 18:47:08 +00:00
Martin Berg Alstad	4985fd4a89	🐛 [pi4] Fix Actual container not working	2025-07-10 18:47:08 +00:00
Martin Berg Alstad	9064fc6d1d	✨ [shared] Add Httpie-desktop	2025-07-03 21:50:48 +02:00
Martin Berg Alstad	3e718fadfc	✨ [pi4] Containerize Actual service	2025-06-23 19:18:40 +00:00
Martin Berg Alstad	763ee6312a	♻️ [pi4] Refactor firewall with variables	2025-06-23 18:17:08 +00:00
Martin Berg Alstad	5704ebe712	✨ [pi4] Initial Actual Budget service	2025-06-23 18:07:09 +00:00
Martin Berg Alstad	70b5d5fd4d	✨ [pi4] Nginx reload on change instead of restart	2025-06-23 17:47:35 +00:00
Martin Berg Alstad	c29acb0902	✨ [pi4] Headscale config with Postgres	2025-06-23 17:42:15 +00:00
Martin Berg Alstad	a545b4a45c	🔧 [pi4] Update Forgejo deprecated setting	2025-06-10 16:41:54 +00:00
Martin Berg Alstad	c839811b9f	🐛 [pi4] Fix wrong nginx config for headscale	2025-06-10 16:41:02 +00:00
Martin Berg Alstad	2812e85976	🚑 [pi4] Redirect from www. to	2025-06-08 21:41:29 +00:00
Martin Berg Alstad	3835c3a1a6	🚸 [pi4] Don't change password in forgejo	2025-06-08 21:37:07 +00:00
Martin Berg Alstad	a277e8f3ed	✨ [pi4] Fix nginx config with TLS	2025-06-08 21:34:06 +00:00
Martin Berg Alstad	eb8c857940	🚨 [shared] Migrate Yazi from manager to mgr	2025-06-03 21:50:42 +02:00
Martin Berg Alstad	b3e6222cac	✨ [pi4] Added initial Nginx config	2025-06-03 19:36:14 +00:00
Martin Berg Alstad	575452512a	📦 [desktop] Set Linux kernel to 6.14	2025-06-03 18:55:26 +02:00
Martin Berg Alstad	5cc4c6479c	📦 [shared] Update dependencies	2025-06-03 18:55:02 +02:00
Martin Berg Alstad	724fe6767e	♻️ [shared] Refactor system configs	2025-06-02 21:02:33 +02:00
Martin Berg Alstad	b74e5aab62	✨ [pi4] Added initial Simple mailserver config	2025-06-02 17:44:41 +00:00
Martin Berg Alstad	be02be6bf2	♻️ [pi4] Rename default_phone_region and other minor changes in Nextcloud	2025-05-31 16:04:19 +00:00
Martin Berg Alstad	d614495a2c	🧑‍💻 [pi4] Allow all traffic from local network	2025-05-31 15:42:48 +00:00
Martin Berg Alstad	1f2ea2d5fa	✨ [pi4] Added initial Forgejo config and Podman	2025-05-31 15:42:48 +00:00
Martin Berg Alstad	969a1e75bf	✨ [pi4] Added notes to nextcloud	2025-05-31 15:42:47 +00:00
Martin Berg Alstad	fe01334a85	🚸 [shared] Added public SSH keys for androids	2025-05-31 14:35:37 +02:00
Martin Berg Alstad	e986f337bd	✨ [pi4] Initial Nextcloud config	2025-05-27 20:01:07 +00:00
Martin Berg Alstad	96d57d34c1	🔒 [pi4] Disable ssh on gpg	2025-05-27 17:08:47 +00:00
Martin Berg Alstad	dcad8f12b9	🐛 [shared] Fix missing background on sddm	2025-05-27 18:27:07 +02:00
Martin Berg Alstad	1595e260d5	✨ [shared] Added bat with cat alias	2025-05-27 17:31:25 +02:00
Martin Berg Alstad	de53426fa5	🔧 [shared] Update stateVersion to 25.05	2025-05-26 20:30:17 +02:00
Martin Berg Alstad	fc89c377e8	⬆️ [shared] Upgrade to NixOS 25.05	2025-05-26 20:27:34 +02:00
Martin Berg Alstad	53329b8d1c	♻️ [shared] Moved Hm configs to shared base	2025-05-22 20:10:48 +02:00
Martin Berg Alstad	2b020958ed	♻️ [shared] Move gnome-keyring to base	2025-05-22 19:50:11 +02:00
Martin Berg Alstad	e4fe0e1127	♻️ [shared] Moved users config to base. Use password from Sops	2025-05-22 19:40:49 +02:00
Martin Berg Alstad	21d07edcf1	♻️ [shared] Moved files to base shared directory	2025-05-22 19:36:56 +02:00
Martin Berg Alstad	7455299dd7	♻️ [shared] Refactor hm ssh config, added systems to hm module	2025-05-20 22:03:58 +02:00
Martin Berg Alstad	9a8cc63674	🚚 [shared] Added shared config that shared desktop config inherits from	2025-05-20 21:52:00 +02:00
Martin Berg Alstad	adb02fbcc2	✨ [shared] Added homelab systemConfig	2025-05-20 21:37:26 +02:00
Martin Berg Alstad	882c42a093	♻️ [shared] Move domain to common file	2025-05-19 21:51:12 +02:00
Martin Berg Alstad	c6fcb7b6b8	♻️ [shared] Refactor ssh config to be dynamic	2025-05-19 21:42:29 +02:00
Martin Berg Alstad	b2fd4f1da5	✨ [shared] Added all public ssh keys to authorizedKeys	2025-05-19 20:23:04 +02:00
Martin Berg Alstad	2fe8c9edcb	🔧 [shared] Added ssh config for pi4 and homelab	2025-05-15 19:35:36 +00:00
Martin Berg Alstad	ab8a579a9c	➖ [shared] Only use cuda acceleration for Ollama if Nvidia is used	2025-05-15 21:32:19 +02:00
Martin Berg Alstad	b7c38d133e	🔧 [shared] Added thinkpad to ssh config	2025-05-15 21:18:06 +02:00
Martin Berg Alstad	55f7a37aaa	✨ [shared] Added ssh config for desktop. Justfile to get pub ssh	2025-05-15 21:14:05 +02:00
Martin Berg Alstad	48ff2cdfd2	💥 [pi4] Caddy redirect from kitchenowl to grocery	2025-05-15 20:48:00 +02:00
Martin Berg Alstad	73e6462229	🔐 [pi4] Password defined in sops	2025-05-15 18:47:22 +00:00
Martin Berg Alstad	050741393b	✨ [pi4] Added initial caddy config based on homelab	2025-05-13 21:31:29 +02:00
Martin Berg Alstad	08cd2cbebc	✨ [shared] Added planify	2025-05-13 21:00:14 +02:00
Martin Berg Alstad	5fce13233e	✨ Added Signal-desktop	2025-05-04 22:19:58 +02:00
Martin Berg Alstad	0770ae3ecf	✨ [desktop] Bluetooth Added Bluetooth support to desktop, including PS3 controllers	2025-04-29 20:32:24 +02:00
Martin Berg Alstad	a49dc70148	📦️ [desktop] Update packages, update Linux kernel to latest, update Nvidia drivers	2025-04-29 20:32:14 +02:00
Martin Berg Alstad	33351682c0	✨ [shared] Added fzf, ssh hm config, reencrypted secrets	2025-04-21 11:54:22 +02:00
Martin Berg Alstad	15d5121f0e	♻️ [shared] Refactor helix conifg, rm vscodium, add age for thinkpad	2025-04-20 18:04:23 +02:00
Martin Berg Alstad	d74f3880ca	✨ [shared] Helix config Support for more languages in Helix. C-f to format. Autosave. Added some lsp packages	2025-04-19 19:37:12 +02:00
Martin Berg Alstad	f1bf7b4ded	✨ [shared] Gitmoji-cli Added gitmoji-cli to home-manager	2025-04-19 18:07:55 +02:00
Martin Berg Alstad	985a71d901	✨ [shared] Replace Neovim with Helix Moved Helix editor to shared. Removed Nixvim flake and it's config	2025-04-19 17:54:56 +02:00
Martin Berg Alstad	7e5bc137e5	✨ [shared] Added eza, ls replacement	2025-04-19 17:05:35 +02:00
Martin Berg Alstad	923b0c8980	✨ [shared] Zoxide cd alias. Replaced Papers with sioyek	2025-04-19 16:27:53 +02:00
Martin Berg Alstad	e97dd6f5ce	✨ [shared] Updated Zed config, changed user config to just username	2025-04-18 19:49:14 +02:00
Martin Berg Alstad	31c25681c5	✨ [thinkpad] Fingerprint for sudo and login. Upgraded hyprlock to unstable	2025-04-18 17:54:17 +02:00
Martin Berg Alstad	9e96de997d	✨ [pi4] Added Sops with new hash. Added boot recipe to justfile	2025-04-18 13:59:06 +00:00
Martin Berg Alstad	b521aebef6	🐛 [pi4] Fix wrong paths. Added Zoxide	2025-04-17 12:49:59 +00:00
Martin Berg Alstad	feb1d07500	✨ [pi4] Public age key for pi4, generate ssh key in justfile	2025-04-17 10:25:14 +00:00
Martin Berg Alstad	4f126bab90	📝 [shared] Add justfile comments	2025-04-17 12:06:57 +02:00
Martin Berg Alstad	4b3ad49384	🐛 [desktop] Fix wallpaper not overriding default setting	2025-04-17 12:06:13 +02:00
Martin Berg Alstad	01e5fb42d3	✨ [shared] Sops nix for user passwords	2025-04-17 00:31:19 +02:00
Martin Berg Alstad	8244fe8927	✨ [pi4] Added gnome-keyring for keys	2025-04-16 21:17:50 +00:00
Martin Berg Alstad	244a029d70	✨ [pi4] Nftables firewall config, moved security.nix to security dir	2025-04-16 21:17:50 +00:00
Martin Berg Alstad	36ba00efc3	✨ [shared] Toggle hidden files using ctrl+h in Yazi	2025-04-16 15:45:57 +02:00
Martin Berg Alstad	f1d2672194	✨ [shared] Moved cmdline tools to /shell in home-manager config. Added Yazi catppuccin theme instead of manual	2025-04-16 15:10:40 +02:00
Martin Berg Alstad	b9e009b0cb	✨ [shell] Added shell for formatting entire repo	2025-04-16 14:16:00 +02:00
Martin Berg Alstad	8f1782eccd	🐛 [thinkpad] Fix hypr overrides not overriding	2025-04-16 13:50:22 +02:00
Martin Berg Alstad	ed6a435d79	✨ [pi4] Replaced Nvim with Helix editor	2025-04-16 09:26:50 +00:00
Martin Berg Alstad	7ed64943a6	🐛 [shared] Moved nixfmt to formatters.nix	2025-04-16 10:39:49 +02:00
Martin Berg Alstad	3c5484f1a1	✨ [shared] Formatters in their own file	2025-04-16 00:08:42 +02:00
Martin Berg Alstad	e515408ef2	🐛 [pi4] Fix wrong paths, added missing prettier formatter	2025-04-15 22:03:50 +00:00
Martin Berg Alstad	5a23b66666	✨ [pi4] Tailscale, just, nh, experimentals, fish in module	2025-04-15 23:44:15 +02:00
Martin Berg Alstad	22ab5aa5cf	✨ [pi4] Split module config	2025-04-15 23:39:10 +02:00
Martin Berg Alstad	4ed23cdf5f	Pi4 home-manager config	2025-04-15 23:22:49 +02:00
Martin Berg Alstad	a47b9bb118	Moved gpg config, added programs.gpg	2025-04-15 23:15:40 +02:00
Martin Berg Alstad	4df44fa4de	🐛 Fix build errors on pi4, added configs to push	2025-04-15 21:14:17 +00:00
Martin Berg Alstad	3df0986257	:Moved zen styling to hosts:	2025-04-15 18:26:14 +02:00
Martin Berg Alstad	57d4f949aa	🐛 Fix build errors. Moved zen styling to hosts and app to shared. Start tailscale in justfile	2025-04-15 18:22:06 +02:00
Martin Berg Alstad	4a884f5e6e	✨ Monitor specific configs in hosts	2025-04-15 17:48:57 +02:00
Martin Berg Alstad	980334b44b	✨ Prefer rebase when pulling from git	2025-04-15 13:01:23 +02:00
Martin Berg Alstad	0474fd9802	✨ Moved yubikey config to security dir and rename	2025-04-15 13:01:23 +02:00
Martin Berg Alstad	16c4a8f46b	✨ Split up config files to multiple and added imports. Fixed default values for systemConfigs	2025-04-15 12:48:27 +02:00
Martin Berg Alstad	9611b8bb8d	✨ Moved modeules into shared	2025-04-14 23:30:50 +02:00
Martin Berg Alstad	3b6a3e5a66	🐛 Moved fmt to before git add, formatted file	2025-04-13 13:22:57 +02:00
Martin Berg Alstad	a7836ff585	🐛 Fix config errors	2025-04-13 11:57:32 +02:00
Martin Berg Alstad	f0ce1f4169	♻️ Moved git key to desktop config, step variable in hyprpanel audio	2025-04-13 11:40:05 +02:00
Martin Berg Alstad	a0537f5634	✨ Moved common home-manager config to shared/home-manager	2025-04-12 23:29:10 +02:00
Martin Berg Alstad	0649473709	✨ Added pi4 to systems, moved getSecret function to lib	2025-04-12 20:25:10 +02:00