fix: replace nixfmt-rfc-style with nixfmt

Reviewed-on: Jan/dotfiles#2

README.md

@@ -2,6 +2,41 @@
 
 My NixOS configuration.
 
-## Usage
+## Installation
 
-Clone the repository to some directory. And build with `sudo nixos-rebuild switch --flake /directory/containing/flake.nix/`.
+For disk configuration we use disko, but for secrets management we use sops-nix and the particular setup makes the installation process a bit more involved. It is required that the computer from which the installation is being run has access to the `nixos-secrets` repository, otherwise you will need to manually add the required ssh keys to the installation image. 
+```bash
+# Load into the installer
+sudo passwd # Set a root password
+
+# From a machine with network access to the installer
+# and access to the nixos-secrets repo
+ssh -A root@(installer-ip)
+
+# Set up disks
+nix-shell -p disko
+disko --mode disko --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+exit
+
+# Install NixOS
+nixos-install --no-channel-copy --no-root-password --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+
+# Set up host credentials for access to the secrets
+cd /mnt/persist/system/etc/sops
+touch sops_ed25519_key 
+chmod 600 sops_ed25519_key
+nano sops_ed25519_key
+```
+If `nixos-install` is being stopped by the OOM-killer, you can try adding `-j 1` to limit the amount of jobs that will be executed at the same time to 1. It might require running nixos-install multiple times untill it has managed to download all requirements and slowly start building the rest of the system.
+
+## Updating
+
+To update the system configuration, it is a single command:
+```bash
+sudo system-update
+```
+Or if this shell script has not been installed for some reason:
+```bash
+sudo nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config
+```
+Sometimes it may be necessary to reboot of course.

default.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    # Import modules
-    ./modules/default.nix
-
-    # Import custom packages
-    ./pkgs/default.nix
-  ];
-}

flake.lock

@@ -1,334 +1,22 @@
 {
   "nodes": {
-    "base16": {
+    "disko": {
       "inputs": {
-        "fromYaml": "fromYaml"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1732200724,
+        "lastModified": 1779135526,
-        "narHash": "sha256-+R1BH5wHhfnycySb7Sy5KbYEaTJZWm1h+LW1OtyhiTs=",
+        "narHash": "sha256-glCununz6lmaK5fs2X946HA3EkNxB2JagdAAvInuRYU=",
-        "owner": "SenchoPens",
-        "repo": "base16.nix",
-        "rev": "153d52373b0fb2d343592871009a286ec8837aec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "SenchoPens",
-        "repo": "base16.nix",
-        "type": "github"
-      }
-    },
-    "base16-fish": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1622559957,
-        "narHash": "sha256-PebymhVYbL8trDVVXxCvZgc0S5VxI7I1Hv4RMSquTpA=",
-        "owner": "tomyun",
-        "repo": "base16-fish",
-        "rev": "2f6dd973a9075dabccd26f1cded09508180bf5fe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tomyun",
-        "repo": "base16-fish",
-        "type": "github"
-      }
-    },
-    "base16-helix": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1736852337,
-        "narHash": "sha256-esD42YdgLlEh7koBrSqcT7p2fsMctPAcGl/+2sYJa2o=",
-        "owner": "tinted-theming",
-        "repo": "base16-helix",
-        "rev": "03860521c40b0b9c04818f2218d9cc9efc21e7a5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-helix",
-        "type": "github"
-      }
-    },
-    "base16-vim": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1732806396,
-        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
-        "owner": "tinted-theming",
-        "repo": "base16-vim",
-        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-vim",
-        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
-        "type": "github"
-      }
-    },
-    "firefox-gnome-theme": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1743774811,
-        "narHash": "sha256-oiHLDHXq7ymsMVYSg92dD1OLnKLQoU/Gf2F1GoONLCE=",
-        "owner": "rafaelmardojai",
-        "repo": "firefox-gnome-theme",
-        "rev": "df53a7a31872faf5ca53dd0730038a62ec63ca9e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "rafaelmardojai",
-        "repo": "firefox-gnome-theme",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1717312683,
-        "narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
         "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "disko",
-        "rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
+        "rev": "d405a179887d52b24c0ddd31e09a150bd1f66779",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "repo": "flake-compat",
+        "repo": "disko",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "stylix",
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
-      "inputs": {
-        "systems": [
-          "stylix",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "fromYaml": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1731966426,
-        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
-        "owner": "SenchoPens",
-        "repo": "fromYaml",
-        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "SenchoPens",
-        "repo": "fromYaml",
-        "type": "github"
-      }
-    },
-    "git-hooks": {
-      "inputs": {
-        "flake-compat": [
-          "stylix",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "stylix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1742649964,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "stylix",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gnome-shell": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1732369855,
-        "narHash": "sha256-JhUWbcYPjHO3Xs3x9/Z9RuqXbcp5yhPluGjwsdE2GMg=",
-        "owner": "GNOME",
-        "repo": "gnome-shell",
-        "rev": "dadd58f630eeea41d645ee225a63f719390829dc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "GNOME",
-        "ref": "47.2",
-        "repo": "gnome-shell",
         "type": "github"
       }
     },
@@ -339,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745340124,
+        "lastModified": 1779157263,
-        "narHash": "sha256-zQTOl/JPGjiAQoU1yraCGfPBg7yr4nlHNdbZy8Ebrl4=",
+        "narHash": "sha256-VbiyZkRf8/qr7ObmlyfOHJsNAW5tyZ4MB1+cUwAwdrw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c9433ae62fbb4bd09609e242569edc3b551e21a9",
+        "rev": "866412a19866b4a8e32d2306a118040afa2b840c",
         "type": "github"
       },
       "original": {
@@ -355,16 +43,16 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "stylix",
+          "impermanence",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1745198506,
+        "lastModified": 1768598210,
-        "narHash": "sha256-0hVbHuqAnZUnnGaBTqNes0P0kfH+KKyup2boWDST0iI=",
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b0cc092405da805da6fa964f5a178343658ceaf0",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
@@ -373,87 +61,36 @@
         "type": "github"
       }
     },
-    "ixx": {
+    "impermanence": {
       "inputs": {
-        "flake-utils": [
+        "home-manager": "home-manager_2",
-          "nixvim",
+        "nixpkgs": "nixpkgs"
-          "nuschtosSearch",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixvim",
-          "nuschtosSearch",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1737371634,
+        "lastModified": 1769548169,
-        "narHash": "sha256-fTVAWzT1UMm1lT+YxHuVPtH+DATrhYfea3B0MxG/cGw=",
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
-        "owner": "NuschtOS",
+        "owner": "nix-community",
-        "repo": "ixx",
+        "repo": "impermanence",
-        "rev": "a1176e2a10ce745ff8f63e4af124ece8fe0b1648",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
         "type": "github"
       },
       "original": {
-        "owner": "NuschtOS",
+        "owner": "nix-community",
-        "ref": "v0.0.7",
+        "repo": "impermanence",
-        "repo": "ixx",
-        "type": "github"
-      }
-    },
-    "nix-matlab": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745161329,
-        "narHash": "sha256-OEx+1ceH7bONZhxZv+CjoE9CXElL2raz2Zb/9iabWuE=",
-        "owner": "doronbehar",
-        "repo": "nix-matlab",
-        "rev": "751b9ca566a57ad297987937e7873365a034788c",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "doronbehar",
-        "repo": "nix-matlab",
-        "type": "gitlab"
-      }
-    },
-    "nixos-cosmic": {
-      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1745320144,
-        "narHash": "sha256-Rbw+E3Na694sTPjNSRFHtT1o31eQXO3OLEzM+25kcME=",
-        "owner": "lilyinstarlight",
-        "repo": "nixos-cosmic",
-        "rev": "84d7c1002734f21f150c641da095c5ce43f1cb98",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lilyinstarlight",
-        "repo": "nixos-cosmic",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744932701,
+        "lastModified": 1768564909,
-        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -461,391 +98,79 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1744440957,
+        "lastModified": 1767313136,
-        "narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=",
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1744868846,
+        "lastModified": 1778869304,
-        "narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ebe4301cbd8f81c4f8d3244b3632338bbeb6d49c",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1744868846,
-        "narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ebe4301cbd8f81c4f8d3244b3632338bbeb6d49c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1743583204,
-        "narHash": "sha256-F7n4+KOIfWrwoQjXrL2wD9RhFYLs2/GGe/MQY1sSdlE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2c8d3f48d33929642c1c12cd243df4cc7d2ce434",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixvim": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_3",
-        "nuschtosSearch": "nuschtosSearch"
-      },
-      "locked": {
-        "lastModified": 1745324162,
-        "narHash": "sha256-Sjb/LvtWpPtSXacjJCTrLAmWtXNJd0SWxO3PzTvD7Tc=",
-        "owner": "nix-community",
-        "repo": "nixvim",
-        "rev": "60638182b8d1b0fe13631d02eafaf8903499ee60",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixvim",
-        "type": "github"
-      }
-    },
-    "nur": {
-      "inputs": {
-        "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1745342999,
-        "narHash": "sha256-50TqkAv1ma3zI8TwekiVOdxBD+fyJsEeBHRgQtmSktk=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "71cefa751b886862229c679aab1c2b0fab837052",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "NUR",
-        "type": "github"
-      }
-    },
-    "nur_2": {
-      "inputs": {
-        "flake-parts": "flake-parts_3",
-        "nixpkgs": [
-          "stylix",
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix_2"
-      },
-      "locked": {
-        "lastModified": 1743884191,
-        "narHash": "sha256-foVcginhVvjg8ZnTzY5wwMeZ4wjJ8yX66PW5kgyivPE=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "fde90f5f52e13eed110a0e53a2818a2b09e4d37c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "NUR",
-        "type": "github"
-      }
-    },
-    "nuschtosSearch": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "ixx": "ixx",
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745046075,
-        "narHash": "sha256-8v4y6k16Ra/fiecb4DxhsoOGtzLKgKlS+9/XJ9z0T2I=",
-        "owner": "NuschtOS",
-        "repo": "search",
-        "rev": "066afe8643274470f4a294442aadd988356a478f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "repo": "search",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "disko": "disko",
         "home-manager": "home-manager",
-        "nix-matlab": "nix-matlab",
+        "impermanence": "impermanence",
-        "nixos-cosmic": "nixos-cosmic",
         "nixpkgs": "nixpkgs_2",
-        "nixvim": "nixvim",
+        "nixpkgs-stable": "nixpkgs-stable",
-        "nur": "nur",
+        "secrets": "secrets",
-        "stylix": "stylix"
+        "sops-nix": "sops-nix"
       }
     },
-    "rust-overlay": {
+    "secrets": {
+      "locked": {
+        "lastModified": 1766822527,
+        "narHash": "sha256-0qNxAxr7LQ8C6MjSxV2FkMSfdVmOVRq7Yz/wCea8plo=",
+        "ref": "refs/heads/main",
+        "rev": "695e36891b5de248993845e1435df5e4116a26f2",
+        "revCount": 21,
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      }
+    },
+    "sops-nix": {
       "inputs": {
         "nixpkgs": [
-          "nixos-cosmic",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1745289264,
+        "lastModified": 1777944972,
-        "narHash": "sha256-7nt+UJ7qaIUe2J7BdnEEph9n2eKEwxUwKS/QIr091uA=",
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
-        "owner": "oxalica",
+        "owner": "Mic92",
-        "repo": "rust-overlay",
+        "repo": "sops-nix",
-        "rev": "3b7171858c20d5293360042936058fb0c4cb93a9",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
-        "owner": "oxalica",
+        "owner": "Mic92",
-        "repo": "rust-overlay",
+        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
-    "stylix": {
-      "inputs": {
-        "base16": "base16",
-        "base16-fish": "base16-fish",
-        "base16-helix": "base16-helix",
-        "base16-vim": "base16-vim",
-        "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_3",
-        "git-hooks": "git-hooks",
-        "gnome-shell": "gnome-shell",
-        "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_4",
-        "nur": "nur_2",
-        "systems": "systems_3",
-        "tinted-foot": "tinted-foot",
-        "tinted-kitty": "tinted-kitty",
-        "tinted-schemes": "tinted-schemes",
-        "tinted-tmux": "tinted-tmux",
-        "tinted-zed": "tinted-zed"
-      },
-      "locked": {
-        "lastModified": 1745332124,
-        "narHash": "sha256-2lRWKSUlKTsfqLhyxXsxKcoPQG5tFQ3GbTne8/vVCQY=",
-        "owner": "danth",
-        "repo": "stylix",
-        "rev": "375b1de2424aac1338ee6e8b4ef15976b64b0462",
-        "type": "github"
-      },
-      "original": {
-        "owner": "danth",
-        "repo": "stylix",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
-    "tinted-kitty": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1716423189,
-        "narHash": "sha256-2xF3sH7UIwegn+2gKzMpFi3pk5DlIlM18+vj17Uf82U=",
-        "owner": "tinted-theming",
-        "repo": "tinted-kitty",
-        "rev": "eb39e141db14baef052893285df9f266df041ff8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-kitty",
-        "rev": "eb39e141db14baef052893285df9f266df041ff8",
-        "type": "github"
-      }
-    },
-    "tinted-schemes": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1742851696,
-        "narHash": "sha256-sR4K+OVFKeUOvNIqcCr5Br7NLxOBEwoAgsIyjsZmb8s=",
-        "owner": "tinted-theming",
-        "repo": "schemes",
-        "rev": "c37771c4ae8ff1667e27ddcf24991ebeb94a4e77",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "schemes",
-        "type": "github"
-      }
-    },
-    "tinted-tmux": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1743296873,
-        "narHash": "sha256-8IQulrb1OBSxMwdKijO9fB70ON//V32dpK9Uioy7FzY=",
-        "owner": "tinted-theming",
-        "repo": "tinted-tmux",
-        "rev": "af5152c8d7546dfb4ff6df94080bf5ff54f64e3a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-tmux",
-        "type": "github"
-      }
-    },
-    "tinted-zed": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1725758778,
-        "narHash": "sha256-8P1b6mJWyYcu36WRlSVbuj575QWIFZALZMTg5ID/sM4=",
-        "owner": "tinted-theming",
-        "repo": "base16-zed",
-        "rev": "122c9e5c0e6f27211361a04fae92df97940eccf9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-zed",
-        "type": "github"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "treefmt-nix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "stylix",
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
         "type": "github"
       }
     }

flake.nix

@@ -1,84 +1,38 @@
 {
-  description = "NixOS system";
+  description = "System configuration for NixOS";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    # General inputs
-    home-manager = {
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
-      url = "github:nix-community/home-manager";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-      inputs.nixpkgs.follows = "nixpkgs";
+    home-manager.url = "github:nix-community/home-manager";
-    };
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    stylix.url = "github:danth/stylix";
+
-    nixvim.url = "github:nix-community/nixvim";
+    # Secrets
-    nur = {
+    sops-nix.url = "github:Mic92/sops-nix";
-      url = "github:nix-community/NUR";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
+    secrets.url = "git+ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets";
-    };
+
-    nix-matlab = {
+    # Disk setup
-      url = "gitlab:doronbehar/nix-matlab";
+    disko.url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
-    };
+    impermanence.url = "github:nix-community/impermanence";
-    flake-utils.url = "github:numtide/flake-utils";
+
-    nixos-cosmic.url = "github:lilyinstarlight/nixos-cosmic";
+    # MADD
+    # madd.url = "git+https://git.bulthuis.dev/Jan/madd";
+    # madd.inputs.nixpkgs.follows = "nixpkgs";
+
+    # For Minecraft VM
+    # nix-minecraft.url = "github:Jan-Bulthuis/nix-minecraft";
+    # nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
+    # nix-modpack.url = "github:Jan-Bulthuis/nix-modpack";
+    # nix-modpack.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
-    {
+    inputs:
-      self,
+    import ./glue {
-      nixpkgs,
+      inherit inputs;
-      home-manager,
+      excludeHomeManagerModules = [ "impermanence" ];
-      stylix,
-      nixvim,
-      nur,
-      nix-matlab,
-      nixos-cosmic,
-      ...
-    }:
-    let
-      mkConfig =
-        system: machineConfig: userConfig:
-        (nixpkgs.lib.nixosSystem {
-          inherit system;
-          specialArgs = { inherit system; };
-          modules = [
-            machineConfig
-            home-manager.nixosModules.home-manager
-            {
-              nix.settings = {
-                substituters = [ "https://cosmic.cachix.org/" ];
-                trusted-public-keys = [ "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE=" ];
-              };
-              machine.users = userConfig;
-              home-manager.extraSpecialArgs = { inherit system; };
-              home-manager.sharedModules = [
-                stylix.homeManagerModules.stylix
-                nixvim.homeManagerModules.nixvim
-                nur.modules.homeManager.default
-                {
-                  nixpkgs.overlays = [
-                    nix-matlab.overlay
-                    nixos-cosmic.overlays.default
-                  ];
-                }
-              ];
-            }
-          ];
-        });
-    in
-    {
-      nixosConfigurations = {
-        "20212060" = mkConfig "x86_64-linux" ./machines/laptop.nix {
-          jan = {
-            sudo = true;
-            configuration = ./users/jan.nix;
-          };
-        };
-        "vm-audio" = mkConfig "x86_64-linux" ./machines/vm-audio.nix {
-          local = {
-            sudo = true;
-            configuration = ./users/server.nix;
-          };
-        };
-      };
-      lib = import ./shell-modules/default.nix self.inputs;
     };
 }

glue/default.nix

@@ -0,0 +1,199 @@
+{
+  inputs,
+  excludeHomeManagerModules ? [ ],
+}:
+let
+  flake = inputs.self;
+  nixpkgs = inputs.nixpkgs;
+  lib = nixpkgs.lib;
+
+  nixpkgs-config = {
+    allowUnfree = true;
+  };
+
+  importDir =
+    path: fn:
+    let
+      entries = builtins.readDir path;
+
+      # Get paths to directories
+      dirs = lib.filterAttrs (_: type: type == "directory") entries;
+      dirPaths = lib.mapAttrs (name: type: {
+        path = "${path}/${name}";
+        type = type;
+      }) dirs;
+
+      # Get paths to nix files
+      nixName = name: builtins.match "(.*)\\.nix" name;
+      files = lib.filterAttrs (name: type: (type != "directory") && ((nixName name) != null)) entries;
+      filePaths = lib.mapAttrs' (name: type: {
+        name = builtins.head (nixName name);
+        value = {
+          path = "${path}/${name}";
+          type = type;
+        };
+      }) files;
+
+      combined = dirPaths // filePaths;
+    in
+    fn (lib.optionalAttrs (builtins.pathExists path) combined);
+
+  # Split out into getNixFiles, getNixFilesRecursive, getDirs
+  importDirRecursive =
+    path: fn:
+    let
+      entries = importDir path lib.id;
+
+      # Dig down recursively
+      dirs = lib.filterAttrs (_: entry: entry.type == "directory") entries;
+      recursedEntries = lib.mapAttrs (name: entry: (importDirRecursive entry.path lib.id)) dirs;
+    in
+    fn (entries // recursedEntries);
+
+  eachSystem = fn: lib.genAttrs lib.systems.flakeExposed fn;
+
+  systemArgs = eachSystem (system: {
+    pkgs = (
+      import inputs.nixpkgs {
+        inherit system;
+        config = nixpkgs-config;
+      }
+    );
+    stable-pkgs = (
+      import inputs.nixpkgs-stable {
+        inherit system;
+        config = nixpkgs-config;
+      }
+    );
+  });
+
+  allPackages = importDir "${flake}/packages" (
+    attrs:
+    lib.mapAttrs (
+      name: entry: (if entry.type == "directory" then "${entry.path}/default.nix" else entry.path)
+    ) attrs
+  );
+
+  packages =
+    let
+      # TODO: Filter out packages that are not supported on the platform?
+      mkPackages =
+        system:
+        let
+          args = systemArgs."${system}";
+          pkgs = args.pkgs;
+        in
+        lib.mapAttrs (name: package: pkgs.callPackage package { }) allPackages;
+    in
+    eachSystem mkPackages;
+
+  overlay = final: prev: (lib.mapAttrs (name: package: prev.callPackage package { }) allPackages);
+
+  collectEntries =
+    attrs:
+    lib.attrsets.collect (
+      entry: (lib.isAttrs entry) && (lib.hasAttr "path" entry) && (lib.hasAttr "type" entry)
+    ) attrs;
+
+  collectModules =
+    path:
+    importDirRecursive path (
+      attrs:
+      map (entry: if entry.type == "directory" then entry.path + "/default.nix" else entry.path) (
+        collectEntries attrs
+      )
+    );
+
+  nixosModules = collectModules "${flake}/modules/nixos";
+  nixosProfiles = collectModules "${flake}/profiles/nixos";
+  inputNixosModules = lib.map (flake: flake.outputs.nixosModules.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "nixosModules" "default" ] flake) (
+      lib.attrValues inputs
+    )
+  );
+
+  homeModules = collectModules "${flake}/modules/home";
+  homeProfiles = collectModules "${flake}/profiles/home";
+  inputHomeModules = lib.map (flake: flake.outputs.homeManagerModules.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "homeManagerModules" "default" ] flake) (
+      lib.attrValues (
+        lib.attrsets.filterAttrs (name: entry: !(lib.elem name excludeHomeManagerModules)) inputs
+      )
+    )
+  );
+
+  inputOverlays = lib.map (flake: flake.outputs.overlays.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "overlays" "default" ] flake) (
+      lib.attrValues inputs
+    )
+  );
+
+  overlayModule =
+    { ... }:
+    {
+      nixpkgs.overlays = [ overlay ] ++ inputOverlays;
+    };
+
+  nixpkgsModule =
+    { ... }:
+    {
+      nixpkgs.config = nixpkgs-config;
+    };
+
+  nixosConfigurations = importDir "${flake}/hosts" (
+    attrs:
+    lib.mapAttrs (
+      name: entry:
+      let
+        pkgs-stable = systemArgs."x86_64-linux".stable-pkgs;
+      in
+      lib.nixosSystem {
+        specialArgs = {
+          inherit inputs pkgs-stable;
+        };
+        modules =
+          let
+            systemPath = "${entry.path}/configuration.nix";
+
+            userEntries = importDir "${entry.path}/users" lib.id;
+
+            usersConfiguration = lib.mapAttrs (name: entry: {
+              isNormalUser = true;
+              group = name;
+            }) userEntries;
+            groupsConfiguration = lib.mapAttrs (name: entry: {
+            }) userEntries;
+            homesConfiguration = lib.mapAttrs (name: entry: entry.path) userEntries;
+
+            usersModule =
+              { ... }:
+              {
+                home-manager.extraSpecialArgs = {
+                  inherit inputs pkgs-stable;
+                };
+                home-manager.sharedModules = homeModules ++ homeProfiles ++ inputHomeModules;
+                home-manager.useUserPackages = true;
+                home-manager.useGlobalPkgs = true;
+                home-manager.users = homesConfiguration;
+                users.users = usersConfiguration;
+                users.groups = groupsConfiguration;
+              };
+          in
+          [
+            systemPath
+            overlayModule
+            usersModule
+            nixpkgsModule
+          ]
+          ++ nixosModules
+          ++ nixosProfiles
+          ++ inputNixosModules;
+      }
+    ) (lib.attrsets.filterAttrs (name: entry: entry.type == "directory") attrs)
+  );
+
+in
+{
+  inherit packages nixosConfigurations overlay;
+  overlays.default = overlay;
+}

hosts/vm-audio/configuration.nix

@@ -0,0 +1,241 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-audio";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+    sound.enable = true;
+    # spotifyd.enable = true; # TODO: Add this as a local module
+  };
+
+  # Install system packages
+  environment.systemPackages = with pkgs; [
+    carla
+    xpra
+    alsa-utils
+    pulsemixer
+    adwaita-icon-theme
+    open-stage-control
+    carla_osc_bridge
+
+    # Add LV2 plugins
+    lsp-plugins
+    airwindows-lv2
+    distrho-ports
+    cardinal
+    calf
+  ];
+
+  # Setup firewall
+  networking.firewall = {
+    allowedTCPPorts = [
+      8080
+      10402
+      15151
+      22752
+    ];
+    allowedUDPPorts = [
+      8080
+      10402
+      15151
+      22752
+    ];
+  };
+
+  # Setup dependencies
+  environment.variables.LD_LIBRARY_PATH = lib.mkForce "${lib.makeLibraryPath (
+    with pkgs;
+    [
+      cairo
+      pipewire.jack
+    ]
+  )}";
+  qt = {
+    enable = true;
+    style = "adwaita";
+  };
+  xdg.icons = {
+    enable = true;
+    fallbackCursorThemes = [ "Adwaita" ];
+  };
+  hardware.graphics.enable = true;
+
+  # User for audio mixing
+  users.users.mixer = {
+    isNormalUser = true;
+    group = "mixer";
+    extraGroups = [ "systemd-journal" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Personal"
+    ];
+  };
+  users.groups.mixer = { };
+  users.groups.audio = {
+    members = [
+      "mixer"
+    ];
+  };
+  users.groups.bluetooth = {
+    members = [
+      "mixer"
+    ];
+  };
+
+  # Xpra service
+  systemd.user.services.xpra = {
+    description = "Xpra Service";
+    wantedBy = [ "default.target" ];
+    after = [
+      "network.target"
+    ];
+    unitConfig = {
+      ConditionUser = "mixer";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.xpra}/bin/xpra start :7 --bind-tcp=0.0.0.0:15151 --daemon=no";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  # Carla service
+  systemd.user.services.carla = {
+    description = "Carla Service";
+    wantedBy = [ "default.target" ];
+    after = [
+      "network.target"
+      "sound.target"
+    ];
+    requires = [
+      "xpra.service"
+    ];
+    unitConfig = {
+      ConditionUser = "mixer";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.carla}/bin/carla /home/mixer/Default.carxp -platform xcb";
+      Environment = "\"DISPLAY=:7\"";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  # Carla service
+  systemd.user.services.carla-bridge = {
+    description = "Carla OSC Bridge";
+    wantedBy = [ "default.target" ];
+    after = [
+      "network.target"
+      "sound.target"
+    ];
+    requires = [
+      "carla.service"
+    ];
+    unitConfig = {
+      ConditionUser = "mixer";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.carla_osc_bridge}/bin/carla_osc_bridge --clients \"127.0.0.1:8080\"";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  # Open stage control service
+  systemd.user.services.osc = {
+    description = "OSC Service";
+    wantedBy = [ "default.target" ];
+    after = [
+      "network.target"
+    ];
+    requires = [
+      "carla.service"
+    ];
+    unitConfig = {
+      ConditionUser = "mixer";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.open-stage-control}/bin/open-stage-control --no-gui --send 127.0.0.1:10402 --load /home/mixer/open-stage-control/session.json --theme /home/mixer/open-stage-control/theme.css";
+      Environment = "\"ELECTRON_RUN_AS_NODE=1\"";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  # Create bluetooth A2DP source
+  hardware.bluetooth = {
+    enable = true;
+    disabledPlugins = [ "hostname" ];
+    settings.General = {
+      Name = "Linox";
+      Class = "0x240414";
+      DiscoverableTimeout = 0;
+      AlwaysPairable = true;
+      PairableTimeout = 0;
+      FastConnectable = true;
+      JustWorksRepairing = "always";
+    };
+  };
+  services.pipewire.wireplumber.extraConfig."50-bluetooth-a2dp" = {
+    "monitor.bluez.properties" = {
+      "bluez5.roles" = [ "a2dp_source" ];
+    };
+  };
+
+  # Create null sinks
+  services.pipewire.extraConfig.pipewire."91-null-sinks" = {
+    "context.objects" = [
+      {
+        factory = "adapter";
+        args = {
+          "factory.name" = "support.null-audio-sink";
+          "node.name" = "Speaker-Proxy";
+          "node.description" = "Proxy for Speaker Output";
+          "media.class" = "Audio/Sink";
+          "audio.position" = "L,R";
+        };
+      }
+      {
+        factory = "adapter";
+        args = {
+          "factory.name" = "support.null-audio-sink";
+          "node.name" = "Headphone-Proxy";
+          "node.description" = "Proxy for Headphone Output";
+          "media.class" = "Audio/Sink";
+          "audio.position" = "L,R";
+        };
+      }
+      {
+        factory = "adapter";
+        args = {
+          "factory.name" = "support.null-audio-sink";
+          "node.name" = "SpotifyD-Proxy";
+          "node.description" = "Proxy for SpotifyD";
+          "media.class" = "Audio/Sink";
+          "audio.position" = "L,R";
+        };
+      }
+      {
+        factory = "adapter";
+        args = {
+          "factory.name" = "support.null-audio-sink";
+          "node.name" = "AnalogIn-Proxy";
+          "node.description" = "Proxy for the analog input";
+          "media.class" = "Audio/Source/Virtual";
+          "audio.position" = "L,R";
+        };
+      }
+    ];
+  };
+}

hosts/vm-infra/configuration.nix

@@ -0,0 +1,39 @@
+{
+  inputs,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "25.05";
+
+  # Machine hostname
+  networking.hostName = "vm-infra";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Setup JOOL NAT64
+  networking.jool = {
+    enable = true;
+    nat64.default = {
+      global.pool6 = "64:ff9b::/96";
+      pool4 = [
+        {
+          protocol = "TCP";
+          prefix = "10.64.0.1/32";
+        }
+        {
+          protocol = "UDP";
+          prefix = "10.64.0.1/32";
+        }
+        {
+          protocol = "ICMP";
+          prefix = "10.64.0.1/32";
+        }
+      ];
+    };
+  };
+}

hosts/vm-k1s/configuration.nix

@@ -0,0 +1,254 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "25.05";
+
+  # Machine hostname
+  networking.hostName = "vm-k1s";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Read in secrets
+  sops.secrets."flux/git-ssh-key" = {
+    sopsFile = "${inputs.secrets}/secrets/k3s-cluster.enc.yaml";
+  };
+  sops.secrets."flux/sops-decrypt-key" = {
+    sopsFile = "${inputs.secrets}/secrets/k3s-cluster.enc.yaml";
+  };
+
+  # Include NFS client module
+  boot.supportedFilesystems = [ "nfs" ];
+
+  # Set up K3S cluster with CoreDNS, FluxCD and Cilium
+  services.k3s = {
+    enable = true;
+    extraFlags = [
+      "--cluster-domain ${inputs.secrets.lab.k3s.clusterDomain}"
+      "--flannel-backend=none"
+      "--disable-network-policy"
+      "--disable-kube-proxy"
+    ];
+    disable = [
+      # "coredns" # CoreDNS is required for Flux to be able to bootstrap the cluster (Flux needs to resolve the git repo)
+      "servicelb"
+      "traefik"
+      "local-storage"
+      "metrics-server"
+      "runtimes"
+    ];
+    manifests = {
+      git-ssh-key = {
+        source = config.sops.secrets."flux/git-ssh-key".path;
+      };
+      sops-decrypt-key = {
+        source = config.sops.secrets."flux/sops-decrypt-key".path;
+      };
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      gateway-api =
+        let
+          manifest = pkgs.fetchurl {
+            url = "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/experimental-install.yaml";
+            hash = "sha256-VTMn4P8yoaK+RGv5OCPIQTz5JTrGptVAfuvR6NJp9p4=";
+          };
+        in
+        {
+          source = manifest;
+        };
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      netpol-system-allow-egress.content = {
+        apiVersion = "cilium.io/v2";
+        kind = "CiliumClusterwideNetworkPolicy";
+        metadata.name = "allow-system-egress";
+        spec = {
+          description = "Allow all egress to system services.";
+          endpointSelector = {
+            matchExpressions = [
+              {
+                key = "io.kubernetes.pod.namespace";
+                operator = "NotIn";
+                values = [
+                  "bogus-namespace"
+                  # "kube-system"
+                  # "cilium-system"
+                  # "flux-system"
+                ];
+              }
+            ];
+          };
+          egress = [
+            {
+              toEntities = [
+                "all"
+              ];
+            }
+          ];
+          ingress = [
+            {
+              fromEntities = [
+                "all"
+              ];
+            }
+          ];
+        };
+      };
+      netpol-cluster-allow-dns.content = {
+        apiVersion = "cilium.io/v2";
+        kind = "CiliumClusterwideNetworkPolicy";
+        metadata.name = "allow-dns";
+        spec = {
+          description = "Allow DNS";
+          endpointSelector = { };
+          egress = [
+            {
+              toEndpoints = [
+                {
+                  matchLabels = {
+                    "io.kubernetes.pod.namespace" = "kube-system";
+                    "k8s-app" = "kube-dns";
+                  };
+                }
+              ];
+              toPorts = [
+                {
+                  ports = [
+                    {
+                      port = 53;
+                      protocol = "ANY";
+                    }
+                  ];
+                  rules.dns = [
+                    {
+                      matchPattern = "*";
+                    }
+                  ];
+                }
+              ];
+            }
+          ];
+        };
+      };
+      netpol-flux-allow-egress.content = { };
+    };
+    autoDeployCharts = {
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      cilium = {
+        name = "cilium";
+        repo = "oci://quay.io/cilium/charts/cilium";
+        version = "1.18.8";
+        hash = "sha256-z1aDpWttEfQ+Af/l0Lxdafasm75QysRc8h7sPhWXr94=";
+        createNamespace = true;
+        targetNamespace = "cilium-system";
+        values = {
+          operator.replicas = 1;
+          kubeProxyReplacement = true;
+          ipam.operator.clusterPoolIPv4PodCIDRList = [ "10.42.0.0/16" ];
+          cluster = {
+            id = 1;
+            name = "vm-k1s";
+          };
+          k8sServiceHost = "10.10.50.60";
+          k8sServicePort = 6443;
+          policyEnforcementMode = "always";
+          gatewayAPI = {
+            enabled = true;
+            gatewayClass.create = "true";
+            enableAlpn = true;
+          };
+          bgpControlPlane.enabled = true;
+          tls.secretsNamespace.create = false;
+          hubble = {
+            relay.enabled = true;
+            ui.enabled = true;
+            peerService.clusterDomain = inputs.secrets.lab.k3s.clusterDomain;
+          };
+        };
+        extraFieldDefinitions = {
+          spec.bootstrap = true;
+        };
+      };
+      flux-operator = {
+        name = "flux-operator";
+        repo = "oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator";
+        version = "0.38.1";
+        hash = "sha256-nb0mzEWC3IwjPenQ4LSWBN0NNJc2cc68RB+G60xBOEM=";
+        createNamespace = true;
+        targetNamespace = "flux-system";
+        extraDeploy = [
+          {
+            apiVersion = "fluxcd.controlplane.io/v1";
+            kind = "FluxInstance";
+            metadata = {
+              name = "flux";
+              namespace = "flux-system";
+              annotations = {
+                "fluxcd.controlplane.io/reconcile" = "enabled";
+                "fluxcd.controlplane.io/reconcileEvery" = "1h";
+                "fluxcd.controlplane.io/reconcileTimeout" = "5m";
+              };
+            };
+            spec = {
+              distribution = {
+                version = "2.x";
+                registry = "ghcr.io/fluxcd";
+              };
+              components = [
+                "source-controller"
+                "kustomize-controller"
+                "helm-controller"
+                "notification-controller"
+              ];
+              cluster = {
+                type = "kubernetes";
+                size = "small";
+                multitenant = false;
+                networkPolicy = true;
+                domain = inputs.secrets.lab.k3s.clusterDomain;
+              };
+              commonMetadata.labels = {
+                "app.kubernetes.io/name" = "flux";
+              };
+              sync = (
+                {
+                  pullSecret = "git-ssh-key";
+                }
+                // inputs.secrets.lab.k3s.fluxRepo
+              );
+            };
+          }
+        ];
+      };
+    };
+  };
+
+  modules.impermanence.directories = [
+    "/var/lib/rancher/k3s"
+  ];
+
+  environment.variables = {
+    KUBECONFIG = "/etc/rancher/k3s/k3s.yaml";
+    CILIUM_NAMESPACE = "cilium-system";
+  };
+
+  environment.systemPackages = with pkgs; [
+    fluxcd
+    k9s
+    cilium-cli
+    hubble
+  ];
+
+  # Use correct disko profile
+  modules.disko.profile = "k3s";
+
+  # TEMP: Disable firewall for now
+  networking.firewall.enable = false;
+  security.sudo.wheelNeedsPassword = false;
+}

hosts/vm-minecraft/configuration.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  pkgs,
+  config,
+  inputs,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Import the nix-minecraft modules
+  imports = [
+    inputs.nix-minecraft.nixosModules.minecraft-servers
+  ];
+
+  # Machine hostname
+  networking.hostName = "vm-minecraft";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Set up minecraft servers
+  users.users.local.extraGroups = [ "minecraft" ];
+  modules.impermanence.directories = [
+    "/srv/minecraft"
+  ];
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    openFirewall = true;
+    servers = {
+      vanilla = {
+        enable = true;
+        autoStart = true;
+        serverProperties = {
+          white-list = true;
+          difficulty = "normal";
+          max-players = 5;
+        };
+        package = inputs.nix-minecraft.legacyPackages.${pkgs.system}.fabricServers.fabric-1_21_7;
+      };
+      modpack = {
+        enable = false;
+        autoStart = true;
+        serverProperties = { };
+        package = inputs.nix-modpack.packages.${pkgs.system}.mkModpackServer {
+          packUrl = "https://raw.githubusercontent.com/Jan-Bulthuis/Modpack/refs/heads/master/pack.toml";
+          server = inputs.nix-minecraft.legacyPackages.${pkgs.system}.neoForgeServers.neoforge-20_1_106;
+        };
+        jvmOpts = "-Xms6144M -Xmx8192M";
+      };
+    };
+  };
+}

hosts/vm-oddjob/configuration.nix

@@ -0,0 +1,143 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-oddjob";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Omada Software Controller
+  users.users.omada = {
+    isSystemUser = true;
+    group = "omada";
+  };
+  users.groups.omada = { };
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      omada-controller = {
+        volumes = [
+          "/var/lib/omada:/opt/tplink/EAPController/data"
+        ];
+        environment = {
+          TZ = "Europe/Amsterdam";
+        };
+        extraOptions = [
+          "--network=host"
+          "--ulimit"
+          "nofile=4096:8192"
+        ];
+        image = "mbentley/omada-controller:5.15";
+      };
+    };
+  };
+  modules.impermanence.directories = [
+    "/var/lib/omada"
+  ];
+  networking.firewall = {
+    allowedTCPPorts = [
+      8088
+      8043
+      8843
+    ];
+    allowedTCPPortRanges = [
+      {
+        from = 29811;
+        to = 29816;
+      }
+    ];
+    allowedUDPPorts = [
+      19810
+      27001
+      29810
+    ];
+  };
+
+  # Setup NAS backups
+  environment.systemPackages = with pkgs; [
+    keyutils
+  ];
+  environment.etc."request-key.d/cifs.spnego.conf".text = ''
+    create cifs.spnego * * ${pkgs.cifs-utils}/bin/cifs.upcall -t %k
+  '';
+  environment.etc."request-key.d/cifs.idmap.conf".text = ''
+    create cifs.idmap * * ${pkgs.cifs-utils}/bin/cifs.idmap %k
+  '';
+  sops.secrets."smb-credentials" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  sops.secrets."backup-script-env" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  services.cron = {
+    enable = true;
+    systemCronJobs =
+      let
+        script = pkgs.writeShellScript "backup-script" (
+          lib.concatStrings (
+            [
+              ''
+                . ${config.sops.secrets."backup-script-env".path}
+                export PBS_REPOSITORY=$PBS_REPOSITORY
+                export PBS_NAMESPACE=$PBS_NAMESPACE
+                export PBS_PASSWORD=$PBS_PASSWORD
+                export PBS_FINGERPRINT=$PBS_FINGERPRINT
+              ''
+            ]
+            ++ lib.map (share: ''
+              systemctl start mnt-${share}.mount
+              ${pkgs.util-linux}/bin/prlimit --nofile=1024:1024 ${pkgs.proxmox-backup-client}/bin/proxmox-backup-client backup nfs.pxar:/mnt/${share} --ns $PBS_NAMESPACE --backup-id share-${share} --change-detection-mode=metadata --exclude "#recycle"
+              systemctl stop mnt-${share}.mount
+            '') inputs.secrets.lab.nas.backupShares
+          )
+        );
+      in
+      [
+        "0 0 * * * root ${script}"
+      ];
+  };
+
+  # Mount filesystems
+  systemd.services.krb5-mnt-credentials = {
+    description = "Set up Kerberos credentials for mounting shares";
+    before = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    requiredBy = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      . ${config.sops.secrets."smb-credentials".path}
+      echo $password | ${pkgs.krb5}/bin/kinit $username
+    '';
+  };
+  fileSystems = lib.listToAttrs (
+    lib.map (share: {
+      name = "/mnt/${share}";
+      value = {
+        device = "//${inputs.secrets.lab.nas.host}/${share}";
+        fsType = "cifs";
+        options = [
+          "noauto"
+          "sec=krb5,credentials=${config.sops.secrets."smb-credentials".path}"
+        ];
+      };
+    }) inputs.secrets.lab.nas.backupShares
+  );
+}

hosts/vm-test/configuration.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-test";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+}

hosts/vm-vpn/configuration.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-vpn";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Setup wstunnel server
+  services.wstunnel = {
+    enable = true;
+    servers.wg-tunnel = {
+      enableHTTPS = false;
+      listen = {
+        host = "0.0.0.0";
+        port = 8080;
+      };
+      restrictTo = [
+        {
+          host = "10.10.40.100";
+          port = 51820;
+        }
+      ];
+    };
+  };
+  networking.firewall = {
+    allowedTCPPorts = [ 8080 ];
+  };
+}

hosts/ws-think/configuration.nix

@@ -0,0 +1,176 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.05";
+
+  # Machine hostname
+  networking.hostName = "ws-think";
+
+  # Set up users
+  sops.secrets."passwords/jan-hashed" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    neededForUsers = true;
+  };
+  users.mutableUsers = false;
+  users.users.Jan = {
+    hashedPasswordFile = config.sops.secrets."passwords/jan-hashed".path;
+    # Extra admin groups
+    # TODO: Streamline setup of this
+    extraGroups = [
+      "wheel"
+      "wireshark"
+      "podman"
+      "libvirtd"
+    ];
+  };
+
+  # Set up impermanence
+  modules.impermanence = {
+    enable = true;
+    resetScript = ''
+      # Revert to the blank state for the root directory
+      zfs rollback -r tank/root@blank
+    '';
+  };
+
+  # Set up kerberos
+  security.krb5 = {
+    enable = true;
+    settings = {
+      libdefaults = {
+        rdns = false;
+      };
+      realms = (inputs.secrets.gewis.krb5Realm);
+    };
+  };
+
+  services.netbird = {
+    enable = true;
+  };
+
+  # SSH X11 forwarding
+  programs.ssh.forwardX11 = true;
+
+  # Enable older samba versions
+  services.samba = {
+    enable = true;
+    settings = {
+      global = {
+        "invalid users" = [ "root" ];
+        "passwd program" = "/run/wrappers/bin/passwd %u";
+        "security" = "user";
+        "client min protocol" = "NT1";
+      };
+    };
+  };
+
+  # TODO: Remove once laptop is properly integrated into domain
+  programs.ssh = {
+    package = pkgs.openssh_gssapi;
+    extraConfig = ''
+      GSSAPIAuthentication yes
+    '';
+  };
+
+  # Enable virtualisation for VMs
+  virtualisation.libvirtd.enable = true;
+  programs.virt-manager.enable = true;
+
+  # Enable wireshark
+  programs.wireshark = {
+    enable = true;
+    dumpcap.enable = true;
+    usbmon.enable = true;
+  };
+
+  # Enable Nix-LD
+  programs.nix-ld = {
+    enable = true;
+  };
+
+  # Set up wstunnel client
+  services.wstunnel = {
+    enable = true;
+    clients.wg-tunnel = {
+      connectTo = "wss://tunnel.bulthuis.dev:443";
+      settings.local-to-remote = [
+        "udp://51819:10.10.40.100:51820"
+      ];
+    };
+  };
+
+  # Enable flatpak
+  services.flatpak.enable = true;
+
+  # Module setup
+  modules = {
+    profiles.laptop.enable = true;
+  };
+
+  # Set up podman
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    autoPrune.enable = true;
+  };
+
+  # Enable Gnome Remote Desktop
+  services.gnome.gnome-remote-desktop.enable = true;
+  systemd.services."gnome-remote-desktop".wantedBy = [ "graphical.target" ];
+  systemd.services."gnome-remote-desktop".preStart =
+    let
+      credDir = "/var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop";
+      credPath = "${credDir}/credentials.ini";
+      credFile = pkgs.writeText "gnome-remote-desktop-credentials" ''
+        [RDP]
+        credentials={'username': <'remote'>, 'password': <'remote'>}
+      '';
+      script = pkgs.writeScript "gnome-remote-desktop-setup" ''
+        mkdir -p ${credDir}
+        touch ${credPath}
+        chown gnome-remote-desktop:gnome-remote-desktop ${credPath}
+        chmod 600 ${credPath}
+        cat ${credFile} > ${credPath}
+      '';
+    in
+    "${script}";
+  environment.etc."gnome-remote-desktop/grd.conf" = {
+    text = ''
+      [RDP]
+      port=3389
+      tls-key=/run/secrets/gnome-remote-desktop/tls-key
+      tls-cert=/run/secrets/gnome-remote-desktop/tls-crt
+      enabled=true
+    '';
+  };
+  networking.firewall = {
+    allowedTCPPorts = [
+      3389
+      3390
+    ];
+    allowedUDPPorts = [
+      3389
+      3390
+    ];
+  };
+  sops.secrets."gnome-remote-desktop/tls-key" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    owner = config.users.users.gnome-remote-desktop.name;
+    group = config.users.users.gnome-remote-desktop.group;
+  };
+  sops.secrets."gnome-remote-desktop/tls-crt" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    owner = config.users.users.gnome-remote-desktop.name;
+    group = config.users.users.gnome-remote-desktop.group;
+  };
+
+  # Set up hardware
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/ws-think/hardware-configuration.nix

@@ -0,0 +1,65 @@
+{ ... }:
+
+{
+  # Machine platform
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  # Set hostid (required for ZFS)
+  networking.hostId = "deadbeef";
+
+  # Use thermald
+  services.thermald.ignoreCpuidCheck = true;
+
+  # Hardware configuration
+  hardware.enableRedistributableFirmware = true;
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.zfs.forceImportRoot = false;
+  hardware.cpu.intel.updateMicrocode = true;
+
+  # Filesystems
+  fileSystems = {
+    "/" = {
+      device = "tank/root";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/nix" = {
+      device = "tank/nix";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/persist" = {
+      device = "tank/persist";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/46BF-DE2C";
+      fsType = "vfat";
+      options = [
+        "fmask=0077"
+        "dmask=0077"
+      ];
+    };
+  };
+
+  # Swap setup
+  swapDevices = [
+    {
+      device = "/dev/disk/by-uuid/9f6f2a47-e53a-45a0-8cb2-8c1082f54ccb";
+      discardPolicy = "both";
+    }
+  ];
+}

hosts/ws-think/users/Jan.nix

@@ -0,0 +1,52 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  home.stateVersion = "25.11";
+
+  modules.profiles.jan.enable = true;
+
+  # home.packages = with pkgs; [
+  #   opencloud-desktop
+  #   code-nautilus
+  #   nautilus-open-in-blackbox
+  # ];
+
+  xdg.desktopEntries = {
+    canvas = {
+      name = "Canvas";
+      type = "Application";
+      exec = "${pkgs.chromium}/bin/chromium --app=\"https://canvas.tue.nl\" --user-data-dir=/home/jan/.local/state/Canvas";
+      settings.StartupWMClass = "chrome-canvas.tue.nl__-Default";
+    };
+    overleaf = {
+      name = "Overleaf";
+      type = "Application";
+      exec = "${pkgs.chromium}/bin/chromium --app=\"https://www.overleaf.com\" --user-data-dir=/home/jan/.local/state/Overleaf";
+      settings.StartupWMClass = "chrome-www.overleaf.com__-Default";
+    };
+  };
+
+  # TODO: Slowly remove
+  modules.impermanence = {
+    directories = [
+      ".cache"
+      ".config"
+      ".cargo"
+      ".dbus"
+      ".gnupg"
+      ".local"
+      ".MathWorks"
+      ".mozilla"
+      ".ssh"
+      ".steam"
+      ".SteamCloud"
+      ".thunderbird"
+      ".vscode"
+      ".wine"
+      ".Wolfram"
+    ];
+  };
+}

machines/laptop.nix

@@ -1,63 +0,0 @@
-{ lib, ... }:
-
-{
-  imports = [
-    # Import environment
-    ../default.nix
-  ];
-
-  config = {
-    # State version
-    system.stateVersion = "24.05";
-
-    # Machine hostname
-    networking.hostName = "20212060";
-
-    # Enabled modules
-    modules = {
-      base.desktop.enable = true;
-      bluetooth.enable = true;
-      power-saving.enable = false;
-      networkmanager.enable = true;
-      grdp.enable = true;
-      printing.enable = true;
-    };
-
-    # Hardware configuration
-    hardware.enableRedistributableFirmware = true;
-    boot.initrd.availableKernelModules = [
-      "xhci_pci"
-      "nvme"
-      "usb_storage"
-      "sd_mod"
-      "rtsx_pci_sdmmc"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ "kvm-intel" ];
-    boot.extraModulePackages = [ ];
-    hardware.cpu.intel.updateMicrocode = true;
-
-    # Filesystems
-    fileSystems."/" = {
-      device = "/dev/disk/by-uuid/3b91eaeb-ea95-4bea-8dc1-f55af7502d23";
-      fsType = "ext4";
-    };
-
-    fileSystems."/boot" = {
-      device = "/dev/disk/by-uuid/46BF-DE2C";
-      fsType = "vfat";
-      options = [
-        "fmask=0077"
-        "dmask=0077"
-      ];
-    };
-
-    # Swapfile
-    swapDevices = [
-      {
-        device = "/var/lib/swapfile";
-        size = 16 * 1024;
-      }
-    ];
-  };
-}

machines/vm-audio.nix

@@ -1,216 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-
-{
-  imports = [
-    # Import environment
-    ./vm-base.nix
-  ];
-
-  config = {
-    # Machine hostname
-    networking.hostName = "vm-audio";
-
-    # Enabled modules
-    modules = {
-      pipewire.enable = true;
-      spotifyd.enable = true;
-    };
-
-    # Install system packages
-    environment.systemPackages = with pkgs; [
-      carla
-      xpra
-      alsa-utils
-      pulsemixer
-      adwaita-icon-theme
-      open-stage-control
-      carla_osc_bridge
-
-      # Add LV2 plugins
-      lsp-plugins
-      airwindows-lv2
-      distrho-ports
-      cardinal
-      calf
-    ];
-
-    # Setup firewall
-    networking.firewall = {
-      allowedTCPPorts = [
-        8080
-        15151
-        22752
-      ];
-      allowedUDPPorts = [
-        8080
-        15151
-        22752
-      ];
-    };
-
-    # Setup dependencies
-    environment.variables.LD_LIBRARY_PATH = lib.mkForce "${lib.makeLibraryPath (
-      with pkgs;
-      [
-        cairo
-        pipewire.jack
-      ]
-    )}";
-    qt = {
-      enable = true;
-      style = "adwaita";
-    };
-    xdg.icons = {
-      enable = true;
-      fallbackCursorThemes = [ "Adwaita" ];
-    };
-
-    # User for audio mixing
-    users.users.mixer = {
-      isNormalUser = true;
-      group = "mixer";
-      extraGroups = [ "systemd-journal" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq jan@bulthuis.dev"
-      ];
-    };
-    users.groups.mixer = { };
-    users.groups.audio = {
-      members = [
-        "mixer"
-      ];
-    };
-
-    # Xpra service
-    systemd.user.services.xpra = {
-      description = "Xpra Service";
-      wantedBy = [ "default.target" ];
-      after = [
-        "network.target"
-      ];
-      unitConfig = {
-        ConditionUser = "mixer";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.xpra}/bin/xpra start :7 --bind-tcp=0.0.0.0:15151 --daemon=no";
-        Restart = "always";
-        RestartSec = 5;
-      };
-    };
-
-    # Carla service
-    systemd.user.services.carla = {
-      description = "Carla Service";
-      wantedBy = [ "default.target" ];
-      after = [
-        "network.target"
-        "sound.target"
-      ];
-      requires = [
-        "xpra.service"
-      ];
-      unitConfig = {
-        ConditionUser = "mixer";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.carla}/bin/carla -platform xcb /home/mixer/Default.carxp";
-        Environment = "\"DISPLAY=:7\"";
-        Restart = "always";
-        RestartSec = 5;
-      };
-    };
-
-    # Carla service
-    systemd.user.services.carla-bridge = {
-      description = "Carla OSC Bridge";
-      wantedBy = [ "default.target" ];
-      after = [
-        "network.target"
-        "sound.target"
-      ];
-      requires = [
-        "carla.service"
-      ];
-      unitConfig = {
-        ConditionUser = "mixer";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.carla_osc_bridge}/bin/carla_osc_bridge --clients \"127.0.0.1:8080\"";
-        Restart = "always";
-        RestartSec = 5;
-      };
-    };
-
-    # Open stage control service
-    systemd.user.services.osc = {
-      description = "OSC Service";
-      wantedBy = [ "default.target" ];
-      after = [
-        "network.target"
-      ];
-      requires = [
-        "carla.service"
-      ];
-      unitConfig = {
-        ConditionUser = "mixer";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.open-stage-control}/bin/open-stage-control --no-gui --send 127.0.0.1:10402 --load /home/mixer/open-stage-control/session.json --theme /home/mixer/open-stage-control/theme.css";
-        Environment = "\"ELECTRON_RUN_AS_NODE=1\"";
-        Restart = "always";
-        RestartSec = 5;
-      };
-    };
-
-    # Create null sinks
-    services.pipewire.extraConfig.pipewire."91-null-sinks" = {
-      "context.objects" = [
-        {
-          factory = "adapter";
-          args = {
-            "factory.name" = "support.null-audio-sink";
-            "node.name" = "Speaker-Proxy";
-            "node.description" = "Proxy for Speaker Output";
-            "media.class" = "Audio/Sink";
-            "audio.position" = "L,R";
-          };
-        }
-        {
-          factory = "adapter";
-          args = {
-            "factory.name" = "support.null-audio-sink";
-            "node.name" = "Headphone-Proxy";
-            "node.description" = "Proxy for Headphone Output";
-            "media.class" = "Audio/Sink";
-            "audio.position" = "L,R";
-          };
-        }
-        {
-          factory = "adapter";
-          args = {
-            "factory.name" = "support.null-audio-sink";
-            "node.name" = "SpotifyD-Proxy";
-            "node.description" = "Proxy for SpotifyD";
-            "media.class" = "Audio/Sink";
-            "audio.position" = "L,R";
-          };
-        }
-        {
-          factory = "adapter";
-          args = {
-            "factory.name" = "support.null-audio-sink";
-            "node.name" = "AnalogIn-Proxy";
-            "node.description" = "Proxy for the analog input";
-            "media.class" = "Audio/Source/Virtual";
-            "audio.position" = "L,R";
-          };
-        }
-      ];
-    };
-  };
-}

machines/vm-base.nix

@@ -1,63 +0,0 @@
-{ lib, ... }:
-
-{
-  imports = [
-    # Import environment
-    ../default.nix
-  ];
-
-  config = {
-    # State version
-    system.stateVersion = "24.11";
-
-    # Machine hostname
-    networking.hostName = lib.mkDefault "vm-base";
-
-    # Enabled modules
-    modules = {
-      base.enable = true;
-      ssh.enable = true;
-    };
-
-    # Enable qemu guest agent
-    services.qemuGuest.enable = true;
-
-    # Hardware configuration
-    hardware.enableRedistributableFirmware = true;
-    boot.initrd.availableKernelModules = [
-      "ata_piix"
-      "uhci_hcd"
-      "virtio_pci"
-      "virtio_scsi"
-      "sd_mod"
-      "sr_mod"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ "kvm-intel" ];
-    boot.extraModulePackages = [ ];
-    hardware.cpu.intel.updateMicrocode = true;
-
-    # Filesystems
-    fileSystems."/" = {
-      device = "/dev/disk/by-partlabel/root";
-      fsType = "ext4";
-    };
-
-    fileSystems."/boot" = {
-      device = "/dev/disk/by-partlabel/EFI";
-      fsType = "vfat";
-      options = [
-        "fmask=0077"
-        "dmask=0077"
-      ];
-    };
-
-    # Swapfile
-    swapDevices = [
-      {
-        device = "/var/lib/swapfile";
-        size = 6 * 1024;
-      }
-    ];
-  };
-}

modules/base/default.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.base;
-in
-{
-  options.modules.base = {
-    enable = mkEnableOption "base";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      # Add base linux utilities
-      git
-      wget
-      curl
-      dig
-      procps
-      wireguard-tools
-      usbutils
-      pciutils
-      zip
-      unzip
-    ];
-
-    modules = {
-      # Enable base modules
-      clean-tmp.enable = true;
-      neovim.enable = true;
-      systemd-boot.enable = true;
-    };
-
-    # TODO: Remove everything below, it is here out of convenience and should be elsewhere
-    # networking.nameservers = [
-    #   "9.9.9.9"
-    #   "149.112.112.112"
-    # ];
-    # programs.captive-browser.enable = true;
-    services.resolved = {
-      enable = true;
-    };
-    networking.firewall.enable = true;
-    modules.unfree.enable = true;
-    nix.settings.experimental-features = "nix-command flakes";
-    nixpkgs.hostPlatform = "x86_64-linux";
-
-    console.packages = [
-      pkgs.dina-psfu
-    ];
-    console.font = "dina";
-    console.earlySetup = true;
-    boot.loader.timeout = 0;
-  };
-}

modules/base/desktop.nix

@@ -1,92 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.base.desktop;
-in
-{
-  options.modules.base.desktop = {
-    enable = mkEnableOption "desktop";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      # TODO: MOVE
-      quickemu # TODO: Reenable once building this is fixed
-      pdftk
-
-      # TODO: Move to USB module
-      # usbutils
-      # udiskie
-      # udisks
-      brightnessctl
-
-      wireshark
-    ];
-
-    # Move to Realm module
-    security.krb5 = {
-      enable = true;
-      settings = {
-        libdefaults = {
-          rdns = false;
-        };
-        realms = {
-          "GEWISWG.GEWIS.NL" = {
-            kdc = [
-              "https://gewisvdesktop.gewis.nl/KdcProxy"
-            ];
-          };
-        };
-      };
-    };
-
-    modules = {
-      # Enable base modules
-      base.enable = true;
-      fontconfig.enable = true;
-      nixgreety.enable = true;
-      pipewire.enable = true;
-      graphics.enable = true;
-    };
-
-    programs.dconf.enable = true;
-    services.libinput.enable = true;
-    networking.firewall = {
-      enable = mkForce false;
-      logRefusedConnections = true;
-      logRefusedPackets = true;
-      logReversePathDrops = true;
-      logRefusedUnicastsOnly = false;
-    };
-    programs.wireshark.enable = true;
-    machine.sudo-groups = [ "wireshark" ];
-    services.upower.enable = true; # For battery percentage in gnome
-    modules.unfree.allowedPackages = [
-      "nvidia-x11"
-      "nvidia-settings"
-    ];
-    networking.firewall.allowedTCPPortRanges = [
-      {
-        from = 10000;
-        to = 11000;
-      }
-    ];
-    networking.firewall.allowedUDPPortRanges = [
-      {
-        from = 10000;
-        to = 11000;
-      }
-    ];
-    security.rtkit.enable = true;
-
-    # TODO: Move to USB module
-    # services.gvfs.enable = true;
-    services.udisks2.enable = true;
-  };
-}

modules/bluetooth/default.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.bluetooth;
-in
-{
-  options.modules.bluetooth = {
-    enable = mkEnableOption "bluetooth";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [ bluez ];
-
-    hardware.bluetooth.enable = true;
-    hardware.bluetooth.powerOnBoot = true;
-  };
-}

modules/boot/clean-tmp.nix

@@ -1,18 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.clean-tmp;
-in
-{
-  options.modules.clean-tmp = {
-    enable = mkEnableOption "clean-tmp";
-  };
-
-  config = mkIf cfg.enable { boot.tmp.cleanOnBoot = true; };
-}

modules/boot/silent-boot.nix

@@ -1,37 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.silent-boot;
-in
-{
-  options.modules.silent-boot = {
-    enable = mkEnableOption "silent-boot";
-  };
-
-  config = mkIf cfg.enable {
-    boot = {
-      loader.timeout = 0;
-
-      consoleLogLevel = 0;
-      initrd.verbose = false;
-      initrd.checkJournalingFS = false;
-
-      kernelParams = [
-        "quiet"
-        "boot.shell_on_fail"
-        "loglevel=3"
-        "rd.systemd.show_status=false"
-        "rd.udev.log_level=3"
-        "udev.log_priority=3"
-        "video=efifb:nobgrt"
-        "bgrt_disable"
-      ];
-    };
-  };
-}

modules/boot/systemd-boot.nix

@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.systemd-boot;
-in
-{
-  options.modules.systemd-boot = {
-    enable = mkEnableOption "systemd-boot";
-  };
-
-  config = mkIf cfg.enable {
-    boot.loader = {
-      systemd-boot.enable = true;
-      systemd-boot.editor = false;
-      efi.canTouchEfiVariables = true;
-    };
-  };
-}

modules/brightnessctl/default.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.brightnessctl;
-in
-{
-  options.modules.brightnessctl = {
-    enable = mkEnableOption "brightnessctl";
-  };
-
-  config = mkIf cfg.enable { environment.systemPackages = [ pkgs.brightnessctl ]; };
-}

modules/default.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-{
-  imports = [
-    # Import modules
-    ./base/default.nix
-    ./base/desktop.nix
-    ./bluetooth/default.nix
-    ./boot/clean-tmp.nix
-    ./boot/silent-boot.nix
-    ./boot/systemd-boot.nix
-    ./brightnessctl/default.nix
-    ./fontconfig/default.nix
-    ./graphics/default.nix
-    ./grdp/default.nix
-    ./greeter/greetd/default.nix
-    ./greeter/greetd/nixgreety.nix
-    ./greeter/greetd/tuigreet.nix
-    ./greeter/ly/default.nix
-    ./locale/default.nix
-    ./neovim/default.nix
-    ./networkmanager/default.nix
-    ./power-saving/default.nix
-    ./printing/default.nix
-    ./sound/pipewire.nix
-    ./spotifyd/default.nix
-    ./ssh/default.nix
-    ./users/default.nix
-    ./unfree/default.nix
-    ./vpn/tailscale.nix
-    ./wifi/wpa_supplicant.nix
-  ];
-}

modules/fontconfig/default.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.fontconfig;
-in
-{
-  options.modules.fontconfig = {
-    enable = mkEnableOption "fontconfig";
-  };
-
-  config = {
-    fonts.fontconfig.enable = cfg.enable;
-    fonts.enableDefaultPackages = false;
-    fonts.fontconfig.defaultFonts = {
-      serif = mkDefault [ ];
-      sansSerif = mkDefault [ ];
-      monospace = mkDefault [ ];
-      emoji = mkDefault [ ];
-    };
-  };
-}

modules/graphics/default.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.fontconfig;
-in
-{
-  options.modules.graphics = {
-    enable = mkEnableOption "graphics";
-  };
-  config = mkIf cfg.enable {
-    # TODO: Modularize further, especially modesetting should be its own module.
-    # Set up graphics
-    hardware.graphics.enable32Bit = true;
-    hardware.graphics.enable = true;
-    services.xserver.videoDrivers = [ "nvidia" ];
-    hardware.nvidia = {
-      modesetting.enable = true;
-      powerManagement.enable = false;
-      powerManagement.finegrained = false;
-      open = false;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.beta;
-      prime = {
-        intelBusId = "PCI:0:2:0";
-        nvidiaBusId = "PCI:1:0:0";
-        offload = {
-          enable = true;
-          enableOffloadCmd = true;
-        };
-      };
-    };
-  };
-}

modules/grdp/default.nix

@@ -1,27 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-{
-  options.modules.grdp = {
-    enable = mkEnableOption "grdp";
-  };
-
-  config = mkIf config.modules.grdp.enable {
-    services.gnome.gnome-remote-desktop.enable = true;
-    systemd.services."gnome-remote-desktop".wantedBy = [ "graphical.target" ];
-    networking.firewall = {
-      allowedTCPPorts = [ 3389 ];
-      allowedUDPPorts = [ 3389 ];
-    };
-    # programs.dconf.profiles.user.databases = [
-    #   {
-    #     settings = with lib.gvariant; {
-    #       "org/gnome/desktop/remote-desktop/rdp" = {
-    #         enable = true;
-    #         view-only = false;
-    #       };
-    #     };
-    #   }
-    # ];
-  };
-}

modules/greeter/greetd/default.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.greetd;
-in
-{
-  options.modules.greetd = {
-    enable = mkEnableOption "greetd";
-    command = mkOption {
-      type = types.str;
-      default = "";
-      description = "Command to run to show greeter.";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.greetd = {
-      enable = true;
-      settings.default_session = {
-        command = cfg.command;
-        user = mkDefault "greeter";
-      };
-    };
-  };
-}

modules/greeter/greetd/nixgreety.nix

@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.nixgreety;
-in
-{
-  options.modules.nixgreety = {
-    enable = mkEnableOption "nixgreety";
-  };
-
-  config = mkIf cfg.enable {
-    # Enable greetd
-    modules.greetd = {
-      enable = true;
-      command = "${pkgs.nixgreety}/bin/nixgreety";
-    };
-
-    services.greetd.settings.default_session.user = "root";
-
-    environment.systemPackages = with pkgs; [
-      nixgreety
-    ];
-  };
-}

modules/greeter/greetd/tuigreet.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.tuigreet;
-in
-{
-  options.modules.tuigreet = {
-    enable = mkEnableOption "tuigreet";
-    greeting = mkOption {
-      type = types.str;
-      default = "Hewwo! >_< :3";
-      description = "Greeting message to show.";
-    };
-    command = mkOption {
-      type = types.str;
-      default = "~/.initrc";
-      description = "Command to run after logging in.";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # Enable greetd
-    modules.greetd = {
-      enable = true;
-      command = "${pkgs.greetd.tuigreet}/bin/tuigreet --remember --greeting \"${cfg.greeting}\" --time --cmd \"${cfg.command}\" --asterisks";
-    };
-
-    # Enable silent boot to prevent late log messages from messing up tuigreet
-    modules.silent-boot.enable = true;
-  };
-}

modules/greeter/ly/default.nix

@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.ly;
-in
-{
-  options.modules.ly = {
-    enable = mkEnableOption "ly";
-  };
-
-  config = mkIf cfg.enable {
-    services.displayManager.ly = {
-      enable = true;
-      settings = {
-        animation = "matrix";
-        animation_refresh_ms = 32;
-        box_title = "Hewwo! >_< :3";
-        clear_password = true;
-        load = true;
-        save = true;
-        xinitrc = "null";
-      };
-    };
-  };
-}

modules/home/desktop/gnome.nix

@@ -0,0 +1,101 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.desktop.gnome;
+in
+{
+  options.modules.desktop.gnome = {
+    enable = mkEnableOption "gnome";
+  };
+
+  config = mkIf cfg.enable {
+    # TODO: Enable extensions (declaratively) with dconf
+
+    home.pointerCursor = {
+      enable = true;
+      name = "capitaine-cursors";
+      size = 24;
+      package = pkgs.capitaine-cursors;
+      gtk.enable = true;
+    };
+
+    home.packages =
+      with pkgs;
+      [
+        gnome-session
+        gnome-shell
+        gnome-tweaks
+        gnome-calculator
+        snapshot
+        gnome-characters
+        gnome-connections
+        blackbox-terminal
+        baobab
+        gnome-disk-utility
+        papers
+        nautilus
+        gnome-font-viewer
+        loupe
+        gnome-maps
+        gnome-music
+        gnome-control-center
+        gnome-text-editor
+        showtime
+        file-roller
+        mission-center
+        dconf-editor
+        gnome-calendar
+        gnome-backgrounds
+        gnome-bluetooth
+        gnome-color-manager
+        epiphany
+
+        # For theming gtk3
+        # adw-gtk3 # TODO: Do this better, same for morewaita, not sure if it even works
+
+        # More icons
+        # morewaita-icon-theme
+      ]
+      ++ (with pkgs.gnomeExtensions; [
+        gsconnect
+        disable-workspace-animation
+        wallpaper-slideshow
+        media-progress
+        mpris-label
+        pip-on-top
+        rounded-window-corners-reborn
+        caffeine
+      ]);
+
+    # Set up gnome terminal as changing the default terminal is a pain
+    programs.gnome-terminal = {
+      enable = true;
+      profile."12d2da79-b36c-43d5-8e1f-cf70907b84b3" = {
+        visibleName = "Default";
+        default = true;
+      };
+    };
+
+    # Enable and set the gtk themes
+    # gtk = {
+    #   enable = true;
+    #   gtk3.extraConfig = {
+    #     gtk-theme-name = "adw-gtk3";
+    #   };
+    #   gtk4.extraConfig = {
+    #     gtk-theme-name = "Adwaita";
+    #   };
+    # };
+
+    # Set the theme with dconf
+    # dconf.settings."org/gnome/desktop/interface" = {
+    #   gtk-theme = "adw-gtk3";
+    # };
+  };
+}

modules/home/development/git.nix

@@ -39,15 +39,15 @@ in
     programs.git = {
       enable = true;
 
-      extraConfig = {
+      settings = {
         pull = {
           rebase = false;
         };
       };
 
-      userName = cfg.user;
+      settings.user.name = cfg.user;
-      userEmail = cfg.email;
+      settings.user.email = cfg.email;
-      ignores = cfg.ignores;
+      # ignores = cfg.ignores;
     };
   };
 }

modules/home/development/languages/cpp.nix

@@ -15,11 +15,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    # Allow unfree
-    modules.unfree.allowedPackages = [
-      "vscode-extension-ms-vscode-cpptools"
-    ];
-
     # Gitignore additions
     modules.git.ignores = [
       ".ccls-cache"
@@ -48,8 +43,8 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = {
+    # programs.nixvim = {
-      plugins.lsp.servers.ccls.enable = true;
+    #   plugins.lsp.servers.ccls.enable = true;
-    };
+    # };
   };
 }

modules/home/development/languages/go.nix

@@ -7,29 +7,24 @@
 
 with lib;
 let
-  cfg = config.modules.docker;
+  cfg = config.modules.go;
 in
 {
-  options.modules.docker = {
+  options.modules.go = {
-    enable = mkEnableOption "docker";
+    enable = mkEnableOption "go";
   };
 
   config = mkIf cfg.enable {
     # Development packages
     home.packages = with pkgs; [
-      docker
-      docker-compose
-    ];
-
-    # Allow unfree
-    modules.unfree.allowedPackages = [
     ];
 
     # VSCode configuration
     programs.vscode = {
       profiles.default = {
         extensions = with pkgs.vscode-extensions; [
-          ms-azuretools.vscode-docker
+          golang.go
+
         ];
 
         userSettings = {
@@ -38,6 +33,10 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = { };
+    # programs.nixvim = {
+    #   plugins.rustaceanvim = {
+    #     enable = true;
+    #   };
+    # };
   };
 }

modules/home/development/languages/haskell.nix

@@ -37,6 +37,6 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = { };
+    # programs.nixvim = { };
   };
 }

modules/home/development/languages/js.nix

@@ -33,6 +33,6 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = { };
+    # programs.nixvim = { };
   };
 }

modules/home/development/languages/jupyter.nix

@@ -39,6 +39,6 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = { };
+    # programs.nixvim = { };
   };
 }

modules/home/development/languages/nix.nix

@@ -18,7 +18,7 @@ in
     # Development packages
     home.packages = with pkgs; [
       nix-tree
-      nixfmt-rfc-style
+      nixfmt
       nixd
     ];
 
@@ -53,8 +53,8 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = {
+    # programs.nixvim = {
 
-    };
+    # };
   };
 }

modules/home/development/languages/python.nix

@@ -27,11 +27,6 @@ in
     # Development packages
     home.packages = [ ];
 
-    # Allow unfree
-    modules.unfree.allowedPackages = [
-      "vscode-extension-MS-python-vscode-pylance"
-    ];
-
     # VSCode configuration
     programs.vscode = {
       profiles.default = {
@@ -52,6 +47,6 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = { };
+    # programs.nixvim = { };
   };
 }

modules/home/development/languages/rust.nix

@@ -50,10 +50,10 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = {
+    # programs.nixvim = {
-      plugins.rustaceanvim = {
+    #   plugins.rustaceanvim = {
-        enable = true;
+    #     enable = true;
-      };
+    #   };
-    };
+    # };
   };
 }

modules/home/development/languages/tex.nix

@@ -39,31 +39,31 @@ in
     };
 
     # Neovim configuration
-    programs.nixvim = {
+    # programs.nixvim = {
-      extraConfigVim = ''
+    #   extraConfigVim = ''
-        " Enforce latexmk
+    #     " Enforce latexmk
-        let g:vimtex_compiler_method = 'latexmk'
+    #     let g:vimtex_compiler_method = 'latexmk'
 
-        " Set latexmk compilation settings
+    #     " Set latexmk compilation settings
-        let g:vimtex_compiler_latexmk = {
+    #     let g:vimtex_compiler_latexmk = {
-          \ 'options': [
+    #       \ 'options': [
-          \   '-shell-escape',
+    #       \   '-shell-escape',
-          \   '-verbose',
+    #       \   '-verbose',
-          \   '-file-line-error',
+    #       \   '-file-line-error',
-          \   '-synctex=1',
+    #       \   '-synctex=1',
-          \   '-interaction=nonstopmode',
+    #       \   '-interaction=nonstopmode',
-          \ ],
+    #       \ ],
-          \}
+    #       \}
-      '';
+    #   '';
 
-      # Vimtex plugin
+    #   # Vimtex plugin
-      plugins.vimtex = {
+    #   plugins.vimtex = {
-        enable = true;
+    #     enable = true;
-        texlivePackage = null;
+    #     texlivePackage = null;
-        settings = {
+    #     settings = {
-          view_method = "zathura";
+    #       view_method = "zathura";
-        };
+    #     };
-      };
+    #   };
-    };
+    # };
   };
 }

modules/home/development/mathematica.nix

@@ -9,10 +9,11 @@ with lib;
 let
   cfg = config.modules.mathematica;
 
-  my-mathematica = pkgs.mathematica.override {
+  my-mathematica = pkgs.mathematica.overrideAttrs (old: {
+    force-rebuild = "1";
     # TODO: Just use a generic name for the installer?
-    source = ./Wolfram_14.1.0_LIN_Bndl.sh;
+    # source = ./Wolfram_14.2.1_LIN_Bndl.sh;
-  };
+  });
 in
 {
   options.modules.mathematica = {
@@ -20,11 +21,8 @@ in
   };
 
   config = mkIf cfg.enable {
-    modules.unfree.allowedPackages = [
-      "mathematica"
-    ];
-
     home.packages = [
+      # pkgs.mathematica-cuda
       my-mathematica
     ];
   };

modules/home/development/neovim.nix

@@ -0,0 +1,190 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.neovim;
+  # theme = config.desktop.theming;
+  # colors = theme.colors;
+in
+{
+  options.modules.neovim = {
+    enable = mkEnableOption "neovim";
+  };
+
+  config = mkIf cfg.enable {
+    # programs.nixvim = {
+    #   enable = true;
+    #   defaultEditor = true;
+    #   viAlias = true;
+    #   vimAlias = true;
+
+    #   # extraPackages = with pkgs; [ ];
+
+    #   opts = {
+    #     number = true;
+    #     relativenumber = true;
+
+    #     signcolumn = "yes";
+
+    #     ignorecase = true;
+    #     smartcase = true;
+
+    #     tabstop = 4;
+    #     shiftwidth = 4;
+    #     softtabstop = 0;
+    #     expandtab = true;
+    #     smarttab = true;
+
+    #     list = true;
+    #     listchars = "tab:»┈«,trail:·,extends:→,precedes:←,nbsp:␣";
+    #   };
+
+    #   diagnostic.settings = {
+    #     enable = true;
+    #     signs = true;
+    #     underline = true;
+    #     update_in_insert = true;
+    #   };
+
+    #   extraConfigLua = ''
+    #     vim.fn.sign_define("DiagnosticSignError",
+    #       {text = "", texthl = "DiagnosticSignError"})
+    #     vim.fn.sign_define("DiagnosticSignWarn",
+    #       {text = "", texthl = "DiagnosticSignWarn"})
+    #     vim.fn.sign_define("DiagnosticSignInfo",
+    #       {text = "", texthl = "DiagnosticSignInfo"})
+    #     vim.fn.sign_define("DiagnosticSignHint",
+    #       {text = "💡", texthl = "DiagnosticSignHint"})
+    #   '';
+
+    #   keymaps = [
+    #     # Save shortcut
+    #     {
+    #       action = ":update<CR>";
+    #       key = "<C-s>";
+    #       mode = "n";
+    #     }
+    #     {
+    #       action = "<C-o>:update<CR>";
+    #       key = "<C-s>";
+    #       mode = "i";
+    #     }
+
+    #     # Neo tree
+    #     {
+    #       action = ":Neotree action=focus reveal toggle<CR>";
+    #       key = "<leader>n";
+    #       mode = "n";
+    #       options.silent = true;
+    #     }
+    #   ];
+
+    #   autoCmd = [
+    #     {
+    #       desc = "Automatic formatting";
+    #       event = "BufWritePre";
+    #       callback = {
+    #         __raw = ''
+    #           function()
+    #             vim.lsp.buf.format {
+    #               async = false,
+    #             }
+    #           end
+    #         '';
+    #       };
+    #     }
+    #   ];
+
+    #   # highlight = {
+    #   #   Comment = {
+    #   #     italic = true;
+    #   #     fg = theme.schemeColors.withHashtag.base03; # TODO: Come up with a good name colors.muted maybe?
+    #   #   };
+    #   # };
+
+    #   plugins.lsp = {
+    #     enable = true;
+    #   };
+
+    #   #plugins.treesitter = {
+    #   #  enable = true;
+    #   #};
+
+    #   plugins.cmp = {
+    #     enable = true;
+
+    #     settings = {
+    #       mapping = {
+    #         "<C-Space>" = "cmp.mapping.complete()";
+    #         "<C-d>" = "cmp.mapping.scroll_docs(-4)";
+    #         "<C-e>" = "cmp.mapping.close()";
+    #         "<C-f>" = "cmp.mapping.scroll_docs(4)";
+    #         "<CR>" = "cmp.mapping.confirm({ select = true })";
+    #         "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
+    #         "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
+    #       };
+    #       sources = [
+    #         { name = "path"; }
+    #         { name = "nvim_lsp"; }
+    #       ];
+    #     };
+    #   };
+
+    #   plugins.web-devicons = {
+    #     enable = true;
+    #   };
+
+    #   plugins.neo-tree = {
+    #     enable = true;
+
+    #     closeIfLastWindow = true;
+    #     window = {
+    #       width = 30;
+    #       autoExpandWidth = true;
+    #     };
+
+    #     extraOptions = {
+    #       default_component_configs.git_status.symbols = {
+    #         # Change type
+    #         added = "+";
+    #         deleted = "✕";
+    #         modified = "✦";
+    #         renamed = "→";
+
+    #         # Status type
+    #         untracked = "?";
+    #         ignored = "▫";
+    #         unstaged = "□";
+    #         staged = "■";
+    #         conflict = "‼";
+    #       };
+    #     };
+    #   };
+
+    #   #plugins.cmp-nvim-lsp.enable = true;
+
+    #   plugins.gitsigns = {
+    #     enable = true;
+    #     settings.current_line_blame = true;
+    #   };
+
+    #   #plugins.copilot-vim = {
+    #   #  enable = true;
+    #   #};
+
+    #   # plugins.vimtex = {
+    #   #   enable = true;
+    #   #   texlivePackage = null;
+    #   #   settings = {
+    #   #     view_method = "zathura";
+    #   #   };
+    #   # };
+    # };
+    # programs.neovim.defaultEditor = true;
+  };
+}

modules/home/development/vscode.nix

@@ -0,0 +1,100 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.vscode;
+  # theme = config.desktop.theming;
+in
+{
+  options.modules.vscode = {
+    enable = mkEnableOption "vscode";
+    # codeFont = mkOption {
+    #   type = types.anything;
+    #   default = theme.fonts.pkgs."Fira Code";
+    # };
+    # fallbackFont = mkOption {
+    #   type = types.anything;
+    #   default = theme.fonts.pkgs."Symbols Nerd Font Mono";
+    # };
+  };
+
+  config = mkIf cfg.enable {
+    # TODO: Fix theming
+    # desktop.theming.fonts.extraFonts = [ cfg.codeFont ];
+
+    programs.vscode = {
+      enable = true;
+
+      mutableExtensionsDir = false;
+      profiles.default = {
+        extensions = with pkgs.vscode-extensions; [
+          eamodio.gitlens
+          ms-vscode.hexeditor
+          mkhl.direnv
+          usernamehw.errorlens
+          gruntfuggly.todo-tree
+          github.copilot
+          github.copilot-chat
+          tomoki1207.pdf
+          ms-vsliveshare.vsliveshare
+          ms-vscode-remote.remote-ssh
+          myriad-dreamin.tinymist
+        ];
+
+        userSettings =
+          let
+            # font-family = mkForce "'${cfg.codeFont.name}', '${cfg.fallbackFont.name}'";
+            # TODO: Move the conversion factor to theme settings
+            # font-size = mkForce cfg.codeFont.recommendedSize; # Convert pt to px
+          in
+          {
+            # Font setup
+            # "editor.fontFamily" = font-family;
+            # "editor.inlayHints.fontFamily" = font-family;
+            # "editor.inlineSuggest.fontFamily" = font-family;
+            # "editor.fontSize" = font-size;
+            # "editor.fontLigatures" = true;
+            # "terminal.integrated.fontFamily" = font-family;
+            # "terminal.integrated.fontSize" = font-size;
+            # "chat.editor.fontFamily" = font-family; # TODO: Change this font to the standard UI font
+            # "chat.editor.fontSize" = font-size;
+            # "debug.console.fontFamily" = font-family;
+            # "debug.console.fontSize" = font-size;
+            # "scm.inputFontFamily" = font-family; # TODO: Change this font to the standard UI font
+            # "scm.inputFontSize" = font-size;
+            # "markdown.preview.fontFamily" = mkForce theme.fonts.sansSerif.name; # TODO: Change this font to the standard UI font
+            # "markdown.preview.fontSize" = mkForce theme.fonts.sansSerif.recommendedSize;
+
+            # Formatting
+            "editor.formatOnSave" = true;
+            "editor.tabSize" = 4;
+
+            # Layout
+            "window.menuBarVisibility" = "hidden";
+
+            # Git settings
+            "git.autofetch" = true;
+            "git.enableSmartCommit" = false;
+            "git.suggestSmartCommit" = false;
+
+            # Disable update notifications
+            "update.mode" = "none";
+
+            # Set themes
+            "window.autoDetectColorScheme" = true;
+
+            # TODO: Move to direnv module
+            # Ignore direnv folder
+            "files.exclude" = {
+              ".direnv" = true;
+            };
+          };
+      };
+    };
+  };
+}

modules/home/utilities/bash.nix

@@ -11,11 +11,17 @@ in
 {
   options.modules.bash = {
     enable = mkEnableOption "bash";
+    aliases = mkOption {
+      type = types.attrsOf types.str;
+      default = {
+        "..." = "cd ../..";
+      };
+      description = "Shell aliases";
+    };
   };
 
   config.programs.bash = {
     enable = cfg.enable;
-
+    shellAliases = cfg.aliases;
-    shellAliases = config.modules.shell.aliases;
   };
 }

modules/home/utilities/bitwarden.nix

@@ -7,16 +7,16 @@
 
 with lib;
 let
-  cfg = config.modules.pcsx2;
+  cfg = config.modules.bitwarden;
 in
 {
-  options.modules.pcsx2 = {
+  options.modules.bitwarden = {
-    enable = mkEnableOption "pcsx2";
+    enable = mkEnableOption "Bitwarden";
   };
 
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
-      pcsx2
+      bitwarden-desktop
     ];
   };
 }

modules/home/utilities/direnv.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.direnv;
+in
+{
+  options.modules.direnv = {
+    enable = mkEnableOption "direnv";
+  };
+
+  config = mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+    modules.git.ignores = [
+      ".direnv"
+    ];
+  };
+}

modules/home/utilities/fish.nix

@@ -12,12 +12,6 @@ in
 {
   options.modules.fish = {
     enable = mkEnableOption "fish";
-
-    plugins = {
-      done = mkEnableOption "done";
-      fzf = mkEnableOption "fzf";
-      grc = mkEnableOption "grc";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -36,28 +30,31 @@ in
     programs.fish = {
       enable = true;
 
-      shellAliases = config.modules.shell.aliases;
+      shellAliases = config.modules.bash.aliases;
 
       plugins = [
-        (mkIf cfg.plugins.done {
+        {
           name = "done";
           src = pkgs.fishPlugins.done.src;
-        })
+        }
-        (mkIf cfg.plugins.fzf {
+        {
           name = "fzf";
           src = pkgs.fishPlugins.fzf-fish.src;
-        })
+        }
-        (mkIf cfg.plugins.grc {
+        {
           name = "grc";
           src = pkgs.fishPlugins.grc.src;
-        })
+        }
       ];
     };
 
     # Fish plugin dependencies
     home.packages = with pkgs; [
-      (mkIf cfg.plugins.fzf fzf)
+      fzf
-      (mkIf cfg.plugins.grc grc)
+      grc
     ];
+
+    # Impermanence
+    modules.impermanence.files = [ ".local/share/fish/fish_history" ];
   };
 }

modules/home/utilities/impermanence.nix

@@ -0,0 +1,34 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.impermanence;
+in
+{
+  options.modules.impermanence = {
+    enable = mkEnableOption "Impermanence";
+    directories = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Directories that should be stored in persistent storage.
+      '';
+    };
+    files = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Files that should be stored in persistent storage.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.persistence."/persist/home" = {
+      enable = true;
+      hideMounts = true;
+      directories = cfg.directories;
+      files = cfg.files;
+    };
+  };
+}

modules/home/utilities/secrets.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in .config/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "${config.home.homeDirectory}/.config/sops/sops_ed25519_key"
+      # "/persist/home/${config.home.username}/.config/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ ".config/sops" ];
+  };
+}

modules/locale/default.nix

@@ -1,14 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-{
-  config = {
-    time.timeZone = "Europe/Amsterdam";
-    i18n.defaultLocale = "en_US.UTF-8";
-    console.keyMap = "us";
-  };
-}

modules/neovim/default.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.neovim;
-in
-{
-  options.modules.neovim = {
-    enable = mkEnableOption "neovim";
-  };
-
-  config = mkIf cfg.enable {
-    programs.neovim = {
-      enable = true;
-      defaultEditor = true;
-    };
-  };
-}

modules/networkmanager/default.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.networkmanager;
-in
-{
-  options.modules.networkmanager = {
-    enable = mkEnableOption "networkmanager";
-  };
-
-  config = mkIf cfg.enable {
-    machine.sudo-groups = [ "networkmanager" ];
-    networking = {
-      networkmanager = {
-        enable = true;
-        wifi.powersave = true;
-      };
-      firewall = {
-        # Fix for wireguard
-        checkReversePath = false;
-      };
-    };
-  };
-}

modules/nixos/bluetooth.nix

@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.bluetooth;
+in
+{
+  options.modules.bluetooth = {
+    enable = mkEnableOption "bluetooth";
+  };
+  config = mkIf cfg.enable {
+    # Enable bluetooth
+    hardware.bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+    };
+  };
+}

modules/nixos/bootloader.nix

@@ -0,0 +1,23 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.bootloader;
+in
+{
+  options.modules.bootloader = {
+    enable = mkEnableOption "bootloader";
+  };
+  config = mkIf cfg.enable {
+    # Bootloader
+    boot.loader = {
+      timeout = 0;
+      systemd-boot.enable = true;
+      systemd-boot.editor = false;
+      efi.canTouchEfiVariables = true;
+    };
+
+    # Initrd
+    boot.initrd.systemd.enable = true;
+  };
+}

modules/nixos/disko.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.disko;
+  profile = import "${inputs.self}/profiles/disko/${cfg.profile}.nix";
+in
+{
+  options.modules.disko = {
+    enable = mkEnableOption "Disko module";
+    profile = mkOption {
+      type = types.str;
+      default = null;
+      description = "The profile to use for the disko module.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    disko.devices = profile.disko.devices;
+  };
+}

modules/nixos/domain.nix

@@ -0,0 +1,218 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.domain;
+  domain = inputs.secrets.lab.domain;
+  domainUpper = lib.strings.toUpper domain;
+in
+{
+  options.modules.domain = {
+    enable = mkEnableOption "Domain Integration";
+    join = {
+      userFile = mkOption {
+        type = types.str;
+        description = "File containing the user used to join the computer.";
+      };
+      passwordFile = mkOption {
+        type = types.str;
+        description = "File containing the password for the join user.";
+      };
+      domainOUFile = mkOption {
+        type = types.str;
+        description = "The OU to join the computer to.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set network domain
+    networking.domain = domain;
+    networking.search = [ domain ];
+
+    # Automatically join the domain
+    systemd.services.adcli-join = {
+      description = "Automatically join the domain";
+      wantedBy = [ "default.target" ];
+      before = [ "sssd.service" ];
+      requiredBy = [ "sssd.service" ];
+      after = [
+        "network-online.target"
+      ];
+      requires = [
+        "network-online.target"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        ADCLI_JOIN_USER=$(cat ${cfg.join.userFile})
+        ADCLI_JOIN_OU=$(cat ${cfg.join.domainOUFile})
+        ${pkgs.adcli}/bin/adcli join -D ${domain} \
+          -U $ADCLI_JOIN_USER \
+          -O $ADCLI_JOIN_OU \
+          --dont-expire-password=true \
+          --stdin-password < ${cfg.join.passwordFile}
+      '';
+    };
+
+    # Set up Kerberos
+    security.krb5 = {
+      enable = true;
+      settings = {
+        libdefaults = {
+          default_realm = domainUpper;
+        };
+        realms.${domainUpper} = {
+        };
+        domain_realm = {
+          "${domain}" = domainUpper;
+          ".${domain}" = domainUpper;
+        };
+      };
+    };
+
+    # Set up SSSD
+    services.sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        domains = ${domain}
+        config_file_version = 2
+        services = nss, pam
+
+        [nss]
+        filter_users = ${concatStringsSep "," (lib.attrNames config.users.users)}
+        filter_groups = ${concatStringsSep "," (lib.attrNames config.users.groups)}
+
+        [domain/${domain}]
+        enumerate = False
+        ad_domain = ${domain}
+        krb5_realm = ${domainUpper}H
+        id_provider = ad
+        auth_provider = ad
+        access_provider = ad
+        chpass_provider = ad
+        use_fully_qualified_names = False
+        ldap_schema = ad
+        ldap_id_mapping = True
+        ad_gpo_access_control = enforcing
+        ad_gpo_implicit_deny = True
+        dyndns_update = True
+        dyndns_update_ptr = False
+        dyndns_refresh_interval = 86400
+        dyndns_ttl = 3600
+      '';
+    };
+    security.pam.services.login.sssdStrictAccess = true;
+    security.pam.services.sshd.sssdStrictAccess = true;
+    security.pam.services.su.sssdStrictAccess = true;
+
+    # Set up Sudo
+    security.sudo =
+      let
+        admin_group = "host_${lib.replaceStrings [ "-" ] [ "_" ] config.networking.hostName}_admin";
+      in
+      {
+        extraConfig = ''
+          %${admin_group} ALL=(ALL) SETENV: ALL
+        '';
+      };
+
+    # Set up SSH
+    programs.ssh = {
+      package = pkgs.openssh_gssapi;
+      extraConfig = ''
+        GSSAPIAuthentication yes
+      '';
+    };
+    services.openssh = {
+      package = pkgs.openssh_gssapi;
+      settings = {
+        GSSAPIAuthentication = true;
+        GSSAPICleanupCredentials = true;
+        GSSAPIStrictAcceptorCheck = true;
+      };
+    };
+
+    # Set up home directory
+    security.pam.services.login.makeHomeDir = true;
+    security.pam.services.sshd.makeHomeDir = true;
+    security.pam.services.su.makeHomeDir = true;
+    environment.etc.profile.text =
+      let
+        # TODO: Activate configuration based on AD group
+        homeConfiguration = inputs.home-manager.lib.homeManagerConfiguration {
+          inherit pkgs;
+          modules = [
+            (
+              { lib, ... }:
+              {
+                home.stateVersion = "24.11";
+                home.username = "$USER";
+                home.homeDirectory = "/.$HOME";
+                modules.profiles.base.enable = true;
+
+                # Mount the directories from the network share
+                # home.activation.dirMount =
+                #   let
+                #     bindScript = dir: ''
+                #       mkdir -p /network/$USER/${dir}
+                #       mkdir -p $HOME/${dir}
+                #       ${pkgs.bindfs}/bin/bindfs /network/$USER/${dir} $HOME/${dir}
+                #     '';
+                #   in
+                #   lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+                #     if ! ${pkgs.krb5}/bin/klist -s; then
+                #       echo "No kerberos ticket found"
+                #       ${pkgs.krb5}/bin/kinit
+                #     fi
+
+                #     if ${pkgs.krb5}/bin/klist -s; then
+                #       echo "Kerberos ticket found, mounting home directory"
+                #       ${bindScript "Documents"}
+                #       ${bindScript "Music"}
+                #       ${bindScript "Pictures"}
+                #       ${bindScript "Video"}
+                #     else
+                #       echo "Still no kerberos ticket found, skipping home directory mount"
+                #     fi
+                #   '';
+              }
+            )
+          ] ++ config.home-manager.sharedModules;
+        };
+      in
+      mkAfter ''
+        # Activate Home Manager configuration for domain users
+        if id | egrep -o 'groups=.*' | sed 's/,/\n/g' | cut -d'(' -f2 | sed 's/)//' | egrep -o "^domain users$"; then
+          echo "Setting up environment for domain user"
+          SKIP_SANITY_CHECKS=1 ${homeConfiguration.activationPackage}/activate
+          if test -f "$HOME/.bashrc"; then
+            . $HOME/.bashrc
+          fi
+        fi
+      '';
+
+    # Automatically mount home share
+    # Can be accessed at /network/$USER
+    # services.autofs = {
+    #   enable = true;
+    #   autoMaster =
+    #     let
+    #       networkMap = pkgs.writeText "auto" ''
+    #         * -fstype=cifs,sec=krb5,user=&,uid=$UID,gid=$GID,cruid=$UID ://${inputs.secrets.lab.nas.host}/home
+    #       '';
+    #     in
+    #     ''
+    #       /network ${networkMap} --timeout=30
+    #     '';
+    # };
+  };
+}

modules/nixos/fonts.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.fonts;
+in
+{
+  options.modules.fonts = {
+    enable = mkEnableOption "fonts";
+  };
+  config = mkIf cfg.enable {
+    console.packages = [
+      pkgs.dina-psfu
+    ];
+    console.font = "dina";
+    console.earlySetup = true;
+
+    fonts.packages = with pkgs; [
+      noto-fonts
+      fira
+      jetbrains-mono
+    ];
+
+    # TODO: Disable default fonts, fonts should be managed per user
+    # fonts.enableDefaultPackages = false;
+    # fonts.fontconfig = {
+    #   enable = true;
+    #   defaultFonts = {
+    #     serif = mkDefault [ ];
+    #     sansSerif = mkDefault [ ];
+    #     monospace = mkDefault [ ];
+    #     emoji = mkDefault [ ];
+    #   };
+    # };
+  };
+}

modules/nixos/gnome.nix

@@ -0,0 +1,65 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.gnome;
+in
+{
+  options.modules.gnome = {
+    enable = mkEnableOption "gnome";
+    # TODO: Add RDP toggle
+  };
+
+  config = mkIf cfg.enable {
+    # Enable GDM and Gnome
+    services.displayManager.gdm.enable = true;
+    services.desktopManager.gnome.enable = true;
+    services.gnome.core-apps.enable = false;
+    services.gnome.games.enable = false;
+    services.gnome.core-developer-tools.enable = false;
+    environment.gnome.excludePackages = with pkgs; [
+      adwaita-icon-theme
+      (derivation { name = "nixos-background-info"; })
+      gnome-backgrounds
+      gnome-bluetooth
+      gnome-color-manager
+      gnome-shell-extensions
+      gnome-tour
+      gnome-user-docs
+      glib
+      gnome-menus
+      gtk3.out
+    ];
+
+    # For GSConnect/KDE Connect
+    # TODO: Move to host config?
+    networking.firewall = {
+      allowedTCPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+      allowedUDPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+    };
+
+    # Enable dependencies
+    modules.networkmanager.enable = true;
+
+    # Impermanence
+    modules.impermanence.directories = [
+      "/etc/NetworkManager/system-connections"
+      "/var/lib/bluetooth"
+    ];
+  };
+}

modules/nixos/graphics.nix

@@ -0,0 +1,26 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.graphics;
+in
+{
+  options.modules.graphics = {
+    enable = mkEnableOption "graphics";
+    # TODO: Add toggle for hybrid graphics
+  };
+  config = mkIf cfg.enable {
+    hardware.graphics.enable = true;
+    hardware.graphics.enable32Bit = true;
+    services.xserver.videoDrivers = [ "nvidia" ];
+    # TODO: Add nvidia settings back in
+    # TODO: Move to nvidia module
+    hardware.nvidia = {
+      open = false;
+      prime = {
+        intelBusId = "PCI:0@0:2:0";
+        nvidiaBusId = "PCI:1@0:0:0";
+      };
+    };
+  };
+}

modules/nixos/impermanence.nix

@@ -0,0 +1,81 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.impermanence;
+in
+{
+  options.modules.impermanence = {
+    enable = mkEnableOption "Impermanence";
+    directories = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Directories that should be stored in persistent storage.
+      '';
+    };
+    files = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Files that should be stored in persistent storage.
+      '';
+    };
+    resetScript = mkOption {
+      type = types.lines;
+      description = ''
+        Script to run in order to reset the system to a clean state.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Filesystem setup
+    fileSystems."/persist".neededForBoot = true;
+    # boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+    # TODO: Reduce dependency on the root filesystem being ZFS?
+    boot.initrd.systemd.services.impermanence-rollback = {
+      description = "Rollback filesystem to clean state.";
+      wantedBy = [ "initrd.target" ];
+      after = [ "zfs-import.target" ];
+      before = [ "sysroot.mount" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig.Type = "oneshot";
+      script = cfg.resetScript;
+    };
+
+    # For home-manager persistence
+    programs.fuse.userAllowOther = true;
+
+    # For testing purposes with VM
+    virtualisation.vmVariantWithDisko.virtualisation.fileSystems."/persist".neededForBoot = true;
+
+    environment.persistence = {
+      "/persist/system" = {
+        enable = true;
+        hideMounts = true;
+        directories = cfg.directories;
+        files = cfg.files;
+      };
+      # "/persist/home" = {
+      #   enable = true;
+      #   hideMounts = true;
+      #   users = (
+      #     lib.mapAttrs' (
+      #       name: value:
+      #       let
+      #         user = name;
+      #         homeDir = "/home/${user}";
+      #         impConfig = value.modules.impermanence;
+      #       in
+      #       lib.nameValuePair user {
+      #         home = homeDir;
+      #         directories = impConfig.directories;
+      #         files = impConfig.files;
+      #       }
+      #     ) config.home-manager.users
+      #   );
+      # };
+    };
+  };
+}

modules/nixos/networkmanager.nix

@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.networkmanager;
+in
+{
+  options.modules.networkmanager = {
+    enable = mkEnableOption "networkmanager";
+  };
+  config = mkIf cfg.enable {
+    # TODO: Add sudo users to the networkmanager group?
+    networking.networkmanager.enable = true;
+
+    networking.firewall.checkReversePath = false;
+  };
+}

modules/nixos/power-saving.nix

@@ -0,0 +1,20 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.power-saving;
+in
+{
+  options.modules.power-saving = {
+    enable = mkEnableOption "power saving";
+  };
+  config = mkIf cfg.enable {
+    # Setup power management
+    powerManagement.enable = true;
+    services.thermald.enable = true;
+    services.power-profiles-daemon.enable = true;
+
+    # Enable wifi power saving
+    networking.networkmanager.wifi.powersave = true;
+  };
+}

modules/nixos/printing.nix

@@ -1,8 +1,4 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 
 with lib;
 let
@@ -12,16 +8,18 @@ in
   options.modules.printing = {
     enable = mkEnableOption "printing";
   };
-
   config = mkIf cfg.enable {
-    services.printing = {
+    # Enable CUPS
-      enable = true;
+    services.printing.enable = true;
-      # drivers = with pkgs; [];
+
-    };
+    # Enable Avahi to auto-detect network printers
     services.avahi = {
       enable = true;
       nssmdns4 = true;
       openFirewall = true;
     };
+
+    # For SMB network printers
+    services.samba.enable = true;
   };
 }

modules/nixos/secrets.nix

@@ -0,0 +1,44 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in /etc/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "/etc/sops/sops_ed25519_key"
+      "/persist/system/etc/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ "/etc/sops" ];
+    virtualisation.vmVariantWithDisko.sops.age.sshKeyPaths = [ "/tmp/shared/sops_ed25519_key" ];
+  };
+}

modules/nixos/sound.nix

@@ -1,21 +1,15 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  pkgs,
-  ...
-}:
 
 with lib;
 let
-  cfg = config.modules.pipewire;
+  cfg = config.modules.sound;
 in
 {
-  options.modules.pipewire = {
+  options.modules.sound = {
-    enable = mkEnableOption "pipewire";
+    enable = mkEnableOption "sound";
   };
-
   config = mkIf cfg.enable {
-    security.rtkit.enable = true;
+    # Enable pipewire
     services.pipewire = {
       enable = true;
       alsa.enable = true;
@@ -23,5 +17,8 @@ in
       pulse.enable = true;
       jack.enable = true;
     };
+
+    # Recommended by wiki, allows user processes to use realtime kernel
+    security.rtkit.enable = true;
   };
 }

modules/nixos/ssh.nix

@@ -0,0 +1,32 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.ssh;
+in
+{
+  options.modules.ssh = {
+    enable = mkEnableOption "ssh";
+  };
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+      };
+      hostKeys = mkIf (config.modules.impermanence.enable) [
+        {
+          type = "ed25519";
+          path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
+        }
+        {
+          type = "rsa";
+          bits = 4096;
+          path = "/persist/system/etc/ssh/ssh_host_rsa_key";
+        }
+      ];
+    };
+  };
+}

modules/power-saving/default.nix

@@ -1,36 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.power-saving;
-in
-{
-  options.modules.power-saving = {
-    enable = mkEnableOption "power-saving";
-  };
-
-  config = mkIf cfg.enable {
-    powerManagement.enable = true;
-    services.thermald.enable = true;
-    services.tlp = {
-      enable = true;
-
-      settings = {
-        CPU_SCALING_GOVERNOR_ON_AC = "performance";
-        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
-
-        CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
-        CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
-
-        CPU_MIN_PERF_ON_AC = 0;
-        CPU_MAX_PERF_ON_AC = 100;
-        CPU_MIN_PERF_ON_BAT = 0;
-        CPU_MAX_PERF_ON_BAT = 20;
-      };
-    };
-  };
-}

modules/spotifyd/default.nix

@@ -1,64 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.spotifyd;
-in
-{
-  options.modules.spotifyd = {
-    enable = mkEnableOption "spotifyd";
-  };
-
-  config = mkIf cfg.enable {
-    # User for spotifyd
-    users.users.mixer = {
-      group = "mixer";
-    };
-    users.groups.mixer = { };
-
-    # Spotifyd service
-    systemd.user.services.spotifyd = {
-      description = "SpotifyD Service";
-      wantedBy = [ "default.target" ];
-      after = [
-        "network.target"
-        "sound.target"
-      ];
-      unitConfig = {
-        ConditionUser = "mixer"; # TODO: Allow user configuration
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --config-path /etc/spotifyd/spotifyd.conf";
-        Restart = "always";
-        RestartSec = 5;
-      };
-    };
-
-    # Set up config
-    environment.etc = {
-      "spotifyd/spotifyd.conf" = {
-        source = ./spotifyd.conf;
-        mode = "0444";
-        user = "mixer"; # TODO: Make user configurable
-        group = "mixer";
-      };
-    };
-
-    # Set up firewall
-    networking.firewall = {
-      allowedTCPPorts = [
-        5353
-        5454
-      ];
-      allowedUDPPorts = [
-        5353
-        5454
-      ];
-    };
-  };
-}

modules/spotifyd/spotifyd.conf

@@ -1,118 +0,0 @@
-[global]
-
-#---------#
-# GENERAL #
-#---------#
-
-# The name that gets displayed under the connect tab on
-# official clients.
-device_name = "Linox"
-
-# The displayed device type in Spotify clients.
-# Can be unknown, computer, tablet, smartphone, speaker, t_v,
-# a_v_r (Audio/Video Receiver), s_t_b (Set-Top Box), and audio_dongle.
-device_type = "a_v_r"
-
-# The directory used to store credentials and audio cache.
-# Default: infers a sensible cache directory (e.g. on Linux: $XDG_CACHE_HOME)
-#
-# Note: The file path does not get expanded. Environment variables and
-# shell placeholders like $HOME or ~ don't work!
-#cache_path = "/full/path/to/cache/directory"
-
-# If set to true, audio data does NOT get cached.
-# In this case, the cache is only used for credentials.
-#no_audio_cache = true
-
-# The maximal size of the cache directory in bytes
-# The example value corresponds to ~ 1GB
-#max_cache_size = 1000000000
-
-# If set to true, `spotifyd` tries to bind to dbus (default is the session bus)
-# and expose MPRIS controls. When running headless, without the session bus,
-# you should set this to false, to avoid errors. If you still want to use MPRIS,
-# have a look at the `dbus_type` option.
-use_mpris = false
-
-# The bus to bind to with the MPRIS interface.
-# Possible values: "session", "system"
-# The system bus can be used if no graphical session is available
-# (e.g. on headless systems) but you still want to be able to use MPRIS.
-# NOTE: You might need to add appropriate policies to allow spotifyd to
-# own the name.
-#dbus_type = "session"
-
-#-----------#
-# DISCOVERY #
-#-----------#
-
-# If set to true, this disables zeroconf discovery.
-# This can be useful, if one prefers to run a single-user instance.
-#disable_discovery = false
-
-# The port at which `spotifyd` is going to offer its service over the network (TCP).
-# If not set, a random port > 1024 is used. For the service to be discoverable on the
-# local network via mDNS, both the mDNS port (5353 UDP) and the random or fixed
-# zeroconf port need to be allowed through any active firewall.
-zeroconf_port = 5454
-
-#-------#
-# AUDIO #
-#-------#
-
-# The audio backend used to play music. To get
-# a list of possible backends, run `spotifyd --help`.
-#backend = "alsa" # use portaudio for macOS [homebrew]
-backend = "pulseaudio"
-
-# The alsa audio device to stream audio. To get a
-# list of valid devices, run `aplay -L`,
-#device = "default"  # omit for macOS
-device = "SpotifyD-Proxy"
-
-# The PCM sample format to use. Possible values 
-# are F32, S32, S24, S24_3, S16. 
-# Change this value if you encounter errors like
-# "Alsa error PCM open ALSA function 'snd_pcm_hw_params_set_format' failed with error 'EINVAL: Invalid argument'"
-#audio_format = "S16"
-
-# The volume controller. Each one behaves different to
-# volume increases. For possible values, run
-# `spotifyd --help`.
-#volume_controller = "softvol"  # use softvol for macOS
-
-# ! Only relevant for ALSA !
-# The alsa control device. By default this is the same
-# name as the `device` field.
-#control = "default"
-
-# ! Only relevant for ALSA !
-# The alsa mixer used by `spotifyd`.
-#mixer = "PCM"  # omit for macOS
-
-# The audio bitrate. 96, 160 or 320 kbit/s
-#bitrate = 160
-
-# Volume on startup between 0 and 100
-#initial_volume = 90
-initial_volume = 100
-
-# If set to true, enables volume normalisation between songs.
-# volume_normalisation = true
-
-# The normalisation pregain that is applied for each song.
-#normalisation_pregain = -10
-
-#-------ä
-# OTHER #
-#-------#
-
-# After the music playback has ended, start playing similar songs based on the previous tracks.
-# By default, `spotifyd` infers this setting from the user settings.
-autoplay = true
-
-# A command that gets executed in your shell after each song changes.
-#on_song_change_hook = "echo \"hook executed on $PLAYER_EVENT\""
-
-# The proxy `spotifyd` will use to connect to spotify.
-#proxy = "http://proxy.example.org:8080"

modules/ssh/default.nix

@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.ssh;
-in
-{
-  options.modules.ssh = {
-    enable = mkEnableOption "ssh";
-  };
-
-  config = mkIf cfg.enable {
-    services.openssh.enable = true;
-  };
-}

modules/unfree/default.nix

@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.unfree;
-in
-{
-  options.modules.unfree = {
-    enable = mkEnableOption "unfree";
-    allowedPackages = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-    };
-  };
-
-  config = mkIf cfg.enable {
-    nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) cfg.allowedPackages;
-  };
-}

modules/users/default.nix

@@ -1,79 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  # User configuration
-  userModule = types.submodule {
-    options = {
-      sudo = mkOption {
-        type = types.bool;
-        default = false;
-        example = true;
-        description = "Whether the user is allowed sudo access.";
-      };
-      configuration = mkOption {
-        type = types.path;
-        default = ./users/base.nix;
-        description = "What home manager configuration to use for this user.";
-      };
-      desktopInit = mkOption {
-        type = types.lines;
-        default = "";
-        description = "Bash script to execute after initial log in.";
-      };
-    };
-  };
-in
-{
-  imports = [
-    # Import systemwide configuration
-    ./systemwide.nix
-  ];
-
-  options = {
-    machine.sudo-groups = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      description = "Groups assigned to sudo users.";
-    };
-    machine.users = mkOption {
-      type = types.attrsOf userModule;
-      default = { };
-      description = "Users configured on this system.";
-    };
-  };
-
-  config = {
-    # Add required home manager modules
-    home-manager.sharedModules = [
-      # Modules
-      ../../user-modules/default.nix
-
-      # Custom packages
-      ../../pkgs/default.nix
-    ];
-
-    # Create users
-    users.users = attrsets.concatMapAttrs (name: value: {
-      ${name} = {
-        isNormalUser = true;
-        extraGroups = mkIf value.sudo (
-          [
-            "wheel"
-          ]
-          ++ config.machine.sudo-groups
-        );
-      };
-    }) config.machine.users;
-
-    # Create home manager configuration for users
-    home-manager.users = attrsets.concatMapAttrs (name: value: {
-      ${name} = value.configuration;
-    }) config.machine.users;
-  };
-}

modules/users/systemwide.nix

@@ -1,42 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-with lib;
-let
-  moduleFiles = [
-    ../../user-modules/desktop/systemwide.nix
-    ../../user-modules/development/systemwide.nix
-    ../../user-modules/gaming/systemwide.nix
-    ../../user-modules/keyring/systemwide.nix
-  ];
-
-  moduleConfig = lists.foldr (file: acc: recursiveUpdate acc (import file)) { } moduleFiles;
-
-  moduleNames = attrNames moduleConfig;
-
-  mkModule =
-    name: moduleConfig:
-    { pkgs, ... }:
-    {
-      config =
-        mkIf
-          (any (
-            user:
-            (
-              config.home-manager.users.${user}.modules.${name}.enable
-              || (any (specialisation: specialisation.configuration.modules.${name}.enable) (
-                attrValues config.home-manager.users.${user}.specialisation
-              ))
-            )
-          ) (attrNames config.home-manager.users))
-          (if (isAttrs moduleConfig) then moduleConfig else (moduleConfig { inherit config pkgs; }));
-    };
-
-  imports = map (name: mkModule name moduleConfig."${name}") moduleNames;
-in
-{
-  imports = imports;
-}

modules/vpn/tailscale.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.tailscale;
-in
-{
-  options.modules.tailscale = {
-    enable = mkEnableOption "tailscale";
-  };
-
-  config = mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "client";
-    };
-  };
-}

modules/wifi/wpa_supplicant.nix

@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  cfg = config.modules.wpa_supplicant;
-in
-{
-  options.modules.wpa_supplicant = {
-    enable = mkEnableOption "wpa_supplicant";
-  };
-
-  config = mkIf cfg.enable {
-    networking.wireless = {
-      enable = true;
-      userControlled.enable = true;
-      allowAuxiliaryImperativeNetworks = true;
-    };
-  };
-}

packages/carla_osc_bridge.nix

@@ -9,8 +9,8 @@ rustPlatform.buildRustPackage {
     domain = "git.bulthuis.dev";
     owner = "Jan";
     repo = "carla_osc_bridge";
-    rev = "8966a25e8d56efa30a28fd320c6f657040a1f01c";
+    rev = "c037e2d2a1b29b785d8acc10fa0cb761afdb3fcf";
-    hash = "sha256-AJ+hb642V/aqizbM4URaZhFSIFwSvGa23HIkHqIru2o=";
+    hash = "sha256-Wvdfm+4dfygZwkvaUhO9w7DrrUl3ZYvtD7nYrPSD0eA=";
   };
 
   cargoHash = "sha256-s1ZKbhHudgPOy7613zbT8TkbM6B7oloLEuTYHoWjX5o=";

packages/extension-tinymist-html.nix

@@ -0,0 +1,37 @@
+{
+  jq,
+  lib,
+  moreutils,
+  tinymist,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "tinymist-vscode-html";
+    publisher = "myriad-dreamin";
+    inherit (tinymist) version;
+    hash = "";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ tinymist ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+    description = "VSCode extension for providing an integration solution for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+    homepage = "https://github.com/myriad-dreamin/tinymist";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
+}

packages/open-stage-control.nix

@@ -0,0 +1,104 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  nodejs_20,
+  electron,
+  python3,
+  nix-update-script,
+}:
+
+buildNpmPackage rec {
+  pname = "open-stage-control";
+  version = "1.29.8";
+
+  src = fetchFromGitHub {
+    owner = "jean-emmanuel";
+    repo = "open-stage-control";
+    rev = "v${version}";
+    hash = "sha256-518KXvNffLOV2aIWlLJcnPzxEbWxYdjWeiDBC1jlecQ=";
+  };
+
+  # Remove some Electron stuff from package.json
+  postPatch = ''
+    sed -i -e '/"electron"\|"electron-installer-debian"/d' package.json
+  '';
+
+  npmDepsHash = "sha256-U4zwYL5URNW0y0W4WvWAVL0hubiiU+2z9F5mDE9l8UU=";
+
+  nodejs = nodejs_20;
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    python3.pkgs.python-rtmidi
+  ];
+
+  doInstallCheck = true;
+
+  makeCacheWritable = true;
+  npmFlags = [
+    "--legacy-peer-deps"
+    "--skip-pkg"
+  ];
+
+  # Override installPhase so we can copy the only directory that matters (app)
+  installPhase = ''
+    runHook preInstall
+
+    # copy built app and node_modules directories
+    mkdir -p $out/lib/node_modules/open-stage-control
+    cp -r app $out/lib/node_modules/open-stage-control/
+
+    # copy icon
+    install -Dm644 resources/images/logo.png $out/share/icons/hicolor/256x256/apps/open-stage-control.png
+    install -Dm644 resources/images/logo.svg $out/share/icons/hicolor/scalable/apps/open-stage-control.svg
+
+    # wrap electron and include python-rtmidi
+    makeWrapper '${electron}/bin/electron' $out/bin/open-stage-control \
+      --inherit-argv0 \
+      --add-flags $out/lib/node_modules/open-stage-control/app \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : '${lib.makeBinPath [ python3 ]}'
+
+    runHook postInstall
+  '';
+
+  installCheckPhase = ''
+    XDG_CONFIG_HOME="$(mktemp -d)" $out/bin/open-stage-control --help
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "open-stage-control";
+      exec = "open-stage-control";
+      icon = "open-stage-control";
+      desktopName = "Open Stage Control";
+      comment = meta.description;
+      categories = [
+        "Network"
+        "Audio"
+        "AudioVideo"
+        "Midi"
+      ];
+      startupWMClass = "open-stage-control";
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Libre and modular OSC / MIDI controller";
+    homepage = "https://openstagecontrol.ammd.net/";
+    license = licenses.gpl3Only;
+    maintainers = [ ];
+    platforms = platforms.linux;
+    mainProgram = "open-stage-control";
+  };
+}

pkgs/default.nix

@@ -1,21 +0,0 @@
-{
-  ...
-}:
-
-let
-  overlay = final: prev: {
-    dina-psfu = prev.callPackage ./fonts/dina-psfu.nix { };
-    ttf2psf = prev.callPackage ./fonts/ttf2psf.nix { };
-    wqy-zenhei = prev.callPackage ./fonts/wqy-zenhei.nix { };
-    wqy-microhei = prev.callPackage ./fonts/wqy-microhei.nix { };
-    wqy-bitmapsong = prev.callPackage ./fonts/wqy-bitmapsong.nix { };
-
-    wprs = prev.callPackage ./programs/wprs/default.nix { };
-    nixgreety = prev.callPackage ./programs/nixgreety.nix { };
-    carla_osc_bridge = prev.callPackage ./programs/carla_osc_bridge.nix { };
-    # ly = prev.callPackage ./programs/ly/default.nix { };
-  };
-in
-{
-  nixpkgs.overlays = [ overlay ];
-}

pkgs/fonts/ttf2psf.nix

@@ -1,31 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-pkgs.stdenv.mkDerivation {
-  pname = "ttf2psf";
-  version = "1.0.0";
-
-  src = pkgs.fetchFromGitHub {
-    owner = "NateChoe1";
-    repo = "ttf2psf";
-    rev = "8db09d05385f595c320eccae4c48ff4393ca5bde";
-    sha256 = "v52TZp+GyXHBAMsIoHFA8ZIMPsDVls13WW29vpesCig=";
-  };
-
-  buildInputs = with pkgs; [
-    pkg-config
-    freetype
-  ];
-
-  buildPhase = ''
-    make build/ttf2psf
-  '';
-
-  installPhase = ''
-    install -Dm 755 -t $out/bin build/ttf2psf
-    install -Dm 644 -t $out/share/ttf2psf data/*.*
-    install -Dm 644 -t $out/share/ttf2psf/fontsets data/fontsets/*
-  '';
-}

pkgs/fonts/wqy-bitmapsong.nix

@@ -1,35 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-pkgs.stdenv.mkDerivation rec {
-  pname = "wqy-bitmapsong-pcf";
-  version = "1.0.0-RC1";
-
-  src = pkgs.fetchurl {
-    url = "mirror://sourceforge/wqy/${pname}-${version}.tar.gz";
-    hash = "sha256-0uvwkRUbvJ0remTnlP8dElRjaBVd6iukNYBTE/CTO7s=";
-  };
-
-  buildInputs = [ pkgs.fontforge ];
-  buildPhase = ''
-    newName() {
-    test "''${1:5:1}" = i && _it=Italic || _it=
-    case ''${1:6:3} in
-        400) test -z $it && _weight=Medium ;;
-        700) _weight=Bold ;;
-    esac
-    _pt=''${1%.pcf}
-    _pt=''${_pt#*-}
-    echo "WenQuanYi_Bitmap_Song$_weight$_it$_pt"
-    }
-
-    for i in *.pcf; do
-    fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$(newName $i).otb\")"
-    done
-  '';
-  installPhase = ''
-    install -Dm644 *.otb -t $out/share/fonts/
-  '';
-}

pkgs/fonts/wqy-microhei.nix

@@ -1,22 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-pkgs.stdenv.mkDerivation rec {
-  pname = "wqy-microhei";
-  version = "0.2.0-beta";
-
-  src = pkgs.fetchurl {
-    url = "mirror://sourceforge/wqy/${pname}-${version}.tar.gz";
-    hash = "sha256-KAKsgCOqNqZupudEWFTjoHjTd///QhaTQb0jeHH3IT4=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 *.ttc -t $out/share/fonts/
-
-    runHook postInstall
-  '';
-}

pkgs/fonts/wqy-zenhei.nix

@@ -1,22 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-pkgs.stdenv.mkDerivation rec {
-  pname = "wqy-zenhei";
-  version = "0.9.45";
-
-  src = pkgs.fetchurl {
-    url = "mirror://sourceforge/wqy/${pname}-${version}.tar.gz";
-    hash = "sha256-5LfjBkdb+UJ9F1dXjw5FKJMMhMROqj8WfUxC8RDuddY=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 *.ttc -t $out/share/fonts/
-
-    runHook postInstall
-  '';
-}

pkgs/programs/ly/default.nix

@@ -1,47 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  linux-pam,
-  libxcb,
-  makeBinaryWrapper,
-  zig_0_12,
-  callPackage,
-  nixosTests,
-}:
-
-stdenv.mkDerivation {
-  pname = "ly";
-  version = "1.0.2";
-
-  src = fetchFromGitHub {
-    owner = "peterc-s";
-    repo = "ly";
-    rev = "e6d8bea236dd0097adb1c22e9a23d95102ebe9d9";
-    sha256 = "w9YdNVD+8UhrEbPJ7xqsd/WoxU2rlo2GXFtc9JpWHxo=";
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    zig_0_12.hook
-  ];
-  buildInputs = [
-    libxcb
-    linux-pam
-  ];
-
-  postPatch = ''
-    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
-  '';
-
-  passthru.tests = { inherit (nixosTests) ly; };
-
-  meta = with lib; {
-    description = "TUI display manager";
-    license = licenses.wtfpl;
-    homepage = "https://github.com/fairyglade/ly";
-    maintainers = [ maintainers.vidister ];
-    platforms = platforms.linux;
-    mainProgram = "ly";
-  };
-}

pkgs/programs/ly/deps.nix

@@ -1,110 +0,0 @@
-# generated by zon2nix (https://github.com/Cloudef/zig2nix)
-
-{
-  lib,
-  linkFarm,
-  fetchurl,
-  fetchgit,
-  runCommandLocal,
-  zig,
-  name ? "zig-packages",
-}:
-
-let
-  unpackZigArtifact =
-    { name, artifact }:
-    runCommandLocal name { nativeBuildInputs = [ zig ]; } ''
-      hash="$(zig fetch --global-cache-dir "$TMPDIR" ${artifact})"
-      mv "$TMPDIR/p/$hash" "$out"
-      chmod 755 "$out"
-    '';
-
-  fetchZig =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      artifact = fetchurl { inherit url hash; };
-    in
-    unpackZigArtifact { inherit name artifact; };
-
-  fetchGitZig =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      parts = lib.splitString "#" url;
-      base = lib.elemAt parts 0;
-      rev = lib.elemAt parts 1;
-    in
-    fetchgit {
-      inherit name rev hash;
-      url = base;
-      deepClone = false;
-    };
-
-  fetchZigArtifact =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      parts = lib.splitString "://" url;
-      proto = lib.elemAt parts 0;
-      path = lib.elemAt parts 1;
-      fetcher = {
-        "git+http" = fetchGitZig {
-          inherit name hash;
-          url = "http://${path}";
-        };
-        "git+https" = fetchGitZig {
-          inherit name hash;
-          url = "https://${path}";
-        };
-        http = fetchZig {
-          inherit name hash;
-          url = "http://${path}";
-        };
-        https = fetchZig {
-          inherit name hash;
-          url = "https://${path}";
-        };
-        file = unpackZigArtifact {
-          inherit name;
-          artifact = /. + path;
-        };
-      };
-    in
-    fetcher.${proto};
-in
-linkFarm name [
-  {
-    name = "122062d301a203d003547b414237229b09a7980095061697349f8bef41be9c30266b";
-    path = fetchZigArtifact {
-      name = "clap";
-      url = "https://github.com/Hejsil/zig-clap/archive/refs/tags/0.9.1.tar.gz";
-      hash = "sha256-7qxm/4xb+58MGG+iUzssUtR97OG2dRjAqyS0BAet4HY=";
-    };
-  }
-  {
-    name = "12209b971367b4066d40ecad4728e6fdffc4cc4f19356d424c2de57f5b69ac7a619a";
-    path = fetchZigArtifact {
-      name = "zigini";
-      url = "https://github.com/Kawaii-Ash/zigini/archive/0bba97a12582928e097f4074cc746c43351ba4c8.tar.gz";
-      hash = "sha256-OdaJ5tqmk2MPwaAbpK4HRD/CcQCN+Cjj8U63BqUcFMs=";
-    };
-  }
-  {
-    name = "1220b0979ea9891fa4aeb85748fc42bc4b24039d9c99a4d65d893fb1c83e921efad8";
-    path = fetchZigArtifact {
-      name = "ini";
-      url = "https://github.com/ziglibs/ini/archive/e18d36665905c1e7ba0c1ce3e8780076b33e3002.tar.gz";
-      hash = "sha256-RQ6OPJBqqH7PCL+xiI58JT7vnIo6zbwpLWn+byZO5iM=";
-    };
-  }
-]

pkgs/programs/nixgreety.nix

@@ -1,19 +0,0 @@
-{ pkgs, ... }:
-
-with pkgs;
-rustPlatform.buildRustPackage {
-  pname = "nixgreety";
-  version = "master";
-
-  src = fetchFromGitea {
-    domain = "git.bulthuis.dev";
-    owner = "Jan";
-    repo = "nixgreety";
-    rev = "c7278a910a0238a53f23fe9a0ae881802a4bcb31";
-    hash = "sha256-kZB+iEFIDJ8pOJetu4Isu4oaktgIn14D4PcpDXLOXA8=";
-  };
-
-  cargoHash = "sha256-pklKVzYoChRqPZ/D3BsMGnaBFd615TKbvoAy7iU8UtA=";
-
-  useFetchCargoVendor = true;
-}

pkgs/programs/wprs/default.nix

@@ -1,50 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  libxkbcommon,
-  python3,
-  runCommand,
-  wprs,
-}:
-rustPlatform.buildRustPackage {
-  pname = "wprs";
-  version = "0-unstable-2025-04-16";
-
-  src = fetchFromGitHub {
-    owner = "wayland-transpositor";
-    repo = "wprs";
-    rev = "dfc1385bcb73734cd0d05a7e353522983c236562";
-    hash = "sha256-MrfYrKAVFoT453B2zED6Ax2coZ/KZ7CWYdZCx469Q/4=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    libxkbcommon
-    (python3.withPackages (pp: with pp; [ psutil ]))
-  ];
-
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-01PTfgDeagC72z8XADXEn5Aio6UWQAAYgDP4zKFTPpY=";
-
-  preFixup = ''
-    cp  wprs "$out/bin/wprs"
-  '';
-
-  passthru.tests.sanity = runCommand "wprs-sanity" { nativeBuildInputs = [ wprs ]; } ''
-    ${wprs}/bin/wprs -h > /dev/null && touch $out
-  '';
-
-  meta = with lib; {
-    description = "rootless remote desktop access for remote Wayland";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ mksafavi ];
-    platforms = [ "x86_64-linux" ]; # The aarch64-linux support is not implemented in upstream yet. Also, the darwin platform is not supported as it requires wayland.
-    homepage = "https://github.com/wayland-transpositor/wprs";
-    mainProgram = "wprs";
-  };
-}

profiles/disko/k3s.nix

@@ -0,0 +1,82 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        imageSize = "32G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-4G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+      longhorn = {
+        type = "disk";
+        device = "/dev/sdb";
+        imageSize = "64G"; # For longhorn storage
+        content = {
+          type = "gpt";
+          partitions = {
+            main = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}

profiles/disko/vm.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        imageSize = "32G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-4G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}

profiles/disko/workstation.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda"; # How do I handle this for laptops
+        imageSize = "64G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-16G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}

profiles/disko/ws-think.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        imageSize = "64G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-16G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}

profiles/home/base.nix

@@ -0,0 +1,32 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.profiles.base;
+in
+{
+  options.modules.profiles.base = {
+    enable = mkEnableOption "Base home-manager profile";
+  };
+
+  config = mkIf cfg.enable {
+    modules = {
+      impermanence.enable = true;
+      # btop.enable = true;
+      direnv.enable = true;
+      fish.enable = true;
+      # scripts.enable = true;
+
+      # Development
+      # neovim.enable = true;
+
+      # Languages
+      nix.enable = true;
+    };
+  };
+}