merge: floo host

.git-blame-ignore-revs

@@ -1,3 +1,8 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+
+# host rename
+cfe4c43887a41e52be4e6472474c0fc3788f86e8
+bebb7c42bbe87fe041b53189e78a4553e8c08666
+258902d409e68b47f781451e6d306a8e47198d75

.pre-commit-config.yaml

@@ -12,3 +12,13 @@ repos:
         language: system
         files: \.nix$
         pass_filenames: false
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        args: [-x, -P, scripts]
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.12.0-2
+    hooks:
+      - id: shfmt
+        args: [-d]

features/calibre.nix

@@ -0,0 +1,22 @@
+{
+  nixos =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.calibre ];
+
+      # udev rules for kindle and mtp device access
+      # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+      # because extraRules writes to 99-local.rules which is too late for uaccess
+      # see https://github.com/NixOS/nixpkgs/issues/308681
+      services.udev.packages = [
+        pkgs.libmtp
+        (pkgs.writeTextFile {
+          name = "kindle-udev-rules";
+          text = ''
+            ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+          '';
+          destination = "/etc/udev/rules.d/70-kindle.rules";
+        })
+      ];
+    };
+}

features/claude.nix

@@ -0,0 +1,10 @@
+{
+  home =
+    { pkgs, ... }:
+    {
+      home.packages = [
+        pkgs.claude-code
+        pkgs.mcp-nixos
+      ];
+    };
+}

features/desktop.nix

@@ -0,0 +1,85 @@
+{
+  nixos =
+    { pkgs, inputs, ... }:
+    {
+      imports = [ inputs.stylix.nixosModules.stylix ];
+
+      # audio
+      services.pipewire = {
+        enable = true;
+        pulse.enable = true;
+      };
+
+      # bluetooth
+      hardware.bluetooth.enable = true;
+      services.blueman.enable = true;
+
+      security.polkit.enable = true;
+      services.dbus.enable = true;
+      services.playerctld.enable = true;
+
+      xdg.portal = {
+        enable = true;
+        xdgOpenUsePortal = true;
+        extraPortals = [
+          pkgs.xdg-desktop-portal-wlr
+          pkgs.xdg-desktop-portal-gtk
+        ];
+      };
+
+      fonts.packages = with pkgs; [
+        font-awesome
+        nerd-fonts.jetbrains-mono
+      ];
+
+      # theming
+      stylix = {
+        enable = true;
+        polarity = "dark";
+        image = "${inputs.assets}/wallpaper.png";
+        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
+      };
+
+      programs.thunderbird.enable = true;
+      programs._1password.enable = true;
+      programs._1password-gui.enable = true;
+
+      environment.systemPackages = with pkgs; [
+        easyeffects
+        ghostty
+        google-chrome
+        zathura
+        pavucontrol
+        bolt-launcher
+        libnotify
+        bibata-cursors
+        vesktop
+        rocketchat-desktop
+        telegram-desktop
+        slack
+        jellyfin-media-player
+        cider-2
+        mpv
+        ffmpeg
+        wf-recorder
+        wl-mirror
+        protonmail-bridge
+        ledger-live-desktop
+      ];
+
+      # internal CA
+      security.pki.certificateFiles = [
+        inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+      ];
+
+      xdg.mime.defaultApplications = {
+        "application/pdf" = "org.pwmt.zathura.desktop";
+      };
+    };
+
+  home =
+    { inputs, ... }:
+    {
+      home.file.".assets".source = inputs.assets;
+    };
+}

features/dev-registry.nix

@@ -0,0 +1,16 @@
+{
+  nixos =
+    { inputs, ... }:
+    {
+      nix.registry.dev = {
+        from = {
+          type = "indirect";
+          id = "dev";
+        };
+        to = {
+          type = "path";
+          path = inputs.self.outPath;
+        };
+      };
+    };
+}

features/dev.nix

@@ -0,0 +1,30 @@
+{
+  home =
+    { pkgs, inputs, ... }:
+    let
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      home.packages = [
+        pkgs.git
+        packages.git-linearize
+        packages.ggman
+        pkgs.go
+        pkgs.python3
+        pkgs.mdbook
+        pkgs.marksman
+        pkgs.mdformat
+        pkgs.google-cloud-sdk
+        pkgs.google-cloud-sql-proxy
+        packages.ahab
+        pkgs.just
+        pkgs.presenterm
+        pkgs.osc
+      ];
+
+      programs.direnv = {
+        enable = true;
+        nix-direnv.enable = true;
+      };
+    };
+}

features/docker.nix

@@ -0,0 +1,12 @@
+{
+  nixos =
+    { user, ... }:
+    {
+      virtualisation.docker = {
+        enable = true;
+        logDriver = "json-file";
+      };
+
+      users.users.${user}.extraGroups = [ "docker" ];
+    };
+}

features/gnupg.nix

@@ -0,0 +1,9 @@
+{
+  nixos = _: {
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      enableExtraSocket = true;
+    };
+  };
+}

features/greeter.nix

@@ -0,0 +1,28 @@
+{
+  nixos =
+    { lib, inputs, ... }:
+    {
+      programs.regreet = {
+        enable = true;
+        # single output to avoid stretching across monitors
+        cageArgs = [
+          "-s"
+          "-m"
+          "last"
+        ];
+        font = {
+          name = lib.mkForce "JetBrainsMono Nerd Font";
+          size = lib.mkForce 14;
+        };
+        settings = {
+          background = {
+            path = lib.mkForce "${inputs.assets}/wallpaper.png";
+            fit = lib.mkForce "Cover";
+          };
+          GTK = {
+            application_prefer_dark_theme = lib.mkForce true;
+          };
+        };
+      };
+    };
+}

features/initrd-ssh.nix

@@ -0,0 +1,75 @@
+{
+  nixos =
+    { lib, config, ... }:
+    let
+      keyDir = "/etc/secrets/initrd";
+
+      mkIpString =
+        {
+          address,
+          gateway,
+          netmask,
+          interface,
+          ...
+        }:
+        "${address}::${gateway}:${netmask}::${interface}:none";
+    in
+    {
+      options = {
+        initrd-ssh = {
+          ip = {
+            enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+
+            address = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            gateway = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            netmask = lib.mkOption {
+              type = lib.types.str;
+              default = "255.255.255.0";
+            };
+
+            interface = lib.mkOption {
+              type = lib.types.str;
+            };
+          };
+
+          authorizedKeys = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+
+          networkModule = lib.mkOption {
+            type = lib.types.str;
+          };
+        };
+      };
+
+      config = {
+        boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
+        boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
+          "ip=${mkIpString config.initrd-ssh.ip}"
+        ];
+
+        boot.initrd.network = {
+          enable = true;
+          ssh = {
+            enable = true;
+            port = 22;
+            hostKeys = [
+              "${keyDir}/ssh_host_rsa_key"
+              "${keyDir}/ssh_host_ed25519_key"
+            ];
+            inherit (config.initrd-ssh) authorizedKeys;
+          };
+          postCommands = ''
+            echo 'cryptsetup-askpass' >> /root/.profile
+          '';
+        };
+      };
+    };
+}

features/localisation.nix

@@ -0,0 +1,25 @@
+{
+  nixos =
+    { lib, config, ... }:
+    {
+      options = {
+        localisation = {
+          timeZone = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          defaultLocale = lib.mkOption {
+            type = lib.types.str;
+          };
+        };
+      };
+
+      config = {
+        time.timeZone = config.localisation.timeZone;
+        i18n.defaultLocale = config.localisation.defaultLocale;
+
+        # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
+        environment.variables.TZ = config.localisation.timeZone;
+      };
+    };
+}

features/neovim.nix

@@ -0,0 +1,69 @@
+{
+  home =
+    {
+      config,
+      options,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    {
+      options = {
+        neovim.dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+
+      config = lib.mkMerge [
+        (lib.optionalAttrs (options ? stylix) {
+          # disable stylix neovim target when stylix is present (loaded by desktop feature)
+          stylix.targets.neovim.enable = false;
+        })
+        {
+          xdg.configFile."nvim" = lib.mkIf (config.neovim.dotfiles != null) {
+            source = config.neovim.dotfiles;
+          };
+
+          programs.neovim = {
+            enable = true;
+            vimAlias = true;
+            defaultEditor = true;
+            package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+            extraPackages = with pkgs; [
+              gcc
+              luajit
+              nodejs_22
+              tree-sitter
+              gnumake
+              osc
+
+              fd
+              ripgrep
+              bat
+              delta
+
+              pyright
+              typescript-language-server
+              lua-language-server
+              gopls
+              nil
+              nixd
+
+              nixpkgs-fmt
+              stylua
+            ];
+
+            extraWrapperArgs = [
+              "--suffix"
+              "LD_LIBRARY_PATH"
+              ":"
+              "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
+            ];
+          };
+        }
+      ];
+    };
+}

features/networkmanager.nix

@@ -0,0 +1,9 @@
+{
+  nixos = _: {
+    networking.networkmanager.enable = true;
+    networking.nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
+  };
+}

features/nix-ld.nix

@@ -0,0 +1,5 @@
+{
+  nixos = _: {
+    programs.nix-ld.enable = true;
+  };
+}

features/openssh.nix

@@ -0,0 +1,25 @@
+{
+  nixos =
+    { lib, config, ... }:
+    {
+      options = {
+        openssh.port = lib.mkOption {
+          type = lib.types.port;
+          default = 22;
+        };
+      };
+
+      config = {
+        services.openssh = {
+          enable = true;
+          ports = [ config.openssh.port ];
+          settings = {
+            PasswordAuthentication = false;
+            AllowUsers = null;
+            PermitRootLogin = "no";
+            StreamLocalBindUnlink = "yes";
+          };
+        };
+      };
+    };
+}

features/printing.nix

@@ -0,0 +1,10 @@
+{
+  nixos = _: {
+    services.printing.enable = true;
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+  };
+}

features/shell.nix

@@ -0,0 +1,25 @@
+{
+  nixos = _: {
+    programs.zsh.enable = true;
+    environment.etc."zshenv".text = ''
+      export ZDOTDIR=$HOME/.config/zsh
+    '';
+  };
+
+  home =
+    { pkgs, ... }:
+    {
+      home.packages = with pkgs; [
+        starship
+        fzf
+        htop
+        jc
+        jq
+        openssl
+        pv
+        ripgrep
+        fd
+        tmux
+      ];
+    };
+}

features/steam.nix

@@ -0,0 +1,10 @@
+{
+  nixos = _: {
+    programs.steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+  };
+}

features/sway.nix

@@ -0,0 +1,38 @@
+{
+  nixos =
+    { pkgs, ... }:
+    {
+      programs.sway = {
+        enable = true;
+        package = pkgs.swayfx;
+        wrapperFeatures.gtk = true;
+        extraSessionCommands = ''
+          # fix for java awt apps not rendering
+          export _JAVA_AWT_WM_NONREPARENTING=1
+        '';
+      };
+
+      environment.systemPackages = with pkgs; [
+        waybar
+        mako
+        wob
+        playerctl
+        brightnessctl
+        foot
+        grim
+        pulseaudio
+        swayidle
+        swaylock-effects
+        jq
+        slurp
+        wl-clipboard
+        pamixer
+        wlsunset
+        satty
+        wayland-pipewire-idle-inhibit
+        fuzzel
+        cliphist
+        zenity
+      ];
+    };
+}

features/tailscale.nix

@@ -0,0 +1,8 @@
+{
+  nixos = _: {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+    };
+  };
+}

features/user-matej.nix

@@ -0,0 +1,35 @@
+let
+  sshKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+  ];
+in
+{
+  keys = {
+    sshAuthorizedKeys = sshKeys;
+  };
+
+  nixos =
+    { pkgs, ... }:
+    {
+      programs.zsh.enable = true;
+
+      users.users.matej = {
+        uid = 1000;
+        isNormalUser = true;
+        home = "/home/matej";
+        shell = pkgs.zsh;
+        extraGroups = [ "wheel" ];
+        openssh.authorizedKeys.keys = sshKeys;
+      };
+
+      users.groups.matej = {
+        gid = 1000;
+        members = [ "matej" ];
+      };
+    };
+
+  home = _: {
+    home.stateVersion = "24.11";
+  };
+}

features/vm-9p-automount.nix

@@ -0,0 +1,72 @@
+{
+  nixos =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      inherit (config.vm-9p-automount) user;
+      inherit (config.users.users.${user}) home group;
+    in
+    {
+      options = {
+        vm-9p-automount = {
+          user = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          prefix = lib.mkOption {
+            type = lib.types.str;
+            default = "m_";
+          };
+
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${home}/mnt";
+          };
+        };
+      };
+
+      config = {
+        systemd.services.vm-9p-automount = {
+          description = "Auto-discover and mount 9p shares";
+          after = [
+            "local-fs.target"
+            "nss-user-lookup.target"
+            "systemd-modules-load.service"
+          ];
+          wants = [ "systemd-modules-load.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+              BASE="${config.vm-9p-automount.basePath}"
+              PREFIX="${config.vm-9p-automount.prefix}"
+              mkdir -p "$BASE"
+              chown ${user}:${group} "$BASE"
+
+              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                [ -f "$tagfile" ] || continue
+                tag=$(tr -d '\0' < "$tagfile")
+
+                case "$tag" in
+                  "$PREFIX"*) ;;
+                  *) continue ;;
+                esac
+
+                name="''${tag#"$PREFIX"}"
+                target="$BASE/$name"
+
+                mkdir -p "$target"
+                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                  -o trans=virtio,version=9p2000.L || continue
+              done
+            '';
+          };
+        };
+      };
+    };
+}

features/vm-guest.nix

@@ -0,0 +1,47 @@
+{
+  nixos =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    {
+      options = {
+        vm-guest.headless = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = {
+        services.qemuGuest.enable = true;
+        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+
+        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+
+        boot.initrd.availableKernelModules = [
+          "9p"
+          "9pnet_virtio"
+        ];
+        boot.kernelModules = [
+          "9p"
+          "9pnet_virtio"
+        ];
+
+        networking = {
+          useDHCP = true;
+          firewall.allowedTCPPorts = [ 22 ];
+        };
+
+        security.sudo.wheelNeedsPassword = false;
+
+        environment.systemPackages = with pkgs; [
+          curl
+          wget
+          htop
+          sshfs
+        ];
+      };
+    };
+}

features/yubikey.nix

@@ -0,0 +1,12 @@
+{
+  nixos =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        yubikey-personalization
+        yubikey-manager
+      ];
+
+      services.pcscd.enable = true;
+    };
+}

flake.lock

@@ -84,24 +84,6 @@
         "type": "github"
       }
     },
-    "claude-code-overlay": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1772160751,
-        "narHash": "sha256-PXv9nrm8HHLGIU2B1XRjOvzlPW9sFdzbtWiJQ1wE8dM=",
-        "owner": "ryoppippi",
-        "repo": "claude-code-overlay",
-        "rev": "662bdbf5ea61fc3cde167bbe3686343a149ea6c6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryoppippi",
-        "repo": "claude-code-overlay",
-        "type": "github"
-      }
-    },
     "crane": {
       "locked": {
         "lastModified": 1765145449,
@@ -117,6 +99,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773889306,
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -151,17 +153,14 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
-          "neovim-nightly-overlay",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
@@ -171,6 +170,27 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "neovim-nightly-overlay",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -191,24 +211,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "fromYaml": {
       "flake": false,
       "locked": {
@@ -273,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771744638,
-        "narHash": "sha256-EDLi+YAsEEAmMeZe1v6GccuGRbCkpSZp/+A6g+pivR8=",
+        "lastModified": 1774274588,
+        "narHash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cb6c151f5c9db4df0b69d06894dc8484de1f16a0",
+        "rev": "cf9686ba26f5ef788226843bc31fda4cf72e373b",
         "type": "github"
       },
       "original": {
@@ -313,16 +315,16 @@
     },
     "neovim-nightly-overlay": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "neovim-src": "neovim-src",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1771891493,
-        "narHash": "sha256-L0OCnG8rsWJYZ3mzHSz0iENtlBXQjjcGgvMgsBqN14U=",
+        "lastModified": 1774483626,
+        "narHash": "sha256-8VAX9GXNfv4eBj0qBEf/Rc2/E6G0SBEpuo2A5plw34I=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "7db85d094c68697fc36801bccdf015b4c2bdb274",
+        "rev": "5deaa19e80e1c0695f7fa8a16e13a704fd08f96e",
         "type": "github"
       },
       "original": {
@@ -334,11 +336,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1771885993,
-        "narHash": "sha256-2c4H+5f0qhsp13Vx8pbsGiSRTHBJIfQaRAAUSHGEpgo=",
+        "lastModified": 1774472446,
+        "narHash": "sha256-Hp4A0llEmBvvNuw5uKOz+BA86X7TmXZ1vUK0StiMdVs=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "d9d8c660fd5559d928c8870a21970a375674e310",
+        "rev": "c9e961994b16ed841be43541ef550bf3d3f043ec",
         "type": "github"
       },
       "original": {
@@ -347,29 +349,60 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1774465523,
+        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768127708,
-        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
+        "lastModified": 1774273680,
+        "narHash": "sha256-a++tZ1RQsDb1I0NHrFwdGuRlR5TORvCEUksM459wKUA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
+        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1771932323,
-        "narHash": "sha256-3PadsTzuMJT/x0KmiD/Me1GG6rW8kaHoWVduSs0ue7o=",
+        "lastModified": 1774515149,
+        "narHash": "sha256-avcNAzwJC2lOyMNKVro2u5d6RLGiquXXxQVVmAEQ2+U=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "89bb5c5da7a857869cc88ef9b856bffdff8af264",
+        "rev": "01fcaaa08a9a44ec63c52bf0ee8d9a29593fee07",
         "type": "github"
       },
       "original": {
@@ -381,11 +414,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1771482645,
-        "narHash": "sha256-MpAKyXfJRDTgRU33Hja+G+3h9ywLAJJNRq4Pjbb4dQs=",
+        "lastModified": 1774273680,
+        "narHash": "sha256-a++tZ1RQsDb1I0NHrFwdGuRlR5TORvCEUksM459wKUA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "724cf38d99ba81fbb4a347081db93e2e3a9bc2ae",
+        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
         "type": "github"
       },
       "original": {
@@ -397,27 +430,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1771423170,
-        "narHash": "sha256-K7Dg9TQ0mOcAtWTO/FX/FaprtWQ8BmEXTpLIaNRhEwU=",
+        "lastModified": 1774244481,
+        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bcc4a9d9533c033d806a46b37dc444f9b0da49dd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1771714954,
-        "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "afbbf774e2087c3d734266c22f96fca2e78d3620",
+        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
         "type": "github"
       },
       "original": {
@@ -452,6 +469,22 @@
         "type": "github"
       }
     },
+    "nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1773783263,
+        "narHash": "sha256-lZG4VERlfCwEJpW6C5irkwUxB+JoPVmuV3qOYD9WNYY=",
+        "ref": "refs/heads/main",
+        "rev": "a95f1be85c858cb7d1bc0a8506dc9cb01161a3e7",
+        "revCount": 93,
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/nvim.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/nvim.git"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -478,14 +511,16 @@
     "root": {
       "inputs": {
         "assets": "assets",
-        "claude-code-overlay": "claude-code-overlay",
-        "flake-utils": "flake-utils",
+        "disko": "disko",
+        "flake-parts": "flake-parts",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "neovim-nightly-overlay": "neovim-nightly-overlay",
-        "nixpkgs": "nixpkgs_3",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "nvim": "nvim",
         "stylix": "stylix"
       }
     },
@@ -517,13 +552,13 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -531,11 +566,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1771788390,
-        "narHash": "sha256-RzBpBwn93GWxLjacTte+ngwwg0L/BVOg4G/sSIeK3Rw=",
+        "lastModified": 1774194089,
+        "narHash": "sha256-SCczWhr8y8aaXVHG+gOGcRahNb0BU1Z5zYZuv9W/nA8=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "ebb238f14d6f930068be4718472da3105fd5d3bf",
+        "rev": "7c34241d80ea64dd2039bb3a786fb66b4c6261d9",
         "type": "github"
       },
       "original": {
@@ -560,21 +595,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tinted-foot": {
       "flake": false,
       "locked": {

flake.nix

@@ -6,16 +6,14 @@
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    # dotfiles = {
-    #   url = "git+https://git.janezic.dev/janezicmatej/.dotfiles.git";
-    #   flake = false;
-    # };
-    # nvim = {
-    #   url = "git+https://git.janezic.dev/janezicmatej/nvim.git?ref=rewrite";
-    #   flake = false;
-    # };
+    nvim = {
+      url = "git+https://git.janezic.dev/janezicmatej/nvim.git";
+      flake = false;
+    };
 
-    flake-utils.url = "github:numtide/flake-utils";
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
+    flake-parts.url = "github:hercules-ci/flake-parts";
 
     home-manager = {
       url = "github:nix-community/home-manager/release-25.11";
@@ -38,100 +36,43 @@
     };
 
     neovim-nightly-overlay.url = "github:nix-community/neovim-nightly-overlay";
-    claude-code-overlay.url = "github:ryoppippi/claude-code-overlay";
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
   };
 
   outputs =
     inputs@{
+      flake-parts,
       nixpkgs,
-      flake-utils,
+      self,
       ...
     }:
-
-    let
-      my-lib = import ./lib { inherit (nixpkgs) lib; };
-
-      overlays = [
-        (_: prev: {
-          inherit
-            (
-              (import inputs.nixpkgs-unstable {
-                inherit (prev.stdenv.hostPlatform) system;
-                config.allowUnfree = true;
-              })
-            )
-            claude-code
-            ;
-        })
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [
+        ./flake/overlays.nix
+        ./flake/packages.nix
+        ./flake/devshell.nix
+        ./flake/hosts.nix
       ];
 
-      mkHost = my-lib.mkHost {
-        inherit
-          nixpkgs
-          overlays
-          inputs
-          ;
+      systems = [ "x86_64-linux" ];
+
+      perSystem =
+        { system, ... }:
+        {
+          _module.args.pkgs = import nixpkgs {
+            inherit system;
+            overlays = [ self.overlays.default ];
+            config.allowUnfree = true;
+          };
+        };
+
+      flake = {
+        lib = import ./lib { inherit (nixpkgs) lib; };
       };
-
-    in
-
-    {
-      lib = my-lib;
-
-      nixosConfigurations = {
-        matej-nixos = mkHost "matej-nixos" {
-          system = "x86_64-linux";
-          users = [ "matej" ];
-        };
-        matej-tower = mkHost "matej-tower" {
-          system = "x86_64-linux";
-          users = [ "matej" ];
-        };
-
-        # nixos-rebuild build-image --image-variant install-iso --flake .#live-iso
-        live-iso = mkHost "live-iso" {
-          system = "x86_64-linux";
-          users = [ ];
-        };
-
-        # nixos-rebuild build-image --image-variant qemu --flake .#sandbox
-        sandbox = mkHost "sandbox" {
-          system = "x86_64-linux";
-          users = [ "gorazd" ];
-        };
-      };
-
-      nixosModules = import ./modules/nixos {
-        inherit my-lib;
-        inherit (nixpkgs) lib;
-      } { };
-    }
-    // flake-utils.lib.eachDefaultSystem (
-      system:
-      let
-        pkgs = nixpkgs.legacyPackages.${system};
-      in
-      {
-        packages =
-          import ./packages
-            {
-              inherit my-lib;
-              inherit (nixpkgs) lib;
-            }
-            {
-              pkgs = nixpkgs.legacyPackages.${system};
-              pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
-              pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
-            };
-
-        formatter = pkgs.nixfmt-tree;
-
-        devShells.default = pkgs.mkShell {
-          packages = [
-            pkgs.pre-commit
-            pkgs.statix
-          ];
-        };
-      }
-    );
+    };
 }

flake/devshell.nix

@@ -0,0 +1,107 @@
+_: {
+  perSystem =
+    { pkgs, lib, ... }:
+    let
+      # libraries needed by python native extensions
+      pythonLibraries = [
+        pkgs.stdenv.cc.cc.lib
+        pkgs.zlib
+        pkgs.openssl
+        pkgs.curl
+      ];
+
+      mkUv = python: {
+        packages = [
+          python
+          pkgs.uv
+        ];
+        libraries = pythonLibraries;
+        env = {
+          UV_PYTHON_DOWNLOADS = "never";
+          UV_PYTHON_PREFERENCE = "only-system";
+          UV_PYTHON = "${python}/bin/python";
+        };
+        shellHook = ''
+          unset PYTHONPATH
+          export UV_PROJECT_ENVIRONMENT="$HOME/.venvs/$(basename "$PWD")-$(echo "$PWD" | md5sum | cut -c1-8)"
+        '';
+      };
+
+      # composable dev environment components
+      # each is exposed as its own devShell, layered via `use dev` in .envrc
+      components = {
+        uv_10 = mkUv pkgs.python310;
+        uv_11 = mkUv pkgs.python311;
+        uv_12 = mkUv pkgs.python312;
+        uv_13 = mkUv pkgs.python313;
+        uv_14 = mkUv pkgs.python314;
+
+        pg_15 = {
+          packages = [ pkgs.postgresql_15 ];
+        };
+        pg_16 = {
+          packages = [ pkgs.postgresql_16 ];
+        };
+        pg_17 = {
+          packages = [ pkgs.postgresql_17 ];
+        };
+        pg_18 = {
+          packages = [ pkgs.postgresql_18 ];
+        };
+
+        rust = {
+          packages = [
+            pkgs.rustc
+            pkgs.cargo
+            pkgs.rust-analyzer
+            pkgs.openssl
+            pkgs.pkg-config
+          ];
+        };
+
+        cmake = {
+          packages = [
+            pkgs.cmake
+            pkgs.ninja
+          ];
+        };
+      };
+
+      mkComponentShell =
+        component:
+        let
+          c = components.${component};
+          libraries = c.libraries or [ ];
+          libPath = lib.makeLibraryPath libraries;
+        in
+        pkgs.mkShell (
+          {
+            packages = c.packages or [ ];
+            shellHook =
+              (lib.optionalString (libraries != [ ]) ''
+                export LD_LIBRARY_PATH="${libPath}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+              '')
+              + (c.shellHook or "");
+          }
+          // lib.optionalAttrs (c ? env) { inherit (c) env; }
+        );
+
+      componentShells = lib.mapAttrs (name: _: mkComponentShell name) components;
+    in
+    {
+      formatter = pkgs.nixfmt-tree;
+
+      devShells = {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.pre-commit
+            pkgs.statix
+            pkgs.shellcheck
+            pkgs.shfmt
+            pkgs.qemu
+          ];
+        };
+      }
+      // componentShells;
+    };
+}

flake/hosts.nix

@@ -0,0 +1,105 @@
+{ inputs, self, ... }:
+
+let
+  inherit (inputs) nixpkgs;
+  my-lib = import ../lib { inherit (nixpkgs) lib; };
+
+  mkHost = my-lib.mkHost {
+    inherit nixpkgs inputs;
+    overlays = [ self.overlays.default ];
+  };
+in
+{
+  flake.nixosConfigurations = {
+    fw16 = mkHost "fw16" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "openssh"
+        "localisation"
+        "gnupg"
+        "shell"
+        "desktop"
+        "sway"
+        "greeter"
+        "printing"
+        "networkmanager"
+        "docker"
+        "tailscale"
+        "nix-ld"
+        "yubikey"
+        "calibre"
+        "steam"
+        "dev-registry"
+        "neovim"
+        "dev"
+        "claude"
+      ];
+    };
+
+    tower = mkHost "tower" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "openssh"
+        "localisation"
+        "gnupg"
+        "shell"
+        "desktop"
+        "sway"
+        "greeter"
+        "printing"
+        "networkmanager"
+        "docker"
+        "tailscale"
+        "nix-ld"
+        "yubikey"
+        "calibre"
+        "steam"
+        "initrd-ssh"
+        "dev-registry"
+        "neovim"
+        "dev"
+        "claude"
+      ];
+    };
+
+    # nixos-rebuild build-image --image-variant install-iso --flake .#iso
+    iso = mkHost "iso" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "openssh"
+      ];
+    };
+
+    # nix run github:nix-community/nixos-anywhere -- --flake .#floo root@<ip>
+    floo = mkHost "floo" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "openssh"
+        "localisation"
+        "shell"
+        "tailscale"
+      ];
+    };
+
+    ephvm = mkHost "ephvm" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "openssh"
+        "localisation"
+        "gnupg"
+        "shell"
+        "vm-guest"
+        "vm-9p-automount"
+        "docker"
+        "neovim"
+        "claude"
+        "dev"
+      ];
+    };
+  };
+}

flake/overlays.nix

@@ -0,0 +1,21 @@
+{ inputs, ... }:
+
+{
+  flake.overlays.default =
+    _: prev:
+    let
+      pkgs-unstable = import inputs.nixpkgs-unstable {
+        inherit (prev.stdenv.hostPlatform) system;
+        inherit (prev) config;
+      };
+      pkgs-master = import inputs.nixpkgs-master {
+        inherit (prev.stdenv.hostPlatform) system;
+        inherit (prev) config;
+      };
+    in
+    {
+      inherit (pkgs-master) claude-code;
+      # TODO:(@janezicmatej) 2026-03-09 error with stable for telegram-desktop
+      inherit (pkgs-unstable) telegram-desktop;
+    };
+}

flake/packages.nix

@@ -0,0 +1,22 @@
+{ inputs, ... }:
+
+let
+  my-lib = import ../lib { inherit (inputs.nixpkgs) lib; };
+in
+{
+  perSystem =
+    { pkgs, system, ... }:
+    {
+      packages =
+        import ../packages
+          {
+            inherit my-lib;
+            inherit (inputs.nixpkgs) lib;
+          }
+          {
+            inherit pkgs;
+            pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
+            pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
+          };
+    };
+}

hosts/ephvm/configuration.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+{
+  # no hardware firmware needed in a VM
+  hardware.enableRedistributableFirmware = lib.mkForce false;
+  hardware.wirelessRegulatoryDatabase = lib.mkForce false;
+
+  documentation.enable = false;
+  environment.defaultPackages = [ ];
+
+  # compressed qcow2, no channel copy
+  image.modules.qemu =
+    { config, modulesPath, ... }:
+    {
+      system.build.image = lib.mkForce (
+        import (modulesPath + "/../lib/make-disk-image.nix") {
+          inherit lib config pkgs;
+          inherit (config.virtualisation) diskSize;
+          inherit (config.image) baseName;
+          format = "qcow2-compressed";
+          copyChannel = false;
+          partitionTableType = "legacy";
+        }
+      );
+    };
+
+  vm-guest.headless = true;
+
+  vm-9p-automount.user = "matej";
+
+  localisation = {
+    timeZone = "UTC";
+    defaultLocale = "en_US.UTF-8";
+  };
+
+  home-manager.users.matej = {
+    neovim.dotfiles = inputs.nvim;
+  };
+
+  # ensure .config exists with correct ownership before automount
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
+
+  # writable claude config via 9p
+  fileSystems."/home/matej/.config/claude" = {
+    device = "claude";
+    fsType = "9p";
+    options = [
+      "trans=virtio"
+      "version=9p2000.L"
+      "nofail"
+      "x-systemd.automount"
+    ];
+  };
+
+  environment.sessionVariables.CLAUDE_CONFIG_DIR = "/home/matej/.config/claude";
+
+  system.stateVersion = "25.11";
+}

hosts/ephvm/hardware-configuration.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
@@ -8,11 +9,14 @@
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
+  virtualisation.diskSize = 30720; # 30G
+
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
     autoResize = true;
     fsType = "ext4";
   };
 
+  # image.modules (disk-image.nix) overrides boot loader per variant
   boot.loader.grub.device = lib.mkDefault "/dev/vda";
 }

hosts/floo/configuration.nix

@@ -0,0 +1,37 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  boot.loader.grub.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+
+  users.users.matej.hashedPassword = "$6$59Z5NIkOYZ3eSElX$FehMGGXQlC040G8eoO42JQDScb7hI04NbdVMAkKYKqVOLTO/.MJxfk8fHypQHrCdtAs67N1bnU2s5H/3zLWhC1";
+
+  localisation = {
+    timeZone = "Europe/Ljubljana";
+    defaultLocale = "en_US.UTF-8";
+  };
+
+  system.stateVersion = "25.11";
+}

hosts/floo/hardware-configuration.nix

@@ -0,0 +1,37 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/fw16/configuration.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  pkgs,
+  inputs,
+  options,
+  ...
+}:
+
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
+  ];
+
+  localisation = {
+    timeZone = "Europe/Ljubljana";
+    defaultLocale = "en_US.UTF-8";
+  };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
+
+  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
+
+  services.logind.settings.Login = {
+    HandleLidSwitch = "suspend-then-hibernate";
+    HandlePowerKey = "suspend-then-hibernate";
+    IdleAction = "suspend-then-hibernate";
+    IdleActionSec = "15min";
+  };
+
+  systemd.sleep.extraConfig = ''
+    HibernateDelaySec=30min
+  '';
+
+  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
+
+  services.gnome.gnome-keyring.enable = true;
+  services.teamviewer.enable = true;
+
+  services.hardware.bolt.enable = true;
+  hardware.keyboard.zsa.enable = true;
+  hardware.ledger.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+  hardware.inputmodule.enable = true;
+
+  # NOTE:(@janezicmatej) disable wakeup for framework input modules to prevent spurious wakes
+  services.udev.extraRules = lib.mkAfter ''
+    SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0012", ATTR{power/wakeup}="disabled"
+    SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0014", ATTR{power/wakeup}="disabled"
+  '';
+
+  networking.firewall.enable = false;
+
+  system.stateVersion = "24.11";
+}

hosts/fw16/hardware-configuration.nix

@@ -17,8 +17,10 @@
   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
-    "ahci"
+    "thunderbolt"
     "usbhid"
+    "uas"
+    "sd_mod"
   ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
@@ -33,7 +35,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7151-CE52";
+    device = "/dev/disk/by-uuid/42D9-FAFD";
     fsType = "vfat";
     options = [
       "fmask=0022"

hosts/iso/configuration.nix

@@ -0,0 +1,11 @@
+_: {
+  image.modules.iso-installer = {
+    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
+  };
+
+  # live iso: passwordless login and sudo
+  users.users.matej.initialHashedPassword = "";
+  security.sudo.wheelNeedsPassword = false;
+
+  system.stateVersion = "25.05";
+}

hosts/live-iso/configuration.nix

@@ -1,49 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-let
-  keys = import ../../users/matej/keys.nix;
-in
-{
-  imports = [
-    inputs.self.nixosModules.openssh
-  ];
-
-  openssh.enable = true;
-
-  image.modules.iso-installer = {
-    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
-  };
-
-  fileSystems."/" = lib.mkDefault {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  boot.loader.grub.device = lib.mkDefault "/dev/sda";
-
-  networking.firewall.allowedTCPPorts = [ 22 ];
-
-  users = {
-    groups.matej = {
-      gid = 1000;
-    };
-    users.matej = {
-      group = "matej";
-      uid = 1000;
-      isNormalUser = true;
-      home = "/home/matej";
-      createHome = true;
-      password = "burek123";
-      extraGroups = [
-        "wheel"
-        "users"
-      ];
-      openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
-    };
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/matej-nixos/configuration.nix

@@ -1,124 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  options,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  imports = [
-    inputs.stylix.nixosModules.stylix
-    inputs.self.nixosModules.yubikey
-    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.nvidia
-    inputs.self.nixosModules.initrd-ssh
-    inputs.self.nixosModules.localisation
-  ];
-
-  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
-
-  sway = {
-    enable = true;
-    cmdFlags = [ "--unsupported-gpu" ];
-  };
-
-  nvidia.enable = true;
-
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-    ip = {
-      enable = true;
-      address = "10.222.0.247";
-      gateway = "10.222.0.1";
-      interface = "enp5s0";
-    };
-  };
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  localisation = {
-    enable = true;
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  # WARN:(@janezicmatej) nix-ld for running pip-installed binaries outside nix, probably want to drop this
-  programs.nix-ld.enable = true;
-  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
-
-  security.pki.certificateFiles = [ packages.ca-matheo-si ];
-  services.gnome.gnome-keyring.enable = true;
-
-  services.teamviewer.enable = true;
-
-  programs.thunderbird.enable = true;
-  programs._1password.enable = true;
-  programs._1password-gui.enable = true;
-  programs.firefox.enable = true;
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-    localNetworkGameTransfers.openFirewall = true;
-  };
-
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
-  hardware.bluetooth.powerOnBoot = true;
-
-  networking = {
-    hostName = "matej-nixos";
-    useDHCP = false;
-    networkmanager.enable = true;
-    interfaces.enp5s0.ipv4.addresses = [
-      {
-        address = "10.222.0.247";
-        prefixLength = 24;
-      }
-    ];
-    firewall.enable = false;
-    defaultGateway = "10.222.0.1";
-    nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-  };
-
-  xdg.mime.defaultApplications = {
-    "application/pdf" = "org.pwmt.zathura.desktop";
-  };
-
-  system.stateVersion = "24.11";
-}

hosts/matej-tower/configuration.nix

@@ -1,91 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  options,
-  ...
-}:
-
-{
-  networking.hostName = "matej-tower";
-  imports = [
-    inputs.stylix.nixosModules.stylix
-    inputs.lanzaboote.nixosModules.lanzaboote
-
-    inputs.self.nixosModules.yubikey
-    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.initrd-ssh
-    inputs.self.nixosModules.localisation
-  ];
-
-  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
-  sway.enable = true;
-
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-  };
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-  };
-
-  # lanzaboote secure boot
-  boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
-  localisation = {
-    enable = true;
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  services.udisks2.enable = true;
-
-  programs._1password.enable = true;
-  programs._1password-gui.enable = true;
-
-  # higher sample rate for audio equipment
-  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
-    "context.properties" = {
-      "default.clock.rate" = 192000;
-      "default.allowed-rates" = [ 192000 ];
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    easyeffects
-  ];
-
-  xdg.mime.defaultApplications = {
-    "application/pdf" = "org.pwmt.zathura.desktop";
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/sandbox/configuration.nix

@@ -1,132 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    inputs.self.nixosModules.vm-guest
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.zsh
-  ];
-
-  vm-guest.enable = true;
-  desktop.enable = true;
-  zsh.enable = true;
-
-  programs.labwc.enable = true;
-
-  # labwc stacking compositor with auto-login
-  services.greetd =
-    let
-      labwc-session = pkgs.writeShellScript "labwc-session" ''
-        export XDG_SESSION_TYPE=wayland
-        export XDG_CURRENT_DESKTOP=labwc:wlroots
-        # software renderer for qemu virtio-vga
-        export WLR_RENDERER=pixman
-        export WLR_DRM_NO_ATOMIC=1
-        exec ${pkgs.labwc}/bin/labwc
-      '';
-    in
-    {
-      enable = true;
-      settings = {
-        default_session = {
-          command = labwc-session;
-          user = "gorazd";
-        };
-        initial_session = {
-          command = labwc-session;
-          user = "gorazd";
-        };
-      };
-    };
-
-  users = {
-    groups.gorazd = {
-      gid = 1000;
-    };
-    users.gorazd = {
-      group = "gorazd";
-      uid = 1000;
-      isNormalUser = true;
-      home = "/home/gorazd";
-      createHome = true;
-      password = "sandbox";
-      extraGroups = [
-        "wheel"
-        "users"
-      ];
-    };
-  };
-
-  # 9p mounts for host files
-  fileSystems."/home/gorazd/projects" = {
-    device = "projects";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-    ];
-  };
-
-  fileSystems."/mnt/host-claude" = {
-    device = "hostclaude";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-    ];
-  };
-
-  fileSystems."/mnt/host-home" = {
-    device = "hosthome";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-      "ro"
-    ];
-  };
-
-  # pre-auth claude-code from host config
-  systemd.services.claude-auth = {
-    description = "Copy claude-code credentials from host mount";
-    after = [
-      "mnt-host\\x2dclaude.mount"
-      "mnt-host\\x2dhome.mount"
-    ];
-    requires = [
-      "mnt-host\\x2dclaude.mount"
-      "mnt-host\\x2dhome.mount"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "claude-auth" ''
-        mkdir -p /home/gorazd/.claude
-        cp -a /mnt/host-claude/. /home/gorazd/.claude/
-        cp /mnt/host-home/.claude.json /home/gorazd/.claude.json || true
-        chown -R gorazd:gorazd /home/gorazd/.claude /home/gorazd/.claude.json
-      '';
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    claude-code
-    labwc
-    sfwbar
-    foot
-    firefox
-  ];
-
-  system.stateVersion = "25.11";
-}

hosts/tower/configuration.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  inputs,
+  userKeys,
+  ...
+}:
+
+{
+  imports = [
+    inputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  localisation = {
+    timeZone = "Europe/Ljubljana";
+    defaultLocale = "en_US.UTF-8";
+  };
+
+  initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };
+
+  # lanzaboote secure boot
+  boot.kernelParams = [ "btusb.reset=1" ];
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  services.udisks2.enable = true;
+
+  # higher sample rate for audio equipment
+  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
+    "context.properties" = {
+      "default.clock.rate" = 192000;
+      "default.allowed-rates" = [ 192000 ];
+    };
+  };
+
+  system.stateVersion = "25.05";
+}

justfile

@@ -3,8 +3,8 @@ default:
     @just --list
 
 # rebuild and switch
-switch:
-    nixos-rebuild switch --flake . --sudo
+switch config="":
+    nixos-rebuild switch --flake .{{ if config != "" { "#" + config } else { "" } }} --sudo
 
 # fetch flake inputs
 sync:
@@ -17,44 +17,38 @@ update:
 # update flake inputs, rebuild and switch
 bump: update switch
 
+# update a package to latest version
+update-package pkg:
+    bash packages/{{pkg}}/update.sh
+
+# update all packages with update scripts
+update-package-all:
+    @for script in packages/*/update.sh; do bash "$script"; done
+
+# build all packages and hosts
+build:
+    nix flake check
+
 # build installation iso
 iso:
-    nixos-rebuild build-image --image-variant iso-installer --flake .#live-iso
+    nixos-rebuild build-image --image-variant iso-installer --flake .#iso
+
+# run ephemeral VM
+ephvm *ARGS:
+    bash scripts/ephvm-run.sh {{ARGS}}
+
+# ssh into running ephemeral VM
+ephvm-ssh port="2222":
+    ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost
+
+# provision a host with nixos-anywhere
+provision host ip:
+    nix run github:nix-community/nixos-anywhere -- --flake .#{{host}} --generate-hardware-config nixos-generate-config ./hosts/{{host}}/hardware-configuration.nix root@{{ip}}
+
+# deploy config to a remote host
+deploy host remote=host:
+    nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
 
 # garbage collect old generations
 clean:
     sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
-
-# build sandbox VM image
-sandbox-build:
-    nixos-rebuild build-image --image-variant qemu --flake .#sandbox
-
-# run sandbox with GUI (ephemeral, changes discarded)
-sandbox-run:
-    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
-      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
-      -vga virtio -display gtk,zoom-to-fit=false \
-      -device virtio-serial-pci \
-      -chardev qemu-vdagent,id=ch1,name=vdagent,clipboard=on \
-      -device virtserialport,chardev=ch1,id=ch1,name=com.redhat.spice.0 \
-      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
-      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
-      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
-      -nic user,hostfwd=tcp::2222-:22
-
-# run sandbox headless (ephemeral, changes discarded)
-sandbox-run-headless:
-    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
-      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
-      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
-      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
-      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
-      -nic user,hostfwd=tcp::2222-:22 -nographic
-
-# ssh into running sandbox
-sandbox-ssh:
-    ssh -A -p 2222 gorazd@localhost
-
-# hot-mount a host directory into the running sandbox
-sandbox-mount path:
-    ssh -p 2222 gorazd@localhost "mkdir -p ~/mnt/$(basename {{path}}) && sshfs matej@10.0.2.2:{{path}} ~/mnt/$(basename {{path}})"

lib/autoDir.nix

@@ -1,15 +1,21 @@
 lib:
 
-# import all .nix files in dir as attribute set
+# auto-discover nix modules from a directory
+# - flat .nix files (excluding default.nix) are imported directly
+# - subdirectories containing package.nix are imported via package.nix
 dir:
 let
   readDir = builtins.readDir dir;
-  files = lib.attrNames (
-    lib.filterAttrs (
-      name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix"
-    ) readDir
-  );
 
-  packages = builtins.map (name: lib.removeSuffix ".nix" name) files;
+  files = lib.filterAttrs (
+    name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix"
+  ) readDir;
+
+  dirs = lib.filterAttrs (
+    name: type: type == "directory" && builtins.pathExists (dir + "/${name}/package.nix")
+  ) readDir;
 in
-lib.genAttrs packages (name: import (dir + "/${name}.nix"))
+lib.mapAttrs' (
+  name: _: lib.nameValuePair (lib.removeSuffix ".nix" name) (import (dir + "/${name}"))
+) files
+// lib.mapAttrs (name: _: import (dir + "/${name}/package.nix")) dirs

lib/mkHost.nix

@@ -7,20 +7,48 @@
 name:
 {
   system,
-  users ? [ ],
+  user ? null,
+  features ? [ ],
 }:
 
 let
+  inherit (nixpkgs) lib;
+  hasUser = user != null;
+
+  # path helpers
+  featurePath = f: ../features/${f}.nix;
+  userFeaturePath = u: ../features/user-${u}.nix;
   hostConfig = ../hosts/${name}/configuration.nix;
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
-  hasHWConfig = builtins.pathExists hostHWConfig;
 
-  userNixosConfigs = map (user: ../users/${user}/nixos.nix) (
-    builtins.filter (user: builtins.pathExists ../users/${user}/nixos.nix) users
-  );
+  # load feature with path check
+  loadFeature =
+    f:
+    assert
+      builtins.pathExists (featurePath f)
+      || throw "feature '${f}' not found at ${toString (featurePath f)}";
+    import (featurePath f);
 
-  userHMConfigs = nixpkgs.lib.genAttrs users (user: import ../users/${user}/home-manager.nix);
+  loadedFeatures = map loadFeature features;
 
+  # load user feature with path check
+  userFeature =
+    if hasUser then
+      assert
+        builtins.pathExists (userFeaturePath user)
+        || throw "user feature 'user-${user}' not found at ${toString (userFeaturePath user)}";
+      import (userFeaturePath user)
+    else
+      null;
+
+  allFeatures = loadedFeatures ++ lib.optional (userFeature != null) userFeature;
+
+  # extract keys from user feature for specialArgs
+  userKeys = if userFeature != null then (userFeature.keys or { }) else { };
+
+  # collect nixos and home modules from all features
+  nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
+  homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
 in
 nixpkgs.lib.nixosSystem {
   inherit system;
@@ -29,20 +57,23 @@ nixpkgs.lib.nixosSystem {
 
     { nixpkgs.overlays = overlays; }
     { nixpkgs.config.allowUnfree = true; }
+    { networking.hostName = name; }
 
     hostConfig
   ]
-  ++ nixpkgs.lib.optional hasHWConfig hostHWConfig
-  ++ userNixosConfigs
-  ++ [
+  ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
+  ++ nixosMods
+  ++ lib.optionals hasUser [
     inputs.home-manager.nixosModules.home-manager
     {
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
       home-manager.backupFileExtension = "backup";
-      home-manager.users = userHMConfigs;
+      home-manager.users.${user}.imports = homeMods;
       home-manager.extraSpecialArgs = { inherit inputs; };
     }
   ];
-  specialArgs = { inherit inputs; };
+  specialArgs = {
+    inherit inputs userKeys user;
+  };
 }

modules/nixos/default.nix

@@ -1 +0,0 @@
-{ lib, my-lib }: args: (my-lib.autoDir ./.)

modules/nixos/desktop.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    desktop = {
-      enable = lib.mkEnableOption "base desktop environment";
-    };
-  };
-
-  config = lib.mkIf config.desktop.enable {
-    services.pipewire = {
-      enable = true;
-      pulse.enable = true;
-    };
-
-    hardware.bluetooth.enable = true;
-    services.blueman.enable = true;
-
-    security.polkit.enable = true;
-
-    services.dbus.enable = true;
-
-    services.playerctld.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      xdgOpenUsePortal = true;
-      extraPortals = [
-        pkgs.xdg-desktop-portal-wlr
-        pkgs.xdg-desktop-portal-gtk
-      ];
-    };
-
-    fonts.packages = with pkgs; [
-      font-awesome
-      nerd-fonts.jetbrains-mono
-      maple-mono.NF
-    ];
-  };
-}

modules/nixos/gnupg.nix

@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    gnupg = {
-      enable = lib.mkEnableOption "GnuPG agent with SSH support";
-    };
-  };
-
-  config = lib.mkIf config.gnupg.enable {
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableExtraSocket = true;
-    };
-  };
-}

modules/nixos/initrd-ssh.nix

@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  # TODO:(@janezicmatej) restructure keys import
-  keys = import ../../users/matej/keys.nix;
-
-  # generate host keys for new machines: ./scripts/initrd-ssh-keygen.sh
-  keyDir = "/etc/secrets/initrd";
-
-  mkIpString =
-    {
-      address,
-      gateway,
-      netmask,
-      interface,
-      ...
-    }:
-    "${address}::${gateway}:${netmask}::${interface}:none";
-in
-{
-  options = {
-    initrd-ssh = {
-      enable = lib.mkEnableOption "SSH in initrd for remote LUKS unlock";
-
-      ip = {
-        enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-        address = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.247";
-        };
-
-        gateway = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.1";
-        };
-
-        netmask = lib.mkOption {
-          type = lib.types.str;
-          default = "255.255.255.0";
-        };
-
-        interface = lib.mkOption {
-          type = lib.types.str;
-          example = "enp5s0";
-        };
-      };
-
-      authorizedKeys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = keys.sshAuthorizedKeys;
-      };
-
-      networkModule = lib.mkOption {
-        type = lib.types.str;
-        example = "r8169";
-      };
-    };
-  };
-
-  config = lib.mkIf config.initrd-ssh.enable {
-    boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-    boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-      "ip=${mkIpString config.initrd-ssh.ip}"
-    ];
-
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 22;
-        hostKeys = [
-          "${keyDir}/ssh_host_rsa_key"
-          "${keyDir}/ssh_host_ed25519_key"
-        ];
-        inherit (config.initrd-ssh) authorizedKeys;
-      };
-      postCommands = ''
-        echo 'cryptsetup-askpass' >> /root/.profile
-      '';
-    };
-  };
-}

modules/nixos/localisation.nix

@@ -1,28 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    localisation = {
-      enable = lib.mkEnableOption "localisation defaults";
-
-      timeZone = lib.mkOption {
-        type = lib.types.str;
-      };
-
-      defaultLocale = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-
-  config = lib.mkIf config.localisation.enable {
-    time.timeZone = config.localisation.timeZone;
-    i18n.defaultLocale = config.localisation.defaultLocale;
-
-    # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
-    environment.variables.TZ = config.localisation.timeZone;
-  };
-}

modules/nixos/nvidia.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    nvidia.enable = lib.mkEnableOption "NVIDIA GPU support";
-  };
-
-  config = lib.mkIf config.nvidia.enable {
-    hardware.graphics.enable = true;
-
-    services.xserver.videoDrivers = [ "nvidia" ];
-
-    hardware.nvidia = {
-      modesetting.enable = true;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
-}

modules/nixos/openssh.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    openssh = {
-      enable = lib.mkEnableOption "hardened SSH server";
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 22;
-      };
-    };
-  };
-
-  config = lib.mkIf config.openssh.enable {
-    services.openssh = {
-      enable = true;
-      ports = [ config.openssh.port ];
-      settings = {
-        PasswordAuthentication = false;
-        AllowUsers = null;
-        PermitRootLogin = "no";
-        StreamLocalBindUnlink = "yes";
-      };
-    };
-  };
-}

modules/nixos/printing.nix

@@ -1,21 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    printing = {
-      enable = lib.mkEnableOption "CUPS printing with Avahi discovery";
-    };
-  };
-
-  config = lib.mkIf config.printing.enable {
-    services.printing.enable = true;
-    services.avahi = {
-      enable = true;
-      nssmdns4 = true;
-      openFirewall = true;
-    };
-  };
-}

modules/nixos/sway.nix

@@ -1,51 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    sway = {
-      enable = lib.mkEnableOption "enable sway module";
-      cmdFlags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-      };
-    };
-  };
-
-  config = lib.mkIf config.sway.enable {
-    programs.sway = {
-      enable = true;
-      package = pkgs.swayfx;
-      wrapperFeatures.gtk = true;
-      extraOptions = config.sway.cmdFlags;
-      extraSessionCommands = ''
-        # fix for java awt apps not rendering
-        export _JAVA_AWT_WM_NONREPARENTING=1
-      '';
-    };
-
-    environment.systemPackages = with pkgs; [
-      brightnessctl
-      foot
-      grim
-      pulseaudio
-      swayidle
-      # use swaylock-effects instead of swaylock
-      swaylock-effects
-      wmenu
-      slurp
-      wofi
-      wl-clipboard
-      wob
-      pamixer
-      wlsunset
-      flameshot
-      waybar
-      wayland-pipewire-idle-inhibit
-    ];
-  };
-}

modules/nixos/tuigreet.nix

@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    tuigreet = {
-      enable = lib.mkEnableOption "greetd with tuigreet";
-
-      command = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-
-  config = lib.mkIf config.tuigreet.enable {
-    services.greetd = {
-      enable = true;
-      useTextGreeter = true;
-      settings = {
-        default_session = {
-          command = pkgs.writeShellScript "tuigreet-session" ''
-            ${pkgs.util-linux}/bin/setterm --blank 1 --powersave powerdown --powerdown 1
-            exec ${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd ${config.tuigreet.command}
-          '';
-          user = "greeter";
-        };
-      };
-    };
-  };
-}

modules/nixos/vm-guest.nix

@@ -1,55 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    vm-guest = {
-      enable = lib.mkEnableOption "VM guest configuration";
-    };
-  };
-
-  config = lib.mkIf config.vm-guest.enable {
-    services.qemuGuest.enable = true;
-    services.spice-vdagentd.enable = true;
-
-    # 9p for host file mounting
-    boot.initrd.availableKernelModules = [
-      "9p"
-      "9pnet_virtio"
-    ];
-    boot.kernelModules = [
-      "9p"
-      "9pnet_virtio"
-    ];
-
-    # ssh with agent forwarding for git and hot-mount
-    services.openssh = {
-      enable = true;
-      ports = [ 22 ];
-      settings = {
-        PasswordAuthentication = true;
-        PermitRootLogin = "no";
-        AllowAgentForwarding = true;
-        StreamLocalBindUnlink = "yes";
-      };
-    };
-
-    networking = {
-      useDHCP = true;
-      firewall.allowedTCPPorts = [ 22 ];
-    };
-
-    security.sudo.wheelNeedsPassword = false;
-
-    environment.systemPackages = with pkgs; [
-      curl
-      wget
-      htop
-      sshfs
-    ];
-  };
-}

modules/nixos/workstation.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    workstation = {
-      enable = lib.mkEnableOption "workstation utilities";
-    };
-  };
-
-  config = lib.mkIf config.workstation.enable {
-    virtualisation.docker = {
-      enable = true;
-      logDriver = "json-file";
-    };
-
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    environment.systemPackages = with pkgs; [
-      smartmontools
-    ];
-  };
-}

modules/nixos/yubikey.nix

@@ -1,23 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    yubikey = {
-      enable = lib.mkEnableOption "enable yubikey module";
-    };
-  };
-
-  config = lib.mkIf config.yubikey.enable {
-    environment.systemPackages = with pkgs; [
-      yubikey-personalization
-      yubikey-manager
-    ];
-
-    services.pcscd.enable = true;
-  };
-}

modules/nixos/zsh.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    zsh = {
-      enable = lib.mkEnableOption "zsh with ZDOTDIR in ~/.config/zsh";
-    };
-  };
-
-  config = lib.mkIf config.zsh.enable {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-}

packages/ahab.nix

@@ -1,28 +0,0 @@
-{ pkgs, ... }:
-
-let
-  version = "v0.4.1";
-in
-pkgs.rustPlatform.buildRustPackage {
-  pname = "ahab";
-  inherit version;
-
-  src = pkgs.fetchFromGitea {
-    domain = "git.janezic.dev";
-    owner = "janezicmatej";
-    repo = "ahab";
-    rev = version;
-    sha256 = "sha256-Y8UqZOskSlt8GrYem97yKXNbGkd6Ab7WRynKEA9w16E=";
-  };
-
-  cargoHash = "sha256-T5r+Og3+mHMsqCFGi+QzHdN2MgvPxzA/R+xu38I+lcg=";
-
-  buildType = "debug";
-
-  meta = {
-    description = "ahab";
-    homepage = "https://git.janezic.dev/janezicmatej/ahab";
-    license = pkgs.lib.licenses.mit;
-    maintainers = [ ];
-  };
-}

packages/ahab/package.nix

@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+
+let
+  version = "v0.4.2";
+in
+pkgs.rustPlatform.buildRustPackage {
+  pname = "ahab";
+  inherit version;
+
+  src = pkgs.fetchFromGitea {
+    domain = "git.janezic.dev";
+    owner = "janezicmatej";
+    repo = "ahab";
+    rev = version;
+    sha256 = "sha256-hJg6vRaqTu9a3fua2J/e6akdJQffAk6TBAzJRBD5qHQ=";
+  };
+
+  cargoHash = "sha256-T/2+kxa5X2fmMQs023JN9ZDihExfYvPnunJ8b2Irwoo=";
+
+  buildType = "debug";
+
+  nativeBuildInputs = [ pkgs.installShellFiles ];
+
+  preBuild = ''
+    mkdir -p completions
+  '';
+
+  SHELL_COMPLETIONS_DIR = "completions";
+
+  postInstall = ''
+    installShellCompletion --bash completions/ahab.bash
+    installShellCompletion --zsh completions/_ahab
+    installShellCompletion --fish completions/ahab.fish
+  '';
+
+  meta = {
+    description = "ahab";
+    homepage = "https://git.janezic.dev/janezicmatej/ahab";
+    license = pkgs.lib.licenses.mit;
+    maintainers = [ ];
+  };
+}

packages/ahab/update.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+	sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+main() {
+	echo "fetching latest version..."
+	local latest current
+	latest=$(curl -sf "https://git.janezic.dev/api/v1/repos/janezicmatej/ahab/tags?limit=1" | jq -r '.[0].name')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "ahab already at $latest"
+		return 0
+	fi
+
+	echo "updating ahab: $current -> $latest"
+
+	echo "  prefetching source..."
+	local base32 src_hash
+	base32=$(nix-prefetch-url --unpack "https://git.janezic.dev/janezicmatej/ahab/archive/${latest}.tar.gz" 2>/dev/null)
+	src_hash=$(nix hash convert --to sri "sha256:$base32")
+	echo "  source: $src_hash"
+
+	echo "  computing cargo hash..."
+	local build_output cargo_hash
+	build_output=$(nix build --no-link --impure --expr "
+    let
+      pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+    in pkgs.rustPlatform.fetchCargoVendor {
+      src = pkgs.fetchFromGitea {
+        domain = \"git.janezic.dev\";
+        owner = \"janezicmatej\";
+        repo = \"ahab\";
+        rev = \"$latest\";
+        hash = \"$src_hash\";
+      };
+      hash = \"\";
+    }
+  " 2>&1) || true
+	cargo_hash=$(echo "$build_output" | extract_hash) || true
+
+	if [[ -z "$cargo_hash" ]]; then
+		echo "error: failed to compute cargo hash" >&2
+		echo "$build_output" >&2
+		exit 1
+	fi
+	echo "  cargo: $cargo_hash"
+
+	local old_src old_cargo
+	old_src=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+	old_cargo=$(grep 'cargoHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+	sed -i "s|$old_src|$src_hash|" "$PKG_FILE"
+	sed -i "s|$old_cargo|$cargo_hash|" "$PKG_FILE"
+
+	echo "ahab updated to $latest"
+}
+
+main "$@"

packages/ggman/package.nix

@@ -2,7 +2,7 @@
 
 let
   pkgs = pkgs-master;
-  version = "e24855c";
+  version = "v1.27.1";
 in
 pkgs.buildGoModule.override
   {
@@ -16,16 +16,25 @@ pkgs.buildGoModule.override
       owner = "tkw1536";
       repo = "ggman";
       rev = version;
-      sha256 = "sha256-H78xtF7l5joX3/qDFaRIT4LyZpHmm6DMR4JIKzNO7c0=";
+      sha256 = "sha256-z7zqV69rPYwtkm4ieF+FIssBsFbREvaYQzSF648DHK0=";
     };
 
-    vendorHash = "sha256-w8NrOt0xtn+/gugJ4amzdJP70Y5KHe5DlhsEprycm3U=";
+    vendorHash = "sha256-5c5EgYjZXfexWMrUDS4fo46GCJBmFuWkw0cVqqGT7Ik=";
     subPackages = [ "cmd/ggman" ];
 
     ldflags = [
       "-X go.tkw01536.de/ggman.buildVersion=${version}"
     ];
 
+    nativeBuildInputs = [ pkgs.installShellFiles ];
+
+    postInstall = ''
+      installShellCompletion --cmd ggman \
+        --bash <($out/bin/ggman completion bash) \
+        --zsh <($out/bin/ggman completion zsh) \
+        --fish <($out/bin/ggman completion fish)
+    '';
+
     meta = {
       description = "Manager for all your local git repositories";
       homepage = "https://github.com/tkw1536/ggman";

packages/ggman/update.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+	sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+main() {
+	echo "fetching latest tag..."
+	local latest current
+	latest=$(curl -sf "https://api.github.com/repos/tkw1536/ggman/tags?per_page=1" | jq -r '.[0].name')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "ggman already at $latest"
+		return 0
+	fi
+
+	echo "updating ggman: $current -> $latest"
+
+	echo "  prefetching source..."
+	local base32 src_hash
+	base32=$(nix-prefetch-url --unpack "https://github.com/tkw1536/ggman/archive/${latest}.tar.gz" 2>/dev/null)
+	src_hash=$(nix hash convert --to sri "sha256:$base32")
+	echo "  source: $src_hash"
+
+	echo "  computing vendor hash..."
+	local build_output vendor_hash
+	build_output=$(nix build --no-link --impure --expr "
+    let
+      pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs-master.legacyPackages.\${builtins.currentSystem};
+    in (pkgs.buildGoModule.override { go = pkgs.go_1_26; } {
+      pname = \"ggman\";
+      version = \"$latest\";
+      src = pkgs.fetchFromGitHub {
+        owner = \"tkw1536\";
+        repo = \"ggman\";
+        rev = \"$latest\";
+        hash = \"$src_hash\";
+      };
+      vendorHash = \"\";
+    }).goModules
+  " 2>&1) || true
+	vendor_hash=$(echo "$build_output" | extract_hash) || true
+
+	if [[ -z "$vendor_hash" ]]; then
+		echo "error: failed to compute vendor hash" >&2
+		echo "$build_output" >&2
+		exit 1
+	fi
+	echo "  vendor: $vendor_hash"
+
+	local old_src old_vendor
+	old_src=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+	old_vendor=$(grep 'vendorHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+	sed -i "s|$old_src|$src_hash|" "$PKG_FILE"
+	sed -i "s|$old_vendor|$vendor_hash|" "$PKG_FILE"
+
+	echo "ggman updated to $latest"
+}
+
+main "$@"

packages/todo-mcp.nix

@@ -1,39 +0,0 @@
-{ pkgs, ... }:
-
-let
-  version = "v0.2.1";
-in
-pkgs.rustPlatform.buildRustPackage {
-  pname = "todo-mcp";
-  inherit version;
-
-  src = pkgs.fetchFromGitea {
-    domain = "git.janezic.dev";
-    owner = "janezicmatej";
-    repo = "todo-mcp";
-    rev = version;
-    sha256 = "sha256-BBL7PAgTdGR/+vEJmot8c8mgw5vq5Y/szud0YEiR1UY=";
-  };
-
-  cargoHash = "sha256-uAyD7Tj9qctDXQ5NkR6T/aItxRmd5WqIXr7NeOlCl8M=";
-
-  nativeBuildInputs = [ pkgs.installShellFiles ];
-
-  preBuild = ''
-    mkdir -p completions
-  '';
-
-  SHELL_COMPLETIONS_DIR = "completions";
-
-  postInstall = ''
-    installShellCompletion --bash completions/todo-mcp.bash
-    installShellCompletion --zsh completions/_todo-mcp
-    installShellCompletion --fish completions/todo-mcp.fish
-  '';
-
-  meta = {
-    description = "simple todo cli with mcp server for ai integration";
-    homepage = "https://git.janezic.dev/janezicmatej/todo-mcp";
-    maintainers = [ ];
-  };
-}

scripts/ephvm-run.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+setup_colors() {
+	if [ -t 2 ]; then
+		red=$'\033[31m'
+		yellow=$'\033[33m'
+		cyan=$'\033[36m'
+		reset=$'\033[0m'
+	else
+		red="" yellow="" cyan="" reset=""
+	fi
+}
+
+die() {
+	echo "${red}error:${reset} $*" >&2
+	exit 1
+}
+
+warn() {
+	echo "${yellow}warning:${reset} $*" >&2
+}
+
+info() {
+	echo "${cyan}$*${reset}" >&2
+}
+
+# globals for cleanup trap
+CLEANUP_OVERLAY=""
+cleanup() {
+	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	return 0
+}
+trap cleanup EXIT
+
+usage() {
+	cat <<EOF
+Usage: ephvm-run.sh [options]
+
+Options:
+  --mount <path>       Mount host directory into VM (repeatable)
+  --claude             Mount claude config dir (requires CLAUDE_CONFIG_DIR)
+  --disk-size <size>   Resize guest disk (e.g. 50G)
+  --memory <size>      VM memory (default: 8G)
+  --cpus <n>           VM CPUs (default: 4)
+  --ssh-port <port>    SSH port forward (default: 2222)
+  -h, --help           Show usage
+EOF
+	exit "${1:-0}"
+}
+
+main() {
+	setup_colors
+
+	local ssh_port=2222 memory=8G cpus=4 claude=false disk_size=""
+	local -a mounts=()
+
+	while [ $# -gt 0 ]; do
+		case "$1" in
+		--mount)
+			mounts+=("$2")
+			shift 2
+			;;
+		--claude)
+			claude=true
+			shift
+			;;
+		--disk-size)
+			disk_size="$2"
+			shift 2
+			;;
+		--memory)
+			memory="$2"
+			shift 2
+			;;
+		--cpus)
+			cpus="$2"
+			shift 2
+			;;
+		--ssh-port)
+			ssh_port="$2"
+			shift 2
+			;;
+		-h | --help) usage ;;
+		*)
+			echo "${red}error:${reset} unknown option: $1" >&2
+			usage 1
+			;;
+		esac
+	done
+
+	info "building ephvm image..."
+	local image_dir image
+	image_dir=$(nix build --no-link --print-out-paths .#nixosConfigurations.ephvm.config.system.build.images.qemu)
+	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
+	[ -n "$image" ] || die "no qcow2 image found in $image_dir"
+
+	# create resized overlay when --disk-size is given
+	local drive_arg
+	if [ -n "$disk_size" ]; then
+		CLEANUP_OVERLAY=$(mktemp -d)
+		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
+		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
+		drive_arg="file=$overlay,format=qcow2"
+	else
+		drive_arg="file=$image,format=qcow2,snapshot=on"
+	fi
+
+	local accel="tcg"
+	[ -r /dev/kvm ] && accel="kvm"
+
+	local -a qemu_args=(
+		qemu-system-x86_64
+		-accel "$accel"
+		-m "$memory"
+		-smp "$cpus"
+		-drive "$drive_arg"
+		-nic "user,hostfwd=tcp::${ssh_port}-:22"
+		-nographic
+	)
+
+	if [ "$accel" != "tcg" ]; then
+		qemu_args+=(-cpu host)
+	fi
+
+	local fs_id=0 mount_path name tag
+	for mount_path in "${mounts[@]}"; do
+		mount_path=$(realpath "$mount_path")
+		name=$(basename "$mount_path")
+		tag="m_${name:0:29}"
+		qemu_args+=(
+			-virtfs "local,path=$mount_path,mount_tag=$tag,security_model=none,id=fs${fs_id}"
+		)
+		fs_id=$((fs_id + 1))
+	done
+
+	if [ "$claude" = true ]; then
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "--claude requires CLAUDE_CONFIG_DIR to be set"
+		mkdir -p "$CLAUDE_CONFIG_DIR"
+		local claude_dir
+		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+
+		qemu_args+=(
+			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
+		)
+		fs_id=$((fs_id + 1))
+	fi
+
+	info "---"
+	info "Accel: $accel | SSH: ssh -p $ssh_port matej@localhost"
+	info "---"
+
+	exec "${qemu_args[@]}"
+}
+
+main "$@"

scripts/initrd-ssh-keygen.sh

@@ -3,22 +3,22 @@ set -euo pipefail
 
 KEY_DIR="/etc/secrets/initrd"
 
-echo "Generating initrd SSH host keys in $KEY_DIR"
+main() {
+	echo "generating initrd SSH host keys in $KEY_DIR"
+	sudo mkdir -p "$KEY_DIR"
 
-sudo mkdir -p "$KEY_DIR"
+	local key_type
+	for key_type in rsa ed25519; do
+		local key_file="$KEY_DIR/ssh_host_${key_type}_key"
+		if [[ ! -f "$key_file" ]]; then
+			sudo ssh-keygen -t "$key_type" -N "" -f "$key_file"
+			echo "generated: $key_file"
+		else
+			echo "exists: $key_file"
+		fi
+	done
 
-if [[ ! -f "$KEY_DIR/ssh_host_rsa_key" ]]; then
-  sudo ssh-keygen -t rsa -N "" -f "$KEY_DIR/ssh_host_rsa_key"
-  echo "Generated: $KEY_DIR/ssh_host_rsa_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_rsa_key"
-fi
+	echo "done. now run nixos-rebuild."
+}
 
-if [[ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]]; then
-  sudo ssh-keygen -t ed25519 -N "" -f "$KEY_DIR/ssh_host_ed25519_key"
-  echo "Generated: $KEY_DIR/ssh_host_ed25519_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_ed25519_key"
-fi
-
-echo "Done. Now run nixos-rebuild."
+main "$@"

users/gorazd/home-manager.nix

@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  home.stateVersion = "24.11";
-
-  home.packages = [
-    pkgs.git
-  ];
-
-  # labwc desktop menu (right-click)
-  xdg.configFile."labwc/menu.xml".text = ''
-    <?xml version="1.0" encoding="UTF-8"?>
-    <openbox_menu>
-      <menu id="root-menu" label="">
-        <item label="Terminal"><action name="Execute"><command>foot</command></action></item>
-        <item label="Firefox"><action name="Execute"><command>firefox</command></action></item>
-        <item label="Files"><action name="Execute"><command>foot -e ranger</command></action></item>
-        <separator />
-        <item label="Reconfigure"><action name="Reconfigure" /></item>
-        <item label="Exit"><action name="Exit" /></item>
-      </menu>
-    </openbox_menu>
-  '';
-
-  # labwc autostart panel
-  xdg.configFile."labwc/autostart".text = ''
-    sfwbar &
-  '';
-
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    defaultEditor = true;
-
-    package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
-
-    extraPackages = with pkgs; [
-      # runtime deps
-      fzf
-      ripgrep
-      gnumake
-      gcc
-      luajit
-
-      lua-language-server
-      nil
-      nixd
-
-      nixpkgs-fmt
-      stylua
-
-    ];
-
-    extraWrapperArgs = [
-      "--suffix"
-      "LD_LIBRARY_PATH"
-      ":"
-      "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-    ];
-
-  };
-}

users/matej/home-manager.nix

@@ -1,130 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  home.stateVersion = "24.11";
-
-  # TODO:(@janezicmatej) do i need this here?
-  services.dunst.enable = true;
-
-  home.packages = [
-    pkgs.bibata-cursors
-
-    pkgs.starship
-
-    inputs.claude-code-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default
-    packages.todo-mcp
-
-    # git and co
-    pkgs.git
-    packages.git-linearize
-    packages.ggman
-
-    # cli utils
-    packages.ahab
-    pkgs.fzf
-    pkgs.htop
-    pkgs.jc
-    pkgs.jq
-    pkgs.openssl
-    pkgs.pv
-    pkgs.python3
-    pkgs.ripgrep
-    pkgs.fd
-    pkgs.tmux
-    pkgs.osc
-    pkgs.just
-
-    # compilers, toolchains, ...
-    pkgs.go
-    # pkgs.gcc
-    # pkgs.clang
-
-    # need for gcp stuff
-    pkgs.google-cloud-sdk
-    pkgs.google-cloud-sql-proxy
-
-    # desktop apps
-    pkgs.vesktop
-    pkgs.rocketchat-desktop
-    pkgs.telegram-desktop
-    pkgs.slack
-    pkgs.ghostty
-    pkgs.google-chrome
-    pkgs.zathura
-    pkgs.pavucontrol
-    pkgs.jellyfin-media-player
-    pkgs.cider-2
-    pkgs.protonmail-bridge
-    pkgs.ledger-live-desktop
-    pkgs.bolt-launcher
-    pkgs.libnotify
-
-    # writing/docs
-    pkgs.mdbook
-    pkgs.marksman
-    pkgs.mdformat
-
-    # security
-    pkgs.gnupg
-    pkgs.pass
-  ];
-
-  home.file.".assets".source = inputs.assets;
-
-  programs.direnv = {
-    enable = true;
-    nix-direnv.enable = true;
-  };
-
-  stylix.targets.neovim.enable = false;
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    defaultEditor = true;
-
-    package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
-
-    extraPackages = with pkgs; [
-      # runtime deps
-      gcc
-      luajit
-      nodejs_22 # copilot
-
-      tree-sitter
-
-      # lua_fzf
-      fd
-      ripgrep
-      bat
-      gnumake
-      delta
-
-      pyright
-      typescript-language-server
-      lua-language-server
-      gopls
-      nil
-      nixd
-
-      nixpkgs-fmt
-      stylua
-    ];
-
-    extraWrapperArgs = [
-      "--suffix"
-      "LD_LIBRARY_PATH"
-      ":"
-      "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-    ];
-  };
-}

users/matej/keys.nix

@@ -1,6 +0,0 @@
-{
-  sshAuthorizedKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
-}

users/matej/nixos.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  keys = import ./keys.nix;
-in
-{
-  users.users.matej = {
-    uid = 1000;
-    isNormalUser = true;
-    home = "/home/matej";
-    shell = pkgs.zsh;
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
-  };
-
-  users.groups.matej = {
-    gid = 1000;
-    members = [ "matej" ];
-  };
-}