merge: harden ephvm

.git-blame-ignore-revs

@@ -1,3 +1,10 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+2204b12fadf27886058e6945806ce93a547f5278
+77236af5896524218605badcd3cdfc2267b213da
+
+# host rename
+cfe4c43887a41e52be4e6472474c0fc3788f86e8
+bebb7c42bbe87fe041b53189e78a4553e8c08666
+258902d409e68b47f781451e6d306a8e47198d75

.pre-commit-config.yaml

@@ -12,3 +12,13 @@ repos:
         language: system
         files: \.nix$
         pass_filenames: false
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        args: [-x, -P, scripts]
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.12.0-2
+    hooks:
+      - id: shfmt
+        args: [-d]

.sops.yaml

@@ -0,0 +1,36 @@
+keys:
+  - &matej AF349EECC849D87B790E88FF6318FFB7DB374B7D
+
+  # host age keys (via: ssh-keyscan <host> | ssh-to-age)
+  - &tower age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+  - &fw16 age19qj2aaryx869cvcqp77gs9x5hcv4dqjxunkmyre78upsxda6ss7s5vquz4
+  - &floo age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+  - &cube age15cktenavt5v7zm84se36jtly740syca5nw8em8edx404n5x2ddws8jn29g
+
+creation_rules:
+  # per-host secrets
+  - path_regex: ^secrets/tower\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*tower]
+
+  - path_regex: ^secrets/fw16\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*fw16]
+
+  - path_regex: ^secrets/floo\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*floo]
+
+  - path_regex: ^secrets/cube\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*cube]
+
+  # shared secrets (all hosts)
+  - path_regex: ^secrets/common\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*tower, *fw16, *floo, *cube]

features/bootloader.nix

@@ -0,0 +1,73 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+
+        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            boot.loader.efi.canTouchEfiVariables = true;
+            # request the largest framebuffer uefi offers; plymouth inherits it
+            boot.loader.systemd-boot.consoleMode = "max";
+          }
+
+          (lib.mkIf (cfg.mode == "systemd-boot") {
+            boot.loader.systemd-boot.enable = true;
+          })
+
+          (lib.mkIf (cfg.mode == "lanzaboote") {
+            boot.loader.systemd-boot.enable = lib.mkForce false;
+            boot.lanzaboote = {
+              enable = true;
+              pkiBundle = "/var/lib/sbctl";
+            };
+          })
+
+          (lib.mkIf cfg.plymouth.enable {
+            # plymouth needs systemd-initrd to render the luks prompt cleanly
+            boot.initrd.systemd.enable = true;
+
+            # host is responsible for early-KMS so plymouth lands on the gpu driver,
+            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
+            boot.plymouth.enable = true;
+            stylix.targets.plymouth.logoAnimated = false;
+
+            boot.kernelParams = [
+              "quiet"
+              "splash"
+              "loglevel=3"
+              "rd.systemd.show_status=false"
+              "rd.udev.log_level=3"
+              "udev.log_priority=3"
+              "plymouth.force-scale=1"
+            ];
+            boot.consoleLogLevel = 0;
+            boot.initrd.verbose = false;
+          })
+        ]
+      );
+    };
+}

features/claude.nix

@@ -0,0 +1,28 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.claude.enable = lib.mkEnableOption "claude";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.claude;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          packages.claude-code
+          pkgs.mcp-nixos
+        ];
+      };
+    };
+}

features/desktop.nix

@@ -0,0 +1,273 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.desktop;
+    in
+    {
+      options.features.desktop = {
+        enable = lib.mkEnableOption "desktop environment";
+
+        audio.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        bluetooth.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        apps.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        theme = {
+          wallpaper = lib.mkOption {
+            type = lib.types.path;
+            default = "${inputs.assets}/wallpaper.png";
+          };
+
+          scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "gruvbox-material-dark-medium";
+          };
+
+          polarity = lib.mkOption {
+            type = lib.types.enum [
+              "dark"
+              "light"
+            ];
+            default = "dark";
+          };
+        };
+
+        internalCA.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          # base desktop
+          {
+            security.polkit.enable = true;
+            services.dbus.enable = true;
+            services.playerctld.enable = true;
+
+            xdg.portal = {
+              enable = true;
+              extraPortals = with pkgs; [
+                xdg-desktop-portal-wlr
+                xdg-desktop-portal-gtk
+              ];
+            };
+
+            # honor persist_mode so electron apps don't re-prompt for screencast every login
+            systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";
+
+            # enable ozone/wayland for electron apps so idle detection works
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+            fonts.packages = with pkgs; [
+              font-awesome
+              nerd-fonts.jetbrains-mono
+            ];
+
+            stylix = {
+              enable = true;
+              inherit (cfg.theme) polarity;
+              image = cfg.theme.wallpaper;
+              base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
+            };
+          }
+
+          # audio
+          (lib.mkIf cfg.audio.enable {
+            services.pipewire = {
+              enable = true;
+              pulse.enable = true;
+            };
+            environment.systemPackages = with pkgs; [
+              pavucontrol
+              easyeffects
+            ];
+          })
+
+          # bluetooth
+          (lib.mkIf cfg.bluetooth.enable {
+            hardware.bluetooth.enable = true;
+            services.blueman.enable = true;
+          })
+
+          # apps
+          (lib.mkIf cfg.apps.enable {
+            programs.thunderbird.enable = true;
+
+            environment.systemPackages = with pkgs; [
+              ghostty
+              google-chrome
+              zathura
+              calibre
+              bolt-launcher
+              libnotify
+              bibata-cursors
+              discord
+              rocketchat-desktop
+              telegram-desktop
+              slack
+              jellyfin-media-player
+              cider-2
+              mpv
+              ffmpeg
+              wf-recorder
+              wl-mirror
+              protonmail-bridge
+              ledger-live-desktop
+              imv
+              yazi
+              nemo
+              file-roller
+              libreoffice-still
+            ];
+
+            # kindle udev rules for calibre
+            features.udev.kindle.enable = lib.mkDefault true;
+          })
+
+          # internal CA
+          (lib.mkIf cfg.internalCA.enable {
+            security.pki.certificateFiles = [
+              inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+            ];
+          })
+        ]
+      );
+    };
+
+  home =
+    {
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.desktop;
+    in
+    {
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            home.file.".assets".source = inputs.assets;
+          }
+
+          (lib.mkIf cfg.apps.enable {
+            # TODO:(@janezicmatej) consider moving nvim desktop entry to neovim feature
+            xdg.desktopEntries.nvim = {
+              name = "Neovim";
+              exec = "ghostty -e nvim %F";
+              terminal = false;
+              mimeType = [
+                "text/plain"
+                "application/json"
+                "text/markdown"
+              ];
+            };
+
+            xdg.mimeApps = {
+              enable = true;
+              defaultApplications = {
+                # text
+                "text/plain" = "nvim.desktop";
+                "application/json" = "nvim.desktop";
+                "text/markdown" = "nvim.desktop";
+
+                # web
+                "text/html" = "google-chrome.desktop";
+                "application/xhtml+xml" = "google-chrome.desktop";
+                "x-scheme-handler/http" = "google-chrome.desktop";
+                "x-scheme-handler/https" = "google-chrome.desktop";
+                "x-scheme-handler/ftp" = "google-chrome.desktop";
+                "x-scheme-handler/about" = "google-chrome.desktop";
+                "x-scheme-handler/unknown" = "google-chrome.desktop";
+
+                # mail and calendar
+                "x-scheme-handler/mailto" = "thunderbird.desktop";
+                "message/rfc822" = "thunderbird.desktop";
+                "text/calendar" = "thunderbird.desktop";
+
+                # documents
+                "application/pdf" = "org.pwmt.zathura.desktop";
+                "application/postscript" = "org.pwmt.zathura.desktop";
+                "image/vnd.djvu" = "org.pwmt.zathura.desktop";
+                "application/epub+zip" = "org.pwmt.zathura.desktop";
+
+                # office
+                "application/msword" = "libreoffice-writer.desktop";
+                "application/vnd.ms-excel" = "libreoffice-calc.desktop";
+                "application/vnd.ms-powerpoint" = "libreoffice-impress.desktop";
+                "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
+                  "libreoffice-writer.desktop";
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = "libreoffice-calc.desktop";
+                "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
+                  "libreoffice-impress.desktop";
+                "application/vnd.oasis.opendocument.text" = "libreoffice-writer.desktop";
+                "application/vnd.oasis.opendocument.spreadsheet" = "libreoffice-calc.desktop";
+                "application/vnd.oasis.opendocument.presentation" = "libreoffice-impress.desktop";
+                "text/csv" = "libreoffice-calc.desktop";
+
+                # images
+                "image/png" = "imv-dir.desktop";
+                "image/jpeg" = "imv-dir.desktop";
+                "image/gif" = "imv-dir.desktop";
+                "image/webp" = "imv-dir.desktop";
+                "image/tiff" = "imv-dir.desktop";
+                "image/bmp" = "imv-dir.desktop";
+                "image/svg+xml" = "google-chrome.desktop";
+
+                # video
+                "video/mp4" = "mpv.desktop";
+                "video/x-matroska" = "mpv.desktop";
+                "video/webm" = "mpv.desktop";
+                "video/quicktime" = "mpv.desktop";
+                "video/x-msvideo" = "mpv.desktop";
+
+                # audio
+                "audio/mpeg" = "mpv.desktop";
+                "audio/flac" = "mpv.desktop";
+                "audio/ogg" = "mpv.desktop";
+                "audio/wav" = "mpv.desktop";
+                "audio/aac" = "mpv.desktop";
+
+                # archives
+                "application/zip" = "org.gnome.FileRoller.desktop";
+                "application/x-tar" = "org.gnome.FileRoller.desktop";
+                "application/gzip" = "org.gnome.FileRoller.desktop";
+                "application/x-rar-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-bzip2" = "org.gnome.FileRoller.desktop";
+                "application/x-xz" = "org.gnome.FileRoller.desktop";
+
+                # file manager
+                "inode/directory" = "nemo.desktop";
+
+                # app deep links
+                "x-scheme-handler/tg" = "org.telegram.desktop.desktop";
+                "x-scheme-handler/discord" = "discord.desktop";
+                "x-scheme-handler/slack" = "slack.desktop";
+              };
+            };
+          })
+        ]
+      );
+    };
+}

features/dev.nix

@@ -0,0 +1,36 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.dev.enable = lib.mkEnableOption "development tools";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.dev;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.python3
+          pkgs.osc
+
+          pkgs.google-cloud-sdk
+          pkgs.google-cloud-sql-proxy
+
+          packages.ahab
+          pkgs.just
+          pkgs.presenterm
+          pkgs.qemu
+        ];
+      };
+    };
+}

features/direnv/default.nix

@@ -0,0 +1,45 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.direnv;
+    in
+    {
+      options.features.direnv.enable = lib.mkEnableOption "direnv";
+
+      config = lib.mkIf cfg.enable {
+        nix.registry.dev = {
+          from = {
+            type = "indirect";
+            id = "dev";
+          };
+          to = {
+            type = "path";
+            path = inputs.self.outPath;
+          };
+        };
+      };
+    };
+
+  home =
+    { lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.direnv;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        programs.direnv = {
+          enable = true;
+          nix-direnv.enable = true;
+          config.global.hide_env_diff = true;
+        };
+
+        xdg.configFile."direnv/lib/use_dev.sh".source = ./use_dev.sh;
+      };
+    };
+}

features/direnv/use_dev.sh

@@ -0,0 +1,92 @@
+# shellcheck shell=bash
+# composable nix devshell from matej.nix
+# usage in .envrc: use dev uv_14 pg_18 --extra cairo pkg-config
+
+# generates a flake and delegates to use_flake at the calling scope
+use_dev() {
+	local nix_list="" extra_list="" in_extra=0
+	for c in "$@"; do
+		if [[ "$c" == "--extra" ]]; then
+			in_extra=1
+			continue
+		fi
+		if [[ $in_extra -eq 1 ]]; then
+			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_-]*$ ]]; then
+				log_error "use_dev: invalid package name: $c"
+				return 1
+			fi
+			extra_list="$extra_list pkgs.$c"
+		else
+			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+				log_error "use_dev: invalid component name: $c"
+				return 1
+			fi
+			nix_list="$nix_list \"$c\""
+		fi
+	done
+
+	local system
+	case "$(uname -s)-$(uname -m)" in
+	Linux-x86_64) system="x86_64-linux" ;;
+	Linux-aarch64) system="aarch64-linux" ;;
+	Darwin-x86_64) system="x86_64-darwin" ;;
+	Darwin-arm64) system="aarch64-darwin" ;;
+	esac
+
+	if [[ -z "$system" ]]; then
+		log_error "use_dev: unsupported platform: $(uname -s)-$(uname -m)"
+		return 1
+	fi
+
+	local dev_path nixpkgs_path registry_filter
+	# shellcheck disable=SC2016 # $id is a jq variable, not shell
+	registry_filter='.flakes[] | select(.from.id == $id) | .to.path'
+
+	local registry_file="${XDG_CONFIG_HOME:-$HOME/.config}/nix/registry.json"
+	if [[ ! -f "$registry_file" ]]; then
+		registry_file="/etc/nix/registry.json"
+	fi
+
+	dev_path="$(jq -re --arg id dev "$registry_filter" "$registry_file" 2>/dev/null)"
+	nixpkgs_path="$(jq -re --arg id nixpkgs "$registry_filter" "$registry_file" 2>/dev/null)"
+
+	if [[ -z "$dev_path" ]]; then
+		log_error "use_dev: 'dev' not found in nix registry"
+		return 1
+	fi
+	if [[ -z "$nixpkgs_path" ]]; then
+		log_error "use_dev: 'nixpkgs' not found in nix registry"
+		return 1
+	fi
+
+	local components_hash project_hash cache_dir
+	components_hash="$(sha256sum "$dev_path/flake/dev-components.nix" 2>/dev/null | cut -c1-16)"
+	project_hash="$(echo "$PWD" | sha256sum | cut -c1-16)"
+	cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/dev-flakes/$project_hash"
+	mkdir -p "$cache_dir"
+
+	cat >"$cache_dir/flake.nix.tmp" <<DEVFLAKE
+# dev-components: $components_hash
+{
+  inputs.dev = { url = "path:${dev_path}"; flake = false; };
+  inputs.nixpkgs.url = "path:${nixpkgs_path}";
+  outputs = { dev, nixpkgs, ... }:
+    let
+      system = "${system}";
+      pkgs = nixpkgs.legacyPackages.\${system};
+      devLib = import "\${dev}/flake/dev-components.nix" { inherit pkgs; lib = nixpkgs.lib; };
+    in {
+      devShells.\${system}.default = devLib.mkComponentShell [$nix_list ] [${extra_list} ];
+    };
+}
+DEVFLAKE
+
+	if ! cmp -s "$cache_dir/flake.nix.tmp" "$cache_dir/flake.nix" 2>/dev/null; then
+		mv "$cache_dir/flake.nix.tmp" "$cache_dir/flake.nix"
+		rm -f "$cache_dir/flake.lock"
+	else
+		rm "$cache_dir/flake.nix.tmp"
+	fi
+
+	use_flake "path:$cache_dir"
+}

features/docker.nix

@@ -0,0 +1,24 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.docker;
+    in
+    {
+      options.features.docker.enable = lib.mkEnableOption "docker";
+
+      config = lib.mkIf cfg.enable {
+        virtualisation.docker = {
+          enable = true;
+          logDriver = "json-file";
+        };
+
+        users.users.${user}.extraGroups = [ "docker" ];
+      };
+    };
+}

features/filedrop.nix

@@ -0,0 +1,61 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      userKeys,
+      ...
+    }:
+    let
+      cfg = config.features.filedrop;
+    in
+    {
+      options.features.filedrop = {
+        enable = lib.mkEnableOption "filedrop sftp service";
+
+        sopsFile = lib.mkOption {
+          type = lib.types.path;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        sops.secrets.filedrop-authorized-keys = {
+          inherit (cfg) sopsFile;
+          mode = "0444";
+        };
+
+        users.groups.filedrop = {
+          members = [ "matej" ];
+        };
+
+        users.users.filedrop = {
+          isSystemUser = true;
+          group = "filedrop";
+          home = "/home/filedrop";
+          shell = "/run/current-system/sw/bin/nologin";
+          openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
+        };
+
+        # chroot dir must be root-owned; incoming is writable by filedrop
+        systemd.tmpfiles.rules = [
+          "d /home/filedrop 0755 root root -"
+          "d /home/filedrop/incoming 2775 filedrop filedrop -"
+          "a+ /home/filedrop/incoming - - - - group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:mask::rwx"
+          "L /home/matej/filedrop - - - - /home/filedrop/incoming"
+        ];
+
+        # relaxed umask so default acl takes full effect
+        services.openssh.extraConfig = ''
+          Match User filedrop
+            ForceCommand internal-sftp -u 0002
+            ChrootDirectory /home/filedrop
+            AuthorizedKeysFile /etc/ssh/authorized_keys.d/filedrop %h/.ssh/authorized_keys ${config.sops.secrets.filedrop-authorized-keys.path}
+            AllowTcpForwarding no
+            X11Forwarding no
+        '';
+      };
+    };
+}

features/gaming.nix

@@ -0,0 +1,26 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gaming;
+    in
+    {
+      options.features.gaming.enable = lib.mkEnableOption "gaming";
+
+      config = lib.mkIf cfg.enable {
+        programs.steam = {
+          enable = true;
+          remotePlay.openFirewall = true;
+          dedicatedServer.openFirewall = true;
+          localNetworkGameTransfers.openFirewall = true;
+        };
+
+        environment.systemPackages = [ pkgs.prismlauncher ];
+      };
+    };
+}

features/git.nix

@@ -0,0 +1,29 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.git.enable = lib.mkEnableOption "git";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.git;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.git
+          packages.git-linearize
+          packages.ggman
+        ];
+      };
+    };
+}

features/gnupg.nix

@@ -0,0 +1,43 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gnupg;
+    in
+    {
+      options.features.gnupg = {
+        enable = lib.mkEnableOption "gnupg";
+
+        yubikey.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.gnupg.agent = {
+              enable = true;
+              enableSSHSupport = true;
+              enableExtraSocket = true;
+            };
+          }
+
+          (lib.mkIf cfg.yubikey.enable {
+            environment.systemPackages = with pkgs; [
+              yubikey-personalization
+              yubikey-manager
+            ];
+
+            services.pcscd.enable = true;
+          })
+        ]
+      );
+    };
+}

features/harmonia/cache-builder.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+build() {
+	local name="$1" ref="$2" link="$3"
+	echo "building $name..." >&2
+	if nix build "$ref" --out-link "$link"; then
+		return 0
+	else
+		echo "FAILED: $name" >&2
+		return 1
+	fi
+}
+
+main() {
+	mkdir -p "$GC_ROOT_DIR"
+	local failed=0
+
+	for host in $HOSTS; do
+		build "$host" \
+			"$FLAKE_REF#nixosConfigurations.$host.config.system.build.toplevel" \
+			"$GC_ROOT_DIR/$host" || failed=1
+	done
+
+	build "ephvm-image" \
+		"$FLAKE_REF#nixosConfigurations.ephvm.config.system.build.images.qemu" \
+		"$GC_ROOT_DIR/ephvm-image" || failed=1
+
+	return $failed
+}
+
+main "$@"

features/harmonia/default.nix

@@ -0,0 +1,52 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.harmonia;
+      hosts = [
+        "fw16"
+        "tower"
+        "cube"
+        "floo"
+        "ephvm"
+      ];
+      flakeRef = inputs.self.outPath;
+    in
+    {
+      options.features.harmonia.enable = lib.mkEnableOption "harmonia";
+
+      config = lib.mkIf cfg.enable {
+        services.harmonia.cache = {
+          enable = true;
+          signKeyPaths = [ config.sops.secrets.nix-signing-key.path ];
+        };
+
+        networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 5000 ];
+
+        systemd.services.cache-builder = {
+          description = "Build all host closures for binary cache";
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.bash}/bin/bash ${./cache-builder.sh}";
+          };
+          environment = {
+            FLAKE_REF = flakeRef;
+            HOSTS = builtins.concatStringsSep " " hosts;
+            GC_ROOT_DIR = "/nix/var/nix/gcroots/cache-builder";
+          };
+          path = [ config.nix.package ];
+        };
+
+        # restart cache-builder after every nixos switch (non-blocking)
+        system.activationScripts.cache-builder = lib.stringAfter [ "specialfs" ] ''
+          ${config.systemd.package}/bin/systemctl restart --no-block cache-builder.service || true
+        '';
+      };
+    };
+}

features/initrd-ssh.nix

@@ -0,0 +1,90 @@
+{
+  nixos =
+    { lib, config, ... }:
+    let
+      cfg = config.features.initrd-ssh;
+      keyDir = "/etc/secrets/initrd";
+
+      mkIpString =
+        {
+          address,
+          gateway,
+          netmask,
+          interface,
+          ...
+        }:
+        "${address}::${gateway}:${netmask}::${interface}:none";
+    in
+    {
+      options.features.initrd-ssh = {
+        enable = lib.mkEnableOption "initrd ssh";
+
+        ip = {
+          enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+
+          address = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          gateway = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          netmask = lib.mkOption {
+            type = lib.types.str;
+            default = "255.255.255.0";
+          };
+
+          interface = lib.mkOption {
+            type = lib.types.str;
+          };
+        };
+
+        authorizedKeys = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+
+        networkModule = lib.mkOption {
+          type = lib.types.str;
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.initrd.availableKernelModules = [ cfg.networkModule ];
+        boot.initrd.kernelModules = [ cfg.networkModule ];
+        boot.kernelParams = lib.mkIf cfg.ip.enable [
+          "ip=${mkIpString cfg.ip}"
+        ];
+
+        boot.initrd.systemd.enable = true;
+
+        # remote unlock may take a while; don't let device units give up
+        boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
+
+        boot.initrd.network = {
+          enable = true;
+          ssh = {
+            enable = true;
+            port = 22;
+            hostKeys = [
+              "${keyDir}/ssh_host_rsa_key"
+              "${keyDir}/ssh_host_ed25519_key"
+            ];
+            inherit (cfg) authorizedKeys;
+          };
+        };
+
+        # systemd-networkd retries DHCP indefinitely, unlike udhcpc
+        boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
+          "10-initrd" = {
+            matchConfig.Driver = cfg.networkModule;
+            networkConfig.DHCP = "yes";
+          };
+        };
+
+        # forward LUKS password prompt to the SSH session
+        boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
+      };
+    };
+}

features/localisation.nix

@@ -0,0 +1,30 @@
+{
+  nixos =
+    { lib, config, ... }:
+    let
+      cfg = config.features.localisation;
+    in
+    {
+      options.features.localisation = {
+        enable = lib.mkEnableOption "localisation";
+
+        timeZone = lib.mkOption {
+          type = lib.types.str;
+          default = "Europe/Ljubljana";
+        };
+
+        defaultLocale = lib.mkOption {
+          type = lib.types.str;
+          default = "en_US.UTF-8";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        time.timeZone = cfg.timeZone;
+        i18n.defaultLocale = cfg.defaultLocale;
+
+        # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
+        environment.variables.TZ = cfg.timeZone;
+      };
+    };
+}

features/neovim.nix

@@ -0,0 +1,82 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.neovim = {
+        enable = lib.mkEnableOption "neovim";
+
+        dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+    };
+
+  home =
+    {
+      config,
+      options,
+      lib,
+      pkgs,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.neovim;
+    in
+    {
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.optionalAttrs (options ? stylix) {
+            # disable stylix neovim target when stylix is present
+            stylix.targets.neovim.enable = false;
+          })
+          {
+            xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
+              source = cfg.dotfiles;
+            };
+
+            programs.neovim = {
+              enable = true;
+              sideloadInitLua = true;
+              vimAlias = true;
+              defaultEditor = true;
+              package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+              extraPackages = with pkgs; [
+                gcc
+                luajit
+                nodejs_22
+                tree-sitter
+                gnumake
+                osc
+
+                fd
+                ripgrep
+                bat
+                delta
+
+                pyright
+                typescript-language-server
+                lua-language-server
+                gopls
+                nil
+                nixd
+
+                nixpkgs-fmt
+                stylua
+              ];
+
+              extraWrapperArgs = [
+                "--suffix"
+                "LD_LIBRARY_PATH"
+                ":"
+                "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
+              ];
+            };
+          }
+        ]
+      );
+    };
+}

features/networkmanager.nix

@@ -0,0 +1,18 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.networkmanager;
+    in
+    {
+      options.features.networkmanager.enable = lib.mkEnableOption "networkmanager";
+
+      config = lib.mkIf cfg.enable {
+        networking.networkmanager.enable = true;
+        networking.nameservers = [
+          "1.1.1.1"
+          "8.8.8.8"
+        ];
+      };
+    };
+}

features/nix-ld.nix

@@ -0,0 +1,14 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-ld;
+    in
+    {
+      options.features.nix-ld.enable = lib.mkEnableOption "nix-ld";
+
+      config = lib.mkIf cfg.enable {
+        programs.nix-ld.enable = true;
+      };
+    };
+}

features/nix-settings.nix

@@ -0,0 +1,71 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-settings;
+    in
+    {
+      options.features.nix-settings = {
+        enable = lib.mkEnableOption "nix settings";
+
+        towerCache.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+
+        gc = {
+          dates = lib.mkOption {
+            type = lib.types.str;
+            default = "monthly";
+          };
+
+          olderThan = lib.mkOption {
+            type = lib.types.str;
+            default = "30d";
+          };
+        };
+
+        optimise.dates = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "monthly" ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        nix = {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            download-attempts = 3;
+            fallback = true;
+            warn-dirty = false;
+            substituters = [
+              "https://cache.nixos.org"
+              "https://nix-community.cachix.org?priority=45"
+            ]
+            ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys = [
+              "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+              "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+            ]
+            ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+          };
+
+          gc = {
+            automatic = true;
+            inherit (cfg.gc) dates;
+            options = "--delete-older-than ${cfg.gc.olderThan}";
+          };
+
+          optimise = {
+            automatic = true;
+            inherit (cfg.optimise) dates;
+          };
+        };
+      };
+    };
+}

features/onepassword.nix

@@ -0,0 +1,23 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}

features/openssh.nix

@@ -0,0 +1,30 @@
+{
+  nixos =
+    { lib, config, ... }:
+    let
+      cfg = config.features.openssh;
+    in
+    {
+      options.features.openssh = {
+        enable = lib.mkEnableOption "openssh";
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 22;
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        services.openssh = {
+          enable = true;
+          ports = [ cfg.port ];
+          settings = {
+            PasswordAuthentication = false;
+            AllowUsers = null;
+            PermitRootLogin = "no";
+            StreamLocalBindUnlink = "yes";
+          };
+        };
+      };
+    };
+}

features/power.nix

@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}

features/printing.nix

@@ -0,0 +1,19 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.printing;
+    in
+    {
+      options.features.printing.enable = lib.mkEnableOption "printing";
+
+      config = lib.mkIf cfg.enable {
+        services.printing.enable = true;
+        services.avahi = {
+          enable = true;
+          nssmdns4 = true;
+          openFirewall = true;
+        };
+      };
+    };
+}

features/remote-base.nix

@@ -0,0 +1,25 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.remote-base;
+    in
+    {
+      options.features.remote-base.enable = lib.mkEnableOption "remote-base";
+
+      config = lib.mkIf cfg.enable {
+        sops.secrets.user-password = {
+          sopsFile = ../secrets/common.yaml;
+          neededForUsers = true;
+        };
+
+        users.mutableUsers = false;
+        users.users.${user}.hashedPasswordFile = config.sops.secrets.user-password.path;
+      };
+    };
+}

features/shell.nix

@@ -0,0 +1,33 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.shell.enable = lib.mkEnableOption "shell extras";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.shell;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = with pkgs; [
+          fzf
+          htop
+          jc
+          jq
+          openssl
+          pv
+          ripgrep
+          fd
+          tmux
+        ];
+      };
+    };
+}

features/sway.nix

@@ -0,0 +1,100 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
+    {
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            # soft dependency
+            features.desktop.enable = lib.mkDefault true;
+
+            # hard dependency
+            assertions = [
+              {
+                assertion = desktopCfg.enable;
+                message = "features.sway requires features.desktop";
+              }
+            ];
+
+            programs.sway = {
+              enable = true;
+              package = pkgs.swayfx;
+              wrapperFeatures.gtk = true;
+              extraSessionCommands = ''
+                # fix for java awt apps not rendering
+                export _JAVA_AWT_WM_NONREPARENTING=1
+                # propagate XDG_DATA_DIRS to dbus/systemd for d-bus activated apps
+                dbus-update-activation-environment --systemd XDG_DATA_DIRS
+              '';
+            };
+
+            environment.systemPackages = with pkgs; [
+              waybar
+              mako
+              wob
+              playerctl
+              brightnessctl
+              foot
+              grim
+              pulseaudio
+              swayidle
+              swaylock-effects
+              jq
+              slurp
+              wl-clipboard
+              pamixer
+              wlsunset
+              satty
+              wayland-pipewire-idle-inhibit
+              fuzzel
+              cliphist
+              zenity
+            ];
+          }
+
+          # greeter
+          (lib.mkIf cfg.greeter.enable {
+            programs.regreet = {
+              enable = true;
+              cageArgs = [
+                "-s"
+                "-m"
+                "last"
+              ];
+              font = {
+                name = lib.mkForce "JetBrainsMono Nerd Font";
+                size = lib.mkForce 14;
+              };
+              settings = {
+                background = {
+                  path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                  fit = lib.mkForce "Cover";
+                };
+                GTK = {
+                  application_prefer_dark_theme = lib.mkForce true;
+                };
+              };
+            };
+          })
+        ]
+      );
+    };
+}

features/tailscale.nix

@@ -0,0 +1,17 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.tailscale;
+    in
+    {
+      options.features.tailscale.enable = lib.mkEnableOption "tailscale";
+
+      config = lib.mkIf cfg.enable {
+        services.tailscale = {
+          enable = true;
+          useRoutingFeatures = "both";
+        };
+      };
+    };
+}

features/udev.nix

@@ -0,0 +1,59 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.mkIf cfg.kindle.enable {
+            # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+            # because extraRules writes to 99-local.rules which is too late for uaccess
+            services.udev.packages = [
+              pkgs.libmtp
+              (pkgs.writeTextFile {
+                name = "kindle-udev-rules";
+                text = ''
+                  ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+                '';
+                destination = "/etc/udev/rules.d/70-kindle.rules";
+              })
+            ];
+          })
+
+          (lib.mkIf cfg.ledger.enable {
+            hardware.ledger.enable = true;
+          })
+
+          (lib.mkIf cfg.keyboard-zsa.enable {
+            hardware.keyboard.zsa.enable = true;
+          })
+        ]
+      );
+    };
+}

features/user-matej.nix

@@ -0,0 +1,30 @@
+let
+  sshKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+  ];
+in
+{
+  keys = {
+    sshAuthorizedKeys = sshKeys;
+  };
+
+  nixos = _: {
+    users.users.matej = {
+      uid = 1000;
+      isNormalUser = true;
+      home = "/home/matej";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = sshKeys;
+    };
+
+    users.groups.matej = {
+      gid = 1000;
+      members = [ "matej" ];
+    };
+  };
+
+  home = _: {
+    home.stateVersion = "26.05";
+  };
+}

features/vm-guest.nix

@@ -0,0 +1,112 @@
+{
+  nixos =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
+    {
+      options.features.vm-guest = {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";
+
+          user = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          prefix = lib.mkOption {
+            type = lib.types.str;
+            default = "m_";
+          };
+
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+            boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
+
+            # 9p autoloads on first mount
+            boot.initrd.availableKernelModules = [
+              "9p"
+              "9pnet_virtio"
+            ];
+
+            networking = {
+              useDHCP = true;
+              firewall.allowedTCPPorts = [ 22 ];
+            };
+
+            security.sudo.wheelNeedsPassword = false;
+
+            environment.systemPackages = with pkgs; [
+              curl
+              wget
+              htop
+            ];
+          }
+
+          (lib.mkIf cfg.automount.enable {
+            systemd.services.vm-9p-automount = {
+              description = "Auto-discover and mount 9p shares";
+              after = [
+                "local-fs.target"
+                "nss-user-lookup.target"
+                "systemd-modules-load.service"
+              ];
+              wants = [ "systemd-modules-load.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                  BASE="${cfg.automount.basePath}"
+                  PREFIX="${cfg.automount.prefix}"
+                  mkdir -p "$BASE"
+                  chown ${autoUser}:${autoGroup} "$BASE"
+
+                  for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                    [ -f "$tagfile" ] || continue
+                    tag=$(tr -d '\0' < "$tagfile")
+
+                    case "$tag" in
+                      "$PREFIX"*) ;;
+                      *) continue ;;
+                    esac
+
+                    name="''${tag#"$PREFIX"}"
+                    target="$BASE/$name"
+
+                    mkdir -p "$target"
+                    ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                      -o trans=virtio,version=9p2000.L || continue
+                  done
+                '';
+              };
+            };
+          })
+        ]
+      );
+    };
+}

features/zsh.nix

@@ -0,0 +1,55 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.zsh;
+    in
+    {
+      options.features.zsh = {
+        enable = lib.mkEnableOption "zsh";
+
+        loginShell.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.zsh.enable = true;
+            environment.etc."zshenv".text = ''
+              export ZDOTDIR=$HOME/.config/zsh
+            '';
+          }
+
+          (lib.mkIf cfg.loginShell.enable {
+            users.users.${user}.shell = pkgs.zsh;
+          })
+        ]
+      );
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.zsh;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [ pkgs.starship ];
+      };
+    };
+}

flake.lock

@@ -99,14 +99,34 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776613567,
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764873433,
+        "lastModified": 1775176642,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -133,17 +153,14 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "neovim-nightly-overlay",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1769996383,
+        "lastModified": 1775087534,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -155,16 +172,16 @@
     "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
-          "stylix",
+          "neovim-nightly-overlay",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1767609335,
+        "lastModified": 1775087534,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -173,21 +190,24 @@
         "type": "github"
       }
     },
-    "flake-utils": {
+    "flake-parts_3": {
       "inputs": {
-        "systems": "systems"
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
+        "lastModified": 1775087534,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "flake-parts",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "flake-parts",
         "type": "github"
       }
     },
@@ -232,20 +252,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -255,16 +273,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1770260404,
+        "lastModified": 1776777932,
-        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
+        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
+        "rev": "5d5640599a0050b994330328b9fd45709c909720",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -295,16 +312,16 @@
     },
     "neovim-nightly-overlay": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "neovim-src": "neovim-src",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1771545891,
+        "lastModified": 1776729909,
-        "narHash": "sha256-aaVUfc/9q2pCsELZmYhf+uvYRMCUlBvccgL1VS27R+o=",
+        "narHash": "sha256-wGu/N42PJqrj8ju9GoXdppg4rwaKzZqdAjsgxJbCvfY=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "917b72d5e27bc217440655b81f701d7062bdd198",
+        "rev": "ff21a18bde28b4c8ca0bc1f9a5b7186a1b89a3d1",
         "type": "github"
       },
       "original": {
@@ -316,11 +333,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1771541613,
+        "lastModified": 1776727374,
-        "narHash": "sha256-1Rpt5B4pNW/MNkWoEamqwCa5I4/9G84dSqp4eHS5zsA=",
+        "narHash": "sha256-iP5SviNXW5W+ay4ZmwjDFsfQjfM+fYlUxRlLPHjpwWI=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "e3d46a63375c84b7bd409f1f07ef56eb985eae50",
+        "rev": "901b3f0c394a53961781ebeee682e64ad690a242",
         "type": "github"
       },
       "original": {
@@ -329,13 +346,29 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771207753,
+        "lastModified": 1776329215,
-        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
@@ -345,13 +378,28 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1774748309,
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1771612900,
+        "lastModified": 1776807375,
-        "narHash": "sha256-ToJ0wYbphG1ZN7bgGpCJxu69Tt3ij0+T6W4YljLCHak=",
+        "narHash": "sha256-LDnHG0T54OEHyRydmGUlAND8ham0KrRNWjgoS+6GUd4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f65d4c996f96838b8f50253859cf7b17e956a792",
+        "rev": "553ecb1686a2edb75dee44c9f72e1674e6adc26a",
         "type": "github"
       },
       "original": {
@@ -361,34 +409,34 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1771207753,
+        "lastModified": 1776560675,
-        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
+        "narHash": "sha256-p68udKWWh7+V4ZPpcMDq0gTHWNZJnr4JPI+kHPPE40o=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
+        "rev": "e07580dae39738e46609eaab8b154de2488133ce",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1771419570,
+        "lastModified": 1776548001,
-        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -405,11 +453,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767886815,
+        "lastModified": 1775228139,
-        "narHash": "sha256-pB2BBv6X9cVGydEV/9Y8+uGCvuYJAlsprs1v1QHjccA=",
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4ff84374d77ff62e2e13a46c33bfeb73590f9fef",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -418,6 +466,22 @@
         "type": "github"
       }
     },
+    "nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1773783263,
+        "narHash": "sha256-lZG4VERlfCwEJpW6C5irkwUxB+JoPVmuV3qOYD9WNYY=",
+        "ref": "refs/heads/main",
+        "rev": "a95f1be85c858cb7d1bc0a8506dc9cb01161a3e7",
+        "revCount": 93,
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/nvim.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/nvim.git"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -444,13 +508,17 @@
     "root": {
       "inputs": {
         "assets": "assets",
-        "flake-utils": "flake-utils",
+        "disko": "disko",
+        "flake-parts": "flake-parts",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "neovim-nightly-overlay": "neovim-nightly-overlay",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-master": "nixpkgs-master",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "nvim": "nvim",
+        "sops-nix": "sops-nix",
         "stylix": "stylix"
       }
     },
@@ -475,6 +543,26 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776771786,
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "stylix": {
       "inputs": {
         "base16": "base16",
@@ -482,30 +570,28 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems",
-        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1771429540,
+        "lastModified": 1776170745,
-        "narHash": "sha256-YKytDx8LOPOvE+dip1ja+1nbIpDVdqTaFbP4MaXwveM=",
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "1a5c9d8be82127aeccc929f60b952e8a3df6b63c",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
         "type": "github"
       },
       "original": {
         "owner": "danth",
-        "ref": "release-25.11",
         "repo": "stylix",
         "type": "github"
       }
@@ -525,38 +611,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -576,11 +630,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1767817087,
+        "lastModified": 1772661346,
-        "narHash": "sha256-eGE8OYoK6HzhJt/7bOiNV2cx01IdIrHL7gXgjkHRdNo=",
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "bd99656235aab343e3d597bf196df9bc67429507",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -592,11 +646,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1767489635,
+        "lastModified": 1772934010,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -608,11 +662,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1767488740,
+        "lastModified": 1772909925,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,35 +2,29 @@
   description = "matej's nix setup";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    # dotfiles = {
+    nvim = {
-    #   url = "git+https://git.janezic.dev/janezicmatej/.dotfiles.git";
+      url = "git+https://git.janezic.dev/janezicmatej/nvim.git";
-    #   flake = false;
+      flake = false;
-    # };
+    };
-    # nvim = {
-    #   url = "git+https://git.janezic.dev/janezicmatej/nvim.git?ref=rewrite";
-    #   flake = false;
-    # };
 
-    flake-utils.url = "github:numtide/flake-utils";
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
+    flake-parts.url = "github:hercules-ci/flake-parts";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     stylix = {
-      url = "github:danth/stylix/release-25.11";
+      url = "github:danth/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    neovim-nightly-overlay = {
-      url = "github:nix-community/neovim-nightly-overlay";
-    };
-
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v1.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -40,93 +34,50 @@
       url = "git+https://git.janezic.dev/janezicmatej/assets.git";
       flake = false;
     };
+
+    neovim-nightly-overlay.url = "github:nix-community/neovim-nightly-overlay";
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
   };
 
   outputs =
     inputs@{
+      flake-parts,
       nixpkgs,
-      flake-utils,
+      self,
       ...
     }:
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [
+        ./flake/overlays.nix
+        ./flake/packages.nix
+        ./flake/devshell.nix
+        ./flake/hosts.nix
+      ];
 
-    let
+      systems = [ "x86_64-linux" ];
-      my-lib = import ./lib { inherit (nixpkgs) lib; };
 
-      overlays = [
+      perSystem =
-        (_: prev: {
+        { system, ... }:
-          inherit
+        {
-            (
+          _module.args.pkgs = import nixpkgs {
-              (import inputs.nixpkgs-unstable {
+            inherit system;
-                inherit (prev.stdenv.hostPlatform) system;
+            overlays = [ self.overlays.default ];
             config.allowUnfree = true;
-              })
-            )
-            claude-code
-            ;
-        })
-      ];
-
-      mkHost = my-lib.mkHost {
-        inherit
-          nixpkgs
-          overlays
-          inputs
-          ;
-      };
-
-    in
-
-    {
-      lib = my-lib;
-
-      nixosConfigurations = {
-        matej-nixos = mkHost "matej-nixos" {
-          system = "x86_64-linux";
-          users = [ "matej" ];
-        };
-        matej-tower = mkHost "matej-tower" {
-          system = "x86_64-linux";
-          users = [ "matej" ];
-        };
-
-        # nixos-rebuild build-image --image-variant install-iso --flake .#live-iso
-        live-iso = mkHost "live-iso" {
-          system = "x86_64-linux";
-          users = [ ];
           };
         };
 
-      nixosModules = import ./modules/nixos {
+      flake = {
-        inherit my-lib;
+        lib = import ./lib { inherit (nixpkgs) lib; };
-        inherit (nixpkgs) lib;
-      } { };
-    }
-    // flake-utils.lib.eachDefaultSystem (
-      system:
-      let
-        pkgs = nixpkgs.legacyPackages.${system};
-      in
-      {
-        packages =
-          import ./packages
-            {
-              inherit my-lib;
-              inherit (nixpkgs) lib;
-            }
-            {
-              pkgs = nixpkgs.legacyPackages.${system};
-              pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
-              pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
       };
-
-        formatter = pkgs.nixfmt-tree;
-
-        devShells.default = pkgs.mkShell {
-          packages = [
-            pkgs.pre-commit
-            pkgs.statix
-          ];
     };
-      }
-    );
 }

flake/dev-components.nix

@@ -0,0 +1,89 @@
+# composable dev environment components
+# imported by generated per-project flakes via use_dev
+{ pkgs, lib }:
+let
+  # libraries needed by python native extensions
+  pythonLibraries = [
+    pkgs.stdenv.cc.cc.lib
+    pkgs.zlib
+    pkgs.openssl
+    pkgs.curl
+    pkgs.libffi
+  ];
+
+  mkNode = nodejs: {
+    packages = [
+      nodejs
+      pkgs.corepack
+    ];
+    env = {
+      COREPACK_ENABLE_STRICT = "0";
+    };
+  };
+
+  mkUv = python: {
+    packages = [
+      python
+      pkgs.uv
+      pkgs.pkg-config
+    ];
+    libraries = pythonLibraries;
+    env = {
+      UV_PYTHON_DOWNLOADS = "never";
+      UV_PYTHON_PREFERENCE = "only-system";
+    };
+    shellHook = ''
+      unset PYTHONPATH
+      export UV_PROJECT_ENVIRONMENT="''${XDG_DATA_HOME:-$HOME/.local/share}/dev-venvs/$(basename "$PWD")-$(echo "$PWD" | sha256sum | cut -c1-8)"
+    '';
+  };
+
+  components = {
+    uv_10 = mkUv pkgs.python310;
+    uv_11 = mkUv pkgs.python311;
+    uv_12 = mkUv pkgs.python312;
+    uv_13 = mkUv pkgs.python313;
+    uv_14 = mkUv pkgs.python314;
+
+    node_20 = mkNode pkgs.nodejs_20;
+    node_22 = mkNode pkgs.nodejs_22;
+    node_24 = mkNode pkgs.nodejs_24;
+
+    rust = {
+      packages = [
+        pkgs.rustc
+        pkgs.cargo
+        pkgs.rust-analyzer
+        pkgs.openssl
+        pkgs.pkg-config
+      ];
+    };
+
+  };
+
+  # build a single mkShell from one or more component names
+  mkComponentShell =
+    names: extraPackages:
+    let
+      selected = map (n: components.${n}) names;
+      allPackages = lib.concatMap (c: c.packages or [ ]) selected ++ extraPackages;
+      allLibraries = lib.concatMap (c: c.libraries or [ ]) selected;
+      allHooks = lib.concatMapStrings (c: c.shellHook or "") selected;
+      allEnvs = lib.foldl' (acc: c: acc // (c.env or { })) { } selected;
+      libPath = lib.makeLibraryPath allLibraries;
+    in
+    pkgs.mkShell (
+      {
+        packages = allPackages;
+        shellHook =
+          (lib.optionalString (allLibraries != [ ]) ''
+            export LD_LIBRARY_PATH="${libPath}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+          '')
+          + allHooks;
+      }
+      // lib.optionalAttrs (allEnvs != { }) { env = allEnvs; }
+    );
+in
+{
+  inherit components mkComponentShell;
+}

flake/devshell.nix

@@ -0,0 +1,21 @@
+_: {
+  perSystem =
+    { pkgs, ... }:
+    {
+      formatter = pkgs.nixfmt-tree;
+
+      devShells = {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.pre-commit
+            pkgs.statix
+            pkgs.shellcheck
+            pkgs.shfmt
+            pkgs.qemu
+            pkgs.sops
+            pkgs.ssh-to-age
+          ];
+        };
+      };
+    };
+}

flake/hosts.nix

@@ -0,0 +1,152 @@
+{ inputs, self, ... }:
+
+let
+  inherit (inputs) nixpkgs;
+  my-lib = import ../lib { inherit (nixpkgs) lib; };
+
+  mkHost = my-lib.mkHost {
+    inherit nixpkgs inputs;
+    overlays = [ self.overlays.default ];
+  };
+in
+{
+  flake.nixosConfigurations = {
+    fw16 = mkHost "fw16" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "power"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
+      ];
+    };
+
+    tower = mkHost "tower" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "harmonia"
+        "initrd-ssh"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
+      ];
+    };
+
+    # nixos-rebuild build-image --image-variant install-iso --flake .#iso
+    iso = mkHost "iso" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "nix-settings"
+        "openssh"
+        "zsh"
+      ];
+    };
+
+    cube = mkHost "cube" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
+        "shell"
+        "tailscale"
+        "zsh"
+      ];
+    };
+
+    # nix run github:nix-community/nixos-anywhere -- --flake .#floo root@<ip>
+    floo = mkHost "floo" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "filedrop"
+        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
+        "shell"
+        "tailscale"
+        "zsh"
+      ];
+    };
+
+    fortress = mkHost "fortress" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "desktop"
+        "gnupg"
+        "localisation"
+        "networkmanager"
+        "nix-settings"
+        "sway"
+        "udev"
+        "zsh"
+      ];
+    };
+
+    ephvm = mkHost "ephvm" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "claude"
+        "dev"
+        "docker"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "nix-settings"
+        "openssh"
+        "shell"
+        "vm-guest"
+        "zsh"
+      ];
+    };
+  };
+}

flake/overlays.nix

@@ -0,0 +1,5 @@
+_:
+
+{
+  flake.overlays.default = _: _: { };
+}

flake/packages.nix

@@ -0,0 +1,21 @@
+{ inputs, ... }:
+
+let
+  my-lib = import ../lib { inherit (inputs.nixpkgs) lib; };
+in
+{
+  perSystem =
+    { pkgs, system, ... }:
+    {
+      packages =
+        import ../packages
+          {
+            inherit my-lib;
+            inherit (inputs.nixpkgs) lib;
+          }
+          {
+            inherit pkgs;
+            pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
+          };
+    };
+}

hosts/cube/configuration.nix

@@ -0,0 +1,33 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        esp = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "25.11";
+}

hosts/cube/hardware-configuration.nix

@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/ephvm/configuration.nix

@@ -0,0 +1,119 @@
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+{
+  features.nix-settings.towerCache.enable = false;
+  # no hardware firmware needed in a VM
+  hardware.enableRedistributableFirmware = lib.mkForce false;
+  hardware.wirelessRegulatoryDatabase = lib.mkForce false;
+
+  documentation.enable = false;
+  environment.defaultPackages = [ ];
+
+  # qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
+  # (~half the size of zlib v2, faster decompress)
+  image.modules.qemu =
+    { config, modulesPath, ... }:
+    {
+      system.build.image = lib.mkForce (
+        let
+          rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
+            inherit lib config pkgs;
+            inherit (config.virtualisation) diskSize;
+            inherit (config.image) baseName;
+            format = "qcow2";
+            copyChannel = false;
+            partitionTableType = "legacy";
+          };
+          inherit (config.image) baseName;
+        in
+        pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
+          mkdir -p $out
+          # qemu-img caps -m at 16
+          cores="''${NIX_BUILD_CORES:-4}"
+          [ "$cores" -gt 0 ] || cores=4
+          [ "$cores" -gt 16 ] && cores=16
+          qemu-img convert \
+            -f qcow2 \
+            -O qcow2 \
+            -c \
+            -o compression_type=zstd \
+            -m "$cores" \
+            ${rawImage}/${baseName}.qcow2 \
+            $out/${baseName}.qcow2
+        ''
+      );
+    };
+
+  # auto-login on serial console
+  services.getty.autologinUser = "matej";
+
+  # enable zsh in home-manager so starship init gets wired up
+  home-manager.users.matej.programs.zsh = {
+    enable = true;
+    dotDir = "/home/matej/.config/zsh";
+    shellAliases.dsp = "claude --dangerously-skip-permissions";
+  };
+
+  home-manager.users.matej.programs.starship = {
+    enable = true;
+    settings = {
+      add_newline = false;
+      format = "$username$hostname$directory$character";
+      hostname = {
+        ssh_only = false;
+        style = "bold blue";
+        format = "[@$hostname]($style)";
+      };
+      username = {
+        show_always = true;
+        style_user = "bold blue";
+        format = "[$user]($style)";
+      };
+      directory.format = " [$path]($style) ";
+      character = {
+        success_symbol = "[>](bold green)";
+        error_symbol = "[>](bold red)";
+      };
+    };
+  };
+
+  features.vm-guest.headless = true;
+  features.vm-guest.automount = {
+    enable = true;
+    user = "matej";
+  };
+  features.neovim.dotfiles = inputs.nvim;
+
+  # ensure .config exists with correct ownership before automount
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
+
+  # TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
+  # https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
+  # accept any ssh key (ephemeral localhost-only vm)
+  services.openssh.settings.AuthorizedKeysCommand =
+    let
+      acceptKey = pkgs.writeShellScript "ephvm-accept-key" ''echo "$1 $2"'';
+    in
+    "${acceptKey} %t %k";
+  services.openssh.settings.AuthorizedKeysCommandUser = "nobody";
+
+  # writable claude config via 9p
+  fileSystems."/home/matej/.config/claude" = {
+    device = "claude";
+    fsType = "9p";
+    options = [
+      "trans=virtio"
+      "version=9p2000.L"
+      "nofail"
+      "x-systemd.automount"
+    ];
+  };
+
+  environment.sessionVariables.CLAUDE_CONFIG_DIR = "/home/matej/.config/claude";
+
+  system.stateVersion = "25.11";
+}

hosts/ephvm/hardware-configuration.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  virtualisation.diskSize = 30720; # 30G
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+    fsType = "ext4";
+  };
+
+  # image.modules (disk-image.nix) overrides boot loader per variant
+  boot.loader.grub.device = lib.mkDefault "/dev/vda";
+}

hosts/floo/configuration.nix

@@ -0,0 +1,32 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
+  boot.loader.grub.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "25.11";
+}

hosts/floo/hardware-configuration.nix

@@ -0,0 +1,37 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/fortress/configuration.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
+  ];
+
+  features.desktop = {
+    apps.enable = false;
+    internalCA.enable = false;
+  };
+  features.gnupg.yubikey.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        esp = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptlvm";
+            settings.allowDiscards = true;
+            content = {
+              type = "lvm_pv";
+              vg = "vg";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  disko.devices.lvm_vg.vg = {
+    type = "lvm_vg";
+    lvs = {
+      root = {
+        size = "100%FREE";
+        content = {
+          type = "filesystem";
+          format = "ext4";
+          mountpoint = "/";
+        };
+      };
+      swap = {
+        size = "32G";
+        content = {
+          type = "swap";
+        };
+      };
+    };
+  };
+
+  networking.firewall.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    google-chrome
+    firefox
+    vim
+  ];
+
+  system.stateVersion = "25.11";
+}

hosts/fortress/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  hardware.firmware = [ pkgs.linux-firmware ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/fw16/configuration.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  options,
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
+  ];
+
+  features.bootloader.plymouth.enable = true;
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
+
+  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
+
+  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
+
+  services.gnome.gnome-keyring.enable = true;
+  services.teamviewer.enable = true;
+
+  services.hardware.bolt.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+  hardware.inputmodule.enable = true;
+
+  # NOTE:(@janezicmatej) disable wakeup for framework input modules to prevent spurious wakes
+  services.udev.extraRules = lib.mkAfter ''
+    SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0012", ATTR{power/wakeup}="disabled"
+    SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0014", ATTR{power/wakeup}="disabled"
+  '';
+
+  networking.firewall.enable = false;
+
+  system.stateVersion = "24.11";
+}

hosts/fw16/hardware-configuration.nix

@@ -17,8 +17,10 @@
   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
-    "ahci"
+    "thunderbolt"
     "usbhid"
+    "uas"
+    "sd_mod"
   ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
@@ -33,7 +35,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7151-CE52";
+    device = "/dev/disk/by-uuid/42D9-FAFD";
     fsType = "vfat";
     options = [
       "fmask=0022"

hosts/iso/configuration.nix

@@ -0,0 +1,15 @@
+{ lib, userKeys, ... }:
+{
+  features.nix-settings.towerCache.enable = false;
+  image.modules.iso-installer = {
+    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
+  };
+
+  # live iso: passwordless login and sudo
+  users.users.matej.initialHashedPassword = "";
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
+  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
+  security.sudo.wheelNeedsPassword = false;
+
+  system.stateVersion = "25.05";
+}

hosts/live-iso/configuration.nix

@@ -1,49 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-let
-  keys = import ../../users/matej/keys.nix;
-in
-{
-  imports = [
-    inputs.self.nixosModules.openssh
-  ];
-
-  openssh.enable = true;
-
-  image.modules.iso-installer = {
-    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
-  };
-
-  fileSystems."/" = lib.mkDefault {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  boot.loader.grub.device = lib.mkDefault "/dev/sda";
-
-  networking.firewall.allowedTCPPorts = [ 22 ];
-
-  users = {
-    groups.matej = {
-      gid = 1000;
-    };
-    users.matej = {
-      group = "matej";
-      uid = 1000;
-      isNormalUser = true;
-      home = "/home/matej";
-      createHome = true;
-      password = "burek123";
-      extraGroups = [
-        "wheel"
-        "users"
-      ];
-      openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
-    };
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/matej-nixos/configuration.nix

@@ -1,121 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  options,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  imports = [
-    inputs.stylix.nixosModules.stylix
-    inputs.self.nixosModules.yubikey
-    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.nvidia
-    inputs.self.nixosModules.initrd-ssh
-  ];
-
-  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
-
-  sway = {
-    enable = true;
-    cmdFlags = [ "--unsupported-gpu" ];
-  };
-
-  nvidia.enable = true;
-
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-    ip = {
-      enable = true;
-      address = "10.222.0.247";
-      gateway = "10.222.0.1";
-      interface = "enp5s0";
-    };
-  };
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "America/New_York";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # WARN:(@janezicmatej) nix-ld for running pip-installed binaries outside nix, probably want to drop this
-  programs.nix-ld.enable = true;
-  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
-
-  security.pki.certificateFiles = [ packages.ca-matheo-si ];
-  services.gnome.gnome-keyring.enable = true;
-
-  services.teamviewer.enable = true;
-
-  programs.thunderbird.enable = true;
-  programs._1password.enable = true;
-  programs._1password-gui.enable = true;
-  programs.firefox.enable = true;
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-    localNetworkGameTransfers.openFirewall = true;
-  };
-
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
-  hardware.bluetooth.powerOnBoot = true;
-
-  networking = {
-    hostName = "matej-nixos";
-    useDHCP = false;
-    networkmanager.enable = true;
-    interfaces.enp5s0.ipv4.addresses = [
-      {
-        address = "10.222.0.247";
-        prefixLength = 24;
-      }
-    ];
-    firewall.enable = false;
-    defaultGateway = "10.222.0.1";
-    nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-  };
-
-  xdg.mime.defaultApplications = {
-    "application/pdf" = "org.pwmt.zathura.desktop";
-  };
-
-  system.stateVersion = "24.11";
-}

hosts/matej-tower/configuration.nix

@@ -1,87 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  options,
-  ...
-}:
-
-{
-  networking.hostName = "matej-tower";
-  imports = [
-    inputs.stylix.nixosModules.stylix
-    inputs.lanzaboote.nixosModules.lanzaboote
-
-    inputs.self.nixosModules.yubikey
-    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.initrd-ssh
-  ];
-
-  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
-  sway.enable = true;
-
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-  };
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-  };
-
-  # lanzaboote secure boot
-  boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "Europe/Ljubljana";
-
-  services.udisks2.enable = true;
-
-  programs._1password.enable = true;
-  programs._1password-gui.enable = true;
-
-  # higher sample rate for audio equipment
-  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
-    "context.properties" = {
-      "default.clock.rate" = 192000;
-      "default.allowed-rates" = [ 192000 ];
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    easyeffects
-  ];
-
-  xdg.mime.defaultApplications = {
-    "application/pdf" = "org.pwmt.zathura.desktop";
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/tower/configuration.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  userKeys,
+  ...
+}:
+
+{
+  features.nix-settings.towerCache.enable = false;
+  features.bootloader = {
+    mode = "lanzaboote";
+    plymouth.enable = true;
+  };
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };
+
+  # nix store signing
+  sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
+  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
+
+  boot.kernelParams = [ "btusb.reset=1" ];
+  # early kms so plymouth lands on amdgpu, not simpledrm
+  hardware.amdgpu.initrd.enable = true;
+
+  services.udisks2.enable = true;
+
+  # higher sample rate for audio equipment
+  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
+    "context.properties" = {
+      "default.clock.rate" = 192000;
+      "default.allowed-rates" = [ 192000 ];
+    };
+  };
+
+  system.stateVersion = "25.05";
+}

justfile

@@ -3,8 +3,8 @@ default:
     @just --list
 
 # rebuild and switch
-switch:
+switch config="":
-    nixos-rebuild switch --flake . --sudo
+    nixos-rebuild switch --flake .{{ if config != "" { "#" + config } else { "" } }} --sudo
 
 # fetch flake inputs
 sync:
@@ -17,9 +17,50 @@ update:
 # update flake inputs, rebuild and switch
 bump: update switch
 
+# update a package to latest version
+update-package pkg:
+    bash packages/{{pkg}}/update.sh
+
+# update all packages with update scripts
+update-package-all:
+    @for script in packages/*/update.sh; do bash "$script"; done
+
+# build all packages and hosts
+build:
+    nix flake check
+
 # build installation iso
 iso:
-    nixos-rebuild build-image --image-variant iso-installer --flake .#live-iso
+    nixos-rebuild build-image --image-variant iso-installer --flake .#iso
+
+# run ephemeral VM
+ephvm *ARGS:
+    bash scripts/ephvm-run.sh {{ARGS}}
+
+# ssh into running ephemeral VM
+ephvm-ssh port="2222":
+    ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost
+
+# provision a host with nixos-anywhere
+provision host ip:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    tmpdir=$(mktemp -d)
+    trap 'rm -rf "$tmpdir"' EXIT
+    install -d -m 755 "$tmpdir/etc/ssh"
+    ssh-keygen -t ed25519 -f "$tmpdir/etc/ssh/ssh_host_ed25519_key" -N ""
+    age_key=$(ssh-to-age < "$tmpdir/etc/ssh/ssh_host_ed25519_key.pub")
+    echo "age key: $age_key"
+    echo "add this key to .sops.yaml, re-encrypt secrets, then press enter to continue"
+    read -r
+    nix run github:nix-community/nixos-anywhere -- --no-reboot --flake .#{{host}} --extra-files "$tmpdir" --generate-hardware-config nixos-generate-config ./hosts/{{host}}/hardware-configuration.nix root@{{ip}}
+    echo "remove USB and press enter to reboot"
+    read -r
+    ssh root@{{ip}} reboot
+
+# deploy config to a remote host
+deploy host remote=host:
+    nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
 
 # garbage collect old generations
 clean:

lib/autoDir.nix

@@ -1,15 +1,21 @@
 lib:
 
-# import all .nix files in dir as attribute set
+# auto-discover nix modules from a directory
+# - flat .nix files (excluding default.nix) are imported directly
+# - subdirectories containing package.nix are imported via package.nix
 dir:
 let
   readDir = builtins.readDir dir;
-  files = lib.attrNames (
-    lib.filterAttrs (
-      name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix"
-    ) readDir
-  );
 
-  packages = builtins.map (name: lib.removeSuffix ".nix" name) files;
+  files = lib.filterAttrs (
+    name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix"
+  ) readDir;
+
+  dirs = lib.filterAttrs (
+    name: type: type == "directory" && builtins.pathExists (dir + "/${name}/package.nix")
+  ) readDir;
 in
-lib.genAttrs packages (name: import (dir + "/${name}.nix"))
+lib.mapAttrs' (
+  name: _: lib.nameValuePair (lib.removeSuffix ".nix" name) (import (dir + "/${name}"))
+) files
+// lib.mapAttrs (name: _: import (dir + "/${name}/package.nix")) dirs

lib/mkHost.nix

@@ -7,42 +7,102 @@
 name:
 {
   system,
-  users ? [ ],
+  user ? null,
+  features ? [ ],
 }:
 
 let
+  inherit (nixpkgs) lib;
+  hasUser = user != null;
+
+  # path helpers
+  featurePath =
+    f:
+    let
+      file = ../features/${f}.nix;
+      dir = ../features/${f};
+    in
+    if builtins.pathExists file then file else dir;
+  userFeaturePath = u: ../features/user-${u}.nix;
   hostConfig = ../hosts/${name}/configuration.nix;
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
-  hasHWConfig = builtins.pathExists hostHWConfig;
 
-  userNixosConfigs = map (user: ../users/${user}/nixos.nix) (
+  # auto-discover all features, excluding user-* and default.nix
-    builtins.filter (user: builtins.pathExists ../users/${user}/nixos.nix) users
+  featureDir = builtins.readDir ../features;
-  );
+  allFeatureNames = lib.pipe featureDir [
+    (lib.filterAttrs (
+      n: t:
+      (t == "regular" && lib.hasSuffix ".nix" n && n != "default.nix" && !lib.hasPrefix "user-" n)
+      || (t == "directory" && builtins.pathExists ../features/${n}/default.nix)
+    ))
+    builtins.attrNames
+    (map (n: lib.removeSuffix ".nix" n))
+  ];
 
-  userHMConfigs = nixpkgs.lib.genAttrs users (user: import ../users/${user}/home-manager.nix);
+  # load all features unconditionally
+  loadFeature =
+    f:
+    assert
+      builtins.pathExists (featurePath f)
+      || throw "feature '${f}' not found at ${toString (featurePath f)}";
+    import (featurePath f);
 
+  loadedFeatures = map loadFeature allFeatureNames;
+
+  # load user feature with path check
+  userFeature =
+    if hasUser then
+      assert
+        builtins.pathExists (userFeaturePath user)
+        || throw "user feature 'user-${user}' not found at ${toString (userFeaturePath user)}";
+      import (userFeaturePath user)
+    else
+      null;
+
+  allFeatures = loadedFeatures ++ lib.optional (userFeature != null) userFeature;
+
+  # extract keys from user feature for specialArgs
+  userKeys = if userFeature != null then (userFeature.keys or { }) else { };
+
+  # collect nixos and home modules from all features
+  nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
+  homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
+
+  # translate features list to enable flags
+  featureEnableModule =
+    { lib, ... }:
+    {
+      config.features = lib.genAttrs features (_: {
+        enable = true;
+      });
+    };
 in
 nixpkgs.lib.nixosSystem {
   inherit system;
   modules = [
-    ../nix.nix
+    inputs.sops-nix.nixosModules.sops
+    inputs.stylix.nixosModules.stylix
 
     { nixpkgs.overlays = overlays; }
     { nixpkgs.config.allowUnfree = true; }
+    { networking.hostName = name; }
 
+    featureEnableModule
     hostConfig
   ]
-  ++ nixpkgs.lib.optional hasHWConfig hostHWConfig
+  ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
-  ++ userNixosConfigs
+  ++ nixosMods
-  ++ [
+  ++ lib.optionals hasUser [
     inputs.home-manager.nixosModules.home-manager
     {
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
       home-manager.backupFileExtension = "backup";
-      home-manager.users = userHMConfigs;
+      home-manager.users.${user}.imports = homeMods;
       home-manager.extraSpecialArgs = { inherit inputs; };
     }
   ];
-  specialArgs = { inherit inputs; };
+  specialArgs = {
+    inherit inputs userKeys user;
+  };
 }

modules/nixos/default.nix

@@ -1 +0,0 @@
-{ lib, my-lib }: args: (my-lib.autoDir ./.)

modules/nixos/desktop.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    desktop = {
-      enable = lib.mkEnableOption "base desktop environment";
-    };
-  };
-
-  config = lib.mkIf config.desktop.enable {
-    services.pipewire = {
-      enable = true;
-      pulse.enable = true;
-    };
-
-    hardware.bluetooth.enable = true;
-    services.blueman.enable = true;
-
-    security.polkit.enable = true;
-
-    services.dbus.enable = true;
-
-    services.playerctld.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      xdgOpenUsePortal = true;
-      extraPortals = [
-        pkgs.xdg-desktop-portal-wlr
-        pkgs.xdg-desktop-portal-gtk
-      ];
-    };
-
-    fonts.packages = with pkgs; [
-      font-awesome
-      nerd-fonts.jetbrains-mono
-      maple-mono.NF
-    ];
-  };
-}

modules/nixos/gnupg.nix

@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    gnupg = {
-      enable = lib.mkEnableOption "GnuPG agent with SSH support";
-    };
-  };
-
-  config = lib.mkIf config.gnupg.enable {
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableExtraSocket = true;
-    };
-  };
-}

modules/nixos/initrd-ssh.nix

@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  # TODO:(@janezicmatej) restructure keys import
-  keys = import ../../users/matej/keys.nix;
-
-  # generate host keys for new machines: ./scripts/initrd-ssh-keygen.sh
-  keyDir = "/etc/secrets/initrd";
-
-  mkIpString =
-    {
-      address,
-      gateway,
-      netmask,
-      interface,
-      ...
-    }:
-    "${address}::${gateway}:${netmask}::${interface}:none";
-in
-{
-  options = {
-    initrd-ssh = {
-      enable = lib.mkEnableOption "SSH in initrd for remote LUKS unlock";
-
-      ip = {
-        enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-        address = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.247";
-        };
-
-        gateway = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.1";
-        };
-
-        netmask = lib.mkOption {
-          type = lib.types.str;
-          default = "255.255.255.0";
-        };
-
-        interface = lib.mkOption {
-          type = lib.types.str;
-          example = "enp5s0";
-        };
-      };
-
-      authorizedKeys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = keys.sshAuthorizedKeys;
-      };
-
-      networkModule = lib.mkOption {
-        type = lib.types.str;
-        example = "r8169";
-      };
-    };
-  };
-
-  config = lib.mkIf config.initrd-ssh.enable {
-    boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-    boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-      "ip=${mkIpString config.initrd-ssh.ip}"
-    ];
-
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 22;
-        hostKeys = [
-          "${keyDir}/ssh_host_rsa_key"
-          "${keyDir}/ssh_host_ed25519_key"
-        ];
-        inherit (config.initrd-ssh) authorizedKeys;
-      };
-      postCommands = ''
-        echo 'cryptsetup-askpass' >> /root/.profile
-      '';
-    };
-  };
-}

modules/nixos/nvidia.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    nvidia.enable = lib.mkEnableOption "NVIDIA GPU support";
-  };
-
-  config = lib.mkIf config.nvidia.enable {
-    hardware.graphics.enable = true;
-
-    services.xserver.videoDrivers = [ "nvidia" ];
-
-    hardware.nvidia = {
-      modesetting.enable = true;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
-}

modules/nixos/openssh.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    openssh = {
-      enable = lib.mkEnableOption "hardened SSH server";
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 22;
-      };
-    };
-  };
-
-  config = lib.mkIf config.openssh.enable {
-    services.openssh = {
-      enable = true;
-      ports = [ config.openssh.port ];
-      settings = {
-        PasswordAuthentication = false;
-        AllowUsers = null;
-        PermitRootLogin = "no";
-        StreamLocalBindUnlink = "yes";
-      };
-    };
-  };
-}

modules/nixos/printing.nix

@@ -1,21 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    printing = {
-      enable = lib.mkEnableOption "CUPS printing with Avahi discovery";
-    };
-  };
-
-  config = lib.mkIf config.printing.enable {
-    services.printing.enable = true;
-    services.avahi = {
-      enable = true;
-      nssmdns4 = true;
-      openFirewall = true;
-    };
-  };
-}

modules/nixos/sway.nix

@@ -1,51 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    sway = {
-      enable = lib.mkEnableOption "enable sway module";
-      cmdFlags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-      };
-    };
-  };
-
-  config = lib.mkIf config.sway.enable {
-    programs.sway = {
-      enable = true;
-      package = pkgs.swayfx;
-      wrapperFeatures.gtk = true;
-      extraOptions = config.sway.cmdFlags;
-      extraSessionCommands = ''
-        # fix for java awt apps not rendering
-        export _JAVA_AWT_WM_NONREPARENTING=1
-      '';
-    };
-
-    environment.systemPackages = with pkgs; [
-      brightnessctl
-      foot
-      grim
-      pulseaudio
-      swayidle
-      # use swaylock-effects instead of swaylock
-      swaylock-effects
-      wmenu
-      slurp
-      wofi
-      wl-clipboard
-      wob
-      pamixer
-      wlsunset
-      flameshot
-      waybar
-      wayland-pipewire-idle-inhibit
-    ];
-  };
-}

modules/nixos/tuigreet.nix

@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    tuigreet = {
-      enable = lib.mkEnableOption "greetd with tuigreet";
-
-      command = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-
-  config = lib.mkIf config.tuigreet.enable {
-    services.greetd = {
-      enable = true;
-      useTextGreeter = true;
-      settings = {
-        default_session = {
-          command = pkgs.writeShellScript "tuigreet-session" ''
-            ${pkgs.util-linux}/bin/setterm --blank 1 --powersave powerdown --powerdown 1
-            exec ${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd ${config.tuigreet.command}
-          '';
-          user = "greeter";
-        };
-      };
-    };
-  };
-}

modules/nixos/workstation.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    workstation = {
-      enable = lib.mkEnableOption "workstation utilities";
-    };
-  };
-
-  config = lib.mkIf config.workstation.enable {
-    virtualisation.docker = {
-      enable = true;
-      logDriver = "json-file";
-    };
-
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    environment.systemPackages = with pkgs; [
-      smartmontools
-    ];
-  };
-}

modules/nixos/yubikey.nix

@@ -1,23 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    yubikey = {
-      enable = lib.mkEnableOption "enable yubikey module";
-    };
-  };
-
-  config = lib.mkIf config.yubikey.enable {
-    environment.systemPackages = with pkgs; [
-      yubikey-personalization
-      yubikey-manager
-    ];
-
-    services.pcscd.enable = true;
-  };
-}

modules/nixos/zsh.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    zsh = {
-      enable = lib.mkEnableOption "zsh with ZDOTDIR in ~/.config/zsh";
-    };
-  };
-
-  config = lib.mkIf config.zsh.enable {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-}

nix.nix

@@ -7,6 +7,16 @@
       ];
       download-buffer-size = 2 * 1024 * 1024 * 1024;
       warn-dirty = false;
+      substituters = [
+        "https://cache.nixos.org"
+        "https://nix-community.cachix.org?priority=45"
+        "http://tower:5000?priority=50"
+      ];
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE="
+      ];
     };
 
     gc = {

packages/ahab.nix

@@ -1,28 +0,0 @@
-{ pkgs, ... }:
-
-let
-  version = "v0.3.2";
-in
-pkgs.rustPlatform.buildRustPackage {
-  pname = "ahab";
-  inherit version;
-
-  src = pkgs.fetchFromGitea {
-    domain = "git.janezic.dev";
-    owner = "janezicmatej";
-    repo = "ahab";
-    rev = version;
-    sha256 = "sha256-bL8LPpD5k97XPYftXhPr7V/LNOB71pcBlsfBjJUIeG8";
-  };
-
-  cargoHash = "sha256-f8omNtjLF5gMJGgxdzWifStcs8d4fu++EegR2auObXE";
-
-  buildType = "debug";
-
-  meta = {
-    description = "ahab";
-    homepage = "https://git.janezic.dev/janezicmatej/ahab";
-    license = pkgs.lib.licenses.mit;
-    maintainers = [ ];
-  };
-}

packages/ahab/package.nix

@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+
+let
+  version = "v0.4.2";
+in
+pkgs.rustPlatform.buildRustPackage {
+  pname = "ahab";
+  inherit version;
+
+  src = pkgs.fetchFromGitea {
+    domain = "git.janezic.dev";
+    owner = "janezicmatej";
+    repo = "ahab";
+    rev = version;
+    sha256 = "sha256-hJg6vRaqTu9a3fua2J/e6akdJQffAk6TBAzJRBD5qHQ=";
+  };
+
+  cargoHash = "sha256-T/2+kxa5X2fmMQs023JN9ZDihExfYvPnunJ8b2Irwoo=";
+
+  buildType = "debug";
+
+  nativeBuildInputs = [ pkgs.installShellFiles ];
+
+  preBuild = ''
+    mkdir -p completions
+  '';
+
+  SHELL_COMPLETIONS_DIR = "completions";
+
+  postInstall = ''
+    installShellCompletion --bash completions/ahab.bash
+    installShellCompletion --zsh completions/_ahab
+    installShellCompletion --fish completions/ahab.fish
+  '';
+
+  meta = {
+    description = "ahab";
+    homepage = "https://git.janezic.dev/janezicmatej/ahab";
+    license = pkgs.lib.licenses.mit;
+    maintainers = [ ];
+  };
+}

packages/ahab/update.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+	sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+main() {
+	echo "fetching latest version..."
+	local latest current
+	latest=$(curl -sf "https://git.janezic.dev/api/v1/repos/janezicmatej/ahab/tags?limit=1" | jq -r '.[0].name')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "ahab already at $latest"
+		return 0
+	fi
+
+	echo "updating ahab: $current -> $latest"
+
+	echo "  prefetching source..."
+	local base32 src_hash
+	base32=$(nix-prefetch-url --unpack "https://git.janezic.dev/janezicmatej/ahab/archive/${latest}.tar.gz" 2>/dev/null)
+	src_hash=$(nix hash convert --to sri "sha256:$base32")
+	echo "  source: $src_hash"
+
+	echo "  computing cargo hash..."
+	local build_output cargo_hash
+	build_output=$(nix build --no-link --impure --expr "
+    let
+      pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+    in pkgs.rustPlatform.fetchCargoVendor {
+      src = pkgs.fetchFromGitea {
+        domain = \"git.janezic.dev\";
+        owner = \"janezicmatej\";
+        repo = \"ahab\";
+        rev = \"$latest\";
+        hash = \"$src_hash\";
+      };
+      hash = \"\";
+    }
+  " 2>&1) || true
+	cargo_hash=$(echo "$build_output" | extract_hash) || true
+
+	if [[ -z "$cargo_hash" ]]; then
+		echo "error: failed to compute cargo hash" >&2
+		echo "$build_output" >&2
+		exit 1
+	fi
+	echo "  cargo: $cargo_hash"
+
+	local old_src old_cargo
+	old_src=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+	old_cargo=$(grep 'cargoHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+	sed -i "s|$old_src|$src_hash|" "$PKG_FILE"
+	sed -i "s|$old_cargo|$cargo_hash|" "$PKG_FILE"
+
+	echo "ahab updated to $latest"
+}
+
+main "$@"

packages/claude-code/package.nix

@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) stdenv lib;
+  version = "2.1.116";
+
+  # upstream ships platform-native binaries as separate npm packages under
+  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
+  # postinstall shim that copies the matching one into place
+  sources = {
+    "x86_64-linux" = {
+      slug = "linux-x64";
+      hash = "sha256-QEjJ4CRk35TubDNW02Dzcu+EMRLLndJUXJeP3BFT3b8=";
+    };
+    "aarch64-linux" = {
+      slug = "linux-arm64";
+      hash = "sha256-/Hqp8GQx8Hub8K4w0Fnx/AksksY61vRC44XxrJVwF5w=";
+    };
+    "x86_64-darwin" = {
+      slug = "darwin-x64";
+      hash = "sha256-O3J/ew2fWbUQePs6tHEhK0Q9E3Mx/BDSL7b7NL3FRc8=";
+    };
+    "aarch64-darwin" = {
+      slug = "darwin-arm64";
+      hash = "sha256-O41sf7b05SJfXVjszMeTp838mja+PgZ+aEKykLsHeNo=";
+    };
+  };
+
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "claude-code: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "claude-code";
+  inherit version;
+
+  src = pkgs.fetchzip {
+    url = "https://registry.npmjs.org/@anthropic-ai/claude-code-${source.slug}/-/claude-code-${source.slug}-${version}.tgz";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.patchelf ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 claude $out/bin/claude
+    runHook postInstall
+  '';
+
+  # NOTE:(@janezicmatej) upstream is a bun single-file-executable; the
+  # embedded script payload sits at the tail of the ELF, so autoPatchelfHook's
+  # section-layout changes corrupt it — only the interpreter can be rewritten
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} $out/bin/claude
+    ''
+    + ''
+      wrapProgram $out/bin/claude \
+        --set DISABLE_AUTOUPDATER 1 \
+        --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+        --set DISABLE_INSTALLATION_CHECKS 1 \
+        --unset DEV \
+        --prefix PATH : ${
+          lib.makeBinPath (
+            [
+              pkgs.procps
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isLinux [
+              pkgs.bubblewrap
+              pkgs.socat
+            ]
+          )
+        }
+    '';
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://www.npmjs.com/package/@anthropic-ai/claude-code";
+    license = lib.licenses.unfree;
+    mainProgram = "claude";
+    platforms = lib.attrNames sources;
+  };
+}

packages/claude-code/update.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+# keep in sync with the `sources` attrset in package.nix
+PLATFORMS=(linux-x64 linux-arm64 darwin-x64 darwin-arm64)
+
+prefetch() {
+	local url="$1"
+	nix --extra-experimental-features 'nix-command flakes' \
+		store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r '.hash'
+}
+
+main() {
+	echo "fetching latest version from npm..."
+	local latest current
+	latest=$(curl -sf "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" | jq -r '.version')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "claude-code already at $latest"
+		return 0
+	fi
+
+	echo "updating claude-code: $current -> $latest"
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+
+	local slug url new_hash old_hash
+	for slug in "${PLATFORMS[@]}"; do
+		url="https://registry.npmjs.org/@anthropic-ai/claude-code-${slug}/-/claude-code-${slug}-${latest}.tgz"
+		echo "  prefetching $slug..."
+		new_hash=$(prefetch "$url")
+		old_hash=$(awk -v slug="$slug" '
+			$0 ~ "slug = \"" slug "\";" { found=1; next }
+			found && /hash = "sha256-/ {
+				match($0, /sha256-[A-Za-z0-9+\/]+=*/)
+				print substr($0, RSTART, RLENGTH)
+				exit
+			}
+		' "$PKG_FILE")
+		sed -i "s|$old_hash|$new_hash|" "$PKG_FILE"
+		echo "    $new_hash"
+	done
+
+	echo "claude-code updated to $latest"
+}
+
+main "$@"

packages/ggman/package.nix

@@ -2,7 +2,7 @@
 
 let
   pkgs = pkgs-master;
-  version = "e24855c";
+  version = "v1.27.1";
 in
 pkgs.buildGoModule.override
   {
@@ -16,16 +16,25 @@ pkgs.buildGoModule.override
       owner = "tkw1536";
       repo = "ggman";
       rev = version;
-      sha256 = "sha256-H78xtF7l5joX3/qDFaRIT4LyZpHmm6DMR4JIKzNO7c0=";
+      sha256 = "sha256-z7zqV69rPYwtkm4ieF+FIssBsFbREvaYQzSF648DHK0=";
     };
 
-    vendorHash = "sha256-w8NrOt0xtn+/gugJ4amzdJP70Y5KHe5DlhsEprycm3U=";
+    vendorHash = "sha256-5c5EgYjZXfexWMrUDS4fo46GCJBmFuWkw0cVqqGT7Ik=";
     subPackages = [ "cmd/ggman" ];
 
     ldflags = [
       "-X go.tkw01536.de/ggman.buildVersion=${version}"
     ];
 
+    nativeBuildInputs = [ pkgs.installShellFiles ];
+
+    postInstall = ''
+      installShellCompletion --cmd ggman \
+        --bash <($out/bin/ggman completion bash) \
+        --zsh <($out/bin/ggman completion zsh) \
+        --fish <($out/bin/ggman completion fish)
+    '';
+
     meta = {
       description = "Manager for all your local git repositories";
       homepage = "https://github.com/tkw1536/ggman";

packages/ggman/update.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+	sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+main() {
+	echo "fetching latest tag..."
+	local latest current
+	latest=$(curl -sf "https://api.github.com/repos/tkw1536/ggman/tags?per_page=1" | jq -r '.[0].name')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "ggman already at $latest"
+		return 0
+	fi
+
+	echo "updating ggman: $current -> $latest"
+
+	echo "  prefetching source..."
+	local base32 src_hash
+	base32=$(nix-prefetch-url --unpack "https://github.com/tkw1536/ggman/archive/${latest}.tar.gz" 2>/dev/null)
+	src_hash=$(nix hash convert --to sri "sha256:$base32")
+	echo "  source: $src_hash"
+
+	echo "  computing vendor hash..."
+	local build_output vendor_hash
+	build_output=$(nix build --no-link --impure --expr "
+    let
+      pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs-master.legacyPackages.\${builtins.currentSystem};
+    in (pkgs.buildGoModule.override { go = pkgs.go_1_26; } {
+      pname = \"ggman\";
+      version = \"$latest\";
+      src = pkgs.fetchFromGitHub {
+        owner = \"tkw1536\";
+        repo = \"ggman\";
+        rev = \"$latest\";
+        hash = \"$src_hash\";
+      };
+      vendorHash = \"\";
+    }).goModules
+  " 2>&1) || true
+	vendor_hash=$(echo "$build_output" | extract_hash) || true
+
+	if [[ -z "$vendor_hash" ]]; then
+		echo "error: failed to compute vendor hash" >&2
+		echo "$build_output" >&2
+		exit 1
+	fi
+	echo "  vendor: $vendor_hash"
+
+	local old_src old_vendor
+	old_src=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+	old_vendor=$(grep 'vendorHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+	sed -i "s|$old_src|$src_hash|" "$PKG_FILE"
+	sed -i "s|$old_vendor|$vendor_hash|" "$PKG_FILE"
+
+	echo "ggman updated to $latest"
+}
+
+main "$@"

scripts/ephvm-run.sh

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+setup_colors() {
+	if [ -t 2 ]; then
+		red=$'\033[31m'
+		yellow=$'\033[33m'
+		cyan=$'\033[36m'
+		reset=$'\033[0m'
+	else
+		red="" yellow="" cyan="" reset=""
+	fi
+}
+
+die() {
+	echo "${red}error:${reset} $*" >&2
+	exit 1
+}
+
+warn() {
+	echo "${yellow}warning:${reset} $*" >&2
+}
+
+info() {
+	echo "${cyan}$*${reset}" >&2
+}
+
+# globals for cleanup trap
+CLEANUP_OVERLAY=""
+CLEANUP_TMPDIR=""
+QEMU_PID=""
+VM_READY=false
+cleanup() {
+	[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
+	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	# preserve tmpdir on abnormal exit so the qemu log survives for inspection
+	if [ -n "$CLEANUP_TMPDIR" ]; then
+		if [ "$VM_READY" = true ]; then
+			rm -rf "$CLEANUP_TMPDIR"
+		else
+			echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
+		fi
+	fi
+	return 0
+}
+trap cleanup EXIT
+
+# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
+awaiting_ssh_banner() {
+	local port="$1"
+	local banner
+	banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
+	[ "$banner" = "SSH-" ]
+}
+
+usage() {
+	cat <<EOF
+Usage: ephvm-run.sh [options]
+
+Options:
+  --mount <path>       Mount host directory into VM (repeatable)
+  --no-claude          Skip mounting claude config dir
+  --disk-size <size>   Resize guest disk (e.g. 50G)
+  --memory <size>      VM memory (default: 4G)
+  --cpus <n>           VM CPUs (default: 2)
+  --ssh-port <port>    Use specific SSH port (default: auto)
+  --serial             Attach to serial console instead of SSH
+  -h, --help           Show usage
+EOF
+	exit "${1:-0}"
+}
+
+main() {
+	setup_colors
+
+	[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
+
+	local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
+	local -a mounts=()
+
+	while [ $# -gt 0 ]; do
+		case "$1" in
+		--mount)
+			mounts+=("$2")
+			shift 2
+			;;
+		--no-claude)
+			claude=false
+			shift
+			;;
+		--disk-size)
+			disk_size="$2"
+			shift 2
+			;;
+		--memory)
+			memory="$2"
+			shift 2
+			;;
+		--cpus)
+			cpus="$2"
+			shift 2
+			;;
+		--ssh-port)
+			ssh_port="$2"
+			shift 2
+			;;
+		--serial)
+			serial=true
+			shift
+			;;
+		-h | --help) usage ;;
+		*)
+			echo "${red}error:${reset} unknown option: $1" >&2
+			usage 1
+			;;
+		esac
+	done
+
+	info "building ephvm image..."
+	local image_dir image
+	[ -n "${EPHVM_FLAKE:-}" ] || die "EPHVM_FLAKE must be set to the flake directory"
+	local flake="$EPHVM_FLAKE"
+	image_dir=$(nix build --no-link --print-out-paths "${flake}#nixosConfigurations.ephvm.config.system.build.images.qemu")
+	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
+	[ -n "$image" ] || die "no qcow2 image found in $image_dir"
+
+	# create resized overlay when --disk-size is given
+	local drive_arg
+	if [ -n "$disk_size" ]; then
+		CLEANUP_OVERLAY=$(mktemp -d)
+		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
+		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
+		drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
+	else
+		drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
+	fi
+
+	command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
+	[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
+
+	# auto-allocate ssh port unless serial mode
+	if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
+		ssh_port=10022
+		while ss -tln | grep -q ":${ssh_port}\b"; do
+			ssh_port=$((ssh_port + 1))
+		done
+	fi
+
+	local nic_arg="user,model=virtio-net-pci"
+	if [ -n "$ssh_port" ]; then
+		nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
+	fi
+
+	local -a qemu_args=(
+		qemu-system-x86_64
+		-accel kvm
+		-cpu host
+		-m "$memory"
+		-smp "$cpus"
+		-drive "$drive_arg"
+		-device "virtio-blk-pci,drive=hd0"
+		-device virtio-rng-pci
+		-nic "$nic_arg"
+		-nographic
+		-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
+	)
+
+	local fs_id=0 mount_path name tag
+	for mount_path in "${mounts[@]}"; do
+		[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
+		mount_path=$(realpath "$mount_path")
+		# qemu parses -virtfs as csv, a comma in the path would inject options
+		case "$mount_path" in
+		*,*) die "--mount path may not contain commas: $mount_path" ;;
+		esac
+		name=$(basename "$mount_path")
+		tag="m_${name:0:29}"
+		qemu_args+=(
+			-virtfs "local,path=$mount_path,mount_tag=$tag,security_model=none,id=fs${fs_id}"
+		)
+		fs_id=$((fs_id + 1))
+	done
+
+	if [ "$claude" = true ]; then
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "CLAUDE_CONFIG_DIR must be set (use --no-claude to skip)"
+		mkdir -p "$CLAUDE_CONFIG_DIR"
+		local claude_dir
+		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+		case "$claude_dir" in
+		*,*) die "claude config dir may not contain commas: $claude_dir" ;;
+		esac
+
+		qemu_args+=(
+			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
+		)
+		fs_id=$((fs_id + 1))
+	fi
+
+	info "---"
+	[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
+	info "---"
+
+	if [ "$serial" = true ]; then
+		exec "${qemu_args[@]}"
+	fi
+
+	CLEANUP_TMPDIR=$(mktemp -d)
+	local qemu_log="$CLEANUP_TMPDIR/qemu.log"
+
+	# start qemu in background and auto-ssh
+	"${qemu_args[@]}" &>"$qemu_log" &
+	QEMU_PID=$!
+
+	# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
+	local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
+	ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
+
+	info "waiting for vm (port $ssh_port)..."
+	local attempts=0
+	# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
+	# accepts host-side the moment qemu starts, well before guest sshd is up
+	while ! awaiting_ssh_banner "$ssh_port"; do
+		attempts=$((attempts + 1))
+		[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
+		kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
+		sleep 0.5
+	done
+	VM_READY=true
+
+	ssh -p "$ssh_port" -t \
+		-i "$ssh_key" \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o LogLevel=ERROR \
+		matej@localhost
+}
+
+main "$@"

scripts/initrd-ssh-keygen.sh

@@ -3,22 +3,22 @@ set -euo pipefail
 
 KEY_DIR="/etc/secrets/initrd"
 
-echo "Generating initrd SSH host keys in $KEY_DIR"
+main() {
+	echo "generating initrd SSH host keys in $KEY_DIR"
+	sudo mkdir -p "$KEY_DIR"
 
-sudo mkdir -p "$KEY_DIR"
+	local key_type
+	for key_type in rsa ed25519; do
+		local key_file="$KEY_DIR/ssh_host_${key_type}_key"
+		if [[ ! -f "$key_file" ]]; then
+			sudo ssh-keygen -t "$key_type" -N "" -f "$key_file"
+			echo "generated: $key_file"
+		else
+			echo "exists: $key_file"
+		fi
+	done
 
-if [[ ! -f "$KEY_DIR/ssh_host_rsa_key" ]]; then
+	echo "done. now run nixos-rebuild."
-  sudo ssh-keygen -t rsa -N "" -f "$KEY_DIR/ssh_host_rsa_key"
+}
-  echo "Generated: $KEY_DIR/ssh_host_rsa_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_rsa_key"
-fi
 
-if [[ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]]; then
+main "$@"
-  sudo ssh-keygen -t ed25519 -N "" -f "$KEY_DIR/ssh_host_ed25519_key"
-  echo "Generated: $KEY_DIR/ssh_host_ed25519_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_ed25519_key"
-fi
-
-echo "Done. Now run nixos-rebuild."

secrets/common.yaml

@@ -0,0 +1,55 @@
+user-password: ENC[AES256_GCM,data:c7y3RZSikVS32w7RTY5nBSWxDWbwNI5FhLIEoXcru5lpCUu3YqKjHNm8eMI7oeAg1VQIW/1axv0LPHM+bb7wn7SSHy49EvGyda4AU8hdVnsO9gNBul9WQy9Q6RM1PR5vW+IbX1HBFPTTOQ==,iv:oNsDzDugNq2E1CJ89BCXZ/ieCGV+evOwsOuKlKsotBg=,tag:jU8g9fIgexw2bm3E+ow3wA==,type:str]
+sops:
+    age:
+        - recipient: age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOU9BTksxbXdjTkExRDJV
+            aFhVbUFGd1ZSeHFBL0lJRjdSRDRjcjl6ZEQ0Cjg2TFlNZENUWTh5aWNGck52TWFx
+            SC9LS0FrelFCWUI3RUZjdCs3cXF6aDQKLS0tIEwwTWkzOXgxUC9iTFgrQ0szRW8v
+            cGFMa2Rqd1VvWjU3Z2pUdExsdnJUT1EK9iQiW5qZszu65b0wEeq+9JnzzhiAS7fo
+            BmR9OWbDA4GZJBEPBJFD8KxIcO/BYFOjfW2A9PZaTsTpa50Z6+zWxw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19qj2aaryx869cvcqp77gs9x5hcv4dqjxunkmyre78upsxda6ss7s5vquz4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPczdWeTRxalA1M3R0S0Qr
+            eGdtZnJxaHllZ2lKMXJUZTN3VWhhTnU1TFRnCjM5OHoxMnEzKzdQelZEQ3ZZRFpt
+            aWRzaTg4dUc5OXpQUngrVmtSRkk1Q3MKLS0tIEZOd0FyMFRlRElWbjlHOVVkZlZP
+            eEhwRVRrcVgvQUx6bi85YWxDYjJZa28K7Hrk4fAqbjeYJfPJODvsth1p8JYbsfMf
+            a6gTckyeQWTNlE+1Tw6g18lvMP1dzIAYRPHtyzmxeCaETVMmSn7XxQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbUh0U1ZDc0ZOKzhxZ3Yv
+            ZHRwbzBIdVNsbEJmU0h4ZnpuTlNHSFdwRlQ0Ck1BREhlVFQ3bnVKajVlTGUzRjhN
+            cWpna25Ya1hoZG1ybFZ0REpCNTFTZmcKLS0tIG5ZQzNIWmd4a3J6YWxDQjYyY2px
+            Y085TkhubS9MSjJtMmZDakdZd2RhR3cKlGH906WAhXNDKwaWqHRoYO9bgiZau0ay
+            8ph3OLOVmrENPW3Othf17NDRet/nATFYZghBU/CI5CvZjr9n9SDYMg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15cktenavt5v7zm84se36jtly740syca5nw8em8edx404n5x2ddws8jn29g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRG5zRkxOT0RyeXVpTDJu
+            TSt2SFFtSlFrSTk1YUZBMnAxTEM3dnFnQkFrClA0cnVpMkdsQWxCakNEZm16OEVG
+            dHFIUDA3TDJLdytySEJJMSsrMGZHcTgKLS0tIHhvdWNXaUthbDJqMWVYeWxuOGpL
+            L0lEZ3FVbmlOcndGUXUybXA4RDA2alUKQo5ctVmARPNY0POf2Ft6AxjwIN1N06C7
+            ft4YX+B4D61tUZ+uvFqHzmKsNpvDdoV81zxvGnnCnv0nSXwNghPFxw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-29T23:11:10Z"
+    mac: ENC[AES256_GCM,data:XY5wElDn+YD4UHSIGd9Ru8ob39gJVE8VE5gqJJkmzF/xERXp7re/d/6RXxoYDgYS0qUnn8c2VFzJxCvakmV/lPLA8YulFk/ZDysEVn+U3CbfTIkjXcJzewJNz0N+hQKeVaCzPfWeB5oaGtB8bjxOg+GYz2TmSvEAT+kO1U/4Klg=,iv:QOlZ4O+eqvOS9/guc+RmWgVDgPzskb4WIlzyT/14MVM=,tag:ziJE9Yytlr680EpSnBGmdQ==,type:str]
+    pgp:
+        - created_at: "2026-03-29T23:25:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdAPlvxgVq9o2boPPXWWwV6X3TjHZEl3lm9OcOj7lbsQxsw
+            5PTrX1rIV73XbRQUdFlnoYpUAwxh3UPULyA4+19fvCooC3L0FxA8e4wTiAdw6SKE
+            0l4BImy4sTiM8hNHXqB6u4rj3LbykCjesQve5C3fut62RV8x4cqUJHAB/aumQINT
+            QRXErylKmqo3h7ReRrCm2oOELauv4JFKNPi/cTE0MNh1+w9JxjoASoBufozDOxe4
+            =vIK+
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1

secrets/floo.yaml

@@ -0,0 +1,28 @@
+filedrop-authorized-keys: ENC[AES256_GCM,data:3zg0ZZR/EfmffhT+5hiiCawhHW0Y8VOcsMRwPq50AgSvM8DJO/fOK5RhPMlHmOOXSbYYal9QoPILP5rSHDMszk6QSRqmvAbpkpJhgfW4jx8XbLTFxO4lUKe/hd968ryqP2pXtZzUBnOp4vSI29LcYms6e8fSwS8ANtSIjCLkEsY=,iv:EOjsWB7uxjqI5NXot586Q0997SOmkAMwVkxm6VLplDc=,tag:Q4rB6KFibV+F79/rs5m0dA==,type:str]
+sops:
+    age:
+        - recipient: age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTRk1qOGNGNFp4VS9GOUs0
+            dTQ0K3A2Y3VXY3NSV0RyU0VxV3VCa0dDOG5zClAvOElXcHhYaWNCamxFZHMvV2Iy
+            WFRwNFRjaHpKSDdkak5UK05hd0hYMFUKLS0tIGRQeVJGdk8vYVdQdS9BYVd3TEhn
+            UWxzeHlaY2pvdS9tbW9vaVE5NTNwRFEKKieIA5Sn6oN5qjDwh5/usaKwLdYPClmS
+            d+hBdcn4/mtQnrm9dnbRVHd/B1MOuQxoXEB1kc4nzFKvCEqRdRIlYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-09T08:57:26Z"
+    mac: ENC[AES256_GCM,data:XHC5cBvQuDi9byVgDymx9qSbplDlHwFTSLaGfWTRQJZeioBelDgBwUstbgWDeNPj1RzGGaSa3+kDOa054DuXi/mw2nDnLGuQDFAmJ66kepJE1mw4F6i4+YnbSE+y7GTbTkUkvbmiNV7uGO4Fq9jy/gNb1wq3IHzDVaKNjNbkKAk=,iv:qK/tgbAkxGpfgJAjBrqDwO/lVkD79pY9S3hzXGGycvM=,tag:oHURU988sW4iN7fXwurOtQ==,type:str]
+    pgp:
+        - created_at: "2026-04-09T08:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdATk1lN0/WDX6S1oPje9jZloSll1qSNau3zgt67CrselMw
+            YlbenxVeY8G4qTvfimX9/qH1/SNHkL/B0jqMCEkw8EpeyA3oEIWuzEEEOA+W/Iri
+            0lwB26CTd8PKwvjuMwmvzTaZfQ9fk+ZsvIjtQaj//WA2utfU4b9T2E+M2Jb5vyki
+            INcWT4PJkNSDxm5NabcTqyetcorDGaU1oN/T1p7pvRBvGCSHItYthVvq/RC0bw==
+            =pKJc
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

secrets/tower.yaml

@@ -0,0 +1,28 @@
+nix-signing-key: ENC[AES256_GCM,data:V/mFaYQazqn3KkbDSt5Fnrl/IFvS9kEe10uhkPHeBluZGjFphKD+2dFCQrPPcXreX0UWklQA9Dokd2cGQBGZIUihJE9o9lH+Q6nrmqk3xsi1fzPS5l8zbn4RITmL3rNkmycXBw==,iv:g/jbUS88IBXnb9e6jGiWYHGfCZtdgI1X167hNmzUQEY=,tag:vO5kiN01FzU7s5jOCGW3Fg==,type:str]
+sops:
+    age:
+        - recipient: age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbkdXUW5YSTA4c3MyZzdi
+            ZlF0L2FQZmttbFBaVmlaWWppaXUxUVdYZEZZCmJHT25IZVBESHVqUWE2bnBYWXQ5
+            UTFLeXg3eUpyWngxc1FXUzhXRCs3R2MKLS0tIGxkbzFMaEUycCtpOC9mTitpVEZh
+            c0pROVJpMjJ6bHd1aEQ2QVE5MUUwdnMK/3tXEStP8JF/2c5nAJ19uA+P1cMG1X+v
+            H5b49uBJ+0UUGMzUpCLgMKz8bq+L8Se0b92iMW5bGW1Fdg/zwJWXOw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-29T21:47:29Z"
+    mac: ENC[AES256_GCM,data:573t4NH/764zZKzhhpVbzNzpN4QrBjwesIBMyHe7aB47ptGceLhnm+cHOhty3J89VBgn8jgHv5WCBzXFER0LDuQUMFPg6snJ0DK+IgRwuAwNbZdKdSR6VnjqOSBnaijU/Wx93kd/gcMqerYo6rEOLNjVadKgs+NYPLKC/dY4sVs=,iv:kOTr9CIvp6haV8BxTpQfdndYTjZRcmyg+7yjPjHRNLU=,tag:1odj8DYHSnOatRnqyZAcgg==,type:str]
+    pgp:
+        - created_at: "2026-03-29T21:46:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdA4NO+XFIyWa8YNV24yrosJKMQ60rmiEWYLjFdIkPrKz8w
+            cj1x62iDXeO6DYvyCZnw2h0WstIrXziX6PySveTVnCri90QdLl3jsolIW+V13b8V
+            0lEB5LFvx7OdZJPzrs32qiPv+ofleSMKAokPEhSTKccFI2GbyUiIw7ge2vHSjNpT
+            T9E3tA7HOglyopKTjFw/ujEhKDSRGXwdD2VEYH426Dt8JjU=
+            =E3fO
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1

users/gorazd/home-manager.nix

@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  home.stateVersion = "24.11";
-
-  home.packages = [
-    pkgs.git
-  ];
-
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    defaultEditor = true;
-
-    package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
-
-    extraPackages = with pkgs; [
-      # runtime deps
-      fzf
-      ripgrep
-      gnumake
-      gcc
-      luajit
-
-      lua-language-server
-      nil
-      nixd
-
-      nixpkgs-fmt
-      stylua
-
-    ];
-
-    extraWrapperArgs = [
-      "--suffix"
-      "LD_LIBRARY_PATH"
-      ":"
-      "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-    ];
-
-  };
-}

users/matej/home-manager.nix

@@ -1,129 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
-{
-  home.stateVersion = "24.11";
-
-  # TODO:(@janezicmatej) do i need this here?
-  services.dunst.enable = true;
-
-  home.packages = [
-    pkgs.bibata-cursors
-
-    pkgs.starship
-
-    pkgs.claude-code
-
-    # git and co
-    pkgs.git
-    packages.git-linearize
-    packages.ggman
-
-    # cli utils
-    packages.ahab
-    pkgs.fzf
-    pkgs.htop
-    pkgs.jc
-    pkgs.jq
-    pkgs.openssl
-    pkgs.pv
-    pkgs.python3
-    pkgs.ripgrep
-    pkgs.fd
-    pkgs.tmux
-    pkgs.osc
-    pkgs.just
-
-    # compilers, toolchains, ...
-    pkgs.go
-    # pkgs.gcc
-    # pkgs.clang
-
-    # need for gcp stuff
-    pkgs.google-cloud-sdk
-    pkgs.google-cloud-sql-proxy
-
-    # desktop apps
-    pkgs.vesktop
-    pkgs.rocketchat-desktop
-    pkgs.telegram-desktop
-    pkgs.slack
-    pkgs.ghostty
-    pkgs.google-chrome
-    pkgs.zathura
-    pkgs.pavucontrol
-    pkgs.jellyfin-media-player
-    pkgs.cider-2
-    pkgs.protonmail-bridge
-    pkgs.ledger-live-desktop
-    pkgs.bolt-launcher
-    pkgs.libnotify
-
-    # writing/docs
-    pkgs.mdbook
-    pkgs.marksman
-    pkgs.mdformat
-
-    # security
-    pkgs.gnupg
-    pkgs.pass
-  ];
-
-  home.file.".assets".source = inputs.assets;
-
-  programs.direnv = {
-    enable = true;
-    nix-direnv.enable = true;
-  };
-
-  stylix.targets.neovim.enable = false;
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    defaultEditor = true;
-
-    package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
-
-    extraPackages = with pkgs; [
-      # runtime deps
-      gcc
-      luajit
-      nodejs_22 # copilot
-
-      tree-sitter
-
-      # lua_fzf
-      fd
-      ripgrep
-      bat
-      gnumake
-      delta
-
-      pyright
-      typescript-language-server
-      lua-language-server
-      gopls
-      nil
-      nixd
-
-      nixpkgs-fmt
-      stylua
-    ];
-
-    extraWrapperArgs = [
-      "--suffix"
-      "LD_LIBRARY_PATH"
-      ":"
-      "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-    ];
-  };
-}

users/matej/keys.nix

@@ -1,6 +0,0 @@
-{
-  sshAuthorizedKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
-}

users/matej/nixos.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  keys = import ./keys.nix;
-in
-{
-  users.users.matej = {
-    uid = 1000;
-    isNormalUser = true;
-    home = "/home/matej";
-    shell = pkgs.zsh;
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
-  };
-
-  users.groups.matej = {
-    gid = 1000;
-    members = [ "matej" ];
-  };
-}