merge: harden ephvm

feat: tighten ephvm perms, zstd compress qcow2
feat: prune vm-guest module
2026-04-24 14:14:29 +02:00 · 2026-04-24 14:13:01 +02:00 · 2026-04-24 14:12:57 +02:00 · 2026-04-24 14:12:52 +02:00 · 2026-04-24 14:12:48 +02:00 · 2026-04-24 14:12:42 +02:00
66 changed files with 2605 additions and 805 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -1,6 +1,8 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+2204b12fadf27886058e6945806ce93a547f5278
+77236af5896524218605badcd3cdfc2267b213da

 # host rename
 cfe4c43887a41e52be4e6472474c0fc3788f86e8
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -0,0 +1,36 @@
+keys:
+  - &matej AF349EECC849D87B790E88FF6318FFB7DB374B7D
+
+  # host age keys (via: ssh-keyscan <host> | ssh-to-age)
+  - &tower age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+  - &fw16 age19qj2aaryx869cvcqp77gs9x5hcv4dqjxunkmyre78upsxda6ss7s5vquz4
+  - &floo age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+  - &cube age15cktenavt5v7zm84se36jtly740syca5nw8em8edx404n5x2ddws8jn29g
+
+creation_rules:
+  # per-host secrets
+  - path_regex: ^secrets/tower\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*tower]
+
+  - path_regex: ^secrets/fw16\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*fw16]
+
+  - path_regex: ^secrets/floo\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*floo]
+
+  - path_regex: ^secrets/cube\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*cube]
+
+  # shared secrets (all hosts)
+  - path_regex: ^secrets/common\.yaml$
+    key_groups:
+      - pgp: [*matej]
+        age: [*tower, *fw16, *floo, *cube]
--- a/features/bootloader.nix
+++ b/features/bootloader.nix
@@ -0,0 +1,73 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+
+        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            boot.loader.efi.canTouchEfiVariables = true;
+            # request the largest framebuffer uefi offers; plymouth inherits it
+            boot.loader.systemd-boot.consoleMode = "max";
+          }
+
+          (lib.mkIf (cfg.mode == "systemd-boot") {
+            boot.loader.systemd-boot.enable = true;
+          })
+
+          (lib.mkIf (cfg.mode == "lanzaboote") {
+            boot.loader.systemd-boot.enable = lib.mkForce false;
+            boot.lanzaboote = {
+              enable = true;
+              pkiBundle = "/var/lib/sbctl";
+            };
+          })
+
+          (lib.mkIf cfg.plymouth.enable {
+            # plymouth needs systemd-initrd to render the luks prompt cleanly
+            boot.initrd.systemd.enable = true;
+
+            # host is responsible for early-KMS so plymouth lands on the gpu driver,
+            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
+            boot.plymouth.enable = true;
+            stylix.targets.plymouth.logoAnimated = false;
+
+            boot.kernelParams = [
+              "quiet"
+              "splash"
+              "loglevel=3"
+              "rd.systemd.show_status=false"
+              "rd.udev.log_level=3"
+              "udev.log_priority=3"
+              "plymouth.force-scale=1"
+            ];
+            boot.consoleLogLevel = 0;
+            boot.initrd.verbose = false;
+          })
+        ]
+      );
+    };
+}
--- a/features/calibre.nix
+++ b/features/calibre.nix
@@ -1,22 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.calibre ];
-
-      # udev rules for kindle and mtp device access
-      # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
-      # because extraRules writes to 99-local.rules which is too late for uaccess
-      # see https://github.com/NixOS/nixpkgs/issues/308681
-      services.udev.packages = [
-        pkgs.libmtp
-        (pkgs.writeTextFile {
-          name = "kindle-udev-rules";
-          text = ''
-            ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
-          '';
-          destination = "/etc/udev/rules.d/70-kindle.rules";
-        })
-      ];
-    };
-}
--- a/features/claude.nix
+++ b/features/claude.nix
@@ -1,10 +1,28 @@
 {
-  home =
-    { pkgs, ... }:
+  nixos =
+    { lib, ... }:
    {
-      home.packages = [
-        pkgs.claude-code
-        pkgs.mcp-nixos
-      ];
+      options.features.claude.enable = lib.mkEnableOption "claude";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.claude;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          packages.claude-code
+          pkgs.mcp-nixos
+        ];
+      };
    };
 }
--- a/features/desktop.nix
+++ b/features/desktop.nix
@@ -1,85 +1,273 @@
 {
  nixos =
-    { pkgs, inputs, ... }:
    {
-      imports = [ inputs.stylix.nixosModules.stylix ];
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.desktop;
+    in
+    {
+      options.features.desktop = {
+        enable = lib.mkEnableOption "desktop environment";

-      # audio
-      services.pipewire = {
-        enable = true;
-        pulse.enable = true;
+        audio.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        bluetooth.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        apps.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        theme = {
+          wallpaper = lib.mkOption {
+            type = lib.types.path;
+            default = "${inputs.assets}/wallpaper.png";
+          };
+
+          scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "gruvbox-material-dark-medium";
+          };
+
+          polarity = lib.mkOption {
+            type = lib.types.enum [
+              "dark"
+              "light"
+            ];
+            default = "dark";
+          };
+        };
+
+        internalCA.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
      };

-      # bluetooth
-      hardware.bluetooth.enable = true;
-      services.blueman.enable = true;
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          # base desktop
+          {
+            security.polkit.enable = true;
+            services.dbus.enable = true;
+            services.playerctld.enable = true;

-      security.polkit.enable = true;
-      services.dbus.enable = true;
-      services.playerctld.enable = true;
+            xdg.portal = {
+              enable = true;
+              extraPortals = with pkgs; [
+                xdg-desktop-portal-wlr
+                xdg-desktop-portal-gtk
+              ];
+            };

-      xdg.portal = {
-        enable = true;
-        xdgOpenUsePortal = true;
-        extraPortals = [
-          pkgs.xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-gtk
-        ];
-      };
+            # honor persist_mode so electron apps don't re-prompt for screencast every login
+            systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";

-      fonts.packages = with pkgs; [
-        font-awesome
-        nerd-fonts.jetbrains-mono
-      ];
+            # enable ozone/wayland for electron apps so idle detection works
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";

-      # theming
-      stylix = {
-        enable = true;
-        polarity = "dark";
-        image = "${inputs.assets}/wallpaper.png";
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-      };
+            fonts.packages = with pkgs; [
+              font-awesome
+              nerd-fonts.jetbrains-mono
+            ];

-      programs.thunderbird.enable = true;
-      programs._1password.enable = true;
-      programs._1password-gui.enable = true;
+            stylix = {
+              enable = true;
+              inherit (cfg.theme) polarity;
+              image = cfg.theme.wallpaper;
+              base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
+            };
+          }

-      environment.systemPackages = with pkgs; [
-        easyeffects
-        ghostty
-        google-chrome
-        zathura
-        pavucontrol
-        bolt-launcher
-        libnotify
-        bibata-cursors
-        vesktop
-        rocketchat-desktop
-        telegram-desktop
-        slack
-        jellyfin-media-player
-        cider-2
-        mpv
-        ffmpeg
-        wf-recorder
-        wl-mirror
-        protonmail-bridge
-        ledger-live-desktop
-      ];
+          # audio
+          (lib.mkIf cfg.audio.enable {
+            services.pipewire = {
+              enable = true;
+              pulse.enable = true;
+            };
+            environment.systemPackages = with pkgs; [
+              pavucontrol
+              easyeffects
+            ];
+          })

-      # internal CA
-      security.pki.certificateFiles = [
-        inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
-      ];
+          # bluetooth
+          (lib.mkIf cfg.bluetooth.enable {
+            hardware.bluetooth.enable = true;
+            services.blueman.enable = true;
+          })

-      xdg.mime.defaultApplications = {
-        "application/pdf" = "org.pwmt.zathura.desktop";
-      };
+          # apps
+          (lib.mkIf cfg.apps.enable {
+            programs.thunderbird.enable = true;
+
+            environment.systemPackages = with pkgs; [
+              ghostty
+              google-chrome
+              zathura
+              calibre
+              bolt-launcher
+              libnotify
+              bibata-cursors
+              discord
+              rocketchat-desktop
+              telegram-desktop
+              slack
+              jellyfin-media-player
+              cider-2
+              mpv
+              ffmpeg
+              wf-recorder
+              wl-mirror
+              protonmail-bridge
+              ledger-live-desktop
+              imv
+              yazi
+              nemo
+              file-roller
+              libreoffice-still
+            ];
+
+            # kindle udev rules for calibre
+            features.udev.kindle.enable = lib.mkDefault true;
+          })
+
+          # internal CA
+          (lib.mkIf cfg.internalCA.enable {
+            security.pki.certificateFiles = [
+              inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+            ];
+          })
+        ]
+      );
    };

  home =
-    { inputs, ... }:
    {
-      home.file.".assets".source = inputs.assets;
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.desktop;
+    in
+    {
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            home.file.".assets".source = inputs.assets;
+          }
+
+          (lib.mkIf cfg.apps.enable {
+            # TODO:(@janezicmatej) consider moving nvim desktop entry to neovim feature
+            xdg.desktopEntries.nvim = {
+              name = "Neovim";
+              exec = "ghostty -e nvim %F";
+              terminal = false;
+              mimeType = [
+                "text/plain"
+                "application/json"
+                "text/markdown"
+              ];
+            };
+
+            xdg.mimeApps = {
+              enable = true;
+              defaultApplications = {
+                # text
+                "text/plain" = "nvim.desktop";
+                "application/json" = "nvim.desktop";
+                "text/markdown" = "nvim.desktop";
+
+                # web
+                "text/html" = "google-chrome.desktop";
+                "application/xhtml+xml" = "google-chrome.desktop";
+                "x-scheme-handler/http" = "google-chrome.desktop";
+                "x-scheme-handler/https" = "google-chrome.desktop";
+                "x-scheme-handler/ftp" = "google-chrome.desktop";
+                "x-scheme-handler/about" = "google-chrome.desktop";
+                "x-scheme-handler/unknown" = "google-chrome.desktop";
+
+                # mail and calendar
+                "x-scheme-handler/mailto" = "thunderbird.desktop";
+                "message/rfc822" = "thunderbird.desktop";
+                "text/calendar" = "thunderbird.desktop";
+
+                # documents
+                "application/pdf" = "org.pwmt.zathura.desktop";
+                "application/postscript" = "org.pwmt.zathura.desktop";
+                "image/vnd.djvu" = "org.pwmt.zathura.desktop";
+                "application/epub+zip" = "org.pwmt.zathura.desktop";
+
+                # office
+                "application/msword" = "libreoffice-writer.desktop";
+                "application/vnd.ms-excel" = "libreoffice-calc.desktop";
+                "application/vnd.ms-powerpoint" = "libreoffice-impress.desktop";
+                "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
+                  "libreoffice-writer.desktop";
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = "libreoffice-calc.desktop";
+                "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
+                  "libreoffice-impress.desktop";
+                "application/vnd.oasis.opendocument.text" = "libreoffice-writer.desktop";
+                "application/vnd.oasis.opendocument.spreadsheet" = "libreoffice-calc.desktop";
+                "application/vnd.oasis.opendocument.presentation" = "libreoffice-impress.desktop";
+                "text/csv" = "libreoffice-calc.desktop";
+
+                # images
+                "image/png" = "imv-dir.desktop";
+                "image/jpeg" = "imv-dir.desktop";
+                "image/gif" = "imv-dir.desktop";
+                "image/webp" = "imv-dir.desktop";
+                "image/tiff" = "imv-dir.desktop";
+                "image/bmp" = "imv-dir.desktop";
+                "image/svg+xml" = "google-chrome.desktop";
+
+                # video
+                "video/mp4" = "mpv.desktop";
+                "video/x-matroska" = "mpv.desktop";
+                "video/webm" = "mpv.desktop";
+                "video/quicktime" = "mpv.desktop";
+                "video/x-msvideo" = "mpv.desktop";
+
+                # audio
+                "audio/mpeg" = "mpv.desktop";
+                "audio/flac" = "mpv.desktop";
+                "audio/ogg" = "mpv.desktop";
+                "audio/wav" = "mpv.desktop";
+                "audio/aac" = "mpv.desktop";
+
+                # archives
+                "application/zip" = "org.gnome.FileRoller.desktop";
+                "application/x-tar" = "org.gnome.FileRoller.desktop";
+                "application/gzip" = "org.gnome.FileRoller.desktop";
+                "application/x-rar-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-bzip2" = "org.gnome.FileRoller.desktop";
+                "application/x-xz" = "org.gnome.FileRoller.desktop";
+
+                # file manager
+                "inode/directory" = "nemo.desktop";
+
+                # app deep links
+                "x-scheme-handler/tg" = "org.telegram.desktop.desktop";
+                "x-scheme-handler/discord" = "discord.desktop";
+                "x-scheme-handler/slack" = "slack.desktop";
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/dev-registry.nix
+++ b/features/dev-registry.nix
@@ -1,16 +0,0 @@
-{
-  nixos =
-    { inputs, ... }:
-    {
-      nix.registry.dev = {
-        from = {
-          type = "indirect";
-          id = "dev";
-        };
-        to = {
-          type = "path";
-          path = inputs.self.outPath;
-        };
-      };
-    };
-}
--- a/features/dev.nix
+++ b/features/dev.nix
@@ -1,30 +1,36 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.dev.enable = lib.mkEnableOption "development tools";
+    };
+
  home =
-    { pkgs, inputs, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
    let
+      cfg = osConfig.features.dev;
      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
    in
    {
-      home.packages = [
-        pkgs.git
-        packages.git-linearize
-        packages.ggman
-        pkgs.go
-        pkgs.python3
-        pkgs.mdbook
-        pkgs.marksman
-        pkgs.mdformat
-        pkgs.google-cloud-sdk
-        pkgs.google-cloud-sql-proxy
-        packages.ahab
-        pkgs.just
-        pkgs.presenterm
-        pkgs.osc
-      ];
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.python3
+          pkgs.osc

-      programs.direnv = {
-        enable = true;
-        nix-direnv.enable = true;
+          pkgs.google-cloud-sdk
+          pkgs.google-cloud-sql-proxy
+
+          packages.ahab
+          pkgs.just
+          pkgs.presenterm
+          pkgs.qemu
+        ];
      };
    };
 }
--- a/features/direnv/default.nix
+++ b/features/direnv/default.nix
@@ -0,0 +1,45 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.direnv;
+    in
+    {
+      options.features.direnv.enable = lib.mkEnableOption "direnv";
+
+      config = lib.mkIf cfg.enable {
+        nix.registry.dev = {
+          from = {
+            type = "indirect";
+            id = "dev";
+          };
+          to = {
+            type = "path";
+            path = inputs.self.outPath;
+          };
+        };
+      };
+    };
+
+  home =
+    { lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.direnv;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        programs.direnv = {
+          enable = true;
+          nix-direnv.enable = true;
+          config.global.hide_env_diff = true;
+        };
+
+        xdg.configFile."direnv/lib/use_dev.sh".source = ./use_dev.sh;
+      };
+    };
+}
--- a/features/direnv/use_dev.sh
+++ b/features/direnv/use_dev.sh
@@ -0,0 +1,92 @@
+# shellcheck shell=bash
+# composable nix devshell from matej.nix
+# usage in .envrc: use dev uv_14 pg_18 --extra cairo pkg-config
+
+# generates a flake and delegates to use_flake at the calling scope
+use_dev() {
+	local nix_list="" extra_list="" in_extra=0
+	for c in "$@"; do
+		if [[ "$c" == "--extra" ]]; then
+			in_extra=1
+			continue
+		fi
+		if [[ $in_extra -eq 1 ]]; then
+			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_-]*$ ]]; then
+				log_error "use_dev: invalid package name: $c"
+				return 1
+			fi
+			extra_list="$extra_list pkgs.$c"
+		else
+			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+				log_error "use_dev: invalid component name: $c"
+				return 1
+			fi
+			nix_list="$nix_list \"$c\""
+		fi
+	done
+
+	local system
+	case "$(uname -s)-$(uname -m)" in
+	Linux-x86_64) system="x86_64-linux" ;;
+	Linux-aarch64) system="aarch64-linux" ;;
+	Darwin-x86_64) system="x86_64-darwin" ;;
+	Darwin-arm64) system="aarch64-darwin" ;;
+	esac
+
+	if [[ -z "$system" ]]; then
+		log_error "use_dev: unsupported platform: $(uname -s)-$(uname -m)"
+		return 1
+	fi
+
+	local dev_path nixpkgs_path registry_filter
+	# shellcheck disable=SC2016 # $id is a jq variable, not shell
+	registry_filter='.flakes[] | select(.from.id == $id) | .to.path'
+
+	local registry_file="${XDG_CONFIG_HOME:-$HOME/.config}/nix/registry.json"
+	if [[ ! -f "$registry_file" ]]; then
+		registry_file="/etc/nix/registry.json"
+	fi
+
+	dev_path="$(jq -re --arg id dev "$registry_filter" "$registry_file" 2>/dev/null)"
+	nixpkgs_path="$(jq -re --arg id nixpkgs "$registry_filter" "$registry_file" 2>/dev/null)"
+
+	if [[ -z "$dev_path" ]]; then
+		log_error "use_dev: 'dev' not found in nix registry"
+		return 1
+	fi
+	if [[ -z "$nixpkgs_path" ]]; then
+		log_error "use_dev: 'nixpkgs' not found in nix registry"
+		return 1
+	fi
+
+	local components_hash project_hash cache_dir
+	components_hash="$(sha256sum "$dev_path/flake/dev-components.nix" 2>/dev/null | cut -c1-16)"
+	project_hash="$(echo "$PWD" | sha256sum | cut -c1-16)"
+	cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/dev-flakes/$project_hash"
+	mkdir -p "$cache_dir"
+
+	cat >"$cache_dir/flake.nix.tmp" <<DEVFLAKE
+# dev-components: $components_hash
+{
+  inputs.dev = { url = "path:${dev_path}"; flake = false; };
+  inputs.nixpkgs.url = "path:${nixpkgs_path}";
+  outputs = { dev, nixpkgs, ... }:
+    let
+      system = "${system}";
+      pkgs = nixpkgs.legacyPackages.\${system};
+      devLib = import "\${dev}/flake/dev-components.nix" { inherit pkgs; lib = nixpkgs.lib; };
+    in {
+      devShells.\${system}.default = devLib.mkComponentShell [$nix_list ] [${extra_list} ];
+    };
+}
+DEVFLAKE
+
+	if ! cmp -s "$cache_dir/flake.nix.tmp" "$cache_dir/flake.nix" 2>/dev/null; then
+		mv "$cache_dir/flake.nix.tmp" "$cache_dir/flake.nix"
+		rm -f "$cache_dir/flake.lock"
+	else
+		rm "$cache_dir/flake.nix.tmp"
+	fi
+
+	use_flake "path:$cache_dir"
+}
--- a/features/docker.nix
+++ b/features/docker.nix
@@ -1,12 +1,24 @@
 {
  nixos =
-    { user, ... }:
    {
-      virtualisation.docker = {
-        enable = true;
-        logDriver = "json-file";
-      };
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.docker;
+    in
+    {
+      options.features.docker.enable = lib.mkEnableOption "docker";

-      users.users.${user}.extraGroups = [ "docker" ];
+      config = lib.mkIf cfg.enable {
+        virtualisation.docker = {
+          enable = true;
+          logDriver = "json-file";
+        };
+
+        users.users.${user}.extraGroups = [ "docker" ];
+      };
    };
 }
--- a/features/filedrop.nix
+++ b/features/filedrop.nix
@@ -0,0 +1,61 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      userKeys,
+      ...
+    }:
+    let
+      cfg = config.features.filedrop;
+    in
+    {
+      options.features.filedrop = {
+        enable = lib.mkEnableOption "filedrop sftp service";
+
+        sopsFile = lib.mkOption {
+          type = lib.types.path;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        sops.secrets.filedrop-authorized-keys = {
+          inherit (cfg) sopsFile;
+          mode = "0444";
+        };
+
+        users.groups.filedrop = {
+          members = [ "matej" ];
+        };
+
+        users.users.filedrop = {
+          isSystemUser = true;
+          group = "filedrop";
+          home = "/home/filedrop";
+          shell = "/run/current-system/sw/bin/nologin";
+          openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
+        };
+
+        # chroot dir must be root-owned; incoming is writable by filedrop
+        systemd.tmpfiles.rules = [
+          "d /home/filedrop 0755 root root -"
+          "d /home/filedrop/incoming 2775 filedrop filedrop -"
+          "a+ /home/filedrop/incoming - - - - group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:mask::rwx"
+          "L /home/matej/filedrop - - - - /home/filedrop/incoming"
+        ];
+
+        # relaxed umask so default acl takes full effect
+        services.openssh.extraConfig = ''
+          Match User filedrop
+            ForceCommand internal-sftp -u 0002
+            ChrootDirectory /home/filedrop
+            AuthorizedKeysFile /etc/ssh/authorized_keys.d/filedrop %h/.ssh/authorized_keys ${config.sops.secrets.filedrop-authorized-keys.path}
+            AllowTcpForwarding no
+            X11Forwarding no
+        '';
+      };
+    };
+}
--- a/features/gaming.nix
+++ b/features/gaming.nix
@@ -0,0 +1,26 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gaming;
+    in
+    {
+      options.features.gaming.enable = lib.mkEnableOption "gaming";
+
+      config = lib.mkIf cfg.enable {
+        programs.steam = {
+          enable = true;
+          remotePlay.openFirewall = true;
+          dedicatedServer.openFirewall = true;
+          localNetworkGameTransfers.openFirewall = true;
+        };
+
+        environment.systemPackages = [ pkgs.prismlauncher ];
+      };
+    };
+}
--- a/features/git.nix
+++ b/features/git.nix
@@ -0,0 +1,29 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.git.enable = lib.mkEnableOption "git";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.git;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.git
+          packages.git-linearize
+          packages.ggman
+        ];
+      };
+    };
+}
--- a/features/gnupg.nix
+++ b/features/gnupg.nix
@@ -1,9 +1,43 @@
 {
-  nixos = _: {
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableExtraSocket = true;
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gnupg;
+    in
+    {
+      options.features.gnupg = {
+        enable = lib.mkEnableOption "gnupg";
+
+        yubikey.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.gnupg.agent = {
+              enable = true;
+              enableSSHSupport = true;
+              enableExtraSocket = true;
+            };
+          }
+
+          (lib.mkIf cfg.yubikey.enable {
+            environment.systemPackages = with pkgs; [
+              yubikey-personalization
+              yubikey-manager
+            ];
+
+            services.pcscd.enable = true;
+          })
+        ]
+      );
    };
-  };
 }
--- a/features/greeter.nix
+++ b/features/greeter.nix
@@ -1,28 +0,0 @@
-{
-  nixos =
-    { lib, inputs, ... }:
-    {
-      programs.regreet = {
-        enable = true;
-        # single output to avoid stretching across monitors
-        cageArgs = [
-          "-s"
-          "-m"
-          "last"
-        ];
-        font = {
-          name = lib.mkForce "JetBrainsMono Nerd Font";
-          size = lib.mkForce 14;
-        };
-        settings = {
-          background = {
-            path = lib.mkForce "${inputs.assets}/wallpaper.png";
-            fit = lib.mkForce "Cover";
-          };
-          GTK = {
-            application_prefer_dark_theme = lib.mkForce true;
-          };
-        };
-      };
-    };
-}
--- a/features/harmonia/cache-builder.sh
+++ b/features/harmonia/cache-builder.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+build() {
+	local name="$1" ref="$2" link="$3"
+	echo "building $name..." >&2
+	if nix build "$ref" --out-link "$link"; then
+		return 0
+	else
+		echo "FAILED: $name" >&2
+		return 1
+	fi
+}
+
+main() {
+	mkdir -p "$GC_ROOT_DIR"
+	local failed=0
+
+	for host in $HOSTS; do
+		build "$host" \
+			"$FLAKE_REF#nixosConfigurations.$host.config.system.build.toplevel" \
+			"$GC_ROOT_DIR/$host" || failed=1
+	done
+
+	build "ephvm-image" \
+		"$FLAKE_REF#nixosConfigurations.ephvm.config.system.build.images.qemu" \
+		"$GC_ROOT_DIR/ephvm-image" || failed=1
+
+	return $failed
+}
+
+main "$@"
--- a/features/harmonia/default.nix
+++ b/features/harmonia/default.nix
@@ -0,0 +1,52 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.harmonia;
+      hosts = [
+        "fw16"
+        "tower"
+        "cube"
+        "floo"
+        "ephvm"
+      ];
+      flakeRef = inputs.self.outPath;
+    in
+    {
+      options.features.harmonia.enable = lib.mkEnableOption "harmonia";
+
+      config = lib.mkIf cfg.enable {
+        services.harmonia.cache = {
+          enable = true;
+          signKeyPaths = [ config.sops.secrets.nix-signing-key.path ];
+        };
+
+        networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 5000 ];
+
+        systemd.services.cache-builder = {
+          description = "Build all host closures for binary cache";
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.bash}/bin/bash ${./cache-builder.sh}";
+          };
+          environment = {
+            FLAKE_REF = flakeRef;
+            HOSTS = builtins.concatStringsSep " " hosts;
+            GC_ROOT_DIR = "/nix/var/nix/gcroots/cache-builder";
+          };
+          path = [ config.nix.package ];
+        };
+
+        # restart cache-builder after every nixos switch (non-blocking)
+        system.activationScripts.cache-builder = lib.stringAfter [ "specialfs" ] ''
+          ${config.systemd.package}/bin/systemctl restart --no-block cache-builder.service || true
+        '';
+      };
+    };
+}
--- a/features/initrd-ssh.nix
+++ b/features/initrd-ssh.nix
@@ -2,6 +2,7 @@
  nixos =
    { lib, config, ... }:
    let
+      cfg = config.features.initrd-ssh;
      keyDir = "/etc/secrets/initrd";

      mkIpString =
@@ -15,46 +16,52 @@
        "${address}::${gateway}:${netmask}::${interface}:none";
    in
    {
-      options = {
-        initrd-ssh = {
-          ip = {
-            enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+      options.features.initrd-ssh = {
+        enable = lib.mkEnableOption "initrd ssh";

-            address = lib.mkOption {
-              type = lib.types.str;
-            };
+        ip = {
+          enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";

-            gateway = lib.mkOption {
-              type = lib.types.str;
-            };
-
-            netmask = lib.mkOption {
-              type = lib.types.str;
-              default = "255.255.255.0";
-            };
-
-            interface = lib.mkOption {
-              type = lib.types.str;
-            };
+          address = lib.mkOption {
+            type = lib.types.str;
          };

-          authorizedKeys = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [ ];
+          gateway = lib.mkOption {
+            type = lib.types.str;
          };

-          networkModule = lib.mkOption {
+          netmask = lib.mkOption {
+            type = lib.types.str;
+            default = "255.255.255.0";
+          };
+
+          interface = lib.mkOption {
            type = lib.types.str;
          };
        };
+
+        authorizedKeys = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+
+        networkModule = lib.mkOption {
+          type = lib.types.str;
+        };
      };

-      config = {
-        boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-        boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-          "ip=${mkIpString config.initrd-ssh.ip}"
+      config = lib.mkIf cfg.enable {
+        boot.initrd.availableKernelModules = [ cfg.networkModule ];
+        boot.initrd.kernelModules = [ cfg.networkModule ];
+        boot.kernelParams = lib.mkIf cfg.ip.enable [
+          "ip=${mkIpString cfg.ip}"
        ];

+        boot.initrd.systemd.enable = true;
+
+        # remote unlock may take a while; don't let device units give up
+        boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
+
        boot.initrd.network = {
          enable = true;
          ssh = {
@@ -64,12 +71,20 @@
              "${keyDir}/ssh_host_rsa_key"
              "${keyDir}/ssh_host_ed25519_key"
            ];
-            inherit (config.initrd-ssh) authorizedKeys;
+            inherit (cfg) authorizedKeys;
          };
-          postCommands = ''
-            echo 'cryptsetup-askpass' >> /root/.profile
-          '';
        };
+
+        # systemd-networkd retries DHCP indefinitely, unlike udhcpc
+        boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
+          "10-initrd" = {
+            matchConfig.Driver = cfg.networkModule;
+            networkConfig.DHCP = "yes";
+          };
+        };
+
+        # forward LUKS password prompt to the SSH session
+        boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
      };
    };
 }
--- a/features/localisation.nix
+++ b/features/localisation.nix
@@ -1,25 +1,30 @@
 {
  nixos =
    { lib, config, ... }:
+    let
+      cfg = config.features.localisation;
+    in
    {
-      options = {
-        localisation = {
-          timeZone = lib.mkOption {
-            type = lib.types.str;
-          };
+      options.features.localisation = {
+        enable = lib.mkEnableOption "localisation";

-          defaultLocale = lib.mkOption {
-            type = lib.types.str;
-          };
+        timeZone = lib.mkOption {
+          type = lib.types.str;
+          default = "Europe/Ljubljana";
+        };
+
+        defaultLocale = lib.mkOption {
+          type = lib.types.str;
+          default = "en_US.UTF-8";
        };
      };

-      config = {
-        time.timeZone = config.localisation.timeZone;
-        i18n.defaultLocale = config.localisation.defaultLocale;
+      config = lib.mkIf cfg.enable {
+        time.timeZone = cfg.timeZone;
+        i18n.defaultLocale = cfg.defaultLocale;

        # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
-        environment.variables.TZ = config.localisation.timeZone;
+        environment.variables.TZ = cfg.timeZone;
      };
    };
 }
--- a/features/neovim.nix
+++ b/features/neovim.nix
@@ -1,4 +1,17 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.neovim = {
+        enable = lib.mkEnableOption "neovim";
+
+        dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+    };
+
  home =
    {
      config,
@@ -6,64 +19,64 @@
      lib,
      pkgs,
      inputs,
+      osConfig,
      ...
    }:
+    let
+      cfg = osConfig.features.neovim;
+    in
    {
-      options = {
-        neovim.dotfiles = lib.mkOption {
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-        };
-      };
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.optionalAttrs (options ? stylix) {
+            # disable stylix neovim target when stylix is present
+            stylix.targets.neovim.enable = false;
+          })
+          {
+            xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
+              source = cfg.dotfiles;
+            };

-      config = lib.mkMerge [
-        (lib.optionalAttrs (options ? stylix) {
-          # disable stylix neovim target when stylix is present (loaded by desktop feature)
-          stylix.targets.neovim.enable = false;
-        })
-        {
-          xdg.configFile."nvim" = lib.mkIf (config.neovim.dotfiles != null) {
-            source = config.neovim.dotfiles;
-          };
+            programs.neovim = {
+              enable = true;
+              sideloadInitLua = true;
+              vimAlias = true;
+              defaultEditor = true;
+              package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;

-          programs.neovim = {
-            enable = true;
-            vimAlias = true;
-            defaultEditor = true;
-            package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
+              extraPackages = with pkgs; [
+                gcc
+                luajit
+                nodejs_22
+                tree-sitter
+                gnumake
+                osc

-            extraPackages = with pkgs; [
-              gcc
-              luajit
-              nodejs_22
-              tree-sitter
-              gnumake
-              osc
+                fd
+                ripgrep
+                bat
+                delta

-              fd
-              ripgrep
-              bat
-              delta
+                pyright
+                typescript-language-server
+                lua-language-server
+                gopls
+                nil
+                nixd

-              pyright
-              typescript-language-server
-              lua-language-server
-              gopls
-              nil
-              nixd
+                nixpkgs-fmt
+                stylua
+              ];

-              nixpkgs-fmt
-              stylua
-            ];
-
-            extraWrapperArgs = [
-              "--suffix"
-              "LD_LIBRARY_PATH"
-              ":"
-              "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-            ];
-          };
-        }
-      ];
+              extraWrapperArgs = [
+                "--suffix"
+                "LD_LIBRARY_PATH"
+                ":"
+                "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
+              ];
+            };
+          }
+        ]
+      );
    };
 }
--- a/features/networkmanager.nix
+++ b/features/networkmanager.nix
@@ -1,9 +1,18 @@
 {
-  nixos = _: {
-    networking.networkmanager.enable = true;
-    networking.nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-  };
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.networkmanager;
+    in
+    {
+      options.features.networkmanager.enable = lib.mkEnableOption "networkmanager";
+
+      config = lib.mkIf cfg.enable {
+        networking.networkmanager.enable = true;
+        networking.nameservers = [
+          "1.1.1.1"
+          "8.8.8.8"
+        ];
+      };
+    };
 }
--- a/features/nix-ld.nix
+++ b/features/nix-ld.nix
@@ -1,5 +1,14 @@
 {
-  nixos = _: {
-    programs.nix-ld.enable = true;
-  };
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-ld;
+    in
+    {
+      options.features.nix-ld.enable = lib.mkEnableOption "nix-ld";
+
+      config = lib.mkIf cfg.enable {
+        programs.nix-ld.enable = true;
+      };
+    };
 }
--- a/features/nix-settings.nix
+++ b/features/nix-settings.nix
@@ -0,0 +1,71 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-settings;
+    in
+    {
+      options.features.nix-settings = {
+        enable = lib.mkEnableOption "nix settings";
+
+        towerCache.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+
+        gc = {
+          dates = lib.mkOption {
+            type = lib.types.str;
+            default = "monthly";
+          };
+
+          olderThan = lib.mkOption {
+            type = lib.types.str;
+            default = "30d";
+          };
+        };
+
+        optimise.dates = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "monthly" ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        nix = {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            download-attempts = 3;
+            fallback = true;
+            warn-dirty = false;
+            substituters = [
+              "https://cache.nixos.org"
+              "https://nix-community.cachix.org?priority=45"
+            ]
+            ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys = [
+              "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+              "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+            ]
+            ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+          };
+
+          gc = {
+            automatic = true;
+            inherit (cfg.gc) dates;
+            options = "--delete-older-than ${cfg.gc.olderThan}";
+          };
+
+          optimise = {
+            automatic = true;
+            inherit (cfg.optimise) dates;
+          };
+        };
+      };
+    };
+}
--- a/features/onepassword.nix
+++ b/features/onepassword.nix
@@ -0,0 +1,23 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}
--- a/features/openssh.nix
+++ b/features/openssh.nix
@@ -1,18 +1,23 @@
 {
  nixos =
    { lib, config, ... }:
+    let
+      cfg = config.features.openssh;
+    in
    {
-      options = {
-        openssh.port = lib.mkOption {
+      options.features.openssh = {
+        enable = lib.mkEnableOption "openssh";
+
+        port = lib.mkOption {
          type = lib.types.port;
          default = 22;
        };
      };

-      config = {
+      config = lib.mkIf cfg.enable {
        services.openssh = {
          enable = true;
-          ports = [ config.openssh.port ];
+          ports = [ cfg.port ];
          settings = {
            PasswordAuthentication = false;
            AllowUsers = null;
--- a/features/power.nix
+++ b/features/power.nix
@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}
--- a/features/printing.nix
+++ b/features/printing.nix
@@ -1,10 +1,19 @@
 {
-  nixos = _: {
-    services.printing.enable = true;
-    services.avahi = {
-      enable = true;
-      nssmdns4 = true;
-      openFirewall = true;
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.printing;
+    in
+    {
+      options.features.printing.enable = lib.mkEnableOption "printing";
+
+      config = lib.mkIf cfg.enable {
+        services.printing.enable = true;
+        services.avahi = {
+          enable = true;
+          nssmdns4 = true;
+          openFirewall = true;
+        };
+      };
    };
-  };
 }
--- a/features/remote-base.nix
+++ b/features/remote-base.nix
@@ -0,0 +1,25 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.remote-base;
+    in
+    {
+      options.features.remote-base.enable = lib.mkEnableOption "remote-base";
+
+      config = lib.mkIf cfg.enable {
+        sops.secrets.user-password = {
+          sopsFile = ../secrets/common.yaml;
+          neededForUsers = true;
+        };
+
+        users.mutableUsers = false;
+        users.users.${user}.hashedPasswordFile = config.sops.secrets.user-password.path;
+      };
+    };
+}
--- a/features/shell.nix
+++ b/features/shell.nix
@@ -1,25 +1,33 @@
 {
-  nixos = _: {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
+  nixos =
+    { lib, ... }:
+    {
+      options.features.shell.enable = lib.mkEnableOption "shell extras";
+    };

  home =
-    { pkgs, ... }:
    {
-      home.packages = with pkgs; [
-        starship
-        fzf
-        htop
-        jc
-        jq
-        openssl
-        pv
-        ripgrep
-        fd
-        tmux
-      ];
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.shell;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = with pkgs; [
+          fzf
+          htop
+          jc
+          jq
+          openssl
+          pv
+          ripgrep
+          fd
+          tmux
+        ];
+      };
    };
 }
--- a/features/steam.nix
+++ b/features/steam.nix
@@ -1,10 +0,0 @@
-{
-  nixos = _: {
-    programs.steam = {
-      enable = true;
-      remotePlay.openFirewall = true;
-      dedicatedServer.openFirewall = true;
-      localNetworkGameTransfers.openFirewall = true;
-    };
-  };
-}
--- a/features/sway.nix
+++ b/features/sway.nix
@@ -1,38 +1,100 @@
 {
  nixos =
-    { pkgs, ... }:
    {
-      programs.sway = {
-        enable = true;
-        package = pkgs.swayfx;
-        wrapperFeatures.gtk = true;
-        extraSessionCommands = ''
-          # fix for java awt apps not rendering
-          export _JAVA_AWT_WM_NONREPARENTING=1
-        '';
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
+    {
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
      };

-      environment.systemPackages = with pkgs; [
-        waybar
-        mako
-        wob
-        playerctl
-        brightnessctl
-        foot
-        grim
-        pulseaudio
-        swayidle
-        swaylock-effects
-        jq
-        slurp
-        wl-clipboard
-        pamixer
-        wlsunset
-        satty
-        wayland-pipewire-idle-inhibit
-        fuzzel
-        cliphist
-        zenity
-      ];
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            # soft dependency
+            features.desktop.enable = lib.mkDefault true;
+
+            # hard dependency
+            assertions = [
+              {
+                assertion = desktopCfg.enable;
+                message = "features.sway requires features.desktop";
+              }
+            ];
+
+            programs.sway = {
+              enable = true;
+              package = pkgs.swayfx;
+              wrapperFeatures.gtk = true;
+              extraSessionCommands = ''
+                # fix for java awt apps not rendering
+                export _JAVA_AWT_WM_NONREPARENTING=1
+                # propagate XDG_DATA_DIRS to dbus/systemd for d-bus activated apps
+                dbus-update-activation-environment --systemd XDG_DATA_DIRS
+              '';
+            };
+
+            environment.systemPackages = with pkgs; [
+              waybar
+              mako
+              wob
+              playerctl
+              brightnessctl
+              foot
+              grim
+              pulseaudio
+              swayidle
+              swaylock-effects
+              jq
+              slurp
+              wl-clipboard
+              pamixer
+              wlsunset
+              satty
+              wayland-pipewire-idle-inhibit
+              fuzzel
+              cliphist
+              zenity
+            ];
+          }
+
+          # greeter
+          (lib.mkIf cfg.greeter.enable {
+            programs.regreet = {
+              enable = true;
+              cageArgs = [
+                "-s"
+                "-m"
+                "last"
+              ];
+              font = {
+                name = lib.mkForce "JetBrainsMono Nerd Font";
+                size = lib.mkForce 14;
+              };
+              settings = {
+                background = {
+                  path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                  fit = lib.mkForce "Cover";
+                };
+                GTK = {
+                  application_prefer_dark_theme = lib.mkForce true;
+                };
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/tailscale.nix
+++ b/features/tailscale.nix
@@ -1,8 +1,17 @@
 {
-  nixos = _: {
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.tailscale;
+    in
+    {
+      options.features.tailscale.enable = lib.mkEnableOption "tailscale";
+
+      config = lib.mkIf cfg.enable {
+        services.tailscale = {
+          enable = true;
+          useRoutingFeatures = "both";
+        };
+      };
    };
-  };
 }
--- a/features/udev.nix
+++ b/features/udev.nix
@@ -0,0 +1,59 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.mkIf cfg.kindle.enable {
+            # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+            # because extraRules writes to 99-local.rules which is too late for uaccess
+            services.udev.packages = [
+              pkgs.libmtp
+              (pkgs.writeTextFile {
+                name = "kindle-udev-rules";
+                text = ''
+                  ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+                '';
+                destination = "/etc/udev/rules.d/70-kindle.rules";
+              })
+            ];
+          })
+
+          (lib.mkIf cfg.ledger.enable {
+            hardware.ledger.enable = true;
+          })
+
+          (lib.mkIf cfg.keyboard-zsa.enable {
+            hardware.keyboard.zsa.enable = true;
+          })
+        ]
+      );
+    };
+}
--- a/features/user-matej.nix
+++ b/features/user-matej.nix
@@ -9,27 +9,22 @@ in
    sshAuthorizedKeys = sshKeys;
  };

-  nixos =
-    { pkgs, ... }:
-    {
-      programs.zsh.enable = true;
-
-      users.users.matej = {
-        uid = 1000;
-        isNormalUser = true;
-        home = "/home/matej";
-        shell = pkgs.zsh;
-        extraGroups = [ "wheel" ];
-        openssh.authorizedKeys.keys = sshKeys;
-      };
-
-      users.groups.matej = {
-        gid = 1000;
-        members = [ "matej" ];
-      };
+  nixos = _: {
+    users.users.matej = {
+      uid = 1000;
+      isNormalUser = true;
+      home = "/home/matej";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = sshKeys;
    };

+    users.groups.matej = {
+      gid = 1000;
+      members = [ "matej" ];
+    };
+  };
+
  home = _: {
-    home.stateVersion = "24.11";
+    home.stateVersion = "26.05";
  };
 }
--- a/features/vm-9p-automount.nix
+++ b/features/vm-9p-automount.nix
@@ -1,72 +0,0 @@
-{
-  nixos =
-    {
-      pkgs,
-      lib,
-      config,
-      ...
-    }:
-    let
-      inherit (config.vm-9p-automount) user;
-      inherit (config.users.users.${user}) home group;
-    in
-    {
-      options = {
-        vm-9p-automount = {
-          user = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          prefix = lib.mkOption {
-            type = lib.types.str;
-            default = "m_";
-          };
-
-          basePath = lib.mkOption {
-            type = lib.types.str;
-            default = "${home}/mnt";
-          };
-        };
-      };
-
-      config = {
-        systemd.services.vm-9p-automount = {
-          description = "Auto-discover and mount 9p shares";
-          after = [
-            "local-fs.target"
-            "nss-user-lookup.target"
-            "systemd-modules-load.service"
-          ];
-          wants = [ "systemd-modules-load.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-              BASE="${config.vm-9p-automount.basePath}"
-              PREFIX="${config.vm-9p-automount.prefix}"
-              mkdir -p "$BASE"
-              chown ${user}:${group} "$BASE"
-
-              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                [ -f "$tagfile" ] || continue
-                tag=$(tr -d '\0' < "$tagfile")
-
-                case "$tag" in
-                  "$PREFIX"*) ;;
-                  *) continue ;;
-                esac
-
-                name="''${tag#"$PREFIX"}"
-                target="$BASE/$name"
-
-                mkdir -p "$target"
-                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                  -o trans=virtio,version=9p2000.L || continue
-              done
-            '';
-          };
-        };
-      };
-    };
-}
--- a/features/vm-guest.nix
+++ b/features/vm-guest.nix
@@ -6,42 +6,107 @@
      config,
      ...
    }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
    {
-      options = {
-        vm-guest.headless = lib.mkOption {
+      options.features.vm-guest = {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
          type = lib.types.bool;
          default = false;
        };
-      };

-      config = {
-        services.qemuGuest.enable = true;
-        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";

-        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+          user = lib.mkOption {
+            type = lib.types.str;
+          };

-        boot.initrd.availableKernelModules = [
-          "9p"
-          "9pnet_virtio"
-        ];
-        boot.kernelModules = [
-          "9p"
-          "9pnet_virtio"
-        ];
+          prefix = lib.mkOption {
+            type = lib.types.str;
+            default = "m_";
+          };

-        networking = {
-          useDHCP = true;
-          firewall.allowedTCPPorts = [ 22 ];
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
        };
-
-        security.sudo.wheelNeedsPassword = false;
-
-        environment.systemPackages = with pkgs; [
-          curl
-          wget
-          htop
-          sshfs
-        ];
      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+            boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
+
+            # 9p autoloads on first mount
+            boot.initrd.availableKernelModules = [
+              "9p"
+              "9pnet_virtio"
+            ];
+
+            networking = {
+              useDHCP = true;
+              firewall.allowedTCPPorts = [ 22 ];
+            };
+
+            security.sudo.wheelNeedsPassword = false;
+
+            environment.systemPackages = with pkgs; [
+              curl
+              wget
+              htop
+            ];
+          }
+
+          (lib.mkIf cfg.automount.enable {
+            systemd.services.vm-9p-automount = {
+              description = "Auto-discover and mount 9p shares";
+              after = [
+                "local-fs.target"
+                "nss-user-lookup.target"
+                "systemd-modules-load.service"
+              ];
+              wants = [ "systemd-modules-load.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                  BASE="${cfg.automount.basePath}"
+                  PREFIX="${cfg.automount.prefix}"
+                  mkdir -p "$BASE"
+                  chown ${autoUser}:${autoGroup} "$BASE"
+
+                  for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                    [ -f "$tagfile" ] || continue
+                    tag=$(tr -d '\0' < "$tagfile")
+
+                    case "$tag" in
+                      "$PREFIX"*) ;;
+                      *) continue ;;
+                    esac
+
+                    name="''${tag#"$PREFIX"}"
+                    target="$BASE/$name"
+
+                    mkdir -p "$target"
+                    ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                      -o trans=virtio,version=9p2000.L || continue
+                  done
+                '';
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/yubikey.nix
+++ b/features/yubikey.nix
@@ -1,12 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        yubikey-personalization
-        yubikey-manager
-      ];
-
-      services.pcscd.enable = true;
-    };
-}
--- a/features/zsh.nix
+++ b/features/zsh.nix
@@ -0,0 +1,55 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.zsh;
+    in
+    {
+      options.features.zsh = {
+        enable = lib.mkEnableOption "zsh";
+
+        loginShell.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.zsh.enable = true;
+            environment.etc."zshenv".text = ''
+              export ZDOTDIR=$HOME/.config/zsh
+            '';
+          }
+
+          (lib.mkIf cfg.loginShell.enable {
+            users.users.${user}.shell = pkgs.zsh;
+          })
+        ]
+      );
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.zsh;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [ pkgs.starship ];
+      };
+    };
+}
--- a/flake.lock
+++ b/flake.lock
@@ -99,14 +99,34 @@
        "type": "github"
      }
    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776613567,
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "lastModified": 1775176642,
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
        "type": "github"
      },
      "original": {
@@ -136,11 +156,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
        "type": "github"
      },
      "original": {
@@ -157,11 +177,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
        "type": "github"
      },
      "original": {
@@ -178,11 +198,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
        "type": "github"
      },
      "original": {
@@ -232,20 +252,18 @@
    "gnome-shell": {
      "flake": false,
      "locked": {
-        "host": "gitlab.gnome.org",
        "lastModified": 1767737596,
        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
        "owner": "GNOME",
        "repo": "gnome-shell",
        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
      },
      "original": {
-        "host": "gitlab.gnome.org",
        "owner": "GNOME",
-        "ref": "gnome-49",
        "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
      }
    },
    "home-manager": {
@@ -255,16 +273,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1774274588,
-        "narHash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=",
+        "lastModified": 1776777932,
+        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "cf9686ba26f5ef788226843bc31fda4cf72e373b",
+        "rev": "5d5640599a0050b994330328b9fd45709c909720",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-25.11",
        "repo": "home-manager",
        "type": "github"
      }
@@ -300,11 +317,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1774483626,
-        "narHash": "sha256-8VAX9GXNfv4eBj0qBEf/Rc2/E6G0SBEpuo2A5plw34I=",
+        "lastModified": 1776729909,
+        "narHash": "sha256-wGu/N42PJqrj8ju9GoXdppg4rwaKzZqdAjsgxJbCvfY=",
        "owner": "nix-community",
        "repo": "neovim-nightly-overlay",
-        "rev": "5deaa19e80e1c0695f7fa8a16e13a704fd08f96e",
+        "rev": "ff21a18bde28b4c8ca0bc1f9a5b7186a1b89a3d1",
        "type": "github"
      },
      "original": {
@@ -316,11 +333,11 @@
    "neovim-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1774472446,
-        "narHash": "sha256-Hp4A0llEmBvvNuw5uKOz+BA86X7TmXZ1vUK0StiMdVs=",
+        "lastModified": 1776727374,
+        "narHash": "sha256-iP5SviNXW5W+ay4ZmwjDFsfQjfM+fYlUxRlLPHjpwWI=",
        "owner": "neovim",
        "repo": "neovim",
-        "rev": "c9e961994b16ed841be43541ef550bf3d3f043ec",
+        "rev": "901b3f0c394a53961781ebeee682e64ad690a242",
        "type": "github"
      },
      "original": {
@@ -331,11 +348,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1774465523,
-        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
        "type": "github"
      },
      "original": {
@@ -347,11 +364,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1774273680,
-        "narHash": "sha256-a++tZ1RQsDb1I0NHrFwdGuRlR5TORvCEUksM459wKUA=",
+        "lastModified": 1776329215,
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
        "type": "github"
      },
      "original": {
@@ -363,11 +380,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1772328832,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "lastModified": 1774748309,
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
        "type": "github"
      },
      "original": {
@@ -378,11 +395,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1774515149,
-        "narHash": "sha256-avcNAzwJC2lOyMNKVro2u5d6RLGiquXXxQVVmAEQ2+U=",
+        "lastModified": 1776807375,
+        "narHash": "sha256-LDnHG0T54OEHyRydmGUlAND8ham0KrRNWjgoS+6GUd4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "01fcaaa08a9a44ec63c52bf0ee8d9a29593fee07",
+        "rev": "553ecb1686a2edb75dee44c9f72e1674e6adc26a",
        "type": "github"
      },
      "original": {
@@ -392,34 +409,34 @@
        "type": "github"
      }
    },
-    "nixpkgs-unstable": {
+    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1774273680,
-        "narHash": "sha256-a++tZ1RQsDb1I0NHrFwdGuRlR5TORvCEUksM459wKUA=",
-        "owner": "nixos",
+        "lastModified": 1776560675,
+        "narHash": "sha256-p68udKWWh7+V4ZPpcMDq0gTHWNZJnr4JPI+kHPPE40o=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
+        "rev": "e07580dae39738e46609eaab8b154de2488133ce",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1774244481,
-        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
+        "lastModified": 1776548001,
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -436,11 +453,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767886815,
-        "narHash": "sha256-pB2BBv6X9cVGydEV/9Y8+uGCvuYJAlsprs1v1QHjccA=",
+        "lastModified": 1775228139,
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "4ff84374d77ff62e2e13a46c33bfeb73590f9fef",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
        "type": "github"
      },
      "original": {
@@ -491,6 +508,7 @@
    "root": {
      "inputs": {
        "assets": "assets",
+        "disko": "disko",
        "flake-parts": "flake-parts",
        "home-manager": "home-manager",
        "lanzaboote": "lanzaboote",
@@ -498,8 +516,9 @@
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-master": "nixpkgs-master",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs-stable": "nixpkgs-stable",
        "nvim": "nvim",
+        "sops-nix": "sops-nix",
        "stylix": "stylix"
      }
    },
@@ -524,6 +543,26 @@
        "type": "github"
      }
    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776771786,
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
    "stylix": {
      "inputs": {
        "base16": "base16",
@@ -538,23 +577,21 @@
        ],
        "nur": "nur",
        "systems": "systems",
-        "tinted-foot": "tinted-foot",
        "tinted-kitty": "tinted-kitty",
        "tinted-schemes": "tinted-schemes",
        "tinted-tmux": "tinted-tmux",
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1774194089,
-        "narHash": "sha256-SCczWhr8y8aaXVHG+gOGcRahNb0BU1Z5zYZuv9W/nA8=",
+        "lastModified": 1776170745,
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "7c34241d80ea64dd2039bb3a786fb66b4c6261d9",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
        "type": "github"
      },
      "original": {
        "owner": "danth",
-        "ref": "release-25.11",
        "repo": "stylix",
        "type": "github"
      }
@@ -574,23 +611,6 @@
        "type": "github"
      }
    },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
    "tinted-kitty": {
      "flake": false,
      "locked": {
@@ -610,11 +630,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1767817087,
-        "narHash": "sha256-eGE8OYoK6HzhJt/7bOiNV2cx01IdIrHL7gXgjkHRdNo=",
+        "lastModified": 1772661346,
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "bd99656235aab343e3d597bf196df9bc67429507",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
        "type": "github"
      },
      "original": {
@@ -626,11 +646,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "lastModified": 1772934010,
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
        "type": "github"
      },
      "original": {
@@ -642,11 +662,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "lastModified": 1772909925,
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
  description = "matej's nix setup";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
    nixpkgs-master.url = "github:nixos/nixpkgs/master";

    nvim = {
@@ -16,12 +16,12 @@
    flake-parts.url = "github:hercules-ci/flake-parts";

    home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    stylix = {
-      url = "github:danth/stylix/release-25.11";
+      url = "github:danth/stylix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -37,6 +37,16 @@

    neovim-nightly-overlay.url = "github:nix-community/neovim-nightly-overlay";

+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
  };

  outputs =
--- a/flake/dev-components.nix
+++ b/flake/dev-components.nix
@@ -0,0 +1,89 @@
+# composable dev environment components
+# imported by generated per-project flakes via use_dev
+{ pkgs, lib }:
+let
+  # libraries needed by python native extensions
+  pythonLibraries = [
+    pkgs.stdenv.cc.cc.lib
+    pkgs.zlib
+    pkgs.openssl
+    pkgs.curl
+    pkgs.libffi
+  ];
+
+  mkNode = nodejs: {
+    packages = [
+      nodejs
+      pkgs.corepack
+    ];
+    env = {
+      COREPACK_ENABLE_STRICT = "0";
+    };
+  };
+
+  mkUv = python: {
+    packages = [
+      python
+      pkgs.uv
+      pkgs.pkg-config
+    ];
+    libraries = pythonLibraries;
+    env = {
+      UV_PYTHON_DOWNLOADS = "never";
+      UV_PYTHON_PREFERENCE = "only-system";
+    };
+    shellHook = ''
+      unset PYTHONPATH
+      export UV_PROJECT_ENVIRONMENT="''${XDG_DATA_HOME:-$HOME/.local/share}/dev-venvs/$(basename "$PWD")-$(echo "$PWD" | sha256sum | cut -c1-8)"
+    '';
+  };
+
+  components = {
+    uv_10 = mkUv pkgs.python310;
+    uv_11 = mkUv pkgs.python311;
+    uv_12 = mkUv pkgs.python312;
+    uv_13 = mkUv pkgs.python313;
+    uv_14 = mkUv pkgs.python314;
+
+    node_20 = mkNode pkgs.nodejs_20;
+    node_22 = mkNode pkgs.nodejs_22;
+    node_24 = mkNode pkgs.nodejs_24;
+
+    rust = {
+      packages = [
+        pkgs.rustc
+        pkgs.cargo
+        pkgs.rust-analyzer
+        pkgs.openssl
+        pkgs.pkg-config
+      ];
+    };
+
+  };
+
+  # build a single mkShell from one or more component names
+  mkComponentShell =
+    names: extraPackages:
+    let
+      selected = map (n: components.${n}) names;
+      allPackages = lib.concatMap (c: c.packages or [ ]) selected ++ extraPackages;
+      allLibraries = lib.concatMap (c: c.libraries or [ ]) selected;
+      allHooks = lib.concatMapStrings (c: c.shellHook or "") selected;
+      allEnvs = lib.foldl' (acc: c: acc // (c.env or { })) { } selected;
+      libPath = lib.makeLibraryPath allLibraries;
+    in
+    pkgs.mkShell (
+      {
+        packages = allPackages;
+        shellHook =
+          (lib.optionalString (allLibraries != [ ]) ''
+            export LD_LIBRARY_PATH="${libPath}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+          '')
+          + allHooks;
+      }
+      // lib.optionalAttrs (allEnvs != { }) { env = allEnvs; }
+    );
+in
+{
+  inherit components mkComponentShell;
+}
--- a/flake/devshell.nix
+++ b/flake/devshell.nix
@@ -1,93 +1,6 @@
 _: {
  perSystem =
-    { pkgs, lib, ... }:
-    let
-      # libraries needed by python native extensions
-      pythonLibraries = [
-        pkgs.stdenv.cc.cc.lib
-        pkgs.zlib
-        pkgs.openssl
-        pkgs.curl
-      ];
-
-      mkUv = python: {
-        packages = [
-          python
-          pkgs.uv
-        ];
-        libraries = pythonLibraries;
-        env = {
-          UV_PYTHON_DOWNLOADS = "never";
-          UV_PYTHON_PREFERENCE = "only-system";
-          UV_PYTHON = "${python}/bin/python";
-        };
-        shellHook = ''
-          unset PYTHONPATH
-          export UV_PROJECT_ENVIRONMENT="$HOME/.venvs/$(basename "$PWD")-$(echo "$PWD" | md5sum | cut -c1-8)"
-        '';
-      };
-
-      # composable dev environment components
-      # each is exposed as its own devShell, layered via `use dev` in .envrc
-      components = {
-        uv_10 = mkUv pkgs.python310;
-        uv_11 = mkUv pkgs.python311;
-        uv_12 = mkUv pkgs.python312;
-        uv_13 = mkUv pkgs.python313;
-        uv_14 = mkUv pkgs.python314;
-
-        pg_15 = {
-          packages = [ pkgs.postgresql_15 ];
-        };
-        pg_16 = {
-          packages = [ pkgs.postgresql_16 ];
-        };
-        pg_17 = {
-          packages = [ pkgs.postgresql_17 ];
-        };
-        pg_18 = {
-          packages = [ pkgs.postgresql_18 ];
-        };
-
-        rust = {
-          packages = [
-            pkgs.rustc
-            pkgs.cargo
-            pkgs.rust-analyzer
-            pkgs.openssl
-            pkgs.pkg-config
-          ];
-        };
-
-        cmake = {
-          packages = [
-            pkgs.cmake
-            pkgs.ninja
-          ];
-        };
-      };
-
-      mkComponentShell =
-        component:
-        let
-          c = components.${component};
-          libraries = c.libraries or [ ];
-          libPath = lib.makeLibraryPath libraries;
-        in
-        pkgs.mkShell (
-          {
-            packages = c.packages or [ ];
-            shellHook =
-              (lib.optionalString (libraries != [ ]) ''
-                export LD_LIBRARY_PATH="${libPath}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-              '')
-              + (c.shellHook or "");
-          }
-          // lib.optionalAttrs (c ? env) { inherit (c) env; }
-        );
-
-      componentShells = lib.mapAttrs (name: _: mkComponentShell name) components;
-    in
+    { pkgs, ... }:
    {
      formatter = pkgs.nixfmt-tree;

@@ -99,9 +12,10 @@ _: {
            pkgs.shellcheck
            pkgs.shfmt
            pkgs.qemu
+            pkgs.sops
+            pkgs.ssh-to-age
          ];
        };
-      }
-      // componentShells;
+      };
    };
 }
--- a/flake/hosts.nix
+++ b/flake/hosts.nix
@@ -15,25 +15,29 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "steam"
-        "dev-registry"
-        "neovim"
-        "dev"
+        "bootloader"
        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "power"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
      ];
    };

@@ -41,26 +45,30 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "steam"
-        "initrd-ssh"
-        "dev-registry"
-        "neovim"
-        "dev"
+        "bootloader"
        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "harmonia"
+        "initrd-ssh"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
      ];
    };

@@ -69,7 +77,56 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
+        "nix-settings"
        "openssh"
+        "zsh"
+      ];
+    };
+
+    cube = mkHost "cube" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
+        "shell"
+        "tailscale"
+        "zsh"
+      ];
+    };
+
+    # nix run github:nix-community/nixos-anywhere -- --flake .#floo root@<ip>
+    floo = mkHost "floo" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "filedrop"
+        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
+        "shell"
+        "tailscale"
+        "zsh"
+      ];
+    };
+
+    fortress = mkHost "fortress" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "desktop"
+        "gnupg"
+        "localisation"
+        "networkmanager"
+        "nix-settings"
+        "sway"
+        "udev"
+        "zsh"
      ];
    };

@@ -77,16 +134,18 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "vm-guest"
-        "vm-9p-automount"
-        "docker"
-        "neovim"
        "claude"
        "dev"
+        "docker"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "nix-settings"
+        "openssh"
+        "shell"
+        "vm-guest"
+        "zsh"
      ];
    };
  };
--- a/flake/overlays.nix
+++ b/flake/overlays.nix
@@ -1,21 +1,5 @@
-{ inputs, ... }:
+_:

 {
-  flake.overlays.default =
-    _: prev:
-    let
-      pkgs-unstable = import inputs.nixpkgs-unstable {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-      pkgs-master = import inputs.nixpkgs-master {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-    in
-    {
-      inherit (pkgs-master) claude-code;
-      # TODO:(@janezicmatej) 2026-03-09 error with stable for telegram-desktop
-      inherit (pkgs-unstable) telegram-desktop;
-    };
+  flake.overlays.default = _: _: { };
 }
--- a/flake/packages.nix
+++ b/flake/packages.nix
@@ -15,7 +15,6 @@ in
          }
          {
            inherit pkgs;
-            pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
            pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
          };
    };
--- a/hosts/cube/configuration.nix
+++ b/hosts/cube/configuration.nix
@@ -0,0 +1,33 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        esp = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/cube/hardware-configuration.nix
+++ b/hosts/cube/hardware-configuration.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/ephvm/configuration.nix
+++ b/hosts/ephvm/configuration.nix
@@ -5,6 +5,7 @@
  ...
 }:
 {
+  features.nix-settings.towerCache.enable = false;
  # no hardware firmware needed in a VM
  hardware.enableRedistributableFirmware = lib.mkForce false;
  hardware.wirelessRegulatoryDatabase = lib.mkForce false;
@@ -12,37 +13,93 @@
  documentation.enable = false;
  environment.defaultPackages = [ ];

-  # compressed qcow2, no channel copy
+  # qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
+  # (~half the size of zlib v2, faster decompress)
  image.modules.qemu =
    { config, modulesPath, ... }:
    {
      system.build.image = lib.mkForce (
-        import (modulesPath + "/../lib/make-disk-image.nix") {
-          inherit lib config pkgs;
-          inherit (config.virtualisation) diskSize;
+        let
+          rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
+            inherit lib config pkgs;
+            inherit (config.virtualisation) diskSize;
+            inherit (config.image) baseName;
+            format = "qcow2";
+            copyChannel = false;
+            partitionTableType = "legacy";
+          };
          inherit (config.image) baseName;
-          format = "qcow2-compressed";
-          copyChannel = false;
-          partitionTableType = "legacy";
-        }
+        in
+        pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
+          mkdir -p $out
+          # qemu-img caps -m at 16
+          cores="''${NIX_BUILD_CORES:-4}"
+          [ "$cores" -gt 0 ] || cores=4
+          [ "$cores" -gt 16 ] && cores=16
+          qemu-img convert \
+            -f qcow2 \
+            -O qcow2 \
+            -c \
+            -o compression_type=zstd \
+            -m "$cores" \
+            ${rawImage}/${baseName}.qcow2 \
+            $out/${baseName}.qcow2
+        ''
      );
    };

-  vm-guest.headless = true;
+  # auto-login on serial console
+  services.getty.autologinUser = "matej";

-  vm-9p-automount.user = "matej";
-
-  localisation = {
-    timeZone = "UTC";
-    defaultLocale = "en_US.UTF-8";
+  # enable zsh in home-manager so starship init gets wired up
+  home-manager.users.matej.programs.zsh = {
+    enable = true;
+    dotDir = "/home/matej/.config/zsh";
+    shellAliases.dsp = "claude --dangerously-skip-permissions";
  };

-  home-manager.users.matej = {
-    neovim.dotfiles = inputs.nvim;
+  home-manager.users.matej.programs.starship = {
+    enable = true;
+    settings = {
+      add_newline = false;
+      format = "$username$hostname$directory$character";
+      hostname = {
+        ssh_only = false;
+        style = "bold blue";
+        format = "[@$hostname]($style)";
+      };
+      username = {
+        show_always = true;
+        style_user = "bold blue";
+        format = "[$user]($style)";
+      };
+      directory.format = " [$path]($style) ";
+      character = {
+        success_symbol = "[>](bold green)";
+        error_symbol = "[>](bold red)";
+      };
+    };
  };

+  features.vm-guest.headless = true;
+  features.vm-guest.automount = {
+    enable = true;
+    user = "matej";
+  };
+  features.neovim.dotfiles = inputs.nvim;
+
  # ensure .config exists with correct ownership before automount
-  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
+
+  # TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
+  # https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
+  # accept any ssh key (ephemeral localhost-only vm)
+  services.openssh.settings.AuthorizedKeysCommand =
+    let
+      acceptKey = pkgs.writeShellScript "ephvm-accept-key" ''echo "$1 $2"'';
+    in
+    "${acceptKey} %t %k";
+  services.openssh.settings.AuthorizedKeysCommandUser = "nobody";

  # writable claude config via 9p
  fileSystems."/home/matej/.config/claude" = {
--- a/hosts/floo/configuration.nix
+++ b/hosts/floo/configuration.nix
@@ -0,0 +1,32 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
+  boot.loader.grub.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/floo/hardware-configuration.nix
+++ b/hosts/floo/hardware-configuration.nix
@@ -0,0 +1,37 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/hosts/fortress/configuration.nix
+++ b/hosts/fortress/configuration.nix
@@ -0,0 +1,79 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
+  ];
+
+  features.desktop = {
+    apps.enable = false;
+    internalCA.enable = false;
+  };
+  features.gnupg.yubikey.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        esp = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptlvm";
+            settings.allowDiscards = true;
+            content = {
+              type = "lvm_pv";
+              vg = "vg";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  disko.devices.lvm_vg.vg = {
+    type = "lvm_vg";
+    lvs = {
+      root = {
+        size = "100%FREE";
+        content = {
+          type = "filesystem";
+          format = "ext4";
+          mountpoint = "/";
+        };
+      };
+      swap = {
+        size = "32G";
+        content = {
+          type = "swap";
+        };
+      };
+    };
+  };
+
+  networking.firewall.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    google-chrome
+    firefox
+    vim
+  ];
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/fortress/hardware-configuration.nix
+++ b/hosts/fortress/hardware-configuration.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  hardware.firmware = [ pkgs.linux-firmware ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/fw16/configuration.nix
+++ b/hosts/fw16/configuration.nix
@@ -1,8 +1,7 @@
 {
  lib,
-  pkgs,
-  inputs,
  options,
+  inputs,
  ...
 }:

@@ -11,37 +10,23 @@
    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
  ];

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.bootloader.plymouth.enable = true;
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";

  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];

-  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandlePowerKey = "suspend-then-hibernate";
-    IdleAction = "suspend-then-hibernate";
-    IdleActionSec = "15min";
-  };
-
-  systemd.sleep.extraConfig = ''
-    HibernateDelaySec=30min
-  '';
-
  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;

  services.gnome.gnome-keyring.enable = true;
  services.teamviewer.enable = true;

  services.hardware.bolt.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
  hardware.bluetooth.powerOnBoot = true;
  hardware.inputmodule.enable = true;

--- a/hosts/iso/configuration.nix
+++ b/hosts/iso/configuration.nix
@@ -1,10 +1,14 @@
-_: {
+{ lib, userKeys, ... }:
+{
+  features.nix-settings.towerCache.enable = false;
  image.modules.iso-installer = {
    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
  };

  # live iso: passwordless login and sudo
  users.users.matej.initialHashedPassword = "";
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
+  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
  security.sudo.wheelNeedsPassword = false;

  system.stateVersion = "25.05";
--- a/hosts/tower/configuration.nix
+++ b/hosts/tower/configuration.nix
@@ -1,33 +1,33 @@
 {
-  lib,
-  inputs,
+  config,
  userKeys,
  ...
 }:

 {
-  imports = [
-    inputs.lanzaboote.nixosModules.lanzaboote
-  ];
-
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.nix-settings.towerCache.enable = false;
+  features.bootloader = {
+    mode = "lanzaboote";
+    plymouth.enable = true;
  };
-
-  initrd-ssh = {
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
    networkModule = "r8169";
    authorizedKeys = userKeys.sshAuthorizedKeys;
  };

-  # lanzaboote secure boot
+  # nix store signing
+  sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
+  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
+
  boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
+  # early kms so plymouth lands on amdgpu, not simpledrm
+  hardware.amdgpu.initrd.enable = true;

  services.udisks2.enable = true;

--- a/21
+++ b/21
@@ -41,6 +41,27 @@ ephvm *ARGS:
 ephvm-ssh port="2222":
    ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost

+# provision a host with nixos-anywhere
+provision host ip:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    tmpdir=$(mktemp -d)
+    trap 'rm -rf "$tmpdir"' EXIT
+    install -d -m 755 "$tmpdir/etc/ssh"
+    ssh-keygen -t ed25519 -f "$tmpdir/etc/ssh/ssh_host_ed25519_key" -N ""
+    age_key=$(ssh-to-age < "$tmpdir/etc/ssh/ssh_host_ed25519_key.pub")
+    echo "age key: $age_key"
+    echo "add this key to .sops.yaml, re-encrypt secrets, then press enter to continue"
+    read -r
+    nix run github:nix-community/nixos-anywhere -- --no-reboot --flake .#{{host}} --extra-files "$tmpdir" --generate-hardware-config nixos-generate-config ./hosts/{{host}}/hardware-configuration.nix root@{{ip}}
+    echo "remove USB and press enter to reboot"
+    read -r
+    ssh root@{{ip}} reboot
+
+# deploy config to a remote host
+deploy host remote=host:
+    nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
+
 # garbage collect old generations
 clean:
    sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
--- a/lib/mkHost.nix
+++ b/lib/mkHost.nix
@@ -16,12 +16,30 @@ let
  hasUser = user != null;

  # path helpers
-  featurePath = f: ../features/${f}.nix;
+  featurePath =
+    f:
+    let
+      file = ../features/${f}.nix;
+      dir = ../features/${f};
+    in
+    if builtins.pathExists file then file else dir;
  userFeaturePath = u: ../features/user-${u}.nix;
  hostConfig = ../hosts/${name}/configuration.nix;
  hostHWConfig = ../hosts/${name}/hardware-configuration.nix;

-  # load feature with path check
+  # auto-discover all features, excluding user-* and default.nix
+  featureDir = builtins.readDir ../features;
+  allFeatureNames = lib.pipe featureDir [
+    (lib.filterAttrs (
+      n: t:
+      (t == "regular" && lib.hasSuffix ".nix" n && n != "default.nix" && !lib.hasPrefix "user-" n)
+      || (t == "directory" && builtins.pathExists ../features/${n}/default.nix)
+    ))
+    builtins.attrNames
+    (map (n: lib.removeSuffix ".nix" n))
+  ];
+
+  # load all features unconditionally
  loadFeature =
    f:
    assert
@@ -29,7 +47,7 @@ let
      || throw "feature '${f}' not found at ${toString (featurePath f)}";
    import (featurePath f);

-  loadedFeatures = map loadFeature features;
+  loadedFeatures = map loadFeature allFeatureNames;

  # load user feature with path check
  userFeature =
@@ -49,16 +67,27 @@ let
  # collect nixos and home modules from all features
  nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
  homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
+
+  # translate features list to enable flags
+  featureEnableModule =
+    { lib, ... }:
+    {
+      config.features = lib.genAttrs features (_: {
+        enable = true;
+      });
+    };
 in
 nixpkgs.lib.nixosSystem {
  inherit system;
  modules = [
-    ../nix.nix
+    inputs.sops-nix.nixosModules.sops
+    inputs.stylix.nixosModules.stylix

    { nixpkgs.overlays = overlays; }
    { nixpkgs.config.allowUnfree = true; }
    { networking.hostName = name; }

+    featureEnableModule
    hostConfig
  ]
  ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
--- a/nix.nix
+++ b/nix.nix
@@ -7,6 +7,16 @@
      ];
      download-buffer-size = 2 * 1024 * 1024 * 1024;
      warn-dirty = false;
+      substituters = [
+        "https://cache.nixos.org"
+        "https://nix-community.cachix.org?priority=45"
+        "http://tower:5000?priority=50"
+      ];
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE="
+      ];
    };

    gc = {
--- a/packages/claude-code/package.nix
+++ b/packages/claude-code/package.nix
@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) stdenv lib;
+  version = "2.1.116";
+
+  # upstream ships platform-native binaries as separate npm packages under
+  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
+  # postinstall shim that copies the matching one into place
+  sources = {
+    "x86_64-linux" = {
+      slug = "linux-x64";
+      hash = "sha256-QEjJ4CRk35TubDNW02Dzcu+EMRLLndJUXJeP3BFT3b8=";
+    };
+    "aarch64-linux" = {
+      slug = "linux-arm64";
+      hash = "sha256-/Hqp8GQx8Hub8K4w0Fnx/AksksY61vRC44XxrJVwF5w=";
+    };
+    "x86_64-darwin" = {
+      slug = "darwin-x64";
+      hash = "sha256-O3J/ew2fWbUQePs6tHEhK0Q9E3Mx/BDSL7b7NL3FRc8=";
+    };
+    "aarch64-darwin" = {
+      slug = "darwin-arm64";
+      hash = "sha256-O41sf7b05SJfXVjszMeTp838mja+PgZ+aEKykLsHeNo=";
+    };
+  };
+
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "claude-code: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "claude-code";
+  inherit version;
+
+  src = pkgs.fetchzip {
+    url = "https://registry.npmjs.org/@anthropic-ai/claude-code-${source.slug}/-/claude-code-${source.slug}-${version}.tgz";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.patchelf ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 claude $out/bin/claude
+    runHook postInstall
+  '';
+
+  # NOTE:(@janezicmatej) upstream is a bun single-file-executable; the
+  # embedded script payload sits at the tail of the ELF, so autoPatchelfHook's
+  # section-layout changes corrupt it — only the interpreter can be rewritten
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} $out/bin/claude
+    ''
+    + ''
+      wrapProgram $out/bin/claude \
+        --set DISABLE_AUTOUPDATER 1 \
+        --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+        --set DISABLE_INSTALLATION_CHECKS 1 \
+        --unset DEV \
+        --prefix PATH : ${
+          lib.makeBinPath (
+            [
+              pkgs.procps
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isLinux [
+              pkgs.bubblewrap
+              pkgs.socat
+            ]
+          )
+        }
+    '';
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://www.npmjs.com/package/@anthropic-ai/claude-code";
+    license = lib.licenses.unfree;
+    mainProgram = "claude";
+    platforms = lib.attrNames sources;
+  };
+}
--- a/packages/claude-code/update.sh
+++ b/packages/claude-code/update.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+# keep in sync with the `sources` attrset in package.nix
+PLATFORMS=(linux-x64 linux-arm64 darwin-x64 darwin-arm64)
+
+prefetch() {
+	local url="$1"
+	nix --extra-experimental-features 'nix-command flakes' \
+		store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r '.hash'
+}
+
+main() {
+	echo "fetching latest version from npm..."
+	local latest current
+	latest=$(curl -sf "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" | jq -r '.version')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "claude-code already at $latest"
+		return 0
+	fi
+
+	echo "updating claude-code: $current -> $latest"
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+
+	local slug url new_hash old_hash
+	for slug in "${PLATFORMS[@]}"; do
+		url="https://registry.npmjs.org/@anthropic-ai/claude-code-${slug}/-/claude-code-${slug}-${latest}.tgz"
+		echo "  prefetching $slug..."
+		new_hash=$(prefetch "$url")
+		old_hash=$(awk -v slug="$slug" '
+			$0 ~ "slug = \"" slug "\";" { found=1; next }
+			found && /hash = "sha256-/ {
+				match($0, /sha256-[A-Za-z0-9+\/]+=*/)
+				print substr($0, RSTART, RLENGTH)
+				exit
+			}
+		' "$PKG_FILE")
+		sed -i "s|$old_hash|$new_hash|" "$PKG_FILE"
+		echo "    $new_hash"
+	done
+
+	echo "claude-code updated to $latest"
+}
+
+main "$@"
--- a/scripts/ephvm-run.sh
+++ b/scripts/ephvm-run.sh
@@ -27,23 +27,44 @@ info() {

 # globals for cleanup trap
 CLEANUP_OVERLAY=""
+CLEANUP_TMPDIR=""
+QEMU_PID=""
+VM_READY=false
 cleanup() {
+	[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
 	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	# preserve tmpdir on abnormal exit so the qemu log survives for inspection
+	if [ -n "$CLEANUP_TMPDIR" ]; then
+		if [ "$VM_READY" = true ]; then
+			rm -rf "$CLEANUP_TMPDIR"
+		else
+			echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
+		fi
+	fi
 	return 0
 }
 trap cleanup EXIT

+# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
+awaiting_ssh_banner() {
+	local port="$1"
+	local banner
+	banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
+	[ "$banner" = "SSH-" ]
+}
+
 usage() {
 	cat <<EOF
 Usage: ephvm-run.sh [options]

 Options:
  --mount <path>       Mount host directory into VM (repeatable)
-  --claude             Mount claude config dir (requires CLAUDE_CONFIG_DIR)
+  --no-claude          Skip mounting claude config dir
  --disk-size <size>   Resize guest disk (e.g. 50G)
-  --memory <size>      VM memory (default: 8G)
-  --cpus <n>           VM CPUs (default: 4)
-  --ssh-port <port>    SSH port forward (default: 2222)
+  --memory <size>      VM memory (default: 4G)
+  --cpus <n>           VM CPUs (default: 2)
+  --ssh-port <port>    Use specific SSH port (default: auto)
+  --serial             Attach to serial console instead of SSH
  -h, --help           Show usage
 EOF
 	exit "${1:-0}"
@@ -52,7 +73,9 @@ EOF
 main() {
 	setup_colors

-	local ssh_port=2222 memory=8G cpus=4 claude=false disk_size=""
+	[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
+
+	local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
 	local -a mounts=()

 	while [ $# -gt 0 ]; do
@@ -61,8 +84,8 @@ main() {
 			mounts+=("$2")
 			shift 2
 			;;
-		--claude)
-			claude=true
+		--no-claude)
+			claude=false
 			shift
 			;;
 		--disk-size)
@@ -81,6 +104,10 @@ main() {
 			ssh_port="$2"
 			shift 2
 			;;
+		--serial)
+			serial=true
+			shift
+			;;
 		-h | --help) usage ;;
 		*)
 			echo "${red}error:${reset} unknown option: $1" >&2
@@ -91,7 +118,9 @@ main() {

 	info "building ephvm image..."
 	local image_dir image
-	image_dir=$(nix build --no-link --print-out-paths .#nixosConfigurations.ephvm.config.system.build.images.qemu)
+	[ -n "${EPHVM_FLAKE:-}" ] || die "EPHVM_FLAKE must be set to the flake directory"
+	local flake="$EPHVM_FLAKE"
+	image_dir=$(nix build --no-link --print-out-paths "${flake}#nixosConfigurations.ephvm.config.system.build.images.qemu")
 	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
 	[ -n "$image" ] || die "no qcow2 image found in $image_dir"

@@ -101,31 +130,49 @@ main() {
 		CLEANUP_OVERLAY=$(mktemp -d)
 		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
 		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
-		drive_arg="file=$overlay,format=qcow2"
+		drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	else
-		drive_arg="file=$image,format=qcow2,snapshot=on"
+		drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	fi

-	local accel="tcg"
-	[ -r /dev/kvm ] && accel="kvm"
+	command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
+	[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
+
+	# auto-allocate ssh port unless serial mode
+	if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
+		ssh_port=10022
+		while ss -tln | grep -q ":${ssh_port}\b"; do
+			ssh_port=$((ssh_port + 1))
+		done
+	fi
+
+	local nic_arg="user,model=virtio-net-pci"
+	if [ -n "$ssh_port" ]; then
+		nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
+	fi

 	local -a qemu_args=(
 		qemu-system-x86_64
-		-accel "$accel"
+		-accel kvm
+		-cpu host
 		-m "$memory"
 		-smp "$cpus"
 		-drive "$drive_arg"
-		-nic "user,hostfwd=tcp::${ssh_port}-:22"
+		-device "virtio-blk-pci,drive=hd0"
+		-device virtio-rng-pci
+		-nic "$nic_arg"
 		-nographic
+		-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
 	)

-	if [ "$accel" != "tcg" ]; then
-		qemu_args+=(-cpu host)
-	fi
-
 	local fs_id=0 mount_path name tag
 	for mount_path in "${mounts[@]}"; do
+		[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
 		mount_path=$(realpath "$mount_path")
+		# qemu parses -virtfs as csv, a comma in the path would inject options
+		case "$mount_path" in
+		*,*) die "--mount path may not contain commas: $mount_path" ;;
+		esac
 		name=$(basename "$mount_path")
 		tag="m_${name:0:29}"
 		qemu_args+=(
@@ -135,10 +182,13 @@ main() {
 	done

 	if [ "$claude" = true ]; then
-		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "--claude requires CLAUDE_CONFIG_DIR to be set"
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "CLAUDE_CONFIG_DIR must be set (use --no-claude to skip)"
 		mkdir -p "$CLAUDE_CONFIG_DIR"
 		local claude_dir
 		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+		case "$claude_dir" in
+		*,*) die "claude config dir may not contain commas: $claude_dir" ;;
+		esac

 		qemu_args+=(
 			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
@@ -147,10 +197,42 @@ main() {
 	fi

 	info "---"
-	info "Accel: $accel | SSH: ssh -p $ssh_port matej@localhost"
+	[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
 	info "---"

-	exec "${qemu_args[@]}"
+	if [ "$serial" = true ]; then
+		exec "${qemu_args[@]}"
+	fi
+
+	CLEANUP_TMPDIR=$(mktemp -d)
+	local qemu_log="$CLEANUP_TMPDIR/qemu.log"
+
+	# start qemu in background and auto-ssh
+	"${qemu_args[@]}" &>"$qemu_log" &
+	QEMU_PID=$!
+
+	# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
+	local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
+	ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
+
+	info "waiting for vm (port $ssh_port)..."
+	local attempts=0
+	# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
+	# accepts host-side the moment qemu starts, well before guest sshd is up
+	while ! awaiting_ssh_banner "$ssh_port"; do
+		attempts=$((attempts + 1))
+		[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
+		kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
+		sleep 0.5
+	done
+	VM_READY=true
+
+	ssh -p "$ssh_port" -t \
+		-i "$ssh_key" \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o LogLevel=ERROR \
+		matej@localhost
 }

 main "$@"
--- a/secrets/.gitkeep
+++ b/secrets/.gitkeep
--- a/secrets/common.yaml
+++ b/secrets/common.yaml
@@ -0,0 +1,55 @@
+user-password: ENC[AES256_GCM,data:c7y3RZSikVS32w7RTY5nBSWxDWbwNI5FhLIEoXcru5lpCUu3YqKjHNm8eMI7oeAg1VQIW/1axv0LPHM+bb7wn7SSHy49EvGyda4AU8hdVnsO9gNBul9WQy9Q6RM1PR5vW+IbX1HBFPTTOQ==,iv:oNsDzDugNq2E1CJ89BCXZ/ieCGV+evOwsOuKlKsotBg=,tag:jU8g9fIgexw2bm3E+ow3wA==,type:str]
+sops:
+    age:
+        - recipient: age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOU9BTksxbXdjTkExRDJV
+            aFhVbUFGd1ZSeHFBL0lJRjdSRDRjcjl6ZEQ0Cjg2TFlNZENUWTh5aWNGck52TWFx
+            SC9LS0FrelFCWUI3RUZjdCs3cXF6aDQKLS0tIEwwTWkzOXgxUC9iTFgrQ0szRW8v
+            cGFMa2Rqd1VvWjU3Z2pUdExsdnJUT1EK9iQiW5qZszu65b0wEeq+9JnzzhiAS7fo
+            BmR9OWbDA4GZJBEPBJFD8KxIcO/BYFOjfW2A9PZaTsTpa50Z6+zWxw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19qj2aaryx869cvcqp77gs9x5hcv4dqjxunkmyre78upsxda6ss7s5vquz4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPczdWeTRxalA1M3R0S0Qr
+            eGdtZnJxaHllZ2lKMXJUZTN3VWhhTnU1TFRnCjM5OHoxMnEzKzdQelZEQ3ZZRFpt
+            aWRzaTg4dUc5OXpQUngrVmtSRkk1Q3MKLS0tIEZOd0FyMFRlRElWbjlHOVVkZlZP
+            eEhwRVRrcVgvQUx6bi85YWxDYjJZa28K7Hrk4fAqbjeYJfPJODvsth1p8JYbsfMf
+            a6gTckyeQWTNlE+1Tw6g18lvMP1dzIAYRPHtyzmxeCaETVMmSn7XxQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbUh0U1ZDc0ZOKzhxZ3Yv
+            ZHRwbzBIdVNsbEJmU0h4ZnpuTlNHSFdwRlQ0Ck1BREhlVFQ3bnVKajVlTGUzRjhN
+            cWpna25Ya1hoZG1ybFZ0REpCNTFTZmcKLS0tIG5ZQzNIWmd4a3J6YWxDQjYyY2px
+            Y085TkhubS9MSjJtMmZDakdZd2RhR3cKlGH906WAhXNDKwaWqHRoYO9bgiZau0ay
+            8ph3OLOVmrENPW3Othf17NDRet/nATFYZghBU/CI5CvZjr9n9SDYMg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15cktenavt5v7zm84se36jtly740syca5nw8em8edx404n5x2ddws8jn29g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRG5zRkxOT0RyeXVpTDJu
+            TSt2SFFtSlFrSTk1YUZBMnAxTEM3dnFnQkFrClA0cnVpMkdsQWxCakNEZm16OEVG
+            dHFIUDA3TDJLdytySEJJMSsrMGZHcTgKLS0tIHhvdWNXaUthbDJqMWVYeWxuOGpL
+            L0lEZ3FVbmlOcndGUXUybXA4RDA2alUKQo5ctVmARPNY0POf2Ft6AxjwIN1N06C7
+            ft4YX+B4D61tUZ+uvFqHzmKsNpvDdoV81zxvGnnCnv0nSXwNghPFxw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-29T23:11:10Z"
+    mac: ENC[AES256_GCM,data:XY5wElDn+YD4UHSIGd9Ru8ob39gJVE8VE5gqJJkmzF/xERXp7re/d/6RXxoYDgYS0qUnn8c2VFzJxCvakmV/lPLA8YulFk/ZDysEVn+U3CbfTIkjXcJzewJNz0N+hQKeVaCzPfWeB5oaGtB8bjxOg+GYz2TmSvEAT+kO1U/4Klg=,iv:QOlZ4O+eqvOS9/guc+RmWgVDgPzskb4WIlzyT/14MVM=,tag:ziJE9Yytlr680EpSnBGmdQ==,type:str]
+    pgp:
+        - created_at: "2026-03-29T23:25:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdAPlvxgVq9o2boPPXWWwV6X3TjHZEl3lm9OcOj7lbsQxsw
+            5PTrX1rIV73XbRQUdFlnoYpUAwxh3UPULyA4+19fvCooC3L0FxA8e4wTiAdw6SKE
+            0l4BImy4sTiM8hNHXqB6u4rj3LbykCjesQve5C3fut62RV8x4cqUJHAB/aumQINT
+            QRXErylKmqo3h7ReRrCm2oOELauv4JFKNPi/cTE0MNh1+w9JxjoASoBufozDOxe4
+            =vIK+
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1
--- a/secrets/floo.yaml
+++ b/secrets/floo.yaml
@@ -0,0 +1,28 @@
+filedrop-authorized-keys: ENC[AES256_GCM,data:3zg0ZZR/EfmffhT+5hiiCawhHW0Y8VOcsMRwPq50AgSvM8DJO/fOK5RhPMlHmOOXSbYYal9QoPILP5rSHDMszk6QSRqmvAbpkpJhgfW4jx8XbLTFxO4lUKe/hd968ryqP2pXtZzUBnOp4vSI29LcYms6e8fSwS8ANtSIjCLkEsY=,iv:EOjsWB7uxjqI5NXot586Q0997SOmkAMwVkxm6VLplDc=,tag:Q4rB6KFibV+F79/rs5m0dA==,type:str]
+sops:
+    age:
+        - recipient: age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTRk1qOGNGNFp4VS9GOUs0
+            dTQ0K3A2Y3VXY3NSV0RyU0VxV3VCa0dDOG5zClAvOElXcHhYaWNCamxFZHMvV2Iy
+            WFRwNFRjaHpKSDdkak5UK05hd0hYMFUKLS0tIGRQeVJGdk8vYVdQdS9BYVd3TEhn
+            UWxzeHlaY2pvdS9tbW9vaVE5NTNwRFEKKieIA5Sn6oN5qjDwh5/usaKwLdYPClmS
+            d+hBdcn4/mtQnrm9dnbRVHd/B1MOuQxoXEB1kc4nzFKvCEqRdRIlYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-09T08:57:26Z"
+    mac: ENC[AES256_GCM,data:XHC5cBvQuDi9byVgDymx9qSbplDlHwFTSLaGfWTRQJZeioBelDgBwUstbgWDeNPj1RzGGaSa3+kDOa054DuXi/mw2nDnLGuQDFAmJ66kepJE1mw4F6i4+YnbSE+y7GTbTkUkvbmiNV7uGO4Fq9jy/gNb1wq3IHzDVaKNjNbkKAk=,iv:qK/tgbAkxGpfgJAjBrqDwO/lVkD79pY9S3hzXGGycvM=,tag:oHURU988sW4iN7fXwurOtQ==,type:str]
+    pgp:
+        - created_at: "2026-04-09T08:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdATk1lN0/WDX6S1oPje9jZloSll1qSNau3zgt67CrselMw
+            YlbenxVeY8G4qTvfimX9/qH1/SNHkL/B0jqMCEkw8EpeyA3oEIWuzEEEOA+W/Iri
+            0lwB26CTd8PKwvjuMwmvzTaZfQ9fk+ZsvIjtQaj//WA2utfU4b9T2E+M2Jb5vyki
+            INcWT4PJkNSDxm5NabcTqyetcorDGaU1oN/T1p7pvRBvGCSHItYthVvq/RC0bw==
+            =pKJc
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
--- a/secrets/tower.yaml
+++ b/secrets/tower.yaml
@@ -0,0 +1,28 @@
+nix-signing-key: ENC[AES256_GCM,data:V/mFaYQazqn3KkbDSt5Fnrl/IFvS9kEe10uhkPHeBluZGjFphKD+2dFCQrPPcXreX0UWklQA9Dokd2cGQBGZIUihJE9o9lH+Q6nrmqk3xsi1fzPS5l8zbn4RITmL3rNkmycXBw==,iv:g/jbUS88IBXnb9e6jGiWYHGfCZtdgI1X167hNmzUQEY=,tag:vO5kiN01FzU7s5jOCGW3Fg==,type:str]
+sops:
+    age:
+        - recipient: age1frwe9fpt9vh969aqnggvq8pfypp6hl98guwfmgttucp7gr55r42sqy2t65
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbkdXUW5YSTA4c3MyZzdi
+            ZlF0L2FQZmttbFBaVmlaWWppaXUxUVdYZEZZCmJHT25IZVBESHVqUWE2bnBYWXQ5
+            UTFLeXg3eUpyWngxc1FXUzhXRCs3R2MKLS0tIGxkbzFMaEUycCtpOC9mTitpVEZh
+            c0pROVJpMjJ6bHd1aEQ2QVE5MUUwdnMK/3tXEStP8JF/2c5nAJ19uA+P1cMG1X+v
+            H5b49uBJ+0UUGMzUpCLgMKz8bq+L8Se0b92iMW5bGW1Fdg/zwJWXOw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-29T21:47:29Z"
+    mac: ENC[AES256_GCM,data:573t4NH/764zZKzhhpVbzNzpN4QrBjwesIBMyHe7aB47ptGceLhnm+cHOhty3J89VBgn8jgHv5WCBzXFER0LDuQUMFPg6snJ0DK+IgRwuAwNbZdKdSR6VnjqOSBnaijU/Wx93kd/gcMqerYo6rEOLNjVadKgs+NYPLKC/dY4sVs=,iv:kOTr9CIvp6haV8BxTpQfdndYTjZRcmyg+7yjPjHRNLU=,tag:1odj8DYHSnOatRnqyZAcgg==,type:str]
+    pgp:
+        - created_at: "2026-03-29T21:46:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdA4NO+XFIyWa8YNV24yrosJKMQ60rmiEWYLjFdIkPrKz8w
+            cj1x62iDXeO6DYvyCZnw2h0WstIrXziX6PySveTVnCri90QdLl3jsolIW+V13b8V
+            0lEB5LFvx7OdZJPzrs32qiPv+ofleSMKAokPEhSTKccFI2GbyUiIw7ge2vHSjNpT
+            T9E3tA7HOglyopKTjFw/ujEhKDSRGXwdD2VEYH426Dt8JjU=
+            =E3fO
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1
Author	SHA1	Message	Date
Matej Janežič	6772afb845	merge: harden ephvm	2026-04-24 14:14:29 +02:00
Matej Janežič	e9755d41c6	feat: tighten ephvm perms, zstd compress qcow2	2026-04-24 14:13:01 +02:00
Matej Janežič	68411d9459	feat: prune vm-guest module	2026-04-24 14:12:57 +02:00
Matej Janežič	7fd5b790ff	feat: ephvm-run.sh virtio devices, require kvm	2026-04-24 14:12:52 +02:00
Matej Janežič	37bca1fdd1	feat: ephvm-run.sh resilience	2026-04-24 14:12:48 +02:00
Matej Janežič	75ca09949c	feat: harden ephvm-run.sh	2026-04-24 14:12:42 +02:00
Matej Janežič	2fcdee5d81	feat: set XDPW_PERSIST_MODE="permanent"	2026-04-23 23:14:45 +02:00
Matej Janežič	c01f797e79	chore: bump lockfile	2026-04-22 00:10:04 +02:00
Matej Janežič	59a2bfa126	chore: update claude-code to v2.1.116	2026-04-22 00:08:31 +02:00
Matej Janežič	e486bb28b0	feat: enable hM.neovim.sidloadInitLua	2026-04-22 00:06:16 +02:00
Matej Janežič	d33fd60ce4	feat: switch from vesktop to discord	2026-04-21 23:39:57 +02:00
Matej Janežič	37428d922b	feat: add plymouth option to bootloader	2026-04-21 22:43:13 +02:00
Matej Janežič	b1cfe1e31b	feat: initrd infinite default device timeout	2026-04-21 22:42:33 +02:00
Matej Janežič	df2bc27f54	chore: blame ignore `77236af589`	2026-04-21 22:11:33 +02:00
Matej Janežič	77236af589	chore: run format	2026-04-21 22:09:39 +02:00
Matej Janežič	f71d156ea8	feat: enable cache fallback	2026-04-21 10:08:08 +02:00
Matej Janežič	0c517e0957	chore: bump lockfile	2026-04-20 07:33:32 +02:00
Matej Janežič	37620c76fe	chore: bump claude-code to v2.1.114	2026-04-20 07:32:02 +02:00
Matej Janežič	ac76b8c842	feat: systemd-networkd during initrd	2026-04-16 23:36:10 +02:00
Matej Janežič	df7c4cec83	feat: bump claude-code to v2.1.112	2026-04-16 23:10:00 +02:00
Matej Janežič	5b52e41496	feat: self-package claude-code	2026-04-16 22:59:01 +02:00
Matej Janežič	a60b40eeac	feat: propagate XDG_DATA_DIRS to dbus/systemd	2026-04-15 09:45:21 +02:00
Matej Janežič	b341f7f4fc	feat: setup mime apps	2026-04-15 00:25:07 +02:00
Matej Janežič	571fb2ff99	chore: blame ignore `2204b12fad`	2026-04-13 23:04:46 +02:00
Matej Janežič	2204b12fad	chore: run lint & format	2026-04-13 23:04:16 +02:00
Matej Janežič	df2ee459a1	feat: improve cache-builder service trigger	2026-04-13 11:53:41 +02:00
Matej Janežič	f7d86e7718	feat: improve ephvm ux	2026-04-13 11:48:18 +02:00
Matej Janežič	2e5eb92e32	chore: bump lockfile	2026-04-13 00:22:51 +02:00
Matej Janežič	f30b03cc04	fix: enable dhcp in initrd if no static ip	2026-04-13 00:20:36 +02:00
Matej Janežič	c7fb218511	merge: feature improvements	2026-04-12 23:33:33 +02:00
Matej Janežič	3caace87d3	refactor: update hosts and feature lists for new architecture	2026-04-12 23:33:14 +02:00
Matej Janežič	8793f97a04	feat: add udev, onepassword, bootloader, power features	2026-04-12 23:33:07 +02:00
Matej Janežič	b8509196d5	feat: merge greeter into sway, yubikey into gnupg, automount into vm-guest	2026-04-12 23:33:01 +02:00
Matej Janežič	e1d136bd2f	feat: merge desktop + desktop-minimal + calibre with sub-options	2026-04-12 23:32:55 +02:00
Matej Janežič	898751576d	feat: add zsh + git features, redesign shell	2026-04-12 23:32:47 +02:00
Matej Janežič	6770bc76a2	refactor: mkHost load-all infrastructure and convert simple features	2026-04-12 23:32:28 +02:00
Matej Janežič	3ff4583017	merge: fortress host	2026-04-10 22:51:26 +02:00
Matej Janežič	f85980190e	feat: prepare initial fortress host	2026-04-10 16:40:55 +02:00
Matej Janežič	8e5557921d	feat: prepare minimal features for fortress	2026-04-10 16:05:34 +02:00
Matej Janežič	216328927d	feat: improve dev-components with --extra	2026-04-09 17:05:33 +02:00
Matej Janežič	86e8fe7397	feat: filedrop via sftp	2026-04-09 13:44:28 +02:00
Matej Janežič	0fa91d4f40	feat: migrate home-manager to 26.05	2026-04-07 13:54:50 +02:00
Matej Janežič	07334db7ee	chore: bump lockfile	2026-04-07 13:54:44 +02:00
Matej Janežič	a08f824d0e	feat: rename steam to gaming and add prismlauncher	2026-04-07 13:28:51 +02:00
Matej Janežič	dd4fc4eff3	feat: switch to unstable channel	2026-04-05 14:43:26 +02:00
Matej Janežič	89e36c5096	chore: bump lockfile	2026-04-02 12:56:34 +02:00
Matej Janežič	c29f4d0624	merge: harmonia	2026-04-02 00:12:30 +02:00
Matej Janežič	cffd90db69	feat: add harmonia and nix-community substituters	2026-04-02 00:12:06 +02:00
Matej Janežič	7faddd053b	feat: add harmonia cache server	2026-04-02 00:11:51 +02:00
Matej Janežič	71cd268f79	feat: restructure dev-components/dev-registry with direnv	2026-04-01 22:50:00 +02:00
Matej Janežič	5a37795151	feat: disable mutableUsers for remote hosts	2026-03-30 01:39:28 +02:00
Matej Janežič	36106c37fd	feat: allow root ssh login for iso	2026-03-30 01:31:16 +02:00
Matej Janežič	3b80f90b99	feat: improve just provison to wait for reboot	2026-03-30 01:29:24 +02:00
Matej Janežič	35d0db6bf0	merge: cube host	2026-03-30 01:29:04 +02:00
Matej Janežič	cba2f63f01	feat: add cube hardware configuration	2026-03-30 01:28:49 +02:00
Matej Janežič	4f901d4367	feat: wire up sops for cube and reencrypt secrets	2026-03-30 01:25:43 +02:00
Matej Janežič	7d18c2713f	feat: prepare initial cube host	2026-03-30 01:22:36 +02:00
Matej Janežič	18105107a6	feat: pregenerate ssh-keys and wire up sops in just provision	2026-03-30 01:22:31 +02:00
Matej Janežič	36630d98a3	feat: add remote-base with default user password via sops	2026-03-30 01:11:50 +02:00
Matej Janežič	27b7b2abf2	feat: add nix store signing for remote deploys	2026-03-30 00:21:37 +02:00
Matej Janežič	29053f4ec2	merge: sops-nix setup	2026-03-29 23:27:42 +02:00
Matej Janežič	b50c574342	feat: add initial sops config	2026-03-29 23:27:19 +02:00
Matej Janežič	666f7f35a6	feat: add sops and ssh-to-age to devshell	2026-03-29 23:12:43 +02:00
Matej Janežič	50533cc737	feat: wire sops into mkHost	2026-03-29 23:12:11 +02:00
Matej Janežič	42c2a1604c	feat: add sops-nix flake input	2026-03-29 23:09:15 +02:00
Matej Janežič	e696417e63	chore: bump lockfile	2026-03-29 20:58:56 +02:00
Matej Janežič	94198293ff	merge: floo host	2026-03-28 00:50:52 +01:00
Matej Janežič	16eb3dcf00	feat: add floo hardware configuration	2026-03-28 00:50:24 +01:00
Matej Janežič	21a757232d	feat: add provision and deploy just recipes	2026-03-28 00:49:57 +01:00
Matej Janežič	99fea4e9db	feat: prepare initial floo host	2026-03-28 00:49:37 +01:00
Matej Janežič	dc2e7bf1aa	feat: add disko input	2026-03-27 23:11:27 +01:00