merge: harden ephvm

.git-blame-ignore-revs

@@ -1,6 +1,8 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+2204b12fadf27886058e6945806ce93a547f5278
+77236af5896524218605badcd3cdfc2267b213da
 
 # host rename
 cfe4c43887a41e52be4e6472474c0fc3788f86e8

features/bootloader.nix

@@ -0,0 +1,73 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+
+        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            boot.loader.efi.canTouchEfiVariables = true;
+            # request the largest framebuffer uefi offers; plymouth inherits it
+            boot.loader.systemd-boot.consoleMode = "max";
+          }
+
+          (lib.mkIf (cfg.mode == "systemd-boot") {
+            boot.loader.systemd-boot.enable = true;
+          })
+
+          (lib.mkIf (cfg.mode == "lanzaboote") {
+            boot.loader.systemd-boot.enable = lib.mkForce false;
+            boot.lanzaboote = {
+              enable = true;
+              pkiBundle = "/var/lib/sbctl";
+            };
+          })
+
+          (lib.mkIf cfg.plymouth.enable {
+            # plymouth needs systemd-initrd to render the luks prompt cleanly
+            boot.initrd.systemd.enable = true;
+
+            # host is responsible for early-KMS so plymouth lands on the gpu driver,
+            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
+            boot.plymouth.enable = true;
+            stylix.targets.plymouth.logoAnimated = false;
+
+            boot.kernelParams = [
+              "quiet"
+              "splash"
+              "loglevel=3"
+              "rd.systemd.show_status=false"
+              "rd.udev.log_level=3"
+              "udev.log_priority=3"
+              "plymouth.force-scale=1"
+            ];
+            boot.consoleLogLevel = 0;
+            boot.initrd.verbose = false;
+          })
+        ]
+      );
+    };
+}

features/calibre.nix

@@ -1,22 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.calibre ];
-
-      # udev rules for kindle and mtp device access
-      # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
-      # because extraRules writes to 99-local.rules which is too late for uaccess
-      # see https://github.com/NixOS/nixpkgs/issues/308681
-      services.udev.packages = [
-        pkgs.libmtp
-        (pkgs.writeTextFile {
-          name = "kindle-udev-rules";
-          text = ''
-            ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
-          '';
-          destination = "/etc/udev/rules.d/70-kindle.rules";
-        })
-      ];
-    };
-}

features/claude.nix

@@ -1,10 +1,28 @@
 {
-  home =
+  nixos =
-    { pkgs, ... }:
+    { lib, ... }:
     {
+      options.features.claude.enable = lib.mkEnableOption "claude";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.claude;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
         home.packages = [
-        pkgs.claude-code
+          packages.claude-code
           pkgs.mcp-nixos
         ];
       };
+    };
 }

features/desktop.nix

@@ -1,59 +1,126 @@
 {
   nixos =
-    { pkgs, inputs, ... }:
     {
-      imports = [ inputs.stylix.nixosModules.stylix ];
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.desktop;
+    in
+    {
+      options.features.desktop = {
+        enable = lib.mkEnableOption "desktop environment";
 
-      # audio
+        audio.enable = lib.mkOption {
-      services.pipewire = {
+          type = lib.types.bool;
-        enable = true;
+          default = true;
-        pulse.enable = true;
         };
 
-      # bluetooth
+        bluetooth.enable = lib.mkOption {
-      hardware.bluetooth.enable = true;
+          type = lib.types.bool;
-      services.blueman.enable = true;
+          default = false;
+        };
 
+        apps.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        theme = {
+          wallpaper = lib.mkOption {
+            type = lib.types.path;
+            default = "${inputs.assets}/wallpaper.png";
+          };
+
+          scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "gruvbox-material-dark-medium";
+          };
+
+          polarity = lib.mkOption {
+            type = lib.types.enum [
+              "dark"
+              "light"
+            ];
+            default = "dark";
+          };
+        };
+
+        internalCA.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          # base desktop
+          {
             security.polkit.enable = true;
             services.dbus.enable = true;
             services.playerctld.enable = true;
 
             xdg.portal = {
               enable = true;
-        xdgOpenUsePortal = true;
+              extraPortals = with pkgs; [
-        extraPortals = [
+                xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-wlr
+                xdg-desktop-portal-gtk
-          pkgs.xdg-desktop-portal-gtk
               ];
             };
 
+            # honor persist_mode so electron apps don't re-prompt for screencast every login
+            systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";
+
+            # enable ozone/wayland for electron apps so idle detection works
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
             fonts.packages = with pkgs; [
               font-awesome
               nerd-fonts.jetbrains-mono
             ];
 
-      # theming
             stylix = {
               enable = true;
-        polarity = "dark";
+              inherit (cfg.theme) polarity;
-        image = "${inputs.assets}/wallpaper.png";
+              image = cfg.theme.wallpaper;
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
+              base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
             };
+          }
 
+          # audio
+          (lib.mkIf cfg.audio.enable {
+            services.pipewire = {
+              enable = true;
+              pulse.enable = true;
+            };
+            environment.systemPackages = with pkgs; [
+              pavucontrol
+              easyeffects
+            ];
+          })
+
+          # bluetooth
+          (lib.mkIf cfg.bluetooth.enable {
+            hardware.bluetooth.enable = true;
+            services.blueman.enable = true;
+          })
+
+          # apps
+          (lib.mkIf cfg.apps.enable {
             programs.thunderbird.enable = true;
-      programs._1password.enable = true;
-      programs._1password-gui.enable = true;
 
             environment.systemPackages = with pkgs; [
-        easyeffects
               ghostty
               google-chrome
               zathura
-        pavucontrol
+              calibre
               bolt-launcher
               libnotify
               bibata-cursors
-        vesktop
+              discord
               rocketchat-desktop
               telegram-desktop
               slack
@@ -65,21 +132,142 @@
               wl-mirror
               protonmail-bridge
               ledger-live-desktop
+              imv
+              yazi
+              nemo
+              file-roller
+              libreoffice-still
             ];
 
+            # kindle udev rules for calibre
+            features.udev.kindle.enable = lib.mkDefault true;
+          })
+
           # internal CA
+          (lib.mkIf cfg.internalCA.enable {
             security.pki.certificateFiles = [
               inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
             ];
-
+          })
-      xdg.mime.defaultApplications = {
+        ]
-        "application/pdf" = "org.pwmt.zathura.desktop";
+      );
-      };
     };
 
   home =
-    { inputs, ... }:
+    {
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.desktop;
+    in
+    {
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
             home.file.".assets".source = inputs.assets;
+          }
+
+          (lib.mkIf cfg.apps.enable {
+            # TODO:(@janezicmatej) consider moving nvim desktop entry to neovim feature
+            xdg.desktopEntries.nvim = {
+              name = "Neovim";
+              exec = "ghostty -e nvim %F";
+              terminal = false;
+              mimeType = [
+                "text/plain"
+                "application/json"
+                "text/markdown"
+              ];
+            };
+
+            xdg.mimeApps = {
+              enable = true;
+              defaultApplications = {
+                # text
+                "text/plain" = "nvim.desktop";
+                "application/json" = "nvim.desktop";
+                "text/markdown" = "nvim.desktop";
+
+                # web
+                "text/html" = "google-chrome.desktop";
+                "application/xhtml+xml" = "google-chrome.desktop";
+                "x-scheme-handler/http" = "google-chrome.desktop";
+                "x-scheme-handler/https" = "google-chrome.desktop";
+                "x-scheme-handler/ftp" = "google-chrome.desktop";
+                "x-scheme-handler/about" = "google-chrome.desktop";
+                "x-scheme-handler/unknown" = "google-chrome.desktop";
+
+                # mail and calendar
+                "x-scheme-handler/mailto" = "thunderbird.desktop";
+                "message/rfc822" = "thunderbird.desktop";
+                "text/calendar" = "thunderbird.desktop";
+
+                # documents
+                "application/pdf" = "org.pwmt.zathura.desktop";
+                "application/postscript" = "org.pwmt.zathura.desktop";
+                "image/vnd.djvu" = "org.pwmt.zathura.desktop";
+                "application/epub+zip" = "org.pwmt.zathura.desktop";
+
+                # office
+                "application/msword" = "libreoffice-writer.desktop";
+                "application/vnd.ms-excel" = "libreoffice-calc.desktop";
+                "application/vnd.ms-powerpoint" = "libreoffice-impress.desktop";
+                "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
+                  "libreoffice-writer.desktop";
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = "libreoffice-calc.desktop";
+                "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
+                  "libreoffice-impress.desktop";
+                "application/vnd.oasis.opendocument.text" = "libreoffice-writer.desktop";
+                "application/vnd.oasis.opendocument.spreadsheet" = "libreoffice-calc.desktop";
+                "application/vnd.oasis.opendocument.presentation" = "libreoffice-impress.desktop";
+                "text/csv" = "libreoffice-calc.desktop";
+
+                # images
+                "image/png" = "imv-dir.desktop";
+                "image/jpeg" = "imv-dir.desktop";
+                "image/gif" = "imv-dir.desktop";
+                "image/webp" = "imv-dir.desktop";
+                "image/tiff" = "imv-dir.desktop";
+                "image/bmp" = "imv-dir.desktop";
+                "image/svg+xml" = "google-chrome.desktop";
+
+                # video
+                "video/mp4" = "mpv.desktop";
+                "video/x-matroska" = "mpv.desktop";
+                "video/webm" = "mpv.desktop";
+                "video/quicktime" = "mpv.desktop";
+                "video/x-msvideo" = "mpv.desktop";
+
+                # audio
+                "audio/mpeg" = "mpv.desktop";
+                "audio/flac" = "mpv.desktop";
+                "audio/ogg" = "mpv.desktop";
+                "audio/wav" = "mpv.desktop";
+                "audio/aac" = "mpv.desktop";
+
+                # archives
+                "application/zip" = "org.gnome.FileRoller.desktop";
+                "application/x-tar" = "org.gnome.FileRoller.desktop";
+                "application/gzip" = "org.gnome.FileRoller.desktop";
+                "application/x-rar-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-bzip2" = "org.gnome.FileRoller.desktop";
+                "application/x-xz" = "org.gnome.FileRoller.desktop";
+
+                # file manager
+                "inode/directory" = "nemo.desktop";
+
+                # app deep links
+                "x-scheme-handler/tg" = "org.telegram.desktop.desktop";
+                "x-scheme-handler/discord" = "discord.desktop";
+                "x-scheme-handler/slack" = "slack.desktop";
+              };
+            };
+          })
+        ]
+      );
     };
 }

features/dev.nix

@@ -1,25 +1,36 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.dev.enable = lib.mkEnableOption "development tools";
+    };
+
   home =
-    { pkgs, inputs, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
     let
+      cfg = osConfig.features.dev;
       packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
     in
     {
+      config = lib.mkIf cfg.enable {
         home.packages = [
-        pkgs.git
-        packages.git-linearize
-        packages.ggman
           pkgs.python3
-        pkgs.mdbook
+          pkgs.osc
-        pkgs.marksman
+
-        pkgs.mdformat
           pkgs.google-cloud-sdk
           pkgs.google-cloud-sql-proxy
+
           packages.ahab
           pkgs.just
           pkgs.presenterm
-        pkgs.osc
+          pkgs.qemu
         ];
-
+      };
     };
 }

features/direnv/default.nix

@@ -1,7 +1,18 @@
 {
   nixos =
-    { inputs, ... }:
     {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
+    let
+      cfg = config.features.direnv;
+    in
+    {
+      options.features.direnv.enable = lib.mkEnableOption "direnv";
+
+      config = lib.mkIf cfg.enable {
         nix.registry.dev = {
           from = {
             type = "indirect";
@@ -13,8 +24,15 @@
           };
         };
       };
+    };
 
-  home = _: {
+  home =
+    { lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.direnv;
+    in
+    {
+      config = lib.mkIf cfg.enable {
         programs.direnv = {
           enable = true;
           nix-direnv.enable = true;
@@ -23,4 +41,5 @@
 
         xdg.configFile."direnv/lib/use_dev.sh".source = ./use_dev.sh;
       };
+    };
 }

features/direnv/use_dev.sh

@@ -1,16 +1,28 @@
 # shellcheck shell=bash
 # composable nix devshell from matej.nix
-# usage in .envrc: use dev uv_14 pg_18
+# usage in .envrc: use dev uv_14 pg_18 --extra cairo pkg-config
 
 # generates a flake and delegates to use_flake at the calling scope
 use_dev() {
-	local nix_list=""
+	local nix_list="" extra_list="" in_extra=0
 	for c in "$@"; do
+		if [[ "$c" == "--extra" ]]; then
+			in_extra=1
+			continue
+		fi
+		if [[ $in_extra -eq 1 ]]; then
+			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_-]*$ ]]; then
+				log_error "use_dev: invalid package name: $c"
+				return 1
+			fi
+			extra_list="$extra_list pkgs.$c"
+		else
 			if [[ ! "$c" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
 				log_error "use_dev: invalid component name: $c"
 				return 1
 			fi
 			nix_list="$nix_list \"$c\""
+		fi
 	done
 
 	local system
@@ -64,7 +76,7 @@ use_dev() {
       pkgs = nixpkgs.legacyPackages.\${system};
       devLib = import "\${dev}/flake/dev-components.nix" { inherit pkgs; lib = nixpkgs.lib; };
     in {
-      devShells.\${system}.default = devLib.mkComponentShell [$nix_list ];
+      devShells.\${system}.default = devLib.mkComponentShell [$nix_list ] [${extra_list} ];
     };
 }
 DEVFLAKE

features/docker.nix

@@ -1,7 +1,18 @@
 {
   nixos =
-    { user, ... }:
     {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.docker;
+    in
+    {
+      options.features.docker.enable = lib.mkEnableOption "docker";
+
+      config = lib.mkIf cfg.enable {
         virtualisation.docker = {
           enable = true;
           logDriver = "json-file";
@@ -9,4 +20,5 @@
 
         users.users.${user}.extraGroups = [ "docker" ];
       };
+    };
 }

features/filedrop.nix

@@ -0,0 +1,61 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      userKeys,
+      ...
+    }:
+    let
+      cfg = config.features.filedrop;
+    in
+    {
+      options.features.filedrop = {
+        enable = lib.mkEnableOption "filedrop sftp service";
+
+        sopsFile = lib.mkOption {
+          type = lib.types.path;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        sops.secrets.filedrop-authorized-keys = {
+          inherit (cfg) sopsFile;
+          mode = "0444";
+        };
+
+        users.groups.filedrop = {
+          members = [ "matej" ];
+        };
+
+        users.users.filedrop = {
+          isSystemUser = true;
+          group = "filedrop";
+          home = "/home/filedrop";
+          shell = "/run/current-system/sw/bin/nologin";
+          openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
+        };
+
+        # chroot dir must be root-owned; incoming is writable by filedrop
+        systemd.tmpfiles.rules = [
+          "d /home/filedrop 0755 root root -"
+          "d /home/filedrop/incoming 2775 filedrop filedrop -"
+          "a+ /home/filedrop/incoming - - - - group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:group:filedrop:rwx"
+          "a+ /home/filedrop/incoming - - - - default:mask::rwx"
+          "L /home/matej/filedrop - - - - /home/filedrop/incoming"
+        ];
+
+        # relaxed umask so default acl takes full effect
+        services.openssh.extraConfig = ''
+          Match User filedrop
+            ForceCommand internal-sftp -u 0002
+            ChrootDirectory /home/filedrop
+            AuthorizedKeysFile /etc/ssh/authorized_keys.d/filedrop %h/.ssh/authorized_keys ${config.sops.secrets.filedrop-authorized-keys.path}
+            AllowTcpForwarding no
+            X11Forwarding no
+        '';
+      };
+    };
+}

features/gaming.nix

@@ -0,0 +1,26 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gaming;
+    in
+    {
+      options.features.gaming.enable = lib.mkEnableOption "gaming";
+
+      config = lib.mkIf cfg.enable {
+        programs.steam = {
+          enable = true;
+          remotePlay.openFirewall = true;
+          dedicatedServer.openFirewall = true;
+          localNetworkGameTransfers.openFirewall = true;
+        };
+
+        environment.systemPackages = [ pkgs.prismlauncher ];
+      };
+    };
+}

features/git.nix

@@ -0,0 +1,29 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.git.enable = lib.mkEnableOption "git";
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.git;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.git
+          packages.git-linearize
+          packages.ggman
+        ];
+      };
+    };
+}

features/gnupg.nix

@@ -1,9 +1,43 @@
 {
-  nixos = _: {
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.gnupg;
+    in
+    {
+      options.features.gnupg = {
+        enable = lib.mkEnableOption "gnupg";
+
+        yubikey.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
             programs.gnupg.agent = {
               enable = true;
               enableSSHSupport = true;
               enableExtraSocket = true;
             };
+          }
+
+          (lib.mkIf cfg.yubikey.enable {
+            environment.systemPackages = with pkgs; [
+              yubikey-personalization
+              yubikey-manager
+            ];
+
+            services.pcscd.enable = true;
+          })
+        ]
+      );
     };
 }

features/greeter.nix

@@ -1,28 +0,0 @@
-{
-  nixos =
-    { lib, inputs, ... }:
-    {
-      programs.regreet = {
-        enable = true;
-        # single output to avoid stretching across monitors
-        cageArgs = [
-          "-s"
-          "-m"
-          "last"
-        ];
-        font = {
-          name = lib.mkForce "JetBrainsMono Nerd Font";
-          size = lib.mkForce 14;
-        };
-        settings = {
-          background = {
-            path = lib.mkForce "${inputs.assets}/wallpaper.png";
-            fit = lib.mkForce "Cover";
-          };
-          GTK = {
-            application_prefer_dark_theme = lib.mkForce true;
-          };
-        };
-      };
-    };
-}

features/harmonia/default.nix

@@ -1,12 +1,14 @@
 {
   nixos =
     {
-      pkgs,
       config,
+      lib,
+      pkgs,
       inputs,
       ...
     }:
     let
+      cfg = config.features.harmonia;
       hosts = [
         "fw16"
         "tower"
@@ -17,7 +19,10 @@
       flakeRef = inputs.self.outPath;
     in
     {
-      services.harmonia = {
+      options.features.harmonia.enable = lib.mkEnableOption "harmonia";
+
+      config = lib.mkIf cfg.enable {
+        services.harmonia.cache = {
           enable = true;
           signKeyPaths = [ config.sops.secrets.nix-signing-key.path ];
         };
@@ -38,14 +43,10 @@
           path = [ config.nix.package ];
         };
 
-      systemd.timers.cache-builder = {
+        # restart cache-builder after every nixos switch (non-blocking)
-        description = "Periodically build all host closures";
+        system.activationScripts.cache-builder = lib.stringAfter [ "specialfs" ] ''
-        wantedBy = [ "timers.target" ];
+          ${config.systemd.package}/bin/systemctl restart --no-block cache-builder.service || true
-        timerConfig = {
+        '';
-          OnUnitActiveSec = "15min";
-          OnBootSec = "5min";
-          Persistent = true;
-        };
       };
     };
 }

features/initrd-ssh.nix

@@ -2,6 +2,7 @@
   nixos =
     { lib, config, ... }:
     let
+      cfg = config.features.initrd-ssh;
       keyDir = "/etc/secrets/initrd";
 
       mkIpString =
@@ -15,8 +16,9 @@
         "${address}::${gateway}:${netmask}::${interface}:none";
     in
     {
-      options = {
+      options.features.initrd-ssh = {
-        initrd-ssh = {
+        enable = lib.mkEnableOption "initrd ssh";
+
         ip = {
           enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
 
@@ -47,14 +49,19 @@
           type = lib.types.str;
         };
       };
-      };
 
-      config = {
+      config = lib.mkIf cfg.enable {
-        boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
+        boot.initrd.availableKernelModules = [ cfg.networkModule ];
-        boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
+        boot.initrd.kernelModules = [ cfg.networkModule ];
-          "ip=${mkIpString config.initrd-ssh.ip}"
+        boot.kernelParams = lib.mkIf cfg.ip.enable [
+          "ip=${mkIpString cfg.ip}"
         ];
 
+        boot.initrd.systemd.enable = true;
+
+        # remote unlock may take a while; don't let device units give up
+        boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
+
         boot.initrd.network = {
           enable = true;
           ssh = {
@@ -64,12 +71,20 @@
               "${keyDir}/ssh_host_rsa_key"
               "${keyDir}/ssh_host_ed25519_key"
             ];
-            inherit (config.initrd-ssh) authorizedKeys;
+            inherit (cfg) authorizedKeys;
           };
-          postCommands = ''
-            echo 'cryptsetup-askpass' >> /root/.profile
-          '';
         };
+
+        # systemd-networkd retries DHCP indefinitely, unlike udhcpc
+        boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
+          "10-initrd" = {
+            matchConfig.Driver = cfg.networkModule;
+            networkConfig.DHCP = "yes";
+          };
+        };
+
+        # forward LUKS password prompt to the SSH session
+        boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
       };
     };
 }

features/localisation.nix

@@ -1,25 +1,30 @@
 {
   nixos =
     { lib, config, ... }:
+    let
+      cfg = config.features.localisation;
+    in
     {
-      options = {
+      options.features.localisation = {
-        localisation = {
+        enable = lib.mkEnableOption "localisation";
+
         timeZone = lib.mkOption {
           type = lib.types.str;
+          default = "Europe/Ljubljana";
         };
 
         defaultLocale = lib.mkOption {
           type = lib.types.str;
-          };
+          default = "en_US.UTF-8";
         };
       };
 
-      config = {
+      config = lib.mkIf cfg.enable {
-        time.timeZone = config.localisation.timeZone;
+        time.timeZone = cfg.timeZone;
-        i18n.defaultLocale = config.localisation.defaultLocale;
+        i18n.defaultLocale = cfg.defaultLocale;
 
         # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
-        environment.variables.TZ = config.localisation.timeZone;
+        environment.variables.TZ = cfg.timeZone;
       };
     };
 }

features/neovim.nix

@@ -1,4 +1,17 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.neovim = {
+        enable = lib.mkEnableOption "neovim";
+
+        dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+    };
+
   home =
     {
       config,
@@ -6,28 +19,27 @@
       lib,
       pkgs,
       inputs,
+      osConfig,
       ...
     }:
+    let
+      cfg = osConfig.features.neovim;
+    in
     {
-      options = {
+      config = lib.mkIf cfg.enable (
-        neovim.dotfiles = lib.mkOption {
+        lib.mkMerge [
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-        };
-      };
-
-      config = lib.mkMerge [
           (lib.optionalAttrs (options ? stylix) {
-          # disable stylix neovim target when stylix is present (loaded by desktop feature)
+            # disable stylix neovim target when stylix is present
             stylix.targets.neovim.enable = false;
           })
           {
-          xdg.configFile."nvim" = lib.mkIf (config.neovim.dotfiles != null) {
+            xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
-            source = config.neovim.dotfiles;
+              source = cfg.dotfiles;
             };
 
             programs.neovim = {
               enable = true;
+              sideloadInitLua = true;
               vimAlias = true;
               defaultEditor = true;
               package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
@@ -64,6 +76,7 @@
               ];
             };
           }
-      ];
+        ]
+      );
     };
 }

features/networkmanager.nix

@@ -1,9 +1,18 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.networkmanager;
+    in
+    {
+      options.features.networkmanager.enable = lib.mkEnableOption "networkmanager";
+
+      config = lib.mkIf cfg.enable {
         networking.networkmanager.enable = true;
         networking.nameservers = [
           "1.1.1.1"
           "8.8.8.8"
         ];
       };
+    };
 }

features/nix-ld.nix

@@ -1,5 +1,14 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-ld;
+    in
+    {
+      options.features.nix-ld.enable = lib.mkEnableOption "nix-ld";
+
+      config = lib.mkIf cfg.enable {
         programs.nix-ld.enable = true;
       };
+    };
 }

features/nix-settings.nix

@@ -0,0 +1,71 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-settings;
+    in
+    {
+      options.features.nix-settings = {
+        enable = lib.mkEnableOption "nix settings";
+
+        towerCache.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+
+        gc = {
+          dates = lib.mkOption {
+            type = lib.types.str;
+            default = "monthly";
+          };
+
+          olderThan = lib.mkOption {
+            type = lib.types.str;
+            default = "30d";
+          };
+        };
+
+        optimise.dates = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "monthly" ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        nix = {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            download-attempts = 3;
+            fallback = true;
+            warn-dirty = false;
+            substituters = [
+              "https://cache.nixos.org"
+              "https://nix-community.cachix.org?priority=45"
+            ]
+            ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys = [
+              "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+              "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+            ]
+            ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+          };
+
+          gc = {
+            automatic = true;
+            inherit (cfg.gc) dates;
+            options = "--delete-older-than ${cfg.gc.olderThan}";
+          };
+
+          optimise = {
+            automatic = true;
+            inherit (cfg.optimise) dates;
+          };
+        };
+      };
+    };
+}

features/onepassword.nix

@@ -0,0 +1,23 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}

features/openssh.nix

@@ -1,18 +1,23 @@
 {
   nixos =
     { lib, config, ... }:
+    let
+      cfg = config.features.openssh;
+    in
     {
-      options = {
+      options.features.openssh = {
-        openssh.port = lib.mkOption {
+        enable = lib.mkEnableOption "openssh";
+
+        port = lib.mkOption {
           type = lib.types.port;
           default = 22;
         };
       };
 
-      config = {
+      config = lib.mkIf cfg.enable {
         services.openssh = {
           enable = true;
-          ports = [ config.openssh.port ];
+          ports = [ cfg.port ];
           settings = {
             PasswordAuthentication = false;
             AllowUsers = null;

features/power.nix

@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}

features/printing.nix

@@ -1,5 +1,13 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.printing;
+    in
+    {
+      options.features.printing.enable = lib.mkEnableOption "printing";
+
+      config = lib.mkIf cfg.enable {
         services.printing.enable = true;
         services.avahi = {
           enable = true;
@@ -7,4 +15,5 @@
           openFirewall = true;
         };
       };
+    };
 }

features/remote-base.nix

@@ -1,7 +1,18 @@
 {
   nixos =
-    { config, user, ... }:
     {
+      config,
+      lib,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.remote-base;
+    in
+    {
+      options.features.remote-base.enable = lib.mkEnableOption "remote-base";
+
+      config = lib.mkIf cfg.enable {
         sops.secrets.user-password = {
           sopsFile = ../secrets/common.yaml;
           neededForUsers = true;
@@ -10,4 +21,5 @@
         users.mutableUsers = false;
         users.users.${user}.hashedPasswordFile = config.sops.secrets.user-password.path;
       };
+    };
 }

features/shell.nix

@@ -1,16 +1,23 @@
 {
-  nixos = _: {
+  nixos =
-    programs.zsh.enable = true;
+    { lib, ... }:
-    environment.etc."zshenv".text = ''
+    {
-      export ZDOTDIR=$HOME/.config/zsh
+      options.features.shell.enable = lib.mkEnableOption "shell extras";
-    '';
     };
 
   home =
-    { pkgs, ... }:
     {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.shell;
+    in
+    {
+      config = lib.mkIf cfg.enable {
         home.packages = with pkgs; [
-        starship
           fzf
           htop
           jc
@@ -22,4 +29,5 @@
           tmux
         ];
       };
+    };
 }

features/steam.nix

@@ -1,10 +0,0 @@
-{
-  nixos = _: {
-    programs.steam = {
-      enable = true;
-      remotePlay.openFirewall = true;
-      dedicatedServer.openFirewall = true;
-      localNetworkGameTransfers.openFirewall = true;
-    };
-  };
-}

features/sway.nix

@@ -1,7 +1,39 @@
 {
   nixos =
-    { pkgs, ... }:
     {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
+    {
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            # soft dependency
+            features.desktop.enable = lib.mkDefault true;
+
+            # hard dependency
+            assertions = [
+              {
+                assertion = desktopCfg.enable;
+                message = "features.sway requires features.desktop";
+              }
+            ];
+
             programs.sway = {
               enable = true;
               package = pkgs.swayfx;
@@ -9,6 +41,8 @@
               extraSessionCommands = ''
                 # fix for java awt apps not rendering
                 export _JAVA_AWT_WM_NONREPARENTING=1
+                # propagate XDG_DATA_DIRS to dbus/systemd for d-bus activated apps
+                dbus-update-activation-environment --systemd XDG_DATA_DIRS
               '';
             };
 
@@ -34,5 +68,33 @@
               cliphist
               zenity
             ];
+          }
+
+          # greeter
+          (lib.mkIf cfg.greeter.enable {
+            programs.regreet = {
+              enable = true;
+              cageArgs = [
+                "-s"
+                "-m"
+                "last"
+              ];
+              font = {
+                name = lib.mkForce "JetBrainsMono Nerd Font";
+                size = lib.mkForce 14;
+              };
+              settings = {
+                background = {
+                  path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                  fit = lib.mkForce "Cover";
+                };
+                GTK = {
+                  application_prefer_dark_theme = lib.mkForce true;
+                };
+              };
+            };
+          })
+        ]
+      );
     };
 }

features/tailscale.nix

@@ -1,8 +1,17 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.tailscale;
+    in
+    {
+      options.features.tailscale.enable = lib.mkEnableOption "tailscale";
+
+      config = lib.mkIf cfg.enable {
         services.tailscale = {
           enable = true;
           useRoutingFeatures = "both";
         };
       };
+    };
 }

features/udev.nix

@@ -0,0 +1,59 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.mkIf cfg.kindle.enable {
+            # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+            # because extraRules writes to 99-local.rules which is too late for uaccess
+            services.udev.packages = [
+              pkgs.libmtp
+              (pkgs.writeTextFile {
+                name = "kindle-udev-rules";
+                text = ''
+                  ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+                '';
+                destination = "/etc/udev/rules.d/70-kindle.rules";
+              })
+            ];
+          })
+
+          (lib.mkIf cfg.ledger.enable {
+            hardware.ledger.enable = true;
+          })
+
+          (lib.mkIf cfg.keyboard-zsa.enable {
+            hardware.keyboard.zsa.enable = true;
+          })
+        ]
+      );
+    };
+}

features/user-matej.nix

@@ -9,16 +9,11 @@ in
     sshAuthorizedKeys = sshKeys;
   };
 
-  nixos =
+  nixos = _: {
-    { pkgs, ... }:
-    {
-      programs.zsh.enable = true;
-
     users.users.matej = {
       uid = 1000;
       isNormalUser = true;
       home = "/home/matej";
-        shell = pkgs.zsh;
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keys = sshKeys;
     };
@@ -30,6 +25,6 @@ in
   };
 
   home = _: {
-    home.stateVersion = "24.11";
+    home.stateVersion = "26.05";
   };
 }

features/vm-9p-automount.nix

@@ -1,72 +0,0 @@
-{
-  nixos =
-    {
-      pkgs,
-      lib,
-      config,
-      ...
-    }:
-    let
-      inherit (config.vm-9p-automount) user;
-      inherit (config.users.users.${user}) home group;
-    in
-    {
-      options = {
-        vm-9p-automount = {
-          user = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          prefix = lib.mkOption {
-            type = lib.types.str;
-            default = "m_";
-          };
-
-          basePath = lib.mkOption {
-            type = lib.types.str;
-            default = "${home}/mnt";
-          };
-        };
-      };
-
-      config = {
-        systemd.services.vm-9p-automount = {
-          description = "Auto-discover and mount 9p shares";
-          after = [
-            "local-fs.target"
-            "nss-user-lookup.target"
-            "systemd-modules-load.service"
-          ];
-          wants = [ "systemd-modules-load.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-              BASE="${config.vm-9p-automount.basePath}"
-              PREFIX="${config.vm-9p-automount.prefix}"
-              mkdir -p "$BASE"
-              chown ${user}:${group} "$BASE"
-
-              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                [ -f "$tagfile" ] || continue
-                tag=$(tr -d '\0' < "$tagfile")
-
-                case "$tag" in
-                  "$PREFIX"*) ;;
-                  *) continue ;;
-                esac
-
-                name="''${tag#"$PREFIX"}"
-                target="$BASE/$name"
-
-                mkdir -p "$target"
-                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                  -o trans=virtio,version=9p2000.L || continue
-              done
-            '';
-          };
-        };
-      };
-    };
-}

features/vm-guest.nix

@@ -6,28 +6,52 @@
       config,
       ...
     }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
     {
-      options = {
+      options.features.vm-guest = {
-        vm-guest.headless = lib.mkOption {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
           type = lib.types.bool;
           default = false;
         };
+
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";
+
+          user = lib.mkOption {
+            type = lib.types.str;
           };
 
-      config = {
+          prefix = lib.mkOption {
-        services.qemuGuest.enable = true;
+            type = lib.types.str;
-        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+            default = "m_";
+          };
 
-        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
+        };
+      };
 
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+            boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
+
+            # 9p autoloads on first mount
             boot.initrd.availableKernelModules = [
               "9p"
               "9pnet_virtio"
             ];
-        boot.kernelModules = [
-          "9p"
-          "9pnet_virtio"
-        ];
 
             networking = {
               useDHCP = true;
@@ -40,8 +64,49 @@
               curl
               wget
               htop
-          sshfs
             ];
+          }
+
+          (lib.mkIf cfg.automount.enable {
+            systemd.services.vm-9p-automount = {
+              description = "Auto-discover and mount 9p shares";
+              after = [
+                "local-fs.target"
+                "nss-user-lookup.target"
+                "systemd-modules-load.service"
+              ];
+              wants = [ "systemd-modules-load.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                  BASE="${cfg.automount.basePath}"
+                  PREFIX="${cfg.automount.prefix}"
+                  mkdir -p "$BASE"
+                  chown ${autoUser}:${autoGroup} "$BASE"
+
+                  for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                    [ -f "$tagfile" ] || continue
+                    tag=$(tr -d '\0' < "$tagfile")
+
+                    case "$tag" in
+                      "$PREFIX"*) ;;
+                      *) continue ;;
+                    esac
+
+                    name="''${tag#"$PREFIX"}"
+                    target="$BASE/$name"
+
+                    mkdir -p "$target"
+                    ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                      -o trans=virtio,version=9p2000.L || continue
+                  done
+                '';
               };
             };
+          })
+        ]
+      );
+    };
 }

features/yubikey.nix

@@ -1,12 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        yubikey-personalization
-        yubikey-manager
-      ];
-
-      services.pcscd.enable = true;
-    };
-}

features/zsh.nix

@@ -0,0 +1,55 @@
+{
+  nixos =
+    {
+      config,
+      lib,
+      pkgs,
+      user,
+      ...
+    }:
+    let
+      cfg = config.features.zsh;
+    in
+    {
+      options.features.zsh = {
+        enable = lib.mkEnableOption "zsh";
+
+        loginShell.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.zsh.enable = true;
+            environment.etc."zshenv".text = ''
+              export ZDOTDIR=$HOME/.config/zsh
+            '';
+          }
+
+          (lib.mkIf cfg.loginShell.enable {
+            users.users.${user}.shell = pkgs.zsh;
+          })
+        ]
+      );
+    };
+
+  home =
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
+    let
+      cfg = osConfig.features.zsh;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [ pkgs.starship ];
+      };
+    };
+}

flake.lock

@@ -106,11 +106,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773889306,
+        "lastModified": 1776613567,
-        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764873433,
+        "lastModified": 1775176642,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -156,11 +156,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1775087534,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1775087534,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767609335,
+        "lastModified": 1775087534,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -252,20 +252,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -275,16 +273,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1774559029,
+        "lastModified": 1776777932,
-        "narHash": "sha256-deix7yg3j6AhjMPnFDCmWB3f83LsajaaULP5HH2j34k=",
+        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a0bb0d11514f92b639514220114ac8063c72d0a3",
+        "rev": "5d5640599a0050b994330328b9fd45709c909720",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -320,11 +317,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1774742707,
+        "lastModified": 1776729909,
-        "narHash": "sha256-a3FjZJxDOn0t18VwtIAgpNuUNaIEl6T+Awu5tXifQQw=",
+        "narHash": "sha256-wGu/N42PJqrj8ju9GoXdppg4rwaKzZqdAjsgxJbCvfY=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "7966a9c203276bea3b7e8dd2e125fd2b4c8b6753",
+        "rev": "ff21a18bde28b4c8ca0bc1f9a5b7186a1b89a3d1",
         "type": "github"
       },
       "original": {
@@ -336,11 +333,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1774725909,
+        "lastModified": 1776727374,
-        "narHash": "sha256-aOiiQCmjCrvo+jAUDO2oMa377FvOtU97aqvTm74ZRGU=",
+        "narHash": "sha256-iP5SviNXW5W+ay4ZmwjDFsfQjfM+fYlUxRlLPHjpwWI=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "d5516daf121aa718e79bcd423ee24c24492893c0",
+        "rev": "901b3f0c394a53961781ebeee682e64ad690a242",
         "type": "github"
       },
       "original": {
@@ -351,11 +348,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774777275,
+        "lastModified": 1775490113,
-        "narHash": "sha256-qogBiYFq8hZusDPeeKRqzelBAhZvREc7Cl+qlewGUCg=",
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b8f81636927f1af0cca812d22c876bad0a883ccd",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -367,11 +364,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1774610258,
+        "lastModified": 1776329215,
-        "narHash": "sha256-HaThtroVD9wRdx7KQk0B75JmFcXlMUoEdDFNOMOlsOs=",
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "832efc09b4caf6b4569fbf9dc01bec3082a00611",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
@@ -383,11 +380,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1772328832,
+        "lastModified": 1774748309,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
         "type": "github"
       },
       "original": {
@@ -398,11 +395,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1774809814,
+        "lastModified": 1776807375,
-        "narHash": "sha256-Whds0FmLqkMftqIWMjugfP07WwBepbo09xkOxRmHi+U=",
+        "narHash": "sha256-LDnHG0T54OEHyRydmGUlAND8ham0KrRNWjgoS+6GUd4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e75351d88d980df26a421789003f5d5c46c3f693",
+        "rev": "553ecb1686a2edb75dee44c9f72e1674e6adc26a",
         "type": "github"
       },
       "original": {
@@ -412,34 +409,34 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1774701658,
+        "lastModified": 1776560675,
-        "narHash": "sha256-CIS/4AMUSwUyC8X5g+5JsMRvIUL3YUfewe8K4VrbsSQ=",
+        "narHash": "sha256-p68udKWWh7+V4ZPpcMDq0gTHWNZJnr4JPI+kHPPE40o=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b63fe7f000adcfa269967eeff72c64cafecbbebe",
+        "rev": "e07580dae39738e46609eaab8b154de2488133ce",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1774388614,
+        "lastModified": 1776548001,
-        "narHash": "sha256-tFwzTI0DdDzovdE9+Ras6CUss0yn8P9XV4Ja6RjA+nU=",
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1073dad219cb244572b74da2b20c7fe39cb3fa9e",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -456,11 +453,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767886815,
+        "lastModified": 1775228139,
-        "narHash": "sha256-pB2BBv6X9cVGydEV/9Y8+uGCvuYJAlsprs1v1QHjccA=",
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4ff84374d77ff62e2e13a46c33bfeb73590f9fef",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -519,7 +516,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-master": "nixpkgs-master",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs-stable": "nixpkgs-stable",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -553,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774760784,
+        "lastModified": 1776771786,
-        "narHash": "sha256-D+tgywBHldTc0klWCIC49+6Zlp57Y4GGwxP1CqfxZrY=",
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8adb84861fe70e131d44e1e33c426a51e2e0bfa5",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
         "type": "github"
       },
       "original": {
@@ -580,23 +577,21 @@
         ],
         "nur": "nur",
         "systems": "systems",
-        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1774194089,
+        "lastModified": 1776170745,
-        "narHash": "sha256-SCczWhr8y8aaXVHG+gOGcRahNb0BU1Z5zYZuv9W/nA8=",
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "7c34241d80ea64dd2039bb3a786fb66b4c6261d9",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
         "type": "github"
       },
       "original": {
         "owner": "danth",
-        "ref": "release-25.11",
         "repo": "stylix",
         "type": "github"
       }
@@ -616,23 +611,6 @@
         "type": "github"
       }
     },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -652,11 +630,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1767817087,
+        "lastModified": 1772661346,
-        "narHash": "sha256-eGE8OYoK6HzhJt/7bOiNV2cx01IdIrHL7gXgjkHRdNo=",
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "bd99656235aab343e3d597bf196df9bc67429507",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -668,11 +646,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1767489635,
+        "lastModified": 1772934010,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -684,11 +662,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1767488740,
+        "lastModified": 1772909925,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,8 +2,8 @@
   description = "matej's nix setup";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
     nvim = {
@@ -16,12 +16,12 @@
     flake-parts.url = "github:hercules-ci/flake-parts";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     stylix = {
-      url = "github:danth/stylix/release-25.11";
+      url = "github:danth/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

flake/dev-components.nix

@@ -8,6 +8,7 @@ let
     pkgs.zlib
     pkgs.openssl
     pkgs.curl
+    pkgs.libffi
   ];
 
   mkNode = nodejs: {
@@ -24,12 +25,12 @@ let
     packages = [
       python
       pkgs.uv
+      pkgs.pkg-config
     ];
     libraries = pythonLibraries;
     env = {
       UV_PYTHON_DOWNLOADS = "never";
       UV_PYTHON_PREFERENCE = "only-system";
-      UV_PYTHON = "${python}/bin/python";
     };
     shellHook = ''
       unset PYTHONPATH
@@ -44,27 +45,10 @@ let
     uv_13 = mkUv pkgs.python313;
     uv_14 = mkUv pkgs.python314;
 
-    pg_15 = {
-      packages = [ pkgs.postgresql_15 ];
-    };
-    pg_16 = {
-      packages = [ pkgs.postgresql_16 ];
-    };
-    pg_17 = {
-      packages = [ pkgs.postgresql_17 ];
-    };
-    pg_18 = {
-      packages = [ pkgs.postgresql_18 ];
-    };
-
     node_20 = mkNode pkgs.nodejs_20;
     node_22 = mkNode pkgs.nodejs_22;
     node_24 = mkNode pkgs.nodejs_24;
 
-    go = {
-      packages = [ pkgs.go ];
-    };
-
     rust = {
       packages = [
         pkgs.rustc
@@ -75,20 +59,14 @@ let
       ];
     };
 
-    cmake = {
-      packages = [
-        pkgs.cmake
-        pkgs.ninja
-      ];
-    };
   };
 
   # build a single mkShell from one or more component names
   mkComponentShell =
-    names:
+    names: extraPackages:
     let
       selected = map (n: components.${n}) names;
-      allPackages = lib.concatMap (c: c.packages or [ ]) selected;
+      allPackages = lib.concatMap (c: c.packages or [ ]) selected ++ extraPackages;
       allLibraries = lib.concatMap (c: c.libraries or [ ]) selected;
       allHooks = lib.concatMapStrings (c: c.shellHook or "") selected;
       allEnvs = lib.foldl' (acc: c: acc // (c.env or { })) { } selected;

flake/hosts.nix

@@ -15,25 +15,29 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "steam"
-        "direnv"
-        "neovim"
-        "dev"
         "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "power"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -41,27 +45,30 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "steam"
-        "initrd-ssh"
-        "direnv"
-        "neovim"
-        "dev"
         "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
         "harmonia"
+        "initrd-ssh"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -70,7 +77,9 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
+        "nix-settings"
         "openssh"
+        "zsh"
       ];
     };
 
@@ -78,11 +87,14 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
         "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
         "shell"
         "tailscale"
-        "remote-base"
+        "zsh"
       ];
     };
 
@@ -91,11 +103,30 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "filedrop"
         "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
         "shell"
         "tailscale"
-        "remote-base"
+        "zsh"
+      ];
+    };
+
+    fortress = mkHost "fortress" {
+      system = "x86_64-linux";
+      user = "matej";
+      features = [
+        "bootloader"
+        "desktop"
+        "gnupg"
+        "localisation"
+        "networkmanager"
+        "nix-settings"
+        "sway"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -103,16 +134,18 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "vm-guest"
-        "vm-9p-automount"
-        "docker"
-        "neovim"
         "claude"
         "dev"
+        "docker"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "nix-settings"
+        "openssh"
+        "shell"
+        "vm-guest"
+        "zsh"
       ];
     };
   };

flake/overlays.nix

@@ -1,21 +1,5 @@
-{ inputs, ... }:
+_:
 
 {
-  flake.overlays.default =
+  flake.overlays.default = _: _: { };
-    _: prev:
-    let
-      pkgs-unstable = import inputs.nixpkgs-unstable {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-      pkgs-master = import inputs.nixpkgs-master {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-    in
-    {
-      inherit (pkgs-master) claude-code;
-      # TODO:(@janezicmatej) 2026-03-09 error with stable for telegram-desktop
-      inherit (pkgs-unstable) telegram-desktop;
-    };
 }

flake/packages.nix

@@ -15,7 +15,6 @@ in
           }
           {
             inherit pkgs;
-            pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
             pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
           };
     };

hosts/cube/configuration.nix

@@ -2,9 +2,6 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   disko.devices.disk.main = {
     type = "disk";
     device = "/dev/nvme0n1";
@@ -32,10 +29,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/ephvm/configuration.nix

@@ -5,6 +5,7 @@
   ...
 }:
 {
+  features.nix-settings.towerCache.enable = false;
   # no hardware firmware needed in a VM
   hardware.enableRedistributableFirmware = lib.mkForce false;
   hardware.wirelessRegulatoryDatabase = lib.mkForce false;
@@ -12,37 +13,93 @@
   documentation.enable = false;
   environment.defaultPackages = [ ];
 
-  # compressed qcow2, no channel copy
+  # qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
+  # (~half the size of zlib v2, faster decompress)
   image.modules.qemu =
     { config, modulesPath, ... }:
     {
       system.build.image = lib.mkForce (
-        import (modulesPath + "/../lib/make-disk-image.nix") {
+        let
+          rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
             inherit lib config pkgs;
             inherit (config.virtualisation) diskSize;
             inherit (config.image) baseName;
-          format = "qcow2-compressed";
+            format = "qcow2";
             copyChannel = false;
             partitionTableType = "legacy";
-        }
+          };
+          inherit (config.image) baseName;
+        in
+        pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
+          mkdir -p $out
+          # qemu-img caps -m at 16
+          cores="''${NIX_BUILD_CORES:-4}"
+          [ "$cores" -gt 0 ] || cores=4
+          [ "$cores" -gt 16 ] && cores=16
+          qemu-img convert \
+            -f qcow2 \
+            -O qcow2 \
+            -c \
+            -o compression_type=zstd \
+            -m "$cores" \
+            ${rawImage}/${baseName}.qcow2 \
+            $out/${baseName}.qcow2
+        ''
       );
     };
 
-  vm-guest.headless = true;
+  # auto-login on serial console
+  services.getty.autologinUser = "matej";
 
-  vm-9p-automount.user = "matej";
+  # enable zsh in home-manager so starship init gets wired up
-
+  home-manager.users.matej.programs.zsh = {
-  localisation = {
+    enable = true;
-    timeZone = "UTC";
+    dotDir = "/home/matej/.config/zsh";
-    defaultLocale = "en_US.UTF-8";
+    shellAliases.dsp = "claude --dangerously-skip-permissions";
   };
 
-  home-manager.users.matej = {
+  home-manager.users.matej.programs.starship = {
-    neovim.dotfiles = inputs.nvim;
+    enable = true;
+    settings = {
+      add_newline = false;
+      format = "$username$hostname$directory$character";
+      hostname = {
+        ssh_only = false;
+        style = "bold blue";
+        format = "[@$hostname]($style)";
       };
+      username = {
+        show_always = true;
+        style_user = "bold blue";
+        format = "[$user]($style)";
+      };
+      directory.format = " [$path]($style) ";
+      character = {
+        success_symbol = "[>](bold green)";
+        error_symbol = "[>](bold red)";
+      };
+    };
+  };
+
+  features.vm-guest.headless = true;
+  features.vm-guest.automount = {
+    enable = true;
+    user = "matej";
+  };
+  features.neovim.dotfiles = inputs.nvim;
 
   # ensure .config exists with correct ownership before automount
-  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
+
+  # TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
+  # https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
+  # accept any ssh key (ephemeral localhost-only vm)
+  services.openssh.settings.AuthorizedKeysCommand =
+    let
+      acceptKey = pkgs.writeShellScript "ephvm-accept-key" ''echo "$1 $2"'';
+    in
+    "${acceptKey} %t %k";
+  services.openssh.settings.AuthorizedKeysCommandUser = "nobody";
 
   # writable claude config via 9p
   fileSystems."/home/matej/.config/claude" = {

hosts/floo/configuration.nix

@@ -2,6 +2,8 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
   boot.loader.grub.enable = true;
 
   disko.devices.disk.main = {
@@ -26,10 +28,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/fortress/configuration.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
+  ];
+
+  features.desktop = {
+    apps.enable = false;
+    internalCA.enable = false;
+  };
+  features.gnupg.yubikey.enable = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        esp = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptlvm";
+            settings.allowDiscards = true;
+            content = {
+              type = "lvm_pv";
+              vg = "vg";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  disko.devices.lvm_vg.vg = {
+    type = "lvm_vg";
+    lvs = {
+      root = {
+        size = "100%FREE";
+        content = {
+          type = "filesystem";
+          format = "ext4";
+          mountpoint = "/";
+        };
+      };
+      swap = {
+        size = "32G";
+        content = {
+          type = "swap";
+        };
+      };
+    };
+  };
+
+  networking.firewall.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    google-chrome
+    firefox
+    vim
+  ];
+
+  system.stateVersion = "25.11";
+}

hosts/fortress/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  hardware.firmware = [ pkgs.linux-firmware ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/fw16/configuration.nix

@@ -1,8 +1,7 @@
 {
   lib,
-  pkgs,
-  inputs,
   options,
+  inputs,
   ...
 }:
 
@@ -11,37 +10,23 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
-  localisation = {
+  features.bootloader.plymouth.enable = true;
-    timeZone = "Europe/Ljubljana";
+  features.desktop.bluetooth.enable = true;
-    defaultLocale = "en_US.UTF-8";
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
   };
-
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
 
   boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
 
-  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandlePowerKey = "suspend-then-hibernate";
-    IdleAction = "suspend-then-hibernate";
-    IdleActionSec = "15min";
-  };
-
-  systemd.sleep.extraConfig = ''
-    HibernateDelaySec=30min
-  '';
-
   programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
 
   services.gnome.gnome-keyring.enable = true;
   services.teamviewer.enable = true;
 
   services.hardware.bolt.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
   hardware.bluetooth.powerOnBoot = true;
   hardware.inputmodule.enable = true;
 

hosts/iso/configuration.nix

@@ -1,15 +1,13 @@
-{ lib, ... }:
+{ lib, userKeys, ... }:
 {
+  features.nix-settings.towerCache.enable = false;
   image.modules.iso-installer = {
     isoImage.squashfsCompression = "zstd -Xcompression-level 6";
   };
 
   # live iso: passwordless login and sudo
   users.users.matej.initialHashedPassword = "";
-  users.users.root.openssh.authorizedKeys.keys = [
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
   services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
   security.sudo.wheelNeedsPassword = false;
 

hosts/tower/configuration.nix

@@ -1,38 +1,33 @@
 {
   config,
-  lib,
-  inputs,
   userKeys,
   ...
 }:
 
 {
-  imports = [
+  features.nix-settings.towerCache.enable = false;
-    inputs.lanzaboote.nixosModules.lanzaboote
+  features.bootloader = {
-  ];
+    mode = "lanzaboote";
+    plymouth.enable = true;
+  };
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };
 
   # nix store signing
   sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
   nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };
-
-  # lanzaboote secure boot
   boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
+  # early kms so plymouth lands on amdgpu, not simpledrm
-  boot.loader.systemd-boot.enable = lib.mkForce false;
+  hardware.amdgpu.initrd.enable = true;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
 
   services.udisks2.enable = true;
 

lib/mkHost.nix

@@ -27,7 +27,19 @@ let
   hostConfig = ../hosts/${name}/configuration.nix;
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
 
-  # load feature with path check
+  # auto-discover all features, excluding user-* and default.nix
+  featureDir = builtins.readDir ../features;
+  allFeatureNames = lib.pipe featureDir [
+    (lib.filterAttrs (
+      n: t:
+      (t == "regular" && lib.hasSuffix ".nix" n && n != "default.nix" && !lib.hasPrefix "user-" n)
+      || (t == "directory" && builtins.pathExists ../features/${n}/default.nix)
+    ))
+    builtins.attrNames
+    (map (n: lib.removeSuffix ".nix" n))
+  ];
+
+  # load all features unconditionally
   loadFeature =
     f:
     assert
@@ -35,7 +47,7 @@ let
       || throw "feature '${f}' not found at ${toString (featurePath f)}";
     import (featurePath f);
 
-  loadedFeatures = map loadFeature features;
+  loadedFeatures = map loadFeature allFeatureNames;
 
   # load user feature with path check
   userFeature =
@@ -55,17 +67,27 @@ let
   # collect nixos and home modules from all features
   nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
   homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
+
+  # translate features list to enable flags
+  featureEnableModule =
+    { lib, ... }:
+    {
+      config.features = lib.genAttrs features (_: {
+        enable = true;
+      });
+    };
 in
 nixpkgs.lib.nixosSystem {
   inherit system;
   modules = [
-    ../nix.nix
     inputs.sops-nix.nixosModules.sops
+    inputs.stylix.nixosModules.stylix
 
     { nixpkgs.overlays = overlays; }
     { nixpkgs.config.allowUnfree = true; }
     { networking.hostName = name; }
 
+    featureEnableModule
     hostConfig
   ]
   ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig

packages/claude-code/package.nix

@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) stdenv lib;
+  version = "2.1.116";
+
+  # upstream ships platform-native binaries as separate npm packages under
+  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
+  # postinstall shim that copies the matching one into place
+  sources = {
+    "x86_64-linux" = {
+      slug = "linux-x64";
+      hash = "sha256-QEjJ4CRk35TubDNW02Dzcu+EMRLLndJUXJeP3BFT3b8=";
+    };
+    "aarch64-linux" = {
+      slug = "linux-arm64";
+      hash = "sha256-/Hqp8GQx8Hub8K4w0Fnx/AksksY61vRC44XxrJVwF5w=";
+    };
+    "x86_64-darwin" = {
+      slug = "darwin-x64";
+      hash = "sha256-O3J/ew2fWbUQePs6tHEhK0Q9E3Mx/BDSL7b7NL3FRc8=";
+    };
+    "aarch64-darwin" = {
+      slug = "darwin-arm64";
+      hash = "sha256-O41sf7b05SJfXVjszMeTp838mja+PgZ+aEKykLsHeNo=";
+    };
+  };
+
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "claude-code: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "claude-code";
+  inherit version;
+
+  src = pkgs.fetchzip {
+    url = "https://registry.npmjs.org/@anthropic-ai/claude-code-${source.slug}/-/claude-code-${source.slug}-${version}.tgz";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.patchelf ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 claude $out/bin/claude
+    runHook postInstall
+  '';
+
+  # NOTE:(@janezicmatej) upstream is a bun single-file-executable; the
+  # embedded script payload sits at the tail of the ELF, so autoPatchelfHook's
+  # section-layout changes corrupt it — only the interpreter can be rewritten
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} $out/bin/claude
+    ''
+    + ''
+      wrapProgram $out/bin/claude \
+        --set DISABLE_AUTOUPDATER 1 \
+        --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+        --set DISABLE_INSTALLATION_CHECKS 1 \
+        --unset DEV \
+        --prefix PATH : ${
+          lib.makeBinPath (
+            [
+              pkgs.procps
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isLinux [
+              pkgs.bubblewrap
+              pkgs.socat
+            ]
+          )
+        }
+    '';
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://www.npmjs.com/package/@anthropic-ai/claude-code";
+    license = lib.licenses.unfree;
+    mainProgram = "claude";
+    platforms = lib.attrNames sources;
+  };
+}

packages/claude-code/update.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+# keep in sync with the `sources` attrset in package.nix
+PLATFORMS=(linux-x64 linux-arm64 darwin-x64 darwin-arm64)
+
+prefetch() {
+	local url="$1"
+	nix --extra-experimental-features 'nix-command flakes' \
+		store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r '.hash'
+}
+
+main() {
+	echo "fetching latest version from npm..."
+	local latest current
+	latest=$(curl -sf "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" | jq -r '.version')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "claude-code already at $latest"
+		return 0
+	fi
+
+	echo "updating claude-code: $current -> $latest"
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+
+	local slug url new_hash old_hash
+	for slug in "${PLATFORMS[@]}"; do
+		url="https://registry.npmjs.org/@anthropic-ai/claude-code-${slug}/-/claude-code-${slug}-${latest}.tgz"
+		echo "  prefetching $slug..."
+		new_hash=$(prefetch "$url")
+		old_hash=$(awk -v slug="$slug" '
+			$0 ~ "slug = \"" slug "\";" { found=1; next }
+			found && /hash = "sha256-/ {
+				match($0, /sha256-[A-Za-z0-9+\/]+=*/)
+				print substr($0, RSTART, RLENGTH)
+				exit
+			}
+		' "$PKG_FILE")
+		sed -i "s|$old_hash|$new_hash|" "$PKG_FILE"
+		echo "    $new_hash"
+	done
+
+	echo "claude-code updated to $latest"
+}
+
+main "$@"

scripts/ephvm-run.sh

@@ -27,23 +27,44 @@ info() {
 
 # globals for cleanup trap
 CLEANUP_OVERLAY=""
+CLEANUP_TMPDIR=""
+QEMU_PID=""
+VM_READY=false
 cleanup() {
+	[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
 	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	# preserve tmpdir on abnormal exit so the qemu log survives for inspection
+	if [ -n "$CLEANUP_TMPDIR" ]; then
+		if [ "$VM_READY" = true ]; then
+			rm -rf "$CLEANUP_TMPDIR"
+		else
+			echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
+		fi
+	fi
 	return 0
 }
 trap cleanup EXIT
 
+# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
+awaiting_ssh_banner() {
+	local port="$1"
+	local banner
+	banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
+	[ "$banner" = "SSH-" ]
+}
+
 usage() {
 	cat <<EOF
 Usage: ephvm-run.sh [options]
 
 Options:
   --mount <path>       Mount host directory into VM (repeatable)
-  --claude             Mount claude config dir (requires CLAUDE_CONFIG_DIR)
+  --no-claude          Skip mounting claude config dir
   --disk-size <size>   Resize guest disk (e.g. 50G)
-  --memory <size>      VM memory (default: 8G)
+  --memory <size>      VM memory (default: 4G)
-  --cpus <n>           VM CPUs (default: 4)
+  --cpus <n>           VM CPUs (default: 2)
-  --ssh-port <port>    SSH port forward (default: 2222)
+  --ssh-port <port>    Use specific SSH port (default: auto)
+  --serial             Attach to serial console instead of SSH
   -h, --help           Show usage
 EOF
 	exit "${1:-0}"
@@ -52,7 +73,9 @@ EOF
 main() {
 	setup_colors
 
-	local ssh_port=2222 memory=8G cpus=4 claude=false disk_size=""
+	[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
+
+	local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
 	local -a mounts=()
 
 	while [ $# -gt 0 ]; do
@@ -61,8 +84,8 @@ main() {
 			mounts+=("$2")
 			shift 2
 			;;
-		--claude)
+		--no-claude)
-			claude=true
+			claude=false
 			shift
 			;;
 		--disk-size)
@@ -81,6 +104,10 @@ main() {
 			ssh_port="$2"
 			shift 2
 			;;
+		--serial)
+			serial=true
+			shift
+			;;
 		-h | --help) usage ;;
 		*)
 			echo "${red}error:${reset} unknown option: $1" >&2
@@ -91,7 +118,9 @@ main() {
 
 	info "building ephvm image..."
 	local image_dir image
-	image_dir=$(nix build --no-link --print-out-paths .#nixosConfigurations.ephvm.config.system.build.images.qemu)
+	[ -n "${EPHVM_FLAKE:-}" ] || die "EPHVM_FLAKE must be set to the flake directory"
+	local flake="$EPHVM_FLAKE"
+	image_dir=$(nix build --no-link --print-out-paths "${flake}#nixosConfigurations.ephvm.config.system.build.images.qemu")
 	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
 	[ -n "$image" ] || die "no qcow2 image found in $image_dir"
 
@@ -101,31 +130,49 @@ main() {
 		CLEANUP_OVERLAY=$(mktemp -d)
 		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
 		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
-		drive_arg="file=$overlay,format=qcow2"
+		drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	else
-		drive_arg="file=$image,format=qcow2,snapshot=on"
+		drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	fi
 
-	local accel="tcg"
+	command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
-	[ -r /dev/kvm ] && accel="kvm"
+	[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
+
+	# auto-allocate ssh port unless serial mode
+	if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
+		ssh_port=10022
+		while ss -tln | grep -q ":${ssh_port}\b"; do
+			ssh_port=$((ssh_port + 1))
+		done
+	fi
+
+	local nic_arg="user,model=virtio-net-pci"
+	if [ -n "$ssh_port" ]; then
+		nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
+	fi
 
 	local -a qemu_args=(
 		qemu-system-x86_64
-		-accel "$accel"
+		-accel kvm
+		-cpu host
 		-m "$memory"
 		-smp "$cpus"
 		-drive "$drive_arg"
-		-nic "user,hostfwd=tcp::${ssh_port}-:22"
+		-device "virtio-blk-pci,drive=hd0"
+		-device virtio-rng-pci
+		-nic "$nic_arg"
 		-nographic
+		-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
 	)
 
-	if [ "$accel" != "tcg" ]; then
-		qemu_args+=(-cpu host)
-	fi
-
 	local fs_id=0 mount_path name tag
 	for mount_path in "${mounts[@]}"; do
+		[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
 		mount_path=$(realpath "$mount_path")
+		# qemu parses -virtfs as csv, a comma in the path would inject options
+		case "$mount_path" in
+		*,*) die "--mount path may not contain commas: $mount_path" ;;
+		esac
 		name=$(basename "$mount_path")
 		tag="m_${name:0:29}"
 		qemu_args+=(
@@ -135,10 +182,13 @@ main() {
 	done
 
 	if [ "$claude" = true ]; then
-		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "--claude requires CLAUDE_CONFIG_DIR to be set"
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "CLAUDE_CONFIG_DIR must be set (use --no-claude to skip)"
 		mkdir -p "$CLAUDE_CONFIG_DIR"
 		local claude_dir
 		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+		case "$claude_dir" in
+		*,*) die "claude config dir may not contain commas: $claude_dir" ;;
+		esac
 
 		qemu_args+=(
 			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
@@ -147,10 +197,42 @@ main() {
 	fi
 
 	info "---"
-	info "Accel: $accel | SSH: ssh -p $ssh_port matej@localhost"
+	[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
 	info "---"
 
+	if [ "$serial" = true ]; then
 		exec "${qemu_args[@]}"
+	fi
+
+	CLEANUP_TMPDIR=$(mktemp -d)
+	local qemu_log="$CLEANUP_TMPDIR/qemu.log"
+
+	# start qemu in background and auto-ssh
+	"${qemu_args[@]}" &>"$qemu_log" &
+	QEMU_PID=$!
+
+	# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
+	local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
+	ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
+
+	info "waiting for vm (port $ssh_port)..."
+	local attempts=0
+	# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
+	# accepts host-side the moment qemu starts, well before guest sshd is up
+	while ! awaiting_ssh_banner "$ssh_port"; do
+		attempts=$((attempts + 1))
+		[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
+		kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
+		sleep 0.5
+	done
+	VM_READY=true
+
+	ssh -p "$ssh_port" -t \
+		-i "$ssh_key" \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o LogLevel=ERROR \
+		matej@localhost
 }
 
 main "$@"

secrets/floo.yaml

@@ -0,0 +1,28 @@
+filedrop-authorized-keys: ENC[AES256_GCM,data:3zg0ZZR/EfmffhT+5hiiCawhHW0Y8VOcsMRwPq50AgSvM8DJO/fOK5RhPMlHmOOXSbYYal9QoPILP5rSHDMszk6QSRqmvAbpkpJhgfW4jx8XbLTFxO4lUKe/hd968ryqP2pXtZzUBnOp4vSI29LcYms6e8fSwS8ANtSIjCLkEsY=,iv:EOjsWB7uxjqI5NXot586Q0997SOmkAMwVkxm6VLplDc=,tag:Q4rB6KFibV+F79/rs5m0dA==,type:str]
+sops:
+    age:
+        - recipient: age1hksdq2lc89thnpth49sw44f0pmkp950plrhhnttj4petvnfy04tsydz6fl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTRk1qOGNGNFp4VS9GOUs0
+            dTQ0K3A2Y3VXY3NSV0RyU0VxV3VCa0dDOG5zClAvOElXcHhYaWNCamxFZHMvV2Iy
+            WFRwNFRjaHpKSDdkak5UK05hd0hYMFUKLS0tIGRQeVJGdk8vYVdQdS9BYVd3TEhn
+            UWxzeHlaY2pvdS9tbW9vaVE5NTNwRFEKKieIA5Sn6oN5qjDwh5/usaKwLdYPClmS
+            d+hBdcn4/mtQnrm9dnbRVHd/B1MOuQxoXEB1kc4nzFKvCEqRdRIlYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-09T08:57:26Z"
+    mac: ENC[AES256_GCM,data:XHC5cBvQuDi9byVgDymx9qSbplDlHwFTSLaGfWTRQJZeioBelDgBwUstbgWDeNPj1RzGGaSa3+kDOa054DuXi/mw2nDnLGuQDFAmJ66kepJE1mw4F6i4+YnbSE+y7GTbTkUkvbmiNV7uGO4Fq9jy/gNb1wq3IHzDVaKNjNbkKAk=,iv:qK/tgbAkxGpfgJAjBrqDwO/lVkD79pY9S3hzXGGycvM=,tag:oHURU988sW4iN7fXwurOtQ==,type:str]
+    pgp:
+        - created_at: "2026-04-09T08:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DPaEEpDtHdk8SAQdATk1lN0/WDX6S1oPje9jZloSll1qSNau3zgt67CrselMw
+            YlbenxVeY8G4qTvfimX9/qH1/SNHkL/B0jqMCEkw8EpeyA3oEIWuzEEEOA+W/Iri
+            0lwB26CTd8PKwvjuMwmvzTaZfQ9fk+ZsvIjtQaj//WA2utfU4b9T2E+M2Jb5vyki
+            INcWT4PJkNSDxm5NabcTqyetcorDGaU1oN/T1p7pvRBvGCSHItYthVvq/RC0bw==
+            =pKJc
+            -----END PGP MESSAGE-----
+          fp: AF349EECC849D87B790E88FF6318FFB7DB374B7D
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2