diff --git a/modules/hardwares/bluetooth/nixos.nix b/modules/hardwares/bluetooth/nixos.nix
new file mode 100644
index 0000000..32aba0a
--- /dev/null
+++ b/modules/hardwares/bluetooth/nixos.nix
@@ -0,0 +1,8 @@
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+
+  services.blueman.enable = true;
+}
diff --git a/modules/hardwares/graphics/nixos.nix b/modules/hardwares/graphics/nixos.nix
new file mode 100644
index 0000000..93a33d0
--- /dev/null
+++ b/modules/hardwares/graphics/nixos.nix
@@ -0,0 +1,3 @@
+{
+  hardware.graphics.enable = true;
+}
diff --git a/modules/hardwares/ipu6-camera/nixos.nix b/modules/hardwares/ipu6-camera/nixos.nix
new file mode 100644
index 0000000..5acaae6
--- /dev/null
+++ b/modules/hardwares/ipu6-camera/nixos.nix
@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+  boot.kernelModules = [ "uvcvideo" ];
+  hardware.ipu6 = {
+    enable = true;
+    platform = "ipu6epmtl";
+  };
+
+  environment.systemPackages = with pkgs; [
+    v4l-utils
+    ffmpeg-full
+    libcamera
+  ];
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+  security.rtkit.enable = true;
+}
diff --git a/modules/hardwares/qemu-guest/nixos.nix b/modules/hardwares/qemu-guest/nixos.nix
new file mode 100644
index 0000000..30b2817
--- /dev/null
+++ b/modules/hardwares/qemu-guest/nixos.nix
@@ -0,0 +1,3 @@
+{
+  services.qemuGuest.enable = true;
+}
diff --git a/modules/profiles/base/meta.nix b/modules/profiles/base/meta.nix
index 1fc1238..9ae68ac 100644
--- a/modules/profiles/base/meta.nix
+++ b/modules/profiles/base/meta.nix
@@ -3,7 +3,9 @@
 
   includes = [
     "systems.locale"
-    "systems.networking"
+    "systems.networking.base"
+    "systems.networking.wifi"
     "systems.nix"
+    "systems.sops"
   ];
 }
diff --git a/modules/systems/audio/nixos.nix b/modules/systems/audio/nixos.nix
new file mode 100644
index 0000000..9f9bf65
--- /dev/null
+++ b/modules/systems/audio/nixos.nix
@@ -0,0 +1,12 @@
+{
+  security.rtkit.enable = true;
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+    wireplumber.enable = true;
+  };
+}
diff --git a/modules/systems/boot/base/nixos.nix b/modules/systems/boot/base/nixos.nix
new file mode 100644
index 0000000..f2d62bf
--- /dev/null
+++ b/modules/systems/boot/base/nixos.nix
@@ -0,0 +1,6 @@
+{ pkgs, lib, ... }:
+{
+  boot.loader.systemd-boot.configurationLimit = lib.mkDefault 8;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  programs.nix-ld.enable = true;
+}
diff --git a/modules/systems/boot/nfs/nixos.nix b/modules/systems/boot/nfs/nixos.nix
new file mode 100644
index 0000000..b4e1c0a
--- /dev/null
+++ b/modules/systems/boot/nfs/nixos.nix
@@ -0,0 +1,5 @@
+{
+  boot.supportedFilesystems = [ "nfs" ];
+  programs.fuse.userAllowOther = true;
+  services.rpcbind.enable = true;
+}
diff --git a/modules/systems/boot/secure-boot/meta.nix b/modules/systems/boot/secure-boot/meta.nix
new file mode 100644
index 0000000..91970f8
--- /dev/null
+++ b/modules/systems/boot/secure-boot/meta.nix
@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  description = "Lanzaboote Secure Boot";
+
+  imports.nixos = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+}
diff --git a/modules/systems/boot/secure-boot/nixos.nix b/modules/systems/boot/secure-boot/nixos.nix
new file mode 100644
index 0000000..22205ea
--- /dev/null
+++ b/modules/systems/boot/secure-boot/nixos.nix
@@ -0,0 +1,17 @@
+{ pkgs, lib, ... }:
+{
+  boot.loader = {
+    systemd-boot.enable = lib.mkForce false;
+    efi = {
+      canTouchEfiVariables = true;
+      efiSysMountPoint = "/boot";
+    };
+  };
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  environment.systemPackages = [ pkgs.sbctl ];
+}
diff --git a/modules/systems/boot/uefi/nixos.nix b/modules/systems/boot/uefi/nixos.nix
index 8292620..9fca7d0 100644
--- a/modules/systems/boot/uefi/nixos.nix
+++ b/modules/systems/boot/uefi/nixos.nix
@@ -2,7 +2,6 @@
 {
   boot.loader = {
     systemd-boot.enable = lib.mkDefault true;
-    systemd-boot.configurationLimit = lib.mkDefault 8;
     efi.canTouchEfiVariables = lib.mkDefault true;
   };
 }
diff --git a/modules/systems/disko/meta.nix b/modules/systems/disko/meta.nix
new file mode 100644
index 0000000..42e8054
--- /dev/null
+++ b/modules/systems/disko/meta.nix
@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  description = "Disko declarative disk partitioning";
+
+  imports.nixos = [ inputs.disko.nixosModules.disko ];
+}
diff --git a/modules/systems/disko/nixos.nix b/modules/systems/disko/nixos.nix
new file mode 100644
index 0000000..346da7e
--- /dev/null
+++ b/modules/systems/disko/nixos.nix
@@ -0,0 +1,4 @@
+{ lib, ... }:
+{
+  disko.enableConfig = lib.mkDefault false;
+}
diff --git a/modules/systems/fingerprint/nixos.nix b/modules/systems/fingerprint/nixos.nix
new file mode 100644
index 0000000..f9f428a
--- /dev/null
+++ b/modules/systems/fingerprint/nixos.nix
@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  services.fprintd.enable = true;
+  security.polkit.enable = true;
+  security.pam.services.polkit-1.fprintAuth = true;
+  security.pam.services = {
+    login.fprintAuth = false;
+    sudo.fprintAuth = true;
+    greetd.fprintAuth = lib.mkForce false;
+    ly.fprintAuth = lib.mkForce false;
+  };
+}
diff --git a/modules/systems/fonts/nixos.nix b/modules/systems/fonts/nixos.nix
new file mode 100644
index 0000000..972da51
--- /dev/null
+++ b/modules/systems/fonts/nixos.nix
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+{
+  fonts = {
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+      terminus_font
+      cantarell-fonts
+      font-awesome
+      nerd-fonts.blex-mono
+    ];
+    fontDir.enable = true;
+    fontconfig.defaultFonts = {
+      serif = [
+        "Noto Serif CJK JP"
+        "Noto Color Emoji"
+      ];
+      sansSerif = [
+        "Noto Sans CJK JP"
+        "Noto Color Emoji"
+      ];
+      emoji = [ "Noto Color Emoji" ];
+    };
+  };
+}
diff --git a/modules/systems/hardware/nixos.nix b/modules/systems/hardware/nixos.nix
new file mode 100644
index 0000000..eee54af
--- /dev/null
+++ b/modules/systems/hardware/nixos.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+{
+  hardware = {
+    enableRedistributableFirmware = lib.mkDefault true;
+    keyboard.qmk.enable = true;
+  };
+
+  services.fwupd.enable = true;
+}
diff --git a/modules/systems/networking/base/nixos.nix b/modules/systems/networking/base/nixos.nix
new file mode 100644
index 0000000..59c7619
--- /dev/null
+++ b/modules/systems/networking/base/nixos.nix
@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  networking.nameservers = lib.mkDefault [
+    "1.1.1.1"
+    "1.0.0.1"
+    "10.50.80.53"
+    "10.50.80.54"
+  ];
+
+  services.resolved.enable = lib.mkDefault false;
+  security.pki.certificateFiles = [ ./root_ca.crt ];
+}
diff --git a/modules/systems/networking/base/root_ca.crt b/modules/systems/networking/base/root_ca.crt
new file mode 100644
index 0000000..1e60529
--- /dev/null
+++ b/modules/systems/networking/base/root_ca.crt
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBszCCAVqgAwIBAgIRAPCAxajuCEmnXKploQS+KAkwCgYIKoZIzj0EAwIwODEW
+MBQGA1UEChMNTW9vbnMgSG9tZSBDQTEeMBwGA1UEAxMVTW9vbnMgSG9tZSBDQSBS
+b290IENBMB4XDTI1MTIwNjE4MDgwN1oXDTM1MTIwNDE4MDgwN1owODEWMBQGA1UE
+ChMNTW9vbnMgSG9tZSBDQTEeMBwGA1UEAxMVTW9vbnMgSG9tZSBDQSBSb290IENB
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDw2M0NQMju2zN5ZXwsYaTieWggId
+XmRSXjOHW4/pBEI11xk1GkMFbeVmppr1cbcNmbB+fmxoFa+oKguhFDSsdaNFMEMw
+DgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGuC
+UGL5CxdamFfBVC8xH306Wo6xMAoGCCqGSM49BAMCA0cAMEQCIBqWCNWBuwhWDYoi
+fpqOqz2HSChOsKCIAgfTJlUUgSlSAiALekUJ+4M+L4/vP4GpkrSovuQ7JOMXV44+
+30Pcx4AoJg==
+-----END CERTIFICATE-----
diff --git a/modules/systems/networking/nixos.nix b/modules/systems/networking/nixos.nix
deleted file mode 100644
index f29d881..0000000
--- a/modules/systems/networking/nixos.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  networking.networkmanager.enable = true;
-}
diff --git a/modules/systems/networking/wifi/nixos.nix b/modules/systems/networking/wifi/nixos.nix
new file mode 100644
index 0000000..5658a4d
--- /dev/null
+++ b/modules/systems/networking/wifi/nixos.nix
@@ -0,0 +1,25 @@
+{
+  networking = {
+    networkmanager = {
+      enable = true;
+      dns = "none";
+      wifi = {
+        powersave = false;
+        backend = "wpa_supplicant";
+      };
+      settings = {
+        "device"."wifi.scan-rand-mac-address" = "no";
+        "connection"."wifi.cloned-mac-address" = "permanent";
+      };
+    };
+    wireless.iwd.enable = false;
+  };
+
+  boot.extraModprobeConfig = ''
+    options cfg80211 ieee80211_regdom=JP
+    options iwlwifi power_save=0
+    options iwlwifi uapsd_disable=1
+  '';
+
+  programs.nm-applet.enable = true;
+}
diff --git a/modules/systems/nix/common.nix b/modules/systems/nix/common.nix
index 4579c0c..270334e 100644
--- a/modules/systems/nix/common.nix
+++ b/modules/systems/nix/common.nix
@@ -1,8 +1,30 @@
 {
   nixpkgs.config.allowUnfree = true;
 
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    extra-substituters = [
+      "https://cache.nixos.org"
+      "https://nix-community.cachix.org"
+      "https://moons-dotfiles.cachix.org"
+      "https://noctalia.cachix.org"
+      "https://vicinae.cachix.org"
+      "https://cache.numtide.com"
+      "https://codex-desktop-linux.cachix.org"
+    ];
+
+    extra-trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "moons-dotfiles.cachix.org-1:WHoroKiNScG2/dpxHHL1I0qVmvuQhJbEAP+DS2j9Rr0="
+      "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
+      "vicinae.cachix.org-1:1kDrfienkGHPYbkpNj1mWTr7Fm1+zcenzgTizIcI3oc="
+      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
+      "codex-desktop-linux.cachix.org-1:nX/xy6AdK9hQE24A8ALGjkCKj2ObFmcnemiL5Cid4nk="
+    ];
+  };
 }
diff --git a/modules/systems/nix/darwin.nix b/modules/systems/nix/darwin.nix
new file mode 100644
index 0000000..ba7cd0d
--- /dev/null
+++ b/modules/systems/nix/darwin.nix
@@ -0,0 +1,16 @@
+{
+  nix.gc = {
+    automatic = true;
+    interval = [
+      {
+        Weekday = 7;
+        Hour = 3;
+        Minute = 15;
+      }
+    ];
+    options = "--delete-older-than 14d";
+  };
+
+  nix.settings.auto-optimise-store = true;
+  nix.optimise.automatic = true;
+}
diff --git a/modules/systems/nix/nixos.nix b/modules/systems/nix/nixos.nix
new file mode 100644
index 0000000..aacd6ef
--- /dev/null
+++ b/modules/systems/nix/nixos.nix
@@ -0,0 +1,8 @@
+{
+  nix.gc.automatic = false;
+  nix.settings.auto-optimise-store = true;
+  nix.optimise = {
+    automatic = true;
+    dates = [ "weekly" ];
+  };
+}
diff --git a/modules/systems/power/nixos.nix b/modules/systems/power/nixos.nix
new file mode 100644
index 0000000..24f79b8
--- /dev/null
+++ b/modules/systems/power/nixos.nix
@@ -0,0 +1,18 @@
+{
+  boot.kernelParams = [ "mem_sleep_default=deep" ];
+
+  powerManagement = {
+    enable = true;
+    powertop.enable = true;
+  };
+
+  services.power-profiles-daemon.enable = true;
+  services.tlp.enable = false;
+  services.upower.enable = true;
+  services.logind.settings.Login = {
+    HandleLidSwitch = "suspend";
+    HandleLidSwitchDocked = "ignore";
+    HandleLidSwitchExternalPower = "suspend";
+    LidSwitchIgnoreInhibited = "no";
+  };
+}
diff --git a/modules/systems/sops/common.nix b/modules/systems/sops/common.nix
new file mode 100644
index 0000000..a90cbb9
--- /dev/null
+++ b/modules/systems/sops/common.nix
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    sops
+    age
+    ssh-to-age
+    age-plugin-yubikey
+    yubikey-manager
+    pcsc-tools
+    mkpasswd
+  ];
+
+  sops = {
+    defaultSopsFormat = "yaml";
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  };
+}
diff --git a/modules/systems/sops/meta.nix b/modules/systems/sops/meta.nix
new file mode 100644
index 0000000..02f75ce
--- /dev/null
+++ b/modules/systems/sops/meta.nix
@@ -0,0 +1,11 @@
+{ inputs, ... }:
+{
+  description = "sops-nix system integration";
+
+  includes = [ "services.openssh" ];
+
+  imports = {
+    nixos = [ inputs.sops-nix.nixosModules.sops ];
+    darwin = [ inputs.sops-nix.darwinModules.sops ];
+  };
+}
diff --git a/modules/systems/sops/nixos.nix b/modules/systems/sops/nixos.nix
new file mode 100644
index 0000000..753c502
--- /dev/null
+++ b/modules/systems/sops/nixos.nix
@@ -0,0 +1,8 @@
+{
+  services.pcscd.enable = true;
+
+  sops.secrets."users/moons/hashedPassword" = {
+    sopsFile = ../../../secrets/common/system.yaml;
+    neededForUsers = true;
+  };
+}
diff --git a/modules/users/moons/nixos.nix b/modules/users/moons/nixos.nix
index 3937da8..8299ffc 100644
--- a/modules/users/moons/nixos.nix
+++ b/modules/users/moons/nixos.nix
@@ -1,5 +1,7 @@
 { primaryUser, pkgs, ... }:
 {
+  users.mutableUsers = true;
+
   users.users.${primaryUser} = {
     isNormalUser = true;
     description = "moons";
diff --git a/secrets/common/system.yaml b/secrets/common/system.yaml
new file mode 100644
index 0000000..4d3315f
--- /dev/null
+++ b/secrets/common/system.yaml
@@ -0,0 +1,46 @@
+users:
+  moons:
+    hashedPassword: ENC[AES256_GCM,data:QtZei/BXPn/PDxUlOu0ZVrAfRM5jiHChAE5j5NVscPmm4OWjr94nPVOmJlYjL2WAiJY3/JSthmbrEIqiUF6E9qv10HQzAxzmZQ==,iv:ksshJX9S/20lw/8IDZYadNZLLE/gNgENZJ3/wRgJCds=,tag:xJPiO8O/q4rKmb+YNnpZdg==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IGxWc2NMZyBBbEttK0xB
+        ZVVDWk03alZnR3lGZEY4VlJMdTRTMXNDdHR6QW5YekgwZ3B0SQordFdPRUh4YU80
+        MmxMNFdKbTNMVXZPMVVNY3ZKdjczWnhWTzYxbUV6NC9rCi0tLSBDSGlUWC9SVW1T
+        MitabjYrWG1FVG5xUGhqSVZDekgrQmcxSUZGSklFdU5vCu3bLs7yVM7vxFX2q3pt
+        W/4VEsxzYZN2aITrRfbVWCgwVyYBh3WbcImU8oLOhZ2nfgqfcQ5x2LVu1IzuCSdd
+        cjo=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaWxxVWFSTUxDNy9KaGlE
+        ZVBWVHF2eEFXZnJLaXdiSW5kMUJpYiswVGhjCmFkcUhTMXhuRFpLTG9Udkd1UXI2
+        MkN5VXJSNUNiQUp2MzFIbzhhbVZ3aGsKLS0tIGE3ZXlsMjdRb2RBM1lVMHRSY0I4
+        SUVnNjFZVFQzZ3Y4UjlaK3ZNOXdGRXcKyrd86CUWYi13i+M7ESKQH3W41M2/pc60
+        04Px/7G7urIlgjfEV/wXaVIyeSU8Eb65uI/AOseJwH3v4IbW6Nd6bw==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UDU4VFJ1d3VDa2lDNURW
+        RDFMQWFzNWRwcUFqT25KR29MU0x2NW9GMkFZCjJwUExKOFRPRW9kZWxVSisreVRo
+        Y2Era2dHZk1QR04xMkNGcnROR2R3eHcKLS0tIGh4alhBamJzVnMyczBMK0l4TEUr
+        WjF2R2N2RHdkMGh3VkdwKy9kb0VZOXMKCC3bEZROBi45aydfI5UL4oPP+ce91/UK
+        tOuHzwituiYZdJ79a/wXRJMFPg9eCiziSR3uLeP8279oLM417Drwxg==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZlNDTnhFSi9iOXZEcHdQ
+        U1kreStxZ2dJd0g4dE1rdDQrSk5QTUhMbm5JCmRNc0k4K2VrTTFnaFNFSkd1em1J
+        SGczRnFzK2RlSzFPQnVUWHZUdzYyL2MKLS0tICtBbk9Zc0tYaXJ6a3FXcUQ5R0xv
+        MVZxUGZTaHJyeGNjS1B2SVhJLzAyNFkKNGE5sNLodP5TcXqvW//JLRW/5g8I0Hzc
+        cAgBXe+70HqFzEHQF1X7jHSZarTwclaNsjQPVyEaQfxYf+mLh+bTaA==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
+  lastmodified: "2026-06-15T10:20:19Z"
+  mac: ENC[AES256_GCM,data:Tw58FneoksiOuol1aUOFXoAnFiTzddmFfYAA0B0RfPPyj6UKQbBvRYJhOMuOMRE1fVlDhqxxDiqZI5y14vJg8gLusAZt1JKi7ODR7MqcImvxboaee8DIj4uIcN254g0c0cmZWsGrt7yTYoSLDUc3QdAxj9/Az/CMls6XjM+RL8E=,iv:XGgWgbexCUxzuJzRVG3V2GZGwmwjAtowgz+NRPxk1+o=,tag:FwYJXfwS2f70okl0bhS+Sw==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.1