chore(nix): update ghostty to 66fed652

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/actions/update-flake-input/action.yaml

@@ -0,0 +1,260 @@
+name: Update Flake Input
+description: Update one GitHub-backed Nix flake input and create a pull request
+inputs:
+  input-name:
+    description: Name of the flake input to update
+    required: true
+  github-token:
+    description: Token used to query GitHub, push the update branch, and manage the pull request
+    required: true
+  base-branch:
+    description: Branch targeted by the pull request
+    required: false
+    default: main
+  minimum-release-age-days:
+    description: Minimum age of the target commit in days
+    required: false
+    default: "3"
+  skip-delay:
+    description: Update to the latest revision without applying the minimum age
+    required: false
+    default: "false"
+  auto-merge:
+    description: Enable squash auto-merge on the pull request
+    required: false
+    default: "true"
+  pr-labels:
+    description: Comma-separated labels to add when they already exist in the repository
+    required: false
+    default: dependencies,automated
+outputs:
+  updated:
+    description: Whether flake.lock changed
+    value: ${{ steps.update.outputs.updated }}
+  current-version:
+    description: Previous locked revision
+    value: ${{ steps.update.outputs.current_version }}
+  new-version:
+    description: New locked revision
+    value: ${{ steps.update.outputs.new_version }}
+  pr-url:
+    description: URL of the created or updated pull request
+    value: ${{ steps.pull-request.outputs.pr_url }}
+runs:
+  using: composite
+  steps:
+    - name: Update flake input
+      id: update
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        INPUT_NAME: ${{ inputs.input-name }}
+        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
+        SKIP_DELAY: ${{ inputs.skip-delay }}
+      run: |
+        set -euo pipefail
+
+        if [[ ! "$MINIMUM_RELEASE_AGE_DAYS" =~ ^[0-9]+$ ]]; then
+          echo "::error::minimum-release-age-days must be a non-negative integer"
+          exit 1
+        fi
+
+        node_key="$(
+          jq -er --arg input "$INPUT_NAME" '
+            .nodes.root.inputs[$input]
+            | if type == "array" then .[0] else . end
+          ' flake.lock
+        )"
+        input_type="$(jq -r --arg node "$node_key" '.nodes[$node].locked.type // ""' flake.lock)"
+        input_owner="$(jq -r --arg node "$node_key" '.nodes[$node].locked.owner // ""' flake.lock)"
+        input_repo="$(jq -r --arg node "$node_key" '.nodes[$node].locked.repo // ""' flake.lock)"
+        input_ref="$(jq -r --arg node "$node_key" '.nodes[$node].original.ref // ""' flake.lock)"
+        current_rev="$(jq -er --arg node "$node_key" '.nodes[$node].locked.rev' flake.lock)"
+
+        if [ "$input_type" != "github" ] || [ -z "$input_owner" ] || [ -z "$input_repo" ]; then
+          echo "::error::${INPUT_NAME} is not a GitHub-backed flake input"
+          exit 1
+        fi
+
+        echo "Input: $INPUT_NAME"
+        echo "Repository: ${input_owner}/${input_repo}"
+        echo "Current revision: $current_rev"
+
+        if [ "$SKIP_DELAY" = "true" ]; then
+          nix flake update "$INPUT_NAME"
+        else
+          cutoff="$(date --utc --date="${MINIMUM_RELEASE_AGE_DAYS} days ago" +%Y-%m-%dT%H:%M:%SZ)"
+          api_args=(
+            --method GET
+            "repos/${input_owner}/${input_repo}/commits"
+            -f "until=$cutoff"
+            -f per_page=1
+          )
+          if [ -n "$input_ref" ]; then
+            api_args+=(-f "sha=$input_ref")
+          fi
+
+          echo "Selecting the newest commit no later than $cutoff"
+          target_data="$(gh api "${api_args[@]}" --jq '.[0] | {sha: .sha, date: .commit.committer.date}')"
+          target_rev="$(jq -er '.sha' <<< "$target_data")"
+          target_date="$(jq -er '.date' <<< "$target_data")"
+
+          if [ "$target_rev" = "$current_rev" ]; then
+            echo "The input is already at the newest eligible revision"
+            {
+              echo "updated=false"
+              echo "current_version=$current_rev"
+              echo "new_version=$current_rev"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          current_date="$(
+            gh api "repos/${input_owner}/${input_repo}/commits/${current_rev}" \
+              --jq '.commit.committer.date'
+          )"
+          current_timestamp="$(date --date="$current_date" +%s)"
+          target_timestamp="$(date --date="$target_date" +%s)"
+
+          if [ "$target_timestamp" -lt "$current_timestamp" ]; then
+            echo "The newest eligible revision is older than the current revision; skipping"
+            {
+              echo "updated=false"
+              echo "current_version=$current_rev"
+              echo "new_version=$current_rev"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          nix flake update "$INPUT_NAME" \
+            --override-input "$INPUT_NAME" "github:${input_owner}/${input_repo}/${target_rev}"
+        fi
+
+        if git diff --quiet -- flake.lock; then
+          echo "No lock file changes were produced"
+          {
+            echo "updated=false"
+            echo "current_version=$current_rev"
+            echo "new_version=$current_rev"
+          } >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        new_node_key="$(
+          jq -er --arg input "$INPUT_NAME" '
+            .nodes.root.inputs[$input]
+            | if type == "array" then .[0] else . end
+          ' flake.lock
+        )"
+        new_rev="$(jq -er --arg node "$new_node_key" '.nodes[$node].locked.rev' flake.lock)"
+
+        echo "New revision: $new_rev"
+        {
+          echo "updated=true"
+          echo "current_version=$current_rev"
+          echo "new_version=$new_rev"
+          echo "input_owner=$input_owner"
+          echo "input_repo=$input_repo"
+        } >> "$GITHUB_OUTPUT"
+    - name: Create or update pull request
+      id: pull-request
+      if: steps.update.outputs.updated == 'true'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        INPUT_NAME: ${{ inputs.input-name }}
+        BASE_BRANCH: ${{ inputs.base-branch }}
+        CURRENT_REV: ${{ steps.update.outputs.current_version }}
+        NEW_REV: ${{ steps.update.outputs.new_version }}
+        INPUT_OWNER: ${{ steps.update.outputs.input_owner }}
+        INPUT_REPO: ${{ steps.update.outputs.input_repo }}
+        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
+        SKIP_DELAY: ${{ inputs.skip-delay }}
+        AUTO_MERGE: ${{ inputs.auto-merge }}
+        PR_LABELS: ${{ inputs.pr-labels }}
+      run: |
+        set -euo pipefail
+
+        branch_suffix="$(tr -c 'A-Za-z0-9._-' '-' <<< "$INPUT_NAME" | sed 's/-$//')"
+        branch="update-flake-${branch_suffix}"
+        current_short="${CURRENT_REV:0:8}"
+        new_short="${NEW_REV:0:8}"
+        title="chore(nix): update ${INPUT_NAME} to ${new_short}"
+
+        if [ "$SKIP_DELAY" = "true" ]; then
+          age_note="The minimum release age check was skipped for this manually requested update."
+        else
+          age_note="The target commit is at least ${MINIMUM_RELEASE_AGE_DAYS} days old."
+        fi
+
+        body="$(
+          printf '%s\n' \
+            "Automated update of the \`${INPUT_NAME}\` flake input." \
+            "" \
+            "- Previous revision: [\`${current_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${CURRENT_REV})" \
+            "- New revision: [\`${new_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${NEW_REV})" \
+            "- Changes: [compare](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/compare/${CURRENT_REV}...${NEW_REV})" \
+            "" \
+            "$age_note"
+        )"
+
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add flake.lock
+        git switch -C "$branch"
+        git commit -m "$title"
+
+        git fetch origin "refs/heads/${branch}:refs/remotes/origin/${branch}" || true
+        git push --force-with-lease origin "HEAD:refs/heads/${branch}"
+
+        label_args=()
+        available_labels="$(gh label list --limit 100 --json name --jq '.[].name')"
+        IFS=',' read -ra requested_labels <<< "$PR_LABELS"
+        for label in "${requested_labels[@]}"; do
+          label="$(xargs <<< "$label")"
+          if [ -n "$label" ] && grep -Fxq "$label" <<< "$available_labels"; then
+            label_args+=(--add-label "$label")
+          elif [ -n "$label" ]; then
+            echo "::warning::Skipping missing pull request label: $label"
+          fi
+        done
+
+        pr_number="$(
+          gh pr list \
+            --state open \
+            --head "$branch" \
+            --json number \
+            --jq '.[0].number // empty'
+        )"
+
+        if [ -n "$pr_number" ]; then
+          gh pr edit "$pr_number" \
+            --title "$title" \
+            --body "$body" \
+            "${label_args[@]}"
+        else
+          gh pr create \
+            --base "$BASE_BRANCH" \
+            --head "$branch" \
+            --title "$title" \
+            --body "$body"
+          pr_number="$(
+            gh pr list \
+              --state open \
+              --head "$branch" \
+              --json number \
+              --jq '.[0].number'
+          )"
+          if [ "${#label_args[@]}" -gt 0 ]; then
+            gh pr edit "$pr_number" "${label_args[@]}"
+          fi
+        fi
+
+        if [ "$AUTO_MERGE" = "true" ]; then
+          gh pr merge "$pr_number" --auto --squash ||
+            echo "::warning::Auto-merge could not be enabled; check the repository merge settings"
+        fi
+
+        pr_url="$(gh pr view "$pr_number" --json url --jq '.url')"
+        echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
+        echo "Pull request: $pr_url"

.github/workflows/nixos-ci.yml

@@ -0,0 +1,150 @@
+name: NixOS CI
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: nixos-ci-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  validate:
+    name: Validate flake
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+      - name: Check flake and evaluate all outputs
+        run: nix flake check --all-systems --no-build --show-trace
+      - name: Discover NixOS hosts
+        id: hosts
+        run: |
+          hosts=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=$hosts" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: $hosts"
+  build:
+    name: Build ${{ matrix.host }}
+    needs: validate
+    if: ${{ needs.validate.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.validate.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+      - name: Build NixOS system
+        run: |
+          nix build ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel" \
+            --no-link \
+            --print-build-logs \
+            --show-trace
+  report-main-status:
+    name: Report main status
+    needs:
+      - validate
+      - build
+    if: ${{ always() && !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    env:
+      CI_FAILED: ${{ needs.validate.result == 'failure' || needs.build.result == 'failure' }}
+      JOB_RESULTS: ${{ toJSON(needs) }}
+    steps:
+      - name: Create or resolve failure issue
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const title = "NixOS CI is failing on main";
+            const marker = "<!-- nixos-ci-main-failure -->";
+            const failed = process.env.CI_FAILED === "true";
+            const jobs = JSON.parse(process.env.JOB_RESULTS);
+            const failedJobs = Object.entries(jobs)
+              .filter(([, job]) => job.result === "failure")
+              .map(([name]) => `\`${name}\``)
+              .join(", ");
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const commitUrl = `${context.serverUrl}/${owner}/${repo}/commit/${context.sha}`;
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner,
+              repo,
+              state: "open",
+              per_page: 100,
+            });
+            const existing = issues.find(
+              (issue) => !issue.pull_request && issue.title === title && issue.body?.includes(marker),
+            );
+
+            if (failed) {
+              const body = [
+                marker,
+                "The NixOS CI workflow failed after a push to `main`.",
+                "",
+                `- Failed jobs: ${failedJobs || "unknown"}`,
+                `- Commit: [\`${context.sha.slice(0, 7)}\`](${commitUrl})`,
+                `- Workflow run: [${context.runId}](${runUrl})`,
+                "",
+                "This issue is updated on subsequent failures and closed automatically after CI recovers.",
+              ].join("\n");
+
+              if (existing) {
+                await github.rest.issues.update({
+                  owner,
+                  repo,
+                  issue_number: existing.number,
+                  body,
+                });
+              } else {
+                await github.rest.issues.create({ owner, repo, title, body });
+              }
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: existing.number,
+                body: `CI recovered in [workflow run ${context.runId}](${runUrl}).`,
+              });
+              await github.rest.issues.update({
+                owner,
+                repo,
+                issue_number: existing.number,
+                state: "closed",
+                state_reason: "completed",
+              });
+            }

.github/workflows/renovate.yml

@@ -0,0 +1,31 @@
+name: Renovate
+on:
+  schedule:
+    # Every day at 03:00 JST (18:00 UTC on the previous day).
+    - cron: "0 18 * * *"
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+jobs:
+  renovate:
+    name: Update GitHub Actions dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Use a PAT or GitHub App token so Renovate PRs trigger the other workflows.
+      - name: Run Renovate
+        uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200 # v46.1.20
+        with:
+          renovate-version: 43.262.1
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          LOG_LEVEL: info
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}

.github/workflows/update-flake-inputs.yml

@@ -0,0 +1,106 @@
+name: Update Flake Inputs
+on:
+  schedule:
+    # Every day at 03:30 JST (18:30 UTC on the previous day).
+    - cron: "30 18 * * *"
+  workflow_dispatch:
+    inputs:
+      input:
+        description: Update only this flake input (empty updates all inputs)
+        required: false
+        type: string
+      skip-delay:
+        description: Update to the latest revision without the three-day delay
+        required: false
+        default: false
+        type: boolean
+      auto-merge:
+        description: Enable auto-merge after required checks pass
+        required: false
+        default: true
+        type: boolean
+permissions:
+  contents: write
+  pull-requests: write
+concurrency:
+  group: update-flake-inputs
+  cancel-in-progress: false
+jobs:
+  discover:
+    name: Discover flake inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.inputs.outputs.matrix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build update matrix
+        id: inputs
+        env:
+          REQUESTED_INPUT: ${{ inputs.input }}
+        run: |
+          set -euo pipefail
+
+          github_inputs="$(
+            jq -c '
+              . as $lock
+              | [
+                  $lock.nodes.root.inputs
+                  | to_entries[]
+                  | .key as $name
+                  | (
+                      .value
+                      | if type == "array" then .[0] else . end
+                    ) as $node
+                  | select($lock.nodes[$node].locked.type == "github")
+                  | $name
+                ]
+              | sort
+            ' flake.lock
+          )"
+
+          if [ -n "$REQUESTED_INPUT" ]; then
+            if ! jq -e --arg input "$REQUESTED_INPUT" 'index($input) != null' <<< "$github_inputs" >/dev/null; then
+              echo "::error::Unknown or unsupported flake input: $REQUESTED_INPUT"
+              exit 1
+            fi
+            matrix="$(jq -cn --arg input "$REQUESTED_INPUT" '{input: [$input]}')"
+          else
+            matrix="$(jq -cn --argjson inputs "$github_inputs" '{input: $inputs}')"
+          fi
+
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          echo "Update matrix: $matrix"
+  update:
+    name: Update ${{ matrix.input }}
+    needs: discover
+    if: ${{ needs.discover.outputs.matrix != '{"input":[]}' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RENOVATE_TOKEN }}
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ secrets.RENOVATE_TOKEN }}
+      - name: Update input
+        uses: ./.github/actions/update-flake-input
+        with:
+          input-name: ${{ matrix.input }}
+          github-token: ${{ secrets.RENOVATE_TOKEN }}
+          skip-delay: ${{ github.event_name == 'workflow_dispatch' && inputs.skip-delay }}
+          auto-merge: ${{ github.event_name != 'workflow_dispatch' || inputs.auto-merge }}

.gitignore

@@ -4,7 +4,6 @@
 !README.md
 !LICENSE
 !AGENTS.md
-!/docs/
 
 !.github/
 !.gitea/
@@ -15,18 +14,15 @@
 
 !/flake.nix
 !/flake.lock
+!/renovate.json
+
+!shells/
+!hosts/
+!overlays/
+!profiles/
+!modules/
+!docs/
+!images/
+!secrets/
 
-!/shells/
 !/flake/
-!/overlays/
-
-!/images/
-!/secrets/
-
-!/hosts/
-
-!/libs/
-
-!/modules/
-
-!/tests/

README.md

@@ -1,3 +1,191 @@
-# moons14 dotfiles
+# dotfiles
 
-My NixOS + Home Manager configurations build with flake.
+My NixOS + Home Manager configurations built with flake-parts.
+
+## Overview
+
+- **OS**: NixOS 26.05 (stable) + nixpkgs-unstable
+- **Window Manager**: Niri (Wayland)
+- **Shell**: Zsh
+- **Terminal**: Ghostty
+- **Editor**: Neovim (nixvim), VSCode
+- **Launcher**: Vicinae
+- **Theme**: Stylix (Dracula)
+- **Secrets**: sops-nix + age + YubiKey
+
+## Hosts
+
+| Host          | Description     | Profiles                                     |
+| ------------- | --------------- | -------------------------------------------- |
+| `x1g13`       | ThinkPad laptop | gui, thinkpad, dev, personal, secure-storage |
+| `nix-example` | VM              | cli-interactive, vm, dev, remote             |
+| `installer`   | NixOS installer | (standalone)                                 |
+
+## Directory Structure
+
+```
+.
+├── flake.nix              # Flake inputs and outputs
+├── flake/
+│   ├── formatter.nix      # treefmt configuration (nixfmt, deadnix, statix, etc.)
+│   └── git-hooks.nix      # pre-commit hooks
+├── hosts/
+│   ├── default.nix        # mkSystem helper and host definitions
+│   ├── x1g13/             # ThinkPad host config
+│   ├── nix-example/       # VM host config
+│   └── installer/         # Installer ISO config
+├── modules/
+│   ├── applications/      # Application configs (NixOS + Home Manager)
+│   │   ├── niri/          # Wayland compositor
+│   │   ├── ghostty/       # Terminal emulator
+│   │   ├── vim/           # Neovim (nixvim)
+│   │   ├── vscode/        # VSCode
+│   │   ├── zsh/           # Shell
+│   │   ├── zellij/        # Terminal multiplexer
+│   │   ├── git/           # Git config
+│   │   ├── docker.nix     # Container runtime
+│   │   ├── tailscale.nix  # VPN
+│   │   ├── claude/        # Claude Code
+│   │   ├── opencode.nix   # OpenCode
+│   │   └── ...            # chrome, discord, zoom, slack, etc.
+│   ├── system/            # NixOS system configs
+│   │   ├── audio.nix      # PipeWire
+│   │   ├── boot/          # Bootloader (systemd-boot, lanzaboote)
+│   │   ├── disko.nix      # Disk partitioning
+│   │   ├── fonts.nix      # Fonts
+│   │   ├── network/       # Networking
+│   │   ├── sops.nix       # Secrets management
+│   │   ├── user/          # User accounts
+│   │   └── ...
+│   ├── features/          # Feature bundles (abstraction layer)
+│   │   ├── application/   # browser, communication
+│   │   ├── boot/          # UEFI
+│   │   ├── cli/           # base, interactive, shell
+│   │   ├── connect/       # WiFi, Bluetooth
+│   │   ├── dev/           # agent, nix, python, bun, java, arduino
+│   │   ├── gui/           # desktop, terminal, audio, editor, capture
+│   │   ├── identity/      # SSH key, fingerprint
+│   │   ├── network/       # Tailscale
+│   │   ├── services/      # container, KDE
+│   │   └── storage/       # disko
+│   ├── drivers/           # Hardware drivers (Intel)
+│   └── integrations/      # Home Manager integration
+├── profiles/
+│   ├── interfaces/        # cli-minimal, cli-interactive, gui
+│   ├── platforms/         # desktop, laptop, thinkpad, vm
+│   └── workloads/         # dev, personal, srv, remote, secure-storage
+├── overlays/              # nixpkgs overlays
+├── shells/                # devShells (pre-commit hooks, sops, age)
+├── secrets/               # Encrypted secrets (sops)
+└── docs/                  # Documentation
+```
+
+## Architecture
+
+```
+profile (enable features)
+  → features (bundle applications/system + add packages)
+    → applications (system.nix + home.nix)
+    → system (NixOS config)
+```
+
+### Module Patterns
+
+**Simple Module** — Single file for NixOS-only or Home Manager-only configs:
+
+```nix
+{ lib, config, ... }:
+let cfg = config.my.system.audio;
+in {
+  options.my.system.audio.enable = lib.mkEnableOption "Audio";
+  config = lib.mkIf cfg.enable { ... };
+}
+```
+
+**Complex Module** — Directory with `default.nix`, `system.nix`, `home.nix`:
+
+```
+modules/applications/<app>/
+├── default.nix    # Master enable + imports
+├── system.nix     # NixOS config
+└── home.nix       # Home Manager config (sharedModules)
+```
+
+**Feature Module** — Bundles multiple applications/system modules:
+
+```nix
+{ lib, config, ... }:
+let cfg = config.my.features.gui.desktop;
+in {
+  options.my.features.gui.desktop.enable = lib.mkEnableOption "Desktop";
+  config = lib.mkIf cfg.enable {
+    my.applications = { niri.enable = true; gtk.enable = true; ... };
+  };
+}
+```
+
+**Profile** — Thin layer that only enables features:
+
+```nix
+{
+  my.features = {
+    gui.desktop.enable = true;
+    dev.agent.enable = true;
+  };
+}
+```
+
+## Packages
+
+### CLI
+
+- **Shell**: Zsh with zoxide, direnv
+- **Terminal multiplexer**: Zellij
+- **Editor**: Neovim (nixvim)
+- **Tools**: ripgrep, curl, wget, htop, btop, fastfetch, unzip, unrar
+
+### GUI
+
+- **Compositor**: Niri
+- **Terminal**: Ghostty, Alacritty
+- **Editor**: VSCode
+- **Browser**: Chrome
+- **Launcher**: Vicinae
+- **File manager**: Nautilus
+- **Communication**: Discord, Zoom, Slack
+
+### Development
+
+- **AI agents**: Claude Code, Codex, OpenCode, Grok
+- **Languages**: Python, Bun (JavaScript/TypeScript), Java, Arduino
+- **Container**: Docker
+- **Nix**: nh, nixfmt, deadnix, statix
+
+### System
+
+- **VPN**: Tailscale
+- **Secrets**: sops-nix, age
+- **Boot**: systemd-boot, lanzaboote (Secure Boot)
+- **Disk**: disko
+- **Theme**: Stylix
+
+## Commands
+
+```sh
+nix flake update                           # Update flake inputs
+nix fmt                                    # Format code
+nix develop .#dotnix                       # Enter dev shell
+sudo nixos-rebuild switch --flake .#<host> # Apply config
+sudo nixos-rebuild build --flake .#<host>  # Build without applying
+```
+
+## Inspired
+
+- [Zaney/zaneyos](https://gitlab.com/Zaney/zaneyos)
+- [fa0311/.zshrc](https://gist.github.com/fa0311/d37d53ff39c73c54c883379e8e3732df)
+- [AsianLovesLinux/Niri](https://github.com/AsianLovesLinux/Niri)
+- [natsukium/dotfiles](https://github.com/natsukium/dotfiles)
+- [dracula](https://github.com/dracula)
+- [akazdayo/nix-configs](https://github.com/akazdayo/nix-configs)
+- [yutakobayashidev/dotnix](https://github.com/yutakobayashidev/dotnix)
+- [kawaemon/dotfiles](https://github.com/kawaemon/dotfiles)

flake.lock

@@ -107,11 +107,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1785087211,
+        "lastModified": 1784823421,
-        "narHash": "sha256-lmIZA1LPcCB7vPagN3lS5mcSwVgN5GAvOxHS7CjqWzI=",
+        "narHash": "sha256-/EM7Cr2Ai0VjNbKv+eIW0+iXT/NBW6WbPkCbf9w+u/o=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "bc7b92cf38c74b49dbff568257542eabbc62cf55",
+        "rev": "efcf40b5ab41323c8fa8eef5526c6a50c45fd8cd",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         "zon2nix": "zon2nix"
       },
       "locked": {
-        "lastModified": 1785080636,
+        "lastModified": 1784994897,
-        "narHash": "sha256-ACiF5qaL4yiLSMesIPi4+4Aftw5QiMSR2qzp+5hlMvo=",
+        "narHash": "sha256-JYe8CS+vFY63dE1yYXKgO8a2D7Rt4Wi4JsS7rxamZRE=",
         "owner": "moons-14",
         "repo": "ghostty",
-        "rev": "f11e5199a6bd2a2e1a536d3c225a7d9a39827ea4",
+        "rev": "66fed652a148cda9d8ea90b1b34ae9768871dbd9",
         "type": "github"
       },
       "original": {
@@ -469,6 +469,27 @@
         "type": "github"
       }
     },
+    "home-manager_3": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-hazkey",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778444552,
+        "narHash": "sha256-f18pIiR9q/p1vHY93gmAum7aHhQOG49oGvAB9+lptRo=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "dcebe66f958673729896eec2de4abfd86ef22d21",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
@@ -501,11 +522,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785094920,
+        "lastModified": 1784838505,
-        "narHash": "sha256-RPhNusC9jaFUkdgb6COZofPz1QLqmm8k2k9Wh7KcQII=",
+        "narHash": "sha256-v9wgz4KSm259C+Yb9/Y/tPyylXto/bTyOQyiV599Ads=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "56dea2a2de7d50461c502db975e766c2c2d71e84",
+        "rev": "b358b1d5b458d6bd9814d02b70fcd3c0cd61886f",
         "type": "github"
       },
       "original": {
@@ -570,24 +591,24 @@
         "type": "github"
       }
     },
-    "nix-darwin": {
+    "nix-hazkey": {
       "inputs": {
+        "home-manager": "home-manager_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1783744694,
+        "lastModified": 1779529080,
-        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
+        "narHash": "sha256-CHa5L3I71NbPUNJp1gmmwbh91tKsZPyuRK50mLHjAVY=",
-        "owner": "nix-darwin",
+        "owner": "aster-void",
-        "repo": "nix-darwin",
+        "repo": "nix-hazkey",
-        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
+        "rev": "24cb2926666836988e78ceebeb67ad6c5a387ac3",
         "type": "github"
       },
       "original": {
-        "owner": "nix-darwin",
+        "owner": "aster-void",
-        "ref": "nix-darwin-26.05",
+        "repo": "nix-hazkey",
-        "repo": "nix-darwin",
         "type": "github"
       }
     },
@@ -598,11 +619,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785046085,
+        "lastModified": 1784440659,
-        "narHash": "sha256-UiK+mmZJuLWQVhJ5b2wDzogIYWAesyRm6LA3h3Ulh3Y=",
+        "narHash": "sha256-Q5kNLlWngt7TaIIZoxDKWMHjiSaNRVqr70FqWCRRfr4=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "11665045df8b9938ef811a3bfdc65cffb02b4b70",
+        "rev": "4f8d52a3598b0dc7db7a5e7b419e3edd9d1ecfdb",
         "type": "github"
       },
       "original": {
@@ -714,11 +735,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1784963784,
+        "lastModified": 1784835677,
-        "narHash": "sha256-IZAjgNI19TdwYus6QUIMvU0cw0vWVb/5oYwpyxQXL1E=",
+        "narHash": "sha256-99n/+kX5HRtEouTsNNyz5pMfIpNMp4Um/6nCEDQ9YDs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "38affae6a5768f9b61f81355c7558ee971b2afb1",
+        "rev": "d4221905ef70b7f4a40701ce98e3e25c3d95d082",
         "type": "github"
       },
       "original": {
@@ -729,22 +750,6 @@
       }
     },
     "nixpkgs_10": {
-      "locked": {
-        "lastModified": 1770107345,
-        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_11": {
       "locked": {
         "lastModified": 1772542754,
         "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
@@ -760,7 +765,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_12": {
+    "nixpkgs_11": {
       "locked": {
         "lastModified": 1778869304,
         "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
@@ -807,11 +812,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1784872115,
+        "lastModified": 1784555310,
-        "narHash": "sha256-THPEF2po0fsoH8gNtp+Ae0XFDJH3N/ol7xO3v6VMTJU=",
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "335f0738cb2fa9708f3f428e39d2eae975d1338d",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
         "type": "github"
       },
       "original": {
@@ -868,11 +873,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1784856561,
+        "lastModified": 1784923315,
-        "narHash": "sha256-J+Bx1Z6Oeoj2FgnBhRMKyUhhtDoOpTgXYaVLZpDjW4A=",
+        "narHash": "sha256-2e5BnQ0YLJMIRII1BdGsLiBcJ1fRVauvZypwZIR2JLw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "597283ad8aa0b331c788e97c4c262d58877074ef",
+        "rev": "d2f1d98be0573ebf42b96630bc8d7001ff62af43",
         "type": "github"
       },
       "original": {
@@ -884,15 +889,18 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1784796856,
+        "lastModified": 1770107345,
-        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "owner": "nixos",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "nixos",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixvim": {
@@ -920,19 +928,20 @@
     },
     "noctalia": {
       "inputs": {
-        "nixpkgs": "nixpkgs_9"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1785150509,
+        "lastModified": 1784917398,
-        "narHash": "sha256-9YohBD2ceAWQYoT/1/QZIuaqi99hgbiUgBWyV3z6/xM=",
+        "narHash": "sha256-lBVMJgBWbC3H6UGlCYiu8pbgUJqWWyJ70n/xIljk/1I=",
         "owner": "noctalia-dev",
         "repo": "noctalia",
-        "rev": "cf5c9a28fc27facf42309a558c075259e512ba66",
+        "rev": "0cd9b22e19fb71455c950a70c11324b7e245a790",
         "type": "github"
       },
       "original": {
         "owner": "noctalia-dev",
-        "ref": "cachix",
         "repo": "noctalia",
         "type": "github"
       }
@@ -995,7 +1004,7 @@
         "lanzaboote": "lanzaboote",
         "llm-agents": "llm-agents",
         "niri-flake": "niri-flake",
-        "nix-darwin": "nix-darwin",
+        "nix-hazkey": "nix-hazkey",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixos-wsl": "nixos-wsl",
@@ -1070,7 +1079,7 @@
     },
     "soulver-cpp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_12",
+        "nixpkgs": "nixpkgs_11",
         "nixpkgs-libxml2": "nixpkgs-libxml2"
       },
       "locked": {
@@ -1198,16 +1207,16 @@
     },
     "systems_6": {
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1689347949,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
         "owner": "nix-systems",
-        "repo": "default",
+        "repo": "default-linux",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default",
+        "repo": "default-linux",
         "type": "github"
       }
     },
@@ -1328,7 +1337,7 @@
     },
     "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
         "lastModified": 1784369104,
@@ -1346,16 +1355,16 @@
     },
     "vicinae": {
       "inputs": {
-        "nixpkgs": "nixpkgs_11",
+        "nixpkgs": "nixpkgs_10",
         "soulver-cpp": "soulver-cpp",
         "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1785027961,
+        "lastModified": 1784839524,
-        "narHash": "sha256-F8yaTqRGGKzl5QTtMM+4I2zUCpOq4or7zuzTmXSiTMA=",
+        "narHash": "sha256-B87U5HDB/6JPxSnNQwnIiwtqUWvyxzqs7lV/GPzva68=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "65c973b55df4b8f9a80e1663feeca570e3bf016c",
+        "rev": "632ca79e9f8fc9721384921f28ec069ff48aaf53",
         "type": "github"
       },
       "original": {
@@ -1374,11 +1383,11 @@
         "vicinae": "vicinae_2"
       },
       "locked": {
-        "lastModified": 1785084836,
+        "lastModified": 1784504910,
-        "narHash": "sha256-iww/OcxGK8isAgNh8k4E1IJkR5bGUvEK/K+q86g2ISk=",
+        "narHash": "sha256-fzPBEJZiRvc/FNMdpbdcfaZzF01U4IQenHW9IQFzhos=",
         "owner": "vicinaehq",
         "repo": "extensions",
-        "rev": "2d5176bcb19498ff862ca1caa5eb97f03f60faac",
+        "rev": "ca74eede9a778a9373c8f5fd221b0a5026dcd1ef",
         "type": "github"
       },
       "original": {

flake.nix

@@ -11,11 +11,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    nix-darwin = {
-      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # Hardware / Platform
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     nixos-wsl.url = "github:nix-community/NixOS-WSL";
@@ -41,7 +36,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    noctalia.url = "github:noctalia-dev/noctalia/cachix";
+    noctalia = {
+      url = "github:noctalia-dev/noctalia";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # Editor
     nixvim = {
@@ -93,7 +91,13 @@
     };
 
     # Systems
-    systems.url = "github:nix-systems/default";
+    systems.url = "github:nix-systems/default-linux";
+
+    # Japanese Input Method
+    nix-hazkey = {
+      url = "github:aster-void/nix-hazkey";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -107,8 +111,10 @@
 
       imports = [
         ./overlays
+        ./hosts
         ./shells
-        ./flake
+        ./flake/formatter.nix
+        ./flake/git-hooks.nix
       ];
     };
 }

flake/default.nix

@@ -1,7 +0,0 @@
-{
-  imports = [
-    ./formatter.nix
-    ./git-hooks.nix
-    ./registry.nix
-  ];
-}

flake/registry.nix

@@ -1,54 +0,0 @@
-{
-  inputs,
-  lib,
-  ...
-}:
-let
-  dotfilesLib = import ../libs {
-    inherit inputs lib;
-    root = ../.;
-  };
-  hostSpecsPath = ../hosts/default.nix;
-  hostSpecs =
-    if builtins.pathExists hostSpecsPath then
-      let
-        value = import hostSpecsPath;
-      in
-      if builtins.isFunction value then
-        value (
-          builtins.intersectAttrs (builtins.functionArgs value) {
-            inherit inputs lib;
-          }
-        )
-      else
-        value
-    else
-      { };
-  configurations = dotfilesLib.hosts.mkConfigurations hostSpecs;
-in
-{
-  flake = {
-    inherit (configurations) darwinConfigurations nixosConfigurations;
-    lib = dotfilesLib;
-  };
-
-  perSystem =
-    { pkgs, system, ... }:
-    let
-      nixosChecks =
-        lib.mapAttrs' (name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel)
-          (
-            lib.filterAttrs (
-              _: nixos: nixos.pkgs.stdenv.hostPlatform.system == system
-            ) configurations.nixosConfigurations
-          );
-    in
-    {
-      checks = {
-        registry = import ../tests/registry.nix {
-          inherit inputs lib pkgs;
-        };
-      }
-      // nixosChecks;
-    };
-}

hosts/default.nix

@@ -1,58 +1,113 @@
 {
-  x1g9 = {
+  inputs,
-    system = "x86_64-linux";
+  config,
-    stateVersion = "26.05";
+  lib,
-    user = "moons";
+  ...
-    path = ./x1g9;
+}:
+let
+  inherit (inputs.nixpkgs.lib) nixosSystem;
 
-    profiles = [
+  username = "moons";
-      "base"
+
-      "interface.cli"
+  mkSystem =
-      "interface.gnome"
+    {
-      "interface.niri"
+      host,
-      "platform.thinkpad-x1"
+      system,
-      "security.fingerprint"
+      profiles ? [ ],
-      # "security.secrets"
+      extraModules ? [ ],
-      "workload.personal"
+    }:
-    ];
+    let
+      unstable = import inputs.nixpkgs-unstable {
+        inherit system;
+        config = {
+          allowUnfree = true;
+        };
+      };
+    in
+    assert lib.assertMsg (lib.elem system config.systems)
+      "mkSystem: system '${system}' not in valid systems: ${lib.generators.toPretty { } config.systems}";
+    nixosSystem {
+      inherit system;
+      modules = [
+        {
+          nixpkgs.config.allowUnfree = true;
+          nixpkgs.overlays = builtins.attrValues inputs.self.overlays;
+        }
+        ../modules
+        ./${host}/default.nix
+      ]
+      ++ map (p: ../profiles/${p}.nix) profiles
+      ++ extraModules;
+      specialArgs = {
+        inherit
+          inputs
+          username
+          unstable
+          host
+          ;
+      };
+    };
+
+  nixosConfigurations = {
+    nix-example = mkSystem {
+      host = "nix-example";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/cli-interactive"
+        "platforms/vm"
+        "workloads/dev"
+        "workloads/remote"
+      ];
+    };
+    ops = mkSystem {
+      host = "ops";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/cli-interactive"
+        "platforms/vm"
+        "workloads/remote"
+      ];
+    };
+
+    internal-app-01 = mkSystem {
+      host = "internal-app-01";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/cli-interactive"
+        "platforms/vm"
+        "workloads/srv"
+      ];
+    };
+    x1g13 = mkSystem {
+      host = "x1g13";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/gui"
+        "platforms/thinkpad"
+        "workloads/dev"
+        "workloads/personal"
+        "workloads/secure-storage"
+        "workloads/tailscale/client"
+      ];
+    };
+
+    installer = nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        ./installer/default.nix
+      ];
+      specialArgs = {
+        inherit inputs;
+      };
+    };
   };
+in
+{
+  flake = {
+    inherit nixosConfigurations;
 
-  x1g13 = {
+    checks.x86_64-linux = lib.mapAttrs' (
-    system = "x86_64-linux";
+      name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel
-    stateVersion = "26.05";
+    ) nixosConfigurations;
-    user = "moons";
-    path = ./x1g13;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.gnome"
-      "interface.niri"
-      "networking.tailscale-client"
-      "platform.thinkpad-x1"
-      "security.fingerprint"
-      "security.secrets"
-      "security.secure-boot"
-      "security.tpm-storage"
-      "workload.development"
-      "workload.personal"
-    ];
-  };
-
-  m2 = {
-    system = "aarch64-darwin";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./m2;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.macos"
-      "security.fingerprint"
-      # "security.secrets"
-      "workload.development"
-      "workload.personal"
-    ];
   };
 }

hosts/installer/default.nix

@@ -0,0 +1,193 @@
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+  ];
+
+  boot.zfs.forceImportRoot = false;
+
+  networking = {
+    hostName = "nixos-installer";
+
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PubkeyAuthentication = "yes";
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKhxDkucmeCor6CKoXAua7DgDSzuXrZOtpdkyzQxz5+aAAAABHNzaDo= moons@moons14.com"
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN6hZJyng/5LgFKPjR6uZAd/00UkO0vN0uQOoIvfSELdAAAABHNzaDo= moons@moons14.com"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    git # Clone dotfiles repository
+    disko # Disk partitioning
+    sops # Secrets management
+    age # Age encryption
+    ssh-to-age # Convert SSH keys to age
+    age-plugin-yubikey # YubiKey support
+    yubikey-manager # YubiKey management
+    pcsc-tools # Smart card tools
+    mkpasswd # Password hash generation
+    rsync # File synchronization
+    vim # Text editor
+    wget # Download files
+    curl # HTTP client
+    jq # JSON processor
+    parted # Partition tools
+    cryptsetup # LUKS encryption
+    btrfs-progs # Btrfs filesystem tools
+  ];
+
+  services.pcscd.enable = true;
+
+  environment.etc."installer-help.txt".text = ''
+
+    ╔══════════════════════════════════════════════════════════════╗
+    ║                    NixOS Installer ISO                       ║
+    ╠══════════════════════════════════════════════════════════════╣
+    ║                                                              ║
+    ║  SSH Access:                                                 ║
+    ║    ssh root@<ip-address>                                     ║
+    ║                                                              ║
+    ║  Network Setup:                                              ║
+    ║    Wired:   Auto-configured via DHCP                         ║
+    ║    WiFi:    nmcli device wifi connect <SSID> --ask           ║
+    ║                                                              ║
+    ║  Installation Workflow:                                      ║
+    ║                                                              ║
+    ║  1. Clone dotfiles:                                          ║
+    ║     git clone git@github.com:moons-14/dotfiles.git ~/dotfiles║
+    ║                                                              ║
+    ║  2. Generate SSH host key for new host:                      ║
+    ║     ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" ║
+    ║                                                              ║
+    ║  3. Get age public key from SSH host key:                    ║
+    ║     ssh-to-age -i /tmp/ssh_host_ed25519_key.pub              ║
+    ║                                                              ║
+    ║  4. Add age key to .sops.yaml:                               ║
+    ║     cd ~/dotfiles                                            ║
+    ║     # Edit .sops.yaml and add the age key                    ║
+    ║     # Add new host entry to creation_rules                   ║
+    ║                                                              ║
+    ║  5. Re-encrypt secrets:                                      ║
+    ║     sops updatekeys secrets/common/system.yaml               ║
+    ║     sops updatekeys secrets/hosts/<host>/*.yaml              ║
+    ║                                                              ║
+    ║  6. Create disko.nix for new host:                           ║
+    ║     # Check disk devices                                     ║
+    ║     lsblk -f                                                 ║
+    ║                                                              ║
+    ║     # Create hosts/<host>/disko.nix                          ║
+    ║     # Example: LUKS + btrfs                                  ║
+    ║     # See hosts/x1g13/disko.nix for reference                ║
+    ║                                                              ║
+    ║  7. Partition disk with disko:                               ║
+    ║     nix run github:nix-community/disko -- \                  ║
+    ║       --mode disko hosts/<host>/disko.nix                    ║
+    ║                                                              ║
+    ║  8. Copy host key to installed system:                       ║
+    ║     mkdir -p /mnt/etc/ssh                                    ║
+    ║     cp /tmp/ssh_host_ed25519_key* /mnt/etc/ssh/              ║
+    ║     chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key              ║
+    ║                                                              ║
+    ║  9. Install NixOS:                                           ║
+    ║     nixos-install --flake ~/dotfiles#<host>                  ║
+    ║                                                              ║
+    ║  Disko Configuration Examples:                               ║
+    ║                                                              ║
+    ║  Simple (no encryption):                                     ║
+    ║    disko.devices.disk.main = {                               ║
+    ║      type = "disk";                                          ║
+    ║      device = "/dev/sda";                                    ║
+    ║      content = {                                             ║
+    ║        type = "gpt";                                         ║
+    ║        partitions = {                                        ║
+    ║          ESP = { size = "512M"; type = "EF00";              ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "vfat"; mountpoint = "/boot"; }; };   ║
+    ║          root = { size = "100%";                             ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "ext4"; mountpoint = "/"; }; };       ║
+    ║        };                                                    ║
+    ║      };                                                      ║
+    ║    };                                                        ║
+    ║                                                              ║
+    ║  LUKS + btrfs (see hosts/x1g13/disko.nix):                  ║
+    ║    - Use partuuid for device path                            ║
+    ║    - Set askPassword = true for LUKS                         ║
+    ║    - Configure btrfs subvolumes                              ║
+    ║                                                              ║
+    ╚══════════════════════════════════════════════════════════════╝
+
+  '';
+
+  systemd.services.installer-banner = {
+    description = "Display installer help on console";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.coreutils}/bin/cat /etc/installer-help.txt";
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  systemd.services.display-ip = {
+    description = "Display IP address on console";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "display-ip" ''
+        sleep 2
+        echo ""
+        echo "=== Network Interfaces ==="
+        ${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep inet
+        echo ""
+        echo "=== SSH Access ==="
+        for ip in $(${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep -oP 'inet \K[\d.]+' | ${pkgs.gnugrep}/bin/grep -v '127.0.0.1'); do
+          echo "  ssh root@$ip"
+        done
+        echo ""
+      '';
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [ "root" ];
+    };
+
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  system.stateVersion = "26.05";
+}

hosts/internal-app-01/default.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   imports = [
     ./hardware-configuration.nix

hosts/internal-app-01/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/8365-C778";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/m2/darwin.nix

@@ -1,10 +0,0 @@
-{ hostName, ... }:
-{
-  # networking.hostName and networking.localHostName are derived from the
-  # registry name; computerName controls the user-visible macOS name.
-  networking.computerName = hostName;
-
-  # Keep this value stable after the first activation. It is independent of
-  # the Home Manager stateVersion in hosts/default.nix.
-  system.stateVersion = 7;
-}

hosts/nix-example/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+}

hosts/nix-example/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/8f0eaec6-5dc9-4821-aa8d-fb6809b5a5bf";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/201C-961B";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/ops/default.nix

@@ -0,0 +1,56 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  networking = {
+    useDHCP = false;
+
+    interfaces = {
+      ens18 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.128.20";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens19 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.7.101";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens20 = {
+        useDHCP = false;
+        ipv4.routes = [
+          {
+            address = "10.50.64.0";
+            prefixLength = 24;
+            via = "10.50.82.1";
+          }
+        ];
+        ipv4.addresses = [
+          {
+            address = "10.50.82.10";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+    };
+
+    defaultGateway = {
+      address = "10.50.128.1";
+      interface = "ens18";
+    };
+
+  };
+}

hosts/ops/hardware-configuration.nix

@@ -0,0 +1,44 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/69fa2193-1e4f-438a-8898-5de8a3f36e5b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D09B-4277";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/x1g13/default.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   imports = [
     ./hardware-configuration.nix

hosts/x1g13/disko.nix

@@ -1,6 +1,7 @@
 _:
 let
   espPart = "/dev/disk/by-partuuid/a53e3b19-67de-40de-9ded-3eac3117689a";
+
   nixosPart = "/dev/disk/by-partuuid/311d0f9c-f35f-42e6-b6fc-a4d67dd21b2e";
 
   btrfsMountOptions = [
@@ -23,7 +24,9 @@ in
         type = "filesystem";
         format = "vfat";
         mountpoint = "/boot";
-        mountOptions = [ "umask=0077" ];
+        mountOptions = [
+          "umask=0077"
+        ];
       };
     };
 
@@ -35,8 +38,12 @@ in
       content = {
         type = "luks";
         name = "cryptroot";
+
         askPassword = true;
-        settings.allowDiscards = true;
+
+        settings = {
+          allowDiscards = true;
+        };
 
         extraFormatArgs = [
           "--type"
@@ -78,7 +85,10 @@ in
 
             "@swap" = {
               mountpoint = "/.swapvol";
-              mountOptions = [ "noatime" ];
+              mountOptions = [
+                "noatime"
+              ];
+
               swap.swapfile.size = "32G";
             };
           };

hosts/x1g13/hardware-configuration.nix

@@ -1,5 +1,6 @@
-# Do not modify this file! It was generated by `nixos-generate-config`
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations. Make changes in nixos.nix.
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,

hosts/x1g13/home.nix

@@ -1,9 +0,0 @@
-{
-  programs.niri.settings.outputs."eDP-1" = {
-    scale = 1.2;
-    position = {
-      x = 0;
-      y = 0;
-    };
-  };
-}

hosts/x1g9/hardware-configuration.nix

@@ -1,52 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "thunderbolt"
-    "nvme"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/16b29578-6836-414b-a5e1-863bc21c5fc3";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/209A-C8C9";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

libs/default.nix

@@ -1,17 +0,0 @@
-{
-  inputs,
-  lib ? inputs.nixpkgs.lib,
-  root,
-}:
-let
-  registry = import ./registry.nix {
-    inherit inputs lib;
-    modulesRoot = root + "/modules";
-  };
-  hosts = import ./hosts.nix {
-    inherit inputs lib registry;
-  };
-in
-{
-  inherit hosts registry;
-}

libs/hosts.nix

@@ -1,185 +0,0 @@
-{
-  inputs,
-  lib,
-  registry,
-}:
-let
-  ensure =
-    condition: message: value:
-    if condition then value else throw "host registry: ${message}";
-
-  isLinux = system: lib.hasSuffix "-linux" system;
-  isDarwin = system: lib.hasSuffix "-darwin" system;
-
-  hostFile =
-    spec: name:
-    let
-      path = spec.path + "/${name}";
-    in
-    if builtins.pathExists path then path else null;
-
-  selectedUnits =
-    spec:
-    [ "users.${spec.user}" ]
-    ++ map (name: "profiles.${name}") (spec.profiles or [ ])
-    ++ map (name: "applications.${name}") (spec.applications or [ ])
-    ++ (spec.units or [ ]);
-
-  validateSpec =
-    name: spec:
-    ensure (builtins.isAttrs spec) "${name}: host specification must be an attribute set" (
-      ensure (spec ? system && builtins.isString spec.system) "${name}: system is required" (
-        ensure (isLinux spec.system || isDarwin spec.system)
-          "${name}: unsupported system '${spec.system}'; expected a Linux NixOS or Darwin system"
-          (
-            ensure (spec ? user && builtins.isString spec.user && spec.user != "") "${name}: user is required" (
-              ensure (spec ? path && builtins.pathExists spec.path)
-                "${name}: path must name an existing host directory"
-                (
-                  ensure
-                    (
-                      spec ? stateVersion
-                      && builtins.isString spec.stateVersion
-                      && builtins.match "[0-9][0-9]\\.[0-9][0-9]" spec.stateVersion != null
-                    )
-                    "${name}: stateVersion is required and must have the form YY.MM"
-                    (
-                      ensure
-                        (lib.all
-                          (field: builtins.isList (spec.${field} or [ ]) && lib.all builtins.isString (spec.${field} or [ ]))
-                          [
-                            "profiles"
-                            "applications"
-                            "units"
-                          ]
-                        )
-                        "${name}: profiles, applications, and units must be lists of strings"
-                        (ensure (builtins.isBool (spec.homeManager or true)) "${name}: homeManager must be a boolean" spec)
-                    )
-                )
-            )
-          )
-      )
-    );
-
-  mkSpecialArgs = name: spec: {
-    inherit inputs registry;
-    inherit (spec) system;
-    hostName = name;
-    primaryUser = spec.user;
-  };
-
-  mkHomeManagerModule =
-    name: spec: selected:
-    let
-      homePath = hostFile spec "home.nix";
-      homeModules = [
-        (registry.mkModule { class = "home"; })
-        (registry.mkSelectionModule selected)
-        { home.stateVersion = spec.stateVersion; }
-      ]
-      ++ lib.optional (homePath != null) homePath;
-    in
-    {
-      imports = [ inputs.home-manager.nixosModules.home-manager ];
-
-      home-manager = {
-        useGlobalPkgs = true;
-        useUserPackages = true;
-        extraSpecialArgs = mkSpecialArgs name spec;
-        users.${spec.user}.imports = homeModules;
-      };
-    };
-
-  mkDarwinHomeManagerModule =
-    name: spec: selected:
-    let
-      homePath = hostFile spec "home.nix";
-      homeModules = [
-        (registry.mkModule { class = "home"; })
-        (registry.mkSelectionModule selected)
-        { home.stateVersion = spec.stateVersion; }
-      ]
-      ++ lib.optional (homePath != null) homePath;
-    in
-    {
-      imports = [ inputs.home-manager.darwinModules.home-manager ];
-
-      home-manager = {
-        useGlobalPkgs = true;
-        useUserPackages = true;
-        extraSpecialArgs = mkSpecialArgs name spec;
-        users.${spec.user}.imports = homeModules;
-      };
-    };
-
-  mkNixos =
-    name: rawSpec:
-    let
-      spec = validateSpec name rawSpec;
-      selected = registry.validateUnitIds (selectedUnits spec);
-      nixosPath = hostFile spec "nixos.nix";
-      modules = [
-        (registry.mkModule { class = "nixos"; })
-        (registry.mkSelectionModule selected)
-        {
-          networking.hostName = lib.mkDefault name;
-          system.stateVersion = spec.stateVersion;
-        }
-      ]
-      ++ lib.optional (spec.homeManager or true) (mkHomeManagerModule name spec selected)
-      ++ lib.optional (nixosPath != null) nixosPath;
-    in
-    inputs.nixpkgs.lib.nixosSystem {
-      inherit (spec) system;
-      specialArgs = mkSpecialArgs name spec;
-      inherit modules;
-    };
-
-  mkDarwin =
-    name: rawSpec:
-    let
-      spec = validateSpec name rawSpec;
-      selected = registry.validateUnitIds (selectedUnits spec);
-      darwinPath = hostFile spec "darwin.nix";
-      modules = [
-        (registry.mkModule { class = "darwin"; })
-        (registry.mkSelectionModule selected)
-        {
-          networking.hostName = lib.mkDefault name;
-          system.primaryUser = lib.mkDefault spec.user;
-        }
-      ]
-      ++ lib.optional (spec.homeManager or true) (mkDarwinHomeManagerModule name spec selected)
-      ++ lib.optional (darwinPath != null) darwinPath;
-    in
-    ensure (inputs ? nix-darwin) "${name}: the nix-darwin input is required" (
-      inputs.nix-darwin.lib.darwinSystem {
-        inherit (spec) system;
-        specialArgs = mkSpecialArgs name spec;
-        inherit modules;
-      }
-    );
-
-  mkConfigurations =
-    hostSpecs:
-    let
-      validated = lib.mapAttrs validateSpec hostSpecs;
-    in
-    {
-      nixosConfigurations = lib.mapAttrs mkNixos (
-        lib.filterAttrs (_: spec: isLinux spec.system) validated
-      );
-      darwinConfigurations = lib.mapAttrs mkDarwin (
-        lib.filterAttrs (_: spec: isDarwin spec.system) validated
-      );
-    };
-in
-{
-  inherit
-    mkConfigurations
-    mkDarwin
-    mkNixos
-    selectedUnits
-    ;
-}

libs/registry.nix

@@ -1,324 +0,0 @@
-{
-  inputs,
-  lib,
-  modulesRoot,
-}:
-let
-  reservedFiles = {
-    common = "common.nix";
-    nixos = "nixos.nix";
-    darwin = "darwin.nix";
-    home = "home.nix";
-    meta = "meta.nix";
-  };
-
-  isFile = kind: kind == "regular" || kind == "symlink";
-
-  ensure =
-    condition: message: value:
-    if condition then value else throw "unit registry: ${message}";
-
-  callWithAvailableArgs =
-    value: availableArgs:
-    if builtins.isFunction value then
-      value (builtins.intersectAttrs (builtins.functionArgs value) availableArgs)
-    else
-      value;
-
-  pathFor =
-    relativePath:
-    if relativePath == [ ] then
-      modulesRoot
-    else
-      modulesRoot + "/${lib.concatStringsSep "/" relativePath}";
-
-  entryIsFile = entries: name: builtins.hasAttr name entries && isFile entries.${name};
-
-  normalizeMeta =
-    unit:
-    let
-      metaPath = unit.fragments.meta;
-      importedValue =
-        if metaPath == null then
-          { }
-        else
-          callWithAvailableArgs (import metaPath) {
-            inherit inputs lib unit;
-          };
-      imported =
-        ensure (builtins.isAttrs importedValue) "${unit.id}: meta.nix must return an attribute set"
-          importedValue;
-      allowedKeys = [
-        "description"
-        "includes"
-        "imports"
-      ];
-      unknownKeys = lib.filter (name: !(builtins.elem name allowedKeys)) (builtins.attrNames imported);
-      description = imported.description or null;
-      includes = imported.includes or [ ];
-      imports = imported.imports or { };
-      allowedImportKeys = [
-        "nixos"
-        "darwin"
-        "home"
-      ];
-      unknownImportKeys =
-        if builtins.isAttrs imports then
-          lib.filter (name: !(builtins.elem name allowedImportKeys)) (builtins.attrNames imports)
-        else
-          [ ];
-      normalized = {
-        inherit description includes;
-        imports = {
-          nixos = imports.nixos or [ ];
-          darwin = imports.darwin or [ ];
-          home = imports.home or [ ];
-        };
-      };
-    in
-    ensure (unknownKeys == [ ])
-      "${unit.id}: meta.nix has unsupported keys: ${lib.concatStringsSep ", " unknownKeys}"
-      (
-        ensure (description == null || builtins.isString description)
-          "${unit.id}: meta.description must be a string"
-          (
-            ensure (builtins.isList includes && lib.all builtins.isString includes)
-              "${unit.id}: meta.includes must be a list of fully qualified unit IDs"
-              (
-                ensure (lib.unique includes == includes) "${unit.id}: meta.includes contains duplicate unit IDs" (
-                  ensure (builtins.isAttrs imports) "${unit.id}: meta.imports must be an attribute set" (
-                    ensure (unknownImportKeys == [ ])
-                      "${unit.id}: meta.imports has unsupported classes: ${lib.concatStringsSep ", " unknownImportKeys}"
-                      (
-                        ensure (lib.all builtins.isList [
-                          normalized.imports.nixos
-                          normalized.imports.darwin
-                          normalized.imports.home
-                        ]) "${unit.id}: every meta.imports.<class> value must be a list" normalized
-                      )
-                  )
-                )
-              )
-          )
-      );
-
-  makeUnit =
-    relativePath: entries:
-    let
-      directory = pathFor relativePath;
-      id = lib.concatStringsSep "." relativePath;
-      fragments = lib.mapAttrs (
-        _class: fileName: if entryIsFile entries fileName then directory + "/${fileName}" else null
-      ) reservedFiles;
-      baseUnit = {
-        inherit
-          id
-          directory
-          fragments
-          relativePath
-          ;
-        optionPath = [ "my" ] ++ relativePath ++ [ "enable" ];
-        kind = builtins.head relativePath;
-        name = lib.last relativePath;
-      }
-      //
-        lib.optionalAttrs (builtins.length relativePath > 2 && builtins.head relativePath == "profiles")
-          {
-            group = builtins.elemAt relativePath 1;
-          };
-    in
-    ensure (relativePath != [ ]) "the modules root cannot itself be a unit" (
-      ensure (lib.all (component: component != "" && !(lib.hasInfix "." component)) relativePath)
-        "${id}: path components must be non-empty and must not contain dots"
-        (baseUnit // { meta = normalizeMeta baseUnit; })
-    );
-
-  walk =
-    relativePath:
-    let
-      directory = pathFor relativePath;
-      entries = builtins.readDir directory;
-      hasReservedFile = lib.any (fileName: entryIsFile entries fileName) (
-        builtins.attrValues reservedFiles
-      );
-      childDirectories = lib.filter (name: entries.${name} == "directory") (builtins.attrNames entries);
-      current = lib.optional hasReservedFile (makeUnit relativePath entries);
-      children = lib.concatMap (name: walk (relativePath ++ [ name ])) childDirectories;
-    in
-    current ++ children;
-
-  discoveredUnits =
-    ensure (builtins.pathExists modulesRoot) "modules root does not exist: ${toString modulesRoot}"
-      (walk [ ]);
-  unitsById = builtins.listToAttrs (map (unit: lib.nameValuePair unit.id unit) discoveredUnits);
-
-  dependencyValidation = lib.foldl' (
-    valid: unit:
-    lib.foldl' (
-      inner: includedId:
-      if builtins.hasAttr includedId unitsById then
-        inner
-      else
-        throw "unit registry: ${unit.id} includes missing unit '${includedId}'"
-    ) valid unit.meta.includes
-  ) true discoveredUnits;
-
-  units = builtins.seq dependencyValidation unitsById;
-  unitIds = builtins.attrNames units;
-
-  getUnit =
-    id: if builtins.hasAttr id units then units.${id} else throw "unit registry: unknown unit '${id}'";
-
-  validateUnitIds =
-    ids:
-    ensure (
-      builtins.isList ids && lib.all builtins.isString ids
-    ) "selected units must be a list of strings" (map (id: builtins.seq (getUnit id) id) ids);
-
-  optionDefinitions = lib.foldl' lib.recursiveUpdate { } (
-    map (
-      unit:
-      lib.setAttrByPath unit.optionPath (
-        lib.mkOption {
-          type = lib.types.bool;
-          default = false;
-          description =
-            if unit.meta.description == null then
-              "Whether to enable the ${unit.id} unit."
-            else
-              "Whether to enable ${unit.meta.description}.";
-        }
-      )
-    ) discoveredUnits
-  );
-
-  enabled = config: unit: lib.getAttrFromPath unit.optionPath config;
-
-  enableUnit = id: lib.setAttrByPath (getUnit id).optionPath true;
-
-  includeConfig =
-    config: unit: lib.mkIf (enabled config unit) (lib.mkMerge (map enableUnit unit.meta.includes));
-
-  fragmentClasses = {
-    nixos = [
-      "common"
-      "nixos"
-    ];
-    darwin = [
-      "common"
-      "darwin"
-    ];
-    home = [ "home" ];
-  };
-
-  applyFragment =
-    {
-      config,
-      fragmentPath,
-      options,
-      specialArgs,
-      unit,
-    }:
-    let
-      fragment = import fragmentPath;
-      directArgs = specialArgs // {
-        inherit
-          config
-          lib
-          options
-          specialArgs
-          unit
-          ;
-      };
-      fragmentArgSpec = builtins.functionArgs fragment;
-      fragmentArgs = builtins.listToAttrs (
-        lib.concatMap (
-          name:
-          if builtins.hasAttr name directArgs then
-            [ (lib.nameValuePair name directArgs.${name}) ]
-          else if fragmentArgSpec.${name} then
-            [ ]
-          else
-            [ (lib.nameValuePair name config._module.args.${name}) ]
-        ) (builtins.attrNames fragmentArgSpec)
-      );
-      resultValue = if builtins.isFunction fragment then fragment fragmentArgs else fragment;
-      result =
-        ensure (builtins.isAttrs resultValue)
-          "${unit.id}: ${builtins.baseNameOf fragmentPath} must return an attribute set"
-          resultValue;
-      forbiddenKeys = lib.filter (name: builtins.hasAttr name result) [
-        "imports"
-        "options"
-        "config"
-      ];
-    in
-    ensure (forbiddenKeys == [ ])
-      "${unit.id}: ${builtins.baseNameOf fragmentPath} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
-      result;
-
-  externalImports = class: lib.concatMap (unit: unit.meta.imports.${class}) discoveredUnits;
-
-  mkModule =
-    { class }:
-    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
-      builtins.seq dependencyValidation (
-        {
-          config,
-          lib,
-          options,
-          specialArgs,
-          ...
-        }:
-        let
-          fragmentConfigs = lib.concatMap (
-            unit:
-            lib.filter (value: value != null) (
-              map (
-                fragmentClass:
-                let
-                  fragmentPath = unit.fragments.${fragmentClass};
-                in
-                if fragmentPath == null then
-                  null
-                else
-                  lib.mkIf (enabled config unit) (applyFragment {
-                    inherit
-                      config
-                      fragmentPath
-                      options
-                      specialArgs
-                      unit
-                      ;
-                  })
-              ) fragmentClasses.${class}
-            )
-          ) discoveredUnits;
-        in
-        {
-          imports = externalImports class;
-          options = optionDefinitions;
-          config = lib.mkMerge ((map (includeConfig config) discoveredUnits) ++ fragmentConfigs);
-        }
-      )
-    );
-
-  mkSelectionModule =
-    selectedIds:
-    let
-      checkedIds = validateUnitIds (lib.unique selectedIds);
-    in
-    {
-      config = lib.mkMerge (map enableUnit checkedIds);
-    };
-in
-{
-  inherit
-    getUnit
-    mkModule
-    mkSelectionModule
-    unitIds
-    units
-    validateUnitIds
-    ;
-}

modules/applications/1password.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications."1password";
+in
+{
+  options.my.applications."1password" = {
+    enable = lib.mkEnableOption "1Password password manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      polkitPolicyOwners = [ "moons" ];
+    };
+
+    programs.ssh.startAgent = lib.mkForce false;
+    programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
+
+    services.gnome.gcr-ssh-agent.enable = lib.mkForce false;
+  };
+}

modules/applications/1password/darwin.nix

@@ -1,8 +0,0 @@
-{
-  # The macOS app must live in /Applications for its background integrations,
-  # including the SSH agent, to work correctly.
-  homebrew = {
-    enable = true;
-    casks = [ "1password" ];
-  };
-}

modules/applications/1password/home.nix

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    pkgs._1password-cli
-  ]
-  ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs._1password-gui ];
-}

modules/applications/1password/nixos.nix

@@ -1,12 +0,0 @@
-{ primaryUser, lib, ... }:
-{
-  programs._1password.enable = true;
-  programs._1password-gui = {
-    enable = true;
-    polkitPolicyOwners = [ primaryUser ];
-  };
-
-  programs.ssh.startAgent = lib.mkForce false;
-  programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
-  services.gnome.gcr-ssh-agent.enable = lib.mkForce false;
-}

modules/applications/arduino.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.arduino;
+  arduinoIdeX11 = pkgs.arduino-ide.overrideAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+
+    postFixup = (old.postFixup or "") + ''
+      wrapProgram $out/bin/arduino-ide \
+        --add-flags "--ozone-platform=x11"
+    '';
+  });
+in
+{
+  options.my.applications.arduino = {
+    enable = lib.mkEnableOption "Arduino development tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      arduino-cli # Arduino command-line interface
+      arduinoIdeX11 # Arduino IDE with X11 support
+    ];
+  };
+}

modules/applications/arduino/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.arduino-cli ];
-}

modules/applications/arduino/nixos.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-let
-  arduinoIdeX11 = pkgs.arduino-ide.overrideAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-
-    postFixup = (old.postFixup or "") + ''
-      wrapProgram $out/bin/arduino-ide \
-        --add-flags "--ozone-platform=x11"
-    '';
-  });
-in
-{
-  environment.systemPackages = [ arduinoIdeX11 ];
-}

modules/applications/btop/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.btop;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.btop = {
+    enable = lib.mkEnableOption "btop system monitor";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.btop.system.enable = lib.mkDefault true;
+    my.applications.btop.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/btop/dracula.theme

@@ -1,5 +1,5 @@
-# Bashtop theme with Nord palette (https://www.nordtheme.com)
+#Bashtop theme with nord palette (https://www.nordtheme.com)
-# by Justin Zobel <[email protected]>
+#by Justin Zobel <[email protected]>
 
 # Colors should be in 6 or 2 character hexadecimal or single spaced rgb decimal: "#RRGGBB", "#BW" or "0-255 0-255 0-255"
 # example for white: "#ffffff", "#ff" or "255 255 255".
@@ -18,7 +18,7 @@ theme[main_fg]="#BD93F9"
 # Title color for boxes
 theme[title]="#f8f8f2"
 
-# Highlight color for keyboard shortcuts
+# Higlight color for keyboard shortcuts
 theme[hi_fg]="#ff79c6"
 
 # Background color of selected item in processes box

modules/applications/btop/home.nix

@@ -1,8 +1,25 @@
 {
-  programs.btop = {
+  lib,
-    enable = true;
+  config,
-
+  ...
-    settings.color_theme = "dracula";
+}:
-    themes.dracula = builtins.readFile ./dracula.theme;
+let
+  cfg = config.my.applications.btop.homeManager;
+in
+{
+  options.my.applications.btop.homeManager = {
+    enable = lib.mkEnableOption "btop home-manager configuration";
   };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
+        programs.btop = {
+          enable = true;
+          settings.color_theme = "dracula";
+          themes.dracula = builtins.readFile ./dracula.theme;
+        };
+      };
+    }
+  ];
 }

modules/applications/btop/system.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.btop.system;
+in
+{
+  options.my.applications.btop.system = {
+    enable = lib.mkEnableOption "btop system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      btop # Resource monitor that shows usage and stats
+    ];
+  };
+}

modules/applications/chrome.nix

@@ -0,0 +1,44 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.chrome;
+in
+{
+  options.my.applications.chrome = {
+    enable = lib.mkEnableOption "Google Chrome browser";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      {
+        home.packages = with pkgs; [
+          google-chrome # Popular web browser from Google
+        ];
+
+        xdg.desktopEntries."google-chrome" = {
+          name = "Google Chrome";
+          genericName = "Web Browser";
+          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --enable-features=TouchpadOverscrollHistoryNavigation %U";
+          terminal = false;
+          icon = "google-chrome";
+          categories = [
+            "Network"
+            "WebBrowser"
+          ];
+          startupNotify = true;
+          type = "Application";
+        };
+
+        xdg.mimeApps.defaultApplications = {
+          "text/html" = "google-chrome.desktop";
+          "x-scheme-handler/http" = "google-chrome.desktop";
+          "x-scheme-handler/https" = "google-chrome.desktop";
+        };
+      }
+    ];
+  };
+}

modules/applications/chrome/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "google-chrome" ];
-  };
-}

modules/applications/chrome/home.nix

@@ -1,4 +0,0 @@
-{ lib, pkgs, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  home.packages = [ pkgs.google-chrome ];
-}

modules/applications/chrome/nixos.nix

@@ -1,25 +0,0 @@
-{ pkgs, ... }:
-let
-  chromeLauncher = pkgs.makeDesktopItem {
-    name = "google-chrome";
-    desktopName = "Google Chrome";
-    genericName = "Web Browser";
-    exec = "${pkgs.google-chrome}/bin/google-chrome-stable --enable-features=TouchpadOverscrollHistoryNavigation %U";
-    icon = "google-chrome";
-    terminal = false;
-    categories = [
-      "Network"
-      "WebBrowser"
-    ];
-    startupNotify = true;
-  };
-in
-{
-  environment.systemPackages = [ chromeLauncher ];
-
-  xdg.mime.defaultApplications = {
-    "text/html" = "google-chrome.desktop";
-    "x-scheme-handler/http" = "google-chrome.desktop";
-    "x-scheme-handler/https" = "google-chrome.desktop";
-  };
-}

modules/applications/claude/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.claude;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.claude = {
+    enable = lib.mkEnableOption "Claude Code AI assistant";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.claude.system.enable = lib.mkDefault true;
+    my.applications.claude.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/claude/home.nix

@@ -1,18 +1,27 @@
 {
-  inputs,
+  lib,
-  pkgs,
+  config,
   ...
 }:
+let
+  cfg = config.my.applications.claude.homeManager;
+in
 {
-  home.packages = [
+  options.my.applications.claude.homeManager = {
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.claude-code
+    enable = lib.mkEnableOption "Claude Code home-manager configuration";
-  ];
-
-  home.file.".claude/settings.json".text = builtins.toJSON {
-    statusLine = {
-      type = "command";
-      command = "bun x ccusage statusline --no-offline";
-      padding = 0;
-    };
   };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
+        home.file.".claude/settings.json".text = builtins.toJSON {
+          statusLine = {
+            type = "command";
+            command = "bun x ccusage statusline --no-offline";
+            padding = 0;
+          };
+        };
+      };
+    }
+  ];
 }

modules/applications/claude/system.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.claude.system;
+in
+{
+  options.my.applications.claude.system = {
+    enable = lib.mkEnableOption "Claude Code system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.llm-agents.claude-code # AI coding assistant
+    ];
+  };
+}

modules/applications/codex-desktop.nix

@@ -0,0 +1,65 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.codexDesktop;
+  codexCliPackage = pkgs.llm-agents.codex;
+  codexDesktopPackage =
+    inputs.codex-desktop-linux.packages.${pkgs.stdenv.hostPlatform.system}.codex-desktop-computer-use-ui;
+  codexDesktopLauncher = pkgs.makeDesktopItem {
+    name = "codex";
+    desktopName = "Codex";
+    genericName = "ChatGPT Desktop";
+    comment = "Run Codex Desktop on Linux";
+    exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop ${lib.getExe' codexDesktopPackage "codex-desktop"} %u";
+    icon = "codex-desktop";
+    terminal = false;
+    categories = [ "Development" ];
+    keywords = [
+      "codex"
+      "chatgpt"
+      "openai"
+      "ai"
+      "assistant"
+    ];
+    startupNotify = true;
+    startupWMClass = "codex-desktop";
+    actions = {
+      new-window = {
+        name = "New Window";
+        exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop CODEX_MULTI_LAUNCH=1 ${lib.getExe' codexDesktopPackage "codex-desktop"} --new-instance";
+      };
+    };
+    extraConfig = {
+      X-GNOME-WMClass = "codex-desktop";
+    };
+  };
+in
+{
+  imports = [
+    inputs.codex-desktop-linux.nixosModules.default
+  ];
+
+  options.my.applications.codexDesktop = {
+    enable = lib.mkEnableOption "ChatGPT Desktop for Linux";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.codex.enable = true;
+
+    programs.codexDesktopLinux = {
+      enable = true;
+      package = codexDesktopPackage;
+      cliPackage = codexCliPackage;
+      computerUseUi.enable = true;
+    };
+
+    environment.systemPackages = [
+      codexDesktopLauncher # Vicinae-searchable Codex Desktop launcher alias
+    ];
+  };
+}

modules/applications/codex-desktop/darwin.nix

@@ -1,8 +0,0 @@
-{
-  # The former Codex app cask is deprecated in favor of ChatGPT, whose desktop
-  # application includes the current Codex experience on macOS.
-  homebrew = {
-    enable = true;
-    casks = [ "chatgpt" ];
-  };
-}

modules/applications/codex-desktop/meta.nix

@@ -1,10 +0,0 @@
-{ inputs, ... }:
-{
-  description = "Codex Desktop for Linux";
-
-  includes = [ "applications.codex" ];
-
-  imports.nixos = [
-    inputs.codex-desktop-linux.nixosModules.default
-  ];
-}

modules/applications/codex-desktop/nixos.nix

@@ -1,37 +0,0 @@
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  codexCliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-  codexDesktopPackage =
-    inputs.codex-desktop-linux.packages.${pkgs.stdenv.hostPlatform.system}.codex-desktop-computer-use-ui;
-  launcher = pkgs.makeDesktopItem {
-    name = "codex";
-    desktopName = "Codex";
-    genericName = "ChatGPT Desktop";
-    comment = "Run Codex Desktop";
-    exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop ${lib.getExe' codexDesktopPackage "codex-desktop"} %u";
-    icon = "codex-desktop";
-    terminal = false;
-    categories = [ "Development" ];
-    startupNotify = true;
-    startupWMClass = "codex-desktop";
-    actions.new-window = {
-      name = "New Window";
-      exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop CODEX_MULTI_LAUNCH=1 ${lib.getExe' codexDesktopPackage "codex-desktop"} --new-instance";
-    };
-  };
-in
-{
-  programs.codexDesktopLinux = {
-    enable = true;
-    package = codexDesktopPackage;
-    cliPackage = codexCliPackage;
-    computerUseUi.enable = true;
-  };
-
-  environment.systemPackages = [ launcher ];
-}

modules/applications/codex.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.codex;
+in
+{
+  options.my.applications.codex = {
+    enable = lib.mkEnableOption "Codex AI coding assistant";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.llm-agents.codex # OpenAI Codex CLI
+    ];
+  };
+}

modules/applications/codex/home.nix

@@ -1,6 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  home.packages = [
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex
-  ];
-}

modules/applications/default.nix

@@ -0,0 +1,47 @@
+{
+  imports = [
+    ./1password.nix
+    ./arduino.nix
+    ./btop
+    ./chrome.nix
+    ./claude
+    ./codex-desktop.nix
+    ./codex.nix
+    ./direnv.nix
+    ./discord.nix
+    ./docker.nix
+    ./fcitx5
+    ./ghostty
+    ./git
+    ./gnupg
+    ./grok.nix
+    ./gnome.nix
+    ./greetd.nix
+    ./ly
+    ./gtk
+    ./java
+    ./kde.nix
+    ./nautilus.nix
+    ./nh.nix
+    ./niri
+    ./nix-index
+    ./noctalia
+    ./opencode.nix
+    ./openssh.nix
+    ./slack.nix
+    ./ssh
+    ./swayidle.nix
+    ./swaylock
+    ./tailscale.nix
+    ./vicinae.nix
+    ./vim
+    ./vscode
+    ./wayland.nix
+    ./yazi.nix
+    ./zed
+    ./zellij
+    ./zoom.nix
+    ./zoxide.nix
+    ./zsh
+  ];
+}

modules/applications/direnv.nix

@@ -0,0 +1,16 @@
+{ lib, config, ... }:
+let
+  cfg = config.my.applications.direnv;
+in
+{
+  options.my.applications.direnv = {
+    enable = lib.mkEnableOption "direnv environment variable manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+  };
+}

modules/applications/direnv/home.nix

@@ -1,6 +0,0 @@
-{
-  programs.direnv = {
-    enable = true;
-    nix-direnv.enable = true;
-  };
-}

modules/applications/discord.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.discord;
+in
+{
+  options.my.applications.discord = {
+    enable = lib.mkEnableOption "Discord (Vesktop)";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      {
+        programs.vesktop = {
+          enable = true;
+        };
+      }
+    ];
+  };
+}

modules/applications/discord/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "vesktop" ];
-  };
-}

modules/applications/discord/home.nix

@@ -1,4 +0,0 @@
-{ lib, pkgs, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  programs.vesktop.enable = true;
-}

modules/applications/docker.nix

@@ -0,0 +1,34 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.docker;
+in
+{
+  options.my.applications.docker = {
+    enable = lib.mkEnableOption "Docker container runtime";
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+      };
+      daemon.settings = {
+        ipv6 = true;
+        "fixed-cidr-v6" = "fd00:30::/64";
+        ip6tables = true;
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      docker # Container runtime
+      oxker # Docker TUI Tool
+    ];
+  };
+}

modules/applications/docker/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "orbstack" ];
-  };
-}

modules/applications/docker/home.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-let
-  oxker = pkgs.oxker.overrideAttrs (oldAttrs: {
-    checkFlags =
-      (oldAttrs.checkFlags or [ ])
-      ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
-        "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_one_two_definition"
-        "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_two_definition"
-      ];
-  });
-in
-{
-  home.packages = [
-    pkgs.docker-client
-    oxker
-  ];
-}

modules/applications/docker/meta.nix

@@ -1,5 +0,0 @@
-{
-  description = "Docker command-line client and NixOS daemon";
-
-  includes = [ "services.docker" ];
-}

modules/applications/drawio/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "drawio" ];
-  };
-}

modules/applications/drawio/home.nix

@@ -1,4 +0,0 @@
-{ lib, pkgs, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  home.packages = [ pkgs.drawio ];
-}

modules/applications/fcitx5/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.fcitx5;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.fcitx5 = {
+    enable = lib.mkEnableOption "fcitx5 input method";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.fcitx5.system.enable = lib.mkDefault true;
+    my.applications.fcitx5.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/fcitx5/home.nix

@@ -1,6 +1,24 @@
 {
-  home.file.".config/fcitx5/config" = {
+  lib,
-    recursive = true;
+  config,
-    source = ./config;
+  ...
+}:
+let
+  cfg = config.my.applications.fcitx5.homeManager;
+in
+{
+  options.my.applications.fcitx5.homeManager = {
+    enable = lib.mkEnableOption "fcitx5 home-manager configuration";
   };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
+        home.file.".config/fcitx5/config" = {
+          recursive = true;
+          source = ./config;
+        };
+      };
+    }
+  ];
 }

modules/applications/fcitx5/nixos.nix

@@ -1,34 +0,0 @@
-{ pkgs, ... }:
-{
-  i18n.inputMethod = {
-    enable = true;
-    type = "fcitx5";
-
-    fcitx5 = {
-      waylandFrontend = true;
-      addons = with pkgs; [
-        fcitx5-mozc-ut
-        fcitx5-gtk
-        kdePackages.fcitx5-qt
-        qt6Packages.fcitx5-configtool
-      ];
-
-      settings.inputMethod = {
-        GroupOrder."0" = "Default";
-        "Groups/0" = {
-          Name = "Default";
-          "Default Layout" = "jp";
-          DefaultIM = "mozc";
-        };
-        "Groups/0/Items/0" = {
-          Name = "keyboard-jp";
-          Layout = "";
-        };
-        "Groups/0/Items/1" = {
-          Name = "mozc";
-          Layout = "";
-        };
-      };
-    };
-  };
-}

modules/applications/fcitx5/system.nix

@@ -0,0 +1,68 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+
+  cfg = config.my.applications.fcitx5.system;
+in
+{
+  options.my.applications.fcitx5.system = {
+    enable = lib.mkEnableOption "fcitx5 system configuration";
+  };
+
+  imports = [
+    inputs.nix-hazkey.nixosModules.hazkey
+  ];
+
+  config = lib.mkIf cfg.enable {
+
+    services.hazkey = {
+      enable = true;
+      server.package = inputs.nix-hazkey.packages.${system}.hazkey-server.override {
+        enableVulkan = true;
+      };
+      installHazkeySettings = false;
+      installFcitx5Addon = false;
+    };
+
+    environment.systemPackages = [ inputs.nix-hazkey.packages.${system}.hazkey-settings ];
+
+    i18n.inputMethod = {
+      enable = true;
+      type = "fcitx5";
+      fcitx5 = {
+        waylandFrontend = true;
+        addons = with pkgs; [
+          inputs.nix-hazkey.packages.${system}.fcitx5-hazkey
+          fcitx5-mozc-ut
+          fcitx5-gtk
+          kdePackages.fcitx5-qt
+          qt6Packages.fcitx5-configtool
+        ];
+        settings.inputMethod = {
+          GroupOrder = {
+            "0" = "Default";
+          };
+          "Groups/0" = {
+            Name = "Default";
+            "Default Layout" = "jp";
+            DefaultIM = "mozc";
+          };
+          "Groups/0/Items/0" = {
+            Name = "keyboard-jp";
+            Layout = "";
+          };
+          "Groups/0/Items/1" = {
+            Name = "mozc";
+            Layout = "";
+          };
+        };
+      };
+    };
+  };
+}

modules/applications/ghostty/config

@@ -0,0 +1,40 @@
+theme = dracula
+background-blur-radius = 20
+background-opacity = 0.9
+font-family = BlexMono Nerd Font Mono
+mouse-hide-while-typing = true
+window-decoration = true
+
+
+# keybind
+
+# Copy/Paste
+keybind = performable:ctrl+shift+c=copy_to_clipboard
+keybind = ctrl+shift+v=paste_from_clipboard
+
+# create new tab
+keybind = ctrl+shift+t=new_tab
+
+# move tabs
+keybind = ctrl+alt+left_bracket=previous_tab
+keybind = ctrl+alt+right_bracket=next_tab
+
+# close tab
+keybind = ctrl+alt+q=close_window
+
+# font size
+keybind = ctrl+shift+semicolon=increase_font_size:1
+keybind = ctrl+shift+minus=increase_font_size:1
+
+
+# quick terminal
+keybind = global:super+space=toggle_quick_terminal
+quick-terminal-position = top
+quick-terminal-size = 100%
+gtk-quick-terminal-layer = overlay
+quick-terminal-keyboard-interactivity = exclusive
+quick-terminal-autohide = false
+quit-after-last-window-closed = false
+
+shell-integration-features = ssh-terminfo,ssh-env
+

modules/applications/ghostty/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "ghostty" ];
-  };
-}

modules/applications/ghostty/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.ghostty;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.ghostty = {
+    enable = lib.mkEnableOption "ghostty terminal emulator";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.ghostty.system.enable = lib.mkDefault true;
+    my.applications.ghostty.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/ghostty/dracula.theme

@@ -1,17 +1,17 @@
 # MIT License
-#
+# 
 # Copyright (c) 2023 Dracula Theme
-#
+# 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
 # in the Software without restriction, including without limitation the rights
 # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 # copies of the Software, and to permit persons to whom the Software is
 # furnished to do so, subject to the following conditions:
-#
+# 
 # The above copyright notice and this permission notice shall be included in all
 # copies or substantial portions of the Software.
-#
+# 
 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
@@ -42,3 +42,4 @@ cursor-color = #f8f8f2
 cursor-text = #282a36
 selection-foreground = #f8f8f2
 selection-background = #44475a
+

modules/applications/ghostty/home.nix

@@ -1,49 +1,83 @@
 {
-  inputs,
   pkgs,
+  lib,
+  config,
+  inputs,
   ...
 }:
 let
-  package =
+  cfg = config.my.applications.ghostty.homeManager;
-    if pkgs.stdenv.hostPlatform.isLinux then
+
-      inputs.ghostty.packages.${pkgs.stdenv.hostPlatform.system}.ghostty-releasefast
+  system = pkgs.stdenv.hostPlatform.system;
-    else
+
-      null;
+  ghosttyPkg = inputs.ghostty.packages.${system}.ghostty-releasefast;
 in
 {
-  programs.ghostty = {
+  options.my.applications.ghostty.homeManager = {
-    enable = true;
+    enable = lib.mkEnableOption "ghostty home-manager configuration";
-    inherit package;
-    systemd.enable = pkgs.stdenv.hostPlatform.isLinux;
-
-    settings = {
-      theme = "dracula";
-      background-blur-radius = 20;
-      background-opacity = 0.9;
-      font-family = "BlexMono Nerd Font Mono";
-      mouse-hide-while-typing = true;
-      window-decoration = "auto";
-
-      keybind = [
-        "performable:ctrl+shift+c=copy_to_clipboard"
-        "ctrl+shift+v=paste_from_clipboard"
-        "ctrl+shift+t=new_tab"
-        "ctrl+alt+left_bracket=previous_tab"
-        "ctrl+alt+right_bracket=next_tab"
-        "ctrl+alt+q=close_window"
-        "ctrl+shift+semicolon=increase_font_size:1"
-        "ctrl+shift+minus=decrease_font_size:1"
-      ];
-
-      quick-terminal-position = "top";
-      quick-terminal-size = "98%,100%";
-      quick-terminal-autohide = false;
-      quick-terminal-keyboard-interactivity = "on-demand";
-      gtk-quick-terminal-layer = "top";
-      quit-after-last-window-closed = false;
-      shell-integration-features = "no-ssh-env,no-ssh-terminfo";
-    };
   };
 
-  xdg.configFile."ghostty/themes/dracula".source = ./dracula.theme;
+  config.home-manager.sharedModules = [
+    (
+      { lib, ... }:
+      {
+        config = lib.mkIf cfg.enable {
+          programs.ghostty = {
+            enable = true;
+
+            package = ghosttyPkg;
+
+            systemd.enable = true;
+
+            settings = {
+              theme = "dracula";
+
+              background-blur-radius = 20;
+              background-opacity = 0.9;
+
+              font-family = "BlexMono Nerd Font Mono";
+
+              mouse-hide-while-typing = true;
+
+              window-decoration = "auto";
+
+              keybind = [
+                # Copy/Paste
+                "performable:ctrl+shift+c=copy_to_clipboard"
+                "ctrl+shift+v=paste_from_clipboard"
+
+                # Create new tab
+                "ctrl+shift+t=new_tab"
+
+                # Move tabs
+                "ctrl+alt+left_bracket=previous_tab"
+                "ctrl+alt+right_bracket=next_tab"
+
+                # Close window
+                "ctrl+alt+q=close_window"
+
+                # Font size
+                "ctrl+shift+semicolon=increase_font_size:1"
+                "ctrl+shift+minus=decrease_font_size:1"
+              ];
+
+              # Quick terminal
+              quick-terminal-position = "top";
+              quick-terminal-size = "98%,100%";
+
+              quick-terminal-autohide = false;
+              quick-terminal-keyboard-interactivity = "on-demand";
+              gtk-quick-terminal-layer = "top";
+
+              quit-after-last-window-closed = false;
+
+              shell-integration-features = "no-ssh-env,no-ssh-terminfo";
+            };
+          };
+
+          xdg.configFile."ghostty/themes/dracula".source = ./dracula.theme;
+        };
+      }
+    )
+  ];
 }

modules/applications/ghostty/system.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  cfg = config.my.applications.ghostty.system;
+
+  system = pkgs.stdenv.hostPlatform.system;
+
+  ghosttyPkg = inputs.ghostty.packages.${system}.ghostty-releasefast;
+in
+{
+  options.my.applications.ghostty.system = {
+    enable = lib.mkEnableOption "ghostty system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      ghosttyPkg # A fast and minimal terminal emulator for Wayland
+      ghosttyPkg.terminfo # Terminfo database for ghostty
+    ];
+  };
+}

modules/applications/git/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.git;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.git = {
+    enable = lib.mkEnableOption "git version control";
+
+    userName = lib.mkOption {
+      type = lib.types.singleLineStr;
+      default = "moons";
+      description = "Default Git user.name.";
+    };
+
+    userEmail = lib.mkOption {
+      type = lib.types.singleLineStr;
+      default = "moons@moons14.com";
+      description = "Default Git user.email.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.git.system.enable = lib.mkDefault true;
+    my.applications.git.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/git/home.nix

@@ -1,5 +1,13 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
+  cfg = config.my.applications.git;
+  hmCfg = config.my.applications.git.homeManager;
+
   signingKeyPath = ".ssh/1password-git-signing.pub";
   signingKeyFile = "~/${signingKeyPath}";
 
@@ -27,52 +35,77 @@ let
   '';
 in
 {
-  home.packages = [ pkgs.gh ];
+  options.my.applications.git.homeManager = {
+    enable = lib.mkEnableOption "git home-manager configuration";
 
-  home.file.${signingKeyPath}.text = ''
+    signingPublicKey = lib.mkOption {
-    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing
+      type = lib.types.nullOr lib.types.singleLineStr;
-  '';
+      default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
-
+      example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
-  programs.git = {
+      description = "SSH public key copied from the 1Password SSH key item used for Git signing.";
-    enable = true;
-
-    ignores = [
-      ".direnv/"
-      ".envrc"
-      "!.envrc.example"
-    ];
-
-    signing = {
-      key = signingKeyFile;
-      format = "ssh";
-      signByDefault = true;
     };
 
-    settings = {
+    signingKey = lib.mkOption {
-      user = {
+      type = lib.types.str;
-        name = "moons";
+      default = signingKeyFile;
-        email = "moons@moons14.com";
+      readOnly = true;
-      };
+      description = "SSH public key path used for Git commit and tag signing.";
-
-      push.default = "simple";
-      credential.helper = "cache --timeout=7200";
-      init.defaultBranch = "main";
-      log.decorate = "full";
-      log.date = "iso";
-      merge.conflictStyle = "diff3";
-
-      gpg.ssh.program = "${gitSshSign}";
-
-      alias = {
-        br = "branch --sort=-committerdate";
-        co = "checkout";
-        df = "diff";
-        com = "commit -a";
-        gs = "stash";
-        gp = "pull";
-        lg = "log --graph --pretty=format:'%Cred%h%Creset - %C(yellow)%d%Creset %s %C(green)(%cr)%C(bold blue) <%an>%Creset' --abbrev-commit";
-        st = "status";
-      };
     };
   };
+
+  config = lib.mkIf hmCfg.enable {
+    assertions = [
+      {
+        assertion = hmCfg.signingPublicKey != null && hmCfg.signingPublicKey != "";
+        message = "my.applications.git.homeManager.signingPublicKey must be set to the public key copied from 1Password.";
+      }
+    ];
+
+    home-manager.sharedModules = [
+      {
+        home.file.${signingKeyPath}.text = hmCfg.signingPublicKey + "\n";
+
+        programs.git = {
+          enable = true;
+
+          ignores = [
+            ".direnv/"
+            ".envrc"
+            "!.envrc.example"
+          ];
+
+          signing = {
+            key = hmCfg.signingKey;
+            format = "ssh";
+            signByDefault = true;
+          };
+
+          settings = {
+            user.name = cfg.userName;
+            user.email = cfg.userEmail;
+
+            push.default = "simple";
+            credential.helper = "cache --timeout=7200";
+            init.defaultBranch = "main";
+            log.decorate = "full";
+            log.date = "iso";
+            merge.conflictStyle = "diff3";
+
+            gpg.ssh.program = "${gitSshSign}";
+
+            alias = {
+              br = "branch --sort=-committerdate";
+              co = "checkout";
+              df = "diff";
+              com = "commit -a";
+              gs = "stash";
+              gp = "pull";
+              lg = "log --graph --pretty=format:'%Cred%h%Creset - %C(yellow)%d%Creset %s %C(green)(%cr)%C(bold blue) <%an>%Creset' --abbrev-commit";
+              st = "status";
+            };
+          };
+        };
+      }
+    ];
+  };
 }

modules/applications/git/system.nix

@@ -0,0 +1,21 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.git.system;
+in
+{
+  options.my.applications.git.system = {
+    enable = lib.mkEnableOption "git system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      git # Distributed version control system
+      gh # GitHub CLI
+    ];
+  };
+}

modules/applications/gnome.nix

@@ -0,0 +1,94 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gnome;
+in
+{
+  options.my.applications.gnome = {
+    enable = lib.mkEnableOption "GNOME desktop environment";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.desktopManager.gnome.enable = true;
+
+    # ly is the display manager for switching between installed sessions.
+    services.displayManager.gdm.enable = lib.mkForce false;
+
+    home-manager.sharedModules = [
+      {
+        dconf.settings = {
+          "org/gnome/desktop/sound" = {
+            event-sounds = false;
+            input-feedback-sounds = false;
+          };
+
+          "org/gnome/desktop/wm/keybindings" = {
+            close = [ "<Super>q" ];
+            show-desktop = [ ];
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys" = {
+            home = [ ];
+            screensaver = [ "<Super>l" ];
+            custom-keybindings = [
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4/"
+            ];
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+            name = "Open Terminal";
+            command = "ghostty";
+            binding = "<Super>t";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+            name = "Run Application";
+            command = "vicinae toggle";
+            binding = "<Super>d";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2" = {
+            name = "Open File Manager";
+            command = "nautilus --new-window";
+            binding = "<Super>e";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3" = {
+            name = "Clipboard History";
+            command = "vicinae vicinae://extensions/vicinae/clipboard/history";
+            binding = "<Super>v";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4" = {
+            name = "Log Out";
+            command = "gnome-session-quit --logout --no-prompt";
+            binding = "<Super><Shift>e";
+          };
+
+          "org/gnome/shell" = {
+            favorite-apps = [
+              "google-chrome.desktop"
+              "code.desktop"
+              "com.mitchellh.ghostty.desktop"
+              "slack.desktop"
+              "vesktop.desktop"
+            ];
+          };
+        };
+      }
+    ];
+
+    environment.systemPackages = with pkgs; [
+      gnome-tweaks # GNOME desktop customization tool
+      gnome-extension-manager # GNOME Shell extension manager
+    ];
+  };
+}

modules/applications/gnome/home.nix

@@ -1,56 +0,0 @@
-{ pkgs, lib, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  dconf.settings = {
-    "org/gnome/desktop/sound" = {
-      event-sounds = false;
-      input-feedback-sounds = false;
-    };
-    "org/gnome/desktop/wm/keybindings" = {
-      close = [ "<Super>q" ];
-      show-desktop = [ ];
-    };
-    "org/gnome/settings-daemon/plugins/media-keys" = {
-      home = [ ];
-      screensaver = [ "<Super>l" ];
-      custom-keybindings = [
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4/"
-      ];
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
-      name = "Open Terminal";
-      command = "ghostty";
-      binding = "<Super>t";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
-      name = "Run Application";
-      command = "vicinae toggle";
-      binding = "<Super>d";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2" = {
-      name = "Open File Manager";
-      command = "nautilus --new-window";
-      binding = "<Super>e";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3" = {
-      name = "Clipboard History";
-      command = "vicinae vicinae://extensions/vicinae/clipboard/history";
-      binding = "<Super>v";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4" = {
-      name = "Log Out";
-      command = "gnome-session-quit --logout --no-prompt";
-      binding = "<Super><Shift>e";
-    };
-    "org/gnome/shell".favorite-apps = [
-      "google-chrome.desktop"
-      "code.desktop"
-      "com.mitchellh.ghostty.desktop"
-      "slack.desktop"
-      "vesktop.desktop"
-    ];
-  };
-}

modules/applications/gnome/nixos.nix

@@ -1,10 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  services.desktopManager.gnome.enable = true;
-  services.displayManager.gdm.enable = lib.mkForce false;
-
-  environment.systemPackages = [
-    pkgs.gnome-tweaks
-    pkgs.gnome-extension-manager
-  ];
-}

modules/applications/gnupg/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gnupg;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.gnupg = {
+    enable = lib.mkEnableOption "GnuPG agent";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.gnupg.system.enable = lib.mkDefault true;
+    my.applications.gnupg.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/gnupg/home.nix

@@ -1,9 +1,22 @@
-{ pkgs, ... }:
 {
-  home.packages = [ pkgs.gnupg ];
+  lib,
-
+  config,
-  services.gpg-agent = {
+  ...
-    enable = false;
+}:
-    enableSshSupport = false;
+let
+  hmCfg = config.my.applications.gnupg.homeManager;
+in
+{
+  options.my.applications.gnupg.homeManager = {
+    enable = lib.mkEnableOption "GnuPG home-manager configuration";
   };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf hmCfg.enable {
+        services.gpg-agent.enable = false;
+        services.gpg-agent.enableSshSupport = false;
+      };
+    }
+  ];
 }

modules/applications/gnupg/nixos.nix

@@ -1,6 +0,0 @@
-{
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = false;
-  };
-}

modules/applications/gnupg/system.nix

@@ -0,0 +1,20 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gnupg.system;
+in
+{
+  options.my.applications.gnupg.system = {
+    enable = lib.mkEnableOption "GnuPG system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = false;
+    };
+  };
+}

modules/applications/greetd.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.greetd;
+in
+{
+  options.my.applications.greetd = {
+    enable = lib.mkEnableOption "greetd login manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          user = "greeter";
+          command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd niri-session";
+        };
+      };
+    };
+  };
+}

modules/applications/grok.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.grok;
+
+  grok = pkgs.llm-agents.grok.overrideAttrs (_old: {
+    versionCheckProgram = "${placeholder "out"}/libexec/grok/grok-launcher";
+  });
+in
+{
+  options.my.applications.grok = {
+    enable = lib.mkEnableOption "Grok AI assistant";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      grok
+    ];
+  };
+}

modules/applications/grok/home.nix

@@ -1,9 +0,0 @@
-{ inputs, pkgs, ... }:
-let
-  grok = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.grok.overrideAttrs (_: {
-    versionCheckProgram = "${placeholder "out"}/libexec/grok/grok-launcher";
-  });
-in
-{
-  home.packages = [ grok ];
-}

modules/applications/gtk/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gtk;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.gtk = {
+    enable = lib.mkEnableOption "GTK theme configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.gtk.system.enable = lib.mkDefault true;
+    my.applications.gtk.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/gtk/home.nix

@@ -1,18 +1,36 @@
-{ pkgs, ... }:
 {
-  gtk = {
+  pkgs,
-    enable = true;
+  lib,
-    theme = {
+  config,
-      name = "Dracula";
+  ...
-      package = pkgs.dracula-theme;
+}:
-    };
+let
-    cursorTheme = {
+  cfg = config.my.applications.gtk.homeManager;
-      package = pkgs.adwaita-icon-theme;
+in
-      name = "Adwaita";
+{
-    };
+  options.my.applications.gtk.homeManager = {
-    iconTheme = {
+    enable = lib.mkEnableOption "GTK home-manager configuration";
-      package = pkgs.papirus-icon-theme;
-      name = "Papirus-Dark";
-    };
   };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
+        gtk = {
+          enable = true;
+          theme = {
+            name = "Dracula";
+            package = pkgs.dracula-theme;
+          };
+          cursorTheme = {
+            package = pkgs.adwaita-icon-theme;
+            name = "Adwaita";
+          };
+          iconTheme = {
+            package = pkgs.papirus-icon-theme;
+            name = "Papirus-Dark";
+          };
+        };
+      };
+    }
+  ];
 }

modules/applications/gtk/nixos.nix

@@ -1,5 +0,0 @@
-{
-  programs.dconf.enable = true;
-  programs.seahorse.enable = true;
-  services.gnome.gnome-keyring.enable = true;
-}

modules/applications/gtk/system.nix

@@ -0,0 +1,20 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gtk.system;
+in
+{
+  options.my.applications.gtk.system = {
+    enable = lib.mkEnableOption "GTK system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.dconf.enable = true;
+    programs.seahorse.enable = true;
+
+    services.gnome.gnome-keyring.enable = true;
+  };
+}

modules/applications/java/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.java;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.java = {
+    enable = lib.mkEnableOption "Java runtime";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.java.system.enable = lib.mkDefault true;
+    my.applications.java.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/java/home.nix

@@ -1,12 +1,23 @@
-{ pkgs, ... }:
 {
-  programs.java = {
+  lib,
-    enable = true;
+  config,
-    package = pkgs.jdk25;
+  ...
+}:
+let
+  cfg = config.my.applications.java.homeManager;
+in
+{
+  options.my.applications.java.homeManager = {
+    enable = lib.mkEnableOption "Java home-manager configuration";
   };
 
-  home.packages = with pkgs; [
+  config.home-manager.sharedModules = [
-    maven
+    {
-    gradle
+      config = lib.mkIf cfg.enable {
+        programs.java = {
+          enable = true;
+        };
+      };
+    }
   ];
 }

modules/applications/java/system.nix

@@ -0,0 +1,27 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.java.system;
+in
+{
+  options.my.applications.java.system = {
+    enable = lib.mkEnableOption "Java system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.java = {
+      enable = true;
+      package = pkgs.jdk25;
+    };
+
+    environment.systemPackages = with pkgs; [
+      jdk25 # Java Development Kit 25
+      maven # Java Build Tool
+      gradle # Java Build Tool
+    ];
+  };
+}

modules/applications/kde.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.kde;
+in
+{
+  options.my.applications.kde = {
+    enable = lib.mkEnableOption "KDE Connect";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.kdeconnect = {
+      enable = true;
+    };
+  };
+}

modules/applications/kde/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "kde-connect" ];
-  };
-}

modules/applications/kde/nixos.nix

@@ -1,3 +0,0 @@
-{
-  programs.kdeconnect.enable = true;
-}

modules/applications/ly/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.applications.ly;
+  indyzLinuxfire = pkgs.fetchurl {
+    url = "https://codeberg.org/attachments/f336d6ac-8331-4323-91fc-0e4619803401";
+    hash = "sha256-fRm0wlkq9/GdLrVBOzMEnQG/i2ng+uGIzq0u9hu3m9g=";
+  };
+in
+{
+  options.my.applications.ly = {
+    enable = lib.mkEnableOption "ly TUI display manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.displayManager.defaultSession = lib.mkDefault "niri";
+
+    services.displayManager.ly = {
+      enable = true;
+      settings = {
+        default_session = "niri";
+
+        animate = true;
+        animation = "dur_file";
+        dur_file_path = "${indyzLinuxfire}";
+        dur_offset_alignment = "center";
+
+        full_color = true;
+      };
+    };
+  };
+}

modules/applications/nautilus.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.nautilus;
+in
+{
+  options.my.applications.nautilus = {
+    enable = lib.mkEnableOption "Nautilus file manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      nautilus # GNOME file manager
+      gvfs # GNOME virtual file system
+      sushi # Nautilus file previewer
+    ];
+  };
+}

modules/applications/nautilus/home.nix

@@ -1,8 +0,0 @@
-{ pkgs, lib, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  home.packages = [
-    pkgs.nautilus
-    pkgs.gvfs
-    pkgs.sushi
-  ];
-}