chore(nix): update llm-agents to cef1a335

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/actions/check-nixos/action.yaml

@@ -1,27 +0,0 @@
-# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
-name: Check NixOS configurations
-description: Build every NixOS configuration and the Registry tests
-runs:
-  using: composite
-  steps:
-    - name: Build every NixOS configuration
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        mapfile -t hosts < <(
-          nix eval --raw .#nixosConfigurations \
-            --apply 'configs: builtins.concatStringsSep "\n" (builtins.attrNames configs)'
-        )
-
-        installables=(.#checks.x86_64-linux.registry)
-        for host in "${hosts[@]}"; do
-          installables+=(".#nixosConfigurations.${host}.config.system.build.toplevel")
-        done
-
-        nix build \
-          --keep-going \
-          --no-link \
-          --print-build-logs \
-          --show-trace \
-          "${installables[@]}"

.github/actions/setup-nix/action.yaml

@@ -1,22 +0,0 @@
-# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/actions/setup-nix/action.yaml
-name: Setup Nix
-description: Install Nix and cache the Nix store
-runs:
-  using: composite
-  steps:
-    - name: Allow unprivileged user namespaces
-      if: runner.os == 'Linux'
-      shell: bash
-      run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
-    - name: Install Nix
-      uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
-      with:
-        nix_conf: |
-          accept-flake-config = true
-          max-jobs = auto
-    - name: Cache Nix store
-      uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
-      with:
-        primary-key: nix-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.lock') }}
-        restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}-
-        gc-max-store-size-linux: 4G

.github/actions/update-flake-input/action.yaml

@@ -0,0 +1,260 @@
+name: Update Flake Input
+description: Update one GitHub-backed Nix flake input and create a pull request
+inputs:
+  input-name:
+    description: Name of the flake input to update
+    required: true
+  github-token:
+    description: Token used to query GitHub, push the update branch, and manage the pull request
+    required: true
+  base-branch:
+    description: Branch targeted by the pull request
+    required: false
+    default: main
+  minimum-release-age-days:
+    description: Minimum age of the target commit in days
+    required: false
+    default: "3"
+  skip-delay:
+    description: Update to the latest revision without applying the minimum age
+    required: false
+    default: "false"
+  auto-merge:
+    description: Enable squash auto-merge on the pull request
+    required: false
+    default: "true"
+  pr-labels:
+    description: Comma-separated labels to add when they already exist in the repository
+    required: false
+    default: dependencies,automated
+outputs:
+  updated:
+    description: Whether flake.lock changed
+    value: ${{ steps.update.outputs.updated }}
+  current-version:
+    description: Previous locked revision
+    value: ${{ steps.update.outputs.current_version }}
+  new-version:
+    description: New locked revision
+    value: ${{ steps.update.outputs.new_version }}
+  pr-url:
+    description: URL of the created or updated pull request
+    value: ${{ steps.pull-request.outputs.pr_url }}
+runs:
+  using: composite
+  steps:
+    - name: Update flake input
+      id: update
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        INPUT_NAME: ${{ inputs.input-name }}
+        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
+        SKIP_DELAY: ${{ inputs.skip-delay }}
+      run: |
+        set -euo pipefail
+
+        if [[ ! "$MINIMUM_RELEASE_AGE_DAYS" =~ ^[0-9]+$ ]]; then
+          echo "::error::minimum-release-age-days must be a non-negative integer"
+          exit 1
+        fi
+
+        node_key="$(
+          jq -er --arg input "$INPUT_NAME" '
+            .nodes.root.inputs[$input]
+            | if type == "array" then .[0] else . end
+          ' flake.lock
+        )"
+        input_type="$(jq -r --arg node "$node_key" '.nodes[$node].locked.type // ""' flake.lock)"
+        input_owner="$(jq -r --arg node "$node_key" '.nodes[$node].locked.owner // ""' flake.lock)"
+        input_repo="$(jq -r --arg node "$node_key" '.nodes[$node].locked.repo // ""' flake.lock)"
+        input_ref="$(jq -r --arg node "$node_key" '.nodes[$node].original.ref // ""' flake.lock)"
+        current_rev="$(jq -er --arg node "$node_key" '.nodes[$node].locked.rev' flake.lock)"
+
+        if [ "$input_type" != "github" ] || [ -z "$input_owner" ] || [ -z "$input_repo" ]; then
+          echo "::error::${INPUT_NAME} is not a GitHub-backed flake input"
+          exit 1
+        fi
+
+        echo "Input: $INPUT_NAME"
+        echo "Repository: ${input_owner}/${input_repo}"
+        echo "Current revision: $current_rev"
+
+        if [ "$SKIP_DELAY" = "true" ]; then
+          nix flake update "$INPUT_NAME"
+        else
+          cutoff="$(date --utc --date="${MINIMUM_RELEASE_AGE_DAYS} days ago" +%Y-%m-%dT%H:%M:%SZ)"
+          api_args=(
+            --method GET
+            "repos/${input_owner}/${input_repo}/commits"
+            -f "until=$cutoff"
+            -f per_page=1
+          )
+          if [ -n "$input_ref" ]; then
+            api_args+=(-f "sha=$input_ref")
+          fi
+
+          echo "Selecting the newest commit no later than $cutoff"
+          target_data="$(gh api "${api_args[@]}" --jq '.[0] | {sha: .sha, date: .commit.committer.date}')"
+          target_rev="$(jq -er '.sha' <<< "$target_data")"
+          target_date="$(jq -er '.date' <<< "$target_data")"
+
+          if [ "$target_rev" = "$current_rev" ]; then
+            echo "The input is already at the newest eligible revision"
+            {
+              echo "updated=false"
+              echo "current_version=$current_rev"
+              echo "new_version=$current_rev"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          current_date="$(
+            gh api "repos/${input_owner}/${input_repo}/commits/${current_rev}" \
+              --jq '.commit.committer.date'
+          )"
+          current_timestamp="$(date --date="$current_date" +%s)"
+          target_timestamp="$(date --date="$target_date" +%s)"
+
+          if [ "$target_timestamp" -lt "$current_timestamp" ]; then
+            echo "The newest eligible revision is older than the current revision; skipping"
+            {
+              echo "updated=false"
+              echo "current_version=$current_rev"
+              echo "new_version=$current_rev"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          nix flake update "$INPUT_NAME" \
+            --override-input "$INPUT_NAME" "github:${input_owner}/${input_repo}/${target_rev}"
+        fi
+
+        if git diff --quiet -- flake.lock; then
+          echo "No lock file changes were produced"
+          {
+            echo "updated=false"
+            echo "current_version=$current_rev"
+            echo "new_version=$current_rev"
+          } >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        new_node_key="$(
+          jq -er --arg input "$INPUT_NAME" '
+            .nodes.root.inputs[$input]
+            | if type == "array" then .[0] else . end
+          ' flake.lock
+        )"
+        new_rev="$(jq -er --arg node "$new_node_key" '.nodes[$node].locked.rev' flake.lock)"
+
+        echo "New revision: $new_rev"
+        {
+          echo "updated=true"
+          echo "current_version=$current_rev"
+          echo "new_version=$new_rev"
+          echo "input_owner=$input_owner"
+          echo "input_repo=$input_repo"
+        } >> "$GITHUB_OUTPUT"
+    - name: Create or update pull request
+      id: pull-request
+      if: steps.update.outputs.updated == 'true'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        INPUT_NAME: ${{ inputs.input-name }}
+        BASE_BRANCH: ${{ inputs.base-branch }}
+        CURRENT_REV: ${{ steps.update.outputs.current_version }}
+        NEW_REV: ${{ steps.update.outputs.new_version }}
+        INPUT_OWNER: ${{ steps.update.outputs.input_owner }}
+        INPUT_REPO: ${{ steps.update.outputs.input_repo }}
+        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
+        SKIP_DELAY: ${{ inputs.skip-delay }}
+        AUTO_MERGE: ${{ inputs.auto-merge }}
+        PR_LABELS: ${{ inputs.pr-labels }}
+      run: |
+        set -euo pipefail
+
+        branch_suffix="$(tr -c 'A-Za-z0-9._-' '-' <<< "$INPUT_NAME" | sed 's/-$//')"
+        branch="update-flake-${branch_suffix}"
+        current_short="${CURRENT_REV:0:8}"
+        new_short="${NEW_REV:0:8}"
+        title="chore(nix): update ${INPUT_NAME} to ${new_short}"
+
+        if [ "$SKIP_DELAY" = "true" ]; then
+          age_note="The minimum release age check was skipped for this manually requested update."
+        else
+          age_note="The target commit is at least ${MINIMUM_RELEASE_AGE_DAYS} days old."
+        fi
+
+        body="$(
+          printf '%s\n' \
+            "Automated update of the \`${INPUT_NAME}\` flake input." \
+            "" \
+            "- Previous revision: [\`${current_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${CURRENT_REV})" \
+            "- New revision: [\`${new_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${NEW_REV})" \
+            "- Changes: [compare](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/compare/${CURRENT_REV}...${NEW_REV})" \
+            "" \
+            "$age_note"
+        )"
+
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add flake.lock
+        git switch -C "$branch"
+        git commit -m "$title"
+
+        git fetch origin "refs/heads/${branch}:refs/remotes/origin/${branch}" || true
+        git push --force-with-lease origin "HEAD:refs/heads/${branch}"
+
+        label_args=()
+        available_labels="$(gh label list --limit 100 --json name --jq '.[].name')"
+        IFS=',' read -ra requested_labels <<< "$PR_LABELS"
+        for label in "${requested_labels[@]}"; do
+          label="$(xargs <<< "$label")"
+          if [ -n "$label" ] && grep -Fxq "$label" <<< "$available_labels"; then
+            label_args+=(--add-label "$label")
+          elif [ -n "$label" ]; then
+            echo "::warning::Skipping missing pull request label: $label"
+          fi
+        done
+
+        pr_number="$(
+          gh pr list \
+            --state open \
+            --head "$branch" \
+            --json number \
+            --jq '.[0].number // empty'
+        )"
+
+        if [ -n "$pr_number" ]; then
+          gh pr edit "$pr_number" \
+            --title "$title" \
+            --body "$body" \
+            "${label_args[@]}"
+        else
+          gh pr create \
+            --base "$BASE_BRANCH" \
+            --head "$branch" \
+            --title "$title" \
+            --body "$body"
+          pr_number="$(
+            gh pr list \
+              --state open \
+              --head "$branch" \
+              --json number \
+              --jq '.[0].number'
+          )"
+          if [ "${#label_args[@]}" -gt 0 ]; then
+            gh pr edit "$pr_number" "${label_args[@]}"
+          fi
+        fi
+
+        if [ "$AUTO_MERGE" = "true" ]; then
+          gh pr merge "$pr_number" --auto --squash ||
+            echo "::warning::Auto-merge could not be enabled; check the repository merge settings"
+        fi
+
+        pr_url="$(gh pr view "$pr_number" --json url --jq '.url')"
+        echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
+        echo "Pull request: $pr_url"

.github/workflows/nixos-ci.yml

@@ -0,0 +1,150 @@
+name: NixOS CI
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: nixos-ci-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  validate:
+    name: Validate flake
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      hosts: ${{ steps.hosts.outputs.hosts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+      - name: Check flake and evaluate all outputs
+        run: nix flake check --all-systems --no-build --show-trace
+      - name: Discover NixOS hosts
+        id: hosts
+        run: |
+          hosts=$(nix eval --json '.#nixosConfigurations' --apply 'configs: builtins.attrNames configs')
+          echo "hosts=$hosts" >> "$GITHUB_OUTPUT"
+          echo "Discovered hosts: $hosts"
+  build:
+    name: Build ${{ matrix.host }}
+    needs: validate
+    if: ${{ needs.validate.outputs.hosts != '[]' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        host: ${{ fromJSON(needs.validate.outputs.hosts) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+      - name: Build NixOS system
+        run: |
+          nix build ".#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel" \
+            --no-link \
+            --print-build-logs \
+            --show-trace
+  report-main-status:
+    name: Report main status
+    needs:
+      - validate
+      - build
+    if: ${{ always() && !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    env:
+      CI_FAILED: ${{ needs.validate.result == 'failure' || needs.build.result == 'failure' }}
+      JOB_RESULTS: ${{ toJSON(needs) }}
+    steps:
+      - name: Create or resolve failure issue
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const title = "NixOS CI is failing on main";
+            const marker = "<!-- nixos-ci-main-failure -->";
+            const failed = process.env.CI_FAILED === "true";
+            const jobs = JSON.parse(process.env.JOB_RESULTS);
+            const failedJobs = Object.entries(jobs)
+              .filter(([, job]) => job.result === "failure")
+              .map(([name]) => `\`${name}\``)
+              .join(", ");
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const commitUrl = `${context.serverUrl}/${owner}/${repo}/commit/${context.sha}`;
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner,
+              repo,
+              state: "open",
+              per_page: 100,
+            });
+            const existing = issues.find(
+              (issue) => !issue.pull_request && issue.title === title && issue.body?.includes(marker),
+            );
+
+            if (failed) {
+              const body = [
+                marker,
+                "The NixOS CI workflow failed after a push to `main`.",
+                "",
+                `- Failed jobs: ${failedJobs || "unknown"}`,
+                `- Commit: [\`${context.sha.slice(0, 7)}\`](${commitUrl})`,
+                `- Workflow run: [${context.runId}](${runUrl})`,
+                "",
+                "This issue is updated on subsequent failures and closed automatically after CI recovers.",
+              ].join("\n");
+
+              if (existing) {
+                await github.rest.issues.update({
+                  owner,
+                  repo,
+                  issue_number: existing.number,
+                  body,
+                });
+              } else {
+                await github.rest.issues.create({ owner, repo, title, body });
+              }
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: existing.number,
+                body: `CI recovered in [workflow run ${context.runId}](${runUrl}).`,
+              });
+              await github.rest.issues.update({
+                owner,
+                repo,
+                issue_number: existing.number,
+                state: "closed",
+                state_reason: "completed",
+              });
+            }

.github/workflows/nixos.yaml

@@ -1,51 +0,0 @@
-# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
-name: "CI: NixOS"
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - flake.nix
-      - flake.lock
-      - "flake/**"
-      - "hosts/**"
-      - "libs/**"
-      - "modules/**"
-      - "overlays/**"
-      - "shells/**"
-      - "tests/**"
-      - ".github/actions/check-nixos/**"
-      - ".github/actions/setup-nix/**"
-      - ".github/workflows/nixos.yaml"
-  pull_request:
-    paths:
-      - flake.nix
-      - flake.lock
-      - "flake/**"
-      - "hosts/**"
-      - "libs/**"
-      - "modules/**"
-      - "overlays/**"
-      - "shells/**"
-      - "tests/**"
-      - ".github/actions/check-nixos/**"
-      - ".github/actions/setup-nix/**"
-      - ".github/workflows/nixos.yaml"
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-jobs:
-  check:
-    name: Check all NixOS configurations
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Setup Nix
-        uses: ./.github/actions/setup-nix
-      - name: Check NixOS configurations
-        uses: ./.github/actions/check-nixos

.github/workflows/renovate.yml

@@ -0,0 +1,31 @@
+name: Renovate
+on:
+  schedule:
+    # Every day at 03:00 JST (18:00 UTC on the previous day).
+    - cron: "0 18 * * *"
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+jobs:
+  renovate:
+    name: Update GitHub Actions dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Use a PAT or GitHub App token so Renovate PRs trigger the other workflows.
+      - name: Run Renovate
+        uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200 # v46.1.20
+        with:
+          renovate-version: 43.262.1
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          LOG_LEVEL: info
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}

.github/workflows/update-flake-inputs.yml

@@ -0,0 +1,106 @@
+name: Update Flake Inputs
+on:
+  schedule:
+    # Every day at 03:30 JST (18:30 UTC on the previous day).
+    - cron: "30 18 * * *"
+  workflow_dispatch:
+    inputs:
+      input:
+        description: Update only this flake input (empty updates all inputs)
+        required: false
+        type: string
+      skip-delay:
+        description: Update to the latest revision without the three-day delay
+        required: false
+        default: false
+        type: boolean
+      auto-merge:
+        description: Enable auto-merge after required checks pass
+        required: false
+        default: true
+        type: boolean
+permissions:
+  contents: write
+  pull-requests: write
+concurrency:
+  group: update-flake-inputs
+  cancel-in-progress: false
+jobs:
+  discover:
+    name: Discover flake inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.inputs.outputs.matrix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build update matrix
+        id: inputs
+        env:
+          REQUESTED_INPUT: ${{ inputs.input }}
+        run: |
+          set -euo pipefail
+
+          github_inputs="$(
+            jq -c '
+              . as $lock
+              | [
+                  $lock.nodes.root.inputs
+                  | to_entries[]
+                  | .key as $name
+                  | (
+                      .value
+                      | if type == "array" then .[0] else . end
+                    ) as $node
+                  | select($lock.nodes[$node].locked.type == "github")
+                  | $name
+                ]
+              | sort
+            ' flake.lock
+          )"
+
+          if [ -n "$REQUESTED_INPUT" ]; then
+            if ! jq -e --arg input "$REQUESTED_INPUT" 'index($input) != null' <<< "$github_inputs" >/dev/null; then
+              echo "::error::Unknown or unsupported flake input: $REQUESTED_INPUT"
+              exit 1
+            fi
+            matrix="$(jq -cn --arg input "$REQUESTED_INPUT" '{input: [$input]}')"
+          else
+            matrix="$(jq -cn --argjson inputs "$github_inputs" '{input: $inputs}')"
+          fi
+
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          echo "Update matrix: $matrix"
+  update:
+    name: Update ${{ matrix.input }}
+    needs: discover
+    if: ${{ needs.discover.outputs.matrix != '{"input":[]}' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RENOVATE_TOKEN }}
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ secrets.RENOVATE_TOKEN }}
+      - name: Update input
+        uses: ./.github/actions/update-flake-input
+        with:
+          input-name: ${{ matrix.input }}
+          github-token: ${{ secrets.RENOVATE_TOKEN }}
+          skip-delay: ${{ github.event_name == 'workflow_dispatch' && inputs.skip-delay }}
+          auto-merge: ${{ github.event_name != 'workflow_dispatch' || inputs.auto-merge }}

.github/workflows/update-flake.yaml

@@ -1,48 +0,0 @@
-# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/update-flake.yaml
-name: "Bot: Update flake inputs"
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-permissions:
-  contents: write
-  pull-requests: write
-jobs:
-  update:
-    name: Update and validate flake inputs
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Setup Nix
-        uses: ./.github/actions/setup-nix
-      - name: Update flake inputs
-        id: update
-        run: |
-          nix flake update
-          if git diff --quiet -- flake.lock; then
-            echo 'changed=false' >> "$GITHUB_OUTPUT"
-          else
-            echo 'changed=true' >> "$GITHUB_OUTPUT"
-          fi
-      - name: Check updated NixOS configurations
-        if: steps.update.outputs.changed == 'true'
-        uses: ./.github/actions/check-nixos
-      - name: Create update pull request
-        if: steps.update.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          add-paths: flake.lock
-          branch: automation/update-flake-lock
-          delete-branch: true
-          commit-message: "flake: update inputs"
-          title: "flake: update inputs"
-          body: |
-            Automated update of `flake.lock`.
-
-            The updated inputs passed the Registry tests and a build of every NixOS configuration.

.gitignore

@@ -4,7 +4,6 @@
 !README.md
 !LICENSE
 !AGENTS.md
-!/docs/
 
 !.github/
 !.gitea/
@@ -15,18 +14,15 @@
 
 !/flake.nix
 !/flake.lock
+!/renovate.json
+
+!shells/
+!hosts/
+!overlays/
+!profiles/
+!modules/
+!docs/
+!images/
+!secrets/
 
-!/shells/
 !/flake/
-!/overlays/
-
-!/images/
-!/secrets/
-
-!/windows/
-
-!/hosts/
-!/libs/
-!/modules/
-
-!/tests/

.sops.yaml

@@ -3,7 +3,6 @@ keys:
   - &host_x1g13 age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
   - &host_ops age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
   - &host_internal-app-01 age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
-  - &host_galleria age1wh7r9wnvyrgt5efjvg2324khsf4w6e9atpmz2udr4uw7frhnvvwquzcu72
 creation_rules:
   - path_regex: ^secrets/common/[^/]+\.ya?ml$
     key_groups:
@@ -12,7 +11,6 @@ creation_rules:
           - *host_x1g13
           - *host_ops
           - *host_internal-app-01
-          - *host_galleria
   - path_regex: ^secrets/hosts/x1g13/[^/]+\.ya?ml$
     key_groups:
       - age:

README.md

@@ -1,3 +1,191 @@
-# moons14 dotfiles
+# dotfiles
 
-My NixOS + Home Manager configurations build with flake.
+My NixOS + Home Manager configurations built with flake-parts.
+
+## Overview
+
+- **OS**: NixOS 26.05 (stable) + nixpkgs-unstable
+- **Window Manager**: Niri (Wayland)
+- **Shell**: Zsh
+- **Terminal**: Ghostty
+- **Editor**: Neovim (nixvim), VSCode
+- **Launcher**: Vicinae
+- **Theme**: Stylix (Dracula)
+- **Secrets**: sops-nix + age + YubiKey
+
+## Hosts
+
+| Host          | Description     | Profiles                                     |
+| ------------- | --------------- | -------------------------------------------- |
+| `x1g13`       | ThinkPad laptop | gui, thinkpad, dev, personal, secure-storage |
+| `nix-example` | VM              | cli-interactive, vm, dev, remote             |
+| `installer`   | NixOS installer | (standalone)                                 |
+
+## Directory Structure
+
+```
+.
+├── flake.nix              # Flake inputs and outputs
+├── flake/
+│   ├── formatter.nix      # treefmt configuration (nixfmt, deadnix, statix, etc.)
+│   └── git-hooks.nix      # pre-commit hooks
+├── hosts/
+│   ├── default.nix        # mkSystem helper and host definitions
+│   ├── x1g13/             # ThinkPad host config
+│   ├── nix-example/       # VM host config
+│   └── installer/         # Installer ISO config
+├── modules/
+│   ├── applications/      # Application configs (NixOS + Home Manager)
+│   │   ├── niri/          # Wayland compositor
+│   │   ├── ghostty/       # Terminal emulator
+│   │   ├── vim/           # Neovim (nixvim)
+│   │   ├── vscode/        # VSCode
+│   │   ├── zsh/           # Shell
+│   │   ├── zellij/        # Terminal multiplexer
+│   │   ├── git/           # Git config
+│   │   ├── docker.nix     # Container runtime
+│   │   ├── tailscale.nix  # VPN
+│   │   ├── claude/        # Claude Code
+│   │   ├── opencode.nix   # OpenCode
+│   │   └── ...            # chrome, discord, zoom, slack, etc.
+│   ├── system/            # NixOS system configs
+│   │   ├── audio.nix      # PipeWire
+│   │   ├── boot/          # Bootloader (systemd-boot, lanzaboote)
+│   │   ├── disko.nix      # Disk partitioning
+│   │   ├── fonts.nix      # Fonts
+│   │   ├── network/       # Networking
+│   │   ├── sops.nix       # Secrets management
+│   │   ├── user/          # User accounts
+│   │   └── ...
+│   ├── features/          # Feature bundles (abstraction layer)
+│   │   ├── application/   # browser, communication
+│   │   ├── boot/          # UEFI
+│   │   ├── cli/           # base, interactive, shell
+│   │   ├── connect/       # WiFi, Bluetooth
+│   │   ├── dev/           # agent, nix, python, bun, java, arduino
+│   │   ├── gui/           # desktop, terminal, audio, editor, capture
+│   │   ├── identity/      # SSH key, fingerprint
+│   │   ├── network/       # Tailscale
+│   │   ├── services/      # container, KDE
+│   │   └── storage/       # disko
+│   ├── drivers/           # Hardware drivers (Intel)
+│   └── integrations/      # Home Manager integration
+├── profiles/
+│   ├── interfaces/        # cli-minimal, cli-interactive, gui
+│   ├── platforms/         # desktop, laptop, thinkpad, vm
+│   └── workloads/         # dev, personal, srv, remote, secure-storage
+├── overlays/              # nixpkgs overlays
+├── shells/                # devShells (pre-commit hooks, sops, age)
+├── secrets/               # Encrypted secrets (sops)
+└── docs/                  # Documentation
+```
+
+## Architecture
+
+```
+profile (enable features)
+  → features (bundle applications/system + add packages)
+    → applications (system.nix + home.nix)
+    → system (NixOS config)
+```
+
+### Module Patterns
+
+**Simple Module** — Single file for NixOS-only or Home Manager-only configs:
+
+```nix
+{ lib, config, ... }:
+let cfg = config.my.system.audio;
+in {
+  options.my.system.audio.enable = lib.mkEnableOption "Audio";
+  config = lib.mkIf cfg.enable { ... };
+}
+```
+
+**Complex Module** — Directory with `default.nix`, `system.nix`, `home.nix`:
+
+```
+modules/applications/<app>/
+├── default.nix    # Master enable + imports
+├── system.nix     # NixOS config
+└── home.nix       # Home Manager config (sharedModules)
+```
+
+**Feature Module** — Bundles multiple applications/system modules:
+
+```nix
+{ lib, config, ... }:
+let cfg = config.my.features.gui.desktop;
+in {
+  options.my.features.gui.desktop.enable = lib.mkEnableOption "Desktop";
+  config = lib.mkIf cfg.enable {
+    my.applications = { niri.enable = true; gtk.enable = true; ... };
+  };
+}
+```
+
+**Profile** — Thin layer that only enables features:
+
+```nix
+{
+  my.features = {
+    gui.desktop.enable = true;
+    dev.agent.enable = true;
+  };
+}
+```
+
+## Packages
+
+### CLI
+
+- **Shell**: Zsh with zoxide, direnv
+- **Terminal multiplexer**: Zellij
+- **Editor**: Neovim (nixvim)
+- **Tools**: ripgrep, curl, wget, htop, btop, fastfetch, unzip, unrar
+
+### GUI
+
+- **Compositor**: Niri
+- **Terminal**: Ghostty, Alacritty
+- **Editor**: VSCode
+- **Browser**: Chrome
+- **Launcher**: Vicinae
+- **File manager**: Nautilus
+- **Communication**: Discord, Zoom, Slack
+
+### Development
+
+- **AI agents**: Claude Code, Codex, OpenCode, Grok
+- **Languages**: Python, Bun (JavaScript/TypeScript), Java, Arduino
+- **Container**: Docker
+- **Nix**: nh, nixfmt, deadnix, statix
+
+### System
+
+- **VPN**: Tailscale
+- **Secrets**: sops-nix, age
+- **Boot**: systemd-boot, lanzaboote (Secure Boot)
+- **Disk**: disko
+- **Theme**: Stylix
+
+## Commands
+
+```sh
+nix flake update                           # Update flake inputs
+nix fmt                                    # Format code
+nix develop .#dotnix                       # Enter dev shell
+sudo nixos-rebuild switch --flake .#<host> # Apply config
+sudo nixos-rebuild build --flake .#<host>  # Build without applying
+```
+
+## Inspired
+
+- [Zaney/zaneyos](https://gitlab.com/Zaney/zaneyos)
+- [fa0311/.zshrc](https://gist.github.com/fa0311/d37d53ff39c73c54c883379e8e3732df)
+- [AsianLovesLinux/Niri](https://github.com/AsianLovesLinux/Niri)
+- [natsukium/dotfiles](https://github.com/natsukium/dotfiles)
+- [dracula](https://github.com/dracula)
+- [akazdayo/nix-configs](https://github.com/akazdayo/nix-configs)
+- [yutakobayashidev/dotnix](https://github.com/yutakobayashidev/dotnix)
+- [kawaemon/dotfiles](https://github.com/kawaemon/dotfiles)

flake.lock

@@ -68,28 +68,6 @@
         "type": "github"
       }
     },
-    "browser-previews": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1785530251,
-        "narHash": "sha256-WdjqE36StkaKYhYxmltncwo4cxwrkMwPpJTAftAnRAM=",
-        "owner": "nix-community",
-        "repo": "browser-previews",
-        "rev": "79c9ddd90e793869fa587859b9911bb6050067ec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "browser-previews",
-        "type": "github"
-      }
-    },
     "bun2nix": {
       "inputs": {
         "flake-parts": [
@@ -125,15 +103,15 @@
     },
     "codex-desktop-linux": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1785771258,
+        "lastModified": 1784823421,
-        "narHash": "sha256-4qwZF7xxLBokf6gfIBkymFMQiJ36fbJ9SPkOAp5VI4I=",
+        "narHash": "sha256-/EM7Cr2Ai0VjNbKv+eIW0+iXT/NBW6WbPkCbf9w+u/o=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "ab314923b5bf9b786a16cee67605d9eea2433d84",
+        "rev": "efcf40b5ab41323c8fa8eef5526c6a50c45fd8cd",
         "type": "github"
       },
       "original": {
@@ -144,11 +122,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1784564969,
+        "lastModified": 1784407669,
-        "narHash": "sha256-TkTWNhJV/8Wk3czlbz4bwHZkFCaCHPsOy+oJe4PUiXg=",
+        "narHash": "sha256-gcFMcRjw0ZSn380Rx2QLlU1goUQeSrKX/DF12omI6+o=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "7930f6c291de6f83c257839d434592aa085f290a",
+        "rev": "1316b7d278ad77a16aec024b71d971366e123bec",
         "type": "github"
       },
       "original": {
@@ -180,11 +158,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1783570805,
+        "lastModified": 1782007937,
-        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
+        "narHash": "sha256-PbnJr+eB+9Czol3ReI83dUgEhcn0sDK6TSy6ODTQm88=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
+        "rev": "981bd332015397fb1ca033fa982bd61635160c78",
         "type": "github"
       },
       "original": {
@@ -278,11 +256,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1782949081,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -299,11 +277,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1782949081,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -356,28 +334,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": [
+        "systems": "systems"
-          "browser-previews",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -414,20 +371,20 @@
         "flake-compat": "flake-compat",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs_2",
-        "systems": "systems_3",
+        "systems": "systems_2",
         "zig": "zig",
         "zon2nix": "zon2nix"
       },
       "locked": {
-        "lastModified": 1785770443,
+        "lastModified": 1784868212,
-        "narHash": "sha256-VZ9UpfgG5+Dy17eTLJ8ryV5e7Ki0/0JTA5MhWnfSriw=",
+        "narHash": "sha256-DvPf4hVaD8iEeSfqhPCfAtD9kWkBAODqvxp9rmEBgPo=",
-        "owner": "ghostty-org",
+        "owner": "moons-14",
         "repo": "ghostty",
-        "rev": "863fc9531ae0b8e09b7103a9089dfc00319a7d9c",
+        "rev": "4c725242b7dbe8c77c6e227ef1f9540c5ef17921",
         "type": "github"
       },
       "original": {
-        "owner": "ghostty-org",
+        "owner": "moons-14",
         "repo": "ghostty",
         "type": "github"
       }
@@ -498,11 +455,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1784350909,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
         "type": "github"
       },
       "original": {
@@ -543,11 +500,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1785749642,
+        "lastModified": 1784568171,
-        "narHash": "sha256-5/wlGe3a4ucxvYq2cuAAsuSFWKcIttQ6En83MLlV2jY=",
+        "narHash": "sha256-t17AqLEhPG6m27ipkp8mJd8Ug0XkdANFDVsgyIFBZcQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "f142433bdbeffd2af51231e0aff7162c2bfbf6ef",
+        "rev": "f4b0aef3dba28677a5ca4b3416827aade60b5a0b",
         "type": "github"
       },
       "original": {
@@ -561,15 +518,15 @@
         "bun2nix": "bun2nix",
         "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_4",
-        "systems": "systems_4",
+        "systems": "systems_3",
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785753922,
+        "lastModified": 1785008781,
-        "narHash": "sha256-cRnp7DSvT4BwRI04YSbA0Ocn1iY6+fN9KTfnsADHm3I=",
+        "narHash": "sha256-8/sqtedCCZGZwQQYwvR2LcT+viE99rFOKrU0tcC/HLk=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "8a86f04f5cfbffc5b5d0b38ac24795ab4909b46b",
+        "rev": "cef1a33548bebe53824e7216fe1766a6a79eed97",
         "type": "github"
       },
       "original": {
@@ -588,11 +545,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1785753837,
+        "lastModified": 1784874881,
-        "narHash": "sha256-Lyy16y+SnRqM+vwODCWYYwwvYkKMPPpc1p6l4wevR0M=",
+        "narHash": "sha256-u4jhSIf/Un0qZB+Cn3hTTaHSI20XeAxYbA5o4faqdJs=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "3c93dc3656160f3aedb21d3acf82b5dfe868a539",
+        "rev": "ef7a2a3d719af46b906c22a3ebfb7d65627b2cd2",
         "type": "github"
       },
       "original": {
@@ -621,11 +578,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1785701241,
+        "lastModified": 1784570726,
-        "narHash": "sha256-ircVOzPWRircI39ac/tqJajr5OoJxEVrDlBb05TULEk=",
+        "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "feb3e43f1475e0865bb89cbd1e898b34d1d2ccf6",
+        "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc",
         "type": "github"
       },
       "original": {
@@ -634,27 +591,6 @@
         "type": "github"
       }
     },
-    "nix-darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1783744694,
-        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
-        "owner": "nix-darwin",
-        "repo": "nix-darwin",
-        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-darwin",
-        "ref": "nix-darwin-26.05",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "nix-hazkey": {
       "inputs": {
         "home-manager": "home-manager_3",
@@ -683,11 +619,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785650611,
+        "lastModified": 1784440659,
-        "narHash": "sha256-q4kR7g+pCcz6NASvoVPYu+CWWUurX03wogtBqGmR4h0=",
+        "narHash": "sha256-Q5kNLlWngt7TaIIZoxDKWMHjiSaNRVqr70FqWCRRfr4=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "dbc756c9d7287de19b3e0e38c928c47510d42c3e",
+        "rev": "4f8d52a3598b0dc7db7a5e7b419e3edd9d1ecfdb",
         "type": "github"
       },
       "original": {
@@ -701,11 +637,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1785232496,
+        "lastModified": 1784723954,
-        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
+        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
+        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
         "type": "github"
       },
       "original": {
@@ -752,11 +688,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1785031560,
+        "lastModified": 1782614948,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -799,11 +735,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1785747939,
+        "lastModified": 1784835677,
-        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
+        "narHash": "sha256-99n/+kX5HRtEouTsNNyz5pMfIpNMp4Um/6nCEDQ9YDs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
+        "rev": "d4221905ef70b7f4a40701ce98e3e25c3d95d082",
         "type": "github"
       },
       "original": {
@@ -814,22 +750,6 @@
       }
     },
     "nixpkgs_10": {
-      "locked": {
-        "lastModified": 1770107345,
-        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_11": {
       "locked": {
         "lastModified": 1772542754,
         "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
@@ -845,7 +765,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_12": {
+    "nixpkgs_11": {
       "locked": {
         "lastModified": 1778869304,
         "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
@@ -892,11 +812,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1785602060,
+        "lastModified": 1784555310,
-        "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=",
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
         "type": "github"
       },
       "original": {
@@ -908,11 +828,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1785692966,
+        "lastModified": 1784796856,
-        "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=",
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "643809054d65fdd466a63e3155b8c498cb483c04",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -953,11 +873,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1785599192,
+        "lastModified": 1784923315,
-        "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
+        "narHash": "sha256-2e5BnQ0YLJMIRII1BdGsLiBcJ1fRVauvZypwZIR2JLw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
+        "rev": "d2f1d98be0573ebf42b96630bc8d7001ff62af43",
         "type": "github"
       },
       "original": {
@@ -969,15 +889,18 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1785571196,
+        "lastModified": 1770107345,
-        "narHash": "sha256-xwSqxTsama0YTtS78+4YyCm6jJg09v78QWfP1cAyoVA=",
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
-        "rev": "148bab9c1c3c53136ecb44a6ea356a0ed5b39b06",
+        "owner": "nixos",
-        "type": "tarball",
+        "repo": "nixpkgs",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1045728.148bab9c1c3c/nixexprs.tar.xz"
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "nixos",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixvim": {
@@ -986,7 +909,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1782919967,
@@ -1005,19 +928,20 @@
     },
     "noctalia": {
       "inputs": {
-        "nixpkgs": "nixpkgs_9"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1785767538,
+        "lastModified": 1784917398,
-        "narHash": "sha256-9foQ31PSKpIu8UWGalt+4G5o4TU21g4a1qwMwJmeOy4=",
+        "narHash": "sha256-lBVMJgBWbC3H6UGlCYiu8pbgUJqWWyJ70n/xIljk/1I=",
         "owner": "noctalia-dev",
         "repo": "noctalia",
-        "rev": "50f0f095053a4b5c10874c4e7080f55dc15d3b38",
+        "rev": "0cd9b22e19fb71455c950a70c11324b7e245a790",
         "type": "github"
       },
       "original": {
         "owner": "noctalia-dev",
-        "ref": "cachix",
         "repo": "noctalia",
         "type": "github"
       }
@@ -1034,11 +958,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785549842,
+        "lastModified": 1783439237,
-        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
+        "narHash": "sha256-WUr8JF2v3n4Y30E5dxv4sAgNJXpVDBoCQNoQ/V4+n4o=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
+        "rev": "b70bb66c7bcd162642f3a609bc16843c7059f503",
         "type": "github"
       },
       "original": {
@@ -1071,7 +995,6 @@
     },
     "root": {
       "inputs": {
-        "browser-previews": "browser-previews",
         "codex-desktop-linux": "codex-desktop-linux",
         "disko": "disko",
         "flake-parts": "flake-parts",
@@ -1081,7 +1004,6 @@
         "lanzaboote": "lanzaboote",
         "llm-agents": "llm-agents",
         "niri-flake": "niri-flake",
-        "nix-darwin": "nix-darwin",
         "nix-hazkey": "nix-hazkey",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
@@ -1093,7 +1015,7 @@
         "services-flake": "services-flake",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
-        "systems": "systems_7",
+        "systems": "systems_6",
         "treefmt-nix": "treefmt-nix_2",
         "vicinae": "vicinae",
         "vicinae-extensions": "vicinae-extensions"
@@ -1107,11 +1029,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785044261,
+        "lastModified": 1784438913,
-        "narHash": "sha256-ehF/c4fLdgmNu7YXEClnmwhoBYddhYIVoSQpsZoorC4=",
+        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "fe2124391e739e7b3e8720cd8a73f06edd0aceba",
+        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
         "type": "github"
       },
       "original": {
@@ -1157,7 +1079,7 @@
     },
     "soulver-cpp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_12",
+        "nixpkgs": "nixpkgs_11",
         "nixpkgs-libxml2": "nixpkgs-libxml2"
       },
       "locked": {
@@ -1187,18 +1109,18 @@
           "nixpkgs"
         ],
         "nur": "nur",
-        "systems": "systems_6",
+        "systems": "systems_5",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1785680312,
+        "lastModified": 1784676123,
-        "narHash": "sha256-e26BuraMqnara0VXVk9nsQLgGC+8nvEgYNc6odv5Yi8=",
+        "narHash": "sha256-ndyanKzw90yX2nUVFmTuYqXidUNymtMfgmIHyNdhht0=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "04b284060ffa638f080ab1b2d05cf1f236217995",
+        "rev": "66714e5ce44269ecc58c20d9196da8dbe1b27a31",
         "type": "github"
       },
       "original": {
@@ -1209,20 +1131,21 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1680978846,
+        "lastModified": 1681028828,
-        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
         "owner": "nix-systems",
-        "repo": "x86_64-linux",
+        "repo": "default",
-        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "x86_64-linux",
+        "repo": "default",
         "type": "github"
       }
     },
     "systems_2": {
+      "flake": false,
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1238,7 +1161,6 @@
       }
     },
     "systems_3": {
-      "flake": false,
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1285,17 +1207,16 @@
     },
     "systems_6": {
       "locked": {
-        "lastModified": 1774449309,
+        "lastModified": 1689347949,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
         "owner": "nix-systems",
-        "repo": "default",
+        "repo": "default-linux",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "ref": "future-26.11",
+        "repo": "default-linux",
-        "repo": "default",
         "type": "github"
       }
     },
@@ -1329,21 +1250,6 @@
         "type": "github"
       }
     },
-    "systems_9": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -1363,11 +1269,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1785153830,
+        "lastModified": 1781968807,
-        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
+        "narHash": "sha256-yYO3Vw2M0y3TAUqt+9+Mj0zwP3XDTF5/PXcPhhFQ1ZM=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
+        "rev": "2ccef2f4b22e3cab5a9292811f7133a07eeba4a7",
         "type": "github"
       },
       "original": {
@@ -1379,11 +1285,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1785031658,
+        "lastModified": 1782012462,
-        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
+        "narHash": "sha256-2iDiD8DQLwS1lGuD9TS8WlvNyDoTs6krWntJbtB2zGo=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
+        "rev": "8c4e750f738a742bd73377ee41d3dadedebedef4",
         "type": "github"
       },
       "original": {
@@ -1395,11 +1301,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1785030526,
+        "lastModified": 1782009766,
-        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
+        "narHash": "sha256-VUhBjpGvWqHI7rWeyMYb/u87YJSXHKfVV6S+IelWeO8=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
+        "rev": "5e8350bcd354e3241ab681a265fa6ef060c40be1",
         "type": "github"
       },
       "original": {
@@ -1416,11 +1322,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1784369104,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {
@@ -1431,14 +1337,14 @@
     },
     "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1784369104,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {
@@ -1449,16 +1355,16 @@
     },
     "vicinae": {
       "inputs": {
-        "nixpkgs": "nixpkgs_11",
+        "nixpkgs": "nixpkgs_10",
         "soulver-cpp": "soulver-cpp",
-        "systems": "systems_8"
+        "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1785733880,
+        "lastModified": 1784839524,
-        "narHash": "sha256-Rv4rVFSvxF7ViOQOrv+N8IEvweS5MCqUM2fnaQVIR+w=",
+        "narHash": "sha256-B87U5HDB/6JPxSnNQwnIiwtqUWvyxzqs7lV/GPzva68=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "61bd7cd5c9cdd6d8df6e6d34531beb344219ff71",
+        "rev": "632ca79e9f8fc9721384921f28ec069ff48aaf53",
         "type": "github"
       },
       "original": {
@@ -1473,15 +1379,15 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_9",
+        "systems": "systems_8",
         "vicinae": "vicinae_2"
       },
       "locked": {
-        "lastModified": 1785689597,
+        "lastModified": 1784504910,
-        "narHash": "sha256-WF3eenopWI9tvwcEhDsgEp2T46QFWw7ttEGefokLEZ0=",
+        "narHash": "sha256-fzPBEJZiRvc/FNMdpbdcfaZzF01U4IQenHW9IQFzhos=",
         "owner": "vicinaehq",
         "repo": "extensions",
-        "rev": "37724bc3f2bcdf9f273bb160359cf22f453b5ef6",
+        "rev": "ca74eede9a778a9373c8f5fd221b0a5026dcd1ef",
         "type": "github"
       },
       "original": {

flake.nix

@@ -11,11 +11,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    nix-darwin = {
-      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # Hardware / Platform
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     nixos-wsl.url = "github:nix-community/NixOS-WSL";
@@ -23,11 +18,6 @@
     # Desktop
     niri-flake.url = "github:sodiboo/niri-flake";
 
-    nix-hazkey = {
-      url = "github:aster-void/nix-hazkey";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -35,7 +25,7 @@
 
     # Terminal
     ghostty = {
-      url = "github:ghostty-org/ghostty";
+      url = "github:moons-14/ghostty";
     };
 
     # Shell / Launcher
@@ -46,7 +36,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    noctalia.url = "github:noctalia-dev/noctalia/cachix";
+    noctalia = {
+      url = "github:noctalia-dev/noctalia";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # Editor
     nixvim = {
@@ -98,10 +91,11 @@
     };
 
     # Systems
-    systems.url = "github:nix-systems/default";
+    systems.url = "github:nix-systems/default-linux";
 
-    browser-previews = {
+    # Japanese Input Method
-      url = "github:nix-community/browser-previews";
+    nix-hazkey = {
+      url = "github:aster-void/nix-hazkey";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -117,8 +111,10 @@
 
       imports = [
         ./overlays
+        ./hosts
         ./shells
-        ./flake
+        ./flake/formatter.nix
+        ./flake/git-hooks.nix
       ];
     };
 }

flake/default.nix

@@ -1,7 +0,0 @@
-{
-  imports = [
-    ./formatter.nix
-    ./git-hooks.nix
-    ./registry.nix
-  ];
-}

flake/registry.nix

@@ -1,54 +0,0 @@
-{
-  inputs,
-  lib,
-  ...
-}:
-let
-  dotfilesLib = import ../libs {
-    inherit inputs lib;
-    root = ../.;
-  };
-  hostSpecsPath = ../hosts/default.nix;
-  hostSpecs =
-    if builtins.pathExists hostSpecsPath then
-      let
-        value = import hostSpecsPath;
-      in
-      if builtins.isFunction value then
-        value (
-          builtins.intersectAttrs (builtins.functionArgs value) {
-            inherit inputs lib;
-          }
-        )
-      else
-        value
-    else
-      { };
-  configurations = dotfilesLib.hosts.mkConfigurations hostSpecs;
-in
-{
-  flake = {
-    inherit (configurations) darwinConfigurations nixosConfigurations;
-    lib = dotfilesLib;
-  };
-
-  perSystem =
-    { pkgs, system, ... }:
-    let
-      nixosChecks =
-        lib.mapAttrs' (name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel)
-          (
-            lib.filterAttrs (
-              _: nixos: nixos.pkgs.stdenv.hostPlatform.system == system
-            ) configurations.nixosConfigurations
-          );
-    in
-    {
-      checks = {
-        registry = import ../tests/registry.nix {
-          inherit inputs lib pkgs;
-        };
-      }
-      // nixosChecks;
-    };
-}

hosts/default.nix

@@ -1,135 +1,113 @@
 {
-  nix-example = {
+  inputs,
-    system = "x86_64-linux";
+  config,
-    stateVersion = "26.05";
+  lib,
-    user = "moons";
+  ...
-    path = ./nix-example;
+}:
+let
+  inherit (inputs.nixpkgs.lib) nixosSystem;
 
+  username = "moons";
+
+  mkSystem =
+    {
+      host,
+      system,
+      profiles ? [ ],
+      extraModules ? [ ],
+    }:
+    let
+      unstable = import inputs.nixpkgs-unstable {
+        inherit system;
+        config = {
+          allowUnfree = true;
+        };
+      };
+    in
+    assert lib.assertMsg (lib.elem system config.systems)
+      "mkSystem: system '${system}' not in valid systems: ${lib.generators.toPretty { } config.systems}";
+    nixosSystem {
+      inherit system;
+      modules = [
+        {
+          nixpkgs.config.allowUnfree = true;
+          nixpkgs.overlays = builtins.attrValues inputs.self.overlays;
+        }
+        ../modules
+        ./${host}/default.nix
+      ]
+      ++ map (p: ../profiles/${p}.nix) profiles
+      ++ extraModules;
+      specialArgs = {
+        inherit
+          inputs
+          username
+          unstable
+          host
+          ;
+      };
+    };
+
+  nixosConfigurations = {
+    nix-example = mkSystem {
+      host = "nix-example";
+      system = "x86_64-linux";
       profiles = [
-      "base"
+        "interfaces/cli-interactive"
-      "interface.cli"
+        "platforms/vm"
-      "platform.vm"
+        "workloads/dev"
-      "workload.development"
+        "workloads/remote"
-      "workload.remote-access"
+      ];
+    };
+    ops = mkSystem {
+      host = "ops";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/cli-interactive"
+        "platforms/vm"
+        "workloads/remote"
       ];
     };
 
-  ops = {
+    internal-app-01 = mkSystem {
+      host = "internal-app-01";
       system = "x86_64-linux";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./ops;
-
       profiles = [
-      "base"
+        "interfaces/cli-interactive"
-      "interface.cli"
+        "platforms/vm"
-      "platform.vm"
+        "workloads/srv"
-      "workload.remote-access"
+      ];
+    };
+    x1g13 = mkSystem {
+      host = "x1g13";
+      system = "x86_64-linux";
+      profiles = [
+        "interfaces/gui"
+        "platforms/thinkpad"
+        "workloads/dev"
+        "workloads/personal"
+        "workloads/secure-storage"
+        "workloads/tailscale/client"
       ];
     };
 
-  internal-app-01 = {
+    installer = nixosSystem {
       system = "x86_64-linux";
-    stateVersion = "26.05";
+      modules = [
-    user = "moons";
+        ./installer/default.nix
-    path = ./internal-app-01;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "platform.vm"
-      "workload.server"
       ];
+      specialArgs = {
+        inherit inputs;
       };
-
-  installer = {
-    system = "x86_64-linux";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./installer;
-    homeManager = false;
-
-    profiles = [ "base" ];
     };
-
-  x1g9 = {
-    system = "x86_64-linux";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./x1g9;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.labwc"
-      "interface.niri"
-      "platform.thinkpad-x1"
-      "security.fingerprint"
-      # "security.secrets"
-      "workload.personal"
-    ];
   };
+in
+{
+  flake = {
+    inherit nixosConfigurations;
 
-  x1g13 = {
+    checks.x86_64-linux = lib.mapAttrs' (
-    system = "x86_64-linux";
+      name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel
-    stateVersion = "26.05";
+    ) nixosConfigurations;
-    user = "moons";
-    path = ./x1g13;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.labwc"
-      "interface.niri"
-      "networking.tailscale-client"
-      "platform.thinkpad-x1"
-      "security.fingerprint"
-      "security.secrets"
-      "security.secure-boot"
-      "security.tpm-storage"
-      "workload.development"
-      "workload.game"
-      "workload.personal"
-    ];
-  };
-
-  galleria = {
-    system = "x86_64-linux";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./galleria;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.labwc"
-      "interface.niri"
-      "platform.intel-nvidia-desktop"
-      "security.secrets"
-      "security.secure-boot"
-      "security.tpm-storage"
-      "security.fingerprint"
-      "workload.development"
-      "workload.game"
-      "workload.personal"
-    ];
-  };
-
-  m2 = {
-    system = "aarch64-darwin";
-    stateVersion = "26.05";
-    user = "moons";
-    path = ./m2;
-
-    profiles = [
-      "base"
-      "interface.cli"
-      "interface.macos"
-      "security.fingerprint"
-      # "security.secrets"
-      "workload.development"
-      "workload.game"
-      "workload.personal"
-    ];
   };
 }

hosts/galleria/disko.nix

@@ -1,91 +0,0 @@
-_:
-let
-  espPart = "/dev/disk/by-partuuid/008b04ef-9c06-4049-bffb-3906f5c3a9c1";
-  nixosPart = "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
-
-  btrfsMountOptions = [
-    "compress=zstd"
-    "noatime"
-    "ssd"
-    "space_cache=v2"
-  ];
-in
-{
-  disko.enableConfig = true;
-
-  # These are deliberately partition paths, not the whole Windows disk. Disko
-  # must never own or destroy the disk's GPT or any Windows partition.
-  disko.devices.disk = {
-    esp = {
-      type = "disk";
-      device = espPart;
-      destroy = false;
-
-      content = {
-        type = "filesystem";
-        format = "vfat";
-        mountpoint = "/boot";
-        mountOptions = [ "umask=0077" ];
-      };
-    };
-
-    nixos = {
-      type = "disk";
-      device = nixosPart;
-      destroy = false;
-
-      content = {
-        type = "luks";
-        name = "cryptroot";
-        askPassword = true;
-        settings.allowDiscards = true;
-
-        extraFormatArgs = [
-          "--type"
-          "luks2"
-          "--pbkdf"
-          "argon2id"
-          "--label"
-          "NixOS-LUKS"
-        ];
-
-        content = {
-          type = "btrfs";
-          extraArgs = [
-            "-f"
-            "-L"
-            "NixOS"
-          ];
-
-          subvolumes = {
-            "@root" = {
-              mountpoint = "/";
-              mountOptions = btrfsMountOptions;
-            };
-
-            "@home" = {
-              mountpoint = "/home";
-              mountOptions = btrfsMountOptions;
-            };
-
-            "@nix" = {
-              mountpoint = "/nix";
-              mountOptions = btrfsMountOptions;
-            };
-
-            "@log" = {
-              mountpoint = "/var/log";
-              mountOptions = btrfsMountOptions;
-            };
-
-            "@swap" = {
-              mountpoint = "/.swapvol";
-              mountOptions = [ "noatime" ];
-              swap.swapfile.size = "32G";
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/galleria/hardware-configuration.nix

@@ -1,30 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/galleria/home.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  services.kanshi = {
-    enable = true;
-
-    settings = [
-      {
-        profile = {
-          name = "galleria";
-
-          outputs = [
-            {
-              criteria = "HDMI-A-1";
-              status = "enable";
-              position = "0,0";
-              scale = 1.5;
-            }
-            {
-              criteria = "DP-1";
-              status = "enable";
-              position = "2560,0";
-            }
-            {
-              criteria = "DP-2";
-              status = "enable";
-              position = "5120,0";
-              scale = 1.5;
-            }
-          ];
-        };
-      }
-    ];
-  };
-
-  home.file.".wallpapers" = {
-    source = lib.mkForce (
-      config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Pictures/wallpapers"
-    );
-
-    recursive = lib.mkForce false;
-  };
-}

hosts/galleria/nixos.nix

@@ -1,14 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./disko.nix
-  ];
-
-  boot.initrd.luks.devices.cryptroot.device =
-    "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
-
-  environment.systemPackages = with inputs.browser-previews.packages.${pkgs.system}; [
-    google-chrome-beta
-  ];
-}

hosts/installer/default.nix

@@ -5,7 +5,9 @@
   ...
 }:
 {
-  imports = [ "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix" ];
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+  ];
 
   boot.zfs.forceImportRoot = false;
 
@@ -34,28 +36,23 @@
   ];
 
   environment.systemPackages = with pkgs; [
-    git
+    git # Clone dotfiles repository
-    disko
+    disko # Disk partitioning
-    sops
+    sops # Secrets management
-    age
+    age # Age encryption
-    ssh-to-age
+    ssh-to-age # Convert SSH keys to age
-    age-plugin-yubikey
+    age-plugin-yubikey # YubiKey support
-    yubikey-manager
+    yubikey-manager # YubiKey management
-    pcsc-tools
+    pcsc-tools # Smart card tools
-    mkpasswd
+    mkpasswd # Password hash generation
-    rsync
+    rsync # File synchronization
-    vim
+    vim # Text editor
-    wget
+    wget # Download files
-    curl
+    curl # HTTP client
-    jq
+    jq # JSON processor
-    parted
+    parted # Partition tools
-    cryptsetup
+    cryptsetup # LUKS encryption
-    btrfs-progs
+    btrfs-progs # Btrfs filesystem tools
-    efibootmgr
-    pciutils
-    sbctl
-    tpm2-tools
-    util-linux
   ];
 
   services.pcscd.enable = true;
@@ -191,4 +188,6 @@
   };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  system.stateVersion = "26.05";
 }

hosts/internal-app-01/default.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   imports = [
     ./hardware-configuration.nix

hosts/internal-app-01/hardware-configuration.nix

@@ -1,8 +1,12 @@
-# Do not modify this file! It was generated by `nixos-generate-config` and may
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# be overwritten by future invocations.
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 { lib, modulesPath, ... }:
+
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
   boot.initrd.availableKernelModules = [
     "ata_piix"

hosts/internal-app-01/nixos.nix

@@ -1,3 +0,0 @@
-{
-  imports = [ ./hardware-configuration.nix ];
-}

hosts/m2/darwin.nix

@@ -1,10 +0,0 @@
-{ hostName, ... }:
-{
-  # networking.hostName and networking.localHostName are derived from the
-  # registry name; computerName controls the user-visible macOS name.
-  networking.computerName = hostName;
-
-  # Keep this value stable after the first activation. It is independent of
-  # the Home Manager stateVersion in hosts/default.nix.
-  system.stateVersion = 7;
-}

hosts/nix-example/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+}

hosts/nix-example/hardware-configuration.nix

@@ -1,8 +1,15 @@
-# Do not modify this file! It was generated by `nixos-generate-config` and may
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# be overwritten by future invocations.
+# and may be overwritten by future invocations.  Please make changes
-{ lib, modulesPath, ... }:
+# to /etc/nixos/configuration.nix instead.
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
   boot.initrd.availableKernelModules = [
     "ata_piix"

hosts/nix-example/nixos.nix

@@ -1,3 +0,0 @@
-{
-  imports = [ ./hardware-configuration.nix ];
-}

hosts/ops/default.nix

@@ -1,5 +1,8 @@
+{ ... }:
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+  ];
 
   networking = {
     useDHCP = false;
@@ -41,11 +44,13 @@
           }
         ];
       };
+
     };
 
     defaultGateway = {
       address = "10.50.128.1";
       interface = "ens18";
     };
+
   };
 }

hosts/ops/hardware-configuration.nix

@@ -1,8 +1,16 @@
-# Do not modify this file! It was generated by `nixos-generate-config` and may
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# be overwritten by future invocations.
+# and may be overwritten by future invocations.  Please make changes
-{ lib, modulesPath, ... }:
+# to /etc/nixos/configuration.nix instead.
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
   boot.initrd.availableKernelModules = [
     "ata_piix"

hosts/x1g13/default.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   imports = [
     ./hardware-configuration.nix

hosts/x1g13/disko.nix

@@ -1,6 +1,7 @@
 _:
 let
   espPart = "/dev/disk/by-partuuid/a53e3b19-67de-40de-9ded-3eac3117689a";
+
   nixosPart = "/dev/disk/by-partuuid/311d0f9c-f35f-42e6-b6fc-a4d67dd21b2e";
 
   btrfsMountOptions = [
@@ -23,7 +24,9 @@ in
         type = "filesystem";
         format = "vfat";
         mountpoint = "/boot";
-        mountOptions = [ "umask=0077" ];
+        mountOptions = [
+          "umask=0077"
+        ];
       };
     };
 
@@ -35,8 +38,12 @@ in
       content = {
         type = "luks";
         name = "cryptroot";
+
         askPassword = true;
-        settings.allowDiscards = true;
+
+        settings = {
+          allowDiscards = true;
+        };
 
         extraFormatArgs = [
           "--type"
@@ -78,7 +85,10 @@ in
 
             "@swap" = {
               mountpoint = "/.swapvol";
-              mountOptions = [ "noatime" ];
+              mountOptions = [
+                "noatime"
+              ];
+
               swap.swapfile.size = "32G";
             };
           };

hosts/x1g13/hardware-configuration.nix

@@ -1,5 +1,6 @@
-# Do not modify this file! It was generated by `nixos-generate-config`
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations. Make changes in nixos.nix.
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,

hosts/x1g13/home.nix

@@ -1,22 +0,0 @@
-{
-  services.kanshi = {
-    enable = true;
-
-    settings = [
-      {
-        profile = {
-          name = "x1g13";
-
-          outputs = [
-            {
-              criteria = "eDP-1";
-              status = "enable";
-              position = "0,0";
-              scale = 1.5;
-            }
-          ];
-        };
-      }
-    ];
-  };
-}

hosts/x1g9/hardware-configuration.nix

@@ -1,52 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "thunderbolt"
-    "nvme"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/16b29578-6836-414b-a5e1-863bc21c5fc3";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/209A-C8C9";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

libs/default.nix

@@ -1,17 +0,0 @@
-{
-  inputs,
-  lib ? inputs.nixpkgs.lib,
-  root,
-}:
-let
-  registry = import ./registry.nix {
-    inherit inputs lib;
-    modulesRoot = root + "/modules";
-  };
-  hosts = import ./hosts.nix {
-    inherit inputs lib registry;
-  };
-in
-{
-  inherit hosts registry;
-}

libs/hosts.nix

@@ -1,191 +0,0 @@
-{
-  inputs,
-  lib,
-  registry,
-}:
-let
-  ensure =
-    condition: message: value:
-    if condition then value else throw "host registry: ${message}";
-
-  isLinux = system: lib.hasSuffix "-linux" system;
-  isDarwin = system: lib.hasSuffix "-darwin" system;
-
-  hostFile =
-    spec: name:
-    let
-      path = spec.path + "/${name}";
-    in
-    if builtins.pathExists path then path else null;
-
-  selectedUnits =
-    spec:
-    [ "users.${spec.user}" ]
-    ++ map (name: "profiles.${name}") (spec.profiles or [ ])
-    ++ map (name: "applications.${name}") (spec.applications or [ ])
-    ++ (spec.units or [ ]);
-
-  validateSpec =
-    name: spec:
-    ensure (builtins.isAttrs spec) "${name}: host specification must be an attribute set" (
-      ensure (spec ? system && builtins.isString spec.system) "${name}: system is required" (
-        ensure (isLinux spec.system || isDarwin spec.system)
-          "${name}: unsupported system '${spec.system}'; expected a Linux NixOS or Darwin system"
-          (
-            ensure (spec ? user && builtins.isString spec.user && spec.user != "") "${name}: user is required" (
-              ensure (spec ? path && builtins.pathExists spec.path)
-                "${name}: path must name an existing host directory"
-                (
-                  ensure
-                    (
-                      spec ? stateVersion
-                      && builtins.isString spec.stateVersion
-                      && builtins.match "[0-9][0-9]\\.[0-9][0-9]" spec.stateVersion != null
-                    )
-                    "${name}: stateVersion is required and must have the form YY.MM"
-                    (
-                      ensure
-                        (lib.all
-                          (field: builtins.isList (spec.${field} or [ ]) && lib.all builtins.isString (spec.${field} or [ ]))
-                          [
-                            "profiles"
-                            "applications"
-                            "units"
-                          ]
-                        )
-                        "${name}: profiles, applications, and units must be lists of strings"
-                        (ensure (builtins.isBool (spec.homeManager or true)) "${name}: homeManager must be a boolean" spec)
-                    )
-                )
-            )
-          )
-      )
-    );
-
-  mkSpecialArgs = name: spec: {
-    inherit inputs registry;
-    inherit (spec) system;
-    hostName = name;
-    primaryUser = spec.user;
-  };
-
-  mkHomeManagerModule =
-    name: spec: selected:
-    let
-      homePath = hostFile spec "home.nix";
-      homeModules = [
-        (registry.mkModule {
-          class = "home";
-          systemClass = "nixos";
-        })
-        (registry.mkSelectionModule selected)
-        { home.stateVersion = spec.stateVersion; }
-      ]
-      ++ lib.optional (homePath != null) homePath;
-    in
-    {
-      imports = [ inputs.home-manager.nixosModules.home-manager ];
-
-      home-manager = {
-        useGlobalPkgs = true;
-        useUserPackages = true;
-        extraSpecialArgs = mkSpecialArgs name spec;
-        users.${spec.user}.imports = homeModules;
-      };
-    };
-
-  mkDarwinHomeManagerModule =
-    name: spec: selected:
-    let
-      homePath = hostFile spec "home.nix";
-      homeModules = [
-        (registry.mkModule {
-          class = "home";
-          systemClass = "darwin";
-        })
-        (registry.mkSelectionModule selected)
-        { home.stateVersion = spec.stateVersion; }
-      ]
-      ++ lib.optional (homePath != null) homePath;
-    in
-    {
-      imports = [ inputs.home-manager.darwinModules.home-manager ];
-
-      home-manager = {
-        useGlobalPkgs = true;
-        useUserPackages = true;
-        extraSpecialArgs = mkSpecialArgs name spec;
-        users.${spec.user}.imports = homeModules;
-      };
-    };
-
-  mkNixos =
-    name: rawSpec:
-    let
-      spec = validateSpec name rawSpec;
-      selected = registry.validateUnitIds (selectedUnits spec);
-      nixosPath = hostFile spec "nixos.nix";
-      modules = [
-        (registry.mkModule { class = "nixos"; })
-        (registry.mkSelectionModule selected)
-        {
-          networking.hostName = lib.mkDefault name;
-          system.stateVersion = spec.stateVersion;
-        }
-      ]
-      ++ lib.optional (spec.homeManager or true) (mkHomeManagerModule name spec selected)
-      ++ lib.optional (nixosPath != null) nixosPath;
-    in
-    inputs.nixpkgs.lib.nixosSystem {
-      inherit (spec) system;
-      specialArgs = mkSpecialArgs name spec;
-      inherit modules;
-    };
-
-  mkDarwin =
-    name: rawSpec:
-    let
-      spec = validateSpec name rawSpec;
-      selected = registry.validateUnitIds (selectedUnits spec);
-      darwinPath = hostFile spec "darwin.nix";
-      modules = [
-        (registry.mkModule { class = "darwin"; })
-        (registry.mkSelectionModule selected)
-        {
-          networking.hostName = lib.mkDefault name;
-          system.primaryUser = lib.mkDefault spec.user;
-        }
-      ]
-      ++ lib.optional (spec.homeManager or true) (mkDarwinHomeManagerModule name spec selected)
-      ++ lib.optional (darwinPath != null) darwinPath;
-    in
-    ensure (inputs ? nix-darwin) "${name}: the nix-darwin input is required" (
-      inputs.nix-darwin.lib.darwinSystem {
-        inherit (spec) system;
-        specialArgs = mkSpecialArgs name spec;
-        inherit modules;
-      }
-    );
-
-  mkConfigurations =
-    hostSpecs:
-    let
-      validated = lib.mapAttrs validateSpec hostSpecs;
-    in
-    {
-      nixosConfigurations = lib.mapAttrs mkNixos (
-        lib.filterAttrs (_: spec: isLinux spec.system) validated
-      );
-      darwinConfigurations = lib.mapAttrs mkDarwin (
-        lib.filterAttrs (_: spec: isDarwin spec.system) validated
-      );
-    };
-in
-{
-  inherit
-    mkConfigurations
-    mkDarwin
-    mkNixos
-    selectedUnits
-    ;
-}

libs/registry.nix

@@ -1,386 +0,0 @@
-{
-  inputs,
-  lib,
-  modulesRoot,
-}:
-let
-  rootFragmentFiles = {
-    common = "common.nix";
-    nixos = "nixos.nix";
-    darwin = "darwin.nix";
-    home = "home.nix";
-    meta = "meta.nix";
-  };
-
-  homeFragmentFiles = {
-    homeCommon = "common.nix";
-    homeNixos = "nixos.nix";
-    homeDarwin = "darwin.nix";
-  };
-
-  fragmentFileNames = rootFragmentFiles // lib.mapAttrs (_: name: "home/${name}") homeFragmentFiles;
-
-  isFile = kind: kind == "regular" || kind == "symlink";
-
-  ensure =
-    condition: message: value:
-    if condition then value else throw "unit registry: ${message}";
-
-  callWithAvailableArgs =
-    value: availableArgs:
-    if builtins.isFunction value then
-      value (builtins.intersectAttrs (builtins.functionArgs value) availableArgs)
-    else
-      value;
-
-  pathFor =
-    relativePath:
-    if relativePath == [ ] then
-      modulesRoot
-    else
-      modulesRoot + "/${lib.concatStringsSep "/" relativePath}";
-
-  entryIsFile = entries: name: builtins.hasAttr name entries && isFile entries.${name};
-
-  normalizeMeta =
-    unit:
-    let
-      metaPath = unit.fragments.meta;
-      importedValue =
-        if metaPath == null then
-          { }
-        else
-          callWithAvailableArgs (import metaPath) {
-            inherit inputs lib unit;
-          };
-      imported =
-        ensure (builtins.isAttrs importedValue) "${unit.id}: meta.nix must return an attribute set"
-          importedValue;
-      allowedKeys = [
-        "description"
-        "includes"
-        "imports"
-      ];
-      unknownKeys = lib.filter (name: !(builtins.elem name allowedKeys)) (builtins.attrNames imported);
-      description = imported.description or null;
-      includes = imported.includes or [ ];
-      imports = imported.imports or { };
-      allowedImportKeys = [
-        "nixos"
-        "darwin"
-        "home"
-      ];
-      unknownImportKeys =
-        if builtins.isAttrs imports then
-          lib.filter (name: !(builtins.elem name allowedImportKeys)) (builtins.attrNames imports)
-        else
-          [ ];
-      normalized = {
-        inherit description includes;
-        imports = {
-          nixos = imports.nixos or [ ];
-          darwin = imports.darwin or [ ];
-          home = imports.home or [ ];
-        };
-      };
-    in
-    ensure (unknownKeys == [ ])
-      "${unit.id}: meta.nix has unsupported keys: ${lib.concatStringsSep ", " unknownKeys}"
-      (
-        ensure (description == null || builtins.isString description)
-          "${unit.id}: meta.description must be a string"
-          (
-            ensure (builtins.isList includes && lib.all builtins.isString includes)
-              "${unit.id}: meta.includes must be a list of fully qualified unit IDs"
-              (
-                ensure (lib.unique includes == includes) "${unit.id}: meta.includes contains duplicate unit IDs" (
-                  ensure (builtins.isAttrs imports) "${unit.id}: meta.imports must be an attribute set" (
-                    ensure (unknownImportKeys == [ ])
-                      "${unit.id}: meta.imports has unsupported classes: ${lib.concatStringsSep ", " unknownImportKeys}"
-                      (
-                        ensure (lib.all builtins.isList [
-                          normalized.imports.nixos
-                          normalized.imports.darwin
-                          normalized.imports.home
-                        ]) "${unit.id}: every meta.imports.<class> value must be a list" normalized
-                      )
-                  )
-                )
-              )
-          )
-      );
-
-  makeUnit =
-    relativePath: entries: homeEntries:
-    let
-      directory = pathFor relativePath;
-      id = lib.concatStringsSep "." relativePath;
-      rootFragments = lib.mapAttrs (
-        _class: fileName: if entryIsFile entries fileName then directory + "/${fileName}" else null
-      ) rootFragmentFiles;
-      homeFragments = lib.mapAttrs (
-        _class: fileName: if entryIsFile homeEntries fileName then directory + "/home/${fileName}" else null
-      ) homeFragmentFiles;
-      fragments = rootFragments // homeFragments;
-      baseUnit = {
-        inherit
-          id
-          directory
-          fragments
-          relativePath
-          ;
-        optionPath = [ "my" ] ++ relativePath ++ [ "enable" ];
-        kind = builtins.head relativePath;
-        name = lib.last relativePath;
-      }
-      //
-        lib.optionalAttrs (builtins.length relativePath > 2 && builtins.head relativePath == "profiles")
-          {
-            group = builtins.elemAt relativePath 1;
-          };
-    in
-    ensure (relativePath != [ ]) "the modules root cannot itself be a unit" (
-      ensure (lib.all (component: component != "" && !(lib.hasInfix "." component)) relativePath)
-        "${id}: path components must be non-empty and must not contain dots"
-        (baseUnit // { meta = normalizeMeta baseUnit; })
-    );
-
-  walk =
-    relativePath:
-    let
-      directory = pathFor relativePath;
-      entries = builtins.readDir directory;
-      homeEntries =
-        if relativePath != [ ] && (entries.home or null) == "directory" then
-          builtins.readDir (directory + "/home")
-        else
-          { };
-      hasRootFragment = lib.any (fileName: entryIsFile entries fileName) (
-        builtins.attrValues rootFragmentFiles
-      );
-      hasHomeFragment = lib.any (fileName: entryIsFile homeEntries fileName) (
-        builtins.attrValues homeFragmentFiles
-      );
-      hasFragment = hasRootFragment || hasHomeFragment;
-      childDirectories = lib.filter (
-        name: entries.${name} == "directory" && !(name == "home" && hasHomeFragment)
-      ) (builtins.attrNames entries);
-      current = lib.optional hasFragment (makeUnit relativePath entries homeEntries);
-      children = lib.concatMap (name: walk (relativePath ++ [ name ])) childDirectories;
-    in
-    current ++ children;
-
-  discoveredUnits =
-    ensure (builtins.pathExists modulesRoot) "modules root does not exist: ${toString modulesRoot}"
-      (walk [ ]);
-  unitsById = builtins.listToAttrs (map (unit: lib.nameValuePair unit.id unit) discoveredUnits);
-
-  dependencyValidation = lib.foldl' (
-    valid: unit:
-    lib.foldl' (
-      inner: includedId:
-      if builtins.hasAttr includedId unitsById then
-        inner
-      else
-        throw "unit registry: ${unit.id} includes missing unit '${includedId}'"
-    ) valid unit.meta.includes
-  ) true discoveredUnits;
-
-  units = builtins.seq dependencyValidation unitsById;
-  unitIds = builtins.attrNames units;
-
-  getUnit =
-    id: if builtins.hasAttr id units then units.${id} else throw "unit registry: unknown unit '${id}'";
-
-  validateUnitIds =
-    ids:
-    ensure (
-      builtins.isList ids && lib.all builtins.isString ids
-    ) "selected units must be a list of strings" (map (id: builtins.seq (getUnit id) id) ids);
-
-  optionDefinitions = lib.foldl' lib.recursiveUpdate { } (
-    map (
-      unit:
-      lib.setAttrByPath unit.optionPath (
-        lib.mkOption {
-          type = lib.types.bool;
-          default = false;
-          description =
-            if unit.meta.description == null then
-              "Whether to enable the ${unit.id} unit."
-            else
-              "Whether to enable ${unit.meta.description}.";
-        }
-      )
-    ) discoveredUnits
-  );
-
-  enabled = config: unit: lib.getAttrFromPath unit.optionPath config;
-
-  enableUnit = id: lib.setAttrByPath (getUnit id).optionPath true;
-
-  includeConfig =
-    config: unit: lib.mkIf (enabled config unit) (lib.mkMerge (map enableUnit unit.meta.includes));
-
-  fragmentClasses = {
-    nixos = [
-      "common"
-      "nixos"
-    ];
-    darwin = [
-      "common"
-      "darwin"
-    ];
-    home = {
-      nixos = [
-        "home"
-        "homeCommon"
-        "homeNixos"
-      ];
-      darwin = [
-        "home"
-        "homeCommon"
-        "homeDarwin"
-      ];
-    };
-  };
-
-  fragmentClassesFor =
-    {
-      class,
-      systemClass,
-    }:
-    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
-      if class == "home" then
-        ensure
-          (builtins.elem systemClass [
-            "nixos"
-            "darwin"
-          ])
-          "the home module class requires systemClass to be 'nixos' or 'darwin'"
-          fragmentClasses.home.${systemClass}
-      else
-        ensure (
-          systemClass == null
-        ) "systemClass is only supported for the home module class" fragmentClasses.${class}
-    );
-
-  applyFragment =
-    {
-      config,
-      fragmentName,
-      fragmentPath,
-      options,
-      specialArgs,
-      unit,
-    }:
-    let
-      fragment = import fragmentPath;
-      directArgs = specialArgs // {
-        inherit
-          config
-          lib
-          options
-          specialArgs
-          unit
-          ;
-      };
-      fragmentArgSpec = builtins.functionArgs fragment;
-      fragmentArgs = builtins.listToAttrs (
-        lib.concatMap (
-          name:
-          if builtins.hasAttr name directArgs then
-            [ (lib.nameValuePair name directArgs.${name}) ]
-          else if fragmentArgSpec.${name} then
-            [ ]
-          else
-            [ (lib.nameValuePair name config._module.args.${name}) ]
-        ) (builtins.attrNames fragmentArgSpec)
-      );
-      resultValue = if builtins.isFunction fragment then fragment fragmentArgs else fragment;
-      result =
-        ensure (builtins.isAttrs resultValue) "${unit.id}: ${fragmentName} must return an attribute set"
-          resultValue;
-      forbiddenKeys = lib.filter (name: builtins.hasAttr name result) [
-        "imports"
-        "options"
-        "config"
-      ];
-    in
-    ensure (forbiddenKeys == [ ])
-      "${unit.id}: ${fragmentName} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
-      result;
-
-  externalImports = class: lib.concatMap (unit: unit.meta.imports.${class}) discoveredUnits;
-
-  mkModule =
-    {
-      class,
-      systemClass ? null,
-    }:
-    let
-      selectedFragmentClasses = fragmentClassesFor { inherit class systemClass; };
-    in
-    builtins.seq selectedFragmentClasses (
-      builtins.seq dependencyValidation (
-        {
-          config,
-          lib,
-          options,
-          specialArgs,
-          ...
-        }:
-        let
-          fragmentConfigs = lib.concatMap (
-            unit:
-            lib.filter (value: value != null) (
-              map (
-                fragmentClass:
-                let
-                  fragmentName = fragmentFileNames.${fragmentClass};
-                  fragmentPath = unit.fragments.${fragmentClass};
-                in
-                if fragmentPath == null then
-                  null
-                else
-                  lib.mkIf (enabled config unit) (applyFragment {
-                    inherit
-                      config
-                      fragmentName
-                      fragmentPath
-                      options
-                      specialArgs
-                      unit
-                      ;
-                  })
-              ) selectedFragmentClasses
-            )
-          ) discoveredUnits;
-        in
-        {
-          imports = externalImports class;
-          options = optionDefinitions;
-          config = lib.mkMerge ((map (includeConfig config) discoveredUnits) ++ fragmentConfigs);
-        }
-      )
-    );
-
-  mkSelectionModule =
-    selectedIds:
-    let
-      checkedIds = validateUnitIds (lib.unique selectedIds);
-    in
-    {
-      config = lib.mkMerge (map enableUnit checkedIds);
-    };
-in
-{
-  inherit
-    getUnit
-    mkModule
-    mkSelectionModule
-    unitIds
-    units
-    validateUnitIds
-    ;
-}

modules/applications/1password.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications."1password";
+in
+{
+  options.my.applications."1password" = {
+    enable = lib.mkEnableOption "1Password password manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      polkitPolicyOwners = [ "moons" ];
+    };
+
+    programs.ssh.startAgent = lib.mkForce false;
+    programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
+
+    services.gnome.gcr-ssh-agent.enable = lib.mkForce false;
+  };
+}

modules/applications/1password/common.nix

@@ -1,4 +0,0 @@
-_: {
-  programs._1password-gui.enable = true;
-  programs._1password.enable = true;
-}

modules/applications/1password/nixos.nix

@@ -1,9 +0,0 @@
-{ primaryUser, lib, ... }:
-{
-  programs._1password-gui.polkitPolicyOwners = [ primaryUser ];
-
-  # 1Password SSH Agentと競合するagentを無効化
-  programs.ssh.startAgent = lib.mkForce false;
-  programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
-  services.gnome.gcr-ssh-agent.enable = lib.mkForce false;
-}

modules/applications/arduino.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.arduino;
+  arduinoIdeX11 = pkgs.arduino-ide.overrideAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+
+    postFixup = (old.postFixup or "") + ''
+      wrapProgram $out/bin/arduino-ide \
+        --add-flags "--ozone-platform=x11"
+    '';
+  });
+in
+{
+  options.my.applications.arduino = {
+    enable = lib.mkEnableOption "Arduino development tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      arduino-cli # Arduino command-line interface
+      arduinoIdeX11 # Arduino IDE with X11 support
+    ];
+  };
+}

modules/applications/arduino/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.arduino-cli ];
-}

modules/applications/arduino/nixos.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-let
-  arduinoIdeX11 = pkgs.arduino-ide.overrideAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-
-    postFixup = (old.postFixup or "") + ''
-      wrapProgram $out/bin/arduino-ide \
-        --add-flags "--ozone-platform=x11"
-    '';
-  });
-in
-{
-  environment.systemPackages = [ arduinoIdeX11 ];
-}

modules/applications/atuin/home.nix

@@ -1,9 +0,0 @@
-{
-  programs.atuin = {
-    enable = true;
-
-    enableZshIntegration = true;
-    enableBashIntegration = true;
-    enableFishIntegration = true;
-  };
-}

modules/applications/baobab/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.baobab ];
-}

modules/applications/btop/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.btop;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.btop = {
+    enable = lib.mkEnableOption "btop system monitor";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.btop.system.enable = lib.mkDefault true;
+    my.applications.btop.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/btop/dracula.theme

@@ -1,4 +1,4 @@
-# Bashtop theme with Nord palette (https://www.nordtheme.com)
+#Bashtop theme with nord palette (https://www.nordtheme.com)
 #by Justin Zobel <[email protected]>
 
 # Colors should be in 6 or 2 character hexadecimal or single spaced rgb decimal: "#RRGGBB", "#BW" or "0-255 0-255 0-255"
@@ -18,7 +18,7 @@ theme[main_fg]="#BD93F9"
 # Title color for boxes
 theme[title]="#f8f8f2"
 
-# Highlight color for keyboard shortcuts
+# Higlight color for keyboard shortcuts
 theme[hi_fg]="#ff79c6"
 
 # Background color of selected item in processes box

modules/applications/btop/home.nix

@@ -1,8 +1,25 @@
 {
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.btop.homeManager;
+in
+{
+  options.my.applications.btop.homeManager = {
+    enable = lib.mkEnableOption "btop home-manager configuration";
+  };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
         programs.btop = {
           enable = true;
-
           settings.color_theme = "dracula";
           themes.dracula = builtins.readFile ./dracula.theme;
         };
+      };
+    }
+  ];
 }

modules/applications/btop/system.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.btop.system;
+in
+{
+  options.my.applications.btop.system = {
+    enable = lib.mkEnableOption "btop system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      btop # Resource monitor that shows usage and stats
+    ];
+  };
+}

modules/applications/celluloid/home/nixos.nix

@@ -1,31 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.celluloid ];
-
-  xdg.mimeApps = {
-    enable = true;
-    defaultApplicationPackages = [ pkgs.celluloid ];
-    defaultApplications = builtins.listToAttrs (
-      map
-        (mime: {
-          name = mime;
-          value = [ "io.github.celluloid_player.Celluloid.desktop" ];
-        })
-        [
-          "video/3gpp"
-          "video/3gpp2"
-          "video/mp2t"
-          "video/mp4"
-          "video/mpeg"
-          "video/ogg"
-          "video/quicktime"
-          "video/webm"
-          "video/x-flv"
-          "video/x-m4v"
-          "video/x-matroska"
-          "video/x-msvideo"
-          "video/x-ms-wmv"
-        ]
-    );
-  };
-}

modules/applications/chrome.nix

@@ -0,0 +1,44 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.chrome;
+in
+{
+  options.my.applications.chrome = {
+    enable = lib.mkEnableOption "Google Chrome browser";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      {
+        home.packages = with pkgs; [
+          google-chrome # Popular web browser from Google
+        ];
+
+        xdg.desktopEntries."google-chrome" = {
+          name = "Google Chrome";
+          genericName = "Web Browser";
+          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --enable-features=TouchpadOverscrollHistoryNavigation %U";
+          terminal = false;
+          icon = "google-chrome";
+          categories = [
+            "Network"
+            "WebBrowser"
+          ];
+          startupNotify = true;
+          type = "Application";
+        };
+
+        xdg.mimeApps.defaultApplications = {
+          "text/html" = "google-chrome.desktop";
+          "x-scheme-handler/http" = "google-chrome.desktop";
+          "x-scheme-handler/https" = "google-chrome.desktop";
+        };
+      }
+    ];
+  };
+}

modules/applications/chrome/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "google-chrome" ];
-  };
-}

modules/applications/chrome/home/nixos.nix

@@ -1,19 +0,0 @@
-_: {
-  programs.google-chrome = {
-    enable = true;
-
-    commandLineArgs = [
-      "--enable-features=MiddleClickAutoscroll"
-    ];
-  };
-
-  xdg.mimeApps = {
-    enable = true;
-
-    defaultApplications = {
-      "text/html" = "google-chrome.desktop";
-      "x-scheme-handler/http" = "google-chrome.desktop";
-      "x-scheme-handler/https" = "google-chrome.desktop";
-    };
-  };
-}

modules/applications/claude/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.claude;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.claude = {
+    enable = lib.mkEnableOption "Claude Code AI assistant";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.claude.system.enable = lib.mkDefault true;
+    my.applications.claude.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/claude/home.nix

@@ -1,13 +1,19 @@
 {
-  inputs,
+  lib,
-  pkgs,
+  config,
   ...
 }:
+let
+  cfg = config.my.applications.claude.homeManager;
+in
 {
-  home.packages = [
+  options.my.applications.claude.homeManager = {
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.claude-code
+    enable = lib.mkEnableOption "Claude Code home-manager configuration";
-  ];
+  };
 
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
         home.file.".claude/settings.json".text = builtins.toJSON {
           statusLine = {
             type = "command";
@@ -15,4 +21,7 @@
             padding = 0;
           };
         };
+      };
+    }
+  ];
 }

modules/applications/claude/system.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.claude.system;
+in
+{
+  options.my.applications.claude.system = {
+    enable = lib.mkEnableOption "Claude Code system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.llm-agents.claude-code # AI coding assistant
+    ];
+  };
+}

modules/applications/codex-desktop.nix

@@ -0,0 +1,65 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.codexDesktop;
+  codexCliPackage = pkgs.llm-agents.codex;
+  codexDesktopPackage =
+    inputs.codex-desktop-linux.packages.${pkgs.stdenv.hostPlatform.system}.codex-desktop-computer-use-ui;
+  codexDesktopLauncher = pkgs.makeDesktopItem {
+    name = "codex";
+    desktopName = "Codex";
+    genericName = "ChatGPT Desktop";
+    comment = "Run Codex Desktop on Linux";
+    exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop ${lib.getExe' codexDesktopPackage "codex-desktop"} %u";
+    icon = "codex-desktop";
+    terminal = false;
+    categories = [ "Development" ];
+    keywords = [
+      "codex"
+      "chatgpt"
+      "openai"
+      "ai"
+      "assistant"
+    ];
+    startupNotify = true;
+    startupWMClass = "codex-desktop";
+    actions = {
+      new-window = {
+        name = "New Window";
+        exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop CODEX_MULTI_LAUNCH=1 ${lib.getExe' codexDesktopPackage "codex-desktop"} --new-instance";
+      };
+    };
+    extraConfig = {
+      X-GNOME-WMClass = "codex-desktop";
+    };
+  };
+in
+{
+  imports = [
+    inputs.codex-desktop-linux.nixosModules.default
+  ];
+
+  options.my.applications.codexDesktop = {
+    enable = lib.mkEnableOption "ChatGPT Desktop for Linux";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.codex.enable = true;
+
+    programs.codexDesktopLinux = {
+      enable = true;
+      package = codexDesktopPackage;
+      cliPackage = codexCliPackage;
+      computerUseUi.enable = true;
+    };
+
+    environment.systemPackages = [
+      codexDesktopLauncher # Vicinae-searchable Codex Desktop launcher alias
+    ];
+  };
+}

modules/applications/codex-desktop/darwin.nix

@@ -1,8 +0,0 @@
-{
-  # The former Codex app cask is deprecated in favor of ChatGPT, whose desktop
-  # application includes the current Codex experience on macOS.
-  homebrew = {
-    enable = true;
-    casks = [ "chatgpt" ];
-  };
-}

modules/applications/codex-desktop/meta.nix

@@ -1,10 +0,0 @@
-{ inputs, ... }:
-{
-  description = "Codex Desktop for Linux";
-
-  includes = [ "applications.codex" ];
-
-  imports.nixos = [
-    inputs.codex-desktop-linux.nixosModules.default
-  ];
-}

modules/applications/codex-desktop/nixos.nix

@@ -1,18 +0,0 @@
-{
-  inputs,
-  pkgs,
-  ...
-}:
-{
-  programs.codexDesktopLinux = {
-    enable = true;
-    cliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-    remoteControl.enable = true;
-    remoteMobileControl.enable = true;
-    computerUseUi.enable = false;
-    linuxFeatures = [
-      "appshots"
-      "open-target-discovery"
-    ];
-  };
-}

modules/applications/codex.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.codex;
+in
+{
+  options.my.applications.codex = {
+    enable = lib.mkEnableOption "Codex AI coding assistant";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.llm-agents.codex # OpenAI Codex CLI
+    ];
+  };
+}

modules/applications/codex/home.nix

@@ -1,6 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  home.packages = [
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex
-  ];
-}

modules/applications/default.nix

@@ -0,0 +1,47 @@
+{
+  imports = [
+    ./1password.nix
+    ./arduino.nix
+    ./btop
+    ./chrome.nix
+    ./claude
+    ./codex-desktop.nix
+    ./codex.nix
+    ./direnv.nix
+    ./discord.nix
+    ./docker.nix
+    ./fcitx5
+    ./ghostty
+    ./git
+    ./gnupg
+    ./grok.nix
+    ./gnome.nix
+    ./greetd.nix
+    ./ly
+    ./gtk
+    ./java
+    ./kde.nix
+    ./nautilus.nix
+    ./nh.nix
+    ./niri
+    ./nix-index
+    ./noctalia
+    ./opencode.nix
+    ./openssh.nix
+    ./slack.nix
+    ./ssh
+    ./swayidle.nix
+    ./swaylock
+    ./tailscale.nix
+    ./vicinae.nix
+    ./vim
+    ./vscode
+    ./wayland.nix
+    ./yazi.nix
+    ./zed
+    ./zellij
+    ./zoom.nix
+    ./zoxide.nix
+    ./zsh
+  ];
+}

modules/applications/direnv.nix

@@ -0,0 +1,16 @@
+{ lib, config, ... }:
+let
+  cfg = config.my.applications.direnv;
+in
+{
+  options.my.applications.direnv = {
+    enable = lib.mkEnableOption "direnv environment variable manager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+  };
+}

modules/applications/direnv/home.nix

@@ -1,10 +0,0 @@
-{
-  programs.direnv = {
-    enable = true;
-    nix-direnv.enable = true;
-
-    config.global = {
-      warn_timeout = "10s";
-    };
-  };
-}

modules/applications/discord.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.discord;
+in
+{
+  options.my.applications.discord = {
+    enable = lib.mkEnableOption "Discord (Vesktop)";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      {
+        programs.vesktop = {
+          enable = true;
+        };
+      }
+    ];
+  };
+}

modules/applications/discord/home.nix

@@ -1,95 +0,0 @@
-_: {
-  programs.vesktop = {
-    enable = true;
-
-    settings = {
-      discordBranch = "stable";
-
-      hardwareAcceleration = true;
-      hardwareVideoAcceleration = true;
-
-      tray = true;
-      minimizeToTray = true;
-
-      # Discord Rich Presence
-      arRPC = true;
-
-      openLinksWithElectron = false;
-
-      spellCheckLanguages = [
-        "ja-JP"
-        "en-US"
-      ];
-    };
-
-    vencord = {
-      useSystem = false;
-
-      settings = {
-        autoUpdate = true;
-        autoUpdateNotification = false;
-
-        useQuickCss = false;
-
-        cloud.settingsSync = false;
-
-        notifications = {
-          position = "bottom-right";
-          useNative = "not-focused";
-          timeout = 5000;
-          logLimit = 50;
-        };
-
-        plugins = {
-          # プライバシー・安全性
-          NoTrack.enabled = true;
-          ClearURLs.enabled = true;
-
-          # 設定・セッション
-          BetterSettings.enabled = true;
-          BetterSessions.enabled = true;
-
-          # 画像・添付ファイル
-          FixImagesQuality.enabled = true;
-          ImageZoom.enabled = true;
-          ViewIcons.enabled = true;
-          CopyFileContents.enabled = true;
-
-          # メッセージ操作
-          QuickReply.enabled = true;
-          SendTimestamps.enabled = true;
-          FullSearchContext.enabled = true;
-          MessageLinkEmbeds.enabled = true;
-          Unindent.enabled = true;
-          ValidReply.enabled = true;
-
-          # 通知・誤操作対策
-          ReadAllNotificationsButton.enabled = true;
-          NoReplyMention.enabled = true;
-          NotificationVolume.enabled = true;
-
-          # UI・パフォーマンス
-          NoTypingAnimation.enabled = true;
-          FavoriteEmojiFirst.enabled = true;
-          KeepCurrentChannel.enabled = true;
-
-          # サーバー・権限確認
-          PermissionsViewer.enabled = true;
-          MemberCount.enabled = true;
-
-          # ボイス・アクティビティ
-          CallTimer.enabled = true;
-          GameActivityToggle.enabled = true;
-
-          # Vesktop向け
-          WebKeybinds.enabled = true;
-          WebScreenShareFixes.enabled = true;
-
-          # Message history
-          MessageLogger.enabled = true;
-          ShowHiddenChannels.enabled = true;
-        };
-      };
-    };
-  };
-}

modules/applications/docker.nix

@@ -0,0 +1,34 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.docker;
+in
+{
+  options.my.applications.docker = {
+    enable = lib.mkEnableOption "Docker container runtime";
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+      };
+      daemon.settings = {
+        ipv6 = true;
+        "fixed-cidr-v6" = "fd00:30::/64";
+        ip6tables = true;
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      docker # Container runtime
+      oxker # Docker TUI Tool
+    ];
+  };
+}

modules/applications/docker/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "orbstack" ];
-  };
-}

modules/applications/docker/home/common.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    pkgs.docker-client
-  ];
-}

modules/applications/docker/home/nixos.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    pkgs.oxker
-  ];
-}

modules/applications/docker/meta.nix

@@ -1,5 +0,0 @@
-{
-  description = "Docker command-line client and NixOS daemon";
-
-  includes = [ "services.docker" ];
-}

modules/applications/drawio/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.drawio ];
-}

modules/applications/easyeffects/home/nixos.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.easyeffects ];
-}

modules/applications/fcitx5/config

@@ -0,0 +1,69 @@
+[Hotkey]
+# トリガーキーを押すたびに切り替える
+EnumerateWithTriggerKeys=False
+# 一時的に第1入力メソッドに切り替える
+AltTriggerKeys=
+# 切り替え時は第1入力メソッドをスキップする
+EnumerateSkipFirst=False
+# Time limit in milliseconds for triggering modifier key shortcuts
+ModifierOnlyKeyTimeout=250
+
+[Hotkey/TriggerKeys]
+1=Zenkaku_Hankaku
+
+[Hotkey/ActivateKeys]
+0=Henkan
+
+[Hotkey/DeactivateKeys]
+0=Muhenkan
+
+[Hotkey/PrevPage]
+0=Up
+
+[Hotkey/NextPage]
+0=Down
+
+[Hotkey/PrevCandidate]
+0=Shift+Tab
+
+[Hotkey/NextCandidate]
+0=Tab
+
+[Hotkey/TogglePreedit]
+0=Control+Alt+P
+
+[Behavior]
+# デフォルトで有効にする
+ActiveByDefault=False
+# フォーカス時に状態をリセット
+resetStateWhenFocusIn=No
+# 入力状態を共有する
+ShareInputState=No
+# アプリケーションにプリエディットを表示する
+PreeditEnabledByDefault=True
+# 入力メソッドを切り替える際に入力メソッドの情報を表示する
+ShowInputMethodInformation=True
+# フォーカスを変更する際に入力メソッドの情報を表示する
+showInputMethodInformationWhenFocusIn=False
+# 入力メソッドの情報をコンパクトに表示する
+CompactInputMethodInformation=True
+# 第1入力メソッドの情報を表示する
+ShowFirstInputMethodInformation=True
+# デフォルトのページサイズ
+DefaultPageSize=5
+# XKB オプションより優先する
+OverrideXkbOption=False
+# カスタム XKB オプション
+CustomXkbOption=
+# Force Enabled Addons
+EnabledAddons=
+# Force Disabled Addons
+DisabledAddons=
+# Preload input method to be used by default
+PreloadInputMethod=True
+# パスワード欄に入力メソッドを許可する
+AllowInputMethodForPassword=False
+# パスワード入力時にプリエディットテキストを表示する
+ShowPreeditForPassword=False
+# ユーザーデータを保存する間隔（分）
+AutoSavePeriod=30

modules/applications/fcitx5/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.fcitx5;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.fcitx5 = {
+    enable = lib.mkEnableOption "fcitx5 input method";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.fcitx5.system.enable = lib.mkDefault true;
+    my.applications.fcitx5.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/fcitx5/home.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.fcitx5.homeManager;
+in
+{
+  options.my.applications.fcitx5.homeManager = {
+    enable = lib.mkEnableOption "fcitx5 home-manager configuration";
+  };
+
+  config.home-manager.sharedModules = [
+    {
+      config = lib.mkIf cfg.enable {
+        home.file.".config/fcitx5/config" = {
+          recursive = true;
+          source = ./config;
+        };
+      };
+    }
+  ];
+}

modules/applications/fcitx5/home/nixos.nix

@@ -1,77 +0,0 @@
-{ pkgs, ... }:
-{
-
-  services.hazkey.enable = true;
-
-  i18n.inputMethod = {
-    enable = true;
-    type = "fcitx5";
-
-    fcitx5 = {
-      waylandFrontend = true;
-
-      addons = with pkgs; [
-        fcitx5-gtk
-        kdePackages.fcitx5-qt
-        qt6Packages.fcitx5-configtool
-      ];
-
-      settings = {
-        inputMethod = {
-          GroupOrder."0" = "Default";
-
-          "Groups/0" = {
-            Name = "Default";
-            "Default Layout" = "jp";
-            DefaultIM = "hazkey";
-          };
-
-          "Groups/0/Items/0" = {
-            Name = "keyboard-jp";
-          };
-
-          "Groups/0/Items/1" = {
-            Name = "hazkey";
-          };
-        };
-
-        globalOptions = {
-          Hotkey = {
-            EnumerateWithTriggerKeys = false;
-            EnumerateSkipFirst = false;
-            ModifierOnlyKeyTimeout = 250;
-          };
-
-          "Hotkey/TriggerKeys"."1" = "Zenkaku_Hankaku";
-          "Hotkey/ActivateKeys"."0" = "Henkan";
-          "Hotkey/DeactivateKeys"."0" = "Muhenkan";
-          "Hotkey/PrevPage"."0" = "Up";
-          "Hotkey/NextPage"."0" = "Down";
-          "Hotkey/PrevCandidate"."0" = "Shift+Tab";
-          "Hotkey/NextCandidate"."0" = "Tab";
-          "Hotkey/TogglePreedit"."0" = "Control+Alt+P";
-
-          Behavior = {
-            ActiveByDefault = false;
-            resetStateWhenFocusIn = "No";
-            ShareInputState = "No";
-            PreeditEnabledByDefault = true;
-            ShowInputMethodInformation = true;
-            showInputMethodInformationWhenFocusIn = false;
-            CompactInputMethodInformation = true;
-            ShowFirstInputMethodInformation = true;
-            DefaultPageSize = 5;
-            OverrideXkbOption = false;
-            CustomXkbOption = "";
-            EnabledAddons = "";
-            DisabledAddons = "";
-            PreloadInputMethod = true;
-            AllowInputMethodForPassword = false;
-            ShowPreeditForPassword = false;
-            AutoSavePeriod = 30;
-          };
-        };
-      };
-    };
-  };
-}

modules/applications/fcitx5/meta.nix

@@ -1,6 +0,0 @@
-{ inputs, ... }:
-{
-  description = "Fcitx 5 input method framework with Hazkey Japanese input";
-
-  imports.home = [ inputs.nix-hazkey.homeModules.hazkey ];
-}

modules/applications/fcitx5/system.nix

@@ -0,0 +1,68 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+
+  cfg = config.my.applications.fcitx5.system;
+in
+{
+  options.my.applications.fcitx5.system = {
+    enable = lib.mkEnableOption "fcitx5 system configuration";
+  };
+
+  imports = [
+    inputs.nix-hazkey.nixosModules.hazkey
+  ];
+
+  config = lib.mkIf cfg.enable {
+
+    services.hazkey = {
+      enable = true;
+      server.package = inputs.nix-hazkey.packages.${system}.hazkey-server.override {
+        enableVulkan = true;
+      };
+      installHazkeySettings = false;
+      installFcitx5Addon = false;
+    };
+
+    environment.systemPackages = [ inputs.nix-hazkey.packages.${system}.hazkey-settings ];
+
+    i18n.inputMethod = {
+      enable = true;
+      type = "fcitx5";
+      fcitx5 = {
+        waylandFrontend = true;
+        addons = with pkgs; [
+          inputs.nix-hazkey.packages.${system}.fcitx5-hazkey
+          fcitx5-mozc-ut
+          fcitx5-gtk
+          kdePackages.fcitx5-qt
+          qt6Packages.fcitx5-configtool
+        ];
+        settings.inputMethod = {
+          GroupOrder = {
+            "0" = "Default";
+          };
+          "Groups/0" = {
+            Name = "Default";
+            "Default Layout" = "jp";
+            DefaultIM = "mozc";
+          };
+          "Groups/0/Items/0" = {
+            Name = "keyboard-jp";
+            Layout = "";
+          };
+          "Groups/0/Items/1" = {
+            Name = "mozc";
+            Layout = "";
+          };
+        };
+      };
+    };
+  };
+}

modules/applications/finder/darwin.nix

@@ -1,15 +0,0 @@
-{
-  system.defaults.finder = {
-    AppleShowAllExtensions = true;
-    AppleShowAllFiles = false;
-    ShowPathbar = true;
-    ShowStatusBar = true;
-    _FXShowPosixPathInTitle = true;
-    _FXSortFoldersFirst = true;
-    FXDefaultSearchScope = "SCcf";
-    FXPreferredViewStyle = "Nlsv";
-    NewWindowTarget = "Home";
-    FXEnableExtensionChangeWarning = true;
-    FXRemoveOldTrashItems = true;
-  };
-}

modules/applications/gamemode/nixos.nix

@@ -1,17 +0,0 @@
-{
-  programs.gamemode = {
-    enable = true;
-    enableRenice = true;
-
-    settings = {
-      general = {
-        softrealtime = "auto";
-        renice = 10;
-      };
-      custom = {
-        start = "notify-send -a 'Gamemode' 'Optimizations activated'";
-        end = "notify-send -a 'Gamemode' 'Optimizations deactivated'";
-      };
-    };
-  };
-}

modules/applications/gamescope/nixos.nix

@@ -1,6 +0,0 @@
-{
-  programs.gamescope = {
-    enable = true;
-    capSysNice = true;
-  };
-}

modules/applications/ghostty/config

@@ -0,0 +1,40 @@
+theme = dracula
+background-blur-radius = 20
+background-opacity = 0.9
+font-family = BlexMono Nerd Font Mono
+mouse-hide-while-typing = true
+window-decoration = true
+
+
+# keybind
+
+# Copy/Paste
+keybind = performable:ctrl+shift+c=copy_to_clipboard
+keybind = ctrl+shift+v=paste_from_clipboard
+
+# create new tab
+keybind = ctrl+shift+t=new_tab
+
+# move tabs
+keybind = ctrl+alt+left_bracket=previous_tab
+keybind = ctrl+alt+right_bracket=next_tab
+
+# close tab
+keybind = ctrl+alt+q=close_window
+
+# font size
+keybind = ctrl+shift+semicolon=increase_font_size:1
+keybind = ctrl+shift+minus=increase_font_size:1
+
+
+# quick terminal
+keybind = global:super+space=toggle_quick_terminal
+quick-terminal-position = top
+quick-terminal-size = 100%
+gtk-quick-terminal-layer = overlay
+quick-terminal-keyboard-interactivity = exclusive
+quick-terminal-autohide = false
+quit-after-last-window-closed = false
+
+shell-integration-features = ssh-terminfo,ssh-env
+

modules/applications/ghostty/darwin.nix

@@ -1,6 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    casks = [ "ghostty" ];
-  };
-}

modules/applications/ghostty/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.ghostty;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.ghostty = {
+    enable = lib.mkEnableOption "ghostty terminal emulator";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.ghostty.system.enable = lib.mkDefault true;
+    my.applications.ghostty.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/ghostty/dracula.theme

@@ -42,3 +42,4 @@ cursor-color = #f8f8f2
 cursor-text = #282a36
 selection-foreground = #f8f8f2
 selection-background = #44475a
+

modules/applications/ghostty/home.nix

@@ -0,0 +1,83 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  cfg = config.my.applications.ghostty.homeManager;
+
+  system = pkgs.stdenv.hostPlatform.system;
+
+  ghosttyPkg = inputs.ghostty.packages.${system}.ghostty-releasefast;
+in
+{
+  options.my.applications.ghostty.homeManager = {
+    enable = lib.mkEnableOption "ghostty home-manager configuration";
+  };
+
+  config.home-manager.sharedModules = [
+    (
+      { lib, ... }:
+      {
+        config = lib.mkIf cfg.enable {
+          programs.ghostty = {
+            enable = true;
+
+            package = ghosttyPkg;
+
+            systemd.enable = true;
+
+            settings = {
+              theme = "dracula";
+
+              background-blur-radius = 20;
+              background-opacity = 0.9;
+
+              font-family = "BlexMono Nerd Font Mono";
+
+              mouse-hide-while-typing = true;
+
+              window-decoration = "auto";
+
+              keybind = [
+                # Copy/Paste
+                "performable:ctrl+shift+c=copy_to_clipboard"
+                "ctrl+shift+v=paste_from_clipboard"
+
+                # Create new tab
+                "ctrl+shift+t=new_tab"
+
+                # Move tabs
+                "ctrl+alt+left_bracket=previous_tab"
+                "ctrl+alt+right_bracket=next_tab"
+
+                # Close window
+                "ctrl+alt+q=close_window"
+
+                # Font size
+                "ctrl+shift+semicolon=increase_font_size:1"
+                "ctrl+shift+minus=decrease_font_size:1"
+              ];
+
+              # Quick terminal
+              quick-terminal-position = "top";
+              quick-terminal-size = "98%,100%";
+
+              quick-terminal-autohide = false;
+              quick-terminal-keyboard-interactivity = "on-demand";
+              gtk-quick-terminal-layer = "top";
+
+              quit-after-last-window-closed = false;
+
+              shell-integration-features = "no-ssh-env,no-ssh-terminfo";
+            };
+          };
+
+          xdg.configFile."ghostty/themes/dracula".source = ./dracula.theme;
+        };
+      }
+    )
+  ];
+}

modules/applications/ghostty/home/common.nix

@@ -1,38 +0,0 @@
-_: {
-  programs.ghostty = {
-    enable = true;
-
-    settings = {
-      theme = "dracula";
-      background-blur-radius = 20;
-      background-opacity = 0.9;
-      font-family = "BlexMono Nerd Font Mono";
-      mouse-hide-while-typing = true;
-      window-decoration = "auto";
-
-      keybind = [
-        "performable:ctrl+shift+c=copy_to_clipboard"
-        "ctrl+shift+v=paste_from_clipboard"
-        "ctrl+shift+t=new_tab"
-        "ctrl+alt+left_bracket=previous_tab"
-        "ctrl+alt+right_bracket=next_tab"
-        "alt+q=close_window"
-        "global:alt+space=toggle_quick_terminal"
-        "global:alt+t=new_window"
-        "ctrl+shift+semicolon=increase_font_size:1"
-        "ctrl+shift+minus=decrease_font_size:1"
-      ];
-
-      quick-terminal-screen = "mouse";
-      quick-terminal-position = "top";
-      quick-terminal-size = "98%,100%";
-      quick-terminal-autohide = false;
-      quick-terminal-keyboard-interactivity = "on-demand";
-      gtk-quick-terminal-layer = "top";
-      quit-after-last-window-closed = false;
-      shell-integration-features = "no-ssh-env,no-ssh-terminfo";
-    };
-  };
-
-  xdg.configFile."ghostty/themes/dracula".source = ./dracula.theme;
-}

modules/applications/ghostty/home/darwin.nix

@@ -1,17 +0,0 @@
-_: {
-  # Global Ghostty keybindings are handled by the running app. Start it hidden
-  # at login so Option+T and Option+Space work before opening a terminal.
-  launchd.agents.ghostty-global-keybindings = {
-    enable = true;
-    config = {
-      ProgramArguments = [
-        "/usr/bin/open"
-        "-gja"
-        "Ghostty"
-      ];
-      RunAtLoad = true;
-    };
-  };
-
-  programs.ghostty.package = null;
-}

modules/applications/ghostty/home/nixos.nix

@@ -1,6 +0,0 @@
-{ inputs, system, ... }: {
-  programs.ghostty = {
-    systemd.enable = true;
-    package = inputs.ghostty.packages.${system}.default;
-  };
-}

modules/applications/ghostty/system.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  cfg = config.my.applications.ghostty.system;
+
+  system = pkgs.stdenv.hostPlatform.system;
+
+  ghosttyPkg = inputs.ghostty.packages.${system}.ghostty-releasefast;
+in
+{
+  options.my.applications.ghostty.system = {
+    enable = lib.mkEnableOption "ghostty system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      ghosttyPkg # A fast and minimal terminal emulator for Wayland
+      ghosttyPkg.terminfo # Terminfo database for ghostty
+    ];
+  };
+}

modules/applications/git/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.git;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.git = {
+    enable = lib.mkEnableOption "git version control";
+
+    userName = lib.mkOption {
+      type = lib.types.singleLineStr;
+      default = "moons";
+      description = "Default Git user.name.";
+    };
+
+    userEmail = lib.mkOption {
+      type = lib.types.singleLineStr;
+      default = "moons@moons14.com";
+      description = "Default Git user.email.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.git.system.enable = lib.mkDefault true;
+    my.applications.git.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/git/home.nix

@@ -1,5 +1,13 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
+  cfg = config.my.applications.git;
+  hmCfg = config.my.applications.git.homeManager;
+
   signingKeyPath = ".ssh/1password-git-signing.pub";
   signingKeyFile = "~/${signingKeyPath}";
 
@@ -27,11 +35,35 @@ let
   '';
 in
 {
-  home.packages = [ pkgs.gh ];
+  options.my.applications.git.homeManager = {
+    enable = lib.mkEnableOption "git home-manager configuration";
 
-  home.file.${signingKeyPath}.text = ''
+    signingPublicKey = lib.mkOption {
-    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing
+      type = lib.types.nullOr lib.types.singleLineStr;
-  '';
+      default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
+      example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
+      description = "SSH public key copied from the 1Password SSH key item used for Git signing.";
+    };
+
+    signingKey = lib.mkOption {
+      type = lib.types.str;
+      default = signingKeyFile;
+      readOnly = true;
+      description = "SSH public key path used for Git commit and tag signing.";
+    };
+  };
+
+  config = lib.mkIf hmCfg.enable {
+    assertions = [
+      {
+        assertion = hmCfg.signingPublicKey != null && hmCfg.signingPublicKey != "";
+        message = "my.applications.git.homeManager.signingPublicKey must be set to the public key copied from 1Password.";
+      }
+    ];
+
+    home-manager.sharedModules = [
+      {
+        home.file.${signingKeyPath}.text = hmCfg.signingPublicKey + "\n";
 
         programs.git = {
           enable = true;
@@ -43,16 +75,14 @@ in
           ];
 
           signing = {
-      key = signingKeyFile;
+            key = hmCfg.signingKey;
             format = "ssh";
             signByDefault = true;
           };
 
           settings = {
-      user = {
+            user.name = cfg.userName;
-        name = "moons";
+            user.email = cfg.userEmail;
-        email = "moons@moons14.com";
-      };
 
             push.default = "simple";
             credential.helper = "cache --timeout=7200";
@@ -76,3 +106,6 @@ in
           };
         };
       }
+    ];
+  };
+}

modules/applications/git/system.nix

@@ -0,0 +1,21 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.git.system;
+in
+{
+  options.my.applications.git.system = {
+    enable = lib.mkEnableOption "git system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      git # Distributed version control system
+      gh # GitHub CLI
+    ];
+  };
+}

modules/applications/gnome-disk-utility/home/nixos.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.gnome-disk-utility ];
-}

modules/applications/gnome-text-editor/home/nixos.nix

@@ -1,24 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.gnome-text-editor ];
-
-  dconf.settings."org/gnome/TextEditor" = {
-    style-variant = "follow";
-    wrap-text = true;
-    spellcheck = true;
-    restore-session = true;
-    show-line-numbers = false;
-    show-right-margin = false;
-    show-map = false;
-    highlight-current-line = false;
-    auto-indent = false;
-    discover-settings = false;
-    enable-snippets = false;
-    keybindings = "default";
-  };
-
-  xdg.mimeApps = {
-    enable = true;
-    defaultApplicationPackages = [ pkgs.gnome-text-editor ];
-  };
-}

modules/applications/gnome.nix

@@ -0,0 +1,94 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.gnome;
+in
+{
+  options.my.applications.gnome = {
+    enable = lib.mkEnableOption "GNOME desktop environment";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.desktopManager.gnome.enable = true;
+
+    # ly is the display manager for switching between installed sessions.
+    services.displayManager.gdm.enable = lib.mkForce false;
+
+    home-manager.sharedModules = [
+      {
+        dconf.settings = {
+          "org/gnome/desktop/sound" = {
+            event-sounds = false;
+            input-feedback-sounds = false;
+          };
+
+          "org/gnome/desktop/wm/keybindings" = {
+            close = [ "<Super>q" ];
+            show-desktop = [ ];
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys" = {
+            home = [ ];
+            screensaver = [ "<Super>l" ];
+            custom-keybindings = [
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3/"
+              "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4/"
+            ];
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+            name = "Open Terminal";
+            command = "ghostty";
+            binding = "<Super>t";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+            name = "Run Application";
+            command = "vicinae toggle";
+            binding = "<Super>d";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2" = {
+            name = "Open File Manager";
+            command = "nautilus --new-window";
+            binding = "<Super>e";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3" = {
+            name = "Clipboard History";
+            command = "vicinae vicinae://extensions/vicinae/clipboard/history";
+            binding = "<Super>v";
+          };
+
+          "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4" = {
+            name = "Log Out";
+            command = "gnome-session-quit --logout --no-prompt";
+            binding = "<Super><Shift>e";
+          };
+
+          "org/gnome/shell" = {
+            favorite-apps = [
+              "google-chrome.desktop"
+              "code.desktop"
+              "com.mitchellh.ghostty.desktop"
+              "slack.desktop"
+              "vesktop.desktop"
+            ];
+          };
+        };
+      }
+    ];
+
+    environment.systemPackages = with pkgs; [
+      gnome-tweaks # GNOME desktop customization tool
+      gnome-extension-manager # GNOME Shell extension manager
+    ];
+  };
+}