diff --git a/flake.lock b/flake.lock
index e3f8584..466332d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -287,6 +287,21 @@
         "type": "github"
       }
     },
+    "nix-filter": {
+      "locked": {
+        "lastModified": 1710156097,
+        "narHash": "sha256-1Wvk8UP7PXdf8bCCaEoMnOT1qe5/Duqgj+rL8sRQsSM=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "3342559a24e85fc164b295c3444e8a139924675b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1728241625,
@@ -351,6 +366,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1724819573,
+        "narHash": "sha256-GnR7/ibgIH1vhoy8cYdmXE6iyZqKqFxQSVkFgosBh6w=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "71e91c409d1e654808b2621f28a327acfdad8dc2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_stable": {
       "locked": {
         "lastModified": 1728500571,
@@ -1213,6 +1244,26 @@
         "url": "https://git.joshuabell.xyz/nvim"
       }
     },
+    "ringofstorms-stormd": {
+      "inputs": {
+        "nix-filter": "nix-filter",
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay_4"
+      },
+      "locked": {
+        "lastModified": 1728889741,
+        "narHash": "sha256-EbgfN3lQc8nkg2SrVL/HkuNZjXlJ5HSsCejvBNFIisI=",
+        "ref": "refs/heads/master",
+        "rev": "613a70c6f514c463f456cf7a4d750f9895bb0dee",
+        "revCount": 34,
+        "type": "git",
+        "url": "ssh://git.joshuabell.xyz:3032/stormd"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git.joshuabell.xyz:3032/stormd"
+      }
+    },
     "root": {
       "inputs": {
         "cosmic": "cosmic",
@@ -1227,7 +1278,8 @@
         "nixpkgs_stable": "nixpkgs_stable",
         "nypkgs": "nypkgs",
         "ragenix": "ragenix",
-        "ringofstorms-nvim": "ringofstorms-nvim"
+        "ringofstorms-nvim": "ringofstorms-nvim",
+        "ringofstorms-stormd": "ringofstorms-stormd"
       }
     },
     "rust-overlay": {
@@ -1293,6 +1345,27 @@
         "type": "github"
       }
     },
+    "rust-overlay_4": {
+      "inputs": {
+        "nixpkgs": [
+          "ringofstorms-stormd",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1718849885,
+        "narHash": "sha256-Qfc5HKpQvGhWXox0WJVzLqrAcFm3uy6xtWRvVmrkLYc=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "bc1a236757cd5f6622f73838e551fb2035afa44a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 541684a..8e88138 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,6 +42,9 @@
     ringofstorms-nvim = {
       url = "git+https://git.joshuabell.xyz/nvim";
     };
+    ringofstorms-stormd = {
+      url = "git+ssh://git.joshuabell.xyz:3032/stormd";
+    };
 
     cosmic = {
       url = "github:lilyinstarlight/nixos-cosmic";
diff --git a/hosts/lio/configuration.nix b/hosts/lio/configuration.nix
index d58d6a6..6711557 100644
--- a/hosts/lio/configuration.nix
+++ b/hosts/lio/configuration.nix
@@ -22,7 +22,7 @@
     fonts.enable = true;
   #  nebula.enable = true;
     ssh.enable = true;
-    # stormd.enable = true; # TODO figure out why this is failing
+    stormd.enable = true; # TODO figure out why this is failing
   };
 
   # machine specific configuration
diff --git a/modules/stormd.nix b/modules/stormd.nix
index e21b445..e52662e 100644
--- a/modules/stormd.nix
+++ b/modules/stormd.nix
@@ -1,6 +1,8 @@
 {
   config,
   lib,
+  ringofstorms-stormd,
+  settings,
   ...
 }:
 with lib;
@@ -15,32 +17,10 @@ in
     };
   };
 
+  imports = [ ringofstorms-stormd.nixosModules.${settings.system.system} ];
+
   config = mkIf cfg.enable {
-    # environment.systemPackages = with pkgs; [
-    # ];
-
-    # TODO make a derivation for stormd binary and get it properlly in the store. This is super janky and the binary just has to exist there right now.
-
-    # networking.firewall.allowedUDPPorts = [ 4242 ];
-
-    systemd.services."stormd" = {
-      description = "Stormd service";
-      wants = [ "basic.target" ];
-      after = [
-        "basic.target"
-        "network.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "notify";
-        Restart = "always";
-        RestartSec = 1;
-        ExecStart = "/etc/stormd/stormd daemon";
-      };
-      unitConfig = {
-        StartLimitIntervalSec = 5;
-        StartLimitBurst = 3;
-      };
-    };
+    users.users.root.packages = [ ringofstorms-stormd.packages.${settings.system.system}.stormd ];
+    services.stormd.enable = true;
   };
 }
diff --git a/readme.md b/readme.md
index ff19efa..6788a56 100644
--- a/readme.md
+++ b/readme.md
@@ -2,7 +2,7 @@
 
 # First Install on new Machine
 
-## NixOS
+## NixOS install
 
 1. Install nix minimal:
 
@@ -34,7 +34,6 @@
   - `cd /mnt/etc/nixos`
   - `curl -O https://share.joshuabell.link/nix/onboard.sh`
   - `chmod +x onboard.sh && ./onboard.sh`
-  - CHECK HARDWARE LABELS # TODO update onboard to look for label names since we switched to boot/root instead of NIXBOOT/NIXROOT
   - `reboot`
 - log into USERNAME with `password1`, use `passwd` to change the password
 
@@ -51,6 +50,11 @@
 - `nixos-rebuild switch --flake ~/.config/nixos-config`
 - Update remote, ssh should work now: `cd ~/.config/nixos-config && git remote remove origin && git remote add origin "ssh://git.joshuabell.xyz:3032/dotfiles" && git pull origin master`
 
+## Local tooling
+
+- stormd
+  - get stormd and build locally, copy release build to /etc/stormd
+  - enable stormd mod TODO LEFT OFF HERE... get this working on lio
 - atuin setup
   - if atuin is on enable that mod in configuration.nix, make sure to `atuin login` get key from existing device
   - TODO move key into secrets and mount it to atuin local share