diff --git a/common/_containers/forgejo.nix b/common/_containers/forgejo.nix
new file mode 100644
index 0000000..92793a9
--- /dev/null
+++ b/common/_containers/forgejo.nix
@@ -0,0 +1,196 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  name = "forgejo";
+
+  hostDataDir = "/var/lib/${name}";
+
+  hostAddress = "10.0.0.1";
+  containerAddress = "10.0.0.2";
+  hostAddress6 = "fc00::1";
+  containerAddress6 = "fc00::2";
+
+  binds = [
+    # Postgres data, must use postgres user in container and host
+    {
+      host = "${hostDataDir}/postgres";
+      # Adjust based on container postgres data dir
+      container = "/var/lib/postgresql/17";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # Postgres backups
+    {
+      host = "${hostDataDir}/backups/postgres";
+      container = "/var/backup/postgresql";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # App data, uses custom user uid
+    {
+      host = "${hostDataDir}/data";
+      container = "/var/lib/forgejo";
+      user = "forgejo";
+      uid = 115;
+      gid = 115;
+    }
+  ];
+  uniqueUsers = lib.foldl' (
+    acc: bind: if lib.lists.any (item: item.user == bind.user) acc then acc else acc ++ [ bind ]
+  ) [ ] binds;
+  users = {
+    users = lib.listToAttrs (
+      lib.map (u: {
+        name = u.user;
+        value = {
+          isSystemUser = true;
+          name = u.user;
+          uid = u.uid;
+          group = u.user;
+        };
+      }) uniqueUsers
+    );
+
+    groups = lib.listToAttrs (
+      lib.map (g: {
+        name = g.user;
+        value.gid = g.gid;
+      }) uniqueUsers
+    );
+  };
+in
+{
+  # Ensure users exists on host machine with same IDs as container
+  inherit users;
+
+  # Ensure directories exist on host machine
+  system.activationScripts.createMediaServerDirs = ''
+    ${lib.concatStringsSep "\n" (
+      lib.map (bind: ''
+        mkdir -p ${bind.host}
+        chown -R ${toString bind.user}:${toString bind.gid} ${bind.host}
+        chmod -R 750 ${bind.host}
+      '') binds
+    )}
+  '';
+
+  containers.${name} = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = containerAddress;
+    hostAddress6 = hostAddress6;
+    localAddress6 = containerAddress6;
+    bindMounts = lib.foldl (
+      acc: bind:
+      {
+        "${bind.container}" = {
+          hostPath = bind.host;
+          isReadOnly = false;
+        };
+      }
+      // acc
+    ) { } binds;
+    config =
+      { config, pkgs, ... }:
+      {
+        system.stateVersion = "24.11";
+
+        networking = {
+          firewall = {
+            enable = true;
+            allowedTCPPorts = [
+              3000
+              3032
+            ];
+          };
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+        services.resolved.enable = true;
+
+        # Ensure users exist on container
+        inherit users;
+
+        services.postgresql = {
+          enable = true;
+          package = pkgs.postgresql_17.withJIT;
+          enableJIT = true;
+          authentication = ''
+            local all all trust
+            host all all 127.0.0.1/8 trust
+            host all all ::1/128 trust
+            host all all fc00::1/128 trust
+          '';
+        };
+
+        # Backup database
+        services.postgresqlBackup = {
+          enable = true;
+        };
+
+        services.forgejo = {
+          enable = true;
+          dump = {
+            enable = false;
+            type = "tar.gz";
+          };
+          database = {
+            type = "postgres";
+          };
+          settings = {
+            DEFAULT = {
+              APP_NAME = "Josh's Git";
+            };
+            server = {
+              PROTOCOL = "http";
+              DOMAIN = "git.joshuabell.xyz";
+              HTTP_ADDR = "0.0.0.0";
+              HTTP_PORT = 3000;
+
+              START_SSH_SERVER = true;
+              SSH_DOMAIN = "git.joshuabell.xyz";
+              SSH_LISTEN_HOST = "0.0.0.0";
+              SSH_LISTEN_PORT = 3032; # actual listen port
+              SSH_PORT = 3032; # used in UI
+              BUILTIN_SSH_SERVER_USER = "git";
+
+              LANDING_PAGE = "explore";
+            };
+            service = {
+              DISABLE_REGISTRATION = true;
+              ENABLE_BASIC_AUTHENTICATION = false;
+              DISABLE_USERS_PAGE = true;
+              DISABLE_ORGANIZATIONS_PAGE = true;
+            };
+            repository = {
+              # ENABLE_PUSH_CREATE_USER = true;
+              # ENABLE_PUSH_CREATE_ORG = true;
+              DISABLE_STARS = true;
+              DEFAULT_PRIVATE = "private";
+            };
+            admin = {
+              DISABLE_REGULAR_ORG_CREATION = true;
+              USER_DISABLED_FEATURES = "deletion";
+            };
+            other = {
+              SHOW_FOOTER_POWERED_BY = false;
+              SHOW_FOOTER_VERSION = false;
+              SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+            };
+            migrations = {
+              ALLOWED_DOMAINS = "*.github.com,github.com";
+              ALLOW_LOCALNETWORKS = true;
+            };
+          };
+        };
+      };
+  };
+}
diff --git a/common/_containers/obsidian_sync.md b/common/_containers/obsidian_sync.md
new file mode 100644
index 0000000..98f7e11
--- /dev/null
+++ b/common/_containers/obsidian_sync.md
@@ -0,0 +1,7 @@
+docker run \
+ -e hostname=https://obsidiansync.joshuabell.xyz \
+ -e database=obsidian_sync \
+ -e username=obsidian_admin \
+ -e password=$REPLACE \
+ docker.io/oleduc/docker-obsidian-livesync-couchdb:master \
+ deno -A /scripts/generate_setupuri.ts
diff --git a/common/_containers/obsidian_sync.nix b/common/_containers/obsidian_sync.nix
new file mode 100644
index 0000000..42f8b52
--- /dev/null
+++ b/common/_containers/obsidian_sync.nix
@@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.obsidian_sync;
+in
+{
+  options.services.obsidian_sync =
+    let
+      lib = pkgs.lib;
+    in
+    {
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 5984;
+        description = "Port number for Obsidian Sync CouchDB server";
+      };
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/obsidian_sync";
+        description = "Directory to store Obsidian Sync data";
+      };
+      serverUrl = lib.mkOption {
+        type = lib.types.str;
+        description = "URL of the Obsidian Sync server";
+      };
+      dockerEnvFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [ ];
+        description = "List of environment files to be used by the Obsidian Sync container. When provided you must supply chouchdb user/password env files they will not be supplied by default.";
+      };
+    };
+
+  config = {
+    virtualisation.oci-containers.containers = {
+      #############
+      # obsidian_sync #
+      #############
+      obsidian_sync = {
+        user = "root";
+        image = "docker.io/oleduc/docker-obsidian-livesync-couchdb:master";
+        ports = [
+          "${toString cfg.port}:${toString cfg.port}"
+        ];
+        environment = {
+          SERVER_URL = cfg.serverUrl;
+          COUCHDB_DATABASE = "obsidian_sync";
+          COUCHDB_USER = pkgs.lib.mkIf (cfg.dockerEnvFiles == [ ]) "adminu";
+          COUCHDB_PASSWORD = pkgs.lib.mkIf (cfg.dockerEnvFiles == [ ]) "Password123";
+        };
+        environmentFiles = cfg.dockerEnvFiles;
+        volumes = [
+          "${cfg.dataDir}/data:/opt/couchdb/data"
+          "${cfg.dataDir}/config:/opt/couchdb/etc/local.d"
+        ];
+      };
+    };
+  };
+}
diff --git a/common/_home_manager/default.nix b/common/_home_manager/default.nix
new file mode 100644
index 0000000..de3d9b7
--- /dev/null
+++ b/common/_home_manager/default.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  hyprland,
+  hyprlandPkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "homeManager"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      users = lib.mkOption {
+        type = lib.types.attrsOf lib.types.attrs;
+        default = { };
+        description = "Home manager users to configure. Should match nix options of home-manager.users.<name>.*";
+      };
+      stateVersion = lib.mkOption {
+        type = lib.types.str;
+        default = "25.05";
+        description = "Home manager state version";
+      };
+    };
+  config = {
+    # Home manager options
+    security.polkit.enable = true;
+    home-manager.useUserPackages = true;
+    home-manager.useGlobalPkgs = true;
+    home-manager.backupFileExtension = "bak";
+
+    home-manager.extraSpecialArgs = {
+      inherit hyprland hyprlandPkgs;
+    };
+
+    home-manager.users = lib.mapAttrs' (name: userConfig: {
+      inherit name;
+      value = userConfig // {
+        home.stateVersion = cfg.stateVersion;
+        programs.home-manager.enable = true;
+        home.username = name;
+        home.homeDirectory = lib.mkForce (if name == "root" then "/root" else "/home/${name}");
+      };
+    }) cfg.users;
+  };
+}
diff --git a/flakes/common/hm_modules/alacritty.nix b/common/_home_manager/mods/alacritty.nix
similarity index 96%
rename from flakes/common/hm_modules/alacritty.nix
rename to common/_home_manager/mods/alacritty.nix
index 02cb9d6..0794c15 100644
--- a/flakes/common/hm_modules/alacritty.nix
+++ b/common/_home_manager/mods/alacritty.nix
@@ -6,7 +6,6 @@
       window = {
         decorations = "None";
         dynamic_title = false;
-        opacity = 0.94;
       };
       colors = {
         primary = {
diff --git a/flakes/common/hm_modules/atuin.nix b/common/_home_manager/mods/atuin.nix
similarity index 64%
rename from flakes/common/hm_modules/atuin.nix
rename to common/_home_manager/mods/atuin.nix
index 021745f..2eb52df 100644
--- a/flakes/common/hm_modules/atuin.nix
+++ b/common/_home_manager/mods/atuin.nix
@@ -1,18 +1,16 @@
 { ... }:
-# TODO setup auto secret/login for sync
 {
   programs.atuin = {
     enable = true;
-    enableZshIntegration = true; # TODO make dynamic?
+    enableZshIntegration = true;
     flags = [ "--disable-up-arrow" ];
     settings = {
       workspaces = true;
       exit-mode = "return-query";
       enter_accept = true;
       sync_address = "https://atuin.joshuabell.xyz";
-      sync = {
-        records = true;
-      };
+      sync = { records = true; };
     };
   };
 }
+
diff --git a/flakes/common/hm_modules/direnv.nix b/common/_home_manager/mods/direnv.nix
similarity index 100%
rename from flakes/common/hm_modules/direnv.nix
rename to common/_home_manager/mods/direnv.nix
diff --git a/common/_home_manager/mods/foot.nix b/common/_home_manager/mods/foot.nix
new file mode 100644
index 0000000..cffbb53
--- /dev/null
+++ b/common/_home_manager/mods/foot.nix
@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+{
+  options.components.foot = {
+    font_size = lib.mkOption {
+      type = lib.types.float;
+      default = 12.0;
+      description = "Font size for Foot terminal";
+    };
+    alpha = lib.mkOption {
+      type = lib.types.float;
+      default = 0.94;
+      description = "Background opacity for Foot terminal (1.0 = opaque)";
+    };
+  };
+  config = {
+    programs.foot = {
+      enable = true;
+
+      # This renders to ~/.config/foot/foot.ini
+      settings = {
+        main = {
+          # Use the same font and size as your Kitty config
+          font = "JetBrainsMonoNL Nerd Font:size=${toString config.components.kitty.font_size}";
+
+          # Initial window size in character cells (Kitty used 160c x 55c)
+          "initial-window-size-chars" = "160x55";
+        };
+
+        colors = {
+          # Background opacity (1.0 = opaque)
+          alpha = toString config.components.foot.alpha;
+
+          # Foreground/background
+          foreground = "e0e0e0";
+          background = "262626";
+
+          # 16-color palette
+          # normal (0–7)
+          regular0 = "1f1f1f"; # black
+          regular1 = "f38ba8"; # red
+          regular2 = "a6e3a1"; # green
+          regular3 = "f9e2af"; # yellow
+          regular4 = "89b4fa"; # blue
+          regular5 = "cba6f7"; # magenta
+          regular6 = "89dceb"; # cyan
+          regular7 = "e0e0e0"; # white
+
+          # bright (8–15)
+          bright0 = "565656"; # bright black
+          bright1 = "f38ba8"; # bright red
+          bright2 = "a6e3a1"; # bright green
+          bright3 = "f9e2af"; # bright yellow
+          bright4 = "89b4fa"; # bright blue
+          bright5 = "cba6f7"; # bright magenta
+          bright6 = "89dceb"; # bright cyan
+          bright7 = "ffffff"; # bright white
+        };
+      };
+    };
+  };
+}
diff --git a/flakes/common/hm_modules/git.nix b/common/_home_manager/mods/git.nix
similarity index 94%
rename from flakes/common/hm_modules/git.nix
rename to common/_home_manager/mods/git.nix
index 406d280..5e84a6c 100644
--- a/flakes/common/hm_modules/git.nix
+++ b/common/_home_manager/mods/git.nix
@@ -7,7 +7,7 @@
     userName = "RingOfStorms (Joshua Bell)";
 
     extraConfig = {
-      core.pager = "bat";
+      core.pager = "cat";
       core.editor = "nano";
 
       pull.rebase = false;
@@ -55,10 +55,13 @@
 
       # direnv things
       ".direnv"
-      ".envrc"
 
       # local only files
       "*.local"
+
+      # AI tooling
+      ".aider*"
+      "aider"
     ];
   };
 }
diff --git a/common/_home_manager/mods/kitty.nix b/common/_home_manager/mods/kitty.nix
new file mode 100644
index 0000000..1b58b46
--- /dev/null
+++ b/common/_home_manager/mods/kitty.nix
@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+{
+  options.components.kitty = {
+    font_size = lib.mkOption {
+      type = lib.types.float;
+      default = 12.0;
+      description = "Font size for Kitty terminal";
+    };
+  };
+  config = {
+    # Enable Kitty terminal
+    programs.kitty = {
+      enable = true;
+
+      settings = {
+        # Window settings
+        background_opacity = 1.0;
+        os_window_class = "kitty";
+        remember_window_size = false;
+        placement_strategy = "center";
+        initial_window_width = "160c";
+        initial_window_height = "55c";
+
+        # Remove window borders
+        hide_window_decorations = "titlebar-only";
+        tab_title_template = "none";
+        active_tab_title_template = "none";
+        draw_minimal_borders = "yes";
+        window_border_width = "0.1pt";
+
+        # Colors (Catppuccin Coal)
+        foreground = "#e0e0e0";
+        background = "#262626";
+        color0 = "#1f1f1f";
+        color1 = "#f38ba8";
+        color2 = "#a6e3a1";
+        color3 = "#f9e2af";
+        color4 = "#89b4fa";
+        color5 = "#cba6f7";
+        color6 = "#89dceb";
+        color7 = "#e0e0e0";
+        color8 = "#565656";
+        color9 = "#f38ba8";
+        color10 = "#a6e3a1";
+        color11 = "#f9e2af";
+        color12 = "#89b4fa";
+        color13 = "#cba6f7";
+        color14 = "#89dceb";
+        color15 = "#ffffff";
+
+        # Font settings
+        font_family = "JetBrainsMonoNL Nerd Font";
+        font_size = config.components.kitty.font_size;
+        bold_font = "auto";
+        italic_font = "auto";
+        italic_bold_font = "auto";
+      };
+
+      # If you want to include extra configuration this way instead of through the main `settings` attribute
+      extraConfig = ''
+        # You can add additional config here if needed
+      '';
+    };
+  };
+}
diff --git a/flakes/common/hm_modules/launcher_rofi.nix b/common/_home_manager/mods/launcher_rofi.nix
similarity index 89%
rename from flakes/common/hm_modules/launcher_rofi.nix
rename to common/_home_manager/mods/launcher_rofi.nix
index df884a9..353b29e 100644
--- a/flakes/common/hm_modules/launcher_rofi.nix
+++ b/common/_home_manager/mods/launcher_rofi.nix
@@ -10,7 +10,7 @@
       modi = "drun,run,ssh,window,calc";
       terminal = "alacritty";
     };
-    theme = "Arc-Dark";
+    theme = "glue_pro_blue";
   };
   programs.wofi = {
     enable = true;
diff --git a/common/_home_manager/mods/nix_deprecations.nix b/common/_home_manager/mods/nix_deprecations.nix
new file mode 100644
index 0000000..d281d87
--- /dev/null
+++ b/common/_home_manager/mods/nix_deprecations.nix
@@ -0,0 +1,18 @@
+{ ... }:
+{
+  programs.zsh.shellAliases = {
+    # Nix deprecations
+    nix-hash = "echo 'The functionality of nix-hash may be covered by various subcommands or options in the new `nix` command.'";
+    nix-build = "echo 'Use `nix build` instead.'";
+    nix-info = "echo 'Use `nix flake info` or other `nix` subcommands to obtain system and Nix information.'";
+    nix-channel = "echo 'Channels are being phased out in favor of flakes. Use `nix flake` subcommands.'";
+    nix-instantiate = "echo 'Use `nix eval` or `nix-instantiate` with flakes.'";
+    nix-collect-garbage = "echo 'Use `nix store gc` instead.'";
+    nix-prefetch-url = "echo 'Use `nix-prefetch` or fetchers in Nix expressions.'";
+    nix-copy-closure = "echo 'Use `nix copy` instead.'";
+    nix-shell = "echo 'Use `nix shell` instead.'";
+    # nix-daemon # No direct replacement: The Nix daemon is still in use and managed by the system service manager.
+    nix-store = "echo 'Use `nix store` subcommands for store operations.'";
+    nix-env = "echo 'Use `nix profile` instead'";
+  };
+}
diff --git a/common/_home_manager/mods/obs.nix b/common/_home_manager/mods/obs.nix
new file mode 100644
index 0000000..68d6d68
--- /dev/null
+++ b/common/_home_manager/mods/obs.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.obs-studio.enable = true;
+}
diff --git a/flakes/common/hm_modules/postgres_cli_options.nix b/common/_home_manager/mods/postgres.nix
similarity index 100%
rename from flakes/common/hm_modules/postgres_cli_options.nix
rename to common/_home_manager/mods/postgres.nix
diff --git a/flakes/common/hm_modules/slicer.nix b/common/_home_manager/mods/slicer.nix
similarity index 100%
rename from flakes/common/hm_modules/slicer.nix
rename to common/_home_manager/mods/slicer.nix
diff --git a/flakes/common/hm_modules/ssh.nix b/common/_home_manager/mods/ssh.nix
similarity index 96%
rename from flakes/common/hm_modules/ssh.nix
rename to common/_home_manager/mods/ssh.nix
index e86e3ab..50c4e68 100644
--- a/flakes/common/hm_modules/ssh.nix
+++ b/common/_home_manager/mods/ssh.nix
@@ -129,11 +129,6 @@ in
         user = "luser";
       };
       "h003" = lib.mkIf (hasSecret "nix2h003") {
-        identityFile = age.secrets.nix2h003.path;
-        hostname = "10.12.14.1";
-        user = "luser";
-      };
-      "h003_" = lib.mkIf (hasSecret "nix2h003") {
         identityFile = age.secrets.nix2h003.path;
         user = "luser";
       };
diff --git a/flakes/common/hm_modules/starship.nix b/common/_home_manager/mods/starship.nix
similarity index 100%
rename from flakes/common/hm_modules/starship.nix
rename to common/_home_manager/mods/starship.nix
diff --git a/flakes/common/hm_modules/tmux/tmux-reset.conf b/common/_home_manager/mods/tmux/tmux-reset.conf
similarity index 87%
rename from flakes/common/hm_modules/tmux/tmux-reset.conf
rename to common/_home_manager/mods/tmux/tmux-reset.conf
index 1ab2830..fd5dd3d 100644
--- a/flakes/common/hm_modules/tmux/tmux-reset.conf
+++ b/common/_home_manager/mods/tmux/tmux-reset.conf
@@ -35,20 +35,11 @@ bind -r right select-pane -R
 bind x kill-pane
 bind -r space resize-pane -Z
 bind S select-layout tiled
-
 bind -r h select-pane -L
 bind -r j select-pane -D
 bind -r k select-pane -U
 bind -r l select-pane -R
-bind -r C-h swap-pane -t '{left-of}'
-bind -r C-j swap-pane -D
-bind -r C-k swap-pane -U
-bind -r C-l swap-pane -t '{right-of}'
 
-bind -n C-Left resize-pane -L 5
-bind -n C-Down resize-pane -D 5
-bind -n C-Up resize-pane -U 5
-bind -n C-Right resize-pane -R 5
 
 # Sessions
 bind $ command-prompt "rename-session %%"
diff --git a/flakes/common/hm_modules/tmux/default.nix b/common/_home_manager/mods/tmux/tmux.nix
similarity index 97%
rename from flakes/common/hm_modules/tmux/default.nix
rename to common/_home_manager/mods/tmux/tmux.nix
index 6d67f51..7e3038b 100644
--- a/flakes/common/hm_modules/tmux/default.nix
+++ b/common/_home_manager/mods/tmux/tmux.nix
@@ -68,4 +68,9 @@
       }
     ];
   };
+
+  home.shellAliases = {
+    t = "tmux";
+    tat = "tmux attach-session";
+  };
 }
diff --git a/flakes/common/hm_modules/zoxide.nix b/common/_home_manager/mods/zoxide.nix
similarity index 100%
rename from flakes/common/hm_modules/zoxide.nix
rename to common/_home_manager/mods/zoxide.nix
diff --git a/flakes/common/hm_modules/zsh.nix b/common/_home_manager/mods/zsh.nix
similarity index 100%
rename from flakes/common/hm_modules/zsh.nix
rename to common/_home_manager/mods/zsh.nix
diff --git a/common/boot/default.nix b/common/boot/default.nix
new file mode 100644
index 0000000..9561386
--- /dev/null
+++ b/common/boot/default.nix
@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.boot;
+in
+{
+  imports = [
+    ./grub.nix
+    ./systemd.nix
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledBootloaders = lib.filter (x: x.enabled) [
+            {
+              name = "systemd";
+              enabled = cfg.systemd.enable;
+            }
+            {
+              name = "grub";
+              enabled = cfg.grub.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledBootloaders <= 1;
+          message =
+            "Only one bootloader can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledBootloaders);
+        }
+      )
+    ];
+  };
+}
diff --git a/common/boot/grub.nix b/common/boot/grub.nix
new file mode 100644
index 0000000..c922d57
--- /dev/null
+++ b/common/boot/grub.nix
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "boot"
+    "grub"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Grub bootloader";
+      device = lib.mkOption {
+        type = lib.types.str;
+        default = "/dev/sda";
+        description = ''
+          The device to install GRUB on.
+        '';
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    boot.loader.grub = {
+      enable = true;
+      device = cfg.device;
+    };
+  };
+}
diff --git a/common/boot/systemd.nix b/common/boot/systemd.nix
new file mode 100644
index 0000000..7021795
--- /dev/null
+++ b/common/boot/systemd.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "boot"
+    "systemd"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Systemd bootloader";
+    };
+  config = lib.mkIf cfg.enable {
+    boot.loader = {
+      systemd-boot = {
+        enable = true;
+        consoleMode = "keep";
+      };
+      timeout = 5;
+      efi = {
+        canTouchEfiVariables = true;
+      };
+    };
+  };
+}
diff --git a/common/config.nix b/common/config.nix
new file mode 100644
index 0000000..3292380
--- /dev/null
+++ b/common/config.nix
@@ -0,0 +1,3 @@
+{
+  custom_config_key = "ringofstorms_common";
+}
diff --git a/common/desktop_environment/cosmic/default.nix b/common/desktop_environment/cosmic/default.nix
new file mode 100644
index 0000000..6a81d92
--- /dev/null
+++ b/common/desktop_environment/cosmic/default.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [ ccfg.custom_config_key "desktopEnvironment" "cosmic" ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options = {}
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "COSMIC desktop environment (System76)";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      # settings.default_session = {
+      #   command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.cosmic}/bin/cosmic-session'";
+      #   user = "greeter";
+      # };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wofi
+      btop
+    ];
+
+    xdg.portal.enable = true;
+
+    environment.sessionVariables = {
+      NIXOS_OZONE_WL = "1";
+      GTK_THEME = "Adwaita:dark";
+    };
+
+    qt = { enable = true; platformTheme = "gtk2"; style = "adwaita-dark"; };
+    hardware.graphics.enable = true;
+  };
+}
diff --git a/common/desktop_environment/default.nix b/common/desktop_environment/default.nix
new file mode 100644
index 0000000..6e50a40
--- /dev/null
+++ b/common/desktop_environment/default.nix
@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.desktopEnvironment;
+in
+{
+  imports = [
+    ./gnome
+    # ./hyprland
+    ./sway
+    ./cosmic
+    ./i3
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledDEs = lib.filter (x: x.enabled) [
+            {
+              name = "gnome";
+              enabled = cfg.gnome.enable;
+            }
+            # {
+            #   name = "hyprland";
+            #   enabled = cfg.hyprland.enable;
+            # }
+            {
+              name = "sway";
+              enabled = cfg.sway.enable;
+            }
+            {
+              name = "cosmic";
+              enabled = cfg.cosmic.enable;
+            }
+            {
+              name = "i3";
+              enabled = cfg.i3.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledDEs <= 1;
+          message =
+            "Only one desktop environment can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledDEs);
+        }
+      )
+    ];
+  };
+}
diff --git a/common/desktop_environment/gnome/black.png b/common/desktop_environment/gnome/black.png
new file mode 100644
index 0000000..b87512f
Binary files /dev/null and b/common/desktop_environment/gnome/black.png differ
diff --git a/common/desktop_environment/gnome/dconf.nix b/common/desktop_environment/gnome/dconf.nix
new file mode 100644
index 0000000..141baa7
--- /dev/null
+++ b/common/desktop_environment/gnome/dconf.nix
@@ -0,0 +1,208 @@
+{ cfg }:
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      (
+        { lib, ... }:
+        with lib.hm.gvariant;
+        {
+          # use `dconf dump /` before and after and diff the files for easy editing of dconf below
+          #     dconf dump / > /tmp/dconf_dump_start && watch -n0.5 "dconf dump / > /tmp/dconf_dump_current && \diff --color /tmp/dconf_dump_start /tmp/dconf_dump_current -U12"
+          # To get nix specific diff:
+          #     \diff -u /tmp/dconf_dump_start /tmp/dconf_dump_current | grep '^+[^+]' | sed 's/^+//' | dconf2nix
+          # OR (Must be logged into user directly, no SU to user will work): `dconf watch /`
+          # OR get the exact converted nixConfig from `dconf dump / | dconf2nix | less` and search with forward slash
+          dconf.settings = {
+            "org/gnome/shell" = {
+              favorite-apps = [ ];
+              enabled-extensions = with pkgs.gnomeExtensions; [
+                vertical-workspaces.extensionUuid
+                compact-top-bar.extensionUuid
+                tray-icons-reloaded.extensionUuid
+                vitals.extensionUuid
+              ] ++ lib.optionals cfg.enableRotate [
+                screen-rotate.extensionUuid
+              ];
+            };
+
+            # Plugin Settings
+            "org/gnome/shell/extensions/vertical-workspaces" = {
+              animation-speed-factor = 42;
+              center-dash-to-ws = false;
+              dash-bg-color = 0;
+              dash-position = 2;
+              dash-position-adjust = 0;
+              hot-corner-action = 0;
+              startup-state = 1;
+              ws-switcher-wraparound = true;
+            };
+            "org/gnome/shell/extensions/compact-top-bar" = {
+              fade-text-on-fullscreen = true;
+            };
+            "org/gnome/shell/extensions/vitals" = {
+              position-in-panel = 1;
+            };
+
+            # Built in settings
+            "org/gnome/desktop/session" = {
+              idle-delay = mkUint32 0;
+            };
+            "org/gnome/desktop/wm/preferences" = {
+              resize-with-right-button = true;
+              button-layout = "maximize:appmenu,close";
+              audible-bell = false;
+              wrap-around = true;
+            };
+            "org/gnome/settings-daemon/plugins/media-keys" = {
+              # Disable the lock screen shortcut
+              screensaver = [ "" ];
+              custom-keybindings = [
+                "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+                "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+              ];
+            };
+            "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+              binding = "<Super>Return";
+              command = cfg.terminalCommand;
+              name = "Launch terminal";
+            };
+            "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+              binding = "<Super>Space";
+              command = "wofi";
+              name = "Launcher";
+            };
+            "org/gnome/desktop/wm/keybindings" = {
+              minimize = [ "" ];
+              move-to-workspace-1 = [ "" ];
+              move-to-workspace-2 = [ "" ];
+              move-to-workspace-3 = [ "" ];
+              move-to-workspace-4 = [ "" ];
+              move-to-workspace-last = [ "" ];
+              move-to-workspace-down = [ "<Control><Super>j" ];
+              move-to-workspace-up = [ "<Control><Super>k" ];
+              # move-to-workspace-left = [ "<Control><Super>h" ];
+              # move-to-workspace-right = [ "<Control><Super>l" ];
+              switch-input-source = [ ];
+              switch-input-source-backward = [ ];
+              switch-to-workspace-1 = [ "<Super>1" ];
+              switch-to-workspace-2 = [ "<Super>2" ];
+              switch-to-workspace-3 = [ "<Super>3" ];
+              switch-to-workspace-4 = [ "<Super>4" ];
+              switch-to-workspace-last = [ "" ];
+              switch-to-workspace-down = [ "<Super>j" ];
+              switch-to-workspace-up = [ "<Super>k" ];
+              # switch-to-workspace-left = [ "<Super>k" ];
+              # switch-to-workspace-right = [ "<Super>j" ];
+              # move-to-monitor-down = [ "<Control><Super><Shift>j" ];
+              # move-to-monitor-up = [ "<Control><Super><Shift>k" ];
+              move-to-monitor-left = [ "<Control><Super>h" ];
+              move-to-monitor-right = [ "<Control><Super>l" ];
+              unmaximize = [ "<Super><Shift>j" ];
+              maximize = [ "<Super><Shift>k" ];
+            };
+            "org/gnome/mutter" = {
+              dynamic-workspaces = true;
+              edge-tiling = true;
+              workspaces-only-on-primary = true;
+              center-new-windows = true;
+            };
+            "org/gnome/mutter/keybindings" = {
+              toggle-tiled-right = [ "<Super><Shift>l" ];
+              toggle-tiled-left = [ "<Super><Shift>h" ];
+            };
+            "org/gnome/settings-daemon/plugins/power" = {
+              power-button-action = "nothing";
+              sleep-inactive-ac-type = "nothing";
+              sleep-inactive-battery-type = "nothing";
+              idle-brightness = 15;
+              power-saver-profile-on-low-battery = false;
+            };
+            "org/gnome/desktop/background" = {
+              color-shading-type = "solid";
+              picture-options = "zoom";
+              picture-uri = "file://" + (./black.png);
+              picture-uri-dark = "file://" + (./black.png);
+              primary-color = "#000000000000";
+              secondary-color = "#000000000000";
+            };
+            "org/gnome/desktop/screensaver" = {
+              lock-enabled = false;
+              idle-activation-enabled = false;
+              picture-options = "zoom";
+              picture-uri = "file://" + (./black.png);
+              picture-uri-dark = "file://" + (./black.png);
+            };
+            "org/gnome/desktop/applications/terminal" = {
+              exec = "alacritty";
+            };
+            "org/gnome/settings-daemon/plugins/color" = {
+              night-light-enabled = false;
+              night-light-schedule-automatic = false;
+            };
+            "org/gnome/shell/keybindings" = {
+              shift-overview-down = [ "" ];
+              shift-overview-up = [ "" ];
+              switch-to-application-1 = [ "" ];
+              switch-to-application-2 = [ "" ];
+              switch-to-application-3 = [ "" ];
+              switch-to-application-4 = [ "" ];
+              switch-to-application-5 = [ "" ];
+              switch-to-application-6 = [ "" ];
+              switch-to-application-7 = [ "" ];
+              switch-to-application-8 = [ "" ];
+              switch-to-application-9 = [ "" ];
+              toggle-quick-settings = [ "" ];
+              toggle-application-view = [ "" ];
+            };
+            "org/gtk/gtk4/settings/file-chooser" = {
+              show-hidden = true;
+            };
+
+            "org/gnome/desktop/interface" = {
+              accent-color = "orange";
+              show-battery-percentage = true;
+              clock-show-date = true;
+              clock-show-seconds = true;
+              clock-show-weekday = true;
+              color-scheme = "prefer-dark";
+              cursor-size = 24;
+              enable-animations = true;
+              enable-hot-corners = false;
+              font-antialiasing = "grayscale";
+              font-hinting = "slight";
+              gtk-theme = "Adwaita-dark";
+              # icon-theme = "Yaru-magenta-dark";
+            };
+
+            "org/gnome/desktop/notifications" = {
+              application-children = [ "org-gnome-tweaks" ];
+            };
+
+            "org/gnome/desktop/notifications/application/org-gnome-tweaks" = {
+              application-id = "org.gnome.tweaks.desktop";
+            };
+
+            "org/gnome/desktop/peripherals/mouse" = {
+              natural-scroll = false;
+            };
+
+            "org/gnome/desktop/peripherals/touchpad" = {
+              disable-while-typing = true;
+              two-finger-scrolling-enabled = true;
+              natural-scroll = true;
+            };
+
+            "org/gnome/tweaks" = {
+              show-extensions-notice = false;
+            };
+          };
+        }
+      )
+    ];
+  };
+}
diff --git a/common/desktop_environment/gnome/default.nix b/common/desktop_environment/gnome/default.nix
new file mode 100644
index 0000000..9f36b57
--- /dev/null
+++ b/common/desktop_environment/gnome/default.nix
@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "gnome"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "gnome desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "kitty";
+        description = "The terminal command to use.";
+      };
+      enableRotate = lib.mkEnableOption "enable screen rotation";
+    };
+
+  imports = [
+    (import ./dconf.nix { inherit cfg; })
+    (import ./wofi.nix { inherit cfg; })
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.xserver = {
+      enable = true;
+      desktopManager.gnome.enable = true;
+      displayManager.gdm = {
+        enable = true;
+        autoSuspend = false;
+        wayland = true;
+      };
+    };
+    services.gnome.gnome-initial-setup.enable = false;
+
+    environment.gnome.excludePackages = with pkgs; [
+      gnome-backgrounds
+      gnome-video-effects
+      gnome-maps
+      gnome-music
+      gnome-tour
+      gnome-text-editor
+      gnome-user-docs
+    ];
+    environment.systemPackages = with pkgs; [
+      dconf-editor
+      dconf2nix
+      gnome-tweaks
+      wayland
+      wayland-utils
+      wl-clipboard
+      numix-cursor-theme
+      gnomeExtensions.vertical-workspaces
+      gnomeExtensions.compact-top-bar
+      gnomeExtensions.tray-icons-reloaded
+      gnomeExtensions.vitals
+    ] ++ lib.optionals cfg.enableRotate [
+      gnomeExtensions.screen-rotate
+    ];
+    environment.sessionVariables = {
+      NIXOS_OZONE_WL = "1";
+      GTK_THEME = "Adwaita:dark";
+    };
+
+    qt = {
+      enable = true;
+      platformTheme = "gnome";
+      style = "adwaita-dark";
+    };
+
+    hardware.graphics = {
+      enable = true;
+    };
+  };
+}
diff --git a/common/desktop_environment/gnome/wofi.css b/common/desktop_environment/gnome/wofi.css
new file mode 100644
index 0000000..976c0ef
--- /dev/null
+++ b/common/desktop_environment/gnome/wofi.css
@@ -0,0 +1,51 @@
+window {
+  margin: 0px;
+  border: 1px solid #171717;
+  background-color: #262626;
+}
+
+#input {
+  margin: 5px;
+  border: none;
+  color: #e0e0e0;
+  background-color: #1f1f1f;
+}
+
+#inner-box {
+  margin: 5px;
+  border: none;
+  background-color: #171717;
+}
+
+#outer-box {
+  margin: 5px;
+  border: none;
+  background-color: #191919;
+}
+
+#scroll {
+  margin: 0px;
+  border: none;
+}
+
+#text {
+  margin: 5px;
+  border: none;
+  color: #e0e0e0;
+}
+
+#entry.activatable #text {
+  color: #cccccc;
+}
+
+#entry>* {
+  color: #e0e0e0;
+}
+
+#entry:selected {
+  background-color: #4f4f4f;
+}
+
+#entry:selected #text {
+  font-weight: bold;
+}
diff --git a/common/desktop_environment/gnome/wofi.nix b/common/desktop_environment/gnome/wofi.nix
new file mode 100644
index 0000000..d3cd8e2
--- /dev/null
+++ b/common/desktop_environment/gnome/wofi.nix
@@ -0,0 +1,31 @@
+{ cfg }:
+{ lib, ... }:
+{
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      (
+        { lib, ... }:
+        {
+          programs.wofi = {
+            enable = true;
+            settings = {
+              width = "28%";
+              height = "38%";
+              show = "drun";
+              location = "center";
+              gtk_dark = true;
+              valign = "center";
+              key_backward = "Ctrl+k";
+              key_forward = "Ctrl+j";
+              insensitive = true;
+              prompt = "Run";
+              allow_images = true;
+            };
+            style = builtins.readFile ./wofi.css;
+          };
+        }
+      )
+    ];
+
+  };
+}
diff --git a/common/desktop_environment/hyprland/default.nix b/common/desktop_environment/hyprland/default.nix
new file mode 100644
index 0000000..40d332a
--- /dev/null
+++ b/common/desktop_environment/hyprland/default.nix
@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  hyprland,
+  hyprlandPkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "hyprland desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for Hyprland configuration.";
+      };
+      swaync = {
+        enable = lib.mkEnableOption "Enable Swaync (notification center for Hyprland)";
+      };
+      waybar = {
+        enable = lib.mkEnableOption "Enable Waybar (status bar for Hyprland)";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users
+    home-manager = {
+      sharedModules = [
+        hyprland.homeManagerModules.default
+        ./home_manager
+      ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${hyprlandPkgs.hyprland}/bin/Hyprland'";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wl-clip-persist
+      wofi # application launcher
+      nemo # file manager (x11)
+      # nautilus # file manager
+      feh # image viewer (x11)
+      # imv # image viewer
+      networkmanager # network management
+      upower # power management
+      brightnessctl # screen/keyboard brightness control
+      wireplumber # media session manager
+      libgtop # system monitor library
+      bluez # Bluetooth support
+      power-profiles-daemon # power profiles
+      grim
+      slurp
+      hyprpicker
+      grimblast # screenshot tool
+      wf-recorder # screen recording tool
+      btop # system monitor
+    ];
+
+    services.blueman.enable = config.hardware.bluetooth.enable;
+
+    programs.hyprland = {
+      enable = true;
+      # xwayland.enable = false;
+      withUWSM = true;
+
+      # set the flake package
+      package = hyprlandPkgs.hyprland;
+      # make sure to also set the portal package, so that they are in sync
+      # This is set below now in xdf portal directly so we can also add things like gtk
+      # portalPackage = hyprlandPkgs.xdg-desktop-portal-hyprland;
+    };
+
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        hyprlandPkgs.xdg-desktop-portal-hyprland
+        hyprlandPkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "hyprland"
+        "gtk"
+      ];
+    };
+
+    hardware.graphics = {
+      enable = true;
+      package = hyprlandPkgs.mesa;
+      # if you also want 32-bit support (e.g for Steam)
+      # enable32Bit = true;
+      package32 = hyprlandPkgs.pkgsi686Linux.mesa;
+    };
+
+    # Environment variables
+    environment.sessionVariables = {
+      GTK_THEME = "Adwaita:dark";
+      XDG_SESSION_TYPE = "wayland";
+      XDG_CURRENT_DESKTOP = "Hyprland";
+      XDG_SESSION_DESKTOP = "Hyprland";
+      WLR_RENDERER = "auto";
+
+      # Tell apps to run native wayland
+      NIXOS_OZONE_WL = "1";
+      ELECTRON_OZONE_PLATFORM_HINT = "wayland";
+      GDK_BACKEND = "wayland,x11"; # GTK
+      QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
+      MOZ_ENABLE_WAYLAND = "1"; # Firefox
+      SDL_VIDEODRIVER = "wayland"; # SDL apps/games
+      CLUTTER_BACKEND = "wayland"; # You already have this
+    };
+
+    # Qt theming
+    qt = {
+      enable = true;
+      platformTheme = "gtk2";
+      style = "adwaita-dark";
+    };
+  };
+}
diff --git a/flakes/hyprland/home_manager/default.nix b/common/desktop_environment/hyprland/home_manager/default.nix
similarity index 90%
rename from flakes/hyprland/home_manager/default.nix
rename to common/desktop_environment/hyprland/home_manager/default.nix
index 57dac88..9533253 100644
--- a/flakes/hyprland/home_manager/default.nix
+++ b/common/desktop_environment/hyprland/home_manager/default.nix
@@ -3,7 +3,6 @@
   imports = [
     ./theme.nix
     ./hyprland.nix
-    ./hyprpaper.nix
     # ./quickshell.nix
     ./waybar.nix
     ./hyprpolkitagent.nix
diff --git a/flakes/hyprland/home_manager/hyprland.nix b/common/desktop_environment/hyprland/home_manager/hyprland.nix
similarity index 92%
rename from flakes/hyprland/home_manager/hyprland.nix
rename to common/desktop_environment/hyprland/home_manager/hyprland.nix
index afd313e..dc17934 100644
--- a/flakes/hyprland/home_manager/hyprland.nix
+++ b/common/desktop_environment/hyprland/home_manager/hyprland.nix
@@ -4,6 +4,15 @@
   hyprlandPkgs,
   ...
 }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
 {
   wayland.windowManager.hyprland = {
     enable = true;
@@ -12,12 +21,12 @@
     #   hyprspace
     # ];
 
-    settings = {
+    settings = lib.attrsets.recursiveUpdate {
       # Debug logs enabled when this is uncommented
       debug.disable_logs = false;
       debug.disable_time = false;
 
-      # exec-once = [ "pgrep waybar>/dev/null || waybar" ];
+      exec-once = [ "pgrep waybar>/dev/null || waybar" ];
 
       # Default monitor configuration
       monitor = "monitor = , preferred, auto, 1";
@@ -80,13 +89,12 @@
 
       bind = [
         # Applications
-        "$mainMod, Return, exec, foot"
+        "$mainMod, Return, exec, ${cfg.terminalCommand}"
         "$mainMod, Space, exec, pkill wofi || wofi --show drun"
         "$mainMod, q, killactive"
         "$mainMod SHIFT, escape, exit"
         "$mainMod SHIFT, q, exec, swaylock"
         "$mainMod, f, togglefloating"
-        "$mainMod SHIFT, F, fullscreen"
         "$mainMod, g, pseudo"
         "$mainMod, t, togglesplit"
 
@@ -162,6 +170,6 @@
         "$mainMod, mouse:273, resizewindow"
       ];
 
-    };
+    } cfg.extraOptions;
   };
 }
diff --git a/flakes/hyprland/home_manager/hyprpolkitagent.nix b/common/desktop_environment/hyprland/home_manager/hyprpolkitagent.nix
similarity index 100%
rename from flakes/hyprland/home_manager/hyprpolkitagent.nix
rename to common/desktop_environment/hyprland/home_manager/hyprpolkitagent.nix
diff --git a/flakes/hyprland/home_manager/quickshell.nix b/common/desktop_environment/hyprland/home_manager/quickshell.nix
similarity index 94%
rename from flakes/hyprland/home_manager/quickshell.nix
rename to common/desktop_environment/hyprland/home_manager/quickshell.nix
index ac12426..2f5032c 100644
--- a/flakes/hyprland/home_manager/quickshell.nix
+++ b/common/desktop_environment/hyprland/home_manager/quickshell.nix
@@ -1,8 +1,19 @@
 {
+  osConfig,
+  lib,
   pkgs,
   upkgs,
   ...
 }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
 {
   home.packages = with pkgs; [
     upkgs.quickshell
diff --git a/flakes/hyprland/home_manager/scripts.nix b/common/desktop_environment/hyprland/home_manager/scripts.nix
similarity index 100%
rename from flakes/hyprland/home_manager/scripts.nix
rename to common/desktop_environment/hyprland/home_manager/scripts.nix
diff --git a/flakes/hyprland/home_manager/scripts/confirm-action.sh b/common/desktop_environment/hyprland/home_manager/scripts/confirm-action.sh
similarity index 100%
rename from flakes/hyprland/home_manager/scripts/confirm-action.sh
rename to common/desktop_environment/hyprland/home_manager/scripts/confirm-action.sh
diff --git a/flakes/hyprland/home_manager/scripts/toggle-airplane-mode.sh b/common/desktop_environment/hyprland/home_manager/scripts/toggle-airplane-mode.sh
similarity index 100%
rename from flakes/hyprland/home_manager/scripts/toggle-airplane-mode.sh
rename to common/desktop_environment/hyprland/home_manager/scripts/toggle-airplane-mode.sh
diff --git a/flakes/hyprland/home_manager/scripts/toggle-power-profile.sh b/common/desktop_environment/hyprland/home_manager/scripts/toggle-power-profile.sh
similarity index 100%
rename from flakes/hyprland/home_manager/scripts/toggle-power-profile.sh
rename to common/desktop_environment/hyprland/home_manager/scripts/toggle-power-profile.sh
diff --git a/flakes/hyprland/home_manager/scripts/wofi-bluetooth-menu.sh b/common/desktop_environment/hyprland/home_manager/scripts/wofi-bluetooth-menu.sh
similarity index 100%
rename from flakes/hyprland/home_manager/scripts/wofi-bluetooth-menu.sh
rename to common/desktop_environment/hyprland/home_manager/scripts/wofi-bluetooth-menu.sh
diff --git a/flakes/hyprland/home_manager/scripts/wofi-wifi-menu.sh b/common/desktop_environment/hyprland/home_manager/scripts/wofi-wifi-menu.sh
similarity index 100%
rename from flakes/hyprland/home_manager/scripts/wofi-wifi-menu.sh
rename to common/desktop_environment/hyprland/home_manager/scripts/wofi-wifi-menu.sh
diff --git a/flakes/hyprland/home_manager/swaylock.nix b/common/desktop_environment/hyprland/home_manager/swaylock.nix
similarity index 100%
rename from flakes/hyprland/home_manager/swaylock.nix
rename to common/desktop_environment/hyprland/home_manager/swaylock.nix
diff --git a/common/desktop_environment/hyprland/home_manager/swaync.nix b/common/desktop_environment/hyprland/home_manager/swaync.nix
new file mode 100644
index 0000000..b26fa58
--- /dev/null
+++ b/common/desktop_environment/hyprland/home_manager/swaync.nix
@@ -0,0 +1,251 @@
+{
+  lib,
+  osConfig,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+    "swaync"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.swaync = {
+      enable = true;
+      settings = {
+        ignore = [
+          "com.spotify.Client"
+        ];
+
+        positionX = "right";
+        positionY = "top";
+        layer = "overlay";
+        control-center-layer = "top";
+        layer-shell = true;
+        cssPriority = "application";
+
+        control-center-margin-top = 0;
+        control-center-margin-bottom = 0;
+        control-center-margin-right = 0;
+        control-center-margin-left = 0;
+
+        notification-2fa-action = true;
+        notification-inline-replies = false;
+        notification-icon-size = 64;
+        notification-body-image-height = 100;
+        notification-body-image-width = 200;
+
+        timeout = 10;
+        timeout-low = 5;
+        timeout-critical = 0;
+
+        control-center-width = 500;
+        control-center-height = 600;
+        notification-window-width = 500;
+
+        keyboard-shortcuts = true;
+        image-visibility = "when-available";
+        transition-time = 200;
+        hide-on-clear = false;
+        hide-on-action = true;
+        script-fail-notify = true;
+
+        widgets = [
+          "inhibitors"
+          "title"
+          "dnd"
+          "volume"
+          "backlight"
+          "mpris"
+          "buttons-grid#quick"
+          "notifications"
+        ];
+
+        # Widget configurations
+        widget-config = {
+          inhibitors = {
+            text = "Inhibitors";
+            button-text = "Clear All";
+            clear-all-button = true;
+          };
+          title = {
+            text = "Notifications";
+            clear-all-button = true;
+            button-text = "Clear All";
+          };
+          dnd.text = "Do Not Disturb";
+          mpris = {
+            image-size = 96;
+            image-radius = 12;
+          };
+          volume = {
+            label = "󰕾";
+            show-per-app = true;
+          };
+          backlight = {
+            label = "󰃟";
+            device = "intel_backlight";
+          };
+          "buttons-grid#quick" = {
+            columns = 4; # adjust: 3/4/5
+            icon-size = 20; # tweak to taste
+            actions = [
+              # Power
+              {
+                label = "󰐥";
+                tooltip = "Shutdown";
+                command = "confirm-action 'systemctl poweroff' 'Shutdown?'";
+              }
+              {
+                label = "󰜉";
+                tooltip = "Reboot";
+                command = "confirm-action 'systemctl reboot' 'Reboot?'";
+              }
+              {
+                label = "󰍃";
+                tooltip = "Logout";
+                command = "confirm-action 'hyprctl dispatch exit' 'Logout?'";
+              }
+            ];
+          };
+        };
+      };
+
+      # Custom CSS for the control center
+      style = ''
+        .control-center {
+          background: #1a1b26;
+          border: 2px solid #7dcae4;
+          border-radius: 12px;
+        }
+
+        .control-center-list {
+          background: transparent;
+        }
+
+        .control-center .notification-row:focus,
+        .control-center .notification-row:hover {
+          opacity: 1;
+          background: #24283b;
+        }
+
+        .notification {
+          border-radius: 8px;
+          margin: 6px 12px;
+          box-shadow: 0 0 0 1px rgba(125, 196, 228, 0.3), 0 1px 3px 1px rgba(0, 0, 0, 0.7), 0 2px 6px 2px rgba(0, 0, 0, 0.3);
+          padding: 0;
+        }
+
+        /* Widget styling */
+        .widget-title {
+          margin: 8px;
+          font-size: 1.5rem;
+          color: #c0caf5;
+        }
+
+        .widget-dnd {
+          margin: 8px;
+          font-size: 1.1rem;
+          color: #c0caf5;
+        }
+
+        .widget-dnd > switch {
+          font-size: initial;
+          border-radius: 8px;
+          background: #414868;
+          border: 1px solid #7dcae4;
+        }
+
+        .widget-dnd > switch:checked {
+          background: #7dcae4;
+        }
+
+        .widget-mpris {
+          color: #c0caf5;
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+        }
+
+        .widget-mpris-player {
+          padding: 8px;
+          margin: 8px;
+        }
+
+        .widget-mpris-title {
+          font-weight: bold;
+          font-size: 1.25rem;
+        }
+
+        .widget-mpris-subtitle {
+          font-size: 1.1rem;
+          color: #9ece6a;
+        }
+
+        .widget-volume {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-backlight {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-menubar {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-menubar .menu-item button {
+          background: #1f2335;
+          color: #c0caf5;
+          border-radius: 8px;
+          padding: 6px 10px;
+          margin: 4px;
+          border: 1px solid #2e3440;
+          font-family: "JetBrainsMonoNL Nerd Font";
+        }
+
+        .widget-menubar .menu-item button:hover {
+          background: #414868;
+          border-color: #7dcae4;
+        }
+
+        .topbar-buttons button {
+          border: none;
+          background: transparent;
+          color: #c0caf5;
+          font-size: 1.1rem;
+          border-radius: 8px;
+          margin: 0 4px;
+          padding: 8px;
+        }
+
+        .topbar-buttons button:hover {
+          background: #414868;
+        }
+
+        .topbar-buttons button:active {
+          background: #7dcae4;
+          color: #1a1b26;
+        }
+      '';
+    };
+  };
+}
diff --git a/common/desktop_environment/hyprland/home_manager/template.nix b/common/desktop_environment/hyprland/home_manager/template.nix
new file mode 100644
index 0000000..905d5e4
--- /dev/null
+++ b/common/desktop_environment/hyprland/home_manager/template.nix
@@ -0,0 +1,18 @@
+{
+  osConfig,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+ 
+}
diff --git a/flakes/hyprland/home_manager/theme.nix b/common/desktop_environment/hyprland/home_manager/theme.nix
similarity index 100%
rename from flakes/hyprland/home_manager/theme.nix
rename to common/desktop_environment/hyprland/home_manager/theme.nix
diff --git a/common/desktop_environment/hyprland/home_manager/waybar.nix b/common/desktop_environment/hyprland/home_manager/waybar.nix
new file mode 100644
index 0000000..25c5986
--- /dev/null
+++ b/common/desktop_environment/hyprland/home_manager/waybar.nix
@@ -0,0 +1,267 @@
+{
+  lib,
+  osConfig,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+    "waybar"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          position = "top";
+          height = 30;
+          spacing = 6;
+          margin-top = 0;
+          margin-bottom = 0;
+          margin-left = 10;
+          margin-right = 10;
+
+          modules-left = [
+            "hyprland/workspaces"
+          ];
+
+          modules-center = [
+            "clock"
+            "temperature"
+            "cpu"
+            "memory"
+            "disk"
+          ];
+
+          modules-right = [
+            "pulseaudio"
+            "network"
+            "bluetooth"
+            "custom/notifications"
+            "hyprland/language"
+          ];
+
+          # Workspaces configuration
+          "hyprland/workspaces" = {
+            format = "{icon}";
+            format-icons = {
+              "1" = "一";
+              "2" = "二";
+              "3" = "三";
+              "4" = "四";
+              "5" = "五";
+              "6" = "六";
+              "7" = "七";
+              "8" = "八";
+              "9" = "九";
+              "10" = "十";
+              "11" = "十一";
+              "12" = "十二";
+              "13" = "十三";
+              "14" = "十四";
+              "15" = "十五";
+              "16" = "十六";
+              "17" = "十七";
+              "18" = "十八";
+              "19" = "十九";
+              "20" = "二十";
+            };
+            show-special = false;
+          };
+
+          pulseaudio = {
+            format = "{icon} {volume}%";
+            format-bluetooth = "󰂰 {volume}%";
+            format-bluetooth-muted = "󰂲 ";
+            format-muted = "󰖁 ";
+            format-source = "󰍬 {volume}%";
+            format-source-muted = "󰍭 ";
+            format-icons = {
+              headphone = "󰋋";
+              hands-free = "󰂑";
+              headset = "󰂑";
+              phone = "󰏲";
+              portable = "󰦧";
+              car = "󰄋";
+              default = [
+                "󰕿"
+                "󰖀"
+                "󰕾"
+              ];
+            };
+            scroll-step = 5;
+            on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+            on-click-right = "swaync-client -t -sw";
+          };
+
+          "custom/notifications" = {
+            format = "{icon} {}";
+            format-icons = {
+              notification = "";
+              none = "";
+              dnd-notification = "󰂛";
+              dnd-none = "󰂛";
+              inhibited-notification = "";
+              inhibited-none = "";
+              dnd-inhibited-notification = "󰂛";
+              dnd-inhibited-none = "󰂛";
+            };
+            return-type = "json";
+            exec-if = "which swaync-client";
+            exec = "swaync-client -swb";
+            on-click = "swaync-client -t -sw";
+            on-click-right = "swaync-client -d -sw";
+            escape = true;
+            tooltip = false;
+          };
+
+          # Clock
+          clock = {
+            format = "{:%b %d, %H:%M}";
+          };
+
+          temperature = {
+            thermal-zone = 2;
+            hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
+            critical-threshold = 80;
+            format-critical = "󰔏 {temperatureC}°C";
+            format = "󰔏 {temperatureC}°C";
+          };
+
+          cpu = {
+            format = "󰻠 {usage}%";
+            tooltip = false;
+            on-click = "btop";
+          };
+
+          memory = {
+            format = "󰍛 {}%";
+            on-click = "btop";
+          };
+
+          disk = {
+            interval = 30;
+            format = "󰋊 {percentage_used}%";
+            path = "/";
+            on-click = "btop";
+          };
+
+          network = {
+            format-wifi = "󰤨 {essid} ({signalStrength}%)";
+            format-ethernet = "󰈀 {ipaddr}/{cidr}";
+            tooltip-format = "{ifname} via {gwaddr} ";
+            format-linked = "󰈀 {ifname} (No IP)";
+            format-disconnected = "󰖪 Disconnected";
+            on-click = "wofi-wifi-menu";
+            on-click-right = "nmcli radio wifi toggle";
+          };
+
+          bluetooth = {
+            format = "󰂯 {status}";
+            format-connected = "󰂱 {device_alias}";
+            format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
+            tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
+            tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
+            tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
+            tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
+            on-click = "wofi-bluetooth-menu";
+            on-click-right = "bluetoothctl power toggle";
+          };
+
+          # Keyboard input (language)
+          "hyprland/language" = {
+            format = "{}";
+            format-en = "EN";
+            format-ja = "JP";
+          };
+        };
+      };
+
+      style = ''
+        * {
+          font-family: "JetBrainsMonoNL Nerd Font";
+          font-size: 12px;
+          border: none;
+          border-radius: 0;
+          min-height: 0;
+        }
+
+        window#waybar {
+          background: transparent;
+          border-radius: 10px;
+          margin: 0px;
+        }
+
+        .modules-left,
+        .modules-center,
+        .modules-right {
+          background: rgba(26, 27, 38, 0.8);
+          border-radius: 10px;
+          margin: 4px;
+          padding: 0 10px;
+        }
+
+        #workspaces {
+          padding: 0 5px;
+        }
+
+        #workspaces button {
+          padding: 0 8px;
+          background: transparent;
+          color: #c0caf5;
+          border-radius: 5px;
+          margin: 2px;
+        }
+
+        #workspaces button:hover {
+          background: rgba(125, 196, 228, 0.2);
+          color: #7dcae4;
+        }
+
+        #workspaces button.active {
+          background: #7dcae4;
+          color: #1a1b26;
+        }
+
+        #pulseaudio,
+        #custom-notifications,
+        #clock,
+        #temperature,
+        #cpu,
+        #memory,
+        #disk,
+        #network,
+        #bluetooth,
+        #language {
+          padding: 0 8px;
+          color: #c0caf5;
+          margin: 2px;
+        }
+
+        #temperature.critical {
+          color: #f7768e;
+        }
+
+        #network.disconnected {
+          color: #f7768e;
+        }
+
+        #bluetooth.disabled {
+          color: #565f89;
+        }
+
+        #pulseaudio.muted {
+          color: #565f89;
+        }
+      '';
+    };
+  };
+}
diff --git a/flakes/hyprland/home_manager/wofi.nix b/common/desktop_environment/hyprland/home_manager/wofi.nix
similarity index 100%
rename from flakes/hyprland/home_manager/wofi.nix
rename to common/desktop_environment/hyprland/home_manager/wofi.nix
diff --git a/common/desktop_environment/i3/default.nix b/common/desktop_environment/i3/default.nix
new file mode 100644
index 0000000..0ff2e22
--- /dev/null
+++ b/common/desktop_environment/i3/default.nix
@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "i3"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "i3 window manager";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "kitty";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for i3 home manager configuration.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users
+    home-manager = {
+      sharedModules = [
+        ./home_manager
+      ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.xorg.xinit}/bin/xinit ${pkgs.i3}/bin/i3'}";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    # flatpaks need this TODO remove flatpaks?
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        pkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "gtk"
+      ];
+    };
+
+    services.xserver = {
+      enable = true;
+
+      # desktopManager = {
+      #   xterm.enable = false;
+      # };
+
+      windowManager.i3 = {
+        enable = true;
+        extraPackages = with pkgs; [
+          # dmenu # application launcher most people use
+          # i3status # gives you the default i3 status bar
+          # i3blocks # if you are planning on using i3blocks over i3status
+        ];
+      };
+    };
+    services.displayManager.defaultSession = "none+i3";
+    # programs.i3lock.enable = true; # default i3 screen locker
+
+    environment.systemPackages = with pkgs; [
+      xorg.xinit
+      xorg.setxkbmap
+      xorg.xset
+    ];
+
+  };
+}
diff --git a/common/desktop_environment/i3/home_manager/default.nix b/common/desktop_environment/i3/home_manager/default.nix
new file mode 100644
index 0000000..ff15d2d
--- /dev/null
+++ b/common/desktop_environment/i3/home_manager/default.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./i3.nix
+  ];
+}
diff --git a/common/desktop_environment/i3/home_manager/i3.nix b/common/desktop_environment/i3/home_manager/i3.nix
new file mode 100644
index 0000000..b140a7f
--- /dev/null
+++ b/common/desktop_environment/i3/home_manager/i3.nix
@@ -0,0 +1,47 @@
+{
+  config,
+  osConfig,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "i3"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  xsession.windowManager.i3 = {
+    enable = true;
+    config = lib.attrsets.recursiveUpdate {
+      startup = [
+        { command = "setxkbmap -layout us -option caps:escape"; }
+      ];
+      modifier = "Mod4";
+      terminal = cfg.terminalCommand;
+      keybindings =
+        let
+          mod = config.xsession.windowManager.i3.config.modifier;
+        in
+        {
+          # Focus
+          "${mod}+h" = "focus left";
+          "${mod}+l" = "focus right";
+          "${mod}+k" = "focus up";
+          "${mod}+j" = "focus down";
+          # Apps
+          "${mod}+Return" = "exec ${cfg.terminalCommand}";
+          # "${mod}+space" = "exec ${cfg.menu}"; TODO
+          "${mod}+q" = "kill";
+          "${mod}+Shift+Escape" = "exit";
+          "${mod}+Shift+q" = "exec i3lock";
+          "${mod}+f" = "floating toggle";
+
+        };
+      # See home-manager documentation for everything you can add here.
+    } cfg.extraOptions;
+  };
+}
diff --git a/common/desktop_environment/sway/default.nix b/common/desktop_environment/sway/default.nix
new file mode 100644
index 0000000..44c664b
--- /dev/null
+++ b/common/desktop_environment/sway/default.nix
@@ -0,0 +1,139 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "sway (Wayland i3) desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for Sway configuration.";
+      };
+      swaync = {
+        enable = lib.mkEnableOption "Enable Sway Notification Center";
+      };
+      waybar = {
+        enable = lib.mkEnableOption "Enable Waybar (status bar for Sway)";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users via Home Manager fragments in this module
+    home-manager = {
+      sharedModules = [ ./home_manager ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.sway}/bin/sway'";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty and Wayland
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    # Core packages and tools
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wl-clip-persist
+      wofi # application launcher
+      nemo # file manager (x11)
+      feh # image viewer (x11)
+      networkmanager
+      upower
+      brightnessctl
+      wireplumber
+      libgtop
+      bluez
+      power-profiles-daemon
+      grim
+      slurp
+      wf-recorder
+      btop
+      pavucontrol
+    ];
+
+    services.blueman.enable = config.hardware.bluetooth.enable;
+
+    programs.sway = {
+      enable = true;
+      wrapperFeatures.gtk = true; # include GTK integration env
+      extraPackages = with pkgs; [
+        xwayland # allow legacy X11 apps
+      ];
+    };
+
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "wlr"
+        "gtk"
+      ];
+    };
+
+    hardware.graphics = {
+      enable = true;
+      # Keep defaults; Sway runs fine with mesa in system
+    };
+
+    # Environment variables
+    environment.sessionVariables = lib.mkMerge [
+      {
+        GTK_THEME = "Adwaita:dark";
+        XDG_SESSION_TYPE = "wayland";
+        XDG_CURRENT_DESKTOP = "sway";
+        XDG_SESSION_DESKTOP = "sway";
+        WLR_RENDERER = "auto";
+
+        # Tell apps to run native wayland
+        NIXOS_OZONE_WL = "1";
+        ELECTRON_OZONE_PLATFORM_HINT = "wayland";
+        GDK_BACKEND = "wayland,x11"; # GTK
+        QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
+        MOZ_ENABLE_WAYLAND = "1"; # Firefox
+        SDL_VIDEODRIVER = "wayland"; # SDL apps/games
+        CLUTTER_BACKEND = "wayland";
+      }
+    ];
+
+    # Qt theming
+    qt = {
+      enable = true;
+      platformTheme = "gtk2";
+      style = "adwaita-dark";
+    };
+  };
+}
diff --git a/flakes/common/hm_modules/de_sway/default.nix b/common/desktop_environment/sway/home_manager/default.nix
similarity index 100%
rename from flakes/common/hm_modules/de_sway/default.nix
rename to common/desktop_environment/sway/home_manager/default.nix
diff --git a/flakes/common/hm_modules/de_sway/polkit.nix b/common/desktop_environment/sway/home_manager/polkit.nix
similarity index 100%
rename from flakes/common/hm_modules/de_sway/polkit.nix
rename to common/desktop_environment/sway/home_manager/polkit.nix
diff --git a/common/desktop_environment/sway/home_manager/sway.nix b/common/desktop_environment/sway/home_manager/sway.nix
new file mode 100644
index 0000000..4ceea67
--- /dev/null
+++ b/common/desktop_environment/sway/home_manager/sway.nix
@@ -0,0 +1,185 @@
+{
+  config,
+  osConfig,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  wayland.windowManager.sway = {
+    enable = true;
+    xwayland = true;
+
+    config = lib.mkMerge [
+      rec {
+        modifier = "Mod4"; # SUPER
+        terminal = cfg.terminalCommand;
+        menu = "wofi --show drun";
+
+        # Per-output workspace mapping (user can extend via extraOptions)
+        # Example (left as defaults): users can add `output HDMI-A-1 workspace 1,3,5` in extraOptions
+
+        input = {
+          "type:keyboard" = {
+            xkb_layout = "us";
+            xkb_options = "caps:escape";
+          };
+          "type:touchpad" = {
+            natural_scroll = "enabled";
+            tap = "enabled";
+            dwt = "enabled";
+          };
+          # Disable focus follows mouse to avoid accidental focus changes
+          # In Sway this behavior is controlled by focus_follows_mouse
+        };
+
+        focus = {
+          followMouse = "no";
+          # onWindowActivation = "urgent"; # don't steal focus; mark urgent instead
+        };
+
+        gaps = {
+          inner = 2;
+          outer = 5;
+          smartGaps = false;
+          smartBorders = "on";
+        };
+
+        colors = {
+          focused = {
+            background = "#444444";
+            border = "#555555";
+            childBorder = "#444444";
+            indicator = "#595959";
+            text = "#f1f1f1";
+          };
+          unfocused = {
+            background = "#222222";
+            border = "#333333";
+            childBorder = "#222222";
+            indicator = "#292d2e";
+            text = "#888888";
+          };
+        };
+
+        window = {
+          border = 1;
+          titlebar = false;
+          commands = [
+            # Bitwarden chrome popup as floating example from Hyprland rules
+            {
+              criteria = {
+                app_id = "chrome-nngceckbapebfimnlniiiahkandclblb-Default";
+              };
+              command = "floating enable";
+            }
+            {
+              criteria = {
+                app_id = "pavucontrol";
+              };
+              command = "floating enable, move position center, resize set 620 1200";
+            }
+            {
+              criteria = {
+                class = "Google-chrome";
+                window_role = "pop-up";
+              };
+              command = "floating enable, move position center, resize set 720 480";
+            }
+            {
+              criteria = {
+                window_role = "pop-up";
+              };
+              command = "floating enable, move position center, resize set 640 420";
+            }
+            {
+              criteria = {
+                window_role = "About";
+              };
+              command = "floating enable, move position center, resize set 640 420";
+            }
+          ];
+        };
+
+        # Keybindings mirroring Hyprland
+        keybindings = {
+          # Apps
+          "${modifier}+return" = "exec ${cfg.terminalCommand}";
+          "${modifier}+space" = "exec pkill wofi || wofi --show drun";
+          "${modifier}+q" = "kill";
+          "${modifier}+shift+Escape" = "exit";
+          "${modifier}+shift+q" = "exec swaylock";
+          "${modifier}+f" = "floating toggle";
+
+          # Focus
+          "${modifier}+h" = "focus left";
+          "${modifier}+l" = "focus right";
+          "${modifier}+k" = "focus up";
+          "${modifier}+j" = "focus down";
+
+          # Workspaces (numbers and vim-like mirror)
+          "${modifier}+1" = "workspace number 1";
+          "${modifier}+n" = "workspace number 1";
+          "${modifier}+2" = "workspace number 2";
+          "${modifier}+m" = "workspace number 2";
+          "${modifier}+3" = "workspace number 3";
+          "${modifier}+comma" = "workspace number 3";
+          "${modifier}+4" = "workspace number 4";
+          "${modifier}+period" = "workspace number 4";
+          "${modifier}+5" = "workspace number 5";
+          "${modifier}+slash" = "workspace number 5";
+          "${modifier}+6" = "workspace number 6";
+          "${modifier}+7" = "workspace number 7";
+          "${modifier}+8" = "workspace number 8";
+          "${modifier}+9" = "workspace number 9";
+          "${modifier}+0" = "workspace number 10";
+
+          # Move windows
+          "${modifier}+shift+h" = "move left";
+          "${modifier}+shift+l" = "move right";
+          "${modifier}+shift+k" = "move up";
+          "${modifier}+shift+j" = "move down";
+          "${modifier}+shift+1" = "move container to workspace number 1";
+          "${modifier}+shift+n" = "move container to workspace number 1";
+          "${modifier}+shift+2" = "move container to workspace number 2";
+          "${modifier}+shift+m" = "move container to workspace number 2";
+          "${modifier}+shift+3" = "move container to workspace number 3";
+          "${modifier}+shift+comma" = "move container to workspace number 3";
+          "${modifier}+shift+4" = "move container to workspace number 4";
+          "${modifier}+shift+period" = "move container to workspace number 4";
+          "${modifier}+shift+5" = "move container to workspace number 5";
+          "${modifier}+shift+slash" = "move container to workspace number 5";
+          "${modifier}+shift+6" = "move container to workspace number 6";
+          "${modifier}+shift+7" = "move container to workspace number 7";
+          "${modifier}+shift+8" = "move container to workspace number 8";
+          "${modifier}+shift+9" = "move container to workspace number 9";
+          "${modifier}+shift+0" = "move container to workspace number 10";
+
+          # Mouse bindings (Mod + drag)
+          "${modifier}+button1" = "move";
+          "${modifier}+button3" = "resize";
+
+          # Screenshot
+          "Print" = "exec grim -g \"$(slurp)\" - | wl-copy";
+        };
+
+        bars = [ ]; # Use Waybar via Home Manager
+        startup = [
+          {
+            command = "exec sh -c 'sleep 0.01; swaymsg workspace number 7 ; sleep 0.01; swaymsg workspace number 1'";
+          }
+          { command = "pgrep waybar >/dev/null || waybar"; }
+        ];
+      }
+      cfg.extraOptions
+    ];
+  };
+}
diff --git a/flakes/common/hm_modules/de_sway/swaylock.nix b/common/desktop_environment/sway/home_manager/swaylock.nix
similarity index 100%
rename from flakes/common/hm_modules/de_sway/swaylock.nix
rename to common/desktop_environment/sway/home_manager/swaylock.nix
diff --git a/common/desktop_environment/sway/home_manager/swaync.nix b/common/desktop_environment/sway/home_manager/swaync.nix
new file mode 100644
index 0000000..7fb0c8c
--- /dev/null
+++ b/common/desktop_environment/sway/home_manager/swaync.nix
@@ -0,0 +1,112 @@
+{ lib, osConfig, ... }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+    "swaync"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.swaync = {
+      enable = true;
+      settings = {
+        ignore = [ "com.spotify.Client" ];
+        positionX = "right";
+        positionY = "top";
+        layer = "overlay";
+        control-center-layer = "top";
+        layer-shell = true;
+        cssPriority = "application";
+        control-center-margin-top = 0;
+        control-center-margin-bottom = 0;
+        control-center-margin-right = 0;
+        control-center-margin-left = 0;
+        notification-2fa-action = true;
+        notification-inline-replies = false;
+        notification-icon-size = 64;
+        notification-body-image-height = 100;
+        notification-body-image-width = 200;
+        timeout = 10;
+        timeout-low = 5;
+        timeout-critical = 0;
+        control-center-width = 500;
+        control-center-height = 600;
+        notification-window-width = 500;
+        keyboard-shortcuts = true;
+        image-visibility = "when-available";
+        transition-time = 200;
+        hide-on-clear = false;
+        hide-on-action = true;
+        script-fail-notify = true;
+        widgets = [
+          "inhibitors"
+          "title"
+          "dnd"
+          "volume"
+          "backlight"
+          "mpris"
+          "buttons-grid#quick"
+          "notifications"
+        ];
+        widget-config = {
+          inhibitors = {
+            text = "Inhibitors";
+            button-text = "Clear All";
+            clear-all-button = true;
+          };
+          title = {
+            text = "Notifications";
+            clear-all-button = true;
+            button-text = "Clear All";
+          };
+          dnd.text = "Do Not Disturb";
+          mpris = {
+            image-size = 96;
+            image-radius = 12;
+          };
+          volume = {
+            label = "󰕾";
+            show-per-app = true;
+          };
+          backlight = {
+            label = "󰃟";
+            device = "intel_backlight";
+          };
+          # "buttons-grid#quick" = {
+          #   columns = 4;
+          #   icon-size = 20;
+          #   actions = [
+          #     { label = "󰐥"; tooltip = "Shutdown"; command = "confirm-action 'systemctl poweroff' 'Shutdown?'"; }
+          #     { label = "󰜉"; tooltip = "Reboot"; command = "confirm-action 'systemctl reboot' 'Reboot?'"; }
+          #     { label = "󰍃"; tooltip = "Logout"; command = "confirm-action 'swaymsg exit' 'Logout?'"; }
+          #   ];
+          # };
+        };
+      };
+      style = ''
+        .control-center { background: #1a1b26; border: 2px solid #7dcae4; border-radius: 12px; }
+        .control-center-list { background: transparent; }
+        .control-center .notification-row:focus, .control-center .notification-row:hover { opacity: 1; background: #24283b; }
+        .notification { border-radius: 8px; margin: 6px 12px; box-shadow: 0 0 0 1px rgba(125,196,228,.3), 0 1px 3px 1px rgba(0,0,0,.7), 0 2px 6px 2px rgba(0,0,0,.3); padding: 0; }
+        .widget-title { margin: 8px; font-size: 1.5rem; color: #c0caf5; }
+        .widget-dnd { margin: 8px; font-size: 1.1rem; color: #c0caf5; }
+        .widget-dnd > switch { font-size: initial; border-radius: 8px; background: #414868; border: 1px solid #7dcae4; }
+        .widget-dnd > switch:checked { background: #7dcae4; }
+        .widget-mpris { color: #c0caf5; background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; }
+        .widget-mpris-player { padding: 8px; margin: 8px; }
+        .widget-mpris-title { font-weight: bold; font-size: 1.25rem; }
+        .widget-mpris-subtitle { font-size: 1.1rem; color: #9ece6a; }
+        .widget-volume, .widget-backlight, .widget-menubar { background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; color: #c0caf5; }
+        .widget-menubar .menu-item button { background: #1f2335; color: #c0caf5; border-radius: 8px; padding: 6px 10px; margin: 4px; border: 1px solid #2e3440; font-family: "JetBrainsMonoNL Nerd Font"; }
+        .widget-menubar .menu-item button:hover { background: #414868; border-color: #7dcae4; }
+        .topbar-buttons button { border: none; background: transparent; color: #c0caf5; font-size: 1.1rem; border-radius: 8px; margin: 0 4px; padding: 8px; }
+        .topbar-buttons button:hover { background: #414868; }
+        .topbar-buttons button:active { background: #7dcae4; color: #1a1b26; }
+      '';
+    };
+  };
+}
diff --git a/flakes/common/hm_modules/de_sway/theme.nix b/common/desktop_environment/sway/home_manager/theme.nix
similarity index 100%
rename from flakes/common/hm_modules/de_sway/theme.nix
rename to common/desktop_environment/sway/home_manager/theme.nix
diff --git a/common/desktop_environment/sway/home_manager/waybar.nix b/common/desktop_environment/sway/home_manager/waybar.nix
new file mode 100644
index 0000000..addb94c
--- /dev/null
+++ b/common/desktop_environment/sway/home_manager/waybar.nix
@@ -0,0 +1,260 @@
+{ lib, osConfig, ... }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+    "waybar"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          position = "top";
+          height = 28;
+          spacing = 6;
+          margin-top = 0;
+          margin-bottom = 0;
+          margin-left = 10;
+          margin-right = 10;
+
+          modules-left = [
+            "sway/workspaces"
+          ];
+          modules-center = [
+            "clock"
+            "temperature"
+            "cpu"
+            "memory"
+            "disk"
+          ];
+          modules-right = [
+            "battery"
+            "battery#bat2"
+            "pulseaudio"
+            "network"
+            "bluetooth"
+            "power-profiles-daemon"
+            "backlight"
+            "custom/notifications"
+            "sway/language"
+            "tray"
+            "custom/power"
+          ];
+
+          # LEFT
+          "sway/workspaces" = {
+            format = "{icon}";
+            format-icons = {
+              "1" = "一";
+              "2" = "二";
+              "3" = "三";
+              "4" = "四";
+              "5" = "五";
+              "6" = "六";
+              "7" = "七";
+              "8" = "八";
+              "9" = "九";
+              "10" = "十";
+              "11" = "十一";
+              "12" = "十二";
+              "13" = "十三";
+              "14" = "十四";
+              "15" = "十五";
+              "16" = "十六";
+              "17" = "十七";
+              "18" = "十八";
+              "19" = "十九";
+              "20" = "二十";
+            };
+            disable-scroll = false;
+          };
+
+          # CENTER
+          clock = {
+            format = "{:%b %d, %H:%M}";
+            tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
+          };
+
+          temperature = {
+            thermal-zone = 2;
+            hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
+            critical-threshold = 80;
+            format-critical = "󰔏 {temperatureC}°C";
+            format = "󰔏 {temperatureC}°C";
+          };
+
+          cpu = {
+            format = "󰻠 {usage}%";
+            tooltip = true;
+            on-click = "btop";
+          };
+
+          memory = {
+            format = "󰍛 {}%";
+            on-click = "btop";
+          };
+
+          disk = {
+            interval = 30;
+            format = "󰋊 {percentage_used}%";
+            path = "/";
+            on-click = "btop";
+          };
+
+          # RIGHT
+          "battery" = {
+            "states" = {
+              # "good"= 95;
+              "warning" = 30;
+              "critical" = 15;
+            };
+            "format" = "{capacity}% {icon}";
+            "format-full" = "{capacity}% {icon}";
+            "format-charging" = "{capacity}% ";
+            "format-plugged" = "{capacity}% ";
+            "format-alt" = "{time} {icon}";
+            # "format-good"= ""; // An empty format will hide the module
+            # "format-full"= "";
+            "format-icons" = [
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+          };
+          "battery#bat2" = {
+            "bat" = "BAT2";
+          };
+
+          pulseaudio = {
+            format = "{icon} {volume}%";
+            format-bluetooth = "󰂰 {volume}%";
+            format-bluetooth-muted = "󰂲 ";
+            format-muted = "󰖁 ";
+            format-source = "󰍬 {volume}%";
+            format-source-muted = "󰍭 ";
+            format-icons = {
+              headphone = "󰋋";
+              hands-free = "󰂑";
+              headset = "󰂑";
+              phone = "󰏲";
+              portable = "󰦧";
+              car = "󰄋";
+              default = [
+                "󰕿"
+                "󰖀"
+                "󰕾"
+              ];
+            };
+            scroll-step = 5;
+            on-click = "pavucontrol";
+            on-click-right = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+          };
+
+          network = {
+            format-wifi = "󰤨 {essid} ({signalStrength}%)";
+            format-ethernet = "󰈀 {ipaddr}/{cidr}";
+            tooltip-format = "{ifname} via {gwaddr} ";
+            format-linked = "󰈀 {ifname} (No IP)";
+            format-disconnected = "󰖪 Disconnected";
+            # on-click = "wofi-wifi-menu";
+            # on-click-right = "nmcli radio wifi toggle";
+          };
+
+          bluetooth = {
+            format = "󰂯 {status}";
+            format-connected = "󰂱 {device_alias}";
+            format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
+            tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
+            tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
+            tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
+            tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
+            # on-click = "wofi-bluetooth-menu";
+            # on-click-right = "bluetoothctl power toggle";
+          };
+
+          "power-profiles-daemon" = {
+            format = "{icon}";
+            "tooltip-format" = "Power profile: {profile}\nDriver: {driver}";
+            tooltip = true;
+            "format-icons" = {
+              default = "";
+              performance = "";
+              balanced = "";
+              "power-saver" = "";
+            };
+          };
+
+          backlight = {
+            format = "{percent}% {icon}";
+            "format-icons" = [
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+          };
+
+          "custom/notifications" = {
+            format = "{icon} {}";
+            format-icons = {
+              notification = "";
+              none = "";
+              dnd-notification = "󰂛";
+              dnd-none = "󰂛";
+              inhibited-notification = "";
+              inhibited-none = "";
+              dnd-inhibited-notification = "󰂛";
+              dnd-inhibited-none = "󰂛";
+            };
+            return-type = "json";
+            exec-if = "which swaync-client";
+            exec = "swaync-client -swb";
+            on-click = "swaync-client -t -sw";
+            on-click-right = "swaync-client -d -sw";
+            escape = true;
+            tooltip = false;
+          };
+
+          "sway/language" = {
+            format = "{}";
+          };
+
+          "tray" = {
+            "spacing" = 10;
+          };
+
+          "custom/power" = {
+            format = "⏻ ";
+            tooltip = false;
+            menu = "on-click";
+            "menu-file" = ./waybar/power_menu.xml;
+            "menu-actions" = {
+              shutdown = "shutdown 0";
+              reboot = "reboot";
+              logout = "loginctl terminate-session $(loginctl list-sessions | grep seat0 | awk '{print $1}')";
+            };
+          };
+
+        };
+      };
+
+      style = builtins.readFile ./waybar/waybar.css;
+    };
+  };
+}
diff --git a/flakes/common/hm_modules/de_sway/waybar/power_menu.xml b/common/desktop_environment/sway/home_manager/waybar/power_menu.xml
similarity index 100%
rename from flakes/common/hm_modules/de_sway/waybar/power_menu.xml
rename to common/desktop_environment/sway/home_manager/waybar/power_menu.xml
diff --git a/flakes/common/hm_modules/de_sway/waybar/waybar.css b/common/desktop_environment/sway/home_manager/waybar/waybar.css
similarity index 100%
rename from flakes/common/hm_modules/de_sway/waybar/waybar.css
rename to common/desktop_environment/sway/home_manager/waybar/waybar.css
diff --git a/flakes/common/hm_modules/de_sway/wofi.nix b/common/desktop_environment/sway/home_manager/wofi.nix
similarity index 100%
rename from flakes/common/hm_modules/de_sway/wofi.nix
rename to common/desktop_environment/sway/home_manager/wofi.nix
diff --git a/flakes/secrets/flake.lock b/common/flake.lock
similarity index 77%
rename from flakes/secrets/flake.lock
rename to common/flake.lock
index 190b4a5..78e7a15 100644
--- a/flakes/secrets/flake.lock
+++ b/common/flake.lock
@@ -3,7 +3,7 @@
     "agenix": {
       "inputs": {
         "darwin": "darwin",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "nixpkgs": [
           "ragenix",
           "nixpkgs"
@@ -81,6 +81,25 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1758313341,
+        "narHash": "sha256-SsI6INUzWwPcRKRaxvi50RttnD9rcC4EjV+67TOEfrQ=",
+        "owner": "rycee",
+        "repo": "home-manager",
+        "rev": "6f656618ebc71ca82d93d306a8aecb2c5f6f2ab2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rycee",
+        "ref": "release-25.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "ragenix",
@@ -102,7 +121,39 @@
         "type": "github"
       }
     },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
+      "locked": {
+        "lastModified": 1753345091,
+        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1741379970,
         "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
@@ -123,7 +174,7 @@
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "rust-overlay": "rust-overlay"
       },
       "locked": {
@@ -142,6 +193,8 @@
     },
     "root": {
       "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
         "ragenix": "ragenix"
       }
     },
diff --git a/common/flake.nix b/common/flake.nix
new file mode 100644
index 0000000..3070bb6
--- /dev/null
+++ b/common/flake.nix
@@ -0,0 +1,89 @@
+{
+  inputs = {
+    # NOTE if you add/change any inputs here also add them in the TOP level repo's flake.nix
+    home-manager.url = "github:rycee/home-manager/release-25.05";
+    ragenix.url = "github:yaxitech/ragenix";
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
+
+    # disabled for now
+    # hyprland.url = "github:hyprwm/Hyprland";
+  };
+
+  outputs =
+    {
+      home-manager,
+      ragenix,
+      nix-flatpak,
+      # hyprland,
+      ...
+    }:
+    {
+      nixosModules = {
+        default =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            imports = [
+              home-manager.nixosModules.default
+              ragenix.nixosModules.age
+              nix-flatpak.nixosModules.nix-flatpak
+              # hyprland.nixosModules.default
+              ./_home_manager
+              ./options.nix
+              ./general
+              ./boot
+              ./desktop_environment
+              ./users
+              ./programs
+              ./secrets
+            ];
+            config = {
+              nixpkgs.overlays = [
+                # (final: prev: {
+                #   wayland-protocols =
+                #     nixpkgs-unstable.legacyPackages.${prev.stdenv.hostPlatform.system}.wayland-protocols;
+                # })
+              ];
+              _module.args = {
+                inherit ragenix;
+                # inherit hyprland;
+                # hyprlandPkgs = import hyprland.inputs.nixpkgs {
+                #   system = pkgs.stdenv.hostPlatform.system;
+                #   config = config.nixpkgs.config or { };
+                # };
+              };
+            };
+          };
+        containers = {
+          forgejo = import ./_containers/forgejo.nix;
+        };
+      };
+      homeManagerModules = {
+        # hyprland = hyprland.homeManagerModules.default;
+
+        zsh = import ./_home_manager/mods/zsh.nix;
+        tmux = import ./_home_manager/mods/tmux/tmux.nix;
+        atuin = import ./_home_manager/mods/atuin.nix;
+        zoxide = import ./_home_manager/mods/zoxide.nix;
+        starship = import ./_home_manager/mods/starship.nix;
+        direnv = import ./_home_manager/mods/direnv.nix;
+        ssh = import ./_home_manager/mods/ssh.nix;
+        git = import ./_home_manager/mods/git.nix;
+        nix_deprecations = import ./_home_manager/mods/nix_deprecations.nix;
+
+        alacritty = import ./_home_manager/mods/alacritty.nix;
+        foot = import ./_home_manager/mods/foot.nix;
+        kitty = import ./_home_manager/mods/kitty.nix;
+        launcher_rofi = import ./_home_manager/mods/launcher_rofi.nix;
+
+        obs = import ./_home_manager/mods/obs.nix;
+        postgres = import ./_home_manager/mods/postgres.nix;
+        slicer = import ./_home_manager/mods/slicer.nix;
+
+      };
+    };
+}
diff --git a/common/general/default.nix b/common/general/default.nix
new file mode 100644
index 0000000..49e8900
--- /dev/null
+++ b/common/general/default.nix
@@ -0,0 +1,211 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  top_cfg = config.${ccfg.custom_config_key};
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      flakeOptions = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable nix flake options";
+      };
+      unfree = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable unfree packages";
+      };
+      readWindowsDrives = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Read windows drives";
+      };
+      disableRemoteBuildsOnLio = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Disable remote builds on lio";
+      };
+      timezone = lib.mkOption {
+        type = lib.types.str;
+        default = "America/Chicago";
+        description = "Timezone";
+      };
+      defaultLocal = lib.mkOption {
+        type = lib.types.str;
+        default = "en_US.UTF-8";
+        description = "Default locale";
+      };
+      fastShutdown = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Fast shutdown";
+      };
+      enableSleep = lib.mkEnableOption (lib.mdDoc "Enable auto sleeping");
+      hideBootLogs = lib.mkEnableOption (lib.mdDoc "Hide boot logs on startup");
+    };
+  imports = [
+    ./shell/common.nix
+    ./fonts.nix
+    ./tty_caps_esc.nix
+    ./reporting.nix
+  ];
+  config = {
+    # name this computer
+    networking = {
+      hostName = top_cfg.systemName;
+      nftables.enable = true;
+      nftables.flushRuleset = true;
+      firewall.enable = true;
+    };
+
+    # Enable flakes
+    nix.settings.experimental-features = lib.mkIf cfg.flakeOptions [
+      "nix-command"
+      "flakes"
+    ];
+
+    # Allow unfree
+    nixpkgs.config.allowUnfree = cfg.unfree;
+    nixpkgs.config.allowUnfreePredicate = (pkg: cfg.unfree);
+    environment.variables = lib.mkIf cfg.unfree {
+      NIXPKGS_ALLOW_UNFREE = "1";
+    };
+
+    # allow mounting ntfs filesystems
+    boot.supportedFilesystems = lib.mkIf cfg.readWindowsDrives [ "ntfs" ];
+
+    # make shutdown faster for waiting
+    systemd.extraConfig = lib.mkIf cfg.fastShutdown ''
+      DefaultTimeoutStopSec=8s
+    '';
+
+    nix.settings = {
+      max-jobs = "auto";
+      # Fallback quickly if substituters are not available.
+      connect-timeout = 5;
+      download-attempts = 3;
+      download-buffer-size = 524288000; # default is 67108864, this increases to ~500MB
+      # The default at 10 is rarely enough.
+      log-lines = 50;
+      # Avoid disk full issues
+      max-free = (3000 * 1024 * 1024);
+      min-free = (1000 * 1024 * 1024);
+      # Avoid copying unnecessary stuff over SSH
+      builders-use-substitutes = true;
+      auto-optimise-store = true;
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
+      substituters = [
+        "https://cache.nixos.org/"
+        "https://hyprland.cachix.org"
+        "https://cosmic.cachix.org/"
+        "https://nix-community.cachix.org"
+      ];
+      trusted-substituters = config.nix.settings.substituters;
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+        "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+    nix.extraOptions = ''
+      keep-outputs = true
+      keep-derivations = true
+      ${lib.optionalString (
+        # TODO revisit this should it move?
+        config ? age && config.age ? secrets && config.age.secrets ? github_read_token
+      ) "!include ${config.age.secrets.github_read_token.path}"}
+    '';
+
+    # Enable zsh
+    programs.zsh.enable = true;
+    environment.pathsToLink = [ "/share/zsh" ];
+
+    # nix helper
+    programs.nh = {
+      enable = true;
+      # clean.enable = true; # TODO revist does this solve my re-building issues?
+      clean.extraArgs = "--keep 10";
+      # `flake` path is set in users/default.nix for the primary user if set
+    };
+
+    # Remote build off home lio computer
+    programs.ssh.extraConfig = lib.mkIf (!cfg.disableRemoteBuildsOnLio) ''
+      Host lio_
+        PubkeyAcceptedKeyTypes ssh-ed25519
+        ServerAliveInterval 60
+        IPQoS throughput
+        ${lib.optionalString (
+          config ? age && config.age ? secrets && config.age.secrets ? nix2lio
+        ) "IdentityFile ${config.age.secrets.nix2lio.path}"}
+    '';
+    nix = {
+      distributedBuilds = lib.mkIf (!cfg.disableRemoteBuildsOnLio) true;
+      buildMachines = lib.mkIf (!cfg.disableRemoteBuildsOnLio) [
+        {
+          hostName = "lio";
+          system = "x86_64-linux";
+          protocol = "ssh-ng";
+          maxJobs = 32;
+          speedFactor = 2;
+          supportedFeatures = [
+            "nixos-test"
+            "benchmark"
+            "big-parallel"
+            "kvm"
+            "uid-range" # Often helpful
+          ];
+          mandatoryFeatures = [ ];
+        }
+      ];
+    };
+
+    # TODO can I make this Roaming automatically somehow?
+    time.timeZone = cfg.timezone;
+    # Select internationalization properties.
+    i18n.defaultLocale = cfg.defaultLocal;
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = cfg.defaultLocal;
+      LC_IDENTIFICATION = cfg.defaultLocal;
+      LC_MEASUREMENT = cfg.defaultLocal;
+      LC_MONETARY = cfg.defaultLocal;
+      LC_NAME = cfg.defaultLocal;
+      LC_NUMERIC = cfg.defaultLocal;
+      LC_PAPER = cfg.defaultLocal;
+      LC_TELEPHONE = cfg.defaultLocal;
+      LC_TIME = cfg.defaultLocal;
+    };
+
+    # Turn off sleep
+    systemd.sleep.extraConfig = lib.mkIf (!cfg.enableSleep) ''
+      [Sleep]
+      AllowSuspend=no
+      AllowHibernation=no
+      AllowSuspendThenHibernate=no
+      AllowHybridSleep=no
+    '';
+
+    # Hide boot logs
+    boot.initrd.verbose = cfg.hideBootLogs;
+    boot.consoleLogLevel = lib.mkIf cfg.hideBootLogs 3;
+    boot.kernelParams = lib.mkIf cfg.hideBootLogs [
+      "quiet"
+      "loglevel=3"
+      "systemd.show_status=false"
+    ];
+  };
+}
diff --git a/common/general/fonts.nix b/common/general/fonts.nix
new file mode 100644
index 0000000..ebc1014
--- /dev/null
+++ b/common/general/fonts.nix
@@ -0,0 +1,59 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  hasNewJetbrainsMono =
+    if builtins.hasAttr "nerd-fonts" pkgs then
+      builtins.hasAttr "jetbrains-mono" pkgs."nerd-fonts"
+    else
+      false;
+
+  jetbrainsMonoFont =
+    if hasNewJetbrainsMono then
+      pkgs.nerd-fonts.jetbrains-mono
+    else
+      (pkgs.nerdfonts.override { fonts = [ "JetBrainsMono" ]; });
+
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      jetbrainsMonoFont = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable jetbrains mono font";
+      };
+      japaneseFonts = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable japanese fonts";
+      };
+    };
+
+  config = {
+    fonts.packages =
+      lib.optionals cfg.jetbrainsMonoFont [
+        jetbrainsMonoFont
+      ]
+      ++ lib.optionals cfg.japaneseFonts (
+        with pkgs;
+        [
+          ipafont
+          kochi-substitute
+          noto-fonts-cjk-sans # Or another CJK font
+        ]
+      );
+
+    fonts.fontconfig.enable = true;
+  };
+}
diff --git a/common/general/reporting.nix b/common/general/reporting.nix
new file mode 100644
index 0000000..f769402
--- /dev/null
+++ b/common/general/reporting.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+    "reporting"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Reporting node info and logs to grafana";
+      lokiUrl = lib.mkOption {
+        type = lib.types.str;
+        default = "http://h001.net.joshuabell.xyz:3100/loki/api/v1/push";
+        description = "URL of the Loki instance to send logs to";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.prometheus.exporters.node = {
+      enable = true;
+      port = 9100;
+    };
+
+    # Create necessary directories with appropriate permissions
+    systemd.tmpfiles.rules = [
+      "d /tmp/positions 1777 - - -" # World-writable directory for positions file
+      "f /tmp/positions.yaml 0666 - - -" # World-writable positions file
+    ];
+    users.groups.systemd-journal.members = [ "promtail" ];
+    services.promtail = {
+      enable = true;
+      extraFlags = [
+        "-config.expand-env=true"
+      ];
+      configuration = {
+        server = {
+          http_listen_port = 9080;
+          grpc_listen_port = 0;
+        };
+        positions = {
+          filename = "/tmp/positions.yaml"; # Changed from /var/lib/promtail/positions.yaml
+        };
+        clients = [
+          {
+            url = cfg.lokiUrl;
+          }
+        ];
+        scrape_configs = [
+          {
+            job_name = "journal";
+            journal = {
+              json = false;
+              max_age = "12h";
+              path = "/var/log/journal";
+              labels = {
+                job = "systemd-journal";
+                host = config.networking.hostName;
+              };
+            };
+            relabel_configs = [
+              {
+                source_labels = [ "__journal__systemd_unit" ];
+                target_label = "unit";
+              }
+            ];
+          }
+        ];
+      };
+    };
+  };
+}
diff --git a/flakes/common/nix_modules/git/branch.func.sh b/common/general/shell/branch.func.sh
similarity index 80%
rename from flakes/common/nix_modules/git/branch.func.sh
rename to common/general/shell/branch.func.sh
index 3d6e26c..03908fc 100644
--- a/flakes/common/nix_modules/git/branch.func.sh
+++ b/common/general/shell/branch.func.sh
@@ -175,61 +175,10 @@ branch() {
   echo "Creating new worktree for branch '$branch_name' at '$wt_path'."
 
   # Try to add or update worktree from the resolved ref. Use a fallback path if needed.
-
-  _branch__post_setup() {
-    local repo_dir="$1" wt_path="$2"
-    # Sentinel in worktree-specific git dir to avoid re-running
-    local git_dir sentinel
-    git_dir=$(git -C "$wt_path" rev-parse --git-dir 2>/dev/null || true)
-    sentinel="$git_dir/post-setup.done"
-    if [ -f "$sentinel" ]; then
-      return 0
-    fi
-    _branch__auto_link "$repo_dir" "$wt_path" || true
-    _branch__bootstrap "$repo_dir" "$wt_path" || true
-    : > "$sentinel" 2>/dev/null || true
-  }
-
-  _branch__auto_link() {
-    local repo_dir="$1" wt_path="$2"
-    local has_cfg
-    has_cfg=$(git -C "$repo_dir" config --get-all worktree.autolink 2>/dev/null | wc -l)
-    if [ "${BRANCH_AUTOLINK:-0}" -eq 1 ] || [ "$has_cfg" -gt 0 ]; then
-      if command -v link_ignored >/dev/null 2>&1; then
-        ( cd "$wt_path" && link_ignored --auto --no-fzf ) || true
-      fi
-    fi
-  }
-
-  _branch__bootstrap() {
-    local repo_dir="$1" wt_path="$2"
-    local mode cmd
-    mode=$(git -C "$repo_dir" config --get worktree.bootstrap 2>/dev/null || true)
-    if [ -n "${BRANCH_BOOTSTRAP_CMD:-}" ]; then
-      cmd="$BRANCH_BOOTSTRAP_CMD"
-    elif [ -n "$mode" ]; then
-      cmd="$mode"
-    else
-      case "${BRANCH_BOOTSTRAP:-skip}" in
-        auto)
-          if [ -f "$wt_path/pnpm-lock.yaml" ]; then cmd="pnpm i --frozen-lockfile"
-          elif [ -f "$wt_path/yarn.lock" ]; then cmd="yarn install --frozen-lockfile || yarn install --immutable"
-          elif [ -f "$wt_path/package-lock.json" ]; then cmd="npm ci"
-          else cmd=""; fi
-          ;;
-        skip|0|false) cmd="" ;;
-        1|true) cmd="npm ci" ;;
-      esac
-    fi
-    [ -z "$cmd" ] && return 0
-    ( cd "$wt_path" && eval "$cmd" ) || true
-  }
-
   if [ "$local_exists" -eq 1 ]; then
       if git -C "$repo_dir" worktree add "$wt_path" "$branch_name" 2>/dev/null; then
       cd "$wt_path" || return 1
       _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
-      _branch__post_setup "$repo_dir" "$wt_path" || true
       return 0
     fi
 
@@ -237,7 +186,6 @@ branch() {
     if git -C "$repo_dir" worktree add -b "$branch_name" "$wt_path" "$branch_from" 2>/dev/null; then
       cd "$wt_path" || return 1
       _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
-      _branch__post_setup "$repo_dir" "$wt_path" || true
       return 0
     fi
   fi
@@ -249,7 +197,6 @@ branch() {
         if git -C "$repo_dir" worktree add "$wt_path" "$branch_name" 2>/dev/null; then
       cd "$wt_path" || return 1
       _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
-      _branch__post_setup "$repo_dir" "$wt_path" || true
       return 0
       else
         git -C "$repo_dir" branch -D "$branch_name" 2>/dev/null || true
diff --git a/flakes/common/nix_modules/git/branchd.func.sh b/common/general/shell/branchd.func.sh
similarity index 100%
rename from flakes/common/nix_modules/git/branchd.func.sh
rename to common/general/shell/branchd.func.sh
diff --git a/common/general/shell/common.nix b/common/general/shell/common.nix
new file mode 100644
index 0000000..c7bd3df
--- /dev/null
+++ b/common/general/shell/common.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+{
+  config = {
+    environment.systemPackages = with pkgs; [
+      # Basics
+      vim
+      nano
+      wget
+      curl
+      jq
+      fastfetch
+      bat
+      htop
+      unzip
+      git
+      fzf
+      ripgrep
+      lsof
+      killall
+      hdparm
+      speedtest-cli
+      lf
+    ];
+
+    environment.shellAliases = {
+      n = "nvim";
+      nn = "nvim --headless '+SessionDelete' +qa > /dev/null 2>&1 && nvim";
+      bat = "bat --theme Coldark-Dark";
+      cat = "bat --pager=never -p";
+      # TODO this may not be needed now that I am using `nh` clean mode (see /hosts/_common/configuration.nix#programs.nh)
+      nix-boot-clean = "find '/boot/loader/entries' -type f ! -name 'windows.conf' | head -n -4 | xargs -I {} rm {}; nix store gc; nixos-rebuild boot; echo; df";
+      ndr = "nix-direnv-reload";
+
+      # general unix
+      date_compact = "date +'%Y%m%d'";
+      date_short = "date +'%Y-%m-%d'";
+      ls = "ls --color -Gah";
+      ll = "ls --color -Galh";
+      lss = "du --max-depth=0 -h {.,}* 2>/dev/null | sort -hr";
+      psg = "ps aux | head -n 1 && ps aux | grep -v 'grep' | grep";
+      cl = "clear";
+
+      # git
+      status = "git status";
+      diff = "git diff";
+      branches = "git branch -a";
+      gcam = "git commit -a -m";
+      gcm = "git commit -m";
+      stashes = "git stash list";
+      bd = "branch default";
+      li = "link_ignored";
+      bx = "branchdel";
+      b = "branch";
+
+      # ripgrep
+      rg = "rg --no-ignore";
+      rgf = "rg --files --glob '!/nix/store/**' 2>/dev/null | rg";
+    };
+
+    environment.shellInit = lib.concatStringsSep "\n\n" [
+      (builtins.readFile ./common.sh)
+      (builtins.readFile ./tmux_helpers.sh)
+      (builtins.readFile ./branch.func.sh)
+      (builtins.readFile ./branchd.func.sh)
+      (builtins.readFile ./link_ignored.func.sh)
+    ];
+  };
+}
diff --git a/flakes/common/nix_modules/git/utils.func.sh b/common/general/shell/common.sh
similarity index 60%
rename from flakes/common/nix_modules/git/utils.func.sh
rename to common/general/shell/common.sh
index 1ebdae3..3c23918 100644
--- a/flakes/common/nix_modules/git/utils.func.sh
+++ b/common/general/shell/common.sh
@@ -1,3 +1,70 @@
+# Check if ~/.config/environment exists and source all files within it
+if [ -d "$HOME/.config/environment" ]; then
+  for file in "$HOME/.config/environment/"*; do
+    if [ -r "$file" ]; then
+      if ! . "$file"; then
+        echo "Failed to source $file"
+      fi
+    fi
+  done
+fi
+
+# Basics
+htop_psg () {
+  htop -p $(psg $1 | awk '{r=r s $2;s=","} END{print r}')
+}
+
+htop_pid () {
+  htop -p $(ps -ef | awk -v proc=$1 '$3 == proc { cnt++;if (cnt == 1) { printf "%s",$2 } else { printf ",%s",$2 } }')
+}
+
+psg_kill() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "killing ${pid}"
+      kill -9 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+psg_terminate() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "Terminating ${pid}"
+      kill -15 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+psg_skill() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "Killing ${pid}"
+      sudo kill -9 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+mail_clear() {
+  : > /var/mail/$USER
+}
+
+speedtest_fs () {
+  dir=$(pwd)
+  drive=$(df -h ${dir} | awk 'NR==2 {print $1}')
+  echo Testing read speeds on drive ${drive}
+  sudo hdparm -Tt ${drive}
+  test_file=$(date +%u%m%d)
+  test_file="${dir}/speedtest_fs_${test_file}"
+  echo
+  echo Testing write speeds into test file: ${test_file}
+  dd if=/dev/zero of=${test_file} bs=8k count=10k; rm -f ${test_file}
+}
+
+speedtest_internet () {
+  speedtest-cli
+}
+
 # git
 getdefault () {
   git remote show origin | grep "HEAD branch" | sed 's/.*: //'
@@ -78,7 +145,7 @@ stash() {
     read -e -p "Stash label [default: $default_label]: " label
   fi
   label=${label:-$default_label}
-  git stash push -u -k -m "$label"
+  git stash push -m "$label"
 }
 
 pop() {
@@ -105,6 +172,20 @@ delstash() {
   git stash drop "$stash_ref"
 }
 
+# nix
+alias nixpkgs=nixpkg
+nixpkg () {
+  if [ $# -eq 0 ]; then
+    echo "Error: No arguments provided. Please specify at least one package."
+    return 1
+  fi
+  cmd="nix shell"
+  for pkg in "$@"; do
+    cmd="$cmd \"nixpkgs#$pkg\""
+  done
+  eval $cmd
+}
+
 # Marks some files as in "git" but they won't actually get pushed up to the git repo
 # Usefull for `gintent .envrc flake.lock flake.nix` to add nix items required by flakes in a git repo that won't want flakes added
 gintent() {
@@ -131,3 +212,9 @@ gintent_undo() {
   done
 }
 alias gintentnix_undo="gintent_undo .envrc flake.lock flake.nix"
+
+
+# Aider
+aider () {
+  http_proxy="" all_proxy="" https_proxy="" AZURE_API_BASE=http://100.64.0.8 AZURE_API_VERSION=2025-01-01-preview AZURE_API_KEY=1 nix run "nixpkgs#aider-chat-full" -- aider --dark-mode --no-gitignore --no-check-update --no-auto-commits --model azure/gpt-4.1-2025-04-14 $@
+}
diff --git a/flakes/common/nix_modules/git/link_ignored.func.sh b/common/general/shell/link_ignored.func.sh
similarity index 71%
rename from flakes/common/nix_modules/git/link_ignored.func.sh
rename to common/general/shell/link_ignored.func.sh
index 63d8aa0..0043ed9 100644
--- a/flakes/common/nix_modules/git/link_ignored.func.sh
+++ b/common/general/shell/link_ignored.func.sh
@@ -1,14 +1,12 @@
 link_ignored() {
   local DRY_RUN=0
   local USE_FZF=1
-  local AUTO=0
   local -a PATTERNS=()
 
   while [ $# -gt 0 ]; do
     case "$1" in
       --dry-run) DRY_RUN=1; shift ;;
       --no-fzf) USE_FZF=0; shift ;;
-      --auto) AUTO=1; shift ;;
       -h|--help) link_ignored_usage; return 0 ;;
       --) shift; break ;;
       *) PATTERNS+=("$1"); shift ;;
@@ -17,16 +15,11 @@ link_ignored() {
 
   link_ignored_usage() {
     cat <<EOF
-Usage: link_ignored [--dry-run] [--no-fzf] [--auto] [pattern ...]
+Usage: link_ignored [--dry-run] [--no-fzf] [pattern ...]
 
 Interactively or non-interactively create symlinks in the current worktree
 for files/dirs that exist in the main repository root but are git-ignored /
 untracked.
-
-Defaults:
-- If no patterns provided, tries git config worktree.autolink (multi)
-- Else falls back to env LINK_IGNORED_DEFAULTS (space-separated)
-- With --auto and defaults present, skips fzf and links immediately
 EOF
   }
 
@@ -45,38 +38,6 @@ EOF
     return 2
   fi
 
-  _li_load_defaults() {
-    local -a cfg=()
-    while IFS= read -r line; do
-      [ -n "$line" ] && cfg+=("$line")
-    done < <(git -C "$repo_root" config --get-all worktree.autolink 2>/dev/null || true)
-
-    if [ ${#cfg[@]} -gt 0 ]; then
-      PATTERNS=("${cfg[@]}")
-      return 0
-    fi
-
-    if [ -n "${LINK_IGNORED_DEFAULTS:-}" ]; then
-      if [ -n "${ZSH_VERSION:-}" ]; then
-        eval "PATTERNS=(${=LINK_IGNORED_DEFAULTS})"
-      else
-        read -r -a PATTERNS <<< "$LINK_IGNORED_DEFAULTS"
-      fi
-      return 0
-    fi
-    return 1
-  }
-
-  # Try to load defaults if none provided
-  if [ ${#PATTERNS[@]} -eq 0 ]; then
-    _li_load_defaults || true
-  fi
-
-  # If AUTO requested and we have patterns, skip fzf
-  if [ $AUTO -eq 1 ] && [ ${#PATTERNS[@]} -gt 0 ]; then
-    USE_FZF=0
-  fi
-
   local -a candidates=()
   while IFS= read -r -d '' file; do
     candidates+=("$file")
@@ -99,18 +60,6 @@ EOF
     [ "$found" -eq 0 ] && tops+=("$top")
   done
 
-  # Hard-coded top-level excludes to avoid noisy build outputs
-  local -a EXCLUDES=(build dist)
-  if [ ${#tops[@]} -gt 0 ]; then
-    local -a tops_filtered=()
-    for t in "${tops[@]}"; do
-      local skip=0
-      for e in "${EXCLUDES[@]}"; do [ "$t" = "$e" ] && skip=1 && break; done
-      [ $skip -eq 0 ] && tops_filtered+=("$t")
-    done
-    tops=("${tops_filtered[@]}")
-  fi
- 
   if [ ${#tops[@]} -eq 0 ]; then
     echo "No top-level ignored/untracked entries found in $repo_root"
     return 0
@@ -138,7 +87,7 @@ EOF
   local -a chosen
   if command -v fzf >/dev/null 2>&1 && [ "$USE_FZF" -eq 1 ]; then
     local selected
-    selected=$(printf "%s\n" "${filtered[@]}" | fzf --multi --height=40% --border --prompt="Select items to link: " --preview "if [ -f '$repo_root'/{} ]; then bat --color always --paging=never --style=plain '$repo_root'/{}; else ls -la '$repo_root'/{}; fi")
+    selected=$(printf "%s\n" "${filtered[@]}" | fzf --multi --height=40% --border --prompt="Select files to link: " --preview "if [ -f '$repo_root'/{} ]; then bat --color always --paging=never --style=plain '$repo_root'/{}; else ls -la '$repo_root'/{}; fi")
     if [ -z "$selected" ]; then
       echo "No files selected." && return 0
     fi
diff --git a/flakes/common/nix_modules/tmux/tmux_helpers.sh b/common/general/shell/tmux_helpers.sh
similarity index 100%
rename from flakes/common/nix_modules/tmux/tmux_helpers.sh
rename to common/general/shell/tmux_helpers.sh
diff --git a/common/general/tty_caps_esc.nix b/common/general/tty_caps_esc.nix
new file mode 100644
index 0000000..7223bfe
--- /dev/null
+++ b/common/general/tty_caps_esc.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      ttyCapsEscape = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable caps for escape key";
+      };
+    };
+  config = lib.mkIf cfg.ttyCapsEscape {
+    services.xserver.xkb.options = "caps:escape";
+    console = {
+      earlySetup = true;
+      packages = with pkgs; [ terminus_font ];
+      useXkbConfig = true; # use xkb.options in tty. (caps -> escape)
+    };
+  };
+}
diff --git a/common/options.nix b/common/options.nix
new file mode 100644
index 0000000..7bcb038
--- /dev/null
+++ b/common/options.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ./config.nix;
+  cfg_path = "${ccfg.custom_config_key}";
+  cfg = config.${cfg_path};
+in
+{
+  options.${cfg_path} = {
+    systemName = lib.mkOption {
+      type = lib.types.str;
+      description = "The name of the system.";
+    };
+  };
+}
diff --git a/common/programs/default.nix b/common/programs/default.nix
new file mode 100644
index 0000000..c56a1ab
--- /dev/null
+++ b/common/programs/default.nix
@@ -0,0 +1,43 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.programs;
+in
+{
+  imports = [
+    ./qFlipper.nix
+    ./rustDev.nix
+    ./uhkAgent.nix
+    ./tailnet.nix
+    ./ssh.nix
+    ./docker.nix
+    ./podman.nix
+    ./incus.nix
+    ./flatpaks.nix
+    ./virt-manager.nix
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledVirtualizers = lib.filter (x: x.enabled) [
+            {
+              name = "docker";
+              enabled = cfg.docker.enable;
+            }
+            {
+              name = "podman";
+              enabled = cfg.podman.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledVirtualizers <= 1;
+          message =
+            "Only one virtualizer can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledVirtualizers);
+        }
+      )
+    ];
+  };
+}
diff --git a/common/programs/docker.nix b/common/programs/docker.nix
new file mode 100644
index 0000000..c3aea93
--- /dev/null
+++ b/common/programs/docker.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "docker"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "docker";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker = {
+      enable = true;
+      autoPrune.enable = true;
+    };
+    # TODO add admins?
+    users.extraGroups.docker.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+    environment.shellAliases = {
+      dockerv = "docker volume";
+      dockeri = "docker image";
+      dockerc = "docker container";
+    };
+  };
+}
diff --git a/common/programs/flatpaks.nix b/common/programs/flatpaks.nix
new file mode 100644
index 0000000..307fff2
--- /dev/null
+++ b/common/programs/flatpaks.nix
@@ -0,0 +1,66 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "flatpaks"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "flatpaks";
+      packages = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "List of Flatpak package names to install.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.flatpak = {
+      enable = true;
+      packages = cfg.packages;
+      overrides = {
+        global = {
+          Context.sockets = [
+            "wayland"
+            "x11"
+          ];
+          Context.devices = [ "dri" ]; # allow GPU access if desired
+          Environment = {
+            XCURSOR_PATH = "/run/host/user-share/icons:/run/host/share/icons";
+            GTK_THEME = "Adwaita:dark";
+            # Force wayland as much as possible.
+            ELECTRON_OZONE_PLATFORM_HINT = "auto"; # or 'auto'
+            GTK_USE_PORTAL = "1";
+            OZONE_PLATFORM = "wayland";
+            QT_QPA_PLATFORM = "xcb";    # force XCB for Flatpaks (XWayland)
+          };
+        };
+        "org.signal.Signal" = {
+          Environment = {
+            SIGNAL_PASSWORD_STORE = "gnome-libsecret";
+          };
+          Context = {
+            sockets = [
+              "xfg-settings"
+            ];
+          };
+        };
+        "com.google.Chrome" = {
+          Environment = {
+            CHROME_EXTRA_ARGS = "--enable-features=WaylandWindowDecorations --ozone-platform-hint=auto";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/common/programs/incus.nix b/common/programs/incus.nix
new file mode 100644
index 0000000..01f0980
--- /dev/null
+++ b/common/programs/incus.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "incus"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "incus";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.incus = {
+      enable = true;
+      agent.enable = true;
+      ui.enable = true;
+    };
+
+    users.extraGroups.incus_admin.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+    users.extraGroups.incus.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+  };
+}
diff --git a/common/programs/podman.nix b/common/programs/podman.nix
new file mode 100644
index 0000000..8be88f9
--- /dev/null
+++ b/common/programs/podman.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "podman"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "podman";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.podman = {
+      enable = true;
+      dockerSocket.enable = true;
+      autoPrune.enable = true;
+    };
+    # TODO add admins?
+    users.extraGroups.podman.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+  };
+}
diff --git a/common/programs/qFlipper.nix b/common/programs/qFlipper.nix
new file mode 100644
index 0000000..823ef99
--- /dev/null
+++ b/common/programs/qFlipper.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "qFlipper"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "qFlipper";
+    };
+
+  config = lib.mkIf cfg.enable {
+    hardware.flipperzero.enable = true;
+    environment.systemPackages = with pkgs; [ qFlipper ];
+    services.udev.extraRules = ''
+      #Flipper Zero serial port
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="5740", ATTRS{manufacturer}=="Flipper Devices Inc.", GROUP="users", TAG+="uaccess"
+      #Flipper Zero DFU
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", ATTRS{manufacturer}=="STMicroelectronics", GROUP="users", TAG+="uaccess"
+    '';
+  };
+}
diff --git a/common/programs/rustDev.nix b/common/programs/rustDev.nix
new file mode 100644
index 0000000..dd226fb
--- /dev/null
+++ b/common/programs/rustDev.nix
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "rustDev"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "rust development tools";
+      repl = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable the evcxr repl for `rust` command.";
+      };
+      # TODO?
+      # channel = lib.mkOption {
+      #   type = lib.types.str;
+      #   default = "stable";
+      #   description = "The Rust release channel to use (e.g., stable, beta, nightly).";
+      # };
+      # version = lib.mkOption {
+      #   type = lib.types.str;
+      #   default = "latest";
+      #   description = "The specific version of Rust to use. Use 'latest' for the latest stable release.";
+      # };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages =
+      with pkgs;
+      [
+        rustup
+        gcc
+      ]
+      ++ (if cfg.repl then [ pkgs.evcxr ] else [ ]);
+
+    environment.shellAliases = lib.mkIf cfg.repl {
+      rust = "evcxr";
+    };
+  };
+
+}
diff --git a/common/programs/ssh.nix b/common/programs/ssh.nix
new file mode 100644
index 0000000..6b0cea7
--- /dev/null
+++ b/common/programs/ssh.nix
@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "ssh"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "ssh";
+      sshPortOpen = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Open the ssh port.";
+      };
+      fail2Ban = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable fail2ban.";
+      };
+      allowPasswordLogin = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Allow root password login.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      openssh
+      autossh
+    ];
+
+    # Use fail2ban
+    services.fail2ban = lib.mkIf cfg.fail2Ban {
+      enable = true;
+      # Ignore my tailnet
+      ignoreIP = [
+        "100.64.0.0/10"
+      ];
+    };
+
+    # Open ports in the firewall if enabled.
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.sshPortOpen [
+      22 # sshd
+    ];
+
+    # Enable the OpenSSH daemon.
+    services.openssh = {
+      enable = true;
+      settings = {
+        LogLevel = "VERBOSE";
+        PermitRootLogin = "yes";
+        PasswordAuthentication = cfg.allowPasswordLogin;
+      };
+    };
+
+    # Ensure SSH key pair generation for non-root users
+    systemd.services = lib.mapAttrs' (name: _: {
+      name = "generate_ssh_key_${name}";
+      value = {
+        description = "Generate SSH key pair for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = name;
+          Type = "oneshot";
+        };
+        script = ''
+          #!/run/current-system/sw/bin/bash
+          if [ ! -f /home/${name}/.ssh/id_ed25519 ]; then
+            if [ -v DRY_RUN ]; then
+              echo "DRY_RUN is set. Would generate SSH key for ${name}.";
+            else
+              echo "Generating SSH key for ${name}.";
+              mkdir -p /home/${name}/.ssh;
+              chmod 700 /home/${name}/.ssh;
+              /run/current-system/sw/bin/ssh-keygen -t ed25519 -f /home/${name}/.ssh/id_ed25519 -N "";
+            fi
+          else
+            echo "SSH key already exists for ${name}.";
+          fi
+        '';
+      };
+    }) users_cfg.users;
+  };
+}
diff --git a/common/programs/tailnet.nix b/common/programs/tailnet.nix
new file mode 100644
index 0000000..bcbe53f
--- /dev/null
+++ b/common/programs/tailnet.nix
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "tailnet"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "enable tailnet";
+      useHeadscale = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to use headscale login server.";
+      };
+      enableExitNode = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable exit node.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ tailscale ];
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = if cfg.enableExitNode then "both" else "client";
+      authKeyFile = lib.mkIf (
+        config ? age && config.age ? secrets && config.age.secrets ? headscale_auth
+      ) config.age.secrets.headscale_auth.path;
+      extraUpFlags =
+        (lib.optionals cfg.useHeadscale [
+          "--login-server=https://headscale.joshuabell.xyz"
+        ])
+        ++ (lib.optionals cfg.enableExitNode [ "--advertise-exit-node" ]);
+
+    };
+    networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    networking.firewall.checkReversePath = "loose";
+  };
+
+}
diff --git a/common/programs/uhkAgent.nix b/common/programs/uhkAgent.nix
new file mode 100644
index 0000000..90a9c3a
--- /dev/null
+++ b/common/programs/uhkAgent.nix
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "uhkAgent"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "uhk agent (ultimate hacking keyboard)";
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      uhk-agent
+      uhk-udev-rules
+    ];
+    services.udev.packages = [ pkgs.uhk-udev-rules ];
+  };
+
+}
diff --git a/common/programs/virt-manager.nix b/common/programs/virt-manager.nix
new file mode 100644
index 0000000..fb837b1
--- /dev/null
+++ b/common/programs/virt-manager.nix
@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "virt-manager"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Enable virt manager/quemu";
+      users = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = builtins.attrNames users_cfg;
+        description = "Users to configure for virt-manager.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.qemuGuest.enable = true;
+    services.spice-vdagentd.enable = true;
+    programs.virt-manager = {
+      enable = true;
+    };
+
+    virtualisation = {
+      libvirtd.enable = true;
+      spiceUSBRedirection.enable = true;
+    };
+
+    users.groups.libvirtd.members = cfg.users;
+  };
+}
diff --git a/common/secrets/default.nix b/common/secrets/default.nix
new file mode 100644
index 0000000..7944a47
--- /dev/null
+++ b/common/secrets/default.nix
@@ -0,0 +1,77 @@
+{
+  config,
+  ragenix,
+  lib,
+  pkgs,
+  ...
+}@args:
+
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "secrets"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+
+  secretsRaw = import ./secrets/secrets.nix;
+  systemName = lib.attrsets.getAttrFromPath [
+    ccfg.custom_config_key
+    "systemName"
+  ] config;
+  authorityMarker = "authority";
+
+  # Key matches this host if its trailing comment contains "@<host>"
+  matchesThisSystem = key: lib.strings.hasInfix "@${systemName}" key;
+  # Key is the authority key if its comment contains the marker string
+  matchesAuthority = key: lib.strings.hasInfix authorityMarker key;
+
+  keepSecret =
+    attrs:
+    let
+      keys = attrs.publicKeys or [ ];
+    in
+    lib.any (k: matchesThisSystem k) keys;
+
+  # Any secrets that should be world-readable even after auto-import
+  worldReadable = [
+    "zitadel_master_key"
+    "openwebui_env"
+    "vaultwarden_env"
+  ];
+
+  # Keep only secrets intended for this host (or that include the authority key)
+  filteredSecrets = lib.attrsets.filterAttrs (_name: attrs: keepSecret attrs) secretsRaw;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "secrets";
+    };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      ragenix.packages.${pkgs.system}.default
+      pkgs.rage
+    ];
+
+    age = {
+      secrets = lib.attrsets.mapAttrs' (
+        name: _attrs:
+        let
+          base = lib.removeSuffix ".age" name;
+        in
+        lib.nameValuePair base (
+          {
+            file = ./. + "/secrets/${name}";
+            owner = users_cfg.primary;
+          }
+          // lib.optionalAttrs (lib.elem base worldReadable) {
+            mode = "444";
+          }
+        )
+      ) filteredSecrets;
+    };
+  };
+}
diff --git a/common/secrets/secrets/github_read_token.age b/common/secrets/secrets/github_read_token.age
new file mode 100644
index 0000000..3ddcbd6
--- /dev/null
+++ b/common/secrets/secrets/github_read_token.age
@@ -0,0 +1,42 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBJRmpU
+K2tCT1RTNzBhQlNzSHlIZDB4UFNCRDhiY1puVHQxN0QzSDNIbWhFCkdPVTFLYUcv
+MW1FMnUyVG9xVE5KaVJQWlhFYmtaeGl2RGYyWWhtbEtTTFEKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDBNalFocUZXRkZxMU10L1pWN1I5eUlGWXlrMVNLazR5RExycnZJ
+K3BsaDQKVlZCUjRNL1hvMXFjRkd1VGVZNUp3ZnZBdW1qMEFpY3ZhYWFacmlZZEFa
+SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgSWRpT3BZZ0pHOWZjWkszZVg3OEZaZld5
+d2hOdXpYZ2tXVThMb0FTK2ZEQQpKY2xXT1dDeEp1LzlDcnoreVNvSHdCL2dDVFVs
+bUUwQlU4Y3pXV0F1S3RNCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBrMFJOd0xrcGp4
+TkpxTW1DZWUxc1BQVTc3S05scHEzQ2hVT1I3bWhQVnlZCkVZQ0dZMm82VG81Yzda
+MUpmWjZRUUx3NVBwVTlUZmtaS2JJem5ETkR6eVUKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGhoSVhmVVNlc0toR1pBemk5WGp4R0NYdFF0dWFjVlpVcWRQT0hIUlNhazAK
+czdFNlIydWFYSnBuTXNBQXE3eTZtUTBpUUJrdFFZMUZldFh4TXpVWEswSQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgYXp5MElHS04vVlV2b1RoU3RRUTRCeFlHWjRLajFt
+L01Pdi83YnRjNndWTQpFVDk2djEyVFVaUHQyTGliZDRFM0Y0Vi96STFJR0Nqa1hn
+a2VYVFhzelNnCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBET2dPUk5rYm9wVHczaE0w
+L2hpa0F3emZqNDBxR2c1OUVVNnBNeVc1SzBRCmhIWmFKTnl2TFFBRUpyejhEMFBj
+cVR6RkZHS3lpZzd6MzgrQml5QXpWdjAKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIFVk
+cE1YSS9rdzBsTk0xNGtlRjJSV2llNVhYOUsvdVVFam1wUU82czNTUlkKQTdLcFdk
+akErdWRrUXZET1hjL2J4UFJzdkNFVTlEUWJFWTFaczQ1VmxDNAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgQVNMandOOVFiN2xuQTd2MC9UUmt2MVg2YUlzcHBHaEJBWG1E
+Y0srMU9UYwpGQnh6L09qY2JvL0tqcGNnWldkWUVzRHk1QVJvN1N0YlRVNCtlMlV6
+MUNVCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBJR0RzZWpCNHNHcXBhQVErVUwxcG9t
+K0M5RSt0M2R6SFpwYzB5MXZFQVM4Cll2NmJrQkMwNkFGbWM2bHJ2THhNbG9XS0dk
+cmEzWUFCdXBLS1dyNWh0aU0KLT4gc3NoLWVkMjU1MTkgWmUxTXdRIElaN2h2aHRO
+bDRtNUlrMlNmOWVSYlpvR2VVeWRxL25vMnFjVUVmc215ejAKVlBmcTFtN3BUZXJx
+eUg0eXY2S3V0ZklGNzFnK09yRUJacnZYUllkUzF0bwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgU1J3VG1lVDlCNmNVZ2hZbXI4ZDhZdE9jYnNkNHpQclpqQmdGcFhuYTBI
+RQpkMnhjZlYrWjBPZVk0UGt5UEZmQzZoOUxSVG8zMVl6MlZCT1JneWJuWVdnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSA5RldGVWx4aU9ZVUNQdlJTRUVqbS9CajlnTEdR
+NFlCZnEwSy9rRGNIM1RRCkxKN2FUQTBVbVA5SnVZSDlGcXFKL0M1NGhONFhLamF3
+Z0VNZ1VSSEFKSlkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIElkSFNJWnZ3WFA3V1J0
+aFNqN0RTQUEvNkRkeHI5QkR3K0RuQ2NnZTFQU1UKb0dKd3gyYWdPd0NyUEZDWUhB
+eUdaZzIzWEtkNGdUZzZScWpOUzN6K2dCTQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+eGNINUY0UElXbUQvUklPY2c1S1A4OXh0UWRsTjFGUTg3dW9BM0dyTVgwNApyN3pV
+eHhUSnAxZ1ZpdmUva0lScWJxNGFWZDRMdm8zd09kay9ORXdOVkljCi0+IDMtZ3Jl
+YXNlCldFN1JnNGM4Vmh1dE5wZUNGOC9NdktlSEFnCi0tLSByVzE2ZHZSdXRxQTZN
+SjRTNlRtUHlRL2JPS1Yxd1lnalFFUGlWR1lKTjZvCgfzY9S+Cm6zaEAcrAr3fsev
+9enyx9OmVTIIZltr52uqCYbWcsuCkDjHtwR3NXiSQB2HWhNe38l4l2K1+HGcoS7i
+2TMD7o9Jx6QoWLHgmrn/zXL/VKyOj5a7P530AMzdqcgJ4U8641VN0W7L9u1Cw5EB
+Ujzb1rKthf+txuP04aWYit69ZBdH7r+VkOGghXngwvBapwFF8AGUug==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/headscale_auth.age b/common/secrets/secrets/headscale_auth.age
new file mode 100644
index 0000000..867be94
--- /dev/null
+++ b/common/secrets/secrets/headscale_auth.age
@@ -0,0 +1,40 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBvbGZC
+ZFZWZ2ZPWUlNdEZCSXBuYThubHpiNkFzb3Jldlh1QlF0UTZ0NHlZCjlHSTVrekQw
+MDBsaU56Yk9IQVZaQWJDMVNoUWFlQmpJV2gyTXBXNEhNdDQKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDU0eDdqTStiUUlCUUcrYWhDWVRSQmxPNEIySk9NallHaVdNVFg5
+YXNPa1kKQ25PNGxjc1hid25Nd2R5RCttbHN1ci84T1pmQ0ZkNDM0R3FLbGdHRnRm
+OAotPiBzc2gtZWQyNTUxOSBTcENqQlEgNjR5WkE4eUQrUGk1NHFMY3BjclZKWkd2
+TVd1QVNoVm96QkcwcHZmdG16dwpRQjY2V3dOOGo3VlJ5aTNLS0NqUVJ3VHNTWC8x
+V05kbm5yQ3F0MWNFM2ZJCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBFeDIrUWEyYjVw
+QUdjSlBWQ0Y2N01uL3hxTWJiNkdCVkM3UTBZbDhBZWhNCnRraHhUb2NEMzJWbWl5
+SjJEenN0VjJCWlM3TXEyREN0ZysxSG9Rak9hMVUKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGxYRDJta0x6QnNkTXJnQmZwWFlRL0wrNS9EUS9TVDJMRFhZWDBUKzRWaWcK
+VXlwL01IYTdTTTY4Zk1FOHBMc3E4ck1DZHp6aHhEaXFBWFN3SGErcjhmUQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgVUozU1kvVVJsZ0F2Nnk4bmZnUUNyTU8rM1FCRjFY
+bWVBZWNNUFZIcFQyTQpzK0Z1SXVFQWhFSnp0UGs0RHJIQlZrUUtlY0ZFTjdwSTZS
+MXhjSTNpOHNnCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBvQkd5UlNUakhGY0dkRFly
+SU4vM3A1Sm5xNnhIZm5PUjR5WFNLZ1ZmL21NCk00M3k0RnNjL2dkRVd6MmdGSW1G
+aGt1dmwxN0VTQm1zeklDN2MzRmFqSUUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIFBQ
+TGdvVjdEaEJDQ1FxbjhTOVdZTVdjLzJhc3lwdy83UHNyOWJPNk5ZRjQKMTdNemRQ
+L1h6Tk1EVTdZcnFPRVdEZjhnU21hLzcrWk0zS05YSTV3ZGJQNAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTFcyc05mMnNVdWFDQWZUMGN6OWNZeGkrWlMyakV5RVhHaFJw
+bmxiZ0lrYwozcit3dU84L0lVU0JXbVN3YnJoK0NPOUZKS3EvSkNPQ3FCWWhYZnhx
+azhFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBNWWJtTlVQTUo1SFh4b1Q4Vk8vUHdG
+V0xLWjRXdVZxVVl0L2JMeTBrdWxJCmJvNGJ5Q0JUR0g4Q0pISmxTVll0OHl2dTFJ
+dlNtR1A2aGVTUEZRMU5Hc1kKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIFkxendRYm0y
+aEc5dTAwQy9pLzBrbUpVVlpFbnlDdlI4bGh0Zy9oMmtVWHcKNDZuaTBDV1o5MXFV
+NlBLVzlqc0ZzOUdMT3c2SmRYV3hVd044bzZoenFqVQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgQ3VDSnNLMHc4N0dCQ0NOY0lscStpeHlKdXA2UGpqRVhjNDVzV0NCQUx3
+VQpkeU9FOE13bFlaQ0ErWlBFZ0VWWTVZZElQdEg5UFo1SVRSeEhqRnk2NEtFCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBaREtQS2ZsSmxSQml0bkZzd0prUXdvdkhBZzhY
+VkNRZWZqdVNvODIxMDNNCkJVMWZUc0o5Q0g0Yi95czFaVkhwejh0QW5HcXZ1Tmdl
+bWFKSUhITkxFYlUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGlNcjZMWEdjdHNpNWNl
+ZzlrNklvVklXM0tDMGVnRWhuL3BYV3dMa1U2ajQKd2owZXUxSGlIVUI3cFRxbjA3
+eWFhZXVudlBpQnRMTEVwZXhSSFgyOEsvSQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+OXR4MFc0eDZQQ1IwclIxYm9kYk1DSkZBZ1RDMm4wYlEyb1VrRTBaNmpWNApwY1pu
+RE9VTU9Mbm9Ea0twcnBNRUc5ZjdzYXRyRmw0MlVHZDZmTVVLZFBrCi0+IHwqflMt
+Z3JlYXNlCgotLS0gNWpFR3lvdmVsN1V2WG01aHN2VjVUeDZORzRpRDZGK0RWTFRM
+SytLcVZYZwrYTHZo/oozQZasJAFNVb3ZrSAjREvZzRRyz6Mj71Pj2H+dbFz9sZ+c
++B4DEN/4xfhm5FUsU2w8VCQ/E+186igURD2AyhUZxNFFVPUPJKUM9rY=
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2bitbucket.age b/common/secrets/secrets/nix2bitbucket.age
new file mode 100644
index 0000000..0dd3a93
--- /dev/null
+++ b/common/secrets/secrets/nix2bitbucket.age
@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAxNHJi
+QjBYYnZsZTl1OXRwUDRXSGx4MmJOdzhHZXY2NUlaQ0hocFdlV240Ckw4U0FNSGFt
+SmF1aW5mM0lseFZDUDR1ZkgyRFdkbHYrUHdITWUxanBrWHcKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIC9vS1U5ajZ1MS9sdFZZbWs0cmlvc1VQRVNLZUxiQkRrS0xtWWx3
+LzMxQm8KdmU2V0pqZnNMajc4SVk5Skhnd0VQTmViMERIMWtqMEcrUGpHTXkzMGk0
+QQotPiBzc2gtZWQyNTUxOSBTcENqQlEgS0FzbGFCY2xtQjdlQ3p4UjJjUVdNRGsv
+ekwvcWhEK2o1OFkzYW1zMy94ZwpSQTlwRVlKb2x3SlR2QkEwSFlhRi81bGRObWhw
+OU9pdVBJcWRyZm8xQWpnCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA5ZGMrR0xRcXJz
+STlKbGhEYkdOYlYzZHBmZkJHUTVYSndEZk1ab09Pb25vCmJWVDZCYmVTSW5nRTVX
+YzFHTnRMeGt5WE1Ydk0vZ3l3K0NhckwzbU5kN2MKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIHlJZG02U1JaZkVxVnhSc2VVZ21sdmJlMUh6eWhhK05lSkhES2J0L3JEUUUK
+K3FacHVNbEIvWk5QQTV5RHpOU0tpYitJek96YjF1a2o3dTJmTnZya3lpSQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgUmcyWU94VEI0Vm1vUnpBWW9ieTYvQjFBM0hyY0ZU
+QWZoaUFmSTRlTEFIZwpINEFkeFJnVVNINWlBaS9UK0V5aExoMnY0TDVjSFdITEJi
+dzFpdm9wRGJBCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSB0MVR0bE9tMEw2bzc0SHpY
+N0JFWXFDbFJ3M3Rab2VtQUlLeUNUU2l1aTBNClNPTGpSTnFGeXpBcStjdnlmWllx
+K20wdUVVVlZnb1FJbEdlQXVTWWpudDgKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIDF0
+ZFlkaTNOMVNsV29rREJpaUdXSnFuQTlyd3pyM2I2bUtPL0ErUm9wR3MKenNsdEhl
+TDVjSmdQSXR4S1ZWR285RTF1T0hhNEg2TFZCUXAraFkzdXo3awotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgVVNrblluWm1Dck1yelpURWZoeVFjaUJFaXdkZldOcCtFVzJQ
+ajZUTmVsUQoyUmI4Tmttc21HemZDTmdERFhxZXlpdG1RVStiems5cVNaQWNIM3dv
+RlI0Ci0+IHNzaC1lZDI1NTE5IDVhZHFNZyAvS3AwTW1kaUtlQnpjaXByQU1uRVM5
+RDgzMVhBSFRWSVdwczhxVXdUWDBFCnBDNjEzU3BUcCtRM2tDUVRBb0Jqd1pkK0Zo
+WWJEb2gzaUlPTGRsZVlzZ0EKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHRnQndCVU9J
+ZlQrdi81b2J2cmNzdXR6NHI0bW9LaHJqRlprTWZJM1RiRm8KSmpVQjF2U3BuVWVz
+Y2orSlc2dUYrQWRYSHFPb0JRZloxZHo1KzduQkJycwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgVG9LQnRwemt5T2VSVFBVK21acngxMHRDNDNxQlFxZU92NzRuK2U2aUwy
+OApXamtRUENLSVBBM2ZmSVNtWkh1TW41dEQrRkNYQndBcUlOQnU2Ky9BMzA4Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBveE5LTWhRZEhzeHBQVmo4amNBTzlHWlFVYURx
+T3plT0lPaEpsb2F0RWhVCmh3aCtsU21zV0pYQzNmU3VqUXhhOHlYVEhsWDN1eHpD
+UjRjVkEyTVhrVjAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDNMWEtrbWh1SWRwVUc0
+Vm9uYlcvK01xcEdSWkZuZzl4eng3NjlwRXNPamcKYlArYXkxYlMybTE0UnhvempS
+bmlncUJtWjVZMWdHY3VvTHNvdExib2lzYwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZnJtVEdzL1RFK3M3TGFpVGo1Mi9aN1pLRS9TajQ1MlNqODVad1M4ZDh3cwpVSWpy
+elZlT2dWTmhFaWJFUVFXWU5pT0dlam1jU0R2di9TUzVjUlY5b0RnCi0+IEJ6cnpI
+NVktZ3JlYXNlID1YU3I8WkNjClRpZ2dHWkJIaVZVVkNwY1JwOFg2bTdzTnJBRjRs
+SytLdFUyRldoTlpHSkRPY1ZQODRYY3RiVS9VNWtPeXBIc0MKeEdJY3UvTWdEZTVa
+RXNvCi0tLSBLcUNEU1JhQnRCK0RMS1F3VEt1Ykl2MkhROG02NmY5bjVIem1JeWdQ
+TXZnChn2UP3yo7fmH9JimBCsA8X6WLurks8pKMf5lb/yh92Uj+mbIz5R07Fpq0aC
+nLa9VhNeQU4nYkotJUVPRGhBlh7xaVRoeaRfRy8n34TKNU+PQUFz6gv0OHkMDOKh
+B3Z73OAJGaFAX1Q1SlM96ejHVMRdr8SNQao9QJvZq9EXyrejV1L8oS7cKHObfkEi
+ylUPlNsH375zQ+rizYqO3jLBGNXpK3RTOX/3xadbAeccyBLrSaoE+eQi2nba2fSb
+iLd6xNtltmDy4AzRwpmMPpD2EUlTV7iBCBlstK6v7k+VOAyH0PGIXTVUlHs8VORI
+PHx8boVaGNn1b3XSD3CTflCRHxo7gSfXzcDEnfIbPsz97Z8GdQmV6fqIoWyWS3ZM
+DFYdS7VBuKA7lUy9fu+UbP6OFjTu05rg35OcM6uzF6U4TVbKrGzaeyZzrokcXCbo
+LNYJaI0FY+/bznL8/YqU/EJsAzgSZLApIzo3wLJhd6YK9Si17Lgf5N8sfUvHN8ax
+naRZp7SlPmmzyhO82KwI8FXM7E+0mZ3CjfiEUmq9dz2plRGJaWCdMJ/SUv9EcTvG
+Z/Uo
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2gitforgejo.age b/common/secrets/secrets/nix2gitforgejo.age
new file mode 100644
index 0000000..9e9ac24
--- /dev/null
+++ b/common/secrets/secrets/nix2gitforgejo.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBtRTlJ
+RHRaRVFZZ2Y2Uzl5dEZXSnplMlpYdy9UVVdvb0dSVFNGd25rcHhNCmp3ZHFneUJU
+eW1PaGlncUdmVHNWblQvbkVxUDJpQ2p2OFJFVGtNb0pZcXMKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIGdJOTRGVktSY21ob0JKam8zaDN0bkhIQjNieTVEcFl3aVBpSjhw
+Nk9OSGsKVENrTkd4cmdaUnE2VWR4SU1ySWdvZGo3VnMxTFo2dklwSTFieUwycTdr
+RQotPiBzc2gtZWQyNTUxOSBTcENqQlEgU0plOWVNNTNNTkxhSVN6ai92aTd6RFJ2
+WjFRMzdJUjAvbDN6MHVOMTNncwp3bVREblZMUE12WEVaOGpLVDBYZHdILzQ2UVBI
+V3MwTTFwb2dwcDMxSFBnCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2L0NONmxjcGFr
+T0xaRnhHQ0FFVVlseUtKcWJZbi9ISlZIclVOdTRNRDJBCitWRDBvQXdackV6QTRu
+S1FPeXdLZGpvbjhBYllVY0UvZ3JEWWQvMHNOS0UKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIG9XOEhybjJFclFKWEhQeDlrY0xVRHZOcHQrK2RWa0hsZTc0eU1qRWlNMTAK
+cnpLdGRDejAraERuNnVlZDBVV202TmdlSVREMVlPWFhpckdPY3Q4OTY0UQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgQWk4Q25xSFZSbHo1NDJ5VnJWcVN5L2NIQi9SQVJ2
+aWtWSHR6azk3QmhEYwpXQUtjb1JZSHNuOFZHWFZYcy9HdktJVGpvQ2xuQXU1Sndi
+YlRWYWhiVmd3Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBOZWtBQ2NDVmViYm9uZ2hu
+akhMVzNlQ0hiNWEybVE0dTFwWGRpMlZGZlZJCkJncE1nTlZTaEl2dW90bERnQUhO
+SWd5dzhYa2RMRVRFYS9rdkdEVTZIcVkKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHNi
+OVZVblBBdVFuVE4xVGt1UzlMNDVtWGdBakVJaDVjanhmYWVPV3RXRjgKYTBOREpS
+bVowSHlySFg1QWJFK0pPdnZJS0VQcjdXdERRbmdsOUFTeldMdwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgdWY5U1BNTndYYWwveCtjeUxHOERGTEhMMXlSSEpyV0gva2pw
+ZHNzSTRsMApQSm5BUmdMODZ2YmVaaFNxQVFaYk5KWFVEOVoyQjBQQzBxM2kwZEl6
+eXJjCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBVbG9ONlVPbW1QNmxENGJERGs1VEJU
+Q0FhMlowVlZVVG8veG5tUWt2T0VJClJPZUY1T00vZitSRmdhWklrY202ci9yRG9M
+RDRiTGpKWis5ditDVjJIRmcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIE1SY3pidWpw
+TmVNbEV0ZXQwTDkzdEtkbVIwd1BrSG10UVhBRUY5VUt2eXcKSCs2VEc1VXhXWXBY
+UHdRVFVtaGJUK2tBWWYvQTk5V1dEcDVReFJ6WkNJdwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgVE51VHdqeEF5ckRqTUVGWGw5SGtkRGJCd0xoZzdNbDRUajZPdThCQk8y
+cwprTW9tU2Z5d1RVRWNkR2M0WWNCRTRwb2VWcDNQdHFCWDBHZDhINUduN0djCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBOZlB6aHRWRmthWkpuekNza2tBUzRiNGFkSTUv
+WVRNRGFKZXZ1Sm0rUDJvCjV1dzlyTFZxYndvZ3BKNGU0K0hwK2VhSmNYcmFHZk41
+RTlscS9uODR0R0UKLT4gc3NoLWVkMjU1MTkga0hrMmdBIC9sLzYvYnVpenRFUlZO
+cTVmVnBpLzIwNlJrU0xYOEhKWStkOGRDU0dkVFUKbjlVQTlsRnBCci9ucUNMNkJC
+WWpueFlqclA4YVc3RVpXeWZDQ25mWEE5YwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+bjJNa0RIcGZWdkxCUnBsU0p4L3lwUDdia3Q4L0Y3cllYVGJuQ3pZcjV3UQo5SGxu
+SlQ0cFVOM3ZRZ3l0SkdVdk5vY0NLcVUrRXJ3SU5SekxaM1NWYy9NCi0+IEdTTEFp
+OSF6LWdyZWFzZSAoJmR3Vi4gU3A/ICNuLSA7Ck9ZSjhhci9nVjl1L2dIR0twUm1i
+NzRSOU1DM2Rwa3RsYnp4ZQotLS0gRGVpRXZiS2Vlc25HN1M2M0kxbUo0Uyt6OHgr
+Q2loS1MwVzB3Uk9mcTd3MAr1KliXDwBENE5rxqhvy1XX1d59XdiWeqCepnPm78ET
+YbVM6FN9H6UBwiwClc+os59UY1lxNyjvefVOfW4V0Jpo2f2aFWdsJxoJWSdomKzG
+N2wQ4Yq8ESeuz4g7pwxWB3RsTr0w6Rnzuf7D4Syg9rpX1pqVinFhLOki1aK3ZIdk
+tqhjkKFgWQbBM/6540W14uw1fPTIcdX8v5KHbTc9XyNA2MHamFc1GooYduqL6Ylr
+ij3hM7/z+TdXxGu3+kqs3Yh5MFd+ePB+LFgAqiW3gv9nD5RmH3s/x8Oip+RLpoTw
+7fwo8wgHByoDK6gz2SAOZ2Q/Px5YBqivleT0oVdrd/quLN5lU2aQt3OANTxzF+bP
+DaAWwv/7pTaLB7lyqCTSw+C+UmgVXmnOi2MO7ex3tImNzwGVQfZG9mc5k13ltwsq
+uxC3T9l8+fuo4iFUwCXfXlm3ZmcIcpjYE6rOlV4Y2EdmwwvwRhMljWf2OfNHlq4e
+hLtKvsHf7+pMAX0ZsZMig6KH09V/RtGUr9KBWVG8CABPnPJBIzlGZPJdmO+G5eAx
+cEUUkJzlcSCF6SDo1zG7QcT7vRSX4FjvOY579w==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2github.age b/common/secrets/secrets/nix2github.age
new file mode 100644
index 0000000..f56d0f8
--- /dev/null
+++ b/common/secrets/secrets/nix2github.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBYU2N0
+a1MzODQzb2JUbjJyQ0xTbUxlbjhJOExjNm1JOFd6bDNNZEp1TlJ3CktCUXFwWTJ0
+cUZVUldoRStJRHc2cjdwa0szQ0VPZTBsV0NiK2ZmQUQybW8KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIEk0R0lSUitzVkRQb2hQamt3cGdQK1ptYXVkUkdXb2w2N3VsY3hY
+emdNM0kKYXhod0FVMzJ4dFRCZXZBQTBJcFc0RWRsZUdqV1FkSldkVHFnbU50VlNx
+TQotPiBzc2gtZWQyNTUxOSBTcENqQlEgaG5Fc0VOUHdJWlFsRGtOSEwxM2RHZHdh
+anVJZWlOZ2dBRStmRkc5WU5nTQpiQzRwMnBIVHJoQldJeEdrOGVha1phbGRKZGZW
+SGZiWUV3Rk5XdGxUZjFvCi0+IHNzaC1lZDI1NTE5IEJZS0crdyAzN1A4amFYM3Jt
+UDNidlBaRDdpSTNLb1dmTDY5VDArc24yUWcwVGwrenpnCmoxVnlEMTFlZFhEeE92
+ZHJaeFJCY25sWTM4NWFnQlhpbCtodWZyeTVoaVkKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIENONGFuM2ViOHRGa1gzQS93a1RTaXkwVFlYd0tadG1nOFhra0VHa0Jua0EK
+OElXcXgxd0FuVys4eUZwSXA2eCthRFNRTWpmSDFLU0FqSVlCUDJSNVJCOAotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgOUtUeUFubGN2RUp3eGM4d1J3ejFaSXdaeWg4MnBu
+VVNmUE9VRzdUNThtYwpVazRGNS9GMytrOGdBSVJhcWJ3TDNDUWVOMHFBd216a3dB
+UkJmNmpSSkZNCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBFaUVFcE1aVnNrekwrZjdN
+L2ZYZ0JreGRRM3FkYnFzdlViVk0zajE3ZFVRCjA0OUlLczBmaEJMMC9EU0k1K1Vq
+Wmk4eC9wbXdvWG5UTlNMYlBiSTN2RVUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHdI
+RHY3U0VuekdYOS9FUVhBQlVtUlNQTDg1dEt3TnFzVzMwOTgyQktEeWsKRC9TUnJJ
+cytpaTRGMm5wcXFuSE5ReU9seGFUWlBSa2FxbHQ3eE9Idmc0YwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTmp6SnhHV09BbzczdmVoaCtnOFdYaHorNWpmSDQwVmtJVFFx
+Z2FTTnZWVQpnK0lTem9uTE9BZ3FqdVJ5YThmZ3o5RjlZNlhTUW5Zc1NsM2FBa1gx
+RGdFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyB4ME5DK1BQUVFLcU1tYVZadG9hRVlM
+WGFnd2lIVVNXSTNkZnhIaDNNSUY0CnpiUEZKeTVHTkFyYUdaeU4rWE54RmIxVjhC
+NVkvQURrY1N6b0doN3MrYXcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIFZraHhvbndT
+c085d1BFeXE5bGNWcitZaTBKdVduOGtPeVFRam1aWVpyQ3MKbE92VWFqVXF4dkZo
+dElDN0p5S0xXemplSzFWUlJaZ2M3Uzl4UlhmOHllUQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgbndmTFpuR3o5QzZsZzVBMzBnUlU5UGFoNFIrc1dYUmdCdHhYa1N6d2JG
+awo5amhkT0p3YytiRmFLc05GRU1hL3FMbEppd1Vpd0xCbXE2T0dLanpTQ1pnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBUQ3c1Rm52cjl6ZzhQNTQ5R2NEWTlWUlVNWVJ3
+VndHUmg4eWIzNERGZWxRCkNRZk43YWUvc05nYWtFYVlZNjBQbnNhK3RXTjZJMkU1
+OG1hcUtoUDQyUjAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIHJGTk5SYXlKZkx5cEVJ
+dUJQTVNkUWVkVCthU1c0eDMvbGJWN0dKU1dSeU0KYUVQMTFSNVNnZEFxV09UVHJm
+VDhMcElMZ2NRQWVKSXJITU53NlZwK2dPWQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+YVgyMDhXL0RsaEFxSUhGTVh6c1BUeFgrd0lMUDg3blk0a2pocVJMbVZnRQpBb1hJ
+c3pBOFRXMG9kTEt1Q1IvZW5GR0F6UTNLU3J6QmxGWGljT1pzb0NBCi0+IHN8OGhP
+LTVaLWdyZWFzZSBKcTpVVyAvQlZYawp6bHZOYWpabVJhN3BNVEpQbDRWbUh1c3BP
+UXlsSzJWdUdPMHpuWmF2QjNQd0ltUQotLS0gemVvbWt5LzErUlpmZXFxQmpMZFVq
+czhiSVBFQVBVVFo2Q2hiaXNWQ1Zwcwrm4hQtiHjacGXqxDf8QBf6AdsiCFad+cAu
+RA/fKJMnq8zc6NUDkvEAxrWxFLpLD9amqaxgh5889mWstPGaeCQEcWfjO7jl2jsM
+duZsH2rtqfsaoWI1tsUiVKGtgprkI1TBwbtFYQ/aC+1AzOP4rnmuu4T/kIDbP+rn
+SlILVnc458dAsDIUO0vYzNhy7z6oG0Nf6TnPehPocIakRXoLSN0d7fYmC5GDD+8m
+v0ucVjpVlyXCyOHbl6COgLmz0HglXaQba+K1ZFWJJXwB3Ej/wYaS6r5rChe9RKJJ
+tlCCDfOmUC1BgNH2PbPsaDwVmPe5itsAoJrzvq2mR5ho6kTX0dAPnu6A50G2TkTq
+7OtmvcjVarHKO5mRLSaGKgBnxcdI9MPvKdLKb79mBgmp7lWbKqOfQL8W+mfdxWjI
+F6DEPQ478W7QF5tIWYlHsDS4R7hKr7DPBxGLZEhKUYl6UJd8BietDQ+Pti19uoiC
+1qwFIGoKGteEsW5HHfvxdp1hdboVoOh/MzwpksNqMOZIhS2aAr2EKQsUBB5TLL+v
+JdEKGcLiRuxqa/6mVuEw2iqUfSBK+A==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2gitjosh.age b/common/secrets/secrets/nix2gitjosh.age
new file mode 100644
index 0000000..3abe011
--- /dev/null
+++ b/common/secrets/secrets/nix2gitjosh.age
@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBXQXoz
+bGYwc2NqNDBVYzVkeGxldnJxbjZ6elgxUmFoMFhuK0pvTTRLWkhBCmx4RUxONTYw
+VXZGZUtQcnFaRXhuODNQQjhCRmFtOG1TQzQ5Qk5ua0RNQ1UKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHgyQjZBUjVNMTV6cG9LNE5NSFBMc0xid01PQUEyeVd1ZnBEaUVM
+Rjh4bncKVHpqQ09XVk5od2F1MW1namloTUVMaEpuamlZcWIxRmsyRVIzV0RYZGxL
+awotPiBzc2gtZWQyNTUxOSBTcENqQlEgN2s0Zmx1YjEvMlIzdElmeTcycEpNcHNJ
+UUM4RzBaZWJEYTNUK29vOEdHMApkKy9SSk5PT3ZaQXQ1UGFCUFFvVE95V0tBZk5v
+UlR1M2tEYWtMK1hSU09JCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2YzQzQ1J1L1JG
+MXFjbzE5eUhnZDBjNTJGOEZwOGwzSmsyRUZhQzhtakFFCjVQYzM3VlpWR1I4THd3
+Ky8xOEd0UE1hVjRRS2RiVmUxbkpmdGxLR2RLcWcKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIG5ybjFTUEZ5OFhpUkpVdnZHNnZ1eWZGYnNQeFFvaVNoQ1pVaXJ0ZkNna0UK
+cUx6OWtid1FRaTRLMy9EaGk0K2NKWE00UC9Ec0FsUDJCODJzNG0yYXJPTQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgdG5DRTY0QzU4MjBXTnFWT0NiclJ5M0g3eG9HVm92
+M1RIdFdidm9hVlpsTQpFZEd6QVFjY3NLOWVXeDFTdXZPenc3L284bG12V3dIVzRB
+QUZ3ZmU0VldRCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBHQm9ObTBXWUh3YkRSb2VW
+ZGE0aGFYM3RkbURpYlRTL3NMek5kZEpwcXprCjFHL2JIMFRKVitiamRSM3dHNzlj
+ZENNZHFIOVdLS2ZOb29RU2FKd1NCWTQKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIG1z
+ZGpQQ1ZDSVdLVE1EVUFRVW9RZ0QwbVJPSUtIYTcveUdBaGIwb2oxbVUKZGRQcHNB
+WmJuN3B2VGVlUEJLem9ja25wSjlreXpCOEZUUnZnY3F5YXR1VQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTmtoYlhWL2YxZFFheEVCbWMzOFpwendzaFZsOEIvN3VzNjlZ
+cXNsUUduQQpacFI5ckx4TGZPRnp1RFM0SHJlS2hLMnU3NURJcWJKTEZscEpLVU5k
+MXVNCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyA4dFFyS1h2bWJFYXZFSkpaNGVkam55
+RXMzSW94NXZTVy8rRHBWOGl4NVFrCktPVWI3VUhWZGZtYlNaVm8xTHZiTk9FbWZ6
+OE5WYUhaTjAvQWFxWDdyQmMKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHZYT3dNK2cx
+UFpSV2dabnhIcW5HMlYzK2UzNEorQ3BaRTg3NVJwYVM3MlUKeVJqaE93N1lLdkg4
+UU9VaWRpeCtWQ2V1bmkwMkJvbE56U0lXcEhMVE81WQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgMzJUS0hEQjlNTUEveGxXdHZGVlY5ZjNrZTF1QWc4eEhiUmVsUWRBc1FV
+awpkYXgwL0E2cUNvQzRCQlVHQWM0djh5RVJ0SFl2R1p5ZzlEZ2lZV2trTit3Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSB5bDh3ZTBqWE5wNWdVczhsaXFJaXdEZXVBSzND
+ajN3WlRVcmp4dW1FN1dzCkxMN0wzV3BIdHRqYXhmSzlLWE0veWJHVlNBOWFncFZ1
+M0x0MWY1dmM5TlUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEpINTFDeUVTbCswN3F3
+QXp4eWMzTUdPTWFGeENOWWhkTTl3WnRIdk5sRDQKWk80VFJGTW5xdkwzMDdaSGFW
+ei9RTTg5SFFVRktFYUlPYjNOT1FQSklZRQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZVhldEpReS9jMDRzcXhrZVRhSGFCeWphQjBUU3JiUVVYZnc0d1FUNFUwYwpLenBY
+YXMxREFRRjZZTHBIUUwxQVplL3J2WGszNUhXSzhZL2hDNXUvUnI0Ci0+IFUtaS1n
+cmVhc2UgPnMjfCFtCjcwT2hGeVY3b0VBSTZIZkI2bEVSUzR0bzNQQUVjNkpYZTJl
+a2l5b3FNbmpQQ1F3ZTNDTUE5ZmNBbmhzZE1uam8Ka3BqWEtQVEIzOUFFQlV0TUl0
+QWgzU3QwdlRTWkdUWUNRRlB1Ci0tLSBaeUtEanlxcDV5Q0Uxa25hVnFiVW9KMTlw
+TElTNVdoWmxlWFNsMXFlY0VzCpnuSzzkIeZRg56GdBS2gOTaXV70O7kR/9F7deO5
+XJOWo7ES0V1Y3WqNHmCsWHiqHj/yKT3JYBPd5p8tPzW/uwO/4KKfqaG5xY3l01Uk
++zsFTkQh5xRP5vtQ5Q9ztTVV3hp4QLVsBLSwGHMiJyL2BGawLD5OsSehBQ26nU4x
+gmE2ZP8WWm2dCTGJBf/JQ7rl7+G54GRK6akWRCT+ZzL9OMA5u3dgyvE3w5Q04K34
+sY8WJIDaUm/Gr6JB3gHTfHaSsqx5NE69EZ2we4qdUW/ATeIa42NLPOYvShGzJdNO
+nWC1vemKsUUDR1KzfoZ6W5KM1Dl6f0IzC2e3gAztH0FtZO47is1Lx9jsbVN/FRh1
+aM2bk4LUfsH0CtVqRxEqVg1gXzB+ICe/K4xU8OB1g7uzTYS/rZc1KG2sHJ0fjXUV
+m0EdIMiJi4uTltakDrVGBKiNhQAz4V6t/kKkONvFg6wFoVzgm3kOxfRcryWfF0sc
+VDaa0kOnDFS/MuIsMENJ0XP5mTO/BQERY4m423nY7hH4Ud+kU9k8zQ3gdNIGwCEK
+1j0P61nlu6Y4lSO6UaNgr7xl
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2gpdPocket3.age b/common/secrets/secrets/nix2gpdPocket3.age
new file mode 100644
index 0000000..206918c
--- /dev/null
+++ b/common/secrets/secrets/nix2gpdPocket3.age
@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBGdVY4
+TnVkZlJ0elRhQkRSMnlXUjNNb3BQQmVBbmhYYVpqOUx5cE81TXpvCmNYUG5rTjlo
+RmpNQmFtZlBwWXY1eDVzOFh0T0F3d210QWRvOEZnN3VyK0EKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHd4TmdIeWdiTXk4QWwvdURNQ3NtUlpNZWpnT2hubUk1RTUvMFRG
+MUtEQnMKTEZBV1dPOXlQOTNSNVZVcXUweWZjc0RlQzFybE42Szl3WkJCOWszMHdN
+WQotPiBzc2gtZWQyNTUxOSBTcENqQlEgU0V5bUpxNTVNQXh1UU8xYmJLWEROTkRr
+UmtNOWQxbllTMW5BZzdNR1JpcwpCMExaYmpNbW5ma3N6SHBDR0lZdHljNDNlNHlM
+TTJrTnpKanIvYldhcU4wCi0+IHNzaC1lZDI1NTE5IEJZS0crdyB6UHBMWXNCZ3ds
+S1RQL25SdjVkRElKMjYzUXFKV3cyZFl5VlhvQ3ExeUQ0CkdGaGZrNGdZZ2ZsTUsy
+amVPVjhjMEg2ZkM1NnF0cTZFNGhFSGpYQzRNRWsKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIEN2bWhSc3AyWjlXWk80NTVpbkkvTllWbnJScS9XWjQ2RUd1OTkzMHRzZ2MK
+bzNETWVrVFdIQ0VvUEZSY0N4T2Nqd3c2WEZWS3JqZTAxaTZBaTlmOHpZQQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgQUsycFZocFZPdUxQM3MrU0o1OGE3Rjh3SFlNcXdo
+MExnb2hBbHdoTk13QQppenB5THpDV3VXRHdZYjJJc3dPUW9qcFBydUs4ZXA3Z1JO
+ckl1ZVJjNzdNCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSB1MzRNMUwxb1ZESWJrMVdv
+RkMzOGJHYnhnOFdHQ2Y3cjAyemI2bDJoRUIwClpnTys1eEFlNkZ3cStndjFyVFZF
+eExaQ0JDRlhGWDVyRFNPR3lBRUdITkUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEJB
+RkJ2QVZsWjdqQW1TeVpCS0tpSTFiZDVYOG5ybG5rMjg0SWVTRnlwd28KZnJMVE5C
+M1hkRHc2K3RCZFRjU1ZyeVR2YXhWT3ExNGVRNGRMU1NrYk50QQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgYmIwbXd5aXlFUUhJd1VORmxjb0hQWmRZb2lMZ2xBdXJaTmx5
+TEU2Y2wwbwpOZzNJQ2kwVUxBRVcrYjBOMWx2V0F0dWJCdnB3cXU5S2tnZmpQc25P
+NnZBCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBCU3QwNjdGYXE2RHZtNGtHTVdRbmsr
+QzgweFB6V0xyV0c1NldBeGR1UEVjCjBKN2pJT2FJeFZUNDFKRnJMOFBWRGRDa1JK
+UExOZkhwcW9WZWxqSGVwbkkKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIEE5TFYrV0wv
+MzlicXhsUHNoblUxa1FlSFlmMUhnYy90OXROUkIycWFFRTgKclNPSFdtVzF6Mml2
+KzJhK0hmWDIvUmFlSGVLQ3l5bElLY2N4aWxkNFU1MAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgOVkvd3dmV0hhUmwzQlFBOEs5a1hGUmMxRU5heFNaZWhGcDRYdTd4ZktW
+NAo1dGsyMUFlV29hOEt4R1l3S3Y4NndrbHVUR29sSkMvZ0R2SXM3TG9MQXI0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBTclIxdXQycVZlckR6aTZvSzJxY1ZmSVJWNk9j
+MWJBYkp0ZUtvNHR5Tnc0CitlQzZDUWw4M3JNSHVkQ2U3MTdtTFBGTmpLenR3SmRw
+NWFaNzFJSHZhYzAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDcyU0ZjeWREdFJrTEdk
+c2RGY3Q3cE0wdDh4SGRJUVAvSzR5WmFENWQvQzAKVTZraTduUVg2RHlEME9CcnVq
+MFpCbHBKVFNTOG1aUnNIWWJHUXg5T0k0UQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+YSsrbmdVOHplU29GTzNMNVh2aE5OaENXWHE3SlIxa1NuVHI0WEV1SG5sQQpuQWJP
+MnllQkFSMDd3S09DNXhxU0pEcEFGRzZabGkzTlM4ZXBNWlRkMU4wCi0+ICEtZ3Jl
+YXNlIHlEWmUtSzZeCm56bkR2UUV0OVJGNENzRWt0M0NQSG5acHdQazJFb1JFdGdq
+aG5Lb3BtTUF5QmtKaXV3YVJOTWpMdnRodUx3NkoKNmpkeGw1dlB1NmFpUk1RbFEw
+dwotLS0gc3lycXhWZXBmd0srSjhPTW1vMmN2REs4TWI0VUhiaEt6ays0akJQSkhs
+UQoyTVD7Gbo16BII9fA/kbWQA9cLwAIJC2eJldhHa1Z+/nCLTYoolHFvhDF1kNNU
+Q1VUi7Hwh3WfIZ5U9S8Bb1gtesAXrjAVoa07IuuELmY8P1aVnhO1Dh1E9bXhvjs7
+T9Qz5iA0R/IcMGzP1khAwda9urAqjtqjgNJOO9tOnKGOfCuUDhsPVqCZAfag4MeB
+A/UbjmKvQuoMLnx4r8AdZB6hEC6OvT0d26e1EzT7o4C4nXYk4+ocvNY2kp+9N8d6
+C5qxI5juVeZenESlAxQKqaih6wUI5Hb7vlbMM3LvQqmSdwspOCYvji34LTzE2Vl7
+fTb9us7PpueVWLfzF2ea19B2CNZR6VWJ8d2WNDSGhoq80H5k9fawhq/PzgB/CLzB
+dArCKrT7pL/L4oQVXuRC+2dKSmOm+hlrWHS1rwWEbgA7iQV8MR7eaHjUKEpRYC/W
+0oSyCsBNRTJrTQEZfknGgIK9dAKM2Mx1rw/1AbPrtcJe7aHI0R1wK+bSgXOrYgWX
+78V0+RseYYzyPgb6LUwkrA1MAsMp3NqQFts50DZ/x5ZBrKGWyEWO96Sg6oMCz+Gh
+2S5P02QBaoTSyuhHpg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2h001.age b/common/secrets/secrets/nix2h001.age
new file mode 100644
index 0000000..07148ef
--- /dev/null
+++ b/common/secrets/secrets/nix2h001.age
@@ -0,0 +1,48 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBqZkZV
+ZFlDOTkvSkM0NmFlOHlIak5KUkdEZnZJRnJOQ1hLc2pkc1pGODFvCm91Ulc3aEkv
+NTUzblR2ejRzM0I4TnoyYVlkQTk4d2RNSTRUVDJ5bzQwVnMKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDlwQlRHSS9Nd1VZV1BRRUVRRTdjWGdKQ1hiRitPMi9KcW1JMEts
+eWpnVFEKZ0thUVhWbDZxSHY1eFQ3OHl1R2JzRDFRbkpnMkVQRGhUYi9oa2luaEtx
+MAotPiBzc2gtZWQyNTUxOSBTcENqQlEgWTA4bTNxL3E2Q0h5MWhnN0x1a1N2NWRI
+K0JteUdIVTY4dlhtc1JYQ0pFTQp1Y05ob2hRcVNhbzJpSE5ReE1hN3BlTEsvdUtJ
+STVRdlZCWW8vQWhOblhjCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBRYk42V20xZS84
+WGd5NWs0d3ZmcVdKNWU2NlBrVjM0OEdXRHlVaWRORlRzCjBZQ3JaOVFYazVDeHBa
+RVhieEZJRkY2KzRSZy9LOU50VGFiRWtsV1FyUUEKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIE5JNWQ3SHkzcXpGZEZVRVRZZC9GRVRvWDVvNHZkbGpEMTIzUjdNME9YMEEK
+UytTTVlUUUhjaGpVZ1lYV0ZETk04elYwZ1FUdGVlMURGV3JwM01qK1M2bwotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgRkNvUjEzdVRvbUxyMGQvQXlTU1NTM1NWd2tMdW01
+RE1zd1ppRGt6QndoTQpJckl2VitBR2poRHhmV3RWSXN6amg2aFkvcTd3aTRIRkxU
+SFBMSkVERG9JCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBFcStmN29VTG1jTEtiMTho
+V0hJUWFxemRrNnJxL0I0T296bmlvQmt4eEdvCkR0MFFORzExZlhDVXpYT0VlQ2xY
+SklsRkFMVDJzQkpPemQwa3NOYUg3VVEKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIDdF
+YXNFY1F5MElweVhtQjdkQTAxYWo5Zkp5R1VoQ2s4dkhnUmRwV3R3eVkKQlZ4dTNS
+QVlkR2FnR0pyQTlhSWRQNWtnT0dCbTE2YThiZWV5UGdUNFc0MAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgT3luM1VmQm9tSG5majdWeEh6ODBLSm56ZFpSTUVmYzY4K1M3
+RSt3cGMwcwpLUWpGREU3dFc2NFFtNVZGSDIzem0xZGF0aXVhUHFhUEIzWGMzUDFT
+L3I0Ci0+IHNzaC1lZDI1NTE5IDVhZHFNZyBwUml2WFlKSFdnWWw0YXczS3hvZ1dH
+d1BLYWNpL1plYXhldDg4d1BHYjJRClZzNkx4S0ZYY1MzeU1aU3d0TlBhcHVvNlJn
+NDN0Q0wvTCs5eS8zTnFaK0kKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIDAzRk83R0Zw
+ckFzZjNuSHRpQjA2cEsvTnRKdDBRT3hTK1krWTA1Ykh0WDgKWjlEN0NlYjYwb2NH
+RzU2N1lzWjI3eTlCSXgyZUIrY2UxUzdwRVY1a3FVOAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgYmNEaW9ESGVaS21NQWlITmMrbWQrekxQZXI5SExYbE94ZFhNcWtxSzd4
+OApkMzVTSHBSR1BLS25vaFUyaXZQZHE1cDhrTmZENGZNTElINUxwUzNONzdnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBqRXVCUEdEY21xblVXV25sTW5FTkxMTTJPL2pt
+U0VDV3hZRC83TVVnelRNCmZXRnYzS2NqcDNIV1k1WHFOVy92aURVVStDQU50VmZl
+T3lSZTNveWpNVEkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFc2c2lrVWZpbCtXS1Jr
+TFI2RFRYM1BNWEJjeFUzclpXTUF2OGE3MmFNSHcKV0dHQngwRE14VlZRdDJqTHhQ
+dTMyL0JMN3VRWlNRTVZka3VuelF3QW92cwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+d3JwUyszcTl6TU1XVHA0d2RNb3VPa2I1ZzFqdzJyR0ZTTTIzNi9VcnJqQQp5VHVh
+TTBjWXgvb0daeWN0Ty9DTytRMkVES1hBR3M5YWdEanlYdDJSdU8wCi0+IF99LWdy
+ZWFzZQpnZHBVTGZvYm1sWk85SzVOV3FOZkZtM3NKNlFLdUxDRkxBTQotLS0ga2JS
+NGc3N3o1YjBOeEl0L3NVZVprNDA3VFpJdmt4eW0yYnJ4VWdkdXBoRQqosYCeWC24
+SETTy8dVYTN0kWZBhYxUQDb6mhHPZrLOmlNyDeambLNwpoGHGpxUy1vrYL5cOmBA
+pZ4lLKvAvm+lj7FCqX7+uhQi5FohVTm9bz1IsJcId82yf6lLjc4p7M+ww6icM0vH
+DHHsZ2ecQiJKOvf8BUGgAxBkkdy0MWVRAAtOAqadBRtaGB5902FOI0gWLyAyFqlk
++P/pHRfob8PlnWb7MTYsUVgIBtbV/hIcpSx7BIsPTsdr7yFirhfoC4giBMT//2Mz
+e7NGN2bX93pAUPWK2P/k3geArT1zJoFeyOpkyIhnfeXaA8WKb5juA/Rly4aGUJO0
+oQKJkNGg3DPQMAEwwaijjuz19wd3o46o5la+2L/Yx2fCPDcwOyYzh8wVdc2eq6Ab
+y3y1wlFfMLpsuBSENnCQTPCWimTOk2lPUKEjDtLXCtucwyd/fzjHCjF1iR5twVrw
+id5+60bFV73v2QsQ6+qnNRj2Ea+LRHA48NtQH4Nedv8xlhgqkR0tD8mZc6Xo65MT
+1Lj9suIPCf5L/j7GiX4MPDt/uptHJEckGMEo0rrwINBps7K7XrQLfw==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2h002.age b/common/secrets/secrets/nix2h002.age
new file mode 100644
index 0000000..c69d953
--- /dev/null
+++ b/common/secrets/secrets/nix2h002.age
@@ -0,0 +1,48 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBLNmRV
+NlNNT0Y0cTZVY083b2U3K0tORkdxR0IxNExrL2EzWmM4a2hoUkF3CmlDWmVaY2tV
+OVVrYTBXeHpIM1lkOVBPeG9qOW0vL0hmSlM5OTVjcFVNUEkKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIEJJcGRpcnlSRGFtNzFlUWt2OGpxTUI1WG9zdzRZakpwUjkybW1J
+MkdhaDQKNEMrT0VVSnZKYzZscWNBdkQzbXBsc0liYzI5bVBkZC84NnZKYzBtVEZ1
+TQotPiBzc2gtZWQyNTUxOSBTcENqQlEgR0tSZVk3M0hBd3djZklhVmdOQk5lcXpm
+d2NoL2RrVk0xLzNxRWVIWU9YdwpXQk0yQStOY1JFNjF0ZWhkS1gyWGRhTXpkUGdI
+RGlOZlBLMnFaMGVVSjMwCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBBZDluVnlKQ2FV
+NFBpZDZJQmorYXVsV2lHMTdLRkVjSjZPNHhCUk5iSVV3CjdIU1RaaEpocDF5MHNj
+blFVdGJjR2hwczNOZmpZdElXSURLd3hpQ0xvQncKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRICtWcXVMLzdGOE5xajlBaWdoMk5lL1J0U3JCL1dZQmxnOFpsK0Z2ZzFvbjQK
+ekFWSVgxdjZjQlkxMTlCYnNPMWN4MW1YY0xSZFltSk83RXkyUmZBakZjNAotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgZDByMm1IanR4ZE5EUExyTnNNVVN1RTdTV1BJak9E
+TmZYbEZOSHNZbFBDRQo5YTZjcVBrbTExazV1a3ppQ1Y1NUZhUUNqWWhLaTR3NkVx
+YlpzR2xNVWQ0Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBNMEt4UFIwb21GOHk2c25j
+a0hpMkRQVGhCM2NFWmNlWXA4SElZUlQ1TlY0Cm9CVVBDQ21PbU1Fd2ZCclduMjdq
+aXNuZS9lN0dicElXckxhZmxpRjJDL3cKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHA3
+aTJ5VUJROE1PZXlGZjF6R2J1OVBDUWF0N09TNmRkZ0x0YStxK2ZTU1EKWDBkK3FF
+c1FCSHZvZW5YMHBVSis5N1pRTW83bnpQZGY3dTlOOGNJT011ZwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgNFhxRTdZNm9OUm1zOGpadi9jckxOMnRhbzUwL09SLy9JRncy
+TTlzWUVuTQpVdUFtWTZhRStkN1F0cEh5bU84YW45YmxtYzlXR2NOdTY4bHRZZWs0
+RjlJCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBXdWo2c3pPY3hmRmp5Z1FFdERUUzcz
+MXRRNjI0ZVlLUzArRFhodS9FNDFNClZyREpwb1IxdG14TFFSVHlkTFNVOVlzS3kx
+M2FpSkhReXljSytVczR5MHcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIGdIeFpXODY1
+QkM3QkNkMllnWXFyTlBpYjd2SkI5TlNoT1ZxSldCN2xGeUEKaU9XSkQ4Tm56Tk9B
+Y1l3OGozSVk4M2ZFejdwR29Sb0NsQ0xrMmZzai9DawotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgUXVkZUJhbEJ1ZnFKSWRaVUIyK2JCcC9PbDZjQ2VlTURWMzBOM1loV2hV
+dwo3OFVtR1JldEwwSjE5NGJKUEVyYlBzTmJIYzBYSCsyWWU2TnRwaEZLeWM0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSAwTkpuekFzUHZmWFdRSjRnY3YweTlWYlRjOW1U
+a1hXRXFPakRNUzdxVWxJCnhIYU8rUGh4dy9HMGUrVi9aaU5uL3djU2JrYktaaTZI
+QVlMc1VyaTUxTjQKLT4gc3NoLWVkMjU1MTkga0hrMmdBIERkVmp6eDBvZ2dXdURq
+WlNwZjJMN3FLVXJEa2taYWJjbVlLVXBsbkl1MjgKdUhtQ1RFS2Z6U2t1M1MraWo3
+VWFCZERRZXJPTjBNS1FkdFZtdnQ5T0pBUQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+TUpKaThiUVJWUEF4aHZQMXpkdER3TzY3cWxWV1BEbEd2TVRkT2Y2MitqYwpsbDU4
+U05mN0xmY3pkNWtiRTBPSVgyUUhBTTA5cDc1aFJEUDBjU2owd0VvCi0+IHAtZ3Jl
+YXNlIGxgcisvJiUgXWVsIHZrIE4KCi0tLSAvREZvRE9zUlRIOHZpYUVWZ0pyQmlh
+K2ZubG02bjRjdmxBcVdLVENIejlVCtydnNICLzNyabsA6H8fhwkySlITewQ0vFBQ
+GvfvDobgKzac8kmjDDwiIBwRI+EgVznSecv+Oqi2sJaodIxGaYgvEh+FURMfYOPX
+K95ykf+R4bAowyG66i+mg9vthJU2O4v43R4qN4+0CVrArqhQp+ywNERsTV/2pU3f
+bTFAYaLaLihEFDjCy9+p/D5l33Ns54FYAtBtQ/Ut4VY43i9inE/qohM6vy1W1SgY
+THW3pLHvB6WlZvv4uD+IXK7GJXkedKxIuH0pGWLTF28aIlWTV8QYlCYpqpqaYs4X
+87oze8zgPCNa2xODkQnYUI0GX4Fg3vP1K6R4G4DtCOytZdDYXncEIC4+opOoNmfg
+xuhjELH+eZLXXRRd8PPrPTWXQ9CjPOK20vwc2To3Oljt940di6+886j2vFEBd44v
+A1cjFG+K4mQ9GvdAk98EgRVXasmXyKnRdc7kFym9EY7guZtoA0Bav7YCn2vMwF7G
+yLmxss4Wa7UA9v3GF270M/fb6D5u9qcDG7v41wYSldfaqSDs0Vw1ZfaGBYAXF5v7
+GgU0MSWaFyHej5xq5UVTlMtWh2YR
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2h003.age b/common/secrets/secrets/nix2h003.age
new file mode 100644
index 0000000..01a858b
--- /dev/null
+++ b/common/secrets/secrets/nix2h003.age
@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USA0dTdj
+TDY2STIxTm8rbnNWS2J2VlZxcVRFYzdBRElDT2RUR1pRd2piaDFZCnl2d0xoUmg3
+OEs2bXNUY29RQWJ2WG9GMXIzZCsvcHRRUDFvRFl2elR0a28KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIFJsbjBZbFhEanBaSW1BOXBwbVQ5eUtHSDRQRzJleTBGc3BlY0dv
+VzljVk0KZEg2M09TNVlvYXAxaEFaUlpkLzljZXVQUE53aEVLQlZXbVBpdEM2b1Za
+VQotPiBzc2gtZWQyNTUxOSBTcENqQlEgLzQ0MVpLWXMvSXkwTnk2VWFrQWNtdVJj
+bURKUzMrMmRqeW9TcTF4V3FtdwpVQmducWt2dkVPQklma3h0QVkwZk11cW9SMkxa
+Ykp6amg4RWUrZEpFb3NBCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBDNjhjTlovT1J2
+QXFPOVZrQ1ZFWUV2cnF0eFdTR3g0M3VFd0dvU2hVNEFRCjdzR2hZR1pKUkpJL3Uv
+VEdPNzE4TGtWRVpZeEROZGFNMXRtc2pFYTJoMEEKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGlhUGZSUVhtSDBuaTF4a2pCbFNqUk8wN1NGT1cvbkVqUmk0cEVCTkhoa2MK
+OGZGdlZBLzJCOG0rN09BQlFlTm41NVh1VEdZWFRjVTVMeFBRMXB5dktUZwotPiBz
+c2gtZWQyNTUxOSBSNSt4Zncgc3EwWEY0dmZPT2ZnUlN4Sk83WkE1c0FldGhYclFK
+T092dm9rQjY3TEh6UQpFQlFTdXBJWVY3aUx6Y3lKVDBGQ3ZHbVJqMm16R243Z3VU
+T2lHWVdNMTk0Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBuUTNLUGIwMzhKcVVyeUNG
+NmJ1WkRtdS9FWHQvTGROL2ZiUmxmVlBIQWtZCjZJMUduWVNQMXVZRk1CbjhCTnFX
+RkxoaTJuelV2bW01T0hiTHgvNTVZc0EKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEl1
+SnJKZ1Bwb0lsN1dTZ1I4YVN0c0NaUDVEd2c4SjNTRkw1d0ZpaTF0RHcKTzBabFNx
+d0ZjTjNoemY1UzVBemd6QzNIQTl3b0N2WVdWUE9CV1VzcVVtcwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgbGI0MjhMbDFZblFud0U0Qi9ibHhSMlJTa0cyRHFJNW1tcnZQ
+ZUNma0VoTQpuNG5ra2hwRlpneWxkTEgzQWlhMkRJVUMxR1RVZWZXWGloUEtkcWdI
+RlFFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyAwNHF6Zmt5YXViL3o2aVVKVTNSakVX
+eFpuSHN5Ty90bGI5K0l5VFVtL1NvClBsa2tRMm1QSVlBNmJ6T2JlT0V5cFNmV1c4
+Tm5nL1NiOWtGWm95VE1Ya0UKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIGFwdWhWNnBQ
+N1lYeC82NzNHZ2d3TzBzUTcrcm0wWGNPdEc1cUtndTZRM1EKTmxadlp6WC9BQzhJ
+S2NIbjM4OHNpUGJiZkhOSXJDSitiNndOYm5VWDlCcwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgUTFOZUtZSFJRUkw0eE9wd1ZCcXd6Z2RvUFVsUnZBcWlSRXlHU0lWcVpH
+TQo0ZUszNFF0NUdib1BpZ1FnM0hBUjFsMHdSTE1ma01OUHRIWXFUMmJRbWRRCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBocFJ1aGpicCtUTjR5dEw3RTNya1dINTN1emZl
+OVF4Ykd2SmMyNUNqUlJNCkV2ekVCNk1uNEZiTlJYVDVsREQ2cCtRR3pVRVZZek12
+aTlLelNZOVVXZG8KLT4gc3NoLWVkMjU1MTkga0hrMmdBIC9aT0pJSEZiMTA4c0Vi
+dExPN0ZtT1BOY2ltNk95TzB2K0J6WEJaTUJ6bG8KdWo1OFpTWm1JWkRrWmhYUzRl
+TUFJTHp5Mk9hVXZSNXFHM09IZHZOblpqQQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZUpiN0RMRUhKM1ZvRWJQYVNCVzROckZ4SDY3NU4xb1djcUgyQW9xRnkzbwpOZ2Fu
+dXNnTERuOHFoVVZGMUhpb2N3MDhRK29NVjhuRFhyZTdjL0orQXZvCi0+IDtXeHd7
+YFBpLWdyZWFzZSB7PCBcfkRZey4gI1d4Tn4gXwpIVDhGeFk2K3dOUkhBWkU3SnRP
+THVSUXBWTVJBSlZVWERqL1F6NjFYQUJHZitiWXJhYjFHS3lmd1dDVW4rWDZRCmxC
+bmt3NTUvZ0dScGFUaFJ0dwotLS0gTTRUejRxU2ZKZVN4MXkrSG52dHJzamxpdjBC
+aWo0a0lmS0xWeStFN1UzTQrI0E7L65ZYdi9LJwZ3nSgT7WwwQJovYBqw7YO8jE+n
+1iAUsxo+nj7V7ub7D6IxBaXupMwqqEGX/fUgLyHrckL8V6RmVfvoJROp1Vm7HncW
+xqoFr1cj3n6p+O+xQPFy+1uVSktCTvLgHDNHavRPaoT6vP2FcvQkI7jczbGJel55
+YBA6bLrMLsn1+MmY5oT61huymRbKFyt3c7+u/vqYwD9/J4/KPW7nO0hCQ8LBJEm4
+KFwj/6d8zyLFGRB+wwH3pEPFWZ17/7tK4xRR3jUw3ertMKnLtpYpI7sCOhCStH5G
+6CTMGgmWOyPmccVfWF3RSnuj5I53nnkYktWcc3o+ak8GCw8PBJvAfkAJyNjrSo6V
+QTMX9qsrL8SydAXXFk2lNcv3maH6RgRB9ycPGak/ZsrFP0VkMFpOLIfqjJMnfChY
+CUi2b1iTMlmw9VITSfgh82mue+bcevSaP6KboeksBq2ah8hSN80WPtb7VQNUNl/u
+cQT5DoyvaIxOstiVpBy7DY4pvb6c5iWkUuuDiHrn0AA4XB2skTNhGU1oty0YrDFB
+tnRtsOYgu5d/53Fcd8aUNg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2joe.age b/common/secrets/secrets/nix2joe.age
new file mode 100644
index 0000000..befdff7
--- /dev/null
+++ b/common/secrets/secrets/nix2joe.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBrRFlo
+VzhEcDJmTStuQUxxcms4am9idGpZYm5HVndISDlDMzVVVGl1ejJBCldYZllDcGEx
+QVl6NU1vVjBPQXpLTndDdUZIRWJmMC8vRWhjOTRDUm5yTUUKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHl3SGo5eEdyRWlYSmVZaWhJNEt0VWRiY29IN3AyeGdYQWtuKzRL
+NzJrVUEKaGdSelBON1JrbUZGVnJUL2RwZzZVWWJxVUkxUmVrVHdTcno1aWYvbGwv
+cwotPiBzc2gtZWQyNTUxOSBTcENqQlEgQU5Ia294NGsweUI2NUs1S3VZaVVEWUtZ
+d1l6WGdPcnBmck81UGQ1Kyt4QQpwUG5iaFVUNG43a3A3M1FvUjZGd3ZtZzMrTUFm
+amUzcHI4Smp0OXdpdWJVCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBFRkd4U2hvcGRk
+ZjhleWdheUtqVjBRMXdwZ01KY3cyck5tOCtBaXlBc1ZBCjNvUURFdEFpZ0VteCti
+Z2t3SlhRbWMxakRHbFlPMU5HZDlOV2R5d3pWdHMKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIFVZRlYzSU9FZUpoMnp6dVJPR21Zam96R1NQOXJQSldXOHNGYkZnR3ZxaGMK
+eEJvbzFKY1R3WTJVaTN1c1hnTWJ3ZU5OZjlZR1kxMXd5bmJYNDRBSWNqVQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgUHBaY3ZaVjcvZXMxLzRiUisxMnNwV2hlM3NxR05Q
+aE4rQjJ5ZDl2eDcwVQpUM1NKNHg2UmtPeFhGbkxTUlFtTFJ5bjNSZVNEWmVKaHg0
+cWpmT1VZZFZnCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBKZnF6enhLS3BzUis2azFK
+VlFDVTZTRTQ0czdNclBGYzROUEJHYlpod1gwCkpMb2hSRHVFTzVTZ1dmM1Fid2tl
+bkhrK1dMdmxZSWxhMFBFM0wvZ2tuTW8KLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEov
+MGpzVlFwSi9RUDlQSmNCRXRqaGNpSHFwa1o5emdOcmY5UFREejdtencKVHE3OGlT
+NnQxL0xJdTdYTnJQRTl1bjJNZDJ2MVdnWHlzb0pZS3JvYW1GbwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgVVVrQ2ZJdnY0WHRrdFBidDh6ZGxCQThjMk1DcG1UZ1hhMiti
+WENKclB6dwpCZHRhU2NWZTFQYUFWYUxCUlBUenZPVDdQa3pXaVE3ZUdSNm91MWxB
+SGZFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyB3QnVtWjlsOHJvVmltSkdVY0wwcmhk
+S2prNGg5UE0ydWdSck4vMFY2cFdzCnAvOUR6VWtEOXd3OE16ZVROMEJraXVTZHV4
+OFdmQlRXcStLa1l1eE5yR1UKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIE9NbklVa3V4
+aU5ubnk4WUJyRTdXRmIxT2YwODJQOWZ2eFdYUHphSGlwWFkKT2ZWWWF6eGc5YXJy
+NWNqNE4yVXc3MFA3eVJQbDd2Zm1FUkF3M25LT0FGRQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgNEZaNzVhZlVrS2FXTlRXZUZMcWhwNnVORGJKYmErQ2FIRDl2b2wvNDB4
+OAp3NWdNcjVXb2RLczJGdGpyaFo4bTVLMGk5QWNQbkJpMjh5U09kbENVS05VCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSAwbXFvZWVaTEp4eUkxVGkvcWpZbmRnWGdjeXdW
+QzgvbzBnbU5KWE5Ba1cwCkxUNnkwTkFFdHpuRlovWjh0RVE3U3pIc0tVcXY3RTc0
+NjRaRnE0YXp4NDgKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGtraTV0YWxFVDVkb1pE
+NHpVQ2h6VGh3LzVRTG02cVdGRHpmak4rT2h6QWMKS0N0SFpyY3lhYlZxc1NQbkZW
+VkVvQlAwejF4aUpnZmY2RnlHNDhQVHhXcwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+dytPUnI3MW1TckplUDZWRUZrUVN0aXhtSG1OeWkrcEIvVitxOGR1UHdFNApxaVFP
+cVNrV2YxNGZQalZ1aTZLbjFYM1hWRkpFM2xhRlZTN3VNNFlaR09JCi0+IFEtZ3Jl
+YXNlIEVPUgo1b3AzSWtZdkdwWEM0bVM2cU8rdTkxMFpTV3BZUGgzQ1NwWlJ1UXMr
+dVIyMktqZjBRSzlrQkh2V1dGM3NoUQotLS0gSW9aS2RLNzZMQXlVakF1WDNzNWl3
+VEpQSVVWVVZkQU1FZjBaNHFxdmFzSQoHZa1y31EyfxcF5zL9Tp0efLfm1Ak/v9N3
+IqCds1BYhPDeCECA1zHdGZojhrxFuOyr1H/uSKuksPktfi0K7F73NsQ8Prf3hiVg
+C5Ckh540/7lv8Y+f6eOSlbUUHkO/UftqyPqPwl+L3cHApoSN5OZJz+nVgJROQMBY
+63lxHjw170/E1BNsf2jqdHHJUwyFd7hia212PqCQOyh0wbc+6E0t/9gDQXphBxC2
+/EpwLgBf0b8+nzGVZ0RP3wkegZyl2LYwkh+PLhRTTJOulE664eaJBFRpW/wfw1el
+QaoEHw52O92IE6KbM7lQ2ujmHYG2aKBf/u16DfkDBrHSplz9bolcueppa7ubLgfU
+mEacucUtRN2k+kA8S0UVZDsbo2oQfQL+fgq6Hcx1shpIFpugyhDMMHDD90cvAs8w
+Keg8jHbTEtVJAtBmLYraeyGXsla1vPCcoXfHr49ej3Q4B7pMmReMtMEP/BDKy6pK
+csPW/lebooacQpu1fjVyYyW/AgJHa0U6oZTr5i65FNYd0nQa07D3bYO3o7JUFZoB
+Ah7b2Pj3Wv5Uzxka0R13xtr0Ud7jqw==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2l002.age b/common/secrets/secrets/nix2l002.age
new file mode 100644
index 0000000..0866e44
--- /dev/null
+++ b/common/secrets/secrets/nix2l002.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBPODJ1
+Q2VxRFlMeUcrS0V0ZEhGdlRnRE92TDA4aXUwdDVKYUhBaG11R1NVClRUNnlJd1ow
+MkliL08zZE12bHRyaFZuQkszMU1nL2pxT3hIWWlObW5IUE0KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDUzVXpLblJLZmY2UHJnQ1FIV25WRjJEWEYva2RjRUFNbkU2TkIw
+Mk9hUTQKK2pMSytja2ppbE1Vb3hYVWhNMG1wUW1lNjRGMGpseVVpeUV4dkY1eTA4
+NAotPiBzc2gtZWQyNTUxOSBTcENqQlEgWmV5NW1rVGk0Y0VBTFJ1bEpGbVFqdEp3
+ZVhyWkpaWm1uUHl0L2N4WStRYwo5WE5LYnUrTldDMGQrbDhtTEl3cmZGT21FNkZt
+NmJ6eVBGeG5ZUjhCZE5BCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBVcWZqVVl5VDBP
+azJjL0p4VEJnTzJrdkRZdXNSRGpIdXM3ZWttWkluMlc4ClJOV0xTOU9PeHhMeWpD
+a0twcCtxYklUSjF1R2NseFF3NDk5eFI1Z2Z3Y1UKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGhONk1uMk5xRVdFUGZhNkpHUWhMUTN5bkkxdzNTRExqOGlGZzdOZzk5U3cK
+NzJVSFppeGpGSWdob3ArTDhpcEhNSmVNMm8xcXRUS1crN0FubTR0T1BnTQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgcmZ4MzRQQW03MWpwK2EzYUtaL3pPQmhhVzVBK1U4
+K3lOSDhNSzJreUwzWQpKN3BYSUg1ZmZQMEFyMUJRUU53bDJGZ0ovd0hoRWFOdEpK
+WVJUOGErZkFzCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBSblVTemNRb3M1T25yYlhS
+M3dLQ0oxZmhLQ1Nldkc5NVY4bDVMcWpPaEc0ClFDalVaZzMzUGxNN0x1eEJRUklQ
+aWwybzJhNmJNNkJBSkp0WVd4WGxEZEUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHUv
+ZWdmZ1RUZWZIckkzVENjblk4a0lVbVRzL3lDOFZhQk15SnU3REJwaDQKQVNncVdL
+R01RM2FQekJXcHdYb084SzRRVGcrcVdMMmIrWXozM1BXcFdJRQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgeGhtdkMyTUQza2t2Y2ZGbmRNbXhFSmt6MGNNTWVGV2xGKzhN
+bzB6REhrWQpIUTNPanVNZXQzMHlWQUduZUMzdk51bnNqM3Raem9pRG9iR1FRRzBm
+aTIwCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBJaUM0QkV3M2R1czdwYy94VWlyb1Jr
+eUUxRU5zWU9tUGN5R2lMdk4rUFMwCk1ZMkJ1NW1abXRicjRkcE9CUmRqVFRjRlFv
+d2hHYmVKNTVYc090ditMYTAKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIEpFYTNQSDk5
+Y2JXL29YaTExc1ZiWkFKZUdFcDBjd1p0NWh0bkVXSk41aTgKRmZuWHRuNnpqUFNp
+OFVZeVhDeXJMbUxuWnBvQVE2R2NwOXFQYXNnOUFsSQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgNmlsV251TVpneWttdGVKVldSbzg3RE9ablQ3ZDhSZE9Sc3Q0VDRUc0Vp
+VQpXZ282cnFmczRvb1Q5cWtrd2NsdXBlejFMSUJwK2Z3Zmd6NEpNNUxJMDBJCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBLOTNlbFFPdVBMbElNcUtaVGVtVHFjTGJHQlFz
+NUdDYnRsbGJEbWVsdURRClVnWnpuT2dhUDV6dVp0d0FoT0gxcXR3cVJDL2d3Mm5G
+dzArWjhsczd2QVUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFIvZGVGTmJ2TmJxR2Vm
+b05RMy8za0liMGRLQU5XR25DNmladkgwd091Z00KTElBRTF4N29pbHVHYzAydVgv
+TU5BRlVJeW93NVFtZEkyK1puUnBEVUJhVQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZU5EY2kyZWVVWDdEZDdZSUIxQ2lneWJrL1g4Ry9NcWwzOXo2ck9nam1WYwpRWlMw
+SEhMR2VHMWNyS01TV0RQSGJiZzNjWXRRYTc2U2w0QnhpbFZzS0pFCi0+IFBBQC1n
+cmVhc2UgXU0neTEgXkd1TDhHLHwgWEc+ICExVwpSanE3MWgrYWtEQ3JYbm9POE92
+cVVLK1pBaEdGTnVBMQotLS0gQk5Ud2dJZHRzN0RZTTlZLzdvTVp6c0pEejFBZU9l
+bnA2Q3hGcmVOT3NnZwopOnc+QlhQ9rs4u1VZzBGuVT1C/M1+of1PrkVrG9FspsTv
+k9M3NSrz1aCMHSgX+YdH59xr56PqsRjP6nok8+2XMMs04g/sfbQsBG6GIy0l2ke9
++RgoIQ/7yBY6HhcSfBK8OGHsBTypj2iWsXmHji+JJHgXelLBQxPhiPh721Y+aR/g
+6dhgaSkeiztKbzuXX8Y4idAx22vln+a9IhCeh9ObUucxXoQ7PsJXJqPFr4tqJfWe
+R2wluD3RtZxzbkvKcmiVvgJt2pRRoMPC5tn6Se2Hl08fDoTR9Z24wK5igtu0+rBp
+tALfNh62Nl2U1s4Ukd+5eH28vC1QEz9UqnTNvi7o+1usmLsMIjwagEgfUB+yzaT+
+8VJDj4Y4xfI5WdgbWe9A9JFk4ve8Xmqkkg8zlaveEg/wSMDbiZP5NV20xHDIr6kP
+yrctn77Vohff0iYL4Fm38FgJfODFCLsHYOok3OgGGySLdTZcYZ69yJjlDm5m47ea
+vz2zRL4m9MxS4vE9eR04T5G+isZnLZJP/T6SImvSKHKNpeXLSFbycRLYJkf0jNCS
+g1ym3Ql3lTyozQVBCg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2linode.age b/common/secrets/secrets/nix2linode.age
new file mode 100644
index 0000000..21529d3
--- /dev/null
+++ b/common/secrets/secrets/nix2linode.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USB1ak9y
+UTJwcVZCbmd4d1RPaWw5MDd3TTc5WU96MVptcVYyQVIwMzJDMGhzCkUrV1JQMlc5
+SnNxUm9UY3V2Tm0rVDV5ZTFLeEdYcG9qZWc3M013RjVpVTQKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDJBK09UZk9jOEFPL3NXRmFaOTJjM2FlalRaSEhESlFSZjBmN1hr
+RUNoQmMKcXRlMGFnOXpCWjMvTGRLd0FmcDlQSmF1TUhXdXcrNXRIcUh5dEZqbDlz
+OAotPiBzc2gtZWQyNTUxOSBTcENqQlEgSnphbHkzZjU1V3VzTzF6K1ZkcVNvcmp1
+VkxhWDZPTHp5bmlxWGVTOHp5SQowZXc0OS8vOHYreEJXbVZudUtKVVQzR3cxT3RC
+RlpJNVFKN09kcmFtaTVFCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA1RzdxQjVqZG5G
+UWtlUXpnT1FsODhaQlcwclFvZGZmb1pJY3MyRWtuZG5jCjI2QXFGMEFRVzR5MlF5
+QmNXbHQrOG8zbWpCU2FWVEhKNkhuT2JtNko2REEKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIHB3bXM1TVNBUmt2VFJPSEhzZjBZQVdVcFVNM3k5Y1ZCTmVtTHpObXZablUK
+RVllREl1eGNJUmIwZkhtUy9JeEo3VHpWRFFGNG5QbTZNdzN5bGpWeXlwSQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgVmVqYUdWVFdYbThTUFIrZThYOWI1cGNFWTJnT2NS
+RHBzbnArbkM2YXVqbwpzSEowTi9oU3dnOTY2R29GODRpU2piRWFUSXFBcjlXanlR
+SlNZaEFCaWFvCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBFRGd1TWViVFRHQlhEd1NY
+RC9DRXJxUE5VazhkUHkvQWRLT3lrY0xaOUFzCndNUk1USXJ4eUtLQ3hjOEtLaXBJ
+emhmRjJFT2xreGRtWjlZaVo5ZjRLYTQKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIGZ5
+VUQwRlVnUTZFcXZ6ckFvQUhRZzJFMVB3dS9RT0ZOWm4wSEJGVExaWFUKYlFzSHNs
+VUhZTWJjb3doQ1hQTU5tRWQrTWhjR2E2cVlLUWltZGhaWWM1RQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgK0I3MS80aC9MV1ZYZUkwMGk4VjV4Tml5OG5Na3dyS1JWM1V0
+a2FUaWhVZwpKSGJJY0RwaW5lYzUxc0dWaTlxdFBwV2o0c2lQWnFlQng4Tlp1bWtn
+OWhBCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBRVXJYMmp1d0RXNFlPWno4d3pDVUVD
+Vmt0YmhyQy9Zdk1QdmdweTlaVlFRCkEyVmttUjhZSDBaYk53ci9UbERiaDhyRGR3
+V2lpcFJBK3crTFZlVnBvNTAKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIGFiQ1E3bGlr
+bDVXMTNyVzVwNHdwQ2hnVi9Ld20wSnczeXZ4WVJ6MlZnQkEKOGlTUVVBZkVCOWg0
+N0tFTlNxZXFqaUJEellpRVlZM0JyaUZNUWV5dTRCRQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgSFhTUEx0N3FIVzAyYy9rRkZ2OUZBYWVQcmhnYWU3N1J0V2pEZktVQTIz
+cwpoZzhPRThka2JoY254VEZFeVFaN2RDVDBKZ09MUXI3c2VSZmJyRUMwYUd3Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSArazcwb0lLb1NxbTVpbFlKWmJWcXdnK2pXd2xi
+ZmpxNkliZ3RCQ3VBaUc4CjNUOFRJaG9kZEZFKy84ZTJ4aU83U1NEcWJNd3hJZFFY
+amdqV3hIZit2M2MKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFNmNHFrdDlpb05EQlE0
+ZVhqcGpqNFY4M1Y3aHVlTUNOdnJ4VktxbFZobHcKTWd0emd6RFMxY25kbDlNM2I3
+Sy91ZVlOVkl6V3JqTFBuekFLMUs4NjYycwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+aWFYT1A0MDBSMHpzb3YrNXNHNjc4dUtoNkZ1RHlSL0tWV3RscTlocUd3NApMT0FS
+MFZIVytLeGF1WDRKN0ZydEltVkxmaWF3TVdWV1FraTcwd0xzODVvCi0+IGY7cUxl
+Ni1ncmVhc2UgOUwtR28geWMkcTwibyB0LVU/Qyt5SiBZNzxsYEJEQAowTUVXa0Yx
+ZStNYWIwdzI0bXo2R1NWTURCMVVRK1F3WW1QcwotLS0geFBtNS9vMlE1V2Npb2lh
+KzgzWkcrNS9SRG1ZeC8zdUhQbkludVJwbVc3QQo1QQm19YZ6VMz/+vhRhATkrYwD
+KP/ZH7wMl9n40mzx5U1g87ERd3zoDyirTsgMn1N05fpnW24a71FKddHpDUuFc7Fx
+xLc0Xst+uuSD8lj8H309fBBLn6yfvq4vu+/XNqsUvTwkBVFRN6EkWTr0XoFTBrlr
+AwkEzL2hvC8Gt5U2sjNkJR9GLSZhwOFwTrFMZRW6ZcR42o+6GRUtFmRX7iUMKJ6a
+2LIn3i7Qlc8pkvtEWB8yHQ8iLxa0SbWPKWnMcTV8LK/JvhSebBHxx35AhbjZAwc1
+oLmichP61qIGUGb3r3Y5U1C7dWpAwMp12Z2efk1uOfO8QzM1GYqIRvsXSPzfB80w
+OCdnZez4iEIvxslbcLSRNZn1R8mwj5deMK4ZfU+26khzqBAtrjAA+tlCtViGKqUE
+e7eOBujnBz67YbUYFyepBd8UfDsqM9jtl3PW07Bgvi1MJY0S2dzopgTlzYnS3PNS
+8xyLi7Z/McMmHg5RZs2jKHScQlcs/+Y5y000UiqtWy2UmoY6zYwGW08eqgZLZKDS
+QYY/0MHWQGO469J3uNdCx6qkzPygWchlGEKpxA==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2lio.age b/common/secrets/secrets/nix2lio.age
new file mode 100644
index 0000000..1ea57d4
--- /dev/null
+++ b/common/secrets/secrets/nix2lio.age
@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USB3dHp2
+QS9lSENJbC9VR1RpaWYyRG1KQWFXVGFsYTJyU3VqNCtub2RYMkRvCk5pMitVV2xZ
+Y3hqTU9jSllaVXFReklodnVpUVVHeENpdGpBaTc2ZHN5Mm8KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHhIMGkwQmxYZjdBdFk3Wi9BQm12Qkh5NmExNklZbnVsZTdoZVI2
+bk9rSFkKMjZGc1o2SER1d24vVjcxVktjZmc2NXlJand1WE9zZDFZVG1WS1dNY1NG
+cwotPiBzc2gtZWQyNTUxOSBTcENqQlEgSEZhMldYaEFyUktESkttclBUV3JlSldl
+UzQ0T3MrdzNmS2ZJWndVMTJTYwpoazNQMUt3d1A0ZHV0bC84b282R0NlRzhuQTE0
+V1M2QVp2NXdVWTVpelp3Ci0+IHNzaC1lZDI1NTE5IEJZS0crdyBKRUhKZTgwSnc1
+YkJlb3FLdkxRdFNRK3gvTDVzM2RnRDdqT1g4b21pNnlJCmFwK0pGNWR6M3BNRmF3
+aVRHRlVrZzZ5NlgydG5VTkRqTkVnOFZLVmlaelkKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGRrS3AzeE9jR05udXZVczdvaElkT2NFWkhyMGRLM1VRVmE3d0Jpek1DbG8K
+UHNJYlFrME5FWmtoT3JZa042N0pzRlFESGl4U0dJNGtmT1Fad0J3VGdkbwotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgaGd3SVN2MHZlQlhFaFFCRjR5eVV3Wk5LTE1PTHVO
+S1pFK29GRXRhcC9SawpRTE5BcTRIMFE3Y3NTZEtwa1V1cUlodzBXb3dUODJ5ZEVV
+eEdPdjRGcDNJCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBNanV1Qkk3THV6SVZCOEUz
+Q0NBSW16dTMzdWtpa29ncTRmd0o3eUVKb1dVCmFzd20wa29HVkRRRjhZMkFaSGtL
+Z2M1SzRPNHdRMG10MFZQYTRtRGZDZ28KLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHcz
+UUlraHJNd3QwMC9Ta3cxekVCYWJrQit0QWhuSWkwenp6OUdBRG9oVXcKQk84OFpt
+S0RqcGsvN1FMMy9SaWpnTVlwT0VsMGltMzdueVlISWZDblJiMAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgMVA0RzFwQ21YNVVBdlRuNWhRVjhaVEk2MkxmU21IeXp0VFNM
+U0RYN1pBawpiMWJCV0JUMFZNVWxROFByNXBBSzV5LzlxTmJxd211OHI2VGw4RTdJ
+WEZFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBkU3RiRThocHh5QjRKSzJ5cVVIZlRU
+NlJ2VTByL0VQZU9DLzhPN1ZxVmtRCldWTkx6Ty8rbHFDT0RpNER2MVA1dVFiT2ND
+bzBsbHZ5d3hzaWlRM0VyYW8KLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHFrNVRPQmta
+L3YwZjZ0MTNrK3lWeWdCRmF4MmdFMmszeTRlT09uVDlkVE0KYjlINldYK0VuNjBa
+NVY1bFg4VkdyQU9DRk4yNHpGREs5cWthMzBad2hwOAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgU1ZRclhTL2FkU09HcEtiNkY3OUo3Mmw5bUMwdisyL3JoMG9tSG00SGZR
+VQpMZ0NvYXh5N0gySHBMZnF3MC9oc1g5cC82Si9ybjh2ZW9XRlN1SkY5RXdFCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBUZTJXY1Z4a3RSNnRvaHFhbC9BTlNvWVRIazVE
+QVU2RTVrcU9NRDNERXhrCkdmbHJYM2xSUFM5TEs1Q0xnQkgrRnNzQndDRWlXQ05o
+MWdRRU9xQlhuNVUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIE5tZVV3aUhlWEZkeHFs
+SUpTU013RmcwZzc2SlBlZlA0RERnTDg4SmVVVXMKbS9LZHlaNlRJV3dPRjFzMTha
+bU80WXR0SkRINGRxc2NXQVo4N2xqZXhDMAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+SUtVNWZjY3o1UkJvbFZ5WStqWG9IMjMyUmRYL3FYbXRPOG94ckM0TUxVWQo1MFRE
+VUU5Wm1NZGQ3MFpRa3BBcWx0Kzd2UlMvOEM4Z1NoOFFYSWNLOWFFCi0+IHAmdml2
+V3NCLWdyZWFzZSBKKCklSyNAaSBSCnowSWtOYndCZmNoZ2gyYjNMejJpbHpNekZ6
+OStGcGFTVGJYeURqK0xYaUpkbFdLR01WdkRlMmY5UlIwVEQxYnUKLzNGUGJaUWhR
+T2hwc1RXS0pzUi9KUi9QRkdzVmRKYnJVMS9pN0pMdTZIck93d2JmSFhNCi0tLSB4
+K2RSaVBENkNwY3hWbFFJRzRMYVZSY0pXTFI3MENkMVVzRTJoYmdNN1JVCv7Oz2Fi
+S5/m0Lpgzb8jvETd0PIqOImElU7dg60vsww+++Ci7oo1Qw9l/bNdqOhIi4FjsGJp
+vQZz6OsqpvF7Ou+YauUvdx6STlnkwrh9J7BVSkG++oduf16bTsV1rqSE/e3hHe2I
+6rPv29MFmOxd3Ym4g+RAni/Ib/Ti7MdJJ3GDxOozAlHJrymtZ5NNa21UipoQpeWr
+QauxkectXbeVZ8dsss+1sPI/z0CYFHhsEyiKGzZv6LFkdERuTGRmLHfYEwpCeeuZ
+nJg5ztWBmvbwmbnbv4hbRaDNf5lpZA/sJV7OuJ/1iX2yuhBywI3808ioFtq3vScr
+uUusVwaktQTpoj7yr1OuUltgeuALegw/DwnzZE9mNpGtUjbIbMmq/vJYhH3rC1wv
+f2NuCvUN9GvWDt4IQkWDw7m3W6DUaNhoHE5NwcZ8GdScQ2j6IlEEdDAZ/da2Cm4B
+o/heA/LGRkgwldpABIVdp2rZAsoU07SgENteaWTk281yBBbiG/QxTHFzgxw0wNjo
+ShrXQQMnXWC2Fdz8ogj0RLesMsfjRnEIRwexxNLf0ihBwvet+JxKD6hL
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2nix.age b/common/secrets/secrets/nix2nix.age
new file mode 100644
index 0000000..4877bbb
--- /dev/null
+++ b/common/secrets/secrets/nix2nix.age
@@ -0,0 +1,51 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBiSHRC
+QUVCMnBYdDJXUjgweVNiQ1loTlkxMWxjV3haODdWeFFOOXVrb0NrCkVZRzZYZVNR
+RkRBTlRtOFhLZUkxRnM0UmR6S3hzdTcvUGwvV083RU5Hc1UKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIG1HWmhGSG9ZQmNoWEZvWDBta3V0L1I0cTE3c1orMlp3ZTI0OW5F
+TDBaeUkKSWFjSlQrdGtnVlVzNWp3VHBhcm05QTNKZUZrK0g5RWRJY1ROWHYrUWpY
+TQotPiBzc2gtZWQyNTUxOSBTcENqQlEgR09DZnpLcW04TkpDa1crTHg4RG1FdmJh
+T2V2VGJhWC94cm9IbWY3bmtrWQpmSGMrRHdreDNXOUlZRXdUQ3IzU3dMOVU4c2hH
+YlpTMHdBZkxKcWJrMjBRCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBaZ0RPdUhTV29y
+QXN5N04vU2gwc0VEdzUyNDdBMU55VHZmK2Fjc0N1bTFvClRDY0hoRDRsd3ZSSlVr
+RlJHR2VHbGxZYlRKK0hkV2lYWXFMUEM2UzZYUW8KLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIFBqUlZoWW9oMWtoM00yU2oybzNuTXFvYXJjS3I0MHpFN3owUWZtQWdrRWcK
+S0RGOU9jUFJxY0ZmWFJmaU9GaFNjNjhSZk84MFRmcE12SjliSmpEMWpFcwotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgZ3A0NUtnS0JMN1dINStSOUlNSitxWWZRaEk1Qld0
+aXp1V3Z3dVM1TUcxcwo1cENLMTNiSlJkeHNNamQyMGFvQ3FWNHBJYVVNSzhVdE9P
+MkZVWnJmeWI4Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBObzFBR1pKbTdpVlIvMWpa
+bWlxd2Uwb01KYkZtMmhXRmZCRlgySW82bERNCk9kaDlRV0JxRDRvdTlxWU1xM1hF
+YUtnL2lKQTQ5T0dFdEEvT2hTaXdmbVEKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIC8w
+d1hwSEw0Rkg1RE10Nm9oUlk5a1hKS1dJdGNyTHV3anhtcU9Ob0EwWG8KNXNHeWxp
+Q296SjRsR1lSQmpDU1JCbngrVWQ1M2NNOGhLdkQ5REQ5dkFiUQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgM1FWOGVtdzVERTl1dXpzYndmbGd2c0w0a1phczlaZy9wSzZw
+Z20wZFpXTQp2azFzbkVDeWR3eFFhZTloRFlhK3c1Z01vaXdGYkVBNit0QWErRVNL
+MWdRCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBmMG0wRHJDVzJBU1ZoRFRzdlRvOWZi
+TDM0VWpKcUY4V3EyTzlBbWZlOWlZCmI3VHlqYitMODE1LzUvWkhoODl1WVVCM3hl
+YWg2WWFlUUhkQ0lvbXovVTQKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHJON3RGNDYy
+Sk82TnNwUHhOYVE0WGoxTFdIUXAwSlROMkl6YWVEYk5tMkUKd3M3VzA4dWVoVVZH
+VW9zcHd5cEtadUJMWTJacFhkcUkwNDcyT2xHNUxBOAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgbGdIakg4b1JzMkgybmpScFE4bmFreTF6ck9aM0hXbm1nYXl1V09CUVBq
+OApLaGJHdEpjUEdjNVJEQXZvOUVxcllEckxmWVdCVkJPeXFDVnQ1cFI3cEE0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSB0NXNaZEtyQk1SMm93b2t6OGp1OHRUWXZwdWpa
+Z21sVlJ0QmM3bW55MUdnCnZCRlVCdWRqN0hIVHRIWVBIYUdvTGYzWUxpRHY4WVZ6
+MFlXcUk5anlrMGcKLT4gc3NoLWVkMjU1MTkga0hrMmdBIG5TTllCeWJtUkpTbVpQ
+NzF4S1lIWk41aHR1Skw3ZDJxSnBhZ2NHNTdra1kKRW8yeit2SDA2S2xCU1pueHlY
+NXo5WVIxaDBiS3dFMURkbnBQM3M5V09hQQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+K1pUM1pkWDIrd3djSThuNVFrTlBQQ2pOa0ZIRHRLZERnV2xkRitWNXBHNAozZjZs
+MXhvUWM0elJkdEw3MlcvU2xBUXU5VThMVFB5NUZmTnhsVDBncVBBCi0+IHFjeUMt
+Z3JlYXNlIGU3KmRuajM7IDZWCjJ0TWVnSmZRYy9aK3RSNWludGI4emdrSU9KV1dw
+OUtYK3NUZldNcFZid2ZZMzRPZlFKRCtZbitPZ3hMV3FZaDAKdjJjeEVWUjc4Q1pk
+L2tuSUZ0cVFDQ1YzOWxHdWVoT1hZQ2IyNW5XMEJ1UmJDckdTTzY2TnZmNGIwRy9H
+S3JWbQoKLS0tIHVNQTFWNkhLMlVMMCtPU1plSVVBQ0FtZGlKNktSbXJKMjlsaVJx
+L2RkNmMKL4QzBzzSOYmRx+8QC3YrvNX3hbfvPPP5gp2kfFK0clqTId3/UZu4qkOt
+jUlhRTRWqv+ggJAHjyBCIPQP3BgHb6EDH0B2+ZaE/fXepvIaPnvInIoc+W7Dr8wA
+JqgeDOtBWwuKKonGvPcATT3URZ8i5oGGHbyYGyQmeDjw7XdOQU78n8/sgm9bvOPK
+woEE1G5tBvOXPWZXxgIlb01J/1LxLhmk7mmB5hyGgzG1kXyDHxcNmSytWNLe/6ly
+v9mZSXAT97PPLJJcdwzd57tDav7yXXiNq8Wg5jxZR+YtyhmDX5BHcw/0nJr6CU0R
+8bAsraBf1+zUoGYG0XKnqSCCb0Ky8rZYtG+KlN/aFRJ4T2RgLVIzncRvzL3evOa1
+52POfhB26YyMdV2kQ82V5UJXEFHkjdjwixp7n5jxg3MKxZlCumyPCuUe11W9tRtV
+UQPNxdhgOH8GZAm8m6JxECtJ3Xx3XpGG5nZSLPCDoIQnetqShb1vyc06AQKMdUnP
+FBXj0edHQE1DRQoVtcSq1+1v7CmLb4iR7yFGgbiuuRzyn2I2YNX6jxsn+u8z/roD
+jvGrIE8=
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2oracle.age b/common/secrets/secrets/nix2oracle.age
new file mode 100644
index 0000000..a25f102
--- /dev/null
+++ b/common/secrets/secrets/nix2oracle.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBrU045
+Mk9iL1AzbG5LK1dKZEtTK1BENmZqc2wzWTdhMU9lL0NscXpJQ1dZCm5VWTh4eCtK
+QWhVRjU3c3NXOElYQVh5RUZUQy9jcVA1NG9EZEhpKzZLUEkKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIElhTGVrcnk5emJ0ME1hU2xXOTMyTEIxV1l0TVFrc3ppQjc1VTNU
+TmJyaFUKVlJrSVhCcm4xbHhwWUx5TXhlbTBwNzBoN21hcU1hVVZHeTNibUVSZXB6
+VQotPiBzc2gtZWQyNTUxOSBTcENqQlEgOFRvYXZFZjZJcXRsbUJUQ3U3Q3lLK3U4
+OEhiYWxqckMrZEszMXI1SStYOApzN3NCQ2U3TTkxVzB5dEUwWXA0dDMxblVEV3E3
+MXNXQVpKSURyV2ZmNDVZCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBJNUdKOGFDSHd5
+VDUrL3VSeEY3NWNoZlFWS3pvZnRBSjRIZEJnYzBSQ1h3CnpERHlkYXJsTCtUV2Y0
+RVN5NDB4UWF3Vm1pdzN0OHFuZ3ZRK0Fnd0V1cW8KLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIDU0aFQrN1pydWd0bkJLaE5KUTNyWU5Vak1tTlhKTDNHWHBJQ3ZSK0VNWFEK
+UDkyTkFoSG5aL2tBTmxESWVpWXRpbWtTeEY1L0JZSmlEdVlRekN4ZmdxTQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgUXRLZjg3UStKMm9MNzFrcTVaVzhMR25DVk9oMGdP
+UzErclNkQnhiRnNnawpRY01QWnhFQnFqT1AwcDIyeDZiaG4yeVBzaUptQ2RMeWxz
+QkhyMDJnU3hrCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSArWjA3RVlZL2lyVjRFR2Zr
+b1FIK2Y4dlhUejN5Nm42VWV3Nmp4cTB0T2dnCmNXZ0d0V2R0RnZHNGliZ0pwNkEv
+a2Y4UHlmRnpOZ0dLZGIzTXJ0eWx0K00KLT4gc3NoLWVkMjU1MTkgRjRiYjhnIERw
+MkNqci80MXZibkF0Rk02YjBqalhhMmUxelJubWdQMG9mZE9lRzhXbVkKeURhVlhU
+bVZDd0l2bFlKVjBKYmZkdHk0OFFNNTM2YlNYWG1SS3pXS1V3NAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgdnQrOCtiYWJrU3lveStlRzJrYWE0SEVHUEsrcm4xa0ZZNTA0
+UTZ4dWFBZwo3M0QzZEpFV1BFdGh4RC9DZ1l2M1FRWEdzZUtjbnN4cFRveE9KWU5W
+NVFNCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBSU1ZSd3Q3c1NWVUQyNTczMHBqMDVp
+SUowUkhwTEMraWZZS1l4Nlk1eFJVClBjcVYyUndxdjM4ekIxOS90KzNHMXVPQ25Z
+UlB1SW9BQzhyVHJnSU5TUG8KLT4gc3NoLWVkMjU1MTkgWmUxTXdRIDB0WkxkYjBF
+cVBuVFpiUFhmcGxwNW9BWmRzTU10R0prMmZsVVk2TWR3V1EKTHdySU8xK21hMzJ0
+c2NOZ0NSdHUzSHpnVWE0WU1DZXFjSjBXbHhvd1JDZwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgbGFyTzdIaWF2b0w4QlVVUVFyNnNSMklzVGNhM2Rka2FDNm16S0R0MTIx
+SQo4bkQ1cWtEVURORTcyREtDdUVPM3p6aFQ4ZVBXNWpCcXhUS1lOcG5tTUFVCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBDenFma2swTUdNalVpalVRT3ZCU2NyMlBOb2o0
+V0tCQ1gycmRoek5oMFVnCmNCRUlxU0F0ZmZyOXFLY0I2QXpuSTVqRUEvSHBHaHBF
+SENVeDIxcU94Qk0KLT4gc3NoLWVkMjU1MTkga0hrMmdBIGRjYldMZndtVGRuMHIv
+Q2RZNjlwVFkxS0xRQUpselRtS0l1MnNDLzhlR2cKSnF6MEdZRFhFOWtzUzlVZWEz
+SlpHZzYySEpEVW5TOCtiZTJIYWdLL3dYYwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+bThlZVZ4Q2s1OEFWbGNqSHRIQUpxYUNEZzFzNE5qejVnTUs2djFOYjFHUQo1T2lP
+aktEaGFOYkw4T3JsVmIvTGp2WVE1dkxSczgzcjNaZDllaHRyVU1jCi0+IGo8IWFS
+RS1ncmVhc2UgNHtmWAp1dVJtdTRlMFROaHVzVGx4UkEwcGJycitqSTFvbVFFOWl2
+ZGZVWHFHMjUwTEljRnlDVUpMK0lBQ1Npc3VRMW1uCjRDVXRhdDRRRG93Ci0tLSBa
+U2JtM1c4dDd4OHBwK21jNXNqTFdDQ08xTXdWS2xLbjc3dllsUDE4MUpnCheeS5Ao
+jdiBXm9dtTEcTgilutkhBaP6NL2MI7TCkratQvinVxVFc3A2XXGD1Dp+/YGhHMx9
+x0l5flisRyCK3Xz8WJWbVi1VZ6DuGaossLHxfIeVWQhzGGlX/4Xu2Ly26BpTDLmi
+OpZ4WLHy3kMmt7VOon1xQmlZv7NBj4R4/u7QdPnIt60BwoDF6dGUEVBk/AcRnF2P
+23fA0ZlpmSCRCfyMwgdo7TXMq72w/VL4y50y0H1lgexGwsgtOwWsj0HeOxwleSCS
+3vHozKZd61AF898IIJh8/YW/A2AQkD0V+BN5Yn9A5PpN7HEQ2cQtsU2KB2LY7Ws8
+/l2diGyNu8V7CmONQh5Rjg5ON0Vj4xMpmsSQO9VyGzwVzkwXPpYadLYF82xP20UR
+IieybEz/3n6ihpDPJ3aJ6JN31lZJnCmFkQ2sgvizuxwQnIpuN5nVav8laq4Xjm04
+55r37ZJG4SQUzOMjYdnViq6B/LMslVf3B80vMKXlm/lc8cXXQ5ZErcKJs7WsKD10
+GsAE+kvrxpwBDykMNwluExFxYACp1a+1bZZuzdRITMEstbWQgBK36s/e
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2oren.age b/common/secrets/secrets/nix2oren.age
new file mode 100644
index 0000000..a4d820f
--- /dev/null
+++ b/common/secrets/secrets/nix2oren.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBpSGZS
+bkFWQXAyazF5empVcGtuQ3NIQkpBK0RWWnI3WG9vOTdQMW9SNlh3Ck94MlNBSjRS
+NTA3ZjAzZXJtTk5WaTFUd0VYWFFseUVTOFF2aUFmaUtCbU0KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIFZHS0Mvd2NUSHk0TnRFSWhmTk5VSm9LSnI4cE80OXpYMzJKbzV3
+UDdtZ2cKeTlsTGhmazNycElZLzN3R1FZcWdpK1Z4SGRPbGNKcjJzTnlXZFBJSTJl
+UQotPiBzc2gtZWQyNTUxOSBTcENqQlEga09qRnptd0dqN1ByU2JZL1JuMTVJNlNY
+eGYvRG96RXhtZFhxN2lpbWZXOApTYnNOYUkxWmMwZjlOMHJzZjdkajJHTHprbXlV
+aUFZOWtOT2dMY3MzYWFVCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2bnBFcnE5T2Jh
+bmc2dmRQRUdDL0crYXl3ZTI1RkFDSkw5N3VxT2k0Z0dJCkpsdnFjN2xQeXBnQmVx
+RlhTd3hudUNyMzQ4WlN1SGZvRldNNlBFV0ZlaTAKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIExzZGsvbmQ5NWRHdi9iSmVxVG0zbHg3T2V1NGFqREg1V0YyS2Y2bVNsaTAK
+UUNicjhwajgvckxIblMzNk9HUDhLNTFBSmpMdzN4VkpoVjMybWVIc2hpZwotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgNnJiMnVQcUd6aUVzblZMN3cwM3VoZXZRd2xaRlgr
+SmpqYm52OXozZnZodwpKMFdsMVl2Zm9qNkIzOU1MM2dmWGRJTFd3bzMwWTVBdDNP
+L05HUEpxRktFCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBUbW5pRVFHaUFlQ2JKZEEw
+RDJxUVhiRUxxMGNkczgzUGlBVmtiTDQ0RG1JCnhjZVdlcW1LYkZyOXBqSithVXI5
+YytEYmltaFdLYkl1Uy9IV0xTcVR2YlEKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIE4r
+ZC91UURXRHFUWEM2OTJMWjRuUTBDUzZyZjR0MTdlMGJ5NHBBV2lBbDgKcEN0dXln
+Z292L25SejhhVjAwdEthdTkrSVo1NzloSWlpQm5IeEgyeVQrbwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTFpMWnlXY1czQWpIdFl6SXpHeHg1K3hEeTBYdUxnREFmL2RF
+NUhFRENpWQo4ZUswdFVMZXdnMGE3ODZTRFdOc2hBdzVMQllvczMvZk04QnRoWDVI
+ME1jCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBUejNUVWEvWm8zSVFSRkFpQ2tIM3Vs
+UFdTVlBhR3dIL2x4aDZvNUJWd0JVCldXQjRVY0g4KzRhTVRYdzZoRWZPbGlPSDA3
+cUhNTVJVZmpLTmxwN1UwN1kKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHJTb3dMQUpW
+b1htTm1JQlV2TDBXcGk5RzR2ay9JZ2NwSXpWUFlNeW1PVWMKTjV0S2JSd0dhTm02
+VzFzOUZmbXk4d2RweDRtREppZ2NaUmdXZXFQT2xPZwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgYTlGK3NsUUpJeW51SXFSaWRZMktZY1JVSWR1RHdxMkVCZ3JpOG5VeThI
+VQpmL2pER3pkVVpRMG4yUkpoNmZCb2NzMjBqcm9mWUtpd2JYVE9PR1N4S29zCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBqcjhlR0ZQK1V0eFJINm1uUzRRTzBJZ2xnUk5S
+b1BzTUVJdmoyWkVNNVVnCkZZM21DRkR3eDdWSHRtNTQ1WFF5K0hxMk1vMmd1MUJK
+ejl2dW1keFhuWHcKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEpTM2NuU2RFVUJVcDB5
+REI4VE9LQzk5UEJVZEE3NTliNGRlVDhQSHZobWsKVlQwWU52cGErRHlMSUs5SllW
+YWZtZWI5SXJoSFk4UGxHVFFqOHJqQjhaYwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+MFAxUXVaZXM3ckZHbWxhY090T1UzaTZpQTRqZXMvaG5VYTl4U2ZYRThEdwpNa25V
+cXp5Wk5WOEdjdGFWck5Qc1hjRitRMWdXd09CVGc3RDhxSVhlZkFZCi0+IDUxdmZm
+LWdyZWFzZSAqcik9QzxMXSB+UTsgX0hDCmxiUXF0YnRnamt1RC9IaDRkYnFsSHYx
+QkhRUU40TkI3MVFVSlN6WDJVY05KNDN3cGg3R0lVSDk4WGNQM2NFMEIKcncKLS0t
+IE12R3FidXBvMFlMSkl3MkJleHgwOXB3Y1BhaGs4QlBPaTY3aTZBSUtwYW8KBn0h
+p0tQ4FYu7/wPAIJc1Ful9XEfvky2NA1q4xI/gtfeaXvUY1tS5IeVkTQwfEsb6uCa
+2m/MRGsWSmfBYHPzBtl/eHNODZ7EHECHjVpq/i0BLOH5a/GJ1lAImY8MDT/1dd6S
+iqJPUTOWgH+mczo6BMsQBBmfg987oI/WRMeMAr0xZeFbunSw8yglLbopkFY1sv0V
+OgBBUFj06tBhYBivB42fmaFSO/bTYkwD6FSzCfUGSG0p8PPaMIPPF1MU9xtgjW5A
+PkN3OGeTDrDJ6AnVjTY64nzSEwILPRoSKXfErEX7Q3oEzSgIdzCVKUqt+Z9S8do1
+Huc3JOc7ZxxotGr9AHPPGYxT6hgkxxQOIrw6W03wnj6oS2XsFoU3X7uATZP5hc8o
+p2W0knCKHPjqxb0cCZORSdae3FOQpF3RY3hFOIHTHqR3dfl//D/OdW+9+qZx47JW
+hoXDNmdrBjUXW6t/i/rRhcoocomUxo/rLbxdE+/JP86Yg0pb0fPEP6zCMHJusuHo
+EojSeWMeRHZ+cF61ee1+8cHGrvXcShJ7uicIXRTFdbdclfM10to7cijub+U=
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/nix2t.age b/common/secrets/secrets/nix2t.age
new file mode 100644
index 0000000..843600e
--- /dev/null
+++ b/common/secrets/secrets/nix2t.age
@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBVUy9q
+SDc5SjNYT3djMmVnbmZrSkpDQlQ5VmJQZlFzaUhJS1hja3R0bEV3CnMvK2NKd05q
+OUltdUUzWlFUZkhMa3c1UkdaVm1aQlk3MmtGalFsV1dRWkEKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIEh1VWxrNnZoN0tabE85NTJuUFVmTGw0c09IVWI1Q3Ird3BWb0p1
+ZSt4eVEKWWlFMzc2SzVwRE5CNVk1N3haRW9UTGpMdjk2d2cxa3BQOUFrSTk1MmtW
+OAotPiBzc2gtZWQyNTUxOSBTcENqQlEgVHRUTnhwckpoVEFpMUxWbk1yekRDTzA1
+WWZvSXpDZWxEaCtDVHNKVENpMApncXZIY3ZFbHJxY3VkTGVsclBTQ09jaWxRdDdO
+VEsxdmFKYWNEdkUvT29FCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2ZUhRa3o1V20r
+a2tQNmQrYk9wemFhNytRY3FuOTFmMmRad0FNNXExWEQwCmp1RjFDS0xwSGtHQUUy
+RDlWVVdxWjhvRGVEeHo4TEdzT1JSRmIxcDgrZU0KLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIDZYYXVwaWdrTTBKYlZhQk9STGNPV3ZqeW5yZDVpcFUxSTVsNW9JcXF6eTAK
+VEk2Skk3bFdtWEhoaDllYjloQkcyT2tUaTFtdHYvcFQyalpuaTFac29FWQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgS1I0NWdPY3ZSU2xENDFFeEVtNVU4dkdGRVVkUWYw
+bjhYWlNXMm9jU0UwdwpPQU5KMTVuODVhUzFxWnIzclhCU05mMnU0R3FtanVxK0xn
+VFFJSTFvWHA0Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBhSStkek51ZWQ4a1dVaG9w
+TFN3Vm5oMUwraUx3MFR4bXVnenpPNE0xVmdjCjhORitCVU9nRWpQNERDMElBZk94
+a09LMHFhM2V1dDZvamltUnY4TENqYnMKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHVP
+SCtCUWc1N3E5Zzd3aHllS0owQ2d3anhSYnRFOWh4SlgyOG5ZWFlJbEkKNHVzMjZD
+T3QvYXZPaTU1SDNCTnNFNlRtRFpSZy9wQ1F6WkNxNUg2bCtDVQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgYVdKNk41MGxMMXl6SkNWVmdsREhTeFJ6RTJzdkxTcWhtY3NT
+bXYzTnRnZwpnaXBHKzNYYzNDd0ErbDhBNEVOZ1FWcFJZT09TY3FBanZIRU9nTldu
+L293Ci0+IHNzaC1lZDI1NTE5IDVhZHFNZyBWSUFiQjBLVjVjdUdIdUR2b1Q3LzJJ
+c01VMS8yZWJxQkN5bXVuNjhXUkFzClpuT2k5aFFWQjNsNjlNSHc0Q2xZWFdDeGxY
+V2ZBNDNYN3lsZlFrTUkvNmMKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIDBrYkk1akZE
+NFc0UUsrV1RlbW02NU9ZTlcyRGRMUGVmOWtwOW9VaXY4U1UKeklYZUdtci8xYzg5
+Rnc0V1M4QktScUVwSG1JcnprT2pMdDJWYVJmVTdDcwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgQzdTcmtaZER3Zk40OVFpRU9pTDhqTHBFWTA4SS9NY0g1RE10ejJtdjlU
+RQptZ3FQMmNnYzBEc3BpUDdNYTg4U3U1SFhDb05KdnIzV0VzT3pXT1psOVE0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBzRko3NGlWUmpDb1U0WXpKN0lraDYzTWlIYTFj
+OStWa2NzMEQvNzN0UlFRCk1LeUZSVFdPa3NpY2M1eUIxRHhqV1BFNlpjN2Ntb2Rq
+dkFveVdxRFpod2MKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEEzOTVLTzg3d0ZYaTgz
+TXdJYkZlcVVqQm5KaXVDaEZlbWw5OU1jNkw0eFEKVjZra3dac0NUQ2pBZnRFMGND
+Qm8wbkdVQytxQnpGSzNjSjJtVTk2dEhSSQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+UVpVWHV2OWdWYnhydTJZODRzVEdWQVhFODFQWFVVSWw5NWJocXduY2hDMApnUDNM
+UXkxL2NTQWVVeUdkeHdHbnE4cFJXMExLK0IxWUxlQlBFVlllOWVZCi0+ICozLWdy
+ZWFzZSBgS1gtOiBuK18KbThIa1FGM25sc0o1UU1yWlFoY20vNS9oRGdpQmQxWXBr
+cnVwaHd1cDgwdGpGQkQrREs4dwotLS0gUHRYWjF4OUV4NVhESlo3LytqdzVOTHNU
+Z1ROdmJ4SHkyZGhzQlJXeWw4MApz+OC1nGrL+AgkWWYC3bYmEZ4WE7wUiBGSQjuu
+MFlv1EBOveOzJ9eKKdR+zOl0Zo+pL6TrUUju6iaIvPd16x8NBiiDGmiAkpM9qcQv
+CG/KFcP5kq5Ddx9rGqvOTn8YTk7Se10BmBEduERWtSuv6yEngrAJzF1QaeBM2PXH
++TxPlblCbiE3g9Dk6c+0S74izVAz+1cD8Lwx7n/7DX6gHtIoSMIDi38mfy9baZdl
+Zcaw8Nr/wgBT61U2ywXGc9h50Jec1zUXfBEdLZQCFNpnZjntxh+obvdM43HJzRkz
+sF9UXXWrvQrP21xxxa1wYy2UNANAHqMegUVNIZZfncF0lnA38sJDX8nsYKaIsnce
+CnacNDrf2gpZkk6Ml5Pjcc85B1dE3DOrogg/Dq84c+JtN9r5N3mrzBHeg4xc8dOX
+GGq1+9a4w/w2CvvoRbFXxSxo7a/B73oeNggsHCcZ+o2CG/eR1mDNznU6XSW/1dMg
+FnEBJB4vAG/fejLMHHWNb4bfa89Oba7wN2oHKm41cf+JWHJ0/Thn1k6DzcWRoHtc
+kJS1Zr8mQw==
+-----END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/obsidian_sync_env.age b/common/secrets/secrets/obsidian_sync_env.age
similarity index 100%
rename from flakes/secrets/obsidian_sync_env.age
rename to common/secrets/secrets/obsidian_sync_env.age
diff --git a/common/secrets/secrets/openwebui_env.age b/common/secrets/secrets/openwebui_env.age
new file mode 100644
index 0000000..66eee18
--- /dev/null
+++ b/common/secrets/secrets/openwebui_env.age
@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBORVRn
+WmpIQStaRnV3QU9wMStQWHJMTklhb21nM3YyRE1xdWNxcWZEelRnCnZvckQ1K0hE
+UkNyZGIvTFhpU1JtcXgzTy9QK2hhV2JYcm9nczJSbXgyS1kKLT4gc3NoLWVkMjU1
+MTkgcGVGQlFnIFU4QndCcjhFbG05M1prbGkwcFlYWU1WT1NkU3ZCZ09SQm9sMERC
+OGZnMGMKbnBqNzd2dnBQT3R2YXBraEZKVFBJeHJXU1RhOWwwNHdGbC95TzhDM1g4
+MAotPiBzc2gtZWQyNTUxOSA5di8ySEEgOGdMRXZ4cnd0VFdxNlBHYlI0S2pCTkZo
+dGtnUm4vaGFQanpKMFRjVjdHSQo1aStST0hFdkR4T0syekFZZXM1b1JBbXV4bFB0
+RVIyRG0raEZDVmt3L3owCi0+IGxLPUBZOS1ncmVhc2UgOyAqIH06U1EgQCRXdn1K
+CnpSdjUwaDI1eWE3ckNBCi0tLSB2ZTJVTHphZVhBQndhUU1GZTYvYlFMT3h6cVRE
+SzBoK2sySStmWm9SSnU4CjTkglKu9/CMRrbdagHF1uNxTOBSthOhyAgfcHLXHwXe
+dtZiEnev479tMoIo2OXi5ODZpz1LTCkBMO0yRY6JlmNVlwpByNJkyij5bwXbUiPy
+Mk9airOI/s5fIEIStb6ei8TMgy68trToK8JUmBtK8JzL9fkJDET9YyQh8N3BTUMR
+8M2cUXX1qFjP7dyRDOQiq3LQEKpywUIuGNASDw==
+-----END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/secrets.nix b/common/secrets/secrets/secrets.nix
similarity index 96%
rename from flakes/secrets/secrets.nix
rename to common/secrets/secrets/secrets.nix
index 4a1cfa9..b402367 100644
--- a/flakes/secrets/secrets.nix
+++ b/common/secrets/secrets/secrets.nix
@@ -115,24 +115,21 @@ in
     publicKeys = trustedKeys;
   };
   "headscale_auth.age" = {
-    publicKeys = trustedKeys ++ o001;
+    publicKeys = trustedKeys;
   };
+  # "obsidian_sync_env.age" = {
+  #   publicKeys = trustedKeys;
+  # };
   "us_chi_wg.age" = {
     publicKeys = trustedKeys;
   };
   "zitadel_master_key.age" = {
     publicKeys = authorityKey ++ h001;
   };
-  "oauth2_proxy_key_file.age" = {
-    publicKeys = authorityKey ++ h001;
-  };
   "openwebui_env.age" = {
     publicKeys = authorityKey ++ h001;
   };
   "vaultwarden_env.age" = {
     publicKeys = authorityKey ++ o001;
   };
-  "linode_rw_domains.age" = {
-    publicKeys = trustedKeys;
-  };
 }
diff --git a/common/secrets/secrets/us_chi_wg.age b/common/secrets/secrets/us_chi_wg.age
new file mode 100644
index 0000000..94a440b
--- /dev/null
+++ b/common/secrets/secrets/us_chi_wg.age
@@ -0,0 +1,46 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBFazhx
+VVN3VXgrWXdWZzNwOHdIVzZSSTlRa2lEYjhXRzlCWXZhMmQ2QXdzCms5MmpGZ0hW
+c3JYM25mNWliNHlxNG14ZHppcWU3QmhxVHVwS0QwaWNaN0kKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIE5Cd0M1S0ZCWTVXZ2lLR3NzV2lTb3dubHRyQmlsMDF2TFZLM1B2
+bnBMaGMKSE9ad3BrSEF1T0g2bkN5SjAxOEdjSytIWGxSN0t4ZDlQSkpVRzE5ellm
+QQotPiBzc2gtZWQyNTUxOSBTcENqQlEgYllQVWlYUnZ2cjJ5N0t2WFJWMG5ReG03
+V3pkSzFEK2syRzd5R0NyVFdEdwpNODJLenpIZVByL0hPSEFFbG1FVnBpeU1relhl
+R1dpamwwV1JoWG9CNmprCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBFTSt3Z2UrQStY
+Vk5LeXFETkdmeXdGSVcwTlA4bzJKK2poZFNUL1Qvb1NFClpIUHVWV3Q0RTViRzBI
+aG5QTTZCazUralExS0NRUWF0cVNZTlZIaC9mQ0kKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIDF4Z1RmZkJrblIrQ1NqU0hDNWpPYS9sUUJJTWFQOGNJejduTkdLbFBJQ2MK
+b3hXd09EaGNPaUQ5ZnIyNHlpK2hSWm5WV0lERm5xcWQxa3hGaDVTRzFYVQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgY09RbXM3WmlDMVVRMTdKRjN6aktFY20zNjJmMFBY
+ajQ1VjRwQXVqRkN6WQpiaDdRNmtBUy8xMksyQld5bTMzTXlMVnhQQzU2a1RQdE5z
+dGhpWWxXRThNCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBTQzhUY01rOFlCV1ZQbGhJ
+dGFTK00wZnNyRGVYNjQ5T3dtZENDSHpycUdzCjNZNVd5dWkrWG9lMWdhZVJQUE4w
+SHl4dmpwU25PSDZWVkZUTjZtWmNhSjgKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEFH
+WmNFL1ZYazFZNVB0R1JYTFpBNk50U0VWazBhOGh2SDhHdGlwRWdSeHMKemUwNXN0
+aEdMdGJVZmdpWFN2Zm1BT2wrQzFBR0hIUi85ZHFSSVd3NklXMAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgejVkVURQd3hrQ2pyMU9MVG9VTG9VZmtKbmtDZHU0RjdHM2lz
+c2VTTy9FYwpUZTBkaU1rQmsxaWRzTjhvdis2VUZJV09Vb3g2VTNNVHN0Z1llazRL
+U0VBCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBrRXNWcHk2akc1bVZBbitQcUlLYU5B
+cmRnSWM2dkVKU1p3dk1ueUo0bUc0CmEzdjF0dUgrOXhETWRDaGlDQU4zTWxXNXBS
+TUs4V3U5VWNNczNTVDNLb00KLT4gc3NoLWVkMjU1MTkgWmUxTXdRIERULzFFSERl
+b2ZNa2tzSDhZbDVJb0RndDFBRzlBc2dxcWJMcmcrMFJUaDQKY25kejI4VDVrYkUx
+OWo2M0hLRFBLNi9HeXc1elVVTTY5Q094RFUxQUlTUQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgTlpTeVFPOUFMc0hNNkZJZGxJSVltS0JEVnFoRWNBWGpLUVNwR1pPZXlT
+YwpUTjJPak8xTWtlUEdFNDZhMVBxWE5xMGZlUFFmQlpkWkh5UDdqeW1SeHlRCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBZVWtxQWNwcDdxMUdtSVNzT3hkNjMvVXUzd1Vp
+bXp2YTVOOGFyMDJPV0dzClhkZXNpbGVLUGV4SE5CSDIzYTNRRkg0ZXh0MEdDNnhz
+aEtReUJES3ZsbWsKLT4gc3NoLWVkMjU1MTkga0hrMmdBIE1iRkpLbzJnZFVObkNQ
+SzI5K3krcjJvMDNhRXduWFhXd2RWUDBTdWpVaHMKMnFlRGFsSnlTMStZbnhYeG5U
+Yng1TXZOTSswc1FXY00wSTErUzNDTzhvawotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+QVFhZlJhRjNsdndHa0RPaVJoYUMrNTRoY29iUWNXdXJvS0hBb3VMU0oydwp0dmdo
+amFxNGJnanRCREt3ZFhld0M4UFk1WmM2RmJmVTY4b0g0RkJXYnJVCi0+IGgnMTZv
+d2dGLWdyZWFzZSBQMkEKbThTYkxNa3YwK2xXbUhxb2RqQnd6UUl6a0JVcnVPR050
+ZFZCNmpjCi0tLSA0QVdjZEIrOWhUaVpHNytqY0h3eExLVWc0djlDRWtQVEZuWHM5
+YlVydnljCo/0r5CGdm/VW7wxgZhkhisHJbstH3r3YrghiSORsBwxX+GaKIziS1ns
+MyRg6TWoWjIUe4epfGzqton35ekvrXWxGlLCuIkQgY1frgPTE4kZdm/T1pqzZpQ0
+4vZkl7nVd4k9oayv2LfpN8loG8npcwLfSKeVFCEooTOs+M3eH+wCEUd4r+TjfG3D
+ZT2eAX9HethENX4GQxN+RQagyWOlnZVpf6QYnwg/bzRGtRSDLVYqmLJd5BbOrON7
+XN65I5DX2kBGtB3Y3F15hHjGxHFyded4bO9w/SF+jOM+yGnTnTQ1G7FSw0T8dwWo
+7laPDx5WSM1zop0jLJ5iyZjNWJJt/j8t9FBGdqxtPUxP4jPVTTEiYJbtTauZtRUN
+rc3UbQvDJTArGbwAQsTlYuMd59oIy2+cgpYHyhW2cPixL/VHxRYupNWj8g==
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/vaultwarden_env.age b/common/secrets/secrets/vaultwarden_env.age
new file mode 100644
index 0000000..083ba6c
--- /dev/null
+++ b/common/secrets/secrets/vaultwarden_env.age
@@ -0,0 +1,20 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBMZ0VT
+QWNCOUNSZ3ZPcmFFcXMvZkFqMVkxV1dRSDNLOTFzUExoc0F3dENFCldFZHdNSDdm
+ZUR2eC94Y0cyRWJnTTRnSTlTRUlUSHlLS09IS2ZwZmVhOU0KLT4gc3NoLWVkMjU1
+MTkgc2EwSmpnIGlNaHFLQ0tZeFFLR1ZPZnpCbHEzdlZXWUxjWFNmMUdMVjdQUHlJ
+cTJUVkEKcERQMVNNcmxQekUra2tUNUhyVTAxVThSb3RPRFBOOWMwRlFqUnRQQm13
+RQotPiAiXzVSX3wtZ3JlYXNlICpQMQpHUk5aSHJPRnNjQVR4Y2Q2TkhzU01SWWhh
+TjBpb1JXbVFwSUxlT1BObEg0N2syNUJjUlc2TVJueVlyTXJRckQwCnhNOUZIVlVh
+UG96d0pibVJsdmdNekJFUHg0NXFpa1JSd2lBdzN2S2JxenVMNVpWQ2hxRXlWUjFy
+TWcKLS0tIG1QMHV3VW5VM25QVW80aUZOeEpTNG1qYksvQnE5emhBdzBuM2VMZE5n
+VTQK6avsHayBgGGdjkwRORdaAz8mwLcxvI3YCMYwXjXCvJmIvlQerUEkDOU9D8sL
+I+aSD5YCoHoJ5FsIOox5WWYEVcPxR/y1G2m3pAhZh1ner0Ckw29gsjdmckNwtSSr
+tTrSve34ZEij1O7gfO30hW+Kd4579QWH/diFTrP88DjopqsaTWyh+A5A3WP6NxhJ
+U0uL5RIPPGCMs0peqZG1Y44KRlt79hKELop4CwyF/06a3Oxuze5vifGl7+mogq0A
+Xp3NgWR5AM2Fu+NfEQDUHU1R/CpyY6+VcTZWi8iu0/XfEiIQ4n5JSYNtd3ZL0ldL
+WRoNdpA04IiCWM7fnRdDRVRGw9bDJ840oeBiSvbRqIt+uykEndEzKCxXh/jWvP+X
+tBj05Rt2Qj3xAsq7yzsvK7vzacjV8fU2kNpxDvhVLQO8TBI5z7Sofu4Cy2fFY1F7
+J7JABO+kciZ23gdEofrHusv3oZvu2eQ5PO1FXCSsZzalum2cWWou11QDi3Vt65kN
+wjleyKCDx4a68n7IoS2GOCpDw/G0ACmHrTSnztaO
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/secrets/secrets/zitadel_master_key.age b/common/secrets/secrets/zitadel_master_key.age
new file mode 100644
index 0000000..3b07b55
--- /dev/null
+++ b/common/secrets/secrets/zitadel_master_key.age
@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAyWGFw
+bUJNQkwvcjRKUWU5WWozTWZHb21IdDNlT0VwK21LQ2FZNEJWWWxJCjBBUDV4MkRt
+Y3F5TWVMN0xLMjBibkJMcmUwdEwxM2pONUlLSU1EOXV5dXMKLT4gc3NoLWVkMjU1
+MTkgcGVGQlFnIGJPcEx2TnFZZjVicDlYaVdwRmJHSnIvZlpRNkx5RG8zVmZTaTFq
+bmkwM1kKK0o3ZVViNnBjS2NZbFV4TERBczJNQWxtWU1IYTNoL1EzQlNxWHhFNDZL
+TQotPiBzc2gtZWQyNTUxOSA5di8ySEEgZm5nYXdJMElxVTE4TnVnY0xSVFVtMXFs
+NTNobnI1MjdMNDhWRmpkL1BnSQpXRHcwSVVCajFhQlp4N2J5VGhKc3E2eHpYZmd6
+TlU2MXdtdmNrSUJpZjFFCi0+IG5wImA0LWdyZWFzZQpuSHRTckxXVTd4eTFETWE4
+MEQ0QXNaTzhSTmFOdjI5Vyt1bDVRU1k5dExiUVk3bEdCeGN2UFV4Y3RTR1MvalNn
+CkhHWFF4TGtPcktieDZnQTRkdk9ndnllU05zSVlMOWh0R1ZncUlWNy9WZURiCi0t
+LSAxdW84VUg5d21jT2hrNEJ0NlBES1NRRjU4b05JQW80dk9IL29LZGlST0FjCnt8
+t+yvFWU0LlFGAWmLc9i4XFUpexZf8rC2bfw3FkNPuCzAyvbowhBJnGkqK+2C+mtL
+za43EsGaLvA5s8ObhLw=
+-----END AGE ENCRYPTED FILE-----
diff --git a/common/users/default.nix b/common/users/default.nix
new file mode 100644
index 0000000..8561d8d
--- /dev/null
+++ b/common/users/default.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "users"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  top_cfg = config.${ccfg.custom_config_key};
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      admins = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "josh" ];
+        description = ''
+          List of users to be added to the system.
+        '';
+      };
+      primary = lib.mkOption {
+        type = lib.types.str;
+        default = lib.optionalString (cfg.admins != [ ] && cfg.admins != null) (
+          builtins.elemAt cfg.admins 0
+        );
+        description = "The primary user of the system.";
+      };
+      users = lib.mkOption {
+        type = lib.types.attrsOf lib.types.attrs;
+        default = { };
+        description = "Normal users to configure (not for system users). Should match nix options of users.userser.<name>.*";
+      };
+    };
+  config = {
+    users.users = lib.mapAttrs (
+      name: userConfig:
+      userConfig
+      // {
+        inherit name;
+        isNormalUser = lib.mkIf (name != "root") true;
+        initialPassword =
+          if (lib.hasAttr "initialPassword" userConfig) then userConfig.initialPassword else "password1";
+        extraGroups =
+          lib.optionals (builtins.elem name cfg.admins) [ "wheel" ] ++ (userConfig.extraGroups or [ ]);
+      }
+    ) cfg.users;
+
+    programs.nh.flake = lib.mkIf (lib.hasAttr "primary" cfg) "/home/${cfg.primary}/.config/nixos-config/hosts/${top_cfg.systemName}";
+  };
+}
diff --git a/flake.lock b/flake.lock
index c0c2de1..d32edcb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,12 +1,165 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1741481578,
+        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1758313341,
+        "narHash": "sha256-SsI6INUzWwPcRKRaxvi50RttnD9rcC4EjV+67TOEfrQ=",
+        "owner": "rycee",
+        "repo": "home-manager",
+        "rev": "6f656618ebc71ca82d93d306a8aecb2c5f6f2ab2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rycee",
+        "ref": "release-25.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760524057,
-        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
+        "lastModified": 1753345091,
+        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1758198701,
+        "narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
+        "rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
         "type": "github"
       },
       "original": {
@@ -16,9 +169,101 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1741379970,
+        "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "ragenix": {
+      "inputs": {
+        "agenix": "agenix",
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1744897914,
+        "narHash": "sha256-GIVU92o2TZBnKQXTb76zpQbWR4zjU2rFqWKNIIpXnqA=",
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "rev": "40f2e17ecaeab4d78ec323e96a04548c0aaa5223",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "nixpkgs": "nixpkgs_2",
+        "ragenix": "ragenix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741400194,
+        "narHash": "sha256-tEpgT+q5KlGjHSm8MnINgTPErEl8YDzX3Eps8PVc09g=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "16b6045a232fea0e9e4c69e55a6e269607dd8e3f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 1444a5b..8dab2ba 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,13 +1,23 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    # Manually synced with common/flake.nix inputs
+    # =====
+    home-manager.url = "github:rycee/home-manager/release-25.05";
+    ragenix.url = "github:yaxitech/ragenix";
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
+    # ======
   };
 
   outputs =
     {
       nixpkgs,
+      home-manager,
+      ragenix,
+      nix-flatpak,
       ...
-    }:
+    }@inputs:
     let
       # Utilities
       inherit (nixpkgs) lib;
@@ -15,6 +25,8 @@
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
       # Create a mapping from system to corresponding nixpkgs : https://nixos.wiki/wiki/Overlays#In_a_Nix_flake
       nixpkgsFor = forAllSystems (system: nixpkgs.legacyPackages.${system});
+
+      commonFlake = (import ./common/flake.nix).outputs inputs;
     in
     {
       devShells = forAllSystems (
@@ -56,5 +68,6 @@
           };
         }
       );
-    };
+    }
+    // commonFlake;
 }
diff --git a/flakes/common/flake.nix b/flakes/common/flake.nix
deleted file mode 100644
index 39470ef..0000000
--- a/flakes/common/flake.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  description = "Common NixOS configuration modules and Home Manager modules that require not other inputs beyond nixpkgs or home-manager itself. This is made by me for me and not designed to be general purpose for anyone else, but could be useful nontheless.";
-  inputs = { };
-  outputs =
-    {
-      ...
-    }:
-    let
-      utils = import ./utils.nix;
-    in
-    with utils;
-    {
-      nixosModules = importAll ./nix_modules;
-      homeManagerModules = importAll ./hm_modules;
-    };
-}
diff --git a/flakes/common/hm_modules/de_i3/default.nix b/flakes/common/hm_modules/de_i3/default.nix
deleted file mode 100644
index 8274537..0000000
--- a/flakes/common/hm_modules/de_i3/default.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ ... }:
-{
-  imports = [ ./i3.nix ./polybar.nix ./theme.nix ];
-}
-
diff --git a/flakes/common/hm_modules/de_i3/i3.nix b/flakes/common/hm_modules/de_i3/i3.nix
deleted file mode 100644
index e6fb2ef..0000000
--- a/flakes/common/hm_modules/de_i3/i3.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ pkgs, ... }:
-{
-  xsession.enable = true;
-  xsession.windowManager.i3 = {
-    enable = true;
-    package = pkgs.i3;
-    extraConfig = ''
-        focus_follows_mouse no
-        default_border pixel 1
-        default_floating_border pixel 1
-        floating_modifier Mod4
-
-        # Dark mode colors
-        client.focused          #2e3440 #4c566a #eceff4 #4c566a #2e3440
-        client.unfocused        #2e3440 #2e3440 #d8dee9 #2e3440 #2e3440
-        client.focused_inactive #2e3440 #3b4252 #e5e9f0 #3b4252 #2e3440
-        client.urgent           #2e3440 #bf616a #eceff4 #bf616a #2e3440
-    '';
-    config = rec {
-      modifier = "Mod4";
-      terminal = "kitty";
-      menu = "rofi -show drun";
-
-
-      focus.followMouse = false;
-
-      gaps = {
-        inner = 2;
-        outer = 5;
-        smartBorders = "on";
-      };
-
-      keybindings = {
-        "${modifier}+Return" = "exec ${terminal}";
-        "${modifier}+space" = "exec pkill rofi || rofi -show drun";
-        "${modifier}+q" = "kill";
-        "${modifier}+shift+Escape" = "exit";
-        "${modifier}+shift+q" = "exec i3lock";
-        "${modifier}+f" = "floating toggle";
-
-        "${modifier}+h" = "focus left";
-        "${modifier}+l" = "focus right";
-        "${modifier}+k" = "focus up";
-        "${modifier}+j" = "focus down";
-
-        "${modifier}+1" = "workspace number 1";
-        "${modifier}+n" = "workspace number 1";
-        "${modifier}+2" = "workspace number 2";
-        "${modifier}+m" = "workspace number 2";
-        "${modifier}+3" = "workspace number 3";
-        "${modifier}+comma" = "workspace number 3";
-        "${modifier}+4" = "workspace number 4";
-        "${modifier}+period" = "workspace number 4";
-        "${modifier}+5" = "workspace number 5";
-        "${modifier}+slash" = "workspace number 5";
-        "${modifier}+6" = "workspace number 6";
-        "${modifier}+7" = "workspace number 7";
-        "${modifier}+8" = "workspace number 8";
-        "${modifier}+9" = "workspace number 9";
-        "${modifier}+0" = "workspace number 10";
-
-        "${modifier}+shift+h" = "move left";
-        "${modifier}+shift+l" = "move right";
-        "${modifier}+shift+k" = "move up";
-        "${modifier}+shift+j" = "move down";
-        "${modifier}+shift+1" = "move container to workspace number 1";
-        "${modifier}+shift+n" = "move container to workspace number 1";
-        "${modifier}+shift+2" = "move container to workspace number 2";
-        "${modifier}+shift+m" = "move container to workspace number 2";
-        "${modifier}+shift+3" = "move container to workspace number 3";
-        "${modifier}+shift+comma" = "move container to workspace number 3";
-        "${modifier}+shift+4" = "move container to workspace number 4";
-        "${modifier}+shift+period" = "move container to workspace number 4";
-        "${modifier}+shift+5" = "move container to workspace number 5";
-        "${modifier}+shift+slash" = "move container to workspace number 5";
-        "${modifier}+shift+6" = "move container to workspace number 6";
-        "${modifier}+shift+7" = "move container to workspace number 7";
-        "${modifier}+shift+8" = "move container to workspace number 8";
-        "${modifier}+shift+9" = "move container to workspace number 9";
-        "${modifier}+shift+0" = "move container to workspace number 10";
-
-        "${modifier}+Left" = "resize shrink width 10 px or 10 ppt";
-        "${modifier}+Down" = "resize shrink height 10 px or 10 ppt";
-        "${modifier}+Up" = "resize grow height 10 px or 10 ppt";
-        "${modifier}+Right" = "resize grow width 10 px or 10 ppt";
-
-        "Print" = "exec sh -c 'maim -s | xclip -selection clipboard -t image/png'";
-      };
-
-      bars = [ ];
-      startup = [ ];
-    };
-  };
-}
diff --git a/flakes/common/hm_modules/de_i3/polybar.nix b/flakes/common/hm_modules/de_i3/polybar.nix
deleted file mode 100644
index e19f86b..0000000
--- a/flakes/common/hm_modules/de_i3/polybar.nix
+++ /dev/null
@@ -1,306 +0,0 @@
-{ lib, pkgs, ... }:
-let
-  mf = "#3b3b3bcc";
-  bg = "#00000000";
-  fg = "#FFFFFF";
-
-  polybarRun = pkgs.writeShellScriptBin "pbr" ''
-    polybar -m | while IFS=: read -r mon rest; do
-      if echo "$rest" | ${pkgs.gnugrep}/bin/grep -q "(primary)"; then
-        MONITOR="$mon" polybar -r primary &
-      else
-        MONITOR="$mon" polybar -r others &
-      fi
-    done
-    wait
-  '';
-in
-{
-  services.polybar = {
-    enable = true;
-    package = pkgs.polybar.override {
-      i3Support = true;
-      iwSupport = true;
-      pulseSupport = true;
-    };
-    script = "${polybarRun}/bin/pbr";
-    settings = {
-      "global/wm" = {
-        margin-bottom = 0;
-        margin-top = 5;
-      };
-
-      "bar/main" = {
-        monitor = "\${env:MONITOR}";
-        width = "100%";
-        height = 20;
-        radius = 0;
-        background = bg;
-        foreground = fg;
-        font-0 = "JetBrainsMono Nerd Font:size=11;2";
-        font-1 = "Noto Sans CJK JP:size=11;2";
-
-        cursor-click = "pointer";
-        enable-ipc = true;
-      };
-
-      "bar/primary" = {
-        "inherit" = "bar/main";
-        modules-left = "i3";
-        modules-center = "clock temperature cpu memory filesystem";
-        modules-right = "volume tray powermenu";
-        # modules-right = "volume network bluetooth backlight tray powermenu";
-      };
-
-      "bar/others" = {
-        "inherit" = "bar/main";
-        modules-left = "i3";
-        modules-center = "clock temperature cpu memory filesystem";
-        modules-right = "";
-      };
-
-      "settings" = {
-        screenchange-reload = true;
-
-        compositing-background = "source";
-        compositing-foreground = "over";
-        compositing-overline = "over";
-        comppositing-underline = "over";
-        compositing-border = "over";
-
-        pseudo-transparency = true;
-      };
-
-      "module/i3" = {
-        type = "internal/i3";
-        index-sort = true;
-        pin-workspaces = true;
-        strip-wsnumbers = true;
-        wrapping-scroll = false;
-        format = "<label-state>";
-
-        ws-icon-0 = "1;一";
-        ws-icon-1 = "2;二";
-        ws-icon-2 = "3;三";
-        ws-icon-3 = "4;四";
-        ws-icon-4 = "5;五";
-        ws-icon-5 = "6;六";
-        ws-icon-6 = "7;七";
-        ws-icon-7 = "8;八";
-        ws-icon-8 = "9;九";
-        ws-icon-9 = "10;十";
-
-        label-unfocused = "%icon%";
-        label-focused = "%icon%";
-        label-focused-background = mf;
-        label-visible = "%icon%";
-        label-urgent = "%icon%";
-        label-occupied = "%icon%";
-
-        label-unfocused-padding = 1;
-        label-focused-padding = 1;
-        label-visible-padding = 1;
-        label-urgent-padding = 1;
-        label-occupied-padding = 1;
-      };
-
-      "module/clock" = {
-        type = "internal/date";
-        interval = 10;
-        date = "%b %d, %H:%M";
-        format = "<label>";
-        label = "%date%";
-      };
-
-      "module/temperature" = {
-        type = "internal/temperature";
-        interval = 5;
-        thermal-zone = 2;
-        hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
-        warn-temperature = 80;
-        format = "<label>";
-        format-prefix = "  ";
-        label = "󰔏 %temperature-c%";
-      };
-
-      "module/cpu" = {
-        type = "internal/cpu";
-        interval = 2;
-        format = "<label>";
-        format-prefix = "  ";
-        label = "󰻠 %percentage%%";
-      };
-
-      "module/memory" = {
-        type = "internal/memory";
-        interval = 5;
-        format = "<label>";
-        format-prefix = "  ";
-        label = "󰍛 %percentage_used%%";
-      };
-
-      "module/filesystem" = {
-        type = "internal/fs";
-        interval = 30;
-        mount-0 = "/";
-        format-mounted = "<label-mounted>";
-        label-mounted = "󰋊 %percentage_used%%";
-        format-mounted-prefix = "  ";
-      };
-
-      # "module/battery" = {
-      #   type = "internal/battery";
-      #   battery = "BAT0";
-      #   adapter = "AC";
-      #   full-at = 98;
-      #   format-charging = "%percentage%% ";
-      #   format-discharging = "%percentage%% %icon%";
-      #   format-full = "%percentage%% ";
-      #   ramp-capacity-0 = "";
-      #   ramp-capacity-1 = "";
-      #   ramp-capacity-2 = "";
-      #   ramp-capacity-3 = "";
-      #   ramp-capacity-4 = "";
-      # };
-      #
-      # "module/battery2" = {
-      #   type = "internal/battery";
-      #   battery = "BAT2";
-      #   adapter = "AC";
-      #   full-at = 98;
-      #   format-charging = "%percentage%% ";
-      #   format-discharging = "%percentage%% %icon%";
-      #   format-full = "%percentage%% ";
-      #   ramp-capacity-0 = "";
-      #   ramp-capacity-1 = "";
-      #   ramp-capacity-2 = "";
-      #   ramp-capacity-3 = "";
-      #   ramp-capacity-4 = "";
-      # };
-
-      # "module/volumea" = {
-      #   type = "custom/script";
-      #   format = "<label>";
-      #   exec = "/bin/sh";
-      #   exec-args = [
-      #     "-c"
-      #     "${pkgs.wireplumber}/bin/wpctl get-volume @DEFAULT_AUDIO_SINK@ 2>/dev/null | awk '{printf \"󰕿  %d%%\", $2*100}'"
-      #   ];
-      #   interval = 2;
-      #   click-left = "${pkgs.pavucontrol}/bin/pavucontrol";
-      #   click-right = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-      #   scroll-up = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.05+";
-      #   scroll-down = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.05-";
-      # };
-
-      "module/volume" = {
-        type = "internal/alsa";
-      };
-
-      # "module/wifi" = {
-      #   type = "internal/network";
-      #   interface = "wlp11s0";
-      #   unknown-as-up = true;
-      #   accumulate-stats = true;
-      #   interval = 3;
-      #   format-connected = "󰤨 %essid% (%signal%%)";
-      #   format-wired = "󰈀 %local_ip%";
-      #   format-disconnected = "󰖪 Disconnected";
-      # };
-
-      # "module/network" = {
-      #   type = "internal/network";
-      #   interface = "eno1";
-      #
-      #   interval = "1.0";
-      #
-      #   accumulate-stats = true;
-      #   unknown-as-up = true;
-      #
-      #   format-connected = "<label-connected>";
-      #   format-connected-background = mf;
-      #   format-connected-underline = bg;
-      #   format-connected-overline = bg;
-      #   format-connected-padding = 2;
-      #   format-connected-margin = 0;
-      #
-      #   format-disconnected = "<label-disconnected>";
-      #   format-disconnected-background = mf;
-      #   format-disconnected-underline = bg;
-      #   format-disconnected-overline = bg;
-      #   format-disconnected-padding = 2;
-      #   format-disconnected-margin = 0;
-      #
-      #   label-connected = "D %downspeed:2% | U %upspeed:2%";
-      #   label-disconnected = "DISCONNECTED";
-      # };
-
-      # "module/bluetooth" = {
-      #   type = "custom/script";
-      #   format = "<label>";
-      #   format-prefix = "  ";
-      #   exec = "/bin/sh";
-      #   exec-args = [
-      #     "-c"
-      #     "${pkgs.bluez}/bin/bluetoothctl info | grep -q 'Connected: yes' && echo '󰂱' || echo '󰂯 off'"
-      #   ];
-      #   interval = 5;
-      #   click-left = "blueman-manager";
-      # };
-
-      # "module/backlight" = {
-      #   type = "custom/script";
-      #   format = "<label>";
-      #   format-prefix = "  ";
-      #   exec = "/bin/sh";
-      #   exec-args = [
-      #     "-c"
-      #     "${pkgs.brightnessctl}/bin/brightnessctl -m | cut -d, -f4"
-      #   ];
-      #
-      #   interval = 2;
-      #   label = "%output%%  ";
-      #   scroll-up = "${pkgs.brightnessctl}/bin/brightnessctl set +5%";
-      #   scroll-down = "${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
-      # };
-
-      "module/powermenu" = {
-        type = "custom/menu";
-        expand-right = "false";
-
-        format = "<label-toggle> <menu>";
-        format-background = mf;
-        format-padding = 1;
-
-        label-open = " ";
-        label-close = " ";
-        label-separator = "|";
-
-        menu-0-0 = "󰍃 Logout";
-        menu-0-0-exec = "i3-msg exit";
-        menu-0-1 = " Reboot";
-        menu-0-1-exec = "systemctl reboot";
-        menu-0-2 = " Shutdown";
-        menu-0-2-exec = "systemctl poweroff";
-      };
-
-      "module/tray" = {
-        type = "internal/tray";
-        tray-foreground = fg;
-        tray-spacing = 4;
-        tray-size = "90%";
-        tray-position = "right";
-      };
-    };
-  };
-
-  home.packages = [
-    polybarRun
-
-    pkgs.playerctl
-    pkgs.brightnessctl
-    pkgs.blueman
-    pkgs.bluez
-    pkgs.noto-fonts-cjk-sans
-  ];
-}
diff --git a/flakes/common/hm_modules/de_i3/theme.nix b/flakes/common/hm_modules/de_i3/theme.nix
deleted file mode 100644
index 7d37d67..0000000
--- a/flakes/common/hm_modules/de_i3/theme.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ pkgs, ... }:
-{
-  home.pointerCursor = {
-    gtk.enable = true;
-    x11.enable = true;
-    package = pkgs.bibata-cursors;
-    name = "Bibata-Modern-Classic";
-    size = 14;
-  };
-
-  # Ensure all X11 apps see the same cursor settings
-  xresources.properties = {
-    "Xcursor.theme" = "Bibata-Modern-Classic";
-    "Xcursor.size" = 14;
-  };
-  home.sessionVariables = {
-    XCURSOR_THEME = "Bibata-Modern-Classic";
-    XCURSOR_SIZE = "14";
-  };
-
-  gtk = {
-    enable = true;
-    theme = { package = pkgs.flat-remix-gtk; name = "Flat-Remix-GTK-Grey-Darkest"; };
-    iconTheme = { package = pkgs.adwaita-icon-theme; name = "Adwaita"; };
-    font = { name = "Sans"; size = 11; };
-  };
-}
diff --git a/flakes/common/hm_modules/de_sway/sway.nix b/flakes/common/hm_modules/de_sway/sway.nix
deleted file mode 100644
index 09b7b09..0000000
--- a/flakes/common/hm_modules/de_sway/sway.nix
+++ /dev/null
@@ -1,180 +0,0 @@
-{
-  config,
-  ...
-}:
-
-{
-  wayland.windowManager.sway = {
-    enable = true;
-    xwayland = true;
-
-    systemd.enable = true;
-
-    config = rec {
-      modifier = "Mod4"; # SUPER
-      terminal = "foot";
-      menu = "wofi --show drun";
-
-      # Per-output workspace mapping (user can extend via extraOptions)
-      # Example (left as defaults): users can add `output HDMI-A-1 workspace 1,3,5` in extraOptions
-
-      input = {
-        "type:keyboard" = {
-          xkb_layout = "us";
-          xkb_options = "caps:escape";
-        };
-        "type:touchpad" = {
-          natural_scroll = "enabled";
-          tap = "enabled";
-          dwt = "enabled";
-        };
-        # Disable focus follows mouse to avoid accidental focus changes
-        # In Sway this behavior is controlled by focus_follows_mouse
-      };
-
-      focus = {
-        followMouse = "no";
-        # onWindowActivation = "urgent"; # don't steal focus; mark urgent instead
-      };
-
-      gaps = {
-        inner = 2;
-        outer = 5;
-        smartGaps = false;
-        smartBorders = "on";
-      };
-
-      colors = {
-        focused = {
-          background = "#444444";
-          border = "#555555";
-          childBorder = "#444444";
-          indicator = "#595959";
-          text = "#f1f1f1";
-        };
-        unfocused = {
-          background = "#222222";
-          border = "#333333";
-          childBorder = "#222222";
-          indicator = "#292d2e";
-          text = "#888888";
-        };
-      };
-
-      window = {
-        border = 1;
-        titlebar = false;
-        commands = [
-          # Bitwarden chrome popup as floating example from Hyprland rules
-          {
-            criteria = {
-              app_id = "chrome-nngceckbapebfimnlniiiahkandclblb-Default";
-            };
-            command = "floating enable";
-          }
-          {
-            criteria = {
-              app_id = "pavucontrol";
-            };
-            command = "floating enable, move position center, resize set 620 1200";
-          }
-          {
-            criteria = {
-              class = "Google-chrome";
-              window_role = "pop-up";
-            };
-            command = "floating enable, move position center, resize set 720 480";
-          }
-          {
-            criteria = {
-              window_role = "pop-up";
-            };
-            command = "floating enable, move position center, resize set 640 420";
-          }
-          {
-            criteria = {
-              window_role = "About";
-            };
-            command = "floating enable, move position center, resize set 640 420";
-          }
-        ];
-      };
-
-      # Keybindings mirroring Hyprland
-      keybindings = {
-        # Apps
-        "${modifier}+return" = "exec ${config.wayland.windowManager.sway.config.terminal}";
-        "${modifier}+space" = "exec pkill wofi || wofi --show drun";
-        "${modifier}+q" = "kill";
-        "${modifier}+shift+Escape" = "exit";
-        "${modifier}+shift+q" = "exec swaylock";
-        "${modifier}+f" = "floating toggle";
-
-        # Focus
-        "${modifier}+h" = "focus left";
-        "${modifier}+l" = "focus right";
-        "${modifier}+k" = "focus up";
-        "${modifier}+j" = "focus down";
-
-        # Workspaces (numbers and vim-like mirror)
-        "${modifier}+1" = "workspace number 1";
-        "${modifier}+n" = "workspace number 1";
-        "${modifier}+2" = "workspace number 2";
-        "${modifier}+m" = "workspace number 2";
-        "${modifier}+3" = "workspace number 3";
-        "${modifier}+comma" = "workspace number 3";
-        "${modifier}+4" = "workspace number 4";
-        "${modifier}+period" = "workspace number 4";
-        "${modifier}+5" = "workspace number 5";
-        "${modifier}+slash" = "workspace number 5";
-        "${modifier}+6" = "workspace number 6";
-        "${modifier}+7" = "workspace number 7";
-        "${modifier}+8" = "workspace number 8";
-        "${modifier}+9" = "workspace number 9";
-        "${modifier}+0" = "workspace number 10";
-
-        # Move windows
-        "${modifier}+shift+h" = "move left";
-        "${modifier}+shift+l" = "move right";
-        "${modifier}+shift+k" = "move up";
-        "${modifier}+shift+j" = "move down";
-        "${modifier}+shift+1" = "move container to workspace number 1";
-        "${modifier}+shift+n" = "move container to workspace number 1";
-        "${modifier}+shift+2" = "move container to workspace number 2";
-        "${modifier}+shift+m" = "move container to workspace number 2";
-        "${modifier}+shift+3" = "move container to workspace number 3";
-        "${modifier}+shift+comma" = "move container to workspace number 3";
-        "${modifier}+shift+4" = "move container to workspace number 4";
-        "${modifier}+shift+period" = "move container to workspace number 4";
-        "${modifier}+shift+5" = "move container to workspace number 5";
-        "${modifier}+shift+slash" = "move container to workspace number 5";
-        "${modifier}+shift+6" = "move container to workspace number 6";
-        "${modifier}+shift+7" = "move container to workspace number 7";
-        "${modifier}+shift+8" = "move container to workspace number 8";
-        "${modifier}+shift+9" = "move container to workspace number 9";
-        "${modifier}+shift+0" = "move container to workspace number 10";
-
-        "${modifier}+left" = "resize shrink width 10 px or 10 ppt";
-        "${modifier}+down" = "resize shrink height 10 px or 10 ppt";
-        "${modifier}+up" = "resize grow height 10 px or 10 ppt";
-        "${modifier}+right" = "resize grow width 10 px or 10 ppt";
-
-        # Mouse bindings (Mod + drag)
-        "${modifier}+button1" = "move";
-        "${modifier}+button3" = "resize";
-
-        # Screenshot
-        "Print" = "exec grim -g \"$(slurp)\" - | wl-copy";
-      };
-
-      bars = [ ]; # Use Waybar via Home Manager
-      startup = [
-        {
-          command = "exec sh -c 'sleep 0.01; swaymsg workspace number 7 ; sleep 0.01; swaymsg workspace number 1'";
-        }
-        # Waybar is managed by Home Manager systemd unit
-        # { command = "pgrep waybar >/dev/null || waybar"; }
-      ];
-    };
-  };
-}
diff --git a/flakes/common/hm_modules/de_sway/swaync.nix b/flakes/common/hm_modules/de_sway/swaync.nix
deleted file mode 100644
index a60df5d..0000000
--- a/flakes/common/hm_modules/de_sway/swaync.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-{ ... }:
-{
-  services.swaync = {
-    enable = true;
-    settings = {
-      ignore = [ "com.spotify.Client" ];
-      positionX = "right";
-      positionY = "top";
-      layer = "overlay";
-      control-center-layer = "top";
-      layer-shell = true;
-      cssPriority = "application";
-      control-center-margin-top = 0;
-      control-center-margin-bottom = 0;
-      control-center-margin-right = 0;
-      control-center-margin-left = 0;
-      notification-2fa-action = true;
-      notification-inline-replies = false;
-      notification-icon-size = 64;
-      notification-body-image-height = 100;
-      notification-body-image-width = 200;
-      timeout = 10;
-      timeout-low = 5;
-      timeout-critical = 0;
-      control-center-width = 500;
-      control-center-height = 600;
-      notification-window-width = 500;
-      keyboard-shortcuts = true;
-      image-visibility = "when-available";
-      transition-time = 200;
-      hide-on-clear = false;
-      hide-on-action = true;
-      script-fail-notify = true;
-      widgets = [
-        "inhibitors"
-        "title"
-        "dnd"
-        "volume"
-        "backlight"
-        "mpris"
-        "buttons-grid#quick"
-        "notifications"
-      ];
-      widget-config = {
-        inhibitors = {
-          text = "Inhibitors";
-          button-text = "Clear All";
-          clear-all-button = true;
-        };
-        title = {
-          text = "Notifications";
-          clear-all-button = true;
-          button-text = "Clear All";
-        };
-        dnd.text = "Do Not Disturb";
-        mpris = {
-          image-size = 96;
-          image-radius = 12;
-        };
-        volume = {
-          label = "󰕾";
-          show-per-app = true;
-        };
-        backlight = {
-          label = "󰃟";
-          device = "intel_backlight";
-        };
-        # "buttons-grid#quick" = {
-        #   columns = 4;
-        #   icon-size = 20;
-        #   actions = [
-        #     { label = "󰐥"; tooltip = "Shutdown"; command = "confirm-action 'systemctl poweroff' 'Shutdown?'"; }
-        #     { label = "󰜉"; tooltip = "Reboot"; command = "confirm-action 'systemctl reboot' 'Reboot?'"; }
-        #     { label = "󰍃"; tooltip = "Logout"; command = "confirm-action 'swaymsg exit' 'Logout?'"; }
-        #   ];
-        # };
-      };
-    };
-    style = ''
-      .control-center { background: #1a1b26; border: 2px solid #7dcae4; border-radius: 12px; }
-      .control-center-list { background: transparent; }
-      .control-center .notification-row:focus, .control-center .notification-row:hover { opacity: 1; background: #24283b; }
-      .notification { border-radius: 8px; margin: 6px 12px; box-shadow: 0 0 0 1px rgba(125,196,228,.3), 0 1px 3px 1px rgba(0,0,0,.7), 0 2px 6px 2px rgba(0,0,0,.3); padding: 0; }
-      .widget-title { margin: 8px; font-size: 1.5rem; color: #c0caf5; }
-      .widget-dnd { margin: 8px; font-size: 1.1rem; color: #c0caf5; }
-      .widget-dnd > switch { font-size: initial; border-radius: 8px; background: #414868; border: 1px solid #7dcae4; }
-      .widget-dnd > switch:checked { background: #7dcae4; }
-      .widget-mpris { color: #c0caf5; background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; }
-      .widget-mpris-player { padding: 8px; margin: 8px; }
-      .widget-mpris-title { font-weight: bold; font-size: 1.25rem; }
-      .widget-mpris-subtitle { font-size: 1.1rem; color: #9ece6a; }
-      .widget-volume, .widget-backlight, .widget-menubar { background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; color: #c0caf5; }
-      .widget-menubar .menu-item button { background: #1f2335; color: #c0caf5; border-radius: 8px; padding: 6px 10px; margin: 4px; border: 1px solid #2e3440; font-family: "JetBrainsMonoNL Nerd Font"; }
-      .widget-menubar .menu-item button:hover { background: #414868; border-color: #7dcae4; }
-      .topbar-buttons button { border: none; background: transparent; color: #c0caf5; font-size: 1.1rem; border-radius: 8px; margin: 0 4px; padding: 8px; }
-      .topbar-buttons button:hover { background: #414868; }
-      .topbar-buttons button:active { background: #7dcae4; color: #1a1b26; }
-    '';
-  };
-}
diff --git a/flakes/common/hm_modules/de_sway/waybar.nix b/flakes/common/hm_modules/de_sway/waybar.nix
deleted file mode 100644
index cf2afff..0000000
--- a/flakes/common/hm_modules/de_sway/waybar.nix
+++ /dev/null
@@ -1,246 +0,0 @@
-{ ... }:
-{
-  programs.waybar = {
-    enable = true;
-    systemd.enable = true;
-    settings = {
-      mainBar = {
-        layer = "top";
-        position = "top";
-        height = 28;
-        spacing = 6;
-        margin-top = 0;
-        margin-bottom = 0;
-        margin-left = 10;
-        margin-right = 10;
-
-        modules-left = [
-          "sway/workspaces"
-        ];
-        modules-center = [
-          "clock"
-          "temperature"
-          "cpu"
-          "memory"
-          "disk"
-        ];
-        modules-right = [
-          "battery"
-          "battery#bat2"
-          "pulseaudio"
-          "network"
-          "bluetooth"
-          "power-profiles-daemon"
-          "backlight"
-          "custom/notifications"
-          "sway/language"
-          "tray"
-          "custom/power"
-        ];
-
-        "sway/workspaces" = {
-          format = "{icon}";
-          format-icons = {
-            "1" = "一";
-            "2" = "二";
-            "3" = "三";
-            "4" = "四";
-            "5" = "五";
-            "6" = "六";
-            "7" = "七";
-            "8" = "八";
-            "9" = "九";
-            "10" = "十";
-            "11" = "十一";
-            "12" = "十二";
-            "13" = "十三";
-            "14" = "十四";
-            "15" = "十五";
-            "16" = "十六";
-            "17" = "十七";
-            "18" = "十八";
-            "19" = "十九";
-            "20" = "二十";
-          };
-          disable-scroll = false;
-        };
-
-        # CENTER
-        clock = {
-          format = "{:%b %d, %H:%M}";
-          tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-        };
-
-        temperature = {
-          thermal-zone = 2;
-          hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
-          critical-threshold = 80;
-          format-critical = "󰔏 {temperatureC}°C";
-          format = "󰔏 {temperatureC}°C";
-        };
-
-        cpu = {
-          format = "󰻠 {usage}%";
-          tooltip = true;
-          on-click = "btop";
-        };
-
-        memory = {
-          format = "󰍛 {}%";
-          on-click = "btop";
-        };
-
-        disk = {
-          interval = 30;
-          format = "󰋊 {percentage_used}%";
-          path = "/";
-          on-click = "btop";
-        };
-
-        # RIGHT
-        "battery" = {
-          "states" = {
-            # "good"= 95;
-            "warning" = 30;
-            "critical" = 15;
-          };
-          "format" = "{capacity}% {icon}";
-          "format-full" = "{capacity}% {icon}";
-          "format-charging" = "{capacity}% ";
-          "format-plugged" = "{capacity}% ";
-          "format-alt" = "{time} {icon}";
-          # "format-good"= ""; // An empty format will hide the module
-          # "format-full"= "";
-          "format-icons" = [
-            ""
-            ""
-            ""
-            ""
-            ""
-          ];
-        };
-        "battery#bat2" = {
-          "bat" = "BAT2";
-        };
-
-        pulseaudio = {
-          format = "{icon} {volume}%";
-          format-bluetooth = "󰂰 {volume}%";
-          format-bluetooth-muted = "󰂲 ";
-          format-muted = "󰖁 ";
-          format-source = "󰍬 {volume}%";
-          format-source-muted = "󰍭 ";
-          format-icons = {
-            headphone = "󰋋";
-            hands-free = "󰂑";
-            headset = "󰂑";
-            phone = "󰏲";
-            portable = "󰦧";
-            car = "󰄋";
-            default = [
-              "󰕿"
-              "󰖀"
-              "󰕾"
-            ];
-          };
-          scroll-step = 5;
-          on-click = "pavucontrol";
-          on-click-right = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        };
-
-        network = {
-          format-wifi = "󰤨 {essid} ({signalStrength}%)";
-          format-ethernet = "󰈀 {ipaddr}/{cidr}";
-          tooltip-format = "{ifname} via {gwaddr} ";
-          format-linked = "󰈀 {ifname} (No IP)";
-          format-disconnected = "󰖪 Disconnected";
-          # on-click = "wofi-wifi-menu";
-          # on-click-right = "nmcli radio wifi toggle";
-        };
-
-        bluetooth = {
-          format = "󰂯 {status}";
-          format-connected = "󰂱 {device_alias}";
-          format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
-          tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
-          tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
-          tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
-          tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
-          # on-click = "wofi-bluetooth-menu";
-          # on-click-right = "bluetoothctl power toggle";
-        };
-
-        "power-profiles-daemon" = {
-          format = "{icon}";
-          "tooltip-format" = "Power profile: {profile}\nDriver: {driver}";
-          tooltip = true;
-          "format-icons" = {
-            default = "";
-            performance = "";
-            balanced = "";
-            "power-saver" = "";
-          };
-        };
-
-        backlight = {
-          format = "{percent}% {icon}";
-          "format-icons" = [
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-          ];
-        };
-
-        "custom/notifications" = {
-          format = "{icon} {}";
-          format-icons = {
-            notification = "";
-            none = "";
-            dnd-notification = "󰂛";
-            dnd-none = "󰂛";
-            inhibited-notification = "";
-            inhibited-none = "";
-            dnd-inhibited-notification = "󰂛";
-            dnd-inhibited-none = "󰂛";
-          };
-          return-type = "json";
-          exec-if = "which swaync-client";
-          exec = "swaync-client -swb";
-          on-click = "swaync-client -t -sw";
-          on-click-right = "swaync-client -d -sw";
-          escape = true;
-          tooltip = false;
-        };
-
-        "sway/language" = {
-          format = "{}";
-        };
-
-        "tray" = {
-          "spacing" = 10;
-        };
-
-        "custom/power" = {
-          format = "⏻ ";
-          tooltip = false;
-          menu = "on-click";
-          "menu-file" = ./waybar/power_menu.xml;
-          "menu-actions" = {
-            shutdown = "shutdown 0";
-            reboot = "reboot";
-            logout = "loginctl terminate-session $(loginctl list-sessions | grep seat0 | awk '{print $1}')";
-          };
-        };
-
-      };
-    };
-
-    style = builtins.readFile ./waybar/waybar.css;
-  };
-}
diff --git a/flakes/common/hm_modules/foot.nix b/flakes/common/hm_modules/foot.nix
deleted file mode 100644
index d52af61..0000000
--- a/flakes/common/hm_modules/foot.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ ... }:
-{
-  programs.foot = {
-    enable = true;
-
-    # This renders to ~/.config/foot/foot.ini
-    settings = {
-      main = {
-        # Use the same font and size as your Kitty config
-        font = "JetBrainsMonoNL Nerd Font:size=12";
-
-        # Initial window size in character cells (Kitty used 160c x 55c)
-        "initial-window-size-chars" = "160x55";
-      };
-
-      colors = {
-        # Background opacity (1.0 = opaque)
-        alpha = "0.94";
-
-        # Foreground/background
-        foreground = "e0e0e0";
-        background = "262626";
-
-        # 16-color palette
-        # normal (0–7)
-        regular0 = "1f1f1f"; # black
-        regular1 = "f38ba8"; # red
-        regular2 = "a6e3a1"; # green
-        regular3 = "f9e2af"; # yellow
-        regular4 = "89b4fa"; # blue
-        regular5 = "cba6f7"; # magenta
-        regular6 = "89dceb"; # cyan
-        regular7 = "e0e0e0"; # white
-
-        # bright (8–15)
-        bright0 = "565656"; # bright black
-        bright1 = "f38ba8"; # bright red
-        bright2 = "a6e3a1"; # bright green
-        bright3 = "f9e2af"; # bright yellow
-        bright4 = "89b4fa"; # bright blue
-        bright5 = "cba6f7"; # bright magenta
-        bright6 = "89dceb"; # bright cyan
-        bright7 = "ffffff"; # bright white
-      };
-    };
-  };
-}
diff --git a/flakes/common/hm_modules/kitty.nix b/flakes/common/hm_modules/kitty.nix
deleted file mode 100644
index b40f6bc..0000000
--- a/flakes/common/hm_modules/kitty.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ ... }:
-{
-  # Enable Kitty terminal
-  programs.kitty = {
-    enable = true;
-
-    settings = {
-      # Window settings
-      background_opacity = 0.9;
-      os_window_class = "kitty";
-      remember_window_size = false;
-      placement_strategy = "center";
-      initial_window_width = "160c";
-      initial_window_height = "55c";
-
-      # Remove window borders
-      hide_window_decorations = "titlebar-only";
-      tab_title_template = "none";
-      active_tab_title_template = "none";
-      draw_minimal_borders = "yes";
-      window_border_width = "0.1pt";
-
-      # Colors (Catppuccin Coal)
-      foreground = "#e0e0e0";
-      background = "#262626";
-      color0 = "#1f1f1f";
-      color1 = "#f38ba8";
-      color2 = "#a6e3a1";
-      color3 = "#f9e2af";
-      color4 = "#89b4fa";
-      color5 = "#cba6f7";
-      color6 = "#89dceb";
-      color7 = "#e0e0e0";
-      color8 = "#565656";
-      color9 = "#f38ba8";
-      color10 = "#a6e3a1";
-      color11 = "#f9e2af";
-      color12 = "#89b4fa";
-      color13 = "#cba6f7";
-      color14 = "#89dceb";
-      color15 = "#ffffff";
-
-      # Font settings
-      font_family = "JetBrainsMonoNL Nerd Font";
-      font_size = 12.0;
-      bold_font = "auto";
-      italic_font = "auto";
-      italic_bold_font = "auto";
-    };
-
-    # If you want to include extra configuration this way instead of through the main `settings` attribute
-    extraConfig = ''
-      # You can add additional config here if needed
-    '';
-  };
-}
diff --git a/flakes/common/nix_modules/boot_grub.nix b/flakes/common/nix_modules/boot_grub.nix
deleted file mode 100644
index 6043350..0000000
--- a/flakes/common/nix_modules/boot_grub.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  ...
-}:
-
-{
-  boot.loader.grub = {
-    enable = true;
-    device = "/dev/sda";
-  };
-}
diff --git a/flakes/common/nix_modules/boot_systemd.nix b/flakes/common/nix_modules/boot_systemd.nix
deleted file mode 100644
index fd2ed91..0000000
--- a/flakes/common/nix_modules/boot_systemd.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  ...
-}:
-{
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-      consoleMode = "keep";
-    };
-    timeout = 5;
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-}
diff --git a/flakes/common/nix_modules/de_i3.nix b/flakes/common/nix_modules/de_i3.nix
deleted file mode 100644
index ae0bda4..0000000
--- a/flakes/common/nix_modules/de_i3.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  # Caps Lock as Escape for console/tty and Wayland
-  console.useXkbConfig = true;
-  services.xserver.xkb = {
-    layout = "us";
-    options = "caps:escape";
-  };
-
-  xdg.portal = {
-    enable = true;
-    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
-    config.common.default = [ "gtk" ];
-  };
-
-  services.xserver = {
-    enable = true;
-    windowManager.i3 = {
-      enable = true;
-      extraPackages = with pkgs; [
-        dmenu
-        maim
-        xclip
-        xfce.thunar
-      ];
-    };
-    displayManager = {
-      lightdm.enable = true;
-    };
-  };
-  services.displayManager.defaultSession = "none+i3";
-
-  hardware.graphics.enable = true;
-  security.rtkit.enable = true;
-
-  # Applets/services for tray widgets
-  programs.nm-applet.enable = true;
-  services.blueman.enable = true;
-  services.upower.enable = true;
-}
diff --git a/flakes/common/nix_modules/de_sway.nix b/flakes/common/nix_modules/de_sway.nix
deleted file mode 100644
index a9e9fe9..0000000
--- a/flakes/common/nix_modules/de_sway.nix
+++ /dev/null
@@ -1,116 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  # Caps Lock as Escape for console/tty and Wayland
-  console.useXkbConfig = true;
-  services.xserver.xkb = {
-    layout = "us";
-    options = "caps:escape";
-  };
-
-  xdg.portal = {
-    enable = true;
-    extraPortals = lib.mkForce [
-      pkgs.xdg-desktop-portal-wlr
-      pkgs.xdg-desktop-portal-gtk
-    ];
-    config.common.default = [
-      "wlr"
-      "gtk"
-    ];
-  };
-
-  services.greetd = {
-    enable = true;
-    vt = 2;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.sway}/bin/sway'";
-        user = "greeter";
-      };
-    };
-  };
-
-  # Core packages and tools
-  environment.systemPackages = with pkgs; [
-    wl-clipboard
-    wl-clip-persist
-    wofi # application launcher
-    nemo # file manager (x11)
-    feh # image viewer (x11)
-    networkmanager
-    upower
-    brightnessctl
-    wireplumber
-    libgtop
-    bluez
-    power-profiles-daemon
-    grim
-    slurp
-    wf-recorder
-    btop
-    pavucontrol
-  ];
-
-  services.blueman.enable = config.hardware.bluetooth.enable;
-
-  programs.sway = {
-    enable = true;
-    wrapperFeatures.gtk = true; # include GTK integration env
-    extraPackages = with pkgs; [
-      xwayland # allow legacy X11 apps
-    ];
-  };
-
-  # Enable PipeWire + WirePlumber so xdg-desktop-portal can do screencast
-  services.pipewire = {
-    enable = true;
-    # Enable WirePlumber session manager via the pipewire module option
-    wireplumber = {
-      enable = true;
-    };
-  };
-
-  # Ensure graphics/OpenGL are enabled so Sway uses GPU-backed rendering
-  hardware.graphics = {
-    enable = true;
-    # extraPackages can be used to force vendor-specific mesa/drivers if needed
-    # Keep defaults; Sway runs fine with mesa in system
-    # extraPackages = with pkgs; [];
-  };
-
-  # Environment variables
-  environment.sessionVariables = lib.mkMerge [
-    {
-      GTK_THEME = "Adwaita:dark";
-      XDG_SESSION_TYPE = "wayland";
-      XDG_CURRENT_DESKTOP = "sway";
-      XDG_SESSION_DESKTOP = "sway";
-      # prefer EGL renderer (can be changed back to "auto" if needed)
-      WLR_RENDERER = "egl";
-
-      # Tell apps to run native wayland
-      NIXOS_OZONE_WL = "1";
-      ELECTRON_OZONE_PLATFORM_HINT = "wayland";
-      ELECTRON_ENABLE_WAYLAND = "1";
-      ELECTRON_DISABLE_SANDBOX = "0";
-      GDK_BACKEND = "wayland,x11"; # GTK
-      QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
-      MOZ_ENABLE_WAYLAND = "1"; # Firefox
-      SDL_VIDEODRIVER = "wayland"; # SDL apps/games
-      CLUTTER_BACKEND = "wayland";
-    }
-  ];
-
-  # Qt theming
-  qt = {
-    enable = true;
-    platformTheme = "gtk2";
-    style = "adwaita-dark";
-  };
-}
diff --git a/flakes/common/nix_modules/docker.nix b/flakes/common/nix_modules/docker.nix
deleted file mode 100644
index 1d9b1ff..0000000
--- a/flakes/common/nix_modules/docker.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  config,
-  ...
-}:
-
-{
-  virtualisation.docker = {
-    enable = true;
-    autoPrune.enable = true;
-  };
-  users.extraGroups.docker.members = builtins.attrNames config.users.users;
-  environment.shellAliases = {
-    dockerv = "docker volume";
-    dockeri = "docker image";
-    dockerc = "docker container";
-  };
-}
diff --git a/flakes/common/nix_modules/essentials/default.nix b/flakes/common/nix_modules/essentials/default.nix
deleted file mode 100644
index 1f59169..0000000
--- a/flakes/common/nix_modules/essentials/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib;
-{
-  environment.systemPackages = with pkgs; [
-    # Essentials
-    vim
-    nano
-    wget
-    curl
-    traceroute
-    dig
-    fastfetch
-    jq
-    bat
-    htop
-    unzip
-    fzf
-    ripgrep
-    lsof
-    killall
-    speedtest-cli
-  ];
-
-  environment.shellAliases = {
-    n = "nvim";
-    nn = "nvim --headless '+SessionDelete' +qa > /dev/null 2>&1 && nvim";
-    bat = "bat --theme Coldark-Dark";
-    cat = "bat --pager=never -p";
-
-    # TODO this may not be needed now that I am using `nh` clean mode (see /hosts/_common/configuration.nix#programs.nh)
-    nix-boot-clean = "find '/boot/loader/entries' -type f ! -name 'windows.conf' | head -n -4 | xargs -I {} rm {}; nix store gc; nixos-rebuild boot; echo; df";
-    ndr = "nix-direnv-reload";
-
-    # general unix
-    date_compact = "date +'%Y%m%d'";
-    date_short = "date +'%Y-%m-%d'";
-    time_compact = "date +'%Y%m%d%H%M%'";
-    time_short = "date +'%Y-%m-%dT%H:%M:%S'";
-    ls = "ls --color -Gah";
-    ll = "ls --color -Galhtr";
-    lss = "du --max-depth=0 -h {.,}* 2>/dev/null | sort -hr";
-    psg = "ps aux | head -n 1 && ps aux | grep -v 'grep' | grep";
-
-    # ripgrep
-    rg = "rg --no-ignore";
-    rgf = "rg --files --glob '!/nix/store/**' 2>/dev/null | rg";
-  };
-
-  environment.shellInit = lib.concatStringsSep "\n\n" [
-    (builtins.readFile ./unix_utils.func.sh)
-    (builtins.readFile ./nixpkg.func.sh)
-    (builtins.readFile ./envrc-import.func.sh)
-  ];
-}
diff --git a/flakes/common/nix_modules/essentials/envrc-import.func.sh b/flakes/common/nix_modules/essentials/envrc-import.func.sh
deleted file mode 100644
index e588e3e..0000000
--- a/flakes/common/nix_modules/essentials/envrc-import.func.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-# Function to import a .envrc from a central repository of flake wrappers
-# It finds all subdirectories in a configured path that contain a .envrc file,
-# lets you choose one with fzf, and appends its content to the local .envrc.
-envrc() {
-  # --- CONFIGURATION ---
-  # Set this to the path where your flake wrapper projects are stored.
-  local FLAKE_WRAPPERS_DIR="$HOME/projects/flake_wrappers"
-
-  # Check if the source directory exists
-  if [ ! -d "$FLAKE_WRAPPERS_DIR" ]; then
-    echo "Error: Directory not found: $FLAKE_WRAPPERS_DIR" >&2
-    echo "Please configure the FLAKE_WRAPPERS_DIR variable in the import_envrc function." >&2
-    return 1
-  fi
-
-  # Find all subdirectories that contain a .envrc file.
-  # -mindepth 1 and -maxdepth 1 ensure we only search the immediate children.
-  # The `-exec test -f {}/.envrc \;` part checks for the existence of the file.
-  # We use `fzf` to create an interactive menu.
-  # The --preview shows the content of the .envrc file for the highlighted entry.
-  # `bat` is used for preview if available, otherwise it falls back to `cat`.
-  local selected_dir=$(find "$FLAKE_WRAPPERS_DIR" -mindepth 1 -maxdepth 1 -type d -exec test -f {}/.envrc \; -print | \
-    fzf --prompt="Select a Flake Wrapper to import > " \
-        --header="[CTRL-C or ESC to quit]" \
-        --preview="([[ -x \"$(command -v bat)\" ]] && bat --color=always --plain {}/.envrc) || cat {}/.envrc" \
-        --preview-window="right:60%:wrap")
-
-  # If the user pressed ESC or CTRL-C, fzf returns an empty string.
-  # The `[ -z "$selected_dir" ]` check handles this case.
-  if [ -z "$selected_dir" ]; then
-    echo "No selection made. Operation cancelled."
-    return 1
-  fi
-
-  local source_envrc="$selected_dir/.envrc"
-
-  # Check if the selected .envrc file is readable
-  if [ ! -r "$source_envrc" ]; then
-    echo "Error: Cannot read file: $source_envrc" >&2
-    return 1
-  fi
-
-  # Append the contents of the selected .envrc to the local .envrc file.
-  # The `>>` operator will create the file if it doesn't exist, or append if it does.
-  # We add a newline before appending to ensure separation if the local file doesn't end with one.
-  printf "\n# Imported from %s\n" "$source_envrc" >> ./.envrc
-  cat "$source_envrc" >> ./.envrc
-
-  echo "✅ Successfully appended '$source_envrc' to the local .envrc file."
-  ndr
-}
diff --git a/flakes/common/nix_modules/essentials/nixpkg.func.sh b/flakes/common/nix_modules/essentials/nixpkg.func.sh
deleted file mode 100644
index 956a539..0000000
--- a/flakes/common/nix_modules/essentials/nixpkg.func.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-# nix
-alias nixpkgs=nixpkg
-nixpkg () {
-  if [ $# -eq 0 ]; then
-    echo "Error: No arguments provided. Please specify at least one package."
-    return 1
-  fi
-  cmd="nix shell"
-  for pkg in "$@"; do
-    cmd="$cmd \"nixpkgs#$pkg\""
-  done
-  eval $cmd
-}
diff --git a/flakes/common/nix_modules/essentials/unix_utils.func.sh b/flakes/common/nix_modules/essentials/unix_utils.func.sh
deleted file mode 100644
index 3120f6d..0000000
--- a/flakes/common/nix_modules/essentials/unix_utils.func.sh
+++ /dev/null
@@ -1,65 +0,0 @@
-# Check if ~/.config/environment exists and source all files within it
-if [ -d "$HOME/.config/environment" ]; then
-  for file in "$HOME/.config/environment/"*; do
-    if [ -r "$file" ]; then
-      if ! . "$file"; then
-        echo "Failed to source $file"
-      fi
-    fi
-  done
-fi
-
-htop_psg () {
-  htop -p $(psg $1 | awk '{r=r s $2;s=","} END{print r}')
-}
-
-htop_pid () {
-  htop -p $(ps -ef | awk -v proc=$1 '$3 == proc { cnt++;if (cnt == 1) { printf "%s",$2 } else { printf ",%s",$2 } }')
-}
-
-psg_kill() {
-  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
-    if [ -n "${pid}" ]; then
-      echo "killing ${pid}"
-      kill -9 "${pid}" &> /dev/null
-    fi
-  done
-}
-
-psg_terminate() {
-  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
-    if [ -n "${pid}" ]; then
-      echo "Terminating ${pid}"
-      kill -15 "${pid}" &> /dev/null
-    fi
-  done
-}
-
-psg_skill() {
-  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
-    if [ -n "${pid}" ]; then
-      echo "Killing ${pid}"
-      sudo kill -9 "${pid}" &> /dev/null
-    fi
-  done
-}
-
-mail_clear() {
-  : > /var/mail/$USER
-}
-
-speedtest_fs () {
-  dir=$(pwd)
-  drive=$(df -h ${dir} | awk 'NR==2 {print $1}')
-  echo Testing read speeds on drive ${drive}
-  sudo hdparm -Tt ${drive}
-  test_file=$(date +%u%m%d)
-  test_file="${dir}/speedtest_fs_${test_file}"
-  echo
-  echo Testing write speeds into test file: ${test_file}
-  dd if=/dev/zero of=${test_file} bs=8k count=10k; rm -f ${test_file}
-}
-
-speedtest_internet () {
-  speedtest-cli
-}
diff --git a/flakes/common/nix_modules/flatpaks.nix b/flakes/common/nix_modules/flatpaks.nix
deleted file mode 100644
index e69de29..0000000
diff --git a/flakes/common/nix_modules/git/branching_setup.func.sh b/flakes/common/nix_modules/git/branching_setup.func.sh
deleted file mode 100644
index ee90974..0000000
--- a/flakes/common/nix_modules/git/branching_setup.func.sh
+++ /dev/null
@@ -1,106 +0,0 @@
-branching_setup() {
-  # Interactive helper to manage worktree.autolink and worktree.bootstrap
-  local common_dir repo_root
-  if ! common_dir=$(git rev-parse --git-common-dir 2>/dev/null); then
-    echo "Not inside a git repository." >&2
-    return 1
-  fi
-  if [ "${common_dir#/}" = "$common_dir" ]; then
-    common_dir="$(pwd)/$common_dir"
-  fi
-  repo_root="${common_dir%%/.git*}"
-  if [ -z "$repo_root" ]; then
-    echo "Unable to determine repository root." >&2
-    return 1
-  fi
-
-  # Build candidate ignored/untracked top-level entries
-  local -a raw=()
-  while IFS= read -r -d '' file; do
-    raw+=("$file")
-  done < <(git -C "$repo_root" ls-files --others --ignored --exclude-standard -z || true)
-
-  # Reduce to top-level names (directories or files)
-  local -a tops=()
-  for c in "${raw[@]}"; do
-    c="${c%/}"
-    local top="${c%%/*}"
-    [ -z "$top" ] && continue
-    local found=0
-    for existing in "${tops[@]}"; do
-      [ "$existing" = "$top" ] && found=1 && break
-    done
-    [ "$found" -eq 0 ] && tops+=("$top")
-  done
-
-  # Include common root items even if tracked (for convenience)
-  for extra in .env .env.development .env.development.local .envrc .direnv flake.nix flake.lock; do
-    if [ -e "$repo_root/$extra" ]; then
-      local exists=0
-      for t in "${tops[@]}"; do [ "$t" = "$extra" ] && exists=1 && break; done
-      [ $exists -eq 0 ] && tops+=("$extra")
-    fi
-  done
-
-  # Hard-coded excludes (noise, build outputs)
-  local -a EXCLUDES=(build dist)
-  local -a filtered=()
-  for t in "${tops[@]}"; do
-    local skip=0
-    for e in "${EXCLUDES[@]}"; do [ "$t" = "$e" ] && skip=1 && break; done
-    [ $skip -eq 0 ] && filtered+=("$t")
-  done
-
-  # Current config values
-  local -a current
-  while IFS= read -r line; do
-    [ -n "$line" ] && current+=("$line")
-  done < <(git -C "$repo_root" config --get-all worktree.autolink 2>/dev/null || true)
-
-  # Preselect current ones in fzf (mark with *)
-  local list
-  list=$(printf "%s\n" "${filtered[@]}" | while read -r x; do
-    local mark=""
-    for c in "${current[@]}"; do [ "$c" = "$x" ] && mark="*" && break; done
-    printf "%s%s\n" "$mark" "$x"
-  done)
-
-  if ! command -v fzf >/dev/null 2>&1; then
-    echo "fzf not found; printing candidates. Use git config --local --add worktree.autolink <item> to add." >&2
-    printf "%s\n" "$unique"
-  else
-    local selection
-    selection=$(printf "%s\n" "$list" | sed 's/^\*//' | fzf --multi --prompt="Select autolink items: " --preview "if [ -f '$repo_root'/{} ]; then bat --color always --paging=never --style=plain '$repo_root'/{}; else ls -la '$repo_root'/{}; fi")
-    # Reset existing values
-    git -C "$repo_root" config --unset-all worktree.autolink 2>/dev/null || true
-    # Apply selection
-    if [ -n "$selection" ]; then
-      while IFS= read -r line; do
-        [ -n "$line" ] && git -C "$repo_root" config --add worktree.autolink "$line"
-      done <<EOF
-$selection
-EOF
-    fi
-    echo "Updated worktree.autolink entries."
-  fi
-
-  # Bootstrap mode
-  echo "\nBootstrap setup"
-  local current_bootstrap
-  current_bootstrap=$(git -C "$repo_root" config --get worktree.bootstrap 2>/dev/null || printf "")
-  echo "Current: ${current_bootstrap:-<none>}"
-  echo "Options: [skip] [auto] [custom command]"
-  local choice
-  if [ -n "$ZSH_VERSION" ]; then
-    read -r "choice?Enter bootstrap mode or command: "
-  else
-    read -r -p "Enter bootstrap mode or command: " choice
-  fi
-  choice=${choice:-$current_bootstrap}
-  if [ -z "$choice" ]; then
-    echo "Leaving bootstrap unchanged."
-  else
-    git -C "$repo_root" config worktree.bootstrap "$choice"
-    echo "Set worktree.bootstrap=$choice"
-  fi
-}
diff --git a/flakes/common/nix_modules/git/default.nix b/flakes/common/nix_modules/git/default.nix
deleted file mode 100644
index 3a4c5bc..0000000
--- a/flakes/common/nix_modules/git/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib;
-{
-  environment.systemPackages = with pkgs; [
-    git
-  ];
-
-  environment.shellAliases = {
-    # git
-    status = "git status";
-    diff = "git diff";
-    branches = "git branch -a";
-    gcam = "git commit -a -m";
-    gcm = "git commit -m";
-    stashes = "git stash list";
-    bd = "branch default";
-    li = "link_ignored";
-    bx = "branchdel";
-    b = "branch";
-    bs = "branching_setup";
-  };
-
-  environment.shellInit = lib.concatStringsSep "\n\n" [
-    (builtins.readFile ./utils.func.sh)
-    (builtins.readFile ./branch.func.sh)
-    (builtins.readFile ./branchd.func.sh)
-    (builtins.readFile ./link_ignored.func.sh)
-    (builtins.readFile ./branching_setup.func.sh)
-  ];
-}
diff --git a/flakes/common/nix_modules/hardening.nix b/flakes/common/nix_modules/hardening.nix
deleted file mode 100644
index e691f69..0000000
--- a/flakes/common/nix_modules/hardening.nix
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  environment.systemPackages = with pkgs; [
-    openssh
-    autossh
-  ];
-
-  # name this computer
-  networking = {
-    # hostName = top_cfg.systemName;
-    nftables.enable = true;
-    # Clears firewall rules on reboot, only ones set in config will be remade
-    nftables.flushRuleset = true;
-    firewall.enable = true;
-  };
-
-  # TODO invesitgate onensnitch usage and rules I may want. It is cumbersome with flushRuleset above...
-  # services.opensnitch = {
-  #   enable = true;
-  #   settings = {
-  #     Firewall = if config.networking.nftables.enable then "nftables" else "iptables";
-  #     InterceptUknown = true;
-  #     ProcMonitorMethod = "ebpf";
-  #     DefaultAction = "deny";
-  #   };
-  #   rules = {
-  #
-  #   };
-  # };
-
-  # Use fail2ban
-  services.fail2ban = {
-    enable = true;
-    # Ignore my tailnet
-    ignoreIP = [
-      "100.64.0.0/10"
-    ];
-  };
-
-  # Open ports in the firewall if enabled.
-  networking.firewall.allowedTCPPorts = [
-    22 # sshd
-  ];
-
-  # Enable the OpenSSH daemon.
-  services.openssh = {
-    enable = true;
-    settings = {
-      LogLevel = "VERBOSE";
-      # TODO revisit allowing root login
-      PermitRootLogin = "yes";
-      PasswordAuthentication = false;
-    };
-  };
-
-  # Ensure SSH key pair generation for non-root users
-  systemd.services = lib.mapAttrs' (name: _: {
-    name = "generate_ssh_key_${name}";
-    value = {
-      description = "Generate SSH key pair for ${name}";
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        User = name;
-        Type = "oneshot";
-      };
-      script = ''
-        #!/run/current-system/sw/bin/bash
-        if [ ! -f /home/${name}/.ssh/id_ed25519 ]; then
-          if [ -v DRY_RUN ]; then
-            echo "DRY_RUN is set. Would generate SSH key for ${name}.";
-          else
-            echo "Generating SSH key for ${name}.";
-            mkdir -p /home/${name}/.ssh;
-            chmod 700 /home/${name}/.ssh;
-            /run/current-system/sw/bin/ssh-keygen -t ed25519 -f /home/${name}/.ssh/id_ed25519 -N "";
-          fi
-        else
-          echo "SSH key already exists for ${name}.";
-        fi
-      '';
-    };
-  }) (lib.filterAttrs (n: u: u.isNormalUser or false) config.users.users);
-}
diff --git a/flakes/common/nix_modules/jetbrains_font.nix b/flakes/common/nix_modules/jetbrains_font.nix
deleted file mode 100644
index 22d217c..0000000
--- a/flakes/common/nix_modules/jetbrains_font.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-let
-  hasNewJetbrainsMono =
-    if builtins.hasAttr "nerd-fonts" pkgs then
-      builtins.hasAttr "jetbrains-mono" pkgs."nerd-fonts"
-    else
-      false;
-
-  jetbrainsMonoFont =
-    if hasNewJetbrainsMono then
-      pkgs.nerd-fonts.jetbrains-mono
-    else
-      (pkgs.nerdfonts.override { fonts = [ "JetBrainsMono" ]; });
-in
-{
-  config = {
-    fonts.fontconfig.enable = true;
-
-    fonts.packages = [
-      jetbrainsMonoFont
-    ]
-    # TODO verify if these are needed/working
-    # ++ (with pkgs; [
-    #   ipafont
-    #   kochi-substitute
-    #   noto-fonts-cjk-sans # Or another CJK font
-    # ])
-    ;
-  };
-}
diff --git a/flakes/common/nix_modules/nix_options.nix b/flakes/common/nix_modules/nix_options.nix
deleted file mode 100644
index db45356..0000000
--- a/flakes/common/nix_modules/nix_options.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-{
-  # Enable flakes
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # Allow unfree if set in config
-  nixpkgs.config.allowUnfreePredicate = lib.mkIf config.nixpkgs.config.allowUnfree (pkg: true);
-  environment.variables = lib.mkIf config.nixpkgs.config.allowUnfree {
-    NIXPKGS_ALLOW_UNFREE = "1";
-  };
-
-  nix.settings = {
-    max-jobs = "auto";
-    # Fallback quickly if substituters are not available.
-    connect-timeout = 5;
-    download-attempts = 3;
-    download-buffer-size = 524288000; # default is 67108864, this increases to ~500MB
-    # The default at 10 is rarely enough.
-    log-lines = 50;
-    # Avoid disk full issues
-    max-free = (3000 * 1024 * 1024);
-    min-free = (1000 * 1024 * 1024);
-    # Avoid copying unnecessary stuff over SSH
-    builders-use-substitutes = true;
-    auto-optimise-store = true;
-    trusted-users = [
-      "root"
-      "@wheel"
-    ];
-    substituters = [
-      "https://cache.nixos.org/"
-      "https://nix-community.cachix.org"
-    ];
-    trusted-substituters = config.nix.settings.substituters;
-    trusted-public-keys = [
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-    ];
-  };
-  nix.extraOptions = ''
-    keep-outputs = true
-    keep-derivations = true
-    ${lib.optionalString (
-      # TODO revisit this should it move?
-      config ? age && config.age ? secrets && config.age.secrets ? github_read_token
-    ) "!include ${config.age.secrets.github_read_token.path}"}
-  '';
-
-  # nix helper
-  programs.nh = {
-    enable = true;
-    # clean.enable = true; # TODO revist does this solve my re-building issues?
-    clean.extraArgs = "--keep 10";
-  };
-}
diff --git a/flakes/common/nix_modules/no_sleep.nix b/flakes/common/nix_modules/no_sleep.nix
deleted file mode 100644
index 66f7060..0000000
--- a/flakes/common/nix_modules/no_sleep.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ ... }:
-{
-  # Turn off sleep
-  systemd.sleep.extraConfig = ''
-    [Sleep]
-    AllowSuspend=no
-    AllowHibernation=no
-    AllowSuspendThenHibernate=no
-    AllowHybridSleep=no
-  '';
-}
diff --git a/flakes/common/nix_modules/podman.nix b/flakes/common/nix_modules/podman.nix
deleted file mode 100644
index 27a456b..0000000
--- a/flakes/common/nix_modules/podman.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  config,
-  ...
-}:
-{
-  virtualisation.podman = {
-    enable = true;
-    autoPrune.enable = true;
-  };
-  users.extraGroups.docker.members = builtins.attrNames config.users.users;
-}
diff --git a/flakes/common/nix_modules/q_flipper.nix b/flakes/common/nix_modules/q_flipper.nix
deleted file mode 100644
index 21fea44..0000000
--- a/flakes/common/nix_modules/q_flipper.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  hardware.flipperzero.enable = true;
-  environment.systemPackages = with pkgs; [ qFlipper ];
-  services.udev.extraRules = ''
-    #Flipper Zero serial port
-    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="5740", ATTRS{manufacturer}=="Flipper Devices Inc.", GROUP="users", TAG+="uaccess"
-    #Flipper Zero DFU
-    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", ATTRS{manufacturer}=="STMicroelectronics", GROUP="users", TAG+="uaccess"
-  '';
-}
diff --git a/flakes/common/nix_modules/remote_lio_builds.nix b/flakes/common/nix_modules/remote_lio_builds.nix
deleted file mode 100644
index 7a54d1c..0000000
--- a/flakes/common/nix_modules/remote_lio_builds.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-in
-{
-  # Remote build off home lio computer
-  programs.ssh.extraConfig = lib.mkIf (hasSecret "nix2lio") ''
-    Host lio_
-      PubkeyAcceptedKeyTypes ssh-ed25519
-      ServerAliveInterval 60
-      IPQoS throughput
-      IdentityFile ${config.age.secrets.nix2lio.path}
-  '';
-  nix = lib.mkIf (hasSecret "nix2lio") {
-    distributedBuilds = true;
-    buildMachines = [
-      {
-        # TODO require hostname in ssh config?
-        hostName = "lio_";
-        system = "x86_64-linux";
-        protocol = "ssh-ng";
-        maxJobs = 32;
-        speedFactor = 2;
-        supportedFeatures = [
-          "nixos-test"
-          "benchmark"
-          "big-parallel"
-          "kvm"
-          "uid-range" # Often helpful
-        ];
-        mandatoryFeatures = [ ];
-      }
-    ];
-  };
-}
diff --git a/flakes/common/nix_modules/tailnet.nix b/flakes/common/nix_modules/tailnet.nix
deleted file mode 100644
index 8718b7e..0000000
--- a/flakes/common/nix_modules/tailnet.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-in
-{
-  environment.systemPackages = with pkgs; [ tailscale ];
-  services.tailscale = lib.mkIf (hasSecret "headscale_auth") {
-    enable = true;
-    openFirewall = true;
-    useRoutingFeatures = "client";
-    authKeyFile = config.age.secrets.headscale_auth.path;
-    extraUpFlags = [
-      "--login-server=https://headscale.joshuabell.xyz"
-    ];
-    extraDaemonFlags = [
-      "--no-logs-no-support"
-    ];
-  };
-  networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
-  networking.firewall.checkReversePath = "loose";
-}
diff --git a/flakes/common/nix_modules/timezone_auto.nix b/flakes/common/nix_modules/timezone_auto.nix
deleted file mode 100644
index 223aef1..0000000
--- a/flakes/common/nix_modules/timezone_auto.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  ...
-}:
-{
-  time.timeZone = null;
-  services.automatic-timezoned.enable = true;
-}
diff --git a/flakes/common/nix_modules/tmux/default.nix b/flakes/common/nix_modules/tmux/default.nix
deleted file mode 100644
index c9224df..0000000
--- a/flakes/common/nix_modules/tmux/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-{
-  environment.systemPackages = [
-    pkgs.tmux
-  ];
-
-  environment.shellAliases = {
-    tat = "tmux attach-session";
-    t = "tmux";
-  };
-
-  environment.shellInit = lib.concatStringsSep "\n\n" [
-    (builtins.readFile ./tmux_helpers.sh)
-  ];
-}
diff --git a/flakes/common/nix_modules/tty_caps_esc.nix b/flakes/common/nix_modules/tty_caps_esc.nix
deleted file mode 100644
index f7c1fc9..0000000
--- a/flakes/common/nix_modules/tty_caps_esc.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  services.xserver.xkb.options = "caps:escape";
-  console = {
-    earlySetup = true;
-    packages = with pkgs; [ terminus_font ];
-    # use xkb.options in tty. (caps -> escape)
-    useXkbConfig = true;
-  };
-}
diff --git a/flakes/common/nix_modules/uhk_agent.nix b/flakes/common/nix_modules/uhk_agent.nix
deleted file mode 100644
index ab5d503..0000000
--- a/flakes/common/nix_modules/uhk_agent.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  environment.systemPackages = with pkgs; [
-    uhk-agent
-    uhk-udev-rules
-  ];
-  services.udev.packages = [ pkgs.uhk-udev-rules ];
-}
diff --git a/flakes/common/nix_modules/zsh.nix b/flakes/common/nix_modules/zsh.nix
deleted file mode 100644
index 264a74a..0000000
--- a/flakes/common/nix_modules/zsh.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  programs.zsh.enable = true;
-  environment.pathsToLink = [ "/share/zsh" ];
-  users.defaultUserShell = pkgs.zsh;
-}
diff --git a/flakes/common/readme.md b/flakes/common/readme.md
deleted file mode 100644
index 0c0c2d8..0000000
--- a/flakes/common/readme.md
+++ /dev/null
@@ -1,33 +0,0 @@
-# TODO add somewhere
-
-```nix
-
-
-
- # allow mounting ntfs filesystems
-  boot.supportedFilesystems = [ "ntfs" ];
-
-  # make shutdown faster for waiting
-  systemd.extraConfig = ''
-    DefaultTimeoutStopSec=8s
-  '';
-
-
-
-services.tailscale.extraUpFlags = ++ (lib.optionals cfg.enableExitNode [ "--advertise-exit-node" ]);
-
-```
-
-# TODO
-
-- New reporting for machine stats
-- programs not ported, yet
-  - rust dev (now using direnv local flakes for that)
-  - incus
-  - virt-manager
-- hm not ported
-  - obs
-- opensnitch
-  - homemanager `services.opensnitch-ui.enable = true;`
-- hyprland config
-- i3 isntead of sway?
diff --git a/flakes/common/utils.nix b/flakes/common/utils.nix
deleted file mode 100644
index b31056f..0000000
--- a/flakes/common/utils.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-# utils.nix
-{
-  /*
-    Auto-imports all Nix files and directories within a given `path`.
-
-    Args:
-      path: The absolute path to the directory to scan.
-            (e.g., `./.` or `/path/to/dir`)
-
-    Returns:
-      An attribute set where keys are the filenames (without .nix) or
-      directory names, and values are the imported modules.
-
-    It ignores:
-    - Dotfiles (e.g., .git)
-    - default.nix and flake.nix (common entry points)
-    - Itself (utils.nix)
-  */
-  importAll = path:
-    let
-      # Read all entries in the given path
-      entries = builtins.readDir path;
-
-      # Get the names of all entries
-      entryNames = builtins.attrNames entries;
-
-      # Filter for entries we want to import
-      filteredNames = builtins.filter (name:
-        let
-          entryType = entries.${name};
-          isDotfile = builtins.substring 0 1 name == ".";
-          isIgnoredFile = name == "default.nix" || name == "flake.nix" || name == "utils.nix";
-          isNixFile = entryType == "regular" && builtins.match ".*\\.nix$" name != null;
-          isDirectory = entryType == "directory";
-        in
-        !isDotfile && !isIgnoredFile && (isNixFile || isDirectory)
-      ) entryNames;
-
-      # Create an attribute { name = "key"; value = import ./path/key; } for each entry
-      createAttr = name: {
-        # The key for the final attribute set
-        name =
-          if builtins.match ".*\\.nix$" name != null
-          # If it's a .nix file, strip the extension for the key name
-          then builtins.elemAt (builtins.match "(.*)\\.nix$" name) 0
-          # Otherwise, use the directory name
-          else name;
-
-        # The value is the imported file/directory
-        value = import (path + "/${name}");
-      };
-
-    in
-    # Convert the list of attributes into a single attribute set
-    builtins.listToAttrs (map createAttr filteredNames);
-}
diff --git a/flakes/flatpaks/flake.lock b/flakes/flatpaks/flake.lock
deleted file mode 100644
index cc6c6bf..0000000
--- a/flakes/flatpaks/flake.lock
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nix-flatpak": {
-      "locked": {
-        "lastModified": 1739444422,
-        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
-        "owner": "gmodena",
-        "repo": "nix-flatpak",
-        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
-        "type": "github"
-      },
-      "original": {
-        "owner": "gmodena",
-        "ref": "latest",
-        "repo": "nix-flatpak",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nix-flatpak": "nix-flatpak"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flakes/flatpaks/flake.nix b/flakes/flatpaks/flake.nix
deleted file mode 100644
index 3cebad2..0000000
--- a/flakes/flatpaks/flake.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  inputs = {
-    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
-  };
-
-  outputs =
-    {
-      nix-flatpak,
-      ...
-    }:
-    {
-      nixosModules = {
-        default =
-          {
-            config,
-            lib,
-            pkgs,
-            ...
-          }:
-          {
-            imports = [
-              nix-flatpak.nixosModules.nix-flatpak
-            ];
-            config = {
-              services.flatpak = {
-                enable = true;
-                overrides = {
-                  global = {
-                    Context.sockets = [
-                      "wayland"
-                      "x11"
-                    ];
-                    Context.devices = [ "dri" ]; # allow GPU access if desired
-                    Environment = {
-                      XCURSOR_PATH = "/run/host/user-share/icons:/run/host/share/icons";
-                      GTK_THEME = "Adwaita:dark";
-                      # Force wayland as much as possible.
-                      ELECTRON_OZONE_PLATFORM_HINT = "auto"; # or 'auto'
-                      GTK_USE_PORTAL = "1";
-                      OZONE_PLATFORM = "wayland";
-                      QT_QPA_PLATFORM = "xcb"; # force XCB for Flatpaks (XWayland)
-                    };
-                  };
-                  "org.signal.Signal" = {
-                    Environment = {
-                      SIGNAL_PASSWORD_STORE = "gnome-libsecret";
-                    };
-                    Context = {
-                      sockets = [
-                        "xfg-settings"
-                      ];
-                    };
-                  };
-                  "com.google.Chrome" = {
-                    Environment = {
-                      CHROME_EXTRA_ARGS = "--enable-features=WaylandWindowDecorations --ozone-platform-hint=auto";
-                    };
-                  };
-                };
-              };
-            };
-          };
-      };
-    };
-}
diff --git a/flakes/hyprland/flake.nix b/flakes/hyprland/flake.nix
deleted file mode 100644
index 1706957..0000000
--- a/flakes/hyprland/flake.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  inputs = {
-    hyprland.url = "github:hyprwm/Hyprland";
-  };
-
-  outputs =
-    {
-      hyprland,
-      ...
-    }:
-    {
-      nixosModules = {
-        default =
-          {
-            config,
-            lib,
-            pkgs,
-            ...
-          }:
-          {
-            imports = [
-              hyprland.nixosModules.default
-              ./hyprland.nix
-            ];
-            config = {
-              nix.settings = {
-                substituters = [
-                  "https://hyprland.cachix.org"
-                ];
-                trusted-substituters = [
-                  "https://hyprland.cachix.org"
-                ];
-                trusted-public-keys = [
-                  "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-                ];
-              };
-              _module.args = {
-                inherit hyprland;
-                hyprlandPkgs = import hyprland.inputs.nixpkgs {
-                  system = pkgs.stdenv.hostPlatform.system;
-                  config = config.nixpkgs.config or { };
-                };
-              };
-            };
-          };
-      };
-    };
-}
diff --git a/flakes/hyprland/home_manager/hyprpaper.nix b/flakes/hyprland/home_manager/hyprpaper.nix
deleted file mode 100644
index d129096..0000000
--- a/flakes/hyprland/home_manager/hyprpaper.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  ...
-}:
-{
-  services.hyprpaper = {
-    enable = true;
-  };
-}
diff --git a/flakes/hyprland/home_manager/swaync.nix b/flakes/hyprland/home_manager/swaync.nix
deleted file mode 100644
index 6891a76..0000000
--- a/flakes/hyprland/home_manager/swaync.nix
+++ /dev/null
@@ -1,237 +0,0 @@
-{
-  ...
-}:
-{
-  services.swaync = {
-    enable = true;
-    settings = {
-      ignore = [
-        "com.spotify.Client"
-      ];
-
-      positionX = "right";
-      positionY = "top";
-      layer = "overlay";
-      control-center-layer = "top";
-      layer-shell = true;
-      cssPriority = "application";
-
-      control-center-margin-top = 0;
-      control-center-margin-bottom = 0;
-      control-center-margin-right = 0;
-      control-center-margin-left = 0;
-
-      notification-2fa-action = true;
-      notification-inline-replies = false;
-      notification-icon-size = 64;
-      notification-body-image-height = 100;
-      notification-body-image-width = 200;
-
-      timeout = 10;
-      timeout-low = 5;
-      timeout-critical = 0;
-
-      control-center-width = 500;
-      control-center-height = 600;
-      notification-window-width = 500;
-
-      keyboard-shortcuts = true;
-      image-visibility = "when-available";
-      transition-time = 200;
-      hide-on-clear = false;
-      hide-on-action = true;
-      script-fail-notify = true;
-
-      widgets = [
-        "inhibitors"
-        "title"
-        "dnd"
-        "volume"
-        "backlight"
-        "mpris"
-        "buttons-grid#quick"
-        "notifications"
-      ];
-
-      # Widget configurations
-      widget-config = {
-        inhibitors = {
-          text = "Inhibitors";
-          button-text = "Clear All";
-          clear-all-button = true;
-        };
-        title = {
-          text = "Notifications";
-          clear-all-button = true;
-          button-text = "Clear All";
-        };
-        dnd.text = "Do Not Disturb";
-        mpris = {
-          image-size = 96;
-          image-radius = 12;
-        };
-        volume = {
-          label = "󰕾";
-          show-per-app = true;
-        };
-        backlight = {
-          label = "󰃟";
-          device = "intel_backlight";
-        };
-        "buttons-grid#quick" = {
-          columns = 4; # adjust: 3/4/5
-          icon-size = 20; # tweak to taste
-          actions = [
-            # Power
-            {
-              label = "󰐥";
-              tooltip = "Shutdown";
-              command = "confirm-action 'systemctl poweroff' 'Shutdown?'";
-            }
-            {
-              label = "󰜉";
-              tooltip = "Reboot";
-              command = "confirm-action 'systemctl reboot' 'Reboot?'";
-            }
-            {
-              label = "󰍃";
-              tooltip = "Logout";
-              command = "confirm-action 'hyprctl dispatch exit' 'Logout?'";
-            }
-          ];
-        };
-      };
-    };
-
-    # Custom CSS for the control center
-    style = ''
-      .control-center {
-        background: #1a1b26;
-        border: 2px solid #7dcae4;
-        border-radius: 12px;
-      }
-
-      .control-center-list {
-        background: transparent;
-      }
-
-      .control-center .notification-row:focus,
-      .control-center .notification-row:hover {
-        opacity: 1;
-        background: #24283b;
-      }
-
-      .notification {
-        border-radius: 8px;
-        margin: 6px 12px;
-        box-shadow: 0 0 0 1px rgba(125, 196, 228, 0.3), 0 1px 3px 1px rgba(0, 0, 0, 0.7), 0 2px 6px 2px rgba(0, 0, 0, 0.3);
-        padding: 0;
-      }
-
-      /* Widget styling */
-      .widget-title {
-        margin: 8px;
-        font-size: 1.5rem;
-        color: #c0caf5;
-      }
-
-      .widget-dnd {
-        margin: 8px;
-        font-size: 1.1rem;
-        color: #c0caf5;
-      }
-
-      .widget-dnd > switch {
-        font-size: initial;
-        border-radius: 8px;
-        background: #414868;
-        border: 1px solid #7dcae4;
-      }
-
-      .widget-dnd > switch:checked {
-        background: #7dcae4;
-      }
-
-      .widget-mpris {
-        color: #c0caf5;
-        background: #24283b;
-        padding: 8px;
-        margin: 8px;
-        border-radius: 8px;
-      }
-
-      .widget-mpris-player {
-        padding: 8px;
-        margin: 8px;
-      }
-
-      .widget-mpris-title {
-        font-weight: bold;
-        font-size: 1.25rem;
-      }
-
-      .widget-mpris-subtitle {
-        font-size: 1.1rem;
-        color: #9ece6a;
-      }
-
-      .widget-volume {
-        background: #24283b;
-        padding: 8px;
-        margin: 8px;
-        border-radius: 8px;
-        color: #c0caf5;
-      }
-
-      .widget-backlight {
-        background: #24283b;
-        padding: 8px;
-        margin: 8px;
-        border-radius: 8px;
-        color: #c0caf5;
-      }
-
-      .widget-menubar {
-        background: #24283b;
-        padding: 8px;
-        margin: 8px;
-        border-radius: 8px;
-        color: #c0caf5;
-      }
-
-      .widget-menubar .menu-item button {
-        background: #1f2335;
-        color: #c0caf5;
-        border-radius: 8px;
-        padding: 6px 10px;
-        margin: 4px;
-        border: 1px solid #2e3440;
-        font-family: "JetBrainsMonoNL Nerd Font";
-      }
-
-      .widget-menubar .menu-item button:hover {
-        background: #414868;
-        border-color: #7dcae4;
-      }
-
-      .topbar-buttons button {
-        border: none;
-        background: transparent;
-        color: #c0caf5;
-        font-size: 1.1rem;
-        border-radius: 8px;
-        margin: 0 4px;
-        padding: 8px;
-      }
-
-      .topbar-buttons button:hover {
-        background: #414868;
-      }
-
-      .topbar-buttons button:active {
-        background: #7dcae4;
-        color: #1a1b26;
-      }
-    '';
-  };
-}
diff --git a/flakes/hyprland/home_manager/waybar.nix b/flakes/hyprland/home_manager/waybar.nix
deleted file mode 100644
index 8ceef8c..0000000
--- a/flakes/hyprland/home_manager/waybar.nix
+++ /dev/null
@@ -1,245 +0,0 @@
-{ lib, ... }:
-{
-  programs.waybar = {
-    enable = true;
-    systemd.enable = true;
-    settings = {
-      mainBar = {
-        layer = "top";
-        position = "top";
-        height = 28;
-        spacing = 6;
-        margin-top = 0;
-        margin-bottom = 0;
-        margin-left = 10;
-        margin-right = 10;
-
-        modules-left = [
-          "hyprland/workspaces"
-        ];
-        modules-center = [
-          "clock"
-          "temperature"
-          "cpu"
-          "memory"
-          "disk"
-        ];
-        modules-right = [
-          "battery"
-          "battery#bat2"
-          "pulseaudio"
-          "network"
-          "bluetooth"
-          "power-profiles-daemon"
-          "backlight"
-          "custom/notifications"
-          "tray"
-          "custom/power"
-        ];
-
-        "hyprland/workspaces" = {
-          format = "{icon}";
-          format-icons = {
-            "1" = "一";
-            "2" = "二";
-            "3" = "三";
-            "4" = "四";
-            "5" = "五";
-            "6" = "六";
-            "7" = "七";
-            "8" = "八";
-            "9" = "九";
-            "10" = "十";
-            "11" = "十一";
-            "12" = "十二";
-            "13" = "十三";
-            "14" = "十四";
-            "15" = "十五";
-            "16" = "十六";
-            "17" = "十七";
-            "18" = "十八";
-            "19" = "十九";
-            "20" = "二十";
-          };
-          disable-scroll = false;
-        };
-
-        # CENTER
-        clock = {
-          format = "{:%b %d, %H:%M}";
-          tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-        };
-
-        temperature = {
-          thermal-zone = 2;
-          hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
-          critical-threshold = 80;
-          format-critical = "󰔏 {temperatureC}°C";
-          format = "󰔏 {temperatureC}°C";
-        };
-
-        cpu = {
-          format = "󰻠 {usage}%";
-          tooltip = true;
-          on-click = "btop";
-        };
-
-        memory = {
-          format = "󰍛 {}%";
-          on-click = "btop";
-        };
-
-        disk = {
-          interval = 30;
-          format = "󰋊 {percentage_used}%";
-          path = "/";
-          on-click = "btop";
-        };
-
-        # RIGHT
-        "battery" = {
-          "states" = {
-            # "good"= 95;
-            "warning" = 30;
-            "critical" = 15;
-          };
-          "format" = "{capacity}% {icon}";
-          "format-full" = "{capacity}% {icon}";
-          "format-charging" = "{capacity}% ";
-          "format-plugged" = "{capacity}% ";
-          "format-alt" = "{time} {icon}";
-          # "format-good"= ""; // An empty format will hide the module
-          # "format-full"= "";
-          "format-icons" = [
-            ""
-            ""
-            ""
-            ""
-            ""
-          ];
-        };
-        "battery#bat2" = {
-          "bat" = "BAT2";
-        };
-
-        pulseaudio = {
-          format = "{icon} {volume}%";
-          format-bluetooth = "󰂰 {volume}%";
-          format-bluetooth-muted = "󰂲 ";
-          format-muted = "󰖁 ";
-          format-source = "󰍬 {volume}%";
-          format-source-muted = "󰍭 ";
-          format-icons = {
-            headphone = "󰋋";
-            hands-free = "󰂑";
-            headset = "󰂑";
-            phone = "󰏲";
-            portable = "󰦧";
-            car = "󰄋";
-            default = [
-              "󰕿"
-              "󰖀"
-              "󰕾"
-            ];
-          };
-          scroll-step = 5;
-          on-click = "pavucontrol";
-          on-click-right = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        };
-
-        network = {
-          format-wifi = "󰤨 {essid} ({signalStrength}%)";
-          format-ethernet = "󰈀 {ipaddr}/{cidr}";
-          tooltip-format = "{ifname} via {gwaddr} ";
-          format-linked = "󰈀 {ifname} (No IP)";
-          format-disconnected = "󰖪 Disconnected";
-          # on-click = "wofi-wifi-menu";
-          # on-click-right = "nmcli radio wifi toggle";
-        };
-
-        bluetooth = {
-          format = "󰂯 {status}";
-          format-connected = "󰂱 {device_alias}";
-          format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
-          tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
-          tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
-          tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
-          tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
-          # on-click = "wofi-bluetooth-menu";
-          # on-click-right = "bluetoothctl power toggle";
-        };
-
-        "power-profiles-daemon" = {
-          format = "{icon}";
-          "tooltip-format" = "Power profile: {profile}\nDriver: {driver}";
-          tooltip = true;
-          "format-icons" = {
-            default = "";
-            performance = "";
-            balanced = "";
-            "power-saver" = "";
-          };
-        };
-
-        backlight = {
-          format = "{percent}% {icon}";
-          "format-icons" = [
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-            ""
-          ];
-        };
-
-        "custom/notifications" = {
-          format = "{icon} {}";
-          format-icons = {
-            notification = "";
-            none = "";
-            dnd-notification = "󰂛";
-            dnd-none = "󰂛";
-            inhibited-notification = "";
-            inhibited-none = "";
-            dnd-inhibited-notification = "󰂛";
-            dnd-inhibited-none = "󰂛";
-          };
-          return-type = "json";
-          exec-if = "which swaync-client";
-          exec = "swaync-client -swb";
-          on-click = "swaync-client -t -sw";
-          on-click-right = "swaync-client -d -sw";
-          escape = true;
-          tooltip = false;
-        };
-
-        "sway/language" = {
-          format = "{}";
-        };
-
-        "tray" = {
-          "spacing" = 10;
-        };
-
-        "custom/power" = {
-          format = "⏻ ";
-          tooltip = false;
-          menu = "on-click";
-          "menu-file" = ./waybar/power_menu.xml;
-          "menu-actions" = {
-            shutdown = "shutdown 0";
-            reboot = "reboot";
-            logout = "loginctl terminate-session $(loginctl list-sessions | grep seat0 | awk '{print $1}')";
-          };
-        };
-
-      };
-    };
-
-    style = builtins.readFile ./waybar/waybar.css;
-  };
-}
diff --git a/flakes/hyprland/home_manager/waybar/power_menu.xml b/flakes/hyprland/home_manager/waybar/power_menu.xml
deleted file mode 100644
index a061b18..0000000
--- a/flakes/hyprland/home_manager/waybar/power_menu.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<interface>
-  <object class="GtkMenu" id="menu">
-    <child>
-      <object class="GtkMenuItem" id="logout">
-        <property name="label">Logout</property>
-      </object>
-    </child>
-    <child>
-      <object class="GtkSeparatorMenuItem" id="delimiter1" />
-    </child>
-    <child>
-      <object class="GtkMenuItem" id="reboot">
-        <property name="label">Reboot</property>
-      </object>
-    </child>
-    <child>
-      <object class="GtkSeparatorMenuItem" id="delimiter2" />
-    </child>
-    <child>
-      <object class="GtkMenuItem" id="shutdown">
-        <property name="label">Shutdown</property>
-      </object>
-    </child>
-  </object>
-</interface>
diff --git a/flakes/hyprland/home_manager/waybar/waybar.css b/flakes/hyprland/home_manager/waybar/waybar.css
deleted file mode 100644
index 6ed5a8c..0000000
--- a/flakes/hyprland/home_manager/waybar/waybar.css
+++ /dev/null
@@ -1,102 +0,0 @@
-* {
-  /* `otf-font-awesome` is required to be installed for icons */
-  font-family: "JetBrainsMonoNL Nerd Font", FontAwesome, Roboto, Helvetica, Arial, sans-serif;
-  font-size: 14px;
-  border: none;
-  border-radius: 0;
-  min-height: 0;
-  color: #f1f1f1;
-}
-
-window#waybar {
-  background: transparent;
-}
-
-#workspaces button.focused,
-#workspaces button.active {
-  background-color: rgba(220, 220, 220, 0.2);
-}
-
-#workspaces button.urgent {
-  background-color: rgba(214, 82, 82, 0.3);
-}
-
-button,
-#clock,
-#battery,
-#cpu,
-#memory,
-#disk,
-#temperature,
-#backlight,
-#network,
-#pulseaudio,
-#wireplumber,
-#custom-media,
-#custom-notifications,
-#custom-power,
-#tray,
-#mode,
-#idle_inhibitor,
-#scratchpad,
-#power-profiles-daemon,
-#bluetooth,
-#language,
-#mpd {
-  padding: 0 5px;
-  color: #f1f1f1;
-  background-color: rgba(220, 220, 220, 0.1);
-  border-radius: 6px;
-}
-
-
-button:hover,
-#clock:hover,
-#battery:hover,
-#cpu:hover,
-#memory:hover,
-#disk:hover,
-#temperature:hover,
-#backlight:hover,
-#network:hover,
-#pulseaudio:hover,
-#wireplumber:hover,
-#custom-media:hover,
-#custom-notifications:hover,
-#tray:hover,
-#mode:hover,
-#idle_inhibitor:hover,
-#scratchpad:hover,
-#power-profiles-daemon:hover,
-#bluetooth:hover,
-#language:hover,
-#mpd:hover {
-  color: #f1f1f1;
-  background-color: rgba(220, 220, 220, 0.2);
-  border-radius: 6px;
-}
-
-#power-profiles-daemon {
-  padding-right: 15px;
-}
-
-#power-profiles-daemon.performance {
-  color: #fff7d6;
-}
-
-#power-profiles-daemon.balanced {
-  color: #d6efff;
-}
-
-#power-profiles-daemon.power-saver {
-  color:#dcffd6;
-}
-
-#tray>.passive {
-  -gtk-icon-effect: dim;
-}
-
-#tray>.needs-attention {
-  -gtk-icon-effect: highlight;
-  background-color: #eb4d4b;
-}
diff --git a/flakes/hyprland/hyprland.nix b/flakes/hyprland/hyprland.nix
deleted file mode 100644
index 88e9a42..0000000
--- a/flakes/hyprland/hyprland.nix
+++ /dev/null
@@ -1,132 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  hyprland,
-  hyprlandPkgs,
-  ...
-}:
-with lib;
-{
-  # Enable for all users
-  home-manager = {
-    sharedModules = [
-      hyprland.homeManagerModules.default
-      ./home_manager
-    ];
-  };
-
-  services.greetd = {
-    enable = true;
-    vt = 2;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${hyprlandPkgs.hyprland}/bin/Hyprland'";
-        user = "greeter";
-      };
-    };
-  };
-
-  # Caps Lock as Escape for console/tty
-  console.useXkbConfig = true;
-  services.xserver.xkb = {
-    layout = "us";
-    options = "caps:escape";
-  };
-
-  environment.systemPackages = with pkgs; [
-    wl-clipboard
-    wl-clip-persist
-    wofi # application launcher
-    nemo # file manager (x11)
-    # nautilus # file manager
-    feh # image viewer (x11)
-    # imv # image viewer
-    networkmanager # network management
-    upower # power management
-    brightnessctl # screen/keyboard brightness control
-    wireplumber # media session manager
-    libgtop # system monitor library
-    bluez # Bluetooth support
-    power-profiles-daemon # power profiles
-    grim
-    slurp
-    hyprpicker
-    grimblast # screenshot tool
-    wf-recorder # screen recording tool
-    btop # system monitor
-  ];
-
-  services.blueman.enable = config.hardware.bluetooth.enable;
-
-  programs.hyprland = {
-    enable = true;
-    # xwayland.enable = false;
-    # withUWSM = true;
-
-    # set the flake package
-    package = hyprlandPkgs.hyprland;
-    # make sure to also set the portal package, so that they are in sync
-    # This is set below now in xdf portal directly so we can also add things like gtk
-    # portalPackage = hyprlandPkgs.xdg-desktop-portal-hyprland;
-  };
-
-  xdg.portal = {
-    enable = true;
-    extraPortals = lib.mkForce [
-      hyprlandPkgs.xdg-desktop-portal-hyprland
-      # hyprlandPkgs.xdg-desktop-portal-wlr
-      hyprlandPkgs.xdg-desktop-portal-gtk
-    ];
-    config.common.default = [
-      "hyprland"
-      # "wlr"
-      "gtk"
-    ];
-  };
-
-  # Enable PipeWire + WirePlumber so xdg-desktop-portal can do screencast
-  services.pipewire = {
-    enable = true;
-    # Enable WirePlumber session manager via the pipewire module option
-    wireplumber = {
-      enable = true;
-    };
-  };
-
-  hardware.graphics = {
-    enable = true;
-    package = hyprlandPkgs.mesa;
-    # if you also want 32-bit support (e.g for Steam)
-    # enable32Bit = true;
-    package32 = hyprlandPkgs.pkgsi686Linux.mesa;
-  };
-
-  # Environment variables
-  environment.sessionVariables = {
-    GTK_THEME = "Adwaita:dark";
-    XDG_SESSION_TYPE = "wayland";
-    # XDG_CURRENT_DESKTOP = "sway";
-    # XDG_SESSION_DESKTOP = "sway";
-    # prefer EGL renderer (can be changed back to "auto" if needed)
-    WLR_RENDERER = "egl";
-
-    # Tell apps to run native wayland
-    NIXOS_OZONE_WL = "1";
-    ELECTRON_OZONE_PLATFORM_HINT = "wayland";
-    ELECTRON_ENABLE_WAYLAND = "1";
-    ELECTRON_DISABLE_SANDBOX = "0";
-    GDK_BACKEND = "wayland,x11"; # GTK
-    QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
-    MOZ_ENABLE_WAYLAND = "1"; # Firefox
-    SDL_VIDEODRIVER = "wayland"; # SDL apps/games
-    CLUTTER_BACKEND = "wayland";
-  };
-
-  # Qt theming
-  qt = {
-    enable = true;
-    platformTheme = "gtk2";
-    style = "adwaita-dark";
-  };
-}
diff --git a/flakes/secrets/flake.nix b/flakes/secrets/flake.nix
deleted file mode 100644
index ffaad6c..0000000
--- a/flakes/secrets/flake.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  inputs = {
-    ragenix.url = "github:yaxitech/ragenix";
-  };
-
-  outputs =
-    {
-      ragenix,
-      ...
-    }:
-    {
-      nixosModules = {
-        default =
-          {
-            config,
-            lib,
-            pkgs,
-            ...
-          }:
-          {
-            imports = [
-              ragenix.nixosModules.age
-            ];
-            config =
-              let
-                secretsRaw = import ./secrets.nix;
-                systemName = config.networking.hostName;
-                # TODO revisit this slightly kinda scary method for choosing owners...
-                user =
-                  let
-                    normalUsers = builtins.filter (name: config.users.users.${name}.isNormalUser or false) (
-                      builtins.attrNames config.users.users
-                    );
-                  in
-                  if normalUsers == [ ] then "root" else builtins.head normalUsers;
-                authorityMarker = "authority";
-
-                # Key matches this host if its trailing comment contains "@<host>"
-                matchesThisSystem = key: lib.strings.hasInfix "@${systemName}" key;
-                # Key is the authority key if its comment contains the marker string
-                matchesAuthority = key: lib.strings.hasInfix authorityMarker key;
-
-                keepSecret =
-                  attrs:
-                  let
-                    keys = attrs.publicKeys or [ ];
-                  in
-                  lib.any (k: matchesThisSystem k) keys;
-
-                # Any secrets that should be world-readable even after auto-import
-                worldReadable = [
-                  "zitadel_master_key"
-                  "openwebui_env"
-                  "vaultwarden_env"
-                ];
-
-                # Keep only secrets intended for this host (or that include the authority key)
-                filteredSecrets = lib.attrsets.filterAttrs (_name: attrs: keepSecret attrs) secretsRaw;
-              in
-              {
-                age.secrets = lib.attrsets.mapAttrs' (
-                  name: _attrs:
-                  let
-                    base = lib.removeSuffix ".age" name;
-                  in
-                  lib.nameValuePair base (
-                    {
-                      file = ./. + "/${name}";
-                      owner = user;
-                    }
-                    // lib.optionalAttrs (lib.elem base worldReadable) {
-                      mode = "444";
-                    }
-                  )
-                ) filteredSecrets;
-
-              };
-          };
-      };
-    };
-}
diff --git a/flakes/secrets/github_read_token.age b/flakes/secrets/github_read_token.age
deleted file mode 100644
index eb57962..0000000
--- a/flakes/secrets/github_read_token.age
+++ /dev/null
@@ -1,44 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBZTkxJ
-UVFWN21teVhyNlBXQUw0Ti8yWUNXbHBXdEp2M3J3cURBNnk4dDI0ClJzT2lzeWwx
-SWk1YStZVVpDTlpsaHZCSGRkaFFtdGswdy9tSVpNcWQ4WFkKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIERYLzF2djVvRlAya1A1eHJvMzcxTkliZDF5VmVSaUgxUDNYWUlY
-TFNiaWsKUXJlb3E1UDhNTVdlYXJleHE1OHRmblFVNW5UdFJDc3F5QjNiUGZaN1NO
-YwotPiBzc2gtZWQyNTUxOSBTcENqQlEgQ3JlM29WcjZkSUlUQXZSNmpmTmFaT0M5
-SnhOY1NHeTZ0cUNVb2h1TDRqRQp6QmMxN3NkYnZZOHVBQXJJMWlhd2hqZ1owU3k1
-V21vc09qTEZNR1BSVk9rCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyAyMjlEOHVyNGZy
-UDBrOFdIUkEzbW9iWGtNblp6dlBvSGlaZjVHU0t2LzI4CjFXaTlvcjB1bkR0QkVY
-aXVWUERNc2NpMnU3N05iWXRQQldyWDRGV0ZocUUKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBICsxUUhvUytTRlVCb0xrcHNwU1dhblJ4RVpldUpoeGlYNkxYakFDdjVBQzAK
-bzNqdkxPVm5xblF6dU1kZE1mV0NadXlpcDcwazVvbDVDb0o4KzYvOW9QWQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgWVdOdFlxYWovQXFNdDhRdy94Q3FhaTA0dWpuSm0v
-NGFjUFEwYzc5eFNuVQo1ajFteHJUOFROU1NuQ2dKTkxkbzM4MkhrV1JYNzRlbFVD
-RU5UZFBpdVF3Ci0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBmK2pWV1ErdzJweDhXditQ
-TVZIaXlOV2pYNEtpTGxqN1ZCVTFaQVhHOUJvCktGdEFBUVg3OENpREQxNWRvV1Jj
-ZVNPcnNJZGxiR203RE5XeHVVNHIyaWMKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIEZq
-THIwSC8wZDZtNkxwSXdVcEY1TzMrSXdjNDZxUFJvekxSM1hsUHl0VFUKQnlYSHp3
-bWxPVW8xWE5HNm5zN0FGKzNlcUl3SHQ0NWNFSmJ4NTB5QkU2RQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgU2pUazdrYU42NENaSFlXbXNQQlJoMnY4K2xKZ05OMGZRSkJj
-WUJ2TTQwUQpjU3FqcVJOWkRNN3Q4N0pEcUhwa0ZXaUdpa1hUNlU3WTFOQzdOSlhH
-VkRVCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBWd0VhUnlMOSthMjR5QmZ6RWJzNFph
-U283TlJvWjE2M3FMaUtzTFlHS2tVCkw0SnpBM2hBU0NHeWxDV0NlVU5iOG5Wc0do
-K1R6ZkxKVGNlUmxMdjRHNGMKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIFI0aHRLWlVM
-UUFUY0ZSMVYrN2xENDhab2ptbWVYMlFZMTJvWXNYUXBFejQKOGJZNUc0RDVsaVc0
-d1VLelVmaDVlcU1UUXdTRGFlbVIwYkE3TUUvMjRjNAotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgTzNPQWV4UlFxOHEwUlZFZ1VNaEVzWGRqNDJJWlAwTEh3eEVjY25EUnVI
-bwpFWFMzRFB5bDROdkNEenVTMXo0YVhyUG1Ec3pkcTFSbDVnOWd4bnV1ckdJCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSB3MWU5QmUwODNZd21ibDQ0MkVwbmxFTnZYL2tp
-UTl3UDRkTGI4a0R0eldzCnFCU3dKdTJ2bkFFVHY3Y1VMa3hudW0yT0VxZGdnaVps
-L2xxMWhCamd0dE0KLT4gc3NoLWVkMjU1MTkga0hrMmdBIDU1Z2hZMlB6K3MzbG45
-aG9XMUJUUU9rblhLc1k0TEx3cC9FR1NWcHE1RHcKT1k5UE9keTNGT2N6LzcyaE9H
-aXE4RUpnVzg4TmFmVldJTjROL0U4NU5BdwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-dnBGamUxMkxDcCsvZzVvUGlLZGxhZ25SZ0tHVld4OFNsdE5ZZVo2bndVTQpEc0Vk
-UkV0YXZXMldrRlhIeEl5SFNPeTBjWkRuWGpiUVhreUFEWVV5SXcwCi0+IGReSjAt
-Z3JlYXNlCitLWDYreUtrK0oyRzcvZzlzdDB6SHhtZ2lVSi8wWnBWalQ1V1JQcnhv
-aUlzZ0ZVOEFXYnNFM000R2tRZlduNDgKNEh2VWpnSnoybTF4by9vWHBEWStiVmNF
-K0hvenZrOTZFcGpzdmxNcmRRCi0tLSBRQXRCdDJyc3RON29vWWRwd3pHbVlCWUZh
-bHYyWWFOYnBsTDRiRGVBNUJBCpQaU3zP5pjKuTjbjOQMgTiSImmEEGJAM+trvKmi
-E3g8XdSaIHOePo/RCgXrxd++2rYwPxzqzZmEsW/Ivmmoxt6MfNjSU+uRMNSaXcfr
-t6nhJlqNeRXHf0jk6SVjh5b8/0qmZu/w2f/UeTyvgnYoI54VDF35eaYr2J0D1mIS
-fr9M0clCcNdzJuyBKyD+BNEO5ZcD+0B8skcgYg==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/headscale_auth.age b/flakes/secrets/headscale_auth.age
deleted file mode 100644
index e94a4b2..0000000
--- a/flakes/secrets/headscale_auth.age
+++ /dev/null
@@ -1,45 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBqMHpw
-NzJxbGhVYnJzbytyNkd0UzNtR0pCV0VhT2JZcFpzNkZITUtXZUhRCmYrekQ0alN1
-TTVBM2VEV2g5RTZMZFVzRW5QWXA3enhBK2VYOURKOFVNZFEKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHA1NDREd1g0cDlTSDQ0bkZBRGxwTHNneUpDdThpOC93YjRpT3lO
-VUdZZ1UKR3JwaGtYamliUDJ0UnhUcG83ZnhFVzcyY3R3VzM2RFR6L3loVVJTT0ho
-SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgcS96V1ZYbVZLcWdDRHdQSkMvbEhZbjBy
-S2JVWUFXVkFOQmVRMDlJV1kxOAp3Um5vY2FpS3FEVENCTnpERUpPdkcyakNrSUFX
-SjlkR1RHTFdENzJCa1RZCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBVQ1hrNVFqVUR4
-UUNFU0VhVDVxNER0SGtLOENMWGRReG5qRWVVSUFweENBCmxxWjlxelBWQmxZam5P
-NEw3bGN3bkFuelgwRkI1VVRzWWcxekIwbHJqYlEKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIHVvRkZ0NzYxMzZGdTNVTnBRRVVSNEpvM3J6elQxckhWRllLWTR0OXBPVlEK
-a0JtV2c4YUJyWDVwZExkd1NHVG9oRFAxMFRlenhhTFJhalNTOTlHMVFTbwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgQzgvRnZnWkNxRUpxNWlyT1kxQWNhVkQ5NVdQVmxV
-SVdwOWpBUUhwQjZ3UQpraEVOV1RZaHJLTGRwUUcyb2YyYmtzLzRJOUowejJ4Q3lG
-RW9oMW9QMjgwCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSA2Y2lkL1F4aGNRK2Z1R3RP
-SjEwYmV6cmZ4ZUk4VndoeGNNY2wwUUJ2dkRVCmViTWM4c1BVRHA3MjJKYml4MUM0
-YitML0s4b2hzZ3NUN3YvQndCWU1ySGcKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIEhu
-MkRIYU9pM000YmU5MWIwV2JpRHRZWkRWU1VKeFNQVWI3Y2x5dHU1dzAKWW1lbS9E
-T1ZuTGdHMlNiVURvaTZQWHRpNlVQZzRVT1dUUm9Qb1dudndHZwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgOVBNUDRoMUtKSnFvbXF4Yy9EcUpuQStzYkxqQmpna3VRSFJM
-TVQveGQxawpEZXBDOFJuUFJ1bXFzU1pEbFJXRnVES0xCb1RHbllFUHRzK2VKQ2Ja
-a1UwCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBoOHdRbUp0Wkt0WGw4VitRQ2pBT0xX
-WFRwUUNoVExwdzJheHRFTnpNdWpFCk0weGpaV3BBRVA1c3VsV0NSVU40b1lPUnJN
-dWZ3dVg1dE9VTlh0VUJyNlkKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIGYwRzd2WFpD
-dGc0ak8yd3dXeW0zZnRNWTVLVEtnQXV1T1B5TFBkUDQrQmMKWE9mODhtVnc4NW1H
-UVoyZU1VUitpdG01SHpWdWhCZjRBc1NsaWNLajk1NAotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgZndVZUNIU01vdHdMQk1LZ0tZMWZDOFNidEhsdENHdmtEcjFEblNDWnlY
-dwpINTVtaUI5Rm5TWEE2MnZ2eVVOc21scmNVdHF4UUZ5U3VDZEUzQXNNUmxvCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBEUlhMd1hvTzRwdFA1Wk00TWs0SHVXTDY1VVFP
-QUpSd0xlUE1EZXlQWFc4Cm5nWEhxc01RV0FlOUJ3amVwMGIwNkkyZWN0N2dmNkJE
-MG5vSjl1dzFyRmsKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGhZZ3RvMXp0azgwTlgr
-bTlpeXFjL0w3UnhHdFZWRHZidnU4UG5hamtEeUUKNXEwdktjckgzamR1cmpDejZX
-WVRKa0pSN0VsWjBPZVJhVEhKU09wZzNVSQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-ZTE0R2R0SkgxQzdldEZ3bHYxK29qeHdNZDI5MEV6bmNiaTcxdDZQKzBHdwo4dWVL
-WXcwbDJ5ZjBzRHZqV1ZteXR1MnFDa243WllqRG5IbWQ0M3ZyaWNnCi0+IHNzaC1l
-ZDI1NTE5IHNhMEpqZyBRaFRWQ2p2UHV3TURpYjg2OUVOTFJHNGxmcG9oS29qTzlF
-YW83VWpaUlQ0CjB0alZRRzZlR1N3V1VKeW5NQkVSdHhVbkRRSmJpMjlxdEpMQzVi
-czFHbncKLT4gQUluQGAtZ3JlYXNlIDNKfnhhfDIgfiFULV4gPCsKemowVVFoT1lG
-OExYS240L01BaWU1Vk1OTFBFWFpEWWt5R2c0dkVhcVNVUUJtdVBhUXUzUGN2Uk9l
-aGpBMGE1SwpWemRhTGh4VgotLS0geUFNcDJha2YreStkUWMwYlh5SnowdlA5Yzcw
-eVQ5Q2ttb2svZ1Z0MktIWQqguNmSqtPSCeLYrNvbHE/bLpeVyQbL3uKNrZnoMy/f
-NgAgcsRBWpB45FgPEPWNRbHy/jQgVS3S5pe4oVgsKta6dJoh4x/wX6V/Z9dLIMrt
-D5A=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/linode_rw_domains.age b/flakes/secrets/linode_rw_domains.age
deleted file mode 100644
index f7587c9..0000000
--- a/flakes/secrets/linode_rw_domains.age
+++ /dev/null
@@ -1,42 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USB1Y0ZE
-K3ZYK1VQWUpjSlJ5aTMwZnZtMDkwYUZUdFlPRTh6K1Vyai9yekNvCmRxNFVCTy8r
-dzVPbldVeVRHeWE2dkhYK1p6dVQrdVd3bzZGYUJnU0RnSEkKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHRsUGhzb3ROWUR2d2pmckdGSXU0OFY4VUlyajRrOEFYcVZpSFhl
-bWNMZ2cKQUU5Vll3OE94eUlqbWNrYVVuYnRFR1J2bWZPclJyckhzTS9sdjA3dVlH
-awotPiBzc2gtZWQyNTUxOSBTcENqQlEgK2JlOGV4ZEdVS2VkUUl4dGdqcU5uV1Yv
-ai90WGFLVy9PZG1NZHNrQUV5RQpuQmNLalhiK3pRZEJYc1J4RGFOMnA3cnJZQXlm
-ZkZpU21xdDdHSUdScklBCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBZZFp6Z3F1SFZh
-Y056aHoySllXRTFiWHRBUWZyeFk1K3RER3lMcWM0a0g4CjBzSi9iSW1iWlE4eWNk
-bk43MUtKemF6U28vOTZNb0xndzc3N0U5SVYvQncKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIFJJN0FXbllROHJYd0xXZ3FoOXhwZ3hOcGpkeVE1UWhRd2NhVXRYR0svblUK
-ZDRjZEVtc2VsTFc5NUdLdDNuNDJoZU0vMnYxaU1vTDNWdElHcER6OTAzcwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgOFVkR1B0KzRlK0YwZDdScHMzaVdLMzljODF5UzhL
-cmVEZVRTZTJNQ3QyVQovTVRCZjRpUEc3Vkt3WlBQY1dvalhtaXFGaE5JclRsaTRK
-U095MVhlUW1FCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBEanZ3ak5EdDE2b2tzQUNO
-YW5SL0J4bzBHWVI5alNVVTRnaHZtREMrU1JBCnJsbjdyY0cwL1dOTnNGRG1uZllH
-ZWx6ZSs1d3R6SmwySE5HemRMY1lDL0UKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIGF0
-R2tqUGJmMEJQbHkzZnNJVng4eEFSZUluRDhJTU1ndjduWG1TK1p5VEUKV3Jqd2ww
-eFhmQmtCRStaS0I2RnBIanA1dDdwVFdPUW9yd3d6UVlLM21QMAotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgaW1LRWVBSStwMVd4YnJabnovY1d2K1NPY2JmeHhIVGdGSnhS
-MmtOZHBEdwpmMENmVzlKR1dhMWVKQjBzV0c2eWpTNCtiSy8rOEVQT0pUWVN2bUh0
-UmxVCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyB3ZDMxbW41dGROMm5ZOVBBZExQWnBC
-YlQxREpEWGtkVUZqK2lNRkM1NjNvCjNxSCs5UVRISXZhVURWamRtVktaUDZVMXY5
-ZkkyQlhTWmE1bzA4bDhiZXMKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIHBqR04rY3Jh
-VENmMlUvN1hGTjFZTGhkR1hPb2RhZ1pCeUlrZGt4TW01QnMKZVVTTmtPbE9PSFh5
-RDlreDNoQmRGSEYwY0xjcmRkOGV5bVJzMEJOdnFGawotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgNFN0TlJIMlZnaFNzUTBIQ250d0d4TlBjWWtxNkcvbWVFV3FFSU9GbE9G
-RQozQTBZamtGSFE5WUdRZlBBY1VLNnkxeGxJV09zZ2kzZFN4Vzh6WDNnNEVVCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBxdENpbFJqK0kyWXYrUEtjdExVMzhBNk53elRx
-eEQ3Z2NnQUQyYlVGbFJRClI3QkE3R1FTdlZLeWtsdlhLTlpzTUJvYmRHK0xyV1pM
-SVV4dExMRnZWREkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDd3WVdUMGtlRWVNL3py
-WWNqWG5XTFlEQ1k3MWN3K3JOVFBrZXhLV2JhVFkKTTRjWTg2Wi9QeHFPa043YVhh
-QUNyMkF5K1dDLzYwSUNsbGs2bWVuaHF3OAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-VHp3QVc0MXlJY3hDVmEzMERySXdGZ1J4bHE5MXFmY2RsUXZzNk1pd1lpRQpHNGRs
-ZWhnWkVvSVFLUHZ1UDJRdE9uVS9HeHNXZnhTZkN6bDY5TXpHaFdrCi0+IFs9WSt7
-aiotZ3JlYXNlIHRIXClgIF4wSSBLbVcKZVlIc2U1NGIxVDBha3NOVU52WllydlhM
-Ci0tLSBuTUVwdkNqNTl6NlJQN2hqOWlBdnhpSWdCK1hTeXppdjZlMUFOTTZDZ2NN
-CoefXII8+LOERaC5F5hBt84aaTwkFhPb3XT0pPeE3SWoRRN234YwCeqk/nWFNdri
-m1ETRY7qTsmzjeyMalbyo+S0MS0JsWhKoF+CSRgkfotEX0q06ErJfhA+TfzVf8JW
-334=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2bitbucket.age b/flakes/secrets/nix2bitbucket.age
deleted file mode 100644
index 69f7233..0000000
--- a/flakes/secrets/nix2bitbucket.age
+++ /dev/null
@@ -1,48 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBHSi8r
-dDZES0NINlVWZzBxY0VQSnhNR3BEbXZrQ3M4b3NmakczZjlKeWg4CjUxRjZtY284
-WFJPU2dzWTFNNTlCQlpwb1hOYWkzR0wwdlhXZk4vdDl6TUkKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIEFuREVqbmdWcmlkU1l5ZlorVlVLaFZqQmJBTEU4OUtWRDNxZUQ5
-dHYyWDgKUmYxZFRYR3BIQUJ6a3ZDZFRhMURvYkhNOGJkdzZYUExjL2RpVWIwaTJ3
-UQotPiBzc2gtZWQyNTUxOSBTcENqQlEgU2RUZWVaL1h0bHV0VDJIaTdyVEcyU3dl
-SjhkODk5TW0zWnVUSGYzRnJoRQovWU5XbllCeDhuV01kK3hZUTFzZG84bkNZWW9Y
-MTlGTjM4SEVwOWh1aEZFCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBpUjVxMy95d2Q0
-elhBNWUxS2tFcHZiVjRMOWtFU1hEbkd3MWI1T3kvQVJRCk1xbmUrMGhBLzJpK3By
-L09UZEtIQm1vbktqd2p0WGtWRDB3YUF2ZGs0R0kKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIERTZjZ3aHhnbURFOUhydGFZNCtjRHh1ZFdWcjhrU2I1ZTdKMU1oVWwvWFUK
-QzJiNVBQaDBRbnBiMDM4ODRlK0pqR0Ezc0hjL3U1YUVYNTU3SFJUM2ZVcwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgVkM4WkwycGFzUDZWWGFHVE5BWmlwV2ZPVEtuRjVj
-cER4M21LeXM0Z2pSYwphV3Jvd1VZVkkvVGsvWkhPQVBWaXdzSENqZEJLS2U0aC9w
-OS94NllKdmJvCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBVYnhEcmlpeHVXVnBuSnA5
-UE1yUTZUbmZYZnk0Wm16bDBYa0FtMG1ibENvCkwxR2k4aXp0ck56NkJKMS82Ly9B
-VWhraWpTYmNZM2N3OG5IN3dHTkhvUlkKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIDVY
-OFFIcFQycWdjV2xvQ0w0TjVSMGRQQldJOE44WXBvckhUVk1FWUFQQnMKMzF0Smc1
-YVJ0UXhzb3MxR1BmUmlXQWNGbW03RW5MVi8xRjZXd1JrNGQ0WQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgMDkzakZlckpwWDdiZWVJeHpacWx5ZkVkVk51NElWaDBISmMz
-VGxyWC9BMAprZ1lhRituS2x5aklxRVRIUlFlNWNnYS9IZUJOcTQ3TWR4aUhPYVlE
-b2RnCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBhSnVzTTh1TDN2NVZlVjBuOFNsQ2pL
-bEd5UzcwWFJqQXgxc1BsZ0VabTNVCmdNYS9wc3ptb2VIRVQyR1VlVWNmRldVYkhj
-eUE0WG5wRWsveUd2WGRhelkKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIENRYmFRT0Rz
-RDljbEYyYWd5QTNRUFRIMHBsU2UvMkFNbTh6cVpzVy82ajQKQ0NJb3FrSE91MTZW
-WC9hRm1XaGlVTDFiem5EUWFFSzVtL3VjUHc1NnV3bwotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgWS9HU29oZ1ppSE5qcFZrN3dlRGVUbkE0R1ZHOVVpK01hNzR3ZzNLUDFW
-cwpGV3JPNE10aUZIWmlHZk55LzJXWExOd3pKVXhvUVRMNnVSVTh1bXQxOVFZCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBVUzRreHlwTHhubWdVaTc4a21FdWdPSGl3WTJs
-Rkk4aDFyLzdPYktqZ1I4CkdtVkxYVFpNbHRYdUF2RUkxMzliTlh3ZTBYVFRpVkM5
-ZHRvT0ZuOFphNkEKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEUydFRrTnhIV2drbnA1
-M2pQZXRHcHhKdnVZYVFuT05WcmJNUkJZM0dPQzgKTFlhZ3phOUYyWnZHZ3ozeDU5
-WGd0bU0zY3Vtem9qdCsxRzBUZXlTT2JsOAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-aVBRODJtdVl3eHhJaGJQd0h4YzV3bUVjL2VYeGo3TU4vT3U2VmhaeXUzZwpZQU92
-NGhrbU1NRVoxWWVEbldJYVB3UWwzSGUvTDNVTko2Vkw4Q2ttREhVCi0+IEMzamhs
-Wy1ncmVhc2UgZGk8TSBaL1gyUzEgVl4+dU5qOmUKRThyWnp3Ci0tLSBmWmY5Mi82
-SStlWnV2ZHIwSWZHdXllWTJIekNnYzIvK0NSWWIrMDJmZlNRCpPC62SfvnZONrts
-1KjfjNayah2FmQt10ZJcFZuKkioUWtjCuCtj+oz3ptXKd8xDiimrJ/ZoAWzG2fb+
-vs/GB+umHbAntDbfMk7ejQlss3dYxRbIfvatjgghNOMpCETYWGmMP58W+Td5xHeq
-BEHVRq31XeR3su3XA+lUdlUU2h1HCYb6XrkLcjTJheLyFzR+ttiiCyNXhKn7bhzG
-NpzeKZ50Y6vP8C2LZguXyTX2kpLSSKoERl/RoBjlqQx7XeIfZemu9C0PNLG0rN3O
-hV8qnmVZJSry99xNLJmoEfvgo9z+F2PMVlHImwGALWiocyvDvrG3WOIgpyHBvtYI
-oyw8rGbrg/t+a/YpVF8CNfiZvX23vJAFF6wC5Czo/EEWnTxnnazcG+deWbcGnjxs
-fvQLTszbZcA6uxg9JzPkIcnfGMwdAJOF73y/eGxDsSqEi/v/Uz5Uvmhb/8H/brzw
-gD5iSnpr+gzfmKl7b8Qt7i95Y1taZTcMJQbkoIas4oYV7fEvtYZ6T8JxbLQaaco5
-Z7fbh53V54nw3MlZyDe0Gmuqc6doRbWovl30umVAE24NzCrj
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2gitforgejo.age b/flakes/secrets/nix2gitforgejo.age
deleted file mode 100644
index bcfe1b7..0000000
--- a/flakes/secrets/nix2gitforgejo.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBmbDRn
-TW1YZEthZExCemgrUk12Z0lUTnNpOUtxWE9GY2NwN3J4eENEWmpzCktsTnVyV0lj
-S1VzREZnVzNRMUM3TDR5RnczdWtsaTJDZHk1Nm5Hd3drOFUKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIFhERHU2MUk3NVNLRFdjYi93OVFRVmNaSjhUWjNXSW9URTh6b0RW
-ckFvd1UKaFVyYjRjRkZLL2lQdi91UW9Ta2t1bXBrRkJUSXVRamtCMHJsZDBQVjhI
-SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgS2JXc1pXQU5kUDN2QWtuYmJnd0M4cnJz
-OVdDOFVBbEt1R09qUnNER0lsawp4OStYTHVTT21aeHQwVklvVWs3Rk5zV2ZVd3Rn
-cXZCbVVYR2lUQzhOdFdRCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBkdTJrOVBjSlFn
-S3MveDFMVG1yK3YyKzBvb0lob1NjaDQ0akQzQVJKK0ZBCjZweGVwWWtmWlcyR0R0
-cW5UMGRWWmhqQUcxZ0pLTDZyUU9wR1gzcllPTjgKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIFpKbUhlQVdzU3NVS3MvMXlWTEJpamMxYjV4a1pTcGpPQjRxajV2Wk43RlUK
-Z1lkK0hRY0NZakhXTlR5ZjRrRzNjeTh5ekdXRXRNVjRJYzF5VHkzVHJ2VQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgMVBaa05ta2R1T3FGODNaRHFjOXJkRDQyN1QwQmY3
-RFdQc1dvN2trZW5tSQphNUkvUkRlK0RIM2pXR1RONXVzN3owTWxpVHdQQ3dlRVVm
-cGEzdzZFZElrCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBZMkJ6WUtuZi9KVkRlWEVn
-bjNoanRDYXBCSzlOUmY1L2VIU2xFaFpUTFVRCkl3MlgyOVdtcjlrUUxxck5VRUQ2
-TS83MWd1aUo5ZXl6aWV0dXZQSnF5OUUKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIEdM
-NWhEUGVuZ3ZCdlMzemtqMlNoZmc4eWJiNkV0alZacGc2VUEwcVE0M0kKOWZSeEhC
-eWJ6R2JPaXdoNzBWMTFlNnM0bzZnWkxOU3dqYkZ5dXJnc3k3awotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgZ0RiakxaS1FOVlJnekV2L0dZdEJGdXlBa2J1SXdKQk9kL2ZS
-ZFl6bWpqOAo2UWJXVzVPNkc3T0JNalZSc0w4eWd2ZXh5emNqN0hraXhKNGh4ck11
-eS93Ci0+IHNzaC1lZDI1NTE5IHBlRkJRZyBaNnJNcXo1cUlNUEQ5MmVpcEY0Uk81
-NGJjQXJINTJyMHFFb0NVZTYzN0c4CkJwRCtXTXVTME1OTWVNUlFiTTd1N3NtdURp
-ME5TVGJzOXRKMGZOaCtBaFUKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIGU0ZlFoeVFK
-dTFWVS9aYzQ0S3pDUkxLVnNLYkNvZHFUZlRwUHR3VVZRU2cKWVNtcC91RGQveWsw
-YkhPdFpBKzg3SUFwajRES0xvM3h2Rlk2Z1FBeUQ2WQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgOWVhVENVN3NzcHNqMVIxYm1aOStIbnNYaVVhTmZjb0dmcDMvNDFGZXIy
-VQpNTjBpVkd2enFTazAyRk9tY2U3blovWEpTQ2RIemNJV0NNbGc5K3plaGVRCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBXNE1iSlJPTUZLREczVUttSjdsTTFkVlMrT01k
-aGNReE15Z0NxRXFWVlV3CnZvNWhFemFYd0lXL3B2ay83aFNpQk1FL2IxYVNLemdC
-NzIwd24rQ0NSZUEKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFlLeHdKcmVQT3lxdzBW
-UFFhejgxUnh2UVg2WEpSNSs4TlFqeXV6UC9KbTAKNmZMZnZiV3dma2h1UUtHck1K
-VndSQUx5RUlxbFkwamxMcjEvOGdMT2RCbwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-NEpUbVZhdHpvYWlNcUhuS3ZLVHRxVk42OXY1TG1vT21ZYzlNVzRoaXFVTQoyUTN1
-Mk8xSkcxbUJsZm9jSWxJaGJEN284RkNhcTVJN2RzYi94YkFqL004Ci0+IE9nLn48
-LWdyZWFzZSAncF5bTScKT0tqSURCNytRZ2tpQ0ZtSERqLzRtT3NZcUVPcGRoSXdP
-TkxOUkVycUQ4ek5qU3ExZTJpeHJGNjEKLS0tIE9lUlFwQUVLdFYzTUdkMHlVTXZS
-NWYzYzRkTDZPY3NXTi9pSnExRks1Y00K3guBa9QACC467P6CWgoDw2qXSDYv1zV7
-4Qw5gc2rIe7nA96pzd2yv5fr//Hhq6Op4SDE2xwEuw/JGqYKYBbVc1q/lQMiEp36
-Td7BUcGdRqJWmqxCA5+kHJvwmdx8+2o/tbAWsitgl+VWDOsojB1Ftzdy1KHrkRaT
-RgV8RmozPd7wEt4O3iuXLzgeJKcCA4SN366RKh4wV7UrOAbfZEEVfBy2G6ou76/Z
-RGWWc7rysSV9IPMRd3TPE80H+fsKLrxuiJDt2q7IleKku5J9SkgpuS+T6mO+H833
-yaWy28zzSD46f1Q3FePGkuProcSaqEZ5DuAg6k5tHYtIt8RNiAUZea63/k6OhYrB
-Ss7uyQ/14Q4LvJvIGrluBuGfCJe9P2DWPi+cOcpT+astbZ5YvIGVimM8g5CbbyLb
-JuEf/RPRJ3fyjg1gzsAsZ8daaKeRRK/qCr9NbcvAznPaVqB/a4ysU8CqHdPWGXwo
-rei+YefEqllPx1cE/B5z//MzUplPW3+Lc5pCACLeNZsuoJgL1YbzIBJc7fOG5JQ+
-g9Wt1rIFmBoTTD/FtEXgW4cMMkVtSuLWB0VRSOubFHYyJRc=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2github.age b/flakes/secrets/nix2github.age
deleted file mode 100644
index 3800315..0000000
--- a/flakes/secrets/nix2github.age
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USB1NGlT
-M3Brckswb0d3UXRnYnk3S2VPYWcwU2Z3ZjJ1Qzlsb2pieThoTmd3Ckw5STJrYUJm
-QTlOaktMeUQ2c0x5WjZSQVNlQ2hEN1NjYTBlak01YlA3TlUKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIFovbnVSTUl0WVlFaHhiRExIMG45L0w4Sk93bldJWEpTQTVFN3Nn
-YlZkZ1kKaXYzNElZMjZ4Wmw3M3o1dHdEdVZEcTl3ckVJeUpiWWROQUdVZDFzNjVC
-OAotPiBzc2gtZWQyNTUxOSBTcENqQlEgNFEvTmNHQ01YL1poZGZZcCt0Q0NrQVQ0
-amtXRUQxVkh5RGZIRFNNTG9tSQowWTZobEFNeVZvK2Q3T2ljZFlnSWNtaGZKcXN2
-K1JvUnp6ZFFNNEtDOTJZCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBkZ1FEVExQZ2Iz
-dTNaM2ZaUERsaWJJenRjYXdDdDI2UkxxV3MzZ0ZKTWhFCjFiWU1BcGhYRVV0THRS
-TWxjb1FtL0htTmxGS25UZWpwNDBPazFQbDNsdmMKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIDhnOEYwd2RVdm9wd1ppbW90eTNBMGh4RzZSbW8rNmVDVHpvZEhUZTZuRG8K
-Rm9oQWtJM2dWbzExYmhNdlBrSXNvRGxDZW5ZNWFMdERyTEhZRkRNUUJaZwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgMHRHMlhRVjRPaktSR2RRRHlKM24zK3lNb0dlVWJF
-WjBCVVhqRFVhVlAwUQpGajZ4YWJ3RlJ6bDNtMThqY0c3NmFDY2I1OUgxYlgxRVJo
-QjVRRDQ4SndVCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBpTHUra1VjbTJGTWkzekdJ
-aldJZGZ0SkdWSUJ4NFMvaEVTS0xPbjBtbmhNCmJ4K0pubjNhN0VxNldoMWs5VW9u
-eGxzOGpDdjhqN3hxSytWUVV4MmdwUk0KLT4gc3NoLWVkMjU1MTkgNWFkcU1nIHda
-bHBRYitJRGFlODBaakNmbTQ1aWNtTnpnMk9Rd0hFdVJqNW50ejROMGsKdVhqQlYw
-ZFRINDZ4NXdZNGNZMVorRUF5STBPM3FrcjJJbUZ5dElzUlhNSQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgbFROaFk1MXJJRGp0Q0RraXRJa1NEdzFPNVREa1BTWFBVN1Q1
-NlROSUExZwo5ODFlMmVPdDFyWE9IeHYybENFdUJETXN5bEY0cnFzMCt3VGJUN2F3
-RHJBCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBMMWo4RFlIN3ZWbFJLajcvSnFCQWpC
-SEFpM0Z0NUNrTTJiUjUranRhRWxnCkpobERKSHExVDZXUEZjWEsrVVpNOVp5eVl4
-TGh6RUZNNTF2QVVTLzhJMFkKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIEkrSm5ldTZh
-WlpwZllNSVVSYitGVmxsTHdKZjBtcGhtNWJ3cU5QOGRRakEKTFdsa1BjNmR5cDdZ
-S0Q1UXNuWC9GN3E3b0FxSXd3SFcwT2RnQUc3bmRoRQotPiBzc2gtZWQyNTUxOSBS
-NSt4Zncgbm93OXhocWhvZERkZWVKaW42ZXgwT3NaQlRXNVBVUFFiTWJlRkdxdi9D
-bwpkeWNxcUN0TTROMjhpWFBEQXJJNElhMjNZbHhJVzlvbWpzeUZpcmxiZm93Ci0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBzMWxESVRlc3ZoVXVNclNvNnlkN2F1TkE2V2p0
-eXFRMFNiRWk4SEZ0djFVClFlQlVKZmRvSXZwckhBclQ0UmhMTFNVZXRtR0tpaFEv
-ekxDNTQ1cUkrcHMKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDB6T2dqcGZFckhtcUJD
-a3Jqemt4dWRNWXlTT3drSHB5THd1cEc5MnJLVmsKSDEyWGF1VllFWW9ZRWc5bkQ4
-TkRncXM0UmlqVGhXQWdlNnFHZ0E0MFdnUQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-aldKcms1Q01OQ0liVlk5U1VaQTAxV055TE1Ta2JiOFEwTXExS0xGWWZTQQoyam50
-K0NoaEYxbHBBSmgwWEpFLzgvaTJlUmN6bGVvZU5EZXJ2UnVySnhrCi0+IGlmQl4l
-MS1ncmVhc2UgRQpGYUNSaFR6VlhHLzRKcGI2VDVEMlp6WmJjdWV0aU5Jb1RkdUlz
-YSs4eVgyU0UwNnpTMVR0Y2RNSzZXRTZSTm9wCnRjc0lwUkcvVVhwVVNaaVpDbnFp
-eFFXeTJIc2JSKzZyRkdzNWNpaUoxbDVPTSs3M1c1bWFOODFSYmpjTwotLS0gb25X
-WG90RjVVRlFUT1NQaGJGRlloTWRrM09nem8vNFYzejNlYUorRlNWOAqB5PT87zlF
-yQet+xsm4KtjnHg1UlQ+gQ7v7tI/7bXeKDKex5OEKLi/Mf3F/TE1j7Vesu5pDbIt
-XBsnXwOAwuQK9VJJyXF0a2hxjunUzCPKxmrMYXY0/fQmJYNE/0Xmqa0+KDpxKjE9
-4NJ+9O0hnvxgpii1HK/PHYmLhve5LMqwSinKhgKwiyB1UU4gdGuWDSKcrWres9C7
-oBAjzE0BepZDAzvEKdtlai49erd9631/OZPqsBZyz2OT2k6bQ9rld6Ts6U4XcP8/
-Fuua/s/KnwaPZhZFtQF8wO67RjwZMJ1EYDH9nU45WeUIbDpwJDnHTECIx4kefskY
-a/gwi4pzA0MIh8hnuuz1p+xl6LDMsVF+IEve94F83/ijPoYBQ36QNzQRVT6ppuOP
-NpLmtMmuRJ1Eo1TuaT0MMT8Z5ovZUfAcUKXpmZC7Uj0YbYs+deErMBDikiVknG0T
-zxcWk+s6lR9JbWmHhQIzLbXT2vZz/OnVGesa14qslDMCq2YpNprkAqkPoCoHAtzw
-WNwi+FSAJZyseBIf+HH1ZzPLYVTdY30TZB7vF7+2xLvXrpGpqQOA0g==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2gitjosh.age b/flakes/secrets/nix2gitjosh.age
deleted file mode 100644
index 0639c3f..0000000
--- a/flakes/secrets/nix2gitjosh.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBKZU9E
-QVNvdGFxRFI4TTN5WlIycEk1SFora1VjeXFtRWFGeXg4ZTNqTnkwCmJNRjNMeXVK
-eEg5cmVKUHhmMkRsK1IwZ1JWTDhFU2Q1d3ZiOE9LLzdrUUEKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIDdMaUYvU0NwazhjYlFoUXNrc0tKWEQyZi9GcjZlRzJEOFNDMjdx
-bHdDbWcKeGMzMlpwNUNRTW01eis5ZzYyQXB0V1NhTVZpaSs2TmJKMzRwNmNpeWpP
-bwotPiBzc2gtZWQyNTUxOSBTcENqQlEgMTBEOWpoOGQzYUxxbWtyYVd5Sldpd3Fu
-bE4zdXlBVGtHRlBvaDl5OGZtOApHTGFwVEJ1cXhCTERzRVBoc0podmErT2NNeWN5
-Mk9GVGJJRHIvekYvQ0tzCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyB4Mk12Y3pMSkN4
-M2JpaXpGaDFDeWNLc29Kdkl1MDhDeWVjb0UxRlBSbjJRCjRtbGZSSmV4Ritxdncv
-QmdmZVk5cUpBNFVYVmFKbmdDTnZwVk5lY2xKbzAKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIElnQWo0OUl2NDdhRFdtSDBSRkx4WW5VcXlZaHlORmJud3IrMEt0c2ZEQkEK
-TVE2S1J3TzNiL05iV0JHY2FQOEo3WGNqaGNNWjJkTXFoWmNnMS9iLzBWQQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgcjZqdlM3cjJDV3RVck9ZcWpEN3dvTTlIcld6NU9t
-ZkU5TXI2VFZPc0ZRWQpUckRzc25jWlpCbTdkYTI5Y3pSUkZzYkx0TWRuWWo0VE9Y
-eENTOFN2RTJBCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBya2JTWi94NHFtMkxDSVha
-Vml4VTlYZ09kdFJGck5KYVhlSWFnMUNJeW1nClhuSUhGYWF3RFl0RVdzU1FNeTdX
-TndPVmJSQ3cxWGVIZHlUbFZVQTBqdW8KLT4gc3NoLWVkMjU1MTkgNWFkcU1nIGxP
-VTBsam9xdU9Ea2tPWTZEcFhHK1dFN1liVXZVZDlEZTMxR0NMTlVCUUkKaHpWV1JW
-Mmgyb21TblJCeE5tQmlBUVlwSm1Mb2VCWHBSSjdIei80U3g1QQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgYUoxMVF5SXJmdnRjYVFhWGlKMmtUS1lpS2FsZUQ2K3dpM293
-ZmNTWDB6YwpPWHVlMWZCSkJiSFU4VVMxKzlsalRNRTBLdGc5Ky91T04xazVmQ2Yv
-aXRBCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyB1R1lHQS93b3R1eDFNVHhONSt5ZWU4
-cEovOHFuWHA5UzJEd1NzK0Y3L0hnCk5JUGt0OWd6alh3R09IOFROSlJmS1V5V1lT
-MEdRQTFGSk4zYi9GeEN0dVUKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIC8zaFl3MzdI
-YWZZUjBXaGJjYVFEbzd2dk5ydjdKUDZRanc4VUFLUVZsbVkKMWx1MHV2c2tsZzVB
-bWYyZVo5am54L1pXYUtuNGxoQS9sQXNJY2l3ajlsdwotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgYVFmY3pMMkN0VFZ1aDRHQW5WYW5sd1k5R0c3cFlNWFNsajAya0lkWVFD
-dwp0Q1IyQTk5M0VueTBsdHFianNGYW9TQzJWSmw2RndaM2FZWXkwTExaWEVZCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBHVjI5TFVsNS9NRWFEOGlFYm95KytKTU0wNW8x
-MHI4cTdIbDNXMmY0TWo4ClBiYkhlekYxVTB5b3NUaFZkN0piUHhFdUY4RHpDdnQ3
-Y3pHQXdNc3pHTUEKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEVkVFkzMEdDWVdnU2NR
-Ym4rZk4xKzk2dnJnY1h2N0IvWDdneTJady9XbGcKM1NJSEk3TlRIb01WSWhudDZM
-Uld4YVRLbVdJODNKQ29VV1UyR2x2anpxbwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-MFlRK2FCVjlBd1phRG1ibE50eWlZY2hoWURkWXEzdnFSeWl5bGQyNDZBQQppdVIy
-c1ZFUUVJTmdaRmNVYWF4aVgyc2wzbG5zMTgrMC9TTm5lMC9TT3UwCi0+IFVMLWdy
-ZWFzZQpBRXBoTUFpWHZIaVphVjgrdUpIN1A5OUNMS0pUQ2hqN3VCSVVrZFp0SHdj
-MQotLS0gRUNNSXdGMlJnM2VDbkFwQnE5SnNqc0NMMFh5M21GYldJMzR5RkpDank5
-MApcz73xRO16kYBM2rLNjRXcu0NhxlgaTx1NcvFMf3UKzKzCDKbkfa7tmJZ8ilfL
-Z3sy3azIjun1Mu73g8xPPK6IfMP1RUIQP4wPKu55QJUqxtUCC3YcfUwIsD3KE2F4
-ZgGIH8Xuf61SMkBRlVHxC4B/5n2zB6XkEQRrD/gNOvD8snZcHyOW6b/YU2yog/qN
-C5AU9Mz6B1wRY5PUB+ZV+F+rLAydvSdtfaVL8MIVMyhzsdDJiFNE6PSWGSi33/BP
-2O8VpguRmI3uBXAAI+K7lYdF0K/9inigh+IXqNJUcsqtPtAAtxW6nUBIAAfB24hQ
-xG4pBE4s0dVi8ElLVsPHMVneBejQNCR80VOCQiLWLDnnr6Ql3B4Qo4t2p36UWiW8
-2bg/PwGACxIeGoJkIMM4yJX9bTk9kRXEhByd50yVpkgg31mxsrhSYwGFsuziH60n
-I89khR6HwRpz7jeefw+msCtOLJcq9csxWgk11wQYhUdlKXd5AfSNBjq1NrTIQFxZ
-7q8TUn4g9bveUXiZWKTvso0qx17rcQIr1FVablNCvP+3LkNYFw3RCgc17oUNBLnZ
-kA==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2gpdPocket3.age b/flakes/secrets/nix2gpdPocket3.age
deleted file mode 100644
index 64a7443..0000000
--- a/flakes/secrets/nix2gpdPocket3.age
+++ /dev/null
@@ -1,51 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAxaURS
-M05TTFpJT09JWWN0NjRza3g5eUxERHFmUGM1NWc5cVZvejY2N21vCm1TQ2VjeEJp
-bzdXbDI2VTgyNllqSWlWMXdrSjlnNnRlOGFBYjU4N2xtY00KLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHhtOVhhbUttL1hjYmtxYml1RnhZbE5kRC9YM21YeDkxQ1FnOTRR
-clBmUkkKL2hvZXJCdkZBQ3djbzBMZHI1VE9BZGtabEFvaG1nTk96VENSMVhBRW1q
-NAotPiBzc2gtZWQyNTUxOSBTcENqQlEgU2M2Mk9CWVAwN25qTjBXNi9jWmNFTzl1
-WDJVNklFVm5mRkFhVTRBbUozMApMaEV3RlJSWDBLWnRoakVhMUJ0c3RKd0JDK0Iz
-QVJpQ0xUa3VOY1VDUXpnCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBDY1JCQ3Jqamc5
-OEc2ajNiek1XRlcvemtzTzl0R2VYRklsclU2cWhnYkFZClZqaFNKRjNLUys4WXFM
-RlFsRVVRUEFmTW1Kc2NUQ2tZNnc4MGx6N2RlSzQKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIDJyQkp2bDRacGUxMGtrZ2VMQVN5Mm1rUmhzWHhuelhPUDBMWlhtamlsVlEK
-RW9GdWtsUnlXZmxXU1FLVWVQaWhFa1FFWlZVbGNnQ0lRWWVvUE1GeUw4OAotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgSWJTTUZZanFxZVBMUWtxeWlFcktyRmN2RFdYd3V4
-SHcvU3l6OTRjZUQzNApKaE95cFdQR2d4VG0yVGRuNXEyWDhISUdKZHZidGpsUXdi
-Z1VjTEdMK0dBCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBWV3ZSZmt4c3lERSswUFo0
-NmlFMmxtNEY2dHlUcWdqRFEvRWI5V0Jsanl3Cmg2TkZyTGdBK0E4U21rbnBaaVIr
-bnMwYXZ5QktzZGtRK1NTVlk5d0cvbnMKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIElq
-RUVyQ0pkUDdMUjN6YXdkbzZMZm1Gc3I3RStKNm9iU29SMGowNHNweTAKWEdnSjFm
-aUh1U1VvOUJRYkNuTnpTbElCMnpMWDNiRWI4NWpXYlZFR0tONAotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgNXRvYUNBN1IydmRqOUdndHN4MXVUUDZoN2xVZkQ3Tkt4ZjE4
-eDZESUUxYwpzTDlFYnBzY3I3cXF0Q1BKb0lCWDQvaWxrOGRPenJwd2tPVjFKYThu
-MGpjCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBuQ0pYVHl3TmYyVkZ5NDBEa0J0SCty
-eHVTM2M5VnNDVFAyM2c2UTRyVFRvCnNZUW9OZUE2bzVEQUh4Q05ON1JZTC9HNHRZ
-RVdQcUdKS1ZKQWRiY1V0TEUKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIHdTZUt3VTVI
-VmN5WGM5RzhBdjVCQlB0NkdXYTBKbHdaMStLcTF6Um16MFEKd1JnQUkwSXlGemRr
-UlFlc1l2dzU0dlpXRGRGTytzUzl1SFlCSWIwS1NUTQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgbVNseDNoaU1OS1BRQW8xWWZlZnVQVFBtdC9MVldkUHhiZHhOeFU0aE5p
-cwpWWjIxblF2SjhiRXVSUUhnSHZiV0NhNXBUYm9ieDAxL1prQlFmWDdZcm5BCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBKWitUQXE1V2E3MndSM29rS3lka3MxU0hBWGNP
-YXBQTjFkdVBOMWJGdFcwCkFwUjFCQ3psR3BDdldkL1dab0JqSlVGWmt0RXdMZ2lr
-SXIzWCtmb2NhTUkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFVabXdhamt5aTB5T04z
-R0xzUW5GQ1ZUUWt1N0daaE41TzhEZkZLUUg4d1EKbmo2VnZIUTRRcTZaQmRCTU85
-VzdhTndTNWs3TktMZU5oZTdMclBvUlNPQQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-YjZnQyt2OE5LaFpJbExXZEtOcGhERWVoNElUQ2V4R2pnRHBtdVl2ZDNRRQo1N2Vv
-K0RyOXJCL1hrd0x0ZWhsZ2ZKR1RRSVFMTFcvMWdZVmMwUjRDTUVnCi0+IC4teVpu
-MystZ3JlYXNlIDVFYlcgLQpCeWV5anNJN0I0MVhCaGpYY3lRck1TV2VVNWFwMmdr
-R0lGRFRnejZhNGhxZWI2aTRIK25VOXVIOG14U255alptClEzSVRheDdWb0NRWGU5
-ckJqa29OUjEvWWRkTTl3cXN0bG0vNEt0TTlJODU1dFRwcnZ6VkE0VW12RHcKLS0t
-IDlPU3RmalIwUXpUdjBVT2NwWjFsWiszWjN2VTl3cysyOXJTaDU1MWZTNE0Kc9FD
-gkTL9atIF/PbrZIPb1yLzWK9KxUsNhNW63bMnvcM3zn9bQSTPVXuAJXbCn3u4rHS
-kimCEu70RS2yOtC5RKEPvfTPXyONWEGxQTPGtaL6Hgmlj/ppzNrYsbshTt4sc9vh
-dsBW23InrQdLOLurIWKBaqpgdQw9NQRsHZeft3VZDKOnV6VKdu+4XLWpyxAolpvR
-Yu4fjhfy5uKls2DViPiqSg0jGM4qYDZgDQZ4r7rLLk5/I05ElWk2jo1nCaSklO9/
-8NnC0B3oC0ax4QXTRL79YLJj+3x0YR2ejAieZeBhJebr08YsXY8sia1/l03XAHSZ
-KlxyODkEiUkyqks8QoEGdEZZWZSVP+eby3NAROxfVUqhLDTVbDQzGlZ7uzZ4zPHQ
-NHM8pvlf19c0wvtXl4/QFR/rsU5bjzYjukAPxM0w6uaREwj/Rm+mtqmMClv5LVtF
-WiTSKQL5lhTdCTJuNMHE1560RgomtlZAob+KYGh9l1qcbtNhWpnQyvb99ZotbUjw
-ghilfuwJwezpxDf1C+vFPOlqgm6mYjCoREselU2Lb1F4W3aGddQNUnPqms+gv4V9
-tA5PgXt/96g=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2h001.age b/flakes/secrets/nix2h001.age
deleted file mode 100644
index bbe21ed..0000000
--- a/flakes/secrets/nix2h001.age
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBFVVN1
-VEJ6VnpkSUVkbXBWa1IvVmZIQlVNTHp0UksyeFFkYmUvNmxhUnd3CjIzTGNOR0VX
-bDB1S1M1eFNPQllxVHp2UVAvbm1yYTA1YUxqY1VKRnFIN3MKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHVmb2t4Z0JKdmlWQnFYZ3BQcmFsK3RaUTBaOEFxQlA5RmNpbnh2
-R2NlbW8KVWcrK3hUa2xScnJXbGpKVDFIWUpxUk5CbENweXpGakEycnNzSGFVU05S
-NAotPiBzc2gtZWQyNTUxOSBTcENqQlEgRDlyY2N4aDFsNy9MdTR2YnpINmN3Z2RG
-b2VRcEdQZVU4elQyRWg2d3VnOAptcTBGdDRMUTBnVHk1R2xHREZNMzF3Ukw5L1d2
-SUNUbFRqOStrZHlwVWxzCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyA4dGgzSFBrNDBr
-b2R5M2hnUFJKS0dyalIxZE9OcWF6RWxXd1ZkQXJVWm1VCnVJMFV1b3krSUM2WmdU
-b1ZVbzZaajhBTFdLT3BzODNMaWRmdVVTYWsxUTAKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIE9XMy9jRVJuOC9ISk9waHhCRmpRUTM4c2lOYnRpeUQvZkh2VkdHQ21OU1UK
-Mm0xbTR1RWJqQTlGRGV2SDZoSUVWUzQrY1ZjcHFLNUpNNUZNYjNVVUVhRQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgTjc3WVc3Y2MvcUZtU0ZNdXZQNCt0VHVSdGNuOUhF
-TEV1eGJJN0JoVC9pVQo2dWJ6RlQ1NW9NeDB0QWM5VGJGUitJVmdTM00zamVrdnNL
-T1pmTDlsZDBNCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBMYUtaTnpXWFRqQnZWbzND
-WkNIMFBMV0tlV3VrTGVhRXdYZXo0YkNjTW1NCkswQVdaSFRtMHgrVWh0TVptZ3gy
-ZVoyNnRDbFRJNG8yK1NmZDJpR2V2ZVkKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIGlu
-TzVPQitRNWtZUHM0RHE0a1lDeGhpV3phRDEzUnBMZEJUZnI5QUVEVFUKUklwaDA3
-bkFrZHRidHl4bUltZTNEcVZlcGJBSkVSazFOb1F2OTRYa3RjRQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgNEpLUXZKMlZUcFp1ckc3YktZODc2ejlYdjl5eTNUUUgzYWFC
-Y1h2S0ZqTQpjZE90UlNxc2JpRHdMb1pta0dTZy9Lei9UcDBJRGRxQmE3QlFtTmEz
-eTJVCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyAyTzhWM0lRbWhLdEExTW1TOUg1ZzY5
-WVc2T1owS0NJZ0IrQnlxQzdKdWhRCkVYdldKYytHRzZIeExhU1ErbzdRQUdOSElo
-cFRKYUtGaGpsbVBqaWZFUzAKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIE9UdFVLWEU4
-MkF2Y3VRNUE3ZWtnTnIwTDBhWHhVQ2Z6NzJzeDJuOTZCa0kKbFBPQUg4TUFEVnhS
-dlJjcUpZUGNUTHdXZVI3aXhEcElVWFF2c2pnUWNXWQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgNWFPNnZ6NTN2Sks4VGltTjl6MGVaOUR3SXVxL1RYYUdyV1NUVmhzbHIw
-SQo4RTNwaXpLVjBnc0tNa1FkMkVoM2tZcXR2V1I1dnRFMmxGeGdoZmZCaDlNCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSAyWkxsZlN5S0dnMC8wc3poTmMxYXpJeks4RGdl
-NGN6cENVWDJWRzhGWjBFClFpd2I3Tk5ZR2JnSkxUSVk1UFlET1V6Nng4V0hReGtQ
-dFZZZGNKMkJETG8KLT4gc3NoLWVkMjU1MTkga0hrMmdBIDVKYldwMjVNTHJHcGZF
-UlVUMEZFK2hyS0c2bEFzeFUwUHhhdGoxS3ZkbE0KM0lBbnp2eHlESm03T1AvcW5K
-a0lZeGY1T0R5bjhKNjBWeTJheml1Z1BXWQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-VDhYMDFSSUJsL0tHUWYzRmtTQXNSellyeVdpSmVUaHg5ZERqaG1oZ1VCVQpEYmVC
-elEwTWxjT055N3cvNVpDdDlZSWtpdkxzVkg3ZTJFak1wTTdQVk00Ci0+ICVcRTF1
-TVAtZ3JlYXNlID5xdHdTTiBQCnNTc1NYbm14eU1TWWc0c3hXZlhMMmx6TkpoUldW
-STUvTytDZGhuajY2RnpEd3lEM29FbHd0eE53aHdNN3NjeUoKWlpDdEg5amZjRzc3
-cEEKLS0tIGxEVm40YkMyNGk3UER4bks2R0txbnVhOTNjdnU0eDlpOE5PMmFwaU11
-c2MKr3WzgBcLfl3nvG35OYgdYl2A0l8ByVDzy/yn34RPwsiQVgM8C1lY+WH7iqHF
-gcHu9IR5J2S01LyOtcQhIddjwvk0vMTzpDEXn2y5CJa6ro7J3As4rOvsQ9PE4sUF
-TkdVnCE/eEXGyVULFoOVMt6mDDXhQ831YtpeKQOp+T77PCBVMPuKOC7wDm897nKD
-/4/DZT5A6A2eUg/OKkij7lOijJlhtdGvrmBTfuKVURMQQnUfzXwHLorbI5C8dG34
-4naVt4WNr5NSlkxEWYobR1Fluu4nPjtB+JmLeLFhqLqXwNDsfuH70N+ay0ap37lO
-nlSutR3WhrTpxt+kiYiR8DXfKlAUZJ94ybbyC87MjuNmj0XpZOvvstWnZoA99TEZ
-RQmesQK4QICNDcNyH+RCZT16ROiDyV9lc6bLmCNqhMDURQraJI6aA8xqKUN4W6tf
-OLzgVHs/8hW9K8yB4c1wHjKAZVR8+0ccOD8Wrl7hOW2iE2h+zBSA7CGvBQlkH7I9
-a94g2Wj7YnDqw/Qi7QhlTNiQJgcnKae6NBgaehxvZdyfnTFRt4JrwuxQLwJpW1Oi
-O/8=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2h002.age b/flakes/secrets/nix2h002.age
deleted file mode 100644
index e3135a7..0000000
--- a/flakes/secrets/nix2h002.age
+++ /dev/null
@@ -1,48 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBJbmlM
-eXVRc2w2c2Fnem95cFVKeElmSW5tejRYMHVwcHZtUDdZc0I5dFNBCnZ6ay8zSlEy
-OVhxS0pFeUxGdFlteEJKZjFCSHNpYzlrN1FoUVVLUzYyZ28KLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIEZCN2lqQ0VxdzUzMGxMc3drSjY1OGxYUnArNmhpWGxjS3l1MkY5
-TWxyajAKRW5wUklCaEVpMXZ3cDFEelVXd1M3UHJtdmpSNHAxMDZTMHZwWTY1bEVq
-bwotPiBzc2gtZWQyNTUxOSBTcENqQlEgRGszZlRNVC9RZTJvSER4VS96a3Y5Qzg0
-NWVHOWtpa0t6NTUwVVFML2lHYwppUU8zWENidlgwVDRESk45SWlOalVCSTdETkZG
-Sk1QVjhGM2JiNnFtRVVvCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyArYWRNWFIyWDRY
-Q0tFbXRzU1ZWa2JkRGU3UTF2eTRtUWxwWkFybzlqRmc4CldKRHFnLzZWOHQ2VzEy
-Um95TFN6eVVFVlpwMnVNQXByTUtKaVkwQ0ZlVVkKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIDFuRHdzb3Y4a1c1WHJVRTAvcHV6eW5zalZKaHgxY0tub3Mxb3ZUQzhzMjAK
-VVhLMFBEUm80SXkrOGt4c0t4YTdvUmxqUkRSWE5pcGJyUVoyRkdBRTFQQQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgQzE0UStPZjJkSlZPbGdTeE1vWGJoTTBXWjZGemU1
-RlFvY2I3Z3hJbExHRQp4OExQemhlS1ArL2ZjMFBsZzk2YTcrcm1RazNUeHBtY2dZ
-RUdaQkoxYlMwCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSA1RTZXOG1xWGtkMFBva1h6
-WSszTHJxcDE2QkdqU0dvN1VPSlA4ZEp0RDBzCmNaOHA0QUduYkg0dVRHeGZJbEx6
-WU1YTnZ3dHVQTHRkQlhqemZHVEtVTVkKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIDNL
-dlJoOWYwY0luOHh1eDFiZWFIRjhYU3FFWkFxYWJvV2FUaTV0c2lrMmMKMytmWmly
-Y016Zm9SMytzeVpod25HQXd6YmlzWUxTeUN6bG5QMEtQRnpRVQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgUGtXOEV1UVVEN0p5RE11SjlURUJpWE9ORjFaNVd4VUk0NFZr
-dVpCbDgxWQpoeVhURkpTUmp6YjZxZlBtQTBjeklkTC9YTitFZGpuYTBMMEM3OFFk
-TllrCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBYZTdPbEJnaURRWGxoT05zSCtCR1B4
-NHhVbGVPU2xZS3ZLNk8yT3BBYUVvCmNOZERSNVpNaEVRTU1Zck1McEVES0hRT2ZR
-OEhjU2k5UExHWm5NeEc2bWcKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIGp0amkwMHpZ
-bUdoOE82WDkxMmE1OXB4djllVk1uQ1NRTis0Zk52TDd6QkUKdW14QmhHYkl0TEZE
-OXdkVDJWVHhoMkFIdUE0emNyTXVPbGZVSzYycENHbwotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgMHBud2tCRXJhOHBqMktVU1IyTTF0OXFxUHg4TVNkZVpuNGdIc2JrWTIy
-ZwpkbFp6M0FWQzRmeDREakl5NW1wVy94Zkc2eGNhN3c3bkM3elpldmdRWXlvCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBEejR6bDY1azJGN0pPUlBoRWtaVDhpMzUrQldH
-Mzl5Y1pHNkJ2VlI0QlR3CnY4b0N3YmJNWHMwQkZuOHZRSjdCcHRKWEpoVjlpaE9k
-K3A0WUU3d1M5V00KLT4gc3NoLWVkMjU1MTkga0hrMmdBIGtvOXBDS2pka3BzQ2Fq
-MEwrczRIUHFVdDk2M25vVWZORjVjZjJOcnE2UmsKSjQxdzFiSTBDOTR2ZTlHdDhi
-d3BTelRueHpuQ2h2dnJTTWswOWs0Y0ZTTQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-MWtiZmgzQk9aak1rTjJuZUNrVGg3YUFVVGRWZlV0bERoMmVOazc4Sk5Ydwp6K1BI
-cnd4VytYbEJzekRma2lZb0V0NU1SV3RiNkNtTjdUYkJJYURPTnN3Ci0+IFB5LWdy
-ZWFzZQp4RStVVXZaaXR2ajA3WEU0Ci0tLSAxWXlKeWtLQjJjeVdKOHJlVTVqT0h3
-QTlPYWRINXpjMWxXK1VjOUdjU2hnCjIP4zEcmvwi/h2k7qlnlaosNoEFzlOVpETC
-KoaLhcc9z/tHJ0nIlKtye5XxzUikWgkwFP+R1jPrdTPS5/8ssMiLv7PD3DyuqYzp
-a6hq3D9yElXv1G9n8V5XYUzDVAb8tdL7NL+ZrLyTfwmmFhDVWYBfxdyguO/r08rr
-oRITDQ5aPCGHpFfzGavq8jdlAHYiFZtqcc1aGbYHwPtozlRrRzUxAQAywi9tJkev
-+jOqO/49NshFbzsE01mCh7BezVEzERuhbFUbVc+pdhyQSqlMOu4IgU0iuQpuVof3
-q9WmJAW6pM07zapwlUbyxAFGybMgaiLEBze1d9FvKRF8b4cZqgNf6JmJkd8eLbY1
-NUFmgpiipC/Orp9HNB8RtB/o250uqWSWb+kh4oh7aFLoorPmCs/EsOOvb4WN17vX
-p4AUTnwz103VjObM4d2H1yzzvX38bfws+9BF4bSvhqZPDaZHJs4QBLHgMK325+bj
-pyAYlXwe4PF7Q7rfu4TH2OAzPWYZnbPTDFa2tfzF7bEsXgs5RFQhTMDp4//Ch3mT
-DubgdbG4Mq+llWc5pCgLRXz/n7fh
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2h003.age b/flakes/secrets/nix2h003.age
deleted file mode 100644
index ac5d299..0000000
--- a/flakes/secrets/nix2h003.age
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBtTk9z
-aEJ0UUZqMmY4QXJZYm1TUEVnVFY4MkdwWlRITlJ0Unh1bCtZY1NnCm51REV4M09N
-Q0svSGdEa1JKMUZEMm5iTENYZGN3TDNHY3RPa3FRSDBEdWsKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIDdTVFJBZjhDcWx6NzMyekZ3WUE1a1dzZGVuWXJibmtvYUVZbmth
-cldBSDQKQzl4NGNMbGh1TUFVSmZodzJnaTJlQUpqcTZ5eGJPSHhhSGVHcTJFblRP
-SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgL2FHL0hUZWxRcHFCZStEY25mbWttckpR
-dkg5OGU0bWlIU0JTVFl3TGd3MApaUzRyQisxL2tibVdubm5CenZGa0JyZ1V6bWNM
-UExmdFhjeFdDRkg1Y1NnCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBZMXRlaCtNMEVk
-ZHExRXRSdFRSQ3ZTY3VNczQrYlZDU3dUMkJJQThxdmg4CldER0RDa2FoMlBVdUxj
-aDVuVnZidHlyZE1lSzBwclRhVlRzTG0xWkIvckUKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIEMvTDBVMElaaVNsTHJnTE1BMTUzMzNMRjd1YXlpM0ljWkNsZjRyVWwrajQK
-RFg3NDBEYzF0eDBsR2hXV05hZDBOc0EzZ3ZaYUpnbUtmeEJkWndGMUpoMAotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgSzhVUk1UUGFDZGgrczJMR0JJSnlNWmw1MXNyY2Fx
-WlJ3OWRkU29WWUxqTQoxandJRXVXR1ptTStqdDh6Y2NRT3ZFdUtKWmVKREN4VGpN
-UkE5QkxNQTgwCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBtTjJ0T2dWblRteE9OYTVh
-ME5YVEkyWS9DMFdZVURHV3V6V0tEZHRpOVJrCksxL05WSVZ5UTFFaDQ5UVdXUWgw
-WEZvb1Jqb2FVamJrbk9sc01yZnJEUjAKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIFUz
-YWp1ZVA5UTBGMzRySURnR3NsMk9sR3hiSkZ1RDJNcVFYR0dIRUtGbEUKcG5Yc2FR
-UFZIMlFoZ0hFR2J0UDUwMXZpUW1Bc0hsYWpsZ0FLSVUrV1UySQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgVk1nSy9pTkZyNkxkQ0QraC9jWWNIRDA4RVBkODNRVklHVnBP
-WUZLZUpqbwpjczdMUmFadjVSaVJnNUtTcG52QThkV3NBdC9ZdCtLS0I3K2tTSXJY
-ZzBRCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBIVkNZU2h6S3dyNnVva01MTnBVZGNr
-RlNhU3JmRXBuaGFTKzFGSE53WkNjCkxRRDYrdDgwZ0RJM2RCRjVQcHBQQURmUTk4
-T1BaZW00Ym1PY0xZU2lQWWcKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIHptZEVoZlZL
-YzFpM2F3M2JiNHJMeG1IK2loT2U2SGNYckc0REUzaXF5VlEKMEJnaG1UNm9qV29u
-RE5XdXNvaW5IQWIyU1NWbTdNcVRRc2podURQSTg2RQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgM1UrU3VPQlhLOE5sZ2lKQVZBc2NVWjlTTDRNTUUrMzFuTnoyYVZWQllC
-RQo2MTF6aXp1SFIwT1N5WlQ1Y2ZlbXp0L1o3VElGV01JZnZ0cWh3WjhpRE9RCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBhaWVlRkhVUVVYd0VlMWFlK0J6ZFk2Ryt4Mjkv
-Y01QK0lmYkQ2MW5tU1Y4Cm1BbDUya1NvZVFEaGVhVFRaanJFajhXZjJoeHVOc0Y3
-STJwLzduMjJtRWsKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGJib0ZPaUF6QmEyZEJz
-Qk82bEVhdjhjZmxRSWJ2REI4VDBFdG96ZWdRamMKUFA2blhQenN1dnJuOStVcHhU
-b1JLU3VBbi9JM09PSklndnYyYTk4UFpKOAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-SlZ6Ri8zSklGTVJlcWJ5NVRMai9mV0ZNdjFEMkNBTDViZmZPWjJDZVF3RQpGeEJO
-SU5ibFFBajhkL2ZvOHU5dHI5ZHh2Nmw2SndJNW12UFpad3VrWWhFCi0+IG0sYT8t
-Z3JlYXNlIGpMYgpvWHd3cTVpVzRUb0tBQXZRYUtDTzhUeC9sWjUrRUI3c1FpclMw
-RUVuUFRaNG0zYkF1MlY3a3c4U0p5MnllTGdJClF2cDArR21maU9CMnJLT2Vwd3M5
-MnltQWNKdk5tRjFubXdrbndGN2JlWS8xUmVNQldNZzFBaDRqc3hRCi0tLSA3TGJo
-VUh4c3phMVh1UjY1V2o2QUVMaHdWQUQ0MXdiaXlPbGtxd3pQalRvCg5d7TPD5H++
-80/jBhiQQ3NwQEQBhzOdkn3zp+qXDCJ00khIAMoSEEOQSUtArladVCKIqgfM10B3
-8kJLQW2vEJVTHhMk4o0PsB18KwkYalcDIDRPPMHDjNTFpnJx9zWt4cenq6WYWdRJ
-URIdSCx7KAgTuoOmwZP/PCm8skPCtv19AY/dWJdhTEiovTZ4WOJHyTlk8fh+9rzc
-BsWVXodg27L9JArmn2sidEKXXieswzzZDY743c+RiQYOe6g7/6P1fRv25TV6vLmE
-pp4cLRtx72WL3tFBqHnSEYfuThPRFDeEnrUlIACfMPyTQSR0gQJ/3R7KmtX9KFOU
-6VSaYLhHk/0HJzBqiWi73e4K2yFZLGEIPD8NHPGzMrr0ncxC2e4e+miZP5YeOBy7
-xQEpXdoVvR0UhmwHNODVsY4ENKm3YH1/x6fA95r2nIF2sFuIHDg52ucfbNsGLcDp
-xWbc3TJdnzGR2wI/0OR18yXrkhgSt+ZLxutRw76zqpTnfXZ/uxXasA9wbUJhDxho
-9hhzeu9wiaODO2cmDKKIr1O5aRhWc2L0zQYdPSWyWM+jPO9edgOw
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2joe.age b/flakes/secrets/nix2joe.age
deleted file mode 100644
index b3b99e2..0000000
--- a/flakes/secrets/nix2joe.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBoUitQ
-c2c1R09TRDNVUTFFc0ZTcFdRUC8wSXp0OHN5SXVKaXBuZiswaTFRCkpYZExpcVAr
-S1lZWDJxNjRZQVphRThqOHJFckhPS0xiRSs0TG81UnY0NzAKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIDM1cDlZUHBpZUtjVllLOHlZT016Q0pSTEdRQlRhMllxRmRpMnFa
-WVhlR3cKclV4dldBQUxxVjFGRlJLai9CVDRnUXRwdXFVTncwdHNHNVZIWlFFcXAy
-awotPiBzc2gtZWQyNTUxOSBTcENqQlEgd2pZZFdEZzJ3RUhseksxREhuV1kxQWJu
-SDdKd1JGQ1B6ajJaSko5ZHlpVQprQ2dyZ1ZYcC94eUI1cmFZY2tmUjVnVitXekd3
-VFNVNFRpall3c051czdvCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyB6R3dIYjRjb0FL
-RHArWkxtUlIzek9wbHdrc3lWdjVPWnNlT0Y0aGVxOXp3CkxBV1hJT2xEWkNGaWtP
-YnpiaGtkSlEvZjhiTWl0bEF3MC9Xd05aRS9TWjAKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIFNlKzcwWk9HT0t1SFIzTlVGcG5oR2VwZThndG5sOGp0d0lvdi9MSU95eTgK
-UFNLS0E3NGM3TVI1M3V2REJHRVRKSW9xT1pTWTBzQXhIWFlMaWxwdmlCMAotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgZkZLZmprYk9WYUtISXpQTzVacE5UY1hhSGVra0du
-bHFmcllFbUZIdU9nMApKRVZESEk0YlQ3MC9SWldTL3ZwamM1WjFVa3B3aUthUWZS
-QU5FMG10Vlo4Ci0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBwQkt5MmxDT2ZCWXVNcDNv
-Rk9zSVFpNDNXaWpXeHlxRjVscnhjbWwvdGlRCjZSaGY5VzhMR21EcXVscVFlZnB3
-ZHhpTlF0N1JsZ2IwVDhWdW9IWndjY00KLT4gc3NoLWVkMjU1MTkgNWFkcU1nIENV
-QjU2VW5xRVkwYmgrczRXZlVpdVN3eDJFb1lDT0xUTjBVMGN2blR1bXMKRE5WL3hT
-aDQ5aXZTWkZ4TFBxdzBRN0hVejRGWmRmcEtqNnlJeFpreFpnOAotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgL1Y5akxoTUVsTzBrbTZzQnlhSG9yOHYxeGtFNW9BMk5INW5M
-UUNyOWxoMApDNzFjN2lqVWVXSCtmbG9pYi9FRWdwWjBFUVpRaHp2Z2tlLzJaanlx
-MXB3Ci0+IHNzaC1lZDI1NTE5IHBlRkJRZyB6bGtRY1BMSzNrS1F2SXp1dUV5LzFu
-SGpFZWlMQ1lHblY4UVJsYjZpUUdzCkQwVHZVSUVFTHducU42VUNFTGFSNGtaWHd0
-L2JyN1k0bEF3djBkbmlUOHcKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIGxlOTBKNXdu
-UHNmOHZzbHlRbGx3bW40SG1WbFlhWkw3cWVjeU5PRjBBbkkKcXFsWDJPNnpzbEFW
-RFZOL3pGM3Q1QnJuM0taaFdCZE5DMmJGcmtWWnNxawotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgMXJLVmVIZG14KzZXK2s5aW5NeUdlTlBSMFJVakJtT1I2VGlDS1lNY1N5
-dwo2OUxUVUhRVVFYdnQzZUFDMmhyM0ZKRnVPMHA0UXJJN1VOTUJSdGtrc2NJCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSA5ZldDeElGU3BDc0ZOb2U2R1k1Zm1YV3p0UlY1
-bW0wSWFXaHVVcnBteUVnCkV6TEVNbGtlTXRxUFE4YjBNbkxSbGg5amtYZGN3d0hw
-dlpYd1B2M0hMWWsKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDdCQVBPMWJ0ZjMybzlo
-VUIwNWhTMjZHTEdXeEdUZW9KOUNUQXR5aDg4Z1kKL2hqYnRJTWFIbHk5V01JRU83
-bG4zZnorNlhHTGFiampMalR5RkhMSnZBOAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-bHpqQ0s0emZhdXRoOUJ5R0lJNW9zdUEvSDBoRTZtQ0RjbXhlTmtBeE9UOApzbkEy
-bzd2TTQwM1E3OUJRRkw3L1gwZWtkbXBaNCs4bTV5WUt1cWQxSUY0Ci0+IFckLS1n
-cmVhc2UgeiAjIGIsYwpLK2N0VWg2MnkyZnAzUHdTMDZndW5VMFBSSGFRVHc4TkZp
-UWlrb01oK1pZWHczZUxDbzlzWlN1SFByaVFuNkFBClR3LzZQNjJwaW9KbmVuawot
-LS0gdlZpblhVOGJNMGpmUmhadzVwcHFzUjV0NFN4NkRCMXRKZzBWRXVEVWllNApm
-IZa9ECQVLO2oiz99Lzd1KMMgT5yWbxFg/Sdq22UAOxFFpqIIKmxf2MuXpkMK0xpO
-maCeSjj4qv/HXdLZt2+Supu14ZOfTx147ULd0/ki+bdviaZ97SzPMRGqr95e0Nzs
-oRJbX1C8WgacwPiwxOktDM2qQ9w0xp2g33wLgEtQapgo0EnO/TEQv5keVlaFOx6V
-9C+5JSaPrrCa49l8/DYrbP/nk350hCQy0qIJjErqrfqQmSrOGVIYCZbgxV2rltC2
-QCbl/uhZ7wtgunDLmTCal2Trvs8ZF30+SxJgo21p05fCyVgkBWdwO7uduXE0KaIf
-fpYwFEMieIA/TtRxVbmzr5LhCsx29YPCSEDospSti8/oQmGfDoujjUOYP6h+QmaT
-ZH0ag8U0fVuDIxerVQ4ys5tOrH97TrOeOrIKHxUWswUsF/oETDCyTO5TxcZnU7qw
-d/jY7NnU8K/89gjXhADOncA4P29qrD7aHxkZNS28B3iLuCm9283EH/1BB9e7w3Zm
-McMxJsjadnNGpJHzYo1BInUwbJeb7V4WapPK1n6FfOAJZ+la+S0LQyOWXcPImQ==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2l002.age b/flakes/secrets/nix2l002.age
deleted file mode 100644
index da46535..0000000
--- a/flakes/secrets/nix2l002.age
+++ /dev/null
@@ -1,48 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USA5UDI1
-NG0zeEtQaEE5dHhlS3ROdFlETm5QRlNWTjVvSmc2U05kdkZNRnpnClJtRUlHUUhP
-bThGSXkrUTZIcW5IUk1lWklSZ0NBMHZ3RzBNU3pkbW9Rd1UKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIG1TamxlUUpUQWN0VzBVTVV6eGxJNzFPRmlFcy80NTlvTTBjcFVS
-RHJ1bk0KMU55cGhjOXBEUkpyR0twWFZKQU50d044bDVwWmJaemU1SXd5UnFhSExl
-QQotPiBzc2gtZWQyNTUxOSBTcENqQlEgNFB4TTZ0MXJST1JVRjZVd2NHaVBrRlJI
-UjgzMFl0b0FCb1k2TitpeFB5Zwp2ZThtc3BmdTR0UWR4M3lhS0VKMmVUdkwyVk1T
-WXpubGRnTWk5c2lBY1hVCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyB0d1pMU0RDTVUr
-NVhDZDJhbDh5M1RMNUtVYWRuSUU3WHlScW52L2tTQkRjCmR4TnlkRHQvT3p6NDR1
-TmE0YWMrcUIyRTFITFNLM0hsTjBWMFJxbUQ1YVkKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIGV5MzV0WjZLWlRFWnNVeFN6OHFHekdHeDI0bGlSNFh0MEZLQm5yb21xUm8K
-MDVLaUNTek5URS9wejJINWRpNWVSY1pZQ3NUcitkVjNDQ0FHK3NoVU03awotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgOFc2R1BTMHBQLytLVUlQZGNjL3NBUGhUOGd5RTRv
-RFI3dWVpekxPVGdESQo2UEVzUU9BSUl4TkVjTi9jcFBGWU1MQitWOFIwQncyaW9v
-L2tGais5Y2VVCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBpZDhEVEswWHFIWUNYdHpI
-bEdOMzFVbnVydkRaV3U3KzJQdlNPamNkT3dZCkM0VDFKRUdHYXk4dFJjL0RNa3pO
-NlRJdGM2NDlOQ1RoYnFsSmY0RDJrUXMKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIDFD
-UmlzQzlBQXNFZ3QrN3luUFh1VUlER0N1K0pWL0RQK2trTmZGMENPaGMKTTFsdmtY
-NXRxa1cyUmZLV0cwWmx6MVBpRk5adi90cWpaQjVoSUJaQks3TQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgQ0gwQkQxTDlldmJ5eFZvK2FPTXpuR1g2QXIxOHh4ZmhsVFhq
-OHhZRENqTQpjSUdXZjhhandqRWJuSGJvWmJJUTlpTGVWclBKaFhyWVN2ZjZXeHlt
-VVNNCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyB3VjV2MU5kZ3lWUHdyOGFWQnd6QmRT
-dzFrZ3I3aEFkMThFemtvZjRRYmhvCjFSUStmMHBRdFpTWVFRV25ZRU5pL2ZVa2dj
-R2tLL0NTWWdoaE5MTmZtTWsKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIFdGaFpxOXI4
-Tk5rRG9OV0FuQ25nR1ZVMnR2Z2c1L0R5aENaZTFHWURsanMKNTlxVEJXTFl5NWlI
-STZqRmNIRmUxTm81VkN3WEpkK2d2dHR2OXQvSlUyQQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgYXd4aFI0eE1oaUsvalkyc3lwNjBONHhUQ0FOVWRPMmM1MFNZOHVQb0t4
-dwoxdG4xclVmYlRXSEMyMTYxdVA1VnlkUC9XMmZpUEphRDJNM2lYem1hMEkwCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBKUlpaWmFTb2w1NUZ1Zlh4eVpyakZSeXREejNX
-UEpvV29CNGNrM05sY3dNCkMveTQxaFkzWVl6SzdQYVN6S2RuMDBYdnNSQlpZeG43
-MTMrckZ0RkFNWk0KLT4gc3NoLWVkMjU1MTkga0hrMmdBIFhXKzFZbWdmeDNPQkZj
-YU5TY3I4aE96ajdrNzk5RzBDN3BiZGV5N3I4blEKZlF1eXFSYlBPbW9JaldWRlU1
-RE81YlB1OHNmOEZCVmJQc3BnYVNLaDVDOAotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-Y2JXdEZTemVETGE2NVovYUI4ODREZTU3MUpDMGN1SEhxZVdUaTNkZWF3WQpHRnl5
-VVhXeTZiclcyaHJsU3pzdnNuNmdoeWc1UEcwNkk2aDJNdEN1VWdZCi0+IE51dVUi
-RS1ncmVhc2UgUnpmV0cgZFAgPkcwPVMgLE0KbVZ2TGFsNzAKLS0tIDdXRy9Wa2Zo
-d01LNjllYk1IUWRER2VWcVpGZjVUcjI4R3pzaXFOQWZEajgKevDdCPm1Um1nENws
-BIkQGw1ce88c/X/Zu7CGcmysyQcu8ICSU8slpjkk65hO+EYFB74uihs9BKkp+uAV
-0U3U71qnWPkLl9wKlLzXiit3c75EV4yeT5D+ABh31v0gMHpdAaXtS0Sat98J18KU
-iN+sWJW4CBD9A+wq+hviLRjhlJqk4B1cAO59uAYDDKvlrSlPSIQxBwhJG8e8sKRE
-EzXZzNUFMRWrr0Cimd+aIKEu112iwV3cKaXJNBXU2qiqMEyF9dpKqOIQXzgKRRyc
-43avD1DytVFCzp6RO6QG3TkJNdLDQOntxy1E1RCAJdOJauw3O7lYahayrhtm3lw2
-lB2+Af2NLXmIhR+D14wyiAjDBXssImRqomw1MUwtFmWlZYwHDivtzk96Bwm37GpP
-6HzW6qU7wgCXnvyOsDVN/CMF8jWhsesfj/GnTAZdzW+hlXYp0CfezHccid9gfHdS
-5rsWgLCWAJk8RGRTLjRS2dDkkRzeOVcnYzBQiwosZPZvM5eK5EsOSR6BB/Rk0at2
-8B8oFGtngszREhGJWxJWnpJ0gr+/+cHHXJr+Nl9Yso5Rtx4=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2linode.age b/flakes/secrets/nix2linode.age
deleted file mode 100644
index 187d7ce..0000000
--- a/flakes/secrets/nix2linode.age
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBPTkZB
-S0F1anJIUlZkd25EbllBdnAxaWx0NWpvblBZcG1JNnFnOTF6OTBzClFzOEtFcFNC
-YWFkVTRadVIzeVcvQ1owaG0rNGV5VVNmR2dhVklPZ1piRmcKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHRjeS9nTGtsRGhNNlJqU0F3cmVudmxVem5XU0JvcEJ5NWRkRC8x
-b0xMRUkKa01GRGtyc0IwOW53a2Y0ZVZyejhmbkZyYUJtU2FROFovYjRuTk9teXo1
-VQotPiBzc2gtZWQyNTUxOSBTcENqQlEgSTJqTmdnSFRURDY1dGxjRVFVN1g4cWk4
-OFo3YWZHZnhoTDBJenFKVnFuQQppUVJ5VTBDckxBTUlpQ0Y3amQ0UDJmM0QydXk3
-NWg5aHB2RnNuUXpBUVhrCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyA5MEVLMklTTGRK
-ZTg3akZYdVdlckt0bDlieWJzN3VwQWY1THRpWnNxbWhRCnZ0ZzMvZjdQU1JsSG5t
-ZUdra29EaHNOWGZndGtOSlFxQWxtRy9tOFcwaDgKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIEF5ZUNoT01iSFh6ZE1YVS8wNktVRWYwa1JwMHhHWG9jdFU5aVEvRHJDVzgK
-NzVvam9CVVExa01aUXZ1SlQ3aXc0L29Fd3FJMk9XemxUSTRjc29OMEZUVQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgMjRheVJNNFZkYVpnT0o4Q2lhdUFvUlNxTnA3blN5
-d3o1Nys4TkRPOVptWQowVkJEbkFnbytDdThCN2VRamd6S1gvZWtYd0VwT1lHMGs5
-ZnRCZDN3dnhJCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBnN29LR1BRcHloWGR6SEI4
-UGU4WE4vMGRsSlQ5dUNWNS9NdzgySTQyZkJ3CmF1K2tMRUJoRnpMMFdKNnB4ZEwv
-VC9FVkVNTUpHRnlTc3FnZ1hLcWdTTE0KLT4gc3NoLWVkMjU1MTkgNWFkcU1nIGtn
-VEdyOWRHV05CRWNyZHpKRmZnbXBpZGgrMHZRcEtGVS9ETnpWTWM3bTQKdmVLTkRL
-NlNjZkRHVVhlWXRNMHdJUk5FZFdXVmdLY0E1L0FWWG5uR2NjQQotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgNTdzK2xPb3lkZUczTTN2aVFvdTRCai8xZkl3TnlPRXB0VVR0
-S21VeUwwVQo4K1lwNVFERGdLNjRBSTJ6WU04em40TEorcVpEKyt1TWJsbGVWMWg4
-UEEwCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBuM0RoYWhSL0pCUExyV3JZTVEvcnZN
-dTZ0dE8vc1BIYXRHV3hOWEs0MUZRCnQrVlFlaE40R3ZJeE1DM2ZLNGxpeTlIMDUr
-WEVPRlVmM1lITmhxamNpM0kKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIDBnMFhFUFJ6
-aWJSMVYyZFZua0x6NWF3cDBlMmIyNHBlcHFENVJRV0IxeVkKYzVoQnNGeU85ZEFX
-L29aU2F4d1V5cFYwdTJ2SjdOVjJhSEp5QXlKY3E2NAotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgRDhYVU9CeFo5cTIwWnpjU1BHVk04TXpkWUJpTGhYcU9pZlgyRmliZEZp
-dwpFWmlSWmozMzF0TEI1cU91UmllWnoyM0hsMVRVZWJxNER0RDNUZ0x5WWxjCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBpb1RRWDN5RTNPdlNENlNISTJaNVJyOWFnU3FV
-QnNqSjVoMTlmclBwL1U0CkIyWXU0K1hqR0tOSTRLOUFtbzVjbHZWeGZoTmwvazJh
-NzBhWmhFeHp3KzAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFRzRUpVZEsxck1lQ0Z4
-NkV5bjBJbUJoYksxeVVUUXZ3RkpZcjEyMkYxQzAKem9zK25lYW9xK3MwNHA2RDJW
-VzQ0d1Z2UjE4YUtnL0N5cWJ0enBwZFdubwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-cFNCeHBjYlB2Ym9lYUNOWnNtbmw3Z0Q2Wm5qTDd2dFRNUGEwR0J1a2ZVZwpjanhV
-QlZSWjNYejlTMFlnMUZGUWtEeXJrTFZiM29XMUtxYzlFdnczY213Ci0+IFRXJX53
-Ni1ncmVhc2UKMWZFNDdXaEtTbEpkSTd5L1pUOHBRNXhmK01GWFhiaHZvSjhWY3Bq
-WGUzZFFleFo0ZHNhRm9VbCtsNlBVZkhmTwp2bnA5ZFIyM2tGOHNqclVpcmRTM0hq
-T1dGdWptMzVDNWRGcGpSTm82dEJKV2NqalAxdFA0LzhoQmFoWGoKLS0tIE1ZQVpZ
-aGR0OFBObGNiRUJ3dnkwYUwxQjltbjNqNjRvcEpxVWdlSW5udXcK5Y5qQ/0je6zS
-xltE6ckkjNpGkcP9zNlivggX/OpaYwr36s4thNEgQNMVCl5COcIe8q/Xb3gdhY1K
-QT7bB4PjJc5czbLjKIsVV2Vs6tMaraNpbjMCR0j3co2C8KKVW+FJW+WilxkVsiS6
-MZaEjx6F8cKh6OVUgCVzyHWSEnzkrLBq8zUaa7X8maHe+X3WAmIrZgzaoYeN/Usj
-d+do6+WGM7BUMZPlhHQx9rc03xp/jgb6kekIVBJvvneLmyIInOd7aSCzRR/7Y13H
-d66km+ba+l1uhnP2LSMCrBsBwm5ve+k5cy8bR9mMVx+CKAzExN+fFJuMbB1yNFty
-S0luM7ne1kAaWLTG/t687XOE2wDxY75jqEm9QDtPAV0my2UyUhW5H43Ftt6cvQBL
-ZYyqCT3rLKtDKgWEu0bnzSBOrBY9tSJr7nU13ll9r4v+2Py2mJMq/QbiwTsFbHDK
-DRElMt3MKCoRgQTHj1lh0i3cKenc3fRHjcIrlmx12JTL046i9vR/ylFEuMcmJi7i
-oETDhqe5ARfw7VAFn1KBoXppwtuElT+Hz8oE3+i2TzCIY2MU5Pk=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2lio.age b/flakes/secrets/nix2lio.age
deleted file mode 100644
index 212b9a8..0000000
--- a/flakes/secrets/nix2lio.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAwZ2tK
-dFdPYVFhUTJibm0vSSsrZXYrYnFlOVZuRnRINnNrUkVIQTd1ZWhRCnFNK1N5MUgv
-OTk5S2hpTUhpVS9zYkRBMUQ5UFFkMTMxREpodGtBaFdnMkEKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHRJRE9aaWFqOGRiMGpZL1QyclVqSW1lSDhDaGNZNUpyeFcyNWds
-dkZBU2sKUmp4TS9Qd0xQeWJodDFKamlJTnQ5N21Yb2ZJZU5PRnkveGZ4UVVoaGE1
-SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgS2RLWGdscW53NFF2WHZ3RkpoQ2dnb2JO
-Y1FUOEVwUkw2Um1VUjJPc1F6OApBdzRMVUcweTNBWEpCZm52NlF5VVlEbjJaOG1M
-amNYYTR5Zi9GTVBJaXJBCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBEODNNOU0vM2xj
-elJ4S21ZZnVLYzVDVGhpNUZROVY1VThpSDVNVHphZWpJCkhqb0pWQUcrbWlpb2Fh
-R1RSOTY3ekhtSUN4ZTBXajlsSlVkNDdmc0FYSzgKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIFFDeXUrVEdaSkwvY1RBbU04bG1hSk9Jbzd2cTc3eGlsZ3V2SXVycDU4aTQK
-S2ROQ09OYTN0OUVaSXl2V2gwZG4vMks4djh1TDI1QjZMVFVSV0lidDZXQQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgSTd0NXA5YVdmd1E4TmpVMG5oUEh0aXgvcit4SVA3
-Yk1mM2tTc1pLdzBsYwozb0pVcHhhWWhhTG1QeGNBMkpRZ2x5cFpiUk9zUDEvRnBV
-THVOcERUdjZvCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBXMk1tZEdJMnQyRnU4Sm1w
-ZW03Z3hCUnRlUEdyc0x3bjF3WnhzM3ppTEI0Ck1zWUxKaXdKNzczT1N0R2Z0Q1VG
-dmdHL1FmQ0dBUkp5dE4rd0JWL200Y0kKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIEh1
-bUlySEhGazQzWE04cGpyUWJIWDBaSWg3QkFqK2hxRkhJQWR1Z1dMa00KU1VjOW53
-cnJiQkxEVFh5R1pmSTREc1lKNnhGNGRCNkJSZ3ZvcjM1aU1JYwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgZnZ6MjBWVllIU2ozT0V6WU9NRE05eTRWVVhJVmxWZFc1TmlK
-Y05NQy8yawpWK0VUS0hkcmYyRWwyMGZQY3pUTy93Y05TQWRzdlFyb3FsNXA3STB2
-ZE5FCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyA5RWYzOFZuUkJLWFo4eDg0ZG5BOWNt
-SFlEQ0dDU1NBUWJIRjlmT0QwYlgwCmxFd1N3Y2YrSm9XemlzVVFsaG4vdVd0Y1la
-TThsUUVtQUN0L2w2cHhmbzgKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIDJCZmVnK3Zr
-L3lmQzc3SWpxNXJjUitZZnNWMXdDVjl6ZStsK0dkNVczV2cKa1RNNTIyNkUrY29G
-N091S0ZDUmNDbTVzQVRrdVpuV1h5LzdCTmM5Wk8rSQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgZWNnUzlvNGNjVklkbG9UTUFQSVRzaElkQjJudmhoR0xSRGxZR2J5bXcz
-QQp6dUlQY1ZBM1ZrUHVlQkp6dFBUYXZYTGRFRUk2anpkS21jYjN1MndzMmQ4Ci0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSB0aXZQMFg0TkFzRDVQRUptT01JWE81R0UzVFBH
-czlDR3JEU2NnTGVYaVdVCkJGNnJMRW11MEMzbjFTVVN2WjFSZkR6QTE3K25lV3Bh
-L3BTOWNJSGcrTWcKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGUwdXZyNTNWOGhuaXE0
-RTUvRVFPRU4rd1JCNjdCWUd4dUpPMjlHZ3VZaDAKL0N6cFl4b0VzNW5VZnp3MEdJ
-bGQyRDh2dTJmZFBFa001Yks3R1NRNmhhRQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-RzZPWXZnTjVkT3QvczlNMXg0WkVvQnk0bll4SnYwYTNPNzB2a0k4Rld3bwppSU1j
-azEyWU1mWXBEK3BxT2haU3U0MFYwUU1ZNlFLaU5Zbml1cG9vM2Y0Ci0+IE9pajQt
-Z3JlYXNlIHIyRCEgZHI9JFAsP2Age2hvS1xUWDYKUGFtTWYycjRtVUtZRHJxc2Rw
-WStYdCtZU2QzMWFXWTMKLS0tIHZOb0FQNDRGV0hDZmpia1ZhL29YTGswM0ttVWw1
-MlJ0aVk5UERhYWZ2SUkKtd0/FARFzvif8YqUKY+5NfwhS/j6o3KUpa0Z7uSzTq+f
-AO8C1sTF3QenVVInBaTq2kmN9JTucSaAcJmHK9uI6Ti9ytLLzyJC+BLR9puktNWV
-QqlM3QINTG4RCeL4q0LtIzf3akEVgRWGhU1z3YJc0TEVjmXEss1CkYzDOBUTsOPw
-UoHgNQBb+G6DDHjTI8QeO2HEHg+ReWmYprZ/sdSEegbZweu9ARK3I/VNrlvqkVcI
-CkkVN7+8w6x1lbZo914r/U7xHqS10TbF2AH7HJ6h8imHjGlMoWfG5JbU02vSTs8t
-0AQ5SQXH/a4VZA3KhoLazvQFTDiejgO7Rf0jl2yV9gfW629KfAMGgaMk1lg3iSEw
-pCV+wVSFsilbg8ftN0lln7dHUnNfl6Cpnq+fDIxQn2llzTscmO/NyFauRmTwY5KQ
-cmhNo13n4+x5w1pDwNC3quyYu4Im3a+zmqzk/MZR5DHwXP4EPByEqpFawhxPDLn3
-W4Ii6tisKiCFsKahOfVYLKwDsHs/3MKNJG7GHo79bYgx2KhGjKfsEyGVzaQWaCAI
-L0kw3YnhOGDF2SFpqv8=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2nix.age b/flakes/secrets/nix2nix.age
deleted file mode 100644
index d33a421..0000000
--- a/flakes/secrets/nix2nix.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USB4SEVr
-QzNZaUlMZjV4V2RCYVI2VXJ0cnZyeUlJT3BSc0REVE1LTnRqTW13CmdsMkZ1a01a
-MUFEYzBpdUpUblA5OUJpa3gwWXVpQ1FTTTRId1RCeDRxSmMKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIE5NdzFWZkd5bmtGaVJxWDA3R3h4amh4NktKNkowTnFFbXplZkoy
-UlB6eGcKYkZ2eWNtUFNGOWYwSE1SendEOGNETlcxbDRNYUxOczJRejl6TDcxbGpQ
-NAotPiBzc2gtZWQyNTUxOSBTcENqQlEgQ3VPK1QvRndwNmkzbHNxaVFVN0x6REFr
-R3Q5SkNJNVBjcFdjTXRZTzdtUQoyRy8vTExBanl3TnJQWmppb2QweXBpM2FDSDFL
-U1crVTBLcEkxRXVYTnZZCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyB0eStzSG1GZmFr
-WU0rc3NFNWRhbHZVZEQvZGJsR2JLTGoyc3RZWFVXTDJrClhOVTB0OXpQZWJQU3p0
-SVg2OEtvZEYzRVBpWXBkVG9KdU5RMkczYklQcEkKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIDF4Z0l2aUZCMkdGUTZkd2VmWU1DbXpzVDAzRHlWZExycDVaZldVRFZFRzgK
-bHhVcWt5bTdkcHR0RDBvME9Ha1NoL05kOEQzL1hBaUg3SXNmYk9Sc3BHSQotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgNmVycHF5UjVwTEViZHJNdW9xR1hibmxORkxMQm5v
-aFJ6M0ZiZGcra0d3dwpRM1FEWHg3bWJOMEhiZkhka3hiRXFKN1NWUnZVcFVrVWNh
-a3FWekdnNmJVCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBMQzVBWFFsR1c4Q3E2VFE1
-Q1paTURRSGloLzIwRGFhazdZNkdsZWp3UWdvCmVkWGhqb3MxQ0docmRyVHpDTVJI
-TEJ1RzgxUnZBejIrRFc3SlIvUUx6RDAKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIFRu
-bldqUVF2d0dMNkc3UE90N3BEQnd4ZEhvekF5cXNSWlZaQmQxekoxZ3MKNVFLL1kz
-YXRUek9DTDkyNCtyR28yQ2lvRUN1Y3lVTzlSSHRVcFA5OVFZcwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgdTBXSDBwdmxZQTF0VEpiTFpweTNRU0d2b0xqVms3cW1KSHZL
-Yys1MzZuSQpUNnA3RUxvUVdmeVVLR01BcWV5UVVvNENVeTBUbTN5YXI5WnA5Q0Q0
-czUwCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBtYkkzYVhQWHZVQWdGSzBJZGloMGpv
-bEdFR2VDWnI3ell0K2dWOU1ObTJJCkZDY1JWcGtIWkJFelZ3S3RkcjRMbVROMng3
-YnJIaTVhVHNDV1RyL2JNL3MKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIC8yUStOb0lk
-YVlZOG9maUVMeUFpM0puaWkwMFZPQ1gvU3pEdzhTb0FuU0kKVHhnRU5aSGlIZ0RC
-NzRLQzFKOHUrQkY4TjBBbUh5RWJDTEtLaVRENFVkawotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgMVN1aDNmMGl4dmZvdEF0R2Q4bExDM2ZKb1Y3aWlCN3pLY3ZuQnVrOGFV
-awpZZHZIU1pnVGgyNE5pbUV4N3RrcXpMRmRETFpmb2JwNXBuZzRiS1hlY05VCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBwRjZqZFEwbFFWTVlMMmIzOC9SNEU0cG1Ma2J2
-TzJhamlnbGtCNGVaSnpJCkY3Q1lYdlB6L2YzRThxdlVHU3oxcGNsMGpHR1RqeFBn
-UTB3V1Z6MVYwaFEKLT4gc3NoLWVkMjU1MTkga0hrMmdBIElqV3NvL0tsOThTNFR5
-R3pUNVFZSjEwN2M5YzQxS1oxWkt3VHBGZzExMWsKNHNndjBWSlpSZGhUYVkzcDNw
-d1MycGpGTE9vSExwUGc2bE9OZnkwK0ZTawotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-bFJrdTRJeWhVeWNEOEdkaGt4ZE0xellZa2Y4RXJjdGNzZDhYSTJWSmVpRQpxSXZp
-YUhkK0d5blNaVm5EUHI0R3YyZmNhdGU2bHZIVGxUdGJOd2t5UTY4Ci0+IEw7P3s1
-WS1ncmVhc2UgfEIxIDRuCmdjSzhEMnRkcmllRC9VU2pvR0l4aVBVcmV1bjhzVjlB
-QmRpMWs1dkx6UDNtSHU4RWJoSzA4QQotLS0gSHh2VlNRVUx5cG91MnN6a0Q2SVFB
-MjBlQTRoc05CODVkejFScGhrTTRXQQqmfTCUj1DtPvDxT87gQNUVN35wBsjFR5Vy
-NfhaQBWhfGUPs5xtcCuycbxP7A1bj7s+M1HEz8M5ebxcR4CdDDS9BZEGG20pGyqt
-kNOuMziGWJ6brg90w2gyywSg+KisnhEig4skrUlu5nA7sSe/iJPJUhZrg228gXqN
-RThkR3FmJ2MN6nTWWHjv04LmLQ651JfUdjQaPPWoLuySTvkgegRRbJZpFyfzrE+X
-XjMHD8CIAsjohNGUG/W/lLTAtYpZ2lo7Gm36Y635yzeIp8sOXYM9fGLdcr4PtlZC
-E2HajM3GbtXc/geFQpbynCRGQlt6Hrd8uFu6Y4h2XpEolr/KeJ5gSw7P8EGeByE7
-tDHxfTlHsaxLnpPYpziEZyPleacRrX/VG8flrMvAbD5eDEz5cq8PUNzyOidyYTrL
-BE1DveBSlb1JLA7cIlJnZjl2869Omydw8L9bYQekGFxy+Nyw2Pwqo1hgfBH9rvDa
-ANsZvyyvciJF2EMg9TpJj5DIGGSVQRY43nBAOKumGxRpWeVEVBebQhhEydW8NwaQ
-jQxbFSbEDi4Wis+7PcO1Mh4SuWB5Nw==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2oracle.age b/flakes/secrets/nix2oracle.age
deleted file mode 100644
index 890256a..0000000
--- a/flakes/secrets/nix2oracle.age
+++ /dev/null
@@ -1,48 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBiOU53
-VkpncXdFRVY4WHF3T0k2RGtjZ1RVdi9wRjdJS1R0TVJYaDZkNWhNCkRXOCtFaVl4
-blk3aHN5dm5Gam96bXpUM1VzblpqdmQxUCtGY2NiaTRJUVUKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIGlDMWt0VThWQVRjOTlQVkdGUGEwOEIwa0tySnY5ZEdXMHNCblFk
-QmVCRFEKOCt2aWYxRzFTQklXMVVlM3pXSzc5Y3p0TzRRLzZlSXpBTDNmZWNJYlV3
-awotPiBzc2gtZWQyNTUxOSBTcENqQlEgMWVVUTA2cFpackdPL2g3VlFtUFpBQ2hR
-OUZoaUxrN2JYbjB6a2UvdVBHawp1ZGQ2K2Y5V3R4Yk1EZmV1MmZ6a0pOSGpsQk93
-bDhVb1Y1ZW9qRUZYWHBvCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyA4VUJhVThkV1R0
-TzluZjVab0U0b2d1a2NIdFhBV3d0Q1hTZnJRMFJ4cEFFCmZ2clM5NzJ6VmYrcUl2
-MlQwbHMwZGUrY1RCdEpHRTdKMURHZGNrYVVCWGMKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIDZwOE45b3hFQ0JsMDUxNmxIZTg0S3NndUFUanFoSmJoM2pGbzZPd2R0aE0K
-cE4rRTBpZWp4SEFScndSSUNVM1FUbTZNNXNJNmJnL1B0UTJGaGFSWHpVawotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgV3M0MDN0Umw4YUxkU05zbGlwdkRxaXY1QzJ6MWJV
-NXZEUSs4Umhab2tqYwo3RGh1bnRKYmJ0ZVdRMnhzNzVlU2V5Q0pBTnFxK09XeTUw
-WXhnWHRUcVRvCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBFWWk2VGsyNnBKeVpRYlJG
-dFZBaCt2bllwUkZQYW5GcFMwOUZidlYwQUNvCjMrWG4zWmJsaTByMHh4SWY3K3dY
-RmpRMjlKRzFtQ0lvN3BjRFNZYVRhdFkKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIFdR
-R2p4Y1h3bVU1MCtoajJNMU1IdzZkZmgxRUdlS2dXN3I1R1EvUTZoUkkKQUZyU1dy
-c1BJY04vZ1dZRnYrTGVWMXVLSjNYeVFHNWV2M1BNYjMybUY5bwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgTkVwRzFlM1kyeEdjbjZnNEpUZEVaZlJXb0tER3RydzdZZnJZ
-cVNJR0FsYwp4VGM0UHVPU1I4U0pNdVorbUQvOGlaQmZhWGdvVUl5bjFPZEFhdEZq
-RXZRCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBIa3hlck9iUzc2d0tLditvZnhnQm8x
-cVJ4LzgxN3VKMmJOL3c5VGRzZ3drCk1jSUVQYzVra1hqaFJzMnlIK2V6dmlRdDBP
-YTBJNXk5ZjlZK2hNdWR6cncKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIGxzd1NOZWRQ
-UktyUVRJSk1VL1ZjeXBWOGI0RU5hbFJJZ3lxd0NtSjdOa1UKMFJPWG1rd2FacHpW
-QlhKQkVnNWZQT3RwSmV2djlHYVhBTmZsa244MzdpSQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgOEV5VWpZUXY3QmUvU3Uvd2pqS1NjdjBuWFBrNVlja3Vtb1NYV09EaFNX
-cwpzYTFkMFhzNHpOazV0alVkZ1FsQ3ppSlRENE1GeXhmVk51NzhEU0lXOWJrCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSA4K1hVaS9rckRJcERBR3doZ0RHZkdVRjRsTTVh
-RC85MnRSbSt4MXp5ZTFFCk8wY3R1b1gzbC80VVJRRXdNUVBlNGZUcVdPVnRsVmk2
-ODNPVEJmLzdlelkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDlvNFVGOUE2cTY5MTlR
-Y3N2bGJMaUxTQUlwYk5lbU1UdnhUM2VqbXNVeVkKakJDbk81WG1IYW5ORUNrK29U
-RHBlNmdNcHl2ZSt6bXFISWNlWWZGYWpoUQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-ZTd0MWE1NmhSOFV5bldydkppWFNqVTRJM3FQcWU2NzR4aXNQV0Z0TTMwRQpVWXNL
-U1RPcnR6RnlDS21nVHZXaE9keHFSaTQyUTk3OXBPRm80dXFZcFZnCi0+IDwtZ3Jl
-YXNlCnd5S1ZvZm9HdmpHRzQzY1hFaVlRdmpJQkRUYTNQeXBPdDdCbU9QNDNpNmk3
-Ci0tLSBJY3dhNytkc3UycTkyMWN4NTlpU2Q3NFFxdDIwRWM2anlvc3FXL2RmeUxV
-CmlAmx/dLC+A/daemLDnC57D8hHjyheyu3DOnMJa328syqRDawzpjYOgmpUdTRIR
-3vnvrvgsGsjOmyffHi/3Dihgx0QqXNzuIIcPLn1ZQkt6drVzMPw9dR+6+mUcsXpZ
-92XNjo93nSbrRgWxoLNzyrYD1ZYVscVCcXI8weFUCzyYFvr7Skzi+rp0x04TCyH8
-MOfcXXFcfQjdEqO0oKzv5vVOKGAufOZLqLztkANia+bq7xvTRdBYKL2MBDRUsBW/
-XjNpvlshDULqSPjmoIU06c4aGrMY9XYDySmRXtragRcD2EH3RAT/plAk7kddrW09
-eWOdTrCbAWfISk/dgtNu0qOBSG03EpwgXGumWGkjmvLJGZpqAeK0Y5cN7rkGx2Xy
-6zX98dekHZnranfohKtRIWoxFtAggy0sxytpV2b3lFAstk/T4ECC9mBPaEc5c4DR
-B7gpcdDJgdDVi6pFqByjzXrv2l35LJUrCK81f/emnhWpH9qZi73xyvfaBP02Hxd4
-O7WGyHELWwi4bagprUaw7IhPIRmh6tJo0IyiI2Z+knbtdJ/K12BnMTnQPBEsVPEl
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2oren.age b/flakes/secrets/nix2oren.age
deleted file mode 100644
index 306b311..0000000
--- a/flakes/secrets/nix2oren.age
+++ /dev/null
@@ -1,49 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USA2L3lP
-ZVJYT3BleS9TaFg3L0M3NDNUaWQzMlExQ3NBTVd4SFdROEVldWdFCmplazZVZDVK
-KzVWNTRCYmlyOVFZYm5tQjl2WFBLUzVHQUNUdWR5cUk1NkkKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIEJyRTk1U2lsckw2TVVUNDE4Q2FyV0FJQW1Dc3RKemFzcHUxNHlx
-RVpEZ00KeUNUejY0ditYTXFiSE01LzFNSlIyb1hxZnRkN0ExNFIvVFFmMENYcFdy
-awotPiBzc2gtZWQyNTUxOSBTcENqQlEgeVpjdGs3ZWtreG1oNXlBcnR0cXJOTm50
-cXdEQlZzWHltaVFiNEQ1MnNUUQpkYnVIMXlZZEJXQkc4U3pzK3hoWmNtMG1WSy9P
-NHI3NjBtMGZqL1pmaHhnCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBYVndMeU8wSVVl
-SUU5Y3lKT2FMOFZnSE5yaFJFenU2TVhHaElncVhIMkEwClUzcnl1akdRdTBGQndo
-U3E4aGdnSkdFNDhMZUEvbEp4WXU0M2l2NlgvODQKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIEhvb085cW9ET1lFc2lmK053NzMvdkdhOEFYYkc3K0Jlc3NCNU9ENWxrVnMK
-SnlUNVdOVFlFeW1PNCtnMFd5RkJ4cFF5aWs4WWxTbDFLZy9oMlVadVpZcwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgRlgyYXZPcC9IanFoRWcvNzJ0bzdYR3ZrMktqWExn
-MVd1Yjh3NllKcFlDWQpPVHhpLzZKTmRqUUd3VVJIZ0w1dStaeXVpMU4yb2R4cmlm
-cSs0c1NuZ01nCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBLQWgvYzZaQ3MvUE5xbUhV
-b2FuUmZKV0YzYUNRQnAybGF3Zy95cGU1cldrCnBGK2FGTktiNUtWSzRGKytFMjFZ
-aiszWFAwSUU4c09rVjFCRHN2STJMcUEKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIDBB
-cnJubHVoL3JrbWNmWU5LU2JFUFEzd3k1cmlEWTl4ZTFRUTNBMC9nelUKNjdwcjVT
-SVZ1cmlqczRGV0YzTk1NWGRkZzhwckcrVjVpU1JXY0dXMkpwYwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgclhkVURVSW9rMkdvT3dsS0crb2l3d3lMOTk0TVdIdHJFNUx1
-U3NWT1JWcwptcExpM2l2dllLRU8xYVFXVUNDcGlDcWdYM1FKNFNueUxsSU9IUUxv
-cmhrCi0+IHNzaC1lZDI1NTE5IHBlRkJRZyBOT3VaRjRzZlNYK3g0Zm94QStsempu
-blgyc1dKaC96OCtIMndCVkMxeVJJCks4Tm5wdHZaNnBhcFZGWmJhK24vR0FheHNC
-MmRKRmY0aUQ2Sk0ydk9ET0kKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIEoxSTU4b2or
-RmZPcGZEN2Z3Z1ZoL1A1aG5STm5BMU1EQ0VKcXBmMXExQWsKWWZqYWJzdzZkcTN5
-eFRXUmNYd0prUkVBMGNZNnBEWU8veTV6VHVvNHZsUQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgOXgreDZsczFKYWVsU2xOdjJnVTBudEFWR2Zua2d0VHdUVTJXWTJIbVIw
-dwpwVjFtZ3R6enpqRHdxUDdyZmEzcWFXaGJ1OW9mM1ZEWEoyK3JLU3VyeDlvCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSA4RlVtMk9UNkk0bVNUWUJqcWpqMzNIWTVaWlQx
-ZStNYTdvTDZGYWcxY2hrCmtyNzQ3Tk5RWEZnQytLamY1ajNYZGFLbVpUT1BLRWNa
-WWJiczZZVmk3WmsKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEJrenNQUk8xVmVtaUdH
-V0dYRWVBVnpmV3Rzb0RXRzdnYXNpSjZrSUxia2cKek9qYngrVERNbmZYaWxwSmtr
-WU5ia2VxT0lWQzJsN0pVbmMvb1oxbW1iRQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-ak5RbXNJT0NmbUtBMUJ0Ny9GdkxTeDZBSlU1MFlpZXVvcDRXWE1IaFQydwpKem5p
-MFM0MzlCbnpzNVFzWHEzaG9lREY2b28wSzdjYi9QdzRORG4vL0pRCi0+IGJsJ1M2
-LWdyZWFzZSB0PFIgQXkkCk8wTWNLQ2hqaDdqQUFBcnNqM0lnRVVONHhENUJDTnc4
-YU0zTllvNy9BajJvYWFoUHpUYm9jSkROejJPVgotLS0gWS9nWXlkQUxRdEkzRW8y
-YlhyRVRkUXFXZ0VvMUp4SEo0VmZ3L2lFSnNGUQqC3TSxDZk0FxFNawjLIkX2ynti
-t8FUVqwpVQjcxdqFk5nhN8xL2LVWNUrQE2IzNIgimutxtlcPgdFdpel4HJvtgU53
-WIGZVcR3ju8foEijB7BYTccqqvEp04tMrzpdvGNxUFJu6GsZlwp+anJg5webo4YT
-46OEn9EQl8G6uQErupUVdf22UQsjgEj1Xmg6/Te0Wx4xyL1NFa0vy6k4RwbIraJ+
-aYMQrVzadzBLdVAtGaz8TSGrasTBonl/ksvX5gIAFLivBeJPxNJtyL6KiQz7b3UP
-rn9IGekzg4ieSm6cNR3S0GB6UkShOdEToumnwAUAadTxkCjV4EwBCkm8oLtaxtfP
-OYfvEnTPoqHq6u6Cy+stfqzDHbTbAYN49Vdm4Zzi4q0IzQSrlVhZaKXcgv3UIoS3
-lBetox6iz9MBeSPtIaOSQHz+mcqI7D/GwtUXYcdBFFJGtYbUrPLN0uqg7KbsIYsV
-/AWtxJLck+ui9WuOHS2JETv0CaQt4NAM6rezF4XjLsD8ZlJF8Vy1PBrzF3IsIWO0
-ppe+SqTglegG25lF2QbtdR/fXUlaPTlGPu+uSw==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/nix2t.age b/flakes/secrets/nix2t.age
deleted file mode 100644
index 7603de2..0000000
--- a/flakes/secrets/nix2t.age
+++ /dev/null
@@ -1,48 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBsWkVn
-MVpUK2xVdVNRR0RMQ3RyZ0ttRklra0V1UEdqQWVrYTFSeGF0ZkRZCkhLUGp5VHJL
-ZFVKQW5IU3hFNDJ3RnRBU0FKMGtFK2xlb21UR0YxZ3d2MEEKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIHpER1pKYlNLd3cxTkdxaFVBdFNuLzE4WWFNMXhibVd6dG52Z0px
-THpVR1UKdXV6a0tDQU43elRFcjQvZlNmT0xRUS9PYjIwbEdNZ0I4ZmVVMXlNNVNu
-cwotPiBzc2gtZWQyNTUxOSBTcENqQlEgNFRxTjRYTDY4eWdDUmVFeHpaM3psb1BU
-V29xSk9QL0dBZTRxbm9oVStpSQpFMjlWVVI4c29Od1JnZ3JOVUNKNVo3V2hMa2tV
-c0pOVDQ5dW82YUI5Ny93Ci0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBjZDRReWZwdmI4
-blVIQXBJY2g5bWlxenJrUkxZeXYzQ3ZydnVuUWZmd20wCnBqeUhrSmxZSGNVdHJB
-K29EM1JBVDJHME9EVWNIMVZGQ1NHRnpaVW0xMmMKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIGZDZFZiWXBPTm9CbXU2VzduWi83UmI2dE9sbStuL3RPRkRJM0x0V3dEbm8K
-di9GNnFSMEV0L1NsK1NyUHgxczEwNzQyMmFoZmZ0aElxdlpHeTk1NDhmMAotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgNjFDUzBoSVgwRFhWeEdzd3hWTHBHd0IzS2xqbHpM
-VXdTYnFKcER4RTRUOApuK0taWHRRRWRIVDcrSTBCUkNXVFFvSVk2Zk5ndmI2cWph
-Unc2MmxOc2dzCi0+IHNzaC1lZDI1NTE5IFh6Zm1hUSAwaE16WkIvRVRVTzgrNlNj
-S1dPckdoa0RZd0ZNUkFSYjhvZE5uZVZUTmxBCmtVbkhudEh4RVlCOHlsZnllenhj
-VGZ5d0RjaDRlL2NWNTlnbnlvRW1BSk0KLT4gc3NoLWVkMjU1MTkgNWFkcU1nIHVN
-RE8zQy9xWkU1SWc1ODJadVpOOENNWjlITVFsOXU4aUh3THRNZjVJVmcKMG1seE0r
-QTRCMTV2SDRjOGZCS2hGVmRWQ1BFVjNYTU1NOUVEWmFBTExNcwotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgZW1ULzliTFFaTFhBN3diQjRNbVdvQ2g1MUlXL08rN3p4T3gz
-U1puNUswcwpkTE1DdXBKM09Qd2pzTThUcDJVZVplZkhSVThnUWVuYmNuRnQ4bW5X
-eW04Ci0+IHNzaC1lZDI1NTE5IHBlRkJRZyB0Vm5uR2pPcFppS3paZnFvT1hGTXMy
-YWVyT2pSMkFoUEpxNUdPcjBQT0dRClFMQ2tDMTNMUzNCNGxnOThHdnd3bnZwT2Rt
-OUl5UWgvZHlXSEZWckphTUUKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIHFFN1Y2WTNh
-TEVGcnp3UGxqeEFRZFd5ZjgwNm5DajZEUllTNVBBczlXVG8KeUR1TDVtdkhYb3F1
-U1BGdEcvTFNwYmlnY2N2N1BNMnJrb1g2Vzl5NkE3SQotPiBzc2gtZWQyNTUxOSBS
-NSt4ZncgRnR0T2ZONHZpT21aTk9HcDVVZjFaRU55U1Y4cXZrcFc3NGZsRU5CNVBX
-NAphQm5tMXlJWkttVjZ1NnFDdk5VUGV3U094YW4zVWwyY1B1cnovWUsybExFCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSA0NDFqQmp0bWxnZGxsbHg2QkZ6WWluOHg4Vkxx
-eUxMOVl3OTg0YUh4SGpjCmc1KzMwT2pkd1Voazc1c3BkL0FwbUZpaEw5NmRWNFQx
-aVRvc0FHN04xUVkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIC8vQTdOeG9NbDdzd3cv
-aURMSGRFb0dISG1OZjhxRlZNYncrU1ZIaGtKRGMKTUFwOWhnSkdOLzRiNG1vSU11
-WkgzTjEzMEpBZ09GOGgzNmVhQkNidThBRQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-WHVLNTN2aDltNVFBNU1KeXJreW1ObkFGeTJvMWY0UnBSRVQyMGRTT0VScwpJaDYr
-ciszMlBlSVE4bHJaQlYrTEdDekhBOHI3dGdYRjA3aGhvNGFkMmtjCi0+IFNBLWdy
-ZWFzZSBYMEslZTlHLyBefSggSlZzRQpWc21pazBLeEFFck5YcFQ5OUtKY1JERXlM
-UQotLS0gUXE3SDZyc2lhS3JPZjQyNVhxeWo0MlNJN2cwWDkvNE80ZmZZRWR3cWZC
-UQqUxvDGAbWKg3TlA+H1xzAnCXSn1ZcMH8n1FaUaQouO+rzFOs6PNI5pB0x5wPfK
-G8b4YiciGPa1hVINjvToli0wuFY8Wykem4vKq2M98OtkhtQAtcD+hqJnGwNuU8zz
-BIpz1ESYB7UsQ7pdHDOn67WoDbp3UmU2KDA9nWD+qa14tcZrSUzZYcmh5kG/3MlP
-NVAMER6CK98etGh4RhZcafpVg4AbCcYmWt3yqV0tG32BhnQOt5tPk1qF4Q2K9zGQ
-mzZTRU14CPOaQu4WSvElqkvPMi/CNLQu80URUCcRS9M9qV2cc4iMLpCMRYV4M34i
-YMh+8L26cn1DgrToLqlWdwHkhqj7mT7nxMOvvFI+Ou2JEgDDD+t1r9mAS1Mf1fnT
-0V4YGNYfW7iIrDRrbyhljcthfNvv6Q+TT6UFg6x1s/7M6qFf6ea9n1eVNCPSDNsd
-ZOlEZGF4IW8N87ND9w+s69waQ6jwFDPKKYs4QsI6wVlPgHyKzcnXNaSbmC9KgJbs
-46IPE/aJ8tC4UxUMjj7IFcnZI63HJupier3MFHQod7hZnnydjA==
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/oauth2_proxy_key_file.age b/flakes/secrets/oauth2_proxy_key_file.age
deleted file mode 100644
index ab347a6..0000000
--- a/flakes/secrets/oauth2_proxy_key_file.age
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBONkRD
-TnhUUEVtOTErYWY1K21WcDNNMmxmQ282TWU1UVAwN2ZmNXkyQ3dFCm9GclR4ZUxU
-YVRVNm1EU0RIOFA5MEpnYWI5SXNWZVY5ZkVCNlVpU3RnZkkKLT4gc3NoLWVkMjU1
-MTkgcGVGQlFnIENEZmNMZ1BySmdGYUlORVNXM0hieG50OStLaWd5bVdPalZMQUkv
-RGlISFkKbTBHdmlMTXNFTnYvaUVxc0UyWitOQ0loOUhodmhvcnJyK1BXYnlsTXJI
-SQotPiBzc2gtZWQyNTUxOSA5di8ySEEgNzA5a3U5Z1JOdlA0MmdXVEZjbkQzZStV
-SHE3ekNyaGV3dWdiTysyL2ZoSQo0bTk3K25ENXdkb1ZtV0VPcWN2emp0djREYzla
-RnJCWmpVNE9QQVdkTnBNCi0+ICNrQDhyRy1ncmVhc2UKa0NIWGMzYXVPalhnQmxi
-YUVVVE9pSHBmelB2ZnQrUEVkYkdwNjRKK0RQWmhFdnVuYXZNcQotLS0ga0xGWnYv
-dFF5U2QvTzJYUEZza0ZxVkpBSXJkZVdGZ3FXWmEzZ2NZM2FQNAqwaYU23o0gnZ9l
-NsQIgThKkGuymcRllTg6JlPIN04FuNL+ksnAzdNUzxsa8NzquFqToJDdqYH1BEyz
-coiFZoZwgDESiZaQhy1RJso1OnWzGuKzgvhyVp18nUE+eGbKePiLR5WjLCcGyN7+
-GvqQYRrLxYg2QPSRybbvQJ2lJKM/6hR0aQP2wbFIhk55CRWSEDU/K7vLjViJGzl5
-N74HJOCrKq2rYklP+3/polXS9mw2qxoYRlfE2cKCO+hvyUNaKmLHIMEqV7uS62qG
-ZQQtPtRyEvbrnstUYmTBy6RoOmDB3Y3m
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/openwebui_env.age b/flakes/secrets/openwebui_env.age
deleted file mode 100644
index 340dab2..0000000
--- a/flakes/secrets/openwebui_env.age
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBWaVZl
-RitmbnZlVGdnZDREb1FEVXdXU3poK1NuVU92ZzdNMUpVcEl2dldJCkZ2akdodlR2
-aVJPVjlzUWVFMHg2VHpPRnVTa2FrTDVtZzQybU9qRHpmeWsKLT4gc3NoLWVkMjU1
-MTkgcGVGQlFnIFBieHZ3ZER0dnF4TndWejRnU3JuTHBjdUlsbDhvN0NtQ0JZV0Jl
-a3NHUVUKL0VKRzY0ZlFmUEtjU09kNmRabmwvR2RsL1dqTndnNHA4cnlnS295S09N
-ZwotPiBzc2gtZWQyNTUxOSA5di8ySEEgOU5mOG5OQ3pTT2hHOTNVVzhjb2FLb3Nl
-YUkvQkQ3cWFpdU8zTnQ4ZDRncwo0WEgrWVI1M3hDQkpvcGJ5WmZHK2w5WEpCQi8x
-b1VMck5wc2NyT1psWm9RCi0+IDBMUz5VY30tZ3JlYXNlIDdycV9vClhCWWdCUUVq
-M2IwcU1VZ3lJNjM0SzIyZGsxY1UxYnVDdm5iWUthcFpHMVZNMmswUzIvQXdMZwot
-LS0gZGZGMUlBdThteE4vTHZ5RjEwb25uTzJQUVR3MktFNkpYSkFBenZBNjF4RQo5
-h1jVKLROqNgSd5oymtebTvMqJUNy/4vde77BGfTbKEzwlam6yVObxPISCvItHwon
-D7BoKrwvKYNqk3UK6HV8R7ya+pbz3Im3ovhegP0CsWZDX5lRDoWtXmBT/jWDUJjz
-aG7CmM8H3rmT8ZPyJ2ayppCUcHWFAb+IAcm777w/XcAWM3HnsLcCjrpw+rTjrRBu
-wX8Z8rOwlr1r8cg=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/us_chi_wg.age b/flakes/secrets/us_chi_wg.age
deleted file mode 100644
index f47aa66..0000000
--- a/flakes/secrets/us_chi_wg.age
+++ /dev/null
@@ -1,47 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAvWUU5
-dzFCcXkyYmRHTmovWlZITlQrUVFhOUxYZkNLZGFpSms1bVRsK3o0CmhuaXh0YTdB
-SEtvRXV5WllBNHNJeERmbU4zdVNSNk5lQ0s0bTRJaWxRazgKLT4gc3NoLWVkMjU1
-MTkgSmh2TCtRIDJhVXc3QitqYTFLbTZjaWFXRXlPek1CeHlncm1nR083b1ZyREVu
-czl6eFkKc2xVOC9YS3p3bGhkMXF0QklWVnpBWENHY0IzQjFYMGYwV0hhK29ieTQx
-WQotPiBzc2gtZWQyNTUxOSBTcENqQlEgY0c3T082eWJDKy9iejJzMGRSUldFeG1y
-cytMTlF1cElTbjZtRWFhZ1oxawpUdkRoZG95WXJnaWJkcGM4eDRNSmtvQ0tLQnFx
-dzZEbjRDRnEvcFNLQ1NvCi0+IHNzaC1lZDI1NTE5IEY0YmI4ZyBnRW12bjY0Kzlk
-UXBlUFRPV1duN1YvYmczeXRHK1NOZmVJcWErZ0Y3bjFFClFkSVBQMFI3dHI1bnVZ
-bEdKbEhKeVNDT3R1dW1LV1VBVy9NRXJZRmtINVUKLT4gc3NoLWVkMjU1MTkgd2Ry
-WkpBIFIxMUZ4TGpkMlRWQnZoWERjN1VncXlrUk14MnA4MkRKS0NsakQ3a252Q1EK
-SmNQQ1dBTXFwNlp5dXVuOXpMWmFvdmNKck1GQUZRSkNSV0p3bzEvY0VzZwotPiBz
-c2gtZWQyNTUxOSBCWUtHK3cgbXZ2RjgxUm1Hei8weTZtRDl2R0FQNWhNODNlZVRB
-N0pVcHJhcm9BL0JTOApEdXhsL1lKVVpFem5mUnlYdm5YMEhsM0JkblVOWTV0MzhG
-Vi9yU1lCS280Ci0+IHNzaC1lZDI1NTE5IFh6Zm1hUSBLN0hDMWRWd2IyWkc1UTBG
-cnBMNllwSHVwbUVUWEd4MFBRVFVnNnNYNndVCmpVQVozVVpibStJMjVHRnFKdXlu
-UzIrOTFyZWpNSmllN09nTEVCTmRxT1kKLT4gc3NoLWVkMjU1MTkgNWFkcU1nIDFq
-Y1JXZzZCTHN6RmQ1ZWJ4dzJkS3lJSE5IZEdxcjRDT3hlQlRYQ3lkUmsKUVFHTUFl
-OVZJeHR6RVZGenQxL3dtK2JRNmFqK1I1OHowam5WSjcxd2UzOAotPiBzc2gtZWQy
-NTUxOSBaZTFNd1EgckhrUUFJZW1CYlpUTHJhZ1ZEVFFmaFUzekczLzcxb1VRMVlL
-Y2k3MGtHYwp1NStnMWZkWkhVSW1HK2gydkJUbmJBbERNcTJCN1ovRlozb0R4aWp6
-OWk4Ci0+IHNzaC1lZDI1NTE5IHBlRkJRZyBoVlkzazFtcTNHQnh0bEhjS2VLUTJm
-RGVBTVdlZHNoaWZaRVR0UlF4dGh3CkhvNVkvNER0VFBlRHlaUVk3aWRxSXRaWXdJ
-ZVp6aHovNmhDcWpJejM5VlEKLT4gc3NoLWVkMjU1MTkgOXYvMkhBIHlIblRPNHUv
-M2o5YUZ0UlV0WHNCYzE0d2RrMGg3QXpuUTI3L1kzRnJSemMKY3lQSElyODlxcVYy
-aHFsZXFza09PYUkwd2Q3RUk1a3ArU3dIelQvTnZoSQotPiBzc2gtZWQyNTUxOSBS
-NSt4Zncgc2J0bDMxZUpJbjdwNi9xaXBNRzFndm9tUnk3Rm9McFBXTUpXL2QxZHRH
-cwpmTm5OTHhiTWZob0MzY2FYdlpGMGF1Sk1IbWhVZ0dPSVdnaTlQRmdFNXJnCi0+
-IHNzaC1lZDI1NTE5IFJvWDVQUSBDbSttZVRUMFpkemszRkszcmZYQzFaYXV5TU44
-Z1hZaDh0RE1VenoxTG1nCjQyNDVXbEZmYXNkc3FWc05kSTM2UkkzdkxNaDFsSW9F
-OFNSeEdpWVIwek0KLT4gc3NoLWVkMjU1MTkga0hrMmdBIHZjSElrZStsV2R1cThu
-d1VFczBqVjFEc05IVzQ1OTJQMDQzRG1Ga2ZNUUEKcU55Z1ZZdWF5SVhxOW81dEg5
-L0dRd2p2OGcwSkg3NE9iekp6TmRZdk9IdwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
-NS8wT01yb3ZGN3Y5b2tkWkVkakJHbzBPSEhnYjVrSkt0UHkvamFpWnRqVQpBbUN1
-VDBHUHgxOFRXYnNnbDVVc2IvWG8wajRjN3VvWDlQd3MwOFlEVnFrCi0+IHdUPTpq
-JG1ALWdyZWFzZQp5MFVmajJGUXdBUGZqaTJib0VuSHIva09Zb0c1SFAxTy92OUF6
-QWozOHNNcHp0VDU5VG5oQ3FlVThNU0Vkb3RUCjM0K0ZGZkwvVFdUcDJKbWZOMldr
-NkxrblFBNm9tZGMKLS0tICt0T2lzYXNaNEZORm9TSTE0TVA3aGdTMFovaEtUc1J0
-SDhRZlJwV1pQRXMKV2bS7cB6HM35qbECEn/F0+wxGXxEYwX/Fr1Fe+sZYhhtReWW
-PUgUGPw7AG9QkTmQOKqhgm7ka4SBCPfGG4x+cH6T6w/Wc6jrX25BQM/vhOb3yzd7
-OYu8yJNOeEJIFuWd3e5axNGzip9FafVo4o3/h2Md2E9V0jEyq7jGKrdBmaqfl48q
-sRuNC6eMIn6WGPjqrDaFOGNZ74diHq82U/AgEJha5OjBxALEGoLS6Q289oV48Ewn
-fHC5GavXyYHQNL0tXMjRaPhOrXyorhzW9h06rOMj4YqHgp16d71nXSG2xjBPs/ru
-E8xQ99Z03+IiKoOX4ISjvGM+8NOOIjem+NK15kW8a9pDPWLC0cciE0QEbrQUJIuM
-hUzfhKdJssySLTfWLl4dEZU6KSIO3BaMFi909oIkDEwMJjCih4RgEqg9nEFumNtG
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/vaultwarden_env.age b/flakes/secrets/vaultwarden_env.age
deleted file mode 100644
index b006574..0000000
--- a/flakes/secrets/vaultwarden_env.age
+++ /dev/null
@@ -1,19 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBtaW1Y
-Sk5EQTV6RURnY1hIZDMxQi9IYlJWV2dMaGtmM1I2UlhJVUlaYlRrClN1UlB4VU5C
-Y0lQdWgxMTU0MCtBT1VQWU5mU1Y3NW1RVWY5N0FBRzR4VEkKLT4gc3NoLWVkMjU1
-MTkgc2EwSmpnIFdwSXFldDcyYjhJaGZ4Y254N1JGNVVNazZWbHhsMzl1Z3VWMlhR
-WUl1VGMKV2wyQksyWm5LYzl3VjJ3LzUvUFlVNjBMeUIyMWh3Y3pLTDNRZkFqbHBi
-TQotPiAxcy1ncmVhc2UgJTM7RikgaQpCdzArMk1USE1QVEVDU2NlR2l2QStGMGpm
-bW5RTEFCYm51bmllRW9Qbjg0RE1YZmhDZmVHMnZ6bDdWcwotLS0galRoSHdSQjl6
-cTMxWEZ6T0RlRFNLTk92ZUV2cDF4SU9IZVFaTTR1a1djMAo4BLZc4VUKjgHeODeh
-BVtoh5uIpIHyZ+n53vdHbt+rFeuirUi3Oc+l6saTXquBy1UYn5SBmbwIb+V67QLR
-5A6f4YmW2P2iWWyagamRb7y3rluZ0rKZSS+gaYvoBh/QfMuA5JI636BqiKQ/gjmY
-M1qlc/gNtLhQEqeOIVBuIFe438hubrmbBTmu3cW9q3hW3i2an4+PoB/GNdjnE8ET
-8qhvAmAS6iLC9eMqiakOWIYzFhZFmXeLR9aHkpIg9isjR+yMLdXu4v+4YlbHJixS
-7fSKYAfwxD+ShWSXWS92WObxQuhlttaKRJm2bh1U2pEajduVjeLn2iomGmk7S6dx
-rDSv6DlNsd+KlSvtQKxxm5wLSsqx6nWyvYAVvXV+zUI1Sp8149LWxLpkffl8kxp4
-jpCfHeag8cy2GXYNbo//0FOPyU/QHXPUkeeK2eY6w9viRQ/bvb0MiFhQc6yQG75G
-nyJLcGXKGFO3niXOIjzTSZr9NDE3iS628Z5jfZT2GbXrhStb97TBwoyNq08yMjoI
-sqSAI0TisGZhC5iEyZw=
------END AGE ENCRYPTED FILE-----
diff --git a/flakes/secrets/zitadel_master_key.age b/flakes/secrets/zitadel_master_key.age
deleted file mode 100644
index 4fd0017..0000000
--- a/flakes/secrets/zitadel_master_key.age
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBkM0pp
-ZGsxLzBveU9UNHpPOS9JbWdGRFNSbkorMy82MHZDVHdHQnFuRXlFClZTZGFxSXBv
-aFVaKzBRQ3QrM0h0QWFLcHZNNzhTMnJYWkxOaG9XSU5QNkEKLT4gc3NoLWVkMjU1
-MTkgcGVGQlFnIGQ2djE4UXlCSzZJOTBBaVpwS0VZRllWYXJTdXE1MkhtQVVLRmJO
-eG1XQUUKQkxCK3JuQUJwZHVPeDJub1VqQ3I2N3NJVFBVQXRSMWt5UlpweUpCQzIy
-MAotPiBzc2gtZWQyNTUxOSA5di8ySEEgTHRZMEJpbmNYNlRhOE42N1hZWXovdmRn
-Y0ZkVlgzTEowdWVGbzlVNldDVQpPRWthZXh0SHc4ZU9kSG1DWDdPN3BhZEV3c2ps
-SEYrRzdkOGlTdDJZL0h3Ci0+IE8mTFpQLWdyZWFzZSBkQypmO0wgdWVSKCBSIHRD
-Ck1GZkVQUm85Mjk2UlpsRStBaTgybkt4WXdOTnI4blJqZG9HVHRnVmJucnYydEhk
-WEZmNGw3cWxUV0dOdHhZNXAKY0lWRC9OdW4wUDRwemFyY0F4Z1FNRGE4a1BQTk5x
-cmhaZDcxCi0tLSA4NDExUkE1NnM4Y0FXcmZoc0Y5TjI4T3ZNZ05sMkNYcFNlakph
-dnUyTXRnCmzGFsjKzABU1xUTfpPV0zJNfcN4qdunw0n5tAB5AAm4ebyD4IMBQxZx
-JqV8JQPlOP0qzDgiP7NAmtxU7hREIow=
------END AGE ENCRYPTED FILE-----
diff --git a/hosts/h001/configuration.nix b/hosts/h001/configuration.nix
new file mode 100644
index 0000000..96ce2ae
--- /dev/null
+++ b/hosts/h001/configuration.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  system.stateVersion = "24.11"; # Did you read the comment?
+}
diff --git a/hosts/h001/containers/default.nix b/hosts/h001/containers/default.nix
index 2e987c3..59cb9cd 100644
--- a/hosts/h001/containers/default.nix
+++ b/hosts/h001/containers/default.nix
@@ -1,9 +1,13 @@
+{ inputs }:
+let
+  common = inputs.common;
+in
 {
   ...
 }:
 {
   imports = [
-    ./forgejo.nix
+    common.nixosModules.containers.forgejo
     ./opengist.nix
     ./homarr.nix
     ./zitadel.nix
@@ -51,14 +55,45 @@
 
     virtualisation.oci-containers.backend = "podman";
 
+    security.acme.acceptTerms = true;
+    security.acme.defaults.email = "admin@joshuabell.xyz";
     services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
       virtualHosts = {
         "localhost" = {
           locations."/" = {
             proxyPass = "http://10.0.0.111";
           };
         };
+
+        # forgejo http traffic
+        "git.joshuabell.xyz" = {
+          locations."/" = {
+            proxyPass = "http://10.0.0.2:3000";
+          };
+        };
+
+        "_" = {
+          default = true;
+          locations."/" = {
+            return = "404"; # or 444 for drop
+          };
+        };
       };
+
+      # STREAMS
+      # Forgejo ssh
+      streamConfig = ''
+        server {
+          listen 3032;
+          proxy_pass 10.0.0.2:3032;
+        }
+      '';
+
     };
 
     networking.firewall.allowedTCPPorts = [
diff --git a/hosts/h001/containers/forgejo.nix b/hosts/h001/containers/forgejo.nix
index 672721a..92793a9 100644
--- a/hosts/h001/containers/forgejo.nix
+++ b/hosts/h001/containers/forgejo.nix
@@ -65,28 +65,6 @@ let
   };
 in
 {
-  services.nginx = {
-    virtualHosts = {
-      # forgejo http traffic
-      "git.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations."/" = {
-          proxyPass = "http://10.0.0.2:3000";
-        };
-      };
-    };
-    # STREAMS
-    # Forgejo ssh
-    streamConfig = ''
-      server {
-        listen 3032;
-        proxy_pass 10.0.0.2:3032;
-      }
-    '';
-  };
-
   # Ensure users exists on host machine with same IDs as container
   inherit users;
 
diff --git a/hosts/h001/containers/opengist.nix b/hosts/h001/containers/opengist.nix
index 0295f3a..e529b94 100644
--- a/hosts/h001/containers/opengist.nix
+++ b/hosts/h001/containers/opengist.nix
@@ -29,9 +29,6 @@ in
   '';
 
   services.nginx.virtualHosts."gist.joshuabell.xyz" = {
-    addSSL = true;
-    sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-    sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
     locations = {
       "/" = {
         proxyWebsockets = true;
diff --git a/hosts/h001/containers/zitadel.md b/hosts/h001/containers/zitadel.md
deleted file mode 100644
index aa24c27..0000000
--- a/hosts/h001/containers/zitadel.md
+++ /dev/null
@@ -1,43 +0,0 @@
-Note that in zitadel there are several settings that many of the apps need. Specifically the flat roles complement on tokens
-
-flatRolesClaim , timeout in seconds = 10
-flowType: complement_token
--> pre user info creation
--> pre access token creation
-
-```js
-/**
- * Adds an additional claim in the token with roles in flat format.
- * 
- * The role claims of the token look like the following:
- * 
- * // added by the code below
- * "flatRolesClaim": ["test", "role2", ...],
- * // added automatically
- * "urn:zitadel:iam:org:project:roles": {
- *   "test": {
- *     "201982826478953724": "zitadel.localhost"
- *   }
- * }
- *
- * Flow: Complement token, Triggers: Pre Userinfo creation, Pre access token creation
- *
- * @param ctx
- * @param api
- */
-
-function flatRolesClaim(ctx, api) {
-  if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) {
-    return;
-  }
-
-  let grants = [];
-  ctx.v1.user.grants.grants.forEach(claim => {
-    claim.roles.forEach(role => {
-        grants.push(role);  
-    })
-  })
-  
-  api.v1.claims.setClaim('flatRolesClaim', grants);
-}
-```
diff --git a/hosts/h001/containers/zitadel.nix b/hosts/h001/containers/zitadel.nix
index 7db46bd..5c24427 100644
--- a/hosts/h001/containers/zitadel.nix
+++ b/hosts/h001/containers/zitadel.nix
@@ -13,13 +13,6 @@ let
   hostAddress6 = "fc00::1";
   containerAddress6 = "fc00::3";
 
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-
   binds = [
     # Postgres data, must use postgres user in container and host
     {
@@ -38,7 +31,6 @@ let
       uid = config.ids.uids.postgres;
       gid = config.ids.gids.postgres;
     }
-  ] ++ lib.optionals (hasSecret "zitadel_master_key") [
     # secret
     {
       host = config.age.secrets.zitadel_master_key.path;
@@ -76,9 +68,6 @@ in
   options = { };
   config = {
     services.nginx.virtualHosts."sso.joshuabell.xyz" = {
-      addSSL = true;
-      sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-      sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
       locations = {
         "/" = {
           proxyWebsockets = true;
diff --git a/hosts/h001/flake.lock b/hosts/h001/flake.lock
index b9c744e..fa96251 100644
--- a/hosts/h001/flake.lock
+++ b/hosts/h001/flake.lock
@@ -5,7 +5,7 @@
         "darwin": "darwin",
         "home-manager": "home-manager_2",
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ],
@@ -26,18 +26,22 @@
       }
     },
     "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "nixpkgs": "nixpkgs_2",
+        "ragenix": "ragenix"
+      },
       "locked": {
-        "dir": "flakes/common",
-        "lastModified": 1762474273,
-        "narHash": "sha256-3zV7GnBNLfIegXGKcnT1B/gFa9EAFsOTvNyDTMBhFJ4=",
+        "lastModified": 1755841247,
+        "narHash": "sha256-oAMTVNjPhTfN4nyTZcW7J0HvdWirid+OYd45ORX3TyA=",
         "ref": "refs/heads/master",
-        "rev": "82a3c325cff4642aab57489f7e4cd53d4b0a5179",
-        "revCount": 760,
+        "rev": "a53d0510d1accc5799baecf7da85e6621d4152f5",
+        "revCount": 615,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       },
       "original": {
-        "dir": "flakes/common",
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       }
@@ -60,7 +64,7 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -104,11 +108,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1753592768,
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
@@ -121,7 +125,7 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -141,34 +145,34 @@
         "type": "github"
       }
     },
-    "litellm-nixpkgs": {
+    "nix-flatpak": {
       "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
         "type": "github"
       }
     },
     "nixarr": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_4",
         "vpnconfinement": "vpnconfinement",
         "website-builder": "website-builder"
       },
       "locked": {
-        "lastModified": 1762329494,
-        "narHash": "sha256-Cww1bU7xX3i6rSLUidM6mAW6srkPN2YH//YWrGt/yFc=",
+        "lastModified": 1755601892,
+        "narHash": "sha256-4FECnCcaUVQHnocuuu/KRldPW2yj7hFpd1F7bfWxTxY=",
         "owner": "rasmus-kirk",
         "repo": "nixarr",
-        "rev": "837562b51943aec6459348a4cee1735c38067c80",
+        "rev": "c6cd890fa028ec2a8d735a121cb0a161d265101c",
         "type": "github"
       },
       "original": {
@@ -193,54 +197,39 @@
         "type": "github"
       }
     },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1756902501,
+        "narHash": "sha256-a89pyAbY2qVZaiFxYdt9+fvXI8pLKgu/g7CqkCUUf94=",
+        "owner": "wrvsrx",
+        "repo": "nixpkgs",
+        "rev": "898a1df732414f7d293a207459c8e47679b33364",
+        "type": "github"
+      },
+      "original": {
+        "owner": "wrvsrx",
+        "ref": "fix-open-webui",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1761016216,
-        "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",
+        "lastModified": 1753694789,
+        "narHash": "sha256-cKgvtz6fKuK1Xr5LQW/zOUiAC0oSQoA9nOISB0pJZqM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "481cf557888e05d3128a76f14c76397b7d7cc869",
+        "rev": "dc9637876d0dcc8c9e5e22986b857632effeb727",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1762498405,
-        "narHash": "sha256-Zg/SCgCaAioc0/SVZQJxuECGPJy+OAeBcGeA5okdYDc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "6faeb062ee4cf4f105989d490831713cc5a43ee1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1761619080,
-        "narHash": "sha256-PsLFmU/CORWeCjJi9ALsegwr/SMjf2gHsooTR09az4c=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "fd644bba1d3a83169e4b312ce20928ba1b0abb02",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
       "locked": {
         "lastModified": 1741379970,
         "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
@@ -256,6 +245,53 @@
         "type": "github"
       }
     },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1748662220,
+        "narHash": "sha256-7gGa49iB9nCnFk4h/g9zwjlQAyjtpgcFkODjcOQS0Es=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "59138c7667b7970d205d6a05a8bfa2d78caa3643",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1755704039,
+        "narHash": "sha256-gKlP0LbyJ3qX0KObfIWcp5nbuHSb5EHwIvU6UcNBg2A=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "9cb344e96d5b6918e94e1bca2d9f3ea1e9615545",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1755648324,
+        "narHash": "sha256-+2TxwJEXWXGC7JBsRGUHtmQ66lRGPcDI2kFKTTU5e2s=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "226bb7c9df5f953fd7533e199b8d9e5475458a8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nvim_plugin-Almo7aya/openingh.nvim": {
       "flake": false,
       "locked": {
@@ -275,11 +311,11 @@
     "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761323006,
-        "narHash": "sha256-6BjkqZCo2DLVxW6BHyElt2cZdG6Dhzao8hPfWYm0sIQ=",
+        "lastModified": 1755636100,
+        "narHash": "sha256-EeU6AfMISnXUmKdNHXN35srj+fuQiHoWx5uYRKCjsTE=",
         "owner": "CopilotC-Nvim",
         "repo": "CopilotChat.nvim",
-        "rev": "a7138a0ee04d8af42c262554eccee168bbf1454f",
+        "rev": "f7bb32dbbe2ff5e26f5033e2142b5920cf427236",
         "type": "github"
       },
       "original": {
@@ -307,11 +343,11 @@
     "nvim_plugin-L3MON4D3/LuaSnip": {
       "flake": false,
       "locked": {
-        "lastModified": 1761039842,
-        "narHash": "sha256-ovvtTZgqL6MFvuI3byx+boWm6ErZX06+v6a3VoctREc=",
+        "lastModified": 1754037237,
+        "narHash": "sha256-JhTqTGQfIryJ7MElcOGOfb48uaNDnd9RM9Fl1Fs4QV0=",
         "owner": "L3MON4D3",
         "repo": "LuaSnip",
-        "rev": "ccf25a5452b8697a823de3e5ecda63ed3d723b79",
+        "rev": "de10d8414235b0a8cabfeba60d07c24304e71f5c",
         "type": "github"
       },
       "original": {
@@ -323,11 +359,11 @@
     "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343950,
-        "narHash": "sha256-HycEAgAsU8IxFiYfyp5ZGN+z6wYyCarIESxA9TDuJ3s=",
+        "lastModified": 1755631821,
+        "narHash": "sha256-+/GVSb3uQ5HktPv6HFwdywX85hScsAI1IHqXmwDH9PU=",
         "owner": "MeanderingProgrammer",
         "repo": "render-markdown.nvim",
-        "rev": "bfd67f1402b97ac619cb538f4bbaed12a7fa89aa",
+        "rev": "0087ee1d505d4fc4886d8d3121ae7848b7c0e49b",
         "type": "github"
       },
       "original": {
@@ -371,11 +407,11 @@
     "nvim_plugin-Saecki/crates.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1755956579,
-        "narHash": "sha256-jfmST/S9ymwgQ99PTCOlJkk5zaxE5HiDV16TmTISDII=",
+        "lastModified": 1754466592,
+        "narHash": "sha256-b40E121rJrEmlor3fHmh4Y1TXKdfiqsBGBcpbY//eTw=",
         "owner": "Saecki",
         "repo": "crates.nvim",
-        "rev": "ac9fa498a9edb96dc3056724ff69d5f40b898453",
+        "rev": "a49df0f70171adc77704eac70dd2c0d179065933",
         "type": "github"
       },
       "original": {
@@ -387,11 +423,11 @@
     "nvim_plugin-aznhe21/actions-preview.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759462626,
-        "narHash": "sha256-YUeWBXxxeurfWBi0PjUi6izqYAvUw9DHmvsuPXm7ohw=",
+        "lastModified": 1745779150,
+        "narHash": "sha256-rQjwlu5gQcOvxF72lr9ugPRl0W78wCWGWPhpN1oOMbs=",
         "owner": "aznhe21",
         "repo": "actions-preview.nvim",
-        "rev": "cb938c25edaac38d362555f19244a9cb85d561e8",
+        "rev": "36513ad213855d497b7dd3391a24d1d75d58e36f",
         "type": "github"
       },
       "original": {
@@ -403,11 +439,11 @@
     "nvim_plugin-b0o/schemastore.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343239,
-        "narHash": "sha256-obGnux+K0blHROEOAy7Ct18vxiO4Qez8XJB5l23KgMs=",
+        "lastModified": 1755594039,
+        "narHash": "sha256-XU+PtvXlgoHFouyyceUIZ4L5AvZThUR2AegmCQAYt1A=",
         "owner": "b0o",
         "repo": "schemastore.nvim",
-        "rev": "4341619da06779ae310ee9c3d6d70edfefed7152",
+        "rev": "e906ac3ed0bd273781759e7635b5b824393c925c",
         "type": "github"
       },
       "original": {
@@ -419,11 +455,11 @@
     "nvim_plugin-catppuccin/nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761396780,
-        "narHash": "sha256-Nz/XbItShbrnKtj0+gcEDBFO5y00g0EG5CHqdJGK2j0=",
+        "lastModified": 1755621274,
+        "narHash": "sha256-o8VLMPriOh4+Ay5Ff0cWQYXjmihdr3x9131bKHHTsQE=",
         "owner": "catppuccin",
         "repo": "nvim",
-        "rev": "8c4125e3c746976ba025dc5d908fa22c6aa09486",
+        "rev": "30fa4d122d9b22ad8b2e0ab1b533c8c26c4dde86",
         "type": "github"
       },
       "original": {
@@ -435,11 +471,11 @@
     "nvim_plugin-chrisgrieser/nvim-early-retirement": {
       "flake": false,
       "locked": {
-        "lastModified": 1760385962,
-        "narHash": "sha256-PtpD6Uc4GK4dSJynWH5d6c7XOWXfYODXJ3FyOY1eZNo=",
+        "lastModified": 1755590055,
+        "narHash": "sha256-989Zf6SCy+vakFac4KmElUn8+ErJMtYJ8zlOi999UJI=",
         "owner": "chrisgrieser",
         "repo": "nvim-early-retirement",
-        "rev": "9109589b542773c9ad2a34067a085874f255577b",
+        "rev": "ef9fc0267da4204432ab7bf3ab9df359874cfeb6",
         "type": "github"
       },
       "original": {
@@ -467,11 +503,11 @@
     "nvim_plugin-folke/lazy.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761488113,
-        "narHash": "sha256-jBmtFzzdGYe3N3kvWHvR7FGXtA+/t36efxsAqhLmaxU=",
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
         "owner": "folke",
         "repo": "lazy.nvim",
-        "rev": "ed4dc336a73c18da6fea6e1cf7ad6e1b76d281eb",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
         "type": "github"
       },
       "original": {
@@ -499,11 +535,11 @@
     "nvim_plugin-folke/which-key.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759952076,
-        "narHash": "sha256-N31+V5L0gd+TUo9nVtNGRmMVmM9fMxOwldCfuLYT4hU=",
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
         "owner": "folke",
         "repo": "which-key.nvim",
-        "rev": "b4177e3eaf15fe5eb8357ebac2286d488be1ed00",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
         "type": "github"
       },
       "original": {
@@ -563,11 +599,11 @@
     "nvim_plugin-hrsh7th/nvim-cmp": {
       "flake": false,
       "locked": {
-        "lastModified": 1760792454,
-        "narHash": "sha256-wkESSNUViVI5DE+3t4AVTaSLQ/hTB43vrm+PH6uA8H4=",
+        "lastModified": 1744514599,
+        "narHash": "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=",
         "owner": "hrsh7th",
         "repo": "nvim-cmp",
-        "rev": "a7bcf1d88069fc67c9ace8a62ba480b8fe879025",
+        "rev": "b5311ab3ed9c846b585c0c15b7559be131ec4be9",
         "type": "github"
       },
       "original": {
@@ -579,11 +615,11 @@
     "nvim_plugin-j-hui/fidget.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761243883,
-        "narHash": "sha256-XXTeJweQRIsC/WFhFxFbepOETV8e5Wfmh513su2Wve0=",
+        "lastModified": 1755048367,
+        "narHash": "sha256-Hcnbk6go2vYCYqSfXLWQ+KimpU+NPbIkjBTKGMFoNQM=",
         "owner": "j-hui",
         "repo": "fidget.nvim",
-        "rev": "e32b672d8fd343f9d6a76944fedb8c61d7d8111a",
+        "rev": "2cb5edb2dd6700a958a446b20bb2be04d318da9d",
         "type": "github"
       },
       "original": {
@@ -611,11 +647,11 @@
     "nvim_plugin-lewis6991/gitsigns.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760888451,
-        "narHash": "sha256-eGpB7YYWbyCCGYXEYAM432srSp/lUo5C1b0J3OYjwnY=",
+        "lastModified": 1755014582,
+        "narHash": "sha256-zBUrqL+00Y8j4eVNAgI0nYn2i35zhQo2BVl4mL1cgfs=",
         "owner": "lewis6991",
         "repo": "gitsigns.nvim",
-        "rev": "20ad4419564d6e22b189f6738116b38871082332",
+        "rev": "6e3c66548035e50db7bd8e360a29aec6620c3641",
         "type": "github"
       },
       "original": {
@@ -659,11 +695,11 @@
     "nvim_plugin-m4xshen/hardtime.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1757738091,
-        "narHash": "sha256-Jy9ARUHU1ySpSxxoS3hLRjxp5Lqt7juWN5Jnbdo0rg0=",
+        "lastModified": 1753760289,
+        "narHash": "sha256-BgJ0gKy/zxU82L7WocXLkXwD97pnCvpGyJVzSHeUtG0=",
         "owner": "m4xshen",
         "repo": "hardtime.nvim",
-        "rev": "b4e431934af1fe224a3a801f632c008278cb7628",
+        "rev": "6d7664d5bdfaea44c5f50b29f5239fab7b00c273",
         "type": "github"
       },
       "original": {
@@ -675,11 +711,11 @@
     "nvim_plugin-mbbill/undotree": {
       "flake": false,
       "locked": {
-        "lastModified": 1759186837,
-        "narHash": "sha256-EWOH08KAWyoT9m45/B1d5aKQQJtd3k4orJbagVsxe08=",
+        "lastModified": 1752437854,
+        "narHash": "sha256-5WofUOTYE+Nmx3A5OoZBneJBHZ8bdGEYDZ6vTMx1OE0=",
         "owner": "mbbill",
         "repo": "undotree",
-        "rev": "0f1c9816975b5d7f87d5003a19c53c6fd2ff6f7f",
+        "rev": "28f2f54a34baff90ea6f4a735ef1813ad875c743",
         "type": "github"
       },
       "original": {
@@ -691,11 +727,11 @@
     "nvim_plugin-mfussenegger/nvim-lint": {
       "flake": false,
       "locked": {
-        "lastModified": 1759852544,
-        "narHash": "sha256-wVEX0lCxeipvwCfdd2JbQwnhgg6UrTXixC8E1OiEblI=",
+        "lastModified": 1753951521,
+        "narHash": "sha256-GmXScmbXJx74RMgPhkdKtdODZqkOarFHE1XOiSnt5Bo=",
         "owner": "mfussenegger",
         "repo": "nvim-lint",
-        "rev": "9da1fb942dd0668d5182f9c8dee801b9c190e2bb",
+        "rev": "7ef127aaede2a4d5ad8df8321e2eb4e567f29594",
         "type": "github"
       },
       "original": {
@@ -707,11 +743,11 @@
     "nvim_plugin-mrcjkb/rustaceanvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761585884,
-        "narHash": "sha256-m/gd+cb7X2a7R6JSbHes0QjGs+zuj4698Qyi/OW0R1g=",
+        "lastModified": 1755599388,
+        "narHash": "sha256-4o20Hf+rFD2zejPZr5oe3ZkaynW3xAw/wtbF3sMjNnQ=",
         "owner": "mrcjkb",
         "repo": "rustaceanvim",
-        "rev": "be0d1d14b8504c1c0965b608dc7ed39f2d588c91",
+        "rev": "eb9beab7d80eb052f78165b28d18f55844b26aef",
         "type": "github"
       },
       "original": {
@@ -723,11 +759,11 @@
     "nvim_plugin-neovim/nvim-lspconfig": {
       "flake": false,
       "locked": {
-        "lastModified": 1761605346,
-        "narHash": "sha256-3Aulaw6KMmrcoQQxhRhQhjZ2fg6MSU4Q7qAWtrVsOcA=",
+        "lastModified": 1755617152,
+        "narHash": "sha256-PSu5zQi/rzBAnALX8WrYckhqM5lI6hGAhsWWgS7ln7A=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "2b52bc2190c8efde2e4de02d829a138666774c7c",
+        "rev": "5f1c9a90c8db9c647da40ce6cf5be9e49ccbf0c7",
         "type": "github"
       },
       "original": {
@@ -736,6 +772,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755623332,
+        "narHash": "sha256-hnTDzd3eRsDUYYf9WPknYZ126d0XKXO1hjlY7WH4bDI=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "8ab43934caea0eacc986d112e5680c316b8a7944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-numToStr/Comment.nvim": {
       "flake": false,
       "locked": {
@@ -771,11 +823,11 @@
     "nvim_plugin-nvim-lualine/lualine.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760596863,
-        "narHash": "sha256-hdrAdG3hC2sAevQ6a9xizqPgEgnNKxuc5rBYn0pKM1c=",
+        "lastModified": 1754970649,
+        "narHash": "sha256-lWt2kpW+hsTMWt8tar/+AISTDrIt4Jn27NmI9j+Xt4s=",
         "owner": "nvim-lualine",
         "repo": "lualine.nvim",
-        "rev": "3946f0122255bc377d14a59b27b609fb3ab25768",
+        "rev": "b8c23159c0161f4b89196f74ee3a6d02cdc3a955",
         "type": "github"
       },
       "original": {
@@ -851,11 +903,11 @@
     "nvim_plugin-nvim-tree/nvim-tree.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1760921408,
-        "narHash": "sha256-QCUp/6qX/FS8LrZ6K+pvC/mHkYW8xfzQZEB2y0VOStQ=",
+        "lastModified": 1755174669,
+        "narHash": "sha256-Cdd7m2ondica5yDgm8THEm8LttJwDWQTNPnKO4vKr2c=",
         "owner": "nvim-tree",
         "repo": "nvim-tree.lua",
-        "rev": "64e2192f5250796aa4a7f33c6ad888515af50640",
+        "rev": "f0e9951778802526b14c934f7bf746e1e0ae5ed0",
         "type": "github"
       },
       "original": {
@@ -867,11 +919,11 @@
     "nvim_plugin-nvim-tree/nvim-web-devicons": {
       "flake": false,
       "locked": {
-        "lastModified": 1761440007,
-        "narHash": "sha256-klBjUtj0AvarN5a6O8Hh2t5BuOTe/m3ps2cHnlxVJvE=",
+        "lastModified": 1754884337,
+        "narHash": "sha256-Zftd4xFYdCtof6IusN+E079yY2oMTNhJ/yznvLiiur0=",
         "owner": "nvim-tree",
         "repo": "nvim-web-devicons",
-        "rev": "8dcb311b0c92d460fac00eac706abd43d94d68af",
+        "rev": "c2599a81ecabaae07c49ff9b45dcd032a8d90f1a",
         "type": "github"
       },
       "original": {
@@ -883,11 +935,11 @@
     "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
       "flake": false,
       "locked": {
-        "lastModified": 1761077440,
-        "narHash": "sha256-QdZstxKsEILwe7eUZCmMdyLPyvNKc/e7cfdYQowHWPQ=",
+        "lastModified": 1754488703,
+        "narHash": "sha256-f4a9Abwb265Rm+hpUXz+rKWXvaFVrmXf1h7d7eh9jJc=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter-context",
-        "rev": "ec308c7827b5f8cb2dd0ad303a059c945dd21969",
+        "rev": "dca8726fea2c14e1ce6adbaa76a04816fbfaff61",
         "type": "github"
       },
       "original": {
@@ -915,11 +967,11 @@
     "nvim_plugin-rcarriga/nvim-notify": {
       "flake": false,
       "locked": {
-        "lastModified": 1757190131,
-        "narHash": "sha256-h7STMjY+CBTqBkIDJXgtJz4WhNeQ02ES2Jesi3jZXeM=",
+        "lastModified": 1753086914,
+        "narHash": "sha256-uQBB3fajHowivArxbtmEJvVU3+QO0VApYpVNMA58UkI=",
         "owner": "rcarriga",
         "repo": "nvim-notify",
-        "rev": "8701bece920b38ea289b457f902e2ad184131a5d",
+        "rev": "397c7c1184745fca649e5104de659e6392ef5a4d",
         "type": "github"
       },
       "original": {
@@ -931,11 +983,11 @@
     "nvim_plugin-rmagatti/auto-session": {
       "flake": false,
       "locked": {
-        "lastModified": 1761491368,
-        "narHash": "sha256-F2MtkBCVAObRwniSvFjv5MmYnCaj1YSUf0Nk5MF1F4Y=",
+        "lastModified": 1755285297,
+        "narHash": "sha256-x8oPN7JqcY0scFO0vGREerT3dRiQA+k/qeWsug1sGiU=",
         "owner": "rmagatti",
         "repo": "auto-session",
-        "rev": "f0eb3d69848389869572b82b336d7a6887e88e43",
+        "rev": "d27a29f5754e3a8b8d89a4069814e53ac583e951",
         "type": "github"
       },
       "original": {
@@ -944,7 +996,7 @@
         "type": "github"
       }
     },
-    "nvim_plugin-ron-rs/ron.vim": {
+    "nvim_plugin-ron/ron.vim": {
       "flake": false,
       "locked": {
         "lastModified": 1660904719,
@@ -995,11 +1047,11 @@
     "nvim_plugin-stevearc/conform.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761160784,
-        "narHash": "sha256-yUUDxYuIjbFHUscEKpFV6IaraDNOA4hdcGljPHG/+sU=",
+        "lastModified": 1755640282,
+        "narHash": "sha256-WYGvppnMsBaVYnMmv9WJRuKuyk4F/rzJ3DRBh+72tRY=",
         "owner": "stevearc",
         "repo": "conform.nvim",
-        "rev": "9fd3d5e0b689ec1bf400c53cbbec72c6fdf24081",
+        "rev": "04bfa5f35706410376bf7618a01fcf44e3f35b59",
         "type": "github"
       },
       "original": {
@@ -1075,11 +1127,11 @@
     "nvim_plugin-windwp/nvim-ts-autotag": {
       "flake": false,
       "locked": {
-        "lastModified": 1757545454,
-        "narHash": "sha256-nT2W5gKFEfzP7MztLjm7yqwam3ADk0svcMdLg2nmI/4=",
+        "lastModified": 1739910276,
+        "narHash": "sha256-a3Bcql68mp3y5bH9XMiDTQB0e75T+qFB593objIGg/I=",
         "owner": "windwp",
         "repo": "nvim-ts-autotag",
-        "rev": "c4ca798ab95b316a768d51eaaaee48f64a4a46bc",
+        "rev": "a1d526af391f6aebb25a8795cbc05351ed3620b5",
         "type": "github"
       },
       "original": {
@@ -1107,11 +1159,11 @@
     "nvim_plugin-zbirenbaum/copilot.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1761595323,
-        "narHash": "sha256-KkiU2xmpfIbpuijvcXDw+LWKWuBgxjwY7jEQIasN5Kw=",
+        "lastModified": 1755448417,
+        "narHash": "sha256-KV+Wno4aB5uTSBxIZzQKC/0KfjQLM7x8wCDkVSnaPeA=",
         "owner": "zbirenbaum",
         "repo": "copilot.lua",
-        "rev": "93adf9844dcbe09a37e7a72eaa286d33d38bf628",
+        "rev": "3fd7b50810ae4cccf8b38e4c509b1608f141a9e9",
         "type": "github"
       },
       "original": {
@@ -1120,61 +1172,13 @@
         "type": "github"
       }
     },
-    "oauth2-proxy-nixpkgs": {
-      "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "open-webui-nixpkgs": {
-      "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "pinchflat-nixpkgs": {
-      "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "ragenix": {
       "inputs": {
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_5",
-        "rust-overlay": "rust-overlay_2"
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1744897914,
@@ -1193,21 +1197,15 @@
     "root": {
       "inputs": {
         "common": "common",
-        "home-manager": "home-manager",
-        "litellm-nixpkgs": "litellm-nixpkgs",
         "nixarr": "nixarr",
-        "nixpkgs": "nixpkgs_3",
-        "oauth2-proxy-nixpkgs": "oauth2-proxy-nixpkgs",
-        "open-webui-nixpkgs": "open-webui-nixpkgs",
-        "pinchflat-nixpkgs": "pinchflat-nixpkgs",
-        "ros_neovim": "ros_neovim",
-        "secrets": "secrets",
-        "trilium-nixpkgs": "trilium-nixpkgs"
+        "nixpkgs": "nixpkgs_5",
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "ros_neovim": "ros_neovim"
       }
     },
     "ros_neovim": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_6",
         "nvim_plugin-Almo7aya/openingh.nvim": "nvim_plugin-Almo7aya/openingh.nvim",
         "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim",
         "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring",
@@ -1238,6 +1236,7 @@
         "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
         "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
         "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
         "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
         "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
         "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
@@ -1251,7 +1250,7 @@
         "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
         "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
         "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
-        "nvim_plugin-ron-rs/ron.vim": "nvim_plugin-ron-rs/ron.vim",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
         "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
         "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
         "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
@@ -1262,14 +1261,14 @@
         "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
         "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
         "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1761712156,
-        "narHash": "sha256-4vU7FPZFXSFguQUIPrbLQOk3VSokp6RH8t7zQoqneow=",
+        "lastModified": 1755648539,
+        "narHash": "sha256-zElmY3ieHOxJtn5Q3KKXZw3i6/e63jRtHowzOM4jERw=",
         "ref": "refs/heads/master",
-        "rev": "04f666dabbaced8d661693cfbe4eb7efa359ce7d",
-        "revCount": 320,
+        "rev": "1f8444ad78e85c902818ab48479f3f3a1e909031",
+        "revCount": 300,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/nvim"
       },
@@ -1281,28 +1280,7 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "ros_neovim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761619008,
-        "narHash": "sha256-vp97eNmi5GG/+jlvnBpmG6EVO2F1+nqMQFF9GT2TIQg=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "7bc7d2f706ebe5479d230d2c6806b5dc757ae4cd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ]
@@ -1321,24 +1299,25 @@
         "type": "github"
       }
     },
-    "secrets": {
+    "rust-overlay_2": {
       "inputs": {
-        "ragenix": "ragenix"
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "dir": "flakes/secrets",
-        "lastModified": 1762474273,
-        "narHash": "sha256-3zV7GnBNLfIegXGKcnT1B/gFa9EAFsOTvNyDTMBhFJ4=",
-        "ref": "refs/heads/master",
-        "rev": "82a3c325cff4642aab57489f7e4cd53d4b0a5179",
-        "revCount": 760,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1755571033,
+        "narHash": "sha256-V8gmZBfMiFGCyGJQx/yO81LFJ4d/I5Jxs2id96rLxrM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "95487740bb7ac11553445e9249041a6fa4b5eccf",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/secrets",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
@@ -1371,29 +1350,13 @@
         "type": "github"
       }
     },
-    "trilium-nixpkgs": {
-      "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "vpnconfinement": {
       "locked": {
-        "lastModified": 1759956062,
-        "narHash": "sha256-NUZu0Rb0fwUjfdp51zMm0xM3lcK8Kw4c97LLog7+JjA=",
+        "lastModified": 1743810720,
+        "narHash": "sha256-kbv/W4gizUSa6qH2rUQdgPj9AJaeN9k2XSWUYqj7IMU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "fabe7247b720b5eb4c3c053e24a2b3b70e64c52b",
+        "rev": "74ae51e6d18b972ecc918ab43e8bde60c21a65d8",
         "type": "github"
       },
       "original": {
@@ -1410,11 +1373,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753958235,
-        "narHash": "sha256-Rd27XQJKv8Z4BCr3gdbaHFd0TmumiGxdjGRzsEf/mOg=",
+        "lastModified": 1750317638,
+        "narHash": "sha256-B4RWcXXOLO6gMeYyV+K4olu+kGGsYamKH+JAm0cIXqI=",
         "owner": "rasmus-kirk",
         "repo": "website-builder",
-        "rev": "00a14b7ae7baef2197978ba7c3fe72dfca7bc475",
+        "rev": "b54192000a00e865947f45bacf3184d56363ee38",
         "type": "github"
       },
       "original": {
diff --git a/hosts/h001/flake.nix b/hosts/h001/flake.nix
index 1ae4bc2..a3b5646 100644
--- a/hosts/h001/flake.nix
+++ b/hosts/h001/flake.nix
@@ -1,20 +1,12 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
-
-    # nixpkgs-unstable.url = "github:wrvsrx/nixpkgs/fix-open-webui";
-    open-webui-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    litellm-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    trilium-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    oauth2-proxy-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    pinchflat-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:wrvsrx/nixpkgs/fix-open-webui";
+    # nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     # Use relative to get current version for testing
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
+    # common.url = "path:../../common";
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
 
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
 
@@ -24,110 +16,97 @@
   outputs =
     {
       nixpkgs,
-      home-manager,
       common,
-      secrets,
       ros_neovim,
       nixarr,
       ...
     }@inputs:
     let
       configuration_name = "h001";
-      system = "x86_64-linux";
-      stateVersion = "24.11";
-      primaryUser = "luser";
       lib = nixpkgs.lib;
     in
     {
       nixosConfigurations = {
         "${configuration_name}" = (
           lib.nixosSystem {
-            inherit system;
             specialArgs = {
               inherit inputs;
+              upkgs = import inputs.nixpkgs-unstable {
+                system = "x86_64-linux";
+                config.allowUnfree = true;
+              };
             };
             modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
+              common.nixosModules.default
               ros_neovim.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.boot_systemd
-              common.nixosModules.hardening
-              common.nixosModules.nix_options
-              common.nixosModules.podman
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-
               nixarr.nixosModules.default
+              ./configuration.nix
               ./hardware-configuration.nix
               ./mods
               ./nginx.nix
-              ./containers
+              (import ./containers { inherit inputs; })
               (
                 { config, pkgs, ... }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      shell = pkgs.zsh;
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "video"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
-                      ];
-                    };
-                    root = {
-                      shell = pkgs.zsh;
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
-                      ];
-                    };
-                  };
-
+                {
                   environment.systemPackages = with pkgs; [
                     lua
                     sqlite
-                    ttyd
                   ];
+
+                  ringofstorms_common = {
+                    systemName = configuration_name;
+                    boot.systemd.enable = true;
+                    secrets.enable = true;
+                    general = {
+                      reporting.enable = true;
+                    };
+                    programs = {
+                      tailnet.enable = true;
+                      ssh.enable = true;
+                      podman.enable = true;
+                    };
+                    users = {
+                      admins = [ "luser" ]; # First admin is also the primary user owning nix config
+                      users = {
+                        root = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                        luser = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
+                          ];
+                          extraGroups = [
+                            "networkmanager"
+                            "video"
+                            "input"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                      };
+                    };
+                    homeManager = {
+                      users = {
+                        luser = {
+                          imports = with common.homeManagerModules; [
+                            kitty
+                            tmux
+                            atuin
+                            direnv
+                            git
+                            nix_deprecations
+                            postgres
+                            ssh
+                            starship
+                            zoxide
+                            zsh
+                          ];
+                        };
+                      };
+                    };
+                  };
                 }
               )
             ];
diff --git a/hosts/h001/mods/default.nix b/hosts/h001/mods/default.nix
index c1a4db5..5408430 100644
--- a/hosts/h001/mods/default.nix
+++ b/hosts/h001/mods/default.nix
@@ -3,16 +3,9 @@
 }:
 {
   imports = [
-    ./litellm.nix
     ./nixarr.nix
     ./monitoring.nix
     ./pinchflat.nix
     ./openwebui.nix
-    ./trilium.nix
-    ./oauth2-proxy.nix
-    ./n8n.nix
-    ./postgresql.nix
-    # ./openbao.nix
-    ./vault.nix
   ];
 }
diff --git a/hosts/h001/mods/litellm.nix b/hosts/h001/mods/litellm.nix
deleted file mode 100644
index b81109f..0000000
--- a/hosts/h001/mods/litellm.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{
-  inputs,
-  ...
-}:
-let
-  declaration = "services/misc/litellm.nix";
-  nixpkgs = inputs.litellm-nixpkgs;
-  pkgs = import nixpkgs {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
-  port = 8094;
-in
-{
-  disabledModules = [ declaration ];
-  imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
-  options = { };
-  config = {
-    networking.firewall.enable = true;
-    # Expose litellm to my overlay network as well
-    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ port ];
-
-    services.litellm = {
-      enable = true;
-      inherit port;
-      host = "0.0.0.0";
-      openFirewall = false;
-      package = pkgs.litellm;
-      environment = {
-        SCARF_NO_ANALYTICS = "True";
-        DO_NOT_TRACK = "True";
-        ANONYMIZED_TELEMETRY = "False";
-        GITHUB_COPILOT_TOKEN_DIR = "/var/lib/litellm/github_copilot";
-        XDG_CONFIG_HOME = "/var/lib/litellm/.config";
-      };
-      settings = {
-        environment_variables = {
-          LITELLM_PROXY_API_KEY = "na";
-          LITELLM_PROXY_API_BASE = "http://100.64.0.8:9010/air_key";
-        };
-        litellm_settings = {
-          check_provider_endpoints = true;
-          drop_params = true;
-        };
-        model_list = [
-        ]
-        # Copilot
-        ++ (builtins.map
-          (m: {
-            model_name = "copilot-${m}";
-            litellm_params = {
-              model = "github_copilot/${m}";
-              extra_headers = {
-                editor-version = "vscode/${pkgs.vscode.version}";
-                editor-plugin-version = "copilot/${pkgs.vscode-extensions.github.copilot.version}";
-                Copilot-Integration-Id = "vscode-chat";
-                Copilot-Vision-Request = "true";
-                user-agent = "GithubCopilot/${pkgs.vscode-extensions.github.copilot.version}";
-              };
-            };
-
-          })
-          # List from https://github.com/settings/copilot/features enabled models
-          [
-            "claude-sonnet-3.5"
-            "claude-sonnet-4"
-            "claude-sonnet-4.5"
-            "gemini-2.5-pro"
-            "openai-gpt-5"
-            "openai-gpt-5-mini"
-          ]
-        )
-        # Azure
-        ++ (builtins.map
-          (m: {
-            model_name = "azure-${m}";
-            litellm_params = {
-              model = "azure/${m}";
-              api_base = "http://100.64.0.8:9010/azure";
-              api_version = "2025-04-01-preview";
-              api_key = "na";
-            };
-          })
-          [
-            "gpt-4o-2024-05-13"
-            "gpt-4.1-2025-04-14"
-            "gpt-4.1-mini-2025-04-14"
-            "gpt-5-nano-2025-08-07"
-            "gpt-5-mini-2025-08-07"
-            "gpt-5-2025-08-07"
-            # "gpt-5-codex-2025-09-15"
-          ]
-        )
-        # 宙 Proxy
-        ++ (builtins.map
-          (m: {
-            model_name = "air-${m}";
-            litellm_params = {
-              model = "litellm_proxy/${m}";
-              api_base = "http://100.64.0.8:9010/air_prd";
-              api_key = "os.environ/LITELLM_PROXY_API_KEY";
-            };
-          })
-          # curl -L t.net.joshuabell.xyz:9010/air_key/models | jq '.data.[].id'
-          [
-            "gpt-5-mini"
-            "gpt-5"
-            "gpt-4.1"
-            "gpt-4.1-mini"
-            "gpt-4o"
-            "gpt-4o-mini"
-            "o3-mini"
-            "o4-mini"
-            "gemini-2.5-pro"
-            "gemini-2.0-flash"
-            "gemini-2.5-flash"
-            "gemini-2.0-flash-lite"
-            "gemini-2.5-flash-lite"
-            "claude-opus-4.1"
-            "claude-opus-4"
-            "claude-sonnet-4"
-            "claude-3.7-sonnet"
-            "text-embedding-3-small"
-            "text-embedding-3-large"
-            "text-embedding-ada-002"
-            "text-embedding-large-exp-03-07"
-            "text-embedding-005"
-            "llama7b"
-            "medgemma-4b"
-            "qwen3-instruct"
-            "bge-small-en-v1.5"
-          ]
-        );
-      };
-    };
-  };
-}
diff --git a/hosts/h001/mods/n8n.nix b/hosts/h001/mods/n8n.nix
deleted file mode 100644
index a99d889..0000000
--- a/hosts/h001/mods/n8n.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  ...
-}:
-{
-  options = { };
-  config = {
-    services.nginx.virtualHosts = {
-      "n8n.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations = {
-          "/" = {
-            proxyWebsockets = true;
-            recommendedProxySettings = true;
-            proxyPass = "http://127.0.0.1:5678";
-          };
-        };
-      };
-    };
-
-    # Expose litellm to my overlay network as well
-    # networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ port ];
-
-    services.n8n = {
-      enable = true;
-    };
-    systemd.services.n8n.environment = {
-      # N8N_SECURE_COOKIE = "false";
-      N8N_LISTEN_ADDRESS = "127.0.0.1";
-      N8N_EDITOR_BASE_URL = "https://n8n.joshuabell.xyz/";
-      N8N_HOST = "n8n.joshuabell.xyz";
-      VUE_APP_URL_BASE_API = "https://n8n.joshuabell.xyz/";
-      N8N_HIRING_BANNER_ENABLED = "false";
-      # N8N_PUBLIC_API_DISABLED = "true";
-      # N8N_PUBLIC_API_SWAGGERUI_DISABLED = "true";
-    };
-  };
-}
diff --git a/hosts/h001/mods/nixarr.nix b/hosts/h001/mods/nixarr.nix
index 80c760b..2c86273 100644
--- a/hosts/h001/mods/nixarr.nix
+++ b/hosts/h001/mods/nixarr.nix
@@ -1,16 +1,7 @@
 {
   config,
-  lib,
   ...
 }:
-let
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-in
 {
   config = {
     nixarr = {
@@ -18,7 +9,7 @@ in
       mediaDir = "/drives/wd10/nixarr/media";
       stateDir = "/var/lib/nixarr/state";
 
-      vpn = lib.mkIf (hasSecret "us_chi_wg") {
+      vpn = {
         enable = true;
         wgConf = config.age.secrets.us_chi_wg.path;
       };
@@ -26,7 +17,7 @@ in
       jellyfin.enable = true; # jellyfinnnnnn!
       jellyfin.vpn.enable = true;
       jellyseerr.enable = true; # request manager for media
-      # jellyseerr.vpn.enable = true; # NOTE makes it not able to communicate to *arr apps
+      jellyseerr.vpn.enable = true;
       sabnzbd.enable = true; # Usenet downloader
       transmission = {
         enable = true; # Torrent downloader
@@ -56,18 +47,30 @@ in
     services.nginx = {
       virtualHosts = {
         "jellyfin.joshuabell.xyz" = {
-          addSSL = true;
-          sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-          sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
           locations."/" = {
             proxyWebsockets = true;
             proxyPass = "http://localhost:8096";
           };
         };
         "media.joshuabell.xyz" = {
-          addSSL = true;
-          sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-          sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://localhost:5055";
+          };
+        };
+        "10.12.14.10" = {
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://localhost:8096";
+          };
+        };
+        "jellyfin.h001.local.joshuabell.xyz" = {
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://localhost:8096";
+          };
+        };
+        "media.h001.local.joshuabell.xyz" = {
           locations."/" = {
             proxyWebsockets = true;
             proxyPass = "http://localhost:5055";
diff --git a/hosts/h001/mods/oauth2-proxy.nix b/hosts/h001/mods/oauth2-proxy.nix
deleted file mode 100644
index 73d6f2f..0000000
--- a/hosts/h001/mods/oauth2-proxy.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  inputs,
-  config,
-  lib,
-  ...
-}:
-let
-  declaration = "services/security/oauth2-proxy.nix";
-  nixpkgs = inputs.oauth2-proxy-nixpkgs;
-  pkgs = import nixpkgs {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-in
-{
-  disabledModules = [ declaration ];
-  imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
-  config = lib.mkIf (hasSecret "oauth2_proxy_key_file") {
-    services.oauth2-proxy = {
-      enable = true;
-      httpAddress = "http://127.0.0.1:4180";
-      package = pkgs.oauth2-proxy;
-      provider = "oidc";
-      reverseProxy = true;
-      redirectURL = "https://sso-proxy.joshuabell.xyz/oauth2/callback";
-      validateURL = "https://sso.joshuabell.xyz/oauth2/";
-      oidcIssuerUrl = "https://sso.joshuabell.xyz";
-      keyFile = config.age.secrets.oauth2_proxy_key_file.path;
-      nginx.domain = "sso-proxy.joshuabell.xyz";
-      email.domains = [ "*" ];
-      extraConfig = {
-        whitelist-domain = "*.joshuabell.xyz";
-        cookie-domain = ".joshuabell.xyz";
-        oidc-groups-claim = "flatRolesClaim";
-        # scope = "openid email profiles";
-
-        # pass-access-token = "true";
-        # set-authorization-header = "true";
-        # pass-user-headers = "true";
-
-        # show-debug-on-error = "true";
-        # errors-to-info-log = "true";
-      };
-      cookie.refresh = "12h";
-      # setXauthrequest = true;
-    };
-
-    services.nginx.virtualHosts."sso-proxy.joshuabell.xyz" = {
-      addSSL = true;
-      sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-      sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-      locations = {
-        "/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://127.0.0.1:4180";
-          extraConfig = ''
-            proxy_set_header X-Forwarded-Proto https;
-          '';
-        };
-      };
-    };
-  };
-}
diff --git a/hosts/h001/mods/openbao.nix b/hosts/h001/mods/openbao.nix
deleted file mode 100644
index 78e3bd5..0000000
--- a/hosts/h001/mods/openbao.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  services.nginx = {
-    virtualHosts = {
-      "sec.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://localhost:8200";
-          recommendedProxySettings = true;
-        };
-      };
-    };
-  };
-
-  services.openbao = {
-    enable = true;
-    package = pkgs.openbao;
-
-    settings = {
-      ui = true;
-
-      listener.default = {
-        type = "tcp";
-        address = "127.0.0.1:8200";
-        tls_disable = true; # nginx will handle TLS
-      };
-
-      storage.file = {
-        path = "/var/lib/openbao";
-      };
-
-      # Disable mlock requirement for development
-      # In production, you may want to enable this
-      disable_mlock = true;
-    };
-  };
-
-  # Ensure the data directory exists with proper permissions
-  systemd.tmpfiles.rules = [
-    "d /var/lib/openbao 0700 openbao openbao - -"
-  ];
-
-  # Additional systemd service hardening
-  systemd.services.openbao = {
-    serviceConfig = {
-      # Security hardening
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ReadWritePaths = [ "/var/lib/openbao" ];
-
-      # Resource limits
-      LimitNOFILE = 65536;
-      LimitNPROC = 4096;
-    };
-  };
-}
diff --git a/hosts/h001/mods/openwebui.nix b/hosts/h001/mods/openwebui.nix
index f19f77e..68a03a4 100644
--- a/hosts/h001/mods/openwebui.nix
+++ b/hosts/h001/mods/openwebui.nix
@@ -1,32 +1,24 @@
 {
+  upkgs,
   inputs,
   config,
-  lib,
   ...
 }:
-let
-  declaration = "services/misc/open-webui.nix";
-  nixpkgs = inputs.open-webui-nixpkgs;
-  pkgs = import nixpkgs {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
-in
 {
-  disabledModules = [ declaration ];
-  imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
+  # Use unstable services
+  disabledModules = [
+    "services/misc/open-webui.nix"
+    "services/misc/litellm.nix"
+  ];
+  imports = [
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/misc/open-webui.nix"
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/misc/litellm.nix"
+  ];
+
   options = { };
-  config = lib.mkIf (hasSecret "openwebui_env") {
+  config = {
+
     services.nginx.virtualHosts."chat.joshuabell.xyz" = {
-      addSSL = true;
-      sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-      sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
       locations = {
         "/" = {
           proxyWebsockets = true;
@@ -44,7 +36,7 @@ in
       port = 8084;
       host = "127.0.0.1";
       openFirewall = false;
-      package = pkgs.open-webui;
+      package = upkgs.open-webui;
       environmentFile = config.age.secrets.openwebui_env.path;
       environment = {
         # Declarative config, we don't use admin panel for anything
@@ -75,8 +67,84 @@ in
         OAUTH_ADMIN_ROLES = "admin";
         # OAUTH_PICTURE_CLAIM = "picture";
         # OAUTH_UPDATE_PICTURE_ON_LOGIN = "True";
+      };
+    };
 
-        BYPASS_MODEL_ACCESS_CONTROL="True";
+    services.litellm = {
+      enable = true;
+      port = 8094;
+      openFirewall = false;
+      package = upkgs.litellm;
+      environment = {
+        SCARF_NO_ANALYTICS = "True";
+        DO_NOT_TRACK = "True";
+        ANONYMIZED_TELEMETRY = "False";
+        GITHUB_COPILOT_TOKEN_DIR = "/var/lib/litellm/github_copilot";
+        XDG_CONFIG_HOME = "/var/lib/litellm/.config";
+      };
+      settings = {
+        model_list = [
+          # existing
+          {
+            model_name = "GPT-5";
+            litellm_params = {
+              model = "azure/gpt-5-2025-08-07";
+              api_base = "http://100.64.0.8:9001";
+              api_version = "2025-04-01-preview";
+              api_key = "na";
+            };
+          }
+          {
+            model_name = "GPT-5-mini";
+            litellm_params = {
+              model = "azure/gpt-5-mini-2025-08-07";
+              api_base = "http://100.64.0.8:9001";
+              api_version = "2025-04-01-preview";
+              api_key = "na";
+            };
+          }
+          {
+            model_name = "GPT-4.1";
+            litellm_params = {
+              model = "azure/gpt-4.1-2025-04-14";
+              api_base = "http://100.64.0.8:9001";
+              api_version = "2025-04-01-preview";
+              api_key = "na";
+            };
+          }
+          {
+            model_name = "GPT-4.1-mini";
+            litellm_params = {
+              model = "azure/gpt-4.1-mini-2025-04-14";
+              api_base = "http://100.64.0.8:9001";
+              api_version = "2025-04-01-preview";
+              api_key = "na";
+            };
+          }
+          {
+            model_name = "GPT-4o";
+            litellm_params = {
+              model = "azure/gpt-4o-2024-05-13";
+              api_base = "http://100.64.0.8:9001";
+              api_version = "2025-04-01-preview";
+              api_key = "na";
+            };
+          }
+
+          # Copilot
+          {
+            model_name = "copilot-claude-sonnet-4";
+            litellm_params = {
+              model = "github_copilot/claude-sonnet-4";
+              extra_headers = {
+                "editor-version" = "vscode/1.85.1";
+                "Copilot-Integration-Id" = "vscode-chat";
+                "user-agent" = "GithubCopilot/1.155.0";
+                "editor-plugin-version" = "copilot/1.155.0";
+              };
+            };
+          }
+        ];
       };
     };
   };
diff --git a/hosts/h001/mods/pinchflat.nix b/hosts/h001/mods/pinchflat.nix
index abd3183..8690b69 100644
--- a/hosts/h001/mods/pinchflat.nix
+++ b/hosts/h001/mods/pinchflat.nix
@@ -1,22 +1,10 @@
 {
   lib,
-  inputs,
   ...
 }:
-let
-  declaration = "services/misc/pinchflat.nix";
-  nixpkgs = inputs.pinchflat-nixpkgs;
-  pkgs = import nixpkgs {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
-in
 {
-  disabledModules = [ declaration ];
-  imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
   config = {
     services.pinchflat = {
-      package = pkgs.pinchflat;
       enable = true;
       port = 8945;
       selfhosted = true;
diff --git a/hosts/h001/mods/postgresql.nix b/hosts/h001/mods/postgresql.nix
deleted file mode 100644
index 7397377..0000000
--- a/hosts/h001/mods/postgresql.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  config = {
-    services.postgresql = {
-      enable = true;
-      package = pkgs.postgresql_17.withJIT;
-      enableJIT = true;
-      authentication = ''
-        local all all trust
-        host all all 127.0.0.1/8 trust
-        host all all ::1/128 trust
-        host all all fc00::1/128 trust
-      '';
-    };
-
-    # Backup database
-    services.postgresqlBackup = {
-      enable = true;
-    };
-  };
-}
diff --git a/hosts/h001/mods/trilium.nix b/hosts/h001/mods/trilium.nix
deleted file mode 100644
index cc05344..0000000
--- a/hosts/h001/mods/trilium.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-{
-  inputs,
-  ...
-}:
-let
-  declaration = "services/web-apps/trilium.nix";
-  nixpkgs = inputs.trilium-nixpkgs;
-  pkgs = import nixpkgs {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
-in
-{
-  disabledModules = [ declaration ];
-  imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
-  config = {
-    services.trilium-server = {
-      enable = true;
-      package = pkgs.trilium-server;
-      port = 9111;
-      host = "127.0.0.1";
-      dataDir = "/var/lib/trilium";
-      # NOTE using oauth2-proxy for auth, ensure that is not removed below while keeping this on
-      noAuthentication = true;
-      instanceName = "joshuabell";
-    };
-
-    systemd.services.trilium-server.environment = {
-      TRILIUM_NO_UPLOAD_LIMIT = "true";
-
-      # TRILIUM_PUBLIC_URL = "https://notes.joshuabell.xyz";
-
-      # TODO this did not work... sad we use oauth2-proxy instead
-      # TRILIUM_OAUTH_BASE_URL = "https://notes.joshuabell.xyz";
-      # TRILIUM_OAUTH_CLIENT_ID = "REPLACE";
-      # TRILIUM_OAUTH_CLIENT_SECRET = "REPLACE";
-      # TRILIUM_OAUTH_ISSUER_BASE_URL = "https://sso.joshuabell.xyz/.well-known/openid-configuration";
-      # TRILIUM_OAUTH_ISSUER_NAME = "SSO";
-      # TRILIUM_OAUTH_ISSUER_ICON = "https://cdn.jsdelivr.net/gh/selfhst/icons/svg/zitadel.svg";
-    };
-
-    services.oauth2-proxy.nginx.virtualHosts."notes.joshuabell.xyz" = {
-      allowed_groups = [ "notes" ];
-    };
-    services.nginx.virtualHosts = {
-      "notes.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations = {
-          "/" = {
-            proxyWebsockets = true;
-            proxyPass = "http://127.0.0.1:9111";
-          };
-        };
-      };
-      "blog.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations = {
-          "/share" = {
-            proxyWebsockets = true;
-            proxyPass = "http://127.0.0.1:9111";
-            extraConfig = ''
-              auth_request off;
-            '';
-          };
-          "/assets" = {
-            proxyPass = "http://127.0.0.1:9111";
-            extraConfig = ''
-              auth_request off;
-            '';
-          };
-        };
-      };
-      # TODO revisit, am I going to use the native app or web version
-      # this is only needed for the app that can't handle the oauth flow
-      "trilium_overlay" = {
-        serverName = "h001.net.joshuabell.xyz";
-        listen = [
-          {
-            port = 9112;
-            addr = "100.64.0.13";
-          }
-        ];
-        locations = {
-          "/" = {
-            proxyWebsockets = true;
-            recommendedProxySettings = true;
-            proxyPass = "http://127.0.0.1:9111";
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/hosts/h001/mods/vault.nix b/hosts/h001/mods/vault.nix
deleted file mode 100644
index 1645503..0000000
--- a/hosts/h001/mods/vault.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  services.nginx = {
-    virtualHosts = {
-      "sec.joshuabell.xyz" = {
-        addSSL = true;
-        sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-        sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://localhost:8200";
-          recommendedProxySettings = true;
-        };
-      };
-    };
-  };
-
-  services.vault = {
-    enable = true;
-    dev = true; # trying it out... remove
-    address = "127.0.0.1:8200";
-    storagePath = "/var/lib/hashi_vault";
-
-     };
-
-  # Ensure the data directory exists with proper permissions
-  systemd.tmpfiles.rules = [
-    "d /var/lib/hashi_vault 0700 vault vault - -"
-  ];
-
-  # Additional systemd service hardening
-  # systemd.services.openbao = {
-  #   serviceConfig = {
-  #     # Security hardening
-  #     NoNewPrivileges = true;
-  #     PrivateTmp = true;
-  #     ProtectSystem = "strict";
-  #     ProtectHome = true;
-  #     ReadWritePaths = [ "/var/lib/openbao" ];
-  #
-  #     # Resource limits
-  #     LimitNOFILE = 65536;
-  #     LimitNPROC = 4096;
-  #   };
-  # };
-}
diff --git a/hosts/h001/nginx.nix b/hosts/h001/nginx.nix
index 530fe30..1095170 100644
--- a/hosts/h001/nginx.nix
+++ b/hosts/h001/nginx.nix
@@ -1,6 +1,4 @@
 {
-  config,
-  lib,
   ...
 }:
 let
@@ -8,72 +6,34 @@ let
     proxyWebsockets = true;
     proxyPass = "http://localhost:7575";
   };
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
 in
 {
-  # TODO transfer these to o001 to use same certs?
-  # Will I ever get rate limited by lets encrypt with both doing their own?
-  security.acme = lib.mkIf (hasSecret "linode_rw_domains") {
-    acceptTerms = true;
-    defaults.email = "admin@joshuabell.xyz";
-    certs."joshuabell.xyz" = {
-      domain = "joshuabell.xyz";
-      extraDomainNames = [ "*.joshuabell.xyz" ];
-      credentialFiles = {
-        LINODE_TOKEN_FILE = config.age.secrets.linode_rw_domains.path;
+  services.nginx.virtualHosts = {
+    "10.12.14.10" = {
+      locations = {
+        "/" = {
+          return = "301 http://h001.local.joshuabell.xyz";
+        };
       };
-      dnsProvider = "linode";
-      group = "nginx";
     };
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    clientMaxBodySize = "500m";
-    virtualHosts = {
-      "10.12.14.10" = {
-        locations = {
-          "/" = {
-            return = "301 http://h001.local.joshuabell.xyz";
-          };
-        };
+    "h001.local.joshuabell.xyz" = {
+      locations = {
+        "/" = homarr;
       };
-      "h001.local.joshuabell.xyz" = {
-        locations = {
-          "/" = homarr;
-        };
+    };
+    "100.64.0.13" = {
+      locations."/" = {
+        return = "301 http://h001.net.joshuabell.xyz";
       };
-      "100.64.0.13" = {
-        locations."/" = {
-          return = "301 http://h001.net.joshuabell.xyz";
-        };
-      };
-      "h001.net.joshuabell.xyz" = {
-        locations = {
-          "/grafana/" = {
-            proxyPass = "http://localhost:3001";
-            proxyWebsockets = true;
-            recommendedProxySettings = true;
-          };
-          "/" = homarr;
-        };
-      };
-
-      "_" = {
-        rejectSSL = true;
-        default = true;
-        locations."/" = {
-          return = "444"; # 404 for not found or 444 for drop
+    };
+    "h001.net.joshuabell.xyz" = {
+      locations = {
+        "/grafana/" = {
+          proxyPass = "http://localhost:3001";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
         };
+        "/" = homarr;
       };
     };
   };
diff --git a/hosts/h001/readme.md b/hosts/h001/readme.md
new file mode 100644
index 0000000..0758f91
--- /dev/null
+++ b/hosts/h001/readme.md
@@ -0,0 +1 @@
+Main media server and run things server, has a bunch of stuff on it I am self hosting
diff --git a/hosts/h003/configuration.nix b/hosts/h003/configuration.nix
new file mode 100644
index 0000000..eb65bdf
--- /dev/null
+++ b/hosts/h003/configuration.nix
@@ -0,0 +1,6 @@
+{
+  ...
+}:
+{
+  system.stateVersion = "25.05"; # Did you read the comment?
+}
diff --git a/hosts/h003/flake.lock b/hosts/h003/flake.lock
index f94a90b..ddd5a37 100644
--- a/hosts/h003/flake.lock
+++ b/hosts/h003/flake.lock
@@ -5,7 +5,7 @@
         "darwin": "darwin",
         "home-manager": "home-manager_2",
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ],
@@ -26,18 +26,22 @@
       }
     },
     "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "nixpkgs": "nixpkgs_2",
+        "ragenix": "ragenix"
+      },
       "locked": {
-        "dir": "flakes/common",
-        "lastModified": 1762754048,
-        "narHash": "sha256-XZetYIpgMSfez/QdfcZmsEidmnufd6dJVD7VTwd8vDY=",
+        "lastModified": 1755746476,
+        "narHash": "sha256-dLpj8mNfGAjjbcVPzYW5wSIvNUBDReCVlSmm61ypZWs=",
         "ref": "refs/heads/master",
-        "rev": "023f3b5e1807113a16a5fe22dbf7a2c0981b7f99",
-        "revCount": 765,
+        "rev": "8b49688deb12ee65ed17e9432c66975d70c91d49",
+        "revCount": 607,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       },
       "original": {
-        "dir": "flakes/common",
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       }
@@ -60,7 +64,7 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -104,11 +108,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1753592768,
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
@@ -121,7 +125,7 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -141,6 +145,22 @@
         "type": "github"
       }
     },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1753345091,
@@ -159,36 +179,21 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1762498405,
-        "narHash": "sha256-Zg/SCgCaAioc0/SVZQJxuECGPJy+OAeBcGeA5okdYDc=",
+        "lastModified": 1753694789,
+        "narHash": "sha256-cKgvtz6fKuK1Xr5LQW/zOUiAC0oSQoA9nOISB0pJZqM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6faeb062ee4cf4f105989d490831713cc5a43ee1",
+        "rev": "dc9637876d0dcc8c9e5e22986b857632effeb727",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1761619080,
-        "narHash": "sha256-PsLFmU/CORWeCjJi9ALsegwr/SMjf2gHsooTR09az4c=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "fd644bba1d3a83169e4b312ce20928ba1b0abb02",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
       "locked": {
         "lastModified": 1741379970,
         "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
@@ -204,6 +209,37 @@
         "type": "github"
       }
     },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1755704039,
+        "narHash": "sha256-gKlP0LbyJ3qX0KObfIWcp5nbuHSb5EHwIvU6UcNBg2A=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "9cb344e96d5b6918e94e1bca2d9f3ea1e9615545",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1755648324,
+        "narHash": "sha256-+2TxwJEXWXGC7JBsRGUHtmQ66lRGPcDI2kFKTTU5e2s=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "226bb7c9df5f953fd7533e199b8d9e5475458a8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nvim_plugin-Almo7aya/openingh.nvim": {
       "flake": false,
       "locked": {
@@ -223,11 +259,11 @@
     "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761323006,
-        "narHash": "sha256-6BjkqZCo2DLVxW6BHyElt2cZdG6Dhzao8hPfWYm0sIQ=",
+        "lastModified": 1755636100,
+        "narHash": "sha256-EeU6AfMISnXUmKdNHXN35srj+fuQiHoWx5uYRKCjsTE=",
         "owner": "CopilotC-Nvim",
         "repo": "CopilotChat.nvim",
-        "rev": "a7138a0ee04d8af42c262554eccee168bbf1454f",
+        "rev": "f7bb32dbbe2ff5e26f5033e2142b5920cf427236",
         "type": "github"
       },
       "original": {
@@ -255,11 +291,11 @@
     "nvim_plugin-L3MON4D3/LuaSnip": {
       "flake": false,
       "locked": {
-        "lastModified": 1761039842,
-        "narHash": "sha256-ovvtTZgqL6MFvuI3byx+boWm6ErZX06+v6a3VoctREc=",
+        "lastModified": 1754037237,
+        "narHash": "sha256-JhTqTGQfIryJ7MElcOGOfb48uaNDnd9RM9Fl1Fs4QV0=",
         "owner": "L3MON4D3",
         "repo": "LuaSnip",
-        "rev": "ccf25a5452b8697a823de3e5ecda63ed3d723b79",
+        "rev": "de10d8414235b0a8cabfeba60d07c24304e71f5c",
         "type": "github"
       },
       "original": {
@@ -271,11 +307,11 @@
     "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343950,
-        "narHash": "sha256-HycEAgAsU8IxFiYfyp5ZGN+z6wYyCarIESxA9TDuJ3s=",
+        "lastModified": 1755631821,
+        "narHash": "sha256-+/GVSb3uQ5HktPv6HFwdywX85hScsAI1IHqXmwDH9PU=",
         "owner": "MeanderingProgrammer",
         "repo": "render-markdown.nvim",
-        "rev": "bfd67f1402b97ac619cb538f4bbaed12a7fa89aa",
+        "rev": "0087ee1d505d4fc4886d8d3121ae7848b7c0e49b",
         "type": "github"
       },
       "original": {
@@ -319,11 +355,11 @@
     "nvim_plugin-Saecki/crates.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1755956579,
-        "narHash": "sha256-jfmST/S9ymwgQ99PTCOlJkk5zaxE5HiDV16TmTISDII=",
+        "lastModified": 1754466592,
+        "narHash": "sha256-b40E121rJrEmlor3fHmh4Y1TXKdfiqsBGBcpbY//eTw=",
         "owner": "Saecki",
         "repo": "crates.nvim",
-        "rev": "ac9fa498a9edb96dc3056724ff69d5f40b898453",
+        "rev": "a49df0f70171adc77704eac70dd2c0d179065933",
         "type": "github"
       },
       "original": {
@@ -335,11 +371,11 @@
     "nvim_plugin-aznhe21/actions-preview.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759462626,
-        "narHash": "sha256-YUeWBXxxeurfWBi0PjUi6izqYAvUw9DHmvsuPXm7ohw=",
+        "lastModified": 1745779150,
+        "narHash": "sha256-rQjwlu5gQcOvxF72lr9ugPRl0W78wCWGWPhpN1oOMbs=",
         "owner": "aznhe21",
         "repo": "actions-preview.nvim",
-        "rev": "cb938c25edaac38d362555f19244a9cb85d561e8",
+        "rev": "36513ad213855d497b7dd3391a24d1d75d58e36f",
         "type": "github"
       },
       "original": {
@@ -351,11 +387,11 @@
     "nvim_plugin-b0o/schemastore.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343239,
-        "narHash": "sha256-obGnux+K0blHROEOAy7Ct18vxiO4Qez8XJB5l23KgMs=",
+        "lastModified": 1755594039,
+        "narHash": "sha256-XU+PtvXlgoHFouyyceUIZ4L5AvZThUR2AegmCQAYt1A=",
         "owner": "b0o",
         "repo": "schemastore.nvim",
-        "rev": "4341619da06779ae310ee9c3d6d70edfefed7152",
+        "rev": "e906ac3ed0bd273781759e7635b5b824393c925c",
         "type": "github"
       },
       "original": {
@@ -367,11 +403,11 @@
     "nvim_plugin-catppuccin/nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761396780,
-        "narHash": "sha256-Nz/XbItShbrnKtj0+gcEDBFO5y00g0EG5CHqdJGK2j0=",
+        "lastModified": 1755621274,
+        "narHash": "sha256-o8VLMPriOh4+Ay5Ff0cWQYXjmihdr3x9131bKHHTsQE=",
         "owner": "catppuccin",
         "repo": "nvim",
-        "rev": "8c4125e3c746976ba025dc5d908fa22c6aa09486",
+        "rev": "30fa4d122d9b22ad8b2e0ab1b533c8c26c4dde86",
         "type": "github"
       },
       "original": {
@@ -383,11 +419,11 @@
     "nvim_plugin-chrisgrieser/nvim-early-retirement": {
       "flake": false,
       "locked": {
-        "lastModified": 1760385962,
-        "narHash": "sha256-PtpD6Uc4GK4dSJynWH5d6c7XOWXfYODXJ3FyOY1eZNo=",
+        "lastModified": 1755590055,
+        "narHash": "sha256-989Zf6SCy+vakFac4KmElUn8+ErJMtYJ8zlOi999UJI=",
         "owner": "chrisgrieser",
         "repo": "nvim-early-retirement",
-        "rev": "9109589b542773c9ad2a34067a085874f255577b",
+        "rev": "ef9fc0267da4204432ab7bf3ab9df359874cfeb6",
         "type": "github"
       },
       "original": {
@@ -415,11 +451,11 @@
     "nvim_plugin-folke/lazy.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761488113,
-        "narHash": "sha256-jBmtFzzdGYe3N3kvWHvR7FGXtA+/t36efxsAqhLmaxU=",
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
         "owner": "folke",
         "repo": "lazy.nvim",
-        "rev": "ed4dc336a73c18da6fea6e1cf7ad6e1b76d281eb",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
         "type": "github"
       },
       "original": {
@@ -447,11 +483,11 @@
     "nvim_plugin-folke/which-key.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759952076,
-        "narHash": "sha256-N31+V5L0gd+TUo9nVtNGRmMVmM9fMxOwldCfuLYT4hU=",
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
         "owner": "folke",
         "repo": "which-key.nvim",
-        "rev": "b4177e3eaf15fe5eb8357ebac2286d488be1ed00",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
         "type": "github"
       },
       "original": {
@@ -511,11 +547,11 @@
     "nvim_plugin-hrsh7th/nvim-cmp": {
       "flake": false,
       "locked": {
-        "lastModified": 1760792454,
-        "narHash": "sha256-wkESSNUViVI5DE+3t4AVTaSLQ/hTB43vrm+PH6uA8H4=",
+        "lastModified": 1744514599,
+        "narHash": "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=",
         "owner": "hrsh7th",
         "repo": "nvim-cmp",
-        "rev": "a7bcf1d88069fc67c9ace8a62ba480b8fe879025",
+        "rev": "b5311ab3ed9c846b585c0c15b7559be131ec4be9",
         "type": "github"
       },
       "original": {
@@ -527,11 +563,11 @@
     "nvim_plugin-j-hui/fidget.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761243883,
-        "narHash": "sha256-XXTeJweQRIsC/WFhFxFbepOETV8e5Wfmh513su2Wve0=",
+        "lastModified": 1755048367,
+        "narHash": "sha256-Hcnbk6go2vYCYqSfXLWQ+KimpU+NPbIkjBTKGMFoNQM=",
         "owner": "j-hui",
         "repo": "fidget.nvim",
-        "rev": "e32b672d8fd343f9d6a76944fedb8c61d7d8111a",
+        "rev": "2cb5edb2dd6700a958a446b20bb2be04d318da9d",
         "type": "github"
       },
       "original": {
@@ -559,11 +595,11 @@
     "nvim_plugin-lewis6991/gitsigns.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760888451,
-        "narHash": "sha256-eGpB7YYWbyCCGYXEYAM432srSp/lUo5C1b0J3OYjwnY=",
+        "lastModified": 1755014582,
+        "narHash": "sha256-zBUrqL+00Y8j4eVNAgI0nYn2i35zhQo2BVl4mL1cgfs=",
         "owner": "lewis6991",
         "repo": "gitsigns.nvim",
-        "rev": "20ad4419564d6e22b189f6738116b38871082332",
+        "rev": "6e3c66548035e50db7bd8e360a29aec6620c3641",
         "type": "github"
       },
       "original": {
@@ -607,11 +643,11 @@
     "nvim_plugin-m4xshen/hardtime.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1757738091,
-        "narHash": "sha256-Jy9ARUHU1ySpSxxoS3hLRjxp5Lqt7juWN5Jnbdo0rg0=",
+        "lastModified": 1753760289,
+        "narHash": "sha256-BgJ0gKy/zxU82L7WocXLkXwD97pnCvpGyJVzSHeUtG0=",
         "owner": "m4xshen",
         "repo": "hardtime.nvim",
-        "rev": "b4e431934af1fe224a3a801f632c008278cb7628",
+        "rev": "6d7664d5bdfaea44c5f50b29f5239fab7b00c273",
         "type": "github"
       },
       "original": {
@@ -623,11 +659,11 @@
     "nvim_plugin-mbbill/undotree": {
       "flake": false,
       "locked": {
-        "lastModified": 1759186837,
-        "narHash": "sha256-EWOH08KAWyoT9m45/B1d5aKQQJtd3k4orJbagVsxe08=",
+        "lastModified": 1752437854,
+        "narHash": "sha256-5WofUOTYE+Nmx3A5OoZBneJBHZ8bdGEYDZ6vTMx1OE0=",
         "owner": "mbbill",
         "repo": "undotree",
-        "rev": "0f1c9816975b5d7f87d5003a19c53c6fd2ff6f7f",
+        "rev": "28f2f54a34baff90ea6f4a735ef1813ad875c743",
         "type": "github"
       },
       "original": {
@@ -639,11 +675,11 @@
     "nvim_plugin-mfussenegger/nvim-lint": {
       "flake": false,
       "locked": {
-        "lastModified": 1759852544,
-        "narHash": "sha256-wVEX0lCxeipvwCfdd2JbQwnhgg6UrTXixC8E1OiEblI=",
+        "lastModified": 1753951521,
+        "narHash": "sha256-GmXScmbXJx74RMgPhkdKtdODZqkOarFHE1XOiSnt5Bo=",
         "owner": "mfussenegger",
         "repo": "nvim-lint",
-        "rev": "9da1fb942dd0668d5182f9c8dee801b9c190e2bb",
+        "rev": "7ef127aaede2a4d5ad8df8321e2eb4e567f29594",
         "type": "github"
       },
       "original": {
@@ -655,11 +691,11 @@
     "nvim_plugin-mrcjkb/rustaceanvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761585884,
-        "narHash": "sha256-m/gd+cb7X2a7R6JSbHes0QjGs+zuj4698Qyi/OW0R1g=",
+        "lastModified": 1755599388,
+        "narHash": "sha256-4o20Hf+rFD2zejPZr5oe3ZkaynW3xAw/wtbF3sMjNnQ=",
         "owner": "mrcjkb",
         "repo": "rustaceanvim",
-        "rev": "be0d1d14b8504c1c0965b608dc7ed39f2d588c91",
+        "rev": "eb9beab7d80eb052f78165b28d18f55844b26aef",
         "type": "github"
       },
       "original": {
@@ -671,11 +707,11 @@
     "nvim_plugin-neovim/nvim-lspconfig": {
       "flake": false,
       "locked": {
-        "lastModified": 1761605346,
-        "narHash": "sha256-3Aulaw6KMmrcoQQxhRhQhjZ2fg6MSU4Q7qAWtrVsOcA=",
+        "lastModified": 1755617152,
+        "narHash": "sha256-PSu5zQi/rzBAnALX8WrYckhqM5lI6hGAhsWWgS7ln7A=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "2b52bc2190c8efde2e4de02d829a138666774c7c",
+        "rev": "5f1c9a90c8db9c647da40ce6cf5be9e49ccbf0c7",
         "type": "github"
       },
       "original": {
@@ -684,6 +720,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755623332,
+        "narHash": "sha256-hnTDzd3eRsDUYYf9WPknYZ126d0XKXO1hjlY7WH4bDI=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "8ab43934caea0eacc986d112e5680c316b8a7944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-numToStr/Comment.nvim": {
       "flake": false,
       "locked": {
@@ -719,11 +771,11 @@
     "nvim_plugin-nvim-lualine/lualine.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760596863,
-        "narHash": "sha256-hdrAdG3hC2sAevQ6a9xizqPgEgnNKxuc5rBYn0pKM1c=",
+        "lastModified": 1754970649,
+        "narHash": "sha256-lWt2kpW+hsTMWt8tar/+AISTDrIt4Jn27NmI9j+Xt4s=",
         "owner": "nvim-lualine",
         "repo": "lualine.nvim",
-        "rev": "3946f0122255bc377d14a59b27b609fb3ab25768",
+        "rev": "b8c23159c0161f4b89196f74ee3a6d02cdc3a955",
         "type": "github"
       },
       "original": {
@@ -799,11 +851,11 @@
     "nvim_plugin-nvim-tree/nvim-tree.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1760921408,
-        "narHash": "sha256-QCUp/6qX/FS8LrZ6K+pvC/mHkYW8xfzQZEB2y0VOStQ=",
+        "lastModified": 1755174669,
+        "narHash": "sha256-Cdd7m2ondica5yDgm8THEm8LttJwDWQTNPnKO4vKr2c=",
         "owner": "nvim-tree",
         "repo": "nvim-tree.lua",
-        "rev": "64e2192f5250796aa4a7f33c6ad888515af50640",
+        "rev": "f0e9951778802526b14c934f7bf746e1e0ae5ed0",
         "type": "github"
       },
       "original": {
@@ -815,11 +867,11 @@
     "nvim_plugin-nvim-tree/nvim-web-devicons": {
       "flake": false,
       "locked": {
-        "lastModified": 1761440007,
-        "narHash": "sha256-klBjUtj0AvarN5a6O8Hh2t5BuOTe/m3ps2cHnlxVJvE=",
+        "lastModified": 1754884337,
+        "narHash": "sha256-Zftd4xFYdCtof6IusN+E079yY2oMTNhJ/yznvLiiur0=",
         "owner": "nvim-tree",
         "repo": "nvim-web-devicons",
-        "rev": "8dcb311b0c92d460fac00eac706abd43d94d68af",
+        "rev": "c2599a81ecabaae07c49ff9b45dcd032a8d90f1a",
         "type": "github"
       },
       "original": {
@@ -831,11 +883,11 @@
     "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
       "flake": false,
       "locked": {
-        "lastModified": 1761077440,
-        "narHash": "sha256-QdZstxKsEILwe7eUZCmMdyLPyvNKc/e7cfdYQowHWPQ=",
+        "lastModified": 1754488703,
+        "narHash": "sha256-f4a9Abwb265Rm+hpUXz+rKWXvaFVrmXf1h7d7eh9jJc=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter-context",
-        "rev": "ec308c7827b5f8cb2dd0ad303a059c945dd21969",
+        "rev": "dca8726fea2c14e1ce6adbaa76a04816fbfaff61",
         "type": "github"
       },
       "original": {
@@ -863,11 +915,11 @@
     "nvim_plugin-rcarriga/nvim-notify": {
       "flake": false,
       "locked": {
-        "lastModified": 1757190131,
-        "narHash": "sha256-h7STMjY+CBTqBkIDJXgtJz4WhNeQ02ES2Jesi3jZXeM=",
+        "lastModified": 1753086914,
+        "narHash": "sha256-uQBB3fajHowivArxbtmEJvVU3+QO0VApYpVNMA58UkI=",
         "owner": "rcarriga",
         "repo": "nvim-notify",
-        "rev": "8701bece920b38ea289b457f902e2ad184131a5d",
+        "rev": "397c7c1184745fca649e5104de659e6392ef5a4d",
         "type": "github"
       },
       "original": {
@@ -879,11 +931,11 @@
     "nvim_plugin-rmagatti/auto-session": {
       "flake": false,
       "locked": {
-        "lastModified": 1761491368,
-        "narHash": "sha256-F2MtkBCVAObRwniSvFjv5MmYnCaj1YSUf0Nk5MF1F4Y=",
+        "lastModified": 1755285297,
+        "narHash": "sha256-x8oPN7JqcY0scFO0vGREerT3dRiQA+k/qeWsug1sGiU=",
         "owner": "rmagatti",
         "repo": "auto-session",
-        "rev": "f0eb3d69848389869572b82b336d7a6887e88e43",
+        "rev": "d27a29f5754e3a8b8d89a4069814e53ac583e951",
         "type": "github"
       },
       "original": {
@@ -892,7 +944,7 @@
         "type": "github"
       }
     },
-    "nvim_plugin-ron-rs/ron.vim": {
+    "nvim_plugin-ron/ron.vim": {
       "flake": false,
       "locked": {
         "lastModified": 1660904719,
@@ -943,11 +995,11 @@
     "nvim_plugin-stevearc/conform.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761160784,
-        "narHash": "sha256-yUUDxYuIjbFHUscEKpFV6IaraDNOA4hdcGljPHG/+sU=",
+        "lastModified": 1755640282,
+        "narHash": "sha256-WYGvppnMsBaVYnMmv9WJRuKuyk4F/rzJ3DRBh+72tRY=",
         "owner": "stevearc",
         "repo": "conform.nvim",
-        "rev": "9fd3d5e0b689ec1bf400c53cbbec72c6fdf24081",
+        "rev": "04bfa5f35706410376bf7618a01fcf44e3f35b59",
         "type": "github"
       },
       "original": {
@@ -1023,11 +1075,11 @@
     "nvim_plugin-windwp/nvim-ts-autotag": {
       "flake": false,
       "locked": {
-        "lastModified": 1757545454,
-        "narHash": "sha256-nT2W5gKFEfzP7MztLjm7yqwam3ADk0svcMdLg2nmI/4=",
+        "lastModified": 1739910276,
+        "narHash": "sha256-a3Bcql68mp3y5bH9XMiDTQB0e75T+qFB593objIGg/I=",
         "owner": "windwp",
         "repo": "nvim-ts-autotag",
-        "rev": "c4ca798ab95b316a768d51eaaaee48f64a4a46bc",
+        "rev": "a1d526af391f6aebb25a8795cbc05351ed3620b5",
         "type": "github"
       },
       "original": {
@@ -1055,11 +1107,11 @@
     "nvim_plugin-zbirenbaum/copilot.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1761595323,
-        "narHash": "sha256-KkiU2xmpfIbpuijvcXDw+LWKWuBgxjwY7jEQIasN5Kw=",
+        "lastModified": 1755448417,
+        "narHash": "sha256-KV+Wno4aB5uTSBxIZzQKC/0KfjQLM7x8wCDkVSnaPeA=",
         "owner": "zbirenbaum",
         "repo": "copilot.lua",
-        "rev": "93adf9844dcbe09a37e7a72eaa286d33d38bf628",
+        "rev": "3fd7b50810ae4cccf8b38e4c509b1608f141a9e9",
         "type": "github"
       },
       "original": {
@@ -1073,8 +1125,8 @@
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_4",
-        "rust-overlay": "rust-overlay_2"
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1744897914,
@@ -1093,15 +1145,13 @@
     "root": {
       "inputs": {
         "common": "common",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
-        "ros_neovim": "ros_neovim",
-        "secrets": "secrets"
+        "nixpkgs": "nixpkgs_4",
+        "ros_neovim": "ros_neovim"
       }
     },
     "ros_neovim": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_5",
         "nvim_plugin-Almo7aya/openingh.nvim": "nvim_plugin-Almo7aya/openingh.nvim",
         "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim",
         "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring",
@@ -1132,6 +1182,7 @@
         "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
         "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
         "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
         "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
         "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
         "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
@@ -1145,7 +1196,7 @@
         "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
         "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
         "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
-        "nvim_plugin-ron-rs/ron.vim": "nvim_plugin-ron-rs/ron.vim",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
         "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
         "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
         "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
@@ -1156,14 +1207,14 @@
         "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
         "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
         "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1761712156,
-        "narHash": "sha256-4vU7FPZFXSFguQUIPrbLQOk3VSokp6RH8t7zQoqneow=",
+        "lastModified": 1755648539,
+        "narHash": "sha256-zElmY3ieHOxJtn5Q3KKXZw3i6/e63jRtHowzOM4jERw=",
         "ref": "refs/heads/master",
-        "rev": "04f666dabbaced8d661693cfbe4eb7efa359ce7d",
-        "revCount": 320,
+        "rev": "1f8444ad78e85c902818ab48479f3f3a1e909031",
+        "revCount": 300,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/nvim"
       },
@@ -1175,28 +1226,7 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "ros_neovim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761619008,
-        "narHash": "sha256-vp97eNmi5GG/+jlvnBpmG6EVO2F1+nqMQFF9GT2TIQg=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "7bc7d2f706ebe5479d230d2c6806b5dc757ae4cd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ]
@@ -1215,24 +1245,25 @@
         "type": "github"
       }
     },
-    "secrets": {
+    "rust-overlay_2": {
       "inputs": {
-        "ragenix": "ragenix"
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "dir": "flakes/secrets",
-        "lastModified": 1762754048,
-        "narHash": "sha256-XZetYIpgMSfez/QdfcZmsEidmnufd6dJVD7VTwd8vDY=",
-        "ref": "refs/heads/master",
-        "rev": "023f3b5e1807113a16a5fe22dbf7a2c0981b7f99",
-        "revCount": 765,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1755571033,
+        "narHash": "sha256-V8gmZBfMiFGCyGJQx/yO81LFJ4d/I5Jxs2id96rLxrM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "95487740bb7ac11553445e9249041a6fa4b5eccf",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/secrets",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
diff --git a/hosts/h003/flake.nix b/hosts/h003/flake.nix
index 5bf81ea..1d93336 100644
--- a/hosts/h003/flake.nix
+++ b/hosts/h003/flake.nix
@@ -1,13 +1,10 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
 
     # Use relative to get current version for testing
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
+    # common.url = "path:../../common";
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
 
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
   };
@@ -15,108 +12,89 @@
   outputs =
     {
       nixpkgs,
-      home-manager,
       common,
-      secrets,
       ros_neovim,
       ...
-    }@inputs:
+    }:
     let
       configuration_name = "h003";
-      system = "x86_64-linux";
-      stateVersion = "25.05";
-      primaryUser = "luser";
       lib = nixpkgs.lib;
     in
     {
       nixosConfigurations = {
         "${configuration_name}" = (
           lib.nixosSystem {
-            inherit system;
-            specialArgs = {
-              inherit inputs;
-            };
             modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
+              common.nixosModules.default
               ros_neovim.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.boot_systemd
-              common.nixosModules.hardening
-              common.nixosModules.nix_options
-              common.nixosModules.podman
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-
+              ./configuration.nix
               ./hardware-configuration.nix
               ./mods
               (
                 { config, pkgs, ... }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      shell = pkgs.zsh;
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "video"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
-                      ];
-                    };
-                    root = {
-                      shell = pkgs.zsh;
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
-                      ];
-                    };
-                  };
-
+                {
                   environment.systemPackages = with pkgs; [
                     lua
                     sqlite
-                    ttyd
+                    # networking tools
                     tcpdump
                     dig
                   ];
+
+                  ringofstorms_common = {
+                    systemName = configuration_name;
+                    boot.systemd.enable = true;
+                    secrets.enable = true;
+                    general = {
+                      reporting.enable = true;
+                    };
+                    programs = {
+                      tailnet.enable = true;
+                      ssh.enable = true;
+                      podman.enable = true;
+                    };
+                    users = {
+                      admins = [ "luser" ]; # First admin is also the primary user owning nix config
+                      users = {
+                        root = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                        luser = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
+                          ];
+                          extraGroups = [
+                            "networkmanager"
+                            "video"
+                            "input"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                      };
+                    };
+                    homeManager = {
+                      users = {
+                        luser = {
+                          imports = with common.homeManagerModules; [
+                            kitty
+                            tmux
+                            atuin
+                            direnv
+                            git
+                            nix_deprecations
+                            postgres
+                            ssh
+                            starship
+                            zoxide
+                            zsh
+                          ];
+                        };
+                      };
+                    };
+                  };
                 }
               )
             ];
diff --git a/hosts/h003/mods/networking.nix b/hosts/h003/mods/networking.nix
index 8294fdb..e07611e 100644
--- a/hosts/h003/mods/networking.nix
+++ b/hosts/h003/mods/networking.nix
@@ -6,18 +6,36 @@
 {
   networking = {
     # My Switch seems to not let me change management vlan so this is assume native default here for proper routing
+    # Configure bonding (LAG)
+    bonds = {
+      bond0 = {
+        interfaces = [
+          "enp1s0"
+          "enp2s0"
+        ];
+        driverOptions = {
+          # My shitty switch doesn't support this
+          # mode = "802.3ad"; # LACP
+          # lacp_rate = "fast";
+          mode = "balance-xor";
+          miimon = "100";
+        };
+      };
+    };
 
-    # Configure VLANs on the trunk interface (enp2s0)
+    # Configure VLANs on the bonded interface
     vlans = {
       vlan10 = {
-        # management
         id = 10;
-        interface = "enp2s0";
+        interface = "bond0";
       };
       vlan20 = {
-        # normal devices
         id = 20;
-        interface = "enp2s0";
+        interface = "bond0";
+      };
+      vlan30 = {
+        id = 30;
+        interface = "bond0";
       };
     };
 
@@ -26,8 +44,8 @@
 
     # Interface configuration
     interfaces = {
-      # WAN interface (physical enp1s0 - to modem)
-      enp1s0 = {
+      # WAN interface (VLAN 10 - to modem)
+      vlan10 = {
         useDHCP = true; # Get IP from modem/ISP
         tempAddress = lib.mkIf config.networking.enableIPv6 "disabled"; # For IPv6 privacy
       };
@@ -46,8 +64,8 @@
           }
         ];
       };
-      # Management VLAN 10
-      vlan10 = {
+      # Management VLAN 1
+      vlan30 = {
         ipv4.addresses = [
           {
             address = "10.12.16.1"; # Management network
@@ -66,10 +84,10 @@
     # NAT configuration
     nat = {
       enable = true;
-      externalInterface = "enp1s0"; # WAN (physical)
+      externalInterface = "vlan10"; # WAN
       internalInterfaces = [
-        "vlan10"
         "vlan20"
+        "vlan30"
       ]; # LAN/Management
       enableIPv6 = lib.mkIf config.networking.enableIPv6 true; # Enable IPv6 NAT
     };
@@ -90,11 +108,10 @@
 
         # --- Inter-VLAN Security ---
         # Block any NEW connection attempts between LAN and Management
-        iifname "vlan20" oifname "vlan10" drop
-        iifname "vlan10" oifname "vlan20" drop
+        iifname "vlan20" oifname "vlan30" drop
+        iifname "vlan30" oifname "vlan20" drop
 
         # Explicitly allow LAN and Management to go to the WAN
-        oifname "enp1s0" accept
         oifname "vlan10" accept
 
         # Drop any other forwarding attempts between internal networks
@@ -103,26 +120,12 @@
 
       interfaces = {
         # WAN interface - allow nothing inbound by default
-        enp1s0 = {
+        vlan10 = {
           # Block all WAN
           allowedTCPPorts = [ ];
           allowedUDPPorts = [ ];
         };
 
-        vlan10 = {
-          allowedTCPPorts = [
-            22 # SSH (for remote admin access)
-            53 # DNS
-            80
-            443 # HTTP
-          ];
-          allowedUDPPorts = [
-            53 # DNS
-            67 # DHCP server
-            68
-          ];
-        };
-
         # LAN interface (VLAN 20) - FULL SERVICE
         vlan20 = {
           allowedTCPPorts = [
@@ -137,6 +140,21 @@
             68 # DHCP client responses
           ];
         };
+
+        # Management interface (VLAN 1) - LIMITED SERVICE
+        vlan30 = {
+          allowedTCPPorts = [
+            22 # SSH (for remote admin access)
+            53 # DNS
+            80
+            443 # HTTP
+          ];
+          allowedUDPPorts = [
+            53 # DNS
+            67 # DHCP server
+            68
+          ];
+        };
       };
     };
 
@@ -157,8 +175,8 @@
     settings = {
       # Listen only on LAN interface
       interface = [
-        "vlan10"
         "vlan20"
+        "vlan30"
       ];
       bind-interfaces = true;
 
@@ -167,15 +185,6 @@
       # Note in Ad GuardHome in DNS Settings add localhost:9053 to Private reverse DNS servers and enable them
       listen-address = "127.0.0.1";
       port = 9053;
-      # NOTE these make it so my other devices don't hit the open net to stream movies
-      # while on the local network. Note that this is being paired with stateful settings
-      # in Adguardhome upstream dns servers:
-      # [/media.joshuabell.xyz/]127.0.0.1:9053
-      # [/jellyfin.joshuabell.xyz/]127.0.0.1:9053
-      host-record = [
-        "media.joshuabell.xyz,10.12.14.10"
-        "jellyfin.joshuabell.xyz,10.12.14.10"
-      ];
 
       # DHCP range and settings
       dhcp-range = [
@@ -202,18 +211,14 @@
         "2c:cf:67:6a:45:47,HOMEASSISTANT,10.12.14.22"
         "2a:d0:ec:fa:b9:7e,PIXEL-6,10.12.14.31"
         "a8:29:48:94:23:dd,TL-SG1428PE,10.12.16.2"
-        # Ellas work laptop
-        "38:18:68:49:3c:48,ellawork-w,10.12.14.122"
-        "d4:a2:cd:39:4e:f0,ellawork-e,10.12.14.132"
-        # Josh Work laptop
         "00:23:a4:0b:3b:be,TMREM00004335,10.12.14.181"
       ];
 
       enable-ra = lib.mkIf config.networking.enableIPv6 true;
       # interface, min interval, max interval
       ra-param = lib.mkIf config.networking.enableIPv6 [
-        "vlan10,60,120"
         "vlan20,60,120"
+        "vlan30,60,120"
       ];
 
       # DNS settings (not needed since we use adguard for dns)
diff --git a/hosts/linode/l001/configuration.nix b/hosts/linode/l001/configuration.nix
new file mode 100644
index 0000000..016d4ad
--- /dev/null
+++ b/hosts/linode/l001/configuration.nix
@@ -0,0 +1,7 @@
+{
+  ...
+}:
+{
+  boot.loader.grub.enable = true;
+  system.stateVersion = "24.11";
+}
diff --git a/hosts/linode/l001/flake.lock b/hosts/linode/l001/flake.lock
index 824b057..ea531e7 100644
--- a/hosts/linode/l001/flake.lock
+++ b/hosts/linode/l001/flake.lock
@@ -1,34 +1,101 @@
 {
   "nodes": {
-    "common": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "common",
+          "ragenix",
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
       "locked": {
-        "dir": "flakes/common",
-        "lastModified": 1762754782,
-        "narHash": "sha256-orYfD6CRMZAD2EUmxTdXNH0vctXQ04tOp0TmcrlPNcI=",
-        "ref": "refs/heads/master",
-        "rev": "49afd9829075a3e68676978f6565cf8f419d24ef",
-        "revCount": 766,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/common",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs_2",
+        "ragenix": "ragenix"
+      },
+      "locked": {
+        "lastModified": 1742406125,
+        "narHash": "sha256-+NQNj2IMJuEiymB+YrcZkxeZt7QlC+Bwe5rWgRRHKrU=",
+        "ref": "refs/heads/master",
+        "rev": "138565efadeed6baf2a632c5dcc95a2031c77f86",
+        "revCount": 371,
         "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "url": "https://git.joshuabell.xyz/dotfiles"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.joshuabell.xyz/dotfiles"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1741481578,
+        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "common",
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
       }
     },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_4",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1762286984,
-        "narHash": "sha256-9I2H9x5We6Pl+DBYHjR1s3UT8wgwcpAH03kn9CqtdQc=",
+        "lastModified": 1727447169,
+        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "9c870f63e28ec1e83305f7f6cb73c941e699f74f",
+        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
         "type": "github"
       },
       "original": {
@@ -40,11 +107,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -53,32 +120,121 @@
         "type": "github"
       }
     },
-    "home-manager": {
+    "flake-utils": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1742234739,
+        "narHash": "sha256-zFL6zsf/5OztR1NSNQF33dvS1fL/BzVUjabZq4qrtY4=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "f6af7280a3390e65c2ad8fd059cdc303426cbd59",
         "type": "github"
       },
       "original": {
         "owner": "rycee",
-        "ref": "release-25.05",
+        "ref": "release-24.11",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "common",
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743014863,
-        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
+        "lastModified": 1731755305,
+        "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
+        "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1742069588,
+        "narHash": "sha256-C7jVfohcGzdZRF6DO+ybyG/sqpo1h6bZi9T56sxLy+k=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "c80f6a7e10b39afcc1894e02ef785b1ad0b0d7e5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1741379970,
+        "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1702272962,
+        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
         "type": "github"
       },
       "original": {
@@ -88,44 +244,1096 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_5": {
       "locked": {
-        "lastModified": 1753345091,
-        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
-        "owner": "NixOS",
+        "lastModified": 1742268799,
+        "narHash": "sha256-IhnK4LhkBlf14/F8THvUy3xi/TxSQkp9hikfDZRD4Ic=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "rev": "da044451c6a70518db5b730fe277b70f494188f1",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "owner": "nixos",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1762498405,
-        "narHash": "sha256-Zg/SCgCaAioc0/SVZQJxuECGPJy+OAeBcGeA5okdYDc=",
+        "lastModified": 1742225912,
+        "narHash": "sha256-HCD3GrAAJb1jYTEc221DPlBk2VDkBt43hww7DXC1tyc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6faeb062ee4cf4f105989d490831713cc5a43ee1",
+        "rev": "9df17ad16500057b7b081137ff7af1a8a6a32f6e",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nvim_plugin-Almo7aya/openingh.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733158448,
+        "narHash": "sha256-JP3+goMgs3SiMHS9IVE7NAV/iKxyXi0fZgJb8hojtNQ=",
+        "owner": "Almo7aya",
+        "repo": "openingh.nvim",
+        "rev": "9131016c1167e23522a8e874b62217829fd327b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Almo7aya",
+        "repo": "openingh.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742210958,
+        "narHash": "sha256-+1dSGYeUpW/EUbP0scgGz48UB5RAPZYIWCglTFyntaU=",
+        "owner": "CopilotC-Nvim",
+        "repo": "CopilotChat.nvim",
+        "rev": "62b1249aa4a4fc7afe11c7e647cba0cef743826f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CopilotC-Nvim",
+        "repo": "CopilotChat.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733574156,
+        "narHash": "sha256-AjDM3+n4+lNBQi8P2Yrh0Ab06uYCndBQT9TX36rDbOM=",
+        "owner": "JoosepAlviste",
+        "repo": "nvim-ts-context-commentstring",
+        "rev": "1b212c2eee76d787bbea6aa5e92a2b534e7b4f8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "JoosepAlviste",
+        "repo": "nvim-ts-context-commentstring",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-L3MON4D3/LuaSnip": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1736009707,
+        "narHash": "sha256-3ecm5SDTcSOh256xSQPHhddQfMpepiEIpv58fHXrVg0=",
+        "owner": "L3MON4D3",
+        "repo": "LuaSnip",
+        "rev": "c9b9a22904c97d0eb69ccb9bab76037838326817",
+        "type": "github"
+      },
+      "original": {
+        "owner": "L3MON4D3",
+        "repo": "LuaSnip",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742156824,
+        "narHash": "sha256-n+pT7FiQONHhiZQH4BGjERrikGNSFTNciMx92oQGA1c=",
+        "owner": "MeanderingProgrammer",
+        "repo": "render-markdown.nvim",
+        "rev": "9721ffe230ec90e49c49ee33b5ca44c3fc689214",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MeanderingProgrammer",
+        "repo": "render-markdown.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-MunifTanjim/nui.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741233810,
+        "narHash": "sha256-BYTY2ezYuxsneAl/yQbwL1aQvVWKSsN3IVqzTlrBSEU=",
+        "owner": "MunifTanjim",
+        "repo": "nui.nvim",
+        "rev": "8d3bce9764e627b62b07424e0df77f680d47ffdb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MunifTanjim",
+        "repo": "nui.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-RRethy/vim-illuminate": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740540215,
+        "narHash": "sha256-jSny+5RHgxcsoxWwIaFUZ022dk3mDRKZ7dibvE6I2fE=",
+        "owner": "RRethy",
+        "repo": "vim-illuminate",
+        "rev": "19cb21f513fc2b02f0c66be70107741e837516a1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RRethy",
+        "repo": "vim-illuminate",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-Saecki/crates.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741644182,
+        "narHash": "sha256-hmUqhAVLBiCUl16+S/hvRxqA/pTXcWejpLtwvqxBPaY=",
+        "owner": "Saecki",
+        "repo": "crates.nvim",
+        "rev": "403a0abef0e2aec12749a534dc468d6fd50c6741",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Saecki",
+        "repo": "crates.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-aznhe21/actions-preview.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740589350,
+        "narHash": "sha256-MP1hohDL2JFembwW+cb2S+v2Y7j0iZw1jPPKTZiNCWI=",
+        "owner": "aznhe21",
+        "repo": "actions-preview.nvim",
+        "rev": "4ab7842eb6a5b6d2b004f8234dcf33382a0fdde2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "aznhe21",
+        "repo": "actions-preview.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-b0o/schemastore.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741996938,
+        "narHash": "sha256-eAqM/n0DDwl3WUO987c2mk3z7uJ4gAE0hkPg4Twyr4w=",
+        "owner": "b0o",
+        "repo": "schemastore.nvim",
+        "rev": "56d8ed0fa1516242085ba5e95d7f49fad50d5754",
+        "type": "github"
+      },
+      "original": {
+        "owner": "b0o",
+        "repo": "schemastore.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-catppuccin/nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740764472,
+        "narHash": "sha256-4h/fzFY8JR9r+QnoiWEqgQKPMuu8i9HTC4v0Jp7iuUo=",
+        "owner": "catppuccin",
+        "repo": "nvim",
+        "rev": "5b5e3aef9ad7af84f463d17b5479f06b87d5c429",
+        "type": "github"
+      },
+      "original": {
+        "owner": "catppuccin",
+        "repo": "nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-chrisgrieser/nvim-early-retirement": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735588187,
+        "narHash": "sha256-ZjXG+POJFRsc79i1BuAJB9K6UBUfHT05oYvZaUr+RqA=",
+        "owner": "chrisgrieser",
+        "repo": "nvim-early-retirement",
+        "rev": "9ae6fcc933fc865ddf2728460194b67985e06e27",
+        "type": "github"
+      },
+      "original": {
+        "owner": "chrisgrieser",
+        "repo": "nvim-early-retirement",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-declancm/cinnamon.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1722992123,
+        "narHash": "sha256-kccQ4iFMSQ8kvE7hYz90hBrsDLo7VohFj/6lEZZiAO8=",
+        "owner": "declancm",
+        "repo": "cinnamon.nvim",
+        "rev": "450cb3247765fed7871b41ef4ce5fa492d834215",
+        "type": "github"
+      },
+      "original": {
+        "owner": "declancm",
+        "repo": "cinnamon.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-folke/lazy.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
+        "owner": "folke",
+        "repo": "lazy.nvim",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "folke",
+        "repo": "lazy.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-folke/neodev.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1720260306,
+        "narHash": "sha256-hOjzlo/IqmV8tYjGwfmcCPEmHYsWnEIwtHZdhpwA1kM=",
+        "owner": "folke",
+        "repo": "neodev.nvim",
+        "rev": "46aa467dca16cf3dfe27098042402066d2ae242d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "folke",
+        "repo": "neodev.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-folke/which-key.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
+        "owner": "folke",
+        "repo": "which-key.nvim",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "folke",
+        "repo": "which-key.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-hrsh7th/cmp-buffer": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1660101488,
+        "narHash": "sha256-dG4U7MtnXThoa/PD+qFtCt76MQ14V1wX8GMYcvxEnbM=",
+        "owner": "hrsh7th",
+        "repo": "cmp-buffer",
+        "rev": "3022dbc9166796b644a841a02de8dd1cc1d311fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hrsh7th",
+        "repo": "cmp-buffer",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-hrsh7th/cmp-nvim-lsp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733823748,
+        "narHash": "sha256-iaihXNCF5bB5MdeoosD/kc3QtpA/QaIDZVLiLIurBSM=",
+        "owner": "hrsh7th",
+        "repo": "cmp-nvim-lsp",
+        "rev": "99290b3ec1322070bcfb9e846450a46f6efa50f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hrsh7th",
+        "repo": "cmp-nvim-lsp",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-hrsh7th/cmp-path": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1664784283,
+        "narHash": "sha256-thppiiV3wjIaZnAXmsh7j3DUc6ceSCvGzviwFUnoPaI=",
+        "owner": "hrsh7th",
+        "repo": "cmp-path",
+        "rev": "91ff86cd9c29299a64f968ebb45846c485725f23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hrsh7th",
+        "repo": "cmp-path",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-hrsh7th/nvim-cmp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741936119,
+        "narHash": "sha256-zl/rgbZF3+nsLI7Sd6xzQFlcpa5n/8pyganS+u0jD/s=",
+        "owner": "hrsh7th",
+        "repo": "nvim-cmp",
+        "rev": "1e1900b0769324a9675ef85b38f99cca29e203b3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hrsh7th",
+        "repo": "nvim-cmp",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-j-hui/fidget.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1738817426,
+        "narHash": "sha256-AFUx/ZQVWV7s5Wlppjk6N9QXoJKNKqxtf990FFlTEhw=",
+        "owner": "j-hui",
+        "repo": "fidget.nvim",
+        "rev": "d9ba6b7bfe29b3119a610892af67602641da778e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "j-hui",
+        "repo": "fidget.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-johmsalas/text-case.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1722628320,
+        "narHash": "sha256-2IMufSMy9JW50VzZ3SgOtp8kYs81ANwV0eP0ZH3rTFo=",
+        "owner": "johmsalas",
+        "repo": "text-case.nvim",
+        "rev": "e898cfd46fa6cde0e83abb624a16e67d2ffc6457",
+        "type": "github"
+      },
+      "original": {
+        "owner": "johmsalas",
+        "repo": "text-case.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-lewis6991/gitsigns.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742140868,
+        "narHash": "sha256-qWusbKY+3d1dkW5oLYDyfSLdt1qFlJdDeXgFWqQ4hUI=",
+        "owner": "lewis6991",
+        "repo": "gitsigns.nvim",
+        "rev": "7010000889bfb6c26065e0b0f7f1e6aa9163edd9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lewis6991",
+        "repo": "gitsigns.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-lnc3l0t/glow.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1693233815,
+        "narHash": "sha256-vdlwkIK2EkFviJmSiOqPWvc15xqJ9F2gHCC4ObJ5Qjk=",
+        "owner": "lnc3l0t",
+        "repo": "glow.nvim",
+        "rev": "5b38fb7b6e806cac62707a4aba8c10c5f14d5bb5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnc3l0t",
+        "repo": "glow.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-lukas-reineke/indent-blankline.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742224677,
+        "narHash": "sha256-0q/V+b4UrDRnaC/eRWOi9HU9a61vQSAM9/C8ZQyKt+Y=",
+        "owner": "lukas-reineke",
+        "repo": "indent-blankline.nvim",
+        "rev": "005b56001b2cb30bfa61b7986bc50657816ba4ba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lukas-reineke",
+        "repo": "indent-blankline.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-lvimuser/lsp-inlayhints.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1686236485,
+        "narHash": "sha256-06CiJ+xeMO4+OJkckcslqwloJyt2gwg514JuxV6KOfQ=",
+        "owner": "lvimuser",
+        "repo": "lsp-inlayhints.nvim",
+        "rev": "d981f65c9ae0b6062176f0accb9c151daeda6f16",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lvimuser",
+        "repo": "lsp-inlayhints.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-m4xshen/hardtime.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741414159,
+        "narHash": "sha256-tigKgK1yGc5JEHd4RLXCd6Hq7ia3en3Xtk8X6L5+ef4=",
+        "owner": "m4xshen",
+        "repo": "hardtime.nvim",
+        "rev": "f87c86d1aa1e05dcf3c6ecd97fbfd237e2de0bf5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "m4xshen",
+        "repo": "hardtime.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-mbbill/undotree": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741878850,
+        "narHash": "sha256-HGf4Toe+12YZtIalvANDXAtksCsnxQkZbcevOAnl5G4=",
+        "owner": "mbbill",
+        "repo": "undotree",
+        "rev": "b951b87b46c34356d44aa71886aecf9dd7f5788a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mbbill",
+        "repo": "undotree",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-mfussenegger/nvim-lint": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1738838825,
+        "narHash": "sha256-E/KcQr4RM4gz+ItENI9e7hMicyBKyzoIaDO5D1VDYSw=",
+        "owner": "mfussenegger",
+        "repo": "nvim-lint",
+        "rev": "6e9dd545a1af204c4022a8fcd99727ea41ffdcc8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mfussenegger",
+        "repo": "nvim-lint",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-mrcjkb/rustaceanvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742147378,
+        "narHash": "sha256-I2H/0VNKWKK49EReXT81SVTHHHW9hT1+6n7h1cbLD0A=",
+        "owner": "mrcjkb",
+        "repo": "rustaceanvim",
+        "rev": "448c76451ecf3c0edabcde427b7f1c8c219be2dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mrcjkb",
+        "repo": "rustaceanvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-neovim/nvim-lspconfig": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742142850,
+        "narHash": "sha256-CppHawmKEopPbK6HO4RFd7Kc1iMoCVwpIyN2Z6wiMfo=",
+        "owner": "neovim",
+        "repo": "nvim-lspconfig",
+        "rev": "2574ad38c6ee4f0bef3a1ca305cd5df627a52bb3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "neovim",
+        "repo": "nvim-lspconfig",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1724901856,
+        "narHash": "sha256-vFEIISxhTIGSl9LzDYHuEIkjLGkU0y5XhfWI/i5DgN4=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "03f6c40c4032eeb1ab91368e06db9c3f3a97a75d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-numToStr/Comment.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1717957420,
+        "narHash": "sha256-h0kPue5Eqd5aeu4VoLH45pF0DmWWo1d8SnLICSQ63zc=",
+        "owner": "numToStr",
+        "repo": "Comment.nvim",
+        "rev": "e30b7f2008e52442154b66f7c519bfd2f1e32acb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numToStr",
+        "repo": "Comment.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-lua/plenary.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1739311008,
+        "narHash": "sha256-8FV5RjF7QbDmQOQynpK7uRKONKbPRYbOPugf9ZxNvUs=",
+        "owner": "nvim-lua",
+        "repo": "plenary.nvim",
+        "rev": "857c5ac632080dba10aae49dba902ce3abf91b35",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-lua",
+        "repo": "plenary.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-lualine/lualine.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742039150,
+        "narHash": "sha256-qYKykdCcXd+OHmK3WvsUCbn0zDKTQDj49VYsQ8iVvgs=",
+        "owner": "nvim-lualine",
+        "repo": "lualine.nvim",
+        "rev": "b8b60c7f1d0d95ad74ee215b2291280b30482476",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-lualine",
+        "repo": "lualine.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-telescope/telescope-file-browser.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729728595,
+        "narHash": "sha256-VJbRi91TTOwUkQYyTM6Njl7MtX8/mOjINiqWYWEtyxg=",
+        "owner": "nvim-telescope",
+        "repo": "telescope-file-browser.nvim",
+        "rev": "626998e5c1b71c130d8bc6cf7abb6709b98287bb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-telescope",
+        "repo": "telescope-file-browser.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-telescope/telescope-fzf-native.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741765009,
+        "narHash": "sha256-Zyv8ikxdwoUiDD0zsqLzfhBVOm/nKyJdZpndxXEB6ow=",
+        "owner": "nvim-telescope",
+        "repo": "telescope-fzf-native.nvim",
+        "rev": "1f08ed60cafc8f6168b72b80be2b2ea149813e55",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-telescope",
+        "repo": "telescope-fzf-native.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-telescope/telescope-ui-select.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1701723223,
+        "narHash": "sha256-YRhNmmG4gx9Ht8JwjQfbTjJyTHEuZmtP6lqnhOsk8bE=",
+        "owner": "nvim-telescope",
+        "repo": "telescope-ui-select.nvim",
+        "rev": "6e51d7da30bd139a6950adf2a47fda6df9fa06d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-telescope",
+        "repo": "telescope-ui-select.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-telescope/telescope.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742171408,
+        "narHash": "sha256-mHucOyrgQc3wVdK7lUQANW8Jka+m5gQ2z8JWtwo99bU=",
+        "owner": "nvim-telescope",
+        "repo": "telescope.nvim",
+        "rev": "a17d611a0e111836a1db5295f04945df407c5135",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-telescope",
+        "repo": "telescope.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-tree/nvim-tree.lua": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740787655,
+        "narHash": "sha256-KSrY1K64yC6dPDd3DF15bVWs2N7B0BPS9enfmJgTzC4=",
+        "owner": "nvim-tree",
+        "repo": "nvim-tree.lua",
+        "rev": "c09ff35de503a41fa62465c6b4ae72d96e7a7ce4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-tree",
+        "repo": "nvim-tree.lua",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-tree/nvim-web-devicons": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742215722,
+        "narHash": "sha256-JKOvXJr1s2lpP5aeRE7OC3IeOrF5uJxg/Tal3eScd6g=",
+        "owner": "nvim-tree",
+        "repo": "nvim-web-devicons",
+        "rev": "4c3a5848ee0b09ecdea73adcd2a689190aeb728c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-tree",
+        "repo": "nvim-web-devicons",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742201688,
+        "narHash": "sha256-rpmHIOXiD/mh0PHBdo1k1Wdb213KtBevmyCFrP89tME=",
+        "owner": "nvim-treesitter",
+        "repo": "nvim-treesitter-context",
+        "rev": "83ded3bbff8bc13abc9704bf1c5e426f3ba343c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvim-treesitter",
+        "repo": "nvim-treesitter-context",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-rafamadriz/friendly-snippets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733106470,
+        "narHash": "sha256-I8SRZxnoNC6SOWW+scoA77Jwyxcb4eUczppLdyOiZe0=",
+        "owner": "rafamadriz",
+        "repo": "friendly-snippets",
+        "rev": "efff286dd74c22f731cdec26a70b46e5b203c619",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafamadriz",
+        "repo": "friendly-snippets",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-rcarriga/nvim-notify": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1737405174,
+        "narHash": "sha256-6vNfc7E9DMXF0IBXJCLA8Rp+uOgbDch/Q7beW0ys3Vo=",
+        "owner": "rcarriga",
+        "repo": "nvim-notify",
+        "rev": "22f29093eae7785773ee9d543f8750348b1a195c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rcarriga",
+        "repo": "nvim-notify",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-rmagatti/auto-session": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742136796,
+        "narHash": "sha256-Tc4EfcucGAR+5qURjoYqG5gW24PCYJLVd47OrFhyfRo=",
+        "owner": "rmagatti",
+        "repo": "auto-session",
+        "rev": "317412742990371f8e4709074da5c378456a27ff",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rmagatti",
+        "repo": "auto-session",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-ron/ron.vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1660904719,
+        "narHash": "sha256-8/xJmymtVGVz2avzlamgK1cNflZ3NRL+B3c7xxbI964=",
+        "owner": "ron-rs",
+        "repo": "ron.vim",
+        "rev": "f749e543975a82e8dd9a6e7df9600a1c098ae800",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ron-rs",
+        "repo": "ron.vim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-saadparwaiz1/cmp_luasnip": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730707109,
+        "narHash": "sha256-86lKQPPyqFz8jzuLajjHMKHrYnwW6+QOcPyQEx6B+gw=",
+        "owner": "saadparwaiz1",
+        "repo": "cmp_luasnip",
+        "rev": "98d9cb5c2c38532bd9bdb481067b20fea8f32e90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "saadparwaiz1",
+        "repo": "cmp_luasnip",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-sindrets/diffview.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1718279802,
+        "narHash": "sha256-SX+ybIzL/w6uyCy4iZKnWnzTFwqB1oXSgyYVAdpdKi8=",
+        "owner": "sindrets",
+        "repo": "diffview.nvim",
+        "rev": "4516612fe98ff56ae0415a259ff6361a89419b0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "sindrets",
+        "repo": "diffview.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-stevearc/conform.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741136809,
+        "narHash": "sha256-8uC+6rQdLqpfF/lf25mppqK/xgM1+6RGIyZaheaPd48=",
+        "owner": "stevearc",
+        "repo": "conform.nvim",
+        "rev": "db8a4a9edb217067b1d7a2e0362c74bfe9cc944d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "stevearc",
+        "repo": "conform.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-stevearc/dressing.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1739381641,
+        "narHash": "sha256-dBz+/gZA6O6fJy/GSgM6ZHGAR3MTGt/W1olzzTYRlgM=",
+        "owner": "stevearc",
+        "repo": "dressing.nvim",
+        "rev": "2d7c2db2507fa3c4956142ee607431ddb2828639",
+        "type": "github"
+      },
+      "original": {
+        "owner": "stevearc",
+        "repo": "dressing.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-tpope/vim-sleuth": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726718493,
+        "narHash": "sha256-2Cr3h3uJvUL3CSoJs3aBFrkBeOBURSQItgQ4ep9sHXM=",
+        "owner": "tpope",
+        "repo": "vim-sleuth",
+        "rev": "be69bff86754b1aa5adcbb527d7fcd1635a84080",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tpope",
+        "repo": "vim-sleuth",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-tpope/vim-surround": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1666730476,
+        "narHash": "sha256-DZE5tkmnT+lAvx/RQHaDEgEJXRKsy56KJY919xiH1lE=",
+        "owner": "tpope",
+        "repo": "vim-surround",
+        "rev": "3d188ed2113431cf8dac77be61b842acb64433d9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tpope",
+        "repo": "vim-surround",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-uga-rosa/ccc.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735970087,
+        "narHash": "sha256-53WsxOfWULlO4VbSXA4DW6wjkbCzpQjkzv4O8pReuEc=",
+        "owner": "uga-rosa",
+        "repo": "ccc.nvim",
+        "rev": "b57cbaf8db3ac43c56c9e2c7f3812944638260ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "uga-rosa",
+        "repo": "ccc.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-windwp/nvim-ts-autotag": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1739910276,
+        "narHash": "sha256-a3Bcql68mp3y5bH9XMiDTQB0e75T+qFB593objIGg/I=",
+        "owner": "windwp",
+        "repo": "nvim-ts-autotag",
+        "rev": "a1d526af391f6aebb25a8795cbc05351ed3620b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "windwp",
+        "repo": "nvim-ts-autotag",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-yetone/avante.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1742209600,
+        "narHash": "sha256-XmyRo20+VhyjP5CLgSy0Tr/7R031EJSmMEN/wK9JNk8=",
+        "owner": "yetone",
+        "repo": "avante.nvim",
+        "rev": "540cc53f0c30214e3e4b5688f030bb2d8277b8ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yetone",
+        "repo": "avante.nvim",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-zbirenbaum/copilot-cmp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733947099,
+        "narHash": "sha256-erRL8bY/zuwuCZfttw+avTrFV7pjv2H6v73NzY2bymM=",
+        "owner": "zbirenbaum",
+        "repo": "copilot-cmp",
+        "rev": "15fc12af3d0109fa76b60b5cffa1373697e261d1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zbirenbaum",
+        "repo": "copilot-cmp",
+        "type": "github"
+      }
+    },
+    "nvim_plugin-zbirenbaum/copilot.lua": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1739230958,
+        "narHash": "sha256-632UIbG1jwam+tug5+jODkT509+uBfJgUN21C3ppnEo=",
+        "owner": "zbirenbaum",
+        "repo": "copilot.lua",
+        "rev": "30321e33b03cb924fdcd6a806a0dc6fa0b0eafb9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zbirenbaum",
+        "repo": "copilot.lua",
+        "type": "github"
+      }
+    },
+    "ragenix": {
+      "inputs": {
+        "agenix": "agenix",
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_3",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1741508717,
+        "narHash": "sha256-iQf1WdNxaApOFHIx4RLMRZ4f8g+8Xp0Z1/E/Mz2rLxY=",
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "rev": "2a2bea99d74927e54adf53cbf113219def67d5c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "common": "common",
         "deploy-rs": "deploy-rs",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_5",
+        "ros_neovim": "ros_neovim"
+      }
+    },
+    "ros_neovim": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_6",
+        "nvim_plugin-Almo7aya/openingh.nvim": "nvim_plugin-Almo7aya/openingh.nvim",
+        "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim",
+        "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring",
+        "nvim_plugin-L3MON4D3/LuaSnip": "nvim_plugin-L3MON4D3/LuaSnip",
+        "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": "nvim_plugin-MeanderingProgrammer/render-markdown.nvim",
+        "nvim_plugin-MunifTanjim/nui.nvim": "nvim_plugin-MunifTanjim/nui.nvim",
+        "nvim_plugin-RRethy/vim-illuminate": "nvim_plugin-RRethy/vim-illuminate",
+        "nvim_plugin-Saecki/crates.nvim": "nvim_plugin-Saecki/crates.nvim",
+        "nvim_plugin-aznhe21/actions-preview.nvim": "nvim_plugin-aznhe21/actions-preview.nvim",
+        "nvim_plugin-b0o/schemastore.nvim": "nvim_plugin-b0o/schemastore.nvim",
+        "nvim_plugin-catppuccin/nvim": "nvim_plugin-catppuccin/nvim",
+        "nvim_plugin-chrisgrieser/nvim-early-retirement": "nvim_plugin-chrisgrieser/nvim-early-retirement",
+        "nvim_plugin-declancm/cinnamon.nvim": "nvim_plugin-declancm/cinnamon.nvim",
+        "nvim_plugin-folke/lazy.nvim": "nvim_plugin-folke/lazy.nvim",
+        "nvim_plugin-folke/neodev.nvim": "nvim_plugin-folke/neodev.nvim",
+        "nvim_plugin-folke/which-key.nvim": "nvim_plugin-folke/which-key.nvim",
+        "nvim_plugin-hrsh7th/cmp-buffer": "nvim_plugin-hrsh7th/cmp-buffer",
+        "nvim_plugin-hrsh7th/cmp-nvim-lsp": "nvim_plugin-hrsh7th/cmp-nvim-lsp",
+        "nvim_plugin-hrsh7th/cmp-path": "nvim_plugin-hrsh7th/cmp-path",
+        "nvim_plugin-hrsh7th/nvim-cmp": "nvim_plugin-hrsh7th/nvim-cmp",
+        "nvim_plugin-j-hui/fidget.nvim": "nvim_plugin-j-hui/fidget.nvim",
+        "nvim_plugin-johmsalas/text-case.nvim": "nvim_plugin-johmsalas/text-case.nvim",
+        "nvim_plugin-lewis6991/gitsigns.nvim": "nvim_plugin-lewis6991/gitsigns.nvim",
+        "nvim_plugin-lnc3l0t/glow.nvim": "nvim_plugin-lnc3l0t/glow.nvim",
+        "nvim_plugin-lukas-reineke/indent-blankline.nvim": "nvim_plugin-lukas-reineke/indent-blankline.nvim",
+        "nvim_plugin-lvimuser/lsp-inlayhints.nvim": "nvim_plugin-lvimuser/lsp-inlayhints.nvim",
+        "nvim_plugin-m4xshen/hardtime.nvim": "nvim_plugin-m4xshen/hardtime.nvim",
+        "nvim_plugin-mbbill/undotree": "nvim_plugin-mbbill/undotree",
+        "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
+        "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
+        "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
+        "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
+        "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
+        "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
+        "nvim_plugin-nvim-telescope/telescope-file-browser.nvim": "nvim_plugin-nvim-telescope/telescope-file-browser.nvim",
+        "nvim_plugin-nvim-telescope/telescope-fzf-native.nvim": "nvim_plugin-nvim-telescope/telescope-fzf-native.nvim",
+        "nvim_plugin-nvim-telescope/telescope-ui-select.nvim": "nvim_plugin-nvim-telescope/telescope-ui-select.nvim",
+        "nvim_plugin-nvim-telescope/telescope.nvim": "nvim_plugin-nvim-telescope/telescope.nvim",
+        "nvim_plugin-nvim-tree/nvim-tree.lua": "nvim_plugin-nvim-tree/nvim-tree.lua",
+        "nvim_plugin-nvim-tree/nvim-web-devicons": "nvim_plugin-nvim-tree/nvim-web-devicons",
+        "nvim_plugin-nvim-treesitter/nvim-treesitter-context": "nvim_plugin-nvim-treesitter/nvim-treesitter-context",
+        "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
+        "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
+        "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
+        "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
+        "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
+        "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
+        "nvim_plugin-stevearc/dressing.nvim": "nvim_plugin-stevearc/dressing.nvim",
+        "nvim_plugin-tpope/vim-sleuth": "nvim_plugin-tpope/vim-sleuth",
+        "nvim_plugin-tpope/vim-surround": "nvim_plugin-tpope/vim-surround",
+        "nvim_plugin-uga-rosa/ccc.nvim": "nvim_plugin-uga-rosa/ccc.nvim",
+        "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
+        "nvim_plugin-yetone/avante.nvim": "nvim_plugin-yetone/avante.nvim",
+        "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
+        "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1742226527,
+        "narHash": "sha256-CT9227XXn1t8H1ivNBBkBcf+npB7tWk5yzEQoJvbGVU=",
+        "ref": "refs/heads/master",
+        "rev": "e8bafafc36fb2227dab8f0ddb67a2439d9077091",
+        "revCount": 268,
+        "type": "git",
+        "url": "https://git.joshuabell.xyz/nvim"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.joshuabell.xyz/nvim"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "common",
+          "ragenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741400194,
+        "narHash": "sha256-tEpgT+q5KlGjHSm8MnINgTPErEl8YDzX3Eps8PVc09g=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "16b6045a232fea0e9e4c69e55a6e269607dd8e3f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742178793,
+        "narHash": "sha256-S2onMdoDS4tIYd3/Jc5oFEZBr2dJOgPrh9KzSO/bfDw=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "954582a766a50ebef5695a9616c93b5386418c08",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
@@ -143,16 +1351,46 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
diff --git a/hosts/linode/l001/flake.nix b/hosts/linode/l001/flake.nix
index ffcd577..8c929dc 100644
--- a/hosts/linode/l001/flake.nix
+++ b/hosts/linode/l001/flake.nix
@@ -1,28 +1,22 @@
 {
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     deploy-rs.url = "github:serokell/deploy-rs";
-
-    # Use relative to get current version for testing
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
+    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      home-manager,
       common,
+      ros_neovim,
       deploy-rs,
       ...
-    }@inputs:
+    }:
     let
       configuration_name = "l001";
-      system = "x86_64-linux";
-      stateVersion = "24.11";
-      primaryUser = "root";
       lib = nixpkgs.lib;
     in
     {
@@ -44,59 +38,57 @@
       nixosConfigurations = {
         "${configuration_name}" = (
           lib.nixosSystem {
-            inherit system;
-            specialArgs = {
-              inherit inputs;
-            };
             modules = [
-              home-manager.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.hardening
-              common.nixosModules.nix_options
-              common.nixosModules.zsh
-
+              common.nixosModules.default
+              ros_neovim.nixosModules.default
+              ./configuration.nix
               ./hardware-configuration.nix
               ./linode.nix
               ./nginx.nix
               ./headscale.nix
               (
                 { config, pkgs, ... }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: name == "root" || (user.isNormalUser or false)) users.users);
+                {
+                  environment.systemPackages = with pkgs; [
+                    bitwarden
+                    vaultwarden
+                  ];
 
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      shell = pkgs.zsh;
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJuo6L6V52AzdQIK6fWW9s0aX1yKUUTXbPd8v8IU9p2o nix2linode"
-                      ];
+                  ringofstorms_common = {
+                    systemName = configuration_name;
+                    general = {
+                      disableRemoteBuildsOnLio = true;
+                      readWindowsDrives = false;
+                      jetbrainsMonoFont = false;
+                      ttyCapsEscape = false;
+                    };
+                    programs = {
+                      ssh.enable = true;
+                    };
+                    users = {
+                      users = {
+                        root = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJuo6L6V52AzdQIK6fWW9s0aX1yKUUTXbPd8v8IU9p2o nix2linode"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                      };
+                    };
+                    homeManager = {
+                      users = {
+                        root = {
+                          imports = with common.homeManagerModules; [
+                            tmux
+                            atuin
+                            git
+                            postgres
+                            starship
+                            zoxide
+                            zsh
+                          ];
+                        };
+                      };
                     };
                   };
                 }
diff --git a/hosts/linode/l001/headscale.nix b/hosts/linode/l001/headscale.nix
index 0d4ac78..a2bc52c 100644
--- a/hosts/linode/l001/headscale.nix
+++ b/hosts/linode/l001/headscale.nix
@@ -1,5 +1,6 @@
 { pkgs, ... }:
 {
+
   config = {
     # TODO backup /var/lib/headscale data
     # TODO https://github.com/gurucomputing/headscale-ui ?
@@ -16,28 +17,6 @@
         dns = {
           magic_dns = true;
           base_domain = "net.joshuabell.xyz";
-          extra_records =
-            let
-              h001ARecord = name: {
-                type = "A";
-                name = "${name}.joshuabell.xyz";
-                value = "100.64.0.13";
-              };
-              
-            in
-            [
-              (h001ARecord "jellyfin")
-              (h001ARecord "media")
-              (h001ARecord "notes")
-              (h001ARecord "chat")
-              (h001ARecord "sso-proxy")
-              (h001ARecord "n8n")
-              (h001ARecord "sec")
-              (h001ARecord "sso")
-              (h001ARecord "gist")
-              (h001ARecord "git")
-              (h001ARecord "blog")
-            ];
         };
       };
     };
diff --git a/hosts/linode/l001/nginx.nix b/hosts/linode/l001/nginx.nix
index e0ef744..00c8fc5 100644
--- a/hosts/linode/l001/nginx.nix
+++ b/hosts/linode/l001/nginx.nix
@@ -3,7 +3,7 @@
 }:
 {
   security.acme.acceptTerms = true;
-  security.acme.default.email = "admin@joshuabell.xyz";
+  security.acme.email = "admin@joshuabell.xyz";
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;
@@ -11,16 +11,29 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
     virtualHosts = {
-      # "172.236.111.33" = {
-      #   locations."/" = {
-      #     return = "444";
-      #   };
-      # };
-      # "2600:3c06::f03c:95ff:fe1c:84d3" = {
-      #   locations."/" = {
-      #     return = "444";
-      #   };
-      # };
+      # default that is put first for fallbacks
+      # Note that order here doesn't matter it orders alphabetically so `0` puts it first
+      # I had an issue tha the first SSL port 443 site would catch any https traffic instead
+      # of hitting my default fallback and this fixes that issue and ensure this is hit instead
+      "001.linodes.joshuabell.xyz" = {
+        default = true;
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          return = "444"; # 404 for not found or 444 for drop
+        };
+      };
+      "172.236.111.33" = {
+        locations."/" = {
+          return = "444";
+        };
+      };
+      "2600:3c06::f03c:95ff:fe1c:84d3" = {
+        locations."/" = {
+          return = "444";
+        };
+      };
+
       "headscale.joshuabell.xyz" = {
         enableACME = true;
         forceSSL = true;
@@ -29,13 +42,6 @@
           proxyPass = "http://localhost:8080"; # headscale
         };
       };
-      "_" = {
-        rejectSSL = true;
-        default = true;
-        locations."/" = {
-          return = "444"; # 404 for not found or 444 for drop
-        };
-      };
     };
   };
 
diff --git a/hosts/lio/configuration.nix b/hosts/lio/configuration.nix
index cb8f9d5..07eba39 100644
--- a/hosts/lio/configuration.nix
+++ b/hosts/lio/configuration.nix
@@ -1,10 +1,7 @@
 {
-  pkgs,
   ...
 }:
 {
-  system.stateVersion = "23.11";
-
   hardware.enableAllFirmware = true;
 
   # Connectivity
@@ -14,6 +11,8 @@
   # System76
   hardware.system76.enableAll = true;
 
+  system.stateVersion = "23.11";
+
   services = {
     # https://discourse.nixos.org/t/very-high-fan-noises-on-nixos-using-a-system76-thelio/23875/10
     # Fixes insane jet speed fan noise
@@ -29,22 +28,4 @@
       # };
     };
   };
-
-  # Also allow this key to work for root user, this will let us use this as a remote builder easier
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJN2nsLmAlF6zj5dEBkNSJaqcCya+aB6I0imY8Q5Ew0S nix2lio"
-  ];
-  # Allow emulation of aarch64-linux binaries for cross compiling
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  environment.systemPackages = with pkgs; [
-    lua
-    qdirstat
-    ffmpeg-full
-    appimage-run
-    nodejs_24
-    foot
-    vlc
-    google-chrome
-  ];
 }
diff --git a/hosts/lio/flake.lock b/hosts/lio/flake.lock
index 066e86b..547d122 100644
--- a/hosts/lio/flake.lock
+++ b/hosts/lio/flake.lock
@@ -5,7 +5,7 @@
         "darwin": "darwin",
         "home-manager": "home-manager_2",
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ],
@@ -26,12 +26,17 @@
       }
     },
     "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "ragenix": "ragenix"
+      },
       "locked": {
-        "path": "../../flakes/common",
+        "path": "../../common",
         "type": "path"
       },
       "original": {
-        "path": "../../flakes/common",
+        "path": "../../common",
         "type": "path"
       },
       "parent": []
@@ -54,7 +59,7 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -93,36 +98,16 @@
         "type": "github"
       }
     },
-    "flatpaks": {
-      "inputs": {
-        "nix-flatpak": "nix-flatpak"
-      },
-      "locked": {
-        "dir": "flakes/flatpaks",
-        "lastModified": 1761107519,
-        "narHash": "sha256-HV+W8peuB0elo/32CgwfITp/ox4dFDXaM22z/HlmZ2c=",
-        "ref": "refs/heads/master",
-        "rev": "9de4c7892bdf28735875d43849d67d9b16b6d700",
-        "revCount": 731,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      },
-      "original": {
-        "dir": "flakes/flatpaks",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1756245065,
+        "narHash": "sha256-aAZNbGcWrVRZgWgkQbkabSGcDVRDMgON4BipMy69gvI=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "54b2879ce622d44415e727905925e21b8f833a98",
         "type": "github"
       },
       "original": {
@@ -135,7 +120,7 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -189,11 +174,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1760524057,
-        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
         "type": "github"
       },
       "original": {
@@ -204,37 +189,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1760580664,
-        "narHash": "sha256-/YdfibIrnqXAL8p5kqCU345mzpHoOtuVIkMiI2pF4Dc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "98ff3f9af2684f6136c24beef08f5e2033fc5389",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1763010827,
-        "narHash": "sha256-RFEZh8UF4S0GMbWpDin6EzuhuykaAhXKF8qsRU7ArUE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "d3ca3185bb27958941927598b76caf591187f9bf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
       "locked": {
         "lastModified": 1741379970,
         "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
@@ -250,6 +204,37 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1755471983,
+        "narHash": "sha256-axUoWcm4cNQ36jOlnkD9D40LTfSQgk8ExfHSRm3rTtg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1757952092,
+        "narHash": "sha256-BcfTLFCU7elUJ2dwyt0iTjxsz/XLh+8ZygDcFwy6xPE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "fd76dc9e7c68ac7c3941ba2af2bedcd79c5cf4ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nvim_plugin-Almo7aya/openingh.nvim": {
       "flake": false,
       "locked": {
@@ -269,11 +254,11 @@
     "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762727340,
-        "narHash": "sha256-sT4UnxLvfuHZxkrMjFaUNVyun7sxwax83O/QB3f7fQE=",
+        "lastModified": 1757950300,
+        "narHash": "sha256-IQTP3jOmFNc2nphV9jdFbJXkmAN5Wj+/PIGmaZ8gP24=",
         "owner": "CopilotC-Nvim",
         "repo": "CopilotChat.nvim",
-        "rev": "ce485330c76a5b63ccfb02b7dd18890a748ca558",
+        "rev": "87615648ff4dc852d1cf7ec099f0a7c37b1b2c87",
         "type": "github"
       },
       "original": {
@@ -301,11 +286,11 @@
     "nvim_plugin-L3MON4D3/LuaSnip": {
       "flake": false,
       "locked": {
-        "lastModified": 1762213057,
-        "narHash": "sha256-Pil9m8zN3XzMtPT8spdr78dzkMW7dcpVnbWzie6524A=",
+        "lastModified": 1756990415,
+        "narHash": "sha256-5FsUVPy8pAiwBh3c+bPDMtypFEHj6qIwGQIo3hjqV4M=",
         "owner": "L3MON4D3",
         "repo": "LuaSnip",
-        "rev": "3732756842a2f7e0e76a7b0487e9692072857277",
+        "rev": "21f74f7ba8c49f95f9d7c8293b147c2901dd2d3a",
         "type": "github"
       },
       "original": {
@@ -317,11 +302,11 @@
     "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762952625,
-        "narHash": "sha256-K967UmJYqy3Xe0UeskIksczs+g00yA9YJAof1G5pQH8=",
+        "lastModified": 1757910669,
+        "narHash": "sha256-PWbFcGRbTMRhDJrj+kx73HLduMLOSrAhZTLL2YgrAjQ=",
         "owner": "MeanderingProgrammer",
         "repo": "render-markdown.nvim",
-        "rev": "f58c05f349d6e7650f4b40b0df1514400f0c10de",
+        "rev": "2c6cf127c577712bd29d38f6391b3045c5f0180a",
         "type": "github"
       },
       "original": {
@@ -381,11 +366,11 @@
     "nvim_plugin-aznhe21/actions-preview.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759462626,
-        "narHash": "sha256-YUeWBXxxeurfWBi0PjUi6izqYAvUw9DHmvsuPXm7ohw=",
+        "lastModified": 1745779150,
+        "narHash": "sha256-rQjwlu5gQcOvxF72lr9ugPRl0W78wCWGWPhpN1oOMbs=",
         "owner": "aznhe21",
         "repo": "actions-preview.nvim",
-        "rev": "cb938c25edaac38d362555f19244a9cb85d561e8",
+        "rev": "36513ad213855d497b7dd3391a24d1d75d58e36f",
         "type": "github"
       },
       "original": {
@@ -397,11 +382,11 @@
     "nvim_plugin-b0o/schemastore.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762970439,
-        "narHash": "sha256-17PacghZB5pxXgui7KrIkc43yqh9aQe2thyt3OpgzXw=",
+        "lastModified": 1757653237,
+        "narHash": "sha256-94NKAVWPV2sLkGWWL9G07QxA90Ise6tNWaYyKBcS/vI=",
         "owner": "b0o",
         "repo": "schemastore.nvim",
-        "rev": "229e7ecd3ed9b882cc172f7e8a8d6eb8ba4124ff",
+        "rev": "3146720ee3a0c6e2446eedd492fb519d16f2e467",
         "type": "github"
       },
       "original": {
@@ -413,11 +398,11 @@
     "nvim_plugin-catppuccin/nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762006357,
-        "narHash": "sha256-WNOuJ+XdO0x3Vlc8mALwtFU6iwJXilOM/NF0F1161FQ=",
+        "lastModified": 1755621274,
+        "narHash": "sha256-o8VLMPriOh4+Ay5Ff0cWQYXjmihdr3x9131bKHHTsQE=",
         "owner": "catppuccin",
         "repo": "nvim",
-        "rev": "234fc048de931a0e42ebcad675bf6559d75e23df",
+        "rev": "30fa4d122d9b22ad8b2e0ab1b533c8c26c4dde86",
         "type": "github"
       },
       "original": {
@@ -429,11 +414,11 @@
     "nvim_plugin-chrisgrieser/nvim-early-retirement": {
       "flake": false,
       "locked": {
-        "lastModified": 1760385962,
-        "narHash": "sha256-PtpD6Uc4GK4dSJynWH5d6c7XOWXfYODXJ3FyOY1eZNo=",
+        "lastModified": 1757363000,
+        "narHash": "sha256-hfoJDD4ZKIx1IZjmZba117wRe3ELyGqG8ZqxDnRVmIk=",
         "owner": "chrisgrieser",
         "repo": "nvim-early-retirement",
-        "rev": "9109589b542773c9ad2a34067a085874f255577b",
+        "rev": "14aba23ce4168e6d6acbf78ab1d33739c3894f68",
         "type": "github"
       },
       "original": {
@@ -461,11 +446,11 @@
     "nvim_plugin-folke/lazy.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762421181,
-        "narHash": "sha256-h5404njTAfqMJFQ3MAr2PWSbV81eS4aIs0cxAXkT0EM=",
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
         "owner": "folke",
         "repo": "lazy.nvim",
-        "rev": "85c7ff3711b730b4030d03144f6db6375044ae82",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
         "type": "github"
       },
       "original": {
@@ -493,11 +478,11 @@
     "nvim_plugin-folke/which-key.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761664528,
-        "narHash": "sha256-rKaYnXM4gRkkF/+xIFm2oCZwtAU6CeTdRWU93N+Jmbc=",
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
         "owner": "folke",
         "repo": "which-key.nvim",
-        "rev": "3aab2147e74890957785941f0c1ad87d0a44c15a",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
         "type": "github"
       },
       "original": {
@@ -557,11 +542,11 @@
     "nvim_plugin-hrsh7th/nvim-cmp": {
       "flake": false,
       "locked": {
-        "lastModified": 1762254225,
-        "narHash": "sha256-Pnfa1u+hoVIKo7Jvv3VF/p6m0ALXywwUNEb2FI7TeEc=",
+        "lastModified": 1744514599,
+        "narHash": "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=",
         "owner": "hrsh7th",
         "repo": "nvim-cmp",
-        "rev": "106c4bcc053a5da783bf4a9d907b6f22485c2ea0",
+        "rev": "b5311ab3ed9c846b585c0c15b7559be131ec4be9",
         "type": "github"
       },
       "original": {
@@ -573,11 +558,11 @@
     "nvim_plugin-j-hui/fidget.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761243883,
-        "narHash": "sha256-XXTeJweQRIsC/WFhFxFbepOETV8e5Wfmh513su2Wve0=",
+        "lastModified": 1755700851,
+        "narHash": "sha256-KRlUqUdcliKpLnEJqyA2OAWto73F6iGTbMrsiAdc24M=",
         "owner": "j-hui",
         "repo": "fidget.nvim",
-        "rev": "e32b672d8fd343f9d6a76944fedb8c61d7d8111a",
+        "rev": "4d5858bd4c471c895060e1b9f3575f1551184dc5",
         "type": "github"
       },
       "original": {
@@ -605,11 +590,11 @@
     "nvim_plugin-lewis6991/gitsigns.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760888451,
-        "narHash": "sha256-eGpB7YYWbyCCGYXEYAM432srSp/lUo5C1b0J3OYjwnY=",
+        "lastModified": 1757668552,
+        "narHash": "sha256-L5WbNiFUn014hThvGfb5r858O6iLOBhOQHfVUdIlFI4=",
         "owner": "lewis6991",
         "repo": "gitsigns.nvim",
-        "rev": "20ad4419564d6e22b189f6738116b38871082332",
+        "rev": "f780609807eca1f783a36a8a31c30a48fbe150c5",
         "type": "github"
       },
       "original": {
@@ -669,11 +654,11 @@
     "nvim_plugin-mbbill/undotree": {
       "flake": false,
       "locked": {
-        "lastModified": 1759186837,
-        "narHash": "sha256-EWOH08KAWyoT9m45/B1d5aKQQJtd3k4orJbagVsxe08=",
+        "lastModified": 1756538456,
+        "narHash": "sha256-tudR+46nd63jY1VTCNEfZ2CofxCODXaHos0+NdFI6wU=",
         "owner": "mbbill",
         "repo": "undotree",
-        "rev": "0f1c9816975b5d7f87d5003a19c53c6fd2ff6f7f",
+        "rev": "fe9a9d0645f0f5532360b5e5f5c550d7bb4f1869",
         "type": "github"
       },
       "original": {
@@ -685,11 +670,11 @@
     "nvim_plugin-mfussenegger/nvim-lint": {
       "flake": false,
       "locked": {
-        "lastModified": 1762442588,
-        "narHash": "sha256-TRiTTCfOoFXQvEw6Dyjx70Y2svpP7ln0LbYLOHw2Lzw=",
+        "lastModified": 1757878177,
+        "narHash": "sha256-8X9z0pRWx9xg9nQhhQtuOu3TunObg2CIgnlPXZtx86A=",
         "owner": "mfussenegger",
         "repo": "nvim-lint",
-        "rev": "8b349e822a36e9480aed96c6dd2f757f80524a35",
+        "rev": "0864f81c681e15d9bdc1156fe3a17bd07db5a3ed",
         "type": "github"
       },
       "original": {
@@ -701,11 +686,11 @@
     "nvim_plugin-mrcjkb/rustaceanvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762620523,
-        "narHash": "sha256-w1BXvvIK2db4mhI+dIOut7XFAVyAzzvuLu6ThkHYfw4=",
+        "lastModified": 1757809469,
+        "narHash": "sha256-bijgDZozBNmHW3cASmOrQlaSE80d8V3XRxi1BNmfzRI=",
         "owner": "mrcjkb",
         "repo": "rustaceanvim",
-        "rev": "ccd8f99b159f53113e503fa99a613875407db49f",
+        "rev": "370b85298e5afdfd8b5d3da0c60c04e3873499a4",
         "type": "github"
       },
       "original": {
@@ -717,11 +702,11 @@
     "nvim_plugin-neovim/nvim-lspconfig": {
       "flake": false,
       "locked": {
-        "lastModified": 1762966402,
-        "narHash": "sha256-2wflkFO9GYm5kFais+zKewraBItknXeNSmUKe8muj+U=",
+        "lastModified": 1757886255,
+        "narHash": "sha256-lIlFgHkesAK7fRcoEEQO84/0BpE29dBgNzBnCv/0Tf0=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "b34fbdffdcb6295c7a25df6ba375452a2e73c32e",
+        "rev": "d9879110d0422a566fa01d732556f4d5515e1738",
         "type": "github"
       },
       "original": {
@@ -730,6 +715,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755703322,
+        "narHash": "sha256-xy+50CsRd0LfRyDtNNMI8KhzvjH2nt8ogwiXf7H3fYY=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "8b0974c0e23ef086f5598ebbb1980257171dc370",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-numToStr/Comment.nvim": {
       "flake": false,
       "locked": {
@@ -765,11 +766,11 @@
     "nvim_plugin-nvim-lualine/lualine.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760596863,
-        "narHash": "sha256-hdrAdG3hC2sAevQ6a9xizqPgEgnNKxuc5rBYn0pKM1c=",
+        "lastModified": 1754970649,
+        "narHash": "sha256-lWt2kpW+hsTMWt8tar/+AISTDrIt4Jn27NmI9j+Xt4s=",
         "owner": "nvim-lualine",
         "repo": "lualine.nvim",
-        "rev": "3946f0122255bc377d14a59b27b609fb3ab25768",
+        "rev": "b8c23159c0161f4b89196f74ee3a6d02cdc3a955",
         "type": "github"
       },
       "original": {
@@ -797,11 +798,11 @@
     "nvim_plugin-nvim-telescope/telescope-fzf-native.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762521376,
-        "narHash": "sha256-ChEM4jJonAE4qXd/dgTu2mdlpNBj5rEdpA8TgR38oRM=",
+        "lastModified": 1741765009,
+        "narHash": "sha256-Zyv8ikxdwoUiDD0zsqLzfhBVOm/nKyJdZpndxXEB6ow=",
         "owner": "nvim-telescope",
         "repo": "telescope-fzf-native.nvim",
-        "rev": "6fea601bd2b694c6f2ae08a6c6fab14930c60e2c",
+        "rev": "1f08ed60cafc8f6168b72b80be2b2ea149813e55",
         "type": "github"
       },
       "original": {
@@ -829,11 +830,11 @@
     "nvim_plugin-nvim-telescope/telescope.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762931078,
-        "narHash": "sha256-7DHFXZxUtPUQkpy2zjC2lwhj7isBCyEwh9LbtqAjSFs=",
+        "lastModified": 1747012888,
+        "narHash": "sha256-JpW0ehsX81yVbKNzrYOe1hdgVMs6oaaxMLH6lECnOJg=",
         "owner": "nvim-telescope",
         "repo": "telescope.nvim",
-        "rev": "3a12a853ebf21ec1cce9a92290e3013f8ae75f02",
+        "rev": "b4da76be54691e854d3e0e02c36b0245f945c2c7",
         "type": "github"
       },
       "original": {
@@ -845,11 +846,11 @@
     "nvim_plugin-nvim-tree/nvim-tree.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1762812542,
-        "narHash": "sha256-tCIi3C025gooix20RBCGKBtnuGFrZezQGbwv+tz37Wc=",
+        "lastModified": 1757312802,
+        "narHash": "sha256-Km+PWXJJLl8zsBjwIGL//qT/eUEZna4yYRPsWXMXG1E=",
         "owner": "nvim-tree",
         "repo": "nvim-tree.lua",
-        "rev": "1eda2569394f866360e61f590f1796877388cb8a",
+        "rev": "e179ad2f83b5955ab0af653069a493a1828c2697",
         "type": "github"
       },
       "original": {
@@ -861,11 +862,11 @@
     "nvim_plugin-nvim-tree/nvim-web-devicons": {
       "flake": false,
       "locked": {
-        "lastModified": 1761440007,
-        "narHash": "sha256-klBjUtj0AvarN5a6O8Hh2t5BuOTe/m3ps2cHnlxVJvE=",
+        "lastModified": 1756936794,
+        "narHash": "sha256-2Q6ZZQj5HFXTw1YwX3ibdGOTwfbfPUBbcPOsuBUpSjc=",
         "owner": "nvim-tree",
         "repo": "nvim-web-devicons",
-        "rev": "8dcb311b0c92d460fac00eac706abd43d94d68af",
+        "rev": "6e51ca170563330e063720449c21f43e27ca0bc1",
         "type": "github"
       },
       "original": {
@@ -877,11 +878,11 @@
     "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
       "flake": false,
       "locked": {
-        "lastModified": 1762769683,
-        "narHash": "sha256-ICwAUXKngSPsJ6VV+84KUPqtAwlGPrm4FIf9ioisiz8=",
+        "lastModified": 1757521884,
+        "narHash": "sha256-+yj8bstmffVByX3Z/1vkUYdXvpmWGbPt+RDfkBnV11w=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter-context",
-        "rev": "660861b1849256398f70450afdf93908d28dc945",
+        "rev": "41847d3dafb5004464708a3db06b14f12bde548a",
         "type": "github"
       },
       "original": {
@@ -925,11 +926,11 @@
     "nvim_plugin-rmagatti/auto-session": {
       "flake": false,
       "locked": {
-        "lastModified": 1761853983,
-        "narHash": "sha256-9/SfXUAZIiPAS5ojvJCxDCxmuLoL/kIrAsNWAoLWFq4=",
+        "lastModified": 1757864222,
+        "narHash": "sha256-FbN36vVLX3DUXwefTbi6511R6KTHqLiNHeAR0kXiarg=",
         "owner": "rmagatti",
         "repo": "auto-session",
-        "rev": "292492ab7af4bd8b9e37e28508bc8ce995722fd5",
+        "rev": "5a269bb5bec50b8b60564aa00f6454d9e82fbe8d",
         "type": "github"
       },
       "original": {
@@ -938,7 +939,7 @@
         "type": "github"
       }
     },
-    "nvim_plugin-ron-rs/ron.vim": {
+    "nvim_plugin-ron/ron.vim": {
       "flake": false,
       "locked": {
         "lastModified": 1660904719,
@@ -989,11 +990,11 @@
     "nvim_plugin-stevearc/conform.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1762317018,
-        "narHash": "sha256-dJf8g5I85De4JYYCL4k7u85fatjU2BmF9pO5WbxhCQQ=",
+        "lastModified": 1756334700,
+        "narHash": "sha256-j9TOSx2L19AHABdg9pLtmEUtPOCIUSo0qe2YUPBlZ5g=",
         "owner": "stevearc",
         "repo": "conform.nvim",
-        "rev": "cde4da5c1083d3527776fee69536107d98dae6c9",
+        "rev": "b4aab989db276993ea5dcb78872be494ce546521",
         "type": "github"
       },
       "original": {
@@ -1101,11 +1102,11 @@
     "nvim_plugin-zbirenbaum/copilot.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1762533352,
-        "narHash": "sha256-/8baBZIhZdQ4B0hoTmh68I2p08rJJ7INil77qIu9vCU=",
+        "lastModified": 1757884406,
+        "narHash": "sha256-sXobILIsV4nnk9//PbFT4L1BsHP1xSJiuibVbGwYXJ8=",
         "owner": "zbirenbaum",
         "repo": "copilot.lua",
-        "rev": "5bde2cfe01f049f522eeb8b52c5c723407db8bdf",
+        "rev": "8aebaa3a102125fedf08c98773a0a8def92fff37",
         "type": "github"
       },
       "original": {
@@ -1119,8 +1120,8 @@
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_4",
-        "rust-overlay": "rust-overlay_2"
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1744897914,
@@ -1139,17 +1140,14 @@
     "root": {
       "inputs": {
         "common": "common",
-        "flatpaks": "flatpaks",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "ros_neovim": "ros_neovim",
-        "secrets": "secrets"
+        "ros_neovim": "ros_neovim"
       }
     },
     "ros_neovim": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "nvim_plugin-Almo7aya/openingh.nvim": "nvim_plugin-Almo7aya/openingh.nvim",
         "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim",
         "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring",
@@ -1180,6 +1178,7 @@
         "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
         "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
         "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
         "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
         "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
         "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
@@ -1193,7 +1192,7 @@
         "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
         "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
         "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
-        "nvim_plugin-ron-rs/ron.vim": "nvim_plugin-ron-rs/ron.vim",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
         "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
         "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
         "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
@@ -1204,14 +1203,14 @@
         "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
         "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
         "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1763012261,
-        "narHash": "sha256-xrxrvRT9+2dQRs5O5GjgFcCpSHijcweg/3nERf1A/3c=",
+        "lastModified": 1758041510,
+        "narHash": "sha256-vcK6ZwAWNfjdDFYKLVrWk+azva58AiDpm8nMfIniFWA=",
         "ref": "refs/heads/master",
-        "rev": "66100486bb45e80f6007afd780ad0914e263ba8e",
-        "revCount": 321,
+        "rev": "b3dbdf3f7360747987bf38bcdd9baf01b4906929",
+        "revCount": 304,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/nvim"
       },
@@ -1223,28 +1222,7 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "ros_neovim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1763001554,
-        "narHash": "sha256-wsfhRTuxu6f06RMmP4JWcq3wWRlmYtQaJZ6b3f+EJ94=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "315d97eb753cee8e1aa039a5e622b84d32a454bb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ]
@@ -1263,24 +1241,25 @@
         "type": "github"
       }
     },
-    "secrets": {
+    "rust-overlay_2": {
       "inputs": {
-        "ragenix": "ragenix"
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "dir": "flakes/secrets",
-        "lastModified": 1762828900,
-        "narHash": "sha256-0AtMggGG2kUpE3HpWEweLe2jlstMGhEGAHBgqBXA2Ds=",
-        "ref": "refs/heads/master",
-        "rev": "1dd7e442dd99d8f3e3867655ecb0c5f4d666853c",
-        "revCount": 774,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1757930296,
+        "narHash": "sha256-Z9u5VszKs8rfEvg2AsFucWEjl7wMtAln9l1b78cfBh4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "09442765a05c2ca617c20ed68d9613da92a2d96b",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/secrets",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
diff --git a/hosts/lio/flake.nix b/hosts/lio/flake.nix
index cbdd81f..e3bbf5e 100644
--- a/hosts/lio/flake.nix
+++ b/hosts/lio/flake.nix
@@ -1,17 +1,11 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
-
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     # Use relative to get current version for testing
-    common.url = "path:../../flakes/common";
-    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
-    # flatpaks.url = "path:../../flakes/flatpaks";
-    flatpaks.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/flatpaks";
+    common.url = "path:../../common";
+    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
 
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
   };
@@ -19,69 +13,35 @@
   outputs =
     {
       nixpkgs,
-      home-manager,
       common,
-      secrets,
-      flatpaks,
       ros_neovim,
       ...
     }@inputs:
     let
       configuration_name = "lio";
-      system = "x86_64-linux";
-      primaryUser = "josh";
       lib = nixpkgs.lib;
     in
     {
       nixosConfigurations = {
         "${configuration_name}" = (
           lib.nixosSystem {
-            inherit system;
             specialArgs = {
               inherit inputs;
               upkgs = import inputs.nixpkgs-unstable {
-                inherit system;
+                system = "x86_64-linux";
                 config.allowUnfree = true;
               };
             };
             modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
+              common.nixosModules.default
               ros_neovim.nixosModules.default
-              (
-                { ... }:
-                {
-                  ringofstorms-nvim.includeAllRuntimeDependencies = true;
-                }
-              )
-              flatpaks.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.tmux
-              common.nixosModules.boot_systemd
-              # common.nixosModules.de_sway
-              common.nixosModules.de_i3
-              common.nixosModules.hardening
-              common.nixosModules.jetbrains_font
-              common.nixosModules.nix_options
-              common.nixosModules.no_sleep
-              common.nixosModules.podman
-              common.nixosModules.q_flipper
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-
               ./configuration.nix
               ./hardware-configuration.nix
               (import ./containers.nix { inherit inputs; })
               # ./jails_text.nix
               # ./hyprland_customizations.nix
               # ./sway_customizations.nix
-              ./i3_customizations.nix
-              ./opencode-shim.nix
+              # ./i3_customizations.nix
               (
                 {
                   config,
@@ -90,84 +50,130 @@
                   lib,
                   ...
                 }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = "25.05";
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      # common.homeManagerModules.de_sway
-                      common.homeManagerModules.de_i3
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.foot
-                      common.homeManagerModules.git
-                      common.homeManagerModules.kitty
-                      common.homeManagerModules.launcher_rofi
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.slicer
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-
-                    extraSpecialArgs = {
-                      inherit inputs;
-                      inherit upkgs;
+                {
+                  programs = {
+                    nix-ld = {
+                      enable = true;
+                      libraries = with pkgs; [
+                        icu
+                        gmp
+                        glibc
+                        openssl
+                        stdenv.cc.cc
+                      ];
                     };
                   };
-
-                  # System configuration
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${config.networking.hostName}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "video"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJN2nsLmAlF6zj5dEBkNSJaqcCya+aB6I0imY8Q5Ew0S nix2lio"
-                      ];
-                    };
+                  environment.shellAliases = {
+                    "oc" =
+                      "all_proxy='' http_proxy='' https_proxy='' /home/josh/other/opencode/node_modules/opencode-linux-x64/bin/opencode";
+                    "occ" = "oc -c";
                   };
 
                   environment.systemPackages = with pkgs; [
-                    vlang
-                    ttyd
+                    lua
+                    qdirstat
+                    ffmpeg-full
+                    appimage-run
+                    nodejs_24
+                    foot
+                    vlc
+                    upkgs.ladybird
+                    google-chrome
                   ];
+                  # Also allow this key to work for root user, this will let us use this as a remote builder easier
+                  users.users.root.openssh.authorizedKeys.keys = [
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJN2nsLmAlF6zj5dEBkNSJaqcCya+aB6I0imY8Q5Ew0S nix2lio"
+                  ];
+                  # Allow emulation of aarch64-linux binaries for cross compiling
+                  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-                  services.flatpak.packages = [
-                    "org.signal.Signal"
-                    "dev.vencord.Vesktop"
-                    "md.obsidian.Obsidian"
-                    "com.spotify.Client"
-                    "com.bitwarden.desktop"
-                    "org.openscad.OpenSCAD"
-                    "org.blender.Blender"
-                    "com.rustdesk.RustDesk"
-                  ];
+                  home-manager.extraSpecialArgs = {
+                    inherit inputs;
+                    inherit upkgs;
+                  };
 
-                  networking.firewall.allowedTCPPorts = [
-                    8080
-                  ];
+                  ringofstorms_common = {
+                    systemName = configuration_name;
+                    boot.systemd.enable = true;
+                    secrets.enable = true;
+                    general = {
+                      reporting.enable = true;
+                      disableRemoteBuildsOnLio = true;
+                    };
+                    desktopEnvironment.i3 = {
+                      enable = true;
+                      # waybar.enable = true;
+                      # swaync.enable = true;
+                    };
+                    programs = {
+                      rustDev.enable = true;
+                      uhkAgent.enable = true;
+                      tailnet.enable = true;
+                      tailnet.enableExitNode = true;
+                      ssh.enable = true;
+                      podman.enable = true;
+                      virt-manager.enable = true;
+                      flatpaks = {
+                        enable = true;
+                        packages = [
+                          "org.signal.Signal"
+                          "dev.vencord.Vesktop"
+                          "md.obsidian.Obsidian"
+                          "com.spotify.Client"
+                          "com.bitwarden.desktop"
+                          "org.openscad.OpenSCAD"
+                          "org.blender.Blender"
+                          "com.rustdesk.RustDesk"
+                        ];
+                      };
+                    };
+                    users = {
+                      # Users are all normal users and default password is password1
+                      admins = [ "josh" ]; # First admin is also the primary user owning nix config
+                      users = {
+                        josh = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJN2nsLmAlF6zj5dEBkNSJaqcCya+aB6I0imY8Q5Ew0S nix2lio"
+                          ];
+                          extraGroups = [
+                            "networkmanager"
+                            "video"
+                            "input"
+                          ];
+                          shell = pkgs.zsh;
+                          packages = with pkgs; [
+                            sabnzbd
+                          ];
+                        };
+                      };
+                    };
+                    homeManager = {
+                      users = {
+                        josh = {
+                          imports = with common.homeManagerModules; [
+                            tmux
+                            atuin
+                            kitty
+                            foot
+                            direnv
+                            git
+                            nix_deprecations
+                            obs
+                            postgres
+                            slicer
+                            ssh
+                            starship
+                            zoxide
+                            zsh
+                          ];
+                        };
+                      };
+                    };
+                  };
                 }
               )
             ];
+
           }
         );
       };
diff --git a/hosts/lio/home_manager.nix b/hosts/lio/home_manager.nix
deleted file mode 100644
index f42762b..0000000
--- a/hosts/lio/home_manager.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-{
-
-}
diff --git a/hosts/lio/hyprland_customizations.nix b/hosts/lio/hyprland_customizations.nix
index 7629e2e..201b04a 100644
--- a/hosts/lio/hyprland_customizations.nix
+++ b/hosts/lio/hyprland_customizations.nix
@@ -121,19 +121,6 @@ in
 
     ringofstorms_common.desktopEnvironment.hyprland.extraOptions = hyprlandExtraOptions;
 
-    ringofstorms_common.desktopEnvironment.hyprland.hyprpaperSettings = {
-      mode = "fill"; # Wallpaper display mode: fill, fit, stretch, center, tile
-
-      preload = [
-        "${../_shared_assets/wallpapers/pixel_neon.png}"
-      ];
-
-      wallpaper = [
-        "${mainMonitor},${../_shared_assets/wallpapers/pixel_neon.png}"
-        "${secondaryMonitor},${../_shared_assets/wallpapers/pixel_neon_v.png}"
-      ];
-    };
-
     # User-level systemd service that follows your Hyprland session and watches for monitor changes
     # systemd.user.services.hyprland-move-workspaces = {
     #   description = "Keep workspaces 1–6 on main and 7–10 on secondary; react to monitor changes";
diff --git a/hosts/lio/i3_customizations.nix b/hosts/lio/i3_customizations.nix
index 4f294e5..d53186d 100644
--- a/hosts/lio/i3_customizations.nix
+++ b/hosts/lio/i3_customizations.nix
@@ -1,51 +1,71 @@
-{ pkgs, ... }:
-let
-  assignLines = ''
-    workspace 1 output DP-1
-    workspace 2 output DP-1
-    workspace 3 output DP-1
-    workspace 4 output DP-1
-    workspace 5 output DP-1
-    workspace 6 output DP-1
-    workspace 7 output DP-2
-    workspace 8 output DP-2
-    workspace 9 output DP-2
-    workspace 10 output DP-2
-  '';
-  bg1 = ../_shared_assets/wallpapers/pixel_neon.png;
-  bg2 = ../_shared_assets/wallpapers/pixel_neon_v.png;
-  # xrSetup = "xrandr --output DP-1 --mode 3840x2160 --rate 119.88 --pos 0x0 --primary; sleep 0.2; xrandr --output DP-2 --mode 3440x1440 --rate 99.98 --rotate left --left-of DP-1";
-  xrSetup = "xrandr --output DP-1 --mode 3840x2160 --rate 60 --pos 0x0 --primary; sleep 0.2; xrandr --output DP-2 --mode 3440x1440 --rate 99.98 --rotate left --left-of DP-1";
-  xwallpaperCmd = "xwallpaper --output DP-1 --zoom ${bg1} --output DP-2 --zoom ${bg2}";
-  startupCmd = "sh -c 'sleep 0.2; i3-msg workspace number 7; sleep 0.2; i3-msg workspace number 1'";
-  i3ExtraOptions = {
-    startup = [
-      { command = "${xrSetup}"; }
-      { command = "sh -c 'sleep 1; ${xwallpaperCmd}'"; }
-      { command = "${startupCmd}"; }
-    ];
-  };
-in
+{ ... }:
 {
-  options = { };
-  config = {
-    home-manager.sharedModules = [
-      (
-         { lib, pkgs, ... }:
-         let
-           inherit (lib) mkAfter;
-         in
-          {
-            xsession.windowManager.i3.config.startup = mkAfter (i3ExtraOptions.startup ++ [
-              { command = "nm-applet"; }
-              { command = "blueman-applet"; }
-              { command = "xfce4-power-manager"; }
-              { command = "sh -c 'xset s off -dpms; xset s noblank'"; }
-            ]);
-            xsession.windowManager.i3.extraConfig = mkAfter assignLines;
-            home.packages = [ pkgs.xwallpaper pkgs.xorg.xrandr pkgs.xorg.xset ];
-          }
-      )
+  ringofstorms_common.desktopEnvironment.i3.extraOptions = {
+    startup = [
+      {
+        command = "exec sh -c 'sleep 0.01; i3-msg workspace 7; sleep 0.02; i3-msg workspace 1'";
+      }
     ];
+
+    # Example: map workspaces 1–6 to DP-1 and 7–10 to DP-2
+    workspaceOutputAssign = [
+      {
+        workspace = "1";
+        output = "DP-1";
+      }
+      {
+        workspace = "2";
+        output = "DP-1";
+      }
+      {
+        workspace = "3";
+        output = "DP-1";
+      }
+      {
+        workspace = "4";
+        output = "DP-1";
+      }
+      {
+        workspace = "5";
+        output = "DP-1";
+      }
+      {
+        workspace = "6";
+        output = "DP-1";
+      }
+      {
+        workspace = "7";
+        output = "DP-2";
+      }
+      {
+        workspace = "8";
+        output = "DP-2";
+      }
+      {
+        workspace = "9";
+        output = "DP-2";
+      }
+      {
+        workspace = "10";
+        output = "DP-2";
+      }
+    ];
+
+    # Optional output settings
+    output = {
+      "DP-1" = {
+        scale = "1";
+        pos = "0 0";
+        mode = "3840x2160@97.983Hz";
+        bg = "${./wallpapers/pixel_neon.png} fill";
+      };
+      "DP-2" = {
+        scale = "1";
+        transform = "270";
+        pos = "-1440 -640";
+        mode = "3440x1440@99.982Hz";
+        bg = "${./wallpapers/pixel_neon_v.png} fill";
+      };
+    };
   };
 }
diff --git a/hosts/lio/opencode-shim.nix b/hosts/lio/opencode-shim.nix
deleted file mode 100644
index e4ecdd4..0000000
--- a/hosts/lio/opencode-shim.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-{
-  programs = {
-    nix-ld = {
-      enable = true;
-      libraries = with pkgs; [
-        icu
-        gmp
-        glibc
-        openssl
-        stdenv.cc.cc
-      ];
-    };
-  };
-  environment.shellAliases = {
-    "oc" =
-      "all_proxy='' http_proxy='' https_proxy='' /home/josh/other/opencode/node_modules/opencode-linux-x64/bin/opencode";
-    "occ" = "oc -c";
-  };
-}
diff --git a/hosts/lio/sway_customizations.nix b/hosts/lio/sway_customizations.nix
index a58f2e2..f37b83f 100644
--- a/hosts/lio/sway_customizations.nix
+++ b/hosts/lio/sway_customizations.nix
@@ -57,14 +57,14 @@ let
         scale = "1";
         pos = "0 0";
         mode = "3840x2160@97.983Hz";
-        bg = "${../_shared_assets/wallpapers/pixel_neon.png} fill";
+        bg = "${./wallpapers/pixel_neon.png} fill";
       };
       "DP-2" = {
         scale = "1";
         transform = "270";
         pos = "-1440 -640";
         mode = "3440x1440@99.982Hz";
-        bg = "${../_shared_assets/wallpapers/pixel_neon_v.png} fill";
+        bg = "${./wallpapers/pixel_neon_v.png} fill";
       };
     };
   };
@@ -74,15 +74,8 @@ in
   options = { };
 
   config = {
-    # ringofstorms_common.desktopEnvironment.sway.extraOptions = swayExtraOptions;
+    environment.systemPackages = [ ];
 
-    home-manager.sharedModules = [
-      (
-        { ... }:
-        {
-          wayland.windowManager.sway.config = swayExtraOptions;
-        }
-      )
-    ];
+    ringofstorms_common.desktopEnvironment.sway.extraOptions = swayExtraOptions;
   };
 }
diff --git a/hosts/_shared_assets/wallpapers/pixel_neon.png b/hosts/lio/wallpapers/pixel_neon.png
similarity index 100%
rename from hosts/_shared_assets/wallpapers/pixel_neon.png
rename to hosts/lio/wallpapers/pixel_neon.png
diff --git a/hosts/_shared_assets/wallpapers/pixel_neon_v.png b/hosts/lio/wallpapers/pixel_neon_v.png
similarity index 100%
rename from hosts/_shared_assets/wallpapers/pixel_neon_v.png
rename to hosts/lio/wallpapers/pixel_neon_v.png
diff --git a/hosts/oracle/o001/configuration.nix b/hosts/oracle/o001/configuration.nix
index f903bc4..50a0d5e 100644
--- a/hosts/oracle/o001/configuration.nix
+++ b/hosts/oracle/o001/configuration.nix
@@ -4,4 +4,6 @@
   zramSwap.enable = false;
   networking.hostName = "o001";
   networking.domain = "subnet01171946.vcn01171946.oraclevcn.com";
+  services.openssh.enable = true;
+  system.stateVersion = "23.11";
 }
diff --git a/hosts/oracle/o001/containers/vaultwarden.nix b/hosts/oracle/o001/containers/vaultwarden.nix
index 3837d81..d209402 100644
--- a/hosts/oracle/o001/containers/vaultwarden.nix
+++ b/hosts/oracle/o001/containers/vaultwarden.nix
@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   ...
 }:
 let
@@ -10,13 +9,6 @@ let
   hostDataDir = "/var/lib/${name}";
 
   v_port = 8222;
-  
-  hasSecret =
-    secret:
-    let
-      secrets = config.age.secrets or { };
-    in
-    secrets ? ${secret} && secrets.${secret} != null;
 in
 {
   users = {
@@ -34,7 +26,7 @@ in
     chmod -R 750 ${hostDataDir}
   '';
 
-  containers.${name} = lib.mkIf (hasSecret "vaultwarden_env") {
+  containers.${name} = {
     ephemeral = true;
     autoStart = true;
     privateNetwork = false;
@@ -80,7 +72,7 @@ in
       };
   };
 
-  services.nginx.virtualHosts."vault.joshuabell.xyz" = lib.mkIf (hasSecret "vaultwarden_env") {
+  services.nginx.virtualHosts."vault.joshuabell.xyz" = {
     enableACME = true;
     forceSSL = true;
     locations = {
diff --git a/hosts/oracle/o001/flake.lock b/hosts/oracle/o001/flake.lock
index efc9328..a4afc77 100644
--- a/hosts/oracle/o001/flake.lock
+++ b/hosts/oracle/o001/flake.lock
@@ -5,11 +5,11 @@
         "darwin": "darwin",
         "home-manager": "home-manager_2",
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ],
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1736955230,
@@ -26,21 +26,20 @@
       }
     },
     "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "ragenix": "ragenix"
+      },
       "locked": {
-        "dir": "flakes/common",
-        "lastModified": 1762758426,
-        "narHash": "sha256-ynggVRutohq7TPhbz0ADXWRtsi4BGynGoRXdGyertRo=",
-        "ref": "refs/heads/master",
-        "rev": "7185d24a8ba9b7176b6f742ea2ee0e57d375dc43",
-        "revCount": 769,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "path": "../../../common",
+        "type": "path"
       },
       "original": {
-        "dir": "flakes/common",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      }
+        "path": "../../../common",
+        "type": "path"
+      },
+      "parent": []
     },
     "crane": {
       "locked": {
@@ -60,7 +59,7 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -84,15 +83,15 @@
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1762286984,
-        "narHash": "sha256-9I2H9x5We6Pl+DBYHjR1s3UT8wgwcpAH03kn9CqtdQc=",
+        "lastModified": 1749105467,
+        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "9c870f63e28ec1e83305f7f6cb73c941e699f74f",
+        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
         "type": "github"
       },
       "original": {
@@ -119,7 +118,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -137,14 +136,14 @@
     },
     "home-manager": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1753592768,
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
@@ -157,7 +156,7 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -177,23 +176,23 @@
         "type": "github"
       }
     },
-    "nixpkgs": {
+    "nix-flatpak": {
       "locked": {
-        "lastModified": 1743014863,
-        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs": {
       "locked": {
         "lastModified": 1753345091,
         "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
@@ -209,7 +208,39 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1741379970,
+        "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1743014863,
+        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1750622754,
         "narHash": "sha256-kMhs+YzV4vPGfuTpD3mwzibWUE6jotw5Al2wczI0Pv8=",
@@ -225,33 +256,17 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1761619080,
-        "narHash": "sha256-PsLFmU/CORWeCjJi9ALsegwr/SMjf2gHsooTR09az4c=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "fd644bba1d3a83169e4b312ce20928ba1b0abb02",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1741379970,
-        "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
+        "lastModified": 1750188666,
+        "narHash": "sha256-yAfLvtbCzSigTfbsJeOrvljS7VYLAwi2RZ6F+qd+A5E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f",
+        "rev": "aa36c6c05d04f90cf890f87845be9380cf7b83c2",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -275,11 +290,11 @@
     "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761323006,
-        "narHash": "sha256-6BjkqZCo2DLVxW6BHyElt2cZdG6Dhzao8hPfWYm0sIQ=",
+        "lastModified": 1750069301,
+        "narHash": "sha256-lIAsudDunKOY69r00czO+rmMbM+woIdIGroT4dUZAFc=",
         "owner": "CopilotC-Nvim",
         "repo": "CopilotChat.nvim",
-        "rev": "a7138a0ee04d8af42c262554eccee168bbf1454f",
+        "rev": "5df0b668d23c05c173f6bc79bb19642215b8b66a",
         "type": "github"
       },
       "original": {
@@ -307,11 +322,11 @@
     "nvim_plugin-L3MON4D3/LuaSnip": {
       "flake": false,
       "locked": {
-        "lastModified": 1761039842,
-        "narHash": "sha256-ovvtTZgqL6MFvuI3byx+boWm6ErZX06+v6a3VoctREc=",
+        "lastModified": 1749564222,
+        "narHash": "sha256-StttV19d5gWbFPxerCOX3dXIaRwg1oeUANIbNztALps=",
         "owner": "L3MON4D3",
         "repo": "LuaSnip",
-        "rev": "ccf25a5452b8697a823de3e5ecda63ed3d723b79",
+        "rev": "fb525166ccc30296fb3457441eb979113de46b00",
         "type": "github"
       },
       "original": {
@@ -323,11 +338,11 @@
     "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343950,
-        "narHash": "sha256-HycEAgAsU8IxFiYfyp5ZGN+z6wYyCarIESxA9TDuJ3s=",
+        "lastModified": 1749846779,
+        "narHash": "sha256-j1aslQ3SPD9ZuhQDEt9e5GD+VZ6N6Re7IjVFXycaxWI=",
         "owner": "MeanderingProgrammer",
         "repo": "render-markdown.nvim",
-        "rev": "bfd67f1402b97ac619cb538f4bbaed12a7fa89aa",
+        "rev": "76f7ce56ccb913632745714f160faa53164c5574",
         "type": "github"
       },
       "original": {
@@ -371,11 +386,11 @@
     "nvim_plugin-Saecki/crates.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1755956579,
-        "narHash": "sha256-jfmST/S9ymwgQ99PTCOlJkk5zaxE5HiDV16TmTISDII=",
+        "lastModified": 1748637634,
+        "narHash": "sha256-sDjG6fjnQsyYtdf7xpmOW193e7USh6ghrFzo6NoLyP8=",
         "owner": "Saecki",
         "repo": "crates.nvim",
-        "rev": "ac9fa498a9edb96dc3056724ff69d5f40b898453",
+        "rev": "5d8b1bef686db0fabe5f1bb593744b617e8f1405",
         "type": "github"
       },
       "original": {
@@ -387,11 +402,11 @@
     "nvim_plugin-aznhe21/actions-preview.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759462626,
-        "narHash": "sha256-YUeWBXxxeurfWBi0PjUi6izqYAvUw9DHmvsuPXm7ohw=",
+        "lastModified": 1745779150,
+        "narHash": "sha256-rQjwlu5gQcOvxF72lr9ugPRl0W78wCWGWPhpN1oOMbs=",
         "owner": "aznhe21",
         "repo": "actions-preview.nvim",
-        "rev": "cb938c25edaac38d362555f19244a9cb85d561e8",
+        "rev": "36513ad213855d497b7dd3391a24d1d75d58e36f",
         "type": "github"
       },
       "original": {
@@ -403,11 +418,11 @@
     "nvim_plugin-b0o/schemastore.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343239,
-        "narHash": "sha256-obGnux+K0blHROEOAy7Ct18vxiO4Qez8XJB5l23KgMs=",
+        "lastModified": 1750179699,
+        "narHash": "sha256-EGt75z/NbjzDXxsyXT9Qj2wWOf06ijUr1If5ljmfLqo=",
         "owner": "b0o",
         "repo": "schemastore.nvim",
-        "rev": "4341619da06779ae310ee9c3d6d70edfefed7152",
+        "rev": "45fd6c22f30487586c771072dc8c5230931e4c7b",
         "type": "github"
       },
       "original": {
@@ -419,11 +434,11 @@
     "nvim_plugin-catppuccin/nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761396780,
-        "narHash": "sha256-Nz/XbItShbrnKtj0+gcEDBFO5y00g0EG5CHqdJGK2j0=",
+        "lastModified": 1749271780,
+        "narHash": "sha256-wt/Ybjgr4N80B+QsyANs1QezM7PpFceUWSweRFgkhl0=",
         "owner": "catppuccin",
         "repo": "nvim",
-        "rev": "8c4125e3c746976ba025dc5d908fa22c6aa09486",
+        "rev": "fa42eb5e26819ef58884257d5ae95dd0552b9a66",
         "type": "github"
       },
       "original": {
@@ -435,11 +450,11 @@
     "nvim_plugin-chrisgrieser/nvim-early-retirement": {
       "flake": false,
       "locked": {
-        "lastModified": 1760385962,
-        "narHash": "sha256-PtpD6Uc4GK4dSJynWH5d6c7XOWXfYODXJ3FyOY1eZNo=",
+        "lastModified": 1750108178,
+        "narHash": "sha256-3I7Xup+v9Yq9/nJQ1F5CDW99oFQcxbinv7VQcKeA16Y=",
         "owner": "chrisgrieser",
         "repo": "nvim-early-retirement",
-        "rev": "9109589b542773c9ad2a34067a085874f255577b",
+        "rev": "d9ffd8f70ed6d466cecd3e7e2dd1425b0010932f",
         "type": "github"
       },
       "original": {
@@ -467,11 +482,11 @@
     "nvim_plugin-folke/lazy.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761488113,
-        "narHash": "sha256-jBmtFzzdGYe3N3kvWHvR7FGXtA+/t36efxsAqhLmaxU=",
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
         "owner": "folke",
         "repo": "lazy.nvim",
-        "rev": "ed4dc336a73c18da6fea6e1cf7ad6e1b76d281eb",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
         "type": "github"
       },
       "original": {
@@ -499,11 +514,11 @@
     "nvim_plugin-folke/which-key.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759952076,
-        "narHash": "sha256-N31+V5L0gd+TUo9nVtNGRmMVmM9fMxOwldCfuLYT4hU=",
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
         "owner": "folke",
         "repo": "which-key.nvim",
-        "rev": "b4177e3eaf15fe5eb8357ebac2286d488be1ed00",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
         "type": "github"
       },
       "original": {
@@ -531,11 +546,11 @@
     "nvim_plugin-hrsh7th/cmp-nvim-lsp": {
       "flake": false,
       "locked": {
-        "lastModified": 1755085771,
-        "narHash": "sha256-X1rppwf2xBPrmB93ptXukOnEBDZmfjJd4F5ObNa1DHs=",
+        "lastModified": 1743496195,
+        "narHash": "sha256-iaihXNCF5bB5MdeoosD/kc3QtpA/QaIDZVLiLIurBSM=",
         "owner": "hrsh7th",
         "repo": "cmp-nvim-lsp",
-        "rev": "bd5a7d6db125d4654b50eeae9f5217f24bb22fd3",
+        "rev": "a8912b88ce488f411177fc8aed358b04dc246d7b",
         "type": "github"
       },
       "original": {
@@ -547,11 +562,11 @@
     "nvim_plugin-hrsh7th/cmp-path": {
       "flake": false,
       "locked": {
-        "lastModified": 1753844861,
-        "narHash": "sha256-e4Rd2y1Wekp7aobpTGaUeoSBnlfIASDaBR8js5dh2Vw=",
+        "lastModified": 1743497173,
+        "narHash": "sha256-thppiiV3wjIaZnAXmsh7j3DUc6ceSCvGzviwFUnoPaI=",
         "owner": "hrsh7th",
         "repo": "cmp-path",
-        "rev": "c642487086dbd9a93160e1679a1327be111cbc25",
+        "rev": "c6635aae33a50d6010bf1aa756ac2398a2d54c32",
         "type": "github"
       },
       "original": {
@@ -563,11 +578,11 @@
     "nvim_plugin-hrsh7th/nvim-cmp": {
       "flake": false,
       "locked": {
-        "lastModified": 1760792454,
-        "narHash": "sha256-wkESSNUViVI5DE+3t4AVTaSLQ/hTB43vrm+PH6uA8H4=",
+        "lastModified": 1744514599,
+        "narHash": "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=",
         "owner": "hrsh7th",
         "repo": "nvim-cmp",
-        "rev": "a7bcf1d88069fc67c9ace8a62ba480b8fe879025",
+        "rev": "b5311ab3ed9c846b585c0c15b7559be131ec4be9",
         "type": "github"
       },
       "original": {
@@ -579,11 +594,11 @@
     "nvim_plugin-j-hui/fidget.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761243883,
-        "narHash": "sha256-XXTeJweQRIsC/WFhFxFbepOETV8e5Wfmh513su2Wve0=",
+        "lastModified": 1738817426,
+        "narHash": "sha256-AFUx/ZQVWV7s5Wlppjk6N9QXoJKNKqxtf990FFlTEhw=",
         "owner": "j-hui",
         "repo": "fidget.nvim",
-        "rev": "e32b672d8fd343f9d6a76944fedb8c61d7d8111a",
+        "rev": "d9ba6b7bfe29b3119a610892af67602641da778e",
         "type": "github"
       },
       "original": {
@@ -611,11 +626,11 @@
     "nvim_plugin-lewis6991/gitsigns.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760888451,
-        "narHash": "sha256-eGpB7YYWbyCCGYXEYAM432srSp/lUo5C1b0J3OYjwnY=",
+        "lastModified": 1750058704,
+        "narHash": "sha256-V9aXXR9ZP2G/XInHt07RylC4rS+AyMXAAfODvC6pVxw=",
         "owner": "lewis6991",
         "repo": "gitsigns.nvim",
-        "rev": "20ad4419564d6e22b189f6738116b38871082332",
+        "rev": "88205953bd748322b49b26e1dfb0389932520dc9",
         "type": "github"
       },
       "original": {
@@ -659,11 +674,11 @@
     "nvim_plugin-m4xshen/hardtime.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1757738091,
-        "narHash": "sha256-Jy9ARUHU1ySpSxxoS3hLRjxp5Lqt7juWN5Jnbdo0rg0=",
+        "lastModified": 1750160168,
+        "narHash": "sha256-hzFX5mZRxTDDIp/iBVl4lqEaQryLQOe7jFJmXDwq4J8=",
         "owner": "m4xshen",
         "repo": "hardtime.nvim",
-        "rev": "b4e431934af1fe224a3a801f632c008278cb7628",
+        "rev": "b9a989191b3a97c9316a0efea02341c4cdab845a",
         "type": "github"
       },
       "original": {
@@ -675,11 +690,11 @@
     "nvim_plugin-mbbill/undotree": {
       "flake": false,
       "locked": {
-        "lastModified": 1759186837,
-        "narHash": "sha256-EWOH08KAWyoT9m45/B1d5aKQQJtd3k4orJbagVsxe08=",
+        "lastModified": 1741878850,
+        "narHash": "sha256-HGf4Toe+12YZtIalvANDXAtksCsnxQkZbcevOAnl5G4=",
         "owner": "mbbill",
         "repo": "undotree",
-        "rev": "0f1c9816975b5d7f87d5003a19c53c6fd2ff6f7f",
+        "rev": "b951b87b46c34356d44aa71886aecf9dd7f5788a",
         "type": "github"
       },
       "original": {
@@ -691,11 +706,11 @@
     "nvim_plugin-mfussenegger/nvim-lint": {
       "flake": false,
       "locked": {
-        "lastModified": 1759852544,
-        "narHash": "sha256-wVEX0lCxeipvwCfdd2JbQwnhgg6UrTXixC8E1OiEblI=",
+        "lastModified": 1749731021,
+        "narHash": "sha256-V4JJ1VQXoIsUBTxe6ykbkyo6LxEAr+QEIqIV3mA9phs=",
         "owner": "mfussenegger",
         "repo": "nvim-lint",
-        "rev": "9da1fb942dd0668d5182f9c8dee801b9c190e2bb",
+        "rev": "2b0039b8be9583704591a13129c600891ac2c596",
         "type": "github"
       },
       "original": {
@@ -707,11 +722,11 @@
     "nvim_plugin-mrcjkb/rustaceanvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761585884,
-        "narHash": "sha256-m/gd+cb7X2a7R6JSbHes0QjGs+zuj4698Qyi/OW0R1g=",
+        "lastModified": 1750024924,
+        "narHash": "sha256-gmOqCnSLGDNerXyuuNhkyL/pSJitnyqBdWC3LejZoS4=",
         "owner": "mrcjkb",
         "repo": "rustaceanvim",
-        "rev": "be0d1d14b8504c1c0965b608dc7ed39f2d588c91",
+        "rev": "2fdf224107e5bc29fb5c3a175f5f2c9161b34741",
         "type": "github"
       },
       "original": {
@@ -723,11 +738,11 @@
     "nvim_plugin-neovim/nvim-lspconfig": {
       "flake": false,
       "locked": {
-        "lastModified": 1761605346,
-        "narHash": "sha256-3Aulaw6KMmrcoQQxhRhQhjZ2fg6MSU4Q7qAWtrVsOcA=",
+        "lastModified": 1750169575,
+        "narHash": "sha256-lJWMFgQLQhKUuv50WrYXlJ3TFqT04nVbmcBGVDaSz0k=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "2b52bc2190c8efde2e4de02d829a138666774c7c",
+        "rev": "99d3a0f26bfe402f45257c1398287aef252cbe2d",
         "type": "github"
       },
       "original": {
@@ -736,6 +751,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1748880705,
+        "narHash": "sha256-eTnVFOR7FHlkU9kwrk3q3pNo/U8OR2gJrnrMUQKGi2A=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "6e893c32ff7c5b8d0d501b748c525fa53963fb35",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-numToStr/Comment.nvim": {
       "flake": false,
       "locked": {
@@ -755,11 +786,11 @@
     "nvim_plugin-nvim-lua/plenary.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1753570668,
-        "narHash": "sha256-9Un7ekhBxcnmFE1xjCCFTZ7eqIbmXvQexpnhduAg4M0=",
+        "lastModified": 1739311008,
+        "narHash": "sha256-8FV5RjF7QbDmQOQynpK7uRKONKbPRYbOPugf9ZxNvUs=",
         "owner": "nvim-lua",
         "repo": "plenary.nvim",
-        "rev": "b9fd5226c2f76c951fc8ed5923d85e4de065e509",
+        "rev": "857c5ac632080dba10aae49dba902ce3abf91b35",
         "type": "github"
       },
       "original": {
@@ -771,11 +802,11 @@
     "nvim_plugin-nvim-lualine/lualine.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760596863,
-        "narHash": "sha256-hdrAdG3hC2sAevQ6a9xizqPgEgnNKxuc5rBYn0pKM1c=",
+        "lastModified": 1749383457,
+        "narHash": "sha256-2aPgA7riA/FubQpTkqsxLKl7OZ8L6FkucNHc2QEx2HQ=",
         "owner": "nvim-lualine",
         "repo": "lualine.nvim",
-        "rev": "3946f0122255bc377d14a59b27b609fb3ab25768",
+        "rev": "a94fc68960665e54408fe37dcf573193c4ce82c9",
         "type": "github"
       },
       "original": {
@@ -787,11 +818,11 @@
     "nvim_plugin-nvim-telescope/telescope-file-browser.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1754424906,
-        "narHash": "sha256-FlJ7w5Ywwq03E0oYdnFJFb+MMUMQMa+5QhDMy2O9tGQ=",
+        "lastModified": 1750040034,
+        "narHash": "sha256-NHcU3c+1pLeypHr9xXKmqvdwB1QM/vj5axzjpFEQCLQ=",
         "owner": "nvim-telescope",
         "repo": "telescope-file-browser.nvim",
-        "rev": "3610dc7dc91f06aa98b11dca5cc30dfa98626b7e",
+        "rev": "7bf55ed0ff5be182ad3301cff266581fc1c56cce",
         "type": "github"
       },
       "original": {
@@ -851,11 +882,11 @@
     "nvim_plugin-nvim-tree/nvim-tree.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1760921408,
-        "narHash": "sha256-QCUp/6qX/FS8LrZ6K+pvC/mHkYW8xfzQZEB2y0VOStQ=",
+        "lastModified": 1750143568,
+        "narHash": "sha256-E2YdGlvvpnT/PiayfQldwpbCnjsyNDcoTzxgMf2ajV8=",
         "owner": "nvim-tree",
         "repo": "nvim-tree.lua",
-        "rev": "64e2192f5250796aa4a7f33c6ad888515af50640",
+        "rev": "d54a1875a91e1a705795ea26074795210b92ce7f",
         "type": "github"
       },
       "original": {
@@ -867,11 +898,11 @@
     "nvim_plugin-nvim-tree/nvim-web-devicons": {
       "flake": false,
       "locked": {
-        "lastModified": 1761440007,
-        "narHash": "sha256-klBjUtj0AvarN5a6O8Hh2t5BuOTe/m3ps2cHnlxVJvE=",
+        "lastModified": 1747360641,
+        "narHash": "sha256-+RHeFaeCF/iwAf8qAOjbEIl3YcnrBMVfkQnnzDNhyTA=",
         "owner": "nvim-tree",
         "repo": "nvim-web-devicons",
-        "rev": "8dcb311b0c92d460fac00eac706abd43d94d68af",
+        "rev": "1fb58cca9aebbc4fd32b086cb413548ce132c127",
         "type": "github"
       },
       "original": {
@@ -883,11 +914,11 @@
     "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
       "flake": false,
       "locked": {
-        "lastModified": 1761077440,
-        "narHash": "sha256-QdZstxKsEILwe7eUZCmMdyLPyvNKc/e7cfdYQowHWPQ=",
+        "lastModified": 1749893617,
+        "narHash": "sha256-QJAfpVdTHTxjUgggQekRLvNYuvG12gjtfTGybfcFdyo=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter-context",
-        "rev": "ec308c7827b5f8cb2dd0ad303a059c945dd21969",
+        "rev": "1a1a7c5d6d75cb49bf64049dafab15ebe294a79f",
         "type": "github"
       },
       "original": {
@@ -915,11 +946,11 @@
     "nvim_plugin-rcarriga/nvim-notify": {
       "flake": false,
       "locked": {
-        "lastModified": 1757190131,
-        "narHash": "sha256-h7STMjY+CBTqBkIDJXgtJz4WhNeQ02ES2Jesi3jZXeM=",
+        "lastModified": 1744548826,
+        "narHash": "sha256-m4dQ8KuMhbEpRh6zLTlIUDN9ojFj69LZnXXLepmdFI8=",
         "owner": "rcarriga",
         "repo": "nvim-notify",
-        "rev": "8701bece920b38ea289b457f902e2ad184131a5d",
+        "rev": "b5825cf9ee881dd8e43309c93374ed5b87b7a896",
         "type": "github"
       },
       "original": {
@@ -931,11 +962,11 @@
     "nvim_plugin-rmagatti/auto-session": {
       "flake": false,
       "locked": {
-        "lastModified": 1761491368,
-        "narHash": "sha256-F2MtkBCVAObRwniSvFjv5MmYnCaj1YSUf0Nk5MF1F4Y=",
+        "lastModified": 1749967462,
+        "narHash": "sha256-1pIGu/GJ4FiMH/yHhoo6Gu0HLC3rFQiesJBuv8uE7Vw=",
         "owner": "rmagatti",
         "repo": "auto-session",
-        "rev": "f0eb3d69848389869572b82b336d7a6887e88e43",
+        "rev": "fffb13dcbe8731b8650e5bf1caa749a485d20556",
         "type": "github"
       },
       "original": {
@@ -944,7 +975,7 @@
         "type": "github"
       }
     },
-    "nvim_plugin-ron-rs/ron.vim": {
+    "nvim_plugin-ron/ron.vim": {
       "flake": false,
       "locked": {
         "lastModified": 1660904719,
@@ -995,11 +1026,11 @@
     "nvim_plugin-stevearc/conform.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761160784,
-        "narHash": "sha256-yUUDxYuIjbFHUscEKpFV6IaraDNOA4hdcGljPHG/+sU=",
+        "lastModified": 1749498876,
+        "narHash": "sha256-n1IPUNwD14WlDU4zbgfJuhXQcVMt8oc4wCuUJBPJ+y4=",
         "owner": "stevearc",
         "repo": "conform.nvim",
-        "rev": "9fd3d5e0b689ec1bf400c53cbbec72c6fdf24081",
+        "rev": "8132ec733eed3bf415b97b76797ca41b59f51d7d",
         "type": "github"
       },
       "original": {
@@ -1024,6 +1055,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-supermaven-inc/supermaven-nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728314930,
+        "narHash": "sha256-1z3WKIiikQqoweReUyK5O8MWSRN5y95qcxM6qzlKMME=",
+        "owner": "supermaven-inc",
+        "repo": "supermaven-nvim",
+        "rev": "07d20fce48a5629686aefb0a7cd4b25e33947d50",
+        "type": "github"
+      },
+      "original": {
+        "owner": "supermaven-inc",
+        "repo": "supermaven-nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-tpope/vim-sleuth": {
       "flake": false,
       "locked": {
@@ -1075,11 +1122,11 @@
     "nvim_plugin-windwp/nvim-ts-autotag": {
       "flake": false,
       "locked": {
-        "lastModified": 1757545454,
-        "narHash": "sha256-nT2W5gKFEfzP7MztLjm7yqwam3ADk0svcMdLg2nmI/4=",
+        "lastModified": 1739910276,
+        "narHash": "sha256-a3Bcql68mp3y5bH9XMiDTQB0e75T+qFB593objIGg/I=",
         "owner": "windwp",
         "repo": "nvim-ts-autotag",
-        "rev": "c4ca798ab95b316a768d51eaaaee48f64a4a46bc",
+        "rev": "a1d526af391f6aebb25a8795cbc05351ed3620b5",
         "type": "github"
       },
       "original": {
@@ -1107,11 +1154,11 @@
     "nvim_plugin-zbirenbaum/copilot.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1761595323,
-        "narHash": "sha256-KkiU2xmpfIbpuijvcXDw+LWKWuBgxjwY7jEQIasN5Kw=",
+        "lastModified": 1749137204,
+        "narHash": "sha256-qxHpIsFFLDG/jtk6e1hkOZgDSRA5Q0+DMxxAxckNhIc=",
         "owner": "zbirenbaum",
         "repo": "copilot.lua",
-        "rev": "93adf9844dcbe09a37e7a72eaa286d33d38bf628",
+        "rev": "c1bb86abbed1a52a11ab3944ef00c8410520543d",
         "type": "github"
       },
       "original": {
@@ -1125,8 +1172,8 @@
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_5",
-        "rust-overlay": "rust-overlay_2"
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1744897914,
@@ -1146,15 +1193,13 @@
       "inputs": {
         "common": "common",
         "deploy-rs": "deploy-rs",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_3",
-        "ros_neovim": "ros_neovim",
-        "secrets": "secrets"
+        "nixpkgs": "nixpkgs_4",
+        "ros_neovim": "ros_neovim"
       }
     },
     "ros_neovim": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "nvim_plugin-Almo7aya/openingh.nvim": "nvim_plugin-Almo7aya/openingh.nvim",
         "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim",
         "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring": "nvim_plugin-JoosepAlviste/nvim-ts-context-commentstring",
@@ -1185,6 +1230,7 @@
         "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
         "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
         "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
         "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
         "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
         "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
@@ -1198,25 +1244,26 @@
         "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
         "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
         "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
-        "nvim_plugin-ron-rs/ron.vim": "nvim_plugin-ron-rs/ron.vim",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
         "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
         "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
         "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
         "nvim_plugin-stevearc/dressing.nvim": "nvim_plugin-stevearc/dressing.nvim",
+        "nvim_plugin-supermaven-inc/supermaven-nvim": "nvim_plugin-supermaven-inc/supermaven-nvim",
         "nvim_plugin-tpope/vim-sleuth": "nvim_plugin-tpope/vim-sleuth",
         "nvim_plugin-tpope/vim-surround": "nvim_plugin-tpope/vim-surround",
         "nvim_plugin-uga-rosa/ccc.nvim": "nvim_plugin-uga-rosa/ccc.nvim",
         "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
         "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
         "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1761712156,
-        "narHash": "sha256-4vU7FPZFXSFguQUIPrbLQOk3VSokp6RH8t7zQoqneow=",
+        "lastModified": 1750190298,
+        "narHash": "sha256-ero30lVvCzmdKkY0lZR/RO+oTNTY1WXQh6vhfbcbTIk=",
         "ref": "refs/heads/master",
-        "rev": "04f666dabbaced8d661693cfbe4eb7efa359ce7d",
-        "revCount": 320,
+        "rev": "1ed03dac446683ef42035b53a410d857855d82d9",
+        "revCount": 291,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/nvim"
       },
@@ -1228,28 +1275,7 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "ros_neovim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761619008,
-        "narHash": "sha256-vp97eNmi5GG/+jlvnBpmG6EVO2F1+nqMQFF9GT2TIQg=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "7bc7d2f706ebe5479d230d2c6806b5dc757ae4cd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ]
@@ -1268,24 +1294,25 @@
         "type": "github"
       }
     },
-    "secrets": {
+    "rust-overlay_2": {
       "inputs": {
-        "ragenix": "ragenix"
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "dir": "flakes/secrets",
-        "lastModified": 1762758426,
-        "narHash": "sha256-ynggVRutohq7TPhbz0ADXWRtsi4BGynGoRXdGyertRo=",
-        "ref": "refs/heads/master",
-        "rev": "7185d24a8ba9b7176b6f742ea2ee0e57d375dc43",
-        "revCount": 769,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1750127910,
+        "narHash": "sha256-FIgEIS0RAlOyXGqoj/OufTfcKItYq668yPYL4SXdU0M=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "45418795a73b77b7726c62ce265d68cf541ffb49",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/secrets",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
@@ -1335,7 +1362,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
diff --git a/hosts/oracle/o001/flake.nix b/hosts/oracle/o001/flake.nix
index 108673c..80c48ff 100644
--- a/hosts/oracle/o001/flake.nix
+++ b/hosts/oracle/o001/flake.nix
@@ -1,33 +1,24 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
     deploy-rs.url = "github:serokell/deploy-rs";
-    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
 
-    # Use relative to get current version for testing
-    # common.url = "path:../../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
+    common.url = "path:../../../common";
+    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
+    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      home-manager,
       common,
-      secrets,
       ros_neovim,
       deploy-rs,
       ...
-    }@inputs:
+    }:
     let
       configuration_name = "o001";
-      system = "aarch64-linux";
-      stateVersion = "23.11";
-      primaryUser = "root";
       lib = nixpkgs.lib;
     in
     {
@@ -39,88 +30,82 @@
         ];
         nodes.${configuration_name} = {
           hostname = "64.181.210.7";
-          targetPlatform = system;
+          targetPlatform = "aarch64-linux";
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.${configuration_name};
+            path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${configuration_name};
           };
         };
       };
 
       nixosConfigurations = {
-        "${configuration_name}" = (
-          lib.nixosSystem {
-            inherit system;
-            specialArgs = {
-              inherit inputs;
-            };
-            modules = [
-              home-manager.nixosModules.default
-              secrets.nixosModules.default
+        nixos = self.nixosConfigurations.${configuration_name};
+        "${configuration_name}" = lib.nixosSystem {
+          system = "aarch64-linux";
+          modules = [
+            common.nixosModules.default
+            ros_neovim.nixosModules.default
+            ./configuration.nix
+            ./hardware-configuration.nix
+            ./nginx.nix
+            ./containers/vaultwarden.nix
+            ./mods/postgresql.nix
+            ./mods/atuin.nix
+            ./mods/rustdesk-server.nix
+            (
+              { pkgs, ... }:
+              {
+                environment.systemPackages = with pkgs; [
+                  bitwarden
+                  vaultwarden
+                ];
 
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.hardening
-              common.nixosModules.nix_options
-              common.nixosModules.docker
-              common.nixosModules.tailnet
-              common.nixosModules.zsh
-
-              ros_neovim.nixosModules.default
-              ./configuration.nix
-              ./hardware-configuration.nix
-              ./nginx.nix
-              ./containers/vaultwarden.nix
-              ./mods/postgresql.nix
-              ./mods/atuin.nix
-              ./mods/rustdesk-server.nix
-              (
-                { pkgs, ... }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: name == "root" || (user.isNormalUser or false)) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
+                ringofstorms_common = {
+                  systemName = configuration_name;
+                  secrets.enable = true;
+                  general = {
+                    disableRemoteBuildsOnLio = true;
+                    readWindowsDrives = false;
+                    jetbrainsMonoFont = false;
+                    ttyCapsEscape = false;
+                    reporting.enable = true;
                   };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      shell = pkgs.zsh;
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG90Gg6dV3yhZ5+X40vICbeBwV9rfD39/8l9QSqluTw8 nix2oracle"
-                      ];
+                  programs = {
+                    tailnet.enable = true;
+                    ssh.enable = true;
+                    docker.enable = true;
+                  };
+                  users = {
+                    users = {
+                      root = {
+                        openssh.authorizedKeys.keys = [
+                          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG90Gg6dV3yhZ5+X40vICbeBwV9rfD39/8l9QSqluTw8 nix2oracle"
+                        ];
+                        shell = pkgs.zsh;
+                      };
                     };
                   };
-
-                  environment.systemPackages = with pkgs; [
-                    vaultwarden
-                  ];
-                }
-              )
-            ];
-          }
-        );
+                  homeManager = {
+                    users = {
+                      root = {
+                        programs.atuin.settings.sync_address = "http://localhost:8888";
+                        imports = with common.homeManagerModules; [
+                          tmux
+                          atuin
+                          git
+                          postgres
+                          starship
+                          zoxide
+                          zsh
+                        ];
+                      };
+                    };
+                  };
+                };
+              }
+            )
+          ];
+        };
       };
     };
 }
diff --git a/hosts/oracle/o001/nginx.nix b/hosts/oracle/o001/nginx.nix
index 20f2eb5..3866fb5 100644
--- a/hosts/oracle/o001/nginx.nix
+++ b/hosts/oracle/o001/nginx.nix
@@ -30,7 +30,6 @@
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    clientMaxBodySize = "500m";
     virtualHosts =
       let
         tailnetConfig = {
@@ -163,37 +162,6 @@
             proxyPass = "http://100.64.0.13";
           };
         };
-        "n8n.joshuabell.xyz" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyWebsockets = true;
-            proxyPass = "http://100.64.0.13";
-          };
-        };
-        "notes.joshuabell.xyz" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyWebsockets = true;
-            proxyPass = "http://100.64.0.13";
-          };
-        };
-        "blog.joshuabell.xyz" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyWebsockets = true;
-            proxyPass = "http://100.64.0.13";
-          };
-        };
-        "sec.joshuabell.xyz" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyPass = "http://100.64.0.13";
-          };
-        };
         "sso.joshuabell.xyz" = {
           enableACME = true;
           forceSSL = true;
@@ -204,16 +172,20 @@
             '';
           };
         };
-        "sso-proxy.joshuabell.xyz" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyPass = "http://100.64.0.13";
-            extraConfig = ''
-              proxy_set_header X-Forwarded-Proto https;
-            '';
-          };
-        };
+        # "obsidiansync.joshuabell.xyz" = {
+        #   enableACME = true;
+        #   forceSSL = true;
+        #   locations."/" = {
+        #     proxyPass = "http://100.64.0.1:5984";
+        #   };
+        #   extraConfig = ''
+        #     client_max_body_size 100M;
+        #     proxy_redirect off;
+        #     proxy_buffering off;
+        #     proxy_set_header Host $host;
+        #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        #   '';
+        # };
         "jellyfin.joshuabell.xyz" = {
           enableACME = true;
           forceSSL = true;
@@ -230,7 +202,6 @@
         };
 
         "_" = {
-          rejectSSL = true;
           default = true;
           locations."/" = {
             return = "444"; # 404 for not found or 444 for drop
diff --git a/hosts/oren/configuration.nix b/hosts/oren/configuration.nix
index 9bcccd8..268baf6 100644
--- a/hosts/oren/configuration.nix
+++ b/hosts/oren/configuration.nix
@@ -5,6 +5,7 @@
   ...
 }:
 {
+  system.stateVersion = "24.11"; # Did you read the comment?
   environment.systemPackages = with pkgs; [
     # [Laptop] Battery status
     acpi
diff --git a/hosts/oren/flake.lock b/hosts/oren/flake.lock
index 5d43b7d..6bd08e8 100644
--- a/hosts/oren/flake.lock
+++ b/hosts/oren/flake.lock
@@ -5,11 +5,11 @@
         "darwin": "darwin",
         "home-manager": "home-manager_2",
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ],
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1736955230,
@@ -25,59 +25,21 @@
         "type": "github"
       }
     },
-    "aquamarine": {
-      "inputs": {
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprutils"
-        ],
-        "hyprwayland-scanner": [
-          "hyprland",
-          "hyprland",
-          "hyprwayland-scanner"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762356719,
-        "narHash": "sha256-qwd/xdoOya1m8FENle+4hWnydCtlXUWLAW/Auk6WL7s=",
-        "owner": "hyprwm",
-        "repo": "aquamarine",
-        "rev": "6d0b3567584691bf9d8fedb5d0093309e2f979c7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "aquamarine",
-        "type": "github"
-      }
-    },
     "common": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "ragenix": "ragenix"
+      },
       "locked": {
-        "dir": "flakes/common",
-        "lastModified": 1762815549,
-        "narHash": "sha256-ALkVZHb6Yx1JJg8jDW6kjVGdkoFWUZiwDeS3OlGDg4Y=",
-        "ref": "refs/heads/master",
-        "rev": "09bfa9af4ebe3fdc075180cd3434567d1b5d2117",
-        "revCount": 772,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "path": "../../common",
+        "type": "path"
       },
       "original": {
-        "dir": "flakes/common",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      }
+        "path": "../../common",
+        "type": "path"
+      },
+      "parent": []
     },
     "crane": {
       "locked": {
@@ -97,7 +59,7 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -118,25 +80,9 @@
         "type": "github"
       }
     },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -152,59 +98,16 @@
         "type": "github"
       }
     },
-    "flatpaks": {
-      "inputs": {
-        "nix-flatpak": "nix-flatpak"
-      },
-      "locked": {
-        "dir": "flakes/flatpaks",
-        "lastModified": 1762815549,
-        "narHash": "sha256-ALkVZHb6Yx1JJg8jDW6kjVGdkoFWUZiwDeS3OlGDg4Y=",
-        "ref": "refs/heads/master",
-        "rev": "09bfa9af4ebe3fdc075180cd3434567d1b5d2117",
-        "revCount": 772,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      },
-      "original": {
-        "dir": "flakes/flatpaks",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "pre-commit-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1756245065,
+        "narHash": "sha256-aAZNbGcWrVRZgWgkQbkabSGcDVRDMgON4BipMy69gvI=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "54b2879ce622d44415e727905925e21b8f833a98",
         "type": "github"
       },
       "original": {
@@ -217,7 +120,7 @@
     "home-manager_2": {
       "inputs": {
         "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "agenix",
           "nixpkgs"
@@ -237,344 +140,6 @@
         "type": "github"
       }
     },
-    "hyprcursor": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprland",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1753964049,
-        "narHash": "sha256-lIqabfBY7z/OANxHoPeIrDJrFyYy9jAM4GQLzZ2feCM=",
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "rev": "44e91d467bdad8dcf8bbd2ac7cf49972540980a5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "type": "github"
-      }
-    },
-    "hyprgraphics": {
-      "inputs": {
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprutils"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762462052,
-        "narHash": "sha256-6roLYzcDf4V38RUMSqycsOwAnqfodL6BmhRkUtwIgdA=",
-        "owner": "hyprwm",
-        "repo": "hyprgraphics",
-        "rev": "ffc999d980c7b3bca85d3ebd0a9fbadf984a8162",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprgraphics",
-        "type": "github"
-      }
-    },
-    "hyprland": {
-      "inputs": {
-        "hyprland": "hyprland_2"
-      },
-      "locked": {
-        "dir": "flakes/hyprland",
-        "lastModified": 1762815549,
-        "narHash": "sha256-ALkVZHb6Yx1JJg8jDW6kjVGdkoFWUZiwDeS3OlGDg4Y=",
-        "ref": "refs/heads/master",
-        "rev": "09bfa9af4ebe3fdc075180cd3434567d1b5d2117",
-        "revCount": 772,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      },
-      "original": {
-        "dir": "flakes/hyprland",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
-      }
-    },
-    "hyprland-guiutils": {
-      "inputs": {
-        "aquamarine": [
-          "hyprland",
-          "hyprland",
-          "aquamarine"
-        ],
-        "hyprgraphics": [
-          "hyprland",
-          "hyprland",
-          "hyprgraphics"
-        ],
-        "hyprlang": [
-          "hyprland",
-          "hyprland",
-          "hyprlang"
-        ],
-        "hyprtoolkit": "hyprtoolkit",
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprutils"
-        ],
-        "hyprwayland-scanner": [
-          "hyprland",
-          "hyprland",
-          "hyprwayland-scanner"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762755186,
-        "narHash": "sha256-ZjjETUHtoEhVN7JI1Cbt3p/KcXpK8ZQaPHx7UkG1OgA=",
-        "owner": "hyprwm",
-        "repo": "hyprland-guiutils",
-        "rev": "66356e20a8ed348aa49c1b9ceace786e224225b3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-guiutils",
-        "type": "github"
-      }
-    },
-    "hyprland-protocols": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1759610243,
-        "narHash": "sha256-+KEVnKBe8wz+a6dTLq8YDcF3UrhQElwsYJaVaHXJtoI=",
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "rev": "bd153e76f751f150a09328dbdeb5e4fab9d23622",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "type": "github"
-      }
-    },
-    "hyprland_2": {
-      "inputs": {
-        "aquamarine": "aquamarine",
-        "hyprcursor": "hyprcursor",
-        "hyprgraphics": "hyprgraphics",
-        "hyprland-guiutils": "hyprland-guiutils",
-        "hyprland-protocols": "hyprland-protocols",
-        "hyprlang": "hyprlang",
-        "hyprutils": "hyprutils",
-        "hyprwayland-scanner": "hyprwayland-scanner",
-        "nixpkgs": "nixpkgs_2",
-        "pre-commit-hooks": "pre-commit-hooks",
-        "systems": "systems",
-        "xdph": "xdph"
-      },
-      "locked": {
-        "lastModified": 1762755326,
-        "narHash": "sha256-YYTzQUQDnVdtN3k40sC5kq6yL70riU8bM8cQLz38jzk=",
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "rev": "0b1d690676589503f0addece30e936a240733699",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "type": "github"
-      }
-    },
-    "hyprlang": {
-      "inputs": {
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprutils"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1758927902,
-        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "type": "github"
-      }
-    },
-    "hyprtoolkit": {
-      "inputs": {
-        "aquamarine": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "aquamarine"
-        ],
-        "hyprgraphics": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "hyprgraphics"
-        ],
-        "hyprlang": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "hyprlang"
-        ],
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "hyprutils"
-        ],
-        "hyprwayland-scanner": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "hyprwayland-scanner"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "hyprland-guiutils",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762463729,
-        "narHash": "sha256-2fYkU/mdz8WKY3dkDPlE/j6hTxIwqultsx4gMMsMns0=",
-        "owner": "hyprwm",
-        "repo": "hyprtoolkit",
-        "rev": "88483bdee5329ec985f0c8f834c519cd18cfe532",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprtoolkit",
-        "type": "github"
-      }
-    },
-    "hyprutils": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762387740,
-        "narHash": "sha256-gQ9zJ+pUI4o+Gh4Z6jhJll7jjCSwi8ZqJIhCE2oqwhQ=",
-        "owner": "hyprwm",
-        "repo": "hyprutils",
-        "rev": "926689ddb9c0a8787e58c02c765a62e32d63d1f7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprutils",
-        "type": "github"
-      }
-    },
-    "hyprwayland-scanner": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1755184602,
-        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
-        "owner": "hyprwm",
-        "repo": "hyprwayland-scanner",
-        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprwayland-scanner",
-        "type": "github"
-      }
-    },
     "nix-flatpak": {
       "locked": {
         "lastModified": 1739444422,
@@ -607,54 +172,23 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1762363567,
-        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "NixOS",
+        "lastModified": 1758198701,
+        "narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
+        "rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1761619080,
-        "narHash": "sha256-PsLFmU/CORWeCjJi9ALsegwr/SMjf2gHsooTR09az4c=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "fd644bba1d3a83169e4b312ce20928ba1b0abb02",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1741379970,
         "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
@@ -670,6 +204,37 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1758216857,
+        "narHash": "sha256-h1BW2y7CY4LI9w61R02wPaOYfmYo82FyRqHIwukQ6SY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d2ed99647a4b195f0bcc440f76edfa10aeb3b743",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1757952092,
+        "narHash": "sha256-BcfTLFCU7elUJ2dwyt0iTjxsz/XLh+8ZygDcFwy6xPE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "fd76dc9e7c68ac7c3941ba2af2bedcd79c5cf4ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nvim_plugin-Almo7aya/openingh.nvim": {
       "flake": false,
       "locked": {
@@ -689,11 +254,11 @@
     "nvim_plugin-CopilotC-Nvim/CopilotChat.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761323006,
-        "narHash": "sha256-6BjkqZCo2DLVxW6BHyElt2cZdG6Dhzao8hPfWYm0sIQ=",
+        "lastModified": 1757950300,
+        "narHash": "sha256-IQTP3jOmFNc2nphV9jdFbJXkmAN5Wj+/PIGmaZ8gP24=",
         "owner": "CopilotC-Nvim",
         "repo": "CopilotChat.nvim",
-        "rev": "a7138a0ee04d8af42c262554eccee168bbf1454f",
+        "rev": "87615648ff4dc852d1cf7ec099f0a7c37b1b2c87",
         "type": "github"
       },
       "original": {
@@ -721,11 +286,11 @@
     "nvim_plugin-L3MON4D3/LuaSnip": {
       "flake": false,
       "locked": {
-        "lastModified": 1761039842,
-        "narHash": "sha256-ovvtTZgqL6MFvuI3byx+boWm6ErZX06+v6a3VoctREc=",
+        "lastModified": 1756990415,
+        "narHash": "sha256-5FsUVPy8pAiwBh3c+bPDMtypFEHj6qIwGQIo3hjqV4M=",
         "owner": "L3MON4D3",
         "repo": "LuaSnip",
-        "rev": "ccf25a5452b8697a823de3e5ecda63ed3d723b79",
+        "rev": "21f74f7ba8c49f95f9d7c8293b147c2901dd2d3a",
         "type": "github"
       },
       "original": {
@@ -737,11 +302,11 @@
     "nvim_plugin-MeanderingProgrammer/render-markdown.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343950,
-        "narHash": "sha256-HycEAgAsU8IxFiYfyp5ZGN+z6wYyCarIESxA9TDuJ3s=",
+        "lastModified": 1757910669,
+        "narHash": "sha256-PWbFcGRbTMRhDJrj+kx73HLduMLOSrAhZTLL2YgrAjQ=",
         "owner": "MeanderingProgrammer",
         "repo": "render-markdown.nvim",
-        "rev": "bfd67f1402b97ac619cb538f4bbaed12a7fa89aa",
+        "rev": "2c6cf127c577712bd29d38f6391b3045c5f0180a",
         "type": "github"
       },
       "original": {
@@ -801,11 +366,11 @@
     "nvim_plugin-aznhe21/actions-preview.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759462626,
-        "narHash": "sha256-YUeWBXxxeurfWBi0PjUi6izqYAvUw9DHmvsuPXm7ohw=",
+        "lastModified": 1745779150,
+        "narHash": "sha256-rQjwlu5gQcOvxF72lr9ugPRl0W78wCWGWPhpN1oOMbs=",
         "owner": "aznhe21",
         "repo": "actions-preview.nvim",
-        "rev": "cb938c25edaac38d362555f19244a9cb85d561e8",
+        "rev": "36513ad213855d497b7dd3391a24d1d75d58e36f",
         "type": "github"
       },
       "original": {
@@ -817,11 +382,11 @@
     "nvim_plugin-b0o/schemastore.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761343239,
-        "narHash": "sha256-obGnux+K0blHROEOAy7Ct18vxiO4Qez8XJB5l23KgMs=",
+        "lastModified": 1757653237,
+        "narHash": "sha256-94NKAVWPV2sLkGWWL9G07QxA90Ise6tNWaYyKBcS/vI=",
         "owner": "b0o",
         "repo": "schemastore.nvim",
-        "rev": "4341619da06779ae310ee9c3d6d70edfefed7152",
+        "rev": "3146720ee3a0c6e2446eedd492fb519d16f2e467",
         "type": "github"
       },
       "original": {
@@ -833,11 +398,11 @@
     "nvim_plugin-catppuccin/nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761396780,
-        "narHash": "sha256-Nz/XbItShbrnKtj0+gcEDBFO5y00g0EG5CHqdJGK2j0=",
+        "lastModified": 1755621274,
+        "narHash": "sha256-o8VLMPriOh4+Ay5Ff0cWQYXjmihdr3x9131bKHHTsQE=",
         "owner": "catppuccin",
         "repo": "nvim",
-        "rev": "8c4125e3c746976ba025dc5d908fa22c6aa09486",
+        "rev": "30fa4d122d9b22ad8b2e0ab1b533c8c26c4dde86",
         "type": "github"
       },
       "original": {
@@ -849,11 +414,11 @@
     "nvim_plugin-chrisgrieser/nvim-early-retirement": {
       "flake": false,
       "locked": {
-        "lastModified": 1760385962,
-        "narHash": "sha256-PtpD6Uc4GK4dSJynWH5d6c7XOWXfYODXJ3FyOY1eZNo=",
+        "lastModified": 1757363000,
+        "narHash": "sha256-hfoJDD4ZKIx1IZjmZba117wRe3ELyGqG8ZqxDnRVmIk=",
         "owner": "chrisgrieser",
         "repo": "nvim-early-retirement",
-        "rev": "9109589b542773c9ad2a34067a085874f255577b",
+        "rev": "14aba23ce4168e6d6acbf78ab1d33739c3894f68",
         "type": "github"
       },
       "original": {
@@ -881,11 +446,11 @@
     "nvim_plugin-folke/lazy.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761488113,
-        "narHash": "sha256-jBmtFzzdGYe3N3kvWHvR7FGXtA+/t36efxsAqhLmaxU=",
+        "lastModified": 1740511197,
+        "narHash": "sha256-nQ8PR9DTdzg6Z2rViuVD6Pswc2VvDQwS3uMNgyDh5ls=",
         "owner": "folke",
         "repo": "lazy.nvim",
-        "rev": "ed4dc336a73c18da6fea6e1cf7ad6e1b76d281eb",
+        "rev": "6c3bda4aca61a13a9c63f1c1d1b16b9d3be90d7a",
         "type": "github"
       },
       "original": {
@@ -913,11 +478,11 @@
     "nvim_plugin-folke/which-key.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1759952076,
-        "narHash": "sha256-N31+V5L0gd+TUo9nVtNGRmMVmM9fMxOwldCfuLYT4hU=",
+        "lastModified": 1740233407,
+        "narHash": "sha256-uvMcSduMr7Kd2oUmIOYzvWF4FIl6bZxIYm9FSw/3pCo=",
         "owner": "folke",
         "repo": "which-key.nvim",
-        "rev": "b4177e3eaf15fe5eb8357ebac2286d488be1ed00",
+        "rev": "370ec46f710e058c9c1646273e6b225acf47cbed",
         "type": "github"
       },
       "original": {
@@ -977,11 +542,11 @@
     "nvim_plugin-hrsh7th/nvim-cmp": {
       "flake": false,
       "locked": {
-        "lastModified": 1760792454,
-        "narHash": "sha256-wkESSNUViVI5DE+3t4AVTaSLQ/hTB43vrm+PH6uA8H4=",
+        "lastModified": 1744514599,
+        "narHash": "sha256-l5z+PT4S9b09d2M+J/tHVd9W9Ss3eQQk5Ykpz2Qjxxw=",
         "owner": "hrsh7th",
         "repo": "nvim-cmp",
-        "rev": "a7bcf1d88069fc67c9ace8a62ba480b8fe879025",
+        "rev": "b5311ab3ed9c846b585c0c15b7559be131ec4be9",
         "type": "github"
       },
       "original": {
@@ -993,11 +558,11 @@
     "nvim_plugin-j-hui/fidget.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761243883,
-        "narHash": "sha256-XXTeJweQRIsC/WFhFxFbepOETV8e5Wfmh513su2Wve0=",
+        "lastModified": 1755700851,
+        "narHash": "sha256-KRlUqUdcliKpLnEJqyA2OAWto73F6iGTbMrsiAdc24M=",
         "owner": "j-hui",
         "repo": "fidget.nvim",
-        "rev": "e32b672d8fd343f9d6a76944fedb8c61d7d8111a",
+        "rev": "4d5858bd4c471c895060e1b9f3575f1551184dc5",
         "type": "github"
       },
       "original": {
@@ -1025,11 +590,11 @@
     "nvim_plugin-lewis6991/gitsigns.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760888451,
-        "narHash": "sha256-eGpB7YYWbyCCGYXEYAM432srSp/lUo5C1b0J3OYjwnY=",
+        "lastModified": 1757668552,
+        "narHash": "sha256-L5WbNiFUn014hThvGfb5r858O6iLOBhOQHfVUdIlFI4=",
         "owner": "lewis6991",
         "repo": "gitsigns.nvim",
-        "rev": "20ad4419564d6e22b189f6738116b38871082332",
+        "rev": "f780609807eca1f783a36a8a31c30a48fbe150c5",
         "type": "github"
       },
       "original": {
@@ -1089,11 +654,11 @@
     "nvim_plugin-mbbill/undotree": {
       "flake": false,
       "locked": {
-        "lastModified": 1759186837,
-        "narHash": "sha256-EWOH08KAWyoT9m45/B1d5aKQQJtd3k4orJbagVsxe08=",
+        "lastModified": 1756538456,
+        "narHash": "sha256-tudR+46nd63jY1VTCNEfZ2CofxCODXaHos0+NdFI6wU=",
         "owner": "mbbill",
         "repo": "undotree",
-        "rev": "0f1c9816975b5d7f87d5003a19c53c6fd2ff6f7f",
+        "rev": "fe9a9d0645f0f5532360b5e5f5c550d7bb4f1869",
         "type": "github"
       },
       "original": {
@@ -1105,11 +670,11 @@
     "nvim_plugin-mfussenegger/nvim-lint": {
       "flake": false,
       "locked": {
-        "lastModified": 1759852544,
-        "narHash": "sha256-wVEX0lCxeipvwCfdd2JbQwnhgg6UrTXixC8E1OiEblI=",
+        "lastModified": 1757878177,
+        "narHash": "sha256-8X9z0pRWx9xg9nQhhQtuOu3TunObg2CIgnlPXZtx86A=",
         "owner": "mfussenegger",
         "repo": "nvim-lint",
-        "rev": "9da1fb942dd0668d5182f9c8dee801b9c190e2bb",
+        "rev": "0864f81c681e15d9bdc1156fe3a17bd07db5a3ed",
         "type": "github"
       },
       "original": {
@@ -1121,11 +686,11 @@
     "nvim_plugin-mrcjkb/rustaceanvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761585884,
-        "narHash": "sha256-m/gd+cb7X2a7R6JSbHes0QjGs+zuj4698Qyi/OW0R1g=",
+        "lastModified": 1757809469,
+        "narHash": "sha256-bijgDZozBNmHW3cASmOrQlaSE80d8V3XRxi1BNmfzRI=",
         "owner": "mrcjkb",
         "repo": "rustaceanvim",
-        "rev": "be0d1d14b8504c1c0965b608dc7ed39f2d588c91",
+        "rev": "370b85298e5afdfd8b5d3da0c60c04e3873499a4",
         "type": "github"
       },
       "original": {
@@ -1137,11 +702,11 @@
     "nvim_plugin-neovim/nvim-lspconfig": {
       "flake": false,
       "locked": {
-        "lastModified": 1761605346,
-        "narHash": "sha256-3Aulaw6KMmrcoQQxhRhQhjZ2fg6MSU4Q7qAWtrVsOcA=",
+        "lastModified": 1757886255,
+        "narHash": "sha256-lIlFgHkesAK7fRcoEEQO84/0BpE29dBgNzBnCv/0Tf0=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "2b52bc2190c8efde2e4de02d829a138666774c7c",
+        "rev": "d9879110d0422a566fa01d732556f4d5515e1738",
         "type": "github"
       },
       "original": {
@@ -1150,6 +715,22 @@
         "type": "github"
       }
     },
+    "nvim_plugin-nosduco/remote-sshfs.nvim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755703322,
+        "narHash": "sha256-xy+50CsRd0LfRyDtNNMI8KhzvjH2nt8ogwiXf7H3fYY=",
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "rev": "8b0974c0e23ef086f5598ebbb1980257171dc370",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nosduco",
+        "repo": "remote-sshfs.nvim",
+        "type": "github"
+      }
+    },
     "nvim_plugin-numToStr/Comment.nvim": {
       "flake": false,
       "locked": {
@@ -1185,11 +766,11 @@
     "nvim_plugin-nvim-lualine/lualine.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1760596863,
-        "narHash": "sha256-hdrAdG3hC2sAevQ6a9xizqPgEgnNKxuc5rBYn0pKM1c=",
+        "lastModified": 1754970649,
+        "narHash": "sha256-lWt2kpW+hsTMWt8tar/+AISTDrIt4Jn27NmI9j+Xt4s=",
         "owner": "nvim-lualine",
         "repo": "lualine.nvim",
-        "rev": "3946f0122255bc377d14a59b27b609fb3ab25768",
+        "rev": "b8c23159c0161f4b89196f74ee3a6d02cdc3a955",
         "type": "github"
       },
       "original": {
@@ -1265,11 +846,11 @@
     "nvim_plugin-nvim-tree/nvim-tree.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1760921408,
-        "narHash": "sha256-QCUp/6qX/FS8LrZ6K+pvC/mHkYW8xfzQZEB2y0VOStQ=",
+        "lastModified": 1757312802,
+        "narHash": "sha256-Km+PWXJJLl8zsBjwIGL//qT/eUEZna4yYRPsWXMXG1E=",
         "owner": "nvim-tree",
         "repo": "nvim-tree.lua",
-        "rev": "64e2192f5250796aa4a7f33c6ad888515af50640",
+        "rev": "e179ad2f83b5955ab0af653069a493a1828c2697",
         "type": "github"
       },
       "original": {
@@ -1281,11 +862,11 @@
     "nvim_plugin-nvim-tree/nvim-web-devicons": {
       "flake": false,
       "locked": {
-        "lastModified": 1761440007,
-        "narHash": "sha256-klBjUtj0AvarN5a6O8Hh2t5BuOTe/m3ps2cHnlxVJvE=",
+        "lastModified": 1756936794,
+        "narHash": "sha256-2Q6ZZQj5HFXTw1YwX3ibdGOTwfbfPUBbcPOsuBUpSjc=",
         "owner": "nvim-tree",
         "repo": "nvim-web-devicons",
-        "rev": "8dcb311b0c92d460fac00eac706abd43d94d68af",
+        "rev": "6e51ca170563330e063720449c21f43e27ca0bc1",
         "type": "github"
       },
       "original": {
@@ -1297,11 +878,11 @@
     "nvim_plugin-nvim-treesitter/nvim-treesitter-context": {
       "flake": false,
       "locked": {
-        "lastModified": 1761077440,
-        "narHash": "sha256-QdZstxKsEILwe7eUZCmMdyLPyvNKc/e7cfdYQowHWPQ=",
+        "lastModified": 1757521884,
+        "narHash": "sha256-+yj8bstmffVByX3Z/1vkUYdXvpmWGbPt+RDfkBnV11w=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter-context",
-        "rev": "ec308c7827b5f8cb2dd0ad303a059c945dd21969",
+        "rev": "41847d3dafb5004464708a3db06b14f12bde548a",
         "type": "github"
       },
       "original": {
@@ -1345,11 +926,11 @@
     "nvim_plugin-rmagatti/auto-session": {
       "flake": false,
       "locked": {
-        "lastModified": 1761491368,
-        "narHash": "sha256-F2MtkBCVAObRwniSvFjv5MmYnCaj1YSUf0Nk5MF1F4Y=",
+        "lastModified": 1757864222,
+        "narHash": "sha256-FbN36vVLX3DUXwefTbi6511R6KTHqLiNHeAR0kXiarg=",
         "owner": "rmagatti",
         "repo": "auto-session",
-        "rev": "f0eb3d69848389869572b82b336d7a6887e88e43",
+        "rev": "5a269bb5bec50b8b60564aa00f6454d9e82fbe8d",
         "type": "github"
       },
       "original": {
@@ -1358,7 +939,7 @@
         "type": "github"
       }
     },
-    "nvim_plugin-ron-rs/ron.vim": {
+    "nvim_plugin-ron/ron.vim": {
       "flake": false,
       "locked": {
         "lastModified": 1660904719,
@@ -1409,11 +990,11 @@
     "nvim_plugin-stevearc/conform.nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761160784,
-        "narHash": "sha256-yUUDxYuIjbFHUscEKpFV6IaraDNOA4hdcGljPHG/+sU=",
+        "lastModified": 1756334700,
+        "narHash": "sha256-j9TOSx2L19AHABdg9pLtmEUtPOCIUSo0qe2YUPBlZ5g=",
         "owner": "stevearc",
         "repo": "conform.nvim",
-        "rev": "9fd3d5e0b689ec1bf400c53cbbec72c6fdf24081",
+        "rev": "b4aab989db276993ea5dcb78872be494ce546521",
         "type": "github"
       },
       "original": {
@@ -1521,11 +1102,11 @@
     "nvim_plugin-zbirenbaum/copilot.lua": {
       "flake": false,
       "locked": {
-        "lastModified": 1761595323,
-        "narHash": "sha256-KkiU2xmpfIbpuijvcXDw+LWKWuBgxjwY7jEQIasN5Kw=",
+        "lastModified": 1757884406,
+        "narHash": "sha256-sXobILIsV4nnk9//PbFT4L1BsHP1xSJiuibVbGwYXJ8=",
         "owner": "zbirenbaum",
         "repo": "copilot.lua",
-        "rev": "93adf9844dcbe09a37e7a72eaa286d33d38bf628",
+        "rev": "8aebaa3a102125fedf08c98773a0a8def92fff37",
         "type": "github"
       },
       "original": {
@@ -1534,37 +1115,13 @@
         "type": "github"
       }
     },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762441963,
-        "narHash": "sha256-j+rNQ119ffYUkYt2YYS6rnd6Jh/crMZmbqpkGLXaEt0=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "8e7576e79b88c16d7ee3bbd112c8d90070832885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
     "ragenix": {
       "inputs": {
         "agenix": "agenix",
         "crane": "crane",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_5",
-        "rust-overlay": "rust-overlay_2"
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1744897914,
@@ -1583,12 +1140,9 @@
     "root": {
       "inputs": {
         "common": "common",
-        "flatpaks": "flatpaks",
-        "home-manager": "home-manager",
-        "hyprland": "hyprland",
         "nixpkgs": "nixpkgs_3",
-        "ros_neovim": "ros_neovim",
-        "secrets": "secrets"
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "ros_neovim": "ros_neovim"
       }
     },
     "ros_neovim": {
@@ -1624,6 +1178,7 @@
         "nvim_plugin-mfussenegger/nvim-lint": "nvim_plugin-mfussenegger/nvim-lint",
         "nvim_plugin-mrcjkb/rustaceanvim": "nvim_plugin-mrcjkb/rustaceanvim",
         "nvim_plugin-neovim/nvim-lspconfig": "nvim_plugin-neovim/nvim-lspconfig",
+        "nvim_plugin-nosduco/remote-sshfs.nvim": "nvim_plugin-nosduco/remote-sshfs.nvim",
         "nvim_plugin-numToStr/Comment.nvim": "nvim_plugin-numToStr/Comment.nvim",
         "nvim_plugin-nvim-lua/plenary.nvim": "nvim_plugin-nvim-lua/plenary.nvim",
         "nvim_plugin-nvim-lualine/lualine.nvim": "nvim_plugin-nvim-lualine/lualine.nvim",
@@ -1637,7 +1192,7 @@
         "nvim_plugin-rafamadriz/friendly-snippets": "nvim_plugin-rafamadriz/friendly-snippets",
         "nvim_plugin-rcarriga/nvim-notify": "nvim_plugin-rcarriga/nvim-notify",
         "nvim_plugin-rmagatti/auto-session": "nvim_plugin-rmagatti/auto-session",
-        "nvim_plugin-ron-rs/ron.vim": "nvim_plugin-ron-rs/ron.vim",
+        "nvim_plugin-ron/ron.vim": "nvim_plugin-ron/ron.vim",
         "nvim_plugin-saadparwaiz1/cmp_luasnip": "nvim_plugin-saadparwaiz1/cmp_luasnip",
         "nvim_plugin-sindrets/diffview.nvim": "nvim_plugin-sindrets/diffview.nvim",
         "nvim_plugin-stevearc/conform.nvim": "nvim_plugin-stevearc/conform.nvim",
@@ -1648,14 +1203,14 @@
         "nvim_plugin-windwp/nvim-ts-autotag": "nvim_plugin-windwp/nvim-ts-autotag",
         "nvim_plugin-zbirenbaum/copilot-cmp": "nvim_plugin-zbirenbaum/copilot-cmp",
         "nvim_plugin-zbirenbaum/copilot.lua": "nvim_plugin-zbirenbaum/copilot.lua",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1761712156,
-        "narHash": "sha256-4vU7FPZFXSFguQUIPrbLQOk3VSokp6RH8t7zQoqneow=",
+        "lastModified": 1758041510,
+        "narHash": "sha256-vcK6ZwAWNfjdDFYKLVrWk+azva58AiDpm8nMfIniFWA=",
         "ref": "refs/heads/master",
-        "rev": "04f666dabbaced8d661693cfbe4eb7efa359ce7d",
-        "revCount": 320,
+        "rev": "b3dbdf3f7360747987bf38bcdd9baf01b4906929",
+        "revCount": 304,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/nvim"
       },
@@ -1667,28 +1222,7 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "ros_neovim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761619008,
-        "narHash": "sha256-vp97eNmi5GG/+jlvnBpmG6EVO2F1+nqMQFF9GT2TIQg=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "7bc7d2f706ebe5479d230d2c6806b5dc757ae4cd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "secrets",
+          "common",
           "ragenix",
           "nixpkgs"
         ]
@@ -1707,38 +1241,39 @@
         "type": "github"
       }
     },
-    "secrets": {
+    "rust-overlay_2": {
       "inputs": {
-        "ragenix": "ragenix"
+        "nixpkgs": [
+          "ros_neovim",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "dir": "flakes/secrets",
-        "lastModified": 1762815549,
-        "narHash": "sha256-ALkVZHb6Yx1JJg8jDW6kjVGdkoFWUZiwDeS3OlGDg4Y=",
-        "ref": "refs/heads/master",
-        "rev": "09bfa9af4ebe3fdc075180cd3434567d1b5d2117",
-        "revCount": 772,
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "lastModified": 1757930296,
+        "narHash": "sha256-Z9u5VszKs8rfEvg2AsFucWEjl7wMtAln9l1b78cfBh4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "09442765a05c2ca617c20ed68d9613da92a2d96b",
+        "type": "github"
       },
       "original": {
-        "dir": "flakes/secrets",
-        "type": "git",
-        "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
       "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
         "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
         "type": "github"
       }
     },
@@ -1756,68 +1291,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "xdph": {
-      "inputs": {
-        "hyprland-protocols": [
-          "hyprland",
-          "hyprland",
-          "hyprland-protocols"
-        ],
-        "hyprlang": [
-          "hyprland",
-          "hyprland",
-          "hyprlang"
-        ],
-        "hyprutils": [
-          "hyprland",
-          "hyprland",
-          "hyprutils"
-        ],
-        "hyprwayland-scanner": [
-          "hyprland",
-          "hyprland",
-          "hyprwayland-scanner"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761431178,
-        "narHash": "sha256-xzjC1CV3+wpUQKNF+GnadnkeGUCJX+vgaWIZsnz9tzI=",
-        "owner": "hyprwm",
-        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "4b8801228ff958d028f588f0c2b911dbf32297f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "xdg-desktop-portal-hyprland",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/hosts/oren/flake.nix b/hosts/oren/flake.nix
index 3820519..477d9a5 100644
--- a/hosts/oren/flake.nix
+++ b/hosts/oren/flake.nix
@@ -1,17 +1,11 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
-    # Use relative to get current version for testin
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
-    # flatpaks.url = "path:../../flakes/flatpaks";
-    flatpaks.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/flatpaks";
-    # hyprland.url = "path:../../flakes/hyprland";
-    hyprland.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/hyprland";
+    # Use relative to get current version for testing
+    common.url = "path:../../common";
+    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
 
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
   };
@@ -19,142 +13,27 @@
   outputs =
     {
       nixpkgs,
-      home-manager,
+      nixpkgs-unstable,
       common,
-      secrets,
-      flatpaks,
-      hyprland,
       ros_neovim,
       ...
     }:
     let
       configuration_name = "oren";
-      system = "x86_64-linux";
-      stateVersion = "25.05";
-      primaryUser = "josh";
       lib = nixpkgs.lib;
     in
     {
       nixosConfigurations = {
         "${configuration_name}" = (
           lib.nixosSystem {
-            inherit system;
             modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
+              common.nixosModules.default
               ros_neovim.nixosModules.default
-              (
-                { ... }:
-                {
-                  ringofstorms-nvim.includeAllRuntimeDependencies = true;
-                }
-              )
-
-              flatpaks.nixosModules.default
-              hyprland.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.tmux
-              common.nixosModules.boot_systemd
-              common.nixosModules.hardening
-              common.nixosModules.jetbrains_font
-              common.nixosModules.nix_options
-              common.nixosModules.podman
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-
               ./configuration.nix
               ./hardware-configuration.nix
-              # ./sway_customizations.nix
-              ./hyprland_customizations.nix
               (
                 { config, pkgs, ... }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.foot
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${config.networking.hostName}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "video"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMzgAe4od9K4EsvH2g7xjNU7hGoJiFJlYcvB0BoDCvn nix2oren"
-                      ];
-                    };
-                  };
-
-                  environment.systemPackages = with pkgs; [
-                    lua
-                    qdirstat
-                    ffmpeg-full
-                    vlc
-                    google-chrome
-
-                    nodejs_24
-                    ttyd
-                    appimage-run
-                  ];
-
-                  services.flatpak.packages = [
-                    "org.signal.Signal"
-                    "dev.vencord.Vesktop"
-                    "md.obsidian.Obsidian"
-                    "com.spotify.Client"
-                    "com.bitwarden.desktop"
-                    "org.openscad.OpenSCAD"
-                    "im.riot.Riot"
-                    "com.rustdesk.RustDesk"
-                  ];
-
-                  services.devmon.enable = true;
-                  services.gvfs.enable = true;
-                  services.udisks2.enable = true;
-
-                  networking = {
-                    firewall = {
-                      allowedTCPPorts = [
-                        9991
-                      ];
-                    };
-                  };
-
+                {
                   programs = {
                     nix-ld = {
                       enable = true;
@@ -174,6 +53,94 @@
 
                     "ollamal" = "ollama list | tail -n +2 | awk '{print $1}' | fzf --ansi --preview 'ollama show {}'";
                   };
+
+                  environment.systemPackages = with pkgs; [
+                    lua
+                    qdirstat
+                    ffmpeg-full
+                    appimage-run
+                    nodejs_24
+                    foot
+                  ];
+
+                  services.ollama = {
+                    enable = true;
+                    package = nixpkgs-unstable.legacyPackages.x86_64-linux.ollama;
+                    acceleration = "rocm"; # cuda for NVIDA; rocm for amd; false/default for neither
+                  };
+
+                  ringofstorms_common = {
+                    systemName = configuration_name;
+                    boot.systemd.enable = true;
+                    general = {
+                      enableSleep = true;
+                      reporting.enable = true;
+                    };
+                    secrets.enable = true;
+                    desktopEnvironment.i3.enable = true;
+                    programs = {
+                      qFlipper.enable = true;
+                      rustDev.enable = true;
+                      uhkAgent.enable = true;
+                      tailnet.enable = true;
+                      ssh.enable = true;
+                      podman.enable = true;
+                      virt-manager.enable = true;
+                      flatpaks = {
+                        enable = true;
+                        packages = [
+                          "org.signal.Signal"
+                          "dev.vencord.Vesktop"
+                          "md.obsidian.Obsidian"
+                          "com.spotify.Client"
+                          "org.videolan.VLC"
+                          "com.bitwarden.desktop"
+                          "im.riot.Riot"
+                          "com.rustdesk.RustDesk"
+                          "com.google.Chrome"
+                        ];
+                      };
+                    };
+                    users = {
+                      # Users are all normal users and default password is password1
+                      admins = [ "josh" ]; # First admin is also the primary user owning nix config
+                      users = {
+                        josh = {
+                          openssh.authorizedKeys.keys = [
+                            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMzgAe4od9K4EsvH2g7xjNU7hGoJiFJlYcvB0BoDCvn nix2oren"
+                          ];
+                          extraGroups = [
+                            "networkmanager"
+                            "video"
+                            "input"
+                          ];
+                          shell = pkgs.zsh;
+                        };
+                      };
+                    };
+                    homeManager = {
+                      users = {
+                        josh = {
+                          components.kitty.font_size = 20.0;
+                          imports = with common.homeManagerModules; [
+                            zsh
+                            ssh
+                            starship
+                            zoxide
+                            tmux
+                            atuin
+                            kitty
+                            foot
+                            direnv
+                            git
+                            nix_deprecations
+                            obs
+                            postgres
+                          ];
+                        };
+                      };
+                    };
+                  };
                 }
               )
             ];
diff --git a/hosts/oren/hyprland_customizations.nix b/hosts/oren/hyprland_customizations.nix
deleted file mode 100644
index 80cb07f..0000000
--- a/hosts/oren/hyprland_customizations.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, ... }:
-{
-  home-manager.sharedModules = [
-    (
-      { ... }:
-      {
-        wayland.windowManager.hyprland.settings = {
-          exec-once = [
-            # Wait a moment for monitors/workspaces to settle, then "prime" 6 and return to 1
-            "sh -lc 'sleep 0.2; hyprctl dispatch workspace 1'"
-          ];
-          monitor = lib.mkForce [
-            "eDP-1,2560x1600@165.000Hz,0x0,1.666667,transform,0"
-          ];
-        };
-        services.hyprpaper.settings = {
-          mode = "fill"; # Wallpaper display mode: fill, fit, stretch, center, tile
-
-          preload = [
-            "${../_shared_assets/wallpapers/pixel_neon.png}"
-          ];
-
-          wallpaper = [
-            "eDP-1,${../_shared_assets/wallpapers/pixel_neon.png}"
-          ];
-        };
-      }
-    )
-  ];
-}
diff --git a/hosts/oren/sway_customizations.nix b/hosts/oren/sway_customizations.nix
deleted file mode 100644
index ad72ca6..0000000
--- a/hosts/oren/sway_customizations.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ ... }:
-let
-  swayExtraOptions = {
-    startup = [
-      {
-        command = "exec sh -c 'sleep 0.01; swaymsg workspace number 1'";
-      }
-    ];
-
-    # Optional output settings
-    output = {
-      "eDP-1" = {
-        scale = "1.7";
-        pos = "0 0";
-        mode = "2560x1600@165.000Hz";
-        bg = "${../_shared_assets/wallpapers/pixel_neon.png} fill";
-      };
-    };
-  };
-
-in
-{
-  options = { };
-
-  config = {
-    environment.systemPackages = [ ];
-
-    ringofstorms_common.desktopEnvironment.sway.extraOptions = swayExtraOptions;
-  };
-}
diff --git a/hosts/template.josh.nix b/hosts/template.josh.nix
deleted file mode 100644
index fba7b68..0000000
--- a/hosts/template.josh.nix
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
-
-    # Use relative to get current version for testing
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
-    # flatpaks.url = "path:../../flakes/flatpaks";
-    flatpaks.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/flatpaks";
-
-    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
-  };
-
-  outputs =
-    {
-      nixpkgs,
-      home-manager,
-      common,
-      secrets,
-      flatpaks,
-      ros_neovim,
-      ...
-    }:
-    let
-      configuration_name = "SYSTEM_NAME";
-      system = "x86_64-linux";
-      stateVersion = "25.05";
-      primaryUser = "josh";
-      lib = nixpkgs.lib;
-    in
-    {
-      nixosConfigurations = {
-        "${configuration_name}" = (
-          lib.nixosSystem {
-            inherit system;
-            modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
-              ros_neovim.nixosModules.default
-              flatpaks.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.tmux
-              common.nixosModules.boot_systemd
-              common.nixosModules.de_sway
-              common.nixosModules.hardening
-              common.nixosModules.jetbrains_font
-              common.nixosModules.nix_options
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-              (
-                {
-                  config,
-                  pkgs,
-                  upkgs,
-                  lib,
-                  ...
-                }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.de_sway
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.foot
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${config.networking.hostName}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "video"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "REPLACE"
-                      ];
-                    };
-                  };
-
-                  environment.systemPackages = with pkgs; [
-                    lua
-                    qdirstat
-                    ffmpeg-full
-                    vlc
-                    google-chrome
-                  ];
-
-                  services.flatpak.packages = [
-                    "org.signal.Signal"
-                    "dev.vencord.Vesktop"
-                    "md.obsidian.Obsidian"
-                    "com.spotify.Client"
-                    "com.bitwarden.desktop"
-                    "org.openscad.OpenSCAD"
-                    "org.blender.Blender"
-                    "com.rustdesk.RustDesk"
-                  ];
-                }
-              )
-            ];
-          }
-        );
-      };
-    };
-}
diff --git a/hosts/template.luser.nix b/hosts/template.luser.nix
deleted file mode 100644
index 8e3c256..0000000
--- a/hosts/template.luser.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
-    home-manager.url = "github:rycee/home-manager/release-25.05";
-
-    # Use relative to get current version for testing
-    # common.url = "path:../../flakes/common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
-    # secrets.url = "path:../../flakes/secrets";
-    secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
-
-    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
-  };
-
-  outputs =
-    {
-      nixpkgs,
-      home-manager,
-      common,
-      secrets,
-      ros_neovim,
-      ...
-    }:
-    let
-      configuration_name = "SYSTEM_NAME";
-      system = "x86_64-linux";
-      stateVersion = "25.05";
-      primaryUser = "luser";
-      lib = nixpkgs.lib;
-    in
-    {
-      nixosConfigurations = {
-        "${configuration_name}" = (
-          lib.nixosSystem {
-            inherit system;
-            modules = [
-              home-manager.nixosModules.default
-
-              secrets.nixosModules.default
-              ros_neovim.nixosModules.default
-
-              common.nixosModules.essentials
-              common.nixosModules.git
-              common.nixosModules.tmux
-              common.nixosModules.boot_systemd
-              common.nixosModules.hardening
-              common.nixosModules.jetbrains_font
-              common.nixosModules.nix_options
-              common.nixosModules.tailnet
-              common.nixosModules.timezone_auto
-              common.nixosModules.tty_caps_esc
-              common.nixosModules.zsh
-              (
-                {
-                  config,
-                  pkgs,
-                  upkgs,
-                  lib,
-                  ...
-                }:
-                rec {
-                  # Home Manager
-                  home-manager = {
-                    useUserPackages = true;
-                    useGlobalPkgs = true;
-                    backupFileExtension = "bak";
-                    # add all normal users to home manager so it applies to them
-                    users = lib.mapAttrs (name: user: {
-                      home.stateVersion = stateVersion;
-                      programs.home-manager.enable = true;
-                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
-
-                    sharedModules = [
-                      common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
-                      common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.ssh
-                      common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
-                    ];
-                  };
-
-                  # System configuration
-                  system.stateVersion = stateVersion;
-                  networking.hostName = configuration_name;
-                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${config.networking.hostName}";
-                  nixpkgs.config.allowUnfree = true;
-                  users.users = {
-                    "${primaryUser}" = {
-                      isNormalUser = true;
-                      initialPassword = "password1";
-                      extraGroups = [
-                        "wheel"
-                        "networkmanager"
-                        "input"
-                      ];
-                      openssh.authorizedKeys.keys = [
-                        "REPLACE"
-                      ];
-                    };
-                  };
-                }
-              )
-            ];
-          }
-        );
-      };
-    };
-}
diff --git a/hosts/testbed/flake.nix b/hosts/testbed/flake.nix
index 58c3842..3f4a148 100644
--- a/hosts/testbed/flake.nix
+++ b/hosts/testbed/flake.nix
@@ -4,8 +4,8 @@
     # nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
     # Use relative to get current version for testing
-    # common.url = "path:../../common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
+    common.url = "path:../../common";
+    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
 
     disko.url = "github:nix-community/disko/latest";
     disko.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/readme.md b/readme.md
index f248017..19e2cdb 100644
--- a/readme.md
+++ b/readme.md
@@ -1,25 +1,21 @@
 ## TODO working on changes to this now
 
-#### Old config before granular module + flakes
-
-<https://git.joshuabell.xyz/ringofstorms/dotfiles/src/commit/741363b361dbb1f7f08dad81c3d7b3bd2cdae093>
-
 ### Old Config prior to per system flake approach
 
-<https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/6527f67145fe047df57b4778c154dde580ec04c4>
+<https://git.joshuabell.xyz/dotfiles/~files/6527f67145fe047df57b4778c154dde580ec04c4>
 
 ### Old modules from multi branch flake approach
 
-- [common](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/a3df616bee120e8427728c6e6a642686d6efb96d)
-- [de_gnome](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/2434f4858db4b5ddb095d5a7d8bdb05890c48bb4)
-- [de_cosmic](https://git.joshuabell.x/ringofstormsyz/dotfiles/~files/f2ecd63921dd826b138dab2ba431085c31a151d1)
-- [de_hyperland](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/ecb652f6e331312b401488140c583cabdcb0deba)
-- [secrets](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/5f3633d5f7c729b8e8fc2805d2751e7c006a6f7a)
-- [nebula](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/70cea59e9f1f750fd0aee8cde8cd54aee8601336)
-- [stormd](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/765c7f4436db03936960373ff77dc2d41f0c4cd5)
-- [home_manager](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/df0c4e95ac6b056202c4ec6fabfcfa5bd205a0b4)
-- [boot_grub](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/f00b3d38ec2dd62741a84d706f88c0c3bdd60784)
-- [boot_systemd](https://git.joshuabell.xyz/ringofstorms/dotfiles/~files/3155d8a57286aefb835476617ba6d4df92b83013)
+- [common](https://git.joshuabell.xyz/dotfiles/~files/a3df616bee120e8427728c6e6a642686d6efb96d)
+- [de_gnome](https://git.joshuabell.xyz/dotfiles/~files/2434f4858db4b5ddb095d5a7d8bdb05890c48bb4)
+- [de_cosmic](https://git.joshuabell.xyz/dotfiles/~files/f2ecd63921dd826b138dab2ba431085c31a151d1)
+- [de_hyperland](https://git.joshuabell.xyz/dotfiles/~files/ecb652f6e331312b401488140c583cabdcb0deba)
+- [secrets](https://git.joshuabell.xyz/dotfiles/~files/5f3633d5f7c729b8e8fc2805d2751e7c006a6f7a)
+- [nebula](https://git.joshuabell.xyz/dotfiles/~files/70cea59e9f1f750fd0aee8cde8cd54aee8601336)
+- [stormd](https://git.joshuabell.xyz/dotfiles/~files/765c7f4436db03936960373ff77dc2d41f0c4cd5)
+- [home_manager](https://git.joshuabell.xyz/dotfiles/~files/df0c4e95ac6b056202c4ec6fabfcfa5bd205a0b4)
+- [boot_grub](https://git.joshuabell.xyz/dotfiles/~files/f00b3d38ec2dd62741a84d706f88c0c3bdd60784)
+- [boot_systemd](https://git.joshuabell.xyz/dotfiles/~files/3155d8a57286aefb835476617ba6d4df92b83013)
 
 # First Install on new Machine
 
@@ -61,7 +57,6 @@
   - `mount -o umask=077 /dev/disk/by-label/NIXBOOT /mnt/boot`
 - Add SWAP device (optional)
   - in hardware config
-
 ```nix
 swapDevices = [
   {
@@ -70,13 +65,11 @@ swapDevices = [
   }
 ];
 ```
-
 - Copy keyfile for auto-unlock (optional)
   - `cp /tmp/keyfile_DEVICE_1 /mnt/boot/keyfile_DEVICE_1`
   - `chmod 400 /mnt/boot/keyfile_DEVICE_1`
 - If Encrypted keyfile exists
   - Add to hardware config
-
 ```nix
 boot.initrd.secrets = {
   "/keyfile_DEVICE_1" = "/boot/keyfile_DEVICE_1";
diff --git a/secrets_epic.md b/secrets_epic.md
deleted file mode 100644
index f224d6c..0000000
--- a/secrets_epic.md
+++ /dev/null
@@ -1,546 +0,0 @@
-# Secrets Management Migration Epic
-
-Migration from agenix to OpenBao for dynamic secrets management with Zitadel OIDC authentication.
-
-## Goals
-
-- Replace static encrypted secrets (agenix) with dynamic runtime secrets (OpenBao)
-- Enable automated host onboarding with single identity token
-- Support offline operation through vault-agent caching
-- Graceful degradation when secrets unavailable
-
-## Phase 1: OpenBao Setup on h001
-
-### 1.1 Create OpenBao NixOS Module ✅
-
-**File:** `hosts/h001/mods/openbao.nix`
-
-**Tasks:**
-- [x] Create basic module structure using `services.openbao`
-- [x] Configure file storage backend at `/var/lib/openbao`
-- [x] Set up TCP listener on `127.0.0.1:8200`
-- [x] Enable UI (`services.openbao.settings.ui = true`)
-- [x] Add systemd service hardening options
-
-**Config structure:**
-```nix
-services.openbao = {
-  enable = true;
-  settings = {
-    ui = true;
-    listener.tcp = {
-      address = "127.0.0.1:8200";
-      tls_disable = true;  # nginx will handle TLS
-    };
-    storage.file = {
-      path = "/var/lib/openbao";
-    };
-  };
-};
-```
-
-### 1.2 Configure Nginx Reverse Proxy
-
-**File:** Put this inside of the openbao.nix file as well above or below the existing configuration.
-
-**Tasks:**
-- [x] Add virtualHost for `sec.joshuabell.xyz`
-- [x] Configure SSL using existing ACME wildcard cert
-- [x] Add virtualHost for `sec.joshuabell.xyz`
-- [x] Configure SSL using existing ACME wildcard cert
-- [x] Set up proxy to `http://127.0.0.1:8200`
-- [x] Enable websockets for UI
-- [x] Add security headers
-
-**Expected config:**
-```nix
-services.nginx.virtualHosts."sec.joshuabell.xyz" = {
-  addSSL = true;
-  sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
-  sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
-  locations."/" = {
-    proxyPass = "http://127.0.0.1:8200";
-    proxyWebsockets = true;
-    recommendedProxySettings = true;
-  };
-};
-```
-
-### 1.3 Import Module
-
-**File:** `hosts/h001/mods/default.nix`
-
-**Tasks:**
-- [ ] Add `./openbao.nix` to imports list
-
-### 1.4 Initial Deployment
-
-**Tasks:**
-- [x] Deploy to h001 with `nixos-rebuild switch`
-- [x] Verify OpenBao service is running
-- [x] Access UI at `https://sec.joshuabell.xyz`
-- [x] Initialize OpenBao (generates root token and unseal keys)
-- [x] Save unseal keys and root token securely (LastPass/Bitwarden)
-- [x] Unseal the vault
-
-**Commands:**
-```bash
-# Check service status
-systemctl status openbao
-
-# Initialize (do once)
-openbao operator init
-
-# Unseal (after each restart, requires 3 of 5 keys by default)
-openbao operator unseal <key1>
-openbao operator unseal <key2>
-openbao operator unseal <key3>
-```
-
-### 1.5 Enable KV Secrets Engine
-
-**Tasks:**
-- [ ] Login to OpenBao with root token
-- [ ] Enable KV v2 secrets engine at path `kv/`
-- [ ] Create initial secret structure
-
-**Commands:**
-```bash
-export VAULT_ADDR='https://sec.joshuabell.xyz'
-openbao login <root-token>
-openbao secrets enable -version=2 kv
-openbao kv put kv/test password=hello
-openbao kv get kv/test
-```
-
-## Phase 2: Zitadel Integration
-
-### 2.1 Configure OpenBao OIDC Auth Method
-
-**Tasks:**
-- [ ] Get Zitadel OIDC discovery URL (`https://sso.joshuabell.xyz/.well-known/openid-configuration`)
-- [ ] Create service account in Zitadel for OpenBao
-- [ ] Generate client ID and client secret
-- [ ] Configure OIDC auth method in OpenBao at path `oidc/`
-- [ ] Set up bound audiences and claims
-
-**Commands:**
-```bash
-openbao auth enable oidc
-
-openbao write auth/oidc/config \
-  oidc_discovery_url="https://sso.joshuabell.xyz" \
-  oidc_client_id="<client-id-from-zitadel>" \
-  oidc_client_secret="<client-secret-from-zitadel>" \
-  default_role="nixos-host"
-```
-
-### 2.2 Create OpenBao Policies
-
-**File:** Document policies in code or external files
-
-**Tasks:**
-- [ ] Create `nixos-host-base` policy (read access to host-specific paths)
-- [ ] Create `nixos-h001` policy (read `kv/data/hosts/h001/*`)
-- [ ] Create `nixos-h002` policy (read `kv/data/hosts/h002/*`)
-- [ ] Create `nixos-h003` policy (read `kv/data/hosts/h003/*`)
-- [ ] Create admin policy for manual management
-
-**Example policy:**
-```hcl
-# nixos-h001 policy
-path "kv/data/hosts/h001/*" {
-  capabilities = ["read", "list"]
-}
-```
-
-**Commands:**
-```bash
-openbao policy write nixos-h001 - <<EOF
-path "kv/data/hosts/h001/*" {
-  capabilities = ["read", "list"]
-}
-EOF
-```
-
-### 2.3 Create OpenBao Roles for Hosts
-
-**Tasks:**
-- [ ] Create OIDC role `nixos-h001` bound to Zitadel machine user
-- [ ] Create OIDC role `nixos-h002` bound to Zitadel machine user
-- [ ] Create OIDC role `nixos-h003` bound to Zitadel machine user
-- [ ] Associate each role with corresponding policy
-
-**Commands:**
-```bash
-openbao write auth/oidc/role/nixos-h001 \
-  bound_audiences="<client-id>" \
-  allowed_redirect_uris="http://localhost:8250/oidc/callback" \
-  user_claim="sub" \
-  policies="nixos-h001" \
-  bound_claims='{"sub":"<machine-user-id-from-zitadel>"}'
-```
-
-### 2.4 Create Machine Users in Zitadel
-
-**Tasks:**
-- [ ] Login to Zitadel at `https://sso.joshuabell.xyz`
-- [ ] Create machine user `nixos-h001`
-- [ ] Create machine user `nixos-h002`
-- [ ] Create machine user `nixos-h003`
-- [ ] Generate JWT credentials for each
-- [ ] Save JWTs securely (these will be injected during install)
-- [ ] Note the subject claim (`sub`) for each machine user
-
-### 2.5 Test OIDC Authentication
-
-**Tasks:**
-- [ ] Attempt OIDC login from CLI using machine user JWT
-- [ ] Verify token is issued
-- [ ] Verify policies are attached
-- [ ] Test reading a secret with issued token
-
-**Commands:**
-```bash
-# This will open browser - may need manual flow for machine users
-openbao login -method=oidc role=nixos-h001
-
-# Verify token and policies
-openbao token lookup
-```
-
-## Phase 3: NixOS vault-agent Integration
-
-### 3.1 Create Reusable vault-agent Module
-
-**File:** `flakes/common/nix_modules/vault_agent.nix`
-
-**Tasks:**
-- [ ] Create module with options for:
-  - Vault address
-  - Auth method and role
-  - JWT token path
-  - Secret definitions (path, destination, owner, restart command)
-- [ ] Configure auto-auth with OIDC
-- [ ] Set up file sink for token caching at `/var/lib/vault-agent/token`
-- [ ] Enable caching for offline operation
-- [ ] Create template blocks for each secret
-- [ ] Set up systemd tmpfiles for directories
-- [ ] Configure proper file permissions and ownership
-
-**Module structure:**
-```nix
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.vault-agent;
-in {
-  options.services.vault-agent = {
-    enable = lib.mkEnableOption "vault-agent";
-    vaultAddress = lib.mkOption { type = lib.types.str; };
-    role = lib.mkOption { type = lib.types.str; };
-    jwtPath = lib.mkOption { type = lib.types.str; default = "/etc/vault/jwt"; };
-    secrets = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule {
-        options = {
-          path = lib.mkOption { type = lib.types.str; };
-          destination = lib.mkOption { type = lib.types.str; };
-          owner = lib.mkOption { type = lib.types.str; default = "root"; };
-          group = lib.mkOption { type = lib.types.str; default = "root"; };
-          permissions = lib.mkOption { type = lib.types.str; default = "0400"; };
-          template = lib.mkOption { type = lib.types.str; };
-          command = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
-        };
-      });
-    };
-  };
-  
-  config = lib.mkIf cfg.enable {
-    # systemd service config
-    # vault-agent configuration file
-    # tmpfiles rules
-  };
-}
-```
-
-### 3.2 Add Module to Common Flake
-
-**File:** `flakes/common/flake.nix`
-
-**Tasks:**
-- [ ] Export vault-agent module in `nixosModules`
-- [ ] Ensure it's available to host configurations
-
-### 3.3 Create Host-Specific Configuration
-
-**File:** `hosts/h001/mods/vault-integration.nix`
-
-**Tasks:**
-- [ ] Import vault-agent module
-- [ ] Configure vault-agent for h001:
-  - vault address: `https://sec.joshuabell.xyz`
-  - role: `nixos-h001`
-  - JWT path: `/etc/vault/h001-jwt`
-- [ ] Define secrets needed by h001 services
-- [ ] Configure service dependencies (services wait for vault-agent)
-
-**Example:**
-```nix
-services.vault-agent = {
-  enable = true;
-  vaultAddress = "https://sec.joshuabell.xyz";
-  role = "nixos-h001";
-  secrets = {
-    postgres-password = {
-      path = "kv/data/hosts/h001/postgresql";
-      destination = "/run/secrets/postgres-password";
-      owner = "postgres";
-      group = "postgres";
-      template = "{{ with secret \"kv/data/hosts/h001/postgresql\" }}{{ .Data.data.password }}{{ end }}";
-      command = "systemctl try-reload-or-restart postgresql.service";
-    };
-  };
-};
-
-systemd.services.postgresql = {
-  requires = [ "vault-agent.service" ];
-  after = [ "vault-agent.service" ];
-};
-```
-
-### 3.4 Import vault-integration Module
-
-**File:** `hosts/h001/mods/default.nix`
-
-**Tasks:**
-- [ ] Add `./vault-integration.nix` to imports
-
-## Phase 4: Migrate First Secret
-
-### 4.1 Choose Test Secret
-
-**Decision:** Start with `openwebui_env.age`
-- Non-critical if it fails
-- Single host (h001)
-- Environment file format (good test case)
-- Service can gracefully fail
-
-### 4.2 Add Secret to OpenBao
-
-**Tasks:**
-- [ ] Decrypt current `openwebui_env.age` to get values
-- [ ] Parse environment variables
-- [ ] Add each value to OpenBao at `kv/hosts/h001/openwebui`
-
-**Commands:**
-```bash
-# Decrypt current secret
-ragenix -d openwebui_env.age > /tmp/openwebui.env
-
-# Add to vault (example, adjust based on actual env vars)
-openbao kv put kv/hosts/h001/openwebui \
-  api_key="xxx" \
-  other_var="yyy"
-```
-
-### 4.3 Update Service Configuration
-
-**File:** `hosts/h001/mods/openwebui.nix`
-
-**Tasks:**
-- [ ] Remove agenix secret reference
-- [ ] Change service to use `/run/secrets/openwebui-env`
-- [ ] Add vault-agent secret definition for this env file
-- [ ] Configure service dependency on vault-agent
-
-### 4.4 Deploy and Test
-
-**Tasks:**
-- [ ] Deploy configuration to h001
-- [ ] Verify vault-agent service starts
-- [ ] Check `/run/secrets/openwebui-env` is created
-- [ ] Verify openwebui service starts successfully
-- [ ] Test openwebui functionality
-- [ ] Test offline scenario (stop openbao, restart host, verify cached secret works)
-
-### 4.5 Remove Old Secret
-
-**Tasks:**
-- [ ] Remove `openwebui_env.age` from `flakes/secrets/`
-- [ ] Remove from `secrets.nix` definitions
-- [ ] Commit changes
-
-## Phase 5: Migrate Remaining Secrets
-
-### 5.1 Migrate Environment Files
-
-**Secrets to migrate:**
-- [ ] `obsidian_sync_env.age`
-- [ ] `vaultwarden_env.age` (on o001, expand to that host)
-
-**Process per secret:**
-1. Add to OpenBao at appropriate path
-2. Update service configuration
-3. Test deployment
-4. Remove old agenix file
-
-### 5.2 Migrate Single-Value Secrets
-
-**Secrets to migrate:**
-- [ ] `oauth2_proxy_key_file.age`
-- [ ] `zitadel_master_key.age` (careful - currently used in container bind mount)
-
-**Process per secret:**
-1. Add to OpenBao
-2. Update service to read from vault-agent rendered file
-3. Test thoroughly
-4. Remove old agenix file
-
-### 5.3 Decide on SSH Keys
-
-**Secrets to evaluate:**
-- `nix2*.age` - SSH keys for git/deployment access
-- `headscale_auth.age` - network auth
-- `us_chi_wg.age` - wireguard config
-- `github_read_token.age` - API token
-- `linode_rw_domains.age` - DNS API token
-
-**Decision criteria:**
-- How often do they change?
-- Would dynamic fetching improve security?
-- Is rotation feasible?
-
-**Tasks:**
-- [ ] Document which secrets stay in agenix
-- [ ] Document why (static network config, rotation not needed, etc.)
-- [ ] Migrate appropriate ones to OpenBao
-
-### 5.4 Expand to Other Hosts
-
-**Per host (h002, h003):**
-- [ ] Create machine user in Zitadel
-- [ ] Create policy and role in OpenBao
-- [ ] Add secrets to OpenBao at `kv/hosts/h00X/`
-- [ ] Create vault-integration module for host
-- [ ] Generate and save JWT token
-- [ ] Test deployment
-
-**Per host (lio, oren, gpdPocket3):**
-- [ ] Evaluate which secrets they need from OpenBao
-- [ ] Configure vault-agent for mobile/offline scenarios
-- [ ] Test cached operation when offline
-
-## Phase 6: Automated Onboarding Preparation
-
-### 6.1 Document JWT Injection Process
-
-**Tasks:**
-- [ ] Create standard location for JWT: `/etc/vault/jwt`
-- [ ] Document manual process to inject JWT during install
-- [ ] Test manual injection on testbed host
-
-### 6.2 Create Wrapper Script for nixos-anywhere
-
-**File:** `scripts/install-host.sh` or similar
-
-**Tasks:**
-- [ ] Create script that takes hostname and target IP
-- [ ] Script copies JWT from local secrets store
-- [ ] Uses nixos-anywhere with post-partition hooks
-- [ ] Injects JWT to `/mnt/etc/vault/jwt` before nixos-install
-
-### 6.3 Test Full Installation Flow
-
-**Tasks:**
-- [ ] Boot testbed host to installer
-- [ ] Run wrapper script
-- [ ] Verify host installs successfully
-- [ ] Verify host boots and authenticates to OpenBao
-- [ ] Verify services start with secrets
-
-### 6.4 Document New Onboarding Process
-
-**File:** Update `readme.md` or create `docs/onboarding.md`
-
-**Tasks:**
-- [ ] Document Zitadel machine user creation
-- [ ] Document OpenBao policy/role setup
-- [ ] Document adding secrets to OpenBao
-- [ ] Document host configuration steps
-- [ ] Document install command
-- [ ] Document verification steps
-
-## Phase 7: Production Hardening
-
-### 7.1 OpenBao Auto-Unseal
-
-**Tasks:**
-- [ ] Research auto-unseal options (cloud KMS, Shamir, etc.)
-- [ ] Implement chosen auto-unseal method
-- [ ] Test restart without manual unseal
-
-### 7.2 Backup and Recovery
-
-**Tasks:**
-- [ ] Set up automated OpenBao snapshots
-- [ ] Test restore from backup
-- [ ] Document recovery procedures
-- [ ] Store unseal keys in secure location (separate from backups)
-
-### 7.3 Monitoring and Alerting
-
-**Tasks:**
-- [ ] Add OpenBao metrics to Grafana (already have monitoring on h001)
-- [ ] Create alerts for:
-  - Sealed state
-  - Authentication failures
-  - Secret access errors
-- [ ] Monitor vault-agent health on each host
-
-### 7.4 Secret Rotation
-
-**Tasks:**
-- [ ] Document secret rotation procedures
-- [ ] Identify secrets that should rotate regularly
-- [ ] Create rotation schedule
-- [ ] Test rotation without service interruption
-
-### 7.5 Security Review
-
-**Tasks:**
-- [ ] Review OpenBao policies (principle of least privilege)
-- [ ] Review network access (firewall rules)
-- [ ] Review audit logging
-- [ ] Review JWT token expiration and renewal
-- [ ] Penetration test (attempt to access secrets without proper auth)
-
-## Success Criteria
-
-- [ ] OpenBao running and accessible at `https://sec.joshuabell.xyz`
-- [ ] Zitadel OIDC authentication working for machine users
-- [ ] At least 3 secrets migrated from agenix to OpenBao
-- [ ] Services on h001 starting successfully with vault-agent secrets
-- [ ] Offline operation tested and working (cached secrets)
-- [ ] Documentation complete for onboarding new hosts
-- [ ] No secrets in git except encrypted agenix files for static configs
-- [ ] Clear migration path established for remaining secrets
-
-## Rollback Plan
-
-At any point, can rollback by:
-1. Reverting host configuration to use agenix
-2. Ensuring agenix secrets still exist and are valid
-3. Redeploying previous configuration
-4. OpenBao can continue running for future use
-
-## Notes
-
-- Keep agenix infrastructure until migration fully complete
-- Test each migration step on h001 before expanding to other hosts
-- Prioritize services where dynamic secrets add value
-- Some secrets (SSH keys, wireguard) may never migrate - that's ok
-- Focus on secrets that would benefit from:
-  - Dynamic generation
-  - Automatic rotation
-  - Centralized management
-  - Audit logging
-