eh it is not working

push

.envrc

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+dotenv_if_exists .env.local
+
+nix_direnv_manual_reload
+use flake
+

.gitignore

@@ -1,4 +1,5 @@
 # if in /etc/nixos don't grab defaults
 ./hardware-configuration.nix
 ./configuration.nix
-
+modules/
+**/result

common/_containers/forgejo.nix

@@ -0,0 +1,196 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  name = "forgejo";
+
+  hostDataDir = "/var/lib/${name}";
+
+  hostAddress = "10.0.0.1";
+  containerAddress = "10.0.0.2";
+  hostAddress6 = "fc00::1";
+  containerAddress6 = "fc00::2";
+
+  binds = [
+    # Postgres data, must use postgres user in container and host
+    {
+      host = "${hostDataDir}/postgres";
+      # Adjust based on container postgres data dir
+      container = "/var/lib/postgresql/17";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # Postgres backups
+    {
+      host = "${hostDataDir}/backups/postgres";
+      container = "/var/backup/postgresql";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # App data, uses custom user uid
+    {
+      host = "${hostDataDir}/data";
+      container = "/var/lib/forgejo";
+      user = "forgejo";
+      uid = 115;
+      gid = 115;
+    }
+  ];
+  uniqueUsers = lib.foldl' (
+    acc: bind: if lib.lists.any (item: item.user == bind.user) acc then acc else acc ++ [ bind ]
+  ) [ ] binds;
+  users = {
+    users = lib.listToAttrs (
+      lib.map (u: {
+        name = u.user;
+        value = {
+          isSystemUser = true;
+          name = u.user;
+          uid = u.uid;
+          group = u.user;
+        };
+      }) uniqueUsers
+    );
+
+    groups = lib.listToAttrs (
+      lib.map (g: {
+        name = g.user;
+        value.gid = g.gid;
+      }) uniqueUsers
+    );
+  };
+in
+{
+  # Ensure users exists on host machine with same IDs as container
+  inherit users;
+
+  # Ensure directories exist on host machine
+  system.activationScripts.createMediaServerDirs = ''
+    ${lib.concatStringsSep "\n" (
+      lib.map (bind: ''
+        mkdir -p ${bind.host}
+        chown -R ${toString bind.user}:${toString bind.gid} ${bind.host}
+        chmod -R 750 ${bind.host}
+      '') binds
+    )}
+  '';
+
+  containers.${name} = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostAddress;
+    localAddress = containerAddress;
+    hostAddress6 = hostAddress6;
+    localAddress6 = containerAddress6;
+    bindMounts = lib.foldl (
+      acc: bind:
+      {
+        "${bind.container}" = {
+          hostPath = bind.host;
+          isReadOnly = false;
+        };
+      }
+      // acc
+    ) { } binds;
+    config =
+      { config, pkgs, ... }:
+      {
+        system.stateVersion = "24.11";
+
+        networking = {
+          firewall = {
+            enable = true;
+            allowedTCPPorts = [
+              3000
+              3032
+            ];
+          };
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+        services.resolved.enable = true;
+
+        # Ensure users exist on container
+        inherit users;
+
+        services.postgresql = {
+          enable = true;
+          package = pkgs.postgresql_17.withJIT;
+          enableJIT = true;
+          authentication = ''
+            local all all trust
+            host all all 127.0.0.1/8 trust
+            host all all ::1/128 trust
+            host all all fc00::1/128 trust
+          '';
+        };
+
+        # Backup database
+        services.postgresqlBackup = {
+          enable = true;
+        };
+
+        services.forgejo = {
+          enable = true;
+          dump = {
+            enable = false;
+            type = "tar.gz";
+          };
+          database = {
+            type = "postgres";
+          };
+          settings = {
+            DEFAULT = {
+              APP_NAME = "Josh's Git";
+            };
+            server = {
+              PROTOCOL = "http";
+              DOMAIN = "git.joshuabell.xyz";
+              HTTP_ADDR = "0.0.0.0";
+              HTTP_PORT = 3000;
+
+              START_SSH_SERVER = true;
+              SSH_DOMAIN = "git.joshuabell.xyz";
+              SSH_LISTEN_HOST = "0.0.0.0";
+              SSH_LISTEN_PORT = 3032; # actual listen port
+              SSH_PORT = 3032; # used in UI
+              BUILTIN_SSH_SERVER_USER = "git";
+
+              LANDING_PAGE = "explore";
+            };
+            service = {
+              DISABLE_REGISTRATION = true;
+              ENABLE_BASIC_AUTHENTICATION = false;
+              DISABLE_USERS_PAGE = true;
+              DISABLE_ORGANIZATIONS_PAGE = true;
+            };
+            repository = {
+              # ENABLE_PUSH_CREATE_USER = true;
+              # ENABLE_PUSH_CREATE_ORG = true;
+              DISABLE_STARS = true;
+              DEFAULT_PRIVATE = "private";
+            };
+            admin = {
+              DISABLE_REGULAR_ORG_CREATION = true;
+              USER_DISABLED_FEATURES = "deletion";
+            };
+            other = {
+              SHOW_FOOTER_POWERED_BY = false;
+              SHOW_FOOTER_VERSION = false;
+              SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+            };
+            migrations = {
+              ALLOWED_DOMAINS = "*.github.com,github.com";
+              ALLOW_LOCALNETWORKS = true;
+            };
+          };
+        };
+      };
+  };
+}

common/_containers/obsidian_sync.md

@@ -0,0 +1,7 @@
+docker run \
+ -e hostname=https://obsidiansync.joshuabell.xyz \
+ -e database=obsidian_sync \
+ -e username=obsidian_admin \
+ -e password=$REPLACE \
+ docker.io/oleduc/docker-obsidian-livesync-couchdb:master \
+ deno -A /scripts/generate_setupuri.ts

common/_containers/obsidian_sync.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.obsidian_sync;
+in
+{
+  options.services.obsidian_sync =
+    let
+      lib = pkgs.lib;
+    in
+    {
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 5984;
+        description = "Port number for Obsidian Sync CouchDB server";
+      };
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/obsidian_sync";
+        description = "Directory to store Obsidian Sync data";
+      };
+      serverUrl = lib.mkOption {
+        type = lib.types.str;
+        description = "URL of the Obsidian Sync server";
+      };
+      dockerEnvFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [ ];
+        description = "List of environment files to be used by the Obsidian Sync container. When provided you must supply chouchdb user/password env files they will not be supplied by default.";
+      };
+    };
+
+  config = {
+    virtualisation.oci-containers.containers = {
+      #############
+      # obsidian_sync #
+      #############
+      obsidian_sync = {
+        user = "root";
+        image = "docker.io/oleduc/docker-obsidian-livesync-couchdb:master";
+        ports = [
+          "${toString cfg.port}:${toString cfg.port}"
+        ];
+        environment = {
+          SERVER_URL = cfg.serverUrl;
+          COUCHDB_DATABASE = "obsidian_sync";
+          COUCHDB_USER = pkgs.lib.mkIf (cfg.dockerEnvFiles == [ ]) "adminu";
+          COUCHDB_PASSWORD = pkgs.lib.mkIf (cfg.dockerEnvFiles == [ ]) "Password123";
+        };
+        environmentFiles = cfg.dockerEnvFiles;
+        volumes = [
+          "${cfg.dataDir}/data:/opt/couchdb/data"
+          "${cfg.dataDir}/config:/opt/couchdb/etc/local.d"
+        ];
+      };
+    };
+  };
+}

common/_home_manager/default.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  hyprland,
+  hyprlandPkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "homeManager"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      users = lib.mkOption {
+        type = lib.types.attrsOf lib.types.attrs;
+        default = { };
+        description = "Home manager users to configure. Should match nix options of home-manager.users.<name>.*";
+      };
+      stateVersion = lib.mkOption {
+        type = lib.types.str;
+        default = "25.05";
+        description = "Home manager state version";
+      };
+    };
+  config = {
+    # Home manager options
+    security.polkit.enable = true;
+    home-manager.useUserPackages = true;
+    home-manager.useGlobalPkgs = true;
+    home-manager.backupFileExtension = "bak";
+
+    home-manager.extraSpecialArgs = {
+      inherit hyprland hyprlandPkgs;
+    };
+
+    home-manager.users = lib.mapAttrs' (name: userConfig: {
+      inherit name;
+      value = userConfig // {
+        home.stateVersion = cfg.stateVersion;
+        programs.home-manager.enable = true;
+        home.username = name;
+        home.homeDirectory = lib.mkForce (if name == "root" then "/root" else "/home/${name}");
+      };
+    }) cfg.users;
+  };
+}

common/_home_manager/mods/alacritty.nix

@@ -0,0 +1,34 @@
+{ ... }:
+{
+  programs.alacritty = {
+    enable = true;
+    settings = {
+      window = {
+        decorations = "None";
+        dynamic_title = false;
+      };
+      colors = {
+        primary = {
+          foreground = "#e0e0e0";
+          background = "#262626";
+        };
+        normal = {
+          # Catppuccin Coal
+          black = "#1f1f1f";
+          red = "#f38ba8";
+          green = "#a6e3a1";
+          yellow = "#f9e2af";
+          blue = "#89b4fa";
+          magenta = "#cba6f7";
+          cyan = "#89dceb";
+          white = "#e0e0e0";
+        };
+      };
+      font = {
+        normal = { family = "JetBrainsMonoNL Nerd Font"; style = "Regular"; };
+        size = 12.0;
+      };
+    };
+  };
+}
+

common/_home_manager/mods/atuin.nix

@@ -8,6 +8,8 @@
       workspaces = true;
       exit-mode = "return-query";
       enter_accept = true;
+      sync_address = "https://atuin.joshuabell.xyz";
+      sync = { records = true; };
     };
   };
 }

common/_home_manager/mods/direnv.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  programs.direnv = {
+    enable = true;
+    enableZshIntegration = true;
+    nix-direnv.enable = true;
+    config = {
+      nix-direnv = true;
+      global = {
+        strict_env = true;
+        load_dotenv = true;
+        hide_env_diff = true;
+      };
+      whitelist = {
+        prefix = [
+          "~/projects"
+          "~/.config"
+          "~/.local/share/git_worktrees/"
+        ];
+      };
+    };
+  };
+}

common/_home_manager/mods/foot.nix

@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+{
+  options.components.foot = {
+    font_size = lib.mkOption {
+      type = lib.types.float;
+      default = 12.0;
+      description = "Font size for Foot terminal";
+    };
+    alpha = lib.mkOption {
+      type = lib.types.float;
+      default = 0.94;
+      description = "Background opacity for Foot terminal (1.0 = opaque)";
+    };
+  };
+  config = {
+    programs.foot = {
+      enable = true;
+
+      # This renders to ~/.config/foot/foot.ini
+      settings = {
+        main = {
+          # Use the same font and size as your Kitty config
+          font = "JetBrainsMonoNL Nerd Font:size=${toString config.components.kitty.font_size}";
+
+          # Initial window size in character cells (Kitty used 160c x 55c)
+          "initial-window-size-chars" = "160x55";
+        };
+
+        colors = {
+          # Background opacity (1.0 = opaque)
+          alpha = toString config.components.foot.alpha;
+
+          # Foreground/background
+          foreground = "e0e0e0";
+          background = "262626";
+
+          # 16-color palette
+          # normal (0–7)
+          regular0 = "1f1f1f"; # black
+          regular1 = "f38ba8"; # red
+          regular2 = "a6e3a1"; # green
+          regular3 = "f9e2af"; # yellow
+          regular4 = "89b4fa"; # blue
+          regular5 = "cba6f7"; # magenta
+          regular6 = "89dceb"; # cyan
+          regular7 = "e0e0e0"; # white
+
+          # bright (8–15)
+          bright0 = "565656"; # bright black
+          bright1 = "f38ba8"; # bright red
+          bright2 = "a6e3a1"; # bright green
+          bright3 = "f9e2af"; # bright yellow
+          bright4 = "89b4fa"; # bright blue
+          bright5 = "cba6f7"; # bright magenta
+          bright6 = "89dceb"; # bright cyan
+          bright7 = "ffffff"; # bright white
+        };
+      };
+    };
+  };
+}

common/_home_manager/mods/git.nix

@@ -1,15 +1,20 @@
-{ settings, ... }:
+{ ... }:
 {
   programs.git = {
     enable = true;
-    userEmail = settings.user.git.email;
-    userName = settings.user.git.name;
+    # TODO make configurable
+    userEmail = "ringofstorms@gmail.com";
+    userName = "RingOfStorms (Joshua Bell)";
 
     extraConfig = {
       core.pager = "cat";
-      core.editor = "nvim";
+      core.editor = "nano";
 
       pull.rebase = false;
+
+      init.defaultBranch = "main";
+
+      rerere.enabled = true;
     };
 
     difftastic = {
@@ -17,9 +22,6 @@
       background = "dark";
     };
 
-    # TODO move from common system? Need root user home managed too...
-    # aliases: {}
-
     ignores = [
       # --------------
       #    Intellij
@@ -52,7 +54,14 @@
       ".apdisk"
 
       # direnv things
-      "/.direnv"
+      ".direnv"
+
+      # local only files
+      "*.local"
+
+      # AI tooling
+      ".aider*"
+      "aider"
     ];
   };
 }

common/_home_manager/mods/kitty.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+{
+  options.components.kitty = {
+    font_size = lib.mkOption {
+      type = lib.types.float;
+      default = 12.0;
+      description = "Font size for Kitty terminal";
+    };
+  };
+  config = {
+    # Enable Kitty terminal
+    programs.kitty = {
+      enable = true;
+
+      settings = {
+        # Window settings
+        background_opacity = 1.0;
+        os_window_class = "kitty";
+        remember_window_size = false;
+        placement_strategy = "center";
+        initial_window_width = "160c";
+        initial_window_height = "55c";
+
+        # Remove window borders
+        hide_window_decorations = "titlebar-only";
+        tab_title_template = "none";
+        active_tab_title_template = "none";
+        draw_minimal_borders = "yes";
+        window_border_width = "0.1pt";
+
+        # Colors (Catppuccin Coal)
+        foreground = "#e0e0e0";
+        background = "#262626";
+        color0 = "#1f1f1f";
+        color1 = "#f38ba8";
+        color2 = "#a6e3a1";
+        color3 = "#f9e2af";
+        color4 = "#89b4fa";
+        color5 = "#cba6f7";
+        color6 = "#89dceb";
+        color7 = "#e0e0e0";
+        color8 = "#565656";
+        color9 = "#f38ba8";
+        color10 = "#a6e3a1";
+        color11 = "#f9e2af";
+        color12 = "#89b4fa";
+        color13 = "#cba6f7";
+        color14 = "#89dceb";
+        color15 = "#ffffff";
+
+        # Font settings
+        font_family = "JetBrainsMonoNL Nerd Font";
+        font_size = config.components.kitty.font_size;
+        bold_font = "auto";
+        italic_font = "auto";
+        italic_bold_font = "auto";
+      };
+
+      # If you want to include extra configuration this way instead of through the main `settings` attribute
+      extraConfig = ''
+        # You can add additional config here if needed
+      '';
+    };
+  };
+}

common/_home_manager/mods/launcher_rofi.nix

@@ -0,0 +1,18 @@
+{
+  pkgs,
+  ...
+}:
+{
+  programs.rofi = {
+    enable = true;
+    plugins = with pkgs; [ rofi-calc ];
+    extraConfig = {
+      modi = "drun,run,ssh,window,calc";
+      terminal = "alacritty";
+    };
+    theme = "glue_pro_blue";
+  };
+  programs.wofi = {
+    enable = true;
+  };
+}

common/_home_manager/mods/nix_deprecations.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  programs.zsh.shellAliases = {
+    # Nix deprecations
+    nix-hash = "echo 'The functionality of nix-hash may be covered by various subcommands or options in the new `nix` command.'";
+    nix-build = "echo 'Use `nix build` instead.'";
+    nix-info = "echo 'Use `nix flake info` or other `nix` subcommands to obtain system and Nix information.'";
+    nix-channel = "echo 'Channels are being phased out in favor of flakes. Use `nix flake` subcommands.'";
+    nix-instantiate = "echo 'Use `nix eval` or `nix-instantiate` with flakes.'";
+    nix-collect-garbage = "echo 'Use `nix store gc` instead.'";
+    nix-prefetch-url = "echo 'Use `nix-prefetch` or fetchers in Nix expressions.'";
+    nix-copy-closure = "echo 'Use `nix copy` instead.'";
+    nix-shell = "echo 'Use `nix shell` instead.'";
+    # nix-daemon # No direct replacement: The Nix daemon is still in use and managed by the system service manager.
+    nix-store = "echo 'Use `nix store` subcommands for store operations.'";
+    nix-env = "echo 'Use `nix profile` instead'";
+  };
+}

common/_home_manager/mods/obs.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.obs-studio.enable = true;
+}

common/_home_manager/mods/postgres.nix

@@ -1,6 +1,5 @@
 { ... }:
 {
-
   home.file.".psqlrc".text = ''
     \pset pager off
   '';

common/_home_manager/mods/slicer.nix

@@ -0,0 +1,33 @@
+{ pkgs, ... }:
+let
+  orca-slicer-fix = pkgs.stdenv.mkDerivation {
+    name = "orca-slicer";
+    buildInputs = [ pkgs.makeWrapper ];
+    unpackPhase = "true";
+    buildPhase = ''
+      mkdir -p $out/bin
+      makeWrapper ${pkgs.orca-slicer}/bin/orca-slicer $out/bin/orca-slicer \
+        --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/applications
+      cat > $out/share/applications/orca-slicer.desktop <<EOF
+      [Desktop Entry]
+      Name=Orca Slicer
+      Comment=3D printing slicer
+      Exec=$out/bin/orca-slicer
+      Icon=orca-slicer
+      Terminal=false
+      Type=Application
+      Categories=Graphics;3DGraphics;
+      EOF
+    '';
+  };
+in
+{
+  home.packages = with pkgs; [
+    prusa-slicer
+    orca-slicer-fix
+  ];
+}

common/_home_manager/mods/ssh.nix

@@ -0,0 +1,162 @@
+{
+  osConfig,
+  lib,
+  ...
+}:
+let
+  inherit (osConfig) age;
+  hasSecret =
+    secret:
+    let
+      secrets = age.secrets or { };
+    in
+    secrets ? ${secret} && secrets.${secret} != null;
+in
+{
+  # TODO can I put all IP's in the flake.nix top level settings and pull them in here instead?
+  programs.ssh = {
+    enable = true;
+    extraConfig = ''
+      Host *
+        SetEnv TERM=xterm-256color
+    '';
+    matchBlocks = {
+      # EXTERNAL
+      "github.com" = lib.mkIf (hasSecret "nix2github") {
+        identityFile = age.secrets.nix2github.path;
+      };
+      "bitbucket.org" = lib.mkIf (hasSecret "nix2bitbucket") {
+        identityFile = age.secrets.nix2bitbucket.path;
+      };
+      # "git.joshuabell.xyz" =  lib.mkIf (hasSecret "nix2gitjosh") { # TODO remove old
+      #   identityFile = age.secrets.nix2gitjosh.path;
+      #   user = "git";
+      # };
+      "git.joshuabell.xyz" = lib.mkIf (hasSecret "nix2gitforgejo") {
+        identityFile = age.secrets.nix2gitforgejo.path;
+        user = "git";
+      };
+      # PERSONAL DEVICES
+      "lio" = lib.mkIf (hasSecret "nix2lio") {
+        identityFile = age.secrets.nix2lio.path;
+        user = "josh";
+      };
+      "lio_" = lib.mkIf (hasSecret "nix2lio") {
+        identityFile = age.secrets.nix2lio.path;
+        hostname = "10.12.14.116";
+        user = "josh";
+      };
+      "oren" = lib.mkIf (hasSecret "nix2oren") {
+        identityFile = age.secrets.nix2oren.path;
+        user = "josh";
+      };
+      "joe" = lib.mkIf (hasSecret "nix2joe") {
+        identityFile = age.secrets.nix2joe.path;
+        user = "ringo";
+      };
+      "gp3" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        user = "josh";
+      };
+      "t" = lib.mkIf (hasSecret "nix2t") {
+        identityFile = age.secrets.nix2t.path;
+        user = "joshua.bell";
+        localForwards = [
+          {
+            bind.port = 3002;
+            host.port = 3002;
+            host.address = "localhost";
+          }
+        ];
+        setEnv = {
+          TERM = "vt100";
+        };
+      };
+      "t_" = lib.mkIf (hasSecret "nix2t") {
+        identityFile = age.secrets.nix2t.path;
+        hostname = "10.12.14.181";
+        user = "joshua.bell";
+        localForwards = [
+          {
+            bind.port = 3002;
+            host.port = 3002;
+            host.address = "localhost";
+          }
+        ];
+        setEnv = {
+          TERM = "vt100";
+        };
+      };
+      "mbptv" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        user = "waka";
+        setEnv = {
+          TERM = "vt100";
+        };
+      };
+      "mbptv_" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        hostname = "10.12.14.30";
+        user = "waka";
+        setEnv = {
+          TERM = "vt100";
+        };
+      };
+      "nothing1" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        user = "TODO";
+      };
+      "tab1" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        user = "TODO";
+      };
+      "pixel6" = lib.mkIf (hasSecret "nix2gpdPocket3") {
+        identityFile = age.secrets.nix2gpdPocket3.path;
+        user = "TODO";
+      };
+      # HOME SERVERS
+      "h001" = lib.mkIf (hasSecret "nix2h001") {
+        identityFile = age.secrets.nix2h001.path;
+        user = "luser";
+      };
+      "h001_" = lib.mkIf (hasSecret "nix2h001") {
+        identityFile = age.secrets.nix2h001.path;
+        hostname = "10.12.14.10";
+        user = "luser";
+      };
+      "h002" = lib.mkIf (hasSecret "nix2h002") {
+        identityFile = age.secrets.nix2h002.path;
+        user = "luser";
+      };
+      "h003" = lib.mkIf (hasSecret "nix2h003") {
+        identityFile = age.secrets.nix2h003.path;
+        user = "luser";
+      };
+      # LINODE SERVERS
+      "l001" = lib.mkIf (hasSecret "nix2linode") {
+        identityFile = age.secrets.nix2linode.path;
+        hostname = "172.236.111.33"; # Not on the tailscale network it is the primary host
+        user = "root";
+      };
+      "l002_" = lib.mkIf (hasSecret "nix2linode") {
+        identityFile = age.secrets.nix2linode.path;
+        hostname = "172.234.26.141";
+        user = "root";
+      };
+      "l002" = lib.mkIf (hasSecret "nix2linode") {
+        identityFile = age.secrets.nix2linode.path;
+        user = "root";
+      };
+      # ORACLE SERVERS
+      "o001" = lib.mkIf (hasSecret "nix2oracle") {
+        identityFile = age.secrets.nix2oracle.path;
+        user = "root";
+      };
+      "o001_" = lib.mkIf (hasSecret "nix2oracle") {
+        identityFile = age.secrets.nix2oracle.path;
+        hostname = "64.181.210.7";
+        user = "root";
+      };
+    };
+  };
+}

common/_home_manager/mods/starship.nix

@@ -22,7 +22,7 @@
         sapphire = "#74c7ec";
         blue = "#89b4fa";
         lavender = "#b4befe";
-        # Coal variant: https://gist.github.com/RingOfStorms/b2ff0c4e37f5be9f985c72c3ec9a3e62
+        # Coal variant: https://gist.joshuabell.xyz/ringofstorms/catppucin-coal
         text = "#e0e0e0";
         subtext1 = "#cccccc";
         subtext0 = "#b8b8b8";
@@ -36,8 +36,17 @@
         mantle = "#1f1f1f";
         crust = "#171717";
       };
+      nix_shell = {
+        heuristic = true;
+        impure_msg = "不純 \\(ふじゅん\\)";
+        pure_msg = " 純粋 \\(じゅんすい\\)";
+      };
+      git_branch = {
+        format = "オン [$symbol$branch(:$remote_branch)]($style) ";
+      };
+      cmd_duration = {
+        format = "掛かった [$duration]($style) ";
+      };
     };
   };
 }
-
-

common/_home_manager/mods/tmux/tmux-reset.conf

@@ -3,24 +3,23 @@ unbind-key -a
 bind C-Space send-prefix
 
 # Windows
-bind -r p previous-window
-bind -r n next-window
+# bind -r p previous-window
+# bind -r n next-window
 bind -r & kill-window
-bind -r c new-window
+bind c new-window -a -c "#{pane_current_path}"
 bind ',' command-prompt "rename-window %%"
-bind -r '"' split-window -v -c "#{pane_current_path}"
-bind -r % split-window -h -c "#{pane_current_path}"
-# bind "'" command-prompt -T window-target -p index { select-window it ":%%" }
+bind "\|" split-window -h -c "#{pane_current_path}"
+bind "\\" split-window -v -c "#{pane_current_path}"
 bind w choose-tree -Zw
-bind -r 1 select-window -t:1
-bind -r 2 select-window -t:2
-bind -r 3 select-window -t:3
-bind -r 4 select-window -t:4
-bind -r 5 select-window -t:5
-bind -r 6 select-window -t:6
-bind -r 7 select-window -t:7
-bind -r 8 select-window -t:8
-bind -r 9 select-window -t:9
+bind 1 select-window -t:1
+bind 2 select-window -t:2
+bind 3 select-window -t:3
+bind 4 select-window -t:4
+bind 5 select-window -t:5
+bind 6 select-window -t:6
+bind 7 select-window -t:7
+bind 8 select-window -t:8
+bind 9 select-window -t:9
 # custom
 bind m command-prompt -p "Swap with window index:" "swap-window -t '%%'"
 bind -r [ swap-window -t -1 \; previous-window
@@ -33,10 +32,9 @@ bind -r left select-pane -L
 bind -r down select-pane -D
 bind -r up select-pane -U
 bind -r right select-pane -R
-bind -r x kill-pane
-bind z resize-pane -Z
-# custom
-bind e select-layout tiled
+bind x kill-pane
+bind -r space resize-pane -Z
+bind S select-layout tiled
 bind -r h select-pane -L
 bind -r j select-pane -D
 bind -r k select-pane -U
@@ -47,16 +45,23 @@ bind -r l select-pane -R
 bind $ command-prompt "rename-session %%"
 bind -r ) switch-client -n
 bind -r ( switch-client -p
-
+# custom
+bind C command-prompt -p "session name:" "new-session -s '%%'"
 
 # Tmux util
-bind X source-file ~/.config/tmux/tmux.conf
 bind : command-prompt
-bind C-D detach
+bind C-d detach
+
 # ==========
 # My options
-set-option -g terminal-overrides ',xterm-256color:RGB'
+set -g default-terminal "tmux-256color"
+set-option -g terminal-overrides ',tmux-256color:RGB'
 set -g detach-on-destroy off
 set -g renumber-windows on
 set -g status-position top
+set -sg escape-time 0
+set -g xterm-keys on
+set-option -g set-titles on
+set-option -g set-titles-string "tmux: #S - #W"
 
+set-option -g focus-events on

common/_home_manager/mods/tmux/tmux.nix

@@ -1,7 +1,4 @@
-{ settings, lib, pkgs, ... } @ args:
-let
-  tmux = pkgs.tmuxPlugins;
-in
+{ lib, pkgs, ... }:
 {
   # home manager doesn't give us an option to add tmux extra config at the top so we do it ourselves here.
   xdg.configFile."tmux/tmux.conf".text = lib.mkBefore (builtins.readFile ./tmux-reset.conf);
@@ -18,28 +15,18 @@ in
     baseIndex = 1;
     mouse = true;
     keyMode = "vi";
-    newSession = true;
     shell = "${pkgs.zsh}/bin/zsh";
-    terminal = "screen-256color";
+    terminal = "tmux-256color";
     aggressiveResize = true;
+    sensibleOnTop = false;
 
-    plugins = [
-      tmux.yank
-      # tmux.tmux-thumbs
-      # {
-      #   plugin = tmux.fzf-tmux-url;
-      #   extraConfig = ''
-      #     set -g @fzf-url-fzf-options '-p 60%,30% --prompt = "   " - -border-label=" Open URL "'
-      #     set -g @fzf-url-history-limit '2000'
-      #   '';
-      # }
+    plugins = with pkgs.tmuxPlugins; [
       {
-        plugin = tmux.catppuccin.overrideAttrs (_: {
-          src = pkgs.fetchFromGitHub {
-            owner = "ringofstorms";
-            repo = "tmux-catppuccin-coal";
-            rev = "e6d7c658e2d11798912ca1ed4e3626e3e1fad3fc";
-            sha256 = "sha256-M1XAeCz/lqgjZ7CnWCykJxZCDk+WVoawwHrR9SEO9ns=";
+        plugin = catppuccin.overrideAttrs (_: {
+          src = pkgs.fetchgit {
+            url = "https://git.joshuabell.xyz/ringofstorms/tmux-catppuccin-coal.git";
+            rev = "d078123cd81c0dbb3f780e8575a9d38fe2023e1b";
+            sha256 = "sha256-qPY/dovDyut5WoUkZ26F2w3fJVmw4gcC+6l2ugsA65Y=";
           };
         });
         extraConfig = ''
@@ -63,12 +50,27 @@ in
           set -g @catppuccin_date_time_text "%H:%M"
         '';
       }
+      {
+        plugin = resurrect;
+        extraConfig = ''
+          set -g @resurrect-strategy-nvim 'session'
+          set -g @resurrect-capture-pane-contents 'on'
+          # Hook to save tmux-resurrect state when a pane is closed
+          set-hook -g pane-died "run-shell 'tmux-resurrect save'"
+        '';
+      }
+      {
+        plugin = continuum;
+        extraConfig = ''
+          set -g @continuum-restore 'on'
+          set -g @continuum-save-interval '5' # minutes
+        '';
+      }
     ];
   };
 
   home.shellAliases = {
     t = "tmux";
-    tat = "tmux ls 2>/dev/null && tmux attach-session -t \"$(tmux ls | head -n1 | cut -d: -f1)\" || tmux new-session";
+    tat = "tmux attach-session";
   };
 }
-

common/_home_manager/mods/zoxide.nix

@@ -6,4 +6,3 @@
     options = [ "--cmd cd" ];
   };
 }
-

common/_home_manager/mods/zsh.nix

@@ -2,13 +2,27 @@
 {
   programs.zsh = {
     enable = true;
-    enableAutosuggestions = true;
+    autosuggestion.enable = true;
 
     shellAliases = { };
 
     defaultKeymap = "emacs";
 
-    profileExtra = ''
+    initContent = ''
+      # Set editor to neovim, TODO only do this if mod.neovim is enabled
+      export EDITOR=nvim
+      export VISUAL=nvim
+
+      # Enable editing command in external editor
+      autoload -Uz edit-command-line
+      zle -N edit-command-line
+      # fix delete key
+      bindkey "^[[3~" delete-char
+      # Try multiple bindings for edit-command-line
+      bindkey '^X^E' edit-command-line    # Traditional Ctrl+X,Ctrl+E binding
+      bindkey '^[^M' edit-command-line    # Alt+Enter
+      # Note: Ctrl+Enter might not be distinctly capturable in all terminals
+
       # Make home/end and ctrl + left/right nav how I expect them to like in bash
       bindkey "\e[1~" beginning-of-line
       bindkey "\e[4~" end-of-line
@@ -26,4 +40,3 @@
     '';
   };
 }
-

common/boot/default.nix

@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.boot;
+in
+{
+  imports = [
+    ./grub.nix
+    ./systemd.nix
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledBootloaders = lib.filter (x: x.enabled) [
+            {
+              name = "systemd";
+              enabled = cfg.systemd.enable;
+            }
+            {
+              name = "grub";
+              enabled = cfg.grub.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledBootloaders <= 1;
+          message =
+            "Only one bootloader can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledBootloaders);
+        }
+      )
+    ];
+  };
+}

common/boot/grub.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "boot"
+    "grub"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Grub bootloader";
+      device = lib.mkOption {
+        type = lib.types.str;
+        default = "/dev/sda";
+        description = ''
+          The device to install GRUB on.
+        '';
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    boot.loader.grub = {
+      enable = true;
+      device = cfg.device;
+    };
+  };
+}

common/boot/systemd.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "boot"
+    "systemd"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Systemd bootloader";
+    };
+  config = lib.mkIf cfg.enable {
+    boot.loader = {
+      systemd-boot = {
+        enable = true;
+        consoleMode = "keep";
+      };
+      timeout = 5;
+      efi = {
+        canTouchEfiVariables = true;
+      };
+    };
+  };
+}

common/config.nix

@@ -0,0 +1,3 @@
+{
+  custom_config_key = "ringofstorms_common";
+}

common/desktop_environment/cosmic/default.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [ ccfg.custom_config_key "desktopEnvironment" "cosmic" ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options = {}
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "COSMIC desktop environment (System76)";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      # settings.default_session = {
+      #   command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.cosmic}/bin/cosmic-session'";
+      #   user = "greeter";
+      # };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wofi
+      btop
+    ];
+
+    xdg.portal.enable = true;
+
+    environment.sessionVariables = {
+      NIXOS_OZONE_WL = "1";
+      GTK_THEME = "Adwaita:dark";
+    };
+
+    qt = { enable = true; platformTheme = "gtk2"; style = "adwaita-dark"; };
+    hardware.graphics.enable = true;
+  };
+}

common/desktop_environment/default.nix

@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.desktopEnvironment;
+in
+{
+  imports = [
+    ./gnome
+    # ./hyprland
+    ./sway
+    ./cosmic
+    ./i3
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledDEs = lib.filter (x: x.enabled) [
+            {
+              name = "gnome";
+              enabled = cfg.gnome.enable;
+            }
+            # {
+            #   name = "hyprland";
+            #   enabled = cfg.hyprland.enable;
+            # }
+            {
+              name = "sway";
+              enabled = cfg.sway.enable;
+            }
+            {
+              name = "cosmic";
+              enabled = cfg.cosmic.enable;
+            }
+            {
+              name = "i3";
+              enabled = cfg.i3.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledDEs <= 1;
+          message =
+            "Only one desktop environment can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledDEs);
+        }
+      )
+    ];
+  };
+}

common/desktop_environment/gnome/dconf.nix

@@ -0,0 +1,208 @@
+{ cfg }:
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      (
+        { lib, ... }:
+        with lib.hm.gvariant;
+        {
+          # use `dconf dump /` before and after and diff the files for easy editing of dconf below
+          #     dconf dump / > /tmp/dconf_dump_start && watch -n0.5 "dconf dump / > /tmp/dconf_dump_current && \diff --color /tmp/dconf_dump_start /tmp/dconf_dump_current -U12"
+          # To get nix specific diff:
+          #     \diff -u /tmp/dconf_dump_start /tmp/dconf_dump_current | grep '^+[^+]' | sed 's/^+//' | dconf2nix
+          # OR (Must be logged into user directly, no SU to user will work): `dconf watch /`
+          # OR get the exact converted nixConfig from `dconf dump / | dconf2nix | less` and search with forward slash
+          dconf.settings = {
+            "org/gnome/shell" = {
+              favorite-apps = [ ];
+              enabled-extensions = with pkgs.gnomeExtensions; [
+                vertical-workspaces.extensionUuid
+                compact-top-bar.extensionUuid
+                tray-icons-reloaded.extensionUuid
+                vitals.extensionUuid
+              ] ++ lib.optionals cfg.enableRotate [
+                screen-rotate.extensionUuid
+              ];
+            };
+
+            # Plugin Settings
+            "org/gnome/shell/extensions/vertical-workspaces" = {
+              animation-speed-factor = 42;
+              center-dash-to-ws = false;
+              dash-bg-color = 0;
+              dash-position = 2;
+              dash-position-adjust = 0;
+              hot-corner-action = 0;
+              startup-state = 1;
+              ws-switcher-wraparound = true;
+            };
+            "org/gnome/shell/extensions/compact-top-bar" = {
+              fade-text-on-fullscreen = true;
+            };
+            "org/gnome/shell/extensions/vitals" = {
+              position-in-panel = 1;
+            };
+
+            # Built in settings
+            "org/gnome/desktop/session" = {
+              idle-delay = mkUint32 0;
+            };
+            "org/gnome/desktop/wm/preferences" = {
+              resize-with-right-button = true;
+              button-layout = "maximize:appmenu,close";
+              audible-bell = false;
+              wrap-around = true;
+            };
+            "org/gnome/settings-daemon/plugins/media-keys" = {
+              # Disable the lock screen shortcut
+              screensaver = [ "" ];
+              custom-keybindings = [
+                "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+                "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+              ];
+            };
+            "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+              binding = "<Super>Return";
+              command = cfg.terminalCommand;
+              name = "Launch terminal";
+            };
+            "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+              binding = "<Super>Space";
+              command = "wofi";
+              name = "Launcher";
+            };
+            "org/gnome/desktop/wm/keybindings" = {
+              minimize = [ "" ];
+              move-to-workspace-1 = [ "" ];
+              move-to-workspace-2 = [ "" ];
+              move-to-workspace-3 = [ "" ];
+              move-to-workspace-4 = [ "" ];
+              move-to-workspace-last = [ "" ];
+              move-to-workspace-down = [ "<Control><Super>j" ];
+              move-to-workspace-up = [ "<Control><Super>k" ];
+              # move-to-workspace-left = [ "<Control><Super>h" ];
+              # move-to-workspace-right = [ "<Control><Super>l" ];
+              switch-input-source = [ ];
+              switch-input-source-backward = [ ];
+              switch-to-workspace-1 = [ "<Super>1" ];
+              switch-to-workspace-2 = [ "<Super>2" ];
+              switch-to-workspace-3 = [ "<Super>3" ];
+              switch-to-workspace-4 = [ "<Super>4" ];
+              switch-to-workspace-last = [ "" ];
+              switch-to-workspace-down = [ "<Super>j" ];
+              switch-to-workspace-up = [ "<Super>k" ];
+              # switch-to-workspace-left = [ "<Super>k" ];
+              # switch-to-workspace-right = [ "<Super>j" ];
+              # move-to-monitor-down = [ "<Control><Super><Shift>j" ];
+              # move-to-monitor-up = [ "<Control><Super><Shift>k" ];
+              move-to-monitor-left = [ "<Control><Super>h" ];
+              move-to-monitor-right = [ "<Control><Super>l" ];
+              unmaximize = [ "<Super><Shift>j" ];
+              maximize = [ "<Super><Shift>k" ];
+            };
+            "org/gnome/mutter" = {
+              dynamic-workspaces = true;
+              edge-tiling = true;
+              workspaces-only-on-primary = true;
+              center-new-windows = true;
+            };
+            "org/gnome/mutter/keybindings" = {
+              toggle-tiled-right = [ "<Super><Shift>l" ];
+              toggle-tiled-left = [ "<Super><Shift>h" ];
+            };
+            "org/gnome/settings-daemon/plugins/power" = {
+              power-button-action = "nothing";
+              sleep-inactive-ac-type = "nothing";
+              sleep-inactive-battery-type = "nothing";
+              idle-brightness = 15;
+              power-saver-profile-on-low-battery = false;
+            };
+            "org/gnome/desktop/background" = {
+              color-shading-type = "solid";
+              picture-options = "zoom";
+              picture-uri = "file://" + (./black.png);
+              picture-uri-dark = "file://" + (./black.png);
+              primary-color = "#000000000000";
+              secondary-color = "#000000000000";
+            };
+            "org/gnome/desktop/screensaver" = {
+              lock-enabled = false;
+              idle-activation-enabled = false;
+              picture-options = "zoom";
+              picture-uri = "file://" + (./black.png);
+              picture-uri-dark = "file://" + (./black.png);
+            };
+            "org/gnome/desktop/applications/terminal" = {
+              exec = "alacritty";
+            };
+            "org/gnome/settings-daemon/plugins/color" = {
+              night-light-enabled = false;
+              night-light-schedule-automatic = false;
+            };
+            "org/gnome/shell/keybindings" = {
+              shift-overview-down = [ "" ];
+              shift-overview-up = [ "" ];
+              switch-to-application-1 = [ "" ];
+              switch-to-application-2 = [ "" ];
+              switch-to-application-3 = [ "" ];
+              switch-to-application-4 = [ "" ];
+              switch-to-application-5 = [ "" ];
+              switch-to-application-6 = [ "" ];
+              switch-to-application-7 = [ "" ];
+              switch-to-application-8 = [ "" ];
+              switch-to-application-9 = [ "" ];
+              toggle-quick-settings = [ "" ];
+              toggle-application-view = [ "" ];
+            };
+            "org/gtk/gtk4/settings/file-chooser" = {
+              show-hidden = true;
+            };
+
+            "org/gnome/desktop/interface" = {
+              accent-color = "orange";
+              show-battery-percentage = true;
+              clock-show-date = true;
+              clock-show-seconds = true;
+              clock-show-weekday = true;
+              color-scheme = "prefer-dark";
+              cursor-size = 24;
+              enable-animations = true;
+              enable-hot-corners = false;
+              font-antialiasing = "grayscale";
+              font-hinting = "slight";
+              gtk-theme = "Adwaita-dark";
+              # icon-theme = "Yaru-magenta-dark";
+            };
+
+            "org/gnome/desktop/notifications" = {
+              application-children = [ "org-gnome-tweaks" ];
+            };
+
+            "org/gnome/desktop/notifications/application/org-gnome-tweaks" = {
+              application-id = "org.gnome.tweaks.desktop";
+            };
+
+            "org/gnome/desktop/peripherals/mouse" = {
+              natural-scroll = false;
+            };
+
+            "org/gnome/desktop/peripherals/touchpad" = {
+              disable-while-typing = true;
+              two-finger-scrolling-enabled = true;
+              natural-scroll = true;
+            };
+
+            "org/gnome/tweaks" = {
+              show-extensions-notice = false;
+            };
+          };
+        }
+      )
+    ];
+  };
+}

common/desktop_environment/gnome/default.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "gnome"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "gnome desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "kitty";
+        description = "The terminal command to use.";
+      };
+      enableRotate = lib.mkEnableOption "enable screen rotation";
+    };
+
+  imports = [
+    (import ./dconf.nix { inherit cfg; })
+    (import ./wofi.nix { inherit cfg; })
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.xserver = {
+      enable = true;
+      desktopManager.gnome.enable = true;
+      displayManager.gdm = {
+        enable = true;
+        autoSuspend = false;
+        wayland = true;
+      };
+    };
+    services.gnome.gnome-initial-setup.enable = false;
+
+    environment.gnome.excludePackages = with pkgs; [
+      gnome-backgrounds
+      gnome-video-effects
+      gnome-maps
+      gnome-music
+      gnome-tour
+      gnome-text-editor
+      gnome-user-docs
+    ];
+    environment.systemPackages = with pkgs; [
+      dconf-editor
+      dconf2nix
+      gnome-tweaks
+      wayland
+      wayland-utils
+      wl-clipboard
+      numix-cursor-theme
+      gnomeExtensions.vertical-workspaces
+      gnomeExtensions.compact-top-bar
+      gnomeExtensions.tray-icons-reloaded
+      gnomeExtensions.vitals
+    ] ++ lib.optionals cfg.enableRotate [
+      gnomeExtensions.screen-rotate
+    ];
+    environment.sessionVariables = {
+      NIXOS_OZONE_WL = "1";
+      GTK_THEME = "Adwaita:dark";
+    };
+
+    qt = {
+      enable = true;
+      platformTheme = "gnome";
+      style = "adwaita-dark";
+    };
+
+    hardware.graphics = {
+      enable = true;
+    };
+  };
+}

common/desktop_environment/gnome/wofi.css

@@ -0,0 +1,51 @@
+window {
+  margin: 0px;
+  border: 1px solid #171717;
+  background-color: #262626;
+}
+
+#input {
+  margin: 5px;
+  border: none;
+  color: #e0e0e0;
+  background-color: #1f1f1f;
+}
+
+#inner-box {
+  margin: 5px;
+  border: none;
+  background-color: #171717;
+}
+
+#outer-box {
+  margin: 5px;
+  border: none;
+  background-color: #191919;
+}
+
+#scroll {
+  margin: 0px;
+  border: none;
+}
+
+#text {
+  margin: 5px;
+  border: none;
+  color: #e0e0e0;
+}
+
+#entry.activatable #text {
+  color: #cccccc;
+}
+
+#entry>* {
+  color: #e0e0e0;
+}
+
+#entry:selected {
+  background-color: #4f4f4f;
+}
+
+#entry:selected #text {
+  font-weight: bold;
+}

common/desktop_environment/gnome/wofi.nix

@@ -0,0 +1,31 @@
+{ cfg }:
+{ lib, ... }:
+{
+  config = lib.mkIf cfg.enable {
+    home-manager.sharedModules = [
+      (
+        { lib, ... }:
+        {
+          programs.wofi = {
+            enable = true;
+            settings = {
+              width = "28%";
+              height = "38%";
+              show = "drun";
+              location = "center";
+              gtk_dark = true;
+              valign = "center";
+              key_backward = "Ctrl+k";
+              key_forward = "Ctrl+j";
+              insensitive = true;
+              prompt = "Run";
+              allow_images = true;
+            };
+            style = builtins.readFile ./wofi.css;
+          };
+        }
+      )
+    ];
+
+  };
+}

common/desktop_environment/hyprland/default.nix

@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  hyprland,
+  hyprlandPkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "hyprland desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for Hyprland configuration.";
+      };
+      swaync = {
+        enable = lib.mkEnableOption "Enable Swaync (notification center for Hyprland)";
+      };
+      waybar = {
+        enable = lib.mkEnableOption "Enable Waybar (status bar for Hyprland)";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users
+    home-manager = {
+      sharedModules = [
+        hyprland.homeManagerModules.default
+        ./home_manager
+      ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${hyprlandPkgs.hyprland}/bin/Hyprland'";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wl-clip-persist
+      wofi # application launcher
+      nemo # file manager (x11)
+      # nautilus # file manager
+      feh # image viewer (x11)
+      # imv # image viewer
+      networkmanager # network management
+      upower # power management
+      brightnessctl # screen/keyboard brightness control
+      wireplumber # media session manager
+      libgtop # system monitor library
+      bluez # Bluetooth support
+      power-profiles-daemon # power profiles
+      grim
+      slurp
+      hyprpicker
+      grimblast # screenshot tool
+      wf-recorder # screen recording tool
+      btop # system monitor
+    ];
+
+    services.blueman.enable = config.hardware.bluetooth.enable;
+
+    programs.hyprland = {
+      enable = true;
+      # xwayland.enable = false;
+      withUWSM = true;
+
+      # set the flake package
+      package = hyprlandPkgs.hyprland;
+      # make sure to also set the portal package, so that they are in sync
+      # This is set below now in xdf portal directly so we can also add things like gtk
+      # portalPackage = hyprlandPkgs.xdg-desktop-portal-hyprland;
+    };
+
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        hyprlandPkgs.xdg-desktop-portal-hyprland
+        hyprlandPkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "hyprland"
+        "gtk"
+      ];
+    };
+
+    hardware.graphics = {
+      enable = true;
+      package = hyprlandPkgs.mesa;
+      # if you also want 32-bit support (e.g for Steam)
+      # enable32Bit = true;
+      package32 = hyprlandPkgs.pkgsi686Linux.mesa;
+    };
+
+    # Environment variables
+    environment.sessionVariables = {
+      GTK_THEME = "Adwaita:dark";
+      XDG_SESSION_TYPE = "wayland";
+      XDG_CURRENT_DESKTOP = "Hyprland";
+      XDG_SESSION_DESKTOP = "Hyprland";
+      WLR_RENDERER = "auto";
+
+      # Tell apps to run native wayland
+      NIXOS_OZONE_WL = "1";
+      ELECTRON_OZONE_PLATFORM_HINT = "wayland";
+      GDK_BACKEND = "wayland,x11"; # GTK
+      QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
+      MOZ_ENABLE_WAYLAND = "1"; # Firefox
+      SDL_VIDEODRIVER = "wayland"; # SDL apps/games
+      CLUTTER_BACKEND = "wayland"; # You already have this
+    };
+
+    # Qt theming
+    qt = {
+      enable = true;
+      platformTheme = "gtk2";
+      style = "adwaita-dark";
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/default.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  imports = [
+    ./theme.nix
+    ./hyprland.nix
+    # ./quickshell.nix
+    ./waybar.nix
+    ./hyprpolkitagent.nix
+    ./wofi.nix
+    ./swaync.nix
+    ./scripts.nix
+    ./swaylock.nix
+  ];
+}

common/desktop_environment/hyprland/home_manager/hyprland.nix

@@ -0,0 +1,175 @@
+{
+  osConfig,
+  lib,
+  hyprlandPkgs,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  wayland.windowManager.hyprland = {
+    enable = true;
+    xwayland.enable = osConfig.programs.hyprland.xwayland.enable;
+    # plugins = with hyprlandPkgs.hyprlandPlugins; [
+    #   hyprspace
+    # ];
+
+    settings = lib.attrsets.recursiveUpdate {
+      # Debug logs enabled when this is uncommented
+      debug.disable_logs = false;
+      debug.disable_time = false;
+
+      exec-once = [ "pgrep waybar>/dev/null || waybar" ];
+
+      # Default monitor configuration
+      monitor = "monitor = , preferred, auto, 1";
+
+      windowrulev2 = [
+        # Bitwarden password manager popup for chrome, always float it
+        "float, class:^(?i)chrome-nngceckbapebfimnlniiiahkandclblb-Default$, initialtitle:^_crx_nngceckbapebfimnlniiiahkandclblb$"
+        "center, class:^(?i)chrome-nngceckbapebfimnlniiiahkandclblb-Default$, initialtitle:^_crx_nngceckbapebfimnlniiiahkandclblb$"
+        "size 720 600, class:^(?i)chrome-nngceckbapebfimnlniiiahkandclblb-Default$, initialtitle:^_crx_nngceckbapebfimnlniiiahkandclblb$"
+      ];
+
+      # Input configuration
+      input = {
+        kb_layout = "us";
+        kb_options = "caps:escape";
+
+        follow_mouse = 2;
+        touchpad = {
+          natural_scroll = true;
+          disable_while_typing = true;
+        };
+      };
+
+      # General settings
+      general = {
+        gaps_in = 2;
+        gaps_out = 4;
+        border_size = 1;
+        "col.active_border" = "rgba(797979aa)";
+        "col.inactive_border" = "rgba(393939aa)";
+        layout = "dwindle";
+      };
+
+      # Decoration
+      decoration = {
+        rounding = 4;
+        blur.enabled = false;
+      };
+
+      # Animations
+      animations = {
+        enabled = false;
+      };
+
+      # Layout
+      dwindle = {
+        pseudotile = true;
+        preserve_split = true;
+      };
+
+      # Misc
+      misc = {
+        force_default_wallpaper = 0;
+        disable_hyprland_logo = true;
+        disable_splash_rendering = true;
+      };
+
+      # Key bindings
+      "$mainMod" = "SUPER";
+
+      bind = [
+        # Applications
+        "$mainMod, Return, exec, ${cfg.terminalCommand}"
+        "$mainMod, Space, exec, pkill wofi || wofi --show drun"
+        "$mainMod, q, killactive"
+        "$mainMod SHIFT, escape, exit"
+        "$mainMod SHIFT, q, exec, swaylock"
+        "$mainMod, f, togglefloating"
+        "$mainMod, g, pseudo"
+        "$mainMod, t, togglesplit"
+
+        # Move focus with mainMod + hjkl
+        "$mainMod, h, movefocus, l"
+        "$mainMod, l, movefocus, r"
+        "$mainMod, k, movefocus, u"
+        "$mainMod, j, movefocus, d"
+
+        # Switch workspaces with mainMod + [0-9]
+        "$mainMod, 1, workspace, 1"
+        "$mainMod, n, workspace, 1"
+        "$mainMod, 2, workspace, 2"
+        "$mainMod, m, workspace, 2"
+        "$mainMod, 3, workspace, 3"
+        "$mainMod, comma, workspace, 3"
+        "$mainMod, 4, workspace, 4"
+        "$mainMod, period, workspace, 4"
+        "$mainMod, 5, workspace, 5"
+        "$mainMod, slash, workspace, 5"
+        "$mainMod, 6, workspace, 6"
+        "$mainMod, 7, workspace, 7"
+        "$mainMod, 8, workspace, 8"
+        "$mainMod, 9, workspace, 9"
+        "$mainMod, 0, workspace, 10"
+
+        # Window management (similar to your GNOME setup)
+        "$mainMod SHIFT, h, movewindow, l"
+        "$mainMod SHIFT, l, movewindow, r"
+        "$mainMod SHIFT, k, movewindow, u"
+        "$mainMod SHIFT, j, movewindow, d"
+        "$mainMod SHIFT, 1, movetoworkspacesilent, 1"
+        "$mainMod SHIFT, n, movetoworkspacesilent, 1"
+        "$mainMod SHIFT, 2, movetoworkspacesilent, 2"
+        "$mainMod SHIFT, m, movetoworkspacesilent, 2"
+        "$mainMod SHIFT, 3, movetoworkspacesilent, 3"
+        "$mainMod SHIFT, comma, movetoworkspacesilent, 3"
+        "$mainMod SHIFT, 4, movetoworkspacesilent, 4"
+        "$mainMod SHIFT, period, movetoworkspacesilent, 4"
+        "$mainMod SHIFT, 5, movetoworkspacesilent, 5"
+        "$mainMod SHIFT, slash, movetoworkspacesilent, 5"
+        "$mainMod SHIFT, 6, movetoworkspacesilent, 6"
+        "$mainMod SHIFT, 7, movetoworkspacesilent, 7"
+        "$mainMod SHIFT, 8, movetoworkspacesilent, 8"
+        "$mainMod SHIFT, 9, movetoworkspacesilent, 9"
+        "$mainMod SHIFT, 0, movetoworkspacesilent, 10"
+
+        # Screenshots
+        ", Print, exec, grimblast copy area"
+      ];
+
+      bindr = [
+        # overview
+        # "$mainMod, SUPER_L, overview:toggle" $ hyprspace plugin
+        "$mainMod SHIFT, R, exec, systemctl --user restart hyprpanel.service"
+      ];
+
+      binde = [
+        # Move between workspaces
+        # "$mainMod, n, workspace, r+1"
+        # "$mainMod, p, workspace, r-1"
+
+        # Resize windows
+        "$mainMod CTRL, h, resizeactive, -40 0"
+        "$mainMod CTRL, l, resizeactive, 40 0"
+        "$mainMod CTRL, k, resizeactive, 0 -20"
+        "$mainMod CTRL, j, resizeactive, 0 20"
+      ];
+
+      # Mouse bindings
+      bindm = [
+        "$mainMod, mouse:272, movewindow"
+        "$mainMod, mouse:273, resizewindow"
+      ];
+
+    } cfg.extraOptions;
+  };
+}

common/desktop_environment/hyprland/home_manager/hyprpolkitagent.nix

@@ -0,0 +1,8 @@
+{
+  ...
+}:
+{
+  services.hyprpolkitagent = {
+    enable = true;
+  };
+}

common/desktop_environment/hyprland/home_manager/quickshell.nix

@@ -0,0 +1,93 @@
+{
+  osConfig,
+  lib,
+  pkgs,
+  upkgs,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  home.packages = with pkgs; [
+    upkgs.quickshell
+    pulseaudio
+    brightnessctl
+    networkmanager
+    bluez
+    bluez-tools
+    power-profiles-daemon
+    upower
+    systemd
+    hyprlock
+  ];
+
+  # Ensure CLI quickshell can resolve modules when not using --config-path
+  home.sessionVariables = {
+    QML_IMPORT_PATH = "$HOME/.config/quickshell";
+    QML2_IMPORT_PATH = "$HOME/.config/quickshell";
+  };
+
+  # install config files
+  home.file = {
+    ".config/quickshell/shell.qml".source = ./quickshell/shell.qml;
+    ".config/quickshell/panels/TopBar.qml".source = ./quickshell/panels/TopBar.qml;
+    ".config/quickshell/notifications/NotificationServer.qml".source =
+      ./quickshell/notifications/NotificationServer.qml;
+    ".config/quickshell/notifications/NotificationPopup.qml".source =
+      ./quickshell/notifications/NotificationPopup.qml;
+    ".config/quickshell/notifications/NotificationCenter.qml".source =
+      ./quickshell/notifications/NotificationCenter.qml;
+    ".config/quickshell/widgets/status/Workspaces.qml".source =
+      ./quickshell/widgets/status/Workspaces.qml;
+    ".config/quickshell/widgets/status/Clock.qml".source = ./quickshell/widgets/status/Clock.qml;
+    ".config/quickshell/widgets/status/SystemTrayWidget.qml".source =
+      ./quickshell/widgets/status/SystemTrayWidget.qml;
+    ".config/quickshell/widgets/status/Battery.qml".source = ./quickshell/widgets/status/Battery.qml;
+    ".config/quickshell/widgets/controls/QuickSettings.qml".source =
+      ./quickshell/widgets/controls/QuickSettings.qml;
+    ".config/quickshell/widgets/controls/Audio.qml".source = ./quickshell/widgets/controls/Audio.qml;
+    ".config/quickshell/widgets/controls/Network.qml".source =
+      ./quickshell/widgets/controls/Network.qml;
+    ".config/quickshell/widgets/controls/Bluetooth.qml".source =
+      ./quickshell/widgets/controls/Bluetooth.qml;
+    ".config/quickshell/widgets/controls/Brightness.qml".source =
+      ./quickshell/widgets/controls/Brightness.qml;
+    ".config/quickshell/widgets/controls/PowerProfilesWidget.qml".source =
+      ./quickshell/widgets/controls/PowerProfilesWidget.qml;
+    ".config/quickshell/panels/qmldir".source = ./quickshell/panels/qmldir;
+    ".config/quickshell/notifications/qmldir".source = ./quickshell/notifications/qmldir;
+    ".config/quickshell/widgets/status/qmldir".source = ./quickshell/widgets/status/qmldir;
+    ".config/quickshell/widgets/controls/qmldir".source = ./quickshell/widgets/controls/qmldir;
+    # optional: .qmlls.ini should be gitignored; create empty to enable LSP
+    ".config/quickshell/.qmlls.ini".text = "";
+  };
+
+  systemd.user.services.quickshell = {
+    Unit = {
+      Description = "Quickshell Desktop Shell";
+      PartOf = [ "graphical-session.target" ];
+      After = [ "graphical-session.target" ];
+    };
+    Service = {
+      ExecStart = "${upkgs.quickshell}/bin/quickshell --config-path %h/.config/quickshell";
+      Restart = "on-failure";
+      RestartSec = 2;
+      Environment = [
+        "QML_IMPORT_PATH=%h/.config/quickshell"
+        "QT_QPA_PLATFORM=wayland"
+        # Ensure we find icons
+        "XDG_CURRENT_DESKTOP=quickshell"
+      ];
+    };
+    Install = {
+      WantedBy = [ "graphical-session.target" ];
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/scripts.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    (writeShellScriptBin "toggle-airplane-mode" (builtins.readFile ./scripts/toggle-airplane-mode.sh))
+    (writeShellScriptBin "toggle-power-profile" (builtins.readFile ./scripts/toggle-power-profile.sh))
+    (writeShellScriptBin "wofi-wifi-menu" (builtins.readFile ./scripts/wofi-wifi-menu.sh))
+    (writeShellScriptBin "wofi-bluetooth-menu" (builtins.readFile ./scripts/wofi-bluetooth-menu.sh))
+    (writeShellScriptBin "confirm-action" (builtins.readFile ./scripts/confirm-action.sh))
+  ];
+}

common/desktop_environment/hyprland/home_manager/scripts/confirm-action.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+COMMAND_TO_RUN="$1"
+PROMPT_MESSAGE="$2"
+
+if [ -z "$PROMPT_MESSAGE" ]; then
+    PROMPT_MESSAGE="Are you sure?"
+fi
+
+choice=$(echo -e "No\nYes" | wofi --dmenu --location center -p "$PROMPT_MESSAGE")
+
+if [ "$choice" == "Yes" ]; then
+    eval "$COMMAND_TO_RUN"
+fi

common/desktop_environment/hyprland/home_manager/scripts/toggle-airplane-mode.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+if [ "$(nmcli radio all)" = "enabled" ]; then
+  nmcli radio all off
+else
+  nmcli radio all on
+fi

common/desktop_environment/hyprland/home_manager/scripts/toggle-power-profile.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+if [ "$(powerprofilesctl get)" = "performance" ]; then
+  powerprofilesctl set balanced
+else
+  powerprofilesctl set performance
+fi

common/desktop_environment/hyprland/home_manager/scripts/wofi-bluetooth-menu.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+devices=$(bluetoothctl devices | awk '{print $2, $3}')
+
+if [ -z "$devices" ]; then
+    options="󰂲 Power On\n󰂬 Scan for devices"
+else
+    options="$devices\n󰂲 Power Off\n󰂬 Scan for devices"
+fi
+
+chosen=$(echo -e "$options" | wofi --dmenu --location 3 --yoffset 40 --xoffset -20 -p "Bluetooth")
+
+case "$chosen" in
+    "󰂲 Power On") bluetoothctl power on;;
+    "󰂲 Power Off") bluetoothctl power off;;
+    "󰂬 Scan for devices") bluetoothctl scan on;;
+    *) 
+        mac=$(echo "$chosen" | awk '{print $1}')
+        bluetoothctl connect "$mac"
+        ;;
+esac

common/desktop_environment/hyprland/home_manager/scripts/wofi-wifi-menu.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+# Get a list of available Wi-Fi networks
+nets=$(nmcli --terse --fields SSID,SECURITY,BARS device wifi list | sed '/^--/d' | sed 's/\\:/__/g')
+
+# Get the current connection status
+connected_ssid=$(nmcli -t -f active,ssid dev wifi | egrep '^yes' | cut -d: -f2)
+
+if [[ ! -z "$connected_ssid" ]]; then
+    toggle="󰖪 Toggle Wi-Fi Off"
+else
+    toggle="󰖩 Toggle Wi-Fi On"
+fi
+
+# Present the menu to the user
+chosen_network=$(echo -e "$toggle\n$nets" | wofi --dmenu --location 3 --yoffset 40 --xoffset -20 -p "Wi-Fi Networks")
+
+# Perform an action based on the user's choice
+if [ "$chosen_network" = "$toggle" ]; then
+    nmcli radio wifi $([ "$connected_ssid" = "" ] && echo "on" || echo "off")
+elif [ ! -z "$chosen_network" ]; then
+    ssid=$(echo "$chosen_network" | sed 's/__/\\:/g' | awk -F'  ' '{print $1}')
+    nmcli device wifi connect "$ssid"
+fi

common/desktop_environment/hyprland/home_manager/swaylock.nix

@@ -0,0 +1,17 @@
+{
+  ...
+}:
+{
+  programs.swaylock = {
+    enable = true;
+    settings = {
+      color = "#000000";
+      indicator-caps-lock = true;
+      indicator-idle-visible = true;
+      indicator-radius = 100;
+      indicator-thickness = 10;
+      font = "JetBrainsMono Nerd Font Regular";
+      font-size = 20;
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/swaync.nix

@@ -0,0 +1,251 @@
+{
+  lib,
+  osConfig,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+    "swaync"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.swaync = {
+      enable = true;
+      settings = {
+        ignore = [
+          "com.spotify.Client"
+        ];
+
+        positionX = "right";
+        positionY = "top";
+        layer = "overlay";
+        control-center-layer = "top";
+        layer-shell = true;
+        cssPriority = "application";
+
+        control-center-margin-top = 0;
+        control-center-margin-bottom = 0;
+        control-center-margin-right = 0;
+        control-center-margin-left = 0;
+
+        notification-2fa-action = true;
+        notification-inline-replies = false;
+        notification-icon-size = 64;
+        notification-body-image-height = 100;
+        notification-body-image-width = 200;
+
+        timeout = 10;
+        timeout-low = 5;
+        timeout-critical = 0;
+
+        control-center-width = 500;
+        control-center-height = 600;
+        notification-window-width = 500;
+
+        keyboard-shortcuts = true;
+        image-visibility = "when-available";
+        transition-time = 200;
+        hide-on-clear = false;
+        hide-on-action = true;
+        script-fail-notify = true;
+
+        widgets = [
+          "inhibitors"
+          "title"
+          "dnd"
+          "volume"
+          "backlight"
+          "mpris"
+          "buttons-grid#quick"
+          "notifications"
+        ];
+
+        # Widget configurations
+        widget-config = {
+          inhibitors = {
+            text = "Inhibitors";
+            button-text = "Clear All";
+            clear-all-button = true;
+          };
+          title = {
+            text = "Notifications";
+            clear-all-button = true;
+            button-text = "Clear All";
+          };
+          dnd.text = "Do Not Disturb";
+          mpris = {
+            image-size = 96;
+            image-radius = 12;
+          };
+          volume = {
+            label = "󰕾";
+            show-per-app = true;
+          };
+          backlight = {
+            label = "󰃟";
+            device = "intel_backlight";
+          };
+          "buttons-grid#quick" = {
+            columns = 4; # adjust: 3/4/5
+            icon-size = 20; # tweak to taste
+            actions = [
+              # Power
+              {
+                label = "󰐥";
+                tooltip = "Shutdown";
+                command = "confirm-action 'systemctl poweroff' 'Shutdown?'";
+              }
+              {
+                label = "󰜉";
+                tooltip = "Reboot";
+                command = "confirm-action 'systemctl reboot' 'Reboot?'";
+              }
+              {
+                label = "󰍃";
+                tooltip = "Logout";
+                command = "confirm-action 'hyprctl dispatch exit' 'Logout?'";
+              }
+            ];
+          };
+        };
+      };
+
+      # Custom CSS for the control center
+      style = ''
+        .control-center {
+          background: #1a1b26;
+          border: 2px solid #7dcae4;
+          border-radius: 12px;
+        }
+
+        .control-center-list {
+          background: transparent;
+        }
+
+        .control-center .notification-row:focus,
+        .control-center .notification-row:hover {
+          opacity: 1;
+          background: #24283b;
+        }
+
+        .notification {
+          border-radius: 8px;
+          margin: 6px 12px;
+          box-shadow: 0 0 0 1px rgba(125, 196, 228, 0.3), 0 1px 3px 1px rgba(0, 0, 0, 0.7), 0 2px 6px 2px rgba(0, 0, 0, 0.3);
+          padding: 0;
+        }
+
+        /* Widget styling */
+        .widget-title {
+          margin: 8px;
+          font-size: 1.5rem;
+          color: #c0caf5;
+        }
+
+        .widget-dnd {
+          margin: 8px;
+          font-size: 1.1rem;
+          color: #c0caf5;
+        }
+
+        .widget-dnd > switch {
+          font-size: initial;
+          border-radius: 8px;
+          background: #414868;
+          border: 1px solid #7dcae4;
+        }
+
+        .widget-dnd > switch:checked {
+          background: #7dcae4;
+        }
+
+        .widget-mpris {
+          color: #c0caf5;
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+        }
+
+        .widget-mpris-player {
+          padding: 8px;
+          margin: 8px;
+        }
+
+        .widget-mpris-title {
+          font-weight: bold;
+          font-size: 1.25rem;
+        }
+
+        .widget-mpris-subtitle {
+          font-size: 1.1rem;
+          color: #9ece6a;
+        }
+
+        .widget-volume {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-backlight {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-menubar {
+          background: #24283b;
+          padding: 8px;
+          margin: 8px;
+          border-radius: 8px;
+          color: #c0caf5;
+        }
+
+        .widget-menubar .menu-item button {
+          background: #1f2335;
+          color: #c0caf5;
+          border-radius: 8px;
+          padding: 6px 10px;
+          margin: 4px;
+          border: 1px solid #2e3440;
+          font-family: "JetBrainsMonoNL Nerd Font";
+        }
+
+        .widget-menubar .menu-item button:hover {
+          background: #414868;
+          border-color: #7dcae4;
+        }
+
+        .topbar-buttons button {
+          border: none;
+          background: transparent;
+          color: #c0caf5;
+          font-size: 1.1rem;
+          border-radius: 8px;
+          margin: 0 4px;
+          padding: 8px;
+        }
+
+        .topbar-buttons button:hover {
+          background: #414868;
+        }
+
+        .topbar-buttons button:active {
+          background: #7dcae4;
+          color: #1a1b26;
+        }
+      '';
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/template.nix

@@ -0,0 +1,18 @@
+{
+  osConfig,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+ 
+}

common/desktop_environment/hyprland/home_manager/theme.nix

@@ -0,0 +1,32 @@
+{
+  pkgs,
+  ...
+}:
+{
+  home.pointerCursor = {
+    gtk.enable = true;
+    # x11.enable = true;
+    package = pkgs.bibata-cursors;
+    name = "Bibata-Modern-Classic";
+    size = 16;
+  };
+  # GTK theming
+  gtk = {
+    enable = true;
+
+    theme = {
+      package = pkgs.flat-remix-gtk;
+      name = "Flat-Remix-GTK-Grey-Darkest";
+    };
+
+    iconTheme = {
+      package = pkgs.adwaita-icon-theme;
+      name = "Adwaita";
+    };
+
+    font = {
+      name = "Sans";
+      size = 11;
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/waybar.nix

@@ -0,0 +1,267 @@
+{
+  lib,
+  osConfig,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "hyprland"
+    "waybar"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          position = "top";
+          height = 30;
+          spacing = 6;
+          margin-top = 0;
+          margin-bottom = 0;
+          margin-left = 10;
+          margin-right = 10;
+
+          modules-left = [
+            "hyprland/workspaces"
+          ];
+
+          modules-center = [
+            "clock"
+            "temperature"
+            "cpu"
+            "memory"
+            "disk"
+          ];
+
+          modules-right = [
+            "pulseaudio"
+            "network"
+            "bluetooth"
+            "custom/notifications"
+            "hyprland/language"
+          ];
+
+          # Workspaces configuration
+          "hyprland/workspaces" = {
+            format = "{icon}";
+            format-icons = {
+              "1" = "一";
+              "2" = "二";
+              "3" = "三";
+              "4" = "四";
+              "5" = "五";
+              "6" = "六";
+              "7" = "七";
+              "8" = "八";
+              "9" = "九";
+              "10" = "十";
+              "11" = "十一";
+              "12" = "十二";
+              "13" = "十三";
+              "14" = "十四";
+              "15" = "十五";
+              "16" = "十六";
+              "17" = "十七";
+              "18" = "十八";
+              "19" = "十九";
+              "20" = "二十";
+            };
+            show-special = false;
+          };
+
+          pulseaudio = {
+            format = "{icon} {volume}%";
+            format-bluetooth = "󰂰 {volume}%";
+            format-bluetooth-muted = "󰂲 ";
+            format-muted = "󰖁 ";
+            format-source = "󰍬 {volume}%";
+            format-source-muted = "󰍭 ";
+            format-icons = {
+              headphone = "󰋋";
+              hands-free = "󰂑";
+              headset = "󰂑";
+              phone = "󰏲";
+              portable = "󰦧";
+              car = "󰄋";
+              default = [
+                "󰕿"
+                "󰖀"
+                "󰕾"
+              ];
+            };
+            scroll-step = 5;
+            on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+            on-click-right = "swaync-client -t -sw";
+          };
+
+          "custom/notifications" = {
+            format = "{icon} {}";
+            format-icons = {
+              notification = "";
+              none = "";
+              dnd-notification = "󰂛";
+              dnd-none = "󰂛";
+              inhibited-notification = "";
+              inhibited-none = "";
+              dnd-inhibited-notification = "󰂛";
+              dnd-inhibited-none = "󰂛";
+            };
+            return-type = "json";
+            exec-if = "which swaync-client";
+            exec = "swaync-client -swb";
+            on-click = "swaync-client -t -sw";
+            on-click-right = "swaync-client -d -sw";
+            escape = true;
+            tooltip = false;
+          };
+
+          # Clock
+          clock = {
+            format = "{:%b %d, %H:%M}";
+          };
+
+          temperature = {
+            thermal-zone = 2;
+            hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
+            critical-threshold = 80;
+            format-critical = "󰔏 {temperatureC}°C";
+            format = "󰔏 {temperatureC}°C";
+          };
+
+          cpu = {
+            format = "󰻠 {usage}%";
+            tooltip = false;
+            on-click = "btop";
+          };
+
+          memory = {
+            format = "󰍛 {}%";
+            on-click = "btop";
+          };
+
+          disk = {
+            interval = 30;
+            format = "󰋊 {percentage_used}%";
+            path = "/";
+            on-click = "btop";
+          };
+
+          network = {
+            format-wifi = "󰤨 {essid} ({signalStrength}%)";
+            format-ethernet = "󰈀 {ipaddr}/{cidr}";
+            tooltip-format = "{ifname} via {gwaddr} ";
+            format-linked = "󰈀 {ifname} (No IP)";
+            format-disconnected = "󰖪 Disconnected";
+            on-click = "wofi-wifi-menu";
+            on-click-right = "nmcli radio wifi toggle";
+          };
+
+          bluetooth = {
+            format = "󰂯 {status}";
+            format-connected = "󰂱 {device_alias}";
+            format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
+            tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
+            tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
+            tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
+            tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
+            on-click = "wofi-bluetooth-menu";
+            on-click-right = "bluetoothctl power toggle";
+          };
+
+          # Keyboard input (language)
+          "hyprland/language" = {
+            format = "{}";
+            format-en = "EN";
+            format-ja = "JP";
+          };
+        };
+      };
+
+      style = ''
+        * {
+          font-family: "JetBrainsMonoNL Nerd Font";
+          font-size: 12px;
+          border: none;
+          border-radius: 0;
+          min-height: 0;
+        }
+
+        window#waybar {
+          background: transparent;
+          border-radius: 10px;
+          margin: 0px;
+        }
+
+        .modules-left,
+        .modules-center,
+        .modules-right {
+          background: rgba(26, 27, 38, 0.8);
+          border-radius: 10px;
+          margin: 4px;
+          padding: 0 10px;
+        }
+
+        #workspaces {
+          padding: 0 5px;
+        }
+
+        #workspaces button {
+          padding: 0 8px;
+          background: transparent;
+          color: #c0caf5;
+          border-radius: 5px;
+          margin: 2px;
+        }
+
+        #workspaces button:hover {
+          background: rgba(125, 196, 228, 0.2);
+          color: #7dcae4;
+        }
+
+        #workspaces button.active {
+          background: #7dcae4;
+          color: #1a1b26;
+        }
+
+        #pulseaudio,
+        #custom-notifications,
+        #clock,
+        #temperature,
+        #cpu,
+        #memory,
+        #disk,
+        #network,
+        #bluetooth,
+        #language {
+          padding: 0 8px;
+          color: #c0caf5;
+          margin: 2px;
+        }
+
+        #temperature.critical {
+          color: #f7768e;
+        }
+
+        #network.disconnected {
+          color: #f7768e;
+        }
+
+        #bluetooth.disabled {
+          color: #565f89;
+        }
+
+        #pulseaudio.muted {
+          color: #565f89;
+        }
+      '';
+    };
+  };
+}

common/desktop_environment/hyprland/home_manager/wofi.nix

@@ -0,0 +1,26 @@
+{
+  ...
+}:
+{
+  programs.wofi = {
+    enable = true;
+    settings = {
+      width = 500;
+      height = 600;
+      location = "bottom";
+      show = "drun";
+      prompt = "...";
+      filter_rate = 100;
+      allow_markup = true;
+      no_actions = true;
+      halign = "fill";
+      orientation = "vertical";
+      content_halign = "fill";
+      insensitive = true;
+      allow_images = true;
+      image_size = 40;
+      gtk_dark = true;
+    };
+  };
+
+}

common/desktop_environment/i3/default.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "i3"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "i3 window manager";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "kitty";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for i3 home manager configuration.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users
+    home-manager = {
+      sharedModules = [
+        ./home_manager
+      ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.xorg.xinit}/bin/xinit ${pkgs.i3}/bin/i3'}";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    # flatpaks need this TODO remove flatpaks?
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        pkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "gtk"
+      ];
+    };
+
+    services.xserver = {
+      enable = true;
+
+      # desktopManager = {
+      #   xterm.enable = false;
+      # };
+
+      windowManager.i3 = {
+        enable = true;
+        extraPackages = with pkgs; [
+          # dmenu # application launcher most people use
+          # i3status # gives you the default i3 status bar
+          # i3blocks # if you are planning on using i3blocks over i3status
+        ];
+      };
+    };
+    services.displayManager.defaultSession = "none+i3";
+    # programs.i3lock.enable = true; # default i3 screen locker
+
+    environment.systemPackages = with pkgs; [
+      xorg.xinit
+      xorg.setxkbmap
+      xorg.xset
+    ];
+
+  };
+}

common/desktop_environment/i3/home_manager/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./i3.nix
+  ];
+}

common/desktop_environment/i3/home_manager/i3.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  osConfig,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "i3"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  xsession.windowManager.i3 = {
+    enable = true;
+    config = lib.attrsets.recursiveUpdate {
+      startup = [
+        { command = "setxkbmap -layout us -option caps:escape"; }
+      ];
+      modifier = "Mod4";
+      terminal = cfg.terminalCommand;
+      keybindings =
+        let
+          mod = config.xsession.windowManager.i3.config.modifier;
+        in
+        {
+          # Focus
+          "${mod}+h" = "focus left";
+          "${mod}+l" = "focus right";
+          "${mod}+k" = "focus up";
+          "${mod}+j" = "focus down";
+          # Apps
+          "${mod}+Return" = "exec ${cfg.terminalCommand}";
+          # "${mod}+space" = "exec ${cfg.menu}"; TODO
+          "${mod}+q" = "kill";
+          "${mod}+Shift+Escape" = "exit";
+          "${mod}+Shift+q" = "exec i3lock";
+          "${mod}+f" = "floating toggle";
+
+        };
+      # See home-manager documentation for everything you can add here.
+    } cfg.extraOptions;
+  };
+}

common/desktop_environment/sway/default.nix

@@ -0,0 +1,139 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+with lib;
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "sway (Wayland i3) desktop environment";
+      terminalCommand = mkOption {
+        type = lib.types.str;
+        default = "foot";
+        description = "The terminal command to use.";
+      };
+      extraOptions = mkOption {
+        type = lib.types.attrs;
+        default = { };
+        description = "Extra options for Sway configuration.";
+      };
+      swaync = {
+        enable = lib.mkEnableOption "Enable Sway Notification Center";
+      };
+      waybar = {
+        enable = lib.mkEnableOption "Enable Waybar (status bar for Sway)";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Enable for all users via Home Manager fragments in this module
+    home-manager = {
+      sharedModules = [ ./home_manager ];
+    };
+
+    services.greetd = {
+      enable = true;
+      vt = 2;
+      settings = {
+        default_session = {
+          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd '${pkgs.dbus}/bin/dbus-run-session ${pkgs.sway}/bin/sway'";
+          user = "greeter";
+        };
+      };
+    };
+
+    # Caps Lock as Escape for console/tty and Wayland
+    console.useXkbConfig = true;
+    services.xserver.xkb = {
+      layout = "us";
+      options = "caps:escape";
+    };
+
+    # Core packages and tools
+    environment.systemPackages = with pkgs; [
+      wl-clipboard
+      wl-clip-persist
+      wofi # application launcher
+      nemo # file manager (x11)
+      feh # image viewer (x11)
+      networkmanager
+      upower
+      brightnessctl
+      wireplumber
+      libgtop
+      bluez
+      power-profiles-daemon
+      grim
+      slurp
+      wf-recorder
+      btop
+      pavucontrol
+    ];
+
+    services.blueman.enable = config.hardware.bluetooth.enable;
+
+    programs.sway = {
+      enable = true;
+      wrapperFeatures.gtk = true; # include GTK integration env
+      extraPackages = with pkgs; [
+        xwayland # allow legacy X11 apps
+      ];
+    };
+
+    xdg.portal = {
+      enable = true;
+      extraPortals = lib.mkForce [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+      config.common.default = [
+        "wlr"
+        "gtk"
+      ];
+    };
+
+    hardware.graphics = {
+      enable = true;
+      # Keep defaults; Sway runs fine with mesa in system
+    };
+
+    # Environment variables
+    environment.sessionVariables = lib.mkMerge [
+      {
+        GTK_THEME = "Adwaita:dark";
+        XDG_SESSION_TYPE = "wayland";
+        XDG_CURRENT_DESKTOP = "sway";
+        XDG_SESSION_DESKTOP = "sway";
+        WLR_RENDERER = "auto";
+
+        # Tell apps to run native wayland
+        NIXOS_OZONE_WL = "1";
+        ELECTRON_OZONE_PLATFORM_HINT = "wayland";
+        GDK_BACKEND = "wayland,x11"; # GTK
+        QT_QPA_PLATFORM = "wayland;xcb"; # Qt 5/6
+        MOZ_ENABLE_WAYLAND = "1"; # Firefox
+        SDL_VIDEODRIVER = "wayland"; # SDL apps/games
+        CLUTTER_BACKEND = "wayland";
+      }
+    ];
+
+    # Qt theming
+    qt = {
+      enable = true;
+      platformTheme = "gtk2";
+      style = "adwaita-dark";
+    };
+  };
+}

common/desktop_environment/sway/home_manager/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  imports = [
+    ./theme.nix
+    ./sway.nix
+    ./waybar.nix
+    ./wofi.nix
+    ./swaync.nix
+    ./swaylock.nix
+    ./polkit.nix
+  ];
+}

common/desktop_environment/sway/home_manager/polkit.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.polkit-gnome.enable = true;
+}

common/desktop_environment/sway/home_manager/sway.nix

@@ -0,0 +1,185 @@
+{
+  config,
+  osConfig,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  wayland.windowManager.sway = {
+    enable = true;
+    xwayland = true;
+
+    config = lib.mkMerge [
+      rec {
+        modifier = "Mod4"; # SUPER
+        terminal = cfg.terminalCommand;
+        menu = "wofi --show drun";
+
+        # Per-output workspace mapping (user can extend via extraOptions)
+        # Example (left as defaults): users can add `output HDMI-A-1 workspace 1,3,5` in extraOptions
+
+        input = {
+          "type:keyboard" = {
+            xkb_layout = "us";
+            xkb_options = "caps:escape";
+          };
+          "type:touchpad" = {
+            natural_scroll = "enabled";
+            tap = "enabled";
+            dwt = "enabled";
+          };
+          # Disable focus follows mouse to avoid accidental focus changes
+          # In Sway this behavior is controlled by focus_follows_mouse
+        };
+
+        focus = {
+          followMouse = "no";
+          # onWindowActivation = "urgent"; # don't steal focus; mark urgent instead
+        };
+
+        gaps = {
+          inner = 2;
+          outer = 5;
+          smartGaps = false;
+          smartBorders = "on";
+        };
+
+        colors = {
+          focused = {
+            background = "#444444";
+            border = "#555555";
+            childBorder = "#444444";
+            indicator = "#595959";
+            text = "#f1f1f1";
+          };
+          unfocused = {
+            background = "#222222";
+            border = "#333333";
+            childBorder = "#222222";
+            indicator = "#292d2e";
+            text = "#888888";
+          };
+        };
+
+        window = {
+          border = 1;
+          titlebar = false;
+          commands = [
+            # Bitwarden chrome popup as floating example from Hyprland rules
+            {
+              criteria = {
+                app_id = "chrome-nngceckbapebfimnlniiiahkandclblb-Default";
+              };
+              command = "floating enable";
+            }
+            {
+              criteria = {
+                app_id = "pavucontrol";
+              };
+              command = "floating enable, move position center, resize set 620 1200";
+            }
+            {
+              criteria = {
+                class = "Google-chrome";
+                window_role = "pop-up";
+              };
+              command = "floating enable, move position center, resize set 720 480";
+            }
+            {
+              criteria = {
+                window_role = "pop-up";
+              };
+              command = "floating enable, move position center, resize set 640 420";
+            }
+            {
+              criteria = {
+                window_role = "About";
+              };
+              command = "floating enable, move position center, resize set 640 420";
+            }
+          ];
+        };
+
+        # Keybindings mirroring Hyprland
+        keybindings = {
+          # Apps
+          "${modifier}+return" = "exec ${cfg.terminalCommand}";
+          "${modifier}+space" = "exec pkill wofi || wofi --show drun";
+          "${modifier}+q" = "kill";
+          "${modifier}+shift+Escape" = "exit";
+          "${modifier}+shift+q" = "exec swaylock";
+          "${modifier}+f" = "floating toggle";
+
+          # Focus
+          "${modifier}+h" = "focus left";
+          "${modifier}+l" = "focus right";
+          "${modifier}+k" = "focus up";
+          "${modifier}+j" = "focus down";
+
+          # Workspaces (numbers and vim-like mirror)
+          "${modifier}+1" = "workspace number 1";
+          "${modifier}+n" = "workspace number 1";
+          "${modifier}+2" = "workspace number 2";
+          "${modifier}+m" = "workspace number 2";
+          "${modifier}+3" = "workspace number 3";
+          "${modifier}+comma" = "workspace number 3";
+          "${modifier}+4" = "workspace number 4";
+          "${modifier}+period" = "workspace number 4";
+          "${modifier}+5" = "workspace number 5";
+          "${modifier}+slash" = "workspace number 5";
+          "${modifier}+6" = "workspace number 6";
+          "${modifier}+7" = "workspace number 7";
+          "${modifier}+8" = "workspace number 8";
+          "${modifier}+9" = "workspace number 9";
+          "${modifier}+0" = "workspace number 10";
+
+          # Move windows
+          "${modifier}+shift+h" = "move left";
+          "${modifier}+shift+l" = "move right";
+          "${modifier}+shift+k" = "move up";
+          "${modifier}+shift+j" = "move down";
+          "${modifier}+shift+1" = "move container to workspace number 1";
+          "${modifier}+shift+n" = "move container to workspace number 1";
+          "${modifier}+shift+2" = "move container to workspace number 2";
+          "${modifier}+shift+m" = "move container to workspace number 2";
+          "${modifier}+shift+3" = "move container to workspace number 3";
+          "${modifier}+shift+comma" = "move container to workspace number 3";
+          "${modifier}+shift+4" = "move container to workspace number 4";
+          "${modifier}+shift+period" = "move container to workspace number 4";
+          "${modifier}+shift+5" = "move container to workspace number 5";
+          "${modifier}+shift+slash" = "move container to workspace number 5";
+          "${modifier}+shift+6" = "move container to workspace number 6";
+          "${modifier}+shift+7" = "move container to workspace number 7";
+          "${modifier}+shift+8" = "move container to workspace number 8";
+          "${modifier}+shift+9" = "move container to workspace number 9";
+          "${modifier}+shift+0" = "move container to workspace number 10";
+
+          # Mouse bindings (Mod + drag)
+          "${modifier}+button1" = "move";
+          "${modifier}+button3" = "resize";
+
+          # Screenshot
+          "Print" = "exec grim -g \"$(slurp)\" - | wl-copy";
+        };
+
+        bars = [ ]; # Use Waybar via Home Manager
+        startup = [
+          {
+            command = "exec sh -c 'sleep 0.01; swaymsg workspace number 7 ; sleep 0.01; swaymsg workspace number 1'";
+          }
+          { command = "pgrep waybar >/dev/null || waybar"; }
+        ];
+      }
+      cfg.extraOptions
+    ];
+  };
+}

common/desktop_environment/sway/home_manager/swaylock.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  programs.swaylock = {
+    enable = true;
+    settings = {
+      color = "#000000";
+      indicator-caps-lock = true;
+      indicator-idle-visible = true;
+      indicator-radius = 100;
+      indicator-thickness = 10;
+      font = "JetBrainsMono Nerd Font Regular";
+      font-size = 20;
+    };
+  };
+}

common/desktop_environment/sway/home_manager/swaync.nix

@@ -0,0 +1,112 @@
+{ lib, osConfig, ... }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+    "swaync"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.swaync = {
+      enable = true;
+      settings = {
+        ignore = [ "com.spotify.Client" ];
+        positionX = "right";
+        positionY = "top";
+        layer = "overlay";
+        control-center-layer = "top";
+        layer-shell = true;
+        cssPriority = "application";
+        control-center-margin-top = 0;
+        control-center-margin-bottom = 0;
+        control-center-margin-right = 0;
+        control-center-margin-left = 0;
+        notification-2fa-action = true;
+        notification-inline-replies = false;
+        notification-icon-size = 64;
+        notification-body-image-height = 100;
+        notification-body-image-width = 200;
+        timeout = 10;
+        timeout-low = 5;
+        timeout-critical = 0;
+        control-center-width = 500;
+        control-center-height = 600;
+        notification-window-width = 500;
+        keyboard-shortcuts = true;
+        image-visibility = "when-available";
+        transition-time = 200;
+        hide-on-clear = false;
+        hide-on-action = true;
+        script-fail-notify = true;
+        widgets = [
+          "inhibitors"
+          "title"
+          "dnd"
+          "volume"
+          "backlight"
+          "mpris"
+          "buttons-grid#quick"
+          "notifications"
+        ];
+        widget-config = {
+          inhibitors = {
+            text = "Inhibitors";
+            button-text = "Clear All";
+            clear-all-button = true;
+          };
+          title = {
+            text = "Notifications";
+            clear-all-button = true;
+            button-text = "Clear All";
+          };
+          dnd.text = "Do Not Disturb";
+          mpris = {
+            image-size = 96;
+            image-radius = 12;
+          };
+          volume = {
+            label = "󰕾";
+            show-per-app = true;
+          };
+          backlight = {
+            label = "󰃟";
+            device = "intel_backlight";
+          };
+          # "buttons-grid#quick" = {
+          #   columns = 4;
+          #   icon-size = 20;
+          #   actions = [
+          #     { label = "󰐥"; tooltip = "Shutdown"; command = "confirm-action 'systemctl poweroff' 'Shutdown?'"; }
+          #     { label = "󰜉"; tooltip = "Reboot"; command = "confirm-action 'systemctl reboot' 'Reboot?'"; }
+          #     { label = "󰍃"; tooltip = "Logout"; command = "confirm-action 'swaymsg exit' 'Logout?'"; }
+          #   ];
+          # };
+        };
+      };
+      style = ''
+        .control-center { background: #1a1b26; border: 2px solid #7dcae4; border-radius: 12px; }
+        .control-center-list { background: transparent; }
+        .control-center .notification-row:focus, .control-center .notification-row:hover { opacity: 1; background: #24283b; }
+        .notification { border-radius: 8px; margin: 6px 12px; box-shadow: 0 0 0 1px rgba(125,196,228,.3), 0 1px 3px 1px rgba(0,0,0,.7), 0 2px 6px 2px rgba(0,0,0,.3); padding: 0; }
+        .widget-title { margin: 8px; font-size: 1.5rem; color: #c0caf5; }
+        .widget-dnd { margin: 8px; font-size: 1.1rem; color: #c0caf5; }
+        .widget-dnd > switch { font-size: initial; border-radius: 8px; background: #414868; border: 1px solid #7dcae4; }
+        .widget-dnd > switch:checked { background: #7dcae4; }
+        .widget-mpris { color: #c0caf5; background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; }
+        .widget-mpris-player { padding: 8px; margin: 8px; }
+        .widget-mpris-title { font-weight: bold; font-size: 1.25rem; }
+        .widget-mpris-subtitle { font-size: 1.1rem; color: #9ece6a; }
+        .widget-volume, .widget-backlight, .widget-menubar { background: #24283b; padding: 8px; margin: 8px; border-radius: 8px; color: #c0caf5; }
+        .widget-menubar .menu-item button { background: #1f2335; color: #c0caf5; border-radius: 8px; padding: 6px 10px; margin: 4px; border: 1px solid #2e3440; font-family: "JetBrainsMonoNL Nerd Font"; }
+        .widget-menubar .menu-item button:hover { background: #414868; border-color: #7dcae4; }
+        .topbar-buttons button { border: none; background: transparent; color: #c0caf5; font-size: 1.1rem; border-radius: 8px; margin: 0 4px; padding: 8px; }
+        .topbar-buttons button:hover { background: #414868; }
+        .topbar-buttons button:active { background: #7dcae4; color: #1a1b26; }
+      '';
+    };
+  };
+}

common/desktop_environment/sway/home_manager/theme.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  home.pointerCursor = {
+    gtk.enable = true;
+    package = pkgs.bibata-cursors;
+    name = "Bibata-Modern-Classic";
+    size = 16;
+  };
+  gtk = {
+    enable = true;
+    theme = { package = pkgs.flat-remix-gtk; name = "Flat-Remix-GTK-Grey-Darkest"; };
+    iconTheme = { package = pkgs.adwaita-icon-theme; name = "Adwaita"; };
+    font = { name = "Sans"; size = 11; };
+  };
+}

common/desktop_environment/sway/home_manager/waybar.nix

@@ -0,0 +1,260 @@
+{ lib, osConfig, ... }:
+let
+  ccfg = import ../../../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "desktopEnvironment"
+    "sway"
+    "waybar"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path osConfig;
+in
+{
+  config = lib.mkIf cfg.enable {
+
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          position = "top";
+          height = 28;
+          spacing = 6;
+          margin-top = 0;
+          margin-bottom = 0;
+          margin-left = 10;
+          margin-right = 10;
+
+          modules-left = [
+            "sway/workspaces"
+          ];
+          modules-center = [
+            "clock"
+            "temperature"
+            "cpu"
+            "memory"
+            "disk"
+          ];
+          modules-right = [
+            "battery"
+            "battery#bat2"
+            "pulseaudio"
+            "network"
+            "bluetooth"
+            "power-profiles-daemon"
+            "backlight"
+            "custom/notifications"
+            "sway/language"
+            "tray"
+            "custom/power"
+          ];
+
+          # LEFT
+          "sway/workspaces" = {
+            format = "{icon}";
+            format-icons = {
+              "1" = "一";
+              "2" = "二";
+              "3" = "三";
+              "4" = "四";
+              "5" = "五";
+              "6" = "六";
+              "7" = "七";
+              "8" = "八";
+              "9" = "九";
+              "10" = "十";
+              "11" = "十一";
+              "12" = "十二";
+              "13" = "十三";
+              "14" = "十四";
+              "15" = "十五";
+              "16" = "十六";
+              "17" = "十七";
+              "18" = "十八";
+              "19" = "十九";
+              "20" = "二十";
+            };
+            disable-scroll = false;
+          };
+
+          # CENTER
+          clock = {
+            format = "{:%b %d, %H:%M}";
+            tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
+          };
+
+          temperature = {
+            thermal-zone = 2;
+            hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input";
+            critical-threshold = 80;
+            format-critical = "󰔏 {temperatureC}°C";
+            format = "󰔏 {temperatureC}°C";
+          };
+
+          cpu = {
+            format = "󰻠 {usage}%";
+            tooltip = true;
+            on-click = "btop";
+          };
+
+          memory = {
+            format = "󰍛 {}%";
+            on-click = "btop";
+          };
+
+          disk = {
+            interval = 30;
+            format = "󰋊 {percentage_used}%";
+            path = "/";
+            on-click = "btop";
+          };
+
+          # RIGHT
+          "battery" = {
+            "states" = {
+              # "good"= 95;
+              "warning" = 30;
+              "critical" = 15;
+            };
+            "format" = "{capacity}% {icon}";
+            "format-full" = "{capacity}% {icon}";
+            "format-charging" = "{capacity}% ";
+            "format-plugged" = "{capacity}% ";
+            "format-alt" = "{time} {icon}";
+            # "format-good"= ""; // An empty format will hide the module
+            # "format-full"= "";
+            "format-icons" = [
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+          };
+          "battery#bat2" = {
+            "bat" = "BAT2";
+          };
+
+          pulseaudio = {
+            format = "{icon} {volume}%";
+            format-bluetooth = "󰂰 {volume}%";
+            format-bluetooth-muted = "󰂲 ";
+            format-muted = "󰖁 ";
+            format-source = "󰍬 {volume}%";
+            format-source-muted = "󰍭 ";
+            format-icons = {
+              headphone = "󰋋";
+              hands-free = "󰂑";
+              headset = "󰂑";
+              phone = "󰏲";
+              portable = "󰦧";
+              car = "󰄋";
+              default = [
+                "󰕿"
+                "󰖀"
+                "󰕾"
+              ];
+            };
+            scroll-step = 5;
+            on-click = "pavucontrol";
+            on-click-right = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+          };
+
+          network = {
+            format-wifi = "󰤨 {essid} ({signalStrength}%)";
+            format-ethernet = "󰈀 {ipaddr}/{cidr}";
+            tooltip-format = "{ifname} via {gwaddr} ";
+            format-linked = "󰈀 {ifname} (No IP)";
+            format-disconnected = "󰖪 Disconnected";
+            # on-click = "wofi-wifi-menu";
+            # on-click-right = "nmcli radio wifi toggle";
+          };
+
+          bluetooth = {
+            format = "󰂯 {status}";
+            format-connected = "󰂱 {device_alias}";
+            format-connected-battery = "󰂱 {device_alias} {device_battery_percentage}%";
+            tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
+            tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
+            tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
+            tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
+            # on-click = "wofi-bluetooth-menu";
+            # on-click-right = "bluetoothctl power toggle";
+          };
+
+          "power-profiles-daemon" = {
+            format = "{icon}";
+            "tooltip-format" = "Power profile: {profile}\nDriver: {driver}";
+            tooltip = true;
+            "format-icons" = {
+              default = "";
+              performance = "";
+              balanced = "";
+              "power-saver" = "";
+            };
+          };
+
+          backlight = {
+            format = "{percent}% {icon}";
+            "format-icons" = [
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+          };
+
+          "custom/notifications" = {
+            format = "{icon} {}";
+            format-icons = {
+              notification = "";
+              none = "";
+              dnd-notification = "󰂛";
+              dnd-none = "󰂛";
+              inhibited-notification = "";
+              inhibited-none = "";
+              dnd-inhibited-notification = "󰂛";
+              dnd-inhibited-none = "󰂛";
+            };
+            return-type = "json";
+            exec-if = "which swaync-client";
+            exec = "swaync-client -swb";
+            on-click = "swaync-client -t -sw";
+            on-click-right = "swaync-client -d -sw";
+            escape = true;
+            tooltip = false;
+          };
+
+          "sway/language" = {
+            format = "{}";
+          };
+
+          "tray" = {
+            "spacing" = 10;
+          };
+
+          "custom/power" = {
+            format = "⏻ ";
+            tooltip = false;
+            menu = "on-click";
+            "menu-file" = ./waybar/power_menu.xml;
+            "menu-actions" = {
+              shutdown = "shutdown 0";
+              reboot = "reboot";
+              logout = "loginctl terminate-session $(loginctl list-sessions | grep seat0 | awk '{print $1}')";
+            };
+          };
+
+        };
+      };
+
+      style = builtins.readFile ./waybar/waybar.css;
+    };
+  };
+}

common/desktop_environment/sway/home_manager/waybar/power_menu.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkMenu" id="menu">
+    <child>
+      <object class="GtkMenuItem" id="logout">
+        <property name="label">Logout</property>
+      </object>
+    </child>
+    <child>
+      <object class="GtkSeparatorMenuItem" id="delimiter1" />
+    </child>
+    <child>
+      <object class="GtkMenuItem" id="reboot">
+        <property name="label">Reboot</property>
+      </object>
+    </child>
+    <child>
+      <object class="GtkSeparatorMenuItem" id="delimiter2" />
+    </child>
+    <child>
+      <object class="GtkMenuItem" id="shutdown">
+        <property name="label">Shutdown</property>
+      </object>
+    </child>
+  </object>
+</interface>

common/desktop_environment/sway/home_manager/waybar/waybar.css

@@ -0,0 +1,101 @@
+* {
+  /* `otf-font-awesome` is required to be installed for icons */
+  font-family: "JetBrainsMonoNL Nerd Font", FontAwesome, Roboto, Helvetica, Arial, sans-serif;
+  font-size: 14px;
+  border: none;
+  border-radius: 0;
+  min-height: 0;
+  color: #f1f1f1;
+}
+
+window#waybar {
+  background: transparent;
+}
+
+#workspaces button.focused {
+  background-color: rgba(220, 220, 220, 0.2);
+}
+
+#workspaces button.urgent {
+  background-color: rgba(214, 82, 82, 0.3);
+}
+
+button,
+#clock,
+#battery,
+#cpu,
+#memory,
+#disk,
+#temperature,
+#backlight,
+#network,
+#pulseaudio,
+#wireplumber,
+#custom-media,
+#custom-notifications,
+#custom-power,
+#tray,
+#mode,
+#idle_inhibitor,
+#scratchpad,
+#power-profiles-daemon,
+#bluetooth,
+#language,
+#mpd {
+  padding: 0 5px;
+  color: #f1f1f1;
+  background-color: rgba(220, 220, 220, 0.1);
+  border-radius: 6px;
+}
+
+
+button:hover,
+#clock:hover,
+#battery:hover,
+#cpu:hover,
+#memory:hover,
+#disk:hover,
+#temperature:hover,
+#backlight:hover,
+#network:hover,
+#pulseaudio:hover,
+#wireplumber:hover,
+#custom-media:hover,
+#custom-notifications:hover,
+#tray:hover,
+#mode:hover,
+#idle_inhibitor:hover,
+#scratchpad:hover,
+#power-profiles-daemon:hover,
+#bluetooth:hover,
+#language:hover,
+#mpd:hover {
+  color: #f1f1f1;
+  background-color: rgba(220, 220, 220, 0.2);
+  border-radius: 6px;
+}
+
+#power-profiles-daemon {
+  padding-right: 15px;
+}
+
+#power-profiles-daemon.performance {
+  color: #fff7d6;
+}
+
+#power-profiles-daemon.balanced {
+  color: #d6efff;
+}
+
+#power-profiles-daemon.power-saver {
+  color:#dcffd6;
+}
+
+#tray>.passive {
+  -gtk-icon-effect: dim;
+}
+
+#tray>.needs-attention {
+  -gtk-icon-effect: highlight;
+  background-color: #eb4d4b;
+}

common/desktop_environment/sway/home_manager/wofi.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  programs.wofi = {
+    enable = true;
+    settings = {
+      width = 500;
+      height = 600;
+      location = "bottom";
+      show = "drun";
+      prompt = "...";
+      filter_rate = 100;
+      allow_markup = true;
+      no_actions = true;
+      halign = "fill";
+      orientation = "vertical";
+      content_halign = "fill";
+      insensitive = true;
+      allow_images = true;
+      image_size = 40;
+      gtk_dark = true;
+    };
+  };
+}

common/flake.lock

@@ -0,0 +1,255 @@
+{
+  "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1741481578,
+        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1758313341,
+        "narHash": "sha256-SsI6INUzWwPcRKRaxvi50RttnD9rcC4EjV+67TOEfrQ=",
+        "owner": "rycee",
+        "repo": "home-manager",
+        "rev": "6f656618ebc71ca82d93d306a8aecb2c5f6f2ab2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rycee",
+        "ref": "release-25.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1753345091,
+        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1741379970,
+        "narHash": "sha256-Wh7esNh7G24qYleLvgOSY/7HlDUzWaL/n4qzlBePpiw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "36fd87baa9083f34f7f5027900b62ee6d09b1f2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "ragenix": {
+      "inputs": {
+        "agenix": "agenix",
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1744897914,
+        "narHash": "sha256-GIVU92o2TZBnKQXTb76zpQbWR4zjU2rFqWKNIIpXnqA=",
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "rev": "40f2e17ecaeab4d78ec323e96a04548c0aaa5223",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yaxitech",
+        "repo": "ragenix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "ragenix": "ragenix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741400194,
+        "narHash": "sha256-tEpgT+q5KlGjHSm8MnINgTPErEl8YDzX3Eps8PVc09g=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "16b6045a232fea0e9e4c69e55a6e269607dd8e3f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

common/flake.nix

@@ -0,0 +1,89 @@
+{
+  inputs = {
+    # NOTE if you add/change any inputs here also add them in the TOP level repo's flake.nix
+    home-manager.url = "github:rycee/home-manager/release-25.05";
+    ragenix.url = "github:yaxitech/ragenix";
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
+
+    # disabled for now
+    # hyprland.url = "github:hyprwm/Hyprland";
+  };
+
+  outputs =
+    {
+      home-manager,
+      ragenix,
+      nix-flatpak,
+      # hyprland,
+      ...
+    }:
+    {
+      nixosModules = {
+        default =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            imports = [
+              home-manager.nixosModules.default
+              ragenix.nixosModules.age
+              nix-flatpak.nixosModules.nix-flatpak
+              # hyprland.nixosModules.default
+              ./_home_manager
+              ./options.nix
+              ./general
+              ./boot
+              ./desktop_environment
+              ./users
+              ./programs
+              ./secrets
+            ];
+            config = {
+              nixpkgs.overlays = [
+                # (final: prev: {
+                #   wayland-protocols =
+                #     nixpkgs-unstable.legacyPackages.${prev.stdenv.hostPlatform.system}.wayland-protocols;
+                # })
+              ];
+              _module.args = {
+                inherit ragenix;
+                # inherit hyprland;
+                # hyprlandPkgs = import hyprland.inputs.nixpkgs {
+                #   system = pkgs.stdenv.hostPlatform.system;
+                #   config = config.nixpkgs.config or { };
+                # };
+              };
+            };
+          };
+        containers = {
+          forgejo = import ./_containers/forgejo.nix;
+        };
+      };
+      homeManagerModules = {
+        # hyprland = hyprland.homeManagerModules.default;
+
+        zsh = import ./_home_manager/mods/zsh.nix;
+        tmux = import ./_home_manager/mods/tmux/tmux.nix;
+        atuin = import ./_home_manager/mods/atuin.nix;
+        zoxide = import ./_home_manager/mods/zoxide.nix;
+        starship = import ./_home_manager/mods/starship.nix;
+        direnv = import ./_home_manager/mods/direnv.nix;
+        ssh = import ./_home_manager/mods/ssh.nix;
+        git = import ./_home_manager/mods/git.nix;
+        nix_deprecations = import ./_home_manager/mods/nix_deprecations.nix;
+
+        alacritty = import ./_home_manager/mods/alacritty.nix;
+        foot = import ./_home_manager/mods/foot.nix;
+        kitty = import ./_home_manager/mods/kitty.nix;
+        launcher_rofi = import ./_home_manager/mods/launcher_rofi.nix;
+
+        obs = import ./_home_manager/mods/obs.nix;
+        postgres = import ./_home_manager/mods/postgres.nix;
+        slicer = import ./_home_manager/mods/slicer.nix;
+
+      };
+    };
+}

common/general/default.nix

@@ -0,0 +1,211 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  top_cfg = config.${ccfg.custom_config_key};
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      flakeOptions = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable nix flake options";
+      };
+      unfree = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable unfree packages";
+      };
+      readWindowsDrives = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Read windows drives";
+      };
+      disableRemoteBuildsOnLio = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Disable remote builds on lio";
+      };
+      timezone = lib.mkOption {
+        type = lib.types.str;
+        default = "America/Chicago";
+        description = "Timezone";
+      };
+      defaultLocal = lib.mkOption {
+        type = lib.types.str;
+        default = "en_US.UTF-8";
+        description = "Default locale";
+      };
+      fastShutdown = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Fast shutdown";
+      };
+      enableSleep = lib.mkEnableOption (lib.mdDoc "Enable auto sleeping");
+      hideBootLogs = lib.mkEnableOption (lib.mdDoc "Hide boot logs on startup");
+    };
+  imports = [
+    ./shell/common.nix
+    ./fonts.nix
+    ./tty_caps_esc.nix
+    ./reporting.nix
+  ];
+  config = {
+    # name this computer
+    networking = {
+      hostName = top_cfg.systemName;
+      nftables.enable = true;
+      nftables.flushRuleset = true;
+      firewall.enable = true;
+    };
+
+    # Enable flakes
+    nix.settings.experimental-features = lib.mkIf cfg.flakeOptions [
+      "nix-command"
+      "flakes"
+    ];
+
+    # Allow unfree
+    nixpkgs.config.allowUnfree = cfg.unfree;
+    nixpkgs.config.allowUnfreePredicate = (pkg: cfg.unfree);
+    environment.variables = lib.mkIf cfg.unfree {
+      NIXPKGS_ALLOW_UNFREE = "1";
+    };
+
+    # allow mounting ntfs filesystems
+    boot.supportedFilesystems = lib.mkIf cfg.readWindowsDrives [ "ntfs" ];
+
+    # make shutdown faster for waiting
+    systemd.extraConfig = lib.mkIf cfg.fastShutdown ''
+      DefaultTimeoutStopSec=8s
+    '';
+
+    nix.settings = {
+      max-jobs = "auto";
+      # Fallback quickly if substituters are not available.
+      connect-timeout = 5;
+      download-attempts = 3;
+      download-buffer-size = 524288000; # default is 67108864, this increases to ~500MB
+      # The default at 10 is rarely enough.
+      log-lines = 50;
+      # Avoid disk full issues
+      max-free = (3000 * 1024 * 1024);
+      min-free = (1000 * 1024 * 1024);
+      # Avoid copying unnecessary stuff over SSH
+      builders-use-substitutes = true;
+      auto-optimise-store = true;
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
+      substituters = [
+        "https://cache.nixos.org/"
+        "https://hyprland.cachix.org"
+        "https://cosmic.cachix.org/"
+        "https://nix-community.cachix.org"
+      ];
+      trusted-substituters = config.nix.settings.substituters;
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+        "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+    nix.extraOptions = ''
+      keep-outputs = true
+      keep-derivations = true
+      ${lib.optionalString (
+        # TODO revisit this should it move?
+        config ? age && config.age ? secrets && config.age.secrets ? github_read_token
+      ) "!include ${config.age.secrets.github_read_token.path}"}
+    '';
+
+    # Enable zsh
+    programs.zsh.enable = true;
+    environment.pathsToLink = [ "/share/zsh" ];
+
+    # nix helper
+    programs.nh = {
+      enable = true;
+      # clean.enable = true; # TODO revist does this solve my re-building issues?
+      clean.extraArgs = "--keep 10";
+      # `flake` path is set in users/default.nix for the primary user if set
+    };
+
+    # Remote build off home lio computer
+    programs.ssh.extraConfig = lib.mkIf (!cfg.disableRemoteBuildsOnLio) ''
+      Host lio_
+        PubkeyAcceptedKeyTypes ssh-ed25519
+        ServerAliveInterval 60
+        IPQoS throughput
+        ${lib.optionalString (
+          config ? age && config.age ? secrets && config.age.secrets ? nix2lio
+        ) "IdentityFile ${config.age.secrets.nix2lio.path}"}
+    '';
+    nix = {
+      distributedBuilds = lib.mkIf (!cfg.disableRemoteBuildsOnLio) true;
+      buildMachines = lib.mkIf (!cfg.disableRemoteBuildsOnLio) [
+        {
+          hostName = "lio";
+          system = "x86_64-linux";
+          protocol = "ssh-ng";
+          maxJobs = 32;
+          speedFactor = 2;
+          supportedFeatures = [
+            "nixos-test"
+            "benchmark"
+            "big-parallel"
+            "kvm"
+            "uid-range" # Often helpful
+          ];
+          mandatoryFeatures = [ ];
+        }
+      ];
+    };
+
+    # TODO can I make this Roaming automatically somehow?
+    time.timeZone = cfg.timezone;
+    # Select internationalization properties.
+    i18n.defaultLocale = cfg.defaultLocal;
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = cfg.defaultLocal;
+      LC_IDENTIFICATION = cfg.defaultLocal;
+      LC_MEASUREMENT = cfg.defaultLocal;
+      LC_MONETARY = cfg.defaultLocal;
+      LC_NAME = cfg.defaultLocal;
+      LC_NUMERIC = cfg.defaultLocal;
+      LC_PAPER = cfg.defaultLocal;
+      LC_TELEPHONE = cfg.defaultLocal;
+      LC_TIME = cfg.defaultLocal;
+    };
+
+    # Turn off sleep
+    systemd.sleep.extraConfig = lib.mkIf (!cfg.enableSleep) ''
+      [Sleep]
+      AllowSuspend=no
+      AllowHibernation=no
+      AllowSuspendThenHibernate=no
+      AllowHybridSleep=no
+    '';
+
+    # Hide boot logs
+    boot.initrd.verbose = cfg.hideBootLogs;
+    boot.consoleLogLevel = lib.mkIf cfg.hideBootLogs 3;
+    boot.kernelParams = lib.mkIf cfg.hideBootLogs [
+      "quiet"
+      "loglevel=3"
+      "systemd.show_status=false"
+    ];
+  };
+}

common/general/fonts.nix

@@ -0,0 +1,59 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  hasNewJetbrainsMono =
+    if builtins.hasAttr "nerd-fonts" pkgs then
+      builtins.hasAttr "jetbrains-mono" pkgs."nerd-fonts"
+    else
+      false;
+
+  jetbrainsMonoFont =
+    if hasNewJetbrainsMono then
+      pkgs.nerd-fonts.jetbrains-mono
+    else
+      (pkgs.nerdfonts.override { fonts = [ "JetBrainsMono" ]; });
+
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      jetbrainsMonoFont = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable jetbrains mono font";
+      };
+      japaneseFonts = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable japanese fonts";
+      };
+    };
+
+  config = {
+    fonts.packages =
+      lib.optionals cfg.jetbrainsMonoFont [
+        jetbrainsMonoFont
+      ]
+      ++ lib.optionals cfg.japaneseFonts (
+        with pkgs;
+        [
+          ipafont
+          kochi-substitute
+          noto-fonts-cjk-sans # Or another CJK font
+        ]
+      );
+
+    fonts.fontconfig.enable = true;
+  };
+}

common/general/reporting.nix

@@ -0,0 +1,80 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+    "reporting"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Reporting node info and logs to grafana";
+      lokiUrl = lib.mkOption {
+        type = lib.types.str;
+        default = "http://h001.net.joshuabell.xyz:3100/loki/api/v1/push";
+        description = "URL of the Loki instance to send logs to";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.prometheus.exporters.node = {
+      enable = true;
+      port = 9100;
+    };
+
+    # Create necessary directories with appropriate permissions
+    systemd.tmpfiles.rules = [
+      "d /tmp/positions 1777 - - -" # World-writable directory for positions file
+      "f /tmp/positions.yaml 0666 - - -" # World-writable positions file
+    ];
+    users.groups.systemd-journal.members = [ "promtail" ];
+    services.promtail = {
+      enable = true;
+      extraFlags = [
+        "-config.expand-env=true"
+      ];
+      configuration = {
+        server = {
+          http_listen_port = 9080;
+          grpc_listen_port = 0;
+        };
+        positions = {
+          filename = "/tmp/positions.yaml"; # Changed from /var/lib/promtail/positions.yaml
+        };
+        clients = [
+          {
+            url = cfg.lokiUrl;
+          }
+        ];
+        scrape_configs = [
+          {
+            job_name = "journal";
+            journal = {
+              json = false;
+              max_age = "12h";
+              path = "/var/log/journal";
+              labels = {
+                job = "systemd-journal";
+                host = config.networking.hostName;
+              };
+            };
+            relabel_configs = [
+              {
+                source_labels = [ "__journal__systemd_unit" ];
+                target_label = "unit";
+              }
+            ];
+          }
+        ];
+      };
+    };
+  };
+}

common/general/shell/branch.func.sh

@@ -0,0 +1,213 @@
+branch() {
+  local branch_name=${1:-}
+
+  # helper: set tmux window name. If tmux is in auto mode, always rename.
+  # If tmux is manual but the current window name matches the previous branch,
+  # allow renaming from previous branch name to the new one.
+  _branch__maybe_set_tmux_name() {
+    if ! command -v tmux_window >/dev/null 2>&1; then
+      return 1
+    fi
+    local new_name prev_branch tmux_status tmux_cur
+    new_name=${1:-}
+    prev_branch=${2:-}
+    tmux_status=$(tmux_window status 2>/dev/null || true)
+    if [ "$tmux_status" = "auto" ]; then
+      tmux_window rename "$new_name" 2>/dev/null || true
+      return 0
+    fi
+    # tmux is manual. If the current tmux name matches the previous branch,
+    # we consider it safe to update it to the new branch name.
+    if [ -n "$prev_branch" ]; then
+      tmux_cur=$(tmux_window get 2>/dev/null || true)
+      if [ "$tmux_cur" = "$prev_branch" ]; then
+        tmux_window rename "$new_name" 2>/dev/null || true
+      fi
+    fi
+  }
+
+  # helper: revert tmux to automatic rename only if current tmux name matches previous branch
+  _branch__revert_tmux_auto() {
+    if ! command -v tmux_window >/dev/null 2>&1; then
+      return 1
+    fi
+    local prev_branch=${1:-}
+    if [ -z "$prev_branch" ]; then
+      tmux_window rename 2>/dev/null || true
+      return 0
+    fi
+    local tmux_cur
+    tmux_cur=$(tmux_window get 2>/dev/null || true)
+    if [ "$tmux_cur" = "$prev_branch" ]; then
+      tmux_window rename 2>/dev/null || true
+    fi
+  }
+
+  # Determine repo root early so we can run branches inside it
+  local common_dir
+  if ! common_dir=$(git rev-parse --git-common-dir 2>/dev/null); then
+    echo "Not inside a git repository." >&2
+    return 1
+  fi
+  if [ "${common_dir#/}" = "$common_dir" ]; then
+    common_dir="$(pwd)/$common_dir"
+  fi
+  local repo_dir="${common_dir%%/.git*}"
+  if [ -z "$repo_dir" ]; then
+    echo "Unable to determine repository root." >&2
+    return 1
+  fi
+
+  # If no branch was provided, present an interactive selector combining local and remote branches
+  if [ -z "$branch_name" ]; then
+    if ! command -v fzf >/dev/null 2>&1; then
+      echo "Usage: branch <name>" >&2
+      return 2
+    fi
+
+    local branches_list_raw branches_list selection
+    # Gather local and remote branches with fallbacks to ensure locals appear
+    branches_list_raw=""
+    if declare -f local_branches >/dev/null 2>&1; then
+      branches_list_raw=$(cd "$repo_dir" && local_branches 2>/dev/null || true; cd "$repo_dir" && remote_branches 2>/dev/null || true)
+    fi
+    branches_list=$(printf "%s
+" "$branches_list_raw" | awk '!seen[$0]++')
+    if [ -z "$branches_list" ]; then
+      echo "No branches found." >&2
+      return 1
+    fi
+
+    fzf_out=$(printf "%s\n" "$branches_list" | fzf --height=40% --prompt="Select branch: " --print-query)
+    if [ -z "$fzf_out" ]; then
+      echo "No branch selected." >&2
+      return 1
+    fi
+    branch_query=$(printf "%s\n" "$fzf_out" | sed -n '1p')
+    branch_selection=$(printf "%s\n" "$fzf_out" | sed -n '2p')
+    if [ -n "$branch_selection" ]; then
+      branch_name="$branch_selection"
+    else
+      # user typed something in fzf but didn't select: use that as new branch name
+      branch_name=$(printf "%s" "$branch_query" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+    fi
+  fi
+
+  local repo_base repo_hash default_branch
+  repo_base=$(basename "$repo_dir")
+  repo_hash=$(printf "%s" "$repo_dir" | sha1sum | awk '{print $1}')
+
+  default_branch=$(getdefault)
+
+  # capture current branch name as seen by tmux so we can decide safe renames later
+  local prev_branch
+  prev_branch=$(git -C "$PWD" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
+
+  # Special-case: jump to the main working tree on the default branch
+  if [ "$branch_name" = "default" ] || [ "$branch_name" = "master" ] || [ "$branch_name" = "$default_branch" ]; then
+    if [ "$repo_dir" = "$PWD" ]; then
+      echo "Already in the main working tree on branch '$default_branch'."
+      return 0
+    fi
+    echo "Switching to main working tree on branch '$default_branch'."
+    # capture current branch name as seen by tmux so we only revert if it matches
+    prev_branch=$(git -C "$PWD" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
+    cd "$repo_dir" || return 1
+    _branch__revert_tmux_auto "$prev_branch" || true
+    return 0
+  fi
+
+  # If a worktree for this branch is already registered elsewhere, open a shell there
+  local existing
+  existing=$(git -C "$repo_dir" worktree list --porcelain 2>/dev/null | awk -v b="$branch_name" 'BEGIN{RS="";FS="\n"} $0 ~ "refs/heads/"b{for(i=1;i<=NF;i++) if ($i ~ /^worktree /){ sub(/^worktree /,"",$i); print $i }}')
+  if [ -n "$existing" ]; then
+    echo "Opening existing worktree for branch '$branch_name' at '$existing'."
+    cd "$existing" || return 1
+    _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
+    return 0
+  fi
+
+  # Ensure we have up-to-date remote info
+  git -C "$repo_dir" fetch --all --prune || true
+
+  local wt_root wt_path
+  if [ -z "$xdg" ]; then
+    xdg="${XDG_DATA_HOME:-$HOME/.local/share}"
+  fi
+  wt_root="$xdg/git_worktrees/${repo_base}_${repo_hash}"
+  wt_path="$wt_root/$branch_name"
+
+  # ensure worktree root exists
+  if [ ! -d "$wt_root" ]; then
+    mkdir -p "$wt_root" || { echo "Failed to create worktree root: $wt_root" >&2; return 1; }
+  fi
+
+  # If worktree already exists at our expected path, open a shell there
+  if [ -d "$wt_path" ]; then
+    echo "Opening existing worktree at '$wt_path'."
+    cd "$wt_path" || return 1
+    _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
+    return 0
+  fi
+
+  local branch_exists branch_from local_exists
+  branch_exists=$(git -C "$repo_dir" ls-remote --heads origin "$branch_name" | wc -l)
+  # check if a local branch exists
+  if git -C "$repo_dir" show-ref --verify --quiet "refs/heads/$branch_name"; then
+    local_exists=1
+  else
+    local_exists=0
+  fi
+
+  branch_from="$default_branch"
+  if [ "$branch_exists" -eq 0 ]; then
+    if [ "$local_exists" -eq 1 ]; then
+      branch_from="$branch_name"
+      echo "Branch '$branch_name' exists locally; creating worktree from local branch."
+    else
+      echo "Branch '$branch_name' does not exist on remote; creating from '$branch_from'."
+    fi
+  else
+    branch_from="origin/$branch_name"
+    echo "Branch '$branch_name' exists on remote; creating worktree tracking it."
+  fi
+
+  echo "Creating new worktree for branch '$branch_name' at '$wt_path'."
+
+  # Try to add or update worktree from the resolved ref. Use a fallback path if needed.
+  if [ "$local_exists" -eq 1 ]; then
+      if git -C "$repo_dir" worktree add "$wt_path" "$branch_name" 2>/dev/null; then
+      cd "$wt_path" || return 1
+      _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
+      return 0
+    fi
+
+  else
+    if git -C "$repo_dir" worktree add -b "$branch_name" "$wt_path" "$branch_from" 2>/dev/null; then
+      cd "$wt_path" || return 1
+      _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
+      return 0
+    fi
+  fi
+
+  # Fallback: try to resolve a concrete SHA and create the branch ref locally, then add worktree
+  local start_sha
+  if start_sha=$(git -C "$repo_dir" rev-parse --verify "$branch_from" 2>/dev/null); then
+    if git -C "$repo_dir" branch "$branch_name" "$start_sha" 2>/dev/null; then
+        if git -C "$repo_dir" worktree add "$wt_path" "$branch_name" 2>/dev/null; then
+      cd "$wt_path" || return 1
+      _branch__maybe_set_tmux_name "$branch_name" "$prev_branch" || true
+      return 0
+      else
+        git -C "$repo_dir" branch -D "$branch_name" 2>/dev/null || true
+        rmdir "$wt_path" 2>/dev/null || true
+        echo "Failed to add worktree after creating branch ref." >&2
+        return 1
+      fi
+    fi
+  fi
+
+  echo "Failed to add worktree for branch '$branch_name'." >&2
+  rmdir "$wt_path" 2>/dev/null || true
+  return 1
+}

common/general/shell/branchd.func.sh

@@ -0,0 +1,131 @@
+branchdel() {
+  # branchdel — remove a branch worktree (optional branch arg)
+  local branch_arg
+  branch_arg="$1"
+  local wt_path
+  wt_path=$(pwd)
+  local common_dir repo_dir
+  if ! common_dir=$(git rev-parse --git-common-dir 2>/dev/null); then
+    echo "Not inside a git repository." >&2
+    return 1
+  fi
+  if [ "${common_dir#/}" = "$common_dir" ]; then
+    common_dir="$(pwd)/$common_dir"
+  fi
+  repo_dir="${common_dir%%/.git*}"
+  if [ -z "$repo_dir" ]; then
+    echo "Unable to determine repository root." >&2
+    return 1
+  fi
+
+  # determine current branch in this worktree
+  local current default_branch branch target_wt
+  current=$(git rev-parse --abbrev-ref HEAD 2>/dev/null) || { echo "Not inside a git repository." >&2; return 1; }
+
+  default_branch=$(getdefault)
+
+  # choose branch: provided arg or current
+  if [ -z "$branch_arg" ]; then
+    branch="$current"
+  else
+    branch="$branch_arg"
+  fi
+  # normalize branch name if refs/heads/ was provided
+  branch="${branch#refs/heads/}"
+
+  # don't remove default
+  if [ "$branch" = "$default_branch" ] || [ "$branch" = "default" ]; then
+    echo "Refusing to remove default branch worktree ($default_branch)." >&2
+    return 1
+  fi
+
+  # find the worktree path for the requested branch
+  target_wt=$(git -C "$repo_dir" worktree list --porcelain 2>/dev/null | awk -v b="refs/heads/$branch" '
+    $1=="worktree" { w=$2 }
+    $1=="branch" && $2==b { print w; exit }
+  ')
+
+  # if not found in worktree list, check main worktree branch
+  if [ -z "$target_wt" ]; then
+    local main_branch
+    main_branch=$(git -C "$repo_dir" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
+    if [ "$main_branch" = "$branch" ]; then
+      target_wt="$repo_dir"
+    fi
+  fi
+
+  if [ -z "$target_wt" ]; then
+    echo "No worktree found for branch '$branch'." >&2
+    return 1
+  fi
+
+  if [ "$target_wt" = "$repo_dir" ]; then
+    echo "Branch '$branch' is the main worktree at '$repo_dir'. Will not delete main worktree." >&2
+    return 1
+  fi
+
+  # if we're currently in that branch/worktree, switch to default and cd to repo root first
+  if [ "$current" = "$branch" ]; then
+    echo "Currently on branch '$branch' in '$wt_path'. Switching to default branch '$default_branch' in main worktree..."
+    if declare -f branch >/dev/null 2>&1; then
+      branch default || { echo "Failed to switch to default branch" >&2; return 1; }
+    else
+      git -C "$repo_dir" checkout "$default_branch" || { echo "Failed to checkout default branch" >&2; return 1; }
+    fi
+    cd "$repo_dir" || { echo "Failed to change directory to repo root: $repo_dir" >&2; return 1; }
+  fi
+
+  echo "Removing worktree at: $target_wt"
+  # helper: attempt a guarded, forceful removal of a directory
+  remove_dir_forcefully() {
+    local dir="$1"
+    if [ -z "$dir" ]; then
+      return 1
+    fi
+    # resolve absolute paths
+    local abs_dir abs_repo
+    abs_dir=$(readlink -f -- "$dir" 2>/dev/null) || abs_dir="$dir"
+    abs_repo=$(readlink -f -- "$repo_dir" 2>/dev/null) || abs_repo="$repo_dir"
+
+    # safety checks: do not remove repository root or /
+    if [ "$abs_dir" = "/" ] || [ "$abs_dir" = "$abs_repo" ]; then
+      echo "Refusing to remove unsafe path: $abs_dir" >&2
+      return 1
+    fi
+
+    # try plain rm -rf
+    rm -rf -- "$abs_dir" 2>/dev/null && return 0
+
+    # fix permissions then try again
+    chmod -R u+rwx "$abs_dir" 2>/dev/null || true
+    rm -rf -- "$abs_dir" 2>/dev/null && return 0
+
+    # try removing contents first, then remove directory
+    if find "$abs_dir" -mindepth 1 -exec rm -rf -- {} + 2>/dev/null; then
+      rmdir "$abs_dir" 2>/dev/null || true
+    fi
+
+    # final existence check
+    [ ! -e "$abs_dir" ]
+  }
+
+  # try unregistering the worktree, prefer normal then fallback to --force
+  if git -C "$repo_dir" worktree remove "$target_wt" 2>/dev/null || git -C "$repo_dir" worktree remove --force "$target_wt" 2>/dev/null; then
+    if remove_dir_forcefully "$target_wt"; then
+      echo "Removed worktree: $target_wt"
+    else
+      echo "Worktree removed from git, but failed to fully delete directory: $target_wt" >&2
+      echo "Attempted to force-delete; you may need to remove it manually with sudo." >&2
+    fi
+
+    # delete local branch if it exists
+    if git -C "$repo_dir" show-ref --verify --quiet "refs/heads/$branch"; then
+      git -C "$repo_dir" branch -D "$branch" 2>/dev/null || true
+      echo "Deleted local branch: $branch"
+    fi
+    return 0
+  fi
+
+  echo "Failed to remove worktree: $target_wt" >&2
+  return 1
+}

common/general/shell/common.nix

@@ -0,0 +1,73 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+{
+  config = {
+    environment.systemPackages = with pkgs; [
+      # Basics
+      vim
+      nano
+      wget
+      curl
+      jq
+      fastfetch
+      bat
+      htop
+      unzip
+      git
+      fzf
+      ripgrep
+      lsof
+      killall
+      hdparm
+      speedtest-cli
+      lf
+    ];
+
+    environment.shellAliases = {
+      n = "nvim";
+      nn = "nvim --headless '+SessionDelete' +qa > /dev/null 2>&1 && nvim";
+      bat = "bat --theme Coldark-Dark";
+      cat = "bat --pager=never -p";
+      # TODO this may not be needed now that I am using `nh` clean mode (see /hosts/_common/configuration.nix#programs.nh)
+      nix-boot-clean = "find '/boot/loader/entries' -type f ! -name 'windows.conf' | head -n -4 | xargs -I {} rm {}; nix store gc; nixos-rebuild boot; echo; df";
+      ndr = "nix-direnv-reload";
+
+      # general unix
+      date_compact = "date +'%Y%m%d'";
+      date_short = "date +'%Y-%m-%d'";
+      ls = "ls --color -Gah";
+      ll = "ls --color -Galh";
+      lss = "du --max-depth=0 -h {.,}* 2>/dev/null | sort -hr";
+      psg = "ps aux | head -n 1 && ps aux | grep -v 'grep' | grep";
+      cl = "clear";
+
+      # git
+      status = "git status";
+      diff = "git diff";
+      branches = "git branch -a";
+      gcam = "git commit -a -m";
+      gcm = "git commit -m";
+      stashes = "git stash list";
+      bd = "branch default";
+      li = "link_ignored";
+      bx = "branchdel";
+      b = "branch";
+
+      # ripgrep
+      rg = "rg --no-ignore";
+      rgf = "rg --files --glob '!/nix/store/**' 2>/dev/null | rg";
+    };
+
+    environment.shellInit = lib.concatStringsSep "\n\n" [
+      (builtins.readFile ./common.sh)
+      (builtins.readFile ./tmux_helpers.sh)
+      (builtins.readFile ./branch.func.sh)
+      (builtins.readFile ./branchd.func.sh)
+      (builtins.readFile ./link_ignored.func.sh)
+    ];
+  };
+}

common/general/shell/common.sh

@@ -0,0 +1,220 @@
+# Check if ~/.config/environment exists and source all files within it
+if [ -d "$HOME/.config/environment" ]; then
+  for file in "$HOME/.config/environment/"*; do
+    if [ -r "$file" ]; then
+      if ! . "$file"; then
+        echo "Failed to source $file"
+      fi
+    fi
+  done
+fi
+
+# Basics
+htop_psg () {
+  htop -p $(psg $1 | awk '{r=r s $2;s=","} END{print r}')
+}
+
+htop_pid () {
+  htop -p $(ps -ef | awk -v proc=$1 '$3 == proc { cnt++;if (cnt == 1) { printf "%s",$2 } else { printf ",%s",$2 } }')
+}
+
+psg_kill() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "killing ${pid}"
+      kill -9 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+psg_terminate() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "Terminating ${pid}"
+      kill -15 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+psg_skill() {
+  ps aux | grep -v "grep" | grep "${1}" | awk '{print $2}' | while read -r pid; do
+    if [ -n "${pid}" ]; then
+      echo "Killing ${pid}"
+      sudo kill -9 "${pid}" &> /dev/null
+    fi
+  done
+}
+
+mail_clear() {
+  : > /var/mail/$USER
+}
+
+speedtest_fs () {
+  dir=$(pwd)
+  drive=$(df -h ${dir} | awk 'NR==2 {print $1}')
+  echo Testing read speeds on drive ${drive}
+  sudo hdparm -Tt ${drive}
+  test_file=$(date +%u%m%d)
+  test_file="${dir}/speedtest_fs_${test_file}"
+  echo
+  echo Testing write speeds into test file: ${test_file}
+  dd if=/dev/zero of=${test_file} bs=8k count=10k; rm -f ${test_file}
+}
+
+speedtest_internet () {
+  speedtest-cli
+}
+
+# git
+getdefault () {
+  git remote show origin | grep "HEAD branch" | sed 's/.*: //'
+}
+
+master () {
+  branch $(getdefault)
+  git checkout $(getdefault)
+  pull
+}
+
+mp () {
+  master
+  prunel
+}
+
+pullmaster () {
+  git pull origin $(getdefault)
+}
+
+push () {
+  B=$(git branch | sed -n -e 's/^\* \(.*\)/\1/p')
+  git pull origin $B
+  git push origin $B --no-verify
+}
+
+pull () {
+  git fetch
+  B=$(git branch | sed -n -e 's/^\* \(.*\)/\1/p')
+  git pull origin $B
+}
+
+forcepush () {
+  B=$(git branch | sed -n -e 's/^\* \(.*\)/\1/p')
+  git push origin $B --force
+}
+
+remote_branches () {
+  git for-each-ref --format='%(refname:short)' refs/remotes 2>/dev/null | sed 's#^[^/]*/##' | grep -v '^HEAD$' || true
+}
+
+local_branches () {
+  git for-each-ref --format='%(refname:short)' refs/heads 2>/dev/null || true
+}
+
+prunel () {
+  git fetch
+  git remote prune origin
+
+  for local in $(local_branches); do
+    in=false
+    for remote in $(remote_branches); do
+      if [[ ${local} = ${remote} ]]; then
+        in=true
+      fi
+    done;
+    if [[ $in = 'false' ]]; then
+      git branch -D ${local}
+    else
+      echo 'Skipping branch '${local}
+    fi
+  done;
+}
+
+from_master () {
+  git checkout $(getdefault) $@
+}
+
+stash() {
+  local branch
+  branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  local datetime
+  datetime=$(date +"%Y-%m-%d_%H-%M")
+  local default_label="${datetime}_${branch}"
+  if [ -n "$ZSH_VERSION" ]; then
+    read "label?Stash label [default: $default_label]: "
+  else
+    read -e -p "Stash label [default: $default_label]: " label
+  fi
+  label=${label:-$default_label}
+  git stash push -m "$label"
+}
+
+pop() {
+  local selection
+  selection=$(git stash list | \
+    fzf --prompt="Select stash to pop: " \
+        --preview="git stash show -p \$(echo {} | awk -F: '{print \$1}') | bat --color always --paging=never --style=plain -l diff")
+  [ -z "$selection" ] && echo "No stash selected." && return 1
+  local stash_ref
+  stash_ref=$(echo "$selection" | awk -F: '{print $1}')
+  echo "Popping $stash_ref..."
+  git stash pop "$stash_ref"
+}
+
+delstash() {
+  local selection
+  selection=$(git stash list | \
+    fzf --prompt="Select stash to pop: " \
+        --preview="git stash show -p \$(echo {} | awk -F: '{print \$1}') | bat --color always --paging=never --style=plain -l diff")
+  [ -z "$selection" ] && echo "No stash selected." && return 1
+  local stash_ref
+  stash_ref=$(echo "$selection" | awk -F: '{print $1}')
+  echo "About to delete $stash_ref."
+  git stash drop "$stash_ref"
+}
+
+# nix
+alias nixpkgs=nixpkg
+nixpkg () {
+  if [ $# -eq 0 ]; then
+    echo "Error: No arguments provided. Please specify at least one package."
+    return 1
+  fi
+  cmd="nix shell"
+  for pkg in "$@"; do
+    cmd="$cmd \"nixpkgs#$pkg\""
+  done
+  eval $cmd
+}
+
+# Marks some files as in "git" but they won't actually get pushed up to the git repo
+# Usefull for `gintent .envrc flake.lock flake.nix` to add nix items required by flakes in a git repo that won't want flakes added
+gintent() {
+    for file in "$@"; do
+        if [ -f "$file" ]; then
+            git add --intent-to-add "$file"
+            git update-index --assume-unchanged "$file"
+            echo "Intent added for $file"
+        else
+            echo "File not found: $file"
+        fi
+    done
+}
+alias gintentnix="gintent .envrc flake.lock flake.nix"
+
+gintent_undo() {
+  for file in "$@"; do
+    if [ -f "$file" ]; then
+        git update-index --no-assume-unchanged "$file"
+        echo "Intent removed for $file"
+    else
+        echo "File not found: $file"
+    fi
+  done
+}
+alias gintentnix_undo="gintent_undo .envrc flake.lock flake.nix"
+
+
+# Aider
+aider () {
+  http_proxy="" all_proxy="" https_proxy="" AZURE_API_BASE=http://100.64.0.8 AZURE_API_VERSION=2025-01-01-preview AZURE_API_KEY=1 nix run "nixpkgs#aider-chat-full" -- aider --dark-mode --no-gitignore --no-check-update --no-auto-commits --model azure/gpt-4.1-2025-04-14 $@
+}

common/general/shell/link_ignored.func.sh

@@ -0,0 +1,159 @@
+link_ignored() {
+  local DRY_RUN=0
+  local USE_FZF=1
+  local -a PATTERNS=()
+
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --dry-run) DRY_RUN=1; shift ;;
+      --no-fzf) USE_FZF=0; shift ;;
+      -h|--help) link_ignored_usage; return 0 ;;
+      --) shift; break ;;
+      *) PATTERNS+=("$1"); shift ;;
+    esac
+  done
+
+  link_ignored_usage() {
+    cat <<EOF
+Usage: link_ignored [--dry-run] [--no-fzf] [pattern ...]
+
+Interactively or non-interactively create symlinks in the current worktree
+for files/dirs that exist in the main repository root but are git-ignored /
+untracked.
+EOF
+  }
+
+  # Determine the main repo root using git-common-dir (handles worktrees)
+  local common_dir repo_root
+  if ! common_dir=$(git rev-parse --git-common-dir 2>/dev/null); then
+    echo "Error: not in a git repository." >&2
+    return 2
+  fi
+  if [ "${common_dir#/}" = "$common_dir" ]; then
+    common_dir="$(pwd)/$common_dir"
+  fi
+  repo_root="${common_dir%%/.git*}"
+  if [ -z "$repo_root" ]; then
+    echo "Error: unable to determine repository root." >&2
+    return 2
+  fi
+
+  local -a candidates=()
+  while IFS= read -r -d '' file; do
+    candidates+=("$file")
+  done < <(git -C "$repo_root" ls-files --others --ignored --exclude-standard -z || true)
+
+  if [ ${#candidates[@]} -eq 0 ]; then
+    echo "No untracked/ignored files found in $repo_root"
+    return 0
+  fi
+
+  local -a tops=()
+  for c in "${candidates[@]}"; do
+    c="${c%/}"
+    local top="${c%%/*}"
+    [ -z "$top" ] && continue
+    local found=0
+    for existing in "${tops[@]}"; do
+      [ "$existing" = "$top" ] && found=1 && break
+    done
+    [ "$found" -eq 0 ] && tops+=("$top")
+  done
+
+  if [ ${#tops[@]} -eq 0 ]; then
+    echo "No top-level ignored/untracked entries found in $repo_root"
+    return 0
+  fi
+
+  local -a filtered
+  if [ ${#PATTERNS[@]} -gt 0 ]; then
+    for t in "${tops[@]}"; do
+      for p in "${PATTERNS[@]}"; do
+        if [[ "$t" == *"$p"* ]]; then
+          filtered+=("$t")
+          break
+        fi
+      done
+    done
+  else
+    filtered=("${tops[@]}")
+  fi
+
+  if [ ${#filtered[@]} -eq 0 ]; then
+    echo "No candidates match the provided patterns." >&2
+    return 0
+  fi
+
+  local -a chosen
+  if command -v fzf >/dev/null 2>&1 && [ "$USE_FZF" -eq 1 ]; then
+    local selected
+    selected=$(printf "%s\n" "${filtered[@]}" | fzf --multi --height=40% --border --prompt="Select files to link: " --preview "if [ -f '$repo_root'/{} ]; then bat --color always --paging=never --style=plain '$repo_root'/{}; else ls -la '$repo_root'/{}; fi")
+    if [ -z "$selected" ]; then
+      echo "No files selected." && return 0
+    fi
+    chosen=()
+    while IFS= read -r line; do
+      chosen+=("$line")
+    done <<EOF
+$selected
+EOF
+  else
+    chosen=("${filtered[@]}")
+  fi
+
+  local worktree_root
+  worktree_root=$(pwd)
+
+  echo "Repository root: $repo_root"
+  echo "Worktree root : $worktree_root"
+
+  local -a created=()
+  local -a skipped=()
+  local -a errors=()
+
+  for rel in "${chosen[@]}"; do
+    rel=${rel%%$'\n'}
+    local src="${repo_root}/${rel}"
+    local dst="${worktree_root}/${rel}"
+
+    if [ ! -e "$src" ]; then
+      errors+=("$rel (source missing)")
+      continue
+    fi
+
+    if [ -L "$dst" ]; then
+      echo "Skipping $rel (already symlink)"
+      skipped+=("$rel")
+      continue
+    fi
+    if [ -e "$dst" ]; then
+      echo "Skipping $rel (destination exists)"
+      skipped+=("$rel")
+      continue
+    fi
+
+    mkdir -p "$(dirname "$dst")"
+    if [ "$DRY_RUN" -eq 1 ]; then
+      echo "DRY RUN: ln -s '$src' '$dst'"
+    else
+      if ln -s "$src" "$dst"; then
+        echo "Linked: $rel"
+        created+=("$rel")
+      else
+        echo "Failed to link: $rel" >&2
+        errors+=("$rel (link failed)")
+      fi
+    fi
+  done
+
+  echo
+  echo "Summary:"
+  echo "  Linked: ${#created[@]}"
+  [ ${#created[@]} -gt 0 ] && printf '    %s\n' "${created[@]}"
+  echo "  Skipped: ${#skipped[@]}"
+  [ ${#skipped[@]} -gt 0 ] && printf '    %s\n' "${skipped[@]}"
+  echo "  Errors: ${#errors[@]}"
+  [ ${#errors[@]} -gt 0 ] && printf '    %s\n' "${errors[@]}"
+
+  return 0
+}

common/general/shell/tmux_helpers.sh

@@ -0,0 +1,34 @@
+tmux_window () {
+  cmd=${1:-}
+  case "${cmd}" in
+    rename)
+      if [ -z "${2:-}" ]; then
+        tmux setw automatic-rename
+      else
+        tmux rename-window "$2"
+      fi
+      ;;
+    get)
+      printf '%s' "$(tmux display-message -p '#W')"
+      ;;
+    status)
+      out="$(tmux show-window-options automatic-rename 2>/dev/null || true)"
+      if printf '%s' "$out" | grep -q 'automatic-rename on'; then
+        printf 'auto'
+      elif printf '%s' "$out" | grep -q 'automatic-rename off'; then
+        printf 'manual'
+      else
+        # If tmux returns nothing (option not set), default to auto
+        if [ -z "$out" ]; then
+          printf 'auto'
+        else
+          return 1
+        fi
+      fi
+      ;;
+    *)
+      printf 'Usage: tmux_window {rename [NAME]|get|status}\n' >&2
+      return 2
+      ;;
+  esac
+}

common/general/tty_caps_esc.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "general"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      ttyCapsEscape = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable caps for escape key";
+      };
+    };
+  config = lib.mkIf cfg.ttyCapsEscape {
+    services.xserver.xkb.options = "caps:escape";
+    console = {
+      earlySetup = true;
+      packages = with pkgs; [ terminus_font ];
+      useXkbConfig = true; # use xkb.options in tty. (caps -> escape)
+    };
+  };
+}

common/options.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ./config.nix;
+  cfg_path = "${ccfg.custom_config_key}";
+  cfg = config.${cfg_path};
+in
+{
+  options.${cfg_path} = {
+    systemName = lib.mkOption {
+      type = lib.types.str;
+      description = "The name of the system.";
+    };
+  };
+}

common/programs/default.nix

@@ -0,0 +1,43 @@
+{ config, lib, ... }:
+let
+  ccfg = import ../config.nix;
+  cfg = config.${ccfg.custom_config_key}.programs;
+in
+{
+  imports = [
+    ./qFlipper.nix
+    ./rustDev.nix
+    ./uhkAgent.nix
+    ./tailnet.nix
+    ./ssh.nix
+    ./docker.nix
+    ./podman.nix
+    ./incus.nix
+    ./flatpaks.nix
+    ./virt-manager.nix
+  ];
+  config = {
+    assertions = [
+      (
+        let
+          enabledVirtualizers = lib.filter (x: x.enabled) [
+            {
+              name = "docker";
+              enabled = cfg.docker.enable;
+            }
+            {
+              name = "podman";
+              enabled = cfg.podman.enable;
+            }
+          ];
+        in
+        {
+          assertion = lib.length enabledVirtualizers <= 1;
+          message =
+            "Only one virtualizer can be enabled at a time. Enabled: "
+            + lib.concatStringsSep ", " (map (x: x.name) enabledVirtualizers);
+        }
+      )
+    ];
+  };
+}

common/programs/docker.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "docker"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "docker";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker = {
+      enable = true;
+      autoPrune.enable = true;
+    };
+    # TODO add admins?
+    users.extraGroups.docker.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+    environment.shellAliases = {
+      dockerv = "docker volume";
+      dockeri = "docker image";
+      dockerc = "docker container";
+    };
+  };
+}

common/programs/flatpaks.nix

@@ -0,0 +1,66 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "flatpaks"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "flatpaks";
+      packages = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "List of Flatpak package names to install.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.flatpak = {
+      enable = true;
+      packages = cfg.packages;
+      overrides = {
+        global = {
+          Context.sockets = [
+            "wayland"
+            "x11"
+          ];
+          Context.devices = [ "dri" ]; # allow GPU access if desired
+          Environment = {
+            XCURSOR_PATH = "/run/host/user-share/icons:/run/host/share/icons";
+            GTK_THEME = "Adwaita:dark";
+            # Force wayland as much as possible.
+            ELECTRON_OZONE_PLATFORM_HINT = "auto"; # or 'auto'
+            GTK_USE_PORTAL = "1";
+            OZONE_PLATFORM = "wayland";
+            QT_QPA_PLATFORM = "xcb";    # force XCB for Flatpaks (XWayland)
+          };
+        };
+        "org.signal.Signal" = {
+          Environment = {
+            SIGNAL_PASSWORD_STORE = "gnome-libsecret";
+          };
+          Context = {
+            sockets = [
+              "xfg-settings"
+            ];
+          };
+        };
+        "com.google.Chrome" = {
+          Environment = {
+            CHROME_EXTRA_ARGS = "--enable-features=WaylandWindowDecorations --ozone-platform-hint=auto";
+          };
+        };
+      };
+    };
+  };
+}

common/programs/incus.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "incus"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "incus";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.incus = {
+      enable = true;
+      agent.enable = true;
+      ui.enable = true;
+    };
+
+    users.extraGroups.incus_admin.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+    users.extraGroups.incus.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+  };
+}

common/programs/podman.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "podman"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "podman";
+    };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.podman = {
+      enable = true;
+      dockerSocket.enable = true;
+      autoPrune.enable = true;
+    };
+    # TODO add admins?
+    users.extraGroups.podman.members = lib.mkIf (users_cfg.primary != null) [ users_cfg.primary ];
+  };
+}

common/programs/qFlipper.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "qFlipper"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "qFlipper";
+    };
+
+  config = lib.mkIf cfg.enable {
+    hardware.flipperzero.enable = true;
+    environment.systemPackages = with pkgs; [ qFlipper ];
+    services.udev.extraRules = ''
+      #Flipper Zero serial port
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="5740", ATTRS{manufacturer}=="Flipper Devices Inc.", GROUP="users", TAG+="uaccess"
+      #Flipper Zero DFU
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", ATTRS{manufacturer}=="STMicroelectronics", GROUP="users", TAG+="uaccess"
+    '';
+  };
+}

common/programs/rustDev.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "rustDev"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "rust development tools";
+      repl = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable the evcxr repl for `rust` command.";
+      };
+      # TODO?
+      # channel = lib.mkOption {
+      #   type = lib.types.str;
+      #   default = "stable";
+      #   description = "The Rust release channel to use (e.g., stable, beta, nightly).";
+      # };
+      # version = lib.mkOption {
+      #   type = lib.types.str;
+      #   default = "latest";
+      #   description = "The specific version of Rust to use. Use 'latest' for the latest stable release.";
+      # };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages =
+      with pkgs;
+      [
+        rustup
+        gcc
+      ]
+      ++ (if cfg.repl then [ pkgs.evcxr ] else [ ]);
+
+    environment.shellAliases = lib.mkIf cfg.repl {
+      rust = "evcxr";
+    };
+  };
+
+}

common/programs/ssh.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "ssh"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "ssh";
+      sshPortOpen = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Open the ssh port.";
+      };
+      fail2Ban = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable fail2ban.";
+      };
+      allowPasswordLogin = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Allow root password login.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      openssh
+      autossh
+    ];
+
+    # Use fail2ban
+    services.fail2ban = lib.mkIf cfg.fail2Ban {
+      enable = true;
+      # Ignore my tailnet
+      ignoreIP = [
+        "100.64.0.0/10"
+      ];
+    };
+
+    # Open ports in the firewall if enabled.
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.sshPortOpen [
+      22 # sshd
+    ];
+
+    # Enable the OpenSSH daemon.
+    services.openssh = {
+      enable = true;
+      settings = {
+        LogLevel = "VERBOSE";
+        PermitRootLogin = "yes";
+        PasswordAuthentication = cfg.allowPasswordLogin;
+      };
+    };
+
+    # Ensure SSH key pair generation for non-root users
+    systemd.services = lib.mapAttrs' (name: _: {
+      name = "generate_ssh_key_${name}";
+      value = {
+        description = "Generate SSH key pair for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = name;
+          Type = "oneshot";
+        };
+        script = ''
+          #!/run/current-system/sw/bin/bash
+          if [ ! -f /home/${name}/.ssh/id_ed25519 ]; then
+            if [ -v DRY_RUN ]; then
+              echo "DRY_RUN is set. Would generate SSH key for ${name}.";
+            else
+              echo "Generating SSH key for ${name}.";
+              mkdir -p /home/${name}/.ssh;
+              chmod 700 /home/${name}/.ssh;
+              /run/current-system/sw/bin/ssh-keygen -t ed25519 -f /home/${name}/.ssh/id_ed25519 -N "";
+            fi
+          else
+            echo "SSH key already exists for ${name}.";
+          fi
+        '';
+      };
+    }) users_cfg.users;
+  };
+}

common/programs/tailnet.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "tailnet"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "enable tailnet";
+      useHeadscale = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to use headscale login server.";
+      };
+      enableExitNode = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable exit node.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ tailscale ];
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = if cfg.enableExitNode then "both" else "client";
+      authKeyFile = lib.mkIf (
+        config ? age && config.age ? secrets && config.age.secrets ? headscale_auth
+      ) config.age.secrets.headscale_auth.path;
+      extraUpFlags =
+        (lib.optionals cfg.useHeadscale [
+          "--login-server=https://headscale.joshuabell.xyz"
+        ])
+        ++ (lib.optionals cfg.enableExitNode [ "--advertise-exit-node" ]);
+
+    };
+    networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    networking.firewall.checkReversePath = "loose";
+  };
+
+}

common/programs/uhkAgent.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "uhkAgent"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "uhk agent (ultimate hacking keyboard)";
+    };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      uhk-agent
+      uhk-udev-rules
+    ];
+    services.udev.packages = [ pkgs.uhk-udev-rules ];
+  };
+
+}

common/programs/virt-manager.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "programs"
+    "virt-manager"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "Enable virt manager/quemu";
+      users = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = builtins.attrNames users_cfg;
+        description = "Users to configure for virt-manager.";
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.qemuGuest.enable = true;
+    services.spice-vdagentd.enable = true;
+    programs.virt-manager = {
+      enable = true;
+    };
+
+    virtualisation = {
+      libvirtd.enable = true;
+      spiceUSBRedirection.enable = true;
+    };
+
+    users.groups.libvirtd.members = cfg.users;
+  };
+}

common/secrets/default.nix

@@ -0,0 +1,77 @@
+{
+  config,
+  ragenix,
+  lib,
+  pkgs,
+  ...
+}@args:
+
+let
+  ccfg = import ../config.nix;
+  cfg_path = [
+    ccfg.custom_config_key
+    "secrets"
+  ];
+  cfg = lib.attrsets.getAttrFromPath cfg_path config;
+  users_cfg = config.${ccfg.custom_config_key}.users;
+
+  secretsRaw = import ./secrets/secrets.nix;
+  systemName = lib.attrsets.getAttrFromPath [
+    ccfg.custom_config_key
+    "systemName"
+  ] config;
+  authorityMarker = "authority";
+
+  # Key matches this host if its trailing comment contains "@<host>"
+  matchesThisSystem = key: lib.strings.hasInfix "@${systemName}" key;
+  # Key is the authority key if its comment contains the marker string
+  matchesAuthority = key: lib.strings.hasInfix authorityMarker key;
+
+  keepSecret =
+    attrs:
+    let
+      keys = attrs.publicKeys or [ ];
+    in
+    lib.any (k: matchesThisSystem k) keys;
+
+  # Any secrets that should be world-readable even after auto-import
+  worldReadable = [
+    "zitadel_master_key"
+    "openwebui_env"
+    "vaultwarden_env"
+  ];
+
+  # Keep only secrets intended for this host (or that include the authority key)
+  filteredSecrets = lib.attrsets.filterAttrs (_name: attrs: keepSecret attrs) secretsRaw;
+in
+{
+  options =
+    { }
+    // lib.attrsets.setAttrByPath cfg_path {
+      enable = lib.mkEnableOption "secrets";
+    };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      ragenix.packages.${pkgs.system}.default
+      pkgs.rage
+    ];
+
+    age = {
+      secrets = lib.attrsets.mapAttrs' (
+        name: _attrs:
+        let
+          base = lib.removeSuffix ".age" name;
+        in
+        lib.nameValuePair base (
+          {
+            file = ./. + "/secrets/${name}";
+            owner = users_cfg.primary;
+          }
+          // lib.optionalAttrs (lib.elem base worldReadable) {
+            mode = "444";
+          }
+        )
+      ) filteredSecrets;
+    };
+  };
+}

common/secrets/secrets/github_read_token.age

@@ -0,0 +1,42 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBJRmpU
+K2tCT1RTNzBhQlNzSHlIZDB4UFNCRDhiY1puVHQxN0QzSDNIbWhFCkdPVTFLYUcv
+MW1FMnUyVG9xVE5KaVJQWlhFYmtaeGl2RGYyWWhtbEtTTFEKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDBNalFocUZXRkZxMU10L1pWN1I5eUlGWXlrMVNLazR5RExycnZJ
+K3BsaDQKVlZCUjRNL1hvMXFjRkd1VGVZNUp3ZnZBdW1qMEFpY3ZhYWFacmlZZEFa
+SQotPiBzc2gtZWQyNTUxOSBTcENqQlEgSWRpT3BZZ0pHOWZjWkszZVg3OEZaZld5
+d2hOdXpYZ2tXVThMb0FTK2ZEQQpKY2xXT1dDeEp1LzlDcnoreVNvSHdCL2dDVFVs
+bUUwQlU4Y3pXV0F1S3RNCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBrMFJOd0xrcGp4
+TkpxTW1DZWUxc1BQVTc3S05scHEzQ2hVT1I3bWhQVnlZCkVZQ0dZMm82VG81Yzda
+MUpmWjZRUUx3NVBwVTlUZmtaS2JJem5ETkR6eVUKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGhoSVhmVVNlc0toR1pBemk5WGp4R0NYdFF0dWFjVlpVcWRQT0hIUlNhazAK
+czdFNlIydWFYSnBuTXNBQXE3eTZtUTBpUUJrdFFZMUZldFh4TXpVWEswSQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgYXp5MElHS04vVlV2b1RoU3RRUTRCeFlHWjRLajFt
+L01Pdi83YnRjNndWTQpFVDk2djEyVFVaUHQyTGliZDRFM0Y0Vi96STFJR0Nqa1hn
+a2VYVFhzelNnCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBET2dPUk5rYm9wVHczaE0w
+L2hpa0F3emZqNDBxR2c1OUVVNnBNeVc1SzBRCmhIWmFKTnl2TFFBRUpyejhEMFBj
+cVR6RkZHS3lpZzd6MzgrQml5QXpWdjAKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIFVk
+cE1YSS9rdzBsTk0xNGtlRjJSV2llNVhYOUsvdVVFam1wUU82czNTUlkKQTdLcFdk
+akErdWRrUXZET1hjL2J4UFJzdkNFVTlEUWJFWTFaczQ1VmxDNAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgQVNMandOOVFiN2xuQTd2MC9UUmt2MVg2YUlzcHBHaEJBWG1E
+Y0srMU9UYwpGQnh6L09qY2JvL0tqcGNnWldkWUVzRHk1QVJvN1N0YlRVNCtlMlV6
+MUNVCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBJR0RzZWpCNHNHcXBhQVErVUwxcG9t
+K0M5RSt0M2R6SFpwYzB5MXZFQVM4Cll2NmJrQkMwNkFGbWM2bHJ2THhNbG9XS0dk
+cmEzWUFCdXBLS1dyNWh0aU0KLT4gc3NoLWVkMjU1MTkgWmUxTXdRIElaN2h2aHRO
+bDRtNUlrMlNmOWVSYlpvR2VVeWRxL25vMnFjVUVmc215ejAKVlBmcTFtN3BUZXJx
+eUg0eXY2S3V0ZklGNzFnK09yRUJacnZYUllkUzF0bwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgU1J3VG1lVDlCNmNVZ2hZbXI4ZDhZdE9jYnNkNHpQclpqQmdGcFhuYTBI
+RQpkMnhjZlYrWjBPZVk0UGt5UEZmQzZoOUxSVG8zMVl6MlZCT1JneWJuWVdnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSA5RldGVWx4aU9ZVUNQdlJTRUVqbS9CajlnTEdR
+NFlCZnEwSy9rRGNIM1RRCkxKN2FUQTBVbVA5SnVZSDlGcXFKL0M1NGhONFhLamF3
+Z0VNZ1VSSEFKSlkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIElkSFNJWnZ3WFA3V1J0
+aFNqN0RTQUEvNkRkeHI5QkR3K0RuQ2NnZTFQU1UKb0dKd3gyYWdPd0NyUEZDWUhB
+eUdaZzIzWEtkNGdUZzZScWpOUzN6K2dCTQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+eGNINUY0UElXbUQvUklPY2c1S1A4OXh0UWRsTjFGUTg3dW9BM0dyTVgwNApyN3pV
+eHhUSnAxZ1ZpdmUva0lScWJxNGFWZDRMdm8zd09kay9ORXdOVkljCi0+IDMtZ3Jl
+YXNlCldFN1JnNGM4Vmh1dE5wZUNGOC9NdktlSEFnCi0tLSByVzE2ZHZSdXRxQTZN
+SjRTNlRtUHlRL2JPS1Yxd1lnalFFUGlWR1lKTjZvCgfzY9S+Cm6zaEAcrAr3fsev
+9enyx9OmVTIIZltr52uqCYbWcsuCkDjHtwR3NXiSQB2HWhNe38l4l2K1+HGcoS7i
+2TMD7o9Jx6QoWLHgmrn/zXL/VKyOj5a7P530AMzdqcgJ4U8641VN0W7L9u1Cw5EB
+Ujzb1rKthf+txuP04aWYit69ZBdH7r+VkOGghXngwvBapwFF8AGUug==
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/headscale_auth.age

@@ -0,0 +1,40 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBvbGZC
+ZFZWZ2ZPWUlNdEZCSXBuYThubHpiNkFzb3Jldlh1QlF0UTZ0NHlZCjlHSTVrekQw
+MDBsaU56Yk9IQVZaQWJDMVNoUWFlQmpJV2gyTXBXNEhNdDQKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDU0eDdqTStiUUlCUUcrYWhDWVRSQmxPNEIySk9NallHaVdNVFg5
+YXNPa1kKQ25PNGxjc1hid25Nd2R5RCttbHN1ci84T1pmQ0ZkNDM0R3FLbGdHRnRm
+OAotPiBzc2gtZWQyNTUxOSBTcENqQlEgNjR5WkE4eUQrUGk1NHFMY3BjclZKWkd2
+TVd1QVNoVm96QkcwcHZmdG16dwpRQjY2V3dOOGo3VlJ5aTNLS0NqUVJ3VHNTWC8x
+V05kbm5yQ3F0MWNFM2ZJCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBFeDIrUWEyYjVw
+QUdjSlBWQ0Y2N01uL3hxTWJiNkdCVkM3UTBZbDhBZWhNCnRraHhUb2NEMzJWbWl5
+SjJEenN0VjJCWlM3TXEyREN0ZysxSG9Rak9hMVUKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGxYRDJta0x6QnNkTXJnQmZwWFlRL0wrNS9EUS9TVDJMRFhZWDBUKzRWaWcK
+VXlwL01IYTdTTTY4Zk1FOHBMc3E4ck1DZHp6aHhEaXFBWFN3SGErcjhmUQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgVUozU1kvVVJsZ0F2Nnk4bmZnUUNyTU8rM1FCRjFY
+bWVBZWNNUFZIcFQyTQpzK0Z1SXVFQWhFSnp0UGs0RHJIQlZrUUtlY0ZFTjdwSTZS
+MXhjSTNpOHNnCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBvQkd5UlNUakhGY0dkRFly
+SU4vM3A1Sm5xNnhIZm5PUjR5WFNLZ1ZmL21NCk00M3k0RnNjL2dkRVd6MmdGSW1G
+aGt1dmwxN0VTQm1zeklDN2MzRmFqSUUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIFBQ
+TGdvVjdEaEJDQ1FxbjhTOVdZTVdjLzJhc3lwdy83UHNyOWJPNk5ZRjQKMTdNemRQ
+L1h6Tk1EVTdZcnFPRVdEZjhnU21hLzcrWk0zS05YSTV3ZGJQNAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTFcyc05mMnNVdWFDQWZUMGN6OWNZeGkrWlMyakV5RVhHaFJw
+bmxiZ0lrYwozcit3dU84L0lVU0JXbVN3YnJoK0NPOUZKS3EvSkNPQ3FCWWhYZnhx
+azhFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBNWWJtTlVQTUo1SFh4b1Q4Vk8vUHdG
+V0xLWjRXdVZxVVl0L2JMeTBrdWxJCmJvNGJ5Q0JUR0g4Q0pISmxTVll0OHl2dTFJ
+dlNtR1A2aGVTUEZRMU5Hc1kKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIFkxendRYm0y
+aEc5dTAwQy9pLzBrbUpVVlpFbnlDdlI4bGh0Zy9oMmtVWHcKNDZuaTBDV1o5MXFV
+NlBLVzlqc0ZzOUdMT3c2SmRYV3hVd044bzZoenFqVQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgQ3VDSnNLMHc4N0dCQ0NOY0lscStpeHlKdXA2UGpqRVhjNDVzV0NCQUx3
+VQpkeU9FOE13bFlaQ0ErWlBFZ0VWWTVZZElQdEg5UFo1SVRSeEhqRnk2NEtFCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBaREtQS2ZsSmxSQml0bkZzd0prUXdvdkhBZzhY
+VkNRZWZqdVNvODIxMDNNCkJVMWZUc0o5Q0g0Yi95czFaVkhwejh0QW5HcXZ1Tmdl
+bWFKSUhITkxFYlUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIGlNcjZMWEdjdHNpNWNl
+ZzlrNklvVklXM0tDMGVnRWhuL3BYV3dMa1U2ajQKd2owZXUxSGlIVUI3cFRxbjA3
+eWFhZXVudlBpQnRMTEVwZXhSSFgyOEsvSQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+OXR4MFc0eDZQQ1IwclIxYm9kYk1DSkZBZ1RDMm4wYlEyb1VrRTBaNmpWNApwY1pu
+RE9VTU9Mbm9Ea0twcnBNRUc5ZjdzYXRyRmw0MlVHZDZmTVVLZFBrCi0+IHwqflMt
+Z3JlYXNlCgotLS0gNWpFR3lvdmVsN1V2WG01aHN2VjVUeDZORzRpRDZGK0RWTFRM
+SytLcVZYZwrYTHZo/oozQZasJAFNVb3ZrSAjREvZzRRyz6Mj71Pj2H+dbFz9sZ+c
++B4DEN/4xfhm5FUsU2w8VCQ/E+186igURD2AyhUZxNFFVPUPJKUM9rY=
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2bitbucket.age

@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USAxNHJi
+QjBYYnZsZTl1OXRwUDRXSGx4MmJOdzhHZXY2NUlaQ0hocFdlV240Ckw4U0FNSGFt
+SmF1aW5mM0lseFZDUDR1ZkgyRFdkbHYrUHdITWUxanBrWHcKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIC9vS1U5ajZ1MS9sdFZZbWs0cmlvc1VQRVNLZUxiQkRrS0xtWWx3
+LzMxQm8KdmU2V0pqZnNMajc4SVk5Skhnd0VQTmViMERIMWtqMEcrUGpHTXkzMGk0
+QQotPiBzc2gtZWQyNTUxOSBTcENqQlEgS0FzbGFCY2xtQjdlQ3p4UjJjUVdNRGsv
+ekwvcWhEK2o1OFkzYW1zMy94ZwpSQTlwRVlKb2x3SlR2QkEwSFlhRi81bGRObWhw
+OU9pdVBJcWRyZm8xQWpnCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA5ZGMrR0xRcXJz
+STlKbGhEYkdOYlYzZHBmZkJHUTVYSndEZk1ab09Pb25vCmJWVDZCYmVTSW5nRTVX
+YzFHTnRMeGt5WE1Ydk0vZ3l3K0NhckwzbU5kN2MKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIHlJZG02U1JaZkVxVnhSc2VVZ21sdmJlMUh6eWhhK05lSkhES2J0L3JEUUUK
+K3FacHVNbEIvWk5QQTV5RHpOU0tpYitJek96YjF1a2o3dTJmTnZya3lpSQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgUmcyWU94VEI0Vm1vUnpBWW9ieTYvQjFBM0hyY0ZU
+QWZoaUFmSTRlTEFIZwpINEFkeFJnVVNINWlBaS9UK0V5aExoMnY0TDVjSFdITEJi
+dzFpdm9wRGJBCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSB0MVR0bE9tMEw2bzc0SHpY
+N0JFWXFDbFJ3M3Rab2VtQUlLeUNUU2l1aTBNClNPTGpSTnFGeXpBcStjdnlmWllx
+K20wdUVVVlZnb1FJbEdlQXVTWWpudDgKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIDF0
+ZFlkaTNOMVNsV29rREJpaUdXSnFuQTlyd3pyM2I2bUtPL0ErUm9wR3MKenNsdEhl
+TDVjSmdQSXR4S1ZWR285RTF1T0hhNEg2TFZCUXAraFkzdXo3awotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgVVNrblluWm1Dck1yelpURWZoeVFjaUJFaXdkZldOcCtFVzJQ
+ajZUTmVsUQoyUmI4Tmttc21HemZDTmdERFhxZXlpdG1RVStiems5cVNaQWNIM3dv
+RlI0Ci0+IHNzaC1lZDI1NTE5IDVhZHFNZyAvS3AwTW1kaUtlQnpjaXByQU1uRVM5
+RDgzMVhBSFRWSVdwczhxVXdUWDBFCnBDNjEzU3BUcCtRM2tDUVRBb0Jqd1pkK0Zo
+WWJEb2gzaUlPTGRsZVlzZ0EKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHRnQndCVU9J
+ZlQrdi81b2J2cmNzdXR6NHI0bW9LaHJqRlprTWZJM1RiRm8KSmpVQjF2U3BuVWVz
+Y2orSlc2dUYrQWRYSHFPb0JRZloxZHo1KzduQkJycwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgVG9LQnRwemt5T2VSVFBVK21acngxMHRDNDNxQlFxZU92NzRuK2U2aUwy
+OApXamtRUENLSVBBM2ZmSVNtWkh1TW41dEQrRkNYQndBcUlOQnU2Ky9BMzA4Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBveE5LTWhRZEhzeHBQVmo4amNBTzlHWlFVYURx
+T3plT0lPaEpsb2F0RWhVCmh3aCtsU21zV0pYQzNmU3VqUXhhOHlYVEhsWDN1eHpD
+UjRjVkEyTVhrVjAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDNMWEtrbWh1SWRwVUc0
+Vm9uYlcvK01xcEdSWkZuZzl4eng3NjlwRXNPamcKYlArYXkxYlMybTE0UnhvempS
+bmlncUJtWjVZMWdHY3VvTHNvdExib2lzYwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZnJtVEdzL1RFK3M3TGFpVGo1Mi9aN1pLRS9TajQ1MlNqODVad1M4ZDh3cwpVSWpy
+elZlT2dWTmhFaWJFUVFXWU5pT0dlam1jU0R2di9TUzVjUlY5b0RnCi0+IEJ6cnpI
+NVktZ3JlYXNlID1YU3I8WkNjClRpZ2dHWkJIaVZVVkNwY1JwOFg2bTdzTnJBRjRs
+SytLdFUyRldoTlpHSkRPY1ZQODRYY3RiVS9VNWtPeXBIc0MKeEdJY3UvTWdEZTVa
+RXNvCi0tLSBLcUNEU1JhQnRCK0RMS1F3VEt1Ykl2MkhROG02NmY5bjVIem1JeWdQ
+TXZnChn2UP3yo7fmH9JimBCsA8X6WLurks8pKMf5lb/yh92Uj+mbIz5R07Fpq0aC
+nLa9VhNeQU4nYkotJUVPRGhBlh7xaVRoeaRfRy8n34TKNU+PQUFz6gv0OHkMDOKh
+B3Z73OAJGaFAX1Q1SlM96ejHVMRdr8SNQao9QJvZq9EXyrejV1L8oS7cKHObfkEi
+ylUPlNsH375zQ+rizYqO3jLBGNXpK3RTOX/3xadbAeccyBLrSaoE+eQi2nba2fSb
+iLd6xNtltmDy4AzRwpmMPpD2EUlTV7iBCBlstK6v7k+VOAyH0PGIXTVUlHs8VORI
+PHx8boVaGNn1b3XSD3CTflCRHxo7gSfXzcDEnfIbPsz97Z8GdQmV6fqIoWyWS3ZM
+DFYdS7VBuKA7lUy9fu+UbP6OFjTu05rg35OcM6uzF6U4TVbKrGzaeyZzrokcXCbo
+LNYJaI0FY+/bznL8/YqU/EJsAzgSZLApIzo3wLJhd6YK9Si17Lgf5N8sfUvHN8ax
+naRZp7SlPmmzyhO82KwI8FXM7E+0mZ3CjfiEUmq9dz2plRGJaWCdMJ/SUv9EcTvG
+Z/Uo
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2gitforgejo.age

@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBtRTlJ
+RHRaRVFZZ2Y2Uzl5dEZXSnplMlpYdy9UVVdvb0dSVFNGd25rcHhNCmp3ZHFneUJU
+eW1PaGlncUdmVHNWblQvbkVxUDJpQ2p2OFJFVGtNb0pZcXMKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIGdJOTRGVktSY21ob0JKam8zaDN0bkhIQjNieTVEcFl3aVBpSjhw
+Nk9OSGsKVENrTkd4cmdaUnE2VWR4SU1ySWdvZGo3VnMxTFo2dklwSTFieUwycTdr
+RQotPiBzc2gtZWQyNTUxOSBTcENqQlEgU0plOWVNNTNNTkxhSVN6ai92aTd6RFJ2
+WjFRMzdJUjAvbDN6MHVOMTNncwp3bVREblZMUE12WEVaOGpLVDBYZHdILzQ2UVBI
+V3MwTTFwb2dwcDMxSFBnCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2L0NONmxjcGFr
+T0xaRnhHQ0FFVVlseUtKcWJZbi9ISlZIclVOdTRNRDJBCitWRDBvQXdackV6QTRu
+S1FPeXdLZGpvbjhBYllVY0UvZ3JEWWQvMHNOS0UKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIG9XOEhybjJFclFKWEhQeDlrY0xVRHZOcHQrK2RWa0hsZTc0eU1qRWlNMTAK
+cnpLdGRDejAraERuNnVlZDBVV202TmdlSVREMVlPWFhpckdPY3Q4OTY0UQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgQWk4Q25xSFZSbHo1NDJ5VnJWcVN5L2NIQi9SQVJ2
+aWtWSHR6azk3QmhEYwpXQUtjb1JZSHNuOFZHWFZYcy9HdktJVGpvQ2xuQXU1Sndi
+YlRWYWhiVmd3Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBOZWtBQ2NDVmViYm9uZ2hu
+akhMVzNlQ0hiNWEybVE0dTFwWGRpMlZGZlZJCkJncE1nTlZTaEl2dW90bERnQUhO
+SWd5dzhYa2RMRVRFYS9rdkdEVTZIcVkKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHNi
+OVZVblBBdVFuVE4xVGt1UzlMNDVtWGdBakVJaDVjanhmYWVPV3RXRjgKYTBOREpS
+bVowSHlySFg1QWJFK0pPdnZJS0VQcjdXdERRbmdsOUFTeldMdwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgdWY5U1BNTndYYWwveCtjeUxHOERGTEhMMXlSSEpyV0gva2pw
+ZHNzSTRsMApQSm5BUmdMODZ2YmVaaFNxQVFaYk5KWFVEOVoyQjBQQzBxM2kwZEl6
+eXJjCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBVbG9ONlVPbW1QNmxENGJERGs1VEJU
+Q0FhMlowVlZVVG8veG5tUWt2T0VJClJPZUY1T00vZitSRmdhWklrY202ci9yRG9M
+RDRiTGpKWis5ditDVjJIRmcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIE1SY3pidWpw
+TmVNbEV0ZXQwTDkzdEtkbVIwd1BrSG10UVhBRUY5VUt2eXcKSCs2VEc1VXhXWXBY
+UHdRVFVtaGJUK2tBWWYvQTk5V1dEcDVReFJ6WkNJdwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgVE51VHdqeEF5ckRqTUVGWGw5SGtkRGJCd0xoZzdNbDRUajZPdThCQk8y
+cwprTW9tU2Z5d1RVRWNkR2M0WWNCRTRwb2VWcDNQdHFCWDBHZDhINUduN0djCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBOZlB6aHRWRmthWkpuekNza2tBUzRiNGFkSTUv
+WVRNRGFKZXZ1Sm0rUDJvCjV1dzlyTFZxYndvZ3BKNGU0K0hwK2VhSmNYcmFHZk41
+RTlscS9uODR0R0UKLT4gc3NoLWVkMjU1MTkga0hrMmdBIC9sLzYvYnVpenRFUlZO
+cTVmVnBpLzIwNlJrU0xYOEhKWStkOGRDU0dkVFUKbjlVQTlsRnBCci9ucUNMNkJC
+WWpueFlqclA4YVc3RVpXeWZDQ25mWEE5YwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+bjJNa0RIcGZWdkxCUnBsU0p4L3lwUDdia3Q4L0Y3cllYVGJuQ3pZcjV3UQo5SGxu
+SlQ0cFVOM3ZRZ3l0SkdVdk5vY0NLcVUrRXJ3SU5SekxaM1NWYy9NCi0+IEdTTEFp
+OSF6LWdyZWFzZSAoJmR3Vi4gU3A/ICNuLSA7Ck9ZSjhhci9nVjl1L2dIR0twUm1i
+NzRSOU1DM2Rwa3RsYnp4ZQotLS0gRGVpRXZiS2Vlc25HN1M2M0kxbUo0Uyt6OHgr
+Q2loS1MwVzB3Uk9mcTd3MAr1KliXDwBENE5rxqhvy1XX1d59XdiWeqCepnPm78ET
+YbVM6FN9H6UBwiwClc+os59UY1lxNyjvefVOfW4V0Jpo2f2aFWdsJxoJWSdomKzG
+N2wQ4Yq8ESeuz4g7pwxWB3RsTr0w6Rnzuf7D4Syg9rpX1pqVinFhLOki1aK3ZIdk
+tqhjkKFgWQbBM/6540W14uw1fPTIcdX8v5KHbTc9XyNA2MHamFc1GooYduqL6Ylr
+ij3hM7/z+TdXxGu3+kqs3Yh5MFd+ePB+LFgAqiW3gv9nD5RmH3s/x8Oip+RLpoTw
+7fwo8wgHByoDK6gz2SAOZ2Q/Px5YBqivleT0oVdrd/quLN5lU2aQt3OANTxzF+bP
+DaAWwv/7pTaLB7lyqCTSw+C+UmgVXmnOi2MO7ex3tImNzwGVQfZG9mc5k13ltwsq
+uxC3T9l8+fuo4iFUwCXfXlm3ZmcIcpjYE6rOlV4Y2EdmwwvwRhMljWf2OfNHlq4e
+hLtKvsHf7+pMAX0ZsZMig6KH09V/RtGUr9KBWVG8CABPnPJBIzlGZPJdmO+G5eAx
+cEUUkJzlcSCF6SDo1zG7QcT7vRSX4FjvOY579w==
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2github.age

@@ -0,0 +1,49 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBYU2N0
+a1MzODQzb2JUbjJyQ0xTbUxlbjhJOExjNm1JOFd6bDNNZEp1TlJ3CktCUXFwWTJ0
+cUZVUldoRStJRHc2cjdwa0szQ0VPZTBsV0NiK2ZmQUQybW8KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIEk0R0lSUitzVkRQb2hQamt3cGdQK1ptYXVkUkdXb2w2N3VsY3hY
+emdNM0kKYXhod0FVMzJ4dFRCZXZBQTBJcFc0RWRsZUdqV1FkSldkVHFnbU50VlNx
+TQotPiBzc2gtZWQyNTUxOSBTcENqQlEgaG5Fc0VOUHdJWlFsRGtOSEwxM2RHZHdh
+anVJZWlOZ2dBRStmRkc5WU5nTQpiQzRwMnBIVHJoQldJeEdrOGVha1phbGRKZGZW
+SGZiWUV3Rk5XdGxUZjFvCi0+IHNzaC1lZDI1NTE5IEJZS0crdyAzN1A4amFYM3Jt
+UDNidlBaRDdpSTNLb1dmTDY5VDArc24yUWcwVGwrenpnCmoxVnlEMTFlZFhEeE92
+ZHJaeFJCY25sWTM4NWFnQlhpbCtodWZyeTVoaVkKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIENONGFuM2ViOHRGa1gzQS93a1RTaXkwVFlYd0tadG1nOFhra0VHa0Jua0EK
+OElXcXgxd0FuVys4eUZwSXA2eCthRFNRTWpmSDFLU0FqSVlCUDJSNVJCOAotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgOUtUeUFubGN2RUp3eGM4d1J3ejFaSXdaeWg4MnBu
+VVNmUE9VRzdUNThtYwpVazRGNS9GMytrOGdBSVJhcWJ3TDNDUWVOMHFBd216a3dB
+UkJmNmpSSkZNCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBFaUVFcE1aVnNrekwrZjdN
+L2ZYZ0JreGRRM3FkYnFzdlViVk0zajE3ZFVRCjA0OUlLczBmaEJMMC9EU0k1K1Vq
+Wmk4eC9wbXdvWG5UTlNMYlBiSTN2RVUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHdI
+RHY3U0VuekdYOS9FUVhBQlVtUlNQTDg1dEt3TnFzVzMwOTgyQktEeWsKRC9TUnJJ
+cytpaTRGMm5wcXFuSE5ReU9seGFUWlBSa2FxbHQ3eE9Idmc0YwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTmp6SnhHV09BbzczdmVoaCtnOFdYaHorNWpmSDQwVmtJVFFx
+Z2FTTnZWVQpnK0lTem9uTE9BZ3FqdVJ5YThmZ3o5RjlZNlhTUW5Zc1NsM2FBa1gx
+RGdFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyB4ME5DK1BQUVFLcU1tYVZadG9hRVlM
+WGFnd2lIVVNXSTNkZnhIaDNNSUY0CnpiUEZKeTVHTkFyYUdaeU4rWE54RmIxVjhC
+NVkvQURrY1N6b0doN3MrYXcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIFZraHhvbndT
+c085d1BFeXE5bGNWcitZaTBKdVduOGtPeVFRam1aWVpyQ3MKbE92VWFqVXF4dkZo
+dElDN0p5S0xXemplSzFWUlJaZ2M3Uzl4UlhmOHllUQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgbndmTFpuR3o5QzZsZzVBMzBnUlU5UGFoNFIrc1dYUmdCdHhYa1N6d2JG
+awo5amhkT0p3YytiRmFLc05GRU1hL3FMbEppd1Vpd0xCbXE2T0dLanpTQ1pnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBUQ3c1Rm52cjl6ZzhQNTQ5R2NEWTlWUlVNWVJ3
+VndHUmg4eWIzNERGZWxRCkNRZk43YWUvc05nYWtFYVlZNjBQbnNhK3RXTjZJMkU1
+OG1hcUtoUDQyUjAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIHJGTk5SYXlKZkx5cEVJ
+dUJQTVNkUWVkVCthU1c0eDMvbGJWN0dKU1dSeU0KYUVQMTFSNVNnZEFxV09UVHJm
+VDhMcElMZ2NRQWVKSXJITU53NlZwK2dPWQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+YVgyMDhXL0RsaEFxSUhGTVh6c1BUeFgrd0lMUDg3blk0a2pocVJMbVZnRQpBb1hJ
+c3pBOFRXMG9kTEt1Q1IvZW5GR0F6UTNLU3J6QmxGWGljT1pzb0NBCi0+IHN8OGhP
+LTVaLWdyZWFzZSBKcTpVVyAvQlZYawp6bHZOYWpabVJhN3BNVEpQbDRWbUh1c3BP
+UXlsSzJWdUdPMHpuWmF2QjNQd0ltUQotLS0gemVvbWt5LzErUlpmZXFxQmpMZFVq
+czhiSVBFQVBVVFo2Q2hiaXNWQ1Zwcwrm4hQtiHjacGXqxDf8QBf6AdsiCFad+cAu
+RA/fKJMnq8zc6NUDkvEAxrWxFLpLD9amqaxgh5889mWstPGaeCQEcWfjO7jl2jsM
+duZsH2rtqfsaoWI1tsUiVKGtgprkI1TBwbtFYQ/aC+1AzOP4rnmuu4T/kIDbP+rn
+SlILVnc458dAsDIUO0vYzNhy7z6oG0Nf6TnPehPocIakRXoLSN0d7fYmC5GDD+8m
+v0ucVjpVlyXCyOHbl6COgLmz0HglXaQba+K1ZFWJJXwB3Ej/wYaS6r5rChe9RKJJ
+tlCCDfOmUC1BgNH2PbPsaDwVmPe5itsAoJrzvq2mR5ho6kTX0dAPnu6A50G2TkTq
+7OtmvcjVarHKO5mRLSaGKgBnxcdI9MPvKdLKb79mBgmp7lWbKqOfQL8W+mfdxWjI
+F6DEPQ478W7QF5tIWYlHsDS4R7hKr7DPBxGLZEhKUYl6UJd8BietDQ+Pti19uoiC
+1qwFIGoKGteEsW5HHfvxdp1hdboVoOh/MzwpksNqMOZIhS2aAr2EKQsUBB5TLL+v
+JdEKGcLiRuxqa/6mVuEw2iqUfSBK+A==
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2gitjosh.age

@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBXQXoz
+bGYwc2NqNDBVYzVkeGxldnJxbjZ6elgxUmFoMFhuK0pvTTRLWkhBCmx4RUxONTYw
+VXZGZUtQcnFaRXhuODNQQjhCRmFtOG1TQzQ5Qk5ua0RNQ1UKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHgyQjZBUjVNMTV6cG9LNE5NSFBMc0xid01PQUEyeVd1ZnBEaUVM
+Rjh4bncKVHpqQ09XVk5od2F1MW1namloTUVMaEpuamlZcWIxRmsyRVIzV0RYZGxL
+awotPiBzc2gtZWQyNTUxOSBTcENqQlEgN2s0Zmx1YjEvMlIzdElmeTcycEpNcHNJ
+UUM4RzBaZWJEYTNUK29vOEdHMApkKy9SSk5PT3ZaQXQ1UGFCUFFvVE95V0tBZk5v
+UlR1M2tEYWtMK1hSU09JCi0+IHNzaC1lZDI1NTE5IEJZS0crdyA2YzQzQ1J1L1JG
+MXFjbzE5eUhnZDBjNTJGOEZwOGwzSmsyRUZhQzhtakFFCjVQYzM3VlpWR1I4THd3
+Ky8xOEd0UE1hVjRRS2RiVmUxbkpmdGxLR2RLcWcKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIG5ybjFTUEZ5OFhpUkpVdnZHNnZ1eWZGYnNQeFFvaVNoQ1pVaXJ0ZkNna0UK
+cUx6OWtid1FRaTRLMy9EaGk0K2NKWE00UC9Ec0FsUDJCODJzNG0yYXJPTQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgdG5DRTY0QzU4MjBXTnFWT0NiclJ5M0g3eG9HVm92
+M1RIdFdidm9hVlpsTQpFZEd6QVFjY3NLOWVXeDFTdXZPenc3L284bG12V3dIVzRB
+QUZ3ZmU0VldRCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBHQm9ObTBXWUh3YkRSb2VW
+ZGE0aGFYM3RkbURpYlRTL3NMek5kZEpwcXprCjFHL2JIMFRKVitiamRSM3dHNzlj
+ZENNZHFIOVdLS2ZOb29RU2FKd1NCWTQKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIG1z
+ZGpQQ1ZDSVdLVE1EVUFRVW9RZ0QwbVJPSUtIYTcveUdBaGIwb2oxbVUKZGRQcHNB
+WmJuN3B2VGVlUEJLem9ja25wSjlreXpCOEZUUnZnY3F5YXR1VQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgTmtoYlhWL2YxZFFheEVCbWMzOFpwendzaFZsOEIvN3VzNjlZ
+cXNsUUduQQpacFI5ckx4TGZPRnp1RFM0SHJlS2hLMnU3NURJcWJKTEZscEpLVU5k
+MXVNCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyA4dFFyS1h2bWJFYXZFSkpaNGVkam55
+RXMzSW94NXZTVy8rRHBWOGl4NVFrCktPVWI3VUhWZGZtYlNaVm8xTHZiTk9FbWZ6
+OE5WYUhaTjAvQWFxWDdyQmMKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIHZYT3dNK2cx
+UFpSV2dabnhIcW5HMlYzK2UzNEorQ3BaRTg3NVJwYVM3MlUKeVJqaE93N1lLdkg4
+UU9VaWRpeCtWQ2V1bmkwMkJvbE56U0lXcEhMVE81WQotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgMzJUS0hEQjlNTUEveGxXdHZGVlY5ZjNrZTF1QWc4eEhiUmVsUWRBc1FV
+awpkYXgwL0E2cUNvQzRCQlVHQWM0djh5RVJ0SFl2R1p5ZzlEZ2lZV2trTit3Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSB5bDh3ZTBqWE5wNWdVczhsaXFJaXdEZXVBSzND
+ajN3WlRVcmp4dW1FN1dzCkxMN0wzV3BIdHRqYXhmSzlLWE0veWJHVlNBOWFncFZ1
+M0x0MWY1dmM5TlUKLT4gc3NoLWVkMjU1MTkga0hrMmdBIEpINTFDeUVTbCswN3F3
+QXp4eWMzTUdPTWFGeENOWWhkTTl3WnRIdk5sRDQKWk80VFJGTW5xdkwzMDdaSGFW
+ei9RTTg5SFFVRktFYUlPYjNOT1FQSklZRQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZVhldEpReS9jMDRzcXhrZVRhSGFCeWphQjBUU3JiUVVYZnc0d1FUNFUwYwpLenBY
+YXMxREFRRjZZTHBIUUwxQVplL3J2WGszNUhXSzhZL2hDNXUvUnI0Ci0+IFUtaS1n
+cmVhc2UgPnMjfCFtCjcwT2hGeVY3b0VBSTZIZkI2bEVSUzR0bzNQQUVjNkpYZTJl
+a2l5b3FNbmpQQ1F3ZTNDTUE5ZmNBbmhzZE1uam8Ka3BqWEtQVEIzOUFFQlV0TUl0
+QWgzU3QwdlRTWkdUWUNRRlB1Ci0tLSBaeUtEanlxcDV5Q0Uxa25hVnFiVW9KMTlw
+TElTNVdoWmxlWFNsMXFlY0VzCpnuSzzkIeZRg56GdBS2gOTaXV70O7kR/9F7deO5
+XJOWo7ES0V1Y3WqNHmCsWHiqHj/yKT3JYBPd5p8tPzW/uwO/4KKfqaG5xY3l01Uk
++zsFTkQh5xRP5vtQ5Q9ztTVV3hp4QLVsBLSwGHMiJyL2BGawLD5OsSehBQ26nU4x
+gmE2ZP8WWm2dCTGJBf/JQ7rl7+G54GRK6akWRCT+ZzL9OMA5u3dgyvE3w5Q04K34
+sY8WJIDaUm/Gr6JB3gHTfHaSsqx5NE69EZ2we4qdUW/ATeIa42NLPOYvShGzJdNO
+nWC1vemKsUUDR1KzfoZ6W5KM1Dl6f0IzC2e3gAztH0FtZO47is1Lx9jsbVN/FRh1
+aM2bk4LUfsH0CtVqRxEqVg1gXzB+ICe/K4xU8OB1g7uzTYS/rZc1KG2sHJ0fjXUV
+m0EdIMiJi4uTltakDrVGBKiNhQAz4V6t/kKkONvFg6wFoVzgm3kOxfRcryWfF0sc
+VDaa0kOnDFS/MuIsMENJ0XP5mTO/BQERY4m423nY7hH4Ud+kU9k8zQ3gdNIGwCEK
+1j0P61nlu6Y4lSO6UaNgr7xl
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2gpdPocket3.age

@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBGdVY4
+TnVkZlJ0elRhQkRSMnlXUjNNb3BQQmVBbmhYYVpqOUx5cE81TXpvCmNYUG5rTjlo
+RmpNQmFtZlBwWXY1eDVzOFh0T0F3d210QWRvOEZnN3VyK0EKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIHd4TmdIeWdiTXk4QWwvdURNQ3NtUlpNZWpnT2hubUk1RTUvMFRG
+MUtEQnMKTEZBV1dPOXlQOTNSNVZVcXUweWZjc0RlQzFybE42Szl3WkJCOWszMHdN
+WQotPiBzc2gtZWQyNTUxOSBTcENqQlEgU0V5bUpxNTVNQXh1UU8xYmJLWEROTkRr
+UmtNOWQxbllTMW5BZzdNR1JpcwpCMExaYmpNbW5ma3N6SHBDR0lZdHljNDNlNHlM
+TTJrTnpKanIvYldhcU4wCi0+IHNzaC1lZDI1NTE5IEJZS0crdyB6UHBMWXNCZ3ds
+S1RQL25SdjVkRElKMjYzUXFKV3cyZFl5VlhvQ3ExeUQ0CkdGaGZrNGdZZ2ZsTUsy
+amVPVjhjMEg2ZkM1NnF0cTZFNGhFSGpYQzRNRWsKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIEN2bWhSc3AyWjlXWk80NTVpbkkvTllWbnJScS9XWjQ2RUd1OTkzMHRzZ2MK
+bzNETWVrVFdIQ0VvUEZSY0N4T2Nqd3c2WEZWS3JqZTAxaTZBaTlmOHpZQQotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgQUsycFZocFZPdUxQM3MrU0o1OGE3Rjh3SFlNcXdo
+MExnb2hBbHdoTk13QQppenB5THpDV3VXRHdZYjJJc3dPUW9qcFBydUs4ZXA3Z1JO
+ckl1ZVJjNzdNCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSB1MzRNMUwxb1ZESWJrMVdv
+RkMzOGJHYnhnOFdHQ2Y3cjAyemI2bDJoRUIwClpnTys1eEFlNkZ3cStndjFyVFZF
+eExaQ0JDRlhGWDVyRFNPR3lBRUdITkUKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEJB
+RkJ2QVZsWjdqQW1TeVpCS0tpSTFiZDVYOG5ybG5rMjg0SWVTRnlwd28KZnJMVE5C
+M1hkRHc2K3RCZFRjU1ZyeVR2YXhWT3ExNGVRNGRMU1NrYk50QQotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgYmIwbXd5aXlFUUhJd1VORmxjb0hQWmRZb2lMZ2xBdXJaTmx5
+TEU2Y2wwbwpOZzNJQ2kwVUxBRVcrYjBOMWx2V0F0dWJCdnB3cXU5S2tnZmpQc25P
+NnZBCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBCU3QwNjdGYXE2RHZtNGtHTVdRbmsr
+QzgweFB6V0xyV0c1NldBeGR1UEVjCjBKN2pJT2FJeFZUNDFKRnJMOFBWRGRDa1JK
+UExOZkhwcW9WZWxqSGVwbkkKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIEE5TFYrV0wv
+MzlicXhsUHNoblUxa1FlSFlmMUhnYy90OXROUkIycWFFRTgKclNPSFdtVzF6Mml2
+KzJhK0hmWDIvUmFlSGVLQ3l5bElLY2N4aWxkNFU1MAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgOVkvd3dmV0hhUmwzQlFBOEs5a1hGUmMxRU5heFNaZWhGcDRYdTd4ZktW
+NAo1dGsyMUFlV29hOEt4R1l3S3Y4NndrbHVUR29sSkMvZ0R2SXM3TG9MQXI0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBTclIxdXQycVZlckR6aTZvSzJxY1ZmSVJWNk9j
+MWJBYkp0ZUtvNHR5Tnc0CitlQzZDUWw4M3JNSHVkQ2U3MTdtTFBGTmpLenR3SmRw
+NWFaNzFJSHZhYzAKLT4gc3NoLWVkMjU1MTkga0hrMmdBIDcyU0ZjeWREdFJrTEdk
+c2RGY3Q3cE0wdDh4SGRJUVAvSzR5WmFENWQvQzAKVTZraTduUVg2RHlEME9CcnVq
+MFpCbHBKVFNTOG1aUnNIWWJHUXg5T0k0UQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+YSsrbmdVOHplU29GTzNMNVh2aE5OaENXWHE3SlIxa1NuVHI0WEV1SG5sQQpuQWJP
+MnllQkFSMDd3S09DNXhxU0pEcEFGRzZabGkzTlM4ZXBNWlRkMU4wCi0+ICEtZ3Jl
+YXNlIHlEWmUtSzZeCm56bkR2UUV0OVJGNENzRWt0M0NQSG5acHdQazJFb1JFdGdq
+aG5Lb3BtTUF5QmtKaXV3YVJOTWpMdnRodUx3NkoKNmpkeGw1dlB1NmFpUk1RbFEw
+dwotLS0gc3lycXhWZXBmd0srSjhPTW1vMmN2REs4TWI0VUhiaEt6ays0akJQSkhs
+UQoyTVD7Gbo16BII9fA/kbWQA9cLwAIJC2eJldhHa1Z+/nCLTYoolHFvhDF1kNNU
+Q1VUi7Hwh3WfIZ5U9S8Bb1gtesAXrjAVoa07IuuELmY8P1aVnhO1Dh1E9bXhvjs7
+T9Qz5iA0R/IcMGzP1khAwda9urAqjtqjgNJOO9tOnKGOfCuUDhsPVqCZAfag4MeB
+A/UbjmKvQuoMLnx4r8AdZB6hEC6OvT0d26e1EzT7o4C4nXYk4+ocvNY2kp+9N8d6
+C5qxI5juVeZenESlAxQKqaih6wUI5Hb7vlbMM3LvQqmSdwspOCYvji34LTzE2Vl7
+fTb9us7PpueVWLfzF2ea19B2CNZR6VWJ8d2WNDSGhoq80H5k9fawhq/PzgB/CLzB
+dArCKrT7pL/L4oQVXuRC+2dKSmOm+hlrWHS1rwWEbgA7iQV8MR7eaHjUKEpRYC/W
+0oSyCsBNRTJrTQEZfknGgIK9dAKM2Mx1rw/1AbPrtcJe7aHI0R1wK+bSgXOrYgWX
+78V0+RseYYzyPgb6LUwkrA1MAsMp3NqQFts50DZ/x5ZBrKGWyEWO96Sg6oMCz+Gh
+2S5P02QBaoTSyuhHpg==
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2h001.age

@@ -0,0 +1,48 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBqZkZV
+ZFlDOTkvSkM0NmFlOHlIak5KUkdEZnZJRnJOQ1hLc2pkc1pGODFvCm91Ulc3aEkv
+NTUzblR2ejRzM0I4TnoyYVlkQTk4d2RNSTRUVDJ5bzQwVnMKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIDlwQlRHSS9Nd1VZV1BRRUVRRTdjWGdKQ1hiRitPMi9KcW1JMEts
+eWpnVFEKZ0thUVhWbDZxSHY1eFQ3OHl1R2JzRDFRbkpnMkVQRGhUYi9oa2luaEtx
+MAotPiBzc2gtZWQyNTUxOSBTcENqQlEgWTA4bTNxL3E2Q0h5MWhnN0x1a1N2NWRI
+K0JteUdIVTY4dlhtc1JYQ0pFTQp1Y05ob2hRcVNhbzJpSE5ReE1hN3BlTEsvdUtJ
+STVRdlZCWW8vQWhOblhjCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBRYk42V20xZS84
+WGd5NWs0d3ZmcVdKNWU2NlBrVjM0OEdXRHlVaWRORlRzCjBZQ3JaOVFYazVDeHBa
+RVhieEZJRkY2KzRSZy9LOU50VGFiRWtsV1FyUUEKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIE5JNWQ3SHkzcXpGZEZVRVRZZC9GRVRvWDVvNHZkbGpEMTIzUjdNME9YMEEK
+UytTTVlUUUhjaGpVZ1lYV0ZETk04elYwZ1FUdGVlMURGV3JwM01qK1M2bwotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgRkNvUjEzdVRvbUxyMGQvQXlTU1NTM1NWd2tMdW01
+RE1zd1ppRGt6QndoTQpJckl2VitBR2poRHhmV3RWSXN6amg2aFkvcTd3aTRIRkxU
+SFBMSkVERG9JCi0+IHNzaC1lZDI1NTE5IFJvWDVQUSBFcStmN29VTG1jTEtiMTho
+V0hJUWFxemRrNnJxL0I0T296bmlvQmt4eEdvCkR0MFFORzExZlhDVXpYT0VlQ2xY
+SklsRkFMVDJzQkpPemQwa3NOYUg3VVEKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIDdF
+YXNFY1F5MElweVhtQjdkQTAxYWo5Zkp5R1VoQ2s4dkhnUmRwV3R3eVkKQlZ4dTNS
+QVlkR2FnR0pyQTlhSWRQNWtnT0dCbTE2YThiZWV5UGdUNFc0MAotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgT3luM1VmQm9tSG5majdWeEh6ODBLSm56ZFpSTUVmYzY4K1M3
+RSt3cGMwcwpLUWpGREU3dFc2NFFtNVZGSDIzem0xZGF0aXVhUHFhUEIzWGMzUDFT
+L3I0Ci0+IHNzaC1lZDI1NTE5IDVhZHFNZyBwUml2WFlKSFdnWWw0YXczS3hvZ1dH
+d1BLYWNpL1plYXhldDg4d1BHYjJRClZzNkx4S0ZYY1MzeU1aU3d0TlBhcHVvNlJn
+NDN0Q0wvTCs5eS8zTnFaK0kKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIDAzRk83R0Zw
+ckFzZjNuSHRpQjA2cEsvTnRKdDBRT3hTK1krWTA1Ykh0WDgKWjlEN0NlYjYwb2NH
+RzU2N1lzWjI3eTlCSXgyZUIrY2UxUzdwRVY1a3FVOAotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgYmNEaW9ESGVaS21NQWlITmMrbWQrekxQZXI5SExYbE94ZFhNcWtxSzd4
+OApkMzVTSHBSR1BLS25vaFUyaXZQZHE1cDhrTmZENGZNTElINUxwUzNONzdnCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBqRXVCUEdEY21xblVXV25sTW5FTkxMTTJPL2pt
+U0VDV3hZRC83TVVnelRNCmZXRnYzS2NqcDNIV1k1WHFOVy92aURVVStDQU50VmZl
+T3lSZTNveWpNVEkKLT4gc3NoLWVkMjU1MTkga0hrMmdBIFc2c2lrVWZpbCtXS1Jr
+TFI2RFRYM1BNWEJjeFUzclpXTUF2OGE3MmFNSHcKV0dHQngwRE14VlZRdDJqTHhQ
+dTMyL0JMN3VRWlNRTVZka3VuelF3QW92cwotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+d3JwUyszcTl6TU1XVHA0d2RNb3VPa2I1ZzFqdzJyR0ZTTTIzNi9VcnJqQQp5VHVh
+TTBjWXgvb0daeWN0Ty9DTytRMkVES1hBR3M5YWdEanlYdDJSdU8wCi0+IF99LWdy
+ZWFzZQpnZHBVTGZvYm1sWk85SzVOV3FOZkZtM3NKNlFLdUxDRkxBTQotLS0ga2JS
+NGc3N3o1YjBOeEl0L3NVZVprNDA3VFpJdmt4eW0yYnJ4VWdkdXBoRQqosYCeWC24
+SETTy8dVYTN0kWZBhYxUQDb6mhHPZrLOmlNyDeambLNwpoGHGpxUy1vrYL5cOmBA
+pZ4lLKvAvm+lj7FCqX7+uhQi5FohVTm9bz1IsJcId82yf6lLjc4p7M+ww6icM0vH
+DHHsZ2ecQiJKOvf8BUGgAxBkkdy0MWVRAAtOAqadBRtaGB5902FOI0gWLyAyFqlk
++P/pHRfob8PlnWb7MTYsUVgIBtbV/hIcpSx7BIsPTsdr7yFirhfoC4giBMT//2Mz
+e7NGN2bX93pAUPWK2P/k3geArT1zJoFeyOpkyIhnfeXaA8WKb5juA/Rly4aGUJO0
+oQKJkNGg3DPQMAEwwaijjuz19wd3o46o5la+2L/Yx2fCPDcwOyYzh8wVdc2eq6Ab
+y3y1wlFfMLpsuBSENnCQTPCWimTOk2lPUKEjDtLXCtucwyd/fzjHCjF1iR5twVrw
+id5+60bFV73v2QsQ6+qnNRj2Ea+LRHA48NtQH4Nedv8xlhgqkR0tD8mZc6Xo65MT
+1Lj9suIPCf5L/j7GiX4MPDt/uptHJEckGMEo0rrwINBps7K7XrQLfw==
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2h002.age

@@ -0,0 +1,48 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USBLNmRV
+NlNNT0Y0cTZVY083b2U3K0tORkdxR0IxNExrL2EzWmM4a2hoUkF3CmlDWmVaY2tV
+OVVrYTBXeHpIM1lkOVBPeG9qOW0vL0hmSlM5OTVjcFVNUEkKLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIEJJcGRpcnlSRGFtNzFlUWt2OGpxTUI1WG9zdzRZakpwUjkybW1J
+MkdhaDQKNEMrT0VVSnZKYzZscWNBdkQzbXBsc0liYzI5bVBkZC84NnZKYzBtVEZ1
+TQotPiBzc2gtZWQyNTUxOSBTcENqQlEgR0tSZVk3M0hBd3djZklhVmdOQk5lcXpm
+d2NoL2RrVk0xLzNxRWVIWU9YdwpXQk0yQStOY1JFNjF0ZWhkS1gyWGRhTXpkUGdI
+RGlOZlBLMnFaMGVVSjMwCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBBZDluVnlKQ2FV
+NFBpZDZJQmorYXVsV2lHMTdLRkVjSjZPNHhCUk5iSVV3CjdIU1RaaEpocDF5MHNj
+blFVdGJjR2hwczNOZmpZdElXSURLd3hpQ0xvQncKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRICtWcXVMLzdGOE5xajlBaWdoMk5lL1J0U3JCL1dZQmxnOFpsK0Z2ZzFvbjQK
+ekFWSVgxdjZjQlkxMTlCYnNPMWN4MW1YY0xSZFltSk83RXkyUmZBakZjNAotPiBz
+c2gtZWQyNTUxOSBSNSt4ZncgZDByMm1IanR4ZE5EUExyTnNNVVN1RTdTV1BJak9E
+TmZYbEZOSHNZbFBDRQo5YTZjcVBrbTExazV1a3ppQ1Y1NUZhUUNqWWhLaTR3NkVx
+YlpzR2xNVWQ0Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBNMEt4UFIwb21GOHk2c25j
+a0hpMkRQVGhCM2NFWmNlWXA4SElZUlQ1TlY0Cm9CVVBDQ21PbU1Fd2ZCclduMjdq
+aXNuZS9lN0dicElXckxhZmxpRjJDL3cKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIHA3
+aTJ5VUJROE1PZXlGZjF6R2J1OVBDUWF0N09TNmRkZ0x0YStxK2ZTU1EKWDBkK3FF
+c1FCSHZvZW5YMHBVSis5N1pRTW83bnpQZGY3dTlOOGNJT011ZwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgNFhxRTdZNm9OUm1zOGpadi9jckxOMnRhbzUwL09SLy9JRncy
+TTlzWUVuTQpVdUFtWTZhRStkN1F0cEh5bU84YW45YmxtYzlXR2NOdTY4bHRZZWs0
+RjlJCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyBXdWo2c3pPY3hmRmp5Z1FFdERUUzcz
+MXRRNjI0ZVlLUzArRFhodS9FNDFNClZyREpwb1IxdG14TFFSVHlkTFNVOVlzS3kx
+M2FpSkhReXljSytVczR5MHcKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIGdIeFpXODY1
+QkM3QkNkMllnWXFyTlBpYjd2SkI5TlNoT1ZxSldCN2xGeUEKaU9XSkQ4Tm56Tk9B
+Y1l3OGozSVk4M2ZFejdwR29Sb0NsQ0xrMmZzai9DawotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgUXVkZUJhbEJ1ZnFKSWRaVUIyK2JCcC9PbDZjQ2VlTURWMzBOM1loV2hV
+dwo3OFVtR1JldEwwSjE5NGJKUEVyYlBzTmJIYzBYSCsyWWU2TnRwaEZLeWM0Ci0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSAwTkpuekFzUHZmWFdRSjRnY3YweTlWYlRjOW1U
+a1hXRXFPakRNUzdxVWxJCnhIYU8rUGh4dy9HMGUrVi9aaU5uL3djU2JrYktaaTZI
+QVlMc1VyaTUxTjQKLT4gc3NoLWVkMjU1MTkga0hrMmdBIERkVmp6eDBvZ2dXdURq
+WlNwZjJMN3FLVXJEa2taYWJjbVlLVXBsbkl1MjgKdUhtQ1RFS2Z6U2t1M1MraWo3
+VWFCZERRZXJPTjBNS1FkdFZtdnQ5T0pBUQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+TUpKaThiUVJWUEF4aHZQMXpkdER3TzY3cWxWV1BEbEd2TVRkT2Y2MitqYwpsbDU4
+U05mN0xmY3pkNWtiRTBPSVgyUUhBTTA5cDc1aFJEUDBjU2owd0VvCi0+IHAtZ3Jl
+YXNlIGxgcisvJiUgXWVsIHZrIE4KCi0tLSAvREZvRE9zUlRIOHZpYUVWZ0pyQmlh
+K2ZubG02bjRjdmxBcVdLVENIejlVCtydnNICLzNyabsA6H8fhwkySlITewQ0vFBQ
+GvfvDobgKzac8kmjDDwiIBwRI+EgVznSecv+Oqi2sJaodIxGaYgvEh+FURMfYOPX
+K95ykf+R4bAowyG66i+mg9vthJU2O4v43R4qN4+0CVrArqhQp+ywNERsTV/2pU3f
+bTFAYaLaLihEFDjCy9+p/D5l33Ns54FYAtBtQ/Ut4VY43i9inE/qohM6vy1W1SgY
+THW3pLHvB6WlZvv4uD+IXK7GJXkedKxIuH0pGWLTF28aIlWTV8QYlCYpqpqaYs4X
+87oze8zgPCNa2xODkQnYUI0GX4Fg3vP1K6R4G4DtCOytZdDYXncEIC4+opOoNmfg
+xuhjELH+eZLXXRRd8PPrPTWXQ9CjPOK20vwc2To3Oljt940di6+886j2vFEBd44v
+A1cjFG+K4mQ9GvdAk98EgRVXasmXyKnRdc7kFym9EY7guZtoA0Bav7YCn2vMwF7G
+yLmxss4Wa7UA9v3GF270M/fb6D5u9qcDG7v41wYSldfaqSDs0Vw1ZfaGBYAXF5v7
+GgU0MSWaFyHej5xq5UVTlMtWh2YR
+-----END AGE ENCRYPTED FILE-----

common/secrets/secrets/nix2h003.age

@@ -0,0 +1,50 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDd6MzN5USA0dTdj
+TDY2STIxTm8rbnNWS2J2VlZxcVRFYzdBRElDT2RUR1pRd2piaDFZCnl2d0xoUmg3
+OEs2bXNUY29RQWJ2WG9GMXIzZCsvcHRRUDFvRFl2elR0a28KLT4gc3NoLWVkMjU1
+MTkgSmh2TCtRIFJsbjBZbFhEanBaSW1BOXBwbVQ5eUtHSDRQRzJleTBGc3BlY0dv
+VzljVk0KZEg2M09TNVlvYXAxaEFaUlpkLzljZXVQUE53aEVLQlZXbVBpdEM2b1Za
+VQotPiBzc2gtZWQyNTUxOSBTcENqQlEgLzQ0MVpLWXMvSXkwTnk2VWFrQWNtdVJj
+bURKUzMrMmRqeW9TcTF4V3FtdwpVQmducWt2dkVPQklma3h0QVkwZk11cW9SMkxa
+Ykp6amg4RWUrZEpFb3NBCi0+IHNzaC1lZDI1NTE5IEJZS0crdyBDNjhjTlovT1J2
+QXFPOVZrQ1ZFWUV2cnF0eFdTR3g0M3VFd0dvU2hVNEFRCjdzR2hZR1pKUkpJL3Uv
+VEdPNzE4TGtWRVpZeEROZGFNMXRtc2pFYTJoMEEKLT4gc3NoLWVkMjU1MTkgWHpm
+bWFRIGlhUGZSUVhtSDBuaTF4a2pCbFNqUk8wN1NGT1cvbkVqUmk0cEVCTkhoa2MK
+OGZGdlZBLzJCOG0rN09BQlFlTm41NVh1VEdZWFRjVTVMeFBRMXB5dktUZwotPiBz
+c2gtZWQyNTUxOSBSNSt4Zncgc3EwWEY0dmZPT2ZnUlN4Sk83WkE1c0FldGhYclFK
+T092dm9rQjY3TEh6UQpFQlFTdXBJWVY3aUx6Y3lKVDBGQ3ZHbVJqMm16R243Z3VU
+T2lHWVdNMTk0Ci0+IHNzaC1lZDI1NTE5IFJvWDVQUSBuUTNLUGIwMzhKcVVyeUNG
+NmJ1WkRtdS9FWHQvTGROL2ZiUmxmVlBIQWtZCjZJMUduWVNQMXVZRk1CbjhCTnFX
+RkxoaTJuelV2bW01T0hiTHgvNTVZc0EKLT4gc3NoLWVkMjU1MTkgRjRiYjhnIEl1
+SnJKZ1Bwb0lsN1dTZ1I4YVN0c0NaUDVEd2c4SjNTRkw1d0ZpaTF0RHcKTzBabFNx
+d0ZjTjNoemY1UzVBemd6QzNIQTl3b0N2WVdWUE9CV1VzcVVtcwotPiBzc2gtZWQy
+NTUxOSB3ZHJaSkEgbGI0MjhMbDFZblFud0U0Qi9ibHhSMlJTa0cyRHFJNW1tcnZQ
+ZUNma0VoTQpuNG5ra2hwRlpneWxkTEgzQWlhMkRJVUMxR1RVZWZXWGloUEtkcWdI
+RlFFCi0+IHNzaC1lZDI1NTE5IDVhZHFNZyAwNHF6Zmt5YXViL3o2aVVKVTNSakVX
+eFpuSHN5Ty90bGI5K0l5VFVtL1NvClBsa2tRMm1QSVlBNmJ6T2JlT0V5cFNmV1c4
+Tm5nL1NiOWtGWm95VE1Ya0UKLT4gc3NoLWVkMjU1MTkgWmUxTXdRIGFwdWhWNnBQ
+N1lYeC82NzNHZ2d3TzBzUTcrcm0wWGNPdEc1cUtndTZRM1EKTmxadlp6WC9BQzhJ
+S2NIbjM4OHNpUGJiZkhOSXJDSitiNndOYm5VWDlCcwotPiBzc2gtZWQyNTUxOSBw
+ZUZCUWcgUTFOZUtZSFJRUkw0eE9wd1ZCcXd6Z2RvUFVsUnZBcWlSRXlHU0lWcVpH
+TQo0ZUszNFF0NUdib1BpZ1FnM0hBUjFsMHdSTE1ma01OUHRIWXFUMmJRbWRRCi0+
+IHNzaC1lZDI1NTE5IDl2LzJIQSBocFJ1aGpicCtUTjR5dEw3RTNya1dINTN1emZl
+OVF4Ykd2SmMyNUNqUlJNCkV2ekVCNk1uNEZiTlJYVDVsREQ2cCtRR3pVRVZZek12
+aTlLelNZOVVXZG8KLT4gc3NoLWVkMjU1MTkga0hrMmdBIC9aT0pJSEZiMTA4c0Vi
+dExPN0ZtT1BOY2ltNk95TzB2K0J6WEJaTUJ6bG8KdWo1OFpTWm1JWkRrWmhYUzRl
+TUFJTHp5Mk9hVXZSNXFHM09IZHZOblpqQQotPiBzc2gtZWQyNTUxOSBJb3NBQlEg
+ZUpiN0RMRUhKM1ZvRWJQYVNCVzROckZ4SDY3NU4xb1djcUgyQW9xRnkzbwpOZ2Fu
+dXNnTERuOHFoVVZGMUhpb2N3MDhRK29NVjhuRFhyZTdjL0orQXZvCi0+IDtXeHd7
+YFBpLWdyZWFzZSB7PCBcfkRZey4gI1d4Tn4gXwpIVDhGeFk2K3dOUkhBWkU3SnRP
+THVSUXBWTVJBSlZVWERqL1F6NjFYQUJHZitiWXJhYjFHS3lmd1dDVW4rWDZRCmxC
+bmt3NTUvZ0dScGFUaFJ0dwotLS0gTTRUejRxU2ZKZVN4MXkrSG52dHJzamxpdjBC
+aWo0a0lmS0xWeStFN1UzTQrI0E7L65ZYdi9LJwZ3nSgT7WwwQJovYBqw7YO8jE+n
+1iAUsxo+nj7V7ub7D6IxBaXupMwqqEGX/fUgLyHrckL8V6RmVfvoJROp1Vm7HncW
+xqoFr1cj3n6p+O+xQPFy+1uVSktCTvLgHDNHavRPaoT6vP2FcvQkI7jczbGJel55
+YBA6bLrMLsn1+MmY5oT61huymRbKFyt3c7+u/vqYwD9/J4/KPW7nO0hCQ8LBJEm4
+KFwj/6d8zyLFGRB+wwH3pEPFWZ17/7tK4xRR3jUw3ertMKnLtpYpI7sCOhCStH5G
+6CTMGgmWOyPmccVfWF3RSnuj5I53nnkYktWcc3o+ak8GCw8PBJvAfkAJyNjrSo6V
+QTMX9qsrL8SydAXXFk2lNcv3maH6RgRB9ycPGak/ZsrFP0VkMFpOLIfqjJMnfChY
+CUi2b1iTMlmw9VITSfgh82mue+bcevSaP6KboeksBq2ah8hSN80WPtb7VQNUNl/u
+cQT5DoyvaIxOstiVpBy7DY4pvb6c5iWkUuuDiHrn0AA4XB2skTNhGU1oty0YrDFB
+tnRtsOYgu5d/53Fcd8aUNg==
+-----END AGE ENCRYPTED FILE-----