flake update

fix disko_luks syntax
fix pre-commit hook
2026-05-02 14:09:21 +02:00 · 2026-04-26 18:21:02 +02:00 · 2026-04-26 18:16:37 +02:00 · 2026-04-26 10:27:50 +02:00 · 2026-04-26 10:26:22 +02:00 · 2026-04-26 10:01:18 +02:00
142 changed files with 6211 additions and 6474 deletions
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+nix fmt .
+git diff --exit-code || {
+  echo "Formatter changed files — review with 'git diff', then re-stage and commit."
+  exit 1
+}
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -0,0 +1,108 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What This Repo Is
+
+A NixOS flake configuration managing multiple hosts (desktops, laptops, servers). All hosts share common settings via `hosts/configuration_common.nix` and are assembled in `hosts/default.nix`.
+
+## Common Commands
+
+```bash
+# Format all nix files
+nix fmt
+
+# Build a host configuration (no activation)
+nixos-rebuild build --flake .#<host>
+
+# Switch the current host
+sudo nixos-rebuild switch --flake .#<host>
+
+# Build a custom package
+nix build .#<package>
+
+# Edit an age-encrypted secret
+agenix -e secrets/<path>.age
+
+# Re-key all secrets after adding a new host key to secrets/secrets.nix
+agenix -r
+```
+
+## Architecture
+
+### Entry Points
+
+- `flake.nix` — defines inputs (nixpkgs stable=25.11, unstable, home-manager, agenix, lanzaboote, jovian-nixos, microvm, impermanence, noctalia) and calls `hosts/default.nix` for `nixosConfigurations`
+- `hosts/default.nix` — instantiates every host via `lib.nixosSystem`; contains the `mkHM` helper that wires home-manager into a host's modules list
+
+### Host Structure
+
+Each host lives in `hosts/<name>/`:
+- `default.nix` — imports either `../../modules/desktop` or `../../modules/server`, sets the module options (`myDesktop.*` / `myServer.*`), and adds host-specific settings
+- `home.nix` — host-specific home-manager config (merged with `hosts/home.nix` for desktops or `hosts/home_server.nix` for servers)
+- `hardware-configuration.nix` — generated hardware config
+
+Shared host-level files:
+- `hosts/configuration_common.nix` — applied to every host: SSH (key-only, no root), locale, nix GC/settings, zsh, fonts, auto-upgrade flake URL
+- `hosts/home.nix` — desktop home-manager base
+- `hosts/home_server.nix` — server home-manager base
+
+### Module System
+
+Two top-level NixOS modules expose all major knobs as typed options:
+
+**`modules/desktop/default.nix`** — `myDesktop.*`
+- `windowManager`: `"niri"` (default) | `"sway"` | `"kde"`
+- `cpu`: `"amd"` | `"intel"` | `"none"` — selects KVM kernel params
+- `virtualisation.enable` — podman (docker-compat) + qemu/libvirt + virt-manager
+- `syncthing.{enable,devices,folders}`
+- `openrgb.{enable,motherboard}`
+- `laptop.{enable,lidSwitch,hibernateDelaySec}`
+- `nitrokey.enable`
+- `niri.hotkeyVariant`: `"default"` | `"lifebook"`
+- `git.signingKey` — SSH key for commit signing
+- `extraSystemPackages`
+
+**`modules/server/default.nix`** — `myServer.*`
+- `sshPort` (default 2220)
+- `virtualisation.{enable,cpu}` — podman only (no libvirt)
+- `fail2ban.enable`
+- `autoUpgrade.enable` (default true)
+- `uid`, `sudoRequiresPassword`, `extraGroups`, `extraSystemPackages`
+
+Service bundles are imported as lists in host `default.nix`:
+- `modules/services/server/` — kabtop services (gitea, nextcloud, matrix, coturn, hydra, mealie, etc.)
+- `modules/services/nas/` — jupiter services (nfs, vaultwarden, syncthing, paperless)
+- `modules/services/dmz/` — dmz services (gitea runner microVM)
+- `modules/services/kabtopci/` — kabtopci services (hydra, gitea runner)
+- `modules/services/nasbackup/` — nasbak backup jobs
+
+### Secrets (agenix)
+
+`secrets/secrets.nix` declares which age public keys (users + host SSH keys) can decrypt each `.age` file. Add a new host: add its `ssh-ed25519` host key to `secrets/secrets.nix` in the relevant groups, then run `agenix -r` to re-key.
+
+### Custom Packages & Overlays
+
+- `packages/` — custom packages (e.g. `corosync-qdevice`), imported at `flake.nix` level
+- `overlays/` — nixpkgs overlays applied globally
+- Per-host overlays: set `nixpkgs.overlays` inside the host's `default.nix` so only that host is affected
+
+### Disk Layouts
+
+`disko/` contains reusable disko modules: `btrfs.nix`, `btrfs_luks.nix`, `nas_luks.nix` — referenced during initial install.
+
+## Active Hosts
+
+| Host | Role | WM / Notes |
+|---|---|---|
+| hades | Desktop | niri, AMD, Secure Boot (lanzaboote) |
+| lifebook | Laptop | niri, Intel, Secure Boot |
+| steamdeck | Gaming | KDE/Jovian-NixOS, Secure Boot |
+| kabtop | Main server | gitea, nextcloud, matrix+bridges, coturn, hydra, mealie |
+| kabtopci | CI server | hydra, nix-serve |
+| jupiter | NAS | nfs, vaultwarden, syncthing, paperless |
+| dmz | DMZ | gitea Actions homerunner microVM |
+| nasbak | NAS backup | — |
+| kubemaster-1 | K8s master | — |
+
+See `SERVICES.md` for port-level service details per host.
--- a/disko/nas_luks.nix
+++ b/disko/nas_luks.nix
@@ -26,11 +26,11 @@
                      mountpoint = "/mnt/Pluto";
                      mountOptions = ["compress=zstd" "noatime" "ssd" "discard=async"];
                    };
-                    "@/Backups";
-                    "@/Media";
-                    "@/Games";
-                    "@/IT";
-                    "@/Rest";
+                    "@/Backups" = {};
+                    "@/Media" = {};
+                    "@/Games" = {};
+                    "@/IT" = {};
+                    "@/Rest" = {};
                    "@snapshots" = {
                      mountpoint = "/mnt";
                      mountOptions = ["compress=zstd" "noatime" "ssd" "discard=async"];
--- a/flake.lock
+++ b/flake.lock
@@ -25,11 +25,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1773189535,
-        "narHash": "sha256-E1G/Or6MWeP+L6mpQ0iTFLpzSzlpGrITfU2220Gq47g=",
+        "lastModified": 1777242778,
+        "narHash": "sha256-VWTeqWeb8Sel/QiWyaPvCa9luAbcGawR+Rw09FJoHz0=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "6fa2fb4cf4a89ba49fc9dd5a3eb6cde99d388269",
+        "rev": "ad8b31ad0ba8448bd958d7a5d50d811dc5d271c0",
        "type": "github"
      },
      "original": {
@@ -126,11 +126,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776373306,
-        "narHash": "sha256-iAJIzHngGZeLIkjzuuWI6VBsYJ1n89a/Esq0m8R1vjs=",
+        "lastModified": 1777679572,
+        "narHash": "sha256-egYNbRrkn+6SwTHinhdb6WUfzzdC3nXfCRqS321VylY=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "d401492e2acd4fea42f7705a3c266cea739c9c36",
+        "rev": "9cb587ade2aa1b4a7257f0238d41072690b0ca4f",
        "type": "github"
      },
      "original": {
@@ -208,11 +208,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776335039,
-        "narHash": "sha256-2lkQhrv6YUCeMlC/lclzq9vkTALv/ptv7d0jIhZnrPQ=",
+        "lastModified": 1777614199,
+        "narHash": "sha256-k8fgidVoDNQTZWGLdhe6kLgpsLcydhPzal5YKVwxD2U=",
        "owner": "Jovian-Experiments",
        "repo": "Jovian-NixOS",
-        "rev": "cbdf76c063b48d5d755fb26540367b8c2457c2ca",
+        "rev": "79f3e3cc5c643138b7b3405c42681451be85d838",
        "type": "github"
      },
      "original": {
@@ -231,11 +231,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1776248416,
-        "narHash": "sha256-TC6yzbCAex1pDfqUZv9u8fVm8e17ft5fNrcZ0JRDOIQ=",
+        "lastModified": 1777299656,
+        "narHash": "sha256-c0r3xXp2+xFJwkryS+nhyQwoACbFzSt4C1TVs3QMh8E=",
        "owner": "nix-community",
        "repo": "lanzaboote",
-        "rev": "18e9e64bae15b828c092658335599122a6db939b",
+        "rev": "079c608988c2747db3902c9de033572cd50e8656",
        "type": "github"
      },
      "original": {
@@ -290,11 +290,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1776983936,
+        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
        "type": "github"
      },
      "original": {
@@ -322,11 +322,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1776169885,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "lastModified": 1777578337,
+        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
        "type": "github"
      },
      "original": {
@@ -338,11 +338,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1776221942,
-        "narHash": "sha256-FbQAeVNi7G4v3QCSThrSAAvzQTmrmyDLiHNPvTF2qFM=",
+        "lastModified": 1777428379,
+        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1766437c5509f444c1b15331e82b8b6a9b967000",
+        "rev": "755f5aa91337890c432639c60b6064bb7fe67769",
        "type": "github"
      },
      "original": {
@@ -360,11 +360,11 @@
        "noctalia-qs": "noctalia-qs"
      },
      "locked": {
-        "lastModified": 1776302695,
-        "narHash": "sha256-xZc9o1JLQpmWn2Dqui323+Tq2Ai4sSdtdvbFZCs4qLo=",
+        "lastModified": 1777427472,
+        "narHash": "sha256-kqcfLdxb+CqTroMErCScvx6YQcZYJcf6X+z5I8kBJK8=",
        "owner": "noctalia-dev",
        "repo": "noctalia-shell",
-        "rev": "a7c724181fca5d1aff2d47b18fa733504cfdbda2",
+        "rev": "9f8dd48c8df5ab1f7f87ddf9842627e1e5682186",
        "type": "github"
      },
      "original": {
@@ -383,11 +383,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1775957204,
-        "narHash": "sha256-d4CVRtAty2GzDYXx4xYQmR+nlOjjKovyprQfZhgLckU=",
+        "lastModified": 1777380063,
+        "narHash": "sha256-q5mWOEICcZzr+KnjIwDHV9EXiBxOC9cnBpxZbDAViU8=",
        "owner": "noctalia-dev",
        "repo": "noctalia-qs",
-        "rev": "68e82fe34c68ee839a9c37e3466820e266af0c86",
+        "rev": "8742a7a748c43bf44eb6862a8ebd3591ed71502d",
        "type": "github"
      },
      "original": {
@@ -406,11 +406,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772893680,
-        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
+        "lastModified": 1776796298,
+        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
+        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
        "type": "github"
      },
      "original": {
@@ -442,11 +442,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773544328,
-        "narHash": "sha256-Iv+qez54LAz+isij4APBk31VWA//Go81hwFOXr5iWTw=",
+        "lastModified": 1777173302,
+        "narHash": "sha256-ERiu3cbxvnTDxiDcimRA7af7xp6x1y0sRyLGm28Qzz8=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "4f977d776793c8bfbfdd7eca7835847ccc48874e",
+        "rev": "aaec8c50baeaf2f2ba653e8aae71778a2bbbac94",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -5,9 +5,8 @@
 #  flake.nix *
 #   ├─ ./hosts
 #   │   └─ default.nix
-
 {
-  description = "Kabbone's peronal NixOS Flake config";
+  description = "Kabbone's personal NixOS Flake config";

  inputs = {
    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable"; # Nix Packages
@@ -21,12 +20,14 @@

    impermanence.url = "github:nix-community/impermanence";

-      home-manager = {                                                      # User Package Management
+    home-manager = {
+      # User Package Management
      url = "github:nix-community/home-manager/release-25.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-      home-manager-unstable = {                                                      # User Package Management
+    home-manager-unstable = {
+      # User Package Management
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs-unstable";
    };
@@ -50,7 +51,6 @@
      url = "github:noctalia-dev/noctalia-shell";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-
  };

  outputs = {
@@ -65,19 +65,18 @@
    microvm,
    impermanence,
    lanzaboote,
+    noctalia,
    ...
-  } @ inputs: rec {
-    inherit (self) outputs;
+  } @ inputs: let
    systems = [
      #      "aarch64-linux"
      "x86_64-linux"
    ];
-
    forAllSystems = nixpkgs.lib.genAttrs systems;
-  #in {
+  in {
    # Your custom packages
    # Accessible through 'nix build', 'nix shell', etc
-    packages = forAllSystems (system: import ./packages nixpkgs.legacyPackages.${system});
+    packages = forAllSystems (system: import ./packages {pkgs = nixpkgs.legacyPackages.${system};});
    # Formatter for your nix files, available through 'nix fmt'
    # Other options beside 'alejandra' include 'nixpkgs-fmt'
    formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.alejandra);
@@ -91,24 +90,22 @@
    # These are usually stuff you would upstream into home-manager
    #homeManagerModules = import ./modules/home-manager;

-
    nixosConfigurations = ( # NixOS configurations
-      import ./hosts {                                                    # Imports ./hosts/default.nix
+      import ./hosts {
+        # Imports ./hosts/default.nix
        inherit (nixpkgs) lib;
        inherit inputs nixpkgs nixpkgs-unstable nixos-hardware home-manager home-manager-unstable agenix jovian-nixos microvm impermanence lanzaboote; # Also inherit home-manager so it does not need to be defined here.
-        nix.allowedUsers = [ "@wheel" ];
-        security.sudo.execWheelOnly = true;
      }
    );

    hydraJobs = {
-      "steamdeck" = nixosConfigurations.steamdeck.config.system.build.toplevel;
-      "hades" = nixosConfigurations.hades.config.system.build.toplevel;
-      "nasbak" = nixosConfigurations.nasbak.config.system.build.toplevel;
-      "jupiter" = nixosConfigurations.jupiter.config.system.build.toplevel;
-      "lifebook" = nixosConfigurations.lifebook.config.system.build.toplevel;
-      "kabtop" = nixosConfigurations.kabtop.config.system.build.toplevel;
-      "dmz" = nixosConfigurations.dmz.config.system.build.toplevel;
+      "steamdeck" = self.nixosConfigurations.steamdeck.config.system.build.toplevel;
+      "hades" = self.nixosConfigurations.hades.config.system.build.toplevel;
+      "nasbak" = self.nixosConfigurations.nasbak.config.system.build.toplevel;
+      "jupiter" = self.nixosConfigurations.jupiter.config.system.build.toplevel;
+      "lifebook" = self.nixosConfigurations.lifebook.config.system.build.toplevel;
+      "kabtop" = self.nixosConfigurations.kabtop.config.system.build.toplevel;
+      "dmz" = self.nixosConfigurations.dmz.config.system.build.toplevel;
    };
  };
 }
--- a/hosts/configuration_common.nix
+++ b/hosts/configuration_common.nix
@@ -0,0 +1,132 @@
+#
+#  Common configuration shared by all hosts (desktop and server).
+#  Imported by configuration_desktop.nix and configuration_server.nix.
+#
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  user,
+  location,
+  agenix,
+  ...
+}: {
+  imports = [
+    ../modules/hardware/hydraCache.nix
+  ];
+
+  users.users.${user} = {
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
+    ];
+  };
+
+  time.timeZone = "Europe/Berlin";
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_TIME = "de_DE.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+    };
+  };
+
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+
+  fonts.packages = with pkgs; [
+    carlito
+    vegur
+    source-code-pro
+    font-awesome
+    hack-font
+    corefonts
+    intel-one-mono
+    cascadia-code
+  ];
+
+  environment = {
+    variables = {
+      TERMINAL = "alacritty";
+      EDITOR = "nvim";
+      VISUAL = "nvim";
+      BROWSER = "firefox";
+    };
+    systemPackages = with pkgs; [
+      vim
+      git
+      killall
+      pciutils
+      usbutils
+      wget
+      bind
+      dig
+      agenix.packages.${pkgs.system}.default
+      cryptsetup
+      powerline
+      powerline-fonts
+      powerline-symbols
+      tree
+      direnv
+      linuxPackages_latest.cpupower
+      btop
+    ];
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  programs.zsh.enable = true;
+
+  nix = {
+    settings = {
+      auto-optimise-store = true;
+      allowed-users = ["@wheel"];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.permittedInsecurePackages = [
+    "olm-3.2.16"
+  ];
+
+  security = {
+    sudo.execWheelOnly = true;
+    pki.certificateFiles = [
+      ./rootCA.pem
+    ];
+  };
+
+  system = {
+    stateVersion = "23.05";
+    autoUpgrade = {
+      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
+      randomizedDelaySec = "5m";
+      allowReboot = true;
+      rebootWindow = {
+        lower = "02:00";
+        upper = "05:00";
+      };
+    };
+  };
+}
--- a/hosts/configuration_desktop.nix
+++ b/hosts/configuration_desktop.nix
@@ -1,201 +0,0 @@
-#
-#  Main system configuration. More information available in configuration.nix(5) man page.
-#
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ configuration.nix *
-#   └─ ./modules
-#       └─ ./editors
-#           └─ ./nvim
-#               └─ default.nix
-#
-
-{ config, lib, pkgs, pkgs-stable, inputs, user, location, agenix, ... }:
-
-{
-  imports =                                 # Import window or display manager.
-    [
-      #../modules/editors/nvim              # ! Comment this out on first install !
-    ];
-
-  users.users.${user} = {                   # System User
-    isNormalUser = true;
-    extraGroups = [ "wheel" "video" "audio" "camera" "networkmanager" "lp" "kvm" "libvirtd" "adb" "dialout" "tss" ];
-    shell = pkgs.zsh;                       # Default shell
-    uid = 2000;
-#    initialPassword = "password95";
-    openssh.authorizedKeys.keys = [
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
-    ];
-  };
-
-  time.timeZone = "Europe/Berlin";        # Time zone and internationalisation
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    extraLocaleSettings = {                 # Extra locale settings that need to be overwritten
-      LC_TIME = "de_DE.UTF-8";
-      LC_MONETARY = "de_DE.UTF-8";
-    };
-  };
-
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "us";	                    # or us/azerty/etc
-  };
-
-  security = {
-    pam.services.login.enableGnomeKeyring = true;
-    rtkit.enable = true;
-    pki.certificateFiles = [
-      ./rootCA.pem
-    ];
-    #tpm2 = {
-    #    enable = true;
-    #    pkcs11.enable = true;
-    #    tctiEnvironment.enable = true;
-    #  };
-  };
-
-  #sound = {                                 # ALSA sound enable
-  ##  #enable = true;
-  #  mediaKeys = {                           # Keyboard Media Keys (for minimal desktop) enable = true;
-  #    enable = true;
-  #  };
-  #};
-
-  fonts.packages = with pkgs; [                # Fonts
-    carlito                                 # NixOS
-    vegur                                   # NixOS
-    source-code-pro
-    font-awesome                            # Icons
-    hack-font
-    corefonts                               # MS
-    intel-one-mono
-    cascadia-code
-  ];
-
-  environment = {
-    variables = {
-      TERMINAL = "alacritty";
-      EDITOR = "nvim";
-      VISUAL = "nvim";
-      BROWSER = "firefox";
-    };
-    systemPackages = (with pkgs; [           # Default packages install system-wide
-      vim
-      git
-      killall
-      pciutils
-      usbutils
-      wget
-      file
-      powertop
-      cpufrequtils
-      lm_sensors
-      libva-utils
-      at-spi2-core
-      bind
-      dig
-      qmk-udev-rules
-      gptfdisk
-      agenix.packages.x86_64-linux.default
-      age-plugin-yubikey
-      pwgen
-      cryptsetup
-      powerline
-      powerline-fonts
-      powerline-symbols
-      tree
-      direnv
-      linuxPackages_latest.cpupower
-      linuxPackages_latest.turbostat
-      btop
-      sbctl
-      ausweisapp
-      e2fsprogs
-    ])
-
-    ++
-
-    (with pkgs-stable; [
-      orca-slicer
-    ]);
-  };
-
-  services = {
-    pipewire = {                            # Sound
-      enable = true;
-      alsa = {
-        enable = true;
-      #  support32Bit = true;
-      };
-      pulse.enable = true;
-      wireplumber.enable = true;
-    };
-    openssh = {                             # SSH: secure shell (remote connection to shell of server)
-      enable = true;                        # local: $ ssh <user>@<ip>
-      settings = {
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-      };
-#      extraConfig = ''
-#        HostKeyAlgorithms +ssh-rsa
-#      '';                                   # Temporary extra config so ssh will work in guacamole
-    };
-    pcscd.enable = true;
-    yubikey-agent.enable = true;
-    udev.packages = [ pkgs.yubikey-personalization pkgs.nitrokey-udev-rules ];
-    flatpak.enable = true;                  # download flatpak file from website - sudo flatpak install <path> - reboot if not showing up
-                                            # sudo flatpak uninstall --delete-data <app-id> (> flatpak list --app) - flatpak uninstall --unused
-                                            # List:
-                                            # com.obsproject.Studio
-                                            # com.parsecgaming.parsec
-                                            # com.usebottles.bottles
-    gvfs.enable = true;
-    fwupd.enable = true;
-  };
-
-  programs = {                              # No xbacklight, this is the alterantive
-    zsh.enable = true;
-    dconf.enable = true;
-  };
-  
-
-  nix = {                                   # Nix Package Manager settings
-    settings ={
-      auto-optimise-store = true;           # Optimise syslinks
-    };
-    gc = {                                  # Automatic garbage collection
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-    package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    extraOptions = ''
-      experimental-features = nix-command flakes
-    '';
-  };
-  nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.permittedInsecurePackages = [
-    "olm-3.2.16"
-    "mbedtls-2.28.10"
-  ];
-
-  system = {                                # NixOS settings
-    autoUpgrade = {                         # Allow auto update
-      enable = false;
-      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
-      randomizedDelaySec = "5m";
-      allowReboot = true;
-      rebootWindow = {
-          lower = "02:00";
-          upper = "05:00";
-      };
-      #channel = "https://nixos.org/channels/nixos-unstable";
-    };
-    stateVersion = "23.05";
-  };
-}
--- a/hosts/configuration_server.nix
+++ b/hosts/configuration_server.nix
@@ -1,155 +1,44 @@
 #
-#  Main system configuration. More information available in configuration.nix(5) man page.
+#  Server configuration. Imports configuration_common.nix for shared settings.
+#  Service modules are imported per-host.
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ configuration.nix *
-#   └─ ./modules
-#       └─ ./editors
-#           └─ ./nvim
-#               └─ default.nix
-#
-
-{ config, lib, pkgs, inputs, user, location, agenix, ... }:
-
 {
-  imports =                                 # Import window or display manager.
-    [
-     #../modules/editors/nvim              # ! Comment this out on first install !
+  config,
+  lib,
+  pkgs,
+  inputs,
+  user,
+  location,
+  agenix,
+  ...
+}: {
+  imports = [
+    ./configuration_common.nix
  ];

-  users.users.${user} = {                   # System User
+  users.users.${user} = {
    isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "kvm" "libvirtd" ];
-    shell = pkgs.zsh;                       # Default shell
    uid = 3000;
-#    initialPassword = "password95";
-    openssh.authorizedKeys.keys = [
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
-    ];
-  };
-  security.sudo.wheelNeedsPassword = true; # User does not need to give password when using sudo.
-
-  time.timeZone = "Europe/Berlin";        # Time zone and internationalisation
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    extraLocaleSettings = {                 # Extra locale settings that need to be overwritten
-      LC_TIME = "de_DE.UTF-8";
-      LC_MONETARY = "de_DE.UTF-8";
-    };
+    extraGroups = ["wheel" "networkmanager" "kvm" "libvirtd"];
  };

-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "us";	                    # or us/azerty/etc
-  };
+  security.sudo.wheelNeedsPassword = true;

-  security = {
-    rtkit.enable = true;
-    pki.certificateFiles = [
-      ./rootCA.pem
-    ];
-  };
-
-  fonts.packages = with pkgs; [                # Fonts
-    carlito                                 # NixOS
-    vegur                                   # NixOS
-    source-code-pro
-    font-awesome                            # Icons
-    hack-font
-    corefonts                               # MS
-    intel-one-mono
-    cascadia-code
-  ];
-
-  environment = {
-    variables = {
-      TERMINAL = "alacritty";
-      EDITOR = "nvim";
-      VISUAL = "nvim";
-      BROWSER = "firefox";
-    };
-    systemPackages = with pkgs; [           # Default packages install system-wide
-      vim
-      git
-      killall
-      pciutils
-      usbutils
-      wget
-      powertop
-      cpufrequtils
-      lm_sensors
-      bind
-      dig
-      agenix.packages.x86_64-linux.default
+  environment.systemPackages = with pkgs; [
    ffmpeg
    smartmontools
-      cryptsetup
-      powerline
-      powerline-fonts
-      powerline-symbols
-      tree
-      direnv
-      linuxPackages_latest.cpupower
-      btop
    htop
  ];
-  };

-  services = {
-    openssh = {                             # SSH: secure shell (remote connection to shell of server)
-      enable = true;                        # local: $ ssh <user>@<ip>
-      settings = {
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-      };
+  services.openssh = {
    ports = [2220];
    openFirewall = true;
  };

-    #flatpak.enable = true;                  # download flatpak file from website - sudo flatpak install <path> - reboot if not showing up
-                                            # sudo flatpak uninstall --delete-data <app-id> (> flatpak list --app) - flatpak uninstall --unused
-  };
-
-  programs = {
-    zsh.enable = true;
-  };
-
-  nix = {                                   # Nix Package Manager settings
-    settings ={
-      auto-optimise-store = true;           # Optimise syslinks
-    };
-    gc = {                                  # Automatic garbage collection
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-    package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    extraOptions = ''
-      experimental-features = nix-command flakes
+  nix.extraOptions = ''
    keep-outputs          = true
    keep-derivations      = true
  '';
-  };
-  nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.permittedInsecurePackages = [
-    "olm-3.2.16"
-  ];

-  system = {                                # NixOS settings
-    autoUpgrade = {                         # Allow auto update
-      enable = true;
-      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
-      randomizedDelaySec = "5m";
-      allowReboot = true;
-      rebootWindow = {
-          lower = "02:00";
-          upper = "05:00";
-      };
-    };
-    stateVersion = "23.05";
-  };
+  system.autoUpgrade.enable = true;
 }
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -4,252 +4,239 @@
 #  flake.nix
 #   └─ ./hosts
 #       ├─ default.nix *
-#       ├─ configuration.nix
+#       ├─ configuration_common.nix
+#       ├─ configuration_desktop.nix
+#       ├─ configuration_server.nix
 #       ├─ home.nix
 #       └─ ./desktop OR ./laptop OR ./vm
 #            ├─ ./default.nix
 #            └─ ./home.nix
 #
+{
+  lib,
+  inputs,
+  nixpkgs,
+  nixpkgs-unstable,
+  nixos-hardware,
+  home-manager,
+  home-manager-unstable,
+  agenix,
+  jovian-nixos,
+  microvm,
+  impermanence,
+  lanzaboote,
+  ...
+}: let
+  # Default user — desktop hosts share this; server hosts may override per-host
+  # by passing a different `user` value in their own specialArgs block.
+  defaultUser = "kabbone";
+  location = builtins.getEnv "HOME" + "/.setup";

-{ lib, inputs, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, home-manager-unstable, agenix, jovian-nixos, microvm, impermanence, lanzaboote, ... }:
-
-let
-  user = "kabbone";
-  userdmz = "diablo";
-  userserver = "mephisto";
-  location = "$HOME/.setup";
-
-  system = "x86_64-linux";                                  # System architecture
-
-  pkgs = import nixpkgs {
-    inherit system;
-    config.allowUnfree = true;                              # Allow proprietary software
-  };
+  system = "x86_64-linux";

  pkgs-unstable = import nixpkgs-unstable {
    inherit system;
-    config.allowUnfree = true;                              # Allow proprietary software
-  };
-
-  pkgs-stable = import nixpkgs {
-    inherit system;
-    config.allowUnfree = true;                              # Allow proprietary software
+    config.allowUnfree = true;
  };

  pkgs-kabbone = import ../packages {
    inherit system;
-    inherit pkgs;
+    pkgs = import nixpkgs {
+      inherit system;
+      config.allowUnfree = true;
+    };
  };

-  lib = nixpkgs.lib;
-  users.defaultShell = "pkgs.zsh";
-
-in
-{
-  hades = lib.nixosSystem {                                # Desktop profile
+  pkgs = import nixpkgs {
    inherit system;
-    specialArgs = { inherit inputs pkgs-stable user location nixos-hardware agenix microvm nixpkgs lanzaboote pkgs-kabbone; };
-    modules = [
+    config.allowUnfree = true;
+    # Prefer host-specific overlays over a global one here.
+    # Set nixpkgs.overlays inside the host's own module (e.g. hosts/desktop/default.nix)
+    # so only that host's pkgs is affected. Packages can be imported inline —
+    # no specialArgs needed. See hosts/desktop/default.nix for an example.
+  };
+
+  # Helper: returns [hm-module, config-attrset] for the modules list.
+  # hm        - the home-manager flake input to use (stable or unstable)
+  # user      - the username whose home-manager config to build
+  # hmImports - list of home.nix paths for this host
+  mkHM = hm: user: hmImports: [
+    hm.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = {inherit user;};
+      home-manager.users.${user}.imports = hmImports;
+    }
+  ];
+in {
+  hades = lib.nixosSystem {
+    # Desktop profile
+    inherit system;
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix microvm nixpkgs lanzaboote;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        microvm.nixosModules.host
        lanzaboote.nixosModules.lanzaboote
-      ./desktop
-      ./configuration_desktop.nix
-      ../modules/hardware/hydraCache.nix
+        ./desktop # myDesktop options set inside
+        ./configuration_common.nix
        ../modules/hardware/remoteBuilder.nix
        nixos-hardware.nixosModules.common-cpu-amd
        nixos-hardware.nixosModules.common-gpu-amd
        nixos-hardware.nixosModules.common-pc-ssd
-      
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home.nix)] ++ [(import ./desktop/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home.nix ./desktop/home.nix]);
  };

-  lifebook = lib.nixosSystem {                                # Laptop profile
+  lifebook = lib.nixosSystem {
+    # Laptop profile
    inherit system;
-    specialArgs = { inherit inputs pkgs-stable user location nixos-hardware agenix lanzaboote; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix lanzaboote;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        lanzaboote.nixosModules.lanzaboote
-      ./lifebook
-      ./configuration_desktop.nix
-      ../modules/hardware/hydraCache.nix
+        ./lifebook # myDesktop options set inside
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-cpu-intel
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home.nix)] ++ [(import ./lifebook/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home.nix ./lifebook/home.nix]);
  };

-  steamdeck = nixpkgs-unstable.lib.nixosSystem {            # steamdeck profile
+  steamdeck = nixpkgs-unstable.lib.nixosSystem {
+    # steamdeck profile
    inherit system;
-    specialArgs = { inherit inputs pkgs-stable user location nixos-hardware agenix jovian-nixos lanzaboote; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix jovian-nixos lanzaboote;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        jovian-nixos.nixosModules.default
        lanzaboote.nixosModules.lanzaboote
        ./steamdeck
-      ./configuration_desktop.nix
-      ../modules/hardware/hydraCache.nix
-
-      home-manager-unstable.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home.nix)] ++ [(import ./steamdeck/home.nix)];
-        };
-      }
-    ];
+        ./configuration_common.nix
+      ]
+      ++ (mkHM home-manager-unstable defaultUser [./home.nix ./steamdeck/home.nix]);
  };

-  kabtop = lib.nixosSystem {                                # Desktop profile
+  kabtop = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs pkgs-unstable impermanence; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix impermanence;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        microvm.nixosModules.host
        ./kabtop
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-cpu-amd
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./kabtop/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./kabtop/home.nix]);
  };

-  nasbak = lib.nixosSystem {                                # Desktop profile
+  nasbak = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        ./nasbackup
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-cpu-intel
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./nasbackup/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./nasbackup/home.nix]);
  };

-  jupiter = lib.nixosSystem {                                # Desktop profile
+  jupiter = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix pkgs-kabbone; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        ./jupiter
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-cpu-intel
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./jupiter/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./jupiter/home.nix]);
  };

-  kabtopci = lib.nixosSystem {                                # Desktop profile
+  kabtopci = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix impermanence;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        microvm.nixosModules.host
        ./kabtopci
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./kabtopci/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./kabtopci/home.nix]);
  };

-  kubemaster-1 = lib.nixosSystem {                                # Desktop profile
+  kubemaster-1 = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix impermanence;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        microvm.nixosModules.host
        ./kubemaster-1
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-cpu-intel
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./kubemaster-1/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./kubemaster-1/home.nix]);
  };

-  dmz = lib.nixosSystem {                                # Desktop profile
+  dmz = lib.nixosSystem {
+    # Server profile
    inherit system;
-    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
-    modules = [
+    specialArgs = {
+      inherit inputs location nixos-hardware agenix impermanence;
+      user = defaultUser;
+    };
+    modules =
+      [
        agenix.nixosModules.default
        microvm.nixosModules.host
        ./dmz
-      ./configuration_server.nix
-      ../modules/hardware/hydraCache.nix
+        ./configuration_common.nix
        nixos-hardware.nixosModules.common-pc-ssd
-
-      home-manager.nixosModules.home-manager {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.extraSpecialArgs = { inherit user; };
-        home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./dmz/home.nix)];
-        };
-      }
-    ];
+      ]
+      ++ (mkHM home-manager defaultUser [./home_server.nix ./dmz/home.nix]);
  };

  #  vm = lib.nixosSystem {                                    # VM profile
@@ -259,14 +246,7 @@ in
  #      ./vm
  #      ./configuration.nix
  #
-#      home-manager.nixosModules.home-manager {
-#        home-manager.useGlobalPkgs = true;
-#        home-manager.useUserPackages = true;
-#        home-manager.extraSpecialArgs = { inherit user; }; 
-#        home-manager.users.${user} = {
-#          imports = [(import ./home.nix)] ++ [(import ./vm/home.nix)];
-#        };
-#      }
+  #      (mkHM home-manager [ ./home.nix ./vm/home.nix ])
  #    ];
  #  };
 }
--- a/hosts/desktop/default.nix
+++ b/hosts/desktop/default.nix
@@ -1,104 +1,62 @@
 #
-#  Specific system configuration settings for desktop
+#  Hades desktop — system configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ inputs, lib, config, pkgs, user, nixpkgs, pkgs-kabbone, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/niri/default.nix)] ++         # Window Manager
-    (import ../../modules/wm/virtualisation) ++             # libvirt + Docker
-    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
-    #[(import ../../modules/kabbone/corosync-qdevice.nix)] ++   # corosync qdevice quorum
-    (import ../../modules/hardware);                             # Hardware devices
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
+  # Example: host-specific overlays — only hades gets these packages in its pkgs.
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     # pull a single package from unstable (no specialArgs needed)
+  #     firefox          = inputs.nixpkgs-unstable.legacyPackages.${prev.system}.firefox;
+  #     # pull a package from pkgs-kabbone (inline import, no specialArgs needed)
+  #     corosync-qdevice = (import ../../packages { pkgs = prev; }).corosync-qdevice;
+  #   })
+  # ];

-  boot = {                                  # Boot options
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/desktop
+  ];
+
+  # ── Desktop module options ──────────────────────────────────────────────
+  myDesktop.windowManager = "niri";
+  myDesktop.cpu = "amd";
+  myDesktop.virtualisation.enable = true;
+
+  myDesktop.openrgb.enable = true;
+  myDesktop.openrgb.motherboard = "amd";
+
+  myDesktop.syncthing.enable = true;
+  myDesktop.syncthing.devices = {
+    "jupiter.home.opel-online.de" = {id = "T53WU6Z-3NT74ZE-PZVZB2N-7FBTZ5K-HESC2ZM-W4ABDAS-NWXHTGI-ST4CDQR";};
+    "lifebook.home.opel-online.de" = {id = "RKPZG3H-BDUZID3-DV26MKR-UOARIQC-JBCAFXP-J5QFM4H-5EGBSM5-VEGXHQ4";};
+  };
+  myDesktop.syncthing.folders = {
+    "Sync" = {
+      path = "/home/kabbone/Sync";
+      devices = ["jupiter.home.opel-online.de" "lifebook.home.opel-online.de"];
+      ignorePerms = false;
+    };
+  };
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      systemd-boot.enable = lib.mkForce false;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
-      timeout = 1;                          # Grub auto select time
-    };
-
    lanzaboote = {
      enable = true;
      pkiBundle = "/etc/secureboot";
    };
  };

-#  hardware.sane = {                           # Used for scanning with Xsane
-#    enable = false;
-#    extraBackends = [ pkgs.sane-airscan ];
-#  };
-#  hardware = {
-#    nitrokey.enable = true;
-#  };
-
-  environment = {
-    systemPackages = [
-      pkgs.linux-firmware
-      #pkgs-kabbone.corosync-qdevice
-    ];
-  };
-
-  services = {
-    #auto-cpufreq.enable = true;
-    blueman.enable = true;
-    avahi = {                               # Needed to find wireless printer
-      enable = true;
-      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
-        enable = true;
-        addresses = true;
-        userServices = true;
-      };
-    };
-    hardware.openrgb = {
-        enable = true;
-        motherboard = "amd";
-    };
-    syncthing = {
-        enable = true;
-        group = "users";
-        user = "kabbone";
-        dataDir = "/home/${config.services.syncthing.user}/Sync";
-        configDir = "/home/${config.services.syncthing.user}/.config/syncthing";
-        overrideDevices = true;     # overrides any devices added or deleted through the WebUI
-        overrideFolders = true;     # overrides any folders added or deleted through the WebUI
-        openDefaultPorts = true;
-        settings = {
-          devices = {
-            "jupiter.home.opel-online.de" = { id = "T53WU6Z-3NT74ZE-PZVZB2N-7FBTZ5K-HESC2ZM-W4ABDAS-NWXHTGI-ST4CDQR"; };
-            "lifebook.home.opel-online.de" = { id = "RKPZG3H-BDUZID3-DV26MKR-UOARIQC-JBCAFXP-J5QFM4H-5EGBSM5-VEGXHQ4"; };
-          };
-          folders = {
-            "Sync" = {         # Name of folder in Syncthing, also the folder ID
-              path = "/home/${config.services.syncthing.user}/Sync";    # Which folder to add to Syncthing
-              devices = [ "jupiter.home.opel-online.de" "lifebook.home.opel-online.de" ];      # Which devices to share the folder with
-              ignorePerms = false;  # By default, Syncthing doesn't sync file permissions. This line enables it for this folder.
-            };
-          };
-        };
-    };
-  };
+  environment.systemPackages = [pkgs.linux-firmware];
 }
--- a/hosts/desktop/hardware-configuration.nix
+++ b/hosts/desktop/hardware-configuration.nix
@@ -10,12 +10,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")] ++
-      [( import ../../modules/hardware/backup.nix )];
+    [(modulesPath + "/installer/scan/not-detected.nix")]
+    ++ [(import ../../modules/hardware/backup.nix)];

  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod"];
  boot.initrd.kernelModules = ["vfio_pci" "vfio" "vfio_iommu_type1"];
@@ -94,60 +98,59 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part1";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part1";
    fsType = "vfat";
  };

-  fileSystems."/mnt/Pluto" =
-    { device = "jupiter:/Pluto";
+  fileSystems."/mnt/Pluto" = {
+    device = "jupiter:/Pluto";
    fsType = "nfs";
    options = ["noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-  fileSystems."/mnt/Mars" =
-    { device = "jupiter:/Mars";
+  fileSystems."/mnt/Mars" = {
+    device = "jupiter:/Mars";
    fsType = "nfs";
    options = ["noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-
  swapDevices = [{device = "/swap/swapfile";}];

  networking = {
--- a/hosts/desktop/home.nix
+++ b/hosts/desktop/home.nix
@@ -1,52 +1,26 @@
 #
-#  Home-manager configuration for laptop
+#  Hades desktop — home-manager host-specific additions
+#  (WM home config is loaded by modules/desktop based on myDesktop.windowManager)
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │       └─ home.nix *
-#   └─ ./modules
-#       └─ ./desktop
-#           └─ ./hyprland
-#              └─ hyprland.nix
-#
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
-      #../../modules/wm/hyprland/home.nix # Window Manager
-      ../../modules/wm/niri/home.nix # Window Manager
-      ../../modules/home.nix # Window Manager
+{pkgs, ...}: {
+  imports = [
+    ../../modules/home.nix # cmds / theme options
  ];

-  home = {                                # Specific packages for laptop
-    packages = with pkgs; [
-      # Applications
-      #freecad                         # Office packages
-      #firefox
+  home.packages = with pkgs; [
    chromium
    thunderbird
    streamlink
    streamlink-twitch-gui-bin
-      #nheko
    pulsemixer
-      #yubioath-flutter
    nitrokey-app
    kicad
-
-      # Power Management
-      #auto-cpufreq                       # Power management
-      #tlp                                # Power management
  ];
-  };

-  services = {                            # Applets
-   blueman-applet.enable = true;         # Bluetooth
-   network-manager-applet.enable = true; # Network
+  services = {
+    blueman-applet.enable = true;
+    network-manager-applet.enable = true;
  };

  xsession.preferStatusNotifierItems = true;
-
 }
--- a/hosts/dmz/default.nix
+++ b/hosts/dmz/default.nix
@@ -1,59 +1,46 @@
 #
-#  Specific system configuration settings for desktop
+#  DMZ — demilitarised zone server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, agenix, impermanence, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # Docker
-    (import ../../modules/services/dmz);                       # Server Services
+  config,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/dmz);

-  boot = {                                  # Boot options
+  # ── Server module options ───────────────────────────────────────────────
+  myServer.virtualisation.enable = true;
+  myServer.virtualisation.cpu = "intel";
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      systemd-boot.enable = true;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
-      timeout = 1;                          # Grub auto select time
-    };
-  };
-
-  programs = {                              
-    zsh.enable = true;
  };

  services = {
    qemuGuest.enable = true;
-    avahi = {                               # Needed to find wireless printer
+    avahi = {
      enable = true;
      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+      publish = {
        enable = true;
        addresses = true;
        userServices = true;
      };
    };
  };
-
 }
--- a/hosts/dmz/hardware-configuration.nix
+++ b/hosts/dmz/hardware-configuration.nix
@@ -10,11 +10,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  boot.initrd.availableKernelModules = ["uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk"];
@@ -33,44 +37,44 @@
    ];
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/var" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/var" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@var,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };
@@ -103,5 +107,4 @@
      allowedTCPPorts = [80 443];
    };
  };
-
 }
--- a/hosts/dmz/home.nix
+++ b/hosts/dmz/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/fuji/default.nix
+++ b/hosts/fuji/default.nix
@@ -16,21 +16,32 @@
 #       └─ ./hardware
 #           └─ default.nix
 #
-
-{ config, nixpkgs, pkgs, user, lib, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/sway/default.nix)] ++         # Window Manager
-    (import ../../modules/wm/virtualisation) ++             # libvirt + Docker
-    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
+  config,
+  nixpkgs,
+  pkgs,
+  user,
+  lib,
+  ...
+}: {
+  imports =
+    # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)]
+    ++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    [(import ../../modules/wm/sway/default.nix)]
+    ++ # Window Manager
+    (import ../../modules/wm/virtualisation)
+    ++ # libvirt + Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)]
+    ++ # kvm module options
    (import ../../modules/hardware); # Hardware devices

-  boot = {                                  # Boot options
+  boot = {
+    # Boot options
    kernelPackages = pkgs.linuxPackages_latest;

-    loader = {                              # EFI Boot
+    loader = {
+      # EFI Boot
      systemd-boot.enable = lib.mkForce false;
      efi = {
        canTouchEfiVariables = true;
@@ -64,15 +75,16 @@
  services = {
    #auto-cpufreq.enable = true;
    blueman.enable = true;
-    avahi = {                               # Needed to find wireless printer
+    avahi = {
+      # Needed to find wireless printer
      enable = true;
      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+      publish = {
+        # Needed for detecting the scanner
        enable = true;
        addresses = true;
        userServices = true;
      };
    };
  };
-
 }
--- a/hosts/fuji/hardware-configuration.nix
+++ b/hosts/fuji/hardware-configuration.nix
@@ -10,12 +10,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")] ++
-      [( import ../../modules/hardware/backup.nix )];
+    [(modulesPath + "/installer/scan/not-detected.nix")]
+    ++ [(import ../../modules/hardware/backup.nix)];

  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod"];
  boot.initrd.kernelModules = ["vfio_pci" "vfio" "vfio_iommu_type1"];
@@ -59,48 +63,47 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part1";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part1";
    fsType = "vfat";
  };

-
  swapDevices = [{device = "/swap/swapfile";}];

  networking = {
--- a/hosts/fuji/home.nix
+++ b/hosts/fuji/home.nix
@@ -10,18 +10,15 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    #../../modules/wm/hyprland/home.nix # Window Manager
    #../../modules/wm/kde/home.nix # Window Manager
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications
      #firefox
@@ -35,11 +32,11 @@
    ];
  };

-  services = {                            # Applets
+  services = {
+    # Applets
    #blueman-applet.enable = true;         # Bluetooth
    network-manager-applet.enable = true; # Network
  };

  xsession.preferStatusNotifierItems = true;
-
 }
--- a/hosts/home.nix
+++ b/hosts/home.nix
@@ -14,16 +14,19 @@
 #       └─ ./shell
 #           └─ default.nix
 #
-
-{ config, lib, pkgs, user, pkgs-stable, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  user,
+  ...
+}: {
  imports =
-    (import ../modules/editors) ++
-    (import ../modules/programs) ++
-    (import ../modules/programs/configs) ++
-    (import ../modules/services) ++
-    (import ../modules/shell);
+    (import ../modules/editors)
+    ++ (import ../modules/programs)
+    ++ (import ../modules/programs/configs)
+    ++ (import ../modules/services)
+    ++ (import ../modules/shell);

  home = {
    username = "${user}";
@@ -47,6 +50,7 @@
      screen
      yubioath-flutter
      nitrokey-app
+      claude-code

      tailscale
      wireguard-tools
@@ -96,7 +100,6 @@
      })

      sdkmanager
-      android-tools
    ];

    file.".config/wall".source = ../modules/themes/wall.jpg;
@@ -117,7 +120,6 @@
    };
  };

-
  #  gtk = {                                     # Theming
  #    enable = true;
  #    theme = {
--- a/hosts/home_server.nix
+++ b/hosts/home_server.nix
@@ -14,12 +14,17 @@
 #       └─ ./shell
 #           └─ default.nix
 #
-
-{ config, lib, pkgs, user, ... }:
-
 {
-  imports =                                   # Home Manager Modules
-    (import ../modules/editors) ++
+  config,
+  lib,
+  pkgs,
+  user,
+  ...
+}: {
+  imports =
+    # Home Manager Modules
+    (import ../modules/editors)
+    ++
    #(import ../modules/programs) ++
    #(import ../modules/programs/configs) ++
    #(import ../modules/services) ++
@@ -48,7 +53,6 @@
      rsync # Syncer $ rsync -r dir1/ dir2/
      #unzip             # Zip files
      #unrar             # Rar files
-
    ];
    stateVersion = "23.11";
  };
--- a/hosts/jupiter/default.nix
+++ b/hosts/jupiter/default.nix
@@ -1,55 +1,44 @@
 #
-#  Specific system configuration settings for desktop
+#  Jupiter — NAS server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, pkgs-kabbone, ... }:
-
 {
-  imports =                                                         # For now, if applying to other ssystem, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #(import ../../modules/wm/virtualisation) ++   # Docker
-    (import ../../modules/services/nas) ++                       # Server Services
-    (import ../../modules/hardware);                                # Hardware devices
+  config,
+  pkgs,
+  inputs,
+  user,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/nas);

-  boot = {                                  # Boot options
-    kernelPackages = pkgs.linuxPackages_latest;
+  # ── Server module options ───────────────────────────────────────────────
+  # No virtualisation on the NAS

-    loader = {                              # EFI Boot
-      systemd-boot.enable = true;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
-      };
-      timeout = 1;                          # Grub auto select time
-    };
-  };
+  # ── Host-specific settings ──────────────────────────────────────────────

-#  environment = {
-#    systemPackages = with pkgs-kabbone; [
-#      corosync-qdevice
-###      simple-scan
-###       intel-media-driver
-###       alacritty
+  # Example: host-specific overlay — only jupiter gets these packages in its pkgs.
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     corosync-qdevice = (import ../../packages { pkgs = prev; }).corosync-qdevice;
+  #     firefox          = inputs.nixpkgs-unstable.legacyPackages.${prev.system}.firefox;
+  #   })
  # ];
-#  };
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
+    };
+  };

  programs = {
-    zsh.enable = true;
    ssh.startAgent = false;
    gnupg.agent = {
      enable = false;
@@ -60,16 +49,14 @@

  services = {
    qemuGuest.enable = true;
-    avahi = {                               # Needed to find wireless printer
+    avahi = {
      enable = true;
      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+      publish = {
        enable = true;
        addresses = true;
        userServices = true;
      };
    };
-
  };
-
 }
--- a/hosts/jupiter/hardware-configuration.nix
+++ b/hosts/jupiter/hardware-configuration.nix
@@ -10,12 +10,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
  imports =
-    [(modulesPath + "/profiles/qemu-guest.nix")] ++
-    [( import ../../modules/hardware/backup.nix )];
+    [(modulesPath + "/profiles/qemu-guest.nix")]
+    ++ [(import ../../modules/hardware/backup.nix)];

  boot.initrd.availableKernelModules = ["uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk"];
  boot.initrd.kernelModules = [];
@@ -112,78 +116,78 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-    fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-    fileSystems."/mnt/snapshots/Mars" =
-    { device = "/dev/disk/by-label/MARS";
+  fileSystems."/mnt/snapshots/Mars" = {
+    device = "/dev/disk/by-label/MARS";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-  fileSystems."/mnt/snapshots/Pluto" =
-    { device = "/dev/disk/by-label/NAS-RAID";
+  fileSystems."/mnt/snapshots/Pluto" = {
+    device = "/dev/disk/by-label/NAS-RAID";
    fsType = "btrfs";
    options = ["compress=zstd:8,noatime,subvolid=5"];
  };

-  fileSystems."/mnt/Pluto" =
-    { device = "/dev/disk/by-label/NAS-RAID";
+  fileSystems."/mnt/Pluto" = {
+    device = "/dev/disk/by-label/NAS-RAID";
    fsType = "btrfs";
    options = ["compress=zstd:8,noatime,subvol=@"];
  };

-  fileSystems."/mnt/Mars" =
-    { device = "/dev/disk/by-label/MARS";
+  fileSystems."/mnt/Mars" = {
+    device = "/dev/disk/by-label/MARS";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nas,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/NIXBOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/NIXBOOT";
    fsType = "vfat";
  };

-  fileSystems."/export/Pluto" =
-    { device = "/mnt/Pluto";
+  fileSystems."/export/Pluto" = {
+    device = "/mnt/Pluto";
    options = ["bind"];
  };

-  fileSystems."/export/Mars" =
-    { device = "/mnt/Mars";
+  fileSystems."/export/Mars" = {
+    device = "/mnt/Mars";
    options = ["bind"];
  };

@@ -234,5 +238,4 @@
      ${pkgs.hdparm}/sbin/hdparm -S 150 /dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088
    '';
  };
-  
 }
--- a/hosts/jupiter/home.nix
+++ b/hosts/jupiter/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/kabtop/default.nix
+++ b/hosts/kabtop/default.nix
@@ -1,45 +1,39 @@
 #
-#  Specific system configuration settings for desktop
+#  Kabtop — server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, pkgs-unstable, user, agenix, impermanence, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++  # kvm module options
-    (import ../../modules/services/server);                     # Server Services
+  config,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/server);

-  boot = {                                  # Boot options
+  # ── Server module options ───────────────────────────────────────────────
+  myServer.virtualisation.enable = true;
+  myServer.virtualisation.cpu = "amd";
+  myServer.fail2ban.enable = true;
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      grub = {
        enable = true;
        device = "/dev/sda";
      };
-      timeout = 1;                          # Grub auto select time
+      timeout = 1;
    };
  };

-  environment = {
-    etc = {
+  environment.etc = {
    "fail2ban/filter.d/open-webui.conf" = {
      source = ../../modules/services/server/fail2ban/filter/open-webui.conf;
      mode = "0444";
@@ -53,10 +47,8 @@
      mode = "0444";
    };
  };
-  };

  programs = {
-    zsh.enable = true;
    ssh.startAgent = false;
    gnupg.agent = {
      enable = true;
@@ -65,47 +57,5 @@
    };
  };

-  services = {
-    #auto-cpufreq.enable = true;
-    qemuGuest.enable = true;
-    #avahi = {                               # Needed to find wireless printer
-    #  enable = true;
-    #  nssmdns = true;
-    #  publish = {                           # Needed for detecting the scanner
-    #    enable = true;
-    #    addresses = true;
-    #    userServices = true;
-    #  };
-    #};
-    fail2ban = {
-        enable = true;
-        maxretry = 5;
-        jails.DEFAULT.settings = {
-           findtime = "15m";
-        };
-        jails = {
-            open-webui = ''
-              enabled = true
-              filter = open-webui
-              backend = systemd
-              action = iptables-allports
-            '';
-            gitea = ''
-              enabled = true
-              filter = gitea
-              backend = systemd
-              action = iptables-allports
-            '';
-            nextcloud = ''
-              backend = auto
-              enabled = true
-              filter = nextcloud
-              logpath = /var/lib/nextcloud/data/nextcloud.log
-              action = iptables-allports
-            '';
-          };
-    };
-
-  };
-
+  services.qemuGuest.enable = true;
 }
--- a/hosts/kabtop/hardware-configuration.nix
+++ b/hosts/kabtop/hardware-configuration.nix
@@ -10,11 +10,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sd_mod" "sr_mod"];
@@ -61,49 +65,48 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/var" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/var" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["space_cache=v2,ssd,noatime,subvol=@var,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-
  #swapDevices = [ { device = "/swap/swapfile"; } ];
  swapDevices = [];

@@ -144,6 +147,5 @@
    };
  };

-
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/kabtop/home.nix
+++ b/hosts/kabtop/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/kabtopci/default.nix
+++ b/hosts/kabtopci/default.nix
@@ -1,45 +1,34 @@
 #
-#  Specific system configuration settings for desktop
+#  Kabtopci — CI server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, agenix, impermanence, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # Docker
-    (import ../../modules/services/kabtopci);                       # Server Services
+  config,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/kabtopci);

-  boot = {                                  # Boot options
+  # ── Server module options ───────────────────────────────────────────────
+  myServer.virtualisation.enable = true;
+  myServer.virtualisation.cpu = "amd";
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      grub = {
        enable = true;
        device = "/dev/vda";
      };
-      timeout = 1;                          # Grub auto select time
+      timeout = 1;
    };
  };
-
-  programs = {
-    zsh.enable = true;
-  };
-
 }
--- a/hosts/kabtopci/hardware-configuration.nix
+++ b/hosts/kabtopci/hardware-configuration.nix
@@ -10,11 +10,14 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")];
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [(modulesPath + "/installer/scan/not-detected.nix")];

  boot.initrd.availableKernelModules = ["ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sr_mod" "virtio_blk"];
  boot.initrd.kernelModules = ["vfio_pci" "vfio" "vfio_iommu_type1"];
@@ -32,38 +35,38 @@
    ];
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/var" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/var" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["space_cache=v2,ssd,noatime,subvol=@var,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd:9,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };
@@ -80,14 +83,18 @@
    interfaces = {
      ens3 = {
        useDHCP = false; # For versatility sake, manually edit IP on nm-applet.
-        ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
            address = "195.90.221.87";
            prefixLength = 22;
-        } ];
-        ipv6.addresses = [ {
+          }
+        ];
+        ipv6.addresses = [
+          {
            address = "2a00:6800:3:d5b::2";
            prefixLength = 64;
-        } ];
+          }
+        ];
      };
    };
    defaultGateway = "195.90.220.1";
--- a/hosts/kabtopci/home.nix
+++ b/hosts/kabtopci/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/kubemaster-1/default.nix
+++ b/hosts/kubemaster-1/default.nix
@@ -1,58 +1,43 @@
 #
-#  Specific system configuration settings for desktop
+#  Kubemaster-1 — Kubernetes master server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, agenix, impermanence, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # Docker
-    (import ../../modules/services/kubemaster);                       # Server Services
+  config,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/kubemaster);

-  boot = {                                  # Boot options
+  # ── Server module options ───────────────────────────────────────────────
+  myServer.virtualisation.enable = true;
+  myServer.virtualisation.cpu = "intel";
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      systemd-boot.enable = true;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
-      };
-      timeout = 1;                          # Grub auto select time
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
  };

-  programs = {                             
-    zsh.enable = true;
-  };
-
-  services = {
-    avahi = {                               # Needed to find wireless printer
+  services.avahi = {
    enable = true;
    nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+    publish = {
      enable = true;
      addresses = true;
      userServices = true;
    };
  };
-  };
-
 }
--- a/hosts/kubemaster-1/hardware-configuration.nix
+++ b/hosts/kubemaster-1/hardware-configuration.nix
@@ -10,11 +10,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
  ];

  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod"];
@@ -33,44 +37,44 @@
    ];
  };

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/var" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/var" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@var,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };
@@ -113,5 +117,4 @@
    '';
  };
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
 }
--- a/hosts/kubemaster-1/home.nix
+++ b/hosts/kubemaster-1/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/lifebook/default.nix
+++ b/hosts/lifebook/default.nix
@@ -1,99 +1,60 @@
 #
-#  Specific system configuration settings for desktop
+#  Lifebook laptop — system configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ inputs, lib, config, pkgs, user, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/wm/niri/default.nix)] ++        # Window Manager
-    (import ../../modules/wm/virtualisation) ++             # libvirt + Docker
-    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # kvm module options
-    (import ../../modules/hardware);                                # Hardware devices
+  lib,
+  pkgs,
+  user,
+  ...
+}: {
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/desktop
+  ];

-  boot = {                                  # Boot options
+  # ── Desktop module options ──────────────────────────────────────────────
+  myDesktop.windowManager = "niri";
+  myDesktop.niri.hotkeyVariant = "lifebook";
+  myDesktop.cpu = "intel";
+  myDesktop.virtualisation.enable = true;
+
+  myDesktop.laptop.enable = true;
+  myDesktop.laptop.lidSwitch = "suspend-then-hibernate";
+  myDesktop.laptop.hibernateDelaySec = "1h";
+
+  myDesktop.git.signingKey = "/home/${user}/.ssh/id_ed25519_sk_rk_blackred";
+
+  myDesktop.syncthing.enable = true;
+  myDesktop.syncthing.devices = {
+    "jupiter.home.opel-online.de" = {id = "T53WU6Z-3NT74ZE-PZVZB2N-7FBTZ5K-HESC2ZM-W4ABDAS-NWXHTGI-ST4CDQR";};
+    "hades.home.opel-online.de" = {id = "3VPCBVW-RH7XKFM-TWJGQHC-ZRAQ575-CQKGGKP-NAB4VXE-KCKJFUT-AMCUQQA";};
+  };
+  myDesktop.syncthing.folders = {
+    "Sync" = {
+      path = "/home/kabbone/Sync";
+      devices = ["jupiter.home.opel-online.de" "hades.home.opel-online.de"];
+      ignorePerms = false;
+    };
+  };
+
+  myDesktop.extraSystemPackages = with pkgs; [
+    intel-media-driver
+    intel-compute-runtime
+  ];
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
    initrd.prepend = ["${./patched-SSDT4}"];
-
-    loader = {                              # EFI Boot
+    loader = {
      systemd-boot.enable = lib.mkForce false;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
-      timeout = 1;                          # Grub auto select time
-    };
-
    lanzaboote = {
      enable = true;
      pkiBundle = "/etc/secureboot";
    };
  };
-
-  hardware = {
-    nitrokey.enable = true;
-  };
-
-  environment = {
-    systemPackages = with pkgs; [
-       linux-firmware
-       intel-media-driver
-       intel-compute-runtime
-    ];
-  };
-
-  systemd.sleep.extraConfig = "HibernateDelaySec=1h";
-  services = {
-    logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";            # Laptop does not go to sleep when lid is closed
-    blueman.enable = true;
-    avahi = {                               # Needed to find wireless printer
-      enable = true;
-      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
-        enable = true;
-        addresses = true;
-        userServices = true;
-      };
-    };
-    #tailscale.enable = true;
-    syncthing = {
-        enable = true;
-        group = "users";
-        user = "kabbone";
-        dataDir = "/home/${config.services.syncthing.user}/Sync";
-        configDir = "/home/${config.services.syncthing.user}/.config/syncthing";
-        overrideDevices = true;     # overrides any devices added or deleted through the WebUI
-        overrideFolders = true;     # overrides any folders added or deleted through the WebUI
-        openDefaultPorts = true;
-        settings = {
-          devices = {
-            "jupiter.home.opel-online.de" = { id = "T53WU6Z-3NT74ZE-PZVZB2N-7FBTZ5K-HESC2ZM-W4ABDAS-NWXHTGI-ST4CDQR"; };
-            "hades.home.opel-online.de" = { id = "3VPCBVW-RH7XKFM-TWJGQHC-ZRAQ575-CQKGGKP-NAB4VXE-KCKJFUT-AMCUQQA"; };
-          };
-          folders = {
-            "Sync" = {         # Name of folder in Syncthing, also the folder ID
-              path = "/home/${config.services.syncthing.user}/Sync";    # Which folder to add to Syncthing
-              devices = [ "jupiter.home.opel-online.de" "hades.home.opel-online.de" ];      # Which devices to share the folder with
-              ignorePerms = false;  # By default, Syncthing doesn't sync file permissions. This line enables it for this folder.
-            };
-          };
-        };
-    };
-  };
 }
--- a/hosts/lifebook/hardware-configuration.nix
+++ b/hosts/lifebook/hardware-configuration.nix
@@ -10,12 +10,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")] ++
-      [( import ../../modules/hardware/backup.nix )];
+    [(modulesPath + "/installer/scan/not-detected.nix")]
+    ++ [(import ../../modules/hardware/backup.nix)];

  boot = {
    initrd = {
@@ -43,7 +47,6 @@

  zramSwap.enable = true;

-
  services = {
    btrfs.autoScrub = {
      enable = true;
@@ -154,76 +157,73 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/NIXBOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/NIXBOOT";
    fsType = "vfat";
  };

-  fileSystems."/home" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/home" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/nix" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/srv" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/swap" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/opt" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/opt" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@opt,discard=async"];
  };

-  fileSystems."/var" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/var" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@var,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-
-  fileSystems."/mnt/Pluto" =
-    { device = "jupiter.home.opel-online.de:/Pluto";
+  fileSystems."/mnt/Pluto" = {
+    device = "jupiter.home.opel-online.de:/Pluto";
    fsType = "nfs";
    options = ["nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-  fileSystems."/mnt/Mars" =
-    { device = "jupiter.home.opel-online.de:/Mars";
+  fileSystems."/mnt/Mars" = {
+    device = "jupiter.home.opel-online.de:/Mars";
    fsType = "nfs";
    options = ["nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-
  swapDevices = [{device = "/swap/swapfile";}];

-
  networking = {
    useDHCP = false; # Deprecated
    hostName = "lifebook";
--- a/hosts/lifebook/home.nix
+++ b/hosts/lifebook/home.nix
@@ -1,49 +1,26 @@
 #
-#  Home-manager configuration for laptop
+#  Lifebook laptop — home-manager host-specific additions
+#  (WM home config is loaded by modules/desktop based on myDesktop.windowManager)
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │       └─ home.nix *
-#   └─ ./modules
-#       └─ ./desktop
-#           └─ ./hyprland
-#              └─ hyprland.nix
-#
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
-      #../../modules/wm/hyprland/home.nix # Window Manager
-      ../../modules/wm/niri/home.nix # Window Manager
-      ../../modules/home.nix # Window Manager
+{pkgs, ...}: {
+  imports = [
+    ../../modules/home.nix # cmds / theme options
  ];

-  home = {                                # Specific packages for laptop
-    packages = with pkgs; [
-      # Applications
-      libreoffice                         # Office packages
-      #firefox
+  home.packages = with pkgs; [
+    libreoffice
    chromium
    thunderbird
    streamlink
    streamlink-twitch-gui-bin
    intel-gpu-tools
    pulsemixer
-      
-      # Power Management
-      #auto-cpufreq                       # Power management
-      #tlp                                # Power management
  ];
-  };

-  services = {                            # Applets
-   blueman-applet.enable = true;         # Bluetooth
-   network-manager-applet.enable = true; # Network
+  services = {
+    blueman-applet.enable = true;
+    network-manager-applet.enable = true;
  };

  xsession.preferStatusNotifierItems = true;
-
 }
--- a/hosts/nasbackup/default.nix
+++ b/hosts/nasbackup/default.nix
@@ -1,46 +1,34 @@
 #
-#  Specific system configuration settings for desktop
+#  Nasbak — NAS backup server configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #[(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    (import ../../modules/services/nasbackup) ++                       # Server Services
-    (import ../../modules/hardware);                                # Hardware devices
+  config,
+  pkgs,
+  user,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../modules/server
+    ]
+    ++ (import ../../modules/services/nasbackup);

-  boot = {                                  # Boot options
+  # ── Server module options ───────────────────────────────────────────────
+  # No virtualisation on the backup NAS
+
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
-
-    loader = {                              # EFI Boot
+    loader = {
      systemd-boot.enable = true;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
-      };
-      timeout = 1;                          # Grub auto select time
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
  };

  programs = {
-    zsh.enable = true;
    ssh.startAgent = false;
    gnupg.agent = {
      enable = false;
@@ -51,16 +39,14 @@

  services = {
    qemuGuest.enable = true;
-    avahi = {                               # Needed to find wireless printer
+    avahi = {
      enable = true;
      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+      publish = {
        enable = true;
        addresses = true;
        userServices = true;
      };
    };
-
  };
-
 }
--- a/hosts/nasbackup/hardware-configuration.nix
+++ b/hosts/nasbackup/hardware-configuration.nix
@@ -1,4 +1,3 @@
-
 # Hardware settings for Teclast F5 10" Laptop
 # NixOS @ sda2
 #
@@ -10,11 +9,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod"];
@@ -139,39 +142,38 @@
    };
  };

-
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/disk/by-label/NIXROOT";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };
@@ -182,14 +184,14 @@
  #      options = [ "compress=zstd,space_cache=v2,noatime,subvolid=5" ];
  #    };
  #
-  fileSystems."/mnt/nas" =
-    { device = "/dev/disk/by-uuid/70523c79-ef5c-40f2-8782-60fc86bb445b";
+  fileSystems."/mnt/nas" = {
+    device = "/dev/disk/by-uuid/70523c79-ef5c-40f2-8782-60fc86bb445b";
    fsType = "btrfs";
    options = ["compress=zstd:9,space_cache=v2,noatime,subvol=@nasbak"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/NIXBOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/NIXBOOT";
    fsType = "vfat";
  };

@@ -229,5 +231,4 @@
    #      ${pkgs.hdparm}/sbin/hdparm -S 150 /dev/disk/by-uuid/b9edc489-ac37-4b28-981d-442722df7ae2
    #    '';
  };
-  
 }
--- a/hosts/nasbackup/home.nix
+++ b/hosts/nasbackup/home.nix
@@ -10,16 +10,13 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications

@@ -32,5 +29,4 @@
  programs = {
    alacritty.settings.font.size = 11;
  };
-
 }
--- a/hosts/nbf5/default.nix
+++ b/hosts/nbf5/default.nix
@@ -16,23 +16,32 @@
 #       └─ ./hardware
 #           └─ default.nix
 #
-
-{ config, pkgs, user, ... }:
-
 {
-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+  config,
+  pkgs,
+  user,
+  ...
+}: {
+  imports =
+    # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)]
+    ++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    
    #[(import ../../modules/wm/hyprland/default.nix)] ++        # Window Manager
    # [(import ../../modules/wm/sway/default.nix)] ++        # Window Manager
-    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
-    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # kvm module options
-    (import ../../modules/hardware) ++
-    (import ../../modules/services/printer);                                # Hardware devices
+    [(import ../../modules/wm/virtualisation/docker.nix)]
+    ++ # Docker
+    [(import ../../modules/wm/virtualisation/kvm-intel.nix)]
+    ++ # kvm module options
+    (import ../../modules/hardware)
+    ++ (import ../../modules/services/printer); # Hardware devices

-  boot = {                                  # Boot options
+  boot = {
+    # Boot options
    kernelPackages = pkgs.linuxPackages_latest;

-    loader = {                              # EFI Boot
+    loader = {
+      # EFI Boot
      systemd-boot.enable = true;
      efi = {
        canTouchEfiVariables = true;
@@ -48,7 +57,8 @@
    ];
  };

-  programs = {                              # No xbacklight, this is the alterantive
+  programs = {
+    # No xbacklight, this is the alterantive
    light.enable = true;
  };

@@ -63,10 +73,12 @@
    logind.lidSwitch = "suspend-then-hibernate"; # Laptop does not go to sleep when lid is closed
    #auto-cpufreq.enable = true;
    blueman.enable = true;
-    avahi = {                               # Needed to find wireless printer
+    avahi = {
+      # Needed to find wireless printer
      enable = true;
      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
+      publish = {
+        # Needed for detecting the scanner
        enable = true;
        addresses = true;
        userServices = true;
--- a/hosts/nbf5/hardware-configuration.nix
+++ b/hosts/nbf5/hardware-configuration.nix
@@ -10,11 +10,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
  ];

  boot = {
@@ -74,63 +78,61 @@
    };
  };

-  fileSystems."/" =
-    { device = "/dev/mapper/root";
+  fileSystems."/" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/home" =
-    { device = "/dev/mapper/root";
+  fileSystems."/home" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/mapper/root";
+  fileSystems."/srv" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/opt" =
-    { device = "/dev/mapper/root";
+  fileSystems."/opt" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@opt,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/mapper/root";
+  fileSystems."/nix" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/mapper/root";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/mapper/root";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/BOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/BOOT";
    fsType = "vfat";
  };

-  fileSystems."/mnt/Pluto" =
-    { device = "jupiter:/Pluto";
+  fileSystems."/mnt/Pluto" = {
+    device = "jupiter:/Pluto";
    fsType = "nfs";
    options = ["noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-  fileSystems."/mnt/Mars" =
-    { device = "jupiter:/Mars";
+  fileSystems."/mnt/Mars" = {
+    device = "jupiter:/Mars";
    fsType = "nfs";
    options = ["noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-
  swapDevices = [];

-
  networking = {
    useDHCP = false; # Deprecated
    hostName = "nbf5";
--- a/hosts/nbf5/home.nix
+++ b/hosts/nbf5/home.nix
@@ -10,18 +10,15 @@
 #           └─ ./hyprland
 #              └─ hyprland.nix
 #
-
-{ pkgs, ... }:
-
-{
-  imports =
-    [
+{pkgs, ...}: {
+  imports = [
    #../../modules/wm/hyprland/home.nix # Window Manager
    #../../modules/wm/sway/home.nix # Window Manager
    ../../modules/home.nix # Window Manager
  ];

-  home = {                                # Specific packages for laptop
+  home = {
+    # Specific packages for laptop
    packages = with pkgs; [
      # Applications
      firefox
@@ -41,11 +38,11 @@
    alacritty.settings.font.size = 11;
  };

-  services = {                            # Applets
+  services = {
+    # Applets
    blueman-applet.enable = true; # Bluetooth
    network-manager-applet.enable = true; # Network
  };

  xsession.preferStatusNotifierItems = true;
-
 }
--- a/hosts/steamdeck/default.nix
+++ b/hosts/steamdeck/default.nix
@@ -1,80 +1,53 @@
 #
-#  Specific system configuration settings for desktop
+#  Steamdeck — system configuration
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │        ├─ default.nix *
-#   │        └─ hardware-configuration.nix       
-#   └─ ./modules
-#       ├─ ./desktop
-#       │   └─ ./hyprland
-#       │       └─ hyprland.nix
-#       ├─ ./modules
-#       │   └─ ./programs
-#       │       └─ waybar.nix
-#       └─ ./hardware
-#           └─ default.nix
-#
-
-{ config, pkgs, user, jovian-nixos, lib, ... }:
-
 {
+  lib,
+  pkgs,
+  user,
+  jovian-nixos,
+  ...
+}: {
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/desktop
+    ../../modules/wm/steam
+  ];
+
+  # ── Desktop module options ──────────────────────────────────────────────
+  myDesktop.windowManager = "kde";
+  myDesktop.cpu = "amd";
+  myDesktop.virtualisation.enable = true;
+  myDesktop.nitrokey.enable = true;
+
  specialisation = {
    sway.configuration = {
-		imports =
-		  [(import ../../modules/wm/sway)];
-
+      imports = [(import ../../modules/wm/sway)];
      jovian.steam.enable = lib.mkForce false;
      services.desktopManager.plasma6.enable = lib.mkForce false;
    };
  };

-  imports =                                                         # For now, if applying to other system, swap files
-    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    (import ../../modules/wm/virtualisation) ++                 # libvirt + Docker
-    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
-    [(import ../../modules/wm/steam)] ++
-    [(import ../../modules/wm/kde)] ++
-    (import ../../modules/hardware);                                 # Hardware devices
-
-  boot = {                                  # Boot options
-    loader = {                              # EFI Boot
+  # ── Host-specific settings ──────────────────────────────────────────────
+  boot = {
+    loader = {
      systemd-boot.enable = lib.mkForce false;
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
+      efi.canTouchEfiVariables = true;
+      efi.efiSysMountPoint = "/boot";
+      timeout = 1;
    };
-      timeout = 1;                          # Grub auto select time
-    };
-
    lanzaboote = {
      enable = true;
      pkiBundle = "/etc/secureboot";
    };
  };

-  hardware = {
-    nitrokey.enable = true;
-  };
-
-  services = {
- #   blueman.enable = true;
-    printing = {                            # Printing and drivers for TS5300
+  services.printing = {
    enable = true;
    drivers = [pkgs.gutenprint];
  };
-    avahi = {                               # Needed to find wireless printer
-      enable = true;
-      nssmdns4 = true;
-      publish = {                           # Needed for detecting the scanner
-        enable = true;
-        addresses = true;
-        userServices = true;
-      };
-    };
-    tailscale.enable = true;

-  };
+  services.tailscale.enable = true;
+
  security.pam.sshAgentAuth.enable = true;
 }
--- a/hosts/steamdeck/hardware-configuration.nix
+++ b/hosts/steamdeck/hardware-configuration.nix
@@ -10,11 +10,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
  ];

  boot = {
@@ -111,49 +115,49 @@
  #      };
  #  };

-  fileSystems."/" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async"];
  };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/NIXBOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/NIXBOOT";
    fsType = "vfat";
  };

-  fileSystems."/home" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/home" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async"];
  };

-  fileSystems."/nix" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/nix" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async"];
  };

-  fileSystems."/srv" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/srv" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async"];
  };

-  fileSystems."/swap" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/swap" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async"];
  };

-  fileSystems."/opt" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/opt" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvol=@opt,discard=async"];
  };

-  fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/mapper/crypted";
+  fileSystems."/mnt/snapshots/root" = {
+    device = "/dev/mapper/crypted";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async"];
  };
@@ -164,22 +168,20 @@
  #      options = [ "nofail,noauto,users,x-systemd.automount" ];
  #    };

-  fileSystems."/mnt/Pluto" =
-    { device = "jupiter:/Pluto";
+  fileSystems."/mnt/Pluto" = {
+    device = "jupiter:/Pluto";
    fsType = "nfs";
    options = ["nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-  fileSystems."/mnt/Mars" =
-    { device = "jupiter:/Mars";
+  fileSystems."/mnt/Mars" = {
+    device = "jupiter:/Mars";
    fsType = "nfs";
    options = ["nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2"];
  };

-
  swapDevices = [{device = "/swap/swapfile";}];

-
  networking = {
    useDHCP = false; # Deprecated
    hostName = "steamdeck";
--- a/hosts/steamdeck/home.nix
+++ b/hosts/steamdeck/home.nix
@@ -1,52 +1,27 @@
 #
-#  Home-manager configuration for laptop
+#  Home-manager configuration for steamdeck
 #
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ ./laptop
-#   │       └─ home.nix *
-#   └─ ./modules
-#       └─ ./desktop
-#           └─ ./hyprland
-#              └─ hyprland.nix
-#
-
-{ pkgs, ... }:
-
-{
+{pkgs, ...}: {
  specialisation = {
    sway.configuration = {
-		imports =
-		[(import ../../modules/wm/sway/home.nix)];
+      imports = [(import ../../modules/wm/sway/home.nix)];
    };
  };

  imports =
-    [(import ../../modules/home.nix)] ++ # Window Manager
-    [(import ../../modules/wm/steam/home.nix)] ++
-    [(import ../../modules/wm/kde/home.nix)];
+    [(import ../../modules/home.nix)]
+    ++ [(import ../../modules/wm/steam/home.nix)];

-  home = {                                # Specific packages for laptop
+  home = {
    packages = with pkgs; [
-      # Applications
-      libreoffice                         # Office packages
-      #firefox
+      libreoffice
      chromium
      thunderbird
      streamlink
      streamlink-twitch-gui-bin
      pulsemixer
-      #yuzu-early-access
-      
-      # Power Management
-      #auto-cpufreq                       # Power management
-      #tlp                                # Power management
    ];
  };

-  services = {                            # Applets
-  };
-
  xsession.preferStatusNotifierItems = true;
-
 }
--- a/hosts/vm/hardware-configuration.nix
+++ b/hosts/vm/hardware-configuration.nix
@@ -1,11 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  boot.initrd.availableKernelModules = ["uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk"];
@@ -13,8 +17,8 @@
  boot.kernelModules = ["kvm-intel"];
  boot.extraModulePackages = [];

-  fileSystems."/" =
-    { device = "/dev/disk/by-label/nixos";
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
    fsType = "btrfs";
    options = ["compress=zstd,space_cache=v2,ssd,noatime"];
  };
@@ -25,8 +29,8 @@
  #      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home" ];
  #    };

-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/BOOT";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/BOOT";
    fsType = "vfat";
  };

--- a/modules/desktop/default.nix
+++ b/modules/desktop/default.nix
@@ -0,0 +1,552 @@
+#
+#  Desktop module — import this instead of manual WM/virtualisation imports.
+#
+#  Usage in hosts/<hostname>/default.nix:
+#
+#    imports = [
+#      ./hardware-configuration.nix
+#      ../../modules/desktop
+#    ];
+#
+#    myDesktop.windowManager  = "niri";   # niri (default) | sway | kde
+#    myDesktop.cpu            = "amd";    # amd | intel | none (default)
+#
+#    myDesktop.virtualisation.enable = true;
+#
+#    myDesktop.syncthing.enable  = true;
+#    myDesktop.syncthing.devices = { "jupiter.home.example.de" = { id = "XXXXX-..."; }; };
+#    myDesktop.syncthing.folders = { "Sync" = { path = "/home/user/Sync"; devices = [...]; }; };
+#
+#    myDesktop.openrgb.enable      = true;
+#    myDesktop.openrgb.motherboard = "amd";   # or "intel"
+#
+#    myDesktop.laptop.enable           = true;
+#    myDesktop.laptop.lidSwitch        = "suspend-then-hibernate";
+#    myDesktop.laptop.hibernateDelaySec = "1h";
+#
+#    myDesktop.nitrokey.enable = true;
+#
+#    myDesktop.extraSystemPackages = with pkgs; [ some-tool ];
+#
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  user,
+  ...
+}: let
+  cfg = config.myDesktop;
+in {
+  # Hardware modules that are always useful on desktops (bluetooth, …)
+  imports = import ../hardware;
+
+  # ── Options ──────────────────────────────────────────────────────────────
+
+  options.myDesktop = with lib; {
+    windowManager = mkOption {
+      type = types.enum ["niri" "sway" "kde"];
+      default = "niri";
+      description = "Window manager / desktop environment for this host.";
+    };
+
+    cpu = mkOption {
+      type = types.enum ["amd" "intel" "none"];
+      default = "none";
+      description = "CPU type — selects the matching KVM kernel parameters.";
+    };
+
+    virtualisation.enable =
+      mkEnableOption "virtualisation stack (podman/docker-compat, qemu/libvirt, virt-manager)";
+
+    syncthing = {
+      enable = mkEnableOption "syncthing continuous file synchronisation";
+      devices = mkOption {
+        type = types.attrs;
+        default = {};
+        example =
+          literalExpression
+          ''{ "jupiter.home.example.de" = { id = "XXXXX-XXXXX-XXXXX-..."; }; }'';
+        description = "Syncthing peer devices.";
+      };
+      folders = mkOption {
+        type = types.attrs;
+        default = {};
+        example =
+          literalExpression
+          ''{ "Sync" = { path = "/home/user/Sync"; devices = [ "jupiter" ]; ignorePerms = false; }; }'';
+        description = "Syncthing shared folders.";
+      };
+    };
+
+    openrgb = {
+      enable = mkEnableOption "OpenRGB RGB motherboard control";
+      motherboard = mkOption {
+        type = types.str;
+        default = "amd";
+        description = "Motherboard vendor string passed to OpenRGB (amd or intel).";
+      };
+    };
+
+    laptop = {
+      enable = mkEnableOption "laptop-specific settings (lid-switch, hibernate delay)";
+      lidSwitch = mkOption {
+        type = types.str;
+        default = "suspend-then-hibernate";
+        description = "systemd-logind action on lid close.";
+      };
+      hibernateDelaySec = mkOption {
+        type = types.str;
+        default = "1h";
+        description = "Delay before transitioning from suspend to hibernate.";
+      };
+    };
+
+    nitrokey.enable = mkEnableOption "Nitrokey hardware security key support";
+
+    niri.hotkeyVariant = mkOption {
+      type = types.enum ["default" "lifebook"];
+      default = "default";
+      description = "Niri hotkey variant to deploy — selects binds/<variant>.kdl.";
+    };
+
+    git.signingKey = mkOption {
+      type = types.str;
+      default = "/home/${user}/.ssh/id_ed25519_sk_rk_red";
+      description = "SSH key used for git commit signing on this host.";
+    };
+
+    extraSystemPackages = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = "Additional system packages specific to this host.";
+    };
+  };
+
+  # ── Configuration ────────────────────────────────────────────────────────
+
+  config = lib.mkMerge [
+    # ── Base desktop config (replaces configuration_desktop.nix) ───────────
+    {
+      users.users.${user} = {
+        isNormalUser = true;
+        uid = 2000;
+        extraGroups = [
+          "wheel"
+          "video"
+          "audio"
+          "camera"
+          "networkmanager"
+          "lp"
+          "kvm"
+          "libvirtd"
+          "adb"
+          "dialout"
+          "tss"
+        ];
+      };
+
+      security = {
+        pam.services.login.enableGnomeKeyring = true;
+        # swaylock PAM is harmless on non-sway WMs
+        pam.services.swaylock = {};
+        rtkit.enable = true;
+      };
+
+      environment.systemPackages = with pkgs;
+        [
+          file
+          powertop
+          cpufrequtils
+          lm_sensors
+          libva-utils
+          at-spi2-core
+          qmk-udev-rules
+          gptfdisk
+          age-plugin-yubikey
+          pwgen
+          sbctl
+          ausweisapp
+          e2fsprogs
+          orca-slicer
+        ]
+        ++ cfg.extraSystemPackages;
+
+      nixpkgs.config.permittedInsecurePackages = ["mbedtls-2.28.10"];
+
+      services = {
+        pipewire = {
+          enable = true;
+          alsa.enable = true;
+          pulse.enable = true;
+          wireplumber.enable = true;
+        };
+        pcscd.enable = true;
+        yubikey-agent.enable = true;
+        udev.packages = with pkgs; [yubikey-personalization nitrokey-udev-rules];
+        flatpak.enable = true;
+        gvfs.enable = true;
+        fwupd.enable = true;
+        blueman.enable = true;
+        avahi = {
+          enable = true;
+          nssmdns4 = true;
+          publish = {
+            enable = true;
+            addresses = true;
+            userServices = true;
+          };
+        };
+      };
+
+      programs.dconf.enable = true;
+      system.autoUpgrade.enable = false;
+
+      home-manager.users.${user}.programs.git.signing.key =
+        cfg.git.signingKey;
+    }
+
+    # ── Niri ───────────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.windowManager == "niri") {
+      environment = {
+        systemPackages = with pkgs; [
+          alacritty
+          xdg-desktop-portal-gnome
+          xdg-desktop-portal-gtk
+          swaylock
+          swayidle
+          slurp
+          grim
+          lxqt.lxqt-openssh-askpass
+          clinfo
+          glib
+          brightnessctl
+          playerctl
+          xwayland-satellite
+          breeze-hacked-cursor-theme
+          pwvucontrol
+        ];
+        loginShellInit = ''
+          export GTK_IM_MODULE="simple"
+          export ELECTRON_OZONE_PLATFORM_HINT="auto"
+          export NIXOS_OZONE_WL="1"
+          export WLR_RENDERER="vulkan"
+          export _JAVA_AWT_WM_NONREPARENTING="1"
+        '';
+      };
+
+      services = {
+        iio-niri.enable = false;
+        greetd = {
+          enable = true;
+          useTextGreeter = true;
+          settings.default_session.command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd niri-session";
+        };
+        tuned.enable = true;
+        upower.enable = true;
+      };
+
+      programs = {
+        niri.enable = true;
+        ssh.enableAskPassword = true;
+        ssh.askPassword = "${pkgs.lxqt.lxqt-openssh-askpass}/bin/lxqt-openssh-askpass";
+      };
+
+      # Noctalia shell + niri home config via home-manager
+      home-manager.users.${user} = {
+        imports = [
+          inputs.noctalia.homeModules.default
+          ../wm/niri/home.nix
+        ];
+
+        xdg.configFile."niri/binds.kdl".source =
+          ../wm/niri/binds/${cfg.niri.hotkeyVariant}.kdl;
+
+        services = {
+          mako.enable = true;
+          polkit-gnome.enable = true;
+        };
+
+        programs = {
+          fuzzel.enable = true;
+
+          noctalia-shell = {
+            enable = true;
+            settings = {
+              appLauncher.terminalCommand = "alacritty -e";
+
+              bar = {
+                density = "compact";
+                position = "top";
+                showCapsule = false;
+                widgets = {
+                  left = [
+                    {
+                      id = "ControlCenter";
+                      useDistroLogo = true;
+                    }
+                    {
+                      hideUnoccupied = false;
+                      id = "Workspace";
+                      labelMode = "index";
+                      showApplications = true;
+                    }
+                    {id = "ActiveWindow";}
+                  ];
+                  center = [
+                    {
+                      formatHorizontal = "HH:mm\\ndd-MM-yy";
+                      formatVertical = "HH mm";
+                      id = "Clock";
+                      useMonospacedFont = true;
+                      usePrimaryColor = true;
+                    }
+                  ];
+                  right = [
+                    {id = "MediaMini";}
+                    {
+                      id = "SystemMonitor";
+                      showNetworkStats = true;
+                      compactMode = false;
+                    }
+                    {id = "WiFi";}
+                    {id = "Bluetooth";}
+                    {
+                      id = "Battery";
+                      displayMode = "icon-always";
+                      hideIfNotDetected = true;
+                    }
+                    {
+                      id = "Volume";
+                      displayMode = "alwaysShow";
+                    }
+                    {
+                      id = "NotificationHistory";
+                      hideWhenZero = true;
+                    }
+                    {id = "Tray";}
+                  ];
+                };
+              };
+
+              colorSchemes.predefinedScheme = "Catppuccin";
+
+              general = {
+                avatarImage = "/home/${user}/.face";
+                radiusRatio = 0.2;
+                lockOnSusepnd = true;
+              };
+
+              location = {
+                monthBeforeDay = true;
+                name = "Munich, Germany";
+                showWeekNumberInCalendar = true;
+                firstDayOfWeek = 0;
+              };
+
+              wallpaper = {
+                enabled = true;
+                overviewEnabled = false;
+                directory = "/home/${user}/.setup/modules/themes/";
+              };
+
+              brightness = {
+                enforceMinimum = true;
+                brightnessStep = 5;
+              };
+
+              controlCenter.shortcuts.left = [
+                {id = "WiFi";}
+                {id = "Bluetooth";}
+                {id = "ScreenRecorder";}
+                {id = "PowerProfile";}
+                {id = "KeepAwake";}
+              ];
+
+              dock.enabled = false;
+              sessionMenu.enableCountdown = false;
+
+              templates = {
+                fuzzel = true;
+                alacritty = true;
+                qt = true;
+                gtk = true;
+                discord = true;
+                code = true;
+                telegram = true;
+                niri = true;
+                firefox = true;
+              };
+            };
+          };
+        };
+
+        home.file.".cache/noctalia/wallpapers.json".text = builtins.toJSON {
+          defaultWallpaper = "/home/${user}/.setup/modules/themes/wall.jpg";
+        };
+      };
+    })
+
+    # ── Sway ───────────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.windowManager == "sway") {
+      environment = {
+        loginShellInit = ''
+          if [ -z $DISPLAY ] && [ $UID != 0 ] && [ "$(tty)" = "/dev/tty1" ]; then
+            exec sway
+          fi
+        '';
+        systemPackages = with pkgs; [
+          xdg-desktop-portal-wlr
+          sway
+          swaylock
+          swayidle
+          slurp
+          grim
+          bemenu
+          lxqt.lxqt-openssh-askpass
+          clinfo
+          waybar
+          glib
+        ];
+      };
+
+      programs = {
+        sway = {
+          enable = true;
+          extraSessionCommands = ''
+            export MOZ_ENABLE_WAYLAND="1"
+            export MOZ_WEBRENDER="1"
+            export WLR_RENDERER="vulkan"
+            export XDG_SESSION_TYPE="wayland"
+            export GTK_THEME="Arc"
+            export _JAVA_AWT_WM_NONREPARENTING="1"
+          '';
+        };
+        ssh.enableAskPassword = true;
+        ssh.askPassword = "${pkgs.lxqt.lxqt-openssh-askpass}/bin/lxqt-openssh-askpass";
+      };
+
+      xdg.portal = {
+        enable = true;
+        wlr.enable = true;
+        extraPortals = [pkgs.xdg-desktop-portal-gtk];
+      };
+
+      home-manager.users.${user}.imports = [
+        ../wm/sway/home.nix
+        ../wm/waybar.nix # sway uses waybar for the bar
+      ];
+    })
+
+    # ── KDE Plasma ─────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.windowManager == "kde") {
+      environment.systemPackages = with pkgs; [
+        kdePackages.discover
+        maliit-keyboard
+        maliit-framework
+        kdePackages.ksshaskpass
+      ];
+
+      programs.ssh = {
+        enableAskPassword = true;
+        askPassword = lib.mkDefault "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass";
+      };
+
+      services = {
+        packagekit.enable = true;
+        desktopManager.plasma6.enable = true;
+        udev.packages = with pkgs; [gnome-settings-daemon];
+      };
+
+      qt.platformTheme = "kde";
+
+      home-manager.users.${user}.imports = [../wm/kde/home.nix];
+    })
+
+    # ── Virtualisation (podman/docker-compat + qemu/libvirt) ───────────────
+    (lib.mkIf cfg.virtualisation.enable {
+      users.groups = {
+        docker.members = [user];
+        libvirtd.members = ["root" user];
+      };
+
+      virtualisation = {
+        podman = {
+          enable = true;
+          autoPrune.enable = true;
+          dockerCompat = true;
+        };
+        libvirtd = {
+          enable = true;
+          onShutdown = "shutdown";
+          qemu.runAsRoot = false;
+        };
+        spiceUSBRedirection.enable = true;
+      };
+
+      environment.systemPackages = with pkgs; [
+        virt-manager
+        virt-viewer
+        qemu
+        OVMF
+        OVMF-cloud-hypervisor
+        gvfs
+        cloud-hypervisor
+      ];
+    })
+
+    # ── KVM – AMD ──────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.virtualisation.enable && cfg.cpu == "amd") {
+      boot.extraModprobeConfig = ''
+        options kvm_amd nested=0 avic=1 npt=1
+      '';
+    })
+
+    # ── KVM – Intel ────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.virtualisation.enable && cfg.cpu == "intel") {
+      boot.extraModprobeConfig = ''
+        options kvm_intel nested=1
+        options kvm_intel emulate_invalid_guest_state=0
+        options kvm ignore_nsrs=1
+      '';
+    })
+
+    # ── Syncthing ──────────────────────────────────────────────────────────
+    (lib.mkIf cfg.syncthing.enable {
+      services.syncthing = {
+        enable = true;
+        group = "users";
+        user = user;
+        dataDir = "/home/${user}/Sync";
+        configDir = "/home/${user}/.config/syncthing";
+        overrideDevices = true;
+        overrideFolders = true;
+        openDefaultPorts = true;
+        settings = {
+          devices = cfg.syncthing.devices;
+          folders = cfg.syncthing.folders;
+        };
+      };
+    })
+
+    # ── OpenRGB ────────────────────────────────────────────────────────────
+    (lib.mkIf cfg.openrgb.enable {
+      services.hardware.openrgb = {
+        enable = true;
+        motherboard = cfg.openrgb.motherboard;
+      };
+    })
+
+    # ── Laptop ─────────────────────────────────────────────────────────────
+    (lib.mkIf cfg.laptop.enable {
+      systemd.sleep.extraConfig = "HibernateDelaySec=${cfg.laptop.hibernateDelaySec}";
+      services.logind.settings.Login.HandleLidSwitch =
+        cfg.laptop.lidSwitch;
+    })
+
+    # ── Nitrokey ───────────────────────────────────────────────────────────
+    (lib.mkIf cfg.nitrokey.enable {
+      hardware.nitrokey.enable = true;
+    })
+  ];
+}
--- a/modules/editors/default.nix
+++ b/modules/editors/default.nix
@@ -9,7 +9,6 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./nvim
 ]
--- a/modules/editors/nvim/config/default.nix
+++ b/modules/editors/nvim/config/default.nix
@@ -1,5 +1,4 @@
-{ nvim, ... }:
-{
+{nvim, ...}: {
  # Import all your configuration modules here
  programs.nixvim = {
    enable = true;
--- a/modules/editors/nvim/default.nix
+++ b/modules/editors/nvim/default.nix
@@ -1,11 +1,7 @@
 #
 # Neovim
 #
-
-{ pkgs, ... }:
-
-{
-
+{pkgs, ...}: {
  home = {
    packages = [pkgs.gnvim];
  };
@@ -17,6 +13,8 @@
      vimAlias = true;
      vimdiffAlias = true;
      withNodeJs = true;
+      withRuby = true;
+      withPython3 = true;

      #      plugins = with pkgs.vimPlugins; [
      #
@@ -159,4 +157,3 @@
    };
  };
 }
-
--- a/modules/hardware/backup.nix
+++ b/modules/hardware/backup.nix
@@ -1,8 +1,9 @@
-
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.btrbk = {
    sshAccess = [
      {
--- a/modules/hardware/bluetooth.nix
+++ b/modules/hardware/bluetooth.nix
@@ -1,10 +1,7 @@
 #
 # Bluetooth
 #
-
-{ pkgs, ... }:
-
-{
+{pkgs, ...}: {
  hardware.bluetooth = {
    enable = true;
    hsphfpd.enable = false; # HSP & HFP daemon
--- a/modules/hardware/hydraCache.nix
+++ b/modules/hardware/hydraCache.nix
@@ -1,7 +1,9 @@
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  nix = {
    settings = {
      extra-trusted-public-keys = [
@@ -9,13 +11,10 @@
        "steamdeck.cachix.org-1:BVoP4TEu3ECgotaO+3J3r9SSn62GkUDBwizOFU/q4Bc="
      ];
      extra-substituters = [
+        "https://cache.home.opel-online.de"
        "https://steamdeck.cachix.org"
        "https://cache.ci.kabtop.de"
      ];
-      #extra-trusted-substituters = [
-      #  "https://cache.home.opel-online.de"
-      #];
    };
  };
-  
 }
--- a/modules/hardware/remoteBuilder.nix
+++ b/modules/hardware/remoteBuilder.nix
@@ -1,17 +1,21 @@
-{ pkgs, config, ... }:
-
 {
-  users.users.nixremote = {                   # System User
-    isNormalUser = true;
+  pkgs,
+  config,
+  ...
+}: {
+  users.users.nixremote = {
+    # System User
+    isSystemUser = true;
+    group = "nixremote";
    extraGroups = ["kvm"];
-    shell = pkgs.zsh;                       # Default shell
    uid = 1001;
-#    initialPassword = "password95";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M nixremote@hades"
    ];
  };

+  users.groups.nixremote = {};
+
  nix.settings.trusted-users = [
    "nixremote"
  ];
--- a/modules/hardware/remoteClient.nix
+++ b/modules/hardware/remoteClient.nix
@@ -1,10 +1,13 @@
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  nix = {
    distributedBuilds = false;
-    buildMachines = [ {
+    buildMachines = [
+      {
        hostName = "hades";
        system = "x86_64-linux";
        supportedFeatures = ["kvm" "big-parallel"];
@@ -14,7 +17,8 @@
        speedFactor = 4;
        publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVnbld5UVVVYSt2Y0hBS3g2ZWRiVGdxVzhwaCtNQ2lTNmZVd1lqWWNTK28gcm9vdEBoYWRlcwo=%";
        protocol = "ssh-ng";
-    } ];
+      }
+    ];
    settings = {
      extra-trusted-public-keys = [
        "hades-builder:AFdPgi6Qq/yKqc2V2imgzMikEkVEFCrDaHyAmOJ3MII="
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -1,31 +1,75 @@
-{ lib, options, ... }:
-
 {
+  lib,
+  options,
+  ...
+}: {
  options = with lib; {
    cmds = {
-      shell = mkOption { type = types.str; default = "zsh"; };
-      fetch = mkOption { type = types.str; default = "hyfetch"; };
-      editor = mkOption { type = types.str; default = "nvim"; };
+      shell = mkOption {
+        type = types.str;
+        default = "zsh";
+      };
+      fetch = mkOption {
+        type = types.str;
+        default = "hyfetch";
+      };
+      editor = mkOption {
+        type = types.str;
+        default = "nvim";
+      };

-      wm = mkOption { type = types.str; default = "sway"; };
+      wm = mkOption {
+        type = types.str;
+        default = "sway";
+      };

-      terminal = mkOption { type = types.str; default = "alacritty"; };
-      menu = mkOption { type = types.str; default = "rofi -show drun -show-icons"; };
+      terminal = mkOption {
+        type = types.str;
+        default = "alacritty";
+      };
+      menu = mkOption {
+        type = types.str;
+        default = "rofi -show drun -show-icons";
+      };

-      lock = mkOption { type = types.str; default = "locksway"; };
+      lock = mkOption {
+        type = types.str;
+        default = "locksway";
+      };
      notifications = {
-        volume = mkOption { type = types.str; default = "volume-notify"; };
-        brightness = mkOption { type = types.str; default = "brightness-notify"; };
+        volume = mkOption {
+          type = types.str;
+          default = "volume-notify";
+        };
+        brightness = mkOption {
+          type = types.str;
+          default = "brightness-notify";
+        };
      };
    };

-    is-wayland = mkOption { type = types.bool; default = true; };
+    is-wayland = mkOption {
+      type = types.bool;
+      default = true;
+    };

    theme = {
-      theme = mkOption { type = types.str; default = "catppuccin-mocha"; };
-      icon-theme = mkOption { type = types.str; default = "Papirus-Dark"; };
-      font = mkOption { type = types.str; default = "Cascadia Code 11"; };
-      wallpaper = mkOption { type = types.str; default = ""; };
+      theme = mkOption {
+        type = types.str;
+        default = "catppuccin-mocha";
+      };
+      icon-theme = mkOption {
+        type = types.str;
+        default = "Papirus-Dark";
+      };
+      font = mkOption {
+        type = types.str;
+        default = "Cascadia Code 11";
+      };
+      wallpaper = mkOption {
+        type = types.str;
+        default = "";
+      };
    };
  };
 }
--- a/modules/kabbone/corosync-qdevice.nix
+++ b/modules/kabbone/corosync-qdevice.nix
@@ -4,12 +4,10 @@
  pkgs,
  pkgs-kabbone,
  ...
-}:
-let
+}: let
  cfg = config.services.corosync-qnetd;
  dataDir = "/var/run/corosync-qnetd";
-in
-{
+in {
  # interface
  options.services.corosync-qnetd = {
    enable = lib.mkEnableOption "corosync-qnetd";
@@ -45,7 +43,6 @@ in
    #     transport: knet
    #   }

-
    #   logging {
    #     to_syslog: yes
    #   }
--- a/modules/kabbone/mautrix-whatsapp.nix
+++ b/modules/kabbone/mautrix-whatsapp.nix
@@ -3,8 +3,7 @@
  config,
  pkgs,
  ...
-}:
-let
+}: let
  cfg = config.services.kabbone_mautrix-whatsapp;
  dataDir = "/var/lib/mautrix-whatsapp";
  registrationFile = "${dataDir}/whatsapp-registration.yaml";
@@ -66,9 +65,7 @@ let
      };
    };
  };
-
-in
-{
+in {
  options.services.kabbone_mautrix-whatsapp = {
    enable = lib.mkEnableOption "mautrix-whatsapp, a Matrix-Whatsapp puppeting bridge";

@@ -159,7 +156,6 @@ in
  };

  config = lib.mkIf cfg.enable {
-
    users.users.mautrix-whatsapp = {
      isSystemUser = true;
      group = "mautrix-whatsapp";
@@ -178,8 +174,7 @@ in

    # Note: this is defined here to avoid the docs depending on `config`
    services.kabbone_mautrix-whatsapp.settings.homeserver = optOneOf (
-      with config.services;
-      [
+      with config.services; [
        (lib.mkIf matrix-synapse.enable (mkDefaults {
          domain = matrix-synapse.settings.server_name;
        }))
--- a/modules/programs/alacritty.nix
+++ b/modules/programs/alacritty.nix
@@ -1,28 +0,0 @@
-#
-# Terminal Emulator
-#
-
-# Hardcoded as terminal for rofi and doom emacs
-
-{ pkgs, ... }:
-
-{
-
-  home.packages = [ pkgs.alacritty ];
-
-  programs = {
-    alacritty = {
-      enable = true;
-      #settings = {
-      #  env.term = "screen-256color";
-      #  font = rec {                          # Font - Laptop has size manually changed at home.nix
-      #    #normal.family = "FiraCode Nerd Font";
-      #    normal.family = "Cascadia Code";
-      #    #normal.family = "Intel One Mono";
-      #    #bold = { style = "Bold"; };
-#     #    size = 8;
-      #  };
-      #};
-    };
-  };
-}
--- a/modules/programs/configs/default.nix
+++ b/modules/programs/configs/default.nix
@@ -9,7 +9,6 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./mpv.nix
 ]
--- a/modules/programs/configs/mpv.nix
+++ b/modules/programs/configs/mpv.nix
@@ -9,10 +9,7 @@
 #           └─ ./configs
 #               └─ mpv.nix *
 #
-
-{ pkgs, ... }:
-
-{
+{pkgs, ...}: {
  home.file = {
    ".config/mpv/mpv.conf".text = ''
      hwdec=vaapi
--- a/modules/programs/default.nix
+++ b/modules/programs/default.nix
@@ -1,21 +1,3 @@
-#
-#  Apps
-#
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ home.nix
-#   └─ ./modules
-#       └─ ./apps
-#           └─ default.nix *
-#               └─ ...
-#
-
 [
-#   ./alacritty.nix
-#   ./rofi.nix
  ./firefox.nix
-   #./waybar.nix
-   #./games.nix
 ]
-# Waybar.nix is pulled from modules/wm/..
-# Games.nix is pulled from desktop/default.nix
--- a/modules/programs/firefox.nix
+++ b/modules/programs/firefox.nix
@@ -1,17 +1,17 @@
 #
 # Firefox Brower Emulator
 #
-
-
-{ pkgs, ... }:
-
 {
-
+  pkgs,
+  config,
+  ...
+}: {
  #home.packages = [ pkgs.firefox-wayland ];

  programs = {
    firefox = {
      enable = true;
+      configPath = "${config.xdg.configHome}/mozilla/firefox";
      #package = pkgs.wrapFirefox pkgs.firefox-unwrapped {
      #forceWayland = true;
      #    extraPolicies = {
--- a/modules/programs/rofi.nix
+++ b/modules/programs/rofi.nix
@@ -1,119 +0,0 @@
-#
-# System Menu
-#
-
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (config.lib.formats.rasi) mkLiteral;        # Theme.rasi alternative. Add Theme here
-  colors = import ../themes/colors.nix;
-in
-{
-  programs = {
-    rofi = {
-      enable = true;
-      terminal = "${pkgs.alacritty}/bin/alacritty";           # Alacritty is default terminal emulator
-      location = "center";
-      theme =  with colors.scheme.doom; {
-        "*" = {
-          bg0 = mkLiteral "#${bg}";
-          bg1 = mkLiteral "#414868";
-          fg0 = mkLiteral "#${text}";
-          fg1 = mkLiteral "#${text-alt}";
-
-          background-color = mkLiteral "transparent";
-          text-color = mkLiteral "@fg0";
-
-          margin = 0;
-          padding = 0;
-          spacing = 0;
-        };
-
-        "element-icon, element-text, scrollbar" = {
-          cursor = mkLiteral "pointer";
-        };
-
-        "window" = {
-          location = mkLiteral "northwest";
-          width = mkLiteral "280px";
-          x-offset = mkLiteral "8px";
-          y-offset = mkLiteral "24px";
-
-          background-color = mkLiteral "@bg0";
-          border = mkLiteral "1px";
-          border-color = mkLiteral "@bg1";
-          border-radius = mkLiteral "6px";
-        };
-
-        "inputbar" = {
-          spacing = mkLiteral "8px";
-          padding = mkLiteral "4px 8px";
-          children = mkLiteral "[ icon-search, entry ]";
-
-          #background-color = mkLiteral "@bg0";
-          background-color = mkLiteral "@bg0";
-        };
-
-        "icon-search, entry, element-icon, element-text" = {
-          vertical-align = mkLiteral "0.5";
-        };
-
-        "icon-search" = {
-          expand = false;
-          filename = mkLiteral "[ search-symbolic ]";
-          size = mkLiteral "14px";
-        };
-
-        "textbox" = {
-          padding = mkLiteral "4px 8px";
-          background-color = mkLiteral "@bg0";
-        };
-
-        "listview" = {
-          padding = mkLiteral "4px 0px";
-          lines = 12;
-          columns = 1;
-          scrollbar = true;
-          fixed-height = false;
-          dynamic = true;
-        };
-
-        "element" = {
-          padding = mkLiteral "4px 8px";
-          spacing = mkLiteral "8px";
-        };
-
-        "element normal urgent" = {
-          text-color = mkLiteral "@fg1";
-        };
-
-        "element normal active" = {
-          text-color = mkLiteral "@fg1";
-        };
-
-        "element selected" = {
-          text-color = mkLiteral "@bg0"; #1
-          background-color = mkLiteral "@fg1";
-        };
-
-        "element selected urgent" = {
-          background-color = mkLiteral "@fg1";
-        };
-
-        "element-icon" = {
-          size = mkLiteral "0.8em";
-        };
-
-        "element-text" = {
-          text-color = mkLiteral "inherit";
-        };
-
-        "scrollbar" = {
-          handle-width = mkLiteral "4px";
-          handle-color = mkLiteral "@fg1";
-          padding = mkLiteral "0 4px";
-        };
-      };
-    };
-  };
-}
--- a/modules/server/default.nix
+++ b/modules/server/default.nix
@@ -0,0 +1,151 @@
+#
+#  Server module — import this instead of configuration_server.nix + manual virtualisation imports.
+#
+#  Usage in hosts/<hostname>/default.nix:
+#
+#    imports = [
+#      ./hardware-configuration.nix
+#      ../../modules/server
+#    ];
+#
+#    myServer.virtualisation.enable = true;
+#    myServer.virtualisation.cpu    = "amd";   # amd | intel | none (default)
+#
+#    myServer.sshPort               = 2220;    # default
+#    myServer.fail2ban.enable       = true;
+#
+#    myServer.extraSystemPackages   = with pkgs; [ some-tool ];
+#
+{
+  config,
+  lib,
+  pkgs,
+  user,
+  ...
+}: let
+  cfg = config.myServer;
+in {
+  # ── Options ──────────────────────────────────────────────────────────────
+
+  options.myServer = with lib; {
+    uid = mkOption {
+      type = types.int;
+      default = 3000;
+      description = "UID for the server user.";
+    };
+
+    sshPort = mkOption {
+      type = types.port;
+      default = 2220;
+      description = "Port openssh listens on.";
+    };
+
+    sudoRequiresPassword = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether wheel users must enter a password for sudo.";
+    };
+
+    autoUpgrade.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Enable automatic NixOS upgrades (inherits flake URL from configuration_common.nix).";
+    };
+
+    virtualisation = {
+      enable = mkEnableOption "container/VM stack (podman with docker-compat, KVM tuning)";
+      cpu = mkOption {
+        type = types.enum ["amd" "intel" "none"];
+        default = "none";
+        description = "CPU type — selects KVM kernel parameters when virtualisation is enabled.";
+      };
+    };
+
+    extraGroups = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "Additional groups for the server user beyond the defaults.";
+    };
+
+    extraSystemPackages = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = "Additional system packages specific to this host.";
+    };
+
+    fail2ban = {
+      enable = mkEnableOption "fail2ban intrusion prevention";
+    };
+  };
+
+  # ── Configuration ────────────────────────────────────────────────────────
+
+  config = lib.mkMerge [
+    # ── Base server config ────────────────────────────────────────────────
+    {
+      users.users.${user} = {
+        isNormalUser = true;
+        uid = cfg.uid;
+        extraGroups = ["wheel" "networkmanager" "kvm" "libvirtd"] ++ cfg.extraGroups;
+      };
+
+      security.sudo.wheelNeedsPassword = cfg.sudoRequiresPassword;
+
+      environment.systemPackages = with pkgs;
+        [
+          ffmpeg
+          smartmontools
+          htop
+        ]
+        ++ cfg.extraSystemPackages;
+
+      services.openssh = {
+        ports = [cfg.sshPort];
+        openFirewall = true;
+      };
+
+      nix.extraOptions = ''
+        keep-outputs          = true
+        keep-derivations      = true
+      '';
+
+      system.autoUpgrade.enable = cfg.autoUpgrade.enable;
+    }
+
+    # ── Virtualisation (podman/docker-compat) ─────────────────────────────
+    (lib.mkIf cfg.virtualisation.enable {
+      virtualisation.podman = {
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+
+      users.groups.docker.members = [user];
+    })
+
+    # ── KVM – AMD ─────────────────────────────────────────────────────────
+    (lib.mkIf (cfg.virtualisation.enable && cfg.virtualisation.cpu == "amd") {
+      boot.extraModprobeConfig = ''
+        options kvm_amd nested=0 avic=1 npt=1
+      '';
+    })
+
+    # ── KVM – Intel ───────────────────────────────────────────────────────
+    (lib.mkIf (cfg.virtualisation.enable && cfg.virtualisation.cpu == "intel") {
+      boot.extraModprobeConfig = ''
+        options kvm_intel nested=1
+        options kvm_intel emulate_invalid_guest_state=0
+        options kvm ignore_nsrs=1
+      '';
+    })
+
+    # ── Fail2ban ──────────────────────────────────────────────────────────
+    (lib.mkIf cfg.fail2ban.enable {
+      services.fail2ban = {
+        enable = true;
+        maxretry = 5;
+        jails.DEFAULT.settings.findtime = "15m";
+      };
+    })
+  ];
+}
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -1,26 +1,3 @@
-#
-#  Services
-#
-#  flake.nix
-#   ├─ ./hosts
-#   │   └─ home.nix
-#   └─ ./modules
-#       └─ ./services
-#           └─ default.nix *
-#               └─ ...
-#
-
 [
-  #./dunst.nix
-  #./flameshot.nix
-  #./picom.nix
-  #./polybar.nix
-  #./sxhkd.nix
-  #./udiskie.nix
-  #./redshift.nix
-  #./kanshi.nix
  ./keyring.nix
 ]
-
-# picom, polybar and sxhkd are pulled from desktop module
-# redshift temporarely disables
--- a/modules/services/dmz/default.nix
+++ b/modules/services/dmz/default.nix
@@ -9,11 +9,10 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./microvm.nix
  #  ./hydra.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/dmz/gitea_runner.nix
+++ b/modules/services/dmz/gitea_runner.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  virtualisation = {
    podman = {
      enable = true;
--- a/modules/services/dmz/hydra.nix
+++ b/modules/services/dmz/hydra.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  services = {
    hydra = {
      enable = true;
@@ -86,6 +89,4 @@
    file = ../../../secrets/services/acme/opel-online.age;
    owner = "acme";
  };
-
-
 }
--- a/modules/services/dmz/microvm.nix
+++ b/modules/services/dmz/microvm.nix
@@ -1,22 +1,28 @@
-{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
-let
-  name = "gitea-runner";
-in
 {
+  config,
+  microvm,
+  lib,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: let
+  name = "gitea-runner";
+in {
  microvm = {
    autostart = [
      name
    ];
    vms = {
      ${name} = {
-
        inherit pkgs;

        config = {
          imports =
-            [ agenix.nixosModules.default ] ++
-            [ impermanence.nixosModules.impermanence ] ++
-            [( ./gitea_runner.nix )];
+            [agenix.nixosModules.default]
+            ++ [impermanence.nixosModules.impermanence]
+            ++ [(./gitea_runner.nix)];

          networking = {
            hostName = "${name}";
@@ -40,7 +46,8 @@ in
            };
          };

-          users.users.${user} = {                   # System User
+          users.users.${user} = {
+            # System User
            isNormalUser = true;
            extraGroups = ["wheel"];
            uid = 2000;
@@ -64,14 +71,16 @@ in
                  path = "/persist/etc/ssh/ssh_host_rsa_key";
                  type = "rsa";
                  bits = 4096;
-              }];
+                }
+              ];
            };
          };

          fileSystems."/persist".neededForBoot = lib.mkForce true;

          environment = {
-            systemPackages = with pkgs; [           # Default packages install system-wide
+            systemPackages = with pkgs; [
+              # Default packages install system-wide
              bash
              coreutils
              curl
@@ -84,6 +93,7 @@ in
            persistence."/persist" = {
              directories = [
                "/var/log"
+                "/var/lib/nixos"
                "/var/lib/private"
              ];

@@ -95,6 +105,7 @@ in

          microvm = {
            hypervisor = "cloud-hypervisor";
+            vsock.cid = 3;
            vcpu = 4;
            mem = 4096;
            interfaces = [
@@ -106,8 +117,10 @@ in
                  link = "ens18";
                  mode = "bridge";
                };
-            } ];
-             shares = [{
+              }
+            ];
+            shares = [
+              {
                source = "/nix/store";
                mountPoint = "/nix/.ro-store";
                tag = "ro-store";
@@ -118,7 +131,8 @@ in
                mountPoint = "/persist";
                tag = "persist";
                proto = "virtiofs";
-            }];
+              }
+            ];
            #writableStoreOverlay = "/nix/.rw-store";
            #storeOnDisk = true;
          };
--- a/modules/services/dunst.nix
+++ b/modules/services/dunst.nix
@@ -1,76 +0,0 @@
-#
-# System notifications
-#
-
-{ config, lib, pkgs, ... }:
-
-let
-  colors = import ../themes/colors.nix;                 # Import colors theme
-
-  dunst-volume-notification = pkgs.writeShellScriptBin "volume-notify" ''
-    if [ "$(pulsemixer --get-mute)" = "0" ]; then dunstify -u low -r 1 " 🔊 $(pulsemixer --get-volume | awk '{print $1}')%"
-    else dunstify -u low -r 1 "🔈 Muted"; fi
-  '';
-  dunst-brightness-notification = pkgs.writeShellScriptBin "brightness-notify" ''    
-    dunstify -u low -r 1 " $(light -G)%"
-  '';
-in
-{
-  cmds.notifications.volume = "volume-notify";
-  cmds.notifications.brightness = "brightness-notify";
-
-  home.packages = [
-    dunst-volume-notification
-    dunst-brightness-notification
-    pkgs.libnotify
-  ];
-
-  services.dunst = {
-    enable = true;
-    settings = {
-      global = {
-        monitor = 0;
-        follow = "keyboard";
-        indicate_hidden = "yes";
-        shrink = true;
-        transparency = 0;
-        origin = "top-center";
-        offset = "0x20";
-        seperator_height = 0;
-        padding = 12;
-        horizontal_padding = 20;
-        frame_width = 4;
-        seperator_color = "auto";
-        font = "${config.theme.font}";
-        markup = "full";
-        format = "<span foreground='#b3cfa7'><b>%s</b>%p</span>\n%b";
-        alignment = "center";
-        show_age_threshold = 60;
-        word_wrap = "yes";
-        ellipsize = "middle";
-        ignore_newline = "no";
-        stack_duplicates = true;
-        hide_duplicate_count = true;
-        show_indicators = "yes";
-        icon_position = "off";
-        sticky_history = "yes";
-        history_length = 20;
-        always_run_script = true;
-        browser = "/usr/bin/xdg-open";
-        corner_radius = 12;
-        force_xinerama = false;
-        mouse_left_click = "close_current";
-        mouse_middle_click = "do_action";
-        mouse_right_click = "close_all";
-        progress_bar_min_width = "200";
-        enable_recursive_icon_lookup = true;
-      };
-
-      urgency_low.timeout = 4;
-      urgency_normal.timeout = 8;
-      urgency_critical.timeout = 0;
-    };
-
-  };
-  xdg.dataFile."dbus-1/services/org.knopwob.dunst.service".source = "${pkgs.dunst}/share/dbus-1/services/org.knopwob.dunst.service";
-}
--- a/modules/services/flameshot.nix
+++ b/modules/services/flameshot.nix
@@ -1,22 +0,0 @@
-#
-# Screenshots
-#
-
-{ pkgs, user, ... }:
-
-{
-  services = {                                    # sxhkd shortcut = Printscreen button (Print)
-    flameshot = {
-      enable = true;
-      settings = {
-        General = {                               # Settings
-          savePath = "/home/${user}/";
-          saveAsFileExtension = ".png";
-          uiColor = "#2d0096";
-          showHelp = "false";
-          disabledTrayIcon = "true";              # Hide from systray
-        };
-      };
-    };
-  };
-}
--- a/modules/services/kabtopci/default.nix
+++ b/modules/services/kabtopci/default.nix
@@ -9,11 +9,10 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  #  ./microvm.nix
  ./hydra.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/kabtopci/gitea_runner.nix
+++ b/modules/services/kabtopci/gitea_runner.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  virtualisation = {
    podman = {
      enable = true;
--- a/modules/services/kabtopci/hydra.nix
+++ b/modules/services/kabtopci/hydra.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  services = {
    hydra = {
      enable = true;
@@ -78,5 +81,4 @@
    file = ../../../secrets/keys/nixservepriv.age;
    owner = "hydra";
  };
-
 }
--- a/modules/services/kabtopci/microvm.nix
+++ b/modules/services/kabtopci/microvm.nix
@@ -1,22 +1,28 @@
-{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
-let
-  name = "gitea-runner";
-in
 {
+  config,
+  microvm,
+  lib,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: let
+  name = "gitea-runner";
+in {
  microvm = {
    autostart = [
      name
    ];
    vms = {
      ${name} = {
-
        inherit pkgs;

        config = {
          imports =
-            [ agenix.nixosModules.default ] ++
-            [ impermanence.nixosModules.impermanence ] ++
-            [( ./gitea_runner.nix )];
+            [agenix.nixosModules.default]
+            ++ [impermanence.nixosModules.impermanence]
+            ++ [(./gitea_runner.nix)];

          networking = {
            hostName = "${name}";
@@ -40,7 +46,8 @@ in
            };
          };

-          users.users.${user} = {                   # System User
+          users.users.${user} = {
+            # System User
            isNormalUser = true;
            extraGroups = ["wheel"];
            uid = 2000;
@@ -64,14 +71,16 @@ in
                  path = "/persist/etc/ssh/ssh_host_rsa_key";
                  type = "rsa";
                  bits = 4096;
-              }];
+                }
+              ];
            };
          };

          fileSystems."/persist".neededForBoot = lib.mkForce true;

          environment = {
-            systemPackages = with pkgs; [           # Default packages install system-wide
+            systemPackages = with pkgs; [
+              # Default packages install system-wide
              bash
              coreutils
              curl
@@ -84,6 +93,7 @@ in
            persistence."/persist" = {
              directories = [
                "/var/log"
+                "/var/lib/nixos"
                "/var/lib/private"
              ];

@@ -103,8 +113,10 @@ in
                type = "user";
                id = "vm-${name}";
                mac = "04:00:00:00:00:02";
-            } ];
-             shares = [{
+              }
+            ];
+            shares = [
+              {
                source = "/nix/store";
                mountPoint = "/nix/.ro-store";
                tag = "ro-store";
@@ -115,7 +127,8 @@ in
                mountPoint = "/persist";
                tag = "persist";
                proto = "virtiofs";
-            }];
+              }
+            ];
            #writableStoreOverlay = "/nix/.rw-store";
            #storeOnDisk = true;
          };
--- a/modules/services/kanshi.nix
+++ b/modules/services/kanshi.nix
@@ -1,40 +0,0 @@
-#
-# System notifications
-#
-
-{ config, lib, pkgs, ... }:
-
-{
-    services.kanshi = {
-        enable = true;
-        settings = [
-            {
-	      profile = {
-	        name = "undocked";
-                outputs = [
-                    { criteria = "eDP-1"; status = "enable"; mode = "1920x1080"; position = "0,0"; }
-                ];
-	      };
-            }
-	    {
-	      profile = {
-	        name = "docked_c";
-                outputs = [
-                    { criteria = "eDP-1"; status = "enable"; mode = "1920x1080"; position = "0,0"; scale = 1.5; }
-                    { criteria = "DP-1"; status = "enable"; mode = "2560x1080"; position = "1920,0"; }
-                ];
-	      };
-            }
-	    {
-	      profile = {
-	        name = "docked_triple";
-                outputs = [
-                    { criteria = "eDP-1"; status = "disable"; mode = "1920x1080"; position = "4480,0"; }
-                    { criteria = "HDMI-A-1"; status = "enable"; mode = "1920x1080"; position = "0,0"; }
-                    { criteria = "DP-1"; status = "enable"; mode = "2560x1080"; position = "1920,0"; }
-                ];
-	      };
-            }
-        ];
-    };
-}
--- a/modules/services/keyring.nix
+++ b/modules/services/keyring.nix
@@ -1,11 +1,13 @@
 #
 # Screenshots
 #
-
-{ pkgs, user, ... }:
-
 {
-  services = {                                    # sxhkd shortcut = Printscreen button (Print)
+  pkgs,
+  user,
+  ...
+}: {
+  services = {
+    # sxhkd shortcut = Printscreen button (Print)
    gnome-keyring = {
      enable = true;
    };
--- a/modules/services/kubemaster/default.nix
+++ b/modules/services/kubemaster/default.nix
@@ -9,11 +9,10 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  #  ./microvm.nix
  #  ./hydra.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/nas/default.nix
+++ b/modules/services/nas/default.nix
@@ -9,7 +9,6 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./nfs.nix
  ./nginx.nix
@@ -17,6 +16,6 @@
  ./syncthing.nix
  ./paperless.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/nas/nfs.nix
+++ b/modules/services/nas/nfs.nix
@@ -1,4 +1,9 @@
-{config, pkgs, lib, ...}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
  # enable nfs
  services.nfs.server = rec {
    enable = true;
--- a/modules/services/nas/nginx.nix
+++ b/modules/services/nas/nginx.nix
@@ -1,16 +1,28 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
+
+    appendHttpConfig = ''
+      proxy_cache_path /mnt/Pluto/nix-cache
+        levels=1:2
+        keys_zone=nix_cache:10m
+        max_size=100g
+        inactive=14d
+        use_temp_path=off;
+    '';
+
    virtualHosts = {
      "home.opel-online.de" = {
        enableACME = true;
@@ -18,9 +30,34 @@
        default = true;
        locations."/".return = "503";
      };
-    };
-  };
+      "cache.home.opel-online.de" = {
+        useACMEHost = "home.opel-online.de";
+        forceSSL = true;
+        locations."/" = {
+          extraConfig = ''
+            proxy_pass              https://cache.ci.kabtop.de;
+            proxy_ssl_server_name   on;
+            proxy_http_version      1.1;
+            proxy_set_header        Connection "";
+            proxy_set_header        Host cache.ci.kabtop.de;

+            proxy_cache             nix_cache;
+            proxy_cache_valid       200 14d;
+            proxy_cache_valid       404 1m;
+            proxy_cache_use_stale   error timeout updating;
+            proxy_cache_lock        on;
+            proxy_cache_lock_timeout 1h;
+            add_header              X-Cache-Status $upstream_cache_status;
+
+            proxy_buffering         on;
+            proxy_buffer_size       128k;
+            proxy_buffers           8 1m;
+            proxy_max_temp_file_size 0;
+          '';
+        };
+      };
+    };
+  };

  security.acme = {
    acceptTerms = true;
@@ -39,6 +76,8 @@
    };
  };

+  systemd.services.nginx.serviceConfig.ReadWritePaths = ["/mnt/Pluto/nix-cache"];
+
  networking.firewall = {
    enable = true;
    allowedUDPPorts = [];
@@ -49,5 +88,4 @@
    file = ../../../secrets/services/acme/opel-online.age;
    owner = "acme";
  };
-
 }
--- a/modules/services/nas/paperless.nix
+++ b/modules/services/nas/paperless.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.paperless = {
    enable = true;
    domain = "paperless.home.opel-online.de";
@@ -34,5 +36,4 @@
    file = ../../../secrets/services/paperless/pwFile.age;
    owner = "paperless";
  };
-
 }
--- a/modules/services/nas/syncthing.nix
+++ b/modules/services/nas/syncthing.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.syncthing = {
    enable = true;
    group = "users";
@@ -20,7 +22,8 @@
        "lifebook.home.opel-online.de" = {id = "RKPZG3H-BDUZID3-DV26MKR-UOARIQC-JBCAFXP-J5QFM4H-5EGBSM5-VEGXHQ4";};
      };
      folders = {
-        "Sync" = {         # Name of folder in Syncthing, also the folder ID
+        "Sync" = {
+          # Name of folder in Syncthing, also the folder ID
          path = "/mnt/Mars/${config.services.syncthing.user}/Sync"; # Which folder to add to Syncthing
          devices = ["hades.home.opel-online.de" "lifebook.home.opel-online.de"]; # Which devices to share the folder with
          ignorePerms = false; # By default, Syncthing doesn't sync file permissions. This line enables it for this folder.
@@ -49,5 +52,4 @@
      };
    };
  };
-
 }
--- a/modules/services/nas/vaultwarden.nix
+++ b/modules/services/nas/vaultwarden.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.vaultwarden = {
    enable = true;
    dbBackend = "sqlite";
@@ -34,5 +36,4 @@
    file = ../../../secrets/services/vaultwarden/environment.age;
    owner = "vaultwarden";
  };
-
 }
--- a/modules/services/nasbackup/default.nix
+++ b/modules/services/nasbackup/default.nix
@@ -9,10 +9,9 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  #  ./nfs.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/printer/default.nix
+++ b/modules/services/printer/default.nix
@@ -9,10 +9,9 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./klipper.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/printer/klipper.nix
+++ b/modules/services/printer/klipper.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  environment = {
    systemPackages = with pkgs; [
      klipperscreen
@@ -97,5 +100,4 @@
    #        #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
    #      };
  };
-    
 }
--- a/modules/services/printer/nginx.nix
+++ b/modules/services/printer/nginx.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
@@ -21,7 +23,6 @@
    };
  };

-
  security.acme = {
    acceptTerms = true;
    defaults = {
@@ -49,5 +50,4 @@
    file = ../../../secrets/services/acme/opel-online.age;
    owner = "acme";
  };
-
 }
--- a/modules/services/server/coturn.nix
+++ b/modules/services/server/coturn.nix
@@ -1,10 +1,14 @@
-{config, pkgs, lib, ...}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
  # enable coturn
  services.coturn = rec {
    enable = true;
    no-cli = true;
    no-tcp-relay = true;
-    no-tls = true;
    min-port = 49000;
    max-port = 50000;
    use-auth-secret = true;
@@ -44,21 +48,24 @@
  # open the firewall
  networking.firewall = {
    interfaces.ens18 = let
-      range = with config.services.coturn; [ {
+      range = with config.services.coturn; [
+        {
          from = min-port;
          to = max-port;
-    } ];
-    in
-    {
+        }
+      ];
+    in {
      allowedUDPPortRanges = range;
      allowedUDPPorts = [3478];
      allowedTCPPortRanges = range;
-      allowedTCPPorts = [ 3478 ];
+      allowedTCPPorts = [3478 5349];
    };
  };
  # get a certificate
  security.acme.certs.${config.services.coturn.realm} = {
-    /* insert here the right configuration to obtain a certificate */
+    /*
+    insert here the right configuration to obtain a certificate
+    */
    postRun = "systemctl restart coturn.service";
    group = "turnserver";
  };
--- a/modules/services/server/default.nix
+++ b/modules/services/server/default.nix
@@ -9,7 +9,6 @@
 #           └─ default.nix *
 #               └─ ...
 #
-
 [
  ./postgresql.nix
  ./gitea.nix
@@ -21,6 +20,6 @@
  ./mealie.nix
  #  ./ollama.nix
 ]
-
 # picom, polybar and sxhkd are pulled from desktop module
 # redshift temporarely disables
+
--- a/modules/services/server/gitea.nix
+++ b/modules/services/server/gitea.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  services.gitea = {
    enable = true;
    dump.enable = false;
@@ -29,7 +31,7 @@
        LFS_ALLOW_PURE_SSH = true;
      };
      security = {
-            MIN_PASSWORD_LENGTH = 8;
+        MIN_PASSWORD_LENGTH = 12;
        PASSWORD_CHECK_PWN = true;
        PASSWORD_HASH_ALGO = "argon2";
      };
--- a/modules/services/server/gitea_runner.nix
+++ b/modules/services/server/gitea_runner.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  virtualisation = {
    podman = {
      enable = true;
--- a/modules/services/server/hydra.nix
+++ b/modules/services/server/hydra.nix
@@ -1,6 +1,9 @@
-{ lib, config, pkgs, ... }:
-
 {
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
  services = {
    hydra = {
      enable = true;
@@ -73,5 +76,4 @@
    file = ../../../secrets/keys/nixservepriv.age;
    owner = "hydra";
  };
-
 }
--- a/modules/services/server/jitsi.nix
+++ b/modules/services/server/jitsi.nix
@@ -1,6 +1,8 @@
-
-{ config, pkgs, ... }:
 {
+  config,
+  pkgs,
+  ...
+}: {
  services.jitsi-meet = {
    enable = true;
    hostName = "meet.kabtop.de";
--- a/modules/services/server/matrix.nix
+++ b/modules/services/server/matrix.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
-let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
  fqdn = "matrix.${config.networking.domain}";
  clientConfig = {
    "m.homeserver".base_url = "https://${fqdn}";
@@ -62,14 +64,21 @@ in {
      server_name = config.networking.domain;
      public_baseurl = "https://matrix.${config.networking.domain}";
      listeners = [
-          { port = 8008;
+        {
+          port = 8008;
          bind_addresses = ["::1"];
          type = "http";
          tls = false;
          x_forwarded = true;
          resources = [
-              { names = [ "client" ]; compress = true; }
-              { names = [ "federation" ]; compress = false; }
+            {
+              names = ["client"];
+              compress = true;
+            }
+            {
+              names = ["federation"];
+              compress = false;
+            }
          ];
        }
      ];
--- a/modules/services/server/mealie.nix
+++ b/modules/services/server/mealie.nix
@@ -1,18 +1,16 @@
-
-{ config, pkgs, pkgs-unstable, ... }:
 {
-
+  config,
+  pkgs,
+  ...
+}: {
  services.mealie = {
    enable = true;
-	#package = pkgs-unstable.mealie;
    listenAddress = "127.0.0.1";
    credentialsFile = config.age.secrets."services/mealie/credentialsFile".path;
    settings = {
      ALLOW_SIGNUP = "false";
      DB_ENGINE = "postgres";
      TZ = "Europe/Berlin";
-	    PGID = "911";
-	    PUID = "911";
    };
  };

@@ -27,21 +25,6 @@
    };
  };

-    users = {
-      users = {
-        mealie = {
-	  uid = 911;
-	  group = "mealie";
-	  isSystemUser = true;
-	};
-      };
-      groups = {
-        mealie = {
-	  gid = 911;
-	};
-      };
-    };
-
  age.secrets."services/mealie/credentialsFile" = {
    file = ../../../secrets/services/mealie/credentialsFile.age;
    owner = "mealie";
@@ -50,5 +33,4 @@
  security.acme.defaults.email = "webmaster@kabtop.de";
  security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
  security.acme.acceptTerms = true;
-
 }
--- a/modules/services/server/microvm.nix
+++ b/modules/services/server/microvm.nix
@@ -1,22 +1,28 @@
-{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
-let
-  name = "gitea-runner";
-in
 {
+  config,
+  microvm,
+  lib,
+  pkgs,
+  user,
+  agenix,
+  impermanence,
+  ...
+}: let
+  name = "gitea-runner";
+in {
  microvm = {
    autostart = [
      name
    ];
    vms = {
      ${name} = {
-
        inherit pkgs;

        config = {
          imports =
-            [ agenix.nixosModules.default ] ++
-            [ impermanence.nixosModules.impermanence ] ++
-            [( ./gitea_runner.nix )];
+            [agenix.nixosModules.default]
+            ++ [impermanence.nixosModules.impermanence]
+            ++ [(./gitea_runner.nix)];

          networking = {
            hostName = "${name}";
@@ -40,7 +46,8 @@ in
            };
          };

-          users.users.${user} = {                   # System User
+          users.users.${user} = {
+            # System User
            isNormalUser = true;
            extraGroups = ["wheel"];
            uid = 2000;
@@ -64,14 +71,16 @@ in
                  path = "/persist/etc/ssh/ssh_host_rsa_key";
                  type = "rsa";
                  bits = 4096;
-              }];
+                }
+              ];
            };
          };

          fileSystems."/persist".neededForBoot = lib.mkForce true;

          environment = {
-            systemPackages = with pkgs; [           # Default packages install system-wide
+            systemPackages = with pkgs; [
+              # Default packages install system-wide
              bash
              coreutils
              curl
@@ -84,6 +93,7 @@ in
            persistence."/persist" = {
              directories = [
                "/var/log"
+                "/var/lib/nixos"
                "/var/lib/private"
              ];

@@ -103,8 +113,10 @@ in
                type = "user";
                id = "vm-${name}";
                mac = "04:00:00:00:00:01";
-            } ];
-             shares = [{
+              }
+            ];
+            shares = [
+              {
                source = "/nix/store";
                mountPoint = "/nix/.ro-store";
                tag = "ro-store";
@@ -115,7 +127,8 @@ in
                mountPoint = "/persist";
                tag = "persist";
                proto = "virtiofs";
-            }];
+              }
+            ];
            #writableStoreOverlay = "/nix/.rw-store";
            #storeOnDisk = true;
          };
--- a/modules/services/server/nextcloud.nix
+++ b/modules/services/server/nextcloud.nix
@@ -1,10 +1,8 @@
-
-{ config, pkgs, ... }:
 {
-    environment.systemPackages = with pkgs; [           # Default packages install system-wide
-      appimage-run
-    ];
-
+  config,
+  pkgs,
+  ...
+}: {
  services.nextcloud = {
    enable = true;
    hostName = "cloud.kabtop.de";
@@ -99,5 +97,4 @@
  security.acme.defaults.email = "webmaster@kabtop.de";
  security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
  security.acme.acceptTerms = true;
-
 }
--- a/modules/services/server/ollama.nix
+++ b/modules/services/server/ollama.nix
@@ -1,9 +1,10 @@
-
-{ config, pkgs, ... }:
-let
-  ollamahostname = "llm.kabtop.de";
-in
 {
+  config,
+  pkgs,
+  ...
+}: let
+  ollamahostname = "llm.kabtop.de";
+in {
  virtualisation.oci-containers.containers."open-webui" = {
    autoStart = true;
    image = "ghcr.io/open-webui/open-webui:ollama";
--- a/modules/services/server/postgresql.nix
+++ b/modules/services/server/postgresql.nix
@@ -1,10 +1,12 @@
 #
 # System notifications
 #
-
-{ config, lib, pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
  #  imports = [ ./postgresql_upgrade.nix ];
  services.postgresql = {
    enable = true;
@@ -50,5 +52,4 @@
    file = ../../../secrets/services/postgresql/initScript.age;
    owner = "postgres";
  };
-
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Kabbone	113834a397	flake update	2026-05-02 14:09:21 +02:00
Kabbone	4ca3e9abf4	fix disko_luks syntax	2026-04-26 18:21:02 +02:00
Kabbone	49a63fd6aa	fix pre-commit hook	2026-04-26 18:16:37 +02:00
Kabbone	b319cd93e9	format the repo files	2026-04-26 10:27:50 +02:00
Kabbone	92fd97c9a2	add nix fmt pre-commit hook	2026-04-26 10:26:22 +02:00
Kabbone	c5e5b84bfb	some minor security improvements found by claude	2026-04-26 10:01:18 +02:00
Kabbone	447fc61c0b	minor cleanups	2026-04-25 20:29:42 +02:00
Kabbone	464e99ab2c	jupiter: fix nix cache proxy	2026-04-25 20:29:29 +02:00
Kabbone	a33a909ff0	lifebook: add missing user arg	2026-04-25 18:46:04 +02:00
Kabbone	b09b26c3a3	lifebook: correct signing Key	2026-04-25 18:38:13 +02:00
Kabbone	aca0095870	retain nginx proxy cache to 14d	2026-04-25 18:32:06 +02:00
Kabbone	3e9b0496fb	jupiter: add nix cache local proxy	2026-04-25 18:21:00 +02:00
Kabbone	12ad8a7dfa	update flake	2026-04-25 18:03:21 +02:00
Kabbone	f50a5caee5	add persistence to gid/uid services of microvm and set vsock.cid	2026-04-25 17:38:42 +02:00
Kabbone	f7035e0daf	cleanups and move steamdeck to desktop module	2026-04-25 17:09:23 +02:00
Kabbone	c8806e3676	add templates for host specific and global overlays	2026-04-25 10:59:21 +02:00
Kabbone	6ce78e164c	remove gnome and hyprland	2026-04-25 10:37:31 +02:00
Kabbone	2c70c8281e	add keyboardbindings to desktop module for niri	2026-04-25 10:33:58 +02:00
Kabbone	62b68a333f	create users desktop module	2026-04-25 10:20:16 +02:00
Kabbone	5fb7ab4ee0	claude restructure	2026-04-23 20:08:25 +02:00