Home/Nixinator: Add gnome-boxes

System/Nixinator: Configure libvirt virtualisation
Modules/Niri: Update global menu
2026-03-27 17:58:54 +01:00 · 2026-03-27 16:54:56 +01:00 · 2026-03-27 11:20:55 +01:00 · 2026-03-27 01:31:21 +01:00 · 2026-03-27 01:18:26 +01:00 · 2026-03-27 01:18:02 +01:00
74 changed files with 1633 additions and 1579 deletions
--- a/Darwin.png
+++ b/Darwin.png
--- a/README.md
+++ b/README.md
@ -3,6 +3,7 @@
 Modular NixOS configuration, using [Niri](https://github.com/niri-wm/niri) and [Waybar](https://github.com/Alexays/Waybar) for a light desktop.

 ![](FastFetch.png)
+![](Darwin.png)

 To install, run `nixos-rebuild` with the `--flake` parameter from the `NixFlake` directory: `nixos-rebuild switch --flake .#nixinator`.
 Alternatively, use `nh os switch` or `nh os boot`.
--- a/config/navi/christoph.cheat
+++ b/config/navi/christoph.cheat
@ -238,11 +238,11 @@ $ mode: echo -e "--export            \tExport public key\n--export-secret-keys\t

 % sops
 # Edit secrets.yaml
-sops ~/NixFlake/system/modules/sops-nix/secrets.yaml
+sops ~/NixFlake/system/systemmodules/sops-nix/secrets.yaml

 % sops
 # Rekey secrets.yaml
-sops updatekeys ~/NixFlake/system/modules/sops-nix/secrets.yaml
+sops updatekeys ~/NixFlake/system/systemmodules/sops-nix/secrets.yaml

 % ssh
 # Generate a new SSH key
--- a/flake.lock
+++ b/flake.lock
@ -287,11 +287,11 @@
    },
    "hardware": {
      "locked": {
-        "lastModified": 1772972630,
-        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
+        "lastModified": 1774465523,
+        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
+        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
        "type": "github"
      },
      "original": {
@ -307,11 +307,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773332277,
-        "narHash": "sha256-1V+wRrZD9Sw12AQBUWk9CR+XhDZQ8q6yBE0S3Wjbd1M=",
+        "lastModified": 1774534244,
+        "narHash": "sha256-WnmXKsbkwokDdrdI1XwRWH4RYYalOVKgV/hYQmL3/TE=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4aeef1941f862fe3a70d1b8264b4e289358c2325",
+        "rev": "86014e836ca6f4a04d59b85111d39660bdda01cd",
        "type": "github"
      },
      "original": {
@ -346,11 +346,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1773947929,
-        "narHash": "sha256-flpkAPM3zpMpWoqvVkMTo3ptuBF0QKNi6Raa8rnIq7o=",
+        "lastModified": 1774383212,
+        "narHash": "sha256-PyF1nTQp+q5oUYk05yjZMOFvd/rT43mMN1zXyycivBw=",
        "owner": "JPyke3",
        "repo": "hytale-launcher-nix",
-        "rev": "a8d0a974b187f0997c03c23000dea552194edf39",
+        "rev": "f9392e30a2e74e502116eec6c7d42da7be87de0f",
        "type": "github"
      },
      "original": {
@ -456,11 +456,11 @@
        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
      },
      "locked": {
-        "lastModified": 1773329386,
-        "narHash": "sha256-Xoy4j0NKRrZEAkiFxtTKTsmtUumpvjh3ievyat00eA8=",
+        "lastModified": 1774489385,
+        "narHash": "sha256-xGyog2cPoxTo8O6vW0CiCCUhkt866qpI3PN2su9XjV0=",
        "owner": "sodiboo",
        "repo": "niri-flake",
-        "rev": "815e692569fbb01701770a49ad2fe942cec7f431",
+        "rev": "11fe033ac3d0a97c1e62ffb33f9a6a1852fedab1",
        "type": "github"
      },
      "original": {
@ -598,11 +598,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1773222311,
-        "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
+        "lastModified": 1774244481,
+        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0590cd39f728e129122770c029970378a79d076a",
+        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
        "type": "github"
      },
      "original": {
@ -614,11 +614,11 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1773814637,
-        "narHash": "sha256-GNU+ooRmrHLfjlMsKdn0prEKVa0faVanm0jrgu1J/gY=",
+        "lastModified": 1774244481,
+        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "fea3b367d61c1a6592bc47c72f40a9f3e6a53e96",
+        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
        "type": "github"
      },
      "original": {
@ -646,11 +646,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1773821835,
-        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
+        "lastModified": 1774106199,
+        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
+        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
        "type": "github"
      },
      "original": {
@ -694,11 +694,11 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1773122722,
-        "narHash": "sha256-FIqHByVqxCprNjor1NqF80F2QQoiiyqanNNefdlvOg4=",
+        "lastModified": 1774386573,
+        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "62dc67aa6a52b4364dd75994ec00b51fbf474e50",
+        "rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
        "type": "github"
      },
      "original": {
@ -749,11 +749,11 @@
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1772402258,
-        "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
+        "lastModified": 1774309640,
+        "narHash": "sha256-8oWL7YLwElBY9ebYri1LlSlhf/gd1Qoqj0nbBwG2yso=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
+        "rev": "28c58bf023bf537354f78d6e496a349d7a0ed554",
        "type": "github"
      },
      "original": {
@ -793,11 +793,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773339783,
-        "narHash": "sha256-07iRHomuUvJ7Mmp+F7qo68xIb+y3gy0o/B7kuR1K2Qc=",
+        "lastModified": 1774534046,
+        "narHash": "sha256-7BrSW+vVmBFUJfpLhyyfymm70NWjjtax1bjgIWLEg2E=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "1a4ca0d650fbfd4c58e1b1c2b153151fec77d6b2",
+        "rev": "ef199666902a675bca657f63e32c96649aade49d",
        "type": "github"
      },
      "original": {
@ -902,11 +902,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773096132,
-        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
+        "lastModified": 1774303811,
+        "narHash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
+        "rev": "614e256310e0a4f8a9ccae3fa80c11844fba7042",
        "type": "github"
      },
      "original": {
@ -998,11 +998,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773044834,
-        "narHash": "sha256-R2u3z09DuUbSoWClASPUqKXQG/QZYlBsiy8vYXrJ2VU=",
+        "lastModified": 1774424849,
+        "narHash": "sha256-kDRdpgTmxuwyqTyTcXYtgycBvU28tTXm9Es9g/sDpxI=",
        "owner": "adriankarlen",
        "repo": "textfox",
-        "rev": "0b8873d30db55a94e9e0dd934405dcac5e4d8a73",
+        "rev": "98ad395b4fb451b30dbca77be76975d04d97f281",
        "type": "github"
      },
      "original": {
@ -1053,11 +1053,11 @@
    "xwayland-satellite-unstable": {
      "flake": false,
      "locked": {
-        "lastModified": 1772429643,
-        "narHash": "sha256-M+bAeCCcjBnVk6w/4dIVvXvpJwOKnXjwi/lDbaN6Yws=",
+        "lastModified": 1773622265,
+        "narHash": "sha256-wToKwH7IgWdGLMSIWksEDs4eumR6UbbsuPQ42r0oTXQ=",
        "owner": "Supreeeme",
        "repo": "xwayland-satellite",
-        "rev": "10f985b84cdbcc3bbf35b3e7e43d1b2a84fa9ce2",
+        "rev": "a879e5e0896a326adc79c474bf457b8b99011027",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -152,7 +152,17 @@
      config.allowUnfree = true;
      config.allowUnfreePredicate = pkg: true;

-      overlays = [];
+      overlays = let
+        pkgs-stable = import inputs.nixpkgs-stable {
+          system = darwinSystem;
+
+          config.allowUnfree = true;
+          config.allowUnfreePredicate = pkg: true;
+        };
+      in [
+        # All my own overlays (derivations + modifications)
+        (import ./overlays {inherit inputs nixpkgs pkgs-stable;})
+      ];
    };

    # My own library functions are imported here.
@ -211,7 +221,9 @@
        hostname = "darwinix";
        username = "christoph";
        headless = false;
-        extraModules = [];
+        extraModules = [
+          inputs.sops-nix.darwinModules.sops
+        ];
      };
    };

--- a/home/christoph/darwinix/default.nix
+++ b/home/christoph/darwinix/default.nix
@ -8,9 +8,7 @@
  inputs,
  ...
 }: {
-  config = let
-    inherit (config.homemodules) color;
-  in {
+  config = {
    paths = rec {
      nixflake = "${config.home.homeDirectory}/NixFlake";
      dotfiles = "${nixflake}/config";
@ -27,26 +25,8 @@
        font = "MonoLisa Alt Script";
      };

-      fish.enable = true;
-
-      git = {
-        enable = true;
-
-        userName = "Christoph Urlacher";
-        userEmail = "christoph.urlacher@protonmail.com";
-        signCommits = true;
-      };
-
-      kitty.enable = true;
-      lazygit.enable = true;
-
-      neovim = {
-        enable = true;
-        alias = true;
-        neovide = true;
-      };
-
-      yazi.enable = true;
+      packages.enable = true;
+      terminal.enable = true;
    };

    home = {
@ -55,376 +35,20 @@
      homeDirectory = "/Users/${config.home.username}";
      enableNixpkgsReleaseCheck = true;

-      packages = with pkgs; [
-        (ripgrep.override {withPCRE2 = true;})
-        gdu
-        duf
-        sd
-        fclones
-        tealdeer
-        killall
-        atool
-        exiftool
-        ouch
-        ffmpegthumbnailer
-        mediainfo
-        file
-        unrar
-        p7zip
-        unzip
-        progress
-        tokei
-        nix-search-tv
-        nix-tree
-        just
+      sessionVariables = {
+        LANG = "en_US.UTF-8";
+        EDITOR = "nvim";
+        MANPAGER = "nvim +Man!";
+        TERMINAL = "kitty";
+      };

-        ffmpeg-full
-        imagemagick
-
-        poppler-utils
-        pdf2svg
-        pandoc
-
-        dig
-        tcpdump
-        traceroute
-        gping
-        curlie
-        wget
-        doggo
-        rsync
-        rclone
-        httpie
-
-        inputs.nps.packages.${pkgs.stdenv.hostPlatform.system}.default
-
-        cachix
-
-        # GUI
-        ripdrag
-        jellyfin-tui
-      ];
+      # packages = with pkgs; []; # Configured in homemodules/packages

      stateVersion = "25.11";
    };

-    # TODO: Deduplicate with other configs
-    programs = {
-      home-manager.enable = true;
+    programs = {};

-      bat = {
-        enable = true;
-
-        themes = {
-          catppuccin-latte = {
-            src = pkgs.fetchFromGitHub {
-              owner = "catppuccin";
-              repo = "bat";
-              rev = "ba4d16880d63e656acced2b7d4e034e4a93f74b1";
-              sha256 = "sha256-6WVKQErGdaqb++oaXnY3i6/GuH2FhTgK0v4TN4Y0Wbw=";
-            };
-            file = "Catppuccin-latte.tmTheme";
-          };
-        };
-
-        config = {
-          theme = "catppuccin-latte";
-        };
-      };
-
-      cava = {
-        enable = true;
-
-        settings = {
-          general = {
-            framerate = 60; # default 60
-            autosens = 1; # default 1
-            sensitivity = 100; # default 100
-            lower_cutoff_freq = 50; # not passed to cava if not provided
-            higher_cutoff_freq = 10000; # not passed to cava if not provided
-          };
-
-          smoothing = {
-            noise_reduction = 77; # default 77
-            monstercat = false; # default false
-            waves = false; # default false
-          };
-
-          color = {
-            # https://github.com/catppuccin/cava/blob/main/themes/latte-transparent.cava
-            gradient = 1;
-
-            gradient_color_1 = "'${color.hexS.teal}'";
-            gradient_color_2 = "'${color.hexS.sky}'";
-            gradient_color_3 = "'${color.hexS.sapphire}'";
-            gradient_color_4 = "'${color.hexS.blue}'";
-            gradient_color_5 = "'${color.hexS.mauve}'";
-            gradient_color_6 = "'${color.hexS.pink}'";
-            gradient_color_7 = "'${color.hexS.maroon}'";
-            gradient_color_8 = "'${color.hexS.red}'";
-          };
-        };
-      };
-
-      direnv = {
-        enable = true;
-        nix-direnv.enable = true;
-      };
-
-      eza = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
-      fastfetch = {
-        enable = true;
-
-        settings = {
-          logo = {
-            padding = {
-              top = 4;
-              left = 1;
-              right = 2;
-            };
-          };
-
-          display = {
-            separator = "";
-            key.width = 17;
-          };
-
-          # Box Drawing: ╭ ─ ╮ ╰ ╯ │
-          modules = [
-            # Title
-            {
-              type = "title";
-              format = "{#1}╭─── {#}{user-name-colored}";
-            }
-
-            # System Information
-            {
-              type = "custom";
-              format = "{#1}│ {#}System Information";
-            }
-            {
-              type = "os";
-              key = "{#separator}│  {#keys}󰍹 OS";
-            }
-            {
-              type = "kernel";
-              key = "{#separator}│  {#keys}󰒋 Kernel";
-            }
-            {
-              type = "bootmgr";
-              key = "{#separator}│  {#keys}󰒋 BootMGR";
-            }
-            {
-              type = "uptime";
-              key = "{#separator}│  {#keys}󰅐 Uptime";
-            }
-            {
-              type = "packages";
-              key = "{#separator}│  {#keys}󰏖 Packages";
-              # format = "{all}";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Desktop Environment
-            {
-              type = "custom";
-              format = "{#1}│ {#}Desktop Environment";
-            }
-            {
-              type = "de";
-              key = "{#separator}│  {#keys}󰧨 DE";
-            }
-            {
-              type = "wm";
-              key = "{#separator}│  {#keys}󱂬 WM";
-            }
-            {
-              type = "wmtheme";
-              key = "{#separator}│  {#keys}󰉼 Theme";
-            }
-            {
-              type = "display";
-              key = "{#separator}│  {#keys}󰹑 Resolution";
-            }
-            {
-              type = "shell";
-              key = "{#separator}│  {#keys}󰞷 Shell";
-            }
-            {
-              type = "terminalfont";
-              key = "{#separator}│  {#keys}󰛖 Font";
-            }
-            {
-              type = "icons";
-              key = "{#separator}│  {#keys} Icons";
-            }
-            {
-              type = "cursor";
-              key = "{#separator}│  {#keys}󰆽 Cursor";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Hardware Information
-            {
-              type = "custom";
-              format = "{#1}│ {#}Hardware Information";
-            }
-            {
-              type = "board";
-              key = "{#separator}│  {#keys} Board";
-            }
-            {
-              type = "cpu";
-              key = "{#separator}│  {#keys}󰻠 CPU";
-            }
-            {
-              type = "gpu";
-              key = "{#separator}│  {#keys}󰢮 GPU";
-            }
-            {
-              type = "memory";
-              key = "{#separator}│  {#keys}󰍛 Memory";
-            }
-            # {
-            #   type = "disk";
-            #   key = "{#separator}│  {#keys}󰋊 Disk (/)";
-            #   folders = "/";
-            # }
-            # {
-            #   type = "disk";
-            #   key = "{#separator}│  {#keys}󰋊 Disk (~/Games)";
-            #   folders = "/home/christoph/Games";
-            # }
-            {
-              type = "btrfs";
-              key = "{#separator}│  {#keys}󰋊 BTRFS";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Colors Footer
-            {
-              type = "colors";
-              key = "{#separator}╰─── {#1}";
-              keyWidth = 6;
-              symbol = "circle";
-            }
-          ];
-        };
-      };
-
-      fd.enable = true;
-
-      fzf = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
-      navi = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
-      ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-
-        matchBlocks = {
-          "*" = {
-            forwardAgent = false;
-            addKeysToAgent = "yes";
-            compression = true;
-            serverAliveInterval = 0;
-            serverAliveCountMax = 3;
-            hashKnownHosts = false;
-            userKnownHostsFile = "~/.ssh/known_hosts";
-            controlMaster = "no";
-            controlPath = "~/.ssh/master-%r@%n:%p";
-            controlPersist = "no";
-          };
-          "nixinator" = {
-            user = "christoph";
-            hostname = "192.168.86.50";
-          };
-          "servenix" = {
-            user = "christoph";
-            hostname = "local.chriphost.de";
-          };
-          "thinknix" = {
-            user = "christoph";
-            hostname = "think.chriphost.de";
-          };
-          "vps" = {
-            user = "root";
-            hostname = "vps.chriphost.de";
-          };
-          "mars" = {
-            user = "smchurla";
-            hostname = "mars.cs.tu-dortmund.de";
-            serverAliveInterval = 60;
-            localForwards = [
-              {
-                # Resultbrowser
-                bind.port = 22941;
-                host.address = "127.0.0.1";
-                host.port = 22941;
-              }
-              {
-                # Mysql
-                bind.port = 3306;
-                host.address = "127.0.0.1";
-                host.port = 3306;
-              }
-            ];
-          };
-        };
-      };
-
-      tmux = {
-        enable = true;
-
-        clock24 = true;
-        escapeTime = 0; # Delay after pressing escape
-        # keyMode = "vi";
-        terminal = "xterm-256color";
-
-        plugins = with pkgs; [
-          {
-            plugin = tmuxPlugins.catppuccin;
-            extraConfig = ''
-              set -g @plugin 'catppuccin/tmux'
-              set -g @catppuccin_flavour 'latte' # or frappe, macchiato, mocha
-            '';
-          }
-        ];
-
-        extraConfig = ''
-          set -g default-terminal "xterm-256color"
-          set-option -ga terminal-overrides ",xterm-256color:Tc"
-        '';
-      };
-
-      yt-dlp.enable = true;
-
-      zoxide = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-    };
-
-    services = {
-    };
+    services = {};
  };
 }
--- a/home/christoph/default.nix
+++ b/home/christoph/default.nix
@ -34,8 +34,7 @@ in

    homemodules = {
      beets.enable = !headless;
-
-      btop.enable = true;
+      cava.enable = !headless;

      chromium = {
        enable = !headless;
@ -78,37 +77,15 @@ in
        disableTabBar = true;
      };

-      fish.enable = true;
-
-      git = {
-        enable = true;
-
-        userName = "Christoph Urlacher";
-        userEmail = "christoph.urlacher@protonmail.com";
-        signCommits = true;
-      };
-
-      kitty.enable = !headless;
-      lazygit.enable = true;
      mpd.enable = !headless;
-
-      neovim = {
-        enable = true;
-        alias = true;
-        neovide = !headless;
-      };
-
      niri.enable = nixosConfig.programs.niri.enable;
      nnn.enable = false; # Use yazi
+      packages.enable = true;
      qutebrowser.enable = !headless;
      rmpc.enable = !headless;
-
-      rofi = {
-        enable = false;
-      };
-
+      rofi.enable = false;
+      terminal.enable = true;
      waybar.enable = !headless;
-      yazi.enable = true;
      zathura.enable = !headless;
    };

@ -270,374 +247,13 @@ in
      };

      # Add stuff for your user as you see fit:
-      # TODO: Make the headless installations smaller. Don't install stuff here if !headless but in nixinator config.
-      packages = with pkgs;
-        lib.mkMerge [
-          [
-            # Shell utils
-            (ripgrep.override {withPCRE2 = true;}) # fast as fuck
-            gdu # Alternative to du-dust (I like it better)
-            duf # Disk usage analyzer (for all disk overview)
-            sd # Sed alternative
-            fclones # Duplicate file finder
-            tealdeer # Very fast tldr (so readable man)
-            killall
-            atool # Archive preview
-            exiftool
-            ouch # Unified compression/decompression
-            ffmpegthumbnailer # Video thumbnails
-            mediainfo # Media meta information
-            file # File meta information
-            unrar # Cooler WinRar
-            p7zip # Zip stuff
-            unzip # Unzip stuff
-            progress # Find coreutils processes and show their progress
-            tokei # Text file statistics in a project
-            playerctl # Media player control
-            pastel # Color tools
-            nvd # Nix rebuild diff
-            nix-search-tv # Search nixpkgs, nur, nixos options and homemanager options
-            nix-tree # Browse the nix store sorted by size (gdu for closures)
-            nurl # Generate nix fetcher sections based on URLs
-            python313 # Nicer scripting than bash
-            lazyjournal # Journalctl viewer
-            systemctl-tui
-            restic # Backups
-            gnumake
-            just # make alternative
-            binsider # .elf analyzer
-            jujutsu # git-like vcs
-            lurk # strace analysis
-            radare2
-
-            # Hardware/Software info
-            pciutils # lspci
-            mesa-demos # OpenGL info
-            wayland-utils # wayland-info
-            clinfo # OpenCL info
-            vulkan-tools # vulkaninfo
-            libva-utils # vainfo
-            vdpauinfo # Video-Decode and Presentation API for Unix info
-            hwloc # Generate CPU topology diagram
-            lm_sensors # Readout hardware sensors
-            acpica-tools # Dump ACPI tables etc.
-            smartmontools # Disk health
-            nvme-cli # NVME disk health
-
-            # Video/Image/Audio utils
-            ffmpeg-full # I love ffmpeg (including ffplay)
-            ffmpeg-normalize # Normalize audio
-            imagemagick # Convert image (magic)
-            mp3val # Validate mp3 files
-            flac # Validate flac files
-            # spotdl
-
-            # Document utils
-            poppler-utils # pdfunite
-            graphviz # generate graphs from code
-            d2 # generate diagrams from code
-            plantuml # generate diagrams
-            gnuplot # generate function plots
-            pdf2svg # extract vector graphics from pdf
-            pandoc # document converting madness
-
-            # Networking
-            dig # Make DNS requests
-            tcpdump # Listen in on TCP traffic
-            traceroute # "Follow" a packet
-            gping # ping with graph
-            curlie # curl a'la httpie
-            wget # download that shit
-            doggo # dns client
-            rsync # cp on steroids
-            rclone # Rsync for cloud
-            httpie # Cool http client
-            cifs-utils # Mount samba shares
-            nfs-utils # Mount NFS shares
-            sshfs # Mount remote directories via SSH
-
-            # Run unpatched binaries on NixOS
-            # Sets NIX_LD_LIBRARY_PATH and NIX_LD variables for nix-ld.
-            # Usage: "nix-alien-ld -- <Executable>".
-            inputs.nix-alien.packages.${pkgs.stdenv.hostPlatform.system}.nix-alien
-
-            # Search nixpkgs
-            inputs.nps.packages.${pkgs.stdenv.hostPlatform.system}.default
-
-            # Use NixCommunity binary cache
-            cachix
-          ]
-          (lib.mkIf (!headless) [
-            ripdrag # drag & drop from terminal
-            veracrypt
-            wl-clipboard
-
-            # Proton
-            protonvpn-gui
-            protonmail-bridge-gui
-
-            # GUI stuff
-            nautilus # Just in case
-            signal-desktop
-            anki
-            font-manager # Previews fonts, but doesn't set them
-            nextcloud-client
-            keepassxc
-            thunderbird # TODO: Email module
-            obsidian
-            zotero
-            zeal # docs browser
-            # helvum # unmaintained
-            crosspipe
-            vlc
-            audacity
-            ferdium
-            gparted
-            # feishin # electron :(
-            jellyfin-tui
-            czkawka-full # file deduplicator
-
-            # Office
-            kdePackages.wacomtablet # For xournalpp/krita
-            xournalpp # Write with a pen, like old people
-            hunspell # I cna't type
-            hunspellDicts.en_US
-            hunspellDicts.de_DE
-
-            inputs.masssprings.packages.${stdenv.hostPlatform.system}.default
-          ])
-        ];
+      # packages = with pkgs; []; # Configured in homemodules/packages
    };

    # home.file.".options-doc".source = "${pkgs.modules-options-doc}";

    # Packages with extra options managed by HomeManager natively
    programs = {
-      # The home-manager management tool.
-      # Will only be enabled if HM is installed standalone.
-      home-manager.enable = true;
-
-      bat = {
-        enable = true;
-
-        themes = {
-          catppuccin-latte = {
-            src = pkgs.fetchFromGitHub {
-              owner = "catppuccin";
-              repo = "bat";
-              rev = "ba4d16880d63e656acced2b7d4e034e4a93f74b1";
-              sha256 = "sha256-6WVKQErGdaqb++oaXnY3i6/GuH2FhTgK0v4TN4Y0Wbw=";
-            };
-            file = "Catppuccin-latte.tmTheme";
-          };
-        };
-
-        config = {
-          theme = "catppuccin-latte";
-        };
-      };
-
-      cava = {
-        enable = !headless;
-
-        settings = {
-          general = {
-            framerate = 60; # default 60
-            autosens = 1; # default 1
-            sensitivity = 100; # default 100
-            lower_cutoff_freq = 50; # not passed to cava if not provided
-            higher_cutoff_freq = 10000; # not passed to cava if not provided
-          };
-
-          smoothing = {
-            noise_reduction = 77; # default 77
-            monstercat = false; # default false
-            waves = false; # default false
-          };
-
-          color = {
-            # https://github.com/catppuccin/cava/blob/main/themes/latte-transparent.cava
-            gradient = 1;
-
-            gradient_color_1 = "'${color.hexS.teal}'";
-            gradient_color_2 = "'${color.hexS.sky}'";
-            gradient_color_3 = "'${color.hexS.sapphire}'";
-            gradient_color_4 = "'${color.hexS.blue}'";
-            gradient_color_5 = "'${color.hexS.mauve}'";
-            gradient_color_6 = "'${color.hexS.pink}'";
-            gradient_color_7 = "'${color.hexS.maroon}'";
-            gradient_color_8 = "'${color.hexS.red}'";
-          };
-        };
-      };
-
-      direnv = {
-        enable = true;
-        nix-direnv.enable = true;
-      };
-
-      eza = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
-      # TODO: Module
-      fastfetch = {
-        enable = true;
-
-        settings = {
-          logo = {
-            padding = {
-              top = 4;
-              left = 1;
-              right = 2;
-            };
-          };
-
-          display = {
-            separator = "";
-            key.width = 17;
-          };
-
-          # Box Drawing: ╭ ─ ╮ ╰ ╯ │
-          modules = [
-            # Title
-            {
-              type = "title";
-              format = "{#1}╭─── {#}{user-name-colored}";
-            }
-
-            # System Information
-            {
-              type = "custom";
-              format = "{#1}│ {#}System Information";
-            }
-            {
-              type = "os";
-              key = "{#separator}│  {#keys}󰍹 OS";
-            }
-            {
-              type = "kernel";
-              key = "{#separator}│  {#keys}󰒋 Kernel";
-            }
-            {
-              type = "bootmgr";
-              key = "{#separator}│  {#keys}󰒋 BootMGR";
-            }
-            {
-              type = "uptime";
-              key = "{#separator}│  {#keys}󰅐 Uptime";
-            }
-            {
-              type = "packages";
-              key = "{#separator}│  {#keys}󰏖 Packages";
-              # format = "{all}";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Desktop Environment
-            {
-              type = "custom";
-              format = "{#1}│ {#}Desktop Environment";
-            }
-            {
-              type = "de";
-              key = "{#separator}│  {#keys}󰧨 DE";
-            }
-            {
-              type = "wm";
-              key = "{#separator}│  {#keys}󱂬 WM";
-            }
-            {
-              type = "wmtheme";
-              key = "{#separator}│  {#keys}󰉼 Theme";
-            }
-            {
-              type = "display";
-              key = "{#separator}│  {#keys}󰹑 Resolution";
-            }
-            {
-              type = "shell";
-              key = "{#separator}│  {#keys}󰞷 Shell";
-            }
-            {
-              type = "terminalfont";
-              key = "{#separator}│  {#keys}󰛖 Font";
-            }
-            {
-              type = "icons";
-              key = "{#separator}│  {#keys} Icons";
-            }
-            {
-              type = "cursor";
-              key = "{#separator}│  {#keys}󰆽 Cursor";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Hardware Information
-            {
-              type = "custom";
-              format = "{#1}│ {#}Hardware Information";
-            }
-            {
-              type = "board";
-              key = "{#separator}│  {#keys} Board";
-            }
-            {
-              type = "cpu";
-              key = "{#separator}│  {#keys}󰻠 CPU";
-            }
-            {
-              type = "gpu";
-              key = "{#separator}│  {#keys}󰢮 GPU";
-            }
-            {
-              type = "memory";
-              key = "{#separator}│  {#keys}󰍛 Memory";
-            }
-            # {
-            #   type = "disk";
-            #   key = "{#separator}│  {#keys}󰋊 Disk (/)";
-            #   folders = "/";
-            # }
-            # {
-            #   type = "disk";
-            #   key = "{#separator}│  {#keys}󰋊 Disk (~/Games)";
-            #   folders = "/home/christoph/Games";
-            # }
-            {
-              type = "btrfs";
-              key = "{#separator}│  {#keys}󰋊 BTRFS";
-            }
-            {
-              type = "custom";
-              format = "{#1}│";
-            }
-
-            # Colors Footer
-            {
-              type = "colors";
-              key = "{#separator}╰─── {#1}";
-              keyWidth = 6;
-              symbol = "circle";
-            }
-          ];
-        };
-      };
-
-      fd.enable = true;
-
-      fzf = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
      imv = {
        enable = !headless;
        settings = {
@ -665,11 +281,6 @@ in
        };
      };

-      navi = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
-
      nix-index = {
        enable = true;
        enableFishIntegration = config.homemodules.fish.enable;
@ -699,92 +310,6 @@ in
      #     pointer
      #   ];
      # };
-
-      ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-
-        matchBlocks = {
-          "*" = {
-            forwardAgent = false;
-            addKeysToAgent = "no";
-            compression = true;
-            serverAliveInterval = 0;
-            serverAliveCountMax = 3;
-            hashKnownHosts = false;
-            userKnownHostsFile = "~/.ssh/known_hosts";
-            controlMaster = "no";
-            controlPath = "~/.ssh/master-%r@%n:%p";
-            controlPersist = "no";
-          };
-          "nixinator" = {
-            user = "christoph";
-            hostname = "192.168.86.50";
-          };
-          "servenix" = {
-            user = "christoph";
-            hostname = "local.chriphost.de";
-          };
-          "thinknix" = {
-            user = "christoph";
-            hostname = "think.chriphost.de";
-          };
-          "vps" = {
-            user = "root";
-            hostname = "vps.chriphost.de";
-          };
-          "mars" = {
-            user = "smchurla";
-            hostname = "mars.cs.tu-dortmund.de";
-            serverAliveInterval = 60;
-            localForwards = [
-              {
-                # Resultbrowser
-                bind.port = 22941;
-                host.address = "127.0.0.1";
-                host.port = 22941;
-              }
-              {
-                # Mysql
-                bind.port = 3306;
-                host.address = "127.0.0.1";
-                host.port = 3306;
-              }
-            ];
-          };
-        };
-      };
-
-      tmux = {
-        enable = true;
-
-        clock24 = true;
-        escapeTime = 0; # Delay after pressing escape
-        # keyMode = "vi";
-        terminal = "xterm-256color";
-
-        plugins = with pkgs; [
-          {
-            plugin = tmuxPlugins.catppuccin;
-            extraConfig = ''
-              set -g @plugin 'catppuccin/tmux'
-              set -g @catppuccin_flavour 'latte' # or frappe, macchiato, mocha
-            '';
-          }
-        ];
-
-        extraConfig = ''
-          set -g default-terminal "xterm-256color"
-          set-option -ga terminal-overrides ",xterm-256color:Tc"
-        '';
-      };
-
-      yt-dlp.enable = true;
-
-      zoxide = {
-        enable = true;
-        enableFishIntegration = config.homemodules.fish.enable;
-      };
    };

    services = {
--- a/home/christoph/nixinator/default.nix
+++ b/home/christoph/nixinator/default.nix
@ -101,11 +101,16 @@
        jellyfin-mpv-shim
        # tidal-hifi
        # tidal-dl-ng # TODO: Borked
+        # spotdl
        tiddl
        picard
        handbrake
        teamspeak6-client

+        # virt-manager # use system program option
+        virt-viewer
+        gnome-boxes # doesn't list VMs imported using virsh
+
        steam-devices-udev-rules
      ];

--- a/home/homemodules/bat/default.nix
+++ b/home/homemodules/bat/default.nix
@ -0,0 +1,34 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) bat color;
+in {
+  options.homemodules.bat = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf bat.enable {
+    programs.bat = {
+      enable = true;
+
+      themes = {
+        catppuccin-latte = {
+          src = pkgs.fetchFromGitHub {
+            owner = "catppuccin";
+            repo = "bat";
+            rev = "ba4d16880d63e656acced2b7d4e034e4a93f74b1";
+            sha256 = "sha256-6WVKQErGdaqb++oaXnY3i6/GuH2FhTgK0v4TN4Y0Wbw=";
+          };
+          file = "Catppuccin-latte.tmTheme";
+        };
+      };
+
+      config = {
+        theme = "catppuccin-latte";
+      };
+    };
+  };
+}
--- a/home/homemodules/bat/options.nix
+++ b/home/homemodules/bat/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable bat";
+}
--- a/home/homemodules/cava/default.nix
+++ b/home/homemodules/cava/default.nix
@ -0,0 +1,48 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) cava color;
+in {
+  options.homemodules.cava = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf cava.enable {
+    programs.cava = {
+      enable = true;
+
+      settings = {
+        general = {
+          framerate = 60; # default 60
+          autosens = 1; # default 1
+          sensitivity = 100; # default 100
+          lower_cutoff_freq = 50; # not passed to cava if not provided
+          higher_cutoff_freq = 10000; # not passed to cava if not provided
+        };
+
+        smoothing = {
+          noise_reduction = 77; # default 77
+          monstercat = false; # default false
+          waves = false; # default false
+        };
+
+        color = {
+          # https://github.com/catppuccin/cava/blob/main/themes/latte-transparent.cava
+          gradient = 1;
+
+          gradient_color_1 = "'${color.hexS.teal}'";
+          gradient_color_2 = "'${color.hexS.sky}'";
+          gradient_color_3 = "'${color.hexS.sapphire}'";
+          gradient_color_4 = "'${color.hexS.blue}'";
+          gradient_color_5 = "'${color.hexS.mauve}'";
+          gradient_color_6 = "'${color.hexS.pink}'";
+          gradient_color_7 = "'${color.hexS.maroon}'";
+          gradient_color_8 = "'${color.hexS.red}'";
+        };
+      };
+    };
+  };
+}
--- a/home/homemodules/cava/options.nix
+++ b/home/homemodules/cava/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable cava";
+}
--- a/home/homemodules/darwin.nix
+++ b/home/homemodules/darwin.nix
@ -1,13 +1,21 @@
 {inputs, ...}: {
  imports = [
    # My own HM modules
+    ./bat
+    ./btop
    ./color
+    ./fastfetch
    ./fish
    ./git
+    ./jellyfin-tui
    ./kitty
    ./lazygit
    ./neovim
+    ./packages
    ./paths
+    ./ssh
+    ./terminal
+    ./tmux
    ./yazi

    # HM modules imported from the flake inputs
--- a/home/homemodules/default.nix
+++ b/home/homemodules/default.nix
@ -3,26 +3,34 @@
    # Obsolete modules are kept in "1_deprecated" for reference.

    # My own HM modules
+    ./bat
    ./beets
    ./btop
+    ./cava
    ./chromium
    ./color
    ./docs
+    ./fastfetch
    ./fcitx
    ./firefox
    ./fish
    ./git
+    ./jellyfin-tui
    ./kitty
    ./lazygit
    ./mpd
    ./neovim
    ./niri
    ./nnn
+    ./packages
    ./paths
    ./qutebrowser
    ./rmpc
    ./rofi
    ./waybar
+    ./ssh
+    ./terminal
+    ./tmux
    ./yazi
    ./zathura

--- a/home/homemodules/fastfetch/default.nix
+++ b/home/homemodules/fastfetch/default.nix
@ -0,0 +1,163 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) fastfetch color;
+in {
+  options.homemodules.fastfetch = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf fastfetch.enable {
+    programs.fastfetch = {
+      enable = true;
+
+      settings = {
+        logo = {
+          padding = {
+            top = 4;
+            left = 1;
+            right = 2;
+          };
+        };
+
+        display = {
+          separator = "";
+          key.width = 17;
+        };
+
+        # Box Drawing: ╭ ─ ╮ ╰ ╯ │
+        modules = [
+          # Title
+          {
+            type = "title";
+            format = "{#1}╭─── {#}{user-name-colored}";
+          }
+
+          # System Information
+          {
+            type = "custom";
+            format = "{#1}│ {#}System Information";
+          }
+          {
+            type = "os";
+            key = "{#separator}│  {#keys}󰍹 OS";
+          }
+          {
+            type = "kernel";
+            key = "{#separator}│  {#keys}󰒋 Kernel";
+          }
+          {
+            type = "bootmgr";
+            key = "{#separator}│  {#keys}󰒋 BootMGR";
+          }
+          {
+            type = "uptime";
+            key = "{#separator}│  {#keys}󰅐 Uptime";
+          }
+          {
+            type = "packages";
+            key = "{#separator}│  {#keys}󰏖 Packages";
+            # format = "{all}";
+          }
+          {
+            type = "custom";
+            format = "{#1}│";
+          }
+
+          # Desktop Environment
+          {
+            type = "custom";
+            format = "{#1}│ {#}Desktop Environment";
+          }
+          {
+            type = "de";
+            key = "{#separator}│  {#keys}󰧨 DE";
+          }
+          {
+            type = "wm";
+            key = "{#separator}│  {#keys}󱂬 WM";
+          }
+          {
+            type = "wmtheme";
+            key = "{#separator}│  {#keys}󰉼 Theme";
+          }
+          {
+            type = "display";
+            key = "{#separator}│  {#keys}󰹑 Resolution";
+          }
+          {
+            type = "shell";
+            key = "{#separator}│  {#keys}󰞷 Shell";
+          }
+          {
+            type = "terminalfont";
+            key = "{#separator}│  {#keys}󰛖 Font";
+          }
+          {
+            type = "icons";
+            key = "{#separator}│  {#keys} Icons";
+          }
+          {
+            type = "cursor";
+            key = "{#separator}│  {#keys}󰆽 Cursor";
+          }
+          {
+            type = "custom";
+            format = "{#1}│";
+          }
+
+          # Hardware Information
+          {
+            type = "custom";
+            format = "{#1}│ {#}Hardware Information";
+          }
+          {
+            type = "board";
+            key = "{#separator}│  {#keys} Board";
+          }
+          {
+            type = "cpu";
+            key = "{#separator}│  {#keys}󰻠 CPU";
+          }
+          {
+            type = "gpu";
+            key = "{#separator}│  {#keys}󰢮 GPU";
+          }
+          {
+            type = "memory";
+            key = "{#separator}│  {#keys}󰍛 Memory";
+          }
+          # {
+          #   type = "disk";
+          #   key = "{#separator}│  {#keys}󰋊 Disk (/)";
+          #   folders = "/";
+          # }
+          # {
+          #   type = "disk";
+          #   key = "{#separator}│  {#keys}󰋊 Disk (~/Games)";
+          #   folders = "/home/christoph/Games";
+          # }
+          {
+            type = "btrfs";
+            key = "{#separator}│  {#keys}󰋊 BTRFS";
+          }
+          {
+            type = "custom";
+            format = "{#1}│";
+          }
+
+          # Colors Footer
+          {
+            type = "colors";
+            key = "{#separator}╰─── {#1}";
+            keyWidth = 6;
+            symbol = "circle";
+          }
+        ];
+      };
+    };
+  };
+}
--- a/home/homemodules/fastfetch/options.nix
+++ b/home/homemodules/fastfetch/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable fastfetch";
+}
--- a/home/homemodules/fish/default.nix
+++ b/home/homemodules/fish/default.nix
@ -42,99 +42,100 @@ in {
      fish_pager_color_description ${color.hex.overlay0}
    '';

-    programs.fish = lib.mkMerge [
-      # Darwin exclusive config
-      (lib.mkIf pkgs.stdenv.isDarwin {
-        shellAbbrs = let
-          # These can be used for my config.homemodules and for HM config.programs,
-          # as both of these add the package to home.packages
-          hasHomePackage = package: (mylib.modules.contains config.home.packages package);
+    programs.fish = let
+      # Only add " | bat" if bat is installed
+      batify = command: command + (lib.optionalString config.programs.bat.enable " | bat");

-          # Only add fish abbr if package is installed
-          abbrify = package: abbr: (lib.optionalAttrs (hasHomePackage package) abbr);
-        in
-          lib.mkMerge [
+      # Same as above but with args for bat
+      batifyWithArgs = command: args: command + (lib.optionalString config.programs.bat.enable (" | bat " + args));
+
+      # These can be used for my config.homemodules and for HM config.programs,
+      # as both of these add the package to home.packages
+      hasHomePackage = package: (mylib.modules.contains config.home.packages package);
+
+      # Only add fish abbr if package is installed
+      abbrify = package: abbr: (lib.optionalAttrs (hasHomePackage package) abbr);
+    in
+      lib.mkMerge [
+        # Darwin exclusive config
+        (lib.mkIf pkgs.stdenv.isDarwin {
+          shellInit = ''
+            set fish_greeting
+            yes | fish_config theme save "system-theme"
+
+            set --global --export HOMEBREW_PREFIX "/opt/homebrew"
+            set --global --export HOMEBREW_CELLAR "/opt/homebrew/Cellar"
+            set --global --export HOMEBREW_REPOSITORY "/opt/homebrew"
+            fish_add_path --global --move --path "/opt/homebrew/bin" "/opt/homebrew/sbin"
+            if test -n "$MANPATH[1]"; set --global --export MANPATH ''' $MANPATH; end;
+            if not contains "/opt/homebrew/share/info" $INFOPATH; set --global --export INFOPATH "/opt/homebrew/share/info" $INFOPATH; end;
+          '';
+
+          shellAbbrs = lib.mkMerge [
            {
              rebuild = "sudo darwin-rebuild switch --flake .#darwinix";
            }

            (abbrify pkgs.nix-search-tv {search = "nix-search-tv print --indexes 'darwin,home-manager,nixpkgs,nur' | fzf --preview 'nix-search-tv preview {}' --scheme history";})
          ];
-      })
+        })

-      # Linux exclusive config
-      (lib.mkIf pkgs.stdenv.isLinux {
-        generateCompletions = nixosConfig.programs.fish.generateCompletions;
+        # Linux exclusive config
+        (lib.mkIf pkgs.stdenv.isLinux {
+          generateCompletions = nixosConfig.programs.fish.generateCompletions;

-        functions = lib.mergeAttrsList [
-          (lib.optionalAttrs config.homemodules.nnn.enable {
-            nnncd = {
-              wraps = "nnn";
-              description = "support nnn quit and change directory";
-              body = ''
-                # Block nesting of nnn in subshells
-                if test -n "$NNNLVL" -a "$NNNLVL" -ge 1
-                    echo "nnn is already running"
-                    return
-                end
+          shellInit = ''
+            set fish_greeting
+            yes | fish_config theme save "system-theme"
+          '';

-                # The behaviour is set to cd on quit (nnn checks if NNN_TMPFILE is set)
-                # If NNN_TMPFILE is set to a custom path, it must be exported for nnn to
-                # see. To cd on quit only on ^G, remove the "-x" from both lines below,
-                # without changing the paths.
-                if test -n "$XDG_CONFIG_HOME"
-                    set -x NNN_TMPFILE "$XDG_CONFIG_HOME/nnn/.lastd"
-                else
-                    set -x NNN_TMPFILE "$HOME/.config/nnn/.lastd"
-                end
+          functions = lib.mergeAttrsList [
+            (lib.optionalAttrs config.homemodules.nnn.enable {
+              nnncd = {
+                wraps = "nnn";
+                description = "support nnn quit and change directory";
+                body = ''
+                  # Block nesting of nnn in subshells
+                  if test -n "$NNNLVL" -a "$NNNLVL" -ge 1
+                      echo "nnn is already running"
+                      return
+                  end

-                # Unmask ^Q (, ^V etc.) (if required, see `stty -a`) to Quit nnn
-                # stty start undef
-                # stty stop undef
-                # stty lwrap undef
-                # stty lnext undef
+                  # The behaviour is set to cd on quit (nnn checks if NNN_TMPFILE is set)
+                  # If NNN_TMPFILE is set to a custom path, it must be exported for nnn to
+                  # see. To cd on quit only on ^G, remove the "-x" from both lines below,
+                  # without changing the paths.
+                  if test -n "$XDG_CONFIG_HOME"
+                      set -x NNN_TMPFILE "$XDG_CONFIG_HOME/nnn/.lastd"
+                  else
+                      set -x NNN_TMPFILE "$HOME/.config/nnn/.lastd"
+                  end

-                # The command function allows one to alias this function to `nnn` without
-                # making an infinitely recursive alias
-                command nnn $argv
+                  # Unmask ^Q (, ^V etc.) (if required, see `stty -a`) to Quit nnn
+                  # stty start undef
+                  # stty stop undef
+                  # stty lwrap undef
+                  # stty lnext undef

-                if test -e $NNN_TMPFILE
-                    source $NNN_TMPFILE
-                    rm $NNN_TMPFILE
-                end
-              '';
-            };
-          })
-        ];
+                  # The command function allows one to alias this function to `nnn` without
+                  # making an infinitely recursive alias
+                  command nnn $argv

-        shellAbbrs = let
-          # Only add " | bat" if bat is installed
-          batify = command: command + (lib.optionalString config.programs.bat.enable " | bat");
+                  if test -e $NNN_TMPFILE
+                      source $NNN_TMPFILE
+                      rm $NNN_TMPFILE
+                  end
+                '';
+              };
+            })
+          ];

-          # Same as above but with args for bat
-          batifyWithArgs = command: args: command + (lib.optionalString config.programs.bat.enable (" | bat " + args));
-
-          # These can be used for my config.homemodules and for HM config.programs,
-          # as both of these add the package to home.packages
-          hasHomePackage = package: (mylib.modules.contains config.home.packages package);
-
-          # Only add fish abbr if package is installed
-          abbrify = package: abbr: (lib.optionalAttrs (hasHomePackage package) abbr);
-        in
-          lib.mkMerge [
+          shellAbbrs = lib.mkMerge [
            # Abbrs that are always available are defined here.
            {
-              # Fish
-              h = batifyWithArgs "history" "-l fish"; # -l fish sets syntax highlighting to fish
-              abbrs = batifyWithArgs "abbr" "-l fish";
-
              # Tools
              blk = batify "lsblk -o NAME,LABEL,PARTLABEL,FSTYPE,SIZE,FSUSE%,MOUNTPOINT";
              blkids = batify "lsblk -o NAME,LABEL,FSTYPE,SIZE,PARTLABEL,MODEL,ID,UUID";
-              nd = "nix develop";
-              nb = "nix build -L";
-              ns = "nix shell nixpkgs#";
-              nr = "nix run";

              ghidra = "_JAVA_AWT_WM_NONREPARENTING=1 ghidra"; # env var for wayland
            }
@ -151,31 +152,33 @@ in {

            # (abbrify pkgs.sd {sed = "sd";})
          ];
-      })
+        })

-      # Common config
-      {
-        enable = true;
+        # Common config
+        {
+          enable = true;

-        shellAbbrs = let
-          # These can be used for my config.homemodules and for HM config.programs,
-          # as both of these add the package to home.packages
-          hasHomePackage = package: (mylib.modules.contains config.home.packages package);
-
-          # Only add fish abbr if package is installed
-          abbrify = package: abbr: (lib.optionalAttrs (hasHomePackage package) abbr);
-        in
-          lib.mkMerge [
+          shellAbbrs = lib.mkMerge [
            {
-              # Shell basics
+              # Shell
              c = "clear";
              q = "exit";
              mkdir = "mkdir -p"; # also create parents (-p)
              watch = "watch -d -c -n 0.5";
-              sy = "sudo -u ${username} yazi";
+              sy = "sudo yazi";
              cd = "z"; # zoxide for quickjump to previously visited locations
              cdd = "zi";
              b = "z -"; # jump to previous dir
+
+              # Fish
+              h = batifyWithArgs "history" "-l fish"; # -l fish sets syntax highlighting to fish
+              abbrs = batifyWithArgs "abbr" "-l fish";
+
+              # Nix
+              nd = "nix develop";
+              nb = "nix build -L";
+              ns = "nix shell nixpkgs#";
+              nr = "nix run";
              nps = "nps -e";
            }

@ -227,14 +230,9 @@ in {
            (abbrify pkgs.lazygit {lg = "lazygit";})
          ];

-        plugins = [];
-
-        shellInit = ''
-          set fish_greeting
-          yes | fish_config theme save "system-theme"
-        '';
-      }
-    ];
+          plugins = [];
+        }
+      ];

    programs.starship = {
      enable = true;
--- a/home/homemodules/jellyfin-tui/default.nix
+++ b/home/homemodules/jellyfin-tui/default.nix
@ -0,0 +1,91 @@
+{
+  config,
+  nixosConfig,
+  darwinConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) jellyfin-tui color;
+
+  systemConfig =
+    if pkgs.stdenv.isLinux
+    then nixosConfig
+    else darwinConfig;
+in {
+  options.homemodules.jellyfin-tui = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf jellyfin-tui.enable {
+    home = {
+      packages = [
+        pkgs.jellyfin-tui
+      ];
+
+      file = let
+        jellyfinUrl =
+          if pkgs.stdenv.isLinux
+          then "https://jellyfin.local.chriphost.de"
+          else "https://jellyfin.vps.chriphost.de";
+
+        configFile = ''
+          servers:
+          - name: Mafia Dortmund
+            url: ${jellyfinUrl}
+            username: root
+            password_file: ${systemConfig.sops.secrets.jellyfin-password.path}
+            default: true
+
+          # All following settings are OPTIONAL. What you see here are the defaults.
+
+          # Show album cover image
+          art: true
+          # Save and restore the state of the player (queue, volume, etc.)
+          persist: true
+          # Grab the primary color from the cover image (false => uses the current theme's `accent` instead)
+          auto_color: false
+          # Time in milliseconds to fade between colors when the track changes
+          auto_color_fade_ms: 400
+          # Always show the lyrics pane, even if no lyrics are available
+          lyrics: 'always' # options: 'always', 'never', 'auto'
+
+          rounded_corners: true
+
+          transcoding:
+            bitrate: 320
+            # container: mp3
+
+          # Discord Rich Presence. Shows your listening status on your Discord profile if Discord is running.
+          # NOTE: I think we're allowed to leak this to the public (hopefully)?
+          discord: 1466134677537685546 # https://discord.com/developers/applications
+          # Displays album art on your Discord profile if enabled
+          # !!CAUTION!! - Enabling this will expose the URL of your Jellyfin instance to all Discord users!
+          discord_art: false
+
+          # Customize the title of the terminal window
+          window_title: true # default -> {title} – {artist} ({year})
+          # window_title: false # disable
+          # Custom title: choose from current track's {title} {artist} {album} {year}
+          # window_title: "\"{title}\" by {artist} ({year}) – jellyfin-tui"
+
+          # Options specified here will be passed to mpv - https://mpv.io/manual/master/#options
+          mpv:
+            log-file: /tmp/mpv.log
+            no-config: true
+            # af: lavfi=[loudnorm=I=-23:TP=-1]
+            gapless-audio: weak
+            prefetch-playlist: yes
+            replaygain: no
+        '';
+      in
+        lib.mkMerge [
+          (lib.optionalAttrs pkgs.stdenv.isLinux {
+            ".config/jellyfin-tui/config.yaml".text = configFile;
+          })
+          (lib.optionalAttrs pkgs.stdenv.isDarwin {
+            "Library/Application Support/jellyfin-tui/config.yaml".text = configFile;
+          })
+        ];
+    };
+  };
+}
--- a/home/homemodules/jellyfin-tui/options.nix
+++ b/home/homemodules/jellyfin-tui/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable jellyfin-tui";
+}
--- a/home/homemodules/neovim/default.nix
+++ b/home/homemodules/neovim/default.nix
@ -126,7 +126,7 @@ in {
        maplocalleader = ",";
      };

-      opts = import ./vim_opts.nix {inherit lib mylib;};
+      opts = import ./vim_opts.nix {inherit config lib mylib;};
      extraConfigLuaPost = builtins.readFile ./extraConfigLuaPost.lua;
      extraConfigLua = builtins.readFile ./extraConfigLua.lua;

@ -552,6 +552,21 @@ in {
            };
          };

+          devdocs = rec {
+            name = "devdocs";
+            pkg = pkgs.vimPlugins.devdocs-nvim;
+            lazy = true;
+            cmd = ["DevDocs"];
+            dependencies = [snacks];
+            config = mkDefaultConfig name;
+            # opts = {
+            #   ensure_installed = [
+            #     "c"
+            #     "cpp"
+            #   ];
+            # };
+          };
+
          direnv = {
            name = "direnv";
            pkg = pkgs.vimPlugins.direnv-vim;
@ -2160,6 +2175,7 @@ in {

          # dap # Debug adapter protocol # TODO:
          # dap-ui # Debugger UI # TODO:
+          devdocs
          diffview # Git diff # TODO: Check the keybindings

          direnv # Automatically load local environments
--- a/home/homemodules/neovim/mappings.nix
+++ b/home/homemodules/neovim/mappings.nix
@ -505,6 +505,48 @@ _: let
      action = "<cmd>lua Snacks.picker.help()<cr>";
      options.desc = "Helptags Picker";
    }
+    {
+      mode = "n";
+      key = "<leader>hd";
+      action = "+devdocs";
+    }
+    # {
+    #   mode = "n";
+    #   key = "<leader>hdd";
+    #   action.__raw = ''
+    #     function()
+    #       local devdocs = require("devdocs")
+    #       local installedDocs = devdocs.GetInstalledDocs()
+    #       vim.ui.select(installedDocs, {}, function(selected)
+    #         if not selected then
+    #           return
+    #         end
+    #         local docDir = devdocs.GetDocDir(selected)
+    #         -- prettify the filename as you wish
+    #         Snacks.picker.files({ cwd = docDir })
+    #       end)
+    #     end
+    #   '';
+    #   options.desc = "Open Devdocs";
+    # }
+    {
+      mode = "n";
+      key = "<leader>hdd";
+      action = "<cmd>DevDocs get<cr>";
+      options.desc = "Open Devdocs in Split";
+    }
+    {
+      mode = "n";
+      key = "<leader>hdi";
+      action = "<cmd>DevDocs install<cr>";
+      options.desc = "Install Devdocs";
+    }
+    {
+      mode = "n";
+      key = "<leader>hdD";
+      action = "<cmd>DevDocs delete<cr>";
+      options.desc = "Delete Devdocs";
+    }
  ];

  leader-quit = [
--- a/home/homemodules/neovim/vim_opts.nix
+++ b/home/homemodules/neovim/vim_opts.nix
@ -1,4 +1,4 @@
-_: {
+{config, ...}: {
  showmode = false; # Status line already shows this
  backspace = ["indent" "eol" "start"];
  termguicolors = true; # Required by multiple plugins
@ -37,7 +37,7 @@ _: {
  # swapfile = true;
  # backup = false;
  undofile = true;
-  undodir = "/home/christoph/.vim/undo";
+  undodir = "${config.home.homeDirectory}/.vim/undo";
  undolevels = 10000;
  # autochdir = true;
  confirm = true;
--- a/home/homemodules/niri/default.nix
+++ b/home/homemodules/niri/default.nix
@ -19,30 +19,43 @@ in {
      }
    ];

-    gtk = {
-      enable = true;
-      iconTheme.package = color.iconPackage;
-      iconTheme.name = color.iconTheme;
+    gtk = let
+      gtkConfig = {
+        enable = true;

-      colorScheme = "dark";
-      gtk3.colorScheme = "dark";
-      gtk4.colorScheme = "dark";
+        colorScheme = "dark";

-      theme = {
-        # name = "adw-gtk3-dark";
-        # package = pkgs.adw-gtk3;
-        name = "catppuccin-mocha-mauve-standard";
-        package = pkgs.catppuccin-gtk.override {
-          variant = "mocha";
-          accents = ["mauve"];
-          size = "standard";
+        iconTheme = {
+          package = color.iconPackage;
+          name = color.iconTheme;
+        };
+
+        cursorTheme = {
+          name = color.cursor;
+          package = color.cursorPackage;
+        };
+
+        theme = {
+          # name = "adw-gtk3-dark";
+          # package = pkgs.adw-gtk3;
+          name = "catppuccin-mocha-mauve-standard";
+          package = pkgs.catppuccin-gtk.override {
+            variant = "mocha";
+            accents = ["mauve"];
+            size = "standard";
+          };
        };
      };

-      gtk3.extraConfig = {
+      gtkExtraConfig = {
        gtk-application-prefer-dark-theme = 1;
      };
-    };
+    in
+      gtkConfig
+      // {
+        gtk3 = gtkConfig // {extraConfig = gtkExtraConfig;};
+        gtk4 = gtkConfig // {extraConfig = gtkExtraConfig;};
+      };

    dconf = {
      enable = true;
@ -132,6 +145,7 @@ in {
        wiremix # Audio control
        swww
        waypaper
+        wtype # For elephant

        # GTK apps (look good and work well with xdg portals)
        nautilus # Fallback file chooser used by xdg-desktop-portal-gnome
@ -195,6 +209,10 @@ in {
            default = ["desktopapplications"];
          };
          empty = ["desktopapplications"];
+
+          selection_wrap = true;
+          hide_quick_activation = true;
+          actions_as_menu = true;
        };

        themes."cattpuccin-mocha" = let
@ -644,8 +662,112 @@ in {
          };

          # TODO: Move values to config option and set in home/christoph/niri.nix
-          binds = with config.lib.niri.actions; {
+          binds = with config.lib.niri.actions; let
+            sessionMenu = mylib.rofi.mkMenu {
+              prompt = "Session";
+              layers = [
+                {
+                  "󰤂  Poweroff" = "poweroff";
+                  "󰜉  Reboot" = "reboot";
+                  "󰌾  Lock" = "loginctl lock-session";
+                  # "  Reload Hyprpanel" = "systemctl --user restart hyprpanel.service";
+                  # "  Reload Hyprland" = "hyprctl reload";
+                  # "  Exit Hyprland" = "hyprctl dispatch exit";
+                  "  Exit Niri" = "niri msg action quit";
+                }
+              ];
+              prompts = ["Select Session Action"];
+              rofiCmd = "walker -d";
+            };
+            wallpaperMenu = mylib.rofi.mkMenu {
+              prompt = "Wallpaper";
+              layers = [
+                "eza -1 ${config.paths.nixflake}/wallpapers"
+              ];
+              prompts = ["Select Wallpaper"];
+              # Use waypaper instead of swww directly, so the chosen wallpaper will be restored after reboot
+              command = "waypaper --wallpaper ${config.paths.nixflake}/wallpapers/$OPTION0";
+              rofiCmd = "walker -d";
+            };
+            # No lectures anymore :) - Kept as example
+            lecturesMenu = mylib.rofi.mkMenu {
+              prompt = "Lecture";
+              layers = [
+                "eza -1 -D ~/Notes/TU"
+                "eza -1 -D ~/Notes/TU/$OPTION0"
+                "eza -1 ~/Notes/TU/$OPTION0/$OPTION1 | grep '.pdf'"
+              ];
+              prompts = [
+                "Select Lecture"
+                "Select Subfolder"
+                "Select Deck"
+              ];
+              command = "xdg-open ~/Notes/TU/$OPTION0/$OPTION1/$OPTION2";
+              rofiCmd = "walker -d";
+            };
+            # niriMenu = mylib.rofi.mkMenu {
+            #   prompt = "Niri";
+            #   layers = [
+            #     {
+            #       "󰹑  Take Region Screenshot" = "niri msg action screenshot -p false";
+            #       "󰹑  Take Window Screenshot" = "niri msg action screenshot-window -p false -d true";
+            #       "󰹑  Take Full-Screen Screenshot" = "niri msg action screenshot-screen -p false -d true";
+            #     }
+            #   ];
+            #   prompts = ["Execute Niri Action"];
+            #   rofiCmd = "walker -d";
+            # };
+            globalMenu = mylib.rofi.mkMenu {
+              prompt = "Global";
+              layers = [
+                {
+                  "  Control Session" = "${sessionMenu}/bin/rofi-menu-Session";
+                  "󰸉  Change Wallpaper" = "${wallpaperMenu}/bin/rofi-menu-Wallpaper";
+                  "󰋗  View Keybindings" = "niri msg action show-hotkey-overlay";
+                  "  Open Lecture Material" = "${lecturesMenu}/bin/rofi-menu-Lecture";
+                  # "  Niri Actions" = "${niriMenu}/bin/rofi-menu-Niri";
+                  # TODO: What else? SSH menu?
+                }
+              ];
+              prompts = ["Select Action"];
+              rofiCmd = "walker -d";
+            };
+          in {
+            # DMenu
+            "Mod+Shift+A" = {
+              action = spawn "walker" "-m" "providerlist";
+              hotkey-overlay = {title = "Toggle the launcher.";};
+            };
+            "Mod+A" = {
+              action = spawn "walker" "-m" "desktopapplications";
+              hotkey-overlay = {title = "Toggle the application launcher.";};
+            };
+            "Mod+C" = {
+              action = spawn "walker" "-m" "clipboard";
+              hotkey-overlay = {title = "Show clipboard history.";};
+            };
+            "Mod+Escape" = {
+              action = spawn "${sessionMenu}/bin/rofi-menu-Session";
+              hotkey-overlay = {title = "Toggle the session menu.";};
+            };
+            "Mod+W" = {
+              action = spawn "${wallpaperMenu}/bin/rofi-menu-Wallpaper";
+              hotkey-overlay = {title = "Open wallpaper menu.";};
+            };
+            "Mod+D" = {
+              action = spawn "${globalMenu}/bin/rofi-menu-Global";
+              hotkey-overlay = {title = "Open global menu.";};
+            };
+
            # Applications
+            "Mod+Ctrl+W" = {
+              action = spawn "waypaper";
+              hotkey-overlay = {title = "Open waypaper.";};
+            };
+            "Mod+Shift+W" = {
+              action = spawn "waypaper" "--random";
+              hotkey-overlay = {title = "Select random wallpaper.";};
+            };
            "Mod+T" = {
              action = spawn "kitty";
              hotkey-overlay = {title = "Spawn Kitty.";};
@ -678,52 +800,24 @@ in {
              action = spawn "neovide" "${config.paths.dotfiles}/flake.nix";
              hotkey-overlay = {title = "Edit the NixFlake.";};
            };
-            "Mod+W" = {
-              action = spawn "waypaper";
-              hotkey-overlay = {title = "Open wallpaper chooser.";};
-            };
-            "Mod+Shift+W" = {
-              action = spawn "waypaper" "--random";
-              hotkey-overlay = {title = "Select random wallpaper.";};
-            };
-
-            "Mod+A" = {
-              action = spawn "walker" "-m" "desktopapplications";
-              hotkey-overlay = {title = "Toggle the application launcher.";};
-            };
-            "Mod+Shift+A" = {
-              action = spawn "walker" "-m" "providerlist";
-              hotkey-overlay = {title = "Toggle the launcher.";};
-            };
-            "Mod+Escape" = let
-              powerMenu = mylib.rofi.mkSimpleMenu rec {
-                prompt = "Session";
-                attrs = {
-                  "󰤂  Poweroff" = "poweroff";
-                  "󰜉  Reboot" = "reboot";
-                  "󰌾  Lock" = "loginctl lock-session";
-                  # "  Reload Hyprpanel" = "systemctl --user restart hyprpanel.service";
-                  # "  Reload Hyprland" = "hyprctl reload";
-                  # "  Exit Hyprland" = "hyprctl dispatch exit";
-                };
-                command = "walker -d -p ${prompt}";
-              };
-            in {
-              action = spawn "${powerMenu}/bin/rofi-menu-Session";
-              hotkey-overlay = {title = "Toggle the session menu.";};
-            };
-            "Mod+C" = {
-              action = spawn "walker" "-m" "clipboard";
-              hotkey-overlay = {title = "Show clipboard history.";};
-            };

            # Screenshots
            "Mod+S" = {
-              action.screenshot-window = {write-to-disk = true;};
+              action.screenshot-window = {
+                write-to-disk = true;
+                show-pointer = false;
+              };
              hotkey-overlay = {title = "Take a screenshot of the current window.";};
            };
+            "Mod+Ctrl+S" = {
+              action.screenshot-screen = {
+                write-to-disk = true;
+                show-pointer = false;
+              };
+              hotkey-overlay = {title = "Take a screenshot of the current screen.";};
+            };
            "Mod+Shift+S" = {
-              action.screenshot = {show-pointer = true;};
+              action.screenshot = {show-pointer = false;};
              hotkey-overlay = {title = "Take a screenshot of a region.";};
            };

--- a/home/homemodules/packages/default.nix
+++ b/home/homemodules/packages/default.nix
@ -0,0 +1,220 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  headless,
+  inputs,
+  ...
+}: let
+  inherit (config.homemodules) packages color;
+in {
+  options.homemodules.packages = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf packages.enable {
+    # TODO: Add extra packages option and use that from host-specific configs
+    home.packages = with pkgs;
+      lib.mkMerge [
+        # Common packages
+        [
+          # Shell utils
+          (ripgrep.override {withPCRE2 = true;}) # fast as fuck
+          gdu # Alternative to du-dust (I like it better)
+          duf # Disk usage analyzer (for all disk overview)
+          sd # Sed alternative
+          fclones # Duplicate file finder
+          tealdeer # Very fast tldr (so readable man)
+          killall
+          atool # Archive preview
+          exiftool
+          ouch # Unified compression/decompression
+          ffmpegthumbnailer # Video thumbnails
+          mediainfo # Media meta information
+          file # File meta information
+          unrar # Cooler WinRar
+          p7zip # Zip stuff
+          unzip # Unzip stuff
+          progress # Find coreutils processes and show their progress
+          tokei # Text file statistics in a project
+          ttyper
+          wiki-tui
+
+          # Nix
+          nix-search-tv # Search nixpkgs, nur, nixos options and homemanager options
+          nix-tree # Browse the nix store sorted by size (gdu for closures)
+          inputs.nps.packages.${pkgs.stdenv.hostPlatform.system}.default # Search nixpkgs
+
+          # Video/Image/Audio utils
+          ffmpeg-full # I love ffmpeg (including ffplay)
+          ffmpeg-normalize # Normalize audio
+
+          # Document utils
+          poppler-utils # pdfunite
+          pdf2svg # extract vector graphics from pdf
+          pandoc # document converting madness
+
+          # Networking
+          dig # Make DNS requests
+          tcpdump # Listen in on TCP traffic
+          gping # ping with graph
+          curlie # curl a'la httpie
+          wget # download that shit
+          doggo # dns client
+          rsync # cp on steroids
+          rclone # Rsync for cloud
+          httpie # Cool http client
+          speedtest-cli
+          bandwhich
+          snitch
+
+          # Use NixCommunity binary cache
+          cachix
+        ]
+
+        # Common !headless packages
+        (lib.optionals (!headless) [
+          ripdrag # drag & drop from terminal
+          # jellyfin-tui # Use module
+        ])
+
+        # Linux exclusive packages
+        (lib.optionals (pkgs.stdenv.isLinux) [
+          pastel # Color tools
+          nvd # Nix rebuild diff
+          nurl # Generate nix fetcher sections based on URLs
+          python313 # Nicer scripting than bash
+          lazyjournal # Journalctl viewer
+          systemctl-tui
+          restic # Backups
+          gnumake
+          just # make alternative
+          binsider # .elf analyzer
+          jujutsu # git-like vcs
+          lurk # strace analysis
+          radare2
+
+          # Hardware/Software info
+          pciutils # lspci
+          mesa-demos # OpenGL info
+          wayland-utils # wayland-info
+          clinfo # OpenCL info
+          vulkan-tools # vulkaninfo
+          libva-utils # vainfo
+          vdpauinfo # Video-Decode and Presentation API for Unix info
+          hwloc # Generate CPU topology diagram
+          lm_sensors # Readout hardware sensors
+          acpica-tools # Dump ACPI tables etc.
+          smartmontools # Disk health
+          nvme-cli # NVME disk health
+
+          # Video/Image/Audio utils
+          imagemagick # Convert image (magic)
+          mp3val # Validate mp3 files
+          flac # Validate flac files
+
+          # Document utils
+          graphviz # generate graphs from code
+          d2 # generate diagrams from code
+          plantuml # generate diagrams
+          gnuplot # generate function plots
+
+          # Networking
+          traceroute # "Follow" a packet
+          cifs-utils # Mount samba shares
+          nfs-utils # Mount NFS shares
+          sshfs # Mount remote directories via SSH
+
+          # Run unpatched binaries on NixOS
+          # Sets NIX_LD_LIBRARY_PATH and NIX_LD variables for nix-ld.
+          # Usage: "nix-alien-ld -- <Executable>".
+          inputs.nix-alien.packages.${pkgs.stdenv.hostPlatform.system}.nix-alien
+        ])
+
+        # Linux exclusive packages (!headless)
+        (lib.optionals (pkgs.stdenv.isLinux && (!headless)) [
+          wl-clipboard
+
+          # Proton
+          proton-vpn
+          protonmail-bridge-gui
+
+          # GUI stuff
+          nautilus # Just in case
+          signal-desktop
+          anki
+          font-manager # Previews fonts, but doesn't set them
+          nextcloud-client
+          keepassxc
+          thunderbird # TODO: Email module
+          obsidian
+          zotero
+          zeal # docs browser
+          # helvum # unmaintained
+          crosspipe
+          vlc
+          audacity
+          ferdium
+          gparted
+          # feishin # electron :(
+          playerctl # Media player control
+          czkawka-full # file deduplicator
+
+          # Office
+          kdePackages.wacomtablet # For xournalpp/krita
+          xournalpp # Write with a pen, like old people
+          hunspell # I cna't type
+          hunspellDicts.en_US
+          hunspellDicts.de_DE
+
+          inputs.masssprings.packages.${stdenv.hostPlatform.system}.default
+        ])
+
+        # Darwin exclusive packages
+        (lib.optionals pkgs.stdenv.isDarwin [
+          # Use homebrew instead
+          # alt-tab-macos
+          # discord
+          # obsidian
+          # nextcloud-client
+          # proton-vpn
+          # iina
+        ])
+      ];
+
+    programs = {
+      # The home-manager management tool.
+      # Will only be enabled if HM is installed standalone.
+      home-manager.enable = true;
+
+      direnv = {
+        enable = true;
+        nix-direnv.enable = true;
+      };
+
+      eza = {
+        enable = true;
+        enableFishIntegration = config.homemodules.fish.enable;
+      };
+
+      fd.enable = true;
+
+      fzf = {
+        enable = true;
+        enableFishIntegration = config.homemodules.fish.enable;
+      };
+
+      navi = {
+        enable = true;
+        enableFishIntegration = config.homemodules.fish.enable;
+      };
+
+      yt-dlp.enable = true;
+
+      zoxide = {
+        enable = true;
+        enableFishIntegration = config.homemodules.fish.enable;
+      };
+    };
+  };
+}
--- a/home/homemodules/packages/options.nix
+++ b/home/homemodules/packages/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable common packages";
+}
--- a/home/homemodules/ssh/default.nix
+++ b/home/homemodules/ssh/default.nix
@ -0,0 +1,73 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) ssh color;
+in {
+  options.homemodules.ssh = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf ssh.enable {
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+
+      matchBlocks = {
+        "*" = {
+          forwardAgent = false;
+          addKeysToAgent =
+            if pkgs.stdenv.isLinux
+            then "no"
+            else "yes"; # Don't have keychain on darwin
+          compression = true;
+          serverAliveInterval = 0;
+          serverAliveCountMax = 3;
+          hashKnownHosts = false;
+          userKnownHostsFile = "~/.ssh/known_hosts";
+          controlMaster = "no";
+          controlPath = "~/.ssh/master-%r@%n:%p";
+          controlPersist = "no";
+        };
+        "nixinator" = {
+          port = 5432;
+          user = "christoph";
+          hostname = "vps.chriphost.de";
+        };
+        "servenix" = {
+          user = "christoph";
+          hostname = "local.chriphost.de";
+        };
+        "thinknix" = {
+          user = "christoph";
+          hostname = "think.chriphost.de";
+        };
+        "vps" = {
+          user = "root";
+          hostname = "vps.chriphost.de";
+        };
+        "mars" = {
+          user = "smchurla";
+          hostname = "mars.cs.tu-dortmund.de";
+          serverAliveInterval = 60;
+          localForwards = [
+            {
+              # Resultbrowser
+              bind.port = 22941;
+              host.address = "127.0.0.1";
+              host.port = 22941;
+            }
+            {
+              # Mysql
+              bind.port = 3306;
+              host.address = "127.0.0.1";
+              host.port = 3306;
+            }
+          ];
+        };
+      };
+    };
+  };
+}
--- a/home/homemodules/ssh/options.nix
+++ b/home/homemodules/ssh/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable ssh";
+}
--- a/home/homemodules/terminal/default.nix
+++ b/home/homemodules/terminal/default.nix
@ -0,0 +1,44 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  headless,
+  ...
+}: let
+  inherit (config.homemodules) terminal color;
+in {
+  options.homemodules.terminal = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf terminal.enable {
+    homemodules = {
+      bat.enable = true;
+      btop.enable = true;
+      fastfetch.enable = true;
+      fish.enable = true;
+
+      git = {
+        enable = true;
+
+        userName = "Christoph Urlacher";
+        userEmail = "christoph.urlacher@protonmail.com";
+        signCommits = true;
+      };
+
+      jellyfin-tui.enable = true;
+      kitty.enable = true;
+      lazygit.enable = true;
+
+      neovim = {
+        enable = true;
+        alias = true;
+        neovide = !headless;
+      };
+
+      ssh.enable = true;
+      tmux.enable = true;
+      yazi.enable = true;
+    };
+  };
+}
--- a/home/homemodules/terminal/options.nix
+++ b/home/homemodules/terminal/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable terminal tools";
+}
--- a/home/homemodules/tmux/default.nix
+++ b/home/homemodules/tmux/default.nix
@ -0,0 +1,38 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) tmux color;
+in {
+  options.homemodules.tmux = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf tmux.enable {
+    programs.tmux = {
+      enable = true;
+
+      clock24 = true;
+      escapeTime = 0; # Delay after pressing escape
+      # keyMode = "vi";
+      terminal = "xterm-256color";
+
+      plugins = with pkgs; [
+        {
+          plugin = tmuxPlugins.catppuccin;
+          extraConfig = ''
+            set -g @plugin 'catppuccin/tmux'
+            set -g @catppuccin_flavour 'latte' # or frappe, macchiato, mocha
+          '';
+        }
+      ];
+
+      extraConfig = ''
+        set -g default-terminal "xterm-256color"
+        set-option -ga terminal-overrides ",xterm-256color:Tc"
+      '';
+    };
+  };
+}
--- a/home/homemodules/tmux/options.nix
+++ b/home/homemodules/tmux/options.nix
@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable tmux";
+}
--- a/home/homemodules/waybar/default.nix
+++ b/home/homemodules/waybar/default.nix
@ -24,7 +24,7 @@ in {
          output = waybar.monitors;

          modules-left = ["custom/launcher" "niri/workspaces" "niri/window"]; # "user"
-          modules-center = ["systemd-failed-units" "mpris"];
+          modules-center = ["mpris"]; # "systemd-failed-units"
          modules-right = ["privacy" "pulseaudio" "network" "disk" "cpu" "memory" "clock" "tray"];

          "custom/launcher" = {
@ -77,11 +77,11 @@ in {
                tooltip = true;
                tooltip-icon-size = 24;
              }
-              {
-                type = "audio-out";
-                tooltip = true;
-                tooltip-icon-size = 24;
-              }
+              # {
+              #   type = "audio-out";
+              #   tooltip = true;
+              #   tooltip-icon-size = 24;
+              # }
              {
                type = "audio-in";
                tooltip = true;
@ -105,30 +105,29 @@ in {
          };

          disk = {
+            interval = 5;
            format = "<span>󰋊</span> {percentage_used}%";
            on-click = "kitty --hold --title=Duf duf --hide-mp '/var/*,/etc/*,/usr/*,/home/christoph/.*' -width 120";
          };

          cpu = {
-            states = {
-              "warning" = 65;
-              "critical" = 85;
-            };
+            interval = 1;
+            # states = {
+            #   "critical" = 85;
+            # };
            format = "<span></span> {load}%";
-            format-warning = "<span color='#${color.hex.yellow}'><span></span> {load}%</span>";
-            format-critical = "<span color='#${color.hex.red}'><span></span> {load}%</span>";
+            # format-critical = "<span color='#${color.hex.red}'><span></span> {load}%</span>";
            on-click = "kitty --title=Btop btop";
            tooltip = false;
          };

          memory = {
-            states = {
-              "warning" = 65;
-              "critical" = 85;
-            };
+            interval = 1;
+            # states = {
+            #   "critical" = 85;
+            # };
            format = "<span></span> {percentage}%";
-            format-warning = "<span color='#${color.hex.yellow}'><span></span> {percentage}%</span>";
-            format-critical = "<span color='#${color.hex.red}'><span></span> {percentage}%</span>";
+            # format-critical = "<span color='#${color.hex.red}'><span></span> {percentage}%</span>";
            on-click = "kitty --title=Btop btop";
            tooltip = true;
            tooltip-format = "RAM:  {used}GiB / {total}GiB\nSwap: {swapUsed}GiB / {swapTotal}GiB";
@ -144,7 +143,7 @@ in {
              mode-mon-col = 3;
              on-scroll = -1;
              format = {
-                months = "<span color='#${color.hex.yellow}'><b>{}</b></span>";
+                months = "<span color='#${color.hex.peach}'><b>{}</b></span>";
                days = "<span color='#${color.hex.flamingo}'><b>{}</b></span>";
                weeks = "<span color='#${color.hex.teal}'><b>W{}</b></span>";
                weekdays = "<span color='#${color.hex.lavender}'><b>{}</b></span>";
@ -194,24 +193,26 @@ in {
        }

        /* Background colors */
-        #custom-launcher          {background-color: #${color.hex.accent};}
-        #workspaces button        {background-color: #${color.hex.lavender};}
-        #workspaces button.active {background-color: #${color.hex.pink};}
-        #window                   {background-color: #${color.hex.maroon};}
-        #systemd-failed-units     {background-color: #${color.hex.red};}
-        #mpris                    {background-color: #${color.hex.accent};}
-        #privacy                  {background-color: #${color.hex.red};}
-        #pulseaudio               {background-color: #${color.hex.maroon};}
-        #network                  {background-color: #${color.hex.peach};}
-        #disk                     {background-color: #${color.hex.yellow};}
-        #cpu                      {background-color: #${color.hex.green};}
-        #memory                   {background-color: #${color.hex.teal};}
-        #clock                    {background-color: #${color.hex.sky};}
-        #tray                     {background-color: #${color.hex.accent};}
+        #custom-launcher           {background-color: #${color.hex.accent};}
+        #workspaces button         {background-color: #${color.hex.blue};}
+        #workspaces button.empty   {background-color: #${color.hex.lavender};}
+        #workspaces button.active  {background-color: #${color.hex.green};}
+        #workspaces button.urgent  {background-color: #${color.hex.red};}
+        #window                    {background-color: #${color.hex.maroon};}
+
+        #mpris                     {background-color: #${color.hex.accent};}
+
+        #privacy                   {background-color: #${color.hex.red};}
+        #pulseaudio                {background-color: #${color.hex.maroon};}
+        #network                   {background-color: #${color.hex.peach};}
+        #disk                      {background-color: #${color.hex.yellow};}
+        #cpu                       {background-color: #${color.hex.green};}
+        #memory                    {background-color: #${color.hex.teal};}
+        #clock                     {background-color: #${color.hex.sky};}
+        #tray                      {background-color: #${color.hex.accent};}

        /* Square Widgets */
        #custom-launcher,
-        #systemd-failed-units,
        #mpris,
        #tray {
          color: #${color.hex.mantle};
@ -260,10 +261,6 @@ in {
          margin: 0px 5px 0px 0px;
        }

-        #systemd-failed-units {
-          margin: 0px 5px 0px 0px;
-        }
-
        #tray {
          margin: 0px 0px 0px 5px;
        }
--- a/lib/containers.nix
+++ b/lib/containers.nix
@ -0,0 +1,13 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}: {
+  # Standard DockerHub login used by all oci-container services.
+  # Usage: login = mylib.containers.mkDockerLogin config;
+  mkDockerLogin = config: {
+    username = "christoph.urlacher@protonmail.com";
+    passwordFile = "${config.sops.secrets.docker-password.path}";
+  };
+}
--- a/lib/default.nix
+++ b/lib/default.nix
@ -13,4 +13,5 @@
  rofi = import ./rofi.nix {inherit inputs pkgs lib;};
  generators = import ./generators.nix {inherit inputs pkgs lib;};
  color = import ./color.nix {inherit inputs pkgs lib;};
+  containers = import ./containers.nix {inherit inputs pkgs lib;};
 }
--- a/lib/networking.nix
+++ b/lib/networking.nix
@ -43,6 +43,8 @@
    routers,
    nameservers,
    routable,
+    # Extra addresses declared without creating routes (e.g. IPv6 ULA).
+    extraAddresses ? [],
  }: {
    enable = true;

@ -56,7 +58,8 @@
    address = ips;
    gateway = routers;
    dns = nameservers;
-    routes = builtins.map (r: {Gateway = r;}) routers; # TODO: We need to add a way to specify addresses without routes (IPv6 ULA)
+    routes = builtins.map (r: {Gateway = r;}) routers;
+    addresses = builtins.map (a: {Address = a;}) extraAddresses;

    # See man systemd.network
    networkConfig = {
--- a/lib/nixos.nix
+++ b/lib/nixos.nix
@ -4,6 +4,26 @@
  lib,
  ...
 }: {
+  # Common nix daemon settings shared between NixOS and nix-darwin.
+  # Darwin additionally needs nix.enable = true.
+  mkCommonNixSettings = username: {
+    enable = true;
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes pipe-operators
+    '';
+    settings.trusted-users = ["root" username];
+    gc.automatic = false;
+    gc.options = "--delete-older-than 5d";
+    settings.auto-optimise-store = true;
+    optimise.automatic = true;
+    registry = lib.mapAttrs' (n: v: lib.nameValuePair n {flake = v;}) inputs;
+    nixPath = [
+      "nixpkgs=${inputs.nixpkgs.outPath}"
+      "home-manager=${inputs.home-manager.outPath}"
+    ];
+  };
+
  mkNixosConfigWithHomeManagerModule = {
    system,
    mylib,
@ -110,7 +130,7 @@
          ../system/${hostname}

          # Import all of my custom system modules
-          # ../system/systemmodules # TODO:
+          ../system/systemmodules/darwin.nix
        ]

        extraModules
--- a/lib/rofi.nix
+++ b/lib/rofi.nix
@ -3,79 +3,164 @@
  pkgs,
  lib,
  ...
-}: rec {
+}: {
  # Receives attrs like:
  # {
  #   "Poweroff" = "poweroff";
  #   "Reload Hyprland" = "hyprctl reload";
  # }
-  mkSimpleMenu = let
-    # Makes a string like ''"Poweroff" "Reload Hyprland"''
-    unpack-options = attrs: "\"${lib.concatStringsSep "\" \"" (builtins.attrNames attrs)}\"";
+  # mkSimpleMenu = let
+  #   # Makes a string like ''"Poweroff" "Reload Hyprland"''
+  #   unpack-options = attrs: "\"${lib.concatStringsSep "\" \"" (builtins.attrNames attrs)}\"";
+  #
+  #   mkCase = option: action: "else if test \"${option}\" = $OPTION\n    set ACTION \"${action}\"";
+  #
+  #   cases = attrs:
+  #     attrs
+  #     |> builtins.mapAttrs mkCase
+  #     |> builtins.attrValues
+  #     |> builtins.concatStringsSep "\n";
+  # in
+  #   {
+  #     prompt,
+  #     attrs,
+  #     command ? ''rofi -dmenu -i'',
+  #   }:
+  #     pkgs.writeScriptBin "rofi-menu-${prompt}" ''
+  #       #! ${pkgs.fish}/bin/fish
+  #
+  #       # OPTIONS contains all possible values Rofi will display
+  #       set OPTIONS ${unpack-options attrs}
+  #
+  #       # We choose a single OPTION using Rofi
+  #       set OPTION (echo -e (string join "\n" $OPTIONS) | ${command} -p "${prompt}")
+  #
+  #       # Check if the chosen OPTION is a valid choice from OPTIONS
+  #       if not contains $OPTION $OPTIONS
+  #           exit
+  #       end
+  #
+  #       # Set a command to execute based on the chosen OPTION
+  #       if false
+  #           exit # Easier to generate with this
+  #       ${cases attrs}
+  #       else
+  #           exit
+  #       end
+  #
+  #       # Execute the command
+  #       eval $ACTION
+  #     '';

-    mkCase = option: action: "else if test \"${option}\" = $OPTION\n    set ACTION \"${action}\"";
+  # Rofi/Dmenu menu generator.
+  #
+  # Each element in `layers` is one of:
+  #   - attrset { "Label" = "value"; } # static options: selected value → $OPTIONn
+  #   - string  "shell-cmd"            # dynamic options from command: selected text → $OPTIONn
+  #                                    # may reference $OPTION0, $OPTION1, ... from earlier layers
+  #
+  # The "command" is the last action, it can reference $OPTION0, $OPTION1, ...
+  # If no "command" is given and the last layer is a static attrset, its selected value is evaluated directly.
+  #
+  # The "prompts" list are optional per-layer prompt strings (falls back to "prompt" if not provided).
+  #
+  # vpn.fish equivalent:
+  #   mkMenu {
+  #     prompt = "vpn";
+  #     layers = [
+  #       "cat /etc/rofi-vpns"
+  #       { "start" = "start"; "stop" = "stop"; "status" = "status"; }
+  #     ];
+  #     command = "systemctl $OPTION1 $OPTION0.service";
+  #   }
+  #
+  # lectures.fish equivalent:
+  #   mkMenu {
+  #     prompt = "lecture";
+  #     layers = [
+  #       "eza -1 -D ~/Notes/TU"
+  #       "eza -1 ~/Notes/TU/$OPTION0/Lecture | grep '.pdf'"
+  #     ];
+  #     command = "xdg-open ~/Notes/TU/$OPTION0/Lecture/$OPTION1";
+  #   }
+  mkMenu = {
+    prompt,
+    layers,
+    prompts ? [],
+    command ? null,
+    rofiCmd ? "rofi -dmenu -i",
+  }: let
+    isStaticLayer = layer: builtins.isAttrs layer && !(layer ? options);
+    isDynamicLayer = layer: builtins.isString layer;

-    cases = attrs:
-      attrs
-      |> builtins.mapAttrs mkCase
-      |> builtins.attrValues
-      |> builtins.concatStringsSep "\n";
-  in
-    {
-      prompt,
-      attrs,
-      command ? ''rofi -dmenu -p " ${prompt} " -i'',
-    }:
-      pkgs.writeScriptBin "rofi-menu-${prompt}" ''
-        #! ${pkgs.fish}/bin/fish
+    escStr = s: builtins.replaceStrings [''"'' "\\"] [''\"'' "\\\\"] s;

-        # OPTIONS contains all possible values Rofi will display
-        set OPTIONS ${unpack-options attrs}
+    layerPrompt = i:
+      if i < builtins.length prompts
+      then lib.elemAt prompts i
+      else prompt;

-        # We choose a single OPTION using Rofi
-        set OPTION (echo -e (string join "\n" $OPTIONS) | ${command})
-
-        # Check if the chosen OPTION is a valid choice from OPTIONS
-        if not contains $OPTION $OPTIONS
+    # Static layer: attrset of label -> value
+    # Displays labels in rofi; maps selected label to its value -> $OPTIONi
+    mkStaticLayer = i: attrs: let
+      lp = layerPrompt i;
+      labels = builtins.attrNames attrs;
+      optsStr = "\"${lib.concatStringsSep "\" \"" (map escStr labels)}\"";
+      mkCase = label: value: "else if test \"${escStr label}\" = $_LABEL${toString i}\n    set OPTION${toString i} \"${escStr value}\"";
+      casesStr =
+        builtins.concatStringsSep "\n"
+        (builtins.attrValues (builtins.mapAttrs mkCase attrs));
+    in {
+      script = ''
+        set _OPTS${toString i} ${optsStr}
+        set _LABEL${toString i} (echo -e (string join "\n" $_OPTS${toString i}) | ${rofiCmd} -p "${lp}")
+        if not contains $_LABEL${toString i} $_OPTS${toString i}
            exit
        end
-
-        # Set a command to execute based on the chosen OPTION
        if false
-            exit # Easier to generate with this
-        ${cases attrs}
+            exit
+        ${casesStr}
        else
            exit
        end
-
-        # Execute the command
-        eval $ACTION
      '';
+    };

-  # TODO: I want to generate the containers menu using the actionsA and actionsB attrs:
-  #       - actionsA will be generated from the stuff in oci-containers.containers
-  #       - actionsB will be set statically for start, stop, status
+    # Dynamic layer: shell command string whose output is piped to rofi
+    # Selected text -> $OPTIONi; may reference earlier $OPTIONn variables
+    mkDynamicLayer = i: cmd: let
+      lp = layerPrompt i;
+    in {
+      script = ''
+        set OPTION${toString i} (${cmd} | ${rofiCmd} -p "${lp}")
+        if test -z $OPTION${toString i}
+            exit
+        end
+      '';
+    };

-  # Receives attrs like:
-  # {
-  #   optionA = "exa -1 -D ~/Notes/TU";
-  #   optionB = "exa -1 -D ~/Notes/TU/$OPTIONA/Lecture | grep \".pdf\"";
-  #   commandB = "xdg-open ~/Notes/TU/$OPTIONA/Lecture/$OPTIONB";
-  # }
-  #
-  # Keys:
-  # - optionA, optionB   # Command that generates Rofi options:
-  #                        exa -1 -D ~/Notes/TU
-  #                        cat /etc/rofi-vpns
-  # - commandA, commandB # Action to execute after sth. was chosen (mutually excl. with command)
-  # - actionsA, actionsB # Configure actions by lookup (mutually excl. with command):
-  #                        actionsB = {"status" = "systemctl status..."}
-  # - colorA, colorB     # Configure highlighting conditions:
-  #                        colorA = {"red" = "systemctl ... | grep ..."};
-  #
-  # Use $OPTIONA and $OPTIONB to use the options chosen by option<A/B>-command and rofi
-  # Use $EVALA and $EVALB to use the outputs generated by command<A/B>
-  mkMenu = let
+    mkLayer = i: layer:
+      if isStaticLayer layer
+      then mkStaticLayer i layer
+      else if isDynamicLayer layer
+      then mkDynamicLayer i layer
+      else throw "mkMenu: layer ${toString i} has invalid type";
+
+    layerResults = lib.imap0 mkLayer layers; # Map with 0-based index
+    layerScripts = map (r: r.script) layerResults;
+    lastLayer = lib.last layers;
+
+    finalCmd =
+      if command != null
+      then command
+      else if isStaticLayer lastLayer
+      then "$OPTION${toString (builtins.length layers - 1)}"
+      else throw "mkMenu: 'command' must be set when the last layer is not a static attrset";
  in
-    prompt: attrs: "";
+    pkgs.writeScriptBin "rofi-menu-${prompt}" ''
+      #! ${pkgs.fish}/bin/fish
+
+      ${lib.concatStringsSep "\n" layerScripts}
+      eval "${finalCmd}"
+    '';
 }
--- a/system/darwinix/default.nix
+++ b/system/darwinix/default.nix
@ -7,34 +7,94 @@
  config,
  inputs,
  publicKeys,
+  hostname,
  ...
 }: {
-  nix = {
-    package = pkgs.nixVersions.stable;
-    extraOptions = ''
-      experimental-features = nix-command flakes pipe-operators
-    '';
+  systemmodules = {
+    sops-nix.bootSecrets.${username} = [
+      "user-password"
+    ];

-    settings.trusted-users = ["root" "${username}"];
-
-    gc.automatic = false;
-    gc.options = "--delete-older-than 5d";
-    settings.auto-optimise-store = true;
-    optimise.automatic = true;
-
-    registry = lib.mapAttrs' (n: v: lib.nameValuePair n {flake = v;}) inputs;
-
-    nixPath = [
-      "nixpkgs=${inputs.nixpkgs.outPath}"
-      "home-manager=${inputs.home-manager.outPath}"
+    sops-nix.secrets.${username} = [
+      "ssh-private-key"
+      "nix-github-token"
+      "docker-password"
+      "jellyfin-password"
    ];
  };

+  nix = mylib.nixos.mkCommonNixSettings username;
+
+  networking = {
+    hostName = "${hostname}";
+    localHostName = "${hostname}";
+    computerName = "${hostname}";
+
+    applicationFirewall = {
+      enable = true;
+      enableStealthMode = false;
+      allowSigned = true;
+      allowSignedApp = true;
+      blockAllIncoming = false;
+    };
+
+    knownNetworkServices = [
+      "Wi-Fi"
+      "Thunderbold Bridge"
+    ];
+
+    dns = [
+      "192.168.86.26"
+      "8.8.8.8"
+      "8.8.4.4"
+    ];
+
+    # wg-quick = {};
+  };
+
+  power = {
+    # restartAfterFreeze = false;
+    # restartAfterPowerFailure = false;
+
+    sleep = {
+      computer = 10; # 10 minutes until sleep
+      display = 5;
+      harddisk = 5;
+    };
+  };
+
+  system = {
+    primaryUser = "${username}";
+
+    # TODO:
+    defaults = {
+      # dock = {};
+
+      trackpad = {
+        ActuateDetents = true; # Haptic feedback
+        ActuationStrength = 1;
+        Clicking = true; # Tap to click
+        Dragging = true; # Double tap to drag
+        TrackpadRightClick = true;
+        TrackpadPinch = true;
+      };
+    };
+
+    keyboard = {
+      enableKeyMapping = true;
+      swapLeftCtrlAndFn = false;
+      swapLeftCommandAndLeftAlt = false;
+    };
+  };
+
  users.users.${username} = {
-    isHidden = false;
+    name = "${username}";
    description = "Christoph";
-    home = "/Users/${username}";
+    uid = 501;
+    gid = 20;
    createHome = false;
+    home = "/Users/${username}";
+    isHidden = false;

    # NOTE: Not set if the user already exists on darwin, so use chsh for the root user
    shell = pkgs.fish;
@ -46,16 +106,54 @@
    # packages = with pkgs; [];
  };

+  environment.shells = with pkgs; [pkgs.fish];
+
  environment.systemPackages = with pkgs; [
    alejandra
    neovim
    wget
  ];

+  fonts.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+    monolisa
+  ];
+
  programs = {
    fish.enable = true;
  };

+  services = {
+    # For another time maybe
+    # sketchybar = {};
+    # skhd = {};
+    # yabai = {};
+  };
+
+  # NOTE: Not installed automatically
+  homebrew = {
+    enable = true;
+    enableFishIntegration = true;
+
+    onActivation = {
+      autoUpdate = true;
+      cleanup = "zap"; # Uninstall unlisted casks and associated files on rebuild
+      upgrade = true;
+    };
+
+    brews = [];
+
+    casks = [
+      "alt-tab"
+      "discord"
+      "iina"
+      "nextcloud"
+      "obsidian"
+      "protonvpn"
+      "signal"
+    ];
+  };
+
  # Set Git commit hash for darwin-version.
  # system.configurationRevision = self.rev or self.dirtyRev or null;

--- a/system/default.nix
+++ b/system/default.nix
@ -91,6 +91,7 @@ with mylib.networking; {
      "ssh-private-key"
      "nix-github-token"
      "docker-password"
+      "jellyfin-password"
    ];
  };

@ -104,31 +105,7 @@ with mylib.networking; {
  };

  # Enable flakes
-  nix = {
-    package = pkgs.nixVersions.stable;
-    extraOptions = ''
-      experimental-features = nix-command flakes pipe-operators
-    '';
-
-    settings.trusted-users = ["root" "${username}"];
-
-    # Auto garbage-collect and optimize store
-    gc.automatic = false; #  Done by nh.clean.enable;
-    gc.options = "--delete-older-than 5d";
-    settings.auto-optimise-store = true;
-    optimise.automatic = true;
-
-    # This will add your inputs as registries, making operations with them (such
-    # as nix shell nixpkgs#name) consistent with your flake inputs.
-    # (Registry contains flakes)
-    registry = lib.mapAttrs' (n: v: lib.nameValuePair n {flake = v;}) inputs;
-
-    # Set NIX_PATH to find nixpgks
-    nixPath = [
-      "nixpkgs=${inputs.nixpkgs.outPath}"
-      "home-manager=${inputs.home-manager.outPath}"
-    ];
-  };
+  nix = mylib.nixos.mkCommonNixSettings username;

  # Bootloader/Kernel stuff
  boot = {
@ -258,6 +235,7 @@ with mylib.networking; {
    description = "Christoph";
    group = "users";
    uid = 1000;
+    home = "/home/${username}";
    extraGroups = [
      "networkmanager"
      "wheel"
--- a/system/nixinator/default.nix
+++ b/system/nixinator/default.nix
@ -124,6 +124,7 @@
        # 31431 # Parsec
        5173 # SvelteKit
        8090 # PocketBase
+        8188 # ComfyUI
      ];

      allowedUDPPorts = [
@ -134,6 +135,7 @@
        # 31431 # Parsec
        5173 # SvelteKit
        8090 # PocketBase
+        8188 # ComfyUI
      ];
    };

@ -156,7 +158,7 @@
  };

  boot = {
-    # kernelPackages = pkgs.linuxPackages_zen;
+    kernelPackages = pkgs.linuxPackages_zen;
    # kernelPackages = pkgs.linuxPackages_latest;

    # Why do I need to know if something fails during boot???
@ -191,7 +193,25 @@
    # };
  };

-  # environment.systemPackages = with pkgs; [];
+  environment.systemPackages = with pkgs; [
+    spice
+    spice-gtk
+  ];
+
+  virtualisation = {
+    libvirtd = {
+      enable = true;
+      qemu = {
+        package = pkgs.qemu_kvm;
+        # ovmf.enable = true; # deprecated
+        swtpm.enable = true;
+        runAsRoot = true;
+      };
+    };
+    spiceUSBRedirection.enable = true;
+  };
+
+  networking.firewall.trustedInterfaces = ["virbr0"]; # libvirt

  programs = {
    ausweisapp = {
@ -203,6 +223,8 @@
      enable = true;
      gdb = true;
    };
+
+    virt-manager.enable = true;
  };

  services = {
--- a/system/servenix/default.nix
+++ b/system/servenix/default.nix
@ -65,52 +65,13 @@
      useNetworkManager = false;

      networks = {
-        # "10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
-        #   interface = "ens18";
-        #   ips = ["192.168.86.25/24" "fd00::19/64"];
-        #   routers = ["192.168.86.5" "fd00::5"];
-        #   nameservers = ["8.8.8.8" "2001:4860:4860::8888"]; # NOTE: Use reliable DNS for servers instead of 192.168.86.26
-        #   routable = true;
-        # };
-
-        # TODO: mylib.networking.mkStaticSystemdNetwork needs improvement to accomodate for this
-        "10-ether-1G" = rec {
-          enable = true;
-
-          # See man systemd.link, man systemd.netdev, man systemd.network
-          matchConfig = {
-            # This corresponds to the [MATCH] section
-            Name = "ens18"; # Match ethernet interface
-          };
-
-          # Static IP + DNS + Gateway
-          address = ["192.168.86.25/24"];
-          gateway = ["192.168.86.5"]; # Don't add IPv6 gateway, rely on router advertisement instead
-          dns = ["8.8.8.8" "8.8.4.4" "2001:4860:4860:8888" "2001:4860:4860:8844"];
-          routes = builtins.map (r: {Gateway = r;}) gateway;
-
-          # See man systemd.network
-          networkConfig = {
-            # This corresponds to the [NETWORK] section
-            DHCP = "no";
-
-            IPv6AcceptRA = "yes"; # Accept Router Advertisements
-            # MulticastDNS = "no";
-            # LLMNR = "no";
-            # LinkLocalAddressing = "ipv6";
-          };
-
-          addresses = [
-            {
-              # Don't add this to address, we don't want to create any routes with this
-              Address = "fd00::19/64";
-            }
-          ];
-
-          linkConfig = {
-            # This corresponds to the [LINK] section
-            RequiredForOnline = "routable";
-          };
+        "10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
+          interface = "ens18";
+          ips = ["192.168.86.25/24"];
+          routers = ["192.168.86.5"]; # Don't add IPv6 gateway, rely on router advertisement instead
+          nameservers = ["8.8.8.8" "8.8.4.4" "2001:4860:4860:8888" "2001:4860:4860:8844"]; # NOTE: Use reliable DNS for servers instead of 192.168.86.26
+          routable = true;
+          extraAddresses = ["fd00::19/64"]; # IPv6 ULA — declared without creating a route
        };
      };

--- a/system/services/0_TEMPLATE.nix
+++ b/system/services/0_TEMPLATE.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -16,14 +17,7 @@ in {
      image = "TEMPLATE:${TEMPLATEVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/adguard.nix
+++ b/system/services/adguard.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "adguard/adguardhome:${adguardVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/authelia.nix
+++ b/system/services/authelia.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "authelia/authelia:${autheliaVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/bazarr.nix
+++ b/system/services/bazarr.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/bazarr:${bazarrVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/box.nix
+++ b/system/services/box.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "stashapp/stash:${boxVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/comfyui.nix
+++ b/system/services/comfyui.nix
@ -1,24 +1,19 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
  ...
 }: let
-  comfyuiVersion = "cu128-slim-20260316";
+  # comfyuiVersion = "cu128-slim-20260316";
+  comfyuiVersion = "cu128-megapak-20260323";
 in {
  virtualisation.oci-containers.containers = {
    comfyui = {
      image = "yanwk/comfyui-boot:${comfyuiVersion}";
      autoStart = false;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -42,6 +37,13 @@ in {
        PUID = "1000";
        PGID = "1000";
        TZ = "Europe/Berlin";
+
+        # https://github.com/Comfy-Org/ComfyUI/blob/master/comfy/cli_args.py
+        # --use-sage-attention # => OOM
+        # --lowvram
+        # --disable-pinned-memory
+        # --cache-none
+        # CLI_ARGS = "--use-sage-attention";
      };

      extraOptions = [
--- a/system/services/fileflows-node.nix
+++ b/system/services/fileflows-node.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "revenz/fileflows:${fileflowsVersion}";
      autoStart = false;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/fileflows.nix
+++ b/system/services/fileflows.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "revenz/fileflows:${version}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/gitea.nix
+++ b/system/services/gitea.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -27,14 +28,7 @@ in {
      image = "postgres:14";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -59,14 +53,7 @@ in {
      image = "gitea/gitea:${giteaVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        "gitea-db"
@ -107,14 +94,7 @@ in {
      image = "gitea/act_runner:${runnerVersion}"; # NOTE: vegardit has other runner images
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        "gitea"
--- a/system/services/immich.nix
+++ b/system/services/immich.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -39,14 +40,7 @@ in {
      image = "redis";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/jellyfin.nix
+++ b/system/services/jellyfin.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/jellyfin:${jellyfinVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        # "pihole"
--- a/system/services/kopia.nix
+++ b/system/services/kopia.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -18,14 +19,7 @@ in {
      image = "kopia/kopia:${kopiaVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/nextcloud.nix
+++ b/system/services/nextcloud.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -33,14 +34,7 @@ in {
      image = "postgres:alpine";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -67,14 +61,7 @@ in {
      image = "redis:alpine";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -97,14 +84,7 @@ in {
      image = "nextcloud:${nextcloudVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        "nextcloud-db"
--- a/system/services/nginx-proxy-manager.nix
+++ b/system/services/nginx-proxy-manager.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "jc21/nginx-proxy-manager:${nginxVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/paperless.nix
+++ b/system/services/paperless.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -16,14 +17,7 @@ in {
      image = "flor1der/paperless-nextcloud-sync:${paperlessNCVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -59,14 +53,7 @@ in {
      image = "redis:7";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

@ -87,14 +74,7 @@ in {
      image = "postgres:15";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/plex.nix
+++ b/system/services/plex.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "plexinc/pms-docker:${plexVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        # "pihole"
--- a/system/services/portainer-agent.nix
+++ b/system/services/portainer-agent.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -13,14 +14,7 @@ in {
      image = "portainer/agent:${portainerVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/portainer.nix
+++ b/system/services/portainer.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -12,14 +13,7 @@ in {
      image = "portainer/portainer-ce:${portainerVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/prowlarr.nix
+++ b/system/services/prowlarr.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/prowlarr:${prowlarrVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/pulse.nix
+++ b/system/services/pulse.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "rcourtman/pulse:${pulseVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/radarr.nix
+++ b/system/services/radarr.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/radarr:${radarrVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/sabnzbd-movies.nix
+++ b/system/services/sabnzbd-movies.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/sabnzbd:${sabnzbdVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/sabnzbd-shows.nix
+++ b/system/services/sabnzbd-shows.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/sabnzbd:${sabnzbdVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/sonarr.nix
+++ b/system/services/sonarr.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "linuxserver/sonarr:${sonarrVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/teamspeak.nix
+++ b/system/services/teamspeak.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "teamspeaksystems/teamspeak6-server:${teamspeakVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/tinymediamanager.nix
+++ b/system/services/tinymediamanager.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "tinymediamanager/tinymediamanager:${version}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [];

--- a/system/services/whats-up-docker.nix
+++ b/system/services/whats-up-docker.nix
@ -1,4 +1,5 @@
 {
+  mylib,
  config,
  lib,
  pkgs,
@ -11,14 +12,7 @@ in {
      image = "getwud/wud:${wudVersion}";
      autoStart = true;

-      login = {
-        # Uses DockerHub by default
-        # registry = "";
-
-        # DockerHub Credentials
-        username = "christoph.urlacher@protonmail.com";
-        passwordFile = "${config.sops.secrets.docker-password.path}";
-      };
+      login = mylib.containers.mkDockerLogin config;

      dependsOn = [
        # "pihole"
--- a/system/systemmodules/darwin.nix
+++ b/system/systemmodules/darwin.nix
@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./sops-nix
+  ];
+}
--- a/system/systemmodules/docker/default.nix
+++ b/system/systemmodules/docker/default.nix
@ -72,7 +72,6 @@ in {
        if docker.podman
        then "podman"
        else "docker"; # "docker" or "podman"
-      libvirtd.enable = true;
    };

    systemd.services = let
--- a/system/systemmodules/impermanence/default.nix
+++ b/system/systemmodules/impermanence/default.nix
@ -152,13 +152,13 @@ in {
            (mkUDir ".config/ghidra" m755)
            (mkUDir ".config/impermanence" m755)
            (mkUDir ".config/jellyfin-mpv-shim" m755)
-            (mkUDir ".config/jellyfin-tui" m755) # TODO: Generate this config file, have to use sops because it includes the password in cleartext
+            # (mkUDir ".config/jellyfin-tui" m755) # Configured using nix
            (mkUDir ".config/JetBrains" m755)
            (mkUDir ".config/kdeconnect" m755)
            (mkUDir ".config/keepassxc" m755)
            (mkUDir ".config/Msty" m755)
            (mkUDir ".config/Nextcloud" m755)
-            (mkUDir ".config/niri/dms" m755)
+            # (mkUDir ".config/niri/dms" m755)
            (mkUDir ".config/obsidian" m755)
            (mkUDir ".config/obs-studio" m755)
            (mkUDir ".config/Signal" m755)
@ -182,7 +182,7 @@ in {
            (mkUDir ".local/share/hytale-launcher" m755)
            (mkUDir ".local/share/Hytale" m755)
            (mkUDir ".local/share/jellyfin-desktop" m755)
-            (mkUDir ".local/share/jellyfin-tui" m755)
+            # (mkUDir ".local/share/jellyfin-tui" m755) # Configured using nix
            (mkUDir ".local/share/JetBrains" m755) # Unity
            (mkUDir ".local/share/keyrings" m755) # m700
            (mkUDir ".local/share/IsolatedStorage" m755) # JetBrains license data
--- a/system/systemmodules/sops-nix/default.nix
+++ b/system/systemmodules/sops-nix/default.nix
@ -26,17 +26,23 @@ in {
      defaultSopsFile = ./secrets.yaml;

      age = {
-        keyFile = lib.mkDefault "/home/${username}/.secrets/age/age.key";
+        keyFile = lib.mkDefault "${config.users.users.${username}.home}/.secrets/age/age.key";
        generateKey = false;
        sshKeyPaths = [];
      };

      secrets = let
        mkSecret = name: {
-          ${name} = {
-            owner = config.users.users.${username}.name;
-            group = config.users.users.${username}.group;
-          };
+          ${name} = lib.mkMerge [
+            (lib.optionalAttrs pkgs.stdenv.isLinux {
+              owner = config.users.users.${username}.name;
+              group = config.users.users.${username}.group;
+            })
+            (lib.optionalAttrs pkgs.stdenv.isDarwin {
+              owner = config.users.users.${username}.name;
+              group = "staff"; # Apparently there's no way to get the primary group?
+            })
+          ];
        };

        mkBootSecret = name: {
--- a/system/systemmodules/sops-nix/secrets.yaml
+++ b/system/systemmodules/sops-nix/secrets.yaml
@ -5,6 +5,7 @@ user-password: ENC[AES256_GCM,data:okgvaTTesCDwriI8PxhNdHZF8XgzB4yxapuFl2/CK8x4W
 ssh-private-key: ENC[AES256_GCM,data:JrRarfeS3y6b9gxg4Za5GIc5Ci3aGR+OyZxQybj4dcv2mzxXmT/bm7KOwM1zkz1PFl1xW5X82T5jte+XQOKx0+6m4ovjUgUmQUMP4E/yosp8XSdi0+YlUKBEHEJx6HqCZy+v6qx5kfp9JC6fZqCbL1J6FIqWqAoKTFXoiou1YnhmBa2fM17Q++i6TflDWiVrUS7X9xjuZFq1hz1aQXS303uvJEUOEpXdqPyJvUKJWzVsFrAwpa9FG+reO70SSc+1hBbqdw1QjrzNWh3eNnztwZURauJtVFBYUZ5ozHmWBr4aVFjYvqz+t6G1SAunmBRbVqbH4bjBv9jXXjHAB4U0wanvkJN2C+EY1zxwjyx2fWckMdhoLr9gtC1FJKMbV49UFHJ3iXWNczKj1t7LrctehEKXJa0Eb3UogYuaRxbVYbC++kD8LvL4AY8ertgc9/pxQQZmogdINJmIxKN4HTlGbX8kSDLbohZLheOfzZ5ycTlrbOjfJ1EBMLo+mJcMUW0qhFySl1aamPqTeII7lvgTOE3xV/d/9VAQTFKsftWPNkfhAJIym51bYrrMPV8AVeFQnLhSid3d3zK4w20zIQKSYnq9A8zcNhM0keddiv4XC+M=,iv:7HP7VCFpMRZXRD6GD/zFzDSBO02V/DyxKLmuDCLXTLU=,tag:Ugx81JwCP8HmhtflYoevLg==,type:str]
 nix-github-token: ENC[AES256_GCM,data:AXV0ODLhfa4M6+7clulfIKm0qCOeo3lQ+66iYgoDeR12RxZOV19UtA==,iv:1XECVKyzH3NumKwRSPKNlUwJMLFwptcG8DQ09U4LrGk=,tag:QdtvJNV8BttWjhH4v0RtRQ==,type:str]
 docker-password: ENC[AES256_GCM,data:mK5YWEQPKWBtVCgRBZvwWTdVAi8MEGbLnLeP7hfDkcc=,iv:Az8+eAK6R6xssmmbhuEsDbLU+ks8lS+qzc4L33WfefA=,tag:NSXvRhbIuRZZqRR28Tu0PQ==,type:str]
+jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSohE=,iv:VP+Jyv2lUIBz1dFow038uN0KT+tQKK9uGr7/T5crlgk=,tag:rPGPpaqZApfHkecLBSs4Yw==,type:str]
 #
 #ENC[AES256_GCM,data:y5dlZFhK38dR+Q==,iv:1JYizUeyWeMR4KUblkj7kVSHPCL5l8mFpaQdo774BcM=,tag:kUTnBZb46KYQyi8bgIYSOQ==,type:comment]
 #
@ -33,7 +34,7 @@ sops:
            SURMTmh1TGIrRmtENzc0Sk4rNFJNUE0KOpjN6jkEHO+lvdWdp4P++r9SNSPWaT0h
            FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-19T01:29:00Z"
-    mac: ENC[AES256_GCM,data:IzLYRuOlkUpry37sw7OB5MglntVflMjCcNiWpi7rvT2suOivLX9IT36qZFfYIbVIFXDmfsi1hsTvsPyekD7vVWQ1vkajAlGQYYTVpnO2cFrK3+TfWCyYjiD01rQBiRikybrR11zWRq6atieurDIxMUMEI7ypiqFOwpYaqSePAFc=,iv:9bc6rc4gjuiJWNjg1g0KfySqxnPjpzmlzDi/R+Iv2g4=,tag:tEwthVZAmdXbwRtoNykGrQ==,type:str]
+    lastmodified: "2026-03-26T19:30:04Z"
+    mac: ENC[AES256_GCM,data:DGsz+TNyYXuX45Go4fkFDoWePhx1KUzq94awp+1bQtmq2MC+bPJrTNqvhBDx/I2OWFUNSh/0lXJVvaz4gfeYT9z8YCniJeb3z53ui7ldFL0BNnA6ua1iIViWbJvYARgWlSiuU7wTsb8om57Kainkpm9C9pp2U+vQqQ4suxLmrko=,iv:sUibX01AHDrscPqz+gIPyJhLRJYkyW4DPcQ3QtUGha0=,tag:8yuSGHMg1Z7kDMo2Bx4QlA==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.2
--- a/system/thinknix/default.nix
+++ b/system/thinknix/default.nix
@ -46,52 +46,13 @@
      useNetworkManager = false;

      networks = {
-        # "10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
-        #   interface = "ens18";
-        #   ips = ["192.168.86.26/24" "fd00::1a/64"];
-        #   routers = ["192.168.86.5" "fd00::5"];
-        #   nameservers = ["8.8.8.8" "2001:4860:4860::8888"]; # NOTE: Use reliable DNS for servers instead of 127.0.0.1
-        #   routable = true;
-        # };
-
-        # TODO: mylib.networking.mkStaticSystemdNetwork needs improvement to accomodate for this
-        "10-ether-1G" = rec {
-          enable = true;
-
-          # See man systemd.link, man systemd.netdev, man systemd.network
-          matchConfig = {
-            # This corresponds to the [MATCH] section
-            Name = "ens18"; # Match ethernet interface
-          };
-
-          # Static IP + DNS + Gateway
-          address = ["192.168.86.26/24"];
-          gateway = ["192.168.86.5"]; # Don't add "fd00::5", rely on router advertisement instead
-          dns = ["8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844"];
-          routes = builtins.map (r: {Gateway = r;}) gateway;
-
-          # See man systemd.network
-          networkConfig = {
-            # This corresponds to the [NETWORK] section
-            DHCP = "no";
-
-            IPv6AcceptRA = "yes"; # Accept Router Advertisements
-            # MulticastDNS = "no";
-            # LLMNR = "no";
-            # LinkLocalAddressing = "ipv6";
-          };
-
-          addresses = [
-            {
-              # Don't add this to address, we don't want to create any routes with this
-              Address = "fd00::1a/64"; # IPv6 Unique-Local Address (ULA)
-            }
-          ];
-
-          linkConfig = {
-            # This corresponds to the [LINK] section
-            RequiredForOnline = "routable";
-          };
+        "10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
+          interface = "ens18";
+          ips = ["192.168.86.26/24"];
+          routers = ["192.168.86.5"]; # Don't add "fd00::5", rely on router advertisement instead
+          nameservers = ["8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844"]; # NOTE: Use reliable DNS for servers instead of 127.0.0.1
+          routable = true;
+          extraAddresses = ["fd00::1a/64"]; # IPv6 ULA — declared without creating a route
        };
      };
Author	SHA1	Message	Date
Christoph Urlacher	3d5a0f8cb5	Home/Nixinator: Add gnome-boxes	2026-03-27 17:58:54 +01:00
Christoph Urlacher	0831730903	System/Nixinator: Configure libvirt virtualisation	2026-03-27 16:54:56 +01:00
Christoph Urlacher	004eff3abf	Modules/Niri: Update global menu	2026-03-27 11:20:55 +01:00
Christoph Urlacher	592e7e4bb9	Modules/SSH: Add keys to ssh-agent on nix-darwin	2026-03-27 01:31:21 +01:00
Christoph Urlacher	ec7247bc77	Modules/Niri: Update walker menus using new mkMenu lib function	2026-03-27 01:18:26 +01:00
Christoph Urlacher	e1d041f010	Lib/Rofi: Replace mkSimpleMenu with multi-layer-menu capable mkMenu	2026-03-27 01:18:02 +01:00
Christoph Urlacher	84fec63204	Modules/Impermanence: Remove dms mount	2026-03-27 00:25:45 +01:00
Christoph Urlacher	b434aaaccc	Modules/JellyfinTUI: Set jellyfin url depending on system (nixos/darwin)	2026-03-26 21:43:41 +01:00
Christoph Urlacher	4639fd8c7e	Modules/JellyfinTUI: Generate config in path depending on system (nixos/darwin)	2026-03-26 21:35:53 +01:00
Christoph Urlacher	7f22089765	Modules/Sops: Don't hardcode age keyFile path	2026-03-26 21:24:28 +01:00
Christoph Urlacher	8c53eaf570	Modules/JellyfinTUI: Reference nixos/darwin config depending on system	2026-03-26 21:13:04 +01:00
Christoph Urlacher	c9a4b1a428	System/Darwinix: Set sops bootSecrets	2026-03-26 21:03:21 +01:00
Christoph Urlacher	288496afa1	Flake: Import sops module on nix-darwin	2026-03-26 21:02:11 +01:00
Christoph Urlacher	34f61d4f27	Modules/Sops: Update secret definitions for nix-darwin	2026-03-26 21:00:38 +01:00
Christoph Urlacher	77f169fef4	Lib/Nixos: Import compatible systemmodules into darwin system	2026-03-26 20:49:50 +01:00
Christoph Urlacher	8576db096f	System/Darwinix: Import sops secrets	2026-03-26 20:46:38 +01:00
Christoph Urlacher	d20ce66646	Modules/JellyfinTUI: Include + enable module, disable impermanence	2026-03-26 20:46:30 +01:00
Christoph Urlacher	226b72dccf	Config/Navi: Update sops secrets file path	2026-03-26 20:45:44 +01:00
Christoph Urlacher	6147801194	Modules/JellyfinTUI: Init module	2026-03-26 20:38:36 +01:00
Christoph Urlacher	a1b8bc9555	System/Nixinator: Enable linux_zen	2026-03-26 20:15:12 +01:00
Christoph Urlacher	83ffca5e21	Modules/Packages: Update protonvpn-gui package name	2026-03-26 20:15:03 +01:00
Christoph Urlacher	eb782a67cb	Modules/Niri: Update gtk config after HM update	2026-03-26 20:14:47 +01:00
Christoph Urlacher	85a12edbcc	Flake: Update lock	2026-03-26 15:22:55 +01:00
Christoph Urlacher	a056e4d98b	Modules/Packages: Add ttyper, bandwhich, snitch	2026-03-26 15:21:25 +01:00
Christoph Urlacher	5f17a04fbb	Home: Extract common nixos/darwin packages/programs/module-configs into terminal+packages modules	2026-03-24 11:58:45 +01:00
Christoph Urlacher	f514387f64	System: Use lib.networking to configure static networks	2026-03-24 11:32:11 +01:00
Christoph Urlacher	c328c188b8	Lib/Networking: Add option to configure route-less addresses	2026-03-24 11:31:56 +01:00
Christoph Urlacher	585f74ce0f	System: Use common nix configuration	2026-03-24 11:30:38 +01:00
Christoph Urlacher	8263fe01eb	Lib/Nixos: Add common nix configuration	2026-03-24 11:30:22 +01:00
Christoph Urlacher	d61e6f8b9c	Services: Use common dockerhub login	2026-03-24 11:29:21 +01:00
Christoph Urlacher	7c7c195083	Lib/Containers: Add common dockerhub login	2026-03-24 11:27:22 +01:00
Christoph Urlacher	2e78898c5a	Modules/Neovim: Add devdocs integration plugin	2026-03-24 10:38:34 +01:00
Christoph Urlacher	1f61e9958c	System/Darwinix: Add signal cask	2026-03-23 13:56:54 +01:00
Christoph Urlacher	c8954e5854	Home/Darwinix: Add speedtest-cli	2026-03-23 13:42:23 +01:00
Christoph Urlacher	e772d93f23	Home: Add speedtest-cli	2026-03-23 13:42:00 +01:00
Christoph Urlacher	4c17560020	Services/Comfyui: Update launch args	2026-03-23 13:06:43 +01:00
Christoph Urlacher	e1542a1168	System/Darwinix: Add casks (obsidian, discord, ...)	2026-03-23 13:02:46 +01:00
Christoph Urlacher	a351bf59ba	Services/Comfyui: Update image + launch args	2026-03-23 11:19:43 +01:00
Christoph Urlacher	7a62f38084	Modules/Waybar: Update widget intervals	2026-03-23 11:19:34 +01:00
Christoph Urlacher	b50c5f9f71	Modules/Fish: Update abbrs	2026-03-23 11:19:17 +01:00
Christoph Urlacher	0087145957	Services/ComfyUI: Open port	2026-03-23 10:37:29 +01:00
Christoph Urlacher	48c77e9654	System/Darwinix: Move sketchybar to correct location	2026-03-23 00:34:34 +01:00
Christoph Urlacher	71d06d61b1	Modules/Fish: Update abbrs for nix-darwin	2026-03-23 00:24:11 +01:00
Christoph Urlacher	75d024111e	Home/Darwinix: Enable sketchybar	2026-03-23 00:21:19 +01:00
Christoph Urlacher	b67aee2a64	Modules/Waybar: Update workspace widget colors (empty/occupied/active/urgent)	2026-03-23 00:20:59 +01:00
Christoph Urlacher	554a76b585	Modules/Waybar: Update warning colors	2026-03-22 23:24:19 +01:00
Christoph Urlacher	d9e7e315da	Modules/Waybar: Disable systemd-failed-units widget	2026-03-22 23:15:48 +01:00
Christoph Urlacher	daee8da3ae	Home: Move bat/cava/fastfetch/ssh/tmux configs to modules + deduplicate nix-darwin home config	2026-03-22 23:03:19 +01:00
Christoph Urlacher	c2b661adbb	System/Darwinix: Update trackpad/keyboard config	2026-03-22 22:43:08 +01:00
Christoph Urlacher	aa4ebfbc06	Home: Update nixinator ssh config	2026-03-22 22:42:28 +01:00
Christoph Urlacher	db850552e3	Add nix-darwin screenshot	2026-03-21 16:19:47 +01:00
Christoph Urlacher	63afac3d04	Modules/Fish: Add nix-darwin homebrew environment setup	2026-03-21 15:50:27 +01:00
Christoph Urlacher	645fc64ead	System/Darwinix: Set known network services	2026-03-21 15:41:48 +01:00
Christoph Urlacher	6561d4c979	Home/Darwinix: Set environment variables	2026-03-21 15:40:36 +01:00
Christoph Urlacher	f1ed339968	System/Darwinix: System settings	2026-03-21 15:39:01 +01:00
Christoph Urlacher	50d14ecf83	Home/Darwinix: Remove non-available packages	2026-03-21 15:03:34 +01:00
Christoph Urlacher	1cdc3f25e0	System/Darwinix: Add fonts	2026-03-21 15:00:32 +01:00
Christoph Urlacher	9e62f755bb	Modules/Neovim: Don't hardcode home directory	2026-03-21 14:46:11 +01:00