migrate to impermanence?

2026-01-02 23:15:56 +01:00
47 changed files with 536 additions and 626 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -129,27 +129,6 @@
        "type": "github"
      }
    },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1746728054,
-        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff442f5d1425feb86344c028298548024f21256d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "latest",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
@@ -433,22 +412,6 @@
        "type": "github"
      }
    },
-    "nix-zulip": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1764583012,
-        "narHash": "sha256-6ht4dtI1TBDAaB/Tatq+FcPexaZTBWuRiJGnioCDx5c=",
-        "ref": "refs/heads/main",
-        "rev": "a9dd0f80d775745f1d88055f24d944562db97c5e",
-        "revCount": 67,
-        "type": "git",
-        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
-      }
-    },
    "nixos-mailserver": {
      "inputs": {
        "blobs": "blobs",
@@ -618,10 +581,8 @@
    "root": {
      "inputs": {
        "agenix": "agenix",
-        "disko": "disko",
        "home-manager": "home-manager_2",
        "impermanence": "impermanence",
-        "nix-zulip": "nix-zulip",
        "nixos-mailserver": "nixos-mailserver",
        "nixpkgs": "nixpkgs",
        "noshell": "noshell",
--- a/flake.nix
+++ b/flake.nix
@@ -4,10 +4,6 @@
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    disko = {
-      url = "github:nix-community/disko/latest";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -18,10 +14,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nix-zulip = {
-      url = "git+https://git.afnix.fr/nix-zulip/nix-zulip";
-      flake = false;
-    };
    noshell = {
      url = "github:viperML/noshell";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -45,12 +37,10 @@
  };
  outputs = {
    agenix,
-    disko,
    home-manager,
    impermanence,
    nixos-mailserver,
    nixpkgs,
-    nix-zulip,
    noshell,
    nur,
    nvf,
@@ -58,7 +48,6 @@
    stylix,
    ...
  }: let
-    nix-zulip' = (import "${nix-zulip}/nix/default.nix" {}).output;
    machines = import ./machines.nix;
    configuration = machine: modules:
      nixpkgs.lib.nixosSystem {
@@ -67,30 +56,23 @@
        modules =
          modules
          ++ [
+            ./machines/${machine.hostname}/configuration.nix
            ./users.nix
            ./secrets.nix
-            ./modules/nixos/common.nix
-            agenix.nixosModules.default
-            disko.nixosModules.disko
            impermanence.nixosModules.impermanence
+            agenix.nixosModules.default
            nixos-mailserver.nixosModule
-            noshell.nixosModules.default
            phoenix.nixosModules.default
-            nix-zulip'.nixosModules.zulip
-            {
-              nixpkgs.overlays = [
-                agenix.overlays.default
-                nur.overlays.default
-                nix-zulip'.overlays.default
-              ];
-            }
-          ]
-          ++ machine.modules;
+          ];
      };
    configurationWithHomeManager = machine: (configuration machine
      [
        home-manager.nixosModules.home-manager
        {
+          nixpkgs.overlays = [
+            agenix.overlays.default
+            nur.overlays.default
+          ];
          home-manager.useGlobalPkgs = true;
          home-manager.extraSpecialArgs = {inherit machine;};
          home-manager.users =
@@ -111,6 +93,7 @@
              )
            );
        }
+        noshell.nixosModules.default
      ]);
  in {
    nixosConfigurations =
--- a/machines.nix
+++ b/machines.nix
@@ -2,82 +2,14 @@
  lenovo = {
    hostname = "lenovo";
    system = "x86_64-linux";
-    users = ["andromeda"];
-    modules = [
-      # impermanence
-      ./modules/nixos/impermanence.nix
-      ./modules/nixos/impermanence-ssh.nix
-
-      # hardware configuration
-      # includes `system.stateVersion`
-      ./modules/nixos/machines/lenovo.nix
-
-      # boot process
-      # systemd-boot
-      ./modules/nixos/boot/lenovo.nix
-
-      # networking
-      ./modules/nixos/laptop.nix
-
-      # ly display manager
-      ./modules/nixos/ly.nix
-
-      # sway window manager
-      ./modules/nixos/sway.nix
-
-      # apps
-      ./modules/nixos/steam.nix
+    users = [
+      "andromeda"
+      "mtgmonkey"
    ];
  };
  "109-199-104-83" = {
    hostname = "109-199-104-83";
    system = "x86_64-linux";
    users = [];
-    modules = [
-      # impermanence
-      ./modules/nixos/impermanence.nix
-      ./modules/nixos/impermanence-ssh.nix
-
-      # hardware configuration
-      # verbatim as `nixos-generate-config` AND `system.stateVersion`
-      ./modules/nixos/machines/109-199-104-83.nix
-      ./modules/nixos/disko/remote.nix
-
-      # boot process
-      # grub boot on /dev/sda
-      ./modules/nixos/boot/109-199-104-83.nix
-
-      # networking
-      ./modules/nixos/networking/domains/galaxious.de.nix
-      # uses cloud-init to network
-      ./modules/nixos/networking/networks/109-199-104-83.nix
-
-      # ssh through port 5522 among other things
-      # andromeda@lenovo is the only user allowed access
-      ./modules/nixos/networking/hard-ssh.nix
-      ./modules/nixos/networking/ssh-as-root.nix
-      ({config, ...}: {users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];})
-
-      # TODO add Impermanence to the following services
-
-      # simple-nixos-mailserver email server
-      # mail.domain
-      ./modules/nixos/mailserver.nix
-
-      # roundcube webmail client
-      # webmail.domain
-      ./modules/nixos/roundcube.nix
-
-      # forgejo
-      # git.domain
-      ./modules/nixos/forgejo.nix
-
-      # BROKEN
-      # zulip chat client
-      # chat.domain
-      # zulip chat server
-      # zulip.domain
-      # ./modules/nixos/zulip.nix
-    ];
  };
 }
--- a/machines/109-199-104-83/configuration.nix
+++ b/machines/109-199-104-83/configuration.nix
@@ -0,0 +1,98 @@
+{
+  config,
+  modulesPath,
+  machine,
+  ...
+}: {
+  imports = [
+    ./impermanence.nix
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+  # roundcube config
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+
+  # mailserver config
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
+      };
+    };
+  };
+
+  # cert config
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts."mail.${config.networking.domain}" = {
+      forceSSL = true;
+      enableACME = true;
+    };
+  };
+
+  # system config
+  system.stateVersion = "25.11";
+  nix.settings.experimental-features = ["flakes" "nix-command"];
+  fileSystems."/" = {
+    device = "none";
+    fsType = "tmpfs";
+    options = ["defaults" "size=60%" "mode=755"];
+  };
+  fileSystems."/nix" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 30;
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
+  boot.initrd.kernelModules = ["nvme"];
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+  networking = {
+    useNetworkd = true;
+    usePredictableInterfaceNames = true;
+    hostName = machine.hostname;
+    domain = "galaxious.de";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443];
+      allowedUDPPorts = [80 443];
+    };
+  };
+  systemd.network = {
+    enable = true;
+    networks."40-wan" = {
+      matchConfig.Name = "enx0050565f4fff";
+      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
+      routes = [
+        {
+          Gateway = "109.199.96.1";
+          GatewayOnLink = true;
+        }
+        {Gateway = "fe80::1";}
+      ];
+      dns = ["2620:fe::fe" "9.9.9.9"];
+    };
+  };
+  services.openssh.enable = true;
+  users.mutableUsers = false;
+  users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
+  programs.noshell.enable = true;
+}
--- a/machines/109-199-104-83/impermanence.nix
+++ b/machines/109-199-104-83/impermanence.nix
@@ -0,0 +1,30 @@
+{
+  environment.persistence."/nix/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      # logs
+      "/var/log"
+      "/var/lib/systemd/coredump"
+
+      # users
+      "/var/lib/nixos"
+
+      # private ssh keys
+      "/etc/ssh"
+
+      # mailserver
+      "/var/vmail"
+      "/var/dkim"
+      "/var/lib/dovecot"
+      "/var/lib/postfix"
+      "/var/lib/postgresql"
+      "/var/lib/redis-rspamd"
+      "/var/lib/roundcube"
+      "/var/lib/secrets"
+    ];
+    files = [
+      "/etc/machine-id"
+    ];
+  };
+}
--- a/machines/lenovo/configuration.nix
+++ b/machines/lenovo/configuration.nix
@@ -1,17 +1,70 @@
 {
  config,
  lib,
-  pkgs,
  modulesPath,
+  machine,
  ...
 }: {
-  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
+  imports = [
+    ./impermanence.nix
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+  age.secrets = {
+    secret0.file = ../../secrets/secret0.age;
+    secret1.file = ../../secrets/secret1.age;
+  };
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  i18n.defaultLocale = "de_DE.UTF-8";
+  networking = {
+    dhcpcd.enable = true;
+    firewall.enable = true;
+    hostName = machine.hostname;
+    networkmanager.enable = true;
+  };
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+  programs = {
+    noshell.enable = true;
+    steam.enable = true;
+    sway.enable = true;
+  };
+  services = {
+    blueman.enable = true;
+    displayManager = {
+      enable = true;
+      ly.enable = true;
+    };
+    libinput.enable = true;
+    openssh.enable = true;
+    printing.enable = true;
+  };
+  system.stateVersion = "26.05";
+  time.timeZone = "Europe/Berlin";
  boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-intel"];
  boot.extraModulePackages = [];

  fileSystems."/" = {
+    #device = "none";
+    #fsType = "tmpfs";
+    #options = ["defaults" "size=60%" "mode=755"];
    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
    fsType = "btrfs";
    options = ["subvol=root"];
@@ -39,12 +92,12 @@
    done

    btrfs subvolume create /btrfs_tmp/root
-    mkdir /btrfs_tmp/root/persist
+    mkdir /btrfs_tmp/root/nix
    mkdir /btrfs_tmp/root/etc
-    mount ${config.fileSystems."/persist".device} /btrfs_tmp/root/persist -o subvol=persist
-    cp /btrfs_tmp/root/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
-    umount /btrfs_tmp/root/persist
-    rm -r /btrfs_tmp/root/persist
+    mount ${config.fileSystems."/nix".device} /btrfs_tmp/root/nix
+    cp /btrfs_tmp/root/nix/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
+    umount /btrfs_tmp/root/nix
+    rm -r /btrfs_tmp/root/nix
    umount /btrfs_tmp
  '';

@@ -53,12 +106,6 @@
    fsType = "btrfs";
  };

-  fileSystems."/persist" = {
-    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
-    fsType = "btrfs";
-    options = ["subvol=persist"];
-  };
-
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/F425-55BA";
    fsType = "vfat";
@@ -69,5 +116,4 @@

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  system.stateVersion = "26.05";
 }
--- a/machines/lenovo/impermanence.nix
+++ b/machines/lenovo/impermanence.nix
@@ -1,15 +1,19 @@
 {
-  fileSystems."/persist".neededForBoot = true;
-  environment.persistence."/persist" = {
+  environment.persistence."/nix/persist" = {
    enable = true;
    hideMounts = true;
    directories = [
      "/var/log"
+      "/var/lib/bluetooth"
      "/var/lib/nixos"
      "/var/lib/systemd/coredump"
+      "/etc/NetworkManager/system-connections"
+      "/etc/ssh"
+      "/etc/ly/custom-sessions"
    ];
    files = [
      "/etc/machine-id"
+      "/etc/ly/save.txt"
    ];
  };
 }
--- a/modules/nixos/boot/109-199-104-83.nix
+++ b/modules/nixos/boot/109-199-104-83.nix
@@ -1,9 +0,0 @@
-{
-  boot.loader.grub = {
-    efiSupport = true;
-    efiInstallAsRemovable = true;
-  };
-  age.identityPaths = [
-    "/persist/etc/ssh/ssh_host_ed25519_key"
-  ];
-}
--- a/modules/nixos/boot/lenovo.nix
+++ b/modules/nixos/boot/lenovo.nix
@@ -1,6 +0,0 @@
-{
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot.enable = true;
-  };
-}
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -1,26 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: {
-  # flakes usage
-  nix.settings.experimental-features = [
-    "flakes"
-    "nix-command"
-  ];
-
-  # allows users to customize shell in `$XDG_CONFIG_HOME/shell` rather than
-  # needing /etc/shells. Useful for home-manager. Falls back.
-  programs.noshell.enable = true;
-
-  # cleans /tmp to maintain a tidy system
-  boot.tmp.cleanOnBoot = true;
-
-  networking.domain = lib.mkDefault config.networking.hostName;
-
-  # disable lecture
-  security.sudo.extraConfig = ''Defaults lecture="never"'';
-
-  # make users immutable
-  users.mutableUsers = false;
-}
--- a/modules/nixos/disko/remote.nix
+++ b/modules/nixos/disko/remote.nix
@@ -1,64 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      disk1 = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            # legacy boot
-            boot = {
-              name = "boot";
-              size = "1M";
-              type = "EF02";
-            };
-
-            # efi boot
-            esp = {
-              name = "ESP";
-              size = "512M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-              };
-            };
-
-            # btrfs
-            # root is on nodev
-            root = {
-              size = "100%";
-              content = {
-                extraArgs = ["-f"]; # internet told me to, works
-                type = "btrfs";
-                subvolumes = {
-                  # nix store
-                  "/nix" = {
-                    mountpoint = "/nix";
-                  };
-
-                  # persistant directory
-                  "/persist" = {
-                    mountpoint = "/persist";
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-    nodev = {
-      # root
-      "/" = {
-        fsType = "tmpfs";
-        mountOptions = [
-          "defaults"
-          "mode=755" # stops security complaints
-        ];
-      };
-    };
-  };
-}
--- a/modules/nixos/forgejo.nix
+++ b/modules/nixos/forgejo.nix
@@ -1,27 +0,0 @@
-{config, ...}: {
-  services.nginx = {
-    virtualHosts.${config.services.forgejo.settings.server.DOMAIN} = {
-      forceSSL = true;
-      enableACME = true;
-      extraConfig = ''
-        client_max_body_size 512M
-      '';
-      locations."/".proxyPass = "https://localhost:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
-    };
-  };
-  services.forgejo = {
-    enable = true;
-    database.type = "postgres";
-    lfs.enable = true;
-    settings = {
-      server = rec {
-        DOMAIN = "git.galaxious.de";
-        ROOT_URL = "https://${DOMAIN}";
-        HTTP_PORT = 4043;
-        SSH_PORT = 4022;
-      };
-      service.DISABLE_REGISTRATION = false;
-    };
-  };
-  services.openssh.ports = [config.services.forgejo.settings.server.SSH_PORT];
-}
--- a/modules/nixos/impermanence-ssh.nix
+++ b/modules/nixos/impermanence-ssh.nix
@@ -1,4 +0,0 @@
-{
-  # ONLY include this module AFTER a machine has been provisioned
-  environment.persistence."/persist".directories = ["/etc/ssh"];
-}
--- a/modules/nixos/laptop.nix
+++ b/modules/nixos/laptop.nix
@@ -1,37 +0,0 @@
-{
-  # bluetooth
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-  services.blueman.enable = true;
-
-  # locale
-  i18n.defaultLocale = "de_DE.UTF-8";
-  time.timeZone = "Europe/Berlin";
-
-  # networking
-  networking = {
-    firewall.enable = true;
-    networkmanager.enable = true;
-  };
-
-  # misc
-  services = {
-    printing.enable = true;
-
-    # trackpad
-    libinput.enable = true;
-
-    # ssh
-    openssh.enable = true;
-  };
-
-  # impermanence
-  environment.persistence."/persist".directories = [
-    # bluetooth
-    "/var/lib/bluetooth"
-    # wifi connections
-    "/etc/NetworkManager/system-connections"
-  ];
-}
--- a/modules/nixos/ly.nix
+++ b/modules/nixos/ly.nix
@@ -1,11 +0,0 @@
-{
-  services.displayManager = {
-    enable = true;
-    ly.enable = true;
-  };
-  # TODO needs to be manually updated when new users added
-  environment.persistence."/persist" = {
-    directories = ["/etc/ly/custom-sessions"];
-    files = ["/etc/ly/save.txt"];
-  };
-}
--- a/modules/nixos/machines/109-199-104-83.nix
+++ b/modules/nixos/machines/109-199-104-83.nix
@@ -1,25 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  swapDevices = [];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
-  system.stateVersion = "26.05";
-}
--- a/modules/nixos/mailserver.nix
+++ b/modules/nixos/mailserver.nix
@@ -1,39 +0,0 @@
-{config, ...}: {
-  mailserver = {
-    enable = true;
-    stateVersion = 3;
-    fqdn = "mail.${config.networking.domain}";
-    domains = ["${config.networking.domain}"];
-    x509.useACMEHost = config.mailserver.fqdn;
-    loginAccounts = {
-      "test@${config.networking.domain}" = {
-        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
-      };
-      "admin@${config.networking.domain}" = {
-        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
-        aliases = ["@${config.networking.domain}"];
-      };
-    };
-  };
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "mail.${config.networking.domain}" = {
-        forceSSL = true;
-        enableACME = true;
-      };
-    };
-  };
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "mtgmonket@gmail.com";
-  };
-  environment.persistence."/persist" = {
-    directories = [
-      "/var/dkim"
-      "/var/vmail"
-      "/var/lib/redis-rspamd"
-      "/var/lib/acme"
-    ];
-  };
-}
--- a/modules/nixos/networking/domains/galaxious.de.nix
+++ b/modules/nixos/networking/domains/galaxious.de.nix
@@ -1,3 +0,0 @@
-{
-  networking.domain = "galaxious.de";
-}
--- a/modules/nixos/networking/hard-ssh.nix
+++ b/modules/nixos/networking/hard-ssh.nix
@@ -1,19 +0,0 @@
-{
-  services.openssh = {
-    enable = true;
-    allowSFTP = false;
-    ports = [5522];
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = true;
-    };
-    extraConfig = ''
-      AllowTcpForwarding no
-      AllowAgentForwarding no
-      MaxAuthTries 3
-      MaxSessions 4
-      TCPKeepAlive no
-    '';
-  };
-}
--- a/modules/nixos/networking/networks/109-199-104-83.nix
+++ b/modules/nixos/networking/networks/109-199-104-83.nix
@@ -1,15 +0,0 @@
-{
-  networking = {
-    useDHCP = false;
-    hostName = "109-199-104-83";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [80 443];
-      allowedUDPPorts = [80 443];
-    };
-  };
-  services.cloud-init = {
-    enable = true;
-    network.enable = true;
-  };
-}
--- a/modules/nixos/networking/ssh-as-root.nix
+++ b/modules/nixos/networking/ssh-as-root.nix
@@ -1,3 +0,0 @@
-{lib, ...}: {
-  services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
-}
--- a/modules/nixos/roundcube.nix
+++ b/modules/nixos/roundcube.nix
@@ -1,16 +0,0 @@
-{config, ...}: {
-  services.roundcube = {
-    enable = true;
-    hostName = "webmail.${config.networking.domain}";
-    extraConfig = ''
-      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
-      $config['smtp_user'] = "%u";
-      $config['smtp_pass'] = "%p";
-    '';
-  };
-  environment.persistence."/persist".directories = [
-    "/var/lib/roundcube"
-    "/var/lib/postgresql"
-  ];
-}
--- a/modules/nixos/steam.nix
+++ b/modules/nixos/steam.nix
@@ -1,10 +0,0 @@
-{lib, ...}: {
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-  programs.steam.enable = true;
-}
--- a/modules/nixos/sway.nix
+++ b/modules/nixos/sway.nix
@@ -1,3 +0,0 @@
-{
-  programs.sway.enable = true;
-}
--- a/modules/nixos/zulip.nix
+++ b/modules/nixos/zulip.nix
@@ -1,32 +0,0 @@
-{config, ...}: {
-  services.zulip = {
-    enable = true;
-
-    # lets it set up my postgresql for me
-    enablePostgresqlLocally = true;
-
-    # host domain
-    host = "chat.${config.networking.domain}";
-
-    # secrets
-    camoKeyFile = builtins.toString config.age.secrets.zulip-camoKey.path;
-    rabbitmqPasswordFile = builtins.toString config.age.secrets.zulip-rabbitmqPassword.path;
-    secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
-    sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
-    avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
-    extraSecrets = {
-      email_password = builtins.toString config.age.secrets.zulip-extraSecrets-email_password.path;
-    };
-
-    # settings
-    zulipSettings = rec {
-      EMAIL_USE_TLS = true;
-      EMAIL_PORT = 587;
-      ADD_TOKENS_TO_NOREPLY_ADDRESS = false;
-      NOREPLY_EMAIL_ADDRESS = ZULIP_ADMINISTRATOR;
-      OPEN_REALM_CREATION = true;
-      EXTERNAL_HOST = config.services.zulip.host;
-      ZULIP_ADMINISTRATOR = "admin@${config.networking.domain}";
-    };
-  };
-}
--- a/modules/template.nix
+++ b/modules/template.nix
@@ -1,11 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [];
-  options = {};
-  config = {};
-}
--- a/pub-keys.nix
+++ b/pub-keys.nix
@@ -1,22 +1,15 @@
 {
  age.secrets = {
-    andromeda-pw.file = ./secrets/andromeda-pw.age;
-    mtgmonkey-pw.file = ./secrets/mtgmonkey-pw.age;
-    mailserver-acc-test-pw.file = ./secrets/mailserver-acc-test-pw.age;
-    mailserver-acc-admin-pw.file = ./secrets/mailserver-acc-admin-pw.age;
-    "mailserver-acc-zulip+admin-pw".file = ./secrets + "/mailserver-acc-zulip+admin-pw.age";
-    zulip-avatarSaltKey.file = ./secrets/zulip-avatarSaltKey.age;
-    zulip-camoKey.file = ./secrets/zulip-camoKey.age;
-    zulip-extraSecrets-email_password.file = ./secrets/zulip-extraSecrets-email_password.age;
-    zulip-rabbitmqPassword.file = ./secrets/zulip-rabbitmqPassword.age;
-    zulip-secretKey.file = ./secrets/zulip-secretKey.age;
-    zulip-sharedSecretKey.file = ./secrets/zulip-sharedSecretKey.age;
+    secret0.file = ./secrets/secret0.age;
+    secret1.file = ./secrets/secret1.age;
+    secret2.file = ./secrets/secret2.age;
+    secret3.file = ./secrets/secret3.age;
  };
  pub-keys = {
    ssh = {
      andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
      lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
-      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqjbjFrGZD98tAb8tnayeGjkcsJ17nAdREugZub3AWz root@109-199-104-83";
+      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
    };
  };
 }
--- a/secrets/andromeda-pw.age
+++ b/secrets/andromeda-pw.age
@@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg lpbWxTU6p0TLqdrqEAJLZp9lMuGZiTwZviuMBSq8dAI
-hapEREw5ZqDrUsGYFbVy3ZybfxKv7cKtgsCIRUJNMeQ
-> ssh-ed25519 UHxfvA SrK+1CTq/fkEj/KlSHM+9iQq7AcNFjDwwwEVenbKSCs
-zVNGyZbWQCrgmQ/uNCv23O6i6GfDdOoYHPN0E7A0XbE
--- KpfV8+Snrp9R69h5TVphgzvxEsDgaXI1Wva8iq5Y0Mk
-<iv<69><07><>j<EFBFBD>/z<12>뗹m<6D>?<3F><><EFBFBD><EFBFBD><EFBFBD>~\<>=<3D>5<>L<EFBFBD>M<08><>D<EFBFBD><44><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(H$<24><><EFBFBD>^<5E>f<>9<EFBFBD><39>;<3B>j<>aV8<56>q<06>w<EFBFBD>e<EFBFBD>료<EFBFBD>%ۇ<>U
--- a/secrets/mailserver-acc-admin-pw.age
+++ b/secrets/mailserver-acc-admin-pw.age
@@ -1,10 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg VKndh6ieX+XzpTHBh+ov96IrqGCIQeYcKji5wt6HlXA
-LW+yUqS5KFWVTvZHAcUOBH9VS+FoFupqnzajU5nR0EI
-> ssh-ed25519 UHxfvA p1bCzcd97Ra//YUnes9g6Q/qp07n+f+dDkaCNZiBpEc
-ZJ/khm5EuOZj6OyG/JNP7MeyM6SAVAfnx6GkFULHXTs
-> ssh-ed25519 EL/Tyg 9AL2BfGioplxgC+Paid3OMpTxAAZ/MqgD2cZ9JGuNzM
-fY2puHpjjNbCUJpHX1DIoqcpu5pM/yxhgZxkSlJYMBw
--- AnUcifoSL3SM3R+dKgldV2//mRjs6f+7t1v7xAEjUbU
-<EFBFBD><EFBFBD>7<><37>r<EFBFBD>L6<4C>TDr<44><72><EFBFBD>/<2F>E<15><>xȩ<11>u<>cN<63>J<EFBFBD>4<EFBFBD>Y)<29>]<5D>N<EFBFBD>Թ[<5B><>q}<7D>-<2D>ŉ=;2<>hI<68>꫎He<48>_F<15><13>o<EFBFBD><6F><EFBFBD>
-<EFBFBD>}<7D><><EFBFBD>I@3<><33>)<29><>O<EFBFBD>=<08><02><04>
--- a/secrets/mailserver-acc-test-pw.age
+++ b/secrets/mailserver-acc-test-pw.age
@@ -1,9 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg BHPXb0yAMGIMJoEFJFzq5YQrlj7C0IyXcIKHtEbQmiw
-0ilGBqIPjzYe0l6N/PXdTWW3spJZIsIBC0B62wdutNc
-> ssh-ed25519 UHxfvA 4KodpMUl2mkRcsKY7EzoMgIeWQ0yqyW+NqQheyHd6w0
-JMei4drWd0VG/qHDAlucoFtYlDAv/whTKrs23q9YX+c
-> ssh-ed25519 EL/Tyg Ip6g9rPqiKDUlmrBO+Bfu+VAi6rx90zUBxzbKupXHXE
-AK9id0HQqWPzNrK3AVox4vUO4mQlI/uZY7+ez8992K4
--- rhCvXjaEy9bzdG5UTR6HcQvHfioEJi4H0BFjyrQopLc
-<04><>٠<EFBFBD>Jl<4A>O<EFBFBD>W<EFBFBD><57>u<EFBFBD>1<EFBFBD><31>ʀ<EFBFBD><CA80><EFBFBD>˱<EFBFBD>X<EFBFBD>d1	<09>[<15><><EFBFBD>||Bt<42>\<5C> <20>h<EFBFBD>#<23><>ѣ'<27>b<EFBFBD><62>A<EFBFBD><41>z"n1\<5C><>q0<71><30>a<EFBFBD>:Ѯ<>T<EFBFBD><54><EFBFBD>EG<45>	b<><62>Cy<43><79>7U<37><1E>W
--- a/secrets/mailserver-acc-zulip+admin-pw.age
+++ b/secrets/mailserver-acc-zulip+admin-pw.age
@@ -1,10 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg /YSp9eYFPJT5Vj1lkw19CfDCW8bauZ2b1BiMtdZKTnY
-sJL2tL8nmh7q/8raA6Nnha2J9witk3994fxyvGcmBoA
-> ssh-ed25519 UHxfvA 68lyvttT185FSxrJLdAv2Qdb9/50Dn8zL5K5v7knz2A
-hrT93PeA+zX+ilXUjVuNQQi3nHED/ksmY82x89gJxj0
-> ssh-ed25519 EL/Tyg RDA+VpzH1QetDunca2R3KyzvBs0c1Hyp/BCDSGB+DQc
-o9k3z0FO/VXubhug6eeSDRwed2zvu+pbWeed6cKOun0
--- 8dCuX7j1i7EiXtF6jILoMUt8RxxBXnMgDqvqp2uMSOk
-<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>.<1E><><EFBFBD>g5<67><35>T<EFBFBD>oek'<27>nέ-7:<3A><><EFBFBD>XE<58>a<EFBFBD><61><EFBFBD><EFBFBD>pb<70>R<EFBFBD><52>dQ<1F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<04>)n^q<>y<EFBFBD>EJ<45>
-ˬ<EFBFBD>૳a<18>e9u<39><75><EFBFBD>*N$<24><>X<EFBFBD>V<EFBFBD><56>mg<>(Ê<>&<26>
--- a/secrets/mtgmonkey-pw.age
+++ b/secrets/mtgmonkey-pw.age
@@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg OF0H3FW/+6+6efi3cniowSGshtKoTSgk3pgz9ct16Vw
-RBSPPnJG1UtnOEpkPqwpB+xcQCBTmzVNpGH+2eJpYfM
-> ssh-ed25519 UHxfvA 1WcauG5gNnszYp/iAiFNLMvhPXAZ3qAd4F4t41U4bjY
-ERntLA7C/KtbyQzc3REwCSo/i2Yygk8khJTeULUaZ0o
--- 9eUxYn/d3qTHY5AMjJk85iJINxrt6eHyBbx7NbY3s0E
-<EFBFBD>6<EFBFBD>hM)<29>'<27><>ˉ3մ<33><D5B4>e<EFBFBD><65><EFBFBD>
--- a/secrets/secret0.age
+++ b/secrets/secret0.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg 4fCTrNibFdjnVfsIbXi6plbd56K8ZDDqtgryXPk2SUA
+vKlbDi+HpyYlSsN39GRh6GRwdHRSjypCEqguOaHPFDM
+-> ssh-ed25519 UHxfvA RqrDa4xJoAy1Gdzvq6Z5eTSNTDtHzUmzRoLC+j+HxiI
+5CohUFSDB9oiLU0T25FKrQrz07DCviVuzZsVcUltOc
+--- SQ5zQx9lL5UdNinOgP6yG5WWiBdhSwFqJVt6u3SNpLA
+<EFBFBD>6<EFBFBD><16><0B><>U<><55><EFBFBD>p<70><EE9087><EFBFBD><EFBFBD>Q<>]<5D>N<EFBFBD>;K;1y<31><79><EFBFBD>
--- a/secrets/secret1.age
+++ b/secrets/secret1.age
--- a/secrets/secret2.age
+++ b/secrets/secret2.age
--- a/secrets/secret3.age
+++ b/secrets/secret3.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
+E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
+-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
+PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
+-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
+sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
+--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
+'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h	f<>ɮ<13>xT<78><54>!K.<2E><1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51>Q<><51>
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,22 +4,8 @@ let
  lenovo = pub-keys.ssh.lenovo;
  _109-199-104-83 = pub-keys.ssh._109-199-104-83;
 in {
-  # user passwords
-  "andromeda-pw.age".publicKeys = [andromeda lenovo];
-  "mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
-
-  # mail account passwords
-  "mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
-
-  # zulip keys
-  "zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "zulip-secretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
-  "zulip-sharedSecretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
-
-  # zulip-secrets.conf values
-  "zulip-extraSecrets-email_password.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "secret0.age".publicKeys = [andromeda lenovo];
+  "secret1.age".publicKeys = [andromeda lenovo];
+  "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }
--- a/secrets/zulip-avatarSaltKey.age
+++ b/secrets/zulip-avatarSaltKey.age
--- a/secrets/zulip-camoKey.age
+++ b/secrets/zulip-camoKey.age
@@ -1,9 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg F5X75uA03GCdN5hiq4K6GPkjZOEGNxmZ71X8Gx0VeFY
-nURLjoD+R284PtDudfVRVwByEP836e+rhQyggmZG5Jg
-> ssh-ed25519 UHxfvA 6hSu9W0aRzw6lzOg8VtnR19/byrMv3Ioc3dY/HQD3Qc
-bTaLokq4Gn/tpCM7b10ME5MPR0oR3QyAKmlhXlrhLJw
-> ssh-ed25519 EL/Tyg 4k+vFxHeqISiWexGj5IAvXRpWdheKDJ/8b9dy8EYVHU
-eRBAnmIxuXtgi7dVTHfH0Q9h8KsyrVD0tTK0PlXO0EE
--- ZLCSwwY0oD0L1nwBKhZlRmDG4dj6MdjXZFQoITaECDg
-<EFBFBD>oӈ<1F>l<7F><13><>Nq<>[<5B><>J)&7<>`:޸`<60>׆<EFBFBD>D<EFBFBD><44>/J<>ٱF<D9B1>[<12><>A<EFBFBD>#<23>Z<EFBFBD><5A><EFBFBD>L<EFBFBD>y<EFBFBD>)"gt<1F><>*%4<>ᘨ<EFBFBD>O<EFBFBD>9Αv
--- a/secrets/zulip-extraSecrets-email_password.age
+++ b/secrets/zulip-extraSecrets-email_password.age
@@ -1,9 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg 6o7tjdOI24SQ/wAIw6DhF59ZSCY+5weRUxCqQso6PnI
-1OdvoW2M8etjWYM87ZW2muKpNUV+iOFY8NCd1Wopjkk
-> ssh-ed25519 UHxfvA ksk6McR1jrkxTmGqMnkhM0b41+AZc26LoainR5CGmC8
-AZTynapDNQ8aLFx7Rcu3dLVxJnuKcb8Emak9SjEOQcU
-> ssh-ed25519 EL/Tyg ZQaWIGPt41SwnQpGFnAadZmC/bVuTJx2v15GMmqjlU4
-3/S32mze090ThCPZF/lDs3xvsaAKNgfrM7I09WUGtsk
--- aRUPFhqwkRAzL2sQW4UJPPhV/EEvWCmXLE7PjHMLtnU
-<13><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m<EFBFBD>a_VX#!<21>[d<>[<5B><><EFBFBD><0C><><EFBFBD><EFBFBD>s<EFBFBD>M<EFBFBD>!<21>/<2F>b[<5B>J<EFBFBD><4A>[
--- a/secrets/zulip-rabbitmqPassword.age
+++ b/secrets/zulip-rabbitmqPassword.age
@@ -1,11 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg zafxexSagQeL9Upbgi6UCWKIWN93OIViw3U/aFn6p28
-jEUjCPoCuIHJ1ICP8gkHj4kWQaTAhEtoS4QDJLCQQek
-> ssh-ed25519 UHxfvA UiU/MjBeFl7r0HIjMqTMSYGGa/S84ZpyEXMoyKhrMwc
-sCCXk319YR7WOd2YGjl+hgi4xk+yE7eyN9Z6I1qDu40
-> ssh-ed25519 EL/Tyg 4YvWb6Ht4w6jtJZ7ROXzOLDIKjK0H5nDJSFADTcYiDg
-pDaPf5o6dFfE+J6CsEG4grI1DmBGuLCPcOys5q28pHo
--- rtPaK/w9Hla1apU/p3m+oORkmorylxOokUf64Le6A08
-<EFBFBD>-sN<><4E>}<7D>v
-lQw<03><><EFBFBD>
-+<2B><>>Ɏ<><C98E><EFBFBD>#	<09><><EFBFBD>cĻ<63>&<26><><EFBFBD>u<7F><75><14><>(F<>S*<2A><>@k'(<28><>KzƳ<7A>©P<C2A9>K
--- a/secrets/zulip-secretKey.age
+++ b/secrets/zulip-secretKey.age
--- a/secrets/zulip-sharedSecretKey.age
+++ b/secrets/zulip-sharedSecretKey.age
@@ -1,10 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 mT2fyg 2nDDyTFBWePI5AQn2gKWA3bJRJLkdY642nO+lP3VHgk
-L3QjA1urvUsFQ7D282BvfB2nRvDfQ2dDgPU//579Dzs
-> ssh-ed25519 UHxfvA BPbkHPRgQWlWfP3XdQYso1R7IWt/mXk00z6AKb1YeTs
-uzUc7K+G3nyX6Amjab0nuSqUAIqze+qWzmhL4NWFv9M
-> ssh-ed25519 EL/Tyg oKcrvdDUPqVBFPKO5XtN3wHlS0/VQ65JoDf3BZHKNz0
-nNnPODexacfxehSra59D/QSePJ0ReN8t5CVbOwRwuDU
--- yBSSTuxraK6ijWNnC9zJfIzrVHLOu4neg60ZvbFKyuM
-<EFBFBD>;||<7C><><EFBFBD><EFBFBD><0B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e!<21><>@<40><><EFBFBD><EFBFBD>%<<3C>h<17><>D)<1C><><02><><EFBFBD>JH<4A>@4<>
-t<><74>J
--- a/users.nix
+++ b/users.nix
@@ -13,14 +13,30 @@ in {
      "andromeda" = {
        isNormalUser = true;
        description = "andromeda";
-        hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
+        hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
        extraGroups = [
          "networkmanager"
          "wheel"
        ];
      };
+      "mtgmonkey" = {
+        isNormalUser = true;
+        description = "mtgmonkey";
+        hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
+        extraGroups = [
+          (lib.mkIf
+            (machine == machines.lenovo)
+            "networkmanager")
+          "wheel"
+        ];
+        openssh.authorizedKeys.keys = [
+          (lib.mkIf
+            (machine == machines."109-199-104-83")
+            config.pub-keys.ssh.andromeda)
+        ];
+      };
    };
-  environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
+  environment.persistence."/nix/persist".users = lib.mkIf config.environment.persistence."/nix/persist".enable (
    builtins.mapAttrs
    (name: value: lib.mkIf (builtins.elem name machine.users) value)
    {
@@ -29,7 +45,7 @@ in {
          ".backups"
          ".local/share/Anki2"
          ".local/share/chat.fluffy.fluffychat"
-          ".local/share/zoxide"
+          ".local/share.zoxide"
          ".ssh"
          "conf"
          "Downloads"
@@ -40,6 +56,16 @@ in {
          ".brush_history"
        ];
      };
+      "mtgmonkey" = {
+        directories = [
+          ".local/share/zoxide"
+          ".ssh"
+        ];
+        files = [
+          ".bash_history"
+          ".brush_history"
+        ];
+      };
    }
  );
 }
--- a/users/andromeda/home.nix
+++ b/users/andromeda/home.nix
@@ -16,6 +16,82 @@
        "${config.home.homeDirectory}/${background-path}"
      ];
    };
+  sway_config' = builtins.toFile "sway_config" ''
+    set $mod Mod4
+    set $left h
+    set $down j
+    set $up k
+    set $right l
+    set $term alacritty
+    set $menu wmenu-run
+    set $screenshot grim -g "$(slurp)"
+    floating_modifier $mod normal
+
+    workspace_layout stacking
+    output * bg ${config.home.homeDirectory}/${background-path} fill
+
+    # launch programs
+    bindsym $mod+Shift+Return exec $term
+    bindsym $mod+Shift+d exec $menu
+    bindsym $mod+Shift+a exec anki
+    bindsym $mod+Shift+q exec librewolf
+    bindsym $mod+Shift+s exec $screenshot
+
+    bindsym $mod+Shift+c kill
+
+    bindsym $mod+Shift+r reload
+
+    bindsym $mod+Shift+Alt+q exit
+
+    bindsym $mod+$left focus left
+    bindsym $mod+$down focus down
+    bindsym $mod+$up focus up
+    bindsym $mod+$right focus right
+
+    bindsym $mod+Shift+$left move left
+    bindsym $mod+Shift+$down move down
+    bindsym $mod+Shift+$up move up
+    bindsym $mod+Shift+$right move right
+
+    bindsym $mod+1 workspace number 1
+    bindsym $mod+2 workspace number 2
+    bindsym $mod+3 workspace number 3
+    bindsym $mod+4 workspace number 4
+    bindsym $mod+5 workspace number 5
+    bindsym $mod+6 workspace number 6
+    bindsym $mod+7 workspace number 7
+    bindsym $mod+8 workspace number 8
+    bindsym $mod+9 workspace number 9
+    bindsym $mod+0 workspace number 0
+
+    bindsym $mod+Shift+1 move container to workspace number 1
+    bindsym $mod+Shift+2 move container to workspace number 2
+    bindsym $mod+Shift+3 move container to workspace number 3
+    bindsym $mod+Shift+4 move container to workspace number 4
+    bindsym $mod+Shift+5 move container to workspace number 5
+    bindsym $mod+Shift+6 move container to workspace number 6
+    bindsym $mod+Shift+7 move container to workspace number 7
+    bindsym $mod+Shift+8 move container to workspace number 8
+    bindsym $mod+Shift+9 move container to workspace number 9
+    bindsym $mod+Shift+0 move container to workspace number 0
+
+    bindsym $mod+f fullscreen
+    bindsym $mod+Shift+space floating toggle
+    bindsym $mod+Shift+minus move scratchpad
+    bindsym $mod+minus scratchpad show
+
+    bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
+    bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
+    bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
+    bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
+    bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
+    bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
+
+    default_border none
+    font pango:monospace 0.001
+    titlebar_border_thickness 0
+    titlebar_padding 0
+  '';
 in {
  imports = [./stylix.nix];
  xdg.configFile."shell".source = lib.getExe pkgs.brush;
--- a/users/mtgmonkey/home.nix
+++ b/users/mtgmonkey/home.nix
@@ -0,0 +1,172 @@
+{
+  config,
+  lib,
+  machine,
+  pkgs,
+  ...
+}: {
+  imports = [./stylix.nix];
+  xdg.configFile."shell".source = lib.getExe pkgs.brush;
+  home = {
+    username = "mtgmonkey";
+    homeDirectory = "/home/${config.home.username}";
+    stateVersion = "26.05";
+    packages = [
+      pkgs.acpi
+      pkgs.brightnessctl
+      pkgs.brush
+      pkgs.dust
+      pkgs.fzf
+      pkgs.glow
+      pkgs.jmtpfs
+      pkgs.nix-output-monitor
+      pkgs.ranger
+      pkgs.rip2
+      pkgs.ripgrep
+      pkgs.tree
+      pkgs.zoxide
+    ];
+  };
+  programs = {
+    bash = {
+      enable = true;
+      shellAliases = {
+        neofetch = "fastfetch";
+        ls = lib.mkForce "lsd";
+        ll = lib.mkForce "lsd -l";
+        l = "lsd -la";
+        cd = "z";
+        gg = "git log --oneline --abbrev-commit --all --graph --decorate --color";
+        md = "glow";
+      };
+      bashrcExtra = ''
+        PS1="\u@\h:\w$"
+        eval "$(zoxide init bash)"
+      '';
+    };
+    btop = {
+      enable = true;
+      settings = {
+        theme_background = false;
+        vim_keys = true;
+        rounded_corners = false;
+        graph_symbol = "braille";
+        update_ms = 150;
+        proc_sorting = "cpu lazy";
+        proc_gradient = false;
+        proc_left = true;
+        cpu_single_graph = true;
+        cpu_bottom = true;
+        clock_format = "/user@/host:/uptime@%H:%M";
+        background_update = true;
+        mem_graphs = false;
+        mem_below_net = true;
+        show_swap = false;
+        only_physical = true;
+        show_io_stat = true;
+        io_mode = false;
+        io_graph_combined = false;
+      };
+    };
+    fastfetch.enable = true;
+    git = {
+      enable = true;
+      settings = {
+        user = {
+          name = config.home.username;
+          email = "${config.home.username}@${machine.hostname}";
+        };
+        init.defaultBranch = "master";
+      };
+    };
+    gh.enable = true;
+    home-manager.enable = true;
+    lsd.enable = true;
+    nvf = {
+      enable = true;
+      settings.vim = {
+        autocomplete.nvim-cmp.enable = false;
+        formatter.conform-nvim = {
+          enable = true;
+          setupOpts.format_on_save = {
+            lsp_format = "fallback";
+            timeout_ms = 5000;
+          };
+        };
+        lsp.otter-nvim.enable = true;
+        git.enable = true;
+        keymaps = [
+          {
+            key = "<Down>";
+            mode = ["i" "n" "v" "c"];
+            action = "<NOP>";
+          }
+          {
+            key = "<Up>";
+            mode = ["i" "n" "v" "c"];
+            action = "<NOP>";
+          }
+          {
+            key = "<Left>";
+            mode = ["i" "n" "v" "c"];
+            action = "<NOP>";
+          }
+          {
+            key = "<Right>";
+            mode = ["i" "n" "v" "c"];
+            action = "<NOP>";
+          }
+          {
+            key = "jj";
+            mode = ["i"];
+            action = "<Esc>";
+          }
+          {
+            key = "kk";
+            mode = ["i"];
+            action = "<Esc>";
+          }
+          {
+            key = "jk";
+            mode = ["i"];
+            action = "<Esc>";
+          }
+          {
+            key = "kj";
+            mode = ["i"];
+            action = "<Esc>";
+          }
+          {
+            key = "<Esc>";
+            mode = ["i"];
+            action = "<Nop>";
+          }
+        ];
+        languages = {
+          nix = {
+            enable = true;
+            format.enable = true;
+            lsp.enable = true;
+          };
+          haskell = {
+            enable = true;
+            lsp.enable = true;
+          };
+        };
+        lineNumberMode = "relative";
+        options = {
+          tabstop = 2;
+          shiftwidth = 2;
+          expandtab = true;
+          smarttab = true;
+          foldmethod = "indent";
+          number = true;
+          colorcolumn = "80";
+        };
+        statusline.lualine.enable = true;
+        syntaxHighlighting = true;
+      };
+    };
+    ssh.enable = true;
+  };
+}
--- a/users/mtgmonkey/stylix.nix
+++ b/users/mtgmonkey/stylix.nix
@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  stylix = {
+    enable = true;
+    # rebecca has lavener bkg
+    # tube has dark gray bkg
+    # silk-light is light theme
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-hard.yaml";
+    polarity = "dark";
+    fonts = {
+      monospace = {
+        package = pkgs.miracode;
+        name = "Miracode";
+      };
+      serif = config.stylix.fonts.sansSerif;
+      emoji = {
+        package = pkgs.noto-fonts-color-emoji;
+        name = "Noto Color Emoji";
+      };
+      sizes = {
+        applications = 12;
+        terminal = 10;
+      };
+    };
+  };
+}