update flake

.gitignore

@@ -1,2 +1 @@
-smb-secrets
 nixos-switch.log

.sops.yaml

@@ -0,0 +1,15 @@
+keys:
+    - &users:
+      - &chase age19uwxm2gynhjl9m90gckrkh76m9hjut44ak6d8969y4swhz8ypyeqvfcaas
+    - &hosts:
+      - &anzu age1wdjujpvc2zd0g592a9gqa7qzz4pcans8m0tyq3m6eq9np9a3lg2s8kxf3h
+      - &ichigo age1hpcyetyl0yrwxy0geem6z2u2kwl4hmckur7pnaaxwaylf8ata9vsv8j3wh
+      - &kuromi age1culqt965xgweu5h6menrppf7eatq7at04z0n52t365f0nvlv043su5t2yl
+creation_rules:
+    - path_regex: secrets.yaml$
+      key_groups:
+        - age:
+          - *chase
+          - *anzu
+          - *ichigo
+          - *kuromi

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 chase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.org

@@ -13,3 +13,5 @@ this is probably not that great of a reference.
 - https://nixos-and-flakes.thiscute.world/
 - https://github.com/kaleocheng/nix-dots/tree/master
 - https://gist.github.com/0atman/1a5133b842f929ba4c1e195ee67599d5
+- https://github.com/woioeow/hyprland-dotfiles/tree/main
+- https://github.com/HeinzDev/Hyprland-dotfiles 

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749155310,
-        "narHash": "sha256-t0HfHg/1+TbSra5s6nNM0o4tnb3uqWedShSpZXsUMYY=",
+        "lastModified": 1755946532,
+        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "94981cf75a9f11da0b6dd6a1abbd7c50a36ab2d3",
+        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
         "type": "github"
       },
       "original": {
@@ -38,11 +38,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1749223974,
-        "narHash": "sha256-/GAQYRW1duU81KG//2wI9ax8EkHVG/e1UOD97NdwLOY=",
+        "lastModified": 1756741629,
+        "narHash": "sha256-n+mgH3NoQf8d1jd8cDp/9Mt++hhyuE3LO3ZAxzjWRZw=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "3a42cd79c647360ee8742659e42aeec0947dd3b4",
+        "rev": "cd22197da06df1eb6fabdaa2fc22c170c4f67382",
         "type": "github"
       },
       "original": {
@@ -51,7 +51,38 @@
         "type": "github"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -68,6 +99,27 @@
       }
     },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -110,6 +162,28 @@
         "type": "github"
       }
     },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -117,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749243446,
-        "narHash": "sha256-P1gumhZN5N9q+39ndePHYrtwOwY1cGx+VoXGl+vTm7A=",
+        "lastModified": 1756842514,
+        "narHash": "sha256-XbtRMewPGJwTNhBC4pnBu3w/xT1XejvB0HfohC2Kga8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2d7d65f65b61fdfce23278e59ca266ddd0ef0a36",
+        "rev": "30fc1b532645a21e157b6e33e3f8b4c154f86382",
         "type": "github"
       },
       "original": {
@@ -138,11 +212,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749154018,
-        "narHash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg=",
+        "lastModified": 1756679287,
+        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7aae0ee71a17b19708b93b3ed448a1a0952bf111",
+        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
         "type": "github"
       },
       "original": {
@@ -168,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749155331,
-        "narHash": "sha256-XR9fsI0zwLiFWfqi/pdS/VD+YNorKb3XIykgTg4l1nA=",
+        "lastModified": 1753964049,
+        "narHash": "sha256-lIqabfBY7z/OANxHoPeIrDJrFyYy9jAM4GQLzZ2feCM=",
         "owner": "hyprwm",
         "repo": "hyprcursor",
-        "rev": "45fcc10b4c282746d93ec406a740c43b48b4ef80",
+        "rev": "44e91d467bdad8dcf8bbd2ac7cf49972540980a5",
         "type": "github"
       },
       "original": {
@@ -197,11 +271,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749145600,
-        "narHash": "sha256-v2kY5RDk9oyo1x9m8u83GdklC96xlJ7ka1rrvZoYL78=",
+        "lastModified": 1755678602,
+        "narHash": "sha256-uEC5O/NIUNs1zmc1aH1+G3GRACbODjk2iS0ET5hXtuk=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "80b754e38e836777ad3a9d5d1ffc3491b0332471",
+        "rev": "157cc52065a104fc3b8fa542ae648b992421d1c7",
         "type": "github"
       },
       "original": {
@@ -226,11 +300,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1749237813,
-        "narHash": "sha256-TDJHaf01IpP3dN+CC/GGuKRLPLFS9w4v9BufplyJkSY=",
+        "lastModified": 1756811803,
+        "narHash": "sha256-03zmDvAU+VLPWHv5uxfGVR6bs/SnCYeZ8hbedK/Eb/M=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "2794f485cb5d52b3ff572953ddcfaf7fd3c25182",
+        "rev": "127aab815908ecbd3db4d23f127d2e96b79855f9",
         "type": "github"
       },
       "original": {
@@ -319,11 +393,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749155776,
-        "narHash": "sha256-t1PM0wxQLQwv2F2AW23uA7pm5giwmcgYEWbNIRct9r4=",
+        "lastModified": 1753819801,
+        "narHash": "sha256-tHe6XeNeVeKapkNM3tcjW4RuD+tB2iwwoogWJOtsqTI=",
         "owner": "hyprwm",
         "repo": "hyprland-qtutils",
-        "rev": "396e8aa1c06274835b69da7f9a015fff9a9b7522",
+        "rev": "b308a818b9dcaa7ab8ccab891c1b84ebde2152bc",
         "type": "github"
       },
       "original": {
@@ -348,11 +422,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749145882,
-        "narHash": "sha256-qr0KXeczF8Sma3Ae7+dR2NHhvG7YeLBJv19W4oMu6ZE=",
+        "lastModified": 1753622892,
+        "narHash": "sha256-0K+A+gmOI8IklSg5It1nyRNv0kCNL51duwnhUO/B8JA=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "1bfb84f54d50c7ae6558c794d3cfd5f6a7e6e676",
+        "rev": "23f0debd2003f17bd65f851cd3f930cff8a8c809",
         "type": "github"
       },
       "original": {
@@ -373,11 +447,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749135356,
-        "narHash": "sha256-Q8mAKMDsFbCEuq7zoSlcTuxgbIBVhfIYpX0RjE32PS0=",
+        "lastModified": 1756117388,
+        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "e36db00dfb3a3d3fdcc4069cb292ff60d2699ccb",
+        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
         "type": "github"
       },
       "original": {
@@ -398,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749145760,
-        "narHash": "sha256-IHaGWpGrv7seFWdw/1A+wHtTsPlOGIKMrk1TUIYJEFI=",
+        "lastModified": 1755184602,
+        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "817918315ea016cc2d94004bfb3223b5fd9dfcc6",
+        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
         "type": "github"
       },
       "original": {
@@ -411,13 +485,39 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744463964,
-        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "lastModified": 1756266583,
+        "narHash": "sha256-cr748nSmpfvnhqSXPiCfUPxRz2FJnvf/RjJGvFfaCsM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
+        "rev": "8a6d5427d99ec71c64f0b93d45778c889005d9c2",
         "type": "github"
       },
       "original": {
@@ -429,11 +529,27 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1749086602,
-        "narHash": "sha256-DJcgJMekoxVesl9kKjfLPix2Nbr42i7cpEHJiTnBUwU=",
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4792576cb003c994bd7cc1edada3129def20b27d",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable_2": {
+      "locked": {
+        "lastModified": 1756754095,
+        "narHash": "sha256-9Rsn9XEWINExosFkKEqdp8EI6Mujr1gmQiyrEcts2ls=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7c815e513adbf03c9098b2bd230c1e0525c8a7f9",
         "type": "github"
       },
       "original": {
@@ -445,11 +561,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1748929857,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "lastModified": 1756266583,
+        "narHash": "sha256-cr748nSmpfvnhqSXPiCfUPxRz2FJnvf/RjJGvFfaCsM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "8a6d5427d99ec71c64f0b93d45778c889005d9c2",
         "type": "github"
       },
       "original": {
@@ -461,11 +577,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1749143949,
-        "narHash": "sha256-QuUtALJpVrPnPeozlUG/y+oIMSLdptHxb3GK6cpSVhA=",
+        "lastModified": 1756787288,
+        "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d3d2d80a2191a73d1e86456a751b83aa13085d7d",
+        "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1",
         "type": "github"
       },
       "original": {
@@ -477,18 +593,17 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
+        ]
       },
       "locked": {
-        "lastModified": 1749272342,
-        "narHash": "sha256-EGEAvVv3wp+dWeagxePwVNpMTx+dmR//VlZB4vWu2oA=",
+        "lastModified": 1756875847,
+        "narHash": "sha256-2L4kOvvCDUDBBBliCNiEXrYN0VqqkB0YHuOGckpp5X8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "aff4128eb3e712d2a592faacc883f3b0ea86c9fd",
+        "rev": "bffccde9bd7869ab355b76d53fbc25ac1f7d37eb",
         "type": "github"
       },
       "original": {
@@ -507,11 +622,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748196248,
-        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
+        "lastModified": 1756632588,
+        "narHash": "sha256-ydam6eggXf3ZwRutyCABwSbMAlX+5lW6w1SVZQ+kfSo=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
+        "rev": "d47428e5390d6a5a8f764808a4db15929347cd77",
         "type": "github"
       },
       "original": {
@@ -530,11 +645,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747372754,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "lastModified": 1755960406,
+        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
         "type": "github"
       },
       "original": {
@@ -543,16 +658,86 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "catppuccin": "catppuccin",
         "home-manager": "home-manager",
         "home-manager-stable": "home-manager-stable",
         "hyprland": "hyprland",
+        "lanzaboote": "lanzaboote",
         "nixpkgs": "nixpkgs_3",
-        "nixpkgs-stable": "nixpkgs-stable",
+        "nixpkgs-stable": "nixpkgs-stable_2",
         "nur": "nur",
-        "plasma-manager": "plasma-manager"
+        "plasma-manager": "plasma-manager",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1754988908,
+        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {
@@ -570,27 +755,6 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [
@@ -619,11 +783,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749155346,
-        "narHash": "sha256-KIkJu3zF8MF3DuGwzAmo3Ww9wsWXolwV30SjJRTAxYE=",
+        "lastModified": 1755354946,
+        "narHash": "sha256-zdov5f/GcoLQc9qYIS1dUTqtJMeDqmBmo59PAxze6e4=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "44bf29f1df45786098920c655af523535a9191ae",
+        "rev": "a10726d6a8d0ef1a0c645378f983b6278c42eaa0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,37 +1,45 @@
 {
-  description = "A simple NixOS flake";
+  description = "SecureBoot-enabled NixOS config";
 
   inputs = {
-    # NixOS official package source, using unstable here
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nur = {
-      url = "github:nix-community/NUR";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    catppuccin.url = "github:catppuccin/nix";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.05";
     home-manager = {
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    home-manager-stable = {
+      url = "github:nix-community/home-manager/release-25.05";
+      inputs.nixpkgs.follows = "nixpkgs-stable";
+    };
+    nur = {
+      url = "github:nix-community/NUR";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    catppuccin.url = "github:catppuccin/nix";
     hyprland.url = "github:hyprwm/Hyprland";
     plasma-manager = {
       url = "github:nix-community/plasma-manager";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.home-manager.follows = "home-manager";
     };
-
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.05";
-    home-manager-stable = {
-      url = "github:nix-community/home-manager/release-25.05";
-      inputs.nixpkgs.follows = "nixpkgs-stable";
-    };
   };
 
   outputs = {
     self,
     catppuccin,
+    lanzaboote,
     nur,
     plasma-manager,
+    sops-nix,
     ...
   } @ inputs: let
     hosts = import ./hosts/hosts.nix;
@@ -57,6 +65,7 @@
           [
             ./hosts/${host.dir}/home.nix
             catppuccin.homeModules.catppuccin
+            sops-nix.homeManagerModules.sops
           ]
           ++ modules;
       };
@@ -76,10 +85,16 @@
             ./hosts/${host.dir}/configuration.nix
             nur.modules.nixos.default
             catppuccin.nixosModules.catppuccin
+            sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager
             {
               home-manager.backupFileExtension = "backup";
               home-manager.useGlobalPkgs = true;
+              home-manager.useUserPackages = true;
+              home-manager.sharedModules = [
+                plasma-manager.homeManagerModules.plasma-manager
+                sops-nix.homeManagerModules.sops
+              ];
               home-manager.users."${host.user}".imports = [
                 ./hosts/${host.dir}/home.nix
                 catppuccin.homeModules.catppuccin
@@ -95,31 +110,19 @@
         host = hosts.anzu;
         nixpkgs = inputs.nixpkgs;
         home-manager = inputs.home-manager;
-        modules = [
-          {
-            home-manager.sharedModules = [plasma-manager.homeManagerModules.plasma-manager];
-          }
-        ];
+        modules = [lanzaboote.nixosModules.lanzaboote];
       };
       ichigo = mkNixOSConfigurations {
         host = hosts.ichigo;
         nixpkgs = inputs.nixpkgs;
         home-manager = inputs.home-manager;
-        modules = [
-          {
-            home-manager.sharedModules = [plasma-manager.homeManagerModules.plasma-manager];
-          }
-        ];
+        modules = [];
       };
       kuromi = mkNixOSConfigurations {
         host = hosts.kuromi;
-        nixpkgs = inputs.nixpkgs;
-        home-manager = inputs.home-manager;
-        modules = [
-          {
-            home-manager.sharedModules = [plasma-manager.homeManagerModules.plasma-manager];
-          }
-        ];
+        nixpkgs = inputs.nixpkgs-stable;
+        home-manager = inputs.home-manager-stable;
+        modules = [];
       };
     };
   };

home/README.org

@@ -0,0 +1,7 @@
+#+TITLE: Home Manager Config
+#+AUTHOR: chase
+#+LANGUAGE: en
+#+OPTIONS: toc:nil
+
+* Wallpaper Source
+https://x.com/allwifeman/status/1513766332252098562

home/base.nix

@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   pkgs,
   ...
 }: {
@@ -16,6 +17,19 @@
     sessionPath = [
       "$HOME/scripts"
     ];
+    sessionVariables = {
+      # Aspell stuff
+      ASPELL_CONF = "per-conf $XDG_CONFIG_HOME/aspell/aspell.conf; personal $XDG_DATA_HOME/aspell/en.pws; repl $XDG_DATA_HOME/aspell/en.prepl";
+      # Bitwarden stuff
+      BITWARDEN_SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/.bitwarden-ssh-agent.sock";
+      SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/.bitwarden-ssh-agent.sock";
+      ELECTRON_OZONE_PLATFORM_HINT = "wayland";
+      # Java stuff
+      _JAVA_OPTIONS = "-Djava.util.prefs.userRoot='$XDG_CONFIG_HOME'/java";
+      # libx11 stuff
+      XCOMPOSECACHE = "$XDG_CACHE_HOME/X11/xcompose";
+      XCOMPOSEFILE = "$XDG_CONFIG_HOME/X11/xcompose";
+    };
     shellAliases = {
       gs = "git status";
       "..." = "cd ../..";
@@ -43,9 +57,6 @@
   programs.bash = {
     enable = true;
     enableCompletion = true;
-    bashrcExtra = ''
-      export SSH_AUTH_SOCK=/home/chase/.bitwarden-ssh-agent.sock
-    '';
     historyIgnore = [
       "ls"
       "ls -a"
@@ -56,8 +67,33 @@
     ];
   };
 
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    autosuggestion.enable = true;
+    history = {
+      append = true;
+      extended = true;
+      ignoreDups = true;
+      ignorePatterns = [
+        "ls *"
+        "cd *"
+        "gs"
+        "exit"
+      ];
+    };
+    syntaxHighlighting.enable = true;
+  };
+
   programs.bat.enable = true;
 
+  programs.btop.enable = true;
+
+  programs.emacs = {
+    enable = true;
+    package = lib.mkDefault pkgs.emacs-nox;
+  };
+
   programs.fastfetch = {
     enable = true;
     settings = {
@@ -103,12 +139,24 @@
     };
   };
 
+  programs.fzf = {
+    enable = true;
+    enableBashIntegration = true;
+    enableZshIntegration = true;
+  };
+
   programs.git = {
     enable = true;
     userName = "chase";
     userEmail = "chase@cathoderaytube.net";
     extraConfig = {
       init.defaultBranch = "main";
+      pull.rebase = true;
+    };
+    signing = {
+      format = "ssh";
+      key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFSQX+s8Krl312DcnUtoEWOA2silcUnt5URtyVZz8Yek";
+      signByDefault = true;
     };
   };
 
@@ -121,8 +169,6 @@
 
   programs.htop.enable = true;
 
-  programs.ranger.enable = true;
-
   programs.rmpc = {
     enable = true;
     config = ''
@@ -132,13 +178,10 @@
     '';
   };
 
-  # programs.senpai.enable = true;
-
-  # programs.sm64ex.enable = true;
-
   programs.starship = {
     enable = true;
     enableBashIntegration = true;
+    enableZshIntegration = true;
     settings = {
       line_break = {
         disabled = true;
@@ -159,17 +202,27 @@
     };
   };
 
-  programs.texlive.enable = true;
-
   programs.yazi = {
     enable = true;
     enableBashIntegration = true;
+    enableZshIntegration = true;
   };
 
   programs.yt-dlp = {
     enable = true;
     settings = {
+      cookies-from-browser = "firefox";
+      write-description = true;
+      write-info-json = true;
+      embed-info-json = true;
+      embed-chapters = true;
+      embed-metadata = true;
+      write-subs = true;
+      embed-subs = true;
+      sub-langs = "en.*,ja";
+      write-thumbnail = true;
       embed-thumbnail = true;
+      sponsorblock-mark = "all";
     };
   };
 
@@ -179,9 +232,12 @@
     aspellDicts.en-computers
     aspellDicts.en-science
     ffmpeg
+    font-awesome
     fortune
     imagemagick
+    lm_sensors
     lolcat
     nerd-fonts.blex-mono
+    texliveFull
   ];
 }

home/desktop.nix

@@ -20,27 +20,91 @@
         id = 0;
         name = "default";
         isDefault = true;
+        containers = {
+          personal = {
+            color = "purple";
+            icon = "fingerprint";
+            id = 1;
+          };
+          work = {
+            color = "orange";
+            icon = "briefcase";
+            id = 2;
+          };
+          social = {
+            color = "blue";
+            icon = "chill";
+            id = 3;
+          };
+          dev = {
+            color = "green";
+            icon = "circle";
+            id = 4;
+          };
+        };
+        containersForce = true;
         extensions = {
+          force = true;
           packages = with pkgs.nur.repos.rycee.firefox-addons; [
             awesome-rss
             betterttv
             bitwarden
-            clearurls
-            control-panel-for-twitter
-            enhancer-for-youtube
+            blocktube
             facebook-container
             flagfox
+            hyperchat
             istilldontcareaboutcookies
-            privacy-badger
+            linkwarden
+            livetl
             return-youtube-dislikes
             search-by-image
             sponsorblock
             tab-session-manager
             tampermonkey
             ublock-origin
+            windscribe
+            ytcfilter
           ];
+          settings = {
+            "uBlock0@raymondhill.net" = {
+              force = true;
+              settings = {
+                selectedFilterLists = [
+                  "ublock-filters"
+                  "ublock-badware"
+                  "ublock-privacy"
+                  "ublock-unbreak"
+                  "ublock-quick-fixes"
+                  "easylist"
+                  "easyprivacy"
+                  "urlhaus-1"
+                  "plowe-0"
+                  "fanboy-cookiemonster"
+                  "ublock-cookies-easylist"
+                  "adguard-cookies"
+                  "ublock-cookies-adguard"
+                  "ublock-annoyances"
+                  "https://git.traphouse.cathoderaytube.net/chase/ublock-filters/raw/branch/main/chase-all.txt"
+                  "user-filters"
+                ];
+                importedLists = [
+                  "https://git.traphouse.cathoderaytube.net/chase/ublock-filters/raw/branch/main/chase-all.txt"
+                ];
+              };
+            };
+            "Tab-Session-Manager@sienori" = {
+              settings = {
+                "startupBehavior" = ["previousSession"];
+                "Settings" = {
+                  "startupBehavior" = "previousSession";
+                  "openButtonBehavior" = "openInCurrentWindow";
+                };
+              };
+            };
+          };
         };
         settings = {
+          "apz.gtk.touchpad_pinch.enabled" = false;
           "browser.formfill.enable" = false;
           "browser.ml.chat.enabled" = false;
           "browser.ml.chat.shortcuts" = false;
@@ -55,23 +119,40 @@
           "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
           "browser.newtabpage.activity-stream.system.showSponsored" = false;
           "browser.topsites.contile.enabled" = false;
+          "browser.urlbar.trimURLs" = false;
           "browser.urlbar.unitConversion.enabled" = true;
+          "dom.security.https_only_mode" = true;
           "extensions.formautofill.addresses.enabled" = false;
           "extensions.formautofill.creditCards.enabled" = false;
           "extensions.pocket.enabled" = false;
           "general.autoScroll" = true;
-          "widget.use-xdg-desktop-portal.file-picker" = 1;
+          "permissions.default.geo" = 2;
+          "privacy.bounceTrackingProtection.mode" = 1;
+          "privacy.fingerprintingProtection" = true;
+          "privacy.trackingprotection.consentmanager.skip.pbmode.enabled" = false;
+          "privacy.trackingprotection.emailtracking.enabled" = true;
+          "privacy.trackingprotection.enabled" = true;
+          "privacy.trackingprotection.socialtracking.enabled" = true;
           "signon.rememberSignons" = false;
+          "widget.use-xdg-desktop-portal.file-picker" = 1;
         };
         search = {
           force = true;
           default = "SearX";
           order = ["SearX" "google"];
           engines = {
+            "MELPA" = {
+              urls = [
+                {
+                  template = "https://melpa.org/#/?q={searchTerms}";
+                }
+              ];
+              definedAliases = ["@m"];
+            };
             "Nix Packages" = {
               urls = [
                 {
-                  template = "https://search.nixos.org/packages";
+                  template = "https://search.nixos.org/packages?channel=unstable";
                   params = [
                     {
                       name = "type";
@@ -98,21 +179,13 @@
     };
   };
 
-  programs.ghostty = {
-    enable = true;
-    enableBashIntegration = true;
-    installBatSyntax = true;
-    installVimSyntax = true;
-    settings = {
-      font-family = "BlexMono Nerd Font";
-      font-size = 11;
-    };
-  };
-
   programs.kitty = {
     enable = true;
     enableGitIntegration = true;
-    shellIntegration.enableBashIntegration = true;
+    shellIntegration = {
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+    };
     font = {
       name = "BlexMono Nerd Font";
       size = 11;
@@ -127,26 +200,39 @@
     };
     scripts = [
       pkgs.mpvScripts.mpris
+      pkgs.mpvScripts.sponsorblock
     ];
   };
 
   programs.obs-studio.enable = true;
 
+  programs.rofi = {
+    enable = true;
+    package = pkgs.rofi-wayland;
+  };
+
   home.packages = with pkgs; [
     anki-bin
-    audacity
     gimp
     ibm-plex
     kdePackages.kdenlive
     libnotify
     libreoffice
     logiops
+    openutau
     picard
     protonmail-bridge
+    (pkgs.python3.withPackages (python-pkgs: [
+      python-pkgs.python-lsp-server
+      python-pkgs.python-lsp-ruff
+    ]))
+    runelite
     thunderbird
     vcv-rack
-    runelite
+    waybar
+    waybar-mpris
   ];
+
   services.arrpc.enable = true;
 
   services.emacs = {
@@ -162,12 +248,10 @@
     defaultEditor = true;
   };
 
-  services.mako.enable = true;
-
   services.mpd = {
     enable = true;
     extraConfig = ''
-       audio_output {
+      audio_output {
          type "pipewire"
       name "Pipewire Output"
           }

home/emacs/early-init.el

@@ -40,7 +40,7 @@
   (load custom-file))
 
 ;; backup directory instead of loose files
-(setq backup-directory-alist '(("." . "~/.config/emacs/backups")))
+(setq backup-directory-alist '(("." . (expand-file-name "backups/" user-emacs-directory))))
 (setq backup-by-copying t)
 
 ;; defer package initialize
@@ -49,11 +49,6 @@
 ;; prevent resizing of the frame
 (setq frame-inhibit-implied-resize t)
 
-;; no bars
-(menu-bar-mode -1)
-(tool-bar-mode -1)
-(scroll-bar-mode -1)
-
 ;; no startup screen
 (setq inhibit-startup-screen t)
 

home/emacs/init.el

@@ -3,6 +3,10 @@
 ;;; Commentary:
 
 ;;; Code:
+;; Check Emacs version and warn if it is not supported
+(when (and (<= emacs-major-version 29) (< emacs-minor-version 4))
+  (warn (format "This config is designed for Emacs 29+, please upgrade.")))
+
 ;; display startup time
 (defun chase/display-startup-time ()
   "Write init time and number of garbage collections to message buffer."
@@ -14,23 +18,19 @@
 ;; automatically create missing directories
 ;; source: https://emacsredux.com/blog/2022/06/12/auto-create-missing-directories/
 (defun er-auto-create-missing-dirs ()
+  "Create missing parent directories automatically when opening a file."
   (let ((target-dir (file-name-directory buffer-file-name)))
     (unless (file-exists-p target-dir)
       (make-directory target-dir t))))
 
 (add-to-list 'find-file-not-found-functions #'er-auto-create-missing-dirs)
 
-;; set repos and bootstrap use-package
-;; (require 'package)
+;; no bars
+(add-hook 'window-setup-hook (lambda ()
+                               (menu-bar-mode -1)
+                               (tool-bar-mode -1)
+                               (scroll-bar-mode -1)))
 
-;; (add-to-list 'package-archives '("melpa" . "https://melpa.org/packages/") t)
-
-;; (package-initialize)
-
-;; (eval-when-compile
-  ;; (require 'use-package))
-
-;; 
 ;; bootstrap straight
 (defvar bootstrap-version)
 (let ((bootstrap-file
@@ -50,13 +50,10 @@
 
 (setq straight-use-package-by-default t)
 
-;; always install missing packages
-;; (require 'use-package-ensure)
-;; (setq use-package-always-ensure t)
 (setq use-package-always-demand t
       use-package-compute-statistics t)
 
-(require 'bind-key)
+(use-package bind-key)
 
 (use-package diminish)
 
@@ -65,16 +62,6 @@
   :config
   (add-hook 'after-init-hook #'benchmark-init/deactivate))
 
-;; auto-update packages
-;; (use-package auto-package-update
-;;  :custom
-;;  (setq auto-package-update-delete-old-versions t
-;;		auto-package-update-hide-results t
-;;		auto-package-update-interval 7)
-;;  :config
-;;  (auto-package-update-maybe)
-;;  (auto-package-update-at-time "09:30"))
-
 ;; set locale
 (set-language-environment "UTF-8")
 (prefer-coding-system 'utf-8-unix)
@@ -125,6 +112,26 @@
   :config
   (evil-collection-init))
 
+(use-package evil-surround
+  :config
+  (global-evil-surround-mode 1))
+
+(use-package vertico
+  :custom
+  (vertico-cycle t)
+  :init
+  (vertico-mode))
+
+(use-package savehist
+  :init
+  (savehist-mode))
+
+(use-package orderless
+  :custom
+  (completion-styles '(orderless basic))
+  (completion-category-defaults nil)
+  (completion-category-overrides '((file (styles partial-completion)))))
+
 ;; prevent laggy icons
 (setq inhibit-compacting-font-caches t)
 
@@ -137,6 +144,11 @@
   :config
   (nerd-icons-completion-mode))
 
+(use-package nerd-icons-corfu
+  :after corfu
+  :config
+  (add-to-list 'corfu-margin-formatters #'nerd-icons-corfu-formatter))
+
 (use-package nerd-icons-dired
   :hook
   (dired-mode . nerd-icons-dired-mode))
@@ -168,14 +180,10 @@
 (column-number-mode)
 
 ;; line numbers, not quite everywhere
+(setq-default display-line-numbers-type 'relative)
 (add-hook 'prog-mode-hook #'display-line-numbers-mode)
 (add-hook 'text-mode #'display-line-numbers-mode)
 
-;; center cursor
-;; (use-package centered-cursor-mode
-;;   :config
-;;   (global-centered-cursor-mode))
-
 ;; move cursor to new help windows
 (setq help-window-select t)
 
@@ -205,15 +213,17 @@
 (setq ibuffer-saved-filter-groups
 	  '(("Default"
          ("Terminal" (name . "^\\*terminal\\*$"))
+         ("Nix"      (mode . nix-ts-mode))
 		 ("Code"     (or
 				      (mode . c-ts-mode)
 				      (mode . c++-ts-mode)
+                      (mode . emacs-lisp-mode)
 				      (mode . js-ts-mode)
                       (mode . makefile-gmake-mode)
 				      (mode . python-ts-mode)
 				      (mode . rust-ts-mode)))
-		 ("Dired"    (mode . dired-mode))
 		 ("Org"      (mode . org-mode))
+		 ("Dired"    (mode . dired-mode))
 		 ("Magit"    (name . "^magit"))
 		 ("Emacs"    (or
 				      (name . "^\\*Completions\\*$")
@@ -224,10 +234,19 @@
 
 (add-hook 'ibuffer-mode-hook
 		  (lambda ()
-			(ibuffer-switch-to-saved-filter-groups "Default")))
+			(ibuffer-switch-to-saved-filter-groups "Default")
+            (ibuffer-auto-mode 1)))
+
+;; make dired less messy
+(setf dired-kill-when-opening-new-dired-buffer t)
+
+;; kill buffers
+(substitute-key-definition 'kill-buffer 'kill-buffer-and-window global-map)
 
 ;; git stuff
-(use-package magit)
+(use-package magit
+  :config
+  (setq magit-bury-buffer-function 'kill-buffer))
 
 (use-package magit-todos
   :after magit)
@@ -263,15 +282,26 @@
   :config
   (treemacs-load-theme "nerd-icons"))
 
-;; company
-(use-package company
-  :bind (:map company-active-map
-			  ("C-n" . company-select-next)
-			  ("C-p" . company-select-previous))
+;; corfu
+(use-package corfu
+  :custom
+  (corfu-cycle t)
+  (corfu-auto t)
+  (corfu-auto-prefix 2)
+  (corfu-auto-delay 0.2)
+  (corfu-quit-at-boundary 'separator)
+  (corfu-echo-documentation 0.25)
   :init
-  (global-company-mode)
-  :config
-  (setq company-idle-delay 0.1)) ;; faster autocomplete
+  (when (>= emacs-major-version 30)
+    (global-completion-preview-mode 1))
+  (unless (display-graphic-p)
+    (when (require 'corfu-terminal nil :noerror)
+      (corfu-terminal-mode +1)))
+  (global-corfu-mode 1)
+  (corfu-history-mode 1))
+
+;; license templates
+(use-package license-templates)
 
 ;; yasnippet config
 (use-package yasnippet
@@ -280,8 +310,8 @@
   (prog-mode . yas-minor-mode)
   :config
   (setq yas-snippet-dirs
-		'("~/.config/emacs/snippets" ;; personal
-		  "~/.config/emacs/work")))  ;; keep em separated
+		'((expand-file-name "snippets/" user-emacs-directory) ;; personal
+          (expand-file-name "work/" user-emacs-directory))))  ;; keep em separated
 
 ;; nix
 (use-package nix-ts-mode
@@ -300,7 +330,7 @@
 (use-package python
   :defer t
   :config
-  (setq python-flymake-command '("flake8" "-")))
+  (setq python-flymake-command '("ruff" "--quiet" "--stdin-filename=stdin" "-")))
 
 ;; eglot
 (use-package eglot
@@ -364,15 +394,6 @@
   (pdf-tools-install :no-query)
   (require 'pdf-occur))
 
-;; ;; helm
-;; (use-package helm
-  ;; :config
-  ;; (global-set-key (kbd "M-x") #'helm-M-x)
-  ;; (global-set-key (kbd "C-x r b") #'helm-filtered-bookmarks)
-  ;; (global-set-key (kbd "C-x C-f") #'helm-find-files)
-  ;; (setq helm-ff-auto-update-initial-value 1)
-  ;; (helm-mode 1))
-
 ;; org stuff
 (use-package org
   :mode
@@ -396,7 +417,11 @@
 
   ;; agenda
   (require 'find-lisp)
+  (unless (file-exists-p "~/Documents/org")
+    (make-directory "~/Documents/org" t))
   (setq org-directory "~/Documents/org")
+  (unless (file-exists-p (expand-file-name "gtd/" org-directory))
+    (make-directory (expand-file-name "gtd/" org-directory) t))
   (setq chase/org-agenda-directory
         (expand-file-name "gtd/" org-directory))
   (setq org-agenda-files
@@ -420,7 +445,7 @@
   (setq org-refile-allow-creating-parent-nodes 'confirm
         org-refile-targets '(("projects.org" . (:level . 1))))
 
-;; source blocks
+  ;; source blocks
   (add-to-list 'org-structure-template-alist '("el" . "src emacs-lisp"))
   (add-to-list 'org-structure-template-alist '("py" . "src python"))
   (add-to-list 'org-structure-template-alist '("sh" . "src shell"))
@@ -428,6 +453,9 @@
   (add-to-list 'org-structure-template-alist '("json" . "src json"))
   (add-to-list 'org-structure-template-alist '("yaml" . "src yaml"))
 
+  ;; babel
+  (add-to-list 'org-babel-load-languages '(shell . t))
+
   ;; fix yaml fontify
   (add-to-list 'org-src-lang-modes '("yaml" . yaml-ts))
 
@@ -436,10 +464,10 @@
 		org-export-with-section-numbers nil)
 
   ;; LaTeX
-  (setq org-latex-compiler "xelatex")
-  (setq org-latex-listings 'minted
-		org-latex-pdf-process
-		'("latexmk -shell-escape -f -pdf -%latex -interaction=nonstopmode -output-directory=%o %f"))
+  ;;(setq org-latex-compiler "xelatex")
+  ;;(setq org-latex-listings 'minted
+		;;org-latex-pdf-process
+		;;'("latexmk -shell-escape -f -pdf -%latex -interaction=nonstopmode -output-directory=%o %f"))
 
   (use-package evil-org
 	:after org
@@ -455,9 +483,6 @@
 
   (use-package org-roam
     :after org
-	:custom
-	(org-roam-directory
-     (expand-file-name "roam/" org-directory))
 	:bind
 	(("C-c n l" . org-roam-buffer-toggle)
      ("C-c n f" . org-roam-node-find)
@@ -467,6 +492,10 @@
      ;; Dailies
      ("C-c n j" . org-roam-dailies-capture-today))
 	:config
+    (unless (file-exists-p (expand-file-name "roam/" org-directory))
+      (make-directory (expand-file-name "roam/" org-directory) t))
+	(setq org-roam-directory
+     (expand-file-name "roam/" org-directory))
     (require 'org-roam-protocol)
     (require 'org-roam-export)
 	(org-roam-db-autosync-mode)
@@ -510,11 +539,13 @@
 	:after org)
 
   (use-package ox-moderncv
-    :after org
-    :straight
-    (org-cv :type git :host gitlab :repo "Titan-C/org-cv"))
+    :straight nil
+    :load-path "~/org-cv/"
+    ;;(org-cv :type git :host gitlab :repo "Titan-C/org-cv"))
+    :init (require 'ox-moderncv))
 
-(use-package ox-hugocv
+
+  (use-package ox-hugocv
     :after org
     :straight
     (org-cv :type git :host gitlab :repo "Titan-C/org-cv")))
@@ -528,11 +559,19 @@
 (use-package flyspell
   :defer t
   :hook
+  (markdown-mode . flyspell-mode)
   (org-mode . flyspell-mode)
   :diminish flyspell-mode)
 
-;; enlighten flymake to the load path
-(setq elisp-flymake-byte-compile-load-path load-path)
+;; flymake config
+(use-package flymake
+  :straight nil
+  :defer t
+  :init
+  (setq elisp-flymake-byte-compile-load-path load-path)
+  :bind (:map global-map
+		      ("M-n" . flymake-goto-next-error)
+		      ("M-p" . flymake-goto-prev-error)))
 
 ;; windows printer
 (setq ps-printer-name t)
@@ -542,24 +581,5 @@
 
 (use-package emms)
 
-;; exwm
-;; (use-package exwm
-  ;; :config
-  ;; (add-hook 'exwm-update-class-hook
-            ;; (lambda () (exwm-workspace-rename-buffer exwm-class-name)))
-  ;; (setq exwm-input-global-keys
-        ;; `(([?\s-r] . exwm-reset)
-          ;; ([?\s-w] . exwm-workspace-switch)
-          ;; ([?\s-&] . (lambda (cmd)
-                       ;; (interactive (list (read-shell-command "$ ")))
-                       ;; (start-process-shell-command cmd nil cmd)))
-          ;; ,@(mapcar (lambda (i)
-                      ;; `(,(kbd (format "s-%d" i))
-                        ;; (lambda ()
-                          ;; (interactive)
-                          ;; (exwm-workspace-switch-create ,i))))
-                    ;; (number-sequence 0 9))))
-  ;; (exwm-enable))
-
 (provide 'init)
 ;;; init.el ends here

home/hypr.nix

@@ -3,12 +3,175 @@
   pkgs,
   ...
 }: {
+  catppuccin = {
+    waybar = {
+      enable = false;
+    # flavor = "mocha";
+    # mode = "createLink";
+	};
+	hyprland = {
+	  enable = false;
+    };
+  };
+  
   programs.waybar = {
     enable = true;
     systemd = {
       enable = true;
       target = "hyprland-session.target";
     };
+    style = ./waybar.css;
+    settings = [{
+        "layer" = "top";
+        "position" = "top";
+        modules-left = [
+          "custom/launcher"
+          "temperature"
+          "mpd"
+        ];
+        modules-center = [
+          "clock"
+        ];
+        modules-right = [
+          "pulseaudio"
+          "backlight"
+          "memory"
+          "cpu"
+          "network"
+          "custom/powermenu"
+          "tray"
+        ];
+        "custom/launcher" = {
+          "format" = " ";
+          "on-click" = "pkill rofi || rofi2";
+          "on-click-middle" = "exec default_wall";
+          "on-click-right" = "exec wallpaper_random";
+          "tooltip" = false;
+        };
+        "pulseaudio" = {
+          "scroll-step" = 1;
+          "format" = "{icon} {volume}%";
+          "format-muted" = "󰖁 Muted";
+          "format-icons" = {
+            "default" = [ "" "" "" ];
+          };
+          "on-click" = "pamixer -t";
+          "tooltip" = false;
+        };
+        "clock" = {
+          "interval" = 1;
+          "format" = "{:%H:%M}";
+          "tooltip" = true;
+          "tooltip-format"= "{:%Y-%m-%d}\n<tt>{calendar}</tt>";
+        };
+        "memory" = {
+          "interval" = 1;
+          "format" = "󰻠 {percentage}%";
+          "states" = {
+            "warning" = 85;
+          };
+        };
+        "cpu" = {
+          "interval" = 1;
+          "format" = "󰍛 {usage}%";
+        };
+        "mpd" = {
+          "max-length" = 25;
+          "format" = "<span foreground='#bb9af7'></span> {title}";
+          "format-paused" = " {title}";
+          "format-stopped" = "<span foreground='#bb9af7'></span>";
+          "format-disconnected" = "";
+          "on-click" = "rmpc togglepause";
+          "on-click-right" = "rmpc update";
+          "on-click-middle" = "kitty --class='rmpc' rmpc ";
+          "on-scroll-up" = "rmpc prev";
+          "on-scroll-down" = "rmpc next";
+          "smooth-scrolling-threshold" = 5;
+          "tooltip-format" = "{title} - {artist} ({elapsedTime:%M:%S}/{totalTime:%H:%M:%S})";
+        };
+        "network" = {
+          "format-disconnected" = "󰯡";
+          "format-ethernet" = "󰒢";
+          "format-linked" = "󰖪 {essid} (No IP)";
+          "format-wifi" = "󰖩 {essid}";
+          "interval" = 1;
+          "tooltip" = false;
+        };
+        "custom/powermenu" = {
+          "format" = "";
+          "on-click" = "pkill rofi || ~/.config/rofi/powermenu/type-3/powermenu.sh";
+          "tooltip" = false;
+        };
+        "tray" = {
+          "icon-size" = 15;
+          "spacing" = 5;
+        };
+    }];
+  };
+
+  programs.hyprlock = {
+    enable = true;
+    settings = {
+      general = {
+        disable_loading_bar = true;
+        grace = 3;
+        hide_cursor = true;
+        no_fade_in = false;
+      };
+
+      background = [
+        {
+          path = "screenshot";
+          blur_passes = 3;
+          blur_size = 8;
+        }
+      ];
+
+      input-field = [
+        {
+          size = "200, 50";
+          position = "0, -80";
+          monitor = "";
+          dots_center = true;
+          fade_on_empty = false;
+          font_color = "rgb(202, 211, 245)";
+          inner_color = "rgb(91, 96, 120)";
+          outer_color = "rgb(24, 25, 38)";
+          outline_thickness = 5;
+          placeholder_text = "Enter password...";
+          shadow_passes = 2;
+        }
+      ];
+    };
+  };
+
+  home.packages = with pkgs; [
+    brightnessctl
+    helvum
+  ];
+
+  services.hypridle = {
+    enable = true;
+    settings = {
+      general = {
+        lock_cmd = "pidof hyprlock || hyprlock";
+        before_sleep_cmd = "loginctl lock-session";
+        after_sleep_cmd = "hyprctl dispatch dpms on";
+        ignore_dbus_inhibit = false;
+      };
+
+      listener = [
+        {
+          timeout = 600;
+          on-timeout = "loginctl lock-session";
+        }
+        {
+          timeout = 900;
+          on-timeout = "hyprctl dispatch dpms off";
+          on-resume = "hyprctl dispatch dpms on";
+        }
+      ];
+    };
   };
 
   services.hyprpolkitagent.enable = true;
@@ -23,10 +186,37 @@
     };
   };
 
-  wayland.windowManager.hyprland = {
+  services.mako = {
     enable = true;
-    package = null;
-    portalPackage = null;
+    settings = {
+      actions = true;
+      anchor = "top-right";
+      background-color = "#1e1e2e";
+      border-color = "#cba6f7";
+      border-radius = 0;
+      default-timeout = 0;
+      font = "monospace 10";
+      height = 100;
+      width = 300;
+      icons = true;
+      ignore-timeout = false;
+      layer = "top";
+      margin = 10;
+      markup = true;
+
+      # Section example
+      "actionable=true" = {
+        anchor = "top-right";
+      };
+    };
+  };
+
+  services.network-manager-applet.enable = true;
+
+  wayland.windowManager.hyprland = {
+    enable = false;
+    # package = null;
+    # portalPackage = null;
     systemd.enable = true;
   };
 }

home/plasma.nix

@@ -131,7 +131,7 @@
         "next activity" = ",none,Walk through activities";
         "previous activity" = ",none,Walk through activities (Reverse)";
       };
-      "services/com.mitchellh.ghostty.desktop"."_launch" = "Meta+X";
+      "services/kitty.desktop"."_launch" = "Meta+X";
     };
     workspace = {
       wallpaper = "/home/chase/nix-config/home/wallpaper.jpg";

home/waybar.css

@@ -0,0 +1,123 @@
+* {
+    font-family: "JetBrainsMono Nerd Font";
+    font-size: 12pt;
+    font-weight: bold;
+    border-radius: 8px;
+    transition-property: background-color;
+    transition-duration: 0.5s;
+}
+@keyframes blink_red {
+    to {
+        background-color: rgb(242, 143, 173);
+        color: rgb(26, 24, 38);
+    }
+}
+.warning, .critical, .urgent {
+    animation-name: blink_red;
+    animation-duration: 1s;
+    animation-timing-function: linear;
+    animation-iteration-count: infinite;
+    animation-direction: alternate;
+}
+window#waybar {
+    background-color: transparent;
+}
+window > box {
+    margin-left: 5px;
+    margin-right: 5px;
+    margin-top: 5px;
+    background-color: #1e1e2a;
+    padding: 3px;
+    padding-left:8px;
+    border: 2px none #33ccff;
+}
+#workspaces {
+    padding-left: 0px;
+    padding-right: 4px;
+}
+#workspaces button {
+    padding-top: 5px;
+    padding-bottom: 5px;
+    padding-left: 6px;
+    padding-right: 6px;
+}
+#workspaces button.active {
+    background-color: rgb(181, 232, 224);
+    color: rgb(26, 24, 38);
+}
+#workspaces button.urgent {
+    color: rgb(26, 24, 38);
+}
+#workspaces button:hover {
+    background-color: rgb(248, 189, 150);
+    color: rgb(26, 24, 38);
+}
+tooltip {
+    background: rgb(48, 45, 65);
+}
+tooltip label {
+    color: rgb(217, 224, 238);
+}
+#custom-launcher {
+    font-size: 20px;
+    padding-left: 8px;
+    padding-right: 6px;
+    color: #7ebae4;
+}
+#mode, #clock, #memory, #temperature,#cpu,#mpd, #custom-wall, #temperature, #backlight, #pulseaudio, #network, #battery, #custom-powermenu, #custom-cava-internal {
+    padding-left: 10px;
+    padding-right: 10px;
+}
+/* #mode { */
+/* 	margin-left: 10px; */
+/* 	background-color: rgb(248, 189, 150); */
+/*     color: rgb(26, 24, 38); */
+/* } */
+#memory {
+    color: rgb(181, 232, 224);
+}
+#cpu {
+    color: rgb(245, 194, 231);
+}
+#clock {
+    color: rgb(217, 224, 238);
+}
+/* #idle_inhibitor {
+color: rgb(221, 182, 242);
+}*/
+#custom-wall {
+    color: #33ccff;
+}
+#temperature {
+    color: rgb(150, 205, 251);
+}
+#backlight {
+    color: rgb(248, 189, 150);
+}
+#pulseaudio {
+    color: rgb(245, 224, 220);
+}
+#network {
+    color: #ABE9B3;
+}
+#network.disconnected {
+    color: rgb(255, 255, 255);
+}
+#custom-powermenu {
+    color: rgb(242, 143, 173);
+    padding-right: 8px;
+}
+#tray {
+    padding-right: 8px;
+    padding-left: 10px;
+}
+#mpd.paused {
+    color: #414868;
+    font-style: italic;
+}
+#mpd.stopped {
+    background: transparent;
+}
+#mpd {
+    color: #c0caf5;
+}

hosts/anzu/configuration.nix

@@ -1,11 +1,13 @@
 {
   config,
+  lib,
   pkgs,
   ...
 }: {
   imports = [
     ./hardware-configuration.nix
     ../../nixos/desktop.nix
+    ../../nixos/plasma.nix
     ../../nixos/hypr.nix
   ];
 
@@ -18,5 +20,30 @@
     ];
   };
 
+  services.xserver.videoDrivers = [ "amdgpu" ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  # Mount SMB share
+  fileSystems."/mnt/share" = {
+    device = "//haruko/share";
+    fsType = "cifs";
+    options = let
+      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,user,users";
+      credentials = "${config.sops.templates."smb-credentials".path}";
+    in ["${automount_opts},credentials=${credentials},uid=1000,gid=100"];
+  };
+
+  networking.wg-quick.interfaces = {
+    wg0 = {
+      configFile = "/home/chase/wg0.conf";
+    };
+  };
+
   system.stateVersion = "24.11";
 }

hosts/anzu/hardware-configuration.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }: {
@@ -21,7 +20,7 @@
   boot.initrd.luks.devices."luks-9527937d-2d02-4feb-9a16-c9c417b33d0d".device = "/dev/disk/by-uuid/9527937d-2d02-4feb-9a16-c9c417b33d0d";
 
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
+  boot.initrd.kernelModules = ["amdgpu"];
   boot.kernelModules = ["kvm-amd"];
   boot.extraModulePackages = [];
 
@@ -40,15 +39,6 @@
     {device = "/dev/disk/by-uuid/dd48a14e-2c90-465b-81a3-661d31ebf39f";}
   ];
 
-  # Mount SMB share
-  fileSystems."/mnt/share" = {
-    device = "//haruko/share";
-    fsType = "cifs";
-    options = let
-      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,user,users";
-    in ["${automount_opts},credentials=/etc/nixos/smb-secrets,uid=1000,gid=100"];
-  };
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction

hosts/ichigo/configuration.nix

@@ -6,6 +6,7 @@
   imports = [
     ./hardware-configuration.nix
     ../../nixos/desktop.nix
+    ../../nixos/plasma.nix
     ../../nixos/hypr.nix
   ];
 
@@ -18,5 +19,17 @@
     ];
   };
 
+  services.xserver.videoDrivers = [ "amdgpu" ];
+
+  # Mount SMB share
+  fileSystems."/mnt/share" = {
+    device = "//haruko/share";
+    fsType = "cifs";
+    options = let
+      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,user,users";
+      credentials = "${config.sops.templates."smb-credentials".path}";
+    in ["${automount_opts},credentials=${credentials},uid=1000,gid=100"];
+  };
+
   system.stateVersion = "24.11";
 }

hosts/ichigo/hardware-configuration.nix

@@ -1,10 +1,6 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }: {
@@ -15,8 +11,15 @@
   ### this machine ###
   networking.hostName = "ichigo";
 
+  ### hardware config ###
+
+  # encrypted root and swap
+  boot.initrd.luks.devices."luks-d90b3a3d-bb12-4a29-a2b4-99487f0ff1ca".device = "/dev/disk/by-uuid/d90b3a3d-bb12-4a29-a2b4-99487f0ff1ca";
+
+  boot.initrd.luks.devices."luks-877310a4-b495-4060-9ee6-e7a841862f22".device = "/dev/disk/by-uuid/877310a4-b495-4060-9ee6-e7a841862f22";
+
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
+  boot.initrd.kernelModules = ["amdgpu"];
   boot.kernelModules = ["kvm-amd"];
   boot.extraModulePackages = [];
 
@@ -25,10 +28,6 @@
     fsType = "ext4";
   };
 
-  boot.initrd.luks.devices."luks-d90b3a3d-bb12-4a29-a2b4-99487f0ff1ca".device = "/dev/disk/by-uuid/d90b3a3d-bb12-4a29-a2b4-99487f0ff1ca";
-
-  boot.initrd.luks.devices."luks-877310a4-b495-4060-9ee6-e7a841862f22".device = "/dev/disk/by-uuid/877310a4-b495-4060-9ee6-e7a841862f22";
-
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/AA5A-18AD";
     fsType = "vfat";
@@ -39,15 +38,6 @@
     {device = "/dev/disk/by-uuid/752114b2-c304-4670-aba8-7288954605bc";}
   ];
 
-  # Mount SMB share
-  fileSystems."/mnt/share" = {
-    device = "//haruko/share";
-    fsType = "cifs";
-    options = let
-      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,user,users";
-    in ["${automount_opts},credentials=/etc/nixos/smb-secrets,uid=1000,gid=100"];
-  };
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction

hosts/kuromi/configuration.nix

@@ -9,7 +9,7 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
-    ../../nixos/desktop.nix
+    ../../nixos/base.nix
   ];
 
   networking.hostName = "kuromi";

hosts/kuromi/home.nix

@@ -4,8 +4,7 @@
   ...
 }: {
   imports = [
-    ../../home/desktop.nix
-    ../../home/plasma.nix
+    ../../home/base.nix
   ];
 
   home.stateVersion = "25.05";

nixos/base.nix

@@ -6,30 +6,31 @@
   ...
 }: {
   # Bootloader.
-  boot.loader.systemd-boot = {
-    enable = true;
-    configurationLimit = 10;
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+    };
   };
-  boot.loader.efi.canTouchEfiVariables = true;
 
   # Garbage collection
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 1w";
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 1w";
+    };
+    nixPath = ["nixpkgs=${inputs.nixpkgs}"];
+    settings = {
+      auto-optimise-store = true;
+      download-buffer-size = 524288000;
+      experimental-features = ["nix-command" "flakes"];
+    };
   };
 
-  # Optimize store
-  nix.settings.auto-optimise-store = true;
-
-  # Allow power management
-  powerManagement.enable = true;
-
-  # Firmware updates
-  services.fwupd.enable = true;
-
-  # Enable networking
-  networking.networkmanager.enable = true;
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
 
   # Set your time zone.
   time.timeZone = "America/New_York";
@@ -46,42 +47,65 @@
     LC_NUMERIC = "en_US.UTF-8";
     LC_PAPER = "en_US.UTF-8";
     LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "C.UTF-8";
+    LC_TIME = "en_GB.UTF-8";
   };
 
+  # Configure keymap
+  console.keyMap = lib.mkDefault "jp106";
+
+  services.xserver.xkb = {
+    layout = lib.mkDefault "jp";
+    model = lib.mkDefault "jp106";
+  };
+
+  # Allow power management
+  powerManagement.enable = true;
+
+  # NetworkManager
+  networking.networkmanager.enable = true;
+
   # Catppuccin
   catppuccin = {
     enable = true;
     flavor = "mocha";
   };
 
-  # Configure keymap
-  console.keyMap = "jp106";
-
-  services.xserver.xkb = {
-    layout = lib.mkDefault "jp";
-    model = "jp106";
-  };
-
-  # Enable CUPS to print documents.
-  services.printing.enable = true;
-
-  # Enable Flakes
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
+  # Android debug tools
+  programs.adb.enable = true;
 
   # Bash config
   programs.bash = {
     blesh.enable = true;
   };
 
+  # zsh config
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    enableBashCompletion = true;
+    autosuggestions.enable = true;
+    syntaxHighlighting.enable = true;
+  };
+
   # Define a user account
   users.users.chase = {
     isNormalUser = true;
     description = "Chase";
-    extraGroups = ["networkmanager" "wheel"];
+    extraGroups = [
+      "adbusers"
+      "audio"
+      "cdrom"
+      "dialout"
+      "kvm"
+      "networkmanager"
+      "tss"
+      "video"
+      "wheel"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFSQX+s8Krl312DcnUtoEWOA2silcUnt5URtyVZz8Yek"
+    ];
+    shell = pkgs.zsh;
   };
 
   # Install git and enable cache
@@ -116,6 +140,33 @@
     vimAlias = true;
   };
 
+  # ssh agent
+  programs.gnupg.agent.enable = true;
+
+  programs.ssh = {
+    enableAskPassword = false;
+  };
+
+  sops = {
+    defaultSopsFile = ../secrets.yaml;
+    validateSopsFiles = false;
+    age = {
+      sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    secrets = {
+      "smb-username" = {};
+      "smb-password" = {};
+    };
+    templates = {
+      "smb-credentials".content = ''
+        username=${config.sops.placeholder.smb-username}
+        password=${config.sops.placeholder.smb-password}
+      '';
+    };
+  };
+
   # List packages installed in system profile.
   environment.systemPackages = with pkgs; [
     alejandra
@@ -124,26 +175,47 @@
     flashrom
     gcc
     nixd
+    pam_u2f
     pciutils
     python3
     qemu
     rustup
+    sbctl
+    sops
     usbutils
     wget
+    wireguard-tools
+    yubikey-manager
   ];
 
-  nix.nixPath = ["nixpkgs=${inputs.nixpkgs}"];
+  security.pam = lib.optionalAttrs pkgs.stdenv.isLinux {
+    sshAgentAuth.enable = true;
+    u2f = {
+      enable = true;
+      settings = {
+        cue = false;
+        authFile = "~/.config/Yubico/u2f_keys";
+      };
+    };
+    services = {
+      login.u2fAuth = true;
+      sudo = {
+        u2fAuth = true;
+      };
+    };
+  };
 
-  # ssh agent
-  # programs.mtr.enable = true;
-  programs.gnupg.agent.enable = true;
-
-  programs.ssh = {
-    enableAskPassword = false;
+  security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+    tctiEnvironment.enable = true;
   };
 
   services.fstrim.enable = lib.mkDefault true;
 
+  # Firmware updates
+  services.fwupd.enable = true;
+
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
@@ -153,4 +225,20 @@
       KbdInteractiveAuthentication = false;
     };
   };
+
+  services.pcscd.enable = true;
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  services.udev = {
+    packages = with pkgs; [
+      yubikey-personalization
+    ];
+    extraRules = ''
+      SUBSYSTEM=="usb", ATTRS{idVendor}=="04b8", ATTRS{idProduct}=="0202", MODE="0666", GROUP="dialout"
+    '';
+  };
+
+  services.yubikey-agent.enable = true;
 }

nixos/desktop.nix

@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   pkgs,
   inputs,
   ...
@@ -13,21 +14,16 @@
   # Enable Bluetooth
   hardware.bluetooth.enable = true;
 
-  # Enable the KDE Plasma Desktop Environment.
+  # Enable SDDM
   services.xserver.enable = true;
   services.displayManager.sddm = {
     enable = true;
+    package = lib.mkDefault pkgs.kdePackages.sddm;
     extraPackages = [pkgs.kdePackages.sddm-kcm];
     wayland.enable = true;
     enableHidpi = true;
   };
 
-  services.desktopManager.plasma6.enable = true;
-  environment.plasma6.excludePackages = with pkgs.kdePackages; [
-    elisa
-    kate
-  ];
-
   # Catppuccin
   catppuccin = {
     sddm = {
@@ -58,9 +54,14 @@
   # Fonts
   fonts = {
     packages = with pkgs; [
+      corefonts
+      font-awesome
+      hachimarupop
       ibm-plex
+      kanji-stroke-order-font
       liberation_ttf
       nerd-fonts.blex-mono
+      nerd-fonts.jetbrains-mono
       noto-fonts
       noto-fonts-cjk-sans
       noto-fonts-emoji
@@ -107,17 +108,11 @@
   # List packages installed in system profile.
   environment.systemPackages = with pkgs; [
     bitwarden-desktop
-    (catppuccin-kde.override {
-      flavour = ["mocha"];
-      accents = [
-        "blue"
-        "lavender"
-        "pink"
-        "sapphire"
-      ];
-      winDecStyles = ["classic"];
-    })
     firefoxpwa
+    kdePackages.dolphin
+    protonup-qt
+    qpwgraph
+    yubioath-flutter
   ];
 
   services.fprintd.enable = true;

nixos/hypr.nix

@@ -16,5 +16,24 @@
     enable = true;
     package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
     portalPackage = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
+    withUWSM = true;
+    xwayland.enable = true;
   };
+
+  programs.hyprlock.enable = true;
+
+  programs.uwsm = {
+    enable = true;
+    waylandCompositors = {
+      hyprland = {
+        prettyName = "Hyprland";
+        comment = "Hyprland compositor managed by UWSM";
+        binPath = "/run/current-system/sw/bin/Hyprland";
+      };
+    };
+  };
+
+  security.pam.services.hyprlock = {};
+
+  services.hypridle.enable = true;
 }

nixos/plasma.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  ...
+}: {
+  services.desktopManager.plasma6.enable = true;
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [
+    elisa
+    kate
+  ];
+
+  # List packages installed in system profile.
+  environment.systemPackages = with pkgs; [
+    (catppuccin-kde.override {
+      flavour = ["mocha"];
+      accents = [
+        "blue"
+        "lavender"
+        "pink"
+        "sapphire"
+      ];
+      winDecStyles = ["classic"];
+    })
+  ];
+}

secrets.yaml

@@ -0,0 +1,44 @@
+smb-username: ENC[AES256_GCM,data:pFkBi+c=,iv:JSRlBHBGMNZVZZuQaSHj/cpXOaxRV3xkG/OaTOjFDZc=,tag:ALMWCi+gAqt2HtSKGGaS5Q==,type:str]
+smb-password: ENC[AES256_GCM,data:LgxYSOZhj5DwvTwAoF0cLJezxYQ=,iv:is3PWEgvWmbFc39npdjD9qYrMo76wWAczZlo7LCoNf0=,tag:vanjCeI01KaL5STCSwxM/g==,type:str]
+sops:
+    age:
+        - recipient: age19uwxm2gynhjl9m90gckrkh76m9hjut44ak6d8969y4swhz8ypyeqvfcaas
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvT1pKc1VrVllURWozOXd1
+            NURBT1haRlBkeHB3eTVabmhWMEI0a1JySDFjCkU3Ry9QaEpRTllaZlRZUllJOUtF
+            U0ZtOFJRbmEwYnFwK1JRNkJQQXlVVnMKLS0tIGRBZTloenV2YkhGMllUSEx5UGlk
+            emcvaGhuRStCRFBPY29UdmhPeUhqWDQKkabWErK0qtwVnWza7UfhmX9yfIZJC1XV
+            MOsdxHryfilLFHhzOI2UGM2dzKlukNvHwAuJmoRkwjIj8Ugj1sU3nA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wdjujpvc2zd0g592a9gqa7qzz4pcans8m0tyq3m6eq9np9a3lg2s8kxf3h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbDBPVUFTcERIaEh4ZHp3
+            aW1GQXlVQThyeDdVYzNYNHlqcFRIYVNpa2xNCmpMeml4REpsRDl1SU1pSm92SU1V
+            OXNhUklhTGxRMTRTV3dlbENsTVlXTVEKLS0tICtzU3ZteFNCOEo3NmVwNE1ydHVM
+            dFpJMXowc3h1MHdBYVZLc0Y5bXZoTUkKFs67JKeHhZiK2tAu7Poh4Fou5QYm8HXK
+            r09HeCuiIfxjRuT1t8nRvRALdzOG6xNuPULs6aCdjpa/d0EvnXyw+w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hpcyetyl0yrwxy0geem6z2u2kwl4hmckur7pnaaxwaylf8ata9vsv8j3wh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmb3oyWFBvdXIxRkNtL0xs
+            aGNzQ0RERXB3TGFUOVBTQm5wOUlodkZiMXlvClFXR1Z0ZHpFa2RyUlYzL01Bb2RN
+            UGZNREVqRU9ZRVhMQ3VMYUNKcUI4WTgKLS0tIDB5RmkzSTdwSTVUQjJMbklxeFM5
+            M0s3QmI4MzNiVy8yNGE2TG01Z1paOWcKIGj+ofrO443CiK1n3J291KwnKqmG99+M
+            1mYfFrvpx/yVTzt2Pk5ioTC+hzDWUHy1gR8vQTVTjGkhU8cBCzNR/w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1culqt965xgweu5h6menrppf7eatq7at04z0n52t365f0nvlv043su5t2yl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOVQ2ZzhZT0pqZjIzQXp1
+            dzBuVEcyYS9MSW8vdnFPT2p4NzJBZ3g2K0c4CmpqSC9XRFBsdUJsM1phckQ4aW5D
+            RFZmTFJMSkR5VE9idzJMZGZzajFBWFEKLS0tIElnTXg5aUNQVE5qOGlxd00zY0NX
+            ZGRES0oyeGZSRHBQU0RQNzNZd1VBZTAKhRXixVaTXhZrTmntLGaC9WIm/Ylm3tp7
+            xQxZA8n5PRtqENa5Cj3jqJQS2gmwy5kixO9U6IHzMWntBE7zr/hKrQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-08T19:43:47Z"
+    mac: ENC[AES256_GCM,data:9YpgBrJwWhz2utNPldpIU/ylaN2QfkSj1LvWa8sISSnuXvsBsZ8a+oNzuGDd5+Q1pSYtoiBt6viqZn65wp8x+kb9ZMJdsWoZZG2U1b3rHUsadOYarvwMVDoQ5TZFFjEOyzyCgT7ln6v1rfAKwL5LJ3Kjv6SRIb9dK51sDsVijhQ=,iv:yTlxgZoOdB7pu5iZKP+q1cXbDsTT5HgsWo4tkix8948=,tag:qJbiq+Fayx5L9V7to1ijvQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2