Revert "retire toaster"

This reverts commit 1baa256be04a8b4e711a7d48a76197b5ffad6637.

28 files changed, 1668 insertions, 17 deletions

diff --git a/flake.lock b/flake.lock
index 660bfbb..1484432 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,6 +44,21 @@
         "type": "github"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -60,6 +75,22 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
@@ -78,6 +109,27 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": [
@@ -135,6 +187,24 @@
         "type": "github"
       }
     },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "flakey-profile": {
       "locked": {
         "lastModified": 1712898590,
@@ -150,6 +220,69 @@
         "type": "github"
       }
     },
+    "flakey-profile_2": {
+      "locked": {
+        "lastModified": 1712898590,
+        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "lix": {
       "flake": false,
       "locked": {
@@ -164,6 +297,20 @@
         "url": "https://git.lix.systems/lix-project/lix/archive/release-2.93.tar.gz"
       }
     },
+    "lix-main": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755264387,
+        "narHash": "sha256-8mMQ1E/769Zpdh/otiVXAtVX1IYss4QKP31x8EzfYGU=",
+        "rev": "c3bfb6fe17a9f768afc3d9c3fc24929d44570e72",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/c3bfb6fe17a9f768afc3d9c3fc24929d44570e72.tar.gz?rev=c3bfb6fe17a9f768afc3d9c3fc24929d44570e72"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/lix/archive/main.tar.gz"
+      }
+    },
     "lix-module": {
       "inputs": {
         "flake-utils": "flake-utils_3",
@@ -185,6 +332,29 @@
         "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.1.tar.gz"
       }
     },
+    "lix-module-main": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "flakey-profile": "flakey-profile_2",
+        "lix": [
+          "lix-main"
+        ],
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751909859,
+        "narHash": "sha256-gbpuESxl/An4GTh7QEbQRYJozVIxWkwVGbWK0/0GoRc=",
+        "rev": "4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f.tar.gz?rev=4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/main.tar.gz"
+      }
+    },
     "microvm": {
       "inputs": {
         "flake-utils": [
@@ -196,11 +366,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1753388547,
-        "narHash": "sha256-zbjlS9sa2BbtE80YA9C9DMXwCADba3NjUROw/7Rpt7Y=",
+        "lastModified": 1755102374,
+        "narHash": "sha256-v6xhTSgnGQoF1a51BB6OQWN8HXiYbZtVL+54TRuk9zk=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "9694139d7c761e857ac9d025f9110a92cd8f7686",
+        "rev": "0a5cda80e48191959cf5a9c0552532599ef2cee4",
         "type": "github"
       },
       "original": {
@@ -235,6 +405,22 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1754564048,
+        "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1750776420,
@@ -266,13 +452,29 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1754725699,
-        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
         "type": "github"
       },
       "original": {
@@ -284,11 +486,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1754689972,
-        "narHash": "sha256-eogqv6FqZXHgqrbZzHnq43GalnRbLTkbBbFtEfm1RSc=",
+        "lastModified": 1755078291,
+        "narHash": "sha256-Hu/gTDoi4uy6TAKISPHQusSMy8U6xUbLSDjKBYdhDIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fc756aa6f5d3e2e5666efcf865d190701fef150a",
+        "rev": "3385ca0cd7e14c1a1eb80401fe011705ff012323",
         "type": "github"
       },
       "original": {
@@ -298,6 +500,33 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -352,8 +581,12 @@
       "inputs": {
         "authentik-nix": "authentik-nix",
         "flake-utils": "flake-utils_2",
+        "lanzaboote": "lanzaboote",
+        "lix-main": "lix-main",
         "lix-module": "lix-module",
+        "lix-module-main": "lix-module-main",
         "microvm": "microvm",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix",
@@ -361,6 +594,27 @@
         "website": "website"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
@@ -368,11 +622,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754328224,
-        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
+        "lastModified": 1754988908,
+        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
+        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
         "type": "github"
       },
       "original": {
@@ -384,11 +638,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1751265943,
-        "narHash": "sha256-XoHSo6GEElzRUOYAEg/jlh5c8TDsyDESFIux3nU/NMc=",
+        "lastModified": 1754675037,
+        "narHash": "sha256-afS08F7lfMUBR4qrBxinN1kuxu+DoHQ5TPNVp9VS/OA=",
         "ref": "refs/heads/main",
-        "rev": "37c8663fab86fdb202fece339ef7ac7177ffc201",
-        "revCount": 904,
+        "rev": "586577f3015397afacd83bc185454f4cc3c8028f",
+        "revCount": 955,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },
@@ -442,6 +696,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tmux-yank": {
       "flake": false,
       "locked": {
diff --git a/flake.nix b/flake.nix
index 959240a..e10259a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,6 +8,17 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    lix-main = {
+      url = "https://git.lix.systems/lix-project/lix/archive/main.tar.gz";
+      flake = false;
+    };
+
+    lix-module-main = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/main.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.lix.follows = "lix-main";
+    };
+
     flake-utils.url = "github:numtide/flake-utils";
 
     sops-nix = {
@@ -15,6 +26,8 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nixos-hardware.url = "github:NixOS/nixos-hardware?ref=master";
+
     microvm = {
       url = "github:astro/microvm.nix";
       inputs = {
@@ -23,6 +36,11 @@
       };
     };
 
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote?ref=v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
     };
@@ -41,8 +59,11 @@
 
   outputs =
     inputs@{
+      lanzaboote,
       lix-module,
+      lix-module-main,
       microvm,
+      nixos-hardware,
       nixpkgs,
       nixpkgs-unstable,
       sops-nix,
@@ -90,6 +111,31 @@
         in
         microvms
         // {
+          toaster = nixpkgs-unstable.lib.nixosSystem {
+            system = "x86_64-linux";
+            specialArgs = { inherit inputs; };
+            modules = [
+              sops-nix.nixosModules.sops
+              lanzaboote.nixosModules.lanzaboote
+              nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3
+              lix-module-main.nixosModules.default
+
+              ./hosts/toaster
+
+              ./modules/basic-tools
+              ./modules/binary-caches.nix
+              ./modules/devtools.nix
+              ./modules/emacs.nix
+              ./modules/gnome.nix
+              ./modules/gnupg.nix
+              ./modules/mail
+              ./modules/radio.nix
+              ./modules/science.nix
+              ./modules/tlp.nix
+              ./modules/virtualization.nix
+              ./modules/wg
+            ];
+          };
           cloud = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
             specialArgs = { inherit inputs; };
diff --git a/hosts/toaster/0xa-home.nix b/hosts/toaster/0xa-home.nix
new file mode 100644
index 0000000..b3ff5eb
--- /dev/null
+++ b/hosts/toaster/0xa-home.nix
@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+  home.stateVersion = "24.11";
+
+  home.pointerCursor = {
+    name = "Banana";
+    size = 32;
+    package = pkgs.banana-cursor;
+    x11.enable = true;
+    gtk.enable = true;
+  };
+
+  gtk = {
+    enable = true;
+    cursorTheme = {
+      name = "Banana";
+      size = 32;
+      package = pkgs.banana-cursor;
+    };
+  };
+}
diff --git a/hosts/toaster/amd.nix b/hosts/toaster/amd.nix
new file mode 100644
index 0000000..b58784f
--- /dev/null
+++ b/hosts/toaster/amd.nix
@@ -0,0 +1,22 @@
+{ ... }:
+{
+  boot.initrd.kernelModules = [ "amdgpu" ];
+
+  boot.kernelParams = [
+    # use new amd pstate driver
+    "amd_pstate=active"
+    # fix flicker
+    "amdgpu.dcdebugmask=0x10"
+  ];
+
+  #  hardware.graphics = {
+  #    extraPackages = with pkgs; [
+  #      rocm-opencl-icd
+  #      rocm-opencl-runtime
+  #      amdvlk
+  #    ];
+  #    extraPackages32 = with pkgs; [
+  #      driversi686Linux.amdvlk
+  #    ];
+  #  };
+}
diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix
new file mode 100644
index 0000000..2b8577b
--- /dev/null
+++ b/hosts/toaster/default.nix
@@ -0,0 +1,80 @@
+{ pkgs, config, ... }:
+{
+  imports = [
+    ./amd.nix
+    ./hardware-configuration.nix
+    ./irc.nix
+    ./network
+    ./secure-boot.nix
+    ./zfs.nix
+  ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/zw" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/dvb" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/mullvad" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/0xa-mgmt" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  hardware.enableAllFirmware = true;
+
+  # update the firmware
+  services.fwupd.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Amsterdam";
+
+  # Select internationalisation properties.
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    supportedLocales = [ "all" ];
+  };
+
+  # support ddc brigtness control
+  hardware.i2c.enable = true;
+  boot.kernelModules = [ "i2c-dev" ];
+  environment.systemPackages = [ pkgs.ddcutil ];
+
+  users.users."0xa" = {
+    extraGroups = [
+      "wheel"
+      "video"
+      "plugdev"
+      "dialout"
+      "bluetooth"
+      "libvirtd"
+      "qemu-libvirtd"
+      "i2c"
+    ];
+    group = "users";
+    home = "/home/0xa";
+    isNormalUser = true;
+    uid = 1000;
+    shell = pkgs.zsh;
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}
diff --git a/hosts/toaster/hardware-configuration.nix b/hosts/toaster/hardware-configuration.nix
new file mode 100644
index 0000000..318ff03
--- /dev/null
+++ b/hosts/toaster/hardware-configuration.nix
@@ -0,0 +1,85 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+  boot.zfs.extraPools = [ "zpool" ];
+
+  fileSystems."/" = {
+    device = "zpool/root";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/nix" = {
+    device = "zpool/nix";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/home" = {
+    device = "zpool/data/home";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/var" = {
+    device = "zpool/data/var";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/tmp" = {
+    device = "zpool/nocomp/tmp";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/A170-F83D";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  swapDevices = [
+    {
+      device = "/dev/disk/by-partuuid/037518f2-9fa0-44f0-9550-745e27bf1c1f";
+      randomEncryption = true;
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp5s0f4u1u1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/toaster/irc.nix b/hosts/toaster/irc.nix
new file mode 100644
index 0000000..ecdac88
--- /dev/null
+++ b/hosts/toaster/irc.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.senpai ];
+
+  sops.secrets = {
+    "senpai" = {
+      owner = config.users.users."0xa".name;
+    };
+  };
+}
diff --git a/hosts/toaster/network/default.nix b/hosts/toaster/network/default.nix
new file mode 100644
index 0000000..6504dbb
--- /dev/null
+++ b/hosts/toaster/network/default.nix
@@ -0,0 +1,45 @@
+{ lib, config, ... }:
+{
+  imports = [
+    ./mullvad.nix
+    ./dumpdvb.nix
+    ./zw.nix
+  ];
+
+  # Networkmanager shouldn't interfere with systemd managed interfaces
+  networking.networkmanager = {
+    enable = true;
+    unmanaged =
+      let
+        systemd_netdevs = lib.attrsets.attrValues (
+          lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs
+        );
+      in
+      systemd_netdevs;
+  };
+
+  systemd.network = {
+    enable = true;
+    wait-online.enable = false; # uplink is managed by networkmanager
+  };
+
+  users.users."0xa".extraGroups = [ "networkmanager" ];
+
+  networking = {
+    hostName = "toaster";
+    firewall.enable = true;
+    wireguard.enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+      "149.112.112.112"
+      "2620:fe::9"
+    ];
+  };
+
+}
diff --git a/hosts/toaster/network/dumpdvb.nix b/hosts/toaster/network/dumpdvb.nix
new file mode 100644
index 0000000..d3fba93
--- /dev/null
+++ b/hosts/toaster/network/dumpdvb.nix
@@ -0,0 +1,38 @@
+{ config, ... }:
+{
+  systemd.network = {
+    # Wireguard
+    # Dump-dvb
+    netdevs."30-wg-dumpdvb" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg-dumpdvb";
+        Description = "dvb.solutions enterprise network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/dvb".path;
+      };
+      wireguardPeers = [
+        {
+          PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY=";
+          Endpoint = "academicstrokes.com:51820";
+          AllowedIPs = [ "10.13.37.0/24" ];
+          PersistentKeepalive = 25;
+        }
+      ];
+    };
+    networks."30-wg-dumpdvb" = {
+      matchConfig.Name = "wg-dumpdvb";
+      networkConfig = {
+        Address = "10.13.37.3/24";
+        IPv6AcceptRA = true;
+      };
+      routes = [
+        {
+          Gateway = "10.13.37.1";
+          Destination = "10.13.37.0/24";
+        }
+      ];
+    };
+  };
+}
diff --git a/hosts/toaster/network/full-networkd.nix b/hosts/toaster/network/full-networkd.nix
new file mode 100644
index 0000000..ee0bdbe
--- /dev/null
+++ b/hosts/toaster/network/full-networkd.nix
@@ -0,0 +1,71 @@
+{ lib, pkgs, ... }:
+{
+  imports = [
+    ./mullvad.nix
+    ./dumpdvb.nix
+    ./zw.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    iwgtk
+    impala
+  ];
+
+  # kick out networkmanager
+  networking.networkmanager.enable = lib.mkForce false;
+  networking.useNetworkd = true;
+  systemd.network.enable = true;
+
+  networking = {
+    hostName = "toaster";
+    firewall.enable = true;
+    wireguard.enable = true;
+    wireless.iwd.enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+      "149.112.112.112"
+      "2620:fe::9"
+    ];
+  };
+
+  # we might have no interwebs at all
+  systemd.network.wait-online.enable = false;
+
+  # uplinks
+  systemd.network.networks = {
+    "10-ether-uplink" = {
+      matchConfig.Name = "enp1s0f0";
+      networkConfig = {
+        DHCP = "yes";
+        IPv6AcceptRA = true;
+      };
+    };
+    "10-dock-uplink" = {
+      matchConfig.Name = "enp5s0f4u1u1";
+      networkConfig = {
+        DHCP = "yes";
+        IPv6AcceptRA = true;
+      };
+      dhcpV4Config = {
+        RouteMetric = 666;
+      };
+      dhcpV6Config = {
+        RouteMetric = 666;
+      };
+    };
+    "wlan-uplink" = {
+      matchConfig.Name = "wlan0";
+      networkConfig = {
+        DHCP = "yes";
+        IPv6AcceptRA = true;
+      };
+    };
+  };
+
+}
diff --git a/hosts/toaster/network/mullvad.nix b/hosts/toaster/network/mullvad.nix
new file mode 100644
index 0000000..54fec8d
--- /dev/null
+++ b/hosts/toaster/network/mullvad.nix
@@ -0,0 +1,98 @@
+{
+  config,
+  ...
+}:
+{
+  systemd.network =
+    let
+      pubkey = "xpZ3ZDEukbqKQvdHwaqKMUhsYhcYD3uLPUh1ACsVr1s=";
+      endpoint = "185.65.134.86";
+      port = "51820";
+      addr = [
+        "10.74.16.48/32"
+        "fc00:bbbb:bbbb:bb01::b:102f/128"
+      ];
+    in
+    {
+      netdevs."10-wg-mullvad" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg-mullvad";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = config.sops.secrets."wg/mullvad".path;
+          FirewallMark = 34952; # 0x8888
+          RouteTable = "off";
+        };
+        wireguardPeers = [
+          {
+            PublicKey = pubkey;
+            Endpoint = "${endpoint}:${port}";
+            AllowedIPs = [
+              "0.0.0.0/0"
+              "::0/0"
+            ];
+          }
+        ];
+      };
+      networks."10-wg-mullvad" = {
+        matchConfig.Name = "wg-mullvad";
+        address = addr;
+        networkConfig = {
+          DNS = "10.64.0.1";
+          DNSDefaultRoute = true;
+          Domains = [ "~." ];
+        };
+        routes =
+          map
+            (gate: {
+              Gateway = gate;
+              Table = 1000;
+            })
+            [
+              "0.0.0.0"
+              "::"
+            ];
+
+        routingPolicyRules =
+          [
+            {
+              Family = "both";
+              FirewallMark = 34952; # 0x8888
+              InvertRule = true;
+              Table = "1000";
+              Priority = 100;
+            }
+            {
+              Family = "both";
+              SuppressPrefixLength = 0;
+              Table = "main";
+              Priority = 90;
+            }
+          ]
+          ++ map
+            (net: {
+              # only route global addresses over VPN
+              Priority = 80;
+              To = net;
+            })
+            [
+              # Mullvad endpoint
+              "${endpoint}/32"
+              # zw endpoint
+              "81.201.149.152/32"
+              # oxalab/oxa endpoint
+              "188.245.196.27/32"
+              # "10.0.0.0/8"
+              "10.13.37.0/24"
+              # 0xa-mgmt
+              "10.89.87.0/24"
+              # "172.16.0.0/12"
+              "172.16.0.0/12"
+              # "182.168.0.0/16"
+              "182.168.0.0/16"
+              # "fc00::/7"
+            ];
+      };
+    };
+}
diff --git a/hosts/toaster/network/zw.nix b/hosts/toaster/network/zw.nix
new file mode 100644
index 0000000..71e75be
--- /dev/null
+++ b/hosts/toaster/network/zw.nix
@@ -0,0 +1,61 @@
+{ config, ... }:
+{
+  # zentralwerk
+  systemd.network = {
+    netdevs."10-wg-zentralwerk" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg-zentralwerk";
+        Description = "Tunnel to the best basement in Dresden";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/zw".path;
+        RouteTable = "off";
+      };
+      wireguardPeers = [
+        {
+          PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
+          Endpoint = "81.201.149.152:1337";
+          AllowedIPs = [
+            "172.20.72.0/21"
+            "172.22.90.0/24"
+            "172.22.99.0/24"
+          ];
+          PersistentKeepalive = 25;
+        }
+      ];
+    };
+    networks."10-wg-zentralwerk" = {
+      matchConfig.Name = "wg-zentralwerk";
+      networkConfig = {
+        Address = "172.20.76.226/21";
+        IPv6AcceptRA = true;
+        DNS = "172.20.73.8";
+        Domains = [
+          "~hq.c3d2.de"
+          "~serv.zentralwerk.org"
+          "~hq.zentralwerk.org"
+          "~cluster.zentralwerk.org"
+        ];
+      };
+      routes = [
+        {
+          Gateway = "172.20.76.225";
+          Destination = "172.20.72.0/21";
+          Metric = 1023;
+        }
+        {
+          Gateway = "172.20.76.225";
+          Destination = "172.20.90.0/24";
+          Metric = 1023;
+        }
+        {
+          Gateway = "172.20.76.225";
+          Destination = "172.22.99.0/24";
+          Metric = 1023;
+        }
+
+      ];
+    };
+  };
+}
diff --git a/hosts/toaster/secrets.yaml b/hosts/toaster/secrets.yaml
new file mode 100644
index 0000000..701733d
--- /dev/null
+++ b/hosts/toaster/secrets.yaml
@@ -0,0 +1,51 @@
+wg:
+    mullvad: ENC[AES256_GCM,data:P9acMXooRll8i81RIBVb0OxFdzx2WsGgVKqX+BoV7cvPGWJK5FRIF8KAcqg=,iv:kq+3guPx2+reDqmfHuhWEvUsKNynG+t7LYRNp5kFLoQ=,tag:Aj0P7IrrTdRK59aBMjPx5Q==,type:str]
+    zw: ENC[AES256_GCM,data:CXrLvV+b9DUfmr+CwH8dBTHvDHtgVmiF9g+QpzFqMcc91yQDzQqT1d4AQSk=,iv:Wdj11qlGWGm2XSieFZ4csqdIyR0epzPCkeWyUUmjJbk=,tag:UO07WUwr138B5TtMGujvew==,type:str]
+    0xa-mgmt: ENC[AES256_GCM,data:THKgWJs4bxNYwnl1FQzXSC0xIuv1r0jSByQgwoKau34sddgTzztRHbSztGs=,iv:wn08l8hlSORlyD8XpF6pk6F3HTsT345xp8XxkJVUKcY=,tag:oP+5+cunkQ5KVf6PB5Rirw==,type:str]
+    dvb: ENC[AES256_GCM,data:1+IM6ORPtlIroeekaJSkOwYArh0fN6ycJNaXo680pE2Xv4DUBrIlh8q3V2A=,iv:btf3IpM4Wntkf3RYPwUdhH+4WUUqZp0zYp0aj2sdGM0=,tag:MDvS4CWYQLdp2YGs3/5Htw==,type:str]
+mail:
+    oxapentane.com: ENC[AES256_GCM,data:HW1xcclr5CiUFVF8As79ZZH1c14sl4T0l18=,iv:leAVYaQkMuJewkCZc3fTUUNzZ9BDjV5CuT84bzvhrrs=,tag:Mm8OB8gLbmUwKSLugTR6GA==,type:str]
+    shipunov.xyz: ENC[AES256_GCM,data:cg+P+FrZ2icjfhwDGKGyUH9DejSZHpNs2bcSBPyz8g==,iv:XZFaSXnGmTL9j2sEyt5Q7+pe6rr+WA/0UGq/2Gl5DTI=,tag:oq+5EuJWJKwK3h0/e6Uozw==,type:str]
+    dvb.solutions: ENC[AES256_GCM,data:GSjPIPA5TGMWfhdRzTsiHPfXFVGLVSpJvJG+I++i,iv:EBlk00wqADCuYTzuVcuX9kSn6TVBfN12UlcXyps6TtE=,tag:G7rKTngN4v2FtuhQEMdUQQ==,type:str]
+    tlm.solutions: ENC[AES256_GCM,data:ncTMh/jw+YmcmcVU/c1I36vV1CwtmtYwfyDUx9w9,iv:vPnmdvDnEJ9FF4rDkSfPnLWebleSgI/yG7qOgJfq5ic=,tag:z4w4LOGf2v0TBSxrHULBsw==,type:str]
+senpai: ENC[AES256_GCM,data:nLMlw+Gw5p9pcyElvHy/d+GV0/dbTj3+Et+lzBs1YEUcsYT2lM7sN+5+4PEF6weJgHUreTl007fh8+FO8S+mUg==,iv:+5szUWaARn93RTQvY13JGn2zJ3y8iyjv09i3KtbhaTQ=,tag:OsD4IoRv8wGuUbEnsld7Dg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1avaphjah4k8n80jrnraeqh9r94fu6awd6k37z4zfjssl5ft07qkqmuehcm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibGw3UTUzNHg2dDJGYmYx
+            Vis5WlhqeXUybmtxTU9XWEFLcjc1VEErOTN3CmZYa2kzcUdNQURVTG5NeUpSb0I0
+            STdQb1NqSWJoK1pmYXA5UXM5NDRFWVUKLS0tIDNWTmVTcDdneUEwemtWZVNZVFdz
+            bDRBWjJJSDl3bDkxenR1S2NMZW91dW8Kzhc/6HeEJfLGDaKdRSbpaMdR7XaBxdQI
+            jnAySJCGsXxCPebRtCIdDnoLjdqdzEggEhRh27JOpeOiEukLmakPMA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-05T19:41:58Z"
+    mac: ENC[AES256_GCM,data:5u2hJYMHwpFd5fcHXKzOblHfgnRTjNIEL+glBsHct3xZ+G1APQg9WdgZbRWc+ypdYPFfhqXKV9RBl/UHtFEyljL7JQV0U8EfumP1WNjPaMgnWftm5qLOe0PxmrPbwsYYBdotO9GVoplghrNd1euvMsxd3F+YtU+MnY+u4dcr4C8=,iv:A61rDNajtU/NOqcemmCN348STdMI9qqPRvdd6n/EuKg=,tag:Y1zi86LNX1xlXpjbslmRAA==,type:str]
+    pgp:
+        - created_at: "2025-01-02T22:57:16Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ//fH+XzwM0ARlUGFK0/WDVXb4fR8364JdtrWp1njqYQBme
+            rRtIuyYWg7b4c1K9frX+3Ftei6EhZTejgyoSulQkOD5X7L726iik8kaJxtkH0Ubl
+            Hmak4viT9r4cCBYBBCsDQgojAImgNvaW+DyX4UFOyr0asnUEVj4N1/eejxPteXfj
+            c4+PzKKkliRpwUj4OZufmxcZvFi3XBy1AIgji9EpZkG6mGeeRpchJdA7kFWlO0fl
+            wUuDjudqSMr2hOySfOI/AW+4QgWo1t6uZwIi4VWMmI2h3hlAbsWfYiLMXqIB8RpF
+            lx30HdcFmZwfmVyT5n+oFlV4kPWPNvc0lLDvoZdKpsXIeuhMWKdrRZ2XmDE6F+rQ
+            PE4tT46vR4uCHNSAiLYhAY+yr2ic5w+Damv80mxsnGBrFhh93/5grJRSQ+iZcr1D
+            hu4nMAiw7xdkjgVHJrZZ0YEh9cXD74oUfvE7T201h2ppFEAzYaDrwuIuFqJmFew/
+            /meRImzoCpp2H2cAsol90kxVdNc+yQerNqknkNBU6TCWB5HkcEa1xM5PER2s8cHd
+            KK5ej1DzNgQHN41N3zv1xyd2HXOOgVXYwITkHU0BNFBowpf2JScUcVMWYtuZ2Mlh
+            izVM0pJwx7bJgZqVnpZsxyzSOD3I6ufS61VMp5RVOS/58qih2BNsTys3DtmaFcvS
+            XgFD1Mr9Ul4xIyF2akUeGU5n+fRZnIwtM7JmcJGjlg1nQPvRFZSLrYBs83TPrftS
+            zQv+xyb6mPo91iHqe/ey3JbB/+/uSkVSZsBL05thYNLucQJ0L3r0qhc6gnQxNNo=
+            =DYwa
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix
new file mode 100644
index 0000000..9d934e1
--- /dev/null
+++ b/hosts/toaster/secure-boot.nix
@@ -0,0 +1,13 @@
+{ pkgs, lib, ... }:
+{
+  boot = {
+    bootspec.enable = true;
+    loader.systemd-boot.enable = lib.mkForce false;
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+
+  environment.systemPackages = [ pkgs.sbctl ];
+}
diff --git a/hosts/toaster/zfs.nix b/hosts/toaster/zfs.nix
new file mode 100644
index 0000000..1970bbf
--- /dev/null
+++ b/hosts/toaster/zfs.nix
@@ -0,0 +1,25 @@
+{
+  pkgs,
+  ...
+}:
+{
+  services.fstrim.enable = true;
+  services.zfs = {
+    autoSnapshot.enable = true;
+    trim.enable = true;
+    autoScrub = {
+      enable = true;
+      pools = [ "zpool" ];
+    };
+  };
+  networking.hostId = "dca22577";
+  boot = {
+    kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+    zfs.package = pkgs.zfs_2_3;
+    supportedFilesystems = [ "zfs" ];
+    kernelParams = [ "nohibernate" ];
+    plymouth.enable = false;
+    tmp.useTmpfs = false;
+    tmp.cleanOnBoot = true;
+  };
+}
diff --git a/modules/chromium.nix b/modules/chromium.nix
new file mode 100644
index 0000000..4cdf16a
--- /dev/null
+++ b/modules/chromium.nix
@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    (chromium.override { enableWideVine = true; })
+  ];
+
+  nixpkgs.config.chromium.commandLineArgs = "--enable-features=UseOzonePlatform --ozone-platform=wayland --ignore-gpu-blocklist --enable-gpu-rasterization --enable-zero-copy --enable-features=VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization,WebUIDarkMode";
+
+  programs.chromium = {
+    enable = true;
+    extensions = [
+      "ekhagklcjbdpajgpjgmbionohlpdbjgc" # zotero connector
+      "nngceckbapebfimnlniiiahkandclblb" # bitwarden
+      "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite
+      "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsorblock
+      "khncfooichmfjbepaaaebmommgaepoid" # unhook
+    ];
+    extraOpts = {
+      "BrowserSignin" = 0;
+      "SyncDisabled" = true;
+      "PasswordManagerEnabled" = false;
+      "TranslateEnabled" = false;
+      "AutofillAddressEnabled" = false;
+      "AutofillCreditCardEnabled" = false;
+      "AutoplayAllowed" = false;
+      "DefaultNotificationSetting" = 2;
+      "BackgroundModeEnabled" = false;
+      # "DefaultSearchProviderEnabled" = true;
+      # "DefaultSearchProviderSearchURL" = "https://google.com/search?q={searchTerms}";
+      # "DefaultSearchProviderSearchURL" = "https://duckduckgo.com/?q={searchTerms}";
+      "SearchSuggestEnable" = false;
+      "BlockThirdPartyCookies" = true;
+      "PrivacySandboxAdMeasurementEnabled" = false;
+      "PrivacySandboxAdTopicsEnabled" = false;
+      "PrivacySandboxPromptEnabled" = false;
+      "PrivacySandboxSiteEnabledAdsEnabled" = false;
+    };
+  };
+}
diff --git a/modules/desktop-software.nix b/modules/desktop-software.nix
new file mode 100644
index 0000000..af73ea5
--- /dev/null
+++ b/modules/desktop-software.nix
@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./chromium.nix
+  ];
+  environment.systemPackages = with pkgs; [
+    audacity
+    blender
+    dino
+    discord
+    element-desktop
+    ffmpeg-full
+    ghostty
+    gimp
+    inkscape
+    lapce
+    libreoffice
+    mpv
+    obs-studio
+    qbittorrent
+    signal-desktop
+    spotify
+    telegram-desktop
+    tor-browser
+    transmission_4-gtk
+    wl-clipboard
+    yt-dlp
+  ];
+  programs.steam.enable = true;
+  programs.firefox.enable = true;
+}
diff --git a/modules/emacs.nix b/modules/emacs.nix
new file mode 100644
index 0000000..39c2db8
--- /dev/null
+++ b/modules/emacs.nix
@@ -0,0 +1,60 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  environment.systemPackages =
+    let
+      # https://wiki.nixos.org/wiki/TexLive
+      # minimal set of latex packages for orgmode
+      # emacs config:
+      # (setq org-latex-complier "lualatex")
+      # (setq org-preview-latex-default-process 'dvisvgm)
+      orgmode-tex = (
+        pkgs.texlive.combine {
+          inherit (pkgs.texlive)
+            scheme-basic
+            dvisvgm
+            dvipng
+            wrapfig
+            amsmath
+            ulem
+            hyperref
+            capt-of
+            ;
+        }
+      );
+    in
+    with pkgs;
+    [
+      mu
+      orgmode-tex
+    ];
+
+  services.emacs = {
+    install = true;
+    enable = true;
+    package =
+      with pkgs;
+      (
+        (emacsPackagesFor (
+          emacs-pgtk.overrideAttrs (old: {
+            passthru = old.passthru // {
+              treeSitter = true;
+            };
+          })
+        )).emacsWithPackages
+        (
+          epkgs: with epkgs; [
+            treesit-grammars.with-all-grammars
+            vterm
+            pdf-tools
+            mu4e
+          ]
+        )
+      );
+    defaultEditor = lib.mkForce true;
+  };
+}
diff --git a/modules/fonts.nix b/modules/fonts.nix
new file mode 100644
index 0000000..96236cb
--- /dev/null
+++ b/modules/fonts.nix
@@ -0,0 +1,48 @@
+{ pkgs, ... }:
+{
+  fonts.packages = with pkgs; [
+    adwaita-fonts
+    monoid
+    font-awesome
+    dejavu_fonts
+    julia-mono
+    uw-ttyp0
+    gohufont
+    spleen
+    terminus_font
+    creep
+    corefonts
+    dina-font
+    fira
+    fira-mono
+    hack-font
+    liberation_ttf
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-color-emoji
+    noto-fonts-monochrome-emoji
+    noto-fonts-emoji
+    noto-fonts-extra
+    proggyfonts
+    symbola
+    open-sans
+    twemoji-color-font
+    twitter-color-emoji
+    iosevka-bin
+    cozette
+    nerd-fonts.hack
+    ibm-plex
+  ];
+
+  fonts.enableDefaultPackages = true;
+  fonts.fontconfig = {
+    enable = true;
+    allowBitmaps = true;
+    useEmbeddedBitmaps = true;
+    defaultFonts.emoji = [
+      "Twitter Color Emoji"
+      "Noto Color Emoji"
+    ];
+  };
+
+}
diff --git a/modules/gnome.nix b/modules/gnome.nix
new file mode 100644
index 0000000..5743283
--- /dev/null
+++ b/modules/gnome.nix
@@ -0,0 +1,63 @@
+{ pkgs, ... }:
+{
+
+  imports = [
+    ./desktop-software.nix
+    ./fonts.nix
+  ];
+  environment.systemPackages = with pkgs; [
+    amberol
+    celluloid
+    ddcutil
+    gnome-console
+    gnome-obfuscate
+    gnome-boxes
+    gnome-tweaks
+    gnomeExtensions.caffeine
+    gnomeExtensions.brightness-control-using-ddcutil
+    fractal
+  ];
+
+  environment.gnome.excludePackages = with pkgs; [
+    totem
+    geary
+    gnome-music
+  ];
+
+  services.gnome = {
+    evolution-data-server.enable = true;
+    gnome-keyring.enable = true;
+    gnome-online-accounts.enable = true;
+  };
+
+  programs = {
+    seahorse.enable = true;
+    gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3;
+    evolution = {
+      enable = true;
+      plugins = [ pkgs.evolution-ews ];
+    };
+  };
+
+  services = {
+    desktopManager.gnome.enable = true;
+    displayManager.gdm = {
+      enable = true;
+      wayland = true;
+    };
+  };
+
+  # Enable sound.
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  programs.zsh.vteIntegration = true;
+  programs.bash.vteIntegration = true;
+
+  hardware.bluetooth.enable = true;
+
+}
diff --git a/modules/mail/default.nix b/modules/mail/default.nix
new file mode 100644
index 0000000..ba65f2c
--- /dev/null
+++ b/modules/mail/default.nix
@@ -0,0 +1,138 @@
+{ config, pkgs, ... }:
+let
+  mbsyncConf = ./mbsyncrc;
+in
+{
+  environment.systemPackages = with pkgs; [
+    isync
+    msmtp
+    neomutt
+    notmuch
+    alot
+    w3m
+    links2
+  ];
+
+  environment.shellAliases = {
+    mutt = "neomutt";
+  };
+
+  sops.secrets = {
+    "mail/oxapentane.com" = {
+      owner = config.users.users."0xa".name;
+    };
+    "mail/shipunov.xyz" = {
+      owner = config.users.users."0xa".name;
+    };
+    "mail/dvb.solutions" = {
+      owner = config.users.users."0xa".name;
+    };
+    "mail/tlm.solutions" = {
+      owner = config.users.users."0xa".name;
+    };
+  };
+
+  programs.msmtp = {
+    enable = true;
+    setSendmail = true;
+    extraConfig = ''
+      account mail@oxapentane.com
+      host smtp.migadu.com
+      port 587
+      from *@oxapentane.com
+      user mail@oxapentane.com
+      passwordeval cat ${config.sops.secrets."mail/oxapentane.com".path}
+      auth on
+      tls on
+      tls_trust_file	/etc/ssl/certs/ca-certificates.crt
+      logfile ~/.msmtp.log
+
+      account grigory@shipunov.xyz
+      host smtp.migadu.com
+      port 587
+      from *@shipunov.xyz
+      user grigory@shipunov.xyz
+      passwordeval cat ${config.sops.secrets."mail/shipunov.xyz".path}
+      auth on
+      tls on
+      tls_trust_file	/etc/ssl/certs/ca-certificates.crt
+      logfile ~/.msmtp.log
+
+      account dump@dvb.solutions
+      host smtp.migadu.com
+      port 587
+      from dump@dvb.solutions
+      user dump@dvb.solutions
+      passwordeval cat ${config.sops.secrets."mail/dvb.solutions".path}
+      auth on
+      tls on
+      tls_trust_file	/etc/ssl/certs/ca-certificates.crt
+      logfile ~/.msmtp.log
+
+      account grigory@tlm.solutions
+      host smtp.migadu.com
+      port 587
+      from grigory@tlm.solutions
+      user grigory@tlm.solutions
+      passwordeval cat ${config.sops.secrets."mail/tlm.solutions".path}
+      auth on
+      tls on
+      tls_trust_file	/etc/ssl/certs/ca-certificates.crt
+      logfile ~/.msmtp.log
+    '';
+  };
+
+  systemd.user = {
+
+    # Service and timer to sync imap to local maildir
+    services.mbsync = {
+      enable = true;
+      after = [
+        "graphical.target"
+        "network-online.target"
+      ];
+      script = ''
+        ${pkgs.isync}/bin/mbsync -q -a --config=${mbsyncConf}
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+
+    timers.mbsync = {
+      enable = true;
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "mbsync.service";
+        OnBootSec = "5m";
+        OnUnitInactiveSec = "11m";
+      };
+    };
+
+    # service and timer to flush the msmtp queue
+    services.flush-msmtpq = {
+      enable = true;
+      after = [
+        "graphical.target"
+        "network-online.target"
+      ];
+      script = ''
+        ${pkgs.msmtp}/bin/msmtp-queue -r
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+
+    timers.flush-msmtpq = {
+      enable = true;
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "flush-msmtpq.service";
+        OnBootSec = "11m";
+        OnUnitInactiveSec = "13m";
+      };
+    };
+
+  };
+}
diff --git a/modules/mail/mbsyncrc b/modules/mail/mbsyncrc
new file mode 100644
index 0000000..fd2bc5b
--- /dev/null
+++ b/modules/mail/mbsyncrc
@@ -0,0 +1,97 @@
+IMAPStore mail@oxapentane.com-remote
+Host imap.migadu.com
+Port 993
+User mail@oxapentane.com
+PassCmd "cat /run/secrets/mail/oxapentane.com"
+AuthMechs LOGIN
+SSLType IMAPS
+
+MaildirStore mail@oxapentane.com-local
+Subfolders Verbatim
+Path /home/0xa/mail/mail@oxapentane.com/
+Inbox /home/0xa/mail/mail@oxapentane.com/INBOX
+
+Channel mail@oxapentane.com
+Expunge Both
+Master :mail@oxapentane.com-remote:
+Slave :mail@oxapentane.com-local:
+Create Both
+SyncState *
+Patterns *
+MaxMessages 0
+ExpireUnread no
+# End profile
+
+
+IMAPStore grigory@shipunov.xyz-remote
+Host imap.migadu.com
+Port 993
+User grigory@shipunov.xyz
+PassCmd "cat /run/secrets/mail/shipunov.xyz"
+AuthMechs LOGIN
+SSLType IMAPS
+
+MaildirStore grigory@shipunov.xyz-local
+Subfolders Verbatim
+Path /home/0xa/mail/grigory@shipunov.xyz/
+Inbox /home/0xa/mail/grigory@shipunov.xyz/INBOX
+
+Channel grigory@shipunov.xyz
+Expunge Both
+Master :grigory@shipunov.xyz-remote:
+Slave :grigory@shipunov.xyz-local:
+Create Both
+SyncState *
+Patterns *
+MaxMessages 0
+ExpireUnread no
+# End profile
+
+
+IMAPStore dump@dvb.solutions-remote
+Host imap.migadu.com
+Port 993
+User dump@dvb.solutions
+PassCmd "cat /run/secrets/mail/dvb.solutions"
+AuthMechs LOGIN
+SSLType IMAPS
+
+MaildirStore dump@dvb.solutions-local
+Subfolders Verbatim
+Path /home/0xa/mail/dump@dvb.solutions/
+Inbox /home/0xa/mail/dump@dvb.solutions/INBOX
+
+Channel dump@dvb.solutions
+Expunge Both
+Master :dump@dvb.solutions-remote:
+Slave :dump@dvb.solutions-local:
+Create Both
+SyncState *
+Patterns *
+MaxMessages 0
+ExpireUnread no
+# End profile
+
+IMAPStore grigory@tlm.solutions-remote
+Host imap.migadu.com
+Port 993
+User grigory@tlm.solutions
+PassCmd "cat /run/secrets/mail/tlm.solutions"
+AuthMechs LOGIN
+SSLType IMAPS
+
+MaildirStore grigory@tlm.solutions-local
+Subfolders Verbatim
+Path /home/0xa/mail/grigory@tlm.solutions/
+Inbox /home/0xa/mail/grigory@tlm.solutions/INBOX
+
+Channel grigory@tlm.solutions
+Expunge Both
+Master :grigory@tlm.solutions-remote:
+Slave :grigory@tlm.solutions-local:
+Create Both
+SyncState *
+Patterns *
+MaxMessages 0
+ExpireUnread no
+# End profile
diff --git a/modules/niri.nix b/modules/niri.nix
new file mode 100644
index 0000000..441c55b
--- /dev/null
+++ b/modules/niri.nix
@@ -0,0 +1,127 @@
+{ pkgs, ... }:
+{
+  programs.niri.enable = true;
+
+  imports = [
+    ./desktop-software.nix
+    ./fonts.nix
+  ];
+  environment.systemPackages = with pkgs; [
+    screen-message
+    qbittorrent
+    gajim
+    imv
+    mpv
+    evince
+    brightnessctl
+    pulsemixer
+    cmus
+    termusic
+    gsettings-desktop-schemas
+    xdg-utils
+    qt5.qtwayland
+    bashmount
+    audacity
+    spotify-player
+    zathura
+    ncdu
+    adwaita-icon-theme
+    bluetui
+    gammastep
+    graphicsmagick
+    i3status-rust
+    impala
+    kanshi
+    pamixer
+    swayidle
+    swaylock
+    wl-clipboard
+    xfce.thunar
+    banana-cursor
+    yofi
+    alacritty
+    i3bar-river
+    mako
+    swww
+    wbg
+    oculante
+    xwayland-satellite
+    foot
+    fuzzel
+  ];
+
+  # Enable sound.
+  security.rtkit.enable = true;
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  hardware.bluetooth = {
+    enable = true;
+    package = pkgs.bluez;
+  };
+
+  programs.zsh.vteIntegration = true;
+  programs.bash.vteIntegration = true;
+  services.upower.enable = true;
+
+  services.acpid.enable = true;
+  programs.light.enable = true;
+
+  programs.xwayland.enable = true;
+
+  environment.sessionVariables = {
+    GTK_THEME = "Adwaita:dark";
+  };
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-gnome ];
+  };
+
+  services.udisks2.enable = true;
+  environment.shellAliases = {
+    # mounting shit
+    mnt = "udisksctl mount -b";
+    umnt = "udisksctl unmount -b";
+    unlock = "udisksctl unlock -b";
+    lock = "udisksctl lock -b";
+    # easier navigation
+    pwc = "pwd|wl-copy";
+    cdp = "cd $(wl-paste)";
+  };
+
+  qt = {
+    enable = true;
+    platformTheme = "gnome";
+    style = "adwaita-dark";
+  };
+
+  services.gnome.gnome-keyring.enable = true;
+  programs.seahorse.enable = true;
+
+  # https://github.com/JohnRTitor/nix-conf/commit/53bc83aef18849976d5a42cc727d38dd0e38c5b0
+  security.pam.services = {
+    greetd.enableGnomeKeyring = true;
+    greetd-password.enableGnomeKeyring = true;
+    login.enableGnomeKeyring = true;
+  };
+  services.dbus.packages = with pkgs; [
+    gnome-keyring
+    gcr
+  ];
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --greeting \"$(${pkgs.fortune}/bin/fortune -s)\" --cmd ${pkgs.niri}/bin/niri-session";
+      };
+    };
+  };
+
+  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses;
+}
diff --git a/modules/plasma.nix b/modules/plasma.nix
new file mode 100644
index 0000000..1a7a170
--- /dev/null
+++ b/modules/plasma.nix
@@ -0,0 +1,52 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./desktop-software.nix
+    ./fonts.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    kaidan
+    kdePackages.filelight
+    kdePackages.okular
+    vlc
+  ];
+
+  programs.kde-pim = {
+    enable = true;
+    kmail = true;
+    kontact = true;
+    merkuro = true;
+  };
+
+  # Enable sound.
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  programs.zsh.vteIntegration = true;
+  programs.bash.vteIntegration = true;
+
+  hardware.bluetooth.enable = true;
+
+  services.displayManager.sddm = {
+    enable = true;
+    wayland.enable = true;
+  };
+
+  services.desktopManager.plasma6.enable = true;
+
+  programs.ssh = {
+    startAgent = true;
+    enableAskPassword = false;
+    extraConfig = ''
+      AddKeysToAgent yes
+    '';
+  };
+  programs.firefox.nativeMessagingHosts.packages = with pkgs.kdePackages; [
+    plasma-browser-integration
+  ];
+}
diff --git a/modules/radio.nix b/modules/radio.nix
new file mode 100644
index 0000000..391e98b
--- /dev/null
+++ b/modules/radio.nix
@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    gnuradio
+    gqrx
+    cubicsdr
+    sdrangel
+    multimon-ng
+    sox
+
+    libusb1
+    rtl-sdr
+    hackrf
+    soapyhackrf
+
+    sigdigger
+    suscan
+    sigutils
+  ];
+
+  hardware = {
+    rtl-sdr.enable = true;
+    hackrf.enable = true;
+  };
+
+  services.udev.extraRules = ''
+    # MCH2022 Badge
+    SUBSYSTEM=="usb", ATTR{idVendor}=="16d0", ATTR{idProduct}=="0f9a", MODE="0666"
+
+    #Flipper Zero serial port
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="5740", ATTRS{manufacturer}=="Flipper Devices Inc.", TAG+="uaccess"
+    #Flipper Zero DFU
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", ATTRS{manufacturer}=="STMicroelectronics", TAG+="uaccess"
+    #Flipper ESP32s2 BlackMagic
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="40??", ATTRS{manufacturer}=="Flipper Devices Inc.", TAG+="uaccess"
+  '';
+
+}
diff --git a/modules/science.nix b/modules/science.nix
new file mode 100644
index 0000000..ff7eaa3
--- /dev/null
+++ b/modules/science.nix
@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    gnuplot
+    zotero
+    numbat
+  ];
+}
diff --git a/modules/tlp.nix b/modules/tlp.nix
new file mode 100644
index 0000000..5606ab2
--- /dev/null
+++ b/modules/tlp.nix
@@ -0,0 +1,14 @@
+{ ... }:
+
+{
+  powerManagement.cpuFreqGovernor = null;
+  services.power-profiles-daemon.enable = false;
+  services.tlp = {
+    enable = true;
+    settings = {
+      USB_BLACKLIST = "1d50:604b 1d50:6089 1d50:cc15 1fc9:000c";
+      CPU_SCALING_GOVERNOR_ON_AC = "performance";
+      CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+    };
+  };
+}
diff --git a/modules/wg/mgmt.nix b/modules/wg/mgmt.nix
index cfec996..64a55fd 100644
--- a/modules/wg/mgmt.nix
+++ b/modules/wg/mgmt.nix
@@ -26,7 +26,6 @@
         };
 
         "toaster" = {
-          # for now it's a non-nixos system
           address = [
             "10.89.87.100/24"
             "fd31:185d:722e::100/48"