zaphyra's git: nixfiles

initial commit

diff --git a/.gitignore b/.gitignore
@@ -0,0 +1 @@
+result

diff --git a/.sops.yaml b/.sops.yaml
@@ -0,0 +1,72 @@
+keys:
+    - &zaphyra BFE6386C8D66BCD4DAE14FC895F0FE7CD7E6A022
+    - &cautus age1yln5qratl82u6sqakh9gn2c0s88nzm62cw9muq5z4kzgp9wqpyzshhptq9
+    - &sorrah age102glvtt2nwx4ymgjh85449exlhmzk56cayy9hkkpl82u6wm64qzqjar7ju
+    - &isodon age10ujnqv3ttdw23f7jryjg4dtw83fj2wf275kv38f2qrtj5kk3hg4qf5uf3h
+    - &cuvier age1wztgmu7rm4yvdr0x8xucwfmnf0sruafwjx2ttl9cvg54epn0qysqqnr5n3
+    - &clevai age1q58tmhk5hxrfn86qymet3mznafdzuhwl47s8mt3nyn43pararc5sng7kag
+    - &leucas age1enkp0mlswl30s4h7z4qvyha4cmc2n2exs0v97276q5mx0jc86ggs7g2dyq
+
+creation_rules:
+    - path_regex: secrets/common\.yaml$
+      key_groups:
+          - age:
+                - *cautus
+                - *sorrah
+                - *isodon
+                - *cuvier
+                - *clevai
+                - *leucas
+            pgp:
+                - *zaphyra
+
+    - path_regex: secrets/cautus\.yaml$
+      key_groups:
+          - age:
+                - *cautus
+            pgp:
+                - *zaphyra
+
+    - path_regex: secrets/sorrah\.yaml$
+      key_groups:
+          - age:
+                - *sorrah
+            pgp:
+                - *zaphyra
+
+    - path_regex: secrets/isodon\.yaml$
+      key_groups:
+          - age:
+                - *isodon
+            pgp:
+                - *zaphyra
+    - path_regex: secrets/cuvier\.yaml$
+      key_groups:
+          - age:
+                - *cuvier
+            pgp:
+                - *zaphyra
+    - path_regex: secrets/clevai\.yaml$
+      key_groups:
+          - age:
+                - *clevai
+            pgp:
+                - *zaphyra
+    - path_regex: secrets/leucas\.yaml$
+      key_groups:
+          - age:
+                - *leucas
+            pgp:
+                - *zaphyra
+    - path_regex: secrets/zaphyra/sieve\.yaml$
+      key_groups:
+          - age:
+                - *cautus
+            pgp:
+                - *zaphyra
+    - path_regex: secrets/zaphyra/floractl\.yaml$
+      key_groups:
+          - age:
+                - *cuvier
+            pgp:
+                - *zaphyra

diff --git a/default.nix b/default.nix
@@ -0,0 +1,69 @@
+let
+  npins = import ./npins;
+  overlays = import ./overlays { inherit npins; };
+  nixosConfigurations = import ./machines { inherit lib npins; };
+  lib = (import "${npins.nixpkgs}/lib").extend (
+    final: prev: {
+      zpha = import ./lib {
+        inherit npins;
+        lib = prev;
+      };
+    }
+  );
+
+in
+{
+
+  inherit
+    overlays
+    nixosConfigurations
+    ;
+
+  nixosModules = import ./nixosModules { inherit lib; };
+
+  formatter = lib.zpha.forAllSystems {
+    inherit (npins) nixpkgs;
+    body = pkgs: pkgs.nixfmt-rfc-style;
+  };
+
+  packages = lib.zpha.forAllSystems {
+    overlays = overlays.default;
+    body =
+      pkgs:
+      lib.mergeAttrsList [
+        (import ./packages pkgs)
+        (lib.flip lib.mapAttrs' nixosConfigurations (
+          machineName: nixosConfiguration:
+          lib.nameValuePair "setupDisk-${machineName}" (
+            pkgs.zpha.setupDisk.override {
+              systemConfig = nixosConfiguration.config;
+            }
+          )
+        ))
+      ];
+  };
+
+  deploy = {
+    activationTimeout = 600;
+    confirmTimeout = 240;
+    nodes = lib.flip builtins.mapAttrs nixosConfigurations (
+      _: nixosConfiguration:
+      let
+        inherit (nixosConfiguration) config pkgs;
+      in
+      {
+        hostname = config.networking.fqdn;
+        sshUser = "root";
+        sshOpts = [
+          "-p"
+          (toString (lib.head config.services.openssh.ports))
+        ];
+        profiles.system = {
+          user = "root";
+          path = pkgs.zpha.deployrsActivator.override { systemConfig = config; };
+        };
+      }
+    );
+  };
+
+}

diff --git a/flake.lock b/flake.lock
@@ -0,0 +1,5 @@
+{
+  "nodes": { "root": {} },
+  "root": "root",
+  "version": 7
+}

diff --git a/flake.nix b/flake.nix
@@ -0,0 +1 @@
+{ outputs = _: import ./.; }

diff --git a/lib/collectModules.nix b/lib/collectModules.nix
@@ -0,0 +1,77 @@
+{ ... }:
+
+{
+
+  collectModules =
+    {
+      path,
+      scope ? { },
+      fileName ? "default.nix",
+    }:
+    (
+      let
+        #some helpers (mostly from nixpkgs or at least derived from that)
+        sublist =
+          start: count: list:
+          let
+            len = builtins.length list;
+          in
+          builtins.genList (n: builtins.elemAt list (n + start)) (
+            if start >= len then
+              0
+            else if start + count > len then
+              len - start
+            else
+              count
+          );
+        pipe = builtins.foldl' (x: f: f x);
+        flatten = x: if builtins.isList x then builtins.concatMap (y: flatten y) x else [ x ];
+        drop = count: list: sublist count (builtins.length list) list;
+        splitPath = path: builtins.filter builtins.isString (builtins.split "/" (builtins.toString path));
+
+        #actual logic starts here
+        fileNameLength = builtins.stringLength fileName;
+        basePathLength = builtins.length (splitPath ./.);
+
+        collectFiles =
+          path:
+          pipe (builtins.readDir path) [
+            (builtins.mapAttrs (
+              name: value:
+              if value == "directory" then (collectFiles (path + "/${name}")) else (path + "/${name}")
+            ))
+            builtins.attrValues
+            flatten
+            (builtins.filter (
+              elem:
+              let
+                pathLength = builtins.length (splitPath elem);
+              in
+              (
+                (
+                  let
+                    strLength = builtins.stringLength elem;
+                  in
+                  builtins.substring (strLength - fileNameLength) strLength elem
+                ) == fileName
+              )
+              && (pathLength - 1) != basePathLength
+            ))
+          ];
+
+      in
+      pipe (collectFiles path) [
+        (builtins.map (filePath: {
+          name = (
+            let
+              pathParts = drop basePathLength (splitPath filePath);
+            in
+            builtins.concatStringsSep "-" (sublist 0 ((builtins.length pathParts) - 1) pathParts)
+          );
+          value = import filePath scope;
+        }))
+        builtins.listToAttrs
+      ]
+    );
+
+}

diff --git a/lib/default.nix b/lib/default.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  npins,
+  ...
+}:
+
+(
+  let
+    # read the current directorys files and pipe the result through a list of functions
+    selfLib = lib.pipe (builtins.readDir ./.) [
+      # convert to a list containing just the attribute names
+      (builtins.attrNames)
+      # drop "default.nix" from the list
+      (builtins.filter (name: name != "default.nix"))
+      # convert each list-element containing its file-name to an element containing the file's content
+      (builtins.map (
+        name:
+        import ./${name} {
+          inherit npins lib selfLib;
+        }
+      ))
+      # merge list of attribute sets together
+      (lib.mergeAttrsList)
+    ];
+  in
+  selfLib
+)

diff --git a/lib/forAllSystems.nix b/lib/forAllSystems.nix
@@ -0,0 +1,28 @@
+{
+  npins,
+  lib,
+  ...
+}:
+
+{
+
+  forAllSystems =
+    {
+      body,
+      systems ? [
+        "x86_64-linux"
+        "aarch64-linux"
+      ],
+      nixpkgs ? npins.nixpkgs,
+      overlays ? [ ],
+    }:
+    lib.genAttrs systems (
+      system:
+      body (
+        import nixpkgs {
+          inherit system overlays;
+        }
+      )
+    );
+
+}

diff --git a/lib/mergeAttrsRecursiveList.nix b/lib/mergeAttrsRecursiveList.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  ...
+}:
+
+{
+
+  mergeAttrsRecursiveList =
+    list:
+    let
+      # `binaryMerge start end` merges the elements at indices `index` of `list` such that `start <= index < end`
+      # Type: Int -> Int -> AttrSet
+      binaryMerge =
+        start: end:
+        # assert start < end; # Invariant
+        if end - start >= 2 then
+          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
+          # The invariant is satisfied because each half will have at least 1 element
+          lib.recursiveUpdate (binaryMerge start (start + (end - start) / 2)) (
+            binaryMerge (start + (end - start) / 2) end
+          )
+        else
+          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
+          lib.elemAt list start;
+    in
+    if list == [ ] then
+      # Calling binaryMerge as below would not satisfy its invariant
+      { }
+    else
+      binaryMerge 0 (builtins.length list);
+}

diff --git a/lib/toCamelCase.nix b/lib/toCamelCase.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  ...
+}:
+
+{
+
+  toCamelCase =
+    str:
+    lib.throwIfNot (lib.isString str)
+      "toCamelCase does only accepts string values, but got ${lib.typeOf str}"
+      (
+        let
+          separators = lib.splitStringBy (
+            prev: curr:
+            builtins.elem curr [
+              "-"
+              "_"
+              " "
+            ]
+          ) false str;
+
+          parts = lib.flatten (
+            map (lib.splitStringBy (
+              prev: curr: lib.match "[a-z]" prev != null && lib.match "[A-Z]" curr != null
+            ) true) separators
+          );
+
+          first = if lib.length parts > 0 then lib.toLower (lib.head parts) else "";
+          rest = if lib.length parts > 1 then builtins.map lib.toSentenceCase (lib.tail parts) else [ ];
+        in
+        lib.concatStrings (map (lib.addContextFrom str) ([ first ] ++ rest))
+      );
+
+}

diff --git a/machines/cautus.nix b/machines/cautus.nix
@@ -0,0 +1,178 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 2;
+  domain = "fc9f.de";
+
+  sshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfZ86/2bpfOY6G2pcEWPlmIS7Mf47lG+s+lmaD/ZL0Z";
+  wgPublicKey = "pLPU3QizJjY7QkCItenm/zRKKx5chCj5dTHBLtWHFQs=";
+
+  hardware = {
+    cpuVendor = "intel";
+    allowHibernation = false;
+  };
+
+  networking = {
+    ip4IsPrivate = false;
+    ip4Address = "91.132.144.50";
+    ip4PrefixLength = 22;
+    defaultGateway4 = "91.132.144.1";
+
+    ip6IsPrivate = false;
+    ip6Address = "2a03:4000:37:65f::1";
+    ip6PrefixLength = 64;
+
+    dn42 = {
+      ip6Address = "fd6b:6174:6a61::2";
+      ip6PrefixLength = 128;
+    };
+  };
+
+  nixosConfiguration =
+    {
+      machines,
+      machineConfig,
+      config,
+      lib,
+      ...
+    }:
+    {
+      sops.secrets = {
+        wgPrivateKey = {
+          owner = "systemd-network";
+          group = "systemd-network";
+        };
+      };
+
+      common = {
+        profiles.netcup.enable = true;
+        configure = {
+          primaryNetworkInterface.enable = true;
+          rootDisk.swap = {
+            enable = true;
+            size = "2G";
+          };
+        };
+      };
+
+      zpha = {
+        configure = {
+          dnsServer.enable = true;
+          xmppServer.enable = true;
+          mailServer.enable = true;
+          matrixBridges.enable = true;
+        };
+        profiles = {
+          zaphyra.enable = true;
+          dn42 = {
+            enable = true;
+            addresses = [
+              "${machineConfig.networking.dn42.ip6Address}/${toString machineConfig.networking.dn42.ip6PrefixLength}"
+              "fd6b:6174:6a61:53::${toString machineConfig.id}/128"
+            ];
+          };
+        };
+
+        websites = {
+          "zaphyra.eu".enable = true;
+          "oeffi.zaphyra.eu".enable = true;
+          "notes.zaphyra.eu".enable = true;
+          "dav.zaphyra.eu".enable = true;
+          "continuwuity.zaphyra.eu".enable = true;
+          "vault.zaphyra.eu".enable = true;
+          "git.zaphyra.eu".enable = true;
+          "bikemap.zaphyra.eu".enable = true;
+          "gts.zaphyra.eu".enable = true;
+        };
+      };
+
+      services.babeld = {
+        enable = true;
+        interfaces = {
+          wg-sorrah = { };
+        };
+        interfaceDefaults = {
+          type = "tunnel";
+        };
+        extraConfig = ''
+          local-port-readwrite 33123
+
+          export-table 254 # main
+          import-table 255 # local
+
+          kernel-priority 1000
+
+          # allow own prefixes
+          in ip fd6b:6174:6a61::/48 allow
+
+          # allow external routes
+          in ip fd00::/8 allow
+
+          in deny
+
+          redistribute ip fd6b:6174:6a61::${toString machineConfig.id} eq 48 allow
+          redistribute local deny
+          redistribute deny
+        '';
+      };
+
+      networking.firewall = {
+        checkReversePath = "loose";
+        trustedInterfaces = [ "wg-sorrah" ];
+        allowedUDPPorts = [
+          config.systemd.network.netdevs."42-wg-sorrah".wireguardConfig.ListenPort
+        ];
+      };
+
+      systemd.network = {
+        config.networkConfig = {
+          IPv6Forwarding = true;
+        };
+
+        netdevs = {
+          "42-wg-sorrah" = {
+            netdevConfig = {
+              Kind = "wireguard";
+              Name = "wg-sorrah";
+              MTUBytes = 1280;
+            };
+
+            wireguardConfig = {
+              PrivateKeyFile = config.sops.secrets."wgPrivateKey".path;
+              ListenPort = 4200 + machineConfig.id;
+              FirewallMark = 4200 + machineConfig.id;
+            };
+
+            wireguardPeers = lib.singleton {
+              PublicKey = machines.sorrah.wgPublicKey;
+              AllowedIPs = lib.singleton "::/0";
+              Endpoint = "[${machines.sorrah.networking.ip6Address}]:${toString (4200 + machines.sorrah.id)}";
+              PersistentKeepalive = 10;
+            };
+          };
+        };
+
+        networks = {
+          "42-wg-sorrah" = {
+            matchConfig.Name = "wg-sorrah";
+            linkConfig = {
+              RequiredForOnline = false;
+              Multicast = true;
+            };
+            networkConfig = {
+              DHCP = false;
+              IPv6AcceptRA = false;
+            };
+            address = [
+              "fe80:fc9f::${toString machineConfig.id}/64"
+              "fd6b:6174:6a61:fc9f::${toString machineConfig.id}/48"
+            ];
+          };
+        };
+      };
+
+    };
+
+}

diff --git a/machines/clevai.nix b/machines/clevai.nix
@@ -0,0 +1,71 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 5;
+  domain = "fc9f.de";
+
+  sshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH+aZ4jTRDA9Bf9i8UBdGzucahtpDZbjtyaTfR5BE9j4";
+  wgPublicKey = "yP1kDJLP4YmHjDLKlOu7bwyd7wCkPHHAx4tY28b/Mms=";
+
+  hardware = {
+    cpuVendor = "intel";
+    allowHibernation = false;
+  };
+
+  networking = {
+    ip4IsPrivate = false;
+    ip4Address = "152.89.106.158";
+    ip4PrefixLength = 22;
+    defaultGateway4 = "152.89.104.1";
+
+    ip6IsPrivate = false;
+    ip6Address = "2a03:4000:39:e9a::1";
+    ip6PrefixLength = 64;
+    defaultGateway6 = "fe80::1";
+
+    dn42 = {
+      ip6Address = "fd6b:6174:6a61::5";
+      ip6PrefixLength = 128;
+    };
+  };
+
+  nixosConfiguration =
+    {
+      machineConfig,
+      ...
+    }:
+    {
+
+      sops.secrets = {
+        wgPrivateKey = {
+          owner = "systemd-network";
+          group = "systemd-network";
+        };
+      };
+
+      common = {
+        profiles.netcup.enable = true;
+        configure = {
+          primaryNetworkInterface.enable = true;
+          rootDisk.swap = {
+            enable = true;
+            size = "2G";
+          };
+        };
+      };
+
+      zpha.profiles = {
+        zaphyra.enable = true;
+        dn42 = {
+          enable = true;
+          addresses = [
+            "${machineConfig.networking.dn42.ip6Address}/${toString machineConfig.networking.dn42.ip6PrefixLength}"
+          ];
+        };
+      };
+
+    };
+
+}

diff --git a/machines/cuvier.nix b/machines/cuvier.nix
@@ -0,0 +1,200 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 4;
+  domain = "fc9f.de";
+
+  sshPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIANWOi6NMsfZ8wXOj/DXc092yajzG3VjPfRE0M9pViGh";
+  wgPublicKey = "CdnaBQL7c7zX0ORKhYyXp3HZ1kjqoEIGW03/mCCwAgI=";
+  syncthingId = "JUIJQZE-AWVYZIZ-CR6E66M-TAJIRDH-NEPEPZW-FHO37MJ-QM2MV5Q-OFJTEQI";
+
+  hardware = {
+    cpuVendor = "amd";
+    allowHibernation = false;
+  };
+
+  networking = {
+    primaryInterface = "enp3s0f0";
+
+    ip4IsPrivate = true;
+    ip4Address = "192.168.2.110";
+    ip4PrefixLength = 24;
+    defaultGateway4 = "192.168.2.1";
+
+    ip6IsPrivate = false;
+    ip6Address = "2a03:4000:4d:5e:acab::4";
+    ip6PrefixLength = 128;
+
+    dn42 = {
+      ip6Address = "fd6b:6174:6a61::4";
+      ip6PrefixLength = 128;
+    };
+  };
+
+  nixosConfiguration =
+    { lib, pkgs, ... }:
+    {
+      boot.initrd.systemd.emergencyAccess = true;
+      boot.initrd.availableKernelModules = [
+        "ehci_pci"
+        "xhci_pci"
+        "ahci"
+        "usbhid"
+        "usb_storage"
+        "sd_mod"
+        "uas"
+      ];
+
+      boot.initrd.luks.devices = {
+        data.device = "/dev/disk/by-partlabel/cuvier-data";
+        backup.device = "/dev/disk/by-partlabel/cuvier-backup";
+      };
+
+      systemd.tmpfiles.settings."mounts" = {
+        "/mnt/music".d = {
+          mode = "0755";
+          user = "zaphyra";
+          group = "users";
+        };
+        "/mnt/syncthing".d = {
+          mode = "0750";
+          user = "zaphyra";
+          group = "users";
+        };
+        "/mnt/restic".d = {
+          mode = "0700";
+          user = "restic";
+          group = "restic";
+        };
+      };
+
+      fileSystems = {
+        "/mnt/music" = {
+          device = "/dev/mapper/data";
+          options = [
+            "subvol=music"
+            "compress=zstd"
+            "discard=async"
+          ];
+        };
+        "/mnt/syncthing" = {
+          device = "/dev/mapper/data";
+          options = [
+            "subvol=syncthing"
+            "compress=zstd"
+            "discard=async"
+          ];
+        };
+        "/mnt/restic" = {
+          device = "/dev/mapper/backup";
+          options = [
+            "subvol=restic"
+            "discard=async"
+          ];
+        };
+      };
+
+      services.syncthing.settings.folders.zaphyra-music-orig.path = "/mnt/music";
+
+      sops.secrets = {
+        wgPrivateKey = {
+          owner = "systemd-network";
+          group = "systemd-network";
+        };
+      };
+
+      systemd.services.docker.path = [ pkgs.nftables ];
+      security.lockKernelModules = lib.mkForce false;
+      networking.firewall.trustedInterfaces = [
+        "docker0"
+        "br-88669f4be391"
+      ];
+      virtualisation.docker = {
+        enable = true;
+        package = pkgs.docker_29;
+        storageDriver = "btrfs";
+        daemon.settings = {
+          firewall-backend = "nftables";
+          data-root = "/persist/system/var/lib/docker";
+        };
+      };
+
+      users.users.zaphyra.extraGroups = [ "docker" ];
+
+      services.auto-cpufreq.enable = true;
+
+      common = {
+        profiles = {
+          nvme.enable = true;
+        };
+        security = {
+          kernel.enable = false;
+        };
+        configure = {
+          primaryNetworkInterface = {
+            enable = true;
+            acceptRouterAdvertisements = true;
+            ip6Address = null;
+          };
+          rootDisk.swap = {
+            enable = true;
+            size = "2G";
+          };
+        };
+      };
+
+      zpha = {
+        websites = {
+          "ctu.cx".enable = true;
+          "fedi.ctu.cx".enable = true;
+          "hass.zaphyra.eu".enable = true;
+          "gomuks.zaphyra.eu".enable = true;
+          "things.zaphyra.eu".enable = true;
+          "music.zaphyra.eu".enable = true;
+          "memories.zaphyra.eu".enable = true;
+          "links.zaphyra.eu".enable = true;
+        };
+        configure = {
+          netcupTunnel.enable = true;
+          syncthing.enable = true;
+          floraCtl.enable = true;
+          syncthingBackup.enable = true;
+        };
+        profiles = {
+          zaphyra.enable = true;
+          dn42.enable = true;
+          resticBackupTarget = {
+            enable = true;
+            path = "/mnt/restic";
+            keys = {
+              cuvier-syncthing-zaphyra-zaphyra-db-richtlinien = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuRCzv8FO3EaUY9R36cg7RNRaRsMNEdxbUAMrU8hXXX";
+              cuvier-syncthing-zaphyra-documents = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPu2w5POF//j3FWQJ/h5+Upal9hqe4ytDWUX6Nsoow+1";
+              cuvier-syncthing-zaphyra-pictures = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZCB0e1RLyEJlu7gk45R7Y35Kal5VXOCGE+gYvVm1A+";
+              cuvier-syncthing-zaphyra-videos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPbM811C0WvdN+19JBm3ulyb0SMoYIhT+GLU2pXPiEA";
+              cuvier-syncthing-zaphyra-audiobooks = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE6+dtNnZuVqnP7Get7pQWTPRrgf4H+L/d4I69y9+M40";
+              cuvier-syncthing-zaphyra-music-orig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJAAvOyzZz6YgbUuYRFZH1oHbboVUAXQM0hSTXJYFFwA";
+              cuvier-syncthing-zaphyra-media = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAjf9rztvIBVjtuJIMaSCo8nIZuLNjrlA5NoNH/0S+YK";
+              cuvier-navidrome = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0vCwn4H04RqiLFUVK06N1ZOhEvNgdBod1Eedu82LHP";
+              cuvier-things = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9ME2e9a2BbFgTxVY5OSL0VupYxZ10SjcLeO27qBBIF";
+              cuvier-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvl23IonsUnU5nDVMjNp0W56HcT1TTuXRvFrkOay0iM";
+              cuvier-immich = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8a7B0GzYf1J1Of8iwSMFQUON6CWCwnJW94K3uX95ij";
+              isodon-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID85l2Im1ff0JGp8vH8IngnjKB3K/cFiur/grPxWJbUE";
+              isodon-navidrome = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv54uqcNCmcbYWzA1mGPeKrh29E2+/sr08caX3jihQc";
+              cautus-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADOmcKGelaxzS9oObFMOdfUdm/PWS6Og9IJFZlLrsvm";
+              cautus-memos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDJZ4Y87FvE9ejTh2X01u73+iUYAbSxHz0SzgQ/oMW7W";
+              cautus-continuwuity = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICnwja11WL5lX7uUnuapINM5NydD9reJ1N6uIR8IrUnO";
+              cautus-radicale = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK98eqmXaUpbm6PrRi/n2WmQ+Oo0x8z/JQathF8OPzNU";
+              cautus-prosody = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe5En9owlKsj15sgWoq0zOFuAfc7VX3ON5DJ8TPIXAP";
+              cautus-vaultwarden = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrsALG/N1wAA9T4MzMkbdA8LKNSsi38I4AsrmKi3eN2";
+              cautus-gitolite = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrxAUyM6a7Rw1vjK+OyOR+9bYrWfV3L7bu05w9IPG+h";
+              cautus-mailserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGsKAXf8yLKv+B8FIrIssxlryqRPtuajPLJ7hVRh0dbz";
+            };
+          };
+        };
+
+      };
+    };
+
+}

diff --git a/machines/default.nix b/machines/default.nix
@@ -0,0 +1,58 @@
+{
+  lib ? import "${(import ../npins).nixpkgs}/lib",
+  npins ? import ../npins,
+  ...
+}:
+
+(
+  let
+    # read the current directorys files and pipe the result through a list of functions
+    machines = builtins.listToAttrs (
+      lib.pipe (builtins.readDir ./.) [
+        # convert to a list containing just the attribute names
+        (builtins.attrNames)
+        # drop "default.nix" from the list
+        (builtins.filter (name: name != "default.nix"))
+        # convert each list-element containing its file-name to an element containing the file's content
+        (builtins.map (name: {
+          # remove '.nix' suffix
+          name = lib.removeSuffix ".nix" name;
+          value = import ./${name};
+        }))
+      ]
+    );
+
+    nixosModules = import ../nixosModules { inherit lib; };
+    overlays = import ../overlays { inherit npins; };
+
+    specialArgs = {
+      inherit npins machines nixosConfigurations;
+      resources = import ../resources { inherit npins lib; };
+      sopsSecrets = import ../secrets { inherit npins lib; };
+    };
+
+    nixosConfigurations = lib.flip builtins.mapAttrs machines (
+      machineName: machineConfig:
+      let
+        nixpkgs = if !machineConfig.nixpkgsStable then npins.nixpkgsUnstable else npins.nixpkgs;
+      in
+      import "${nixpkgs}/nixos/lib/eval-config.nix" {
+        system = machineConfig.system;
+
+        specialArgs = specialArgs // {
+          machineConfig = machineConfig // {
+            inherit machineName;
+          };
+        };
+
+        modules = lib.flatten [
+          { nixpkgs.overlays = overlays.default; }
+          nixosModules.default
+          machineConfig.nixosConfiguration
+        ];
+      }
+    );
+
+  in
+  nixosConfigurations
+)

diff --git a/machines/isodon.nix b/machines/isodon.nix
@@ -0,0 +1,103 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 3;
+  domain = "fc9f.de";
+
+  sshPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/7udhktYVZHHZ2RXQeKHt0ACfcG5dmTpyd5LMw4U0O root@nixos";
+  wgPublicKey = "nvyhYuWJl/dKyV/2+bDrUisvL3mi38PsNzfdIDDwSjY=";
+  syncthingId = "QI2EPUE-4VMZ3XV-LXX3GXP-RHCWTRY-AACLSGL-YG7MIYV-THST74N-KJGIBQ6";
+
+  hardware = {
+    cpuVendor = "intel";
+    allowHibernation = false;
+  };
+
+  networking = {
+    primaryInterface = "enp1s0";
+
+    ip4IsPrivate = true;
+    ip4Address = "192.168.2.111";
+    ip4PrefixLength = 24;
+    defaultGateway4 = "192.168.2.1";
+
+    ip6IsPrivate = false;
+    ip6Address = "2a03:4000:4d:5e:acab::3";
+    ip6PrefixLength = 128;
+
+    dn42 = {
+      ip6Address = "fd6b:6174:6a61::3";
+      ip6PrefixLength = 128;
+    };
+  };
+
+  nixosConfiguration = _: {
+    boot.initrd.systemd.emergencyAccess = true;
+    boot.kernel.sysctl."net.ipv6.conf.all.proxy_ndp" = true;
+
+    sops.secrets = {
+      wgPrivateKey = {
+        owner = "systemd-network";
+        group = "systemd-network";
+      };
+    };
+
+    common = {
+      profiles.nvme.enable = true;
+      configure = {
+        primaryNetworkInterface = {
+          enable = true;
+          acceptRouterAdvertisements = true;
+          ip6Address = null;
+        };
+        rootDisk.swap = {
+          enable = true;
+          size = "2G";
+        };
+      };
+    };
+
+    zpha = {
+      websites = {
+        "fedi.home.ctu.cx".enable = true;
+        "music.zaphyra.eu" = {
+          enable = true;
+          subdomain = "music2";
+        };
+      };
+
+      configure = {
+        syncthing.enable = true;
+        netcupTunnel.enable = true;
+      };
+
+      profiles = {
+        zaphyra.enable = true;
+        dn42.enable = true;
+        resticBackupTarget = {
+          enable = true;
+          path = "/persist/system/restic-backups";
+          keys = {
+            cuvier-navidrome = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0vCwn4H04RqiLFUVK06N1ZOhEvNgdBod1Eedu82LHP";
+            cuvier-things = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9ME2e9a2BbFgTxVY5OSL0VupYxZ10SjcLeO27qBBIF";
+            cuvier-immich = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8a7B0GzYf1J1Of8iwSMFQUON6CWCwnJW94K3uX95ij";
+            cuvier-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvl23IonsUnU5nDVMjNp0W56HcT1TTuXRvFrkOay0iM";
+            isodon-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID85l2Im1ff0JGp8vH8IngnjKB3K/cFiur/grPxWJbUE";
+            isodon-navidrome = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv54uqcNCmcbYWzA1mGPeKrh29E2+/sr08caX3jihQc";
+            cautus-gotosocial = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADOmcKGelaxzS9oObFMOdfUdm/PWS6Og9IJFZlLrsvm";
+            cautus-memos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDJZ4Y87FvE9ejTh2X01u73+iUYAbSxHz0SzgQ/oMW7W";
+            cautus-continuwuity = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICnwja11WL5lX7uUnuapINM5NydD9reJ1N6uIR8IrUnO";
+            cautus-radicale = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK98eqmXaUpbm6PrRi/n2WmQ+Oo0x8z/JQathF8OPzNU";
+            cautus-prosody = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe5En9owlKsj15sgWoq0zOFuAfc7VX3ON5DJ8TPIXAP";
+            cautus-vaultwarden = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrsALG/N1wAA9T4MzMkbdA8LKNSsi38I4AsrmKi3eN2";
+            cautus-gitolite = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrxAUyM6a7Rw1vjK+OyOR+9bYrWfV3L7bu05w9IPG+h";
+            cautus-mailserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGsKAXf8yLKv+B8FIrIssxlryqRPtuajPLJ7hVRh0dbz";
+          };
+        };
+      };
+    };
+  };
+
+}

diff --git a/machines/leucas.nix b/machines/leucas.nix
@@ -0,0 +1,71 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 6;
+  domain = "fc9f.de";
+
+  sshPublicKey = "";
+  wgPublicKey = "";
+
+  hardware = {
+    cpuVendor = "intel";
+    allowHibernation = false;
+  };
+
+  networking = {
+    dn42 = {
+      ip6Address = "fd6b:6174:6a61::6";
+      ip6PrefixLength = 128;
+    };
+  };
+
+  nixosConfiguration = _: {
+    sops.secrets = {
+      wgPrivateKey = {
+        owner = "systemd-network";
+        group = "systemd-network";
+      };
+    };
+
+    common = {
+      configure.rootDisk.swap = {
+        enable = true;
+        size = "16G";
+      };
+
+      profiles = {
+        nvme.enable = true;
+      };
+
+      programs = {
+        shellUtilities.enable = true;
+        nixUtilities.enable = true;
+      };
+
+      services = {
+        greetd.autoLogin = {
+          enable = true;
+          user = "zaphyra";
+        };
+      };
+    };
+
+    zpha = {
+      configure = {
+        cccdaWifi.enable = true;
+      };
+
+      profiles = {
+        zaphyra.enable = true;
+        graphical.enable = true;
+      };
+
+      services = {
+        keyd.enable = true;
+      };
+    };
+  };
+
+}

diff --git a/machines/sorrah.nix b/machines/sorrah.nix
@@ -0,0 +1,78 @@
+{
+
+  system = "x86_64-linux";
+  nixpkgsStable = true;
+
+  id = 1;
+  domain = "fc9f.de";
+
+  sshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/7udhktYVZHHZ2RXQeKHt0ACfcG5dmTpyd5LMw4U0O root@nixos";
+  wgPublicKey = "J+kRRNU65JGc0yk04v6P3tFwHSQOIfq8EkfD2gFupg4=";
+
+  hardware = {
+    cpuVendor = "intel";
+    allowHibernation = false;
+  };
+
+  networking = {
+    ip4IsPrivate = false;
+    ip4Address = "194.36.145.49";
+    ip4PrefixLength = 22;
+    defaultGateway4 = "194.36.144.1";
+
+    ip6IsPrivate = false;
+    ip6Address = "2a03:4000:4d:5e::1";
+    ip6PrefixLength = 64;
+
+    dn42 = {
+      wgPublicKey = "MRXPP//j+BDCiUyrYHdXtdULAsCZyfgumas8pxp6oiE=";
+      ip6Address = "fd6b:6174:6a61::1";
+      ip6PrefixLength = 48;
+    };
+  };
+
+  nixosConfiguration =
+    { lib, ... }:
+    {
+
+      boot.initrd.systemd.emergencyAccess = true;
+      boot.kernel.sysctl."net.ipv6.conf.all.proxy_ndp" = true;
+
+      sops.secrets = {
+        wgPrivateKey = {
+          owner = "systemd-network";
+          group = "systemd-network";
+        };
+      };
+
+      common = {
+        profiles.netcup.enable = true;
+        configure = {
+          primaryNetworkInterface.enable = true;
+          rootDisk.swap = {
+            enable = true;
+            size = "2G";
+          };
+        };
+      };
+
+      zpha = {
+        profiles.zaphyra.enable = true;
+
+        websites = {
+          "flauschehorn.zaphyra.eu".enable = true;
+          "ip.fc9f.de".enable = true;
+        };
+
+        configure = {
+          dnsServer.enable = true;
+          dn42Router.enable = true;
+          netcupTunnel = {
+            enable = true;
+            addresses = lib.singleton "2a03:4000:4d:5e:acab::1/112";
+          };
+        };
+      };
+    };
+
+}

diff --git a/maidModules/dbus.nix b/maidModules/dbus.nix
@@ -0,0 +1,25 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+
+  options.dbus.packages = lib.mkOption {
+    type = with lib.types; listOf package;
+    default = [ ];
+  };
+
+  config.file.xdg_data = lib.mkIf (config.dbus.packages != [ ]) {
+    "dbus-1/services" = {
+      source = pkgs.symlinkJoin {
+        name = "user-dbus-services";
+        paths = config.dbus.packages;
+        stripPrefix = "/share/dbus-1/services";
+      };
+    };
+  };
+
+}

diff --git a/maidModules/environment.nix b/maidModules/environment.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.environment;
+
+in
+{
+
+  options.environment = {
+    enable = lib.mkEnableOption "environment-related settings";
+    sessionVariables = lib.mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    file.home.".profile".text = ''
+      source <(${pkgs.systemd}/lib/systemd/user-environment-generators/30-systemd-environment-d-generator)
+    '';
+
+    file.xdg_config."environment.d/60-custom-session-vars.conf".text =
+      let
+        vars = cfg.sessionVariables;
+        varEntries = lib.attrsets.mapAttrsToList (k: v: "${k}=${v}") vars;
+        varFileContent = builtins.concatStringsSep "\n" varEntries;
+      in
+      varFileContent;
+  };
+
+}

diff --git a/maidModules/programs/fish.nix b/maidModules/programs/fish.nix
@@ -0,0 +1,132 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.programs.fish;
+
+  toFishFunc =
+    body: funcName:
+    if (types.typeOf body) == "string" then
+      pkgs.writeFish "${funcName}.fish" ''
+        function ${funcName};
+        ${lib.concatMapStringsSep "\n" (line: "\t${line}") (lib.splitString "\n" body)}
+        end
+      ''
+    else if lib.isDerivation body then
+      body
+    else
+      throw "Input is of invalid type ${types.typeOf body}, expected `path` or `string`.";
+
+  isVendored =
+    plugin:
+    types.any (p: lib.pathExists "${plugin}/share/fish/${p}") [
+      "vendor_conf.d"
+      "vendor_completions.d"
+      "vendor_functions.d"
+    ];
+in
+{
+
+  options.programs.fish = {
+    enable = lib.mkEnableOption "fish";
+
+    config = lib.mkOption {
+      default = "";
+      type = types.lines;
+    };
+
+    functions = lib.mkOption {
+      default = { };
+      type =
+        with types;
+        attrsOf (oneOf [
+          lines
+          path
+        ]);
+    };
+
+    earlyConfigFiles = lib.mkOption {
+      default = { };
+      type = types.attrsOf types.lines;
+    };
+
+    abbrs = lib.mkOption {
+      default = { };
+      type = types.attrsOf types.lines;
+    };
+
+    aliases = lib.mkOption {
+      default = { };
+      type = types.attrsOf types.lines;
+    };
+
+    plugins = lib.mkOption {
+      type = types.attrsOf types.path;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.fish.earlyConfigFiles = lib.mapAttrs' (
+      name: source:
+      lib.nameValuePair "plugin-${name}"
+        #  fish
+        ''
+          # Plugin ${name} -- ${source}
+          set -l src "${source}"
+
+          if test -d "$src/functions"
+              set fish_function_path $fish_function_path[1] "$src/functions" $fish_function_path[2..]
+          end
+
+          if test -d "$src/completions"
+              set fish_complete_path $fish_complete_path[1] "$src/completions" $fish_complete_path[2..]
+          end
+
+          for f in "$src/conf.d/"*
+              source "$f"
+          end
+
+          if test -f "$src/key_bindings.fish"
+              source "$src/key_bindings.fish"
+          end
+
+          if test -f "$src/init.fish"
+              source "$src/init.fish"
+          end
+        ''
+    ) (lib.filterAttrs (n: v: !(isVendored v)) cfg.plugins);
+
+    file.xdg_config = {
+      "fish/config.fish" = lib.mkIf (cfg.config != "") {
+        source = pkgs.writers.writeFish "config.fish" cfg.config;
+      };
+      "fish/conf.d/session-variables.fish" = lib.mkIf (config.environment.sessionVariables != { }) {
+        text = lib.concatMapAttrsStringSep "\n" (
+          name: value:
+          "set --global --export ${lib.escapeShellArg name} ${lib.escapeShellArg (toString value)}"
+        ) config.environment.sessionVariables;
+      };
+      "fish/conf.d/abbreviations.fish" = lib.mkIf (cfg.abbrs != { }) {
+        text = lib.concatMapAttrsStringSep "\n" (
+          name: value: "abbr --add -- ${lib.escapeShellArg name} ${lib.escapeShellArg (toString value)}"
+        ) cfg.abbrs;
+      };
+      "fish/conf.d/aliases.fish".text = lib.concatMapAttrsStringSep "\n" (
+        name: value: "alias -- ${lib.escapeShellArg name} ${lib.escapeShellArg (toString value)}"
+      ) cfg.aliases;
+    }
+    // (lib.mapAttrs' (
+      name: val: lib.nameValuePair "fish/functions/${name}.fish" { source = toFishFunc val name; }
+    ) cfg.functions)
+    // (lib.mapAttrs' (
+      name: val:
+      lib.nameValuePair "fish/conf.d/${name}.fish" { source = pkgs.writers.writeFish "${name}.fish" val; }
+    ) cfg.earlyConfigFiles);
+  };
+
+}

diff --git a/maidModules/programs/git.nix b/maidModules/programs/git.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.programs.git;
+  settingsFormat = pkgs.formats.ini { };
+
+in
+{
+
+  options.programs.git = {
+    enable = lib.mkEnableOption "git";
+    ignores = lib.mkOption {
+      default = { };
+      type = with types; listOf str;
+    };
+    settings = lib.mkOption {
+      default = { };
+      type = settingsFormat.type;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    packages = [ pkgs.git ];
+
+    file.xdg_config = {
+      "git/config".source = settingsFormat.generate "gitconfig.ini" cfg.settings;
+      "git/ignore".text = lib.concatStringsSep "\n" cfg.ignores;
+    };
+  };
+
+}

diff --git a/maidModules/programs/lazygit.nix b/maidModules/programs/lazygit.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.programs.lazygit;
+  settingsFormat = pkgs.formats.yaml { };
+
+in
+{
+
+  options.programs.lazygit = {
+    enable = lib.mkEnableOption "lazygit";
+    defaultShell = lib.mkOption {
+      type = types.bool;
+      default = true;
+    };
+    settings = lib.mkOption {
+      default = { };
+      type = settingsFormat.type;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    packages = [ pkgs.lazygit ];
+
+    file.xdg_config."lazygit/config.yml".source =
+      settingsFormat.generate "lazygit-config.yaml" cfg.settings;
+  };
+
+}

diff --git a/maidModules/programs/starship.nix b/maidModules/programs/starship.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.programs.starship;
+  settingsFormat = pkgs.formats.toml { };
+
+in
+{
+
+  options.programs.starship = {
+    enable = lib.mkEnableOption "starship";
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+    };
+    enableFishIntegration = lib.mkOption {
+      type = types.bool;
+      default = config.programs.fish.enable;
+    };
+    enableTransience = lib.mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    packages = [ pkgs.starship ];
+
+    environment.sessionVariables.STARSHIP_CONFIG = lib.mkIf (
+      cfg.settings != { }
+    ) "${cfg.xdg.configDirectory}/starship/config.toml";
+
+    programs.fish.config = lib.mkIf cfg.enableFishIntegration (
+      lib.mkAfter ''
+        if test "$TERM" != "dumb"
+          starship init fish | source
+          ${lib.optionalString cfg.enableTransience "enable_transience"}
+        end
+      ''
+    );
+
+    file.xdg_config."starship/config.toml".source =
+      settingsFormat.generate "starship-config.toml" cfg.settings;
+  };
+
+}

diff --git a/maidModules/xdg.nix b/maidModules/xdg.nix
@@ -0,0 +1,121 @@
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  listOrSingletonOf =
+    type: with types; coercedTo (either (listOf type) type) lib.toList (listOf type);
+
+  cfg = config.xdg;
+  mimeappsFormat = pkgs.formats.ini { listToValue = lib.concatStringsSep ";"; };
+
+in
+{
+
+  options.xdg = {
+    enable = lib.mkEnableOption "xdg foo";
+    cacheDirectory = lib.mkOption {
+      type = types.str;
+      default = "~/.cache";
+    };
+    configDirectory = lib.mkOption {
+      type = types.str;
+      default = "~/.config";
+    };
+
+    dataDirectory = lib.mkOption {
+      type = types.str;
+      default = "~/.local/share";
+    };
+
+    stateDirectory = lib.mkOption {
+      type = types.str;
+      default = "~/.local/state";
+    };
+
+    mime-apps = {
+      addedAssociations = lib.mkOption {
+        type = with types; attrsOf (listOrSingletonOf str);
+        default = { };
+      };
+
+      removedAssociations = lib.mkOption {
+        type = with types; attrsOf (listOrSingletonOf str);
+        default = { };
+      };
+
+      defaultApplications = lib.mkOption {
+        type = with types; attrsOf (listOrSingletonOf str);
+        default = { };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.sessionVariables = {
+      XDG_CACHE_HOME = lib.mkIf (
+        cfg.cacheDirectory != options.xdg.cacheDirectory.default
+      ) cfg.cacheDirectory;
+      XDG_CONFIG_HOME = lib.mkIf (
+        cfg.configDirectory != options.xdg.configDirectory.default
+      ) cfg.configDirectory;
+      XDG_DATA_HOME = lib.mkIf (cfg.dataDirectory != options.xdg.dataDirectory.default) cfg.dataDirectory;
+      XDG_STATE_HOME = lib.mkIf (
+        cfg.stateDirectory != options.xdg.stateDirectory.default
+      ) cfg.stateDirectory;
+    };
+
+    file = {
+      xdg_config."mimeapps.list" =
+        let
+          nonDefault = {
+            added = cfg.mime-apps.addedAssociations != options.xdg.mime-apps.addedAssociations.default;
+            removed = cfg.mime-apps.removedAssociations != options.xdg.mime-apps.removedAssociations.default;
+            default = cfg.mime-apps.defaultApplications != options.xdg.mime-apps.defaultApplications.default;
+          };
+        in
+        lib.mkIf (lib.lists.any lib.trivial.id (lib.attrValues nonDefault)) {
+          source = mimeappsFormat.generate "mimeapps.list" {
+            "Added Associations" = cfg.mime-apps.addedAssociations;
+            "Removed Associations" = cfg.mime-apps.removedAssociations;
+            "Default Applications" = cfg.mime-apps.defaultApplications;
+          };
+        };
+      xdg_data."glib-2.0/schemas".source = pkgs.buildEnv {
+        name = "user-gsettings-schemas";
+        paths = config.packages;
+        pathsToLink = [ "/share/gsettings-schemas" ];
+        ignoreCollisions = true;
+        postBuild = ''
+          if [ -x $out/bin/glib-compile-schemas -a -w $out/share/glib-2.0/schemas ]; then
+              $out/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+          fi
+
+          if [ -d  $out/share/gsettings-schemas/ ]; then
+            # symlink any schema files to the standard schema directory
+            for d in $out/share/gsettings-schemas/*; do
+              # Force symlink, in case there are duplicates
+              ln -fs $d/glib-2.0/schemas/*.xml $out
+            done
+
+            # and compile them
+            if [ -w $out ]; then
+              ${pkgs.glib.dev}/bin/glib-compile-schemas $out
+            fi
+          fi
+        '';
+      };
+
+      # pkgs.symlinkJoin {
+      #   name = "user-gsettings-schemas";
+      #   paths = config.packages;
+      #   stripPrefix = "/share/gsettings-schemas";
+      # };
+    };
+  };
+
+}

diff --git a/nixosModules/common/configure/boot.nix b/nixosModules/common/configure/boot.nix
@@ -0,0 +1,91 @@
+{
+  npins,
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.configure.boot;
+  lanzaboote = import npins.lanzaboote {
+    inherit pkgs;
+  };
+
+in
+{
+
+  options.common.configure.boot = {
+    enable = lib.mkEnableOption "basic systemd-boot config";
+    secureboot = lib.mkEnableOption "secureboot support via lanzaboote";
+
+    configurationLimit = lib.mkOption {
+      type = types.number;
+      default = 10;
+    };
+    plymouth = {
+      enable = lib.mkEnableOption "graphical bootscreen";
+      theme = lib.mkOption {
+        type = types.str;
+        default = "bgrt";
+      };
+    };
+  };
+
+  imports =
+    (lib.mkIf cfg.enable [
+      lanzaboote.nixosModules.lanzaboote
+    ]).content;
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        boot.initrd.systemd.enable = true;
+        boot.loader = {
+          grub.enable = false;
+          systemd-boot = {
+            enable = lib.mkDefault true;
+            inherit (cfg) configurationLimit;
+          };
+          efi = {
+            canTouchEfiVariables = true;
+            efiSysMountPoint = "/boot";
+          };
+        };
+      }
+
+      (lib.mkIf cfg.plymouth.enable {
+        boot = {
+          consoleLogLevel = 0;
+          initrd.verbose = false;
+          kernelParams = [
+            "quiet"
+            "udev.log_level=3"
+          ];
+          plymouth = {
+            enable = true;
+            inherit (cfg) theme;
+          };
+        };
+      })
+
+      (lib.mkIf cfg.secureboot {
+        environment.systemPackages = with pkgs; [ sbctl ];
+
+        common.configure.persist.system.dirs = [
+          "/var/lib/sbctl"
+        ];
+
+        boot = {
+          loader.systemd-boot.enable = lib.mkForce false;
+          lanzaboote = {
+            enable = true;
+            pkiBundle = "/var/lib/sbctl";
+            inherit (cfg) configurationLimit;
+          };
+        };
+      })
+    ]
+  );
+
+}

diff --git a/nixosModules/common/configure/dn42Router.nix b/nixosModules/common/configure/dn42Router.nix
@@ -0,0 +1,315 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.common.configure.dn42Router;
+
+in
+{
+
+  options.common.configure.dn42Router = {
+    enable = lib.mkEnableOption "";
+    asn = lib.mkOption {
+      type = types.int;
+    };
+    routerId = lib.mkOption {
+      type = types.int;
+    };
+    address = lib.mkOption {
+      type = types.str;
+    };
+    range = lib.mkOption {
+      type = types.str;
+    };
+    peerings = lib.mkOption {
+      default = { };
+      type =
+        with types;
+        attrsOf (submodule {
+          options = {
+            asn = lib.mkOption { type = types.int; };
+            remoteLinkLocalAddress = lib.mkOption { type = types.str; };
+            localLinkLocalAddress = lib.mkOption {
+              type = types.str;
+              default = "fe80::6b61/64";
+            };
+            endpoint = lib.mkOption {
+              type = with types; nullOr str;
+              default = null;
+            };
+            listenPort = lib.mkOption { type = types.int; };
+            publicKey = lib.mkOption { type = types.str; };
+            hasPresharedKey = lib.mkOption {
+              type = types.bool;
+              default = false;
+            };
+          };
+        });
+    };
+    babel.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+    };
+    babel.peerings = lib.mkOption {
+      default = { };
+      type =
+        with types;
+        attrsOf (submodule {
+          options = {
+            type = lib.mkOption {
+              type = types.str;
+              default = "tunnel";
+            };
+          };
+        });
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedUDPPorts = lib.mapAttrsToList (
+      _name: peerConfig: peerConfig.listenPort
+    ) cfg.peerings;
+
+    sops.secrets = lib.pipe cfg.peerings [
+      (lib.mapAttrsToList (
+        name: peerConfig:
+        [
+          (lib.nameValuePair "dn42/peerings/${name}/wgPrivateKey" {
+            owner = "systemd-network";
+            group = "systemd-network";
+          })
+        ]
+        ++ lib.optionals peerConfig.hasPresharedKey [
+          (lib.nameValuePair "dn42/peerings/${name}/wgPresharedKey" {
+            owner = "systemd-network";
+            group = "systemd-network";
+          })
+        ]
+      ))
+      lib.lists.flatten
+      lib.listToAttrs
+    ];
+
+    systemd = {
+      network = {
+        netdevs = lib.mapAttrs' (
+          name: peerConfig:
+          lib.nameValuePair "20-dn42${name}" {
+            netdevConfig = {
+              Kind = "wireguard";
+              Name = "dn42${name}";
+            };
+            wireguardConfig = {
+              ListenPort = peerConfig.listenPort;
+              PrivateKeyFile = config.sops.secrets."dn42/peerings/${name}/wgPrivateKey".path;
+            }
+            // (lib.optionalAttrs peerConfig.hasPresharedKey {
+              PresharedKeyFile = config.sops.secrets."dn42/peerings/${name}/wgPresharedKey".path;
+            });
+            wireguardPeers = [
+              {
+                PersistentKeepalive = 30;
+                Endpoint = lib.mkIf (!builtins.isNull peerConfig.endpoint) peerConfig.endpoint;
+                PublicKey = peerConfig.publicKey;
+                AllowedIPs = [
+                  "fd00::/8"
+                  peerConfig.remoteLinkLocalAddress
+                ];
+              }
+            ];
+          }
+        ) cfg.peerings;
+
+        networks = lib.mapAttrs' (
+          name: peerConfig:
+          lib.nameValuePair "20-dn42${name}" {
+            matchConfig.Name = "dn42${name}";
+            linkConfig.RequiredForOnline = "no";
+
+            address = [ peerConfig.localLinkLocalAddress ];
+            routes = [ { Destination = "${peerConfig.remoteLinkLocalAddress}/128"; } ];
+
+            networkConfig = {
+              IPv6Forwarding = true;
+              IPv6AcceptRA = false;
+              DHCP = false;
+            };
+          }
+        ) cfg.peerings;
+      };
+      services = {
+        systemd-networkd.after = [ "sops-install-secrets.service" ];
+        stayrtr = {
+          wantedBy = [
+            "multi-user.target"
+            "bird.service"
+          ];
+          serviceConfig.DynamicUser = true;
+          serviceConfig.ExecStart = ''
+            ${lib.getExe pkgs.stayrtr} \
+              -bind [::1]:8282 \
+              -cache=https://dn42.burble.com/roa/dn42_roa_46.json \
+              -checktime=false
+          '';
+        };
+      };
+    };
+
+    services.bird = {
+      enable = true;
+      package = pkgs.bird3;
+      preCheckConfig = ''
+        # Remove roa files for checking, because they are only available at runtime
+        sed -i 's|include "/etc/bird/roa_dn42.conf";||' bird.conf
+
+        cat -n bird.conf # here for debugging purposes
+      '';
+      config = ''
+        log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
+        log stderr all;
+
+        define OWNAS = ${toString cfg.asn};
+        define OWNNET = ${cfg.range};
+        define OWNNETSET = [ ${cfg.range} ];
+        define OWNIP = ${cfg.address};
+
+        router id ${toString cfg.routerId};
+        hostname "${config.networking.hostName}";
+
+        roa6 table dn42_roa;
+
+        function is_self_net() -> bool {
+          return net ~ OWNNETSET;
+        }
+
+        function is_valid_network() -> bool {
+          return net ~ [
+            fd00::/8{44,64}
+          ];
+        }
+
+        function import_filter() {
+          if (net.type != NET_IP6 || ! is_valid_network() || is_self_net()) then
+            reject;
+
+          if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
+            # Reject when unknown or invalid according to ROA
+            print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
+            reject;
+          }
+
+          accept;
+        }
+
+        function export_filter() {
+          if ( ! is_valid_network() ) then
+            reject;
+
+          if (source !~ [RTS_STATIC, RTS_BGP]) then
+            reject;
+
+          accept;
+        }
+
+        protocol rpki {
+          roa6 { table dn42_roa; };
+          remote ::1;
+          port 8282;
+          refresh 600;
+          retry 300;
+          expire 7200;
+        }
+
+        protocol device {
+          scan time 10;
+        }
+
+        protocol static {
+          route OWNNET unreachable;
+
+          ipv6 {
+            import all;
+            export none;
+          };
+        }
+
+        protocol kernel {
+          scan time 20;
+
+          ipv6 {
+            import none;
+            export filter {
+              # dont export static routes
+              if source = RTS_STATIC then reject;
+              # preferred outgoing source address
+              krt_prefsrc = OWNIP;
+              accept;
+            };
+          };
+        }
+
+        template bgp dn42_peers {
+          local as OWNAS;
+          path metric 1;
+          advertise hostname on;
+          enforce first as on;
+          med metric on;
+
+          ipv6 {
+            import keep filtered;
+            import limit 9000 action block;
+            import where import_filter();
+            next hop self; # advertise this router as next hop
+
+            export where export_filter();
+          };
+        }
+      ''
+      + (lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (name: peerConfig: ''
+          protocol bgp ${name} from dn42_peers {
+            neighbor ${peerConfig.remoteLinkLocalAddress}%dn42${name} as ${toString peerConfig.asn};
+            enable extended messages;
+          }
+        '') cfg.peerings
+      ))
+      + (lib.optionalString cfg.babel.enable ''
+        /* babel config */
+        protocol direct {
+          ipv6;
+
+          ${lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (name: _peerConfig: ''
+              interface "${name}";
+            '') cfg.babel.peerings
+          )}
+        };
+
+        protocol babel {
+          randomize router id on;
+
+          ipv6 {
+            import where source != RTS_BGP && is_self_net();
+            export where source != RTS_BGP && is_self_net();
+          };
+
+          ${lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (name: peerConfig: ''
+              interface "${name}" {
+                type ${peerConfig.type};
+                next hop prefer ipv6;
+              };
+            '') cfg.babel.peerings
+          )}
+        };
+        /* End of babel config */
+      '');
+    };
+  };
+
+}

diff --git a/nixosModules/common/configure/fonts.nix b/nixosModules/common/configure/fonts.nix
@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.configure.fonts.enable = lib.mkEnableOption "basic font config";
+
+  config = lib.mkIf config.common.configure.fonts.enable {
+    fonts = {
+      fontconfig.enable = true;
+      fontDir.enable = true;
+      enableGhostscriptFonts = true;
+      enableDefaultPackages = true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/configure/locale.nix b/nixosModules/common/configure/locale.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.common.configure.locale.enable = lib.mkEnableOption "locale configuration";
+
+  config = lib.mkIf config.common.configure.locale.enable {
+    time.timeZone = "Europe/Berlin";
+    i18n = {
+      defaultLocale = "en_GB.UTF-8";
+      supportedLocales = [
+        "en_GB.UTF-8/UTF-8"
+        "de_DE.UTF-8/UTF-8"
+      ];
+
+      extraLocaleSettings = {
+        LC_ADDRESS = "de_DE.UTF-8";
+        LC_IDENTIFICATION = "de_DE.UTF-8";
+        LC_MEASUREMENT = "de_DE.UTF-8";
+        LC_MONETARY = "de_DE.UTF-8";
+        LC_NAME = "de_DE.UTF-8";
+        LC_NUMERIC = "en_GB.UTF-8";
+        LC_PAPER = "de_DE.UTF-8";
+        LC_TELEPHONE = "de_DE.UTF-8";
+        LC_TIME = "en_GB.UTF-8";
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/common/configure/nix.nix b/nixosModules/common/configure/nix.nix
@@ -0,0 +1,59 @@
+{
+  npins,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.configure.nix.enable = lib.mkEnableOption "sane nix defaults";
+
+  imports =
+    (lib.mkIf config.common.nix.enable [
+      (import "${npins.lixModule}/module.nix" { lix = null; })
+    ]).content;
+
+  config = lib.mkIf config.common.configure.nix.enable (
+    let
+      NIXPKGS_PATH = lib.cleanSource npins.nixpkgs;
+      NIXPKGS_UNSTABLE_PATH = lib.cleanSource npins.nixpkgsUnstable;
+
+    in
+    {
+      nix = {
+        package = pkgs.lix;
+        nixPath = lib.mkForce [ "nixpkgs=${NIXPKGS_PATH}" ];
+        channel.enable = lib.mkForce false;
+
+        registry = {
+          nixpkgs.to = {
+            type = "path";
+            path = NIXPKGS_PATH;
+          };
+
+          nixpkgsUnstable.to = {
+            type = "path";
+            path = NIXPKGS_UNSTABLE_PATH;
+          };
+        };
+
+        settings = {
+          nix-path = config.nix.nixPath;
+          trusted-users = [ "@wheel" ];
+          use-xdg-base-directories = true;
+          experimental-features = [
+            "flakes"
+            "nix-command"
+          ];
+        };
+      };
+
+      environment.sessionVariables = {
+        inherit NIXPKGS_PATH NIXPKGS_UNSTABLE_PATH;
+      };
+    }
+  );
+
+}

diff --git a/nixosModules/common/configure/persist.nix b/nixosModules/common/configure/persist.nix
@@ -0,0 +1,167 @@
+{
+  npins,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+
+  cfg = config.common.configure.persist;
+
+  perms = {
+    user = lib.mkOption {
+      type = types.str;
+      default = "root";
+    };
+    group = lib.mkOption {
+      type = types.str;
+      default = "root";
+    };
+    mode = lib.mkOption {
+      type = with types; nullOr str;
+      default = null;
+    };
+  };
+
+in
+{
+
+  options.common.configure.persist = {
+    home.enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+    };
+    system = {
+      enable = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      dirs = lib.mkOption {
+        default = [ ];
+        type =
+          with types;
+          listOf (oneOf [
+            str
+            (submodule {
+              options = {
+                directory = lib.mkOption { type = types.str; };
+              }
+              // perms;
+            })
+          ]);
+      };
+      files = lib.mkOption {
+        default = [ ];
+        type =
+          with types;
+          listOf (oneOf [
+            str
+            (submodule {
+              options = {
+                file = lib.mkOption { type = types.str; };
+                parentDirectory = lib.mkOption {
+                  type = with types; nullOr (submodule perms);
+                  default = null;
+                };
+              }
+              // perms;
+            })
+          ]);
+      };
+
+    };
+  };
+
+  imports =
+    (lib.mkIf cfg.enable [
+      "${npins.preservation}/module.nix"
+    ]).content;
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.home.enable {
+      common.configure.rootDisk.subVolumes.home = true;
+      programs.fuse.userAllowOther = lib.mkDefault true;
+      preservation.enable = true;
+      preservation.preserveAt."/persist" = { };
+    })
+    (lib.mkIf cfg.system.enable {
+      common.configure.rootDisk.subVolumes.system = true;
+
+      boot.initrd.systemd.services.defenestrate = {
+        description = "Defenestrate old btrfs-root";
+        wantedBy = [ "initrd.target" ];
+        after = [ "cryptsetup.target" ];
+        before = [ "sysroot.mount" ];
+        onFailure = [ "emergency.target" ];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir -p /btrfs_tmp
+          mount -o "subvol=/" /dev/mapper/root /btrfs_tmp
+
+          ${lib.getExe pkgs.btrfs-progs} subvolume delete --recursive /btrfs_tmp/nixos-root-4
+
+          mv /btrfs_tmp/nixos-root-3 /btrfs_tmp/nixos-root-4
+          mv /btrfs_tmp/nixos-root-2 /btrfs_tmp/nixos-root-3
+          mv /btrfs_tmp/nixos-root-1 /btrfs_tmp/nixos-root-2
+
+          ${lib.getExe pkgs.btrfs-progs} subvolume create /btrfs_tmp/nixos-root-1
+          ${lib.getExe pkgs.btrfs-progs} subvolume set-default /btrfs_tmp/nixos-root-1
+
+          umount /btrfs_tmp
+        '';
+      };
+
+      systemd.tmpfiles.rules = [
+        "d /var/lib/private 0700 root root"
+      ];
+      systemd.services = lib.genAttrs [ "sops-install-secrets" "sops-install-secrets-for-users" ] (_: {
+        unitConfig.RequiresMountsFor = [ "/persist/system" ];
+      });
+
+      systemd.tmpfiles.settings.preservation =
+        let
+          directories = map (
+            elem: if (lib.isAttrs elem) then elem.directory else elem
+          ) config.preservation.preserveAt."/persist/system".directories;
+        in
+        lib.genAttrs (lib.filter (elem: lib.hasPrefix "/var/lib/private/" elem) directories) (name: {
+          "d" = {
+            type = "!d";
+            mode = lib.mkForce "0700";
+          };
+        });
+
+      preservation.enable = true;
+      preservation.preserveAt."/persist/system" = {
+        directories = [
+          "/var/log"
+          "/var/lib/systemd/coredump"
+          "/var/lib/systemd/rfkill"
+          "/var/lib/systemd/timers"
+          {
+            directory = "/var/lib/nixos";
+            inInitrd = true;
+          }
+          # {
+          #   directory = "/var/lib/private";
+          #   mode = "0700";
+          # }
+        ]
+        ++ cfg.system.dirs;
+        files = [
+          {
+            file = "/var/lib/systemd/random-seed";
+            how = "symlink";
+            inInitrd = true;
+            configureParent = true;
+          }
+        ]
+        ++ cfg.system.files;
+      };
+    })
+  ];
+
+}

diff --git a/nixosModules/common/configure/primaryNetworkInterface.nix b/nixosModules/common/configure/primaryNetworkInterface.nix
@@ -0,0 +1,94 @@
+{
+  machineConfig,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.configure.primaryNetworkInterface;
+
+in
+{
+
+  options.common.configure.primaryNetworkInterface = {
+    enable = lib.mkEnableOption "configuration of the primary network interface";
+    interfaceName = lib.mkOption {
+      type = types.str;
+      default = machineConfig.networking.primaryInterface;
+    };
+    dnsServers = lib.mkOption {
+      type = with types; listOf str;
+      default = [
+        "1.1.1.1"
+        "8.8.8.8"
+        "9.9.9.9"
+      ];
+    };
+    useDHCP = lib.mkOption {
+      type = types.bool;
+      default = if (cfg.ip4Address != null) then false else true;
+    };
+    acceptRouterAdvertisements = lib.mkOption {
+      type = types.bool;
+      default = if (cfg.ip6Address != null) then false else true;
+    };
+    ip4Address = lib.mkOption {
+      type = with types; nullOr str;
+      default =
+        if (machineConfig.networking ? ip4Address && machineConfig.networking ? ip4PrefixLength) then
+          "${machineConfig.networking.ip4Address}/${toString machineConfig.networking.ip4PrefixLength}"
+        else
+          null;
+    };
+    ip4DefaultGateway = lib.mkOption {
+      type = with types; nullOr str;
+      default =
+        if machineConfig.networking ? defaultGateway4 then
+          machineConfig.networking.defaultGateway4
+        else
+          null;
+    };
+    ip6Address = lib.mkOption {
+      type = with types; nullOr str;
+      default =
+        if (machineConfig.networking ? ip6Address && machineConfig.networking ? ip6PrefixLength) then
+          "${machineConfig.networking.ip6Address}/${toString machineConfig.networking.ip6PrefixLength}"
+        else
+          null;
+    };
+    ip6DefaultGateway = lib.mkOption {
+      type = with types; nullOr str;
+      default =
+        if machineConfig.networking ? defaultGateway6 then
+          machineConfig.networking.defaultGateway6
+        else
+          null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.network = {
+      networks = {
+        "5-primaryInterface" = {
+          enable = true;
+          name = cfg.interfaceName;
+          networkConfig = {
+            DHCP = cfg.useDHCP;
+            IPv6AcceptRA = cfg.acceptRouterAdvertisements;
+          };
+          dns = cfg.dnsServers;
+          gateway = [
+            (lib.mkIf (cfg.ip4DefaultGateway != null) cfg.ip4DefaultGateway)
+            (lib.mkIf (cfg.ip6DefaultGateway != null) cfg.ip6DefaultGateway)
+          ];
+          address = [
+            (lib.mkIf (cfg.ip4Address != null) cfg.ip4Address)
+            (lib.mkIf (cfg.ip6Address != null) cfg.ip6Address)
+          ];
+        };
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/common/configure/rootDisk.nix b/nixosModules/common/configure/rootDisk.nix
@@ -0,0 +1,185 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.configure.rootDisk;
+  users = lib.pipe config.common.users [
+    (lib.mapAttrsToList (name: value: if value.enable then name else null))
+    (lib.filter (element: !builtins.isNull element))
+  ];
+  partOpts = [
+    "compress=zstd"
+    "discard=async"
+  ];
+
+in
+{
+
+  options.common.configure.rootDisk = {
+    enable = lib.mkOption {
+      type = types.bool;
+      default = false;
+    };
+    subVolumes = {
+      nix = lib.mkOption {
+        type = types.bool;
+        default = true;
+      };
+      home = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      homePerUser = lib.mkOption {
+        type = types.bool;
+        default = cfg.subVolumes.home;
+      };
+      tmp = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      system = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+    };
+    swap = {
+      enable = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      size = lib.mkOption {
+        type = types.strMatching "[0-9]+[KMGTP]";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      askPass = pkgs.writeShellScriptBin "cryptsetup-askpass" "systemctl default";
+    in
+    {
+      boot = {
+        supportedFilesystems = [ "btrfs" ];
+        initrd = {
+          luks.devices."root".device = "/dev/disk/by-partlabel/${config.networking.hostName}-root";
+
+          availableKernelModules = [
+            "btrfs"
+            "ipv6"
+          ];
+
+          systemd = {
+            enable = lib.mkDefault true;
+            network = lib.mkIf config.systemd.network.enable config.systemd.network;
+            storePaths = [ "${askPass}/bin/cryptsetup-askpass" ];
+            users.root.shell = "${askPass}/bin/cryptsetup-askpass";
+          };
+
+          network = {
+            enable = lib.mkDefault true;
+            ssh = {
+              enable = lib.mkDefault true;
+              port = 22;
+              hostKeys = lib.mkDefault (lib.map (element: element.path) config.services.openssh.hostKeys);
+              authorizedKeys =
+                with lib;
+                concatLists (
+                  mapAttrsToList (
+                    name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
+                  ) config.users.users
+                );
+            };
+          };
+        };
+      };
+
+      services.btrfs.autoScrub.enable = true;
+
+      swapDevices = lib.singleton { device = lib.mkIf cfg.swap.enable "/swap/swapfile"; };
+
+      fileSystems = lib.mkMerge [
+        {
+          "/" = {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = partOpts;
+          };
+          "/boot" = {
+            device = "/dev/disk/by-partlabel/${config.networking.hostName}-boot";
+            fsType = "vfat";
+            options = [
+              "nofail"
+              "umask=0077"
+              "dmask=0077"
+            ];
+          };
+          "/tmp" = lib.mkIf cfg.subVolumes.tmp {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = [
+              "subvol=nix"
+              "nosuid"
+              "nodev"
+            ];
+          };
+          "/nix" = lib.mkIf cfg.subVolumes.nix {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = [
+              "subvol=nix"
+              "noatime"
+            ]
+            ++ partOpts;
+          };
+          "/persist/system" = lib.mkIf cfg.subVolumes.system {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = [
+              "subvol=system"
+              "noatime"
+            ]
+            ++ partOpts;
+          };
+          "/persist/home" = lib.mkIf (cfg.subVolumes.home && !cfg.subVolumes.homePerUser) {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = [
+              "subvol=home"
+            ]
+            ++ partOpts;
+          };
+          "/swap" = lib.mkIf cfg.swap.enable {
+            device = "/dev/mapper/root";
+            fsType = "btrfs";
+            options = [
+              "subvol=swap"
+              "noatime"
+              "discard=async"
+            ];
+          };
+        }
+        (lib.mkIf cfg.subVolumes.homePerUser (
+          lib.listToAttrs (
+            lib.map (user: {
+              name =
+                if config.common.configure.persist.home.enable then "/persist/home/${user}" else "/home/${user}";
+              value = {
+                device = "/dev/mapper/root";
+                fsType = "btrfs";
+                options = [
+                  "subvol=home-${user}"
+                ]
+                ++ partOpts;
+              };
+            }) users
+          )
+        ))
+      ];
+    }
+  );
+
+}

diff --git a/nixosModules/common/configure/sops.nix b/nixosModules/common/configure/sops.nix
@@ -0,0 +1,22 @@
+{
+  sopsSecrets,
+  npins,
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.common.configure.sops.enable = lib.mkEnableOption "sops secrets";
+
+  imports =
+    (lib.mkIf config.common.configure.sops.enable [
+      "${npins.sopsNix}/modules/sops"
+    ]).content;
+
+  config = lib.mkIf config.common.configure.sops.enable {
+    sops.defaultSopsFile = sopsSecrets.${config.networking.hostName};
+  };
+
+}

diff --git a/nixosModules/common/hardware/audio.nix b/nixosModules/common/hardware/audio.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+
+  options.common.hardware.audio.enable = lib.mkEnableOption "basic pipewire config";
+
+  config = lib.mkIf config.common.hardware.audio.enable {
+    security.rtkit.enable = true;
+
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      pulse.enable = true;
+      wireplumber.enable = true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/hardware/bluetooth.nix b/nixosModules/common/hardware/bluetooth.nix
@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.hardware.bluetooth.enable = lib.mkEnableOption "bluetooth foo";
+
+  config = lib.mkIf config.common.hardware.bluetooth.enable {
+    common.configure.persist.system.dirs = [
+      "/var/lib/bluetooth"
+    ];
+
+    hardware.bluetooth = {
+      enable = true;
+      powerOnBoot = lib.mkDefault false;
+      settings.General.Experimental = lib.mkDefault true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/hardware/fprint.nix b/nixosModules/common/hardware/fprint.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.hardware.fingerprint;
+
+in
+{
+
+  options.common.hardware.fingerprint.enable = lib.mkEnableOption "fingerprint sensor support";
+
+  config = lib.mkIf cfg.enable {
+    services.fprintd.enable = true;
+
+    common.configure.persist.system.dirs = [
+      "/var/lib/fprint"
+    ];
+  };
+
+}

diff --git a/nixosModules/common/hardware/intelGraphics.nix b/nixosModules/common/hardware/intelGraphics.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.hardware.intelGraphics.enable = lib.mkEnableOption "intel gpu drivers";
+
+  config = lib.mkIf config.common.hardware.intelGraphics.enable {
+    boot.initrd.kernelModules = [ "i915" ];
+
+    hardware.graphics = {
+      enable = true;
+      extraPackages = with pkgs; [
+        vpl-gpu-rt
+        intel-media-driver
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/common/hardware/quirks.nix b/nixosModules/common/hardware/quirks.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.common.hardware.quirks;
+
+in
+{
+
+  options.common.hardware.quirks = {
+    thinkpad.enable = lib.mkEnableOption "thinkpad quirks";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.thinkpad.enable {
+      boot.extraModprobeConfig = ''
+        options thinkpad_acpi fan_control=1
+      '';
+    })
+  ];
+}

diff --git a/nixosModules/common/hardware/smartcard.nix b/nixosModules/common/hardware/smartcard.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  options.common.hardware.smartcard.enable = lib.mkEnableOption "smartcard spport";
+
+  config = lib.mkIf config.common.hardware.smartcard.enable {
+    services = {
+      pcscd.enable = true;
+      udev.packages = with pkgs; [ libu2f-host ];
+      dbus.packages = with pkgs; [ gcr ];
+    };
+  };
+
+}

diff --git a/nixosModules/common/hardware/thunderbolt.nix b/nixosModules/common/hardware/thunderbolt.nix
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.hardware.thunderbolt.enable = lib.mkEnableOption "thundebolt support";
+
+  config = lib.mkIf config.common.hardware.thunderbolt.enable {
+    boot.initrd.availableKernelModules = [ "thunderbolt" ];
+    services.hardware.bolt.enable = true;
+  };
+
+}

diff --git a/nixosModules/common/profiles/amdCpu.nix b/nixosModules/common/profiles/amdCpu.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.common.profiles.amdCpu.enable = lib.mkEnableOption "amd-cpu profile";
+
+  config = lib.mkIf config.common.profiles.amdCpu.enable {
+    hardware.cpu.amd.updateMicrocode = true;
+
+    boot = {
+      kernelParams = [ "amd_pstate=active" ];
+      kernelModules = [
+        "kvm-amd"
+        "amd-pstate"
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/common/profiles/base.nix b/nixosModules/common/profiles/base.nix
@@ -0,0 +1,103 @@
+{
+  pkgs,
+  lib,
+  config,
+  machineConfig,
+  ...
+}:
+
+{
+
+  options.common.profiles.base.enable = lib.mkEnableOption "base profile";
+
+  config = lib.mkIf config.common.profiles.base.enable {
+    boot.kernel.sysctl."kernel.sysrq" = lib.mkDefault 1;
+
+    # make things more declerative
+    services.userborn.enable = lib.mkDefault true;
+    #users.mutableUsers = lib.mkForce false;
+
+    networking = {
+      hostId = builtins.substring 0 8 (builtins.hashString "sha256" machineConfig.machineName);
+      hostName = machineConfig.machineName;
+      domain = lib.mkDefault machineConfig.domain;
+
+      useNetworkd = lib.mkDefault true;
+      useDHCP = lib.mkDefault false;
+
+      nftables.enable = lib.mkDefault true;
+      firewall.enable = lib.mkDefault true;
+    };
+
+    hardware.enableRedistributableFirmware = true;
+
+    common = {
+      profiles = {
+        amdCpu.enable = lib.mkDefault (machineConfig.hardware.cpuVendor == "amd");
+        intelCpu.enable = lib.mkDefault (machineConfig.hardware.cpuVendor == "intel");
+      };
+
+      configure = {
+        boot.enable = lib.mkDefault true;
+
+        locale.enable = lib.mkDefault true;
+        sops.enable = lib.mkDefault true;
+
+        nix.enable = true;
+      };
+
+      services = {
+        openssh.enable = true;
+      };
+
+      security = {
+        nix.enable = lib.mkDefault true;
+        kernel.enable = lib.mkDefault true;
+        networking.enable = lib.mkDefault true;
+      };
+
+      programs = {
+        shellUtilities.enable = lib.mkDefault true;
+        systemUtilities.enable = lib.mkDefault true;
+        networkUtilities.enable = lib.mkDefault true;
+
+        fish.enable = lib.mkDefault true;
+      };
+    };
+
+    programs = {
+      command-not-found.enable = false; # Not usable without channels; use nix-index instead.
+    };
+
+    services = {
+      dbus.implementation = "broker";
+    };
+
+    security.sudo.extraConfig = "Defaults lecture=\"never\""; # "We trust you have received the usual lecture from the local System Administrator."
+
+    system = {
+      stateVersion = lib.mkDefault "25.11";
+
+      # thanks piegames (https://git.darmstadt.ccc.de/piegames/home-config/-/blob/master/modules/generic.nix#L84)
+      activationScripts = {
+        diff = {
+          supportsDryActivation = true;
+          text = ''
+            ${pkgs.nvd}/bin/nvd --color=always --nix-bin-dir=${pkgs.nix}/bin diff "$(readlink /run/current-system)" "$systemConfig"
+            # Ignore "failures" because these tools have weird exit codes
+            ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
+              -- "$(readlink /run/current-system)/activate" "$systemConfig/activate" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
+            ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
+              -x "os-release" -x "issue" \
+              -- "$(readlink /run/current-system)/etc" "$systemConfig/etc" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
+            ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
+              -x "environment.d" \
+              -x "hwdb.d" \
+              -- "$(readlink /run/current-system)/systemd" "$systemConfig/systemd" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
+          '';
+        };
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/common/profiles/intelCpu.nix b/nixosModules/common/profiles/intelCpu.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.common.profiles.intelCpu.enable = lib.mkEnableOption "intel-cpu profile";
+
+  config = lib.mkIf config.common.profiles.intelCpu.enable {
+    boot.initrd.kernelModules = [ "kvm-intel" ];
+
+    hardware.cpu.intel.updateMicrocode = true;
+  };
+
+}

diff --git a/nixosModules/common/profiles/minimal.nix b/nixosModules/common/profiles/minimal.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  ...
+}:
+
+{
+
+  options.common.profiles.minimal.enable = lib.mkEnableOption "minimal system profile";
+
+  config = lib.mkIf config.common.profiles.minimal.enable {
+    boot.enableContainers = lib.mkDefault false;
+
+    system.disableInstallerTools = lib.mkDefault true;
+
+    documentation = {
+      enable = lib.mkDefault false;
+      doc.enable = lib.mkDefault false;
+      info.enable = lib.mkDefault false;
+      man.enable = lib.mkDefault false;
+      nixos.enable = lib.mkDefault false;
+    };
+
+    environment = {
+      defaultPackages = lib.mkDefault [ ];
+      stub-ld.enable = lib.mkDefault false;
+    };
+
+    programs = {
+      less.lessopen = lib.mkDefault null;
+      command-not-found.enable = lib.mkDefault false;
+      fish.generateCompletions = lib.mkDefault false;
+    };
+
+    services = {
+      logrotate.enable = lib.mkDefault false;
+      udisks2.enable = lib.mkDefault false;
+    };
+
+    xdg = {
+      autostart.enable = lib.mkDefault false;
+      icons.enable = lib.mkDefault false;
+      mime.enable = lib.mkDefault false;
+      sounds.enable = lib.mkDefault false;
+    };
+  };
+
+}

diff --git a/nixosModules/common/profiles/netcup.nix b/nixosModules/common/profiles/netcup.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.common.profiles.netcup.enable = lib.mkEnableOption "netcup vserver profile";
+
+  config = lib.mkIf config.common.profiles.netcup.enable {
+    boot = {
+      initrd.availableKernelModules = [
+        "ata_piix"
+        "uhci_hcd"
+        "virtio_pci"
+        "sr_mod"
+        "virtio_blk"
+      ];
+    };
+
+    common.configure.primaryNetworkInterface = {
+      interfaceName = "ens3";
+      ip6DefaultGateway = "fe80::1";
+      dnsServers = [
+        "46.38.225.230"
+        "46.38.252.230"
+        "2a03:4000:0:1::e1e6"
+        "2a03:4000:8000::fce6"
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/common/profiles/nvme.nix b/nixosModules/common/profiles/nvme.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.profiles.nvme.enable = lib.mkEnableOption "nvme profile";
+
+  config = lib.mkIf config.common.profiles.nvme.enable {
+    boot.initrd.availableKernelModules = [ "nvme" ];
+
+    environment.systemPackages = [ pkgs.nvme-cli ];
+  };
+
+}

diff --git a/nixosModules/common/programs/fish.nix b/nixosModules/common/programs/fish.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.programs.fish.enable = lib.mkEnableOption "fish shell";
+
+  config = lib.mkIf config.common.programs.fish.enable {
+    programs.fish.enable = true;
+    users.defaultUserShell = pkgs.fish;
+  };
+
+}

diff --git a/nixosModules/common/programs/networkUtilities.nix b/nixosModules/common/programs/networkUtilities.nix
@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.programs.networkUtilities.enable = lib.mkEnableOption "useful network-utilities";
+
+  config = lib.mkIf config.common.programs.networkUtilities.enable {
+    environment.systemPackages = with pkgs; [
+      dig
+      nmap
+      openssh
+      whois
+    ];
+
+    programs = {
+      mtr.enable = true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/programs/niri.nix b/nixosModules/common/programs/niri.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  options.common.programs.niri.enable = lib.mkEnableOption "niri";
+  config = lib.mkIf config.common.programs.niri.enable {
+    programs.niri.enable = true;
+
+    systemd.user.services."niri" = {
+      # Niri ships with a `niri.service` unit, so the configuration here is
+      # actually a drop-in override. Environment variables here should be forced
+      # to be `{ }`, otherwise a default `PATH` for services is injected here,
+      # clearing all inherited paths and making the WM totally unuseable without
+      # `/run/current-system/sw/bin`, `q/etc/profiles/per-user/<username>/bin` and
+      # potentially other paths.
+      environment = lib.mkForce { };
+      bindsTo = [
+        "graphical-session.target"
+        "niri-session.target"
+      ];
+      before = [
+        "graphical-session.target"
+        "niri-session.target"
+      ];
+    };
+
+    systemd.user.targets."niri-session" = {
+      description = "Current Niri graphical user session";
+      documentation = [ "man:systemd.special(7)" ];
+      requires = [ "basic.target" ];
+      unitConfig.RefuseManualStart = true;
+      unitConfig.StopWhenUnneeded = true;
+    };
+
+    # `maid-activation.service` finishes before `graphical-session-pre.target`,
+    # so services dependent on a graphical environment won't run without another
+    # activation.
+    # See <https://github.com/viperML/nix-maid/issues/53>.
+    systemd.user.services."maid-graphical-session-activation" = {
+      wantedBy = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart maid-activation.service";
+      serviceConfig.RemainAfterExit = true;
+    };
+
+    # `nixos-fake-graphical-session.target` breaks some default systemd targets'
+    # semantics, such as `graphical-session.target`, when using most WMs.
+    # See <https://github.com/viperML/nix-maid/issues/56>
+    systemd.user.targets."nixos-fake-graphical-session".enable = false;
+  };
+}

diff --git a/nixosModules/common/programs/nixUtilities.nix b/nixosModules/common/programs/nixUtilities.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.programs.nixUtilities.enable = lib.mkEnableOption "useful nix utilities";
+
+  config = lib.mkIf config.common.programs.nixUtilities.enable {
+    environment.systemPackages = with pkgs; [
+      deadnix
+      nixfmt-rfc-style
+      nixfmt-tree
+      nixd
+      statix
+      nh
+    ];
+  };
+
+}

diff --git a/nixosModules/common/programs/shellUtilities.nix b/nixosModules/common/programs/shellUtilities.nix
@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.programs.shellUtilities.enable = lib.mkEnableOption "useful shell-utilities";
+
+  config = lib.mkIf config.common.programs.shellUtilities.enable {
+    environment = {
+      systemPackages = with pkgs; [
+        eza
+        micro
+        file
+        nmap
+        nvd
+        openssh
+        openssl
+        p7zip
+        unzip
+        progress
+        sops
+        rsync
+        zpha.nix-cleanup
+      ];
+    };
+
+    programs = {
+      bat.enable = true;
+      nano.enable = true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/programs/systemUtilities.nix b/nixosModules/common/programs/systemUtilities.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.programs.systemUtilities.enable = lib.mkEnableOption "system utilities";
+
+  config = lib.mkIf config.common.programs.systemUtilities.enable {
+    environment.systemPackages = with pkgs; [
+      fastfetch
+      pciutils
+      usbutils
+    ];
+
+    programs = {
+      htop.enable = true;
+    };
+  };
+
+}

diff --git a/nixosModules/common/security/kernel.nix b/nixosModules/common/security/kernel.nix
@@ -0,0 +1,77 @@
+{
+  machineConfig,
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.security.kernel.enable = lib.mkEnableOption "enhanced kernel security";
+
+  config = lib.mkIf config.common.security.kernel.enable {
+    environment = {
+      # memoryAllocator.provider = mkDefault "scudo"; # Breaks stuff
+      # variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1"; # Breaks stuff
+    };
+
+    boot = {
+      blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
+      kernel.sysctl = {
+        "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
+        "kernel.kptr_restrict" = lib.mkOverride 500 2;
+        "net.core.bpf_jit_enable" = lib.mkDefault false;
+        "kernel.ftrace_enabled" = lib.mkDefault false;
+      };
+      kernelParams = lib.mkMerge [
+        [
+          # Slab/slub sanity checks, redzoning, and poisoning
+          "slub_debug=FZP"
+
+          # Overwrite free'd memory
+          "page_poison=1"
+
+          # Enable page allocator randomization
+          "page_alloc.shuffle=1"
+        ]
+
+        # Disable hibernation (allows replacing the running kernel) unless requested
+        (lib.mkIf (!machineConfig.hardware.allowHibernation) [ "nohibernate" ])
+      ];
+    };
+
+    # Disable kernel module loading once the system is fully initialised.
+    # FIXME: Remove reverse dependencies
+    security.lockKernelModules = lib.mkDefault false;
+    # Prevent replacing the running kernel image w/o reboot
+    boot.kernel.sysctl."kernel.kexec_load_disabled" = lib.mkDefault true;
+  };
+
+}

diff --git a/nixosModules/common/security/networking.nix b/nixosModules/common/security/networking.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.security.networking.enable = lib.mkEnableOption "enhanced networking security";
+
+  config = lib.mkIf config.common.security.networking.enable {
+    boot.kernel.sysctl = {
+      # Enable strict reverse path filtering (that is, do not attempt to route
+      # packets that "obviously" do not belong to the iface's network; dropped
+      # packets are logged as martians).
+      "net.ipv4.conf.all.log_martians" = lib.mkDefault true;
+      "net.ipv4.conf.all.rp_filter" = lib.mkDefault "1";
+      "net.ipv4.conf.default.log_martians" = lib.mkDefault true;
+      "net.ipv4.conf.default.rp_filter" = lib.mkDefault "1";
+
+      # Ignore broadcast ICMP (mitigate SMURF)
+      "net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault true;
+
+      # Ignore incoming ICMP redirects (note: default is needed to ensure that the
+      # setting is applied to interfaces added after the sysctls are set)
+      "net.ipv4.conf.all.accept_redirects" = lib.mkDefault false;
+      "net.ipv4.conf.all.secure_redirects" = lib.mkDefault false;
+      "net.ipv4.conf.default.accept_redirects" = lib.mkDefault false;
+      "net.ipv4.conf.default.secure_redirects" = lib.mkDefault false;
+      "net.ipv6.conf.all.accept_redirects" = lib.mkDefault false;
+      "net.ipv6.conf.default.accept_redirects" = lib.mkDefault false;
+
+      # Ignore outgoing ICMP redirects (this is ipv4 only)
+      "net.ipv4.conf.all.send_redirects" = lib.mkDefault false;
+      "net.ipv4.conf.default.send_redirects" = lib.mkDefault false;
+    };
+  };
+
+}

diff --git a/nixosModules/common/security/nix.nix b/nixosModules/common/security/nix.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.security.nix.enable = lib.mkEnableOption "enhanced nix security";
+
+  config = lib.mkIf config.common.security.nix.enable {
+    users.groups.nix = { };
+
+    nix.settings.allowed-users = lib.mkForce [
+      "@users"
+      "@nix"
+    ];
+  };
+
+}

diff --git a/nixosModules/common/services/NetworkManager.nix b/nixosModules/common/services/NetworkManager.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+
+  options.common.services.NetworkManager.enable = lib.mkEnableOption "NetworkManager";
+
+  config = lib.mkIf config.common.services.NetworkManager.enable {
+    common.configure.persist.system.dirs = [
+      "/var/lib/NetworkManager"
+      "/etc/NetworkManager/system-connections"
+    ];
+
+    networking.networkmanager.enable = true;
+  };
+
+}

diff --git a/nixosModules/common/services/gitolite.nix b/nixosModules/common/services/gitolite.nix
@@ -0,0 +1,241 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.gitolite;
+
+in
+{
+
+  options.common.services.gitolite = {
+    enable = lib.mkEnableOption "gitolite git server";
+
+    dataDir = lib.mkOption {
+      type = types.str;
+      default = "/var/lib/gitolite";
+    };
+
+    adminPubkey = lib.mkOption {
+      type = types.str;
+    };
+
+    commonHooks = lib.mkOption {
+      type = types.attrsOf types.lines;
+      default = { };
+    };
+
+    triggers = lib.mkOption {
+      type = types.attrsOf types.lines;
+      default = { };
+    };
+
+    commands = lib.mkOption {
+      type = types.attrsOf types.lines;
+      default = { };
+    };
+
+    extraGitoliteRc = lib.mkOption {
+      type = types.lines;
+      default = "";
+    };
+
+    user = lib.mkOption {
+      type = types.str;
+      default = "gitolite";
+    };
+
+    group = lib.mkOption {
+      type = types.str;
+      default = "gitolite";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      # Use writeTextDir to not leak Nix store hash into file name
+      pubkeyFile = (pkgs.writeTextDir "gitolite-admin.pub" cfg.adminPubkey) + "/gitolite-admin.pub";
+      hooks = lib.mapAttrs (
+        name: script:
+        (pkgs.writeShellScript name (
+          if name == "post-receive" then
+            ''
+              read oldrev newrev ref
+              [ -t 0 ] || cat >/dev/null
+              [ -z "$GL_REPO" ] && die GL_REPO not set
+
+            ''
+            + script
+          else
+            script
+        ))
+      ) cfg.commonHooks;
+      triggers = lib.mapAttrs (name: script: (pkgs.writeShellScript name script)) cfg.triggers;
+      commands = lib.mapAttrs (name: script: (pkgs.writeShellScript name script)) cfg.commands;
+      manageGitoliteRc = cfg.extraGitoliteRc != "";
+      rcDir = pkgs.runCommand "gitolite-rc" {
+        preferLocalBuild = true;
+      } rcDirScript;
+      rcDirScript = ''
+        mkdir "$out"
+        export HOME=temp-home
+        mkdir -p "$HOME/.gitolite/logs" # gitolite can't run without it
+        '${pkgs.gitolite}'/bin/gitolite print-default-rc >>"$out/gitolite.rc.default"
+        cat <<END >>"$out/gitolite.rc"
+        # This file is managed by NixOS.
+        # Use services.gitolite options to control it.
+
+        END
+        cat "$out/gitolite.rc.default" >>"$out/gitolite.rc"
+      ''
+      + lib.optionalString (cfg.extraGitoliteRc != "") ''
+        echo -n ${lib.escapeShellArg ''
+
+          # Added by NixOS:
+          ${lib.removeSuffix "\n" cfg.extraGitoliteRc}
+
+          # per perl rules, this should be the last line in such a file:
+          1;
+        ''} >>"$out/gitolite.rc"
+      '';
+
+    in
+    {
+      common.configure.persist.system.dirs = [
+        {
+          directory = cfg.dataDir;
+          mode = "0755";
+          inherit (cfg) user;
+          inherit (cfg) group;
+        }
+      ];
+
+      common.services.gitolite.extraGitoliteRc = ''
+        $RC{LOCAL_CODE} = "$ENV{HOME}/.gitolite/local";
+      '';
+
+      users.users.${cfg.user} = {
+        home = cfg.dataDir;
+        uid = config.ids.uids.gitolite;
+        inherit (cfg) group;
+        extraGroups = [ "ssh" ];
+        useDefaultShell = true;
+        packages = [
+          pkgs.gitolite
+          pkgs.git
+          pkgs.perl
+        ];
+      };
+
+      users.groups.${cfg.group}.gid = config.ids.gids.gitolite;
+
+      systemd.services.gitolite-init = {
+        description = "Gitolite initialization";
+        wantedBy = [ "multi-user.target" ];
+        unitConfig.RequiresMountsFor = cfg.dataDir;
+
+        environment = {
+          GITOLITE_RC = ".gitolite.rc";
+          GITOLITE_RC_DEFAULT = "${rcDir}/gitolite.rc.default";
+        };
+
+        serviceConfig = lib.mkMerge [
+          (lib.mkIf (cfg.dataDir == "/var/lib/gitolite") {
+            StateDirectory = "gitolite gitolite/.gitolite gitolite/.gitolite/logs";
+            StateDirectoryMode = "0750";
+          })
+          {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            WorkingDirectory = "~";
+            RemainAfterExit = true;
+          }
+        ];
+
+        path = [
+          pkgs.gitolite
+          pkgs.git
+          pkgs.perl
+          pkgs.bash
+          pkgs.diffutils
+          config.programs.ssh.package
+        ];
+        script =
+          let
+            rcSetupScriptIfCustomFile =
+              if manageGitoliteRc then
+                ''
+                  cat <<END
+                  <3>ERROR: NixOS can't apply declarative configuration
+                  <3>to your .gitolite.rc file, because it seems to be
+                  <3>already customized manually.
+                  <3>See the services.gitolite.extraGitoliteRc option
+                  <3>in "man configuration.nix" for more information.
+                  END
+                  # Not sure if the line below addresses the issue directly or just
+                  # adds a delay, but without it our error message often doesn't
+                  # show up in `systemctl status gitolite-init`.
+                  journalctl --flush
+                  exit 1
+                ''
+              else
+                ''
+                  :
+                '';
+            rcSetupScriptIfDefaultFileOrStoreSymlink =
+              if manageGitoliteRc then
+                ''
+                  ln -sf "${rcDir}/gitolite.rc" "$GITOLITE_RC"
+                ''
+              else
+                ''
+                  [[ -L "$GITOLITE_RC" ]] && rm -f "$GITOLITE_RC"
+                '';
+          in
+          ''
+            if ( [[ ! -e "$GITOLITE_RC" ]] && [[ ! -L "$GITOLITE_RC" ]] ) ||
+               ( [[ -f "$GITOLITE_RC" ]] && diff -q "$GITOLITE_RC" "$GITOLITE_RC_DEFAULT" >/dev/null ) ||
+               ( [[ -L "$GITOLITE_RC" ]] && [[ "$(readlink "$GITOLITE_RC")" =~ ^/nix/store/ ]] )
+            then
+          ''
+          + rcSetupScriptIfDefaultFileOrStoreSymlink
+          + ''
+            else
+          ''
+          + rcSetupScriptIfCustomFile
+          + ''
+            fi
+
+            if [ ! -d repositories ]; then
+              gitolite setup -pk ${pubkeyFile}
+            fi
+
+            rm -rf   .gitolite/local/hooks/common/
+            mkdir -p .gitolite/local/hooks/common/
+            ${lib.concatStringsSep "\n" (
+              lib.mapAttrsToList (name: script: "ln -s ${script} .gitolite/local/hooks/common/${name}") hooks
+            )}
+
+            rm -rf .gitolite/local/triggers/
+            mkdir -p .gitolite/local/triggers/
+            ${lib.concatStringsSep "\n" (
+              lib.mapAttrsToList (name: script: "ln -s ${script} .gitolite/local/triggers/${name}") triggers
+            )}
+
+            rm -rf .gitolite/local/commands/
+            mkdir -p .gitolite/local/commands/
+            ${lib.concatStringsSep "\n" (
+              lib.mapAttrsToList (name: script: "ln -s ${script} .gitolite/local/commands/${name}") commands
+            )}
+
+            gitolite setup # Upgrade if needed
+          '';
+      };
+    }
+  );
+
+}

diff --git a/nixosModules/common/services/gotosocial.nix b/nixosModules/common/services/gotosocial.nix
@@ -0,0 +1,248 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.gotosocial;
+
+  settingsFormat = pkgs.formats.yaml { };
+  defaultSettings = {
+    # Defaults
+    application-name = "gotosocial";
+    protocol = "https";
+
+    bind-address = "127.0.0.1";
+    port = 8080;
+
+    user = cfg.user;
+    group = cfg.group;
+
+    storage-local-base-path = cfg.stateDir;
+
+    db-type = "sqlite";
+    db-address = "${cfg.stateDir}/database.sqlite";
+  };
+
+in
+{
+
+  meta.maintainers = with lib.maintainers; [ zaphyra ];
+
+  options.common.services.gotosocial = {
+    enable = lib.mkEnableOption "ActivityPub social network server";
+
+    package = lib.mkPackageOption pkgs "gotosocial" { };
+
+    user = lib.mkOption {
+      type = types.str;
+      default = "gotosocial";
+      description = "The user gotosocial should run as";
+    };
+
+    group = lib.mkOption {
+      type = types.str;
+      default = "gotosocial";
+      description = "The group gotosocial should run as";
+    };
+
+    stateDir = lib.mkOption {
+      type = types.str;
+      default = "/var/lib/gotosocial";
+      readOnly = true;
+    };
+
+    setupPostgresqlDB = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to setup a local postgres database and populate the
+        `db-type` fields in `services.gotosocial.settings`.
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = ''
+        File path containing environment variables for configuring the GoToSocial service
+        in the format of an EnvironmentFile as described by {manpage}`systemd.exec(5)`.
+
+        This option could be used to pass sensitive configuration to the GoToSocial daemon.
+
+        Please refer to the Environment Variables section in the [documentation](https://docs.gotosocial.org/en/latest/configuration/#environment-variables).
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = defaultSettings;
+      description = ''
+        Contents of the GoToSocial YAML config.
+
+        Please refer to the
+        [documentation](https://docs.gotosocial.org/en/latest/configuration/)
+        and
+        [example config](https://github.com/superseriousbusiness/gotosocial/blob/main/example/config.yaml).
+
+        Please note that the `host` option cannot be changed later so it is important to configure this correctly before you start GoToSocial.
+      '';
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          host = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Hostname that this server will be reachable at. Defaults to localhost for local testing,
+              but you should *definitely* change this when running for real, or your server won't work at all.
+              DO NOT change this after your server has already run once, or you will break things!
+            '';
+          };
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 8080;
+            description = ''
+              Int. Listen port for the GoToSocial webserver + API. If you're running behind a reverse proxy and/or in a docker,
+              container, just set this to whatever you like (or leave the default), and make sure it's forwarded properly.
+              If you are running with built-in letsencrypt enabled, and running GoToSocial directly on a host machine, you will
+              probably want to set this to 443 (standard https port), unless you have other services already using that port.
+              This *MUST NOT* be the same as the letsencrypt port specified below, unless letsencrypt is turned off.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      configFile = settingsFormat.generate "gotosocial-config.yaml" cfg.settings;
+    in
+    {
+      assertions = [
+        {
+          assertion = cfg.settings.host or null != null;
+          message = "You have to define a hostname for GoToSocial (`common.services.gotosocial.settings.host`), it cannot be changed later without starting over!";
+        }
+      ];
+
+      common.services.gotosocial.settings =
+        (lib.mapAttrs (name: lib.mkDefault) defaultSettings)
+        // {
+          web-template-base-dir = "${cfg.package}/share/gotosocial/web/template/";
+          web-asset-base-dir = "${cfg.package}/share/gotosocal/web/assets/";
+        }
+        // (lib.optionalAttrs cfg.setupPostgresqlDB {
+          db-type = "postgres";
+          db-address = "/run/postgresql";
+          db-database = "gotosocial";
+          db-user = "gotosocial";
+        });
+
+      users = {
+        users."${cfg.user}" = {
+          home = cfg.stateDir;
+          group = cfg.group;
+          isSystemUser = true;
+        };
+        groups."${cfg.group}" = { };
+      };
+
+      environment.etc."gotosocial.yaml".source = configFile;
+
+      environment.systemPackages = [
+        (pkgs.writeShellScriptBin "gotosocial-admin" ''
+          exec systemd-run \
+            -u gotosocial-admin.service \
+            -p Group=${cfg.group} \
+            -p User=${cfg.user} \
+            -q -t -G --wait --service-type=exec \
+            ${lib.getExe cfg.package} --config-path ${configFile} admin "$@"
+        '')
+      ];
+
+      services.postgresql = lib.mkIf cfg.setupPostgresqlDB {
+        enable = true;
+        ensureDatabases = [ "gotosocial" ];
+        ensureUsers = [
+          {
+            name = "gotosocial";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      systemd.services.gotosocial = {
+        description = "GoToSocial ActivityPub server";
+        restartTriggers = [ configFile ];
+
+        wantedBy = [ "multi-user.target" ];
+        requires = lib.optional cfg.setupPostgresqlDB "postgresql.service";
+        after = [
+          "network.target"
+          "sops-install-secrets.service"
+        ]
+        ++ lib.optional cfg.setupPostgresqlDB "postgresql.service";
+
+        environment = {
+          GTS_WAZERO_COMPILATION_CACHE = "${cfg.stateDir}/.cache";
+        };
+
+        serviceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+
+          Type = "exec";
+          WorkingDirectory = cfg.stateDir;
+          StateDirectory = lib.mkIf (
+            cfg.settings.storage-local-base-path != "/var/lib/gotosocial"
+          ) "gotosocial";
+          ReadOnlyPaths = [ cfg.package ];
+          ReadWritePaths = [ cfg.settings.storage-local-base-path ];
+          StateDirectoryMode = "750";
+
+          Restart = "on-failure";
+          RestartSec = 5;
+
+          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+          ExecStart = "${lib.getExe cfg.package} --config-path ${configFile} server start";
+
+          # Security options:
+          # Based on https://github.com/superseriousbusiness/gotosocial/blob/v0.8.1/example/gotosocial.service
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+
+          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+
+          DevicePolicy = "closed";
+          ProtectSystem = "full";
+          ProtectControlGroups = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          LockPersonality = true;
+
+          SystemCallFilter = "~@clock @debug @module @mount @obsolete @reboot @setuid @swap";
+
+          AmbientCapabilities = lib.optional (cfg.settings.port < 1024) "CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = [
+            "~CAP_RAWIO CAP_MKNOD"
+            "~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE"
+            "~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT"
+            "~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK"
+            "~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM"
+            "~CAP_SYS_TTY_CONFIG"
+            "~CAP_MAC_ADMIN CAP_MAC_OVERRIDE"
+            "~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW"
+            "~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG"
+          ];
+        };
+      };
+    }
+  );
+
+}

diff --git a/nixosModules/common/services/greetd.nix b/nixosModules/common/services/greetd.nix
@@ -0,0 +1,74 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.greetd;
+
+in
+{
+
+  options.common.services.greetd = {
+    enable = lib.mkEnableOption "greetd";
+    autoLogin = {
+      enable = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      user = lib.mkOption { type = types.str; };
+      command = lib.mkOption { type = types.str; };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.pam.services.greetd.fprintAuth = false;
+
+    common.configure.persist.system.dirs = [
+      {
+        directory = "/var/cache/tuigreet";
+        mode = "755";
+        user = "greeter";
+        group = "greeter";
+      }
+    ];
+
+    systemd.tmpfiles.settings."greetd" = {
+      "/var/cache/tuigreet" = {
+        d = {
+          mode = "755";
+          user = "greeter";
+          group = "greeter";
+        };
+      };
+    };
+
+    services.greetd = {
+      enable = true;
+      restart = true;
+      useTextGreeter = true;
+      settings = {
+        initial_session = lib.mkIf cfg.autoLogin.enable { inherit (cfg.autoLogin) user command; };
+        default_session = {
+          user = "greeter";
+          command = lib.concatStringsSep " " [
+            (lib.getExe pkgs.tuigreet)
+            "--no-xsession-wrapper"
+            "--remember"
+            "--remember-session"
+            "--time"
+            "--user-menu"
+            "--asterisks"
+            "--power-shutdown"
+            "'systemctl poweroff'"
+            "--power-reboot"
+            "'systemctl reboot'"
+          ];
+        };
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/common/services/gvfs.nix b/nixosModules/common/services/gvfs.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.gvfs;
+
+in
+{
+
+  options.common.services.gvfs = {
+    enable = lib.mkEnableOption "gvfs";
+    backends = {
+      afc = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      afp = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      mtp = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      gphoto2 = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+      smb = lib.mkOption {
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.gvfs = {
+      enable = true;
+      package =
+        (pkgs.gvfs.overrideAttrs (old: {
+          mesonFlags = (old.mesonFlags or [ ]) ++ [
+            "-Dafp=${lib.boolToString cfg.backends.afp}"
+            "-Dafc=${lib.boolToString cfg.backends.afc}"
+            "-Dmtp=${lib.boolToString cfg.backends.mtp}"
+            "-Dgphoto2=${lib.boolToString cfg.backends.gphoto2}"
+          ];
+        })).override
+          { samba = null; };
+    };
+  };
+
+}

diff --git a/nixosModules/common/services/mautrixBridge.nix b/nixosModules/common/services/mautrixBridge.nix
@@ -0,0 +1,150 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.common.services.mautrixBridge;
+  forEachInstance =
+    f: lib.flip lib.mapAttrs' cfg (name: cfg: lib.nameValuePair "mautrixBridge-${name}" (f name cfg));
+
+in
+{
+
+  # todo: add some documentation
+  options.common.services.mautrixBridge = lib.mkOption {
+    default = { };
+    type = types.attrsOf (
+      types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = types.bool;
+            default = false;
+          };
+          package = lib.mkOption {
+            type = types.package;
+          };
+          settings = lib.mkOption {
+            type = (pkgs.formats.json { }).type;
+            default = { };
+          };
+          environmentFile = lib.mkOption {
+            type = with types; nullOr path;
+            default = null;
+          };
+          serviceDependencies = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+        };
+      }
+    );
+  };
+
+  config = {
+    systemd.services = forEachInstance (
+      name: cfg:
+      let
+        dataDir = "/var/lib/mautrix-${name}";
+        registrationFile = "${dataDir}/registration.yaml";
+        settingsFile = "${dataDir}/config.yaml";
+        settingsFileUnsubstituted =
+          (pkgs.formats.json { }).generate "mautrix-${name}-config-unsubstituted.json"
+            cfg.settings;
+      in
+      {
+        enable = cfg.enable;
+        description = "mautrixBridge-${name}, a matrix puppeting bridge.";
+        restartTriggers = [ settingsFileUnsubstituted ];
+
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+
+        path = [ pkgs.ffmpeg-headless ];
+
+        preStart = ''
+          # substitute the settings file by environment variables
+          # in this case read from EnvironmentFile
+          test -f '${settingsFile}' && rm -f '${settingsFile}'
+          old_umask=$(umask)
+          umask 0177
+          ${pkgs.envsubst}/bin/envsubst \
+            -o '${settingsFile}' \
+            -i '${settingsFileUnsubstituted}'
+          umask $old_umask
+
+          # generate the appservice's registration file if absent
+          if [ ! -f '${registrationFile}' ]; then
+            ${lib.getExe cfg.package} \
+              --generate-registration \
+              --config='${settingsFile}' \
+              --registration='${registrationFile}'
+          fi
+          chmod 640 ${registrationFile}
+
+          umask 0177
+          #todo: switch to `yq-go`
+          ${lib.getExe pkgs.yq} -s '
+              .[0].appservice.as_token = (.[0].appservice.as_token // .[1].as_token)
+            | .[0].appservice.hs_token = (.[0].appservice.hs_token // .[1].hs_token)
+          ${lib.optionalString (
+            name == "telegram"
+          ) "
+          | .[0].network.api_id = (.[0].network.api_id | tonumber)
+        "}
+            | .[0]' \
+            '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
+          mv '${settingsFile}.tmp' '${settingsFile}'
+          umask $old_umask
+        '';
+
+        serviceConfig = {
+          Type = "exec";
+
+          DynamicUser = true;
+          User = "mautrixBridge-${name}";
+          Group = "mautrixBridge-${name}";
+
+          EnvironmentFile = cfg.environmentFile;
+          StateDirectory = baseNameOf dataDir;
+          WorkingDirectory = dataDir;
+          UMask = 27;
+
+          ExecStart = "${lib.getExe cfg.package} --no-update --config='${settingsFile}'";
+
+          Restart = "on-failure";
+          RestartSec = "30s";
+
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          MemoryDenyWriteExecute = lib.mkIf (name != "signal") true;
+
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+
+          ProtectSystem = "strict";
+          ProtectClock = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = [ "@system-service" ];
+        };
+      }
+    );
+  };
+
+}

diff --git a/nixosModules/common/services/openssh.nix b/nixosModules/common/services/openssh.nix
@@ -0,0 +1,133 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.openssh;
+
+in
+{
+
+  options.common.services.openssh = {
+    enable = lib.mkEnableOption "openssh server";
+    enableRSASupport = lib.mkEnableOption "rsa support";
+    port = lib.mkOption {
+      type = types.port;
+      default = 22;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups = {
+      ssh = {
+        gid = 200;
+      };
+      sftp = {
+        gid = 201;
+      };
+    };
+
+    # this is required because the secrets need to be decryped before the users get created
+    # but the impermanence bind-mounts get created _after_ the user creation...
+    sops.age.sshKeyPaths = [
+      (
+        if config.common.configure.persist.system.enable then
+          "/persist/system/var/lib/sshd/ssh_host_ed25519_key"
+        else
+          "/var/lib/sshd/ssh_host_ed25519_key"
+      )
+    ];
+
+    common.configure.persist.system.dirs = [ "/var/lib/sshd" ];
+
+    services.openssh = {
+      enable = true;
+
+      # Use socket activation via systemd
+      startWhenNeeded = true;
+
+      # Hostkeys
+      hostKeys = [
+        {
+          type = "ed25519";
+          path = "/persist/system/var/lib/sshd/ssh_host_ed25519_key";
+        }
+      ];
+
+      ports = [ cfg.port ];
+
+      # TODO: Find out why the heck this kills my gpg-agent
+      # extraConfig = "HostCertificate /run/secrets/hostcert";
+
+      settings = {
+
+        # Disable password authentication to enforce pubkey authentication
+        PasswordAuthentication = false;
+
+        # Disable keyboardinteractive authentication
+        KbdInteractiveAuthentication = false;
+
+        X11Forwarding = false;
+
+        # Only allow users of the ssh and sftp groups to connect
+        AllowGroups = [
+          "sftp"
+          "ssh"
+        ];
+
+        CASignatureAlgorithms = lib.concatStringsSep "," [
+          "ssh-ed25519"
+          "sk-ssh-ed25519@openssh.com"
+        ];
+
+        HostBasedAcceptedAlgorithms = lib.concatStringsSep "," [
+          "ssh-ed25519-cert-v01@openssh.com"
+          "sk-ssh-ed25519-cert-v01@openssh.com"
+          "ssh-ed25519"
+          "sk-ssh-ed25519@openssh.com"
+        ];
+
+        HostKeyAlgorithms = lib.concatStringsSep "," [
+          "ssh-ed25519-cert-v01@openssh.com"
+          "sk-ssh-ed25519-cert-v01@openssh.com"
+          "ssh-ed25519"
+          "sk-ssh-ed25519@openssh.com"
+        ];
+
+        PubKeyAcceptedAlgorithms = lib.concatStringsSep "," (
+          [
+            "ssh-ed25519-cert-v01@openssh.com"
+            "sk-ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519"
+            "sk-ssh-ed25519@openssh.com"
+          ]
+          ++ (lib.optionals cfg.enableRSASupport [ "rsa-sha2-512" ])
+        );
+
+        # Specifies the available KEX (Key Exchange) algorithms
+        KexAlgorithms = [
+          "mlkem768x25519-sha256"
+          "sntrup761x25519-sha512"
+          "sntrup761x25519-sha512@openssh.com"
+          "curve25519-sha256"
+          "curve25519-sha256@libssh.org"
+        ];
+
+        # Specifies the available MAC (message authentication code) algorithms
+        Macs = [
+          "hmac-sha2-512-etm@openssh.com"
+          "hmac-sha2-256-etm@openssh.com"
+        ];
+
+        Ciphers = [
+          "chacha20-poly1305@openssh.com"
+          "aes256-gcm@openssh.com"
+          "aes256-ctr"
+        ];
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/common/services/power-profiles-daemon.nix b/nixosModules/common/services/power-profiles-daemon.nix
@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.common.services.power-profiles-daemon;
+
+in
+{
+
+  options.common.services.power-profiles-daemon.enable = lib.mkEnableOption "power-profiles-daemon";
+
+  config = lib.mkIf cfg.enable {
+    common.configure.persist.system.dirs = [
+      "/var/lib/power-profiles-daemon"
+    ];
+
+    services.power-profiles-daemon.enable = true;
+  };
+
+}

diff --git a/nixosModules/common/services/prosody.nix b/nixosModules/common/services/prosody.nix
@@ -0,0 +1,148 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.prosody;
+
+in
+{
+
+  options.common.services.prosody = {
+    enable = lib.mkEnableOption "prosody xmpp server with sane defaults";
+    domain = lib.mkOption {
+      type = types.str;
+    };
+    adminUsers = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    dns.zones."${cfg.domain}" = {
+      SRV = [
+        {
+          proto = "tcp";
+          service = "xmpp-server";
+          priority = 0;
+          weight = 5;
+          port = 5269;
+          target = "xmpp.${cfg.domain}.";
+        }
+        {
+          proto = "tcp";
+          service = "xmpp-client";
+          priority = 0;
+          weight = 5;
+          port = 5222;
+          target = "xmpp.${cfg.domain}.";
+        }
+      ];
+      subdomains = {
+        "muc.xmpp".SRV = [
+          {
+            proto = "tcp";
+            service = "xmpp-server";
+            priority = 0;
+            weight = 5;
+            port = 5269;
+            target = "xmpp.${cfg.domain}.";
+          }
+        ];
+        "upload.xmpp".CNAME = [ "${config.networking.fqdn}." ];
+        xmpp.CNAME = [ "${config.networking.fqdn}." ];
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      5269
+      5222
+    ]
+    ++ config.services.prosody.httpsPorts;
+
+    common.configure.persist.system.dirs = lib.singleton {
+      directory = config.services.prosody.dataDir;
+      mode = "755";
+      inherit (config.services.prosody) user;
+      inherit (config.services.prosody) group;
+    };
+
+    security.acme.certs."${cfg.domain}" = {
+      inherit (config.services.prosody) group;
+      reloadServices = [ "prosody.service" ];
+      extraDomainNames = [
+        "xmpp.${cfg.domain}"
+        "muc.xmpp.${cfg.domain}"
+        "upload.xmpp.${cfg.domain}"
+      ];
+    };
+
+    services.prosody = {
+      enable = true;
+
+      allowRegistration = false;
+      authentication = "internal_hashed";
+      admins = cfg.adminUsers;
+
+      # c2sRequireEncryption = true;
+      # s2sSecureAuth = true;
+
+      modules = {
+        disco = true; # Service discovery
+        roster = true; # Allow users to have a roster. Recommended ;)
+        saslauth = true; # Authentication for clients and servers. Recommended if you want to log in.
+        tls = true; # Add support for secure TLS on c2s/s2s connections
+        blocklist = true; # Allow users to block communications with other users
+        bookmarks = true; # Synchronise the list of open rooms between clients
+        carbons = true; # Keep multiple online clients in sync
+        dialback = true; # Support for verifying remote servers using DNS
+        limits = true; # Enable bandwidth limiting for XMPP connections
+        pep = true; # Allow users to store public and private data in their account
+        private = true; # Private XML storage (for room bookmarks, etc.)
+        smacks = true; # Allow a client to resume a disconnected session, and prevent message loss
+        vcard = true; # User profiles (stored in PEP)
+        vcard_legacy = true; # Conversion between legacy vCard and PEP Avatar, vcard
+        csi = true; # Allows clients to report their active/inactive state
+        ping = true; # Replies to XMPP pings with pongs
+        register = true; # Allow users to register on this server using a client and change passwords
+        time = true; # Let others know the time here on this server
+        uptime = true; # Report how long server has been running
+        version = true; # Replies to server version requests
+        mam = true; # Store recent messages to allow multi-device synchronization
+      };
+
+      extraModules = [
+        "admin_adhoc" # Allows administration via an XMPP client that supports ad-hoc commands
+        "admin_shell" # Allow secure administration via 'prosodyctl shell'
+        "invites" # Create and manage invites
+        "invites_adhoc" # Allow admins/users to create invitations via their client
+        "invites_register" # Allows invited users to create accounts
+      ];
+
+      httpsPorts = [ 5281 ];
+      httpFileShare.domain = "upload.xmpp.${cfg.domain}";
+
+      ssl.cert = "${config.security.acme.certs."${cfg.domain}".directory}/fullchain.pem";
+      ssl.key = "${config.security.acme.certs."${cfg.domain}".directory}/key.pem";
+
+      virtualHosts.zaphyra = {
+        enabled = true;
+        domain = cfg.domain;
+        ssl.cert = "${config.security.acme.certs."${cfg.domain}".directory}/fullchain.pem";
+        ssl.key = "${config.security.acme.certs."${cfg.domain}".directory}/key.pem";
+      };
+
+      muc = [
+        {
+          domain = "muc.xmpp.${cfg.domain}";
+          name = "zaphyra Chat";
+          restrictRoomCreation = "local";
+        }
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/common/services/resticBackup.nix b/nixosModules/common/services/resticBackup.nix
@@ -0,0 +1,178 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.resticBackup;
+
+in
+{
+
+  options.common.services.resticBackup = lib.mkOption {
+    default = { };
+    type = types.attrsOf (
+      types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = types.bool;
+            default = false;
+          };
+          user = lib.mkOption {
+            type = types.str;
+            default = "root";
+          };
+          environmentFile = lib.mkOption {
+            type = with types; nullOr str;
+            default = null;
+          };
+          passwordFile = lib.mkOption {
+            type = types.path;
+          };
+          targets = lib.mkOption {
+            type = with types; listOf str;
+          };
+          sshKeyFile = lib.mkOption {
+            type = types.path;
+          };
+          timerConfig = lib.mkOption {
+            type = types.attrs;
+            default = {
+              OnCalendar = "daily";
+              RandomizedDelaySec = 1200;
+            };
+          };
+          paths = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+          runBeforeBackup = lib.mkOption {
+            type = types.str;
+            default = "";
+          };
+          postgresDatabases = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+          sqliteDatabases = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+          influxBuckets = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+          exclude = lib.mkOption {
+            type = with types; listOf str;
+            default = [ ];
+          };
+        };
+      }
+    );
+  };
+
+  config = lib.mkIf (cfg != { }) {
+    systemd.services = lib.pipe cfg [
+      lib.attrsToList
+      (lib.map (
+        element:
+        (
+          if element.value.enable then
+            (lib.map (
+              target:
+              lib.nameValuePair "restic-backups-${element.name}-${target}" {
+                serviceConfig = {
+                  LoadCredential = [
+                    "sshPrivateKey:${element.value.sshKeyFile}"
+                    "repositoryPassword:${element.value.passwordFile}"
+                  ];
+                  EnvironmentFile = lib.optionals (element.value.environmentFile != null) [
+                    element.value.environmentFile
+                  ];
+                };
+              }
+            ) element.value.targets)
+          else
+            [ ]
+        )
+      ))
+      lib.flatten
+      lib.listToAttrs
+    ];
+
+    services.restic.backups = lib.pipe cfg [
+      lib.attrsToList
+      (lib.map (
+        element:
+        (
+          if element.value.enable then
+            (lib.map (
+              target:
+              lib.nameValuePair "${element.name}-${target}" {
+                initialize = true;
+                inherit (element.value) user timerConfig exclude;
+                passwordFile = "%d/repositoryPassword";
+                extraOptions = [
+                  "rclone.program=\"ssh -o StrictHostKeyChecking=no -i \${CREDENTIALS_DIRECTORY}/sshPrivateKey restic@${target}\""
+                ];
+                repository = "rclone:${element.name}";
+                paths = lib.mkMerge [
+                  element.value.paths
+                  (lib.mkIf (element.value.postgresDatabases != [ ]) (
+                    lib.map (element: "/tmp/postgresDatabases/${element}.sql.zst") element.value.postgresDatabases
+                  ))
+                  (lib.mkIf (element.value.sqliteDatabases != [ ]) (
+                    lib.map (
+                      element: "/tmp/sqliteDatabases/${builtins.baseNameOf element}.sqlite"
+                    ) element.value.sqliteDatabases
+                  ))
+                  (lib.mkIf (element.value.influxBuckets != [ ]) (
+                    lib.map (element: "/tmp/influxBuckets/${element}") element.value.influxBuckets
+                  ))
+                ];
+                backupPrepareCommand =
+                  element.value.runBeforeBackup
+                  +
+                    #dump postgresql databases
+                    (lib.optionalString (element.value.postgresDatabases != [ ]) (
+                      lib.concatMapStringsSep "\n" (db: ''
+                        echo "Dumping Postgres-database: ${db}"
+                        mkdir -p /tmp/postgresDatabases
+                        ${lib.getExe' pkgs.postgresql "pg_dump"} ${db} | ${lib.getExe pkgs.zstd} --rsyncable > /tmp/postgresDatabases/${db}.sql.zst
+                        [ $(du -b /tmp/postgresDatabases/${db}.sql.zst | cut -f1) -gt "50" ] || exit 1
+                      '') element.value.postgresDatabases
+                    ))
+                  +
+                    #dump sqlite databases
+                    (lib.optionalString (element.value.sqliteDatabases != [ ]) (
+                      lib.concatMapStringsSep "\n" (db: ''
+                        echo "Dumping sqlite-database: ${db}"
+                        mkdir -p /tmp/sqliteDatabases
+                        ${lib.getExe pkgs.sqlite} ${db} ".backup '/tmp/sqliteDatabases/${builtins.baseNameOf db}.sqlite'"
+                        [ $(du -b /tmp/sqliteDatabases/${builtins.baseNameOf db}.sqlite | cut -f1) -gt "50" ] || exit 1
+                      '') element.value.sqliteDatabases
+                    ))
+                  +
+                    #dump influx buckets
+                    (lib.optionalString (element.value.influxBuckets != [ ]) (
+                      lib.concatMapStringsSep "\n" (db: ''
+                        echo "Dumping influx-bucket: ${db}"
+                        mkdir -p /tmp/influxBuckets
+                        ${pkgs.influxdb2}/bin/influx backup --compression=none --bucket=${db} /tmp/influxBuckets/${db}
+                        [ $(du -b /tmp/influxBuckets/${db} | cut -f1) -gt "50" ] || exit 1
+                      '') element.value.influxBuckets
+                    ));
+              }
+            ) element.value.targets)
+          else
+            [ ]
+        )
+      ))
+      lib.flatten
+      lib.listToAttrs
+    ];
+  };
+
+}

diff --git a/nixosModules/common/services/upower.nix b/nixosModules/common/services/upower.nix
@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.common.services.upower;
+
+in
+{
+
+  options.common.services.upower.enable = lib.mkEnableOption "upower";
+
+  config = lib.mkIf cfg.enable {
+    services.upower.enable = true;
+
+    common.configure.persist.system.dirs = [ "/var/lib/upower" ];
+  };
+
+}

diff --git a/nixosModules/common/services/vnstat.nix b/nixosModules/common/services/vnstat.nix
@@ -0,0 +1,155 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.common.services.vnstat;
+
+in
+{
+
+  options.common.services.vnstat = {
+    enable = lib.mkEnableOption "vnstat";
+    serveGraphs = lib.mkOption {
+      type = types.bool;
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.vnstat.enable = true;
+
+    common.configure.persist.system.dirs = [ "/var/lib/vnstat" ];
+
+    services.nginx.virtualHosts."${config.networking.fqdn}" = lib.mkIf cfg.serveGraphs {
+      locations."/vnstat/" = {
+        alias = "/var/run/vnstati/";
+        index = "index.html";
+      };
+    };
+
+    systemd.services.vnstati = lib.mkIf cfg.serveGraphs {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "vnstat.service" ];
+      startAt = "*-*-* *:0/10:00";
+
+      serviceConfig = {
+        User = "vnstatd";
+        Group = "vnstatd";
+        RuntimeDirectoryPreserve = true;
+        RuntimeDirectory = "vnstati";
+        RuntimeDirectoryMode = 775;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+      };
+
+      path = with pkgs; [
+        vnstat
+        jq
+        nix
+      ];
+      script = ''
+        set -x
+        ifaces=$(vnstat --json | jq -r .interfaces[].name | grep -v "^lo$")
+        echo $ifaces
+
+        cat > /var/run/vnstati/index.html << EOF
+        <!DOCTYPE html>
+        <html lang="en">
+          <head>
+            <title>${config.networking.hostName} - stats</title>
+            <meta charset="utf-8">
+            <meta name="robots" content="none">
+            <link rel="icon" href="static/favicon.ico" type="image/x-icon">
+            <style>
+        body {
+            padding: 0;
+            margin: 0;
+            background: #eee;
+            font-family: monospace;
+            min-height: 100vh;
+        }
+        img:not(:last-child) {
+            margin-bottom: 15px;
+        }
+        img {
+            flex-shrink: 0;
+        }
+        .ui.segment {
+            margin: 0 1em 10px 1em;
+            padding: 1em;
+            background-color: white;
+            box-shadow: 0 1px 2px 0 rgba(34,36,38,.15);
+            border-radius: .286rem;
+            border: 1px solid rgba(34,36,38,.15);
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            justify-content: center;
+
+        }
+        div.heading {
+            min-width: 100vw;
+            height: 70px;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            justify-content: center;
+        }
+        div.table.vertical {
+            overflow-y: auto;
+            min-width: 100vw;
+            height: calc(100vh - 70px);
+            display: flex;
+            flex-direction: row;
+        }
+        div.iface {
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            flex-grow: 1;
+        }
+            </style>
+          </head>
+          <body>
+            <div class="heading">
+              <h1>${config.networking.hostName}</h1>
+            </div>
+            <div class="table vertical">            
+        EOF
+
+        for iface in $ifaces
+        do
+        cat >> /var/run/vnstati/index.html << EOF
+          <div class="iface">
+            <h3>''${iface}</h3>
+              <div class="ui segment"><img src="''${iface}-summary.png" alt="Summary"></div>
+              <div class="ui segment"><img src="''${iface}-hourly.png" alt="Hourly"></div>
+              <div class="ui segment"><img src="''${iface}-daily.png" alt="Daily"></div>
+              <div class="ui segment"><img src="''${iface}-monthly.png" alt="Monthly"></div>
+              <div class="ui segment"><img src="''${iface}-top10.png" alt="Top 10"></div>
+          </div>
+        EOF
+
+          vnstati -s -nh -i $iface -o /var/run/vnstati/$iface-summary.png
+          vnstati -h -nh -i $iface -o /var/run/vnstati/$iface-hourly.png
+          vnstati -d -nh -i $iface -o /var/run/vnstati/$iface-daily.png
+          vnstati -m -nh -i $iface -o /var/run/vnstati/$iface-monthly.png
+          vnstati -t -nh -i $iface -o /var/run/vnstati/$iface-top10.png
+        done
+
+        cat >> /var/run/vnstati/index.html << EOF
+            </div>
+          </body>
+        </html>
+        EOF
+
+      '';
+    };
+  };
+
+}

diff --git a/nixosModules/common/users/zaphyra.nix b/nixosModules/common/users/zaphyra.nix
@@ -0,0 +1,36 @@
+{
+  sopsSecrets,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.common.users.zaphyra.enable = lib.mkEnableOption "zaphyra user";
+
+  config = lib.mkIf config.common.users.zaphyra.enable {
+    environment.systemPackages = [ pkgs.ghostty.terminfo ];
+
+    sops.secrets.zaphyraPassword = {
+      neededForUsers = true;
+      sopsFile = sopsSecrets.common;
+    };
+
+    users.users.zaphyra = {
+      uid = 1001;
+      description = "Katja";
+      hashedPasswordFile = config.sops.secrets.zaphyraPassword.path;
+      isNormalUser = true;
+      extraGroups = [
+        "ssh"
+        "wheel"
+      ];
+      openssh.authorizedKeys.keys = [
+        (builtins.readFile "${pkgs.zpha.website}/ssh_pubkey.asc")
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/default.nix b/nixosModules/default.nix
@@ -0,0 +1,24 @@
+{
+  lib ? import "${(import ../npins).nixpkgs}/lib",
+}:
+
+let
+  # read the current directorys files and pipe the result through a list of functions
+  modules = builtins.foldl' (x: f: f x) (builtins.readDir ./.) [
+    # convert to a list containing just the attribute names
+    (builtins.attrNames)
+    # drop "default.nix" from the list
+    (builtins.filter (name: name != "default.nix"))
+    (builtins.map (name: {
+      inherit name;
+      value = lib.filesystem.listFilesRecursive ./${name};
+    }))
+    # convert the resulting list to an attribute set
+    (builtins.listToAttrs)
+  ];
+
+in
+modules
+// {
+  default = lib.flatten (builtins.attrValues modules);
+}

diff --git a/nixosModules/dns/dns.nix b/nixosModules/dns/dns.nix
@@ -0,0 +1,53 @@
+{
+  nixosConfigurations,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+
+in
+{
+
+  options.dns = {
+    enable = lib.mkEnableOption "dns zones via nix";
+
+    # contains dns entries defined on the local host
+    zones = lib.mkOption {
+      type = types.attrsOf pkgs.dnsNix.types.subzone;
+      default = { };
+    };
+
+    # contains dns entries defined on the local host and on remote hosts, merged together
+    allZones = lib.mkOption {
+      type = types.attrsOf pkgs.dnsNix.types.zone;
+      default = { };
+    };
+
+    zoneFiles = lib.mkOption {
+      type = types.attrsOf types.path;
+      readOnly = true;
+      default = lib.mapAttrs (
+        name: zone:
+        toString (
+          pkgs.writeTextFile {
+            name = "${name}.zone";
+            text = pkgs.dnsNix.types.zoneToString name (pkgs.dnsNix.evalZone name zone);
+          }
+        )
+      ) config.dns.allZones;
+    };
+  };
+
+  config = lib.mkIf config.dns.enable {
+    # serve records defined in all host configs
+    dns.allZones = lib.mkMerge (
+      lib.flip lib.mapAttrsToList nixosConfigurations (
+        _hostName: machineConfig: machineConfig.config.dns.zones
+      )
+    );
+  };
+
+}

diff --git a/nixosModules/toBeUpstreamed/gomuks.nix b/nixosModules/toBeUpstreamed/gomuks.nix
@@ -0,0 +1,199 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+
+  settingsFormat = pkgs.formats.yaml { };
+
+in
+{
+
+  options.services.gomuks = lib.mkOption {
+    description = "Configuration for gomuks instances.";
+    default = { };
+    type = types.attrsOf (
+      types.submodule {
+        options = {
+          enable = (lib.mkEnableOption "gomuks, a Matrix client written in Go.") // {
+            default = true;
+          };
+
+          package = lib.mkPackageOption pkgs "gomuks" { };
+
+          settings = lib.mkOption {
+            default = { };
+            description = ''
+              Contents of the gomuks YAML config.
+            '';
+            type = types.submodule {
+              freeformType = settingsFormat.type;
+              options = {
+                web = {
+                  listen_address = lib.mkOption {
+                    type = types.str;
+                    default = "localhost:29325";
+                    description = ''
+                      The address and port that gomuks will listen on.
+                    '';
+                  };
+
+                  username = lib.mkOption {
+                    type = types.str;
+                    description = ''
+                      Username for basic http authentication.
+                    '';
+                  };
+
+                  password_hash = lib.mkOption {
+                    type = types.str;
+                    description = ''
+                      `bcrypt`ed password for basic http authentication.
+                    '';
+                  };
+
+                  DisableAuthBecauseIWantMyAccountToBeHacked = lib.mkOption {
+                    type = with types; nullOr bool;
+                    visible = false;
+                    default = null;
+                  };
+                };
+
+                logging.writers = lib.mkOption {
+                  type = with types; listOf attrs;
+                  visible = false;
+                  default = [
+                    {
+                      type = "stdout";
+                      format = "pretty-colored";
+                    }
+                  ];
+                };
+              };
+            };
+          };
+        };
+      }
+    );
+  };
+
+  config = {
+    assertions = lib.flatten (
+      lib.flip lib.mapAttrsToList config.services.gomuks (
+        name: cfg: [
+          {
+            assertion = (
+              (cfg.settings.web.DisableAuthBecauseIWantMyAccountToBeHacked != true)
+              && ((cfg.settings.web ? username) || (cfg.settings.web ? password_hash))
+            );
+            message = ''
+              You need to set at least `services.gomuks.${name}.settings.web.username` and
+              `services.gomuks.${name}.settings.web.password_hash` in the settings.
+            '';
+          }
+        ]
+      )
+    );
+
+    systemd.services = lib.flip lib.mapAttrs' config.services.gomuks (
+      name: cfg:
+      (lib.nameValuePair "gomuks-${name}" (
+        let
+          settingsFile = settingsFormat.generate "gomuks-${name}.yaml" (
+            lib.filterAttrsRecursive (name: value: value != null) cfg.settings
+          );
+
+        in
+        {
+          enable = cfg.enable;
+          description = "A Matrix client written in Go";
+
+          restartTriggers = [ settingsFile ];
+
+          wantedBy = [ "multi-user.target" ];
+
+          environment = {
+            HOME = lib.mkDefault "%S/%N";
+            GOMUKS_CONFIG_HOME = lib.mkDefault "%S/%N";
+            GOMUKS_DATA_HOME = lib.mkDefault "%S/%N";
+            GOMUKS_LOGS_HOME = lib.mkDefault "%S/%N";
+            GOMUKS_CACHE_HOME = lib.mkDefault "%C/%N";
+            GOMUKS_TMPDIR = lib.mkDefault "%C/%N";
+          };
+
+          preStart = ''
+            test -f "$GOMUKS_CONFIG_HOME/config-nixos.yaml" && rm -f "$GOMUKS_CONFIG_HOME/config-nixos.yaml"
+
+            ${lib.getExe pkgs.systemd-credsubst} \
+              --copy-if-no-creds \
+              --input "${settingsFile}" \
+              --output "$GOMUKS_CONFIG_HOME/config-nixos.yaml"
+
+            if [ -f "$GOMUKS_CONFIG_HOME/config.yaml" ];
+            then
+              ${lib.getExe pkgs.yq-go} -i ". *= load(\"$GOMUKS_CONFIG_HOME/config-nixos.yaml\")" "$GOMUKS_CONFIG_HOME/config.yaml"
+            else
+              cp "$GOMUKS_CONFIG_HOME/config-nixos.yaml" "$GOMUKS_CONFIG_HOME/config.yaml"
+            fi
+          '';
+
+          serviceConfig = {
+            DynamicUser = true;
+
+            StateDirectory = "gomuks-${name}";
+            CacheDirectory = "gomuks-${name}";
+
+            ExecStart = lib.getExe cfg.package;
+
+            ProtectSystem = "full";
+            ProtectControlGroups = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            LockPersonality = true;
+
+            DevicePolicy = "strict";
+            DeviceAllow = [ "/dev/stdin r" ];
+
+            SystemCallArchitectures = "native";
+            MemoryDenyWriteExecute = true;
+
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            PrivateDevices = true;
+            UMask = "077";
+
+            RestrictAddressFamilies = "AF_INET AF_INET6";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+
+            RemoveIPC = true;
+            PrivateIPC = true;
+
+            SystemCallFilter = [
+              "@system-service"
+              "~@resources"
+              "~@mount"
+              "~@setuid"
+              "~@cpu-emulation"
+              "~@debug"
+              "~@keyring"
+              "~@obsolete"
+              "~@pkey"
+              "setrlimit"
+            ];
+          };
+        }
+      ))
+    );
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    zaphyra
+  ];
+
+}

diff --git a/nixosModules/zpha/configure/cccdaWifi.nix b/nixosModules/zpha/configure/cccdaWifi.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+
+  options.zpha.configure.cccdaWifi.enable =
+    lib.mkEnableOption "configure cccda wifi NetworkManager profile";
+
+  config = lib.mkIf config.zpha.configure.cccdaWifi.enable {
+    networking.networkmanager.ensureProfiles = {
+      profiles.ccc-da-wifi = {
+        connection = {
+          id = "darmstadt.ccc.de";
+          type = "wifi";
+          uuid = "945c40f1-a800-4619-8276-1002a718a9f2";
+          autoconnect = "true";
+        };
+        "wifi" = {
+          ssid = "darmstadt.ccc.de";
+          mode = "infrastructure";
+        };
+        "wifi-security" = {
+          "auth-alg" = "open";
+          "key-mgmt" = "wpa-eap";
+        };
+        "802-1x" = {
+          "eap" = "ttls";
+          "phase2-auth" = "pap";
+          "ca-cert" = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+          "altsubject-matches" = "DNS:radius.cccda.de";
+          "identity" = config.networking.fqdn;
+          "password" = config.networking.fqdn + (toString config.networking.hostId);
+        };
+        ipv4.method = "auto";
+        ipv6.method = "auto";
+      };
+    };
+  };
+
+}

diff --git a/nixosModules/zpha/configure/dn42Router.nix b/nixosModules/zpha/configure/dn42Router.nix
@@ -0,0 +1,208 @@
+{
+  machineConfig,
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.zpha.configure.dn42Router.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.zpha.configure.dn42Router.enable {
+    dns.zones."zaphyra.eu".subdomains."router-a.dn42".AAAA = [
+      machineConfig.networking.ip6Address
+    ];
+
+    sops.secrets."dn42/wgPrivateKey" = {
+      owner = "systemd-network";
+      group = "systemd-network";
+    };
+
+    networking.firewall = {
+      checkReversePath = "loose";
+      allowedUDPPorts = [
+        config.systemd.network.netdevs."20-dn42".wireguardConfig.ListenPort
+      ];
+      trustedInterfaces = [
+        "dn42"
+        "wg-cautus"
+      ];
+    };
+
+    systemd.network = {
+      config.networkConfig = {
+        IPv6Forwarding = true;
+      };
+    };
+
+    common.configure.dn42Router = {
+      enable = true;
+      routerId = 42171801;
+      asn = 4242421718;
+      address = "fd6b:6174:6a61::1";
+      range = "fd6b:6174:6a61::/48";
+      peerings = {
+        kioubit = {
+          asn = 4242423914;
+          remoteLinkLocalAddress = "fe80::ade0";
+          endpoint = "de2.g-load.eu:21718";
+          publicKey = "B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY=";
+          listenPort = 51823;
+        };
+        pleiades = {
+          asn = 4242420069;
+          remoteLinkLocalAddress = "fe80::706c:6569:6164:6573";
+          endpoint = "central.net.nojus.org:21718";
+          publicKey = "1YAga5Bhreysf/XmhOnDGh3FmbN3Mp2jZjMSAQb/TEM=";
+          listenPort = 51824;
+        };
+        echonet = {
+          asn = 4242420714;
+          remoteLinkLocalAddress = "fe80::718";
+          publicKey = "NxYj58YhWf0JXC+pQAHfh3saUkQSII0lBTDvYGe5kw4=";
+          listenPort = 51825;
+        };
+        tbspace = {
+          asn = 76190;
+          remoteLinkLocalAddress = "fe80::1299:e";
+          endpoint = "dn42.tbspace.de:49158";
+          publicKey = "NW8IeEmAXmwYMuMlvrb9Zpkcko6bzotDlYtGePtgzQE=";
+          listenPort = 51826;
+        };
+        antibldg = {
+          asn = 4242421403;
+          remoteLinkLocalAddress = "fe80::1234:9320";
+          endpoint = "zaphyra.dn42.antibuild.ing:15569";
+          publicKey = "vambITMGGpA7kxCRGFlY1X36bevxXYELT/ORNgZ72ms=";
+          listenPort = 51827;
+        };
+        dahlabandon = {
+          asn = 4242420814;
+          remoteLinkLocalAddress = "fe80::1718";
+          endpoint = "helios-fallen.iron-bear.de:1718";
+          publicKey = "+tg4bDDwfyQZSw0x8x9Ye2tDWPZ/VAf+KTAE1QLaKEI=";
+          listenPort = 51828;
+        };
+        pentane = {
+          asn = 4242423253;
+          remoteLinkLocalAddress = "fe80::43:59:43";
+          endpoint = "imp.aidoskyneen.eu:49507";
+          publicKey = "W+h0FMrxsAP7RppqFFMrfDHuu5CMW5aTW9E1MZXFf1w=";
+          listenPort = 51829;
+        };
+        # e1mo = {
+        #   asn = 4242420565;
+        #   remoteLinkLocalAddress = "";
+        #   endpoint = "";
+        #   publicKey = "";
+        #   listenPort = 51830;
+        # };
+        clerie = {
+          asn = 4242422574;
+          remoteLinkLocalAddress = "fe80::2574";
+          endpoint = "dn42-il-gw1.net.clerie.de:51718";
+          publicKey = "yJmr6lQzibmZV6/6VItXsXbcq4UKMyWFwJJt4lAkvCs=";
+          listenPort = 51831;
+        };
+        etwas = {
+          asn = 4242422264;
+          remoteLinkLocalAddress = "fe80::acab";
+          endpoint = "ncvps.dn42.etwas.me:22266";
+          publicKey = "7ZLtBmXN+zOYJ52jtUdZO0HiEZZrxnIO/LLejFcFnnk=";
+          listenPort = 51832;
+        };
+        pilz = {
+          asn = 4242420663;
+          remoteLinkLocalAddress = "fe80::acab";
+          publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
+          listenPort = 51833;
+        };
+        # c4tg1rl5 = {
+        #   asn = "4242421411";
+        #   remoteLinkLocalAddress = "";
+        #   hasPresharedKey = true;
+        #   publicKey = "";
+        #   listenPort = 51834;
+        # };
+        lgcl = {
+          asn = 4242421825;
+          remoteLinkLocalAddress = "fe80::4d:6172:6379";
+          publicKey = "7AoJ23hNMLzVM4jjusBlrGDEdwAkSdsEl3Vw/diVlns=";
+          listenPort = 51835;
+        };
+        mira = {
+          asn = 4242420161;
+          endpoint = "dn42-router-1.svc.nesaia.net:21718";
+          remoteLinkLocalAddress = "fe80::161";
+          publicKey = "AAcJ/NA68NtxKd27+HlbEZXFo+u0NKt+ksUGYJBc/AQ=";
+          listenPort = 51836;
+        };
+        lfm = {
+          asn = 4242420632;
+          endpoint = "gw-de1.dn42.infra.linfan.moe:41718";
+          remoteLinkLocalAddress = "fe80::632";
+          publicKey = "WfQGnN2WX5KTi3SGIde2kuVfhgDQ+ASaZfU+ORb9ukA=";
+          listenPort = 51837;
+        };
+        ember = {
+          asn = 4242420197;
+          endpoint = "chaldene.dn42.n0emis.eu:21718";
+          remoteLinkLocalAddress = "fe80::42:42:1";
+          publicKey = "UgGpP9j881KeHOL5qElEZ/fXbucBUgTcihbv3yGlxHo=";
+          listenPort = 51838;
+        };
+      };
+    };
+
+    zpha.profiles.dn42 = {
+      enable = true;
+      wgPublicKey = machineConfig.networking.dn42.wgPublicKey;
+      wgPrivateKey = config.sops.secrets."dn42/wgPrivateKey".path;
+      addresses = [
+        "${machineConfig.networking.dn42.ip6Address}/${toString machineConfig.networking.dn42.ip6PrefixLength}"
+        "fd6b:6174:6a61:53::${toString machineConfig.id}/128"
+      ];
+    };
+
+    services.kresd = {
+      enable = true;
+      listenPlain = [ "[fd6b:6174:6a61::1]:53" ];
+      extraConfig = ''
+        modules = {
+          'hints > iterate',  -- Allow loading /etc/hosts or custom root hints
+          'stats',            -- Track internal statistics
+          'predict',          -- Prefetch expiring/frequent records
+        }
+
+        log_level('info')
+
+        -- Cache size
+        cache.size = 100 * MB
+
+        dn42 = {
+          'dn42.',
+          '20.172.in-addr.arpa.',
+          '21.172.in-addr.arpa.',
+          '22.172.in-addr.arpa.',
+          '23.172.in-addr.arpa.',
+          '10.in-addr.arpa.',
+          'd.f.in-addr.arpa.',
+        }
+
+        -- NXDOMAINs that could sometimes happen due to aggressive DNSSEC caching.
+        policy.add(policy.suffix(policy.FLAGS({'NO_EDNS'}), dn42))
+
+        policy.add(policy.suffix(policy.STUB({'fd42:d42:d42:54::1', 'fd42:d42:d42:53::1'}), policy.todnames(dn42)))
+        -- policy.add(policy.FORWARD({'1.1.1.1'}))
+
+        -- trust_anchors.remove('.')
+        trust_anchors.set_insecure(dn42) -- Disable DNSSEC for these domains
+
+        modules.load('nsid')
+        nsid.name(hostname() .. ':' .. os.getenv("SYSTEMD_INSTANCE"))
+      '';
+    };
+  };
+
+}

diff --git a/nixosModules/zpha/configure/dnsServer.nix b/nixosModules/zpha/configure/dnsServer.nix
@@ -0,0 +1,156 @@
+{
+  machines,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.zpha.configure.dnsServer;
+
+in
+{
+
+  options.zpha.configure.dnsServer = {
+    enable = lib.mkEnableOption "";
+    isPrimary = lib.mkOption {
+      type = types.bool;
+      default = config.networking.hostName == "cautus";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      allZones =
+        with pkgs.dnsNix.combinators;
+        let
+          TXT = [ "openpgp4fpr:BFE6386C8D66BCD4DAE14FC895F0FE7CD7E6A022" ];
+          CAA = [
+            {
+              issuerCritical = false;
+              tag = "issue";
+              value = "letsencrypt.org";
+            }
+          ];
+          NS = [
+            "ns1.fc9f.de."
+            "ns2.fc9f.de."
+          ];
+          SOA = {
+            nameServer = "ns1.fc9f.de.";
+            adminEmail = "dns@fc9f.de"; # Email address with a real `@`!
+            serial = 0;
+          };
+
+        in
+        {
+          "fc9f.de" = {
+            inherit NS SOA;
+            subdomains = {
+              acme.NS = [ "ns1" ];
+              ns1 = host machines.cautus.networking.ip4Address machines.cautus.networking.ip6Address;
+              ns2 = host machines.sorrah.networking.ip4Address machines.sorrah.networking.ip6Address;
+            };
+          };
+
+          "zaphyra.dn42" = {
+            NS = [ "ns1.zaphyra.dn42." ];
+            SOA = {
+              nameServer = "ns1.zaphyra.dn42.";
+              adminEmail = "dns@zaphyra.eu"; # Email address with a real `@`!
+              serial = 0;
+            };
+            subdomains = {
+              ns1.AAAA = [ "fd6b:6174:6a61:53::1" ];
+              ns2.AAAA = [ "fd6b:6174:6a61:53::2" ];
+            };
+          };
+
+          "zaphyra.eu" = {
+            inherit
+              SOA
+              NS
+              CAA
+              ;
+          };
+
+          "zaphyra.de" = {
+            inherit
+              SOA
+              NS
+              CAA
+              TXT
+              ;
+          };
+
+          "zpha.de" = {
+            inherit
+              SOA
+              NS
+              CAA
+              TXT
+              ;
+          };
+
+          "katja.wtf" = {
+            inherit SOA NS CAA;
+          };
+
+          "ctucx.de" = {
+            inherit SOA NS CAA;
+          };
+
+          "thein.ovh" = {
+            inherit SOA NS CAA;
+          };
+
+          "ctu.cx" = {
+            inherit SOA NS CAA;
+            subdomains = {
+              _atproto.TXT = [ "did=did:plc:zaeuok3fmh2pcp4cjiicku4i" ];
+            };
+          };
+        };
+
+    in
+    {
+      systemd.services.knot.after = lib.mkIf cfg.isPrimary [ "sops-install-secrets.service" ];
+
+      sops.secrets.knotKeys = lib.mkIf cfg.isPrimary {
+        owner = "knot";
+        group = "knot";
+      };
+
+      dns = {
+        enable = true;
+        inherit allZones;
+      };
+
+      zpha.services = {
+        knot = {
+          enable = true;
+          primary = cfg.isPrimary;
+          zones = lib.mkIf cfg.isPrimary (
+            lib.mapAttrs (_name: value: {
+              file = value;
+              journal-content = "all";
+              zonefile-sync = -1;
+              zonefile-load = "difference-no-serial";
+            }) config.dns.zoneFiles
+          );
+        };
+        knotACME = lib.mkIf cfg.isPrimary {
+          enable = true;
+          zone = "acme.fc9f.de";
+          zones = lib.attrNames allZones;
+          nameServers = [
+            "ns1.fc9f.de."
+          ];
+          keyFile = config.sops.secrets.knotKeys.path;
+        };
+      };
+    }
+  );
+
+}

diff --git a/nixosModules/zpha/configure/floraCtl.nix b/nixosModules/zpha/configure/floraCtl.nix
@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+
+  options.zpha.configure.floraCtl.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.zpha.configure.floraCtl.enable {
+    sops.secrets."zigbee2mqttSecrets.yaml" = {
+      owner = "zigbee2mqtt";
+      key = "zigbee2mqttSecrets";
+    };
+
+    common.configure.persist.system.dirs = [
+      {
+        directory = "/var/lib/zigbee2mqtt";
+        mode = "0770";
+        user = "zigbee2mqtt";
+        group = "zigbee2mqtt";
+      }
+    ];
+
+    systemd.services.zigbee2mqtt = {
+      serviceConfig = {
+        Restart = lib.mkForce "always";
+        RuntimeMaxSec = "1d";
+      };
+    };
+
+    services = {
+      udev.extraRules = ''
+        SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{serial}=="00_12_4B_00_25_9B_C1_FC", SYMLINK+="zigbee0"
+        ATTR{idVendor}=="0451", ATTR{idProduct}=="16a8", ENV{ID_MM_DEVICE_IGNORE}="1"
+        SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="zigbee0"
+      '';
+
+      zigbee2mqtt = {
+        enable = true;
+        settings = {
+          homeassistant.enabled = true;
+          permit_join = false;
+
+          mqtt = {
+            base_topic = "zigbee2mqtt";
+            server = "mqtt://192.168.2.147:1883";
+            user = "!${config.sops.secrets."zigbee2mqttSecrets.yaml".path} mqttUser";
+            password = "!${config.sops.secrets."zigbee2mqttSecrets.yaml".path} mqttPassword";
+          };
+
+          serial = {
+            adapter = "zstack";
+            port = "/dev/zigbee0";
+            disable_led = true;
+          };
+
+          frontend = {
+            port = 8422;
+            host = "::1";
+          };
+
+          advanced = {
+            log_level = "info";
+            log_output = [ "console" ];
+            channel = 11;
+            pan_id = 55067;
+            ext_pan_id = [
+              116
+              73
+              103
+              101
+              20
+              101
+              160
+              9
+            ];
+            network_key = "!${config.sops.secrets."zigbee2mqttSecrets.yaml".path} network_key";
+          };
+
+          device_options.retain = true;
+          devices = {
+            "0x00124b0023ad17f1".friendly_name = "door_buzzer";
+          };
+        };
+      };
+    };
+
+  };
+
+}

diff --git a/nixosModules/zpha/configure/fonts.nix b/nixosModules/zpha/configure/fonts.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+
+  options.zpha.configure.fonts.enable = lib.mkEnableOption "configure fonts";
+
+  config = lib.mkIf config.zpha.configure.fonts.enable {
+    fonts = {
+      fontconfig = {
+        enable = true;
+        defaultFonts = {
+          serif = [ "Adwaita Sans" ];
+          sansSerif = [ "Adwaita Sans" ];
+          monospace = [ "Adwaita Mono" ];
+          emoji = [ "Noto Color Emoji" ];
+        };
+      };
+
+      packages = with pkgs; [
+        adwaita-fonts
+        liberation_ttf
+        ttf_bitstream_vera
+        noto-fonts
+        noto-fonts-color-emoji
+        nerd-fonts.symbols-only
+        fira-code
+        fira-mono
+      ];
+    };
+  };
+
+}

diff --git a/nixosModules/zpha/configure/mailServer.nix b/nixosModules/zpha/configure/mailServer.nix
@@ -0,0 +1,266 @@
+{
+  npins,
+  sopsSecrets,
+  machineConfig,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+
+  options.zpha.configure.mailServer.enable = lib.mkEnableOption "";
+
+  imports =
+    (lib.mkIf config.zpha.configure.mailServer.enable [
+      (import npins.simpleNixosMailserver)
+    ]).content;
+
+  config = lib.mkIf config.zpha.configure.mailServer.enable (
+    let
+      hostName = config.networking.fqdn;
+      ip6Address = machineConfig.networking.ip6Address;
+      ip4Address = machineConfig.networking.ip4Address;
+      primaryDomain = "zaphyra.eu";
+      primaryDomainDkimKey = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMuEtG24S6ksVx04avtjwIrfijZvQMxe44HrAXjW+Qe7ZbBHtS+q8alvL21zHbe4VgAOTNZ+fCnqSif4TFaOQnwuGwWke5SRBHV6RmWLaJUnN7krjFj+oNmKnl5M3GPI62shhk4OlMgAdDrH/JApd4XTqR3m0U/8rXqPumfbHhzwIDAQAB";
+      extraDomains = {
+        "katja.wtf" =
+          "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC56L/GDEY0hTvcZjjCpk3/3c4qAmGAQR06tVpgz7gHs0kMPiGhpg3gDv8kCOu4l3C96oT6eaQoyLcC+ZhJT4ribZaNSD+7lkXk23s4LecklBQxLAjvLrc0GQ9zYp8/Qg4g+Wo9fHR3Lum4tqyyFuT/P21knw+nDWxvz3d0Y4XNVwIDAQAB";
+        "ctu.cx" =
+          "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOuE5vBNP0L4i3OxcFdFbTJ/c8o58CL+cMHBh8lAZej1nSYOPBdpfJRpWiHduWu8cLWNu62nDeY9IGGnE6g9o6+6sMT51NdoY7FFcNNjhm0EoZVDaB1Ffy74ycIDAwuNfp8kpKFsxWMSs1CFy6IRDIIzaQc9JAIoBUBbN5rP2DcwIDAQAB";
+        "ctucx.de" =
+          "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg3pBG8oH8h0w5YrZ7Dpmtk+/XqE9HElWeF1SWMo86aVLkbsMKjY0WbfAq5YfEdSr/pQrILC+oAt/q6TuLzABYd7cLzK7KgdIX2SuYvujmHqzOOn1huAkzQU0wJMnMYx/0wCFMnVHXsWY9UF2zHDhYu8Jo9vuwMPwGG9u1qnfdCQIDAQAB";
+        "thein.ovh" =
+          "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYogCqmPNomxG4KyZGsfpefFNPS5lY9aRm7TjiONKKPKQFb4oFfUBacurfL+cdGhX6CBnRr6IUXZ37e+ptOyWNFfG1e5R7dJeRdmCZvsn2DRbxCEeGA6gjl3hmRIjg3HUCWjWlzjRXV4Qke/7Q1y1lfivOrgU72bLw/V7BEi1OZQIDAQAB";
+      };
+
+      mailAutoConfig = ''
+        <?xml version="1.0" encoding="UTF-8"?>
+        <clientConfig version="1.1">
+         <emailProvider id="${primaryDomain}">
+           <domain>${primaryDomain}</domain>
+           <displayName>${hostName}</displayName>
+           <displayShortName>${hostName}</displayShortName>
+           <incomingServer type="imap">
+             <hostname>${hostName}</hostname>
+             <port>993</port>
+             <socketType>SSL</socketType>
+             <authentication>password-cleartext</authentication>
+             <username>%EMAILADDRESS%</username>
+           </incomingServer>
+           <outgoingServer type="smtp">
+             <hostname>${hostName}</hostname>
+             <port>465</port>
+             <socketType>SSL</socketType>
+             <authentication>password-cleartext</authentication>
+             <username>%EMAILADDRESS%</username>
+           </outgoingServer>
+         </emailProvider>
+        </clientConfig>
+      '';
+
+    in
+    {
+      dns.zones =
+        with pkgs.dnsNix.combinators;
+        let
+          TXT = [ "v=spf1 a mx ip4:${ip4Address} +ip6:${ip6Address} ~all" ];
+          DMARC = "v=DMARC1; p=none";
+          MX = with mx; [ (mx 10 "${hostName}.") ];
+        in
+        {
+          "${primaryDomain}" = {
+            inherit MX TXT;
+
+            SRV = [
+              {
+                proto = "tcp";
+                service = "imaps";
+                priority = 0;
+                weight = 1;
+                port = 993;
+                target = "${hostName}.";
+              }
+              {
+                proto = "tcp";
+                service = "imap";
+                priority = 0;
+                weight = 1;
+                port = 143;
+                target = "${hostName}.";
+              }
+              {
+                proto = "tcp";
+                service = "submission";
+                priority = 0;
+                weight = 1;
+                port = 587;
+                target = "${hostName}.";
+              }
+            ];
+
+            subdomains = {
+              autoconfig.CNAME = [ "${hostName}." ];
+              _dmarc.TXT = [ DMARC ];
+              "${config.mailserver.dkimSelector}._domainkey".TXT = [
+                primaryDomainDkimKey
+              ];
+            };
+          };
+        }
+        // (lib.mapAttrs (_domain: dkimKey: {
+          inherit MX TXT;
+
+          subdomains = {
+            _dmarc.TXT = [ DMARC ];
+            "${config.mailserver.dkimSelector}._domainkey".TXT = [ dkimKey ];
+          };
+        }) extraDomains);
+
+      sops.secrets = {
+        "restic/mailserver/repositoryPassword" = { };
+        "restic/mailserver/sshPrivateKey" = { };
+        "mailPasswords/katja@zaphyra.eu" = { };
+        "mailPasswords/gts@zaphyra.eu" = { };
+        "mailPasswords/vaultwarden@zaphyra.eu" = { };
+        "sieveScripts/katja@zaphyra.eu.sieve" = {
+          sopsFile = sopsSecrets.zaphyra.sieve;
+          key = "katja@zaphyra.eu";
+          restartUnits = [ "dovecot2.service" ];
+          owner = "virtualMail";
+          group = "virtualMail";
+          path = "/etc/dovecot/sieve/katja-zaphyra-eu.sieve";
+        };
+      };
+
+      systemd.services.dovecot.after = [ "sops-install-secrets.service" ];
+
+      security.acme.certs."${hostName}".reloadServices = [
+        "postfix.service"
+        "dovecot.service"
+      ];
+
+      common = {
+        configure.persist.system.dirs = [
+          "/var/lib/dhparams"
+          "/var/lib/dovecot"
+          "/var/lib/postfix"
+          {
+            directory = "/var/lib/dkimKeys";
+            mode = "0700";
+            user = "rspamd";
+            group = "rspamd";
+          }
+          {
+            directory = "/var/lib/mailboxes";
+            mode = "0700";
+            user = "virtualMail";
+            group = "virtualMail";
+          }
+          {
+            directory = "/var/lib/redis-rspamd";
+            mode = "0700";
+            user = "redis-rspamd";
+            group = "redis-rspamd";
+          }
+          {
+            directory = "/var/lib/rspamd";
+            mode = "0700";
+            user = "rspamd";
+            group = "rspamd";
+          }
+          {
+            directory = "/var/lib/sieve";
+            mode = "0770";
+            user = "virtualMail";
+            group = "virtualMail";
+          }
+        ];
+
+        services.resticBackup.mailserver = {
+          enable = true;
+          targets = [ "isodon.fc9f.de" ];
+          sshKeyFile = config.sops.secrets."restic/mailserver/sshPrivateKey".path;
+          passwordFile = config.sops.secrets."restic/mailserver/repositoryPassword".path;
+          paths = [
+            "/var/lib/mailboxes"
+            "/var/lib/dkimKeys"
+            "/var/lib/sieve"
+          ];
+        };
+      };
+
+      services = {
+        dovecot2 = {
+          pluginSettings.sieve_global = "/etc/dovecot/sieve";
+          sieve.extensions = [ "editheader" ];
+        };
+        nginx.virtualHosts."autoconfig.${primaryDomain}" = {
+          useACMEHost = "${config.networking.fqdn}";
+          forceSSL = true;
+          locations."= /mail/config-v1.1.xml".return = "200 '${mailAutoConfig}'";
+        };
+      };
+
+      mailserver = {
+        enable = true;
+        stateVersion = 3;
+
+        openFirewall = true;
+        localDnsResolver = false;
+        virusScanning = false;
+
+        certificateScheme = "acme";
+
+        enableManageSieve = true;
+        enableSubmission = true;
+        enableSubmissionSsl = true;
+        enableImap = true;
+        enableImapSsl = true;
+        enablePop3 = false;
+        enablePop3Ssl = false;
+
+        fullTextSearch.enable = true;
+        dmarcReporting.enable = true;
+
+        indexDir = "/var/lib/dovecot/indices";
+        mailDirectory = "/var/lib/mailboxes";
+        sieveDirectory = "/var/lib/sieve";
+        dkimKeyDirectory = "/var/lib/dkimKeys";
+
+        fqdn = hostName;
+        systemDomain = primaryDomain;
+        systemName = "zaphyra-mail";
+
+        domains = [ primaryDomain ] ++ (lib.attrNames extraDomains);
+
+        loginAccounts = {
+          "katja@zaphyra.eu" = {
+            hashedPasswordFile = config.sops.secrets."mailPasswords/katja@zaphyra.eu".path;
+            sieveScript = ''
+              require ["include"];
+              include :global "katja-zaphyra-eu";
+            '';
+            aliases = [
+              "@zaphyra.eu"
+              "@ctu.cx"
+              "@ctucx.de"
+              "@thein.ovh"
+              "@katja.wtf"
+            ];
+          };
+          "gts@zaphyra.eu" = {
+            hashedPasswordFile = config.sops.secrets."mailPasswords/gts@zaphyra.eu".path;
+            sendOnly = true;
+          };
+          "vaultwarden@zaphyra.eu" = {
+            hashedPasswordFile = config.sops.secrets."mailPasswords/vaultwarden@zaphyra.eu".path;
+            sendOnly = true;
+          };
+        };
+      };
+    }
+  );
+
+}