.gitmodules

@@ -1,15 +1,15 @@
 [submodule "nvim"]
-	path = user/modules/neovim/nvim
+	path = src/user/modules/utils/modules/neovim/config/nvim
 	url = https://github.com/itme-brain/nvim.git
 
 [submodule "vim"]
-	path = user/modules/vim/vim
+	path = src/user/modules/utils/modules/vim/vim
 	url = https://github.com/itme-brain/vim.git
 
 [submodule "git"]
-	path = user/modules/git/git
+	path = src/user/modules/git/git
 	url = https://github.com/itme-brain/git.git
 
 [submodule "bash"]
-	path = user/modules/bash/bash
+	path = src/user/modules/bash/config/bash
 	url = https://github.com/itme-brain/bash.git

README.md

@@ -1,27 +1,23 @@
-# NixOS Configuration
+# My Nix Configurations 💻
 
-Modular NixOS flake configuration with home-manager integration.
+My modular Nix configs 🔥
 
-## Requirements
+## Requirements ⚙️
 
-- [Nix with Flakes](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS)
+- [Nix 2.0 & Flakes enabled](https://nixos.wiki/wiki/Flakes#Enable_flakes_permanently_in_NixOS)
 - [NixOS](https://www.nixos.org/) for system configurations
-- [Home-Manager](https://nix-community.github.io/home-manager/) for user configurations
+- [Nix Home-Manager](https://nix-community.github.io/home-manager/index.xhtml#sec-flakes-standalone) for user configurations
 
-## Flake Outputs
+## Flake Endpoints ❄️
 
-| Configuration | Description |
-|---------------|-------------|
-| `desktop` | Primary workstation |
-| `server` | Home server |
-| `wsl` | Windows Subsystem for Linux |
+NixOS Configurations: `desktop` · `workstation` · `server` (wip) · `vm` · `wsl`
 
-## Fresh Install
+## Fresh Install 🚀
 
 From the NixOS live installer:
 
 ```bash
-# Enable flakes
+# Enable flakes (not enabled by default on installer)
 echo "experimental-features = nix-command flakes" | sudo tee -a /etc/nix/nix.conf
 
 # Clone repo
@@ -33,90 +29,117 @@ nix develop
 just install desktop
 ```
 
-## Getting Started
+Replace `desktop` with `workstation` or `vm` as needed.
+
+## Getting Started 🔧
 
 ```bash
 git clone --recurse-submodules git@github.com:itme-brain/nixos.git
-cd nixos
-nix develop
-just
 ```
 
-**Note:** Replace `hardware.nix` in `system/machines/<machine>` with output from `nixos-generate-config` for your hardware.
+Enter the dev shell with `nix develop`, then run `just` to see available project scripts.
 
-## Directory Structure
+Useful resources:
+- [nixpkgs Packages](https://search.nixos.org/packages) 📦️
+- [nixpkgs Options](https://search.nixos.org/options?) 🔍️
+- [Home-Manager Options](https://mipmip.github.io/home-manager-option-search/) ☕️
+
+⚠️ Be sure to tailor any hardware settings to your own — replace the `hardware.nix` in `src/system/machines/<machine>` with output from `nixos-generate-config`
+
+## Submodules 🔗
+
+Standalone portable configurations maintained as separate repos. Each can be cloned independently on any system — NixOS or not.
+
+| Submodule | Purpose | Repo | Standalone Install |
+|-----------|---------|------|--------------------|
+| **nvim** | Full IDE (LSP, treesitter, telescope) | [itme-brain/nvim](https://github.com/itme-brain/nvim) | `git clone git@github.com:itme-brain/nvim.git ~/.config/nvim` |
+| **vim** | Lightweight editor for headless servers | [itme-brain/vim](https://github.com/itme-brain/vim) | `git clone git@github.com:itme-brain/vim.git ~/.vim` |
+
+```bash
+# Update a submodule
+cd <submodule-path>
+git add . && git commit -m "your changes" && git push
+cd /path/to/nixos
+git add <submodule-path> && git commit -m "Update <name> submodule"
+
+# Pull submodule updates from remote
+git submodule update --remote
+git add <submodule-path> && git commit -m "Update <name> submodule"
+```
+
+## Directory Structure 🗂️
 
 ```
 .
-├── flake.nix
+├── flake.nix                          # Flake entrypoint - defines all NixOS configurations
 ├── flake.lock
-├── justfile
-│
-├── system/
-│   ├── keys/                      # Machine SSH keys
-│   │   └── desktop/
-│   └── machines/
-│       ├── desktop/
-│       │   ├── default.nix        # Machine entry point
-│       │   ├── hardware.nix       # Hardware config
-│       │   ├── system.nix         # System settings
-│       │   └── modules/
-│       │       ├── disko/         # Disk partitioning
-│       │       └── home-manager/  # Home-manager integration
-│       ├── server/                # Server (same structure)
-│       └── wsl/                   # WSL (same structure)
-│
-└── user/
-    ├── default.nix                # User options (name, email, keys)
-    ├── home.nix                   # Shared home-manager defaults
-    ├── bookmarks/
-    ├── keys/
-    │   ├── age/
-    │   ├── pgp/
-    │   └── ssh/
-    └── modules/
-        ├── bash/bash/             # Shell (submodule)
-        ├── git/git/               # Git (submodule)
-        ├── neovim/nvim/           # Neovim (submodule)
-        ├── vim/vim/               # Vim (submodule)
-        ├── tmux/
-        ├── dev/                   # CLI dev tools
-        ├── security/
-        │   ├── gpg/
-        │   └── yubikey/
-        ├── utils/
-        │   ├── dev/               # Dev tools (claude-code, direnv, etc.)
-        │   ├── email/
-        │   ├── irc/
-        │   └── writing/
-        └── gui/
-            ├── default.nix        # Browser-focused mimeApps
-            ├── wm/
-            │   ├── hyprland/
-            │   └── sway/
-            ├── browsers/
-            ├── alacritty/
-            ├── dev/
-            │   ├── pcb/           # Arduino, KiCad
-            │   └── design/        # Penpot
-            ├── corn/
-            ├── fun/
-            └── utils/
+├── justfile                           # Project scripts (via `just`)
+├── system.configs -> src/system/machines/   # Symlink for quick access
+├── user.configs -> src/user/config/         # Symlink for quick access
+└── src/
+    ├── system/                        # System-level (NixOS) configuration
+    │   ├── machines/                  # Per-machine NixOS configurations
+    │   │   ├── desktop/               # Desktop config (flake: nixosConfigurations.desktop)
+    │   │   │   ├── default.nix        #   Machine entry point
+    │   │   │   ├── hardware.nix       #   Machine-specific hardware config
+    │   │   │   ├── system.nix         #   System-level settings
+    │   │   │   └── modules/
+    │   │   │       ├── disko/         #   Disk partitioning (disko)
+    │   │   │       └── home-manager/  #   Home-manager integration + home.nix
+    │   │   ├── workstation/           # Workstation config (same structure as desktop)
+    │   │   ├── server/                # Server config (no disko)
+    │   │   ├── vm/                    # VM config
+    │   │   ├── wsl/                   # WSL config (includes wsl module)
+    │   │   └── laptop/                # Laptop config (stub)
+    │   └── modules/                   # Shared system modules (imported by machines)
+    │       ├── default.nix
+    │       ├── bitcoin/               # Bitcoin node + electrum server
+    │       ├── forgejo/               # Self-hosted Forgejo
+    │       └── nginx/                 # Nginx reverse proxy
+    │
+    └── user/                          # User-level (home-manager) configuration
+        ├── default.nix                # User module entry point
+        ├── config/                    # User identity & settings
+        │   ├── default.nix            #   Common user variables (username, email, etc.)
+        │   ├── bookmarks/             #   Browser bookmarks
+        │   ├── keys/                  #   Public keys
+        │   │   ├── pgp/               #     PGP public keys
+        │   │   └── ssh/               #     SSH public keys
+        │   ├── nvim                   #   Symlink to neovim submodule config
+        │   └── vim                    #   Symlink to vim submodule config
+        └── modules/                   # Home-manager modules
+            ├── bash/                  # Shell config (aliases, prompt, bashrc)
+            ├── git/                   # Git config + helper scripts
+            ├── tmux/                  # Tmux config
+            ├── security/              # Security tools (GPG)
+            ├── utils/                 # CLI utilities
+            │   └── modules/
+            │       ├── dev/           #   Dev tools (penpot, PCB design)
+            │       ├── email/         #   Email client (aerc)
+            │       ├── irc/           #   IRC client
+            │       ├── neovim/        #   Neovim (config is a git submodule)
+            │       └── vim/           #   Vim lightweight (config is a git submodule)
+            └── gui/                   # GUI applications
+                ├── modules/
+                │   ├── alacritty/     #   Terminal emulator
+                │   ├── browsers/      #   Firefox & Chromium
+                │   ├── corn/          #   Corn app
+                │   ├── fun/           #   Discord, etc.
+                │   ├── utils/         #   GUI utilities
+                │   └── writing/       #   Writing tools
+                └── wm/                # Window managers
+                    ├── hyprland/      #   Hyprland (Wayland) + waybar, rofi
+                    ├── sway/          #   Sway (Wayland) + rofi
+                    ├── i3/            #   i3 (X11) + rofi
+                    └── shared/        #   Shared WM config (mimeapps)
 ```
 
-## Architecture
+### How it works
 
-**flake.nix** defines NixOS configurations that reference machines under `system/machines/`.  
-Each machine imports its hardware, system settings, and home-manager config.
+**flake.nix** defines NixOS configurations (desktop, workstation, server, wsl) that each reference a machine under `src/system/machines/`. Each machine's `default.nix` pulls in its own `hardware.nix`, `system.nix`, and per-machine modules (disko, home-manager).
 
-**user/home.nix** provides shared defaults for all users:  
-- Essential packages
-- Default modules
+The **system layer** (`src/system/`) handles NixOS-level concerns: hardware, bootloader, networking, and system services. Shared modules in `src/system/modules/` can be imported by any machine.
 
-**Machine home.nix** imports user defaults and enables machine-specific modules.
+The **user layer** (`src/user/`) handles home-manager configuration. `src/user/config/` defines user identity (name, email, keys), while `src/user/modules/` contains modular home-manager configs for individual tools. Each machine's `home-manager/home.nix` selects which user modules to enable.
 
-## Resources
-
-- [nixpkgs Packages](https://search.nixos.org/packages)
-- [nixpkgs Options](https://search.nixos.org/options)
-- [Home-Manager Options](https://home-manager-options.extranix.com)
+Root symlinks `system.configs` and `user.configs` provide quick access to machine definitions and user config from the repo root.

flake.lock

@@ -102,11 +102,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773375660,
-        "narHash": "sha256-SEzUWw2Rf5Ki3bcM26nSKgbeoqi2uYy8IHVBqOKjX3w=",
+        "lastModified": 1772822230,
+        "narHash": "sha256-yf3iYLGbGVlIthlQIk5/4/EQDZNNEmuqKZkQssMljuw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e20095fe3c6cbb1ddcef89b26969a69a1570776",
+        "rev": "71caefce12ba78d84fe618cf61644dce01cf3a96",
         "type": "github"
       },
       "original": {

flake.nix

@@ -22,36 +22,66 @@
     };
   };
 
-  outputs = { nixpkgs, nur, ... }@inputs:
+  outputs = { nixpkgs, nur, home-manager, nixos-wsl, disko, ... }:
   let
-    mkPkgs = system: import nixpkgs {
+    system = "x86_64-linux";
+    pkgs = import nixpkgs {
       inherit system;
       config = {
         allowUnfree = true;
-        nvidia.acceptLicense = true;
+	nvidia.acceptLicense = true;
       };
       overlays = [
         nur.overlays.default
       ];
     };
 
-    mkSystem = { path, system ? "x86_64-linux" }:
-      let pkgs = mkPkgs system;
-      in nixpkgs.lib.nixosSystem {
-        inherit system pkgs;
-        specialArgs = { inherit inputs; };
-        modules = [ path ];
-      };
-
   in
+  with pkgs;
   {
     nixosConfigurations = {
-      desktop = mkSystem { path = ./system/machines/desktop; };
-      server  = mkSystem { path = ./system/machines/server; };
-      wsl     = mkSystem { path = ./system/machines/wsl; };
+      desktop = nixpkgs.lib.nixosSystem {
+        inherit system pkgs;
+        modules = [
+          disko.nixosModules.disko
+          ./src/system/machines/desktop
+          home-manager.nixosModules.home-manager
+            (import ./src/system/machines/desktop/modules/home-manager)
+        ];
+      };
+
+      workstation = nixpkgs.lib.nixosSystem {
+        inherit system pkgs;
+        modules = [
+          ./src/system/machines/workstation
+          home-manager.nixosModules.home-manager
+            (import ./src/system/machines/workstation/modules/home-manager)
+        ];
+      };
+
+      server = nixpkgs.lib.nixosSystem {
+        inherit system pkgs;
+        modules = [
+          disko.nixosModules.disko
+          ./src/system/machines/server
+          home-manager.nixosModules.home-manager
+            (import ./src/system/machines/server/modules/home-manager)
+        ];
+      };
+
+      wsl = nixpkgs.lib.nixosSystem {
+        inherit system pkgs;
+        modules = [
+          ./src/system/machines/wsl
+          nixos-wsl.nixosModules.wsl
+            (import ./src/system/machines/wsl/modules/wsl)
+          home-manager.nixosModules.home-manager
+            (import ./src/system/machines/wsl/modules/home-manager)
+        ];
+      };
     };
 
-    devShells.x86_64-linux.default = with mkPkgs "x86_64-linux"; mkShell {
+    devShells.${system}.default = mkShell {
       name = "devShell";
       packages = [
         just

justfile

@@ -1,5 +1,5 @@
 SYSTEM := "$(echo $HOSTNAME)"
-VALID_SYSTEMS := "desktop server wsl"
+VALID_SYSTEMS := "desktop workstation server wsl vm laptop"
 
 # Print this list
 default:
@@ -10,7 +10,7 @@ default:
 _validate SYSTEM:
   #!/usr/bin/env bash
   case "{{SYSTEM}}" in
-    desktop|server|wsl) ;;
+    desktop|workstation|server|wsl|vm|laptop) ;;
     *) echo "Error: Unknown system '{{SYSTEM}}'. Use one of: {{VALID_SYSTEMS}}"; exit 1 ;;
   esac
 
@@ -42,7 +42,7 @@ out SYSTEM="desktop": (_validate SYSTEM)
 
 # Test switch into the next generation
 [group('nixos')]
-test SYSTEM=SYSTEM: (_validate SYSTEM)
+test SYSTEM="desktop": (_validate SYSTEM)
   @echo "Testing switching to next NixOS generation for {{SYSTEM}}..."
   @sudo nixos-rebuild test --flake .#{{SYSTEM}}
 
@@ -105,7 +105,7 @@ partition SYSTEM:
   #!/usr/bin/env bash
   set -euo pipefail
 
-  DISKO_CONFIG="./system/machines/{{SYSTEM}}/modules/disko/default.nix"
+  DISKO_CONFIG="./src/system/machines/{{SYSTEM}}/modules/disko/default.nix"
 
   if [[ ! -f "$DISKO_CONFIG" ]]; then
     echo "Error: No disko config for '{{SYSTEM}}'"
@@ -172,7 +172,7 @@ install SYSTEM:
   #!/usr/bin/env bash
   set -euo pipefail
 
-  DISKO_CONFIG="./system/machines/{{SYSTEM}}/modules/disko/default.nix"
+  DISKO_CONFIG="./src/system/machines/{{SYSTEM}}/modules/disko/default.nix"
 
   if [[ ! -f "$DISKO_CONFIG" ]]; then
     echo "Error: No disko config for '{{SYSTEM}}'"

src/system/config/default.nix

@@ -0,0 +1,14 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+{
+  options = {
+    machines = mkOption {
+      description = "Machine Configurations";
+      type = types.attrs;
+      default = {
+        keys = import ./keys { inherit lib; };
+      };
+    };
+  };
+}

src/system/config/keys/desktop/README.md

@@ -0,0 +1,3 @@
+# Desktop Keys
+
+ssh.pub.key - ~/.ssh/id_rsa

src/system/machines/desktop/default.nix

@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  imports = [
+    ../../../user/config
+    ../../config
+    ./hardware.nix
+    ./system.nix
+    ./modules/disko
+  ];
+}

src/system/machines/desktop/hardware.nix

@@ -50,8 +50,6 @@ with lib;
 
       cudaPackages.cudatoolkit
       cudaPackages.cudnn
-
-      nvidia-vaapi-driver
     ];
 
     hardware = {
@@ -72,9 +70,6 @@ with lib;
       };
     };
 
-    # Despite confusing name, this configures userspace nvidia libraries
-    services.xserver.videoDrivers = [ "nvidia" ];
-
     virtualisation.libvirtd = {
       enable = true;
       qemu = {

src/system/machines/desktop/modules/home-manager/home.nix

@@ -0,0 +1,72 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.extraSpecialArgs = {
+    monitors = config.monitors;
+  };
+  home-manager.users.${config.user.name} = {
+    imports = [ ../../../../../user ];
+
+    programs.home-manager.enable = true;
+
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+      matchBlocks = {
+        "*" = {
+          serverAliveInterval = 60;
+          serverAliveCountMax = 3;
+        };
+        "server" = {
+          hostname = "192.168.0.154";
+          user = "bryan";
+        };
+      };
+    };
+
+    home.stateVersion = "23.11";
+
+    home.username = "${config.user.name}";
+    home.homeDirectory = "/home/${config.user.name}";
+
+    modules = {
+      user = {
+        bash.enable = true;
+        git.enable = true;
+
+        security = {
+          enable = true;
+          gpg.enable = true;
+        };
+
+        tmux.enable = true;
+
+        utils = {
+          enable = true;
+          dev = {
+            enable = true;
+          };
+          irc.enable = true;
+          neovim.enable = true;
+          vim.enable = false;
+        };
+
+        gui = {
+          wm.hyprland.enable = true;
+
+          browser = {
+            firefox.enable = true;
+          };
+
+          alacritty.enable = true;
+          corn.enable = true;
+          fun.enable = true;
+          utils.enable = true;
+          writing.enable = true;
+        };
+      };
+    };
+  };
+}

src/system/machines/laptop/default.nix

@@ -0,0 +1 @@
+#TODO: nixify the shitty laptop

src/system/machines/server/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  imports = [
+    ../../../user/config
+    ../../config
+    ./hardware.nix
+    ./system.nix
+  ];
+}

src/system/machines/server/hardware.nix

@@ -1,7 +1,10 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    ./modules/disko
+  ];
 
   boot = {
     initrd = {

src/system/machines/server/modules/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./home
+  ];
+}

src/system/machines/server/modules/home-manager/default.nix

@@ -0,0 +1,33 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.${config.user.name} = {
+    imports = [ ../../../../../user ];
+
+    programs.home-manager.enable = true;
+
+    home.stateVersion = "25.11";
+
+    home.username = "${config.user.name}";
+    home.homeDirectory = "/home/${config.user.name}";
+
+    modules = {
+      user = {
+        bash.enable = true;
+        git.enable = true;
+        tmux.enable = true;
+
+        security = {
+          gpg.enable = true;
+        };
+
+        utils = {
+          enable = true;
+          vim.enable = true;
+        };
+      };
+    };
+  };
+}

src/system/machines/server/system.nix

@@ -2,14 +2,13 @@
 
 { system.stateVersion = "25.11";
 
-  imports = [ ./modules ];
+  imports = [ ../../modules ];
 
   modules.system = {
     nginx.enable = true;
     forgejo.enable = true;
     frigate.enable = true;
     immich.enable = true;
-    webdav.enable = false;
     # bitcoin = {
     #   enable = true;
     #   electrum.enable = true;

src/system/machines/vm/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  imports = [
+    ../../../user/config
+    ../../config
+    ./hardware.nix
+    ./system.nix
+  ];
+}

src/system/machines/vm/hardware.nix

@@ -0,0 +1,14 @@
+{ config, lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

src/system/machines/vm/modules/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./home
+  ];
+}

src/system/machines/vm/modules/disko/default.nix

@@ -0,0 +1,49 @@
+{ disk ? "/dev/vda" }:
+{
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = disk;
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "200M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            primary = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "vm";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      vm = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

src/system/machines/vm/modules/home-manager/default.nix

@@ -0,0 +1,32 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.${config.user.name} = {
+    imports = [ ../../../../../user ];
+
+    programs.home-manager.enable = true;
+
+    home.stateVersion = "23.11";
+
+    home.username = "${config.user.name}";
+    home.homeDirectory = "/home/${config.user.name}";
+
+    modules = {
+      user = {
+        bash.enable = true;
+        git.enable = true;
+
+        security = {
+          gpg.enable = true;
+        };
+
+        utils = {
+          enable = true;
+          vim.enable = true;
+        };
+      };
+    };
+  };
+}

src/system/machines/vm/system.nix

@@ -0,0 +1,96 @@
+{ pkgs, lib, config, ... }:
+
+{ system.stateVersion = "23.11";
+
+  imports = [ ../../modules ];
+
+  users.users = {
+    ${config.user.name} = {
+      isNormalUser = true;
+      extraGroups = config.user.groups;
+      openssh.authorizedKeys.keys = [ "${config.user.keys.ssh.yubikey}" ];
+    };
+  };
+
+  nix = {
+    channel.enable = false;
+    package = pkgs.nixVersions.stable;
+    extraOptions = "experimental-features = nix-command flakes";
+    settings = {
+      auto-optimise-store = true;
+      trusted-users = [ "${config.user.name}" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  boot.loader = {
+    timeout = null;
+    grub = {
+      enable = true;
+      useOSProber = true;
+      devices = [ "nodev" ];
+      efiSupport = true;
+      configurationLimit = 3;
+      splashImage = null;
+    };
+
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  #fonts.packages = with pkgs; [
+  #  terminus_font
+  #  terminus-nerdfont
+  #];
+
+  security.sudo = {
+    wheelNeedsPassword = false;
+    execWheelOnly = true;
+  };
+
+  time = {
+    timeZone = "America/New_York";
+    hardwareClockInLocalTime = false;
+  };
+
+  services.timesyncd = lib.mkDefault {
+    enable = true;
+    servers = [
+      "0.pool.ntp.org"
+      "1.pool.ntp.org"
+      "2.pool.ntp.org"
+      "3.pool.ntp.org"
+    ];
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  networking = {
+    hostName = "vm";
+    useDHCP = lib.mkDefault true;
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 22 80 443 ];
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    startWhenNeeded = true;
+    settings = {
+      X11Forwarding = false;
+      PasswordAuthentication = true;
+    };
+  };
+}

src/system/machines/workstation/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  imports = [
+    ../../../user/config
+    ../../config
+    ./hardware.nix
+    ./system.nix
+  ];
+}

src/system/machines/workstation/hardware.nix

@@ -0,0 +1,101 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [ "vmd" "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+      kernelModules = [ "dm-snapshot" ];
+    };
+    extraModulePackages = [ ];
+    kernelParams = [ "intel_iommu=on" ];
+    kernelModules = [ 
+      "kvm-intel" 
+      "virtio" 
+      "vfio-pci" 
+      "coretemp" 
+
+      "ipmi_devintf"
+      "ipmi_si"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    ipmitool
+    ipmicfg
+    ipmiutil
+    ipmiview
+
+    linuxHeaders
+
+    vulkan-headers
+    vulkan-loader
+    vulkan-tools
+    vulkan-extension-layer
+
+    mesa
+    mesa-demos
+
+    libGL
+  ];
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/6e964c61-ea77-48cc-b495-6a8516b8e756";
+      fsType = "xfs";
+    };
+
+    "/home" = {
+      device = "/dev/disk/by-uuid/db504fb8-14f8-4292-b745-32d6255c4893";
+      fsType = "xfs";
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/61E7-6E56";
+      fsType = "vfat";
+    };
+
+    "/var/lib/libvirt/images" = {
+      device = "/home/VMs";
+      options = [ "bind" ];
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /home/VMs 0755 root root" 
+  ];
+
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      runAsRoot = true;
+    };
+  };
+
+  services.xserver.videoDrivers = lib.mkDefault [ "nvidia" ];
+
+  hardware = {
+    graphics = {
+      enable = true;
+      enable32Bit = true;
+    };
+
+    nvidia = {
+      open = false;
+      powerManagement.enable = false;
+      powerManagement.finegrained = false;
+      modesetting.enable = true;
+      nvidiaSettings = true;
+      package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
+	version = "550.120";
+	sha256_64bit = "sha256-gBkoJ0dTzM52JwmOoHjMNwcN2uBN46oIRZHAX8cDVpc=";
+	settingsSha256 = "sha256-fPfIPwpIijoUpNlAUt9C8EeXR5In633qnlelL+btGbU=";
+	persistencedSha256 = lib.fakeSha256;
+      };
+    };
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

src/system/machines/workstation/modules/disko/default.nix

@@ -0,0 +1,58 @@
+{ disk }:
+{
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = disk;
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            primary = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "nix";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      nix = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "5%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          home = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/home";
+            };
+          };
+        };
+      };
+    };
+  };
+}

src/system/machines/workstation/modules/home-manager/home.nix

@@ -0,0 +1,52 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.${config.user.name} = {
+    imports = [ ../../../../../user ];
+
+    programs.home-manager.enable = true;
+
+    home.stateVersion = "23.11";
+
+    home.username = "${config.user.name}";
+    home.homeDirectory = "/home/${config.user.name}";
+
+    modules = {
+      user = {
+        bash.enable = true;
+        git.enable = true;
+
+        security = {
+          enable = true;
+          gpg.enable = true;
+        };
+
+        tmux.enable = true;
+
+        utils = {
+          enable = true;
+          dev = {
+            enable = true;
+          };
+          email.enable = true;
+          neovim.enable = true;
+          vim.enable = true;
+        };
+
+        gui = {
+          wm.i3.enable = true;
+
+          browser = {
+            chromium.enable = true;
+          };
+
+          alacritty.enable = true;
+          utils.enable = true;
+          writing.enable = true;
+        };
+      };
+    };
+  };
+}

src/system/machines/workstation/system.nix

@@ -0,0 +1,131 @@
+{ pkgs, lib, config, home-manager, ... }:
+
+with lib;
+{ 
+  system.stateVersion = "23.11";
+
+  users.users = {
+    ${config.user.name} = {
+      isNormalUser = true;
+      extraGroups = config.user.groups
+        ++ [ "video" "audio" "kvm" "libvirtd" "dialout" ];
+      openssh.authorizedKeys.keys = [ 
+        "${config.user.keys.ssh.yubikey}" 
+        "${config.user.keys.ssh.work}" 
+      ];
+    };
+  };
+
+  nix = {
+    channel.enable = false;
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      keep-going = true
+    '';
+    settings = {
+      auto-optimise-store = true;
+      trusted-users = [ "${config.user.name}" ];
+      substitute = true;
+      max-jobs = "auto";
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+      memtest86.enable = true;
+    };
+    timeout = null;
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    usbutils
+  ];
+
+  fonts.packages = with pkgs; [
+    terminus_font
+    terminus-nerdfont
+  ];
+
+  security = {
+    sudo = {
+      wheelNeedsPassword = false;
+      execWheelOnly = true;
+    };
+    polkit.enable = true;
+  };
+
+  time = {
+    timeZone = "America/New_York";
+    hardwareClockInLocalTime = true;
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  networking = {
+    hostName = "workstation";
+    useDHCP = lib.mkDefault true;
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 22 80 443 ];
+    };
+  };
+
+  programs.i3lock = {
+    enable = true;
+    package = pkgs.i3lock-fancy;
+  };
+
+  services = {
+    xserver.enable = true;
+    displayManager.ly.enable = true;
+
+    teamviewer.enable = true;
+
+    timesyncd = lib.mkDefault {
+      enable = true;
+      servers = [
+        "0.pool.ntp.org"
+        "1.pool.ntp.org"
+        "2.pool.ntp.org"
+        "3.pool.ntp.org"
+      ];
+    };
+
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+
+      wireplumber.enable = true;
+
+      pulse.enable = true;
+      jack.enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+    };
+
+    openssh = {
+      enable = true;
+      startWhenNeeded = false;
+      settings = {
+        X11Forwarding = false;
+        PasswordAuthentication = true;
+      };
+    };
+  };
+}

src/system/machines/wsl/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  imports = [
+    ../../../user/config
+    ../../config
+    ./system.nix
+  ];
+}

src/system/machines/wsl/modules/home-manager/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+<<<<<<<< HEAD:src/system/machines/wsl/modules/home-manager/default.nix
+    ./home.nix
+========
+    ./c-lightning-REST
+>>>>>>>> lightning:src/system/modules/bitcoin/modules/clightning/plugins/default.nix
+  ];
+}

src/system/machines/wsl/modules/home-manager/home.nix

@@ -0,0 +1,38 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.${config.user.name} = {
+    imports = [ ../../../../../user ];
+
+    programs.home-manager.enable = true;
+
+    home.stateVersion = "23.11";
+
+    home.username = "${config.user.name}";
+    home.homeDirectory = "/home/${config.user.name}";
+
+    modules = {
+      user = {
+        bash.enable = true;
+        git.enable = true;
+
+        security = {
+          enable = true;
+          gpg.enable = true;
+        };
+
+        tmux.enable = true;
+
+        utils = {
+          enable = true;
+          dev.enable = true;
+          email.enable = true;
+          irc.enable = true;
+          neovim.enable = true;
+        };
+      };
+    };
+  };
+}

src/system/machines/wsl/modules/wsl/wsl.nix

@@ -1,11 +1,12 @@
 { config, lib, ... }:
 
 {
-  imports = [ ../../../../../user ];
+  imports = [ ../../../../../user/config ];
 
   wsl = rec {
     enable = true;
     defaultUser = lib.mkDefault config.user.name;
+    nativeSystemd = true;
     useWindowsDriver = true;
 
     wslConf = {

src/system/modules/default.nix

@@ -8,9 +8,7 @@ let
         builtins.pathExists path &&
         builtins.readFileType path == "directory" &&
         builtins.baseNameOf path != "config" &&
-        builtins.baseNameOf path != "plugins" &&
-        builtins.baseNameOf path != "home-manager" &&
-        builtins.baseNameOf path != "disko";
+        builtins.baseNameOf path != "plugins";
       isModule = file: file == "default.nix";
       isNix = file: builtins.match ".*\\.nix" file != null && file != "default.nix";
 

src/system/modules/frigate/default.nix

@@ -0,0 +1,98 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.system.frigate;
+  nginx = config.modules.system.nginx;
+  domain = "ramos.codes";
+
+in
+{
+  options.modules.system.frigate = {
+    enable = mkEnableOption "Enable Frigate NVR";
+  };
+
+  config = mkIf cfg.enable {
+    services.frigate = {
+      enable = true;
+      hostname = "frigate.${domain}";
+      # vaapiDriver = "i965";  # Haswell only supports H.264, not HEVC
+      settings = {
+        mqtt.enabled = false;
+        # ffmpeg.hwaccel_args = "preset-vaapi";  # Disabled - camera uses HEVC which Haswell can't decode
+        record.enabled = true;
+        cameras = {
+          doorbell = {
+            enabled = true;
+            detect.enabled = false;
+            ffmpeg.inputs = [{
+              path = "rtsp://admin:ocu?u3Su@192.168.1.167/cam/realmonitor?channel=1&subtype=0";
+              roles = [ "record" ];
+            }];
+          };
+          living_room = {
+            enabled = false;
+            detect.enabled = false;
+            ffmpeg.inputs = [{
+              path = "rtsp://admin:ocu?u3Su@192.168.1.147/cam/realmonitor?channel=1&subtype=0";
+              roles = [ "record" ];
+            }];
+          };
+          kitchen = {
+            enabled = false;
+            detect.enabled = false;
+            ffmpeg.inputs = [{
+              path = "rtsp://admin:ocu?u3Su@192.168.1.147/cam/realmonitor?channel=2&subtype=0";
+              roles = [ "record" ];
+            }];
+          };
+          parking_lot = {
+            enabled = true;
+            detect.enabled = false;
+            ffmpeg.inputs = [{
+              path = "rtsp://admin:ocu?u3Su@192.168.1.194/cam/realmonitor?channel=1&subtype=0";
+              roles = [ "record" ];
+            }];
+          };
+          porch = {
+            enabled = false;
+            detect.enabled = false;
+            ffmpeg.inputs = [{
+              path = "rtsp://admin:ocu?u3Su@192.168.0.43/cam/realmonitor?channel=1&subtype=0";
+              roles = [ "record" ];
+            }];
+          };
+        };
+      };
+    };
+
+    # Add SSL to frigate's nginx virtualHost
+    services.nginx.virtualHosts."frigate.${domain}" = mkIf nginx.enable {
+      useACMEHost = domain;
+      forceSSL = true;
+    };
+
+    # Bind mount caches into the 3TB frigate LVM volume
+    systemd.tmpfiles.rules = [
+      "d /var/lib/frigate/cache 0750 frigate frigate -"
+      "d /var/lib/frigate/nginx-cache 0750 nginx nginx -"
+    ];
+
+    fileSystems."/var/cache/frigate" = {
+      device = "/var/lib/frigate/cache";
+      options = [ "bind" ];
+    };
+
+    fileSystems."/var/cache/nginx/frigate" = {
+      device = "/var/lib/frigate/nginx-cache";
+      options = [ "bind" ];
+    };
+
+    # Backup recordings/database, exclude caches
+    modules.system.backup = {
+      paths = [ "/var/lib/frigate" ];
+      exclude = [ "*/cache" "*/nginx-cache" ];
+    };
+
+  };
+}

src/user/config/bash

@@ -0,0 +1 @@
+../modules/bash/config/bash/

src/user/config/default.nix

@@ -1,6 +1,10 @@
-{ lib, pkgs, ... }:
+{ lib, pkgs, config, ... }:
 
 with lib;
+let
+  modules = config.modules.user;
+
+in
 {
   options = {
     user = mkOption {

src/user/config/git

@@ -0,0 +1 @@
+../modules/git/git/

src/user/config/keys/default.nix

@@ -1,11 +1,12 @@
-{ lib, ... }:
+{ lib }:
 
-with lib;
 with builtins;
 let
   extractName = filename:
     let
-      noKey = removeSuffix ".key" filename;
+      # Remove .key extension
+      noKey = lib.removeSuffix ".key" filename;
+      # Remove .pub/.priv/.public/.private markers
       noMarkers = replaceStrings
         [ ".pub" ".priv" ".public" ".private" ]
         [ "" "" "" "" ]
@@ -22,22 +23,11 @@ let
             value = readFile "${dir}/${subdir}/${file}";
           }) (filter (file:
             (readDir "${dir}/${subdir}").${file} == "regular" &&
-            hasSuffix ".key" file
+            lib.hasSuffix ".key" file
           ) (attrNames (readDir "${dir}/${subdir}")))
         );
       }) (filter (node: (readDir dir).${node} == "directory") (attrNames (readDir dir)))
     )
   );
-
 in
-{
-  options = {
-    machines = mkOption {
-      description = "Machine Configurations";
-      type = types.attrs;
-      default = {
-        keys = constructKeys ./.;
-      };
-    };
-  };
-}
+  constructKeys ./.

src/user/config/nvim

@@ -0,0 +1 @@
+../modules/utils/modules/neovim/config/nvim

src/user/config/vim

@@ -0,0 +1 @@
+../modules/utils/modules/vim/vim/

src/user/default.nix

@@ -14,6 +14,7 @@ let
         !(builtins.elem (builtins.baseNameOf path) excludedDirs) &&
         !(isSubmodule path);
       isModule = file: file == "default.nix";
+      isNix = file: builtins.match ".*\\.nix" file != null && file != "default.nix";
 
     in
       builtins.concatMap (name:
@@ -24,11 +25,15 @@ let
             mkModules path false
           else if isModule name && !isRoot then
             [ dir ]
+          else if isNix name then
+            [ path ]
           else
             []
       ) names;
 
 in
 {
-  imports = mkModules ./. true;
+  imports = [
+    ./config
+  ] ++ mkModules ./. true;
 }

src/user/modules/bash/config/bash

@@ -0,0 +1 @@
+Subproject commit 79eb823bbb9ff88f284ae055fe1de954df8bf2e0

src/user/modules/bash/config/shellHook.nix

@@ -0,0 +1,38 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  tmux = config.modules.user.tmux;
+  gui = config.modules.user.gui.wm;
+  sway = config.modules.user.gui.wm.sway;
+  hyprland = config.modules.user.gui.wm.hyprland;
+
+  wm = {
+    enable = builtins.any (mod: mod.enable or false) (builtins.attrValues gui);
+  };
+
+in
+''
+case $- in
+  *i*)
+    ${optionalString wm.enable ''
+    if [ -z "$DISPLAY" ] && [ "$(tty)" = "/dev/tty1" ]; then
+      ${optionalString sway.enable ''
+      exec sway
+      ''
+      }
+      ${optionalString hyprland.enable ''
+      exec Hyprland
+      ''
+      }
+      exit 0
+    fi
+    ''}
+    ${optionalString tmux.enable ''
+    if [ -z "$DISPLAY" ] && [ -z "$TMUX" ] && [ -z "$SSH_TTY" ]; then
+      exec tmux
+    fi
+    ''}
+    ;;
+esac
+''

src/user/modules/bash/default.nix

@@ -10,10 +10,12 @@ in
     programs.bash = {
       enable = true;
       initExtra = "source ~/.config/bash/bashrc";
+      profileExtra = import ./config/shellHook.nix { inherit lib config; };
     };
     
+    # .bashrc
     home.file.".config/bash" = {
-      source = ./bash;
+      source = ./config/bash;
       recursive = true;
     };
 

src/user/modules/gui/modules/browsers/firefox/default.nix

@@ -317,12 +317,6 @@ in
             "extensions.quarantinedDomains.enabled" = true;
 
             "media.videocontrols.picture-in-picture.enabled" = false;
-
-            # VA-API hardware video acceleration (NVIDIA)
-            "media.ffmpeg.vaapi.enabled" = true;
-            "media.rdd-ffmpeg.enabled" = true;
-            "media.av1.enabled" = false; # GTX 1650 doesn't support AV1 decode
-            "gfx.x11-egl.force-enabled" = true;
           };
         };
       };

src/user/modules/gui/modules/writing/default.nix

@@ -2,15 +2,16 @@
 
 with lib;
 let
-  cfg = config.modules.user.utils.writing;
+  cfg = config.modules.user.gui.writing;
 
 in
-{ options.modules.user.utils.writing = { enable = mkEnableOption "Enable writing tools"; };
+{ options.modules.user.gui.writing = { enable = mkEnableOption "Enable writing tools"; };
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
       mdbook
       pandoc
       asciidoctor
+      evince
     ];
   };
 }

src/user/modules/gui/wm/hyprland/default.nix

@@ -220,27 +220,20 @@ in
       platformTheme.name = "gtk";
     };
 
-    xdg.portal = {
-      enable = true;
-      extraPortals = with pkgs; [
-        xdg-desktop-portal-hyprland
-      ];
-      config.common.default = "*";
+    xdg = {
+      portal = {
+        enable = true;
+        extraPortals = with pkgs; [
+          xdg-desktop-portal-hyprland
+        ];
+        config.common.default = "*";
+      };
     };
 
     programs = {
       imv.enable = true;
-      mpv.enable = true;
-      zathura.enable = true;
     };
 
     fonts.fontconfig.enable = true;
-
-    # Auto-start Hyprland on tty1
-    programs.bash.profileExtra = ''
-      if [ -z "$DISPLAY" ] && [ "$(tty)" = "/dev/tty1" ]; then
-        exec Hyprland
-      fi
-    '';
   };
 }