sab

Co-authored-by: mjallen18 <matt.l.jallen@gmail.com>
Reviewed-on: #3

.gitignore

@@ -10,4 +10,5 @@ shell.nix
 .envrc
 .DS_Store
 *.qcow2
-keys
+keys
+iso-*

.sops.yaml

@@ -11,10 +11,12 @@ keys:
   - &pi5 age1t2d5scrukk0guva5sr97a8tge5j8kd865adezrcru7p269pzwvpsamkgje
   - &deck age1c8qw59ffcq9l77gfmtyc3djtvt3md0u6dwhrjcgsm98ntyf72ufqugj7cg
   - &steamdeck age1er5qucsc2mugrzrr7n3xhzv7kemkrqrw4m84r544fkk7nkg5g5eswxkqj0
-  - &matt_macbook-pro age19daqsncuzeh3j6cwk8uxp6yfj8h0qtz02jxlwwy4v8j0mfgznsvq30440g
-  - &macbook-pro age19w4zafpwnq9yhzuf8r5te2yhq7xlqj76rcgzcz935hllyrz4yvws4jn6ca
+  - &matt_macbook-pro age12gu9hqhd56yl5x3t5yenkn9yg57du08h77vzjqsmnu5hdppne38qcur5a0
+  - &macbook-pro age1t7378n8kmd3f32fkye2gw3jj6qswv3exjdx0dq8kl0xra3tmcdnsvddq3u
   - &nuc age102el4snus37dj807rwvsmlvwu2sg2d8rw3vfmtntgczfkz04l9nshetcq0
-  - &admin_nuc age102el4snus37dj807rwvsmlvwu2sg2d8rw3vfmtntgczfkz04l9nshetcq0
+  - &admin_nuc age1yn82e39pxt0d0pgny34ux4lkge4ff7wxvsye8ragvwngehemt4ps27phyw
+  - &matt_allyx age1n5frpwgvps7c2348ynu9g7g47kqar4srdplw5kkcyn4x80eqzetqw3ej2m
+  - &allyx age1lvks0rdf743cn9rvvx90mzu3mjldydlzslpmv9608wn4j0m8u3xsmu7yew
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
@@ -35,6 +37,8 @@ creation_rules:
           - *macbook-pro
           - *admin_nuc
           - *nuc
+          - *matt_allyx
+          - *allyx
   - path_regex: nas-secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - pgp:
@@ -64,6 +68,8 @@ creation_rules:
           - *steamdeck
           - *admin
           - *jallen-nas
+          - *matt_allyx
+          - *allyx
   - path_regex: pi4-secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - pgp:

checks/disksnstuff.sh

@@ -1,15 +1,62 @@
-mount -t tmpfs -o mode=755 none /mnt
-mkdir -p /mnt/{boot,home,root,etc,nix,var/log}
-mount /dev/sdb1 /mnt/boot
-mount /dev/sdb3 -o compress=zstd,subvol=home /mnt/home
-mount /dev/sdb3 -o compress=zstd,noatime,subvol=root /mnt/root
-mount /dev/sdb3 -o compress=zstd,noatime,subvol=etc /mnt/etc
-mount /dev/sdb3 -o compress=zstd,noatime,subvol=nix /mnt/nix
-mount /dev/sdb3 -o compress=zstd,noatime,subvol=log /mnt/var/log
+#!/usr/bin/env bash
 
-wpa_passphrase "Joey's Jungle 5G" "kR8v&3Qd" > 5g.conf
-wpa_supplicant -i wlp6s0 -c 5g.conf -B
-dhcpcd
+disk=/dev/mapper/nuc-nixos-cryptroot
 
-keyctl link @u @s
-clevis decrypt < "/etc/clevis/nas_pool.jwe" | bcachefs unlock /dev/disk/by-label/nas_pool
+# sudo mkfs.vfat "$disk"1
+# sudo bcachefs format --label ssd.ssd1 --compression=zstd --discard "$disk"
+
+sudo mount -t tmpfs -o mode=755 none /mnt
+sudo mkdir -p /mnt/{boot,home,root,etc,nix,var/log,tmp,persist}
+sudo mount /dev/disk/by-partlabel/disk-main-nuc-nixos-EFI /mnt/boot
+# sudo mkdir -p /mnt/boot/firmware
+# sudo mount "$disk"2 /mnt/boot/firmware
+# sudo mount "$disk"2 -o compress=zstd,subvol=home /mnt/home
+# sudo mount "$disk"2 -o compress=zstd,noatime,subvol=root /mnt/root
+# sudo mount "$disk"2 -o compress=zstd,noatime,subvol=etc /mnt/etc
+# sudo mount "$disk"2 -o compress=zstd,noatime,subvol=nix /mnt/nix
+# sudo mount "$disk"2 -o compress=zstd,noatime,subvol=log /mnt/var/log
+
+# bcachefs unlock -k session /dev/disk/by-partlabel/disk-main-nuc-nixos-bcachefs-root
+sudo cryptsetup open /dev/disk/by-partlabel/disk-main-nuc-nixos-cryptroot nuc-nixos-cryptroot  
+# sudo bcachefs unlock -k session "$disk"2
+# sudo mount "$disk" /mnt/tmp
+# cd /mnt/tmp
+# ls -alh
+
+# sudo bcachefs subvolume create nix
+# sudo bcachefs subvolume create etc
+# sudo bcachefs subvolume create log
+# sudo bcachefs subvolume create root
+# sudo bcachefs subvolume create persist
+# sudo bcachefs subvolume create home
+
+# ls -alh
+# cd /etc/nixos
+# sudo umount /mnt/tmp
+
+sudo mount -o noatime,X-mount.subdir=nix "$disk" /mnt/nix
+sudo mount -o noatime,X-mount.subdir=etc "$disk" /mnt/etc
+sudo mount -o noatime,X-mount.subdir=log "$disk" /mnt/var/log
+sudo mount -o noatime,X-mount.subdir=root "$disk" /mnt/root
+sudo mount -o noatime,X-mount.subdir=persist "$disk" /mnt/persist
+sudo mount -o X-mount.subdir=home "$disk" /mnt/home
+
+# tree /mnt
+
+# sudo nixos-install --flake /etc/nixos#nuc-nixos
+
+# sudo umount /mnt/boot
+# sudo umount /mnt/var/log
+# sudo umount /mnt/persist
+# sudo umount /mnt/home
+# sudo umount /mnt/root
+# sudo umount /mnt/etc
+# sudo umount /mnt/nix
+# sudo umount /mnt
+
+# wpa_passphrase "Joey's Jungle 5G" "kR8v&3Qd" > 5g.conf
+# wpa_supplicant -i wlp6s0 -c 5g.conf -B
+# dhcpcd
+
+# keyctl link @u @s
+# clevis decrypt < "/etc/clevis/nas_pool.jwe" | bcachefs unlock /dev/disk/by-label/nas_pool

docs/version.schema.json

@@ -0,0 +1,208 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://example.invalid/version.schema.json",
+  "title": "Unified Package Version Schema",
+  "description": "Schema for a unified version.json used by packages/",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "sources"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "type": "integer",
+      "enum": [1],
+      "description": "Schema version. Start at 1; bump on breaking changes."
+    },
+    "variables": {
+      "type": "object",
+      "description": "Common variables available for template substitution in string fields.",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "defaultVariant": {
+      "type": "string",
+      "description": "Optional default variant name for consumers."
+    },
+    "sources": {
+      "type": "object",
+      "description": "Base component sources keyed by component name.",
+      "minProperties": 1,
+      "additionalProperties": {
+        "$ref": "#/$defs/SourceSpec"
+      }
+    },
+    "variants": {
+      "type": "object",
+      "description": "Optional variants/channels/flavors; each overlays the base.",
+      "additionalProperties": {
+        "$ref": "#/$defs/VariantSpec"
+      }
+    },
+    "notes": {
+      "type": "object",
+      "description": "Optional free-form human notes/documentation.",
+      "additionalProperties": true
+    }
+  },
+  "$defs": {
+    "SourceSpecBase": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "fetcher": {
+          "type": "string",
+          "enum": ["github", "git", "url", "pypi", "none"],
+          "description": "Fetcher type for this source."
+        },
+        "hash": {
+          "type": "string",
+          "pattern": "^sha[0-9]+-",
+          "description": "SRI hash for the fetched artifact. Required unless fetcher is 'none'."
+        },
+        "version": {
+          "type": "string",
+          "description": "Optional version string metadata for this component."
+        },
+        "extra": {
+          "type": "object",
+          "description": "Optional free-form metadata for consumer logic.",
+          "additionalProperties": true
+        },
+
+        "owner": { "type": "string", "description": "GitHub owner/org (github fetcher)." },
+        "repo":  { "type": "string", "description": "GitHub repository (github fetcher)." },
+        "tag":   { "type": "string", "description": "Git tag (github fetcher). Mutually exclusive with 'rev'." },
+        "rev":   { "type": "string", "description": "Commit revision (github/git fetchers)." },
+        "submodules": { "type": "boolean", "description": "Whether to fetch submodules (github/git fetchers)." },
+
+        "url": { "type": "string", "description": "Final URL (url fetcher). May be templated." },
+        "urlTemplate": { "type": "string", "description": "Template for URL (url fetcher); supports ${var}." },
+
+        "name": { "type": "string", "description": "PyPI dist name (pypi fetcher)." }
+      }
+    },
+
+    "SourceSpec": {
+      "allOf": [
+        { "$ref": "#/$defs/SourceSpecBase" },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "github" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["owner", "repo"],
+            "oneOf": [
+              { "required": ["tag"] },
+              { "required": ["rev"] }
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "git" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["url", "rev"]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "url" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "oneOf": [
+              { "required": ["url"] },
+              { "required": ["urlTemplate"] }
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "pypi" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["name", "version"]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "enum": ["github", "git", "url", "pypi"] } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["hash"]
+          }
+        }
+      ]
+    },
+
+    "SourceOverride": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Partial override of a source within a variant. All fields optional.",
+      "properties": {
+        "fetcher": { "type": "string", "enum": ["github", "git", "url", "pypi", "none"] },
+        "hash":    { "type": "string", "pattern": "^sha[0-9]+-" },
+        "version": { "type": "string" },
+        "extra":   { "type": "object", "additionalProperties": true },
+
+        "owner": { "type": "string" },
+        "repo":  { "type": "string" },
+        "tag":   { "type": "string" },
+        "rev":   { "type": "string" },
+        "submodules": { "type": "boolean" },
+
+        "url":         { "type": "string" },
+        "urlTemplate": { "type": "string" },
+
+        "name": { "type": "string" }
+      }
+    },
+
+    "VariantSpec": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "inherits": {
+          "type": "string",
+          "description": "Optional base variant to inherit from."
+        },
+        "variables": {
+          "type": "object",
+          "description": "Variant-level variables that overlay top-level variables.",
+          "additionalProperties": { "type": "string" }
+        },
+        "sources": {
+          "type": "object",
+          "description": "Per-component overrides for this variant.",
+          "additionalProperties": { "$ref": "#/$defs/SourceOverride" }
+        },
+        "platforms": {
+          "type": "object",
+          "description": "Optional per-system overrides to support differing hashes/fields by platform.",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "sources": {
+                "type": "object",
+                "additionalProperties": { "$ref": "#/$defs/SourceOverride" }
+              },
+              "variables": {
+                "type": "object",
+                "additionalProperties": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

echo

@@ -1 +0,0 @@
-{"text": "\ue312  49\u00b0F", "tooltip": "             Overcast 49\u00b0\n<span foreground=\"#585858\" font-weight=\"bold\">     .--.    </span>Feels like: 49\u00b0\n<span foreground=\"#585858\" font-weight=\"bold\">  .-(    ).  </span>Wind: 2mph \u2199\n<span foreground=\"#585858\" font-weight=\"bold\"> (___.__)__) </span>Humidity: 80%\n             Moon phase: Waxing Crescent \ud83c\udf12\n\nToday, <b>Mon Nov 24 2025</b>\n\uf2c7 53\u00b0F \uf2ca 38\u00b0F\ue34c 07:23 AM \ue34d 04:36 PM\n03 PM \udb81\udd95 52\u00b0 Partly Cloudy , Overcast 33%, Sunshine 73%\n06 PM \ue313 44\u00b0 Mist, Overcast 83%, Sunshine 8%\n09 PM \ue313 43\u00b0 Fog, Overcast 93%, Sunshine 5%\nTomorrow, <b>Tue Nov 25 2025</b>\n\uf2c7 43\u00b0F \uf2ca 34\u00b0F\ue34c 07:24 AM \ue34d 04:36 PM\n12 AM \ue313 43\u00b0 Fog, Fog 6%, Overcast 81%, Sunshine 19%\n03 AM \ue313 42\u00b0 Fog, Overcast 89%, Sunshine 8%\n06 AM \ue313 41\u00b0 Fog, Fog 6%, Overcast 92%, Sunshine 11%\n09 AM \ue313 40\u00b0 Fog, Fog 6%, Overcast 88%, Sunshine 5%\n12 PM \ue317 39\u00b0 Moderate rain at times, Overcast 90%, Rain 100%\n03 PM \ue308 34\u00b0 Light rain, Overcast 93%, Rain 100%\n06 PM \ue318 31\u00b0 Moderate rain, Overcast 88%, Rain 100%\n09 PM \ue31a 24\u00b0 Moderate snow, Overcast 89%, Rain 100%, Snow 100%\n<b>Wed Nov 26 2025</b>\n\uf2c7 36\u00b0F \uf2ca 25\u00b0F\ue34c 07:26 AM \ue34d 04:35 PM\n12 AM \ue312 21\u00b0 Overcast , Overcast 87%, Sunshine 8%\n03 AM \ue312 14\u00b0 Overcast , Frost 25%, Overcast 94%, Sunshine 13%\n06 AM \ue312 11\u00b0 Overcast , Frost 80%, Overcast 89%, Sunshine 8%\n09 AM \ue312 13\u00b0 Overcast , Frost 79%, Overcast 80%, Sunshine 5%\n12 PM \ue33d 18\u00b0 Cloudy , Frost 77%, Overcast 89%, Sunshine 17%\n03 PM \ue30d 24\u00b0 Sunny, Frost 29%, Sunshine 90%\n06 PM \udb81\udd94 22\u00b0 Clear , Frost 78%, Sunshine 94%\n09 PM \udb83\udf31 15\u00b0 Partly Cloudy , Frost 85%, Overcast 39%, Sunshine 83%\n"}

flake.nix

@@ -1,25 +1,38 @@
 {
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  inputs = rec {
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
 
+    nixpkgs-otbr.url = "github:mrene/nixpkgs/openthread-border-router";
+
+    home-manager-stable = {
+      url = "github:nix-community/home-manager/release-25.11";
+      inputs.nixpkgs.follows = "nixpkgs-stable";
+    };
+
+    home-manager-unstable = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
+    nixpkgs = nixpkgs-unstable;
+    home-manager = home-manager-unstable;
+
     # The name "snowfall-lib" is required due to how Snowfall Lib processes your
     # flake's inputs.
     snowfall-lib = {
-      url = "github:mjallen18/lib";
+      url = "github:mjallen18/snowfall-lib";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
-
-    home-manager = {
-      url = "github:nix-community/home-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    # nixos-generators = {
+    #   url = "github:nix-community/nixos-generators";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
 
     impermanence.url = "github:nix-community/impermanence";
 
-    lanzaboote.url = "github:nix-community/lanzaboote/v0.4.3";
+    lanzaboote.url = "github:nix-community/lanzaboote/v1.0.0";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
@@ -35,7 +48,10 @@
 
     nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
 
-    authentik-nix.url = "github:nix-community/authentik-nix";
+    authentik-nix = {
+      url = "github:nix-community/authentik-nix";
+      # inputs.nixpkgs.follows = "nixpkgs-stable";
+    };
 
     nixai.url = "github:olafkfreund/nix-ai-help";
 
@@ -46,11 +62,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    nixos-raspberrypi.url = "github:mjallen18/nixos-raspberrypi";
-
-    jovian.url = "github:Jovian-Experiments/Jovian-NixOS";
-
-    darwin.url = "github:LnL7/nix-darwin";
+    darwin.url = "github:nix-darwin/nix-darwin/master";
 
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
 
@@ -66,7 +78,10 @@
 
     nixos-apple-silicon.url = "github:nix-community/nixos-apple-silicon";
 
-    pre-commit-hooks-nix.url = "github:cachix/pre-commit-hooks.nix";
+    pre-commit-hooks-nix = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
@@ -96,6 +111,16 @@
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    end4-dotfiles = {
+      url = "git+https://github.com/end-4/dots-hyprland?submodules=1";
+      flake = false;
+    };
+    illogical-flake = {
+      url = "github:soymou/illogical-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.dotfiles.follows = "end4-dotfiles";
+    };
   };
 
   # We will handle this in the next section.
@@ -115,7 +140,6 @@
         # common modules
         modules.nixos = with inputs; [
           authentik-nix.nixosModules.default
-          chaotic.nixosModules.default
           disko.nixosModules.disko
           impermanence.nixosModules.impermanence
           lanzaboote.nixosModules.lanzaboote
@@ -125,6 +149,11 @@
           stylix.nixosModules.stylix
         ];
 
+        modules.home = with inputs; [
+          nix-index-database.homeManagerModules.nix-index
+          illogical-flake.homeManagerModules.default
+        ];
+
         # common darwin modules
         modules.darwin = with inputs; [
           nix-homebrew.darwinModules.nix-homebrew
@@ -144,7 +173,7 @@
             modules = with inputs; [
               nixos-hardware.nixosModules.common-cpu-amd
               nixos-hardware.nixosModules.common-cpu-amd-pstate
-              nixos-hardware.nixosModules.common-cpu-amd-zenpower
+              # nixos-hardware.nixosModules.common-cpu-amd-zenpower
               nixos-hardware.nixosModules.common-gpu-amd
               nixos-hardware.nixosModules.common-hidpi
               nixos-hardware.nixosModules.common-pc
@@ -160,29 +189,12 @@
               nixos-hardware.nixosModules.common-pc
               nixos-hardware.nixosModules.common-cpu-amd
               nixos-hardware.nixosModules.common-cpu-amd-pstate
-              nixos-hardware.nixosModules.common-cpu-amd-zenpower
+              # nixos-hardware.nixosModules.common-cpu-amd-zenpower
               nixos-hardware.nixosModules.common-hidpi
               home-manager.nixosModules.home-manager
             ];
           };
 
-          # ######################################################
-          #                   Steamdeck                          #
-          # ######################################################
-          steamdeck = {
-            modules = with inputs; [
-              disko.nixosModules.disko
-              jovian.nixosModules.jovian
-              nixos-hardware.nixosModules.common-cpu-amd
-              nixos-hardware.nixosModules.common-cpu-amd-pstate
-              nixos-hardware.nixosModules.common-cpu-amd-zenpower
-              nixos-hardware.nixosModules.common-gpu-amd
-              nixos-hardware.nixosModules.common-hidpi
-              nixos-hardware.nixosModules.common-pc
-              lsfg-vk.nixosModules.default
-            ];
-          };
-
           # ######################################################
           #                      NUC                             #
           # ######################################################
@@ -191,7 +203,7 @@
               disko.nixosModules.disko
               nixos-hardware.nixosModules.common-cpu-amd
               nixos-hardware.nixosModules.common-cpu-amd-pstate
-              nixos-hardware.nixosModules.common-cpu-amd-zenpower
+              # nixos-hardware.nixosModules.common-cpu-amd-zenpower
               nixos-hardware.nixosModules.common-gpu-amd
               nixos-hardware.nixosModules.common-hidpi
               nixos-hardware.nixosModules.common-pc
@@ -202,17 +214,8 @@
           #                      Pi4                             #
           # ######################################################
           pi4 = {
-            specialArgs = {
-              nixpkgs = inputs.nixpkgs-stable;
-            };
             modules = with inputs; [
               disko.nixosModules.disko
-              nixos-raspberrypi.nixosModules.raspberry-pi-4.base
-              nixos-raspberrypi.nixosModules.raspberry-pi-4.display-vc4
-              nixos-raspberrypi.nixosModules.nixpkgs-rpi
-              nixos-raspberrypi.nixosModules.trusted-nix-caches
-              nixos-raspberrypi.lib.inject-overlays
-              nixos-raspberrypi.lib.inject-overlays-global
             ];
           };
 
@@ -220,19 +223,8 @@
           #                      Pi5                             #
           # ######################################################
           pi5 = {
-            specialArgs = {
-              nixpkgs = inputs.nixpkgs-stable;
-            };
             modules = with inputs; [
               disko.nixosModules.disko
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.display-vc4
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.bluetooth
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.page-size-16k
-              nixos-raspberrypi.nixosModules.nixpkgs-rpi
-              nixos-raspberrypi.nixosModules.trusted-nix-caches
-              nixos-raspberrypi.lib.inject-overlays
-              nixos-raspberrypi.lib.inject-overlays-global
             ];
           };
 
@@ -270,10 +262,11 @@
 
       channels-config = {
         allowUnfree = true;
+        allowUnsupportedSystem = true;
         permittedInsecurePackages = [
           # ...
-          "libsoup-2.74.3"
-          "mbedtls-2.28.10"
+          # "libsoup-2.74.3"
+          # "mbedtls-2.28.10"
         ];
       };
 

homes/aarch64-darwin/mattjallen@macbook-pro/default.nix

@@ -15,7 +15,7 @@ let
     age
     cpufetch
     deadnix
-    nixfmt-rfc-style
+    nixfmt
     nodePackages.nodejs
     uv
     sops
@@ -41,219 +41,219 @@ in
     };
   };
 
-  programs.nix-plist-manager = {
-    enable = true;
-    options = {
-      applications = {
-        finder = {
-          settings = {
-            general = {
-              showTheseItemsOnTheDesktop = {
-                hardDisks = false;
-                externalDisks = true;
-                cdsDvdsAndiPods = false;
-                connectedServers = false;
-              };
-              openFoldersInTabsInsteadOfNewWindows = true;
-            };
-            sidebar = {
-              recentTags = true;
-            };
-            advanced = {
-              removeItemsFromTheTrashAfter30Days = true;
-              showAllFilenameExtensions = true;
-              showWarningBeforeChangingAnExtension = true;
-              showWarningBeforeRemovingFromiCloudDrive = true;
-              showWarningBeforeEmptyingTheTrash = true;
-              keepFoldersOnTop = {
-                inWindowsWhenSortingByName = true;
-                onDesktop = true;
-              };
-              whenPerformingASearch = "Search This Mac";
-            };
-          };
-          menuBar = {
-            view = {
-              showTabBar = true;
-              showSidebar = true;
-              showPathBar = true;
-              showStatusBar = true;
-            };
-          };
-        };
-        systemSettings = {
-          appearance = {
-            appearance = "Dark";
-            accentColor = "Multicolor";
-            # clickInTheScrollBarTo = "Jump to the next page";
-            sidebarIconSize = "Medium";
-            showScrollBars = "When scrolling";
-          };
-          controlCenter = {
-            wifi = true;
-            bluetooth = true;
-            airdrop = true;
-            stageManager = true;
-            focusModes = "active";
-            screenMirroring = "active";
-            display = "never";
-            sound = "always";
-            nowPlaying = "active";
-            accessibilityShortcuts = "unset";
-            musicRecognition = {
-              showInMenuBar = false;
-              showInControlCenter = true;
-            };
-            hearing = "unset";
-            fastUserSwitching = {
-              showInMenuBar = false;
-              showInControlCenter = true;
-            };
-            keyboardBrightness = {
-              showInMenuBar = false;
-              showInControlCenter = true;
-            };
-            battery = {
-              showInMenuBar = false;
-              showInControlCenter = false;
-            };
-            batteryShowPercentage = true;
-            # menuBarOnly = {
-            #   spotlight = false;
-            #   siri = true;
-            # };
-            # automaticallyHideAndShowTheMenuBar = "In Full Screen Only";
-          };
-          desktopAndDock = {
-            desktopAndStageManager = {
-              showItems = {
-                onDesktop = true;
-                inStageManager = true;
-              };
-              clickWallpaperToRevealDesktop = "Always";
-              stageManager = false;
-              showRecentAppsInStageManager = true;
-              showWindowsFromAnApplication = "All at Once";
-            };
-            dock = {
-              animateOpeningApplications = true;
-              automaticallyHideAndShowTheDock = enabled;
-              doubleClickAWindowsTitleBarTo = "Minimize";
-              magnification = disabled;
-              minimizeWindowsIntoApplicationIcon = true;
-              minimizeWindowsUsing = "Genie Effect";
-              positionOnScreen = "Bottom";
-              showIndicatorsForOpenApplications = true;
-              showSuggestedAndRecentAppsInDock = false;
-              size = 64; # 16 - 128
-              #     persistentApps = [
-              #       { app = "/Applications/Clock.app"; }
-              #       { folder = "/Applications"; }
-              #       { app = "/Applications/Safari.app"; }
-              #       { app = "/Applications/Firefox.app"; }
-              #       { app = "/Applications/Tabby.app"; }
-              #       { app = "/Applications/Termius.app"; }
-              #       { app = "/Applications/Muic.app"; }
-              #       { app = "/Applications/Vesktop.app"; }
-              #       { app = "/Applications/Messages.app"; }
-              #       { app = "/Applications/Calendar.app"; }
-              #       { app = "/Applications/Reminders.app"; }
-              #       { app = "/Applications/Notes.app"; }
-              #       { app = "/Applications/Weather.app"; }
-              #       { app = "/Applications/Maps.app"; }
-              #       { app = "/Applications/App Store.app"; }
-              #       { app = "/Applications/System Settings.app"; }
-              #       { app = "/Applications/ChatGPT.app"; }
-              #       { app = "/Applications/Nextcloud.app"; }
-              #       { app = "/Applications/VSCodium.app"; }
-              #       { app = "/Applications/Omnissa Horizon Client.app"; }
-              #       { app = "/Applications/Proton Pass.app"; }
-              #       { app = "/Applications/OrcaSlicer.app"; }
-              #       { app = "/Applications/AlDente.app"; }
-              #     ];
-              #     persistentOthers = [
-              #       "~/Downloads"
-              #     ];
-            };
-            hotCorners = {
-              # ["-" "Mission Control" "Application Windows" "Desktop" "Start Screen Saver" "Disable Screen Saver" "Dashboard" "Put Display to Sleep" "Launchpad" "Notification Center" "Lock Screen" "Quick Note"]
-              topLeft = "-";
-              topRight = "-";
-              bottomLeft = "-";
-              bottomRight = "-";
-            };
-            missionControl = {
-              automaticallyRearrangeSpacesBasedOnMostRecentUse = true;
-              displaysHaveSeparateSpaces = true;
-              dragWindowsToTopOfScreenToEnterMissionControl = true;
-              groupWindowsByApplication = true;
-              whenSwitchingToAnApplicationSwitchToAspaceWithOpenWindowsForTheApplication = true;
-            };
-            widgets = {
-              showWidgets = {
-                onDesktop = true;
-                inStageManager = true;
-              };
-              widgetStyle = "Automatic";
-              useIphoneWidgets = true;
-            };
-            windows = {
-              askToKeepChangesWhenClosingDocuments = true;
-              closeWindowsWhenQuittingAnApplication = true;
-              dragWindowsToScreenEdgesToTile = true;
-              dragWindowsToMenuBarToFillScreen = true;
-              holdOptionKeyWhileDraggingWindowsToTile = true;
-              preferTabsWhenOpeningDocuments = "In Full Screen";
-              tiledWindowsHaveMargin = false;
-            };
-          };
-          focus = {
-            shareAcrossDevices = true;
-          };
-          # general.dateAndTime."24HourTime" = false;
-          notifications = {
-            notificationCenter = {
-              showPreviews = "When Unlocked";
-              summarizeNotifications = true;
-            };
-          };
-          sound = {
-            soundEffects = {
-              alertSound = "Boop";
-              alertVolume = 0.7;
-              playFeedbackWhenVolumeIsChanged = true;
-              playUserInterfaceSoundEffects = true;
-            };
-          };
-          spotlight = {
-            helpAppleImproveSearch = false;
-            # searchResults = {
-            #   applications = true;
-            #   calculator = true;
-            #   contacts = true;
-            #   conversion = true;
-            #   definition = true;
-            #   developer = true;
-            #   documents = true;
-            #   eventsAndReminders = true;
-            #   folders = true;
-            #   fonts = false;
-            #   images = true;
-            #   mailAndMessages = true;
-            #   movies = true;
-            #   music = true;
-            #   other = false;
-            #   pdfDocuments = true;
-            #   presentations = true;
-            #   siriSuggestions = false;
-            #   systemSettings = true;
-            #   tips = false;
-            #   websites = true;
-          };
-        };
-      };
-    };
-  };
+  # programs.nix-plist-manager = {
+  #   enable = true;
+  #   options = {
+  #     applications = {
+  #       finder = {
+  #         settings = {
+  #           general = {
+  #             showTheseItemsOnTheDesktop = {
+  #               hardDisks = false;
+  #               externalDisks = true;
+  #               cdsDvdsAndiPods = false;
+  #               connectedServers = false;
+  #             };
+  #             openFoldersInTabsInsteadOfNewWindows = true;
+  #           };
+  #           sidebar = {
+  #             recentTags = true;
+  #           };
+  #           advanced = {
+  #             removeItemsFromTheTrashAfter30Days = true;
+  #             showAllFilenameExtensions = true;
+  #             showWarningBeforeChangingAnExtension = true;
+  #             showWarningBeforeRemovingFromiCloudDrive = true;
+  #             showWarningBeforeEmptyingTheTrash = true;
+  #             keepFoldersOnTop = {
+  #               inWindowsWhenSortingByName = true;
+  #               onDesktop = true;
+  #             };
+  #             whenPerformingASearch = "Search This Mac";
+  #           };
+  #         };
+  #         menuBar = {
+  #           view = {
+  #             showTabBar = true;
+  #             showSidebar = true;
+  #             showPathBar = true;
+  #             showStatusBar = true;
+  #           };
+  #         };
+  #       };
+  #       systemSettings = {
+  #         appearance = {
+  #           appearance = "Dark";
+  #           accentColor = "Multicolor";
+  #           # clickInTheScrollBarTo = "Jump to the next page";
+  #           sidebarIconSize = "Medium";
+  #           showScrollBars = "When scrolling";
+  #         };
+  #         controlCenter = {
+  #           wifi = true;
+  #           bluetooth = true;
+  #           airdrop = true;
+  #           stageManager = true;
+  #           focusModes = "active";
+  #           screenMirroring = "active";
+  #           display = "never";
+  #           sound = "always";
+  #           nowPlaying = "active";
+  #           accessibilityShortcuts = "unset";
+  #           musicRecognition = {
+  #             showInMenuBar = false;
+  #             showInControlCenter = true;
+  #           };
+  #           hearing = "unset";
+  #           fastUserSwitching = {
+  #             showInMenuBar = false;
+  #             showInControlCenter = true;
+  #           };
+  #           keyboardBrightness = {
+  #             showInMenuBar = false;
+  #             showInControlCenter = true;
+  #           };
+  #           battery = {
+  #             showInMenuBar = false;
+  #             showInControlCenter = false;
+  #           };
+  #           batteryShowPercentage = true;
+  #           # menuBarOnly = {
+  #           #   spotlight = false;
+  #           #   siri = true;
+  #           # };
+  #           # automaticallyHideAndShowTheMenuBar = "In Full Screen Only";
+  #         };
+  #         desktopAndDock = {
+  #           desktopAndStageManager = {
+  #             showItems = {
+  #               onDesktop = true;
+  #               inStageManager = true;
+  #             };
+  #             clickWallpaperToRevealDesktop = "Always";
+  #             stageManager = false;
+  #             showRecentAppsInStageManager = true;
+  #             showWindowsFromAnApplication = "All at Once";
+  #           };
+  #           dock = {
+  #             animateOpeningApplications = true;
+  #             automaticallyHideAndShowTheDock = enabled;
+  #             doubleClickAWindowsTitleBarTo = "Minimize";
+  #             magnification = disabled;
+  #             minimizeWindowsIntoApplicationIcon = true;
+  #             minimizeWindowsUsing = "Genie Effect";
+  #             positionOnScreen = "Bottom";
+  #             showIndicatorsForOpenApplications = true;
+  #             showSuggestedAndRecentAppsInDock = false;
+  #             size = 64; # 16 - 128
+  #             #     persistentApps = [
+  #             #       { app = "/Applications/Clock.app"; }
+  #             #       { folder = "/Applications"; }
+  #             #       { app = "/Applications/Safari.app"; }
+  #             #       { app = "/Applications/Firefox.app"; }
+  #             #       { app = "/Applications/Tabby.app"; }
+  #             #       { app = "/Applications/Termius.app"; }
+  #             #       { app = "/Applications/Muic.app"; }
+  #             #       { app = "/Applications/Vesktop.app"; }
+  #             #       { app = "/Applications/Messages.app"; }
+  #             #       { app = "/Applications/Calendar.app"; }
+  #             #       { app = "/Applications/Reminders.app"; }
+  #             #       { app = "/Applications/Notes.app"; }
+  #             #       { app = "/Applications/Weather.app"; }
+  #             #       { app = "/Applications/Maps.app"; }
+  #             #       { app = "/Applications/App Store.app"; }
+  #             #       { app = "/Applications/System Settings.app"; }
+  #             #       { app = "/Applications/ChatGPT.app"; }
+  #             #       { app = "/Applications/Nextcloud.app"; }
+  #             #       { app = "/Applications/VSCodium.app"; }
+  #             #       { app = "/Applications/Omnissa Horizon Client.app"; }
+  #             #       { app = "/Applications/Proton Pass.app"; }
+  #             #       { app = "/Applications/OrcaSlicer.app"; }
+  #             #       { app = "/Applications/AlDente.app"; }
+  #             #     ];
+  #             #     persistentOthers = [
+  #             #       "~/Downloads"
+  #             #     ];
+  #           };
+  #           hotCorners = {
+  #             # ["-" "Mission Control" "Application Windows" "Desktop" "Start Screen Saver" "Disable Screen Saver" "Dashboard" "Put Display to Sleep" "Launchpad" "Notification Center" "Lock Screen" "Quick Note"]
+  #             topLeft = "-";
+  #             topRight = "-";
+  #             bottomLeft = "-";
+  #             bottomRight = "-";
+  #           };
+  #           missionControl = {
+  #             automaticallyRearrangeSpacesBasedOnMostRecentUse = true;
+  #             displaysHaveSeparateSpaces = true;
+  #             dragWindowsToTopOfScreenToEnterMissionControl = true;
+  #             groupWindowsByApplication = true;
+  #             whenSwitchingToAnApplicationSwitchToAspaceWithOpenWindowsForTheApplication = true;
+  #           };
+  #           widgets = {
+  #             showWidgets = {
+  #               onDesktop = true;
+  #               inStageManager = true;
+  #             };
+  #             widgetStyle = "Automatic";
+  #             useIphoneWidgets = true;
+  #           };
+  #           windows = {
+  #             askToKeepChangesWhenClosingDocuments = true;
+  #             closeWindowsWhenQuittingAnApplication = true;
+  #             dragWindowsToScreenEdgesToTile = true;
+  #             dragWindowsToMenuBarToFillScreen = true;
+  #             holdOptionKeyWhileDraggingWindowsToTile = true;
+  #             preferTabsWhenOpeningDocuments = "In Full Screen";
+  #             tiledWindowsHaveMargin = false;
+  #           };
+  #         };
+  #         focus = {
+  #           shareAcrossDevices = true;
+  #         };
+  #         # general.dateAndTime."24HourTime" = false;
+  #         notifications = {
+  #           notificationCenter = {
+  #             showPreviews = "When Unlocked";
+  #             summarizeNotifications = true;
+  #           };
+  #         };
+  #         sound = {
+  #           soundEffects = {
+  #             alertSound = "Boop";
+  #             alertVolume = 0.7;
+  #             playFeedbackWhenVolumeIsChanged = true;
+  #             playUserInterfaceSoundEffects = true;
+  #           };
+  #         };
+  #         spotlight = {
+  #           helpAppleImproveSearch = false;
+  #           # searchResults = {
+  #           #   applications = true;
+  #           #   calculator = true;
+  #           #   contacts = true;
+  #           #   conversion = true;
+  #           #   definition = true;
+  #           #   developer = true;
+  #           #   documents = true;
+  #           #   eventsAndReminders = true;
+  #           #   folders = true;
+  #           #   fonts = false;
+  #           #   images = true;
+  #           #   mailAndMessages = true;
+  #           #   movies = true;
+  #           #   music = true;
+  #           #   other = false;
+  #           #   pdfDocuments = true;
+  #           #   presentations = true;
+  #           #   siriSuggestions = false;
+  #           #   systemSettings = true;
+  #           #   tips = false;
+  #           #   websites = true;
+  #         };
+  #       };
+  #     };
+  #   };
+  # };
 
   # Manage bug in compilations - who uses manpages in 2024 anyways? :P
   manual.manpages = enabled;

homes/aarch64-linux/matt@macbook-pro-nixos/default.nix

@@ -6,12 +6,6 @@
 }:
 let
   inherit (lib.${namespace}) enabled disabled;
-  shellAliases = {
-    update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
-    update-switch = "sudo nixos-rebuild switch --max-jobs 10 --build-host admin@10.0.1.3";
-    update-flake = "nix flake update mac-nixpkgs mac-nixos-apple-silicon mac-home-manager mac-impermanence mac-sops-nix --flake /etc/nixos";
-    update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
-  };
   # Displays
   display = {
     input = "eDP-1";
@@ -26,8 +20,9 @@ in
   home.stateVersion = "23.11";
 
   ${namespace} = {
+    desktop.gnome = enabled;
     programs.hyprland = {
-      enable = true;
+      enable = false;
       primaryDisplay = "eDP-1";
       debug.disableScaleChecks = true;
 
@@ -57,7 +52,7 @@ in
       ];
 
       windowRule = [
-        "size 2160 3356, tag:horizonrdp"
+        # "size 2160 3356, tag:horizonrdp"
       ];
 
       hyprpaper = {
@@ -67,31 +62,29 @@ in
       keybinds = {
         bind = [
           "$mod, A, exec, chromium --app=\"https://music.apple.com\""
+
+          "SHIFT, XF86MonBrightnessUp, exec, lightctl -D kbd_backlight up"
+          "SHIFT, XF86MonBrightnessDown, exec, lightctl -D kbd_backlight down"
         ];
       };
 
       defaultApps = {
         browser = pkgs.firefox;
       };
+
+      extraConfig = ''
+        exec-once = brightnessctl -d kbd_backlight s 50%
+      '';
     };
     programs = {
       btop = enabled;
-      kitty = {
-        enable = true;
-      };
-      mako = {
-        enable = true;
-      };
-      nwg-dock = enabled;
-      nwg-drawer = enabled;
-      nwg-panel = {
-        enable = true;
-        defaultApps = {
-          browser = pkgs.firefox;
-        };
-      };
+      kitty = disabled;
+      mako = disabled;
+      nwg-dock = disabled;
+      nwg-drawer = disabled;
+      nwg-panel = disabled;
       waybar = {
-        enable = true;
+        enable = false;
 
         layer = "bottom";
 
@@ -125,24 +118,32 @@ in
 
         windowOffset = 75;
       };
-      wlogout = enabled;
-      wofi = enabled;
+      wlogout = disabled;
+      wofi = disabled;
     };
   };
 
-  home.packages = with pkgs; [
-    pkgs.${namespace}.bolt-launcher
-    pkgs.${namespace}.librepods
+  home.packages =
+    with pkgs.${namespace};
+    [
+      # librepods
+    ]
+    ++ (with pkgs; [
+      bolt-launcher
+      iw
+      iwd
+      orca-slicer
+      vscodium
+    ]);
 
-    iw
-    iwd
-    orca-slicer
-    vscodium
-  ];
+  services = {
+    kdeconnect = {
+      enable = lib.mkForce true;
+      indicator = lib.mkForce true;
+    };
+  };
 
   programs = {
     password-store = enabled;
-
-    zsh.shellAliases = shellAliases;
   };
 }

homes/aarch64-linux/matt@pi4/default.nix

@@ -5,21 +5,6 @@ in
 {
   home.username = "matt";
 
-  ${namespace} = {
-    shell-aliases = {
-      enable = true;
-      flakeInputs = [
-        "pi4-nixpkgs"
-        "pi4-home-manager"
-        "pi4-impermanence"
-        "pi4-sops-nix"
-        "pi4-nixos-hardware"
-        "pi4-nixos-raspberrypi"
-        "pi4-disko"
-      ];
-    };
-  };
-
   sops = {
     age.keyFile = "/home/matt/.config/sops/age/keys.txt";
     defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";

homes/aarch64-linux/matt@pi5/default.nix

@@ -5,14 +5,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
-  shellAliases = {
-    update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
-    update-switch = "sudo nixos-rebuild switch --max-jobs 10 --build-host admin@10.0.1.3";
-    update-flake = "nix flake update pi5-nixpkgs pi5-home-manager pi5-impermanence pi5-nixos-hardware pi5-sops-nix nixos-raspberrypi --flake /etc/nixos";
-    update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
-    nas-ssh = "kitten ssh admin@10.0.1.3";
-  };
+  inherit (lib.${namespace}) disabled;
 in
 {
 
@@ -57,10 +50,6 @@ in
     };
   };
 
-  programs = {
-    zsh.shellAliases = shellAliases;
-  };
-
   services = {
     nextcloud-client = lib.mkForce disabled;
     kdeconnect = {

homes/aarch64-linux/root@macbook-pro-nixos/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/aarch64-linux/root@pi4/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/aarch64-linux/root@pi5/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/x86_64-linux/admin@jallen-nas/default.nix

@@ -1,22 +1,19 @@
 { pkgs, namespace, ... }:
 {
-  home.username = "admin";
+  home = {
+    username = "admin";
+    packages =
+      with pkgs;
+      [
+        heroic
+      ]
+      ++ (with pkgs.${namespace}; [
+        moondeck-buddy
+      ]);
+  };
 
   ${namespace} = {
-    shell-aliases = {
-      enable = true;
-      buildHost = ""; # NAS builds locally
-      flakeInputs = [
-        "nas-nixpkgs"
-        "nas-authentik-nix"
-        "nas-cosmic"
-        "nas-home-manager"
-        "nas-impermanence"
-        "nas-lanzaboote"
-        "nas-nixos-hardware"
-        "nas-sops-nix"
-      ];
-    };
+    sops.enable = true;
   };
 
   sops = {
@@ -68,6 +65,23 @@
         }
       ];
     };
-  };
+    steam-rom-manager = {
+      enable = true;
+      steamUsername = "mjallen18";
 
+      # Optional: override default paths if needed
+      environmentVariables = {
+        romsDirectory = "/home/admin/Emulation/roms";
+        steamDirectory = "/home/admin/.local/share/Steam";
+      };
+
+      emulators = {
+        "Non-SRM Shortcuts" = {
+          enable = true;
+          parserType = "Non-SRM Shortcuts";
+          extraArgs = "";
+        };
+      };
+    };
+  };
 }

homes/x86_64-linux/admin@nuc-nixos/default.nix

@@ -1,18 +1,15 @@
-{ pkgs, ... }:
+{
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
 let
-  shellAliases = {
-    update-boot = "sudo nixos-rebuild boot --max-jobs 10";
-    update-switch = "sudo nixos-rebuild switch --max-jobs 10";
-    update-flake = "nix flake update nas-nixpkgs nas-authentik-nix nas-cosmic nas-crowdsec nas-home-manager nas-impermanence nas-lanzaboote nas-nixos-hardware nas-sops-nix --flake /etc/nixos";
-  };
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "admin";
 
-  programs = {
-    zsh.shellAliases = shellAliases;
-  };
-
   # Configure systemd user service for protonmail-bridge
   systemd.user.services.protonmail-bridge = {
     Service = {
@@ -24,9 +21,17 @@ in
   };
 
   services = {
+    nextcloud-client = lib.mkForce disabled;
+    kdeconnect = {
+      enable = false;
+      indicator = false;
+    };
     protonmail-bridge = {
       enable = true;
-      extraPackages = with pkgs; [ pass libsecret ];
+      extraPackages = with pkgs; [
+        pass
+        libsecret
+      ];
     };
   };
 }

homes/x86_64-linux/deck@steamdeck/default.nix

@@ -1,84 +0,0 @@
-{ lib, pkgs, namespace, ... }:
-let
-  inherit (lib.${namespace}) enabled disabled;
-  shellAliases = {
-    update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
-    update-switch = "sudo nixos-rebuild switch --max-jobs 10";
-    update-flake = "nix flake update steamdeck-nixpkgs steamdeck-chaotic steamdeck-home-manager steamdeck-impermanence steamdeck-jovian steamdeck-lanzaboote steamdeck-nixos-hardware steamdeck-sops-nix steamdeck-steam-rom-manager --flake /etc/nixos";
-    nas-ssh = "ssh admin@10.0.1.3";
-  };
-in
-{
-  home.username = "deck";
-
-  ${namespace}.desktop.gnome = enabled;
-
-  sops = {
-    age.keyFile = "/home/deck/.config/sops/age/keys.txt";
-    defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
-    validateSopsFiles = false;
-    secrets = {
-      "ssh-keys-public/deck" = {
-        path = "/home/deck/.ssh/id_ed25519.pub";
-        mode = "0644";
-      };
-      "ssh-keys-private/deck" = {
-        path = "/home/deck/.ssh/id_ed25519";
-        mode = "0600";
-      };
-    };
-  };
-
-  programs = {
-    steam-rom-manager = {
-      enable = true;
-      steamUsername = "mjallen18";
-
-      # Optional: override default paths if needed
-      environmentVariables = {
-        romsDirectory = "/home/deck/Emulation/roms";
-        steamDirectory = "/home/deck/.local/share/Steam";
-      };
-
-      emulators = {
-        ryujinx = enabled;
-
-        dolphin-gamecube = {
-          enable = true;
-          package = pkgs.dolphin-emu;
-          romFolder = "gc";
-          fileTypes = [
-            ".iso"
-            ".ISO"
-            ".gcm"
-            ".GCM"
-            ".ciso"
-            ".CISO"
-            "rvz"
-          ];
-          extraArgs = "-b -e \"\${filePath}\"";
-        };
-
-        pcsx2 = enabled;
-        mgba = enabled;
-
-        "Non-SRM Shortcuts" = {
-          enable = true;
-          parserType = "Non-SRM Shortcuts";
-          extraArgs = "";
-        };
-      };
-    };
-
-    zsh.shellAliases = shellAliases;
-  };
-
-  home.packages = with pkgs; [
-    dolphin-emu
-    heroic
-    mgba
-    prismlauncher
-    ryubing
-    omnissa-horizon-client
-  ];
-}

homes/x86_64-linux/matt@allyx/default.nix

@@ -0,0 +1,88 @@
+{
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  inherit (lib.${namespace}) enabled;
+in
+{
+  home.username = "matt";
+
+  ${namespace}.desktop.gnome = enabled;
+
+  sops = {
+    age.keyFile = "/home/matt/.config/sops/age/keys.txt";
+    defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
+    validateSopsFiles = false;
+    secrets = {
+      "ssh-keys-public/matt" = {
+        path = "/home/matt/.ssh/id_ed25519.pub";
+        mode = "0644";
+      };
+      "ssh-keys-private/matt" = {
+        path = "/home/matt/.ssh/id_ed25519";
+        mode = "0600";
+      };
+    };
+  };
+
+  programs = {
+    steam-rom-manager = {
+      enable = true;
+      steamUsername = "mjallen18";
+
+      # Optional: override default paths if needed
+      environmentVariables = {
+        romsDirectory = "/home/matt/Emulation/roms";
+        steamDirectory = "/home/matt/.local/share/Steam";
+      };
+
+      emulators = {
+        ryujinx = enabled;
+
+        dolphin-gamecube = {
+          enable = true;
+          package = pkgs.dolphin-emu;
+          romFolder = "gc";
+          fileTypes = [
+            ".iso"
+            ".ISO"
+            ".gcm"
+            ".GCM"
+            ".ciso"
+            ".CISO"
+            "rvz"
+          ];
+          extraArgs = "-b -e \"\${filePath}\"";
+        };
+
+        pcsx2 = enabled;
+        mgba = enabled;
+
+        "Non-SRM Shortcuts" = {
+          enable = true;
+          parserType = "Non-SRM Shortcuts";
+          extraArgs = "";
+        };
+      };
+    };
+  };
+
+  home.packages =
+    with pkgs;
+    [
+      dolphin-emu
+      heroic
+      mgba
+      moonlight-qt
+      prismlauncher
+      ryubing
+      omnissa-horizon-client
+    ]
+    ++ (with pkgs.${namespace}; [
+      discord-krisp
+      librepods-beta
+    ]);
+}

homes/x86_64-linux/matt@matt-nixos/default.nix

@@ -2,7 +2,6 @@
   lib,
   pkgs,
   namespace,
-  config,
   ...
 }:
 let
@@ -17,7 +16,6 @@ let
     resolution = "3840x2160";
     refreshRate = "240.00000";
   };
-  theme = config.mjallen.theme.palette;
 in
 {
   home.username = "matt";
@@ -42,14 +40,14 @@ in
             position = "0x0";
             scale = 1.0;
             extra = [
-              "bitdepth"
-              "10"
-              "cm"
-              "hdr"
-              "sdrbrightness"
-              "1.2"
-              "sdrsaturation"
-              "0.98"
+              # "bitdepth"
+              # "10"
+              # "cm"
+              # "hdredid"
+              # "sdrbrightness"
+              # "1.2"
+              # "sdrsaturation"
+              # "0.98"
             ];
           }
           {
@@ -58,14 +56,14 @@ in
             position = "3840x0";
             scale = 1.0;
             extra = [
-              "bitdepth"
-              "10"
-              "cm"
-              "hdr"
-              "sdrbrightness"
-              "1.5"
-              "sdrsaturation"
-              "0.98"
+              # "bitdepth"
+              # "10"
+              # "cm"
+              # "hdredid"
+              # "sdrbrightness"
+              # "1.5"
+              # "sdrsaturation"
+              # "0.98"
             ];
           }
         ];
@@ -77,7 +75,7 @@ in
         ];
 
         windowRule = [
-          "size 2160 7680, tag:horizonrdp"
+          "match:tag horizonrdp, size 2160 7680"
         ];
 
         autostartCommands = [
@@ -165,36 +163,66 @@ in
     password-store = enabled;
   };
 
-  home.packages = with pkgs; [
-    pkgs.${namespace}.bolt-launcher
-    pkgs.${namespace}.librepods
-
-    bottles
-    compose2nix
-    discord
-    distrobox
-    heroic
-    omnissa-horizon-client
-    jq
-    lutris
-    lzip
-    morph
-    orca-slicer
-    piper
-    prismlauncher
-    protontricks
-    protonvpn-gui
-    python3
-    runelite
-    smile
-    unigine-heaven
-    via
-    virt-manager
-    vorta
-    waydroid-helper
-  ];
+  home.packages =
+    with pkgs;
+    [
+      bolt-launcher
+      clevis
+      compose2nix
+      distrobox
+      heroic
+      home-manager
+      omnissa-horizon-client
+      jq
+      lzip
+      morph
+      orca-slicer
+      piper
+      prismlauncher
+      protontricks
+      protonvpn-gui
+      runelite
+      smile
+      via
+      virt-manager
+      vorta
+      waydroid-helper
+    ]
+    ++ (with pkgs.${namespace}; [
+      discord-krisp
+      # librepods
+    ]);
 
   specialisation = {
+    "end4".configuration = {
+      programs = {
+        illogical-impulse = {
+          enable = true;
+
+          dotfiles = {
+            fish = lib.mkForce disabled;
+            starship = lib.mkForce disabled;
+          };
+
+          hyprland.plugins = [
+            pkgs.hyprlandPlugins.hyprbars
+            pkgs.hyprlandPlugins.hyprexpo
+          ];
+        };
+      };
+      stylix.targets.qt = lib.mkForce disabled;
+      ${namespace} = {
+        programs = {
+          mako = lib.mkForce disabled;
+          nwg-dock = lib.mkForce disabled;
+          nwg-drawer = lib.mkForce disabled;
+          nwg-panel = lib.mkForce disabled;
+          waybar = lib.mkForce disabled;
+          wlogout = lib.mkForce disabled;
+          wofi = lib.mkForce disabled;
+        };
+      };
+    };
     "cosmic".configuration = {
       ${namespace} = {
         programs = {

homes/x86_64-linux/nixos@iso-minimal/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/x86_64-linux/root@allyx/default.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  namespace,
+  ...
+}:
+let
+  inherit (lib.${namespace}) disabled;
+in
+{
+  home.username = "root";
+  services = {
+    nextcloud-client = lib.mkForce disabled;
+    kdeconnect = {
+      enable = false;
+      indicator = false;
+    };
+  };
+}

homes/x86_64-linux/root@iso-minimal/default.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  namespace,
+  ...
+}:
+let
+  inherit (lib.${namespace}) disabled;
+in
+{
+  home.username = "root";
+  services = {
+    nextcloud-client = lib.mkForce disabled;
+    kdeconnect = {
+      enable = false;
+      indicator = false;
+    };
+  };
+}

homes/x86_64-linux/root@jallen-nas/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/x86_64-linux/root@matt-nixos/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

homes/x86_64-linux/root@nuc-nixos/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) disabled;
 in
 {
   home.username = "root";

lib/default.nix

@@ -15,5 +15,11 @@
 
     # Import examples
     examples = import ./examples { inherit inputs; };
+
+    # Import versioning utilities
+    versioning = import ./versioning {
+      lib = inputs.nixpkgs.lib;
+      inherit inputs;
+    };
   };
 }

lib/examples/file-utils.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 let
-  inherit (lib.mjallen.file)
+  inherit (lib.${namespace}.file)
     readFile
     pathExists
     safeImport

lib/examples/home-sops.nix

@@ -2,10 +2,11 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 let
-  inherit (lib.mjallen.module) mkModule mkOpt;
+  inherit (lib.${namespace}.module) mkModule mkOpt;
 in
 mkModule {
   name = "sops";
@@ -23,13 +24,16 @@ mkModule {
     ];
 
     sops = {
-      inherit (config.mjallen.sops) defaultSopsFile;
+      inherit (config.${namespace}.sops) defaultSopsFile;
       defaultSopsFormat = "yaml";
 
       age = {
         generateKey = true;
         keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
-        sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ] ++ config.mjallen.sops.sshKeyPaths;
+        sshKeyPaths = [
+          "${config.home.homeDirectory}/.ssh/id_ed25519"
+        ]
+        ++ config.${namespace}.sops.sshKeyPaths;
       };
     };
   };

lib/examples/reverseproxy.nix

@@ -1,7 +1,7 @@
 # Example usage of the reverse proxy utilities
-{ lib, ... }:
+{ lib, namespace, ... }:
 let
-  inherit (lib.mjallen-lib.reverseproxy)
+  inherit (lib.${namespace} - lib.reverseproxy)
     mkReverseProxy
     mkReverseProxies
     templates

lib/examples/sops.nix

@@ -1,6 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 let
-  inherit (lib.mjallen.module) mkModule mkOpt mkBoolOpt;
+  inherit (lib.${namespace}.module) mkModule mkOpt mkBoolOpt;
 in
 mkModule {
   name = "sops";
@@ -22,18 +27,18 @@ mkModule {
   };
   config = {
     sops = {
-      inherit (config.mjallen.sops) defaultSopsFile validateSopsFiles;
+      inherit (config.${namespace}.sops) defaultSopsFile validateSopsFiles;
 
       age = {
-        inherit (config.mjallen.sops) generateAgeKey;
+        inherit (config.${namespace}.sops) generateAgeKey;
 
         keyFile =
-          if config.mjallen.sops.ageKeyPath != null then
-            config.mjallen.sops.ageKeyPath
+          if config.${namespace}.sops.ageKeyPath != null then
+            config.${namespace}.sops.ageKeyPath
           else
-            "${config.users.users.${config.mjallen.user.name}.home}/.config/sops/age/keys.txt";
+            "${config.users.users.${config.${namespace}.user.name}.home}/.config/sops/age/keys.txt";
 
-        sshKeyPaths = config.mjallen.sops.sshKeyPaths;
+        sshKeyPaths = config.${namespace}.sops.sshKeyPaths;
       };
     };
   };

lib/examples/system-utils.nix

@@ -1,6 +1,6 @@
-{ inputs, ... }:
+{ inputs, namespace, ... }:
 let
-  inherit (inputs.self.mjallen-lib.system.common)
+  inherit (inputs.self.${namespace} - lib.system.common)
     mkExtendedLib
     mkNixpkgsConfig
     mkHomeConfigs
@@ -13,10 +13,10 @@ in
   nixosConfigurations =
     let
       # Get all systems
-      allSystems = inputs.self.mjallen-lib.file.scanSystems ../systems;
+      allSystems = inputs.self.${namespace} - lib.file.scanSystems ../systems;
 
       # Filter for NixOS systems
-      nixosSystems = inputs.self.mjallen-lib.file.filterNixOSSystems allSystems;
+      nixosSystems = inputs.self.${namespace} - lib.file.filterNixOSSystems allSystems;
     in
     inputs.nixpkgs.lib.mapAttrs' (
       _name:
@@ -74,7 +74,7 @@ in
             # Import all nixos modules recursively
             ../${system}/${hostname}
           ]
-          ++ (extendedLib.mjallen.file.importModulesRecursive ../modules/nixos);
+          ++ (extendedLib.${namespace}.file.importModulesRecursive ../modules/nixos);
         };
       }
     ) nixosSystems;
@@ -83,7 +83,7 @@ in
   homeConfigurations =
     let
       # Get all homes
-      allHomes = inputs.self.mjallen-lib.file.scanHomes ../homes;
+      allHomes = inputs.self.${namespace} - lib.file.scanHomes ../homes;
     in
     inputs.nixpkgs.lib.mapAttrs' (
       _name:
@@ -125,7 +125,7 @@ in
             # Import the home configuration
             path
           ]
-          ++ (extendedLib.mjallen.file.importModulesRecursive ../modules/home);
+          ++ (extendedLib.${namespace}.file.importModulesRecursive ../modules/home);
         };
       }
     ) allHomes;

lib/module/default.nix

@@ -1,4 +1,8 @@
-{ inputs }:
+{
+  inputs,
+  lib,
+  namespace,
+}:
 let
   inherit (inputs.nixpkgs.lib)
     mapAttrs
@@ -28,28 +32,144 @@ rec {
       name,
       description ? "",
       options ? { },
-      config ? { },
+      moduleConfig ? { },
+      domain ? "services",
+      config,
+      serviceName ? name,
     }:
+    let
+      cfg = config.${namespace}.${domain}.${name};
+
+      # Create reverse proxy configuration using mkReverseProxy
+      reverseProxyConfig = lib.${namespace}.mkReverseProxy {
+        inherit name;
+        subdomain = cfg.reverseProxy.subdomain;
+        url = "http://${config.${namespace}.network.ipv4.address}:${toString cfg.port}";
+        middlewares = cfg.reverseProxy.middlewares;
+      };
+
+      defaultConfig = {
+        ${namespace}.services.traefik = lib.mkIf cfg.reverseProxy.enable {
+          reverseProxies = [ reverseProxyConfig ];
+        };
+
+        # Open firewall
+        networking.firewall = lib.mkIf cfg.openFirewall {
+          allowedTCPPorts = [ cfg.port ];
+          allowedUDPPorts = [ cfg.port ];
+        };
+
+        users = lib.mkIf cfg.createUser {
+          users.${name} = {
+            isSystemUser = true;
+            group = name;
+            home = cfg.configDir;
+          };
+          groups.${name} = { };
+        };
+
+        systemd.services.${serviceName} = {
+          requires = [
+            "media-nas-main.mount"
+            # "openvpn-us.protonvpn.udp.service"
+          ];
+          after = lib.mkForce [
+            "media-nas-main.mount"
+            # "openvpn-us.protonvpn.udp.service"
+          ];
+          # serviceConfig = {
+          #   NetworkNamespacePath = lib.mkIf cfg.enableVpn "/run/netns/vpn";
+          #   # Consider also setting DNS *inside* the netns (see note below).
+          # };
+        };
+
+        services = {
+          postgresql = lib.mkIf cfg.configureDb {
+            enable = true;
+            ensureDatabases = [ name ];
+            ensureUsers = [
+              {
+                name = name;
+                ensureDBOwnership = true;
+              }
+            ];
+          };
+          redis.servers.${name} = lib.mkIf cfg.redis.enable {
+            enable = true;
+            port = cfg.redis.port;
+          };
+        };
+
+        # systemd.tmpfiles.rules = [
+        #   "d ${cfg.configDir} 0700 ${name} ${name} - -"
+        #   # "d ${cfg.configDir}/server-files 0775 ${name} ${name} - -"
+        #   # "d ${cfg.configDir}/user-files 0775 ${name} ${name} - -"
+        # ];
+      }
+      // moduleConfig;
+    in
     { lib, ... }:
     {
-      options.mjallen.${name} = lib.mkOption {
+      options.${namespace}.${domain}.${name} = lib.mkOption {
         type = lib.types.submodule {
           options = {
             enable = lib.mkEnableOption description;
+
+            port = mkOpt types.int 80 "Port for ${name} to be hosted on";
+
+            configDir = mkOpt types.str "/media/nas/main/appdata" "Path to the config dir";
+
+            dataDir = mkOpt types.str "/media/nas/main" "Path to the data dir";
+
+            createUser = mkBoolOpt false "create a user for this module/service";
+
+            configureDb = mkBoolOpt false "Manage db for this service";
+
+            environmentFile = mkOpt types.str "" "Environment File";
+
+            puid = mkOpt types.str "911" "default user id";
+
+            pgid = mkOpt types.str "1000" "default group id";
+
+            timeZone = mkOpt types.str "America/Chicago" "default timezone";
+
+            listenAddress = mkOpt types.str "0.0.0.0" "Environment File";
+
+            openFirewall = mkBoolOpt true "Open the firewall";
+
+            enableVpn = mkBoolOpt true "Enable routing through VPN";
+
+            redis = {
+              enable = lib.mkEnableOption "enable redis";
+
+              port = mkOpt types.int 80 "Port for ${name} redis to be hosted on";
+            };
+
+            hashedPassword =
+              mkOpt (types.nullOr types.str)
+                "$y$j9T$EkPXmsmIMFFZ.WRrBYCxS1$P0kwo6e4.WM5DsqUcEqWC3MrZp5KfCjxffraMFZWu06"
+                "Hashed password for code-server authentication";
+
+            extraEnvironment =
+              mkOpt (types.attrsOf types.str) { }
+                "Extra environment variables for code-server";
+
+            reverseProxy = mkReverseProxyOpt name;
           }
           // options;
         };
         default = { };
       };
 
-      config = lib.mkIf config.mjallen.${name}.enable config;
+      config = lib.mkIf cfg.enable defaultConfig;
     };
 
+  # container
   mkContainer =
     {
       name,
       localAddress ? "127.0.0.1",
-      ports ? [ "80" ],
+      ports ? [ 80 ],
       bindMounts ? { },
       config ? { },
     }:
@@ -101,12 +221,15 @@ rec {
 
   mkBoolOpt' = mkOpt' types.bool;
 
-  mkReverseProxyOpt = {
+  mkReverseProxyOpt = name: {
     enable = mkBoolOpt false "Enable reverse proxy support";
 
-    subdomain = mkOpt types.str "" "subdomain of the service";
+    subdomain = mkOpt types.str name "subdomain of the service";
 
-    middlewares = mkOpt (types.listOf types.str) [ ] "List of middlewares to use";
+    middlewares = mkOpt (types.listOf types.str) [
+      "crowdsec"
+      "whitelist-geoblock"
+    ] "List of middlewares to use";
   };
 
   # Standard enable/disable patterns

lib/system/common.nix

@@ -1,4 +1,4 @@
-{ inputs }:
+{ inputs, namespace }:
 let
   inherit (inputs.nixpkgs.lib) filterAttrs mapAttrs';
 in
@@ -7,7 +7,7 @@ in
     flake: nixpkgs:
     nixpkgs.lib.extend (
       _final: _prev: {
-        mjallen = flake.mjallen-lib;
+        mjallen = flake.${namespace} - lib;
       }
     );
 
@@ -30,7 +30,7 @@ in
       hostname,
     }:
     let
-      inherit (flake.mjallen-lib.file) scanHomes;
+      inherit (flake.${namespace} - lib.file) scanHomes;
       homesPath = ../../homes;
       allHomes = scanHomes homesPath;
     in
@@ -59,7 +59,7 @@ in
           sharedModules = [
             { _module.args.lib = extendedLib; }
           ]
-          ++ (extendedLib.mjallen.file.importModulesRecursive ../../modules/home);
+          ++ (extendedLib.${namespace}.file.importModulesRecursive ../../modules/home);
           users = mapAttrs' (_name: homeConfig: {
             name = homeConfig.username;
             value = {

lib/versioning/default.nix

@@ -0,0 +1,212 @@
+{
+  lib,
+  inputs,
+  system ? "aarch64-linux",
+}:
+let
+  pkgs = inputs.nixpkgs.legacyPackages.${system};
+in
+let
+  inherit (builtins)
+    isAttrs
+    isList
+    isString
+    hasAttr
+    getAttr
+    attrNames
+    toString
+    replaceStrings
+    ;
+
+  mapAttrs = lib.mapAttrs;
+  recursiveUpdate = lib.recursiveUpdate;
+
+  # Deep-merge attrsets (right-biased).
+  deepMerge = a: b: recursiveUpdate a b;
+
+  # Merge component sources: base.sources overlaid by overrides (component-wise deep merge).
+  mergeSources =
+    baseSources: overrides:
+    baseSources
+    // mapAttrs (
+      name: ov: if hasAttr name baseSources then deepMerge (getAttr name baseSources) ov else ov
+    ) overrides;
+
+  # Apply a single variant overlay (variables + sources).
+  applyVariantOnce =
+    selected: variant:
+    let
+      vVars = if variant ? variables then variant.variables else { };
+      vSrcs = if variant ? sources then variant.sources else { };
+    in
+    {
+      variables = selected.variables // vVars;
+      sources = mergeSources selected.sources vSrcs;
+    };
+
+  # Apply platform-specific overrides if present for the given system.
+  applyPlatforms =
+    selected: variant: system:
+    if system == null || !(variant ? platforms) || !(hasAttr system variant.platforms) then
+      selected
+    else
+      let
+        p = variant.platforms.${system};
+        pVars = if p ? variables then p.variables else { };
+        pSrcs = if p ? sources then p.sources else { };
+      in
+      {
+        variables = selected.variables // pVars;
+        sources = mergeSources selected.sources pSrcs;
+      };
+
+  # Resolve variant chain via inherits (ancestor first), then apply platforms.
+  resolveVariant =
+    spec: baseSelected: variantName: system:
+    if variantName == null || !(spec ? variants) || !(hasAttr variantName spec.variants) then
+      baseSelected
+    else
+      let
+        v = spec.variants.${variantName};
+        parentSelected =
+          if v ? inherits then resolveVariant spec baseSelected v.inherits system else baseSelected;
+        withVariant = applyVariantOnce parentSelected v;
+      in
+      applyPlatforms withVariant v system;
+
+  # Render ${var} substitutions in any string within attrs/lists.
+  renderValue =
+    value: vars:
+    if isString value then
+      let
+        keys = attrNames vars;
+        patterns = map (k: "\${" + k + "}") keys;
+        replacements = map (k: toString (getAttr k vars)) keys;
+      in
+      replaceStrings patterns replacements value
+    else if isAttrs value then
+      mapAttrs (_: v: renderValue v vars) value
+    else if isList value then
+      map (v: renderValue v vars) value
+    else
+      value;
+
+  # Decide fetcher for URL type based on optional extra.unpack hint.
+  useFetchZip = comp: comp ? extra && comp.extra ? unpack && comp.extra.unpack == "zip";
+
+  # Build a single src from a rendered component spec.
+  mkSrcFromRendered =
+    comp:
+    let
+      fetcher = if comp ? fetcher then comp.fetcher else "none";
+    in
+    if fetcher == "github" then
+      pkgs.fetchFromGitHub (
+        {
+          owner = comp.owner;
+          repo = comp.repo;
+          # Allow tag as rev (ignore null/empty tag)
+          rev = if comp ? tag && comp.tag != null && comp.tag != "" then comp.tag else comp.rev;
+          fetchSubmodules = if comp ? submodules then comp.submodules else false;
+          hash = comp.hash;
+        }
+        // lib.optionalAttrs (comp ? name) { name = comp.name; }
+      )
+    else if fetcher == "git" then
+      pkgs.fetchgit {
+        url = comp.url;
+        rev = comp.rev;
+        fetchSubmodules = if comp ? submodules then comp.submodules else false;
+        hash = comp.hash;
+      }
+    else if fetcher == "url" then
+      let
+        url = if comp ? url then comp.url else comp.urlTemplate;
+      in
+      if useFetchZip comp then
+        pkgs.fetchzip (
+          {
+            inherit url;
+            hash = comp.hash;
+          }
+          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { stripRoot = comp.extra.stripRoot; }
+        )
+      else
+        pkgs.fetchurl {
+          inherit url;
+          hash = comp.hash;
+        }
+    else if fetcher == "pypi" then
+      pkgs.python3Packages.fetchPypi {
+        pname = comp.name;
+        version = comp.version;
+        hash = comp.hash;
+      }
+    else
+      # fetcher == "none": pass-through (e.g., linux version/hash consumed by custom logic)
+      comp;
+
+in
+rec {
+  /*
+    Select a variant from a loaded version.json specification.
+
+    Usage:
+      let selected = versioning.selectVariant spec variantName system;
+      - spec: attrset from lib.importJSON ./version.json
+      - variantName: string or null (when null, uses spec.defaultVariant if present)
+      - system: string like "x86_64-linux" or null (to apply platforms overrides)
+  */
+  selectVariant =
+    spec: variantName: system:
+    let
+      chosen =
+        if variantName != null then
+          variantName
+        else
+          (if spec ? defaultVariant then spec.defaultVariant else null);
+      baseSelected = {
+        variables = if spec ? variables then spec.variables else { };
+        sources = if spec ? sources then spec.sources else { };
+      };
+    in
+    resolveVariant spec baseSelected chosen system;
+
+  /*
+    Render ${var} template substitutions across any value using provided variables.
+    Strings, attrsets, and lists are traversed.
+  */
+  render = value: variables: renderValue value variables;
+
+  /*
+    Render a component with variables and then build its src (or pass-through for fetcher "none").
+    Prefer using mkAllSources, which handles rendering for all components.
+  */
+  mkSrc =
+    comp: variables:
+    let
+      rendered = renderValue comp variables;
+    in
+    mkSrcFromRendered rendered;
+
+  /*
+    Produce an attrset of all sources for a selected spec:
+      mkAllSources selected
+    Where:
+      selected = selectVariant spec variantName system
+    Returns:
+      { componentName = src | renderedComp (for "none"); ... }
+  */
+  mkAllSources =
+    selected:
+    mapAttrs (
+      _name: comp:
+      if comp ? fetcher && comp.fetcher == "none" then
+        renderValue comp selected.variables
+      else
+        mkSrc (renderValue comp selected.variables) selected.variables
+    ) selected.sources;
+
+  # Expose deepMerge for convenience (right-biased).
+  inherit deepMerge;
+}

modules/darwin/home/default.nix

@@ -35,9 +35,9 @@
       # Pass inputs so external modules can access them
       extraSpecialArgs = {
         inherit inputs namespace;
-        overlays = with inputs; [
-          nix-vscode-extensions.overlays.default
-        ];
+        # overlays = with inputs; [
+        #   nix-vscode-extensions.overlays.default
+        # ];
       };
 
       # Make ALL external HM modules available globally

modules/home/desktop/gnome/default.nix

@@ -2,10 +2,11 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 let
-  cfg = config.mjallen.desktop.gnome;
+  cfg = config.${namespace}.desktop.gnome;
 in
 {
   imports = [ ./options.nix ];
@@ -22,7 +23,9 @@ in
       gnomeExtensions.bing-wallpaper-changer
       gnomeExtensions.dash-to-dock
       gnomeExtensions.dash-to-panel
+      gnomeExtensions.caffeine
       gnomeExtensions.gsconnect
+      gnomeExtensions.nasa-apod
       gnomeExtensions.random-wallpaper
       gnomeExtensions.tiling-assistant
       gnomeExtensions.user-themes
@@ -53,20 +56,25 @@ in
         "org/gnome/shell".enabled-extensions = [
           "allowlockedremotedesktop@kamens.us"
           "appindicatorsupport@rgcjonas.gmail.com"
-          "user-theme@gnome-shell-extensions.gcampax.github.com"
+          "caffeine@patapon.info"
+          # "user-theme@gnome-shell-extensions.gcampax.github.com"
           "tiling-assistant@leleat-on-github"
           "dash-to-dock@micxgx.gmail.com"
           "BingWallpaper@ineffable-gmail.com"
           "gsconnect@andyholmes.github.io"
         ];
         "org/gnome/shell/extensions/bingwallpaper".override-lockscreen-blur = true;
-        "org/gnome/shell/extensions/bingwallpaper".random-mode-enabled = true;
+        "org/gnome/shell/extensions/bingwallpaper".random-mode-enabled = false;
+        "org/gnome/shell/extensions/bingwallpaper".selected-image = "current";
         "org/gnome/shell/extensions/bingwallpaper".revert-to-current-image = false;
+        "org/gnome/shell/extensions/caffeine".enable-fullscreen = true;
+        "org/gnome/shell/extensions/caffeine".enable-mpris = true;
         "org/gnome/shell/extensions/dash-to-panel".primary-monitor = 1;
         "org/gnome/shell/extensions/dash-to-panel".multi-monitors = false;
         "org/gnome/shell/extensions/gsconnect".id = "4db35bd2-0dcd-42a3-9f77-ef3e8bb83182";
         "org/gnome/shell/extensions/gsconnect".name = "matt-nixos";
         "org/gnome/shell/extensions/user-theme".name = lib.mkDefault "Colloid-Dark";
+        "org/gnome/system/location".enabled = true;
         "org/gtk/settings/file-chooser".clock-format = "12h";
       };
     };

modules/home/desktop/gnome/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.desktop.gnome = {
+  options.${namespace}.desktop.gnome = {
     enable = mkEnableOption "enable gnome settings";
   };
 }

modules/home/home/default.nix

@@ -7,7 +7,7 @@
   ...
 }:
 let
-  inherit (lib.${namespace}) enabled disabled;
+  inherit (lib.${namespace}) enabled;
 in
 {
   home = {
@@ -19,10 +19,12 @@ in
         age
         clinfo
         cpufetch
+        dbus
         deadnix
         lm_sensors
         nano
-        nixfmt-rfc-style
+        nix-prefetch-scripts
+        nixfmt
         pciutils
         protonup-ng
         rsync
@@ -38,14 +40,17 @@ in
       ++ (
         if hasDestopEnvironment then
           [
-            chromium
+            boxbuddy
+            stable.chromium
             firefox
             gamescope
             gamescope-wsi
             gparted
-            goverlay
+            pkgs.unstable.goverlay
             mission-center
+            parted
             vesktop
+            # winboat
           ]
         else
           [ ]
@@ -56,7 +61,10 @@ in
 
   programs = {
     nix-index-database.comma = enabled;
-    btop = lib.mkDefault enabled;
+    btop = {
+      enable = lib.mkDefault true;
+      package = pkgs.unstable.btop;
+    };
     fastfetch = lib.mkDefault enabled;
     home-manager = lib.mkDefault enabled;
     java = {
@@ -125,11 +133,12 @@ in
   };
 
   services = {
-    nextcloud-client.enable = lib.mkDefault hasDestopEnvironment;
+    nextcloud-client.enable = false; # lib.mkDefault hasDestopEnvironment;
     pass-secret-service = lib.mkDefault enabled;
     kdeconnect = {
       enable = lib.mkDefault hasDestopEnvironment;
-      indicator = lib.mkDefault true;
+      indicator = lib.mkDefault hasDestopEnvironment;
+      package = pkgs.kdePackages.kdeconnect-kde;
     };
   };
 }

modules/home/programs/btop/default.nix

@@ -1,7 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.btop;
+  cfg = config.${namespace}.programs.btop;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/btop/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.btop = {
+  options.${namespace}.programs.btop = {
     enable = mkEnableOption "enable btop";
   };
 }

modules/home/programs/code/default.nix

@@ -154,8 +154,8 @@ in
       };
     };
     direnv = {
-      enable = false;
-      nix-direnv.enable = false;
+      enable = true;
+      nix-direnv.enable = true;
       enableZshIntegration = true;
     };
   };

modules/home/programs/hyprland/avizo.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  namespace,
+  lib,
+  ...
+}:
+let
+  cfg = config.${namespace}.programs.hyprland;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.avizo = {
+      enable = true;
+      settings = {
+        default = {
+          time = 1.0;
+          y-offset = 0.5;
+          fade-in = 0.1;
+          fade-out = 0.2;
+          padding = 10;
+        };
+      };
+    };
+  };
+}

modules/home/programs/hyprland/default.nix

@@ -2,15 +2,17 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 with lib;
 let
-  cfg = config.mjallen.programs.hyprland;
+  cfg = config.${namespace}.programs.hyprland;
   drawer = "nwg-drawer -fm nautilus -term kitty -mb 10 -mt 10 -ml 10 -mr 10 -pbuseicontheme -i ${config.stylix.icons.dark}";
 in
 {
   imports = [
+    ./avizo.nix
     ./options.nix
   ];
 
@@ -62,14 +64,13 @@ in
           wl-clipboard
           wlogout
           wlroots
-          xorg.xhost
+          xhost
           xsettingsd
           xwayland
-
-          pkgs.mjallen.pipewire-python
         ]
         ++ (if cfg.notificationDaemon == "mako" then [ mako ] else [ dunst ])
         ++ (if cfg.launcher == "wofi" then [ wofi ] else [ rofi ])
+        ++ (with pkgs.${namespace}; [ pipewire-python ])
       );
 
     # Session variables
@@ -89,7 +90,7 @@ in
       NIXOS_XDG_OPEN_USE_PORTAL = "1";
       QT_AUTO_SCREEN_SCALE_FACTOR = "1";
       QT_QPA_PLATFORM = "wayland-egl";
-      QT_QPA_PLATFORMTHEME = "gtk3";
+      QT_QPA_PLATFORMTHEME = lib.mkDefault "gtk3";
       QT_SCALE_FACTOR = "1";
       QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
       SDL_VIDEODRIVER = "wayland";
@@ -111,22 +112,12 @@ in
         enable = true;
         settings = {
           preload = [ cfg.hyprpaper.wallpaperPath ];
-          wallpaper =
-            let
-              useMonitorV2 = (lib.versionAtLeast pkgs.hyprland.version "0.40.0") && (cfg.monitorv2 != [ ]);
-              names =
-                if useMonitorV2 then
-                  map (m: m.name) cfg.monitorv2
-                else
-                  [
-                    cfg.display1.input
-                    cfg.display2.input
-                  ];
-            in
-            if cfg.hyprpaper.usePerMonitor then
-              map (n: "${n}, ${cfg.hyprpaper.wallpaperPath}") names
-            else
-              [ ", ${cfg.hyprpaper.wallpaperPath}" ];
+          wallpaper = [
+            {
+              monitor = "";
+              path = cfg.hyprpaper.wallpaperPath;
+            }
+          ];
           splash = false;
         };
       };
@@ -171,18 +162,18 @@ in
       hyprlock = {
         enable = true;
         settings = {
-          background = [
+          background = mkForce [
             {
               monitor = "";
               path = "/run/wallpaper.jpg"; # supports png, jpg, webp (no animations, though)
-              color = mkForce "rgba(25, 20, 20, 1.0)";
+              color = mkDefault "rgba(25, 20, 20, 1.0";
 
               # all these options are taken from hyprland, see https://wiki.hyprland.org/Configuring/Variables/#blur for explanations
-              blur_passes = mkForce "3"; # 0 disables blurring
-              blur_size = mkForce "7";
+              blur_passes = mkDefault "3"; # 0 disables blurring
+              blur_size = mkDefault "7";
               noise = "0.0117";
               contrast = "0.8916";
-              brightness = mkForce "0.8172";
+              brightness = mkDefault "0.8172";
               vibrancy = "0.1696";
               vibrancy_darkness = "0.0";
             }
@@ -224,7 +215,7 @@ in
               halign = "center";
               valign = "center";
             }
-            # weather 
+            # weather
             {
               monitor = cfg.primaryDisplay;
               text = "cmd[update:30000] waybar-weather --hyprlock";
@@ -235,7 +226,7 @@ in
               halign = "right";
               valign = "bottom";
             }
-            # media 
+            # media
             {
               monitor = cfg.primaryDisplay;
               text = "cmd[update:1000] waybar-media";
@@ -250,9 +241,9 @@ in
           # user box
           shape = [
             {
-              monitor = "";
+              monitor = cfg.primaryDisplay;
               size = "200, 50";
-              color = "rgba(46, 52, 64, .25)";
+              color = "rgba(46, 52, 64, .25";
               rounding = -1;
               border_size = "0";
               position = "0, 0";
@@ -419,23 +410,20 @@ in
           ++ cfg.keybinds.bindm;
 
           bindel = [
-            ", XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.5 @DEFAULT_AUDIO_SINK@ 5%+"
-            ", XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
+            ", XF86AudioRaiseVolume, exec, volumectl -u up"
+            ", XF86AudioLowerVolume, exec, volumectl -u down"
           ]
           ++ cfg.keybinds.bindel;
 
           bindl = [
-            ", XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
+            ", XF86AudioMute, exec, volumectl toggle-mute"
             ", XF86AudioPlay, exec, playerctl play-pause"
             ", XF86AudioPrev, exec, playerctl previous"
             ", XF86AudioNext, exec, playerctl next"
-            ", XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"
+            ", XF86AudioMicMute, exec, volumectl -m toggle-mute"
 
-            ", XF86MonBrightnessUp, exec, brightnessctl set +5%"
-            ", XF86MonBrightnessDown, exec, brightnessctl set 5%-"
-
-            "$mod, XF86MonBrightnessUp, exec, brightnessctl -d kbd_backlight set +10%"
-            "$mod, XF86MonBrightnessDown, exec, brightnessctl -d kbd_backlight set 10%-"
+            ", XF86MonBrightnessUp, exec, lightctl up"
+            ", XF86MonBrightnessDown, exec, lightctl down"
           ]
           ++ cfg.keybinds.bindl;
 
@@ -528,80 +516,78 @@ in
           workspace = cfg.workspace;
 
           windowrule = [
-            "float, title:(file_progress)"
-            "float, title:(.*[Cc]onfirm.*)"
-            "float, title:(.*[Dd]ialog.*)"
-            "float, title:(.*[Dd]ownload.*)"
-            "float, title:(.*[Nn]otification.*)"
-            "float, title:(.*[Ee]rror.*)"
-            "float, title:(.*[Ss]plash.*)"
-            "float, title:(.*[Cc]onfirmreset.*)"
-            "float, title:(.*[Ss]ign [Ii]n - .*)"
-            "float, title:(.*[Oo]pen [Ff]ile.*)"
-            "float, title:(.*branchdialog.*)"
-            "float, class:(.*pavucontrol.*)"
-            "move onscreen cursor 0% 0%, class:(.*pavucontrol.*)"
-            "float, class:(.*[Oo]verskride.*)"
-            "float, class:(.*FileRoller.*)"
-            "float, class:(.*wlogout.*)"
-            "idleinhibit stayfocused, title:(.*mpv.*)"
+            "match:title file_progress, float 1"
+            "match:title .*[Cc]onfirm.*, float 1"
+            "match:title .*[Dd]ialog.*, float 1"
+            "match:title .*[Dd]ownload.*, float 1"
+            "match:title .*[Nn]otification.*, float 1"
+            "match:title .*[Ee]rror.*, float 1"
+            "match:title .*[Ss]plash.*, float 1"
+            "match:title .*[Cc]onfirmreset.*, float 1"
+            "match:title .*[Ss]ign [Ii]n - .*, float 1"
+            "match:title .*[Oo]pen [Ff]ile.*, float 1"
+            "match:title .*branchdialog.*, float 1"
+            "match:class .*pavucontrol.*, float 1"
+            "match:class .*pavucontrol.*, move onscreen cursor 0% 0%"
+            "match:class .*[Oo]verskride.*, float 1"
+            "match:class .*FileRoller.*, float 1"
+            "match:class .*wlogout.*, float 1"
+            "match:title .*mpv.*, idle_inhibit stayfocused"
 
-            "float, class:(.*nm-connection-editor.*)"
-            "move onscreen cursor 0% 0%, class:(.*nm-connection-editor.*)"
+            "match:class .*nm-connection-editor.*, float 1"
+            "match:class .*nm-connection-editor.*, move onscreen cursor 0% 0%"
 
-            "float, title:(Media viewer)"
-            "float, class:(it.mijorus.smile),title:(Smile)"
-            "float, class:(.blueman-manager-wrapped)$,title:(Bluetooth Devices)"
+            "match:title Media viewer, float 1"
+            "match:class it.mijorus.smile),match:title Smile, float 1"
+            "match:class .blueman-manager-wrapped)$,match:title Bluetooth Devices, float 1"
             # Picture in picture windows
-            "float, title:(.*Picture-in-Picture.*)"
-            "pin, title::(.*Picture-in-Picture.*)"
+            "match:title .*Picture-in-Picture.*, float 1"
+            "match:title .*Picture-in-Picture.*, pin 1"
 
             # discord/vesktop
-            # "workspace: name:discord, class:(.*vesktop)"
-            # "float, class:(.*vesktop),title:(.*Discord Popout.*)"
-            # "pin, class:(.*vesktop),title:(.*Discord Popout.*)"
+            # "workspace: name:discord, match:class .*vesktop"
+            # "match:class .*vesktop),match:title .*Discord Popout.*, float 1"
+            # "pin, match:class .*vesktop),match:title .*Discord Popout.*"
 
             # Music
-            # "workspace: name:discord, class:(Apple Music.*)"
+            # "workspace: name:discord, match:class Apple Music.*"
 
             # Steam
-            "float, class:(.*[Ss]team), title:(.*[Ss]team.*)$"
-            "workspace name:steam silent, class:(.*[Ss]team), title:(.*[Ss]team.*)$"
-            "tile, class:(.*[Ss]team), title:(.*[Ss]team.*)$"
-            "float, class:(.*steam),title:(.*Friends List.*)"
+            "match:class .*[Ss]team, match:title .*[Ss]team.*, float 1"
+            "match:class .*[Ss]team, match:title .*[Ss]team.*, workspace name:steam silent"
+            "match:class .*[Ss]team, match:title .*[Ss]team.*, tile 1"
+            "match:class .*steam,match:title .*Friends List.*, float 1"
 
             # Code
-            "pin, class:(.*codium.*),title:(Save As)"
-            "float, class:(.*codium.*),title:(Save As)"
-            "float, class:(xdg-desktop-portal-gtk),title:(Open Workspace from File)"
+            "match:class .*codium.*, match:title Save As, pin 1"
+            "match:class .*codium.*, match:title Save As, float 1"
+            "match:class xdg-desktop-portal-gtk, match:title Open Workspace from File, float 1"
 
             # Game Tearing??? https://wiki.hypr.land/Configuring/Tearing/
-            "immediate, class:(.*gamescope)"
+            "match:class .*gamescope.*, idle_inhibit fullscreen, content game, immediate 1"
+            "match:xdg_tag proton-game, idle_inhibit fullscreen, content game, immediate 1"
+            "match:class steam_app_.*, idle_inhibit fullscreen, content game, immediate 1"
 
             # vmware
             # this tag will set the below options to the vdi window
             # this will have it auto open as a 2160x7680 window
             # and makes multi-monitor work
-            "tag +horizonrdp, class:(.*[Hh]orizon-client),title:(USPS Next VDI)"
+            "match:class .*[Hh]orizon-client, match:title USPS Next VDI, tag +horizonrdp"
 
-            "noanim, tag:horizonrdp"
-            "noblur, tag:horizonrdp"
-            "norounding, tag:horizonrdp"
-            "noshadow, tag:horizonrdp"
-            "immediate, tag:horizonrdp"
-            "allowsinput, tag:horizonrdp"
-            "noborder, tag:horizonrdp"
-            "nodim, tag:horizonrdp"
-            "nomaxsize, tag:horizonrdp"
-            "renderunfocused, tag:horizonrdp"
-            "idleinhibit, tag:horizonrdp"
-            "float, tag:horizonrdp"
+            "match:tag horizonrdp, no_anim 1"
+            "match:tag horizonrdp, no_blur 1"
+            "match:tag horizonrdp, rounding 0"
+            "match:tag horizonrdp, no_shadow 1"
+            "match:tag horizonrdp, immediate 1"
+            "match:tag horizonrdp, allows_input 1"
+            "match:tag horizonrdp, border_size 0"
+            "match:tag horizonrdp, max_size 2160 7680"
+            "match:tag horizonrdp, min_size 1920 1080"
+            "match:tag horizonrdp, render_unfocused 1"
+            "match:tag horizonrdp, idle_inhibit 1"
+            "match:tag horizonrdp, float 1"
             # float the vmware window cause its annoying to use in fullscreen
-            "float, class:(.*[Hh]orizon-client),title:([Oo]mnissa [Hh]orizon [Cc]lient)"
-
-            "tag +waydroid, class:([Ww]aydroid.*)"
-            "float, tag:waydroid"
-            "pin, tag:waydroid"
+            "match:class .*[Hh]orizon-client),match:title [Oo]mnissa [Hh]orizon [Cc]lient, float 1"
           ]
           ++ cfg.windowRule;
 
@@ -696,12 +682,12 @@ in
             sensitivity = 0; # -1.0 - 1.0, 0 means no modification.
           };
 
-          experimental = {
-            xx_color_management_v4 = true;
-          };
+          # experimental = {
+          #   xx_color_management_v4 = true;
+          # };
 
           debug = {
-            full_cm_proto = cfg.debug.fullCmProto;
+            # full_cm_proto = cfg.debug.fullCmProto;
             disable_logs = cfg.debug.disableLogs;
             disable_scale_checks = cfg.debug.disableScaleChecks;
           };

modules/home/programs/hyprland/options.nix

@@ -1,7 +1,12 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
 with lib;
 {
-  options.mjallen.programs.hyprland = {
+  options.${namespace}.programs.hyprland = {
     enable = mkEnableOption "enable hyprland";
 
     primaryDisplay = mkOption {
@@ -148,7 +153,7 @@ with lib;
 
     extraConfig = mkOption {
       type = with types; str;
-      default = '''';
+      default = "";
       description = "Any extra configuration options";
     };
 
@@ -204,7 +209,7 @@ with lib;
       type = with types; listOf str;
       default = [
         "nwg-look -a"
-        "nwg-dock-hyprland -d"
+        "nwg-dock-hyprland -x"
       ];
       description = "Commands to run via Hyprland exec-once";
     };

modules/home/programs/kitty/default.nix

@@ -1,7 +1,12 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.kitty;
+  cfg = config.${namespace}.programs.kitty;
 in
 {
   imports = [ ./options.nix ];
@@ -12,7 +17,7 @@ in
       shellIntegration.enableZshIntegration = true;
 
       settings = {
-        bold_font = "auto"; 
+        bold_font = "auto";
         italic_font = "auto";
         bold_italic_font = "auto";
         mouse_hide_wait = "2.0";

modules/home/programs/kitty/options.nix

@@ -1,10 +1,7 @@
 { lib, namespace, ... }:
 with lib;
-let
-  inherit (lib.${namespace}) mkOpt;
-in
 {
-  options.mjallen.programs.kitty = {
+  options.${namespace}.programs.kitty = {
     enable = mkEnableOption "enable kitty terminal";
   };
 }

modules/home/programs/mako/default.nix

@@ -1,7 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.mako;
+  cfg = config.${namespace}.programs.mako;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/mako/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.mako = {
+  options.${namespace}.programs.mako = {
     enable = mkEnableOption "enable mako";
 
     fontName = mkOption {

modules/home/programs/nwg-dock/default.nix

@@ -2,12 +2,12 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 with lib;
 let
-  cfg = config.mjallen.programs.nwg-dock;
-  palette = import cfg.theme.file;
+  cfg = config.${namespace}.programs.nwg-dock;
 in
 {
   imports = [ ./options.nix ];
@@ -16,6 +16,79 @@ in
     home.packages = with pkgs; [ nwg-dock-hyprland ];
 
     home.file = {
+      ".config/nwg-dock-hyprland/config.json".text = ''
+        {
+          "position": "bottom",
+          "anchor": "center",
+          "margin": 12,
+          "icon_size": 48,
+          "icon_size_hover": 64,
+          "spacing": 6,
+          "padding": 8,
+          "autohide": false,
+          "autohide_timeout": 0.3,
+          "exclusive": true,
+          "layer": "top",
+          "height": 72,
+          "background_alpha": 0.55,
+          "rounded_corners": 16,
+          "show_labels": false,
+          "show_running": true,
+          "show_pinned": true,
+          "pinned": [
+            "firefox.desktop",
+            "org.wezfurlong.wezterm.desktop",
+            "codium.desktop",
+            "org.gnome.Nautilus.desktop"
+          ]
+        }
+      '';
+
+      ".config/nwg-dock-hyprland/style.css".text = ''
+        window {
+          background: #36364f;
+          border-radius: 10px;
+          border-style: none;
+          border-width: 1px;
+          border-color: rgba(156, 142, 122, 0.7)
+        }
+
+        #box {
+          /* Define attributes of the box surrounding icons here */
+          padding: 10px
+        }
+
+        #active {
+          /* This is to underline the button representing the currently active window */
+          border-bottom: solid 1px;
+          border-color: rgba(255, 255, 255, 0.3)
+        }
+
+        button, image {
+          background: none;
+          border-style: none;
+          box-shadow: none;
+          color: #999
+        }
+
+        button {
+          padding: 4px;
+          margin-left: 4px;
+          margin-right: 4px;
+          color: #eee;
+          font-size: 12px
+        }
+
+        button:hover {
+          background-color: rgba(255, 255, 255, 0.15);
+          border-radius: 2px;
+        }
+
+        button:focus {
+          box-shadow: none
+        }
+      '';
+
       ".config/nwg-dock-hyprland/drawer.css".text = ''
         window {
           background: ${config.lib.stylix.colors.base00};

modules/home/programs/nwg-dock/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.nwg-dock = {
+  options.${namespace}.programs.nwg-dock = {
     enable = mkEnableOption "enable nwg-dock";
   };
 }

modules/home/programs/nwg-drawer/default.nix

@@ -2,12 +2,12 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 with lib;
 let
-  cfg = config.mjallen.programs.nwg-drawer;
-  palette = import cfg.theme.file;
+  cfg = config.${namespace}.programs.nwg-drawer;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/nwg-drawer/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.nwg-drawer = {
+  options.${namespace}.programs.nwg-drawer = {
     enable = mkEnableOption "enable nwg-drawer";
   };
 }

modules/home/programs/nwg-panel/default.nix

@@ -1,7 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.nwg-panel;
+  cfg = config.${namespace}.programs.nwg-panel;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/nwg-panel/options.nix

@@ -1,7 +1,12 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
 with lib;
 {
-  options.mjallen.programs.nwg-panel = {
+  options.${namespace}.programs.nwg-panel = {
     enable = mkEnableOption "enable nwg-panel";
 
     defaultApps = mkOption {

modules/home/programs/onlyoffice/default.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  isArm = builtins.match "aarch64*" system != null;
+  isArm = "aarch64-linux" == system;
 in
 {
   programs.onlyoffice = {

modules/home/programs/update-checker/default.nix

@@ -0,0 +1,290 @@
+{
+  config,
+  namespace,
+  pkgs,
+  ...
+}:
+let
+  git-token = config.sops.secrets."github-token".path;
+
+  update-checker = pkgs.writeScriptBin "update-checker" ''
+    #!/usr/bin/env nix-shell
+    #! nix-shell -i python3 --pure
+    #! nix-shell -p python3 python3Packages.pygithub python3Packages.feedparser python3Packages.requests nix-prefetch-scripts nix
+
+    import os
+    import json
+    import subprocess
+    from github import Github
+    from github import Auth
+    import feedparser
+    import requests
+
+    token = None
+
+    with open('${git-token}', 'r') as token_file:
+        token = token_file.readline()
+
+    auth = Auth.Token(token)
+
+    def check_github(owner, repo, version):
+        try:
+            release = None
+            result = None
+            prefetch = None
+            ghub = Github(auth=auth)
+            print('  getting repo ' + owner + '/' + repo)
+            repo = ghub.get_repo(owner + '/' + repo)
+            if '-b' in version:
+                release = repo.get_releases()[0]
+                latest_version = release.name
+            else:
+                try:
+                    release = repo.get_latest_release()
+                    latest_version = release.tag_name
+                except:
+                    tags = repo.get_tags()
+                    try:
+                        if tags is not None:
+                            latest_version = tags[0].name
+                    except:
+                        commits = repo.get_commits()
+                        latest_version = commits[0].sha
+
+            if latest_version is not None:
+
+                if latest_version.replace('v',''\'') != version.replace('v',''\''):
+                    print('  update found')
+                    print('  Current version: ' + version)
+                    print('  Latest version: ' + latest_version)
+                    result = subprocess.check_output(['nix-prefetch-git', '--quiet', repo.clone_url, '--rev', latest_version])
+                    prefetch = json.loads(result)
+                    print('  New hash: ' + prefetch.get('hash'))
+                else:
+                    print('  no update')
+            ghub.close()
+        except Exception as e:
+            print(e)
+
+    def check_codeberg(owner, repo, version):
+        feed = feedparser.parse('https://codeberg.org/{0}/{1}/releases.rss'.format(owner, repo))
+        if feed.status == 200:
+            entry = feed.entries[0]
+            if entry.title.replace('v',''\'') != version.replace('v',''\''):
+                print('  update found')
+                print('  Current version: ' + version)
+                print('  Latest version: ' + entry.title)
+                sha256 = subprocess.check_output(['nix-prefetch-url', url.replace(''\'''\${version}', entry.title.replace('v', ''\''))])
+                prefetch = subprocess.check_output(['nix', 'hash', 'convert', '--hash-algo', 'sha256', str(sha256.decode('utf-8').strip())])
+                print('  New hash: ' + prefetch.decode('utf-8').strip())
+            else:
+                print('  no update')
+
+    def check_open_vsx(publisher, name, version):
+        open_vsx = requests.get('https://open-vsx.org/api/' + publisher + '/' + name)
+        if open_vsx.status_code == 200:
+            extension = open_vsx.json()
+            latest_version = extension.get('version')
+            url = extension.get('files').get('download')
+            if latest_version.replace('v',''\'') != version.replace('v',''\''):
+                print('  update found')
+                print('  Current version: ' + version)
+                print('  Latest version: ' + latest_version)
+                sha256 = subprocess.check_output(['nix-prefetch-url', url])
+                prefetch = subprocess.check_output(['nix', 'hash', 'convert', '--hash-algo', 'sha256', str(sha256.decode('utf-8').strip())])
+                print('  New hash: ' + prefetch.decode('utf-8').strip())
+            else:
+                print('  no update')
+
+    def parse_nix(package_spec):
+        version = None
+        url = None
+        current_hash = None
+        owner = None
+        repo = None
+        pname = None
+        name = None
+        publisher = None
+        for line in package_spec.readlines():
+            if 'owner = "' in line and owner is None:
+                owner = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'repo = "' in line and repo is None:
+                repo = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'version = "' in line and version is None:
+                version = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'rev = "' in line and ''\'''\${version}' not in line:
+                version = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'url = "' in line and url is None:
+                url = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'sha256 = "' in line or ' hash = "' in line and current_hash is None:
+                current_hash = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'pname = "' in line and pname is None:
+                pname = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if ' name = "' in line and name is None:
+                name = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+            if 'publisher = "' in line and publisher is None:
+                publisher = line.split(' = ')[-1].replace('"', ''\'').replace(';\n', ''\'')
+
+        if url is None and repo is not None:
+            if 'pname' in repo:
+                repo = repo.replace(''\'''\${pname}', pname)
+            url = 'https://github.com/{0}/{1}/releases/tag/{2}'.format(owner, repo, version)
+
+        if url is not None and repo is None and 'github' in url:
+            owner = url.split('github.com/')[-1].split('/')[0]
+            repo = url.split('github.com/')[-1].split('/')[1]
+
+        if url is not None and repo is None and 'codeberg' in url:
+            owner = url.split('codeberg.org/')[-1].split('/')[0]
+            repo = url.split('codeberg.org/')[-1].split('/')[1]
+
+        if url is not None and version is None:
+            version = url.split('/')[-1].replace('.tar.gz', ''\'')
+
+        if url is not None and publisher is not None:
+            url = url.replace(''\'''\${publisher}', publisher).replace(''\'''\${name}', name)
+
+        return url, current_hash, owner, repo, pname, name, publisher, version
+
+    def parse_json(json_versions, flavor=''\''):
+        versions = json.load(json_versions)
+        linux_versions = versions.get('linux')
+        config_versions = versions.get('config')
+        patch_versions = versions.get('patches')
+        zfs_versions = versions.get('zfs')
+                
+        check_kernel(linux_versions, flavor)
+        check_cachy_config(config_versions, flavor)
+        check_patch_versions(patch_versions, flavor)
+        check_zfs_versions(zfs_versions, flavor)
+
+    def check_kernel(linux_versions, flavor=''\''):
+        srcinfo = requests.get('https://raw.githubusercontent.com/CachyOS/linux-cachyos/master/linux-cachyos' + flavor + '/.SRCINFO')
+        for line in srcinfo.text.split('\n'):
+            if 'pkgver = ' in line:
+                kernel_version = line.split('=')[-1].strip()
+                if kernel_version[-2:] == '.0':
+                    kernel_version = kernel_version[:-2]
+                if flavor in [''\'', '-lts', '-server', '-gcc', '-hardened']:
+                    release_src = 'https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-' + kernel_version + '.tar.xz'
+                if flavor == '-rc':
+                    release_src = 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-' + kernel_version.replace('.rc', '-rc') + '.tar.gz'
+        sha256 = subprocess.check_output(['nix-prefetch-url', release_src])
+        prefetch = subprocess.check_output(['nix', 'hash', 'convert', '--hash-algo', 'sha256', str(sha256.decode('utf-8').strip())])
+        current_version = linux_versions.get('version')
+        current_hash = linux_versions.get('hash')
+        latest_hash = prefetch.decode('utf-8').strip()
+        print('  Checking linux versions...')
+        if current_hash != latest_hash:
+            print('    Current rev: ' + current_version)
+            print('    Current hash: ' + current_hash)
+            print('    New rev: ' + kernel_version)
+            print('    New hash: ' + latest_hash)
+        else:
+            print('    no update')
+
+    def check_cachy_config(config_versions, flavor=''\''):
+        result = subprocess.check_output(['nix-prefetch-git', '--quiet', 'https://github.com/CachyOS/linux-cachyos.git'])
+        prefetch = json.loads(result)
+        current_version = config_versions.get('rev')
+        latest_version = prefetch.get('rev')
+        print('  Checking config versions...')
+        if current_version != latest_version:
+            print('    Current rev: ' + current_version)
+            print('    New rev: ' + latest_version)
+            print('    New hash: ' + prefetch.get('hash'))
+        else:
+            print('    no update')
+
+    def check_patch_versions(patch_versions, flavor=''\''):
+        result = subprocess.check_output(['nix-prefetch-git', '--quiet', 'https://github.com/CachyOS/kernel-patches.git'])
+        prefetch = json.loads(result)
+        current_version = patch_versions.get('rev')
+        latest_version = prefetch.get('rev')
+        print('  Checking patch versions...')
+        if current_version != latest_version:
+            print('    Current rev: ' + current_version)
+            print('    New rev: ' + latest_version)
+            print('    New hash: ' + prefetch.get('hash'))
+        else:
+            print('    no update')
+
+    def kconfig_to_nix(flavor=''\''):
+        kconfig_result = subprocess.check_output(['nix', 'build', '.#nixosConfigurations.jallen-nas.pkgs.linuxPackages_cachyos' + flavor + '.kernel.kconfigToNix', '--no-link', '--print-out-paths'])
+        config_file = kconfig_result.decode('utf-8').strip()
+        if flavor == ''\'':
+            cachy_flavor = '-gcc'
+        result = subprocess.check_output(['cat', config_file])
+        with open('/etc/nixos/packages/linux-cachyos/config-nix/cachyos' + cachy_flavor + '.x86_64-linux.nix', 'w') as config:
+            config.write(result.decode('utf-8').strip())
+
+    def check_zfs_versions(zfs_versions, flavor=''\''):
+        result = requests.get('https://raw.githubusercontent.com/CachyOS/linux-cachyos/master/linux-cachyos' + flavor + '/PKGBUILD')
+        for line in result.text.split('\n'):
+            if 'git+https://github.com/cachyos/zfs.git#commit=' in line:
+                zfs_rev = line.split('zfs.git#commit=')[-1].replace('")', ''\'')
+        result = subprocess.check_output(['nix-prefetch-git', '--quiet', 'https://github.com/CachyOS/zfs.git', '--rev', zfs_rev])
+        prefetch = json.loads(result)
+        current_version = zfs_versions.get('rev')
+        latest_version = prefetch.get('rev')
+        print('  Checking zfs versions...')
+        if current_version != latest_version:
+            print('    Current rev: ' + current_version)
+            print('    New rev: ' + latest_version)
+            print('    New hash: ' + prefetch.get('hash'))
+        else:
+            print('    no update')
+
+    for (root,dirs,files) in os.walk('/etc/nixos/packages',topdown=True):
+        if 'default.nix' in files and 'versions.json' not in files:
+            print(root.split('/')[-1])
+            with open(root + '/default.nix', 'r') as package_spec:
+                url, current_hash, owner, repo, pname, name, publisher, version = parse_nix(package_spec)
+
+            if owner is not None and repo is not None and 'codeberg' in url:
+                check_codeberg(owner, repo, version)
+
+            elif owner is not None and repo is not None and 'github' in url:
+                check_github(owner, repo, version)
+
+            elif publisher is not None and 'open-vsx' in url:
+                check_open_vsx(publisher, name, version)
+
+            else:
+                if url is not None:
+                    print(url)
+        
+        if 'default.nix' in files and 'versions.json' in files:
+            with open(root + '/versions.json', 'r') as json_versions:
+                print('Checking Linux CachyOS')
+                parse_json(json_versions)
+            with open(root + '/versions-rc.json', 'r') as json_versions:
+                print('Checking Linux CachyOS RC')
+                parse_json(json_versions, '-rc')
+            with open(root + '/versions-lts.json', 'r') as json_versions:
+                print('Checking Linux CachyOS LTS')
+                parse_json(json_versions, '-lts')
+            with open(root + '/versions-hardened.json', 'r') as json_versions:
+                print('Checking Linux CachyOS Hardened')
+                parse_json(json_versions, '-hardened')
+  '';
+in
+{
+  config = {
+
+    sops = {
+      age.keyFile = "/home/${config.${namespace}.user.name}/.config/sops/age/keys.txt";
+      defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
+      validateSopsFiles = false;
+      secrets = {
+        "github-token" = { };
+      };
+      templates = {
+        ".env".content = ''
+          GITHUB_TOKEN = "${config.sops.placeholder.github-token}"
+        '';
+      };
+    };
+    home.packages = [ update-checker ];
+  };
+}

modules/home/programs/waybar/default.nix

@@ -1,7 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.waybar;
+  cfg = config.${namespace}.programs.waybar;
 
   baseStyle =
     if cfg.style.file != null then
@@ -383,15 +388,15 @@ in
 
               "custom/power" = {
                 format = "⏻ ";
-                tooltip =  false;
+                tooltip = false;
                 menu = "on-click";
                 menu-file = "~/.config/waybar/power_menu.xml";
                 menu-actions = {
-                    shutdown = "shutdown";
-                    reboot = "reboot";
-                    suspend = "systemctl suspend";
-                    hibernate = "systemctl hibernate";
-                    lock = "pidof hyprlock || hyprlock";
+                  shutdown = "shutdown";
+                  reboot = "reboot";
+                  suspend = "systemctl suspend";
+                  hibernate = "systemctl hibernate";
+                  lock = "pidof hyprlock || hyprlock";
                 };
               };
             }

modules/home/programs/waybar/options.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 let
   inherit (types)
@@ -13,7 +13,7 @@ let
     ;
 in
 {
-  options.mjallen.programs.waybar = {
+  options.${namespace}.programs.waybar = {
     enable = mkEnableOption "Waybar status bar";
 
     # Legacy/compat options (kept for backwards compatibility)

modules/home/programs/waybar/scripts/hass.nix

@@ -6,11 +6,13 @@
   ...
 }:
 let
-  cfg = config.mjallen.programs.waybar;
+  cfg = config.${namespace}.programs.waybar;
 
-  pythonEnv = pkgs.python3.withPackages (_ps: [
-    pkgs.${namespace}.homeassistant-api
-  ]);
+  pythonEnv = pkgs.python3.withPackages (
+    _ps: with pkgs.${namespace}; [
+      homeassistant-api
+    ]
+  );
 
   waybar-hass = pkgs.writeScriptBin "waybar-hass" ''
     #!${pythonEnv}/bin/python

modules/home/programs/waybar/scripts/weather.nix

@@ -2,10 +2,11 @@
   config,
   lib,
   pkgs,
+  namespace,
   ...
 }:
 let
-  cfg = config.mjallen.programs.waybar;
+  cfg = config.${namespace}.programs.waybar;
 
   waybar-weather = pkgs.writeScriptBin "waybar-weather" ''
     #!/usr/bin/env nix-shell

modules/home/programs/wlogout/default.nix

@@ -1,8 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.wlogout;
-  palette = import cfg.theme.file;
+  cfg = config.${namespace}.programs.wlogout;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/wlogout/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.wlogout = {
+  options.${namespace}.programs.wlogout = {
     enable = mkEnableOption "enable wlogout";
   };
 }

modules/home/programs/wofi/default.nix

@@ -1,8 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
-  cfg = config.mjallen.programs.wofi;
-  palette = import cfg.theme.file;
+  cfg = config.${namespace}.programs.wofi;
 in
 {
   imports = [ ./options.nix ];

modules/home/programs/wofi/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.programs.wofi = {
+  options.${namespace}.programs.wofi = {
     enable = mkEnableOption "enable wofi";
 
     fontName = mkOption {

modules/home/services/pass/default.nix

@@ -1,8 +1,4 @@
 {
-  config,
-  lib,
-  pkgs,
-  namespace,
   ...
 }:
 {

modules/home/shell-aliases/default.nix

@@ -1,13 +1,14 @@
 {
   config,
   lib,
+  namespace,
   ...
 }:
 let
-  cfg = config.mjallen.shell-aliases;
+  cfg = config.${namespace}.shell-aliases;
 in
 {
-  options.mjallen.shell-aliases = {
+  options.${namespace}.shell-aliases = {
     enable = lib.mkEnableOption "Common shell aliases";
 
     buildHost = lib.mkOption {

modules/home/sops/default.nix

@@ -1,29 +1,28 @@
 {
   config,
   lib,
+  namespace,
   ...
 }:
 let
-  cfg = config.mjallen.sops;
+  cfg = config.${namespace}.sops;
 in
 {
   imports = [ ./options.nix ];
 
   config = lib.mkIf cfg.enable {
-    # sops = {
-    #   age.keyFile = "/home/${user}/.config/sops/age/keys.txt";
-    #   defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
-    #   validateSopsFiles = false;
-    #   secrets = {
-    #     "ssh-keys-public/desktop-nixos" = {
-    #       path = "/home/${user}/.ssh/id_ed25519.pub";
-    #       mode = "0644";
-    #     };
-    #     "ssh-keys-private/desktop-nixos" = {
-    #       path = "/home/${user}/.ssh/id_ed25519";
-    #       mode = "0600";
-    #     };
-    #   };
-    # };
+    sops = {
+      age.keyFile = "/home/${config.${namespace}.user.name}/.config/sops/age/keys.txt";
+      defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
+      validateSopsFiles = false;
+      # secrets = {
+      #   "github-token" = { };
+      # };
+      # templates = {
+      #   ".env".content = ''
+      #     GITHUB_TOKEN = "${config.sops.placeholder.github-token}"
+      #   '';
+      # };
+    };
   };
 }

modules/home/sops/options.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, namespace, ... }:
 with lib;
 {
-  options.mjallen.sops = {
+  options.${namespace}.sops = {
     enable = mkEnableOption "enable sops";
 
     defaultSopsFile = mkOption {

modules/home/stylix/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  system,
+  ...
+}:
 let
   # # Pull from global theme options
   # themeSize = "standard"; # "standard" | "compact"
@@ -23,12 +28,15 @@ let
   #   schemeVariants = [ iconScheme ];
   #   colorVariants = [ iconThemeVariant ];
   # };
+  isDarwin = system == "aarch64-darwin";
 in
 {
   stylix = {
     enable = true;
+    overlays.enable = false;
     enableReleaseChecks = false;
     base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
+    polarity = "dark";
 
     cursor = {
       name = "macOS";
@@ -58,8 +66,8 @@ in
       };
 
       sizes = {
-        applications = 12;
-        desktop = 14;
+        applications = if isDarwin then 10 else 12;
+        desktop = if isDarwin then 12 else 14;
         popups = config.stylix.fonts.sizes.desktop;
         terminal = config.stylix.fonts.sizes.applications;
       };
@@ -67,9 +75,12 @@ in
 
     icons = {
       enable = true;
-      package = pkgs.colloid-icon-theme;
-      dark = "Colloid-nord-dark";
-      light = "Colloid-nord-light";
+      package = pkgs.colloid-icon-theme.override {
+        schemeVariants = [ "nord" ];
+        colorVariants = [ "default" ];
+      };
+      dark = "Colloid-Nord-Dark";
+      light = "Colloid-Nord-Light";
     };
 
     opacity = {
@@ -77,10 +88,18 @@ in
     };
 
     targets = {
-      hyprlock.enable = false;
-      gnome.enable = false;
-      # gtk.enable = false;
-      qt.enable = false;
+      hyprlock = {
+        enable = false;
+        useWallpaper = false;
+      };
+      kde.enable = false;
+      firefox = {
+        enable = false;
+        profileNames = [
+          "default"
+          "954lxlok.default"
+        ];
+      };
     };
   };
-}
+}

modules/home/user/default.nix

@@ -115,8 +115,8 @@ in
           tarnow = "${getExe pkgs.gnutar} -acf ";
           untar = "${getExe pkgs.gnutar} -zxvf ";
           wget = "${getExe pkgs.wget} -c ";
-          remove-empty = ''${getExe' pkgs.findutils "find"} . -type d --empty --delete'';
-          print-empty = ''${getExe' pkgs.findutils "find"} . -type d --empty --print'';
+          remove-empty = "${getExe' pkgs.findutils "find"} . -type d --empty --delete";
+          print-empty = "${getExe' pkgs.findutils "find"} . -type d --empty --print";
           dfh = "${getExe' pkgs.coreutils "df"} -h";
           duh = "${getExe' pkgs.coreutils "du"} -h";
           usage = "${getExe' pkgs.coreutils "du"} -ah -d1 | sort -rn 2>/dev/null";

modules/nixos/boot/common/default.nix

@@ -24,6 +24,13 @@ in
   config = mkIf cfg.enable {
     boot = {
 
+      kernelModules = [ "kvm" ];
+      kernelParams = lib.mkDefault [
+        "quiet"
+        "splash"
+        "udev.log_level=3"
+      ];
+
       binfmt = lib.mkIf isArm {
         registrations."x86_64-linux" = {
           magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
@@ -36,12 +43,28 @@ in
         };
       };
 
-      supportedFilesystems = [ "bcachefs" ];
+      supportedFilesystems = {
+        bcachefs = lib.mkOverride 90 true;
+        btrfs = lib.mkOverride 90 true;
+      };
 
-      consoleLogLevel = lib.mkForce 3;
+      consoleLogLevel = lib.mkDefault 0;
       bootspec.enable = (!isArm);
 
       initrd = {
+        verbose = lib.mkDefault false;
+        # availableKernelModules = {
+        #   bcachefs = lib.mkOverride 90 true;
+        #   btrfs = lib.mkOverride 90 true;
+        # };
+        # kernelModules = {
+        #   bcachefs = lib.mkOverride 90 true;
+        #   btrfs = lib.mkOverride 90 true;
+        # };
+        # systemd.storePaths = with pkgs; [
+        #   bcachefs-tools
+        # ];
+
         luks = mkIf cfg.yubikeyEncryption {
           devices = {
             "${config.disko.devices.disk.main.content.partitions.root.name}" = {

modules/nixos/desktop/hyprland/default.nix

@@ -58,6 +58,8 @@ in
       };
 
       gnome.gnome-keyring.enable = true;
+      geoclue2.enable = true;
+      upower.enable = true;
 
       dbus.enable = true;
       ddccontrol.enable = false;

modules/nixos/desktop/hyprland/options.nix

@@ -15,7 +15,7 @@ let
   '';
 in
 {
-  options.mjallen.desktop.hyprland = {
+  options.${namespace}.desktop.hyprland = {
     enable = mkEnableOption "enable hyprland desktop environment";
 
     wallpaperSource = mkOpt (types.enum [

modules/nixos/desktop/hyprland/wallpapers/default.nix

@@ -155,7 +155,7 @@ in
             ];
             script = ''
               ${wallpaper-command}
-              ${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper reload ,${cfg.wallpaper}
+              ${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper wallpaper ,${cfg.wallpaper},
             '';
             serviceConfig = {
               Type = "oneshot";

modules/nixos/disko/default.nix

@@ -37,14 +37,14 @@ let
     size = "100%";
     content = {
       type = cfg.filesystem;
-      # Subvolumes must set a mountpoint in order to be mounted,
-      # unless their parent is mounted
-      subvolumes = subvolumes;
     }
     // (
       if cfg.filesystem == "btrfs" then
         {
           extraArgs = [ "-f" ]; # Override existing partition
+          # Subvolumes must set a mountpoint in order to be mounted,
+          # unless their parent is mounted
+          subvolumes = subvolumes;
         }
       else
         {
@@ -64,7 +64,7 @@ let
     size = "100%";
     content = {
       type = "luks";
-      name = "cryptroot";
+      name = "${config.${namespace}.network.hostName}-cryptroot";
       extraOpenArgs = [
         "--allow-discards"
         "--perf-no_read_workqueue"
@@ -72,20 +72,21 @@ let
       ];
       settings = {
         crypttabExtraOpts = [
+          "tpm2-device=auto"
           "fido2-device=auto"
           "token-timeout=10"
         ];
       };
       content = {
         type = cfg.filesystem;
-        # Subvolumes must set a mountpoint in order to be mounted,
-        # unless their parent is mounted
-        subvolumes = subvolumes;
       }
       // (
         if cfg.filesystem == "btrfs" then
           {
             extraArgs = [ "-f" ]; # Override existing partition
+            # Subvolumes must set a mountpoint in order to be mounted,
+            # unless their parent is mounted
+            subvolumes = subvolumes;
           }
         else
           {
@@ -121,12 +122,12 @@ in
             content = {
               type = "gpt";
               partitions = {
-                FIRMWARE = lib.mkIf cfg.enableFirmware {
+                firmware = lib.mkIf cfg.firmware.enableFirmware {
                   priority = 1;
-                  name = "FIRMWARE";
+                  type = "0700";
+                  name = "${config.${namespace}.network.hostName}-FIRMWARE";
                   start = "1M";
                   end = "1G";
-                  type = "0700";
                   content = {
                     type = "filesystem";
                     format = "vfat";
@@ -135,9 +136,10 @@ in
                   };
                 };
                 ESP = {
-                  priority = if cfg.enableFirmware then 2 else 1;
+                  priority = if cfg.firmware.enableFirmware then 2 else 1;
                   type = "EF00";
                   size = "500M";
+                  name = "${config.${namespace}.network.hostName}-EFI";
                   content = {
                     type = "filesystem";
                     format = "vfat";
@@ -155,13 +157,35 @@ in
               };
             };
           };
+          # firmware = lib.mkIf cfg.firmware.enableFirmware {
+          #   device = cfg.firmware.firmwareDisk;
+          #   type = "disk";
+          #   imageSize = "1G";
+          #   content = {
+          #     type = "table";
+          #     format = "msdos";
+          #     partitions = [
+          #       {
+          #         name = "${config.${namespace}.network.hostName}-FIRMWARE";
+          #         start = "1M";
+          #         end = "1G";
+          #         content = {
+          #           type = "filesystem";
+          #           format = "vfat";
+          #           mountpoint = "/boot/firmware";
+          #           mountOptions = [ "umask=0077" ];
+          #         };
+          #       }
+          #     ];
+          #   };
+          # };
         };
 
         # configure Bcachefs
         bcachefs_filesystems = lib.mkIf (cfg.filesystem == "bcachefs") {
           mounted_subvolumes_in_multi = {
             type = "bcachefs_filesystem";
-            # passwordFile = "/etc/nixos/pool.jwe";
+            # passwordFile = "/etc/nixos/test.key";
             extraFormatArgs = [
               "--compression=${cfg.compression}"
             ];

modules/nixos/disko/options.nix

@@ -19,7 +19,10 @@ in
 
     enableLuks = mkBoolOpt false "Enable Luks";
 
-    enableFirmware = mkBoolOpt false "Enable rpi firmware part";
+    firmware = {
+      enableFirmware = mkBoolOpt false "Enable rpi firmware part";
+      firmwareDisk = mkOpt types.str "/dev/mmcblk0" "UEFI firmware disk";
+    };
 
     swapSize = mkOpt types.str "16G" "size of swap part";
 

modules/nixos/fonts/default.nix

@@ -2,10 +2,12 @@
 {
   fonts.packages = with pkgs; [
     font-awesome
+    pkgs.nerd-fonts.ubuntu
     noto-fonts
     noto-fonts-color-emoji
     meslo-lgs-nf
     pkgs.nerd-fonts.jetbrains-mono
+    rubik
   ];
   # ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts); # ALL fonts
 

modules/nixos/gaming/default.nix

@@ -18,11 +18,36 @@ in
     # Configure programs
     programs.steam = {
       enable = true;
+      package = pkgs.steam.override {
+        extraPkgs =
+          _pkgs: with pkgs; [
+            libXcursor
+            libXi
+            libXinerama
+            libXScrnSaver
+            libpng
+            libpulseaudio
+            libvorbis
+            stdenv.cc.cc.lib
+            libkrb5
+            keyutils
+          ];
+      };
       # Open ports in the firewall for Steam Remote Play
       remotePlay.openFirewall = true;
       # Open ports in the firewall for Source Dedicated Server
       dedicatedServer.openFirewall = true;
-      extraCompatPackages = with pkgs; [ proton-ge-bin ];
+      extraCompatPackages =
+        with pkgs.unstable;
+        [
+          proton-ge-bin
+        ]
+        ++ (with pkgs.${namespace}; [
+          proton-cachyos
+          proton-cachyos-v3
+          proton-cachyos-v2
+          proton-cachyos-v1
+        ]);
       gamescopeSession = {
         enable = true;
         args = [
@@ -61,28 +86,11 @@ in
     };
 
     environment = {
+      systemPackages = with pkgs.${namespace}; [
+      ];
       variables = {
         STEAM_FORCE_DESKTOPUI_SCALING = "1.0";
       };
     };
-
-    # Configure nixpkgs
-    nixpkgs.config.packageOverrides = pkgs: {
-      steam = pkgs.steam.override {
-        extraPkgs =
-          _pkgs: with pkgs; [
-            xorg.libXcursor
-            xorg.libXi
-            xorg.libXinerama
-            xorg.libXScrnSaver
-            libpng
-            libpulseaudio
-            libvorbis
-            stdenv.cc.cc.lib
-            libkrb5
-            keyutils
-          ];
-      };
-    };
   };
 }

modules/nixos/hardware/btrfs/default.nix

@@ -1,7 +1,12 @@
-{ lib, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 {
   services.btrfs = {
-    autoScrub.enable = lib.mkDefault true;
+    autoScrub.enable = lib.mkDefault (config.${namespace}.hardware.disko.filesystem == "btrfs");
     autoScrub.fileSystems = lib.mkDefault [
       "/nix"
       "/root"

modules/nixos/hardware/openrgb/default.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+let
+  hasDestopEnvironment =
+    config.${namespace}.desktop.cosmic.enable
+    || config.${namespace}.desktop.gnome.enable
+    || config.${namespace}.desktop.hyprland.enable;
+in
+{
+  config = lib.mkIf hasDestopEnvironment {
+    services.hardware.openrgb = {
+      enable = true;
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/apply-overlays-dtmerge.nix

@@ -0,0 +1,67 @@
+# modification of nixpkgs deviceTree.applyOverlays to resolve https://github.com/NixOS/nixpkgs/issues/125354
+# derived from https://github.com/NixOS/nixpkgs/blob/916ca8f2b0c208def051f8ea9760c534a40309db/pkgs/os-specific/linux/device-tree/default.nix
+{
+  lib,
+  stdenvNoCC,
+  dtc,
+  libraspberrypi,
+}:
+
+with lib;
+(
+  base: overlays':
+  stdenvNoCC.mkDerivation {
+    name = "device-tree-overlays";
+    nativeBuildInputs = [
+      dtc
+      libraspberrypi
+    ];
+    buildCommand =
+      let
+        overlays = toList overlays';
+      in
+      ''
+        mkdir -p $out
+        cd "${base}"
+        find . -type f -name '*.dtb' -print0 \
+          | xargs -0 cp -v --no-preserve=mode --target-directory "$out" --parents
+
+        for dtb in $(find "$out" -type f -name '*.dtb'); do
+          dtbCompat=$(fdtget -t s "$dtb" / compatible 2>/dev/null || true)
+          # skip files without `compatible` string
+          test -z "$dtbCompat" && continue
+
+          ${flip (concatMapStringsSep "\n") overlays (o: ''
+            overlayCompat="$(fdtget -t s "${o.dtboFile}" / compatible)"
+
+            # skip incompatible and non-matching overlays
+            if [[ ! "$dtbCompat" =~ "$overlayCompat" ]]; then
+              echo "Skipping overlay ${o.name}: incompatible with $(basename "$dtb")"
+            elif ${
+              if ((o.filter or null) == null) then
+                "false"
+              else
+                ''
+                  [[ "''${dtb//${o.filter}/}" ==  "$dtb" ]]
+                ''
+            }
+            then
+              echo "Skipping overlay ${o.name}: filter does not match $(basename "$dtb")"
+            else
+              echo -n "Applying overlay ${o.name} to $(basename "$dtb")... "
+              mv "$dtb"{,.in}
+
+              # dtmerge requires a .dtbo ext for dtbo files, otherwise it adds it to the given file implicitly
+              dtboWithExt="$TMPDIR/$(basename "${o.dtboFile}").dtbo"
+              cp -r ${o.dtboFile} "$dtboWithExt"
+
+              dtmerge "$dtb.in" "$dtb" "$dtboWithExt"
+
+              echo "ok"
+              rm "$dtb.in" "$dtboWithExt"
+            fi
+          '')}
+
+        done'';
+  }
+)

modules/nixos/hardware/raspberry-pi/audio.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.audio;
+  variant = config.${namespace}.hardware.raspberry-pi.variant;
+in
+{
+  options.${namespace}.hardware.raspberry-pi.audio = {
+    enable = lib.mkEnableOption "enable audio dt overlays";
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.deviceTree = {
+      overlays =
+        [ ]
+        ++ (
+          with pkgs.${namespace};
+          (
+            if (variant == "5") then
+              [
+                {
+                  name = "pisound-pi5-overlay";
+                  dtsFile = "${raspberrypi-overlays}/dtbs/raspberrypi-overlays/pisound-pi5-overlay.dts";
+                }
+              ]
+            else
+              [
+                {
+                  name = "pisound-overlay";
+                  dtsFile = "${raspberrypi-overlays}/dtbs/raspberrypi-overlays/pisound-overlay.dts";
+                }
+              ]
+          )
+        );
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/bluetooth.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.disable-bluetooth;
+  variant = config.${namespace}.hardware.raspberry-pi.variant;
+in
+{
+  options.${namespace}.hardware.raspberry-pi.disable-bluetooth = {
+    enable = lib.mkEnableOption "enable disablewifi dt overlays";
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.deviceTree = {
+      overlays =
+        [ ]
+        ++ (
+          if (variant == "5") then
+            [
+              {
+                name = "disable-bt-pi5-overlay";
+                dtsFile = "${
+                  pkgs.${namespace}.raspberrypi-overlays
+                }/dtbs/raspberrypi-overlays/disable-bt-pi5-overlay.dts";
+              }
+            ]
+          else
+            [
+              {
+                name = "disable-bt-overlay";
+                dtsFile = "${
+                  pkgs.${namespace}.raspberrypi-overlays
+                }/dtbs/raspberrypi-overlays/disable-bt-overlay.dts";
+              }
+            ]
+        );
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/config.nix

@@ -0,0 +1,222 @@
+# This file is a modified version of config.txt generator
+# Licensed under the terms of MIT License
+# https://raw.githubusercontent.com/nix-community/raspberry-pi-nix/refs/heads/master/rpi/config.nix
+# with modifications
+# https://raw.githubusercontent.com/nvmd/raspberry-pi-nix/refs/heads/master/rpi/config.nix
+
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi;
+
+  render-raspberrypi-config =
+    let
+
+      render-kvs =
+        kvs:
+        let
+          render-kv = k: v: if isNull v.value then k else "${k}=${toString v.value}";
+        in
+        lib.attrsets.mapAttrsToList render-kv (lib.filterAttrs (_k: v: v.enable) kvs);
+
+      render-dt-param = x: "dtparam=" + x;
+      render-dt-params = params: lib.strings.concatMapStringsSep "\n" render-dt-param (render-kvs params);
+
+      render-dt-overlay =
+        { overlay, params }:
+        lib.concatStringsSep "\n" (
+          lib.filter (x: x != "") [
+            ("dtoverlay=" + overlay)
+            (render-dt-params params)
+            "dtoverlay="
+          ]
+        );
+
+      render-options = opts: lib.strings.concatStringsSep "\n" (render-kvs opts);
+
+      render-base-dt-params = render-dt-params;
+
+      render-dt-overlays =
+        overlays:
+        lib.strings.concatMapStringsSep "\n" render-dt-overlay (
+          lib.attrsets.mapAttrsToList (overlay: params: {
+            inherit overlay;
+            inherit (params) params;
+          }) (lib.filterAttrs (_k: v: v.enable) overlays)
+        );
+
+      render-config-section =
+        conditionalFilter:
+        {
+          options,
+          base-dt-params,
+          dt-overlays,
+        }:
+        let
+          all-config = lib.concatStringsSep "\n" (
+            lib.filter (x: x != "") [
+              (render-options options)
+              (render-base-dt-params base-dt-params)
+              (render-dt-overlays dt-overlays)
+            ]
+          );
+        in
+        ''
+          [${conditionalFilter}]
+          ${all-config}
+        '';
+    in
+    conf:
+    lib.strings.concatStringsSep "\n" (
+      (lib.attrsets.mapAttrsToList render-config-section conf) ++ [ cfg.extra-config ]
+    );
+in
+{
+  options.${namespace}.hardware.raspberry-pi = {
+    config =
+      let
+        rpi-config-param = {
+          options = {
+            enable = lib.mkEnableOption "attr";
+            value = lib.mkOption {
+              type =
+                with lib.types;
+                oneOf [
+                  int
+                  str
+                  bool
+                ];
+            };
+          };
+        };
+        dt-param = {
+          options = {
+            enable = lib.mkEnableOption "attr";
+            value = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (oneOf [
+                  int
+                  str
+                  bool
+                ]);
+              default = null;
+            };
+          };
+        };
+        dt-overlay = {
+          options = {
+            enable = lib.mkEnableOption "overlay";
+            params = lib.mkOption {
+              type = with lib.types; attrsOf (submodule dt-param);
+              default = { };
+            };
+          };
+        };
+        raspberry-pi-config-options = {
+          options = {
+            options = lib.mkOption {
+              type = with lib.types; attrsOf (submodule rpi-config-param);
+              default = { };
+              description = ''
+                Common hardware configuration options, translates to
+                `<option>=<value>` in the `config.txt`.
+                <https://www.raspberrypi.com/documentation/computers/config_txt.html#common-hardware-configuration-options>
+              '';
+              example = {
+                arm_boost = {
+                  # arm_boost=1
+                  enable = true;
+                  value = true;
+                };
+              };
+            };
+            base-dt-params = lib.mkOption {
+              type = with lib.types; attrsOf (submodule dt-param);
+              default = { };
+              description = ''
+                Parameters to pass to the base DTB, translates to
+                `dtparam=<param>=<value>` in the `config.txt`.
+                <https://www.raspberrypi.com/documentation/computers/configuration.html#part3.2>
+              '';
+              example = {
+                i2c = {
+                  # dtparam=i2c=on
+                  enable = true;
+                  value = "on";
+                };
+                ant2 = {
+                  # dtparam=ant2
+                  enable = true;
+                };
+              };
+            };
+            dt-overlays = lib.mkOption {
+              type = with lib.types; attrsOf (submodule dt-overlay);
+              default = { };
+              description = ''
+                DTB overlays to enable and configure with parameters, translates to
+                ```
+                 dtoverlay=<overlay>
+                 dtparam=<param>=<value>
+                 dtoverlay=
+                ```, which is an equivalent to a more popular format of
+                `dtoverlay=<overlay>,<param>=<value>`.
+                <https://www.raspberrypi.com/documentation/computers/configuration.html#part3.1>
+              '';
+              example = {
+                vc4-kms-v3d = {
+                  # dtoverlay=vc4-kms-v3d,cma-256
+                  enable = true;
+                  params = {
+                    cma-256 = {
+                      enable = true;
+                      # value = "";
+                    };
+                  };
+                };
+                disable-bt = {
+                  # dtoverlay=disable-bt
+                  enable = true;
+                };
+              };
+            };
+          };
+        };
+      in
+      lib.mkOption {
+        type = with lib.types; attrsOf (submodule raspberry-pi-config-options);
+        description = ''
+          Configures `config.txt` file for Raspberry Pi devices.
+          The file is located on a firmware partition, usually mounted at
+          `/boot/firmware`.
+          <https://www.raspberrypi.com/documentation/computers/config_txt.html>
+        '';
+      };
+
+    extra-config = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        Extra options that will be appended to `/boot/firmware/config.txt` file.
+        For possible values, see: https://www.raspberrypi.com/documentation/computers/config_txt.html
+      '';
+    };
+
+    config-generated = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The config file text generated by hardware.raspberry-pi.config
+      '';
+      readOnly = true;
+    };
+  };
+
+  config = {
+    ${namespace}.hardware.raspberry-pi.config-generated = render-raspberrypi-config cfg.config;
+  };
+}

modules/nixos/hardware/raspberry-pi/default.nix

@@ -7,6 +7,196 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi;
+  dt_ao_overlay = _final: prev: {
+    deviceTree = prev.deviceTree // {
+      applyOverlays = _final.callPackage ./apply-overlays-dtmerge.nix { };
+    };
+  };
+
+  # installs raspberry's firmware independent of the nixos generations
+  # sometimes referred to as "boot code"
+  raspberryPiFirmware = (
+    {
+      pkgs,
+      firmware,
+      configTxt,
+    }:
+    pkgs.replaceVarsWith {
+      src = ./generational/install-firmware.sh;
+      isExecutable = true;
+
+      replacements = {
+        inherit (pkgs) bash;
+        path = pkgs.lib.makeBinPath [
+          pkgs.coreutils
+        ];
+
+        inherit firmware configTxt;
+      };
+    }
+  );
+
+  kernelbootGenBuilder = (
+    {
+      pkgs,
+      deviceTreeInstaller,
+    }:
+    pkgs.replaceVarsWith {
+      src = ./generational/kernelboot-gen-builder.sh;
+      isExecutable = true;
+
+      replacements = {
+        inherit (pkgs) bash;
+        path = pkgs.lib.makeBinPath [
+          pkgs.coreutils
+        ];
+
+        installDeviceTree = deviceTreeInstaller;
+      };
+    }
+  );
+
+  deviceTree = (
+    {
+      pkgs,
+      firmware,
+    }:
+    pkgs.replaceVarsWith {
+      src = ./generational/install-device-tree.sh;
+      isExecutable = true;
+
+      replacements = {
+        inherit (pkgs) bash;
+        path = pkgs.lib.makeBinPath [
+          pkgs.coreutils
+        ];
+
+        inherit firmware;
+      };
+    }
+  );
+
+  mkBootloader =
+    pkgs:
+    bootloader {
+      inherit pkgs;
+      inherit (cfg) nixosGenerationsDir;
+
+      firmwareInstaller = "${raspberryPiFirmware {
+        inherit pkgs;
+        firmware = pkgs.${namespace}.raspberrypifw;
+        configTxt = pkgs.writeTextFile {
+          name = "config.txt";
+          text = ''
+            # Do not edit!
+            # This configuration file is generated from NixOS configuration
+            # options `hardware.raspberry-pi.config`.
+            # Any manual changes will be overwritten on the next configuration
+            # switch.
+            ${config.${namespace}.hardware.raspberry-pi.config-generated}
+          '';
+        };
+      }}";
+
+      nixosGenBuilder = "${kernelbootGenBuilder {
+        inherit pkgs;
+        deviceTreeInstaller =
+          let
+            cmd = deviceTree {
+              inherit pkgs;
+              firmware = cfg.firmwarePackage;
+            };
+            args = lib.optionalString (!cfg.useGenerationDeviceTree) " -r";
+          in
+          "${cmd} ${args}";
+      }}";
+
+    };
+
+  bootloader = (
+    {
+      pkgs,
+      nixosGenerationsDir,
+      firmwareInstaller,
+      nixosGenBuilder,
+    }:
+    pkgs.replaceVarsWith {
+      src = ./generational/nixos-generations-builder.sh;
+      isExecutable = true;
+
+      replacements = {
+        inherit (pkgs) bash;
+        path = pkgs.lib.makeBinPath [
+          pkgs.coreutils
+          pkgs.gnused
+        ];
+
+        # NixOS-generations -independent
+        installFirmwareBuilder = firmwareInstaller;
+        # NixOS-generations -dependent
+        inherit nixosGenerationsDir nixosGenBuilder;
+      };
+    }
+  );
+
+  # Builders used to write during system activation
+
+  ubootBuilder = import ./uboot-builder.nix {
+    inherit pkgs;
+    ubootPackage = (
+      if (cfg.variant == "5") then pkgs.${namespace}.uboot-pi5 else pkgs.${namespace}.uboot-pi4
+    );
+    firmwareBuilder = firmwarePopulateCmd;
+    extlinuxConfBuilder = config.boot.loader.generic-extlinux-compatible.populateCmd;
+  };
+
+  uefiBuilder = import ./uefi-builder.nix {
+    inherit pkgs;
+    uefiPackage = (
+      if (cfg.variant == "5") then
+        pkgs.${namespace}.uefi-rpi5
+      else
+        pkgs.${namespace}.edk2.override { MODEL = "4"; }
+    );
+    firmwareBuilder = firmwarePopulateCmd;
+  };
+
+  # Builders exposed via populateCmd, which run on the build architecture
+  populateFirmwareBuilder = import ./firmware-builder.nix {
+    pkgs = pkgs.buildPackages;
+    configTxt = pkgs.writeTextFile {
+      name = "config.txt";
+      text = ''
+        # Do not edit!
+        # This configuration file is generated from NixOS configuration
+        # options `hardware.raspberry-pi.config`.
+        # Any manual changes will be overwritten on the next configuration
+        # switch.
+        ${config.${namespace}.hardware.raspberry-pi.config-generated}
+      '';
+    };
+    firmware = pkgs.${namespace}.raspberrypifw;
+  };
+
+  firmwarePopulateCmd = "${populateFirmwareBuilder} ${firmwareBuilderArgs}";
+  firmwareBuilderArgs = lib.optionalString (!true) " -r";
+
+  # these will receive the top-level path as an argument when invoked as
+  # system.build.installBootloader
+  builder = {
+    # system.build.installBootLoader
+    uboot = "${ubootBuilder} -f /boot/firmware -b /boot -c";
+    uefi = "${uefiBuilder} -f /boot/firmware -b /boot -c";
+    kernel = builtins.concatStringsSep " " [
+      "${mkBootloader pkgs}"
+      "-g ${toString 10}"
+      "-f /boot/firmware"
+      "-c"
+    ];
+  };
+
+  # firmware: caller must provide `-c <nixos configuration>` and  `-f <firmware target path>`
+  # boot: caller must provide `-c <nixos configuration>` and `-b <boot-dir>`
 in
 {
   options.${namespace}.hardware.raspberry-pi = {
@@ -19,15 +209,82 @@ in
       ];
       description = "Raspberry Pi variant (4 or 5)";
     };
+
+    bootType = lib.mkOption {
+      type = lib.types.enum [
+        "uefi"
+        "uboot"
+        "kernel"
+      ];
+      default = "uefi";
+    };
+
+    apply-overlays-dtmerge = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether replace deviceTree.applyOverlays implementation to use dtmerge from libraspberrypi.
+          This can resolve issues with applying dtbs for the pi.
+        '';
+      };
+    };
   };
 
+  imports = [
+    ./audio.nix
+    ./bluetooth.nix
+    ./config.nix
+    ./i2c.nix
+    ./leds.nix
+    ./modesetting.nix
+    ./pwm.nix
+    ./wifi.nix
+  ];
+
   config = lib.mkIf cfg.enable {
+
+    boot = {
+      initrd.availableKernelModules = [
+        "usbhid"
+        "usb-storage"
+      ]
+      ++ (
+        if (cfg.variant == "5") then
+          [
+            "nvme"
+          ]
+        else
+          [
+            "vc4"
+            "pcie-brcmstb" # required for the pcie bus to work
+            "reset-raspberrypi" # required for vl805 firmware to load
+          ]
+      );
+      loader = {
+        # kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target;
+        generic-extlinux-compatible = {
+          enable = lib.mkDefault (if cfg.bootType == "uefi" then false else true);
+          useGenerationDeviceTree = lib.mkOverride 60 (if cfg.bootType == "uefi" then false else true);
+        };
+        systemd-boot.enable = (if cfg.bootType == "uefi" then true else false);
+        systemd-boot.extraInstallCommands =
+          let
+            bootloaderInstaller = (builder."${cfg.bootType}");
+          in
+          ''
+            ${bootloaderInstaller} -f /boot/firmware -b /boot -c
+          '';
+        grub.enable = lib.mkForce false;
+      };
+    };
+
     # Common Raspberry Pi packages
     environment.systemPackages = with pkgs; [
+      dconf
       i2c-tools
       raspberrypi-eeprom
-      raspberrypifw
-      raspberrypiWirelessFirmware
+      pkgs.${namespace}.raspberrypi-utils
+      pkgs.${namespace}.raspberrypifw
+      pkgs.${namespace}.raspberryPiWirelessFirmware
       raspberrypi-armstubs
       erofs-utils
       fex
@@ -36,37 +293,172 @@ in
     ];
 
     # Common Bluetooth configuration
-    systemd.services.btattach = {
-      before = [ "bluetooth.service" ];
-      after = [ "dev-ttyAMA0.device" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${lib.getExe' pkgs.bluez "btattach"} -B /dev/ttyAMA0 -P bcm -S 3000000";
+    systemd = {
+      services.btattach = {
+        before = [ "bluetooth.service" ];
+        after = [ "dev-ttyAMA0.device" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pkgs.bluez "btattach"} -B /dev/ttyAMA0 -P bcm -S 3000000";
+        };
       };
+
+      tmpfiles.packages = [
+        pkgs.${namespace}.udev-rules
+      ];
+    };
+
+    ${namespace}.hardware.raspberry-pi = {
+      config = {
+        all = {
+          options = {
+            os_prefix = lib.mkIf (cfg.bootType == "kernel") {
+              enable = true;
+              value = "${cfg.nixosGenerationsDir}/default/"; # "nixos/<generation-name>/"
+            };
+            kernel = lib.mkIf (cfg.bootType == "kernel" || cfg.bootType == "uboot") {
+              enable = true;
+              value = (
+                if cfg.bootType == "uboot" then
+                  "u-boot.bin"
+                else if cfg.bootType == "kernel" then
+                  "kernel.img"
+                else
+                  ""
+              );
+            };
+          };
+        };
+      };
+      extra-config =
+        let
+          # https://www.raspberrypi.com/documentation/computers/config_txt.html#initramfs
+          ramfsfile = "initrd";
+          ramfsaddr = "followkernel"; # same as 0 = "after the kernel image"
+        in
+        ''
+          [all]
+          initramfs ${ramfsfile} ${ramfsaddr}
+        '';
     };
 
     # Common hardware settings
-    hardware.i2c.enable = lib.mkDefault true;
+    hardware = {
+      deviceTree = {
+        filter = lib.mkDefault (if (cfg.variant == "5") then "bcm2712*.dtb" else "bcm2711*.dtb");
+        package = lib.mkOverride 80 config.boot.kernelPackages.kernel;
+        overlays = (
+          if (cfg.variant == "4") then
+            [
+              {
+                name = "rpi4-cpu-revision";
+                dtsText = ''
+                  /dts-v1/;
+                  /plugin/;
 
-    # Pi specific settings
-    hardware.graphics.enable32Bit = lib.mkForce false;
+                  / {
+                    compatible = "brcm,bcm2711";
 
-    # Pi specific system tags
-    system.nixos.tags = (
-      let
-        bootCfg = config.boot.loader.raspberry-pi;
-      in
-      [
-        "raspberry-pi-${bootCfg.variant}"
-        bootCfg.bootloader
+                    fragment@0 {
+                      target-path = "/";
+                      __overlay__ {
+                        system {
+                          linux,revision = <0x00d03114>;
+                        };
+                      };
+                    };
+                  };
+                '';
+              }
+            ]
+          else
+            [
+              # {
+              #   name = "bcm2712d0-overlay";
+              #   dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/bcm2712d0-overlay.dts";
+              # }
+            ]
+        );
+      };
+      firmware = [ pkgs.${namespace}.raspberryPiWirelessFirmware ];
+      graphics.enable32Bit = lib.mkForce false;
+      i2c.enable = lib.mkDefault true;
+    };
+
+    system = {
+      #build.installBootLoader = lib.mkOverride 60 (if cfg.bootType == "uefi" then (builder."uefi") else (builder."uboot")); # todo
+      #boot = {
+      #  loader = {
+      #    id = lib.mkOverride 60 (if cfg.bootType == "uefi" then "raspberrypi-uefi" else "raspberrypi-uboot"); # todo
+      #    kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target;
+      #  };
+      #};
+      # Pi specific system tags
+      nixos.tags = [
+        "raspberry-pi-${cfg.variant}"
+        # config.boot.loader.raspberry-pi.bootloader
         config.boot.kernelPackages.kernel.version
-      ]
-    );
+      ];
+    };
 
     # Common programs
     programs.kdeconnect.enable = lib.mkDefault false;
 
     # Root user shell configuration
-    users.users.root.shell = pkgs.zsh;
+    users = {
+      users.root.shell = pkgs.zsh;
+      extraGroups = {
+        gpio = { };
+        i2c = { };
+        input = { };
+        plugdev = { };
+        spi = { };
+        video = { };
+      };
+    };
+
+    services = {
+      udev.packages = [
+        pkgs.${namespace}.udev-rules
+      ];
+      xserver.extraConfig =
+        let
+          identifier = "rp1";
+          driver = "rp1-vec|rp1-dsi|rp1-dpi";
+        in
+        ''
+          Section "OutputClass"
+            Identifier "${identifier}"
+            MatchDriver "${driver}"
+            Driver "modesetting"
+            Option "PrimaryGPU" "true"
+          EndSection
+        '';
+    };
+
+    nixpkgs.overlays =
+      [ ]
+      ++ (
+        if cfg.variant == "5" then
+          [
+            (_final: prev: {
+              # https://github.com/nvmd/nixos-raspberrypi/issues/64
+              # credit for the initial version of this snippet goes to @micahcc
+              jemalloc = prev.jemalloc.overrideAttrs (old: {
+                # --with-lg-page=(log2 page_size)
+                # RPi5 (bcm2712): since our page size is 16384 (2**14), we need 14
+                configureFlags =
+                  let
+                    pageSizeFlag = "--with-lg-page";
+                  in
+                  (prev.lib.filter (flag: prev.lib.hasPrefix pageSizeFlag flag == false) old.configureFlags)
+                  ++ [ "${pageSizeFlag}=14" ];
+              });
+            })
+          ]
+        else
+          [ ]
+      )
+      ++ (if cfg.apply-overlays-dtmerge.enable then [ dt_ao_overlay ] else [ ]);
   };
 }

modules/nixos/hardware/raspberry-pi/firmware-builder.nix

@@ -0,0 +1,19 @@
+{
+  pkgs,
+  configTxt,
+  firmware ? pkgs.raspberrypifw,
+}:
+
+pkgs.replaceVarsWith {
+  src = ./firmware-builder.sh;
+  isExecutable = true;
+
+  replacements = {
+    inherit (pkgs) bash;
+    path = pkgs.lib.makeBinPath [
+      pkgs.coreutils
+    ];
+
+    inherit firmware configTxt;
+  };
+}

modules/nixos/hardware/raspberry-pi/firmware-builder.sh

@@ -0,0 +1,93 @@
+#! @bash@/bin/sh -e
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+usage() {
+    echo "usage: $0 -c <path-to-default-configuration> [-d <firmware-dir>] [-r]" >&2
+    exit 1
+}
+
+default=                # Default configuration
+target=/boot/firmware   # Firmware target directory
+
+while getopts "c:d:r" opt; do
+    case "$opt" in
+        c) default="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        r) useVendorDeviceTree=1 ;;
+        \?) usage ;;
+    esac
+done
+
+# Copy a file from the Nix store to $target.
+declare -A filesCopied
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+    cp $src $dst.tmp
+    mv $dst.tmp $dst
+}
+
+# Add the firmware files
+# fwdir=@firmware@/share/raspberrypi/boot/
+SRC_FIRMWARE_DIR=@firmware@/share/raspberrypi/boot
+dtb_path=$SRC_FIRMWARE_DIR
+
+echo "copying firmware..."
+
+# Device Tree
+useVendorDeviceTree=1
+if [ -n "$useVendorDeviceTree" ]; then
+    echo -n "using vendor firmware from "
+    dtb_path=$SRC_FIRMWARE_DIR
+else
+    echo -n "using default generation's kernel device tree binaries: "
+    dtb_path=$(readlink -f $default/dtbs)
+fi
+echo $dtb_path
+
+DTBS=("$dtb_path"/*.dtb)
+echo "dtbs all: $DTBS"
+for dtb in "${DTBS[@]}"; do
+# for dtb in $dtb_path/broadcom/*.dtb; do
+    dst="$target/$(basename $dtb)"
+    copyForced $dtb "$dst"
+    filesCopied[$dst]=1
+done
+
+SRC_OVERLAYS_DIR="$dtb_path/overlays"
+SRC_OVERLAYS=("$SRC_OVERLAYS_DIR"/*)
+mkdir -p $target/overlays
+for ovr in "${SRC_OVERLAYS[@]}"; do
+# for ovr in $dtb_path/overlays/*; do
+    dst="$target/overlays/$(basename $ovr)"
+    copyForced $ovr "$dst"
+    filesCopied[$dst]=1
+done
+
+# remove obsolete device tree files
+for fn in $target/*.dtb $target/overlays/*; do
+    if ! test "${filesCopied[$fn]}" = 1; then
+        rm -vf -- "$fn"
+    fi
+done
+
+
+# Boot code
+
+STARTFILES=("$SRC_FIRMWARE_DIR"/start*.elf)
+BOOTCODE="$SRC_FIRMWARE_DIR/bootcode.bin"
+FIXUPS=("$SRC_FIRMWARE_DIR"/fixup*.dat)
+for SRC in "${STARTFILES[@]}" "$BOOTCODE" "${FIXUPS[@]}"; do
+    dst="$target/$(basename $SRC)"
+    copyForced "$SRC" "$dst"
+done
+
+echo "copying config.txt..."
+# Add the config.txt
+copyForced @configTxt@ $target/config.txt
+
+echo "raspberry pi firmware installed"

modules/nixos/hardware/raspberry-pi/generational/install-device-tree.sh

@@ -0,0 +1,77 @@
+#! @bash@/bin/sh -e
+
+# shellcheck disable=SC3030,SC3043,SC3044,SC3054
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+usage() {
+    echo "usage: $0 -c <path-to-configuration> [-d <destination-dir>] [-r]" >&2
+    exit 1
+}
+
+generationPath=         # Path to nixos configuration/generation
+target=/boot/firmware   # Device tree files target directory
+
+while getopts "c:d:r" opt; do
+    case "$opt" in
+        c) generationPath="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        r) useVendorDeviceTree=1 ;;
+        \?) usage ;;
+    esac
+done
+
+# Copy a file from the Nix store to $target.
+declare -A filesCopied
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+
+    local dstTmp="$dst.tmp.$$"
+
+    cp "$src" "$dstTmp"
+    mv "$dstTmp" "$dst"
+}
+
+echo "$0: $@"
+echo -n "installing device tree files: "
+
+# Device Tree
+
+if [ -n "$useVendorDeviceTree" ]; then
+    echo -n "vendor firmware "
+    dtb_path=@firmware@/share/raspberrypi/boot
+else
+    echo -n "generation's kernel's "
+    dtb_path=$(readlink -f "$generationPath/dtbs")
+fi
+echo "$dtb_path"
+
+# firmware package has dtbs in its root,
+# dtbs built with kernel are in broadcom/
+DTBS=("$dtb_path"/*.dtb "$dtb_path"/broadcom/*.dtb)
+echo "all dtbs: $DTBS"
+for dtb in "${DTBS[@]}"; do
+    dst="$target/$(basename "$dtb")"
+    echo "$dtb"
+    copyForced "$dtb" "$dst"
+    filesCopied[$dst]=1
+done
+
+SRC_OVERLAYS=("$dtb_path/overlays"/*)
+mkdir -p "$target/overlays"
+for ovr in "${SRC_OVERLAYS[@]}"; do
+    dst="$target/overlays/$(basename "$ovr")"
+    copyForced "$ovr" "$dst"
+    filesCopied[$dst]=1
+done
+
+# remove obsolete device tree files
+for fn in $target/*.dtb $target/overlays/*; do
+    if ! test "${filesCopied[$fn]}" = 1; then
+        rm -vf -- "$fn"
+    fi
+done

modules/nixos/hardware/raspberry-pi/generational/install-firmware.sh

@@ -0,0 +1,66 @@
+#! @bash@/bin/sh -e
+
+# shellcheck disable=SC3030,SC3043,SC3044,SC3054
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+usage() {
+    echo "usage: $0 -c <path-to-configuration> [-d <firmware-dir>]" >&2
+    exit 1
+}
+
+generationPath=         # Path to nixos configuration/generation
+target=/boot/firmware   # Firmware target directory
+
+while getopts "c:d:" opt; do
+    case "$opt" in
+        c) generationPath="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+# Copy a file from the Nix store to $target.
+declare -A filesCopied
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+
+    local dstTmp="$dst.tmp.$$"
+
+    cp "$src" "$dstTmp"
+    mv "$dstTmp" "$dst"
+}
+
+# Add the firmware files
+# fwdir=@firmware@/share/raspberrypi/boot/
+SRC_FIRMWARE_DIR=@firmware@/share/raspberrypi/boot
+
+echo "copying raspberry pi firmware..."
+
+# Boot code
+
+STARTFILES=("$SRC_FIRMWARE_DIR"/start*.elf)
+BOOTCODE="$SRC_FIRMWARE_DIR/bootcode.bin"
+FIXUPS=("$SRC_FIRMWARE_DIR"/fixup*.dat)
+for SRC in "${STARTFILES[@]}" "$BOOTCODE" "${FIXUPS[@]}"; do
+    dst="$target/$(basename "$SRC")"
+    copyForced "$SRC" "$dst"
+    filesCopied[$dst]=1
+done
+
+# remove obsolete firmware files
+for fn in $target/start*.elf $target/fixup*.dat; do
+    if ! test "${filesCopied[$fn]}" = 1; then
+        rm -vf -- "$fn"
+    fi
+done
+
+echo "copying config.txt..."
+# Add the config.txt
+copyForced @configTxt@ "$target/config.txt"
+
+echo "raspberry pi firmware installed"

modules/nixos/hardware/raspberry-pi/generational/kernelboot-gen-builder.sh

@@ -0,0 +1,68 @@
+#! @bash@/bin/sh -e
+
+# shellcheck disable=SC3037,SC3043,SC3044
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+
+    local dstTmp="$dst.tmp.$$"
+
+    cp "$src" "$dstTmp"
+    mv "$dstTmp" "$dst"
+}
+
+# Copy generation's kernel, initrd, cmdline to `genDir`.
+addEntry() {
+    local generationPath="$1"
+    local generationName="$2"
+    local genDir="$3"
+
+    if ! { [ -e "$generationPath/kernel" ] && [ -e "$generationPath/initrd" ]; }; then
+        return
+    fi
+
+    echo -n "kernel..."
+
+    local kernel="$(readlink -f "$generationPath/kernel")"
+    local initrd="$(readlink -f "$generationPath/initrd")"
+
+    readlink -f "$generationPath" > "$genDir/system-link"
+    echo "$kernel" > "$genDir/kernel-link"
+
+    copyForced "$kernel" "$genDir/kernel.img"
+    copyForced "$initrd" "$genDir/initrd"
+    echo "$(cat "$generationPath/kernel-params") init=$generationPath/init" > "$genDir/cmdline.txt"
+
+    echo -n "device tree..."
+
+    @installDeviceTree@ -c "$generationPath" -d "$genDir"
+
+    echo
+}
+
+usage() {
+    echo "usage: $0 -c <path-to-configuration> -n <configuration-name> -d <installation-directory>" >&2
+    exit 1
+}
+
+generationPath=         # Path to nixos configuration/generation
+generationName=         # Name of the generation
+target=/boot/firmware   # Target directory
+
+echo "$0: $@"
+while getopts "c:n:d:" opt; do
+    case "$opt" in
+        c) generationPath="$OPTARG" ;;
+        n) generationName="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+addEntry "$generationPath" "$generationName" "$target"
+echo "kernel boot files installed for nixos generation '$generationName'"

modules/nixos/hardware/raspberry-pi/generational/nixos-generations-builder.sh

@@ -0,0 +1,146 @@
+#! @bash@/bin/sh -e
+
+# shellcheck disable=SC3043,SC3044,SC3054
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+# used to track copied generations to decide which are obsolete
+# and need to be removed
+declare -A activeGenerations
+
+moveWBackup() {
+    local src="$1"
+    local dst="$2"
+
+    # Backup $dst if already exists
+    local dstBkp="$dst.bkp.$$"
+    if [ -e "$dst" ]; then
+        mv "$dst" "$dstBkp"
+    fi
+
+    # Move $src as "new" $dst
+    mv "$src" "$dst"
+
+    # Remove backup directory of the previous $dst
+    rm -rf "$dstBkp"
+}
+
+# Copy generation's kernel, initrd, cmdline to `gensDir/generationName`.
+addEntry() {
+    local generationPath="$1"
+    local generationName="$2"
+    local gensDir="$3"
+
+    local dst="$gensDir/$generationName"
+
+    echo "* nixos generation '$generationName' -> $dst"
+    # Don't copy the files if $dst already exists, unless it's the default
+    # configuration.
+    # This means that we have to create $dst atomically to prevent partially
+    # copied generations if this script is ever interrupted.
+    #
+    # For "default" generation: make backup and then replace with the new
+    # "default", minimizing the time when where isn't any "default" generation
+    # directory
+    if ! [ -e $dst ] || [ "$generationName" = "default" ]; then
+        local dstTmp="$dst.tmp.$$"
+        mkdir -p "$dstTmp" || true
+
+        @nixosGenBuilder@ -c "$generationPath" -n "$generationName" -d "$dstTmp"
+
+        # Move new generation on its place, backing up the previous version
+        # if it exists
+        # This may only happen when "$generationName" = "default"
+        moveWBackup "$dstTmp" "$dst"
+    fi
+
+    activeGenerations["$generationName"]=1
+}
+
+removeObsoleteGenerations() {
+    local path="$1"
+
+    echo "removing obsolete generations in $path..."
+    for gen in $path/*; do
+        if ! [ "${activeGenerations["$(basename "$gen")"]}" = 1 ]; then
+            echo "* $gen is obsolete"
+            rm -vrf "$gen"
+        fi
+    done
+}
+
+addAllEntries() {
+    local defaultGenerationPath="$1"
+    local outdir="$2"
+    local numGenerations="$3"
+
+    local gensDir="$outdir/@nixosGenerationsDir@"
+    mkdir -p "$gensDir" || true
+
+    # Add default generation
+    addEntry "$defaultGenerationPath" default "$gensDir"
+
+    if [ "$numGenerations" -gt 0 ]; then
+        # Add up to $numGenerations generations of the system profile, in reverse
+        # (most recent to least recent) order.
+        for generation in $(
+            (cd /nix/var/nix/profiles && ls -d system-*-link) \
+            | sed 's/system-\([0-9]\+\)-link/\1/' \
+            | sort -n -r \
+            | head -n "$numGenerations"); do
+            link=/nix/var/nix/profiles/system-$generation-link
+            addEntry "$link" "${generation}-default" "$gensDir"
+            for specialisation in $(
+                ls /nix/var/nix/profiles/system-$generation-link/specialisation \
+                | sort -n -r); do
+                link=/nix/var/nix/profiles/system-$generation-link/specialisation/$specialisation
+                addEntry "$link" "${generation}-${specialisation}" "$gensDir"
+            done
+        done
+    fi
+
+    removeObsoleteGenerations "$gensDir"
+}
+
+usage() {
+    echo "usage: $0 -c <path-to-default-configuration> [-b <boot-dir>] [-g <num-generations>]" >&2
+    exit 1
+}
+
+
+default=                # Default configuration
+numGenerations=0        # Number of other generations to keep (kernel, initrd, DTBs, overlays)
+
+echo "$0: $@"
+while getopts "c:b:g:f:" opt; do
+    case "$opt" in
+        c) default="$OPTARG" ;;
+        b) boottarget="$OPTARG" ;;
+        g) numGenerations="$OPTARG" ;;
+        f) fwtarget="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+if [ -z "$boottarget" ] && [ -z "$fwtarget" ]; then
+    echo "Error: at least one of \`-b <boot-dir>\` and \`-f <firmware-dir>\` must be set"
+    usage
+fi
+
+if [ -n "$fwtarget" ]; then
+    echo "installing nixos-generation-independent firmware..."
+    @installFirmwareBuilder@ -c "$default" -d "$fwtarget"
+
+    echo "installing nixos generations..."
+    addAllEntries "$default" "$fwtarget" "$numGenerations"
+fi
+
+if [ -n "$boottarget" ]; then
+    echo "'-b $boottarget' isn't used when loading the kernel directly with \`kernel\`: "\
+         "kernels are copied directly to <firmware-dir>"
+    exit 0
+fi
+
+echo "generational bootloader installed"

modules/nixos/hardware/raspberry-pi/i2c.nix

@@ -0,0 +1,77 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.i2c;
+  variant = config.${namespace}.hardware.raspberry-pi.variant;
+in
+{
+  options.${namespace}.hardware.raspberry-pi.i2c = {
+    enable = lib.mkEnableOption "enable i2c dt overlays";
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.deviceTree = {
+      overlays = (
+        if (variant == "5") then
+          [
+            {
+              name = "i2c0-pi5-overlay";
+              dtsFile = "${
+                pkgs.${namespace}.raspberrypi-overlays
+              }/dtbs/raspberrypi-overlays/i2c0-pi5-overlay.dts";
+            }
+            {
+              name = "i2c1-pi5-overlay";
+              dtsFile = "${
+                pkgs.${namespace}.raspberrypi-overlays
+              }/dtbs/raspberrypi-overlays/i2c1-pi5-overlay.dts";
+            }
+            {
+              name = "i2c2-pi5-overlay";
+              dtsFile = "${
+                pkgs.${namespace}.raspberrypi-overlays
+              }/dtbs/raspberrypi-overlays/i2c2-pi5-overlay.dts";
+            }
+            {
+              name = "i2c3-pi5-overlay";
+              dtsFile = "${
+                pkgs.${namespace}.raspberrypi-overlays
+              }/dtbs/raspberrypi-overlays/i2c3-pi5-overlay.dts";
+            }
+          ]
+        else
+          [
+            {
+              name = "i2c0-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c0-overlay.dts";
+            }
+            {
+              name = "i2c1-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c1-overlay.dts";
+            }
+            {
+              name = "i2c3-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c3-overlay.dts";
+            }
+            {
+              name = "i2c4-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c4-overlay.dts";
+            }
+            {
+              name = "i2c5-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c5-overlay.dts";
+            }
+            {
+              name = "i2c6-overlay";
+              dtsFile = "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/i2c6-overlay.dts";
+            }
+          ]
+      );
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/kernelboot-builder.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  firmwareBuilder,
+}:
+
+pkgs.replaceVarsWith {
+  src = ./kernelboot-builder.sh;
+  isExecutable = true;
+
+  replacements = {
+    inherit (pkgs) bash;
+    path = pkgs.lib.makeBinPath [
+      pkgs.coreutils
+      pkgs.gnused
+    ];
+
+    inherit firmwareBuilder;
+    copyKernels = true;
+  };
+}

modules/nixos/hardware/raspberry-pi/kernelboot-builder.sh

@@ -0,0 +1,147 @@
+#! @bash@/bin/sh -e
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+# used to track copied files to decide which are obsolete
+# and need to be removed
+declare -A filesCopied
+
+# Convert a path to a file in the Nix store such as
+# /nix/store/<hash>-<name>/file to <hash>-<name>-<file>.
+cleanName() {
+    local path="$1"
+    echo "$path" | sed 's|^/nix/store/||' | sed 's|/|-|g'
+}
+
+# Copy a file from the Nix store to `kernelsDir`.
+copyToKernelsDir() {
+    local src="$1"
+    local kernelsDir="$2"
+
+    local dst="$kernelsDir/$(cleanName $src)"
+    # Don't copy the file if $dst already exists.  This means that we
+    # have to create $dst atomically to prevent partially copied
+    # kernels or initrd if this script is ever interrupted.
+    if ! test -e $dst; then
+        local dstTmp=$dst.tmp.$$
+        cp $src $dstTmp
+        mv $dstTmp $dst
+    fi
+    filesCopied[$dst]=1
+    result=$dst
+}
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+    cp $src $dst.tmp
+    mv $dst.tmp $dst
+}
+
+# Copy generation's kernel and initrd to `kernelsDir`.
+# Default generation's are also copied to `outdir`
+addEntry() {
+    local generationPath="$1"
+    local generationName="$2"
+    local outdir="$3"
+    local kernelsDir="$4"
+
+    if ! test -e $generationPath/kernel -a -e $generationPath/initrd; then
+        return
+    fi
+
+    local kernel=$(readlink -f $generationPath/kernel)
+    local initrd=$(readlink -f $generationPath/initrd)
+
+    if test "1" = "@copyKernels@"; then
+        copyToKernelsDir $kernel $kernelsDir; kernel=$result
+        copyToKernelsDir $initrd $kernelsDir; initrd=$result
+    fi
+
+    echo $(readlink -f $generationPath) > $kernelsDir/$generationName-system
+    echo $(readlink -f $generationPath/init) > $kernelsDir/$generationName-init
+    cp $generationPath/kernel-params $kernelsDir/$generationName-cmdline.txt
+    echo $initrd > $kernelsDir/$generationName-initrd
+    echo $kernel > $kernelsDir/$generationName-kernel
+
+    if test "$generationName" = "default"; then
+      copyForced $kernel $outdir/kernel.img
+      copyForced $initrd $outdir/initrd
+
+      cp "$(readlink -f "$generationPath/init")" $outdir/nixos-init
+      echo "`cat $generationPath/kernel-params` init=$generationPath/init" >$outdir/cmdline.txt
+    fi
+}
+
+removeObsolete() {
+    local path="$1"
+
+    # Remove obsolete files from $path and $path/old.
+    for fn in $path/*linux* $path/*initrd-initrd*; do
+        if ! test "${filesCopied[$fn]}" = 1; then
+            rm -vf -- "$fn"
+        fi
+    done
+}
+
+addAllEntries() {
+    local defaultGenerationPath="$1"
+    local outdir="$2"
+
+    local kernelsDir="$outdir/nixos-kernels"
+    mkdir -p $kernelsDir || true
+
+    # Add default generation
+    addEntry $defaultGenerationPath default $outdir $kernelsDir
+
+    # Add all generations of the system profile to the menu, in reverse
+    # (most recent to least recent) order.
+    for generation in $(
+        (cd /nix/var/nix/profiles && ls -d system-*-link) \
+        | sed 's/system-\([0-9]\+\)-link/\1/' \
+        | sort -n -r); do
+        link=/nix/var/nix/profiles/system-$generation-link
+        addEntry $link $generation $outdir $kernelsDir
+    done
+
+    removeObsolete $kernelsDir
+}
+
+usage() {
+    echo "usage: $0 -c <path-to-default-configuration> [-d <boot-dir>]" >&2
+    exit 1
+}
+
+
+default=                # Default configuration
+
+echo "kernelboot-builder: $@"
+while getopts "c:b:f:" opt; do
+    case "$opt" in
+        c) default="$OPTARG" ;;
+        b) boottarget="$OPTARG" ;;
+        f) fwtarget="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+if [ -z "$boottarget" ] && [ -z "$fwtarget" ]; then
+    echo "Error: at least one of \`-b <boot-dir>\` and \`-f <firmware-dir>\` must be set"
+    usage
+fi
+
+if [ -n "$fwtarget" ]; then
+    @firmwareBuilder@ -c $default -d $fwtarget
+
+    echo "updating the boot generations directory..."
+    addAllEntries $default $fwtarget
+fi
+
+if [ -n "$boottarget" ]; then
+    echo "'-b $boottarget' isn't used when loading the kernel directly with kernelboot: \
+          kernels are copied directly to <firmware-dir>"
+fi
+
+echo "kernelboot bootloader installed"

modules/nixos/hardware/raspberry-pi/leds.nix

@@ -0,0 +1,137 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.leds;
+  mkDisableOption =
+    name:
+    lib.mkOption {
+      default = false;
+      example = true;
+      description = "Whether to disable ${name}.";
+      type = lib.types.bool;
+    };
+in
+{
+  options.${namespace}.hardware = {
+    raspberry-pi.leds = {
+      eth.disable = mkDisableOption "ethernet LEDs.";
+      act.disable = mkDisableOption "activity LED.";
+      pwr.disable = mkDisableOption "power LED.";
+    };
+  };
+
+  # Adapted from: https://gist.github.com/SFrijters/206d2c09656affb04284f076c75a1969
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.eth.disable || cfg.act.disable || cfg.pwr.disable) {
+      ${namespace}.hardware.raspberry-pi.apply-overlays-dtmerge.enable = lib.mkDefault true;
+      hardware.deviceTree.filter = "*-rpi-4-*.dtb";
+    })
+    (lib.mkIf cfg.eth.disable {
+      hardware.deviceTree = {
+        overlays = [
+          # https://github.com/raspberrypi/firmware/blob/master/boot/overlays/README
+          # eth_led0                Set mode of LED0 - amber on Pi3B+ (default "1"),
+          #                         green on Pi4 (default "0").
+          #                         The legal values are:
+          #
+          #                         Pi4
+          #
+          #                         0=Speed/Activity         1=Speed
+          #                         2=Flash activity         3=FDX
+          #                         4=Off                    5=On
+          #                         6=Alt                    7=Speed/Flash
+          #                         8=Link                   9=Activity
+          #
+          # Debugging:
+          # $ hexdump /proc/device-tree/scb/ethernet@7d580000/mdio@e14/ethernet-phy@1/led-modes
+          {
+            name = "disable-eth-leds";
+            filter = "*rpi-4-b*";
+            dtsText = ''
+              /dts-v1/;
+              /plugin/;
+              /{
+                  compatible = "raspberrypi,4-model-b";
+                  fragment@0 {
+                      target = <&phy1>;
+                      __overlay__ {
+                          led-modes = <0x04 0x04>;
+                      };
+                  };
+              };
+            '';
+          }
+        ];
+      };
+    })
+    (lib.mkIf cfg.act.disable {
+      hardware.deviceTree = {
+        overlays = [
+          # Debugging:
+          # $ hexdump /proc/device-tree/leds/led-act/gpios
+          # $ cat /proc/device-tree/leds/led-act/linux,default-trigger
+          {
+            name = "disable-act-led";
+            filter = "*rpi-4-b*";
+            dtsText =
+              let
+                kernelVersion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2";
+                target = if kernelVersion then "<&led_act>" else "<&act_led>";
+              in
+              ''
+                /dts-v1/;
+                /plugin/;
+                /{
+                    compatible = "raspberrypi,4-model-b";
+                    fragment@0 {
+                        target = ${target};
+                        __overlay__ {
+                            gpios = <&gpio 42 0>; /* first two values copied from bcm2711-rpi-4-b.dts */
+                            linux,default-trigger = "none";
+                        };
+                    };
+                };
+              '';
+          }
+        ];
+      };
+    })
+    (lib.mkIf cfg.pwr.disable {
+      hardware.deviceTree = {
+        overlays = [
+          # Debugging:
+          # $ hexdump /proc/device-tree/leds/led-pwr/gpios
+          # $ cat /proc/device-tree/leds/led-pwr/linux,default-trigger
+          {
+            name = "disable-pwr-led";
+            filter = "*rpi-4-b*";
+            dtsText =
+              let
+                kernelVersion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2";
+                target = if kernelVersion then "<&led_pwr>" else "<&pwr_led>";
+              in
+              ''
+                /dts-v1/;
+                /plugin/;
+                /{
+                    compatible = "raspberrypi,4-model-b";
+                    fragment@0 {
+                        target = ${target};
+                        __overlay__ {
+                            gpios = <&expgpio 2 0>; /* first two values copied from bcm2711-rpi-4-b.dts */
+                            linux,default-trigger = "default-on";
+                        };
+                    };
+                };
+              '';
+          }
+        ];
+      };
+    })
+  ];
+}

modules/nixos/hardware/raspberry-pi/modesetting.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.modesetting;
+  variant = config.${namespace}.hardware.raspberry-pi.variant;
+in
+{
+  options.${namespace}.hardware.raspberry-pi.modesetting = {
+    enable = lib.mkEnableOption "enable modesetting dt overlays";
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.deviceTree = {
+      overlays =
+        [ ]
+        ++ (
+          if (variant == "5") then
+            [
+              {
+                name = "vc4-kms-v3d-pi5-overlay";
+                dtsFile = "${
+                  pkgs.${namespace}.raspberrypi-overlays
+                }/dtbs/raspberrypi-overlays/vc4-kms-v3d-pi5-overlay.dts";
+              }
+            ]
+          else
+            [
+              {
+                name = "vc4-fkms-v3d-pi4-overlay";
+                dtsFile = "${
+                  pkgs.${namespace}.raspberrypi-overlays
+                }/dtbs/raspberrypi-overlays/vc4-fkms-v3d-pi4-overlay.dts";
+              }
+            ]
+        );
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/overlays/default.nix

@@ -0,0 +1,269 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  inherit (lib.${namespace}) mkOpt;
+  cfg = config.${namespace}.hardware.raspberry-pi.overlays;
+
+  firmware = "${pkgs.${namespace}.raspberrypifw}/share/raspberrypi/boot/overlays";
+  configfsPath = "/sys/kernel/config/device-tree/overlays";
+in
+{
+  options.${namespace}.hardware.raspberry-pi.overlays = with lib; {
+    pi5DisableWifi = {
+      enable = lib.mkEnableOption "Disable wifi on Pi5";
+      overlay = mkOpt types.str "${firmware}/disable-wifi-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5DisableBluetooth = {
+      enable = lib.mkEnableOption "Disable bluetooth on Pi5";
+      overlay = mkOpt types.str "${firmware}/disable-bt-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5i2c0 = {
+      enable = lib.mkEnableOption "Enable pi5i2c0 on Pi5";
+      overlay = mkOpt types.str "${firmware}/i2c0-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5i2c1 = {
+      enable = lib.mkEnableOption "Enable pi5i2c1 on Pi5";
+      overlay = mkOpt types.str "${firmware}/i2c1-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5i2c2 = {
+      enable = lib.mkEnableOption "Enable pi5i2c2 on Pi5";
+      overlay = mkOpt types.str "${firmware}/i2c2-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5i2c3 = {
+      enable = lib.mkEnableOption "Enable pi5i2c3 on Pi5";
+      overlay = mkOpt types.str "${firmware}/i2c3-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Sdio = {
+      enable = lib.mkEnableOption "Enable sdio-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/sdio-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi21cs = {
+      enable = lib.mkEnableOption "Enable spi2-1cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi2-1cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi22cs = {
+      enable = lib.mkEnableOption "Enable spi2-2cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi2-2cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi31cs = {
+      enable = lib.mkEnableOption "Enable spi3-1cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi3-1cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi32cs = {
+      enable = lib.mkEnableOption "Enable spi3-2cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi3-2cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi51cs = {
+      enable = lib.mkEnableOption "Enable spi5-1cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi5-1cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Spi52cs = {
+      enable = lib.mkEnableOption "Enable spi5-2cs-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/spi5-1cs-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Uart0 = {
+      enable = lib.mkEnableOption "Enable pi5Uart0 on Pi5";
+      overlay = mkOpt types.str "${firmware}/uart0-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Uart1 = {
+      enable = lib.mkEnableOption "Enable pi5Uart1 on Pi5";
+      overlay = mkOpt types.str "${firmware}/uart1-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Uart2 = {
+      enable = lib.mkEnableOption "Enable pi5Uart2 on Pi5";
+      overlay = mkOpt types.str "${firmware}/uart2-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Uart3 = {
+      enable = lib.mkEnableOption "Enable pi5Uart3 on Pi5";
+      overlay = mkOpt types.str "${firmware}/uart3-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Uart4 = {
+      enable = lib.mkEnableOption "Enable pi5Uart4 on Pi5";
+      overlay = mkOpt types.str "${firmware}/uart4-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    pi5Vc4Kms = {
+      enable = lib.mkEnableOption "Enable vc4-kms-v3d-pi5.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/vc4-kms-v3d-pi5.dtbo" "Location of the dtbo file";
+    };
+
+    bcm2712d0 = {
+      enable = lib.mkEnableOption "Enable bcm2712d0.dtbo on Pi5";
+      overlay = mkOpt types.str "${firmware}/bcm2712d0.dtbo" "Location of the dtbo file";
+    };
+  };
+
+  config = lib.mkIf config.${namespace}.hardware.raspberry-pi.enable {
+    systemd.services = {
+      apply-overlays = {
+        description = "Apply Raspberry Pi Device Tree Overlays";
+        script = ''
+          echo "Applying Device Tree Overlays via ConfigFS"
+
+          if [ ${if cfg.pi5DisableWifi.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/disable-wifi-pi5
+            cp ${cfg.pi5DisableWifi.overlay} ${configfsPath}/disable-wifi-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/disable-wifi-pi5
+          fi
+
+          if [ ${if cfg.pi5DisableBluetooth.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/disable-bt-pi5
+            cp ${cfg.pi5DisableBluetooth.overlay} ${configfsPath}/disable-bt-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/disable-bt-pi5
+          fi
+
+          if [ ${if cfg.pi5i2c0.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/i2c0-pi5
+            cp ${cfg.pi5i2c0.overlay} ${configfsPath}/i2c0-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/i2c0-pi5
+          fi
+
+          if [ ${if cfg.pi5i2c1.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/i2c1-pi5
+            cp ${cfg.pi5i2c1.overlay} ${configfsPath}/i2c1-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/i2c1-pi5
+          fi
+
+          if [ ${if cfg.pi5i2c2.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/i2c2-pi5
+            cp ${cfg.pi5i2c2.overlay} ${configfsPath}/i2c2-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/i2c2-pi5
+          fi
+
+          if [ ${if cfg.pi5i2c3.enable then "true" else "false"} ]; then
+            mkdir -p ${toString configfsPath}/i2c3-pi5
+            cp ${cfg.pi5i2c3.overlay} ${configfsPath}/i2c3-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/i2c3-pi5
+          fi
+
+          if [ ${if cfg.pi5Sdio.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/sdio-pi5
+            cp ${cfg.pi5Sdio.overlay} ${configfsPath}/sdio-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/sdio-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi21cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi2-1cs-pi5
+            cp ${cfg.pi5Spi21cs.overlay} ${configfsPath}/spi2-1cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi2-1cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi22cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi2-2cs-pi5
+            cp ${cfg.pi5Spi22cs.overlay} ${configfsPath}/spi2-2cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi2-2cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi31cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi3-1cs-pi5
+            cp ${cfg.pi5Spi31cs.overlay} ${configfsPath}/spi3-1cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi3-1cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi32cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi3-2cs-pi5
+            cp ${cfg.pi5Spi32cs.overlay} ${configfsPath}/spi3-2cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi3-2cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi51cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi5-1cs-pi5
+            cp ${cfg.pi5Spi51cs.overlay} ${configfsPath}/spi5-1cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi5-1cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Spi52cs.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/spi5-2cs-pi5
+            cp ${cfg.pi5Spi52cs.overlay} ${configfsPath}/spi5-2cs-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/spi5-2cs-pi5
+          fi
+
+          if [ ${if cfg.pi5Uart0.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/uart0-pi5
+            cp ${cfg.pi5Uart0.overlay} ${configfsPath}/uart0-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/uart0-pi5
+          fi
+
+          if [ ${if cfg.pi5Uart1.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/uart1-pi5
+            cp ${cfg.pi5Uart1.overlay} ${configfsPath}/uart1-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/uart1-pi5
+          fi
+
+          if [ ${if cfg.pi5Uart2.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/uart2-pi5
+            cp ${cfg.pi5Uart2.overlay} ${configfsPath}/uart2-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/uart2-pi5
+          fi
+
+          if [ ${if cfg.pi5Uart3.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/uart3-pi5
+            cp ${cfg.pi5Uart3.overlay} ${configfsPath}/uart3-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/uart3-pi5
+          fi
+
+          if [ ${if cfg.pi5Uart4.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/uart4-pi5
+            cp ${cfg.pi5Uart4.overlay} ${configfsPath}/uart4-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/uart4-pi5
+          fi
+
+          if [ ${if cfg.pi5Vc4Kms.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/vc4-kms-v3d-pi5
+            cp ${cfg.pi5Vc4Kms.overlay} ${configfsPath}/vc4-kms-v3d-pi5/dtbo
+          else
+            rm -rf ${toString configfsPath}/vc4-kms-v3d-pi5
+          fi
+
+          if [ ${if cfg.bcm2712d0.enable then "true" else "false"} ]; then
+            mkdir ${toString configfsPath}/bcm2712d0
+            cp ${cfg.bcm2712d0.overlay} ${configfsPath}/bcm2712d0/dtbo
+          else
+            rm -rf ${toString configfsPath}/bcm2712d0
+          fi
+        '';
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/pwm.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.hardware.raspberry-pi.pwm;
+  variant = config.${namespace}.hardware.raspberry-pi.variant;
+in
+{
+  options.${namespace}.hardware.raspberry-pi.pwm = {
+    enable = lib.mkEnableOption "enable pwm dt overlay";
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.deviceTree = {
+      overlays = [
+        {
+          name = "enable-pwm";
+          filter = (if (variant == "5") then "*pi5*" else "*rpi-4-b*");
+          dtsFile = (
+            if (variant == "5") then
+              "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/pwm-pio-overlay.dts"
+            else
+              "${pkgs.${namespace}.raspberrypi-overlays}/dtbs/raspberrypi-overlays/pwm1-overlay.dts"
+          );
+        }
+      ];
+    };
+  };
+}

modules/nixos/hardware/raspberry-pi/uboot-builder.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  ubootPackage,
+  ubootBinName ? "u-boot.bin",
+  extlinuxConfBuilder,
+  firmwareBuilder,
+}:
+
+pkgs.replaceVarsWith {
+  src = ./uboot-builder.sh;
+  isExecutable = true;
+
+  replacements = {
+    inherit (pkgs) bash;
+    path = pkgs.lib.makeBinPath [
+      pkgs.coreutils
+    ];
+
+    uboot = ubootPackage;
+    inherit ubootBinName;
+    inherit extlinuxConfBuilder;
+    inherit firmwareBuilder;
+  };
+}

modules/nixos/hardware/raspberry-pi/uboot-builder.sh

@@ -0,0 +1,67 @@
+#! @bash@/bin/sh -e
+
+shopt -s nullglob
+
+export PATH=/empty:@path@
+
+usage() {
+    echo "usage: $0 -f <firmware-dir> -b <boot-dir> -c <path-to-default-configuration>" >&2
+    exit 1
+}
+
+default=               # Default configuration, needed for extlinux
+# fwtarget=/boot/firmware  # firmware target directory
+# boottarget=/boot         # boot configuration target directory
+
+echo "uboot-builder: $@"
+while getopts "c:b:f:" opt; do
+    case "$opt" in
+        c) default="$OPTARG" ;;
+        b) boottarget="$OPTARG" ;;
+        f) fwtarget="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+if [ -z "$boottarget" ] && [ -z "$fwtarget" ]; then
+    echo "Error: at least one of \`-b <boot-dir>\` and \`-f <firmware-dir>\` must be set"
+    usage
+fi
+
+# # process arguments for this builder, then pass the remainder to extlinux'
+# while getopts ":f:" opt; do
+#     case "$opt" in
+#         f) target="$OPTARG" ;;
+#         *) ;;
+#     esac
+# done
+# shift $((OPTIND-2))
+# extlinuxBuilderExtraArgs="$@"
+
+copyForced() {
+    local src="$1"
+    local dst="$2"
+    cp $src $dst.tmp
+    mv $dst.tmp $dst
+}
+
+if [ -n "$fwtarget" ]; then
+    @firmwareBuilder@ -c $default -d $fwtarget
+
+    echo "copying u-boot binary..."
+    copyForced @uboot@/u-boot.bin $fwtarget/@ubootBinName@
+fi
+
+if [ -n "$boottarget" ]; then
+    echo "generating extlinux configuration..."
+    @extlinuxConfBuilder@ -c $default -d $boottarget
+fi
+
+msg=""
+if [ -n "$fwtarget" ]; then
+    msg="uboot"
+fi
+if [ -n "$boottarget" ]; then
+    msg="$msg+extlinux"
+fi
+echo "$msg bootloader installed"