diff --git a/.gitignore b/.gitignore
index 2819057..93eee29 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,4 +12,8 @@
 # keep the pipelines but hide their results
 /bin/pipelines/*/*/*
 
+# a place to keep secrets per-env
 /env/*/.hidden
+
+# ... and a place to keep shared secrets
+/env/.hidden
diff --git a/apps/de/bspwm/config b/apps/de/bspwm/config
index 7ab65fa..9f6c4b5 100755
--- a/apps/de/bspwm/config
+++ b/apps/de/bspwm/config
@@ -2,7 +2,7 @@
 
 BORDER_WIDTH=5 # change in bspwmrc
 export WINDOW_GAP=25
-DESKTOPS=(dev web gfx env play chat misc mon out util)
+DESKTOPS=$(seq 10)
 
 BSPWM_MONITORS=$(bspc query -M | tac)
 MONITOR_COUNT=$(<<< "${BSPWM_MONITORS}" wc -w | awk '{ printf $1 }')
diff --git a/apps/de/polybar/config b/apps/de/polybar/config
index e3b039d..9091064 100644
--- a/apps/de/polybar/config
+++ b/apps/de/polybar/config
@@ -102,16 +102,16 @@ format-mounted-prefix-foreground = ${colors.icon}
 ; ########################### ;
 
 [module/bspwm]
-ws-icon-0 = dev;
-ws-icon-1 = web;
-ws-icon-2 = gfx;
-ws-icon-3 = env;
-ws-icon-4 = play;
-ws-icon-5 = chat;
-ws-icon-6 = out;
-ws-icon-7 = mon;
-ws-icon-8 = misc;
-ws-icon-9 = util;
+ws-icon-0 = 1;
+ws-icon-1 = 2;
+ws-icon-2 = 3;
+ws-icon-3 = 4;
+ws-icon-4 = 5;
+ws-icon-5 = 6;
+ws-icon-6 = 7;
+ws-icon-7 = 8;
+ws-icon-8 = 9;
+ws-icon-9 = 10;
 ws-icon-default = ♟
 
 ; misc icon: 
diff --git a/apps/de/sxhkd/rc b/apps/de/sxhkd/rc
index 7c1e1ad..1f01c0d 100755
--- a/apps/de/sxhkd/rc
+++ b/apps/de/sxhkd/rc
@@ -67,7 +67,7 @@ super + {Left,Down,Up,Right}
 
 # focus/move node to the selected desktop
 super + {_,shift + }{1-9,0}
-	bspc {desktop -f,node -d} ^{1-9,10}
+	bspc {desktop -f,node -d} {1-9,10}
 
 # # focus clicked node
 ~button1
diff --git a/apps/de/x/init b/apps/de/x/init
index ac65283..38a33d2 100644
--- a/apps/de/x/init
+++ b/apps/de/x/init
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env sh
 
 # as far as I can tell, this file is only executed when you run startx from the
 # TTY - you probably want to modify xprofile
@@ -6,13 +6,9 @@
 [ -z "$XDG_CONFIG_HOME" ] && export XDG_CONFIG_HOME="$HOME/.config"
 [ -z "$DOTFILES_PATH" ] && export DOTFILES_PATH="$XDG_CONFIG_HOME/dotfiles"
 
-echo xinit >> /tmp/xstartup
+. "$DOTFILES_PATH/bin/prelude"
 
 [ -f "$HOME/.xprofile" ] && . "$HOME/.xprofile"
-[ -f "$HOME/.xmodmap" ] && xmodmap "$HOME/.xmodmap"
-
-eval "$(/usr/bin/gnome-keyring-daemon --start --components=pkcs11,secrets,ssh)"
-export SSH_AUTH_SOCK
 
 # TODO: env? [ -f "$HOME/.env_xinitrc" ] && . "$HOME/.env_xinitrc"
 
diff --git a/apps/de/x/profile b/apps/de/x/profile
index e14a85b..ffb8b5b 100644
--- a/apps/de/x/profile
+++ b/apps/de/x/profile
@@ -1,17 +1,10 @@
-#!/bin/sh
+#!/usr/bin/env sh
 
 [ -z "$XDG_CONFIG_HOME" ] && export XDG_CONFIG_HOME="$HOME/.config"
 [ -z "$DOTFILES_PATH" ] && export DOTFILES_PATH="$XDG_CONFIG_HOME/dotfiles"
 
 . "$DOTFILES_PATH/bin/prelude"
 
-# no screen blanking
-# xset -dpms &
-# xset s noblank &
-# xset s off &
-
-# has_command xss-lock && has_command dm-tool && xss-lock -- dm-tool switch-to-greeter &
-
 [ -f "$DOTFILES_PATH/apps/de/x/loadresources" ] && "$DOTFILES_PATH/apps/de/x/loadresources"
 [ -f "$HOME/.xmodmap" ] && xmodmap "$HOME/.xmodmap"
 has_command xcape && xcape -e 'Control_L=Escape' &
@@ -20,6 +13,9 @@ has_command libinput-gestures-setup && libinput-gestures-setup start
 has_command autorandr && autorandr -c
 has_command redshift && redshift -r -l 39.1:-94.6 -t 6500K:3000K &
 
+eval "$(/usr/bin/gnome-keyring-daemon --start --components=pkcs11,secrets,ssh)"
+export SSH_AUTH_SOCK
+
 xset r rate 250 80 & # keyrepeat
 
 . maybe_source_env_file x/profile
diff --git a/apps/shell/bash/aliases b/apps/shell/bash/aliases
index 1716bd8..a3cc4ff 100644
--- a/apps/shell/bash/aliases
+++ b/apps/shell/bash/aliases
@@ -52,7 +52,7 @@ function c() {
 }
 alias cd..="cd .."
 alias cdd="cd \"\$DOTFILES_PATH\"" # go to dotfiles
-alias cde="cd \"\$ENV_DOTFILES_PATH\"" # go to env dotfiles
+alias cde="cd \"\$ENV_PATH\"" # go to current dotfiles...? env
 alias cdc="cd \"\$XDG_CONFIG_HOME\"" # go to ~/.config
 alias cdn="cd \"\$NOTES_PATH\""
 alias cdl="cd \"\$NICE_HOME/dl\""
@@ -151,4 +151,4 @@ alias mutt="neomutt"
 alias fsw-mix-test="fsw \"mix test\" ./**/*.{ex,exs,erl,hrl,xrl,yrl}"
 
 # weechat aliases
-alias chat="WEECHAT_PASSPHRASE=\"\$(pass weechat-passphrase | head -n 1)\" weechat"
+alias chat="WEECHAT_PASSPHRASE=\"\$(pass config/weechat-passphrase | head -n 1)\" weechat"
diff --git a/apps/shell/bash/rc b/apps/shell/bash/rc
index d882e30..14ba3cf 100644
--- a/apps/shell/bash/rc
+++ b/apps/shell/bash/rc
@@ -58,7 +58,9 @@ fi
 mkdir -p "${NOTES_PATH}"
 
 # open nice home instead if we're opening at home
-[ "$PWD" = "$HOME" ] && cd "$NICE_HOME" || cd || return
+if [ "$PWD" = "$HOME" ] || [ "$PWD" = "$NICE_HOME" ]; then
+	cd "$NICE_HOME" || cd || return
+fi
 
 [ -f "$HOME/.fzf.bash" ] && . "$HOME/.fzf.bash"
 
@@ -67,3 +69,5 @@ if [[ -d "$HOME/.asdf/" ]] && [[ -f "$HOME/.asdf/asdf.sh" ]]; then
 elif [[ -d /opt/asdf-vm/ ]] && [[ -f /opt/asdf-vm/asdf.sh ]]; then
 	. "/opt/asdf-vm/asdf.sh"
 fi
+
+[ -f ~/.fzf.bash ] && source ~/.fzf.bash
diff --git a/apps/shell/fish/aliases.fish b/apps/shell/fish/aliases.fish
index 6d053d3..844feae 100755
--- a/apps/shell/fish/aliases.fish
+++ b/apps/shell/fish/aliases.fish
@@ -58,7 +58,7 @@ function c
 end
 alias cd.. "cd .."
 alias cdd "cd $DOTFILES_PATH" # go to dotfiles
-alias cde "cd $ENV_DOTFILES_PATH" # go to env dotfiles
+alias cde "cd $ENV_PATH" # go to env dotfiles
 alias cdc "cd $XDG_CONFIG_HOME" # go to ~/.config
 alias cdn "cd $NOTES_PATH"
 alias cdl "cd $NICE_HOME/dl"
@@ -159,6 +159,6 @@ alias fsw-mix-test 'fsw "mix test" ./**/*.{ex,exs,erl,hrl,xrl,yrl}'
 
 # weechat aliases
 function chat
-	set -l pass (pass weechat-passphrase | head -n 1)
+	set -l pass (pass config/weechat-passphrase | head -n 1)
 	env WEECHAT_PASSPHRASE $pass weechat
 end
diff --git a/apps/shell/fish/config.fish b/apps/shell/fish/config.fish
index 67003a0..af8c693 100755
--- a/apps/shell/fish/config.fish
+++ b/apps/shell/fish/config.fish
@@ -66,7 +66,9 @@ command -v fd 2>&1 >/dev/null && set -U FZF_DEFAULT_COMMAND 'fd --type f --hidde
 # nonsense that clutters it up and that they have a preferred starting
 # directory where they keep the stuff they actually care about
 # we only do this if the user is opening a shell at $HOME
-if test $PWD = $HOME; cd $NICE_HOME || cd; end
+if test $PWD = $HOME; or test $PWD = $NICE_HOME;
+	cd $NICE_HOME || cd
+end
 
 test -f ~/.fzf/shell/key-bindings.fish && source ~/.fzf/shell/key-bindings.fish
 
diff --git a/apps/shell/fish/fish_variables b/apps/shell/fish/fish_variables
index 7fdf4c6..b26f53a 100755
--- a/apps/shell/fish/fish_variables
+++ b/apps/shell/fish/fish_variables
@@ -3,7 +3,6 @@
 SETUVAR BROWSER:firefox\x2ddeveloper\x2dedition
 SETUVAR --path DOTFILES_PATH:/home/daniel/\x2ehome/\x2econfig/dotfiles
 SETUVAR EDITOR:nvim
-SETUVAR --path ENV_DOTFILES_PATH:/home/daniel/\x2ehome/\x2econfig/dotfiles/env
 SETUVAR --path ENV_PATH:/home/daniel/\x2ehome/\x2eenv
 SETUVAR ERL_AFLAGS:\x2dkernel\x20shell_history\x20enabled\x20\x2dkernel\x20shell_history_file_bytes\x201024000
 SETUVAR FZF_DEFAULT_COMMAND:fd\x20\x2d\x2dtype\x20f\x20\x2d\x2dhidden\x20\x2d\x2dfollow\x20\x2d\x2dexclude\x20\x2egit
diff --git a/apps/shell/fish/functions/fish_user_key_bindings.fish b/apps/shell/fish/functions/fish_user_key_bindings.fish
new file mode 100644
index 0000000..350a9da
--- /dev/null
+++ b/apps/shell/fish/functions/fish_user_key_bindings.fish
@@ -0,0 +1,3 @@
+function fish_user_key_bindings
+  fzf_key_bindings
+end
diff --git a/apps/shell/fish/functions/fzf_key_bindings.fish b/apps/shell/fish/functions/fzf_key_bindings.fish
new file mode 120000
index 0000000..5ff404e
--- /dev/null
+++ b/apps/shell/fish/functions/fzf_key_bindings.fish
@@ -0,0 +1 @@
+/home/daniel/.home/.fzf/shell/key-bindings.fish
\ No newline at end of file
diff --git a/apps/shell/tmux/tmux.conf b/apps/shell/tmux/tmux.conf
index d72bd97..ecdad7f 100644
--- a/apps/shell/tmux/tmux.conf
+++ b/apps/shell/tmux/tmux.conf
@@ -11,18 +11,18 @@ bind r source-file ~/.tmux.conf
 set -as terminal-overrides ',xterm*:smxx=\E[9m'
 
 # sane defaults
-# set -g default-terminal "tmux-256color"
-set-option -g mouse on
+set -g default-terminal "tmux-256color"
+set -g mouse on
 
 # honestly not exactly sure?
 # set -sg escape-time 1
-set -sg escape-time 0
+set -g escape-time 0
 
 # show window activity
 # TODO: this needs to be properly setup
-set-window-option -g monitor-activity on
-set-window-option -g visual-bell on
-set-window-option -g bell-action other
+setw -g monitor-activity on
+setw -g visual-bell on
+setw -g bell-action other
 
 # common window sizes
 bind-key W resize-pane -x 100
@@ -38,7 +38,7 @@ bind-key h split-window
 
 # show tmux status bar by default with (C-s, H) to toggle it
 set -g status on
-set-option -g history-limit 102400000
+set -g history-limit 102400000
 bind-key H set -s status
 
 # simple session switching
@@ -52,7 +52,7 @@ bind s run-shell "tmux new-window 'sh -c ~/.config/dotfiles/bin/tmuxswitcher'"
 bind-key P attach-session -t . -c '#{pane_current_path}' \; display-message 'Reset session dir to #{pane_current_path}'
 
 # status bar and messages
-set-option -g status-position bottom
+set -g status-position bottom
 set -g status-bg colour0
 set -g status-fg colour8
 set -g message-style 'fg=colour7 bg=colour18'
@@ -73,10 +73,10 @@ set -g clock-mode-colour colour8
 
 # windows (which I don't use much...?)
 # TODO: do I have a use case for windows?
-set-window-option -g window-status-current-format ''
+setw -g window-status-current-format ''
 
 # vim copying
-set-window-option -g mode-keys vi
+setw -g mode-keys vi
 
 # 1-based indexing for key binding simplicity
 set -g base-index 1
@@ -138,17 +138,17 @@ set -g @resurrect-restore 'R'
 run '~/.tmux/plugins/tpm/tpm'
 
 # attempt at integrating nested tmux sessions nicely
-bind -T root F12 \
-	set prefix None \;\
-	set key-table off \;\
-	set status off \
-	if -F '#{pane_in_mode}' 'send-keys -X cancel' \;\
-	refresh-client -S \;\
+# bind -T root F12 \
+# 	set prefix None \;\
+# 	set key-table off \;\
+# 	set status off \
+# 	if -F '#{pane_in_mode}' 'send-keys -X cancel' \;\
+# 	refresh-client -S \;\
 
-bind -T off F12 \
-	set -u prefix \;\
-	set -u key-table \;\
-	set status on \;\
-	refresh-client -S
+# bind -T off F12 \
+# 	set -u prefix \;\
+# 	set -u key-table \;\
+# 	set status on \;\
+# 	refresh-client -S
 
 unbind-key C-p
diff --git a/setup b/setup
index 49c0d6b..98227c9 100755
--- a/setup
+++ b/setup
@@ -106,6 +106,8 @@ links=(
 
 chmod 700 -R "$HOME/.bin"
 
+# TODO: note about setting up ~/.env (link to a folder in ./env)
+
 # TODO: pass interactive?
 _dotfiles_setup_run_setup "$dfp/.agreed-to-erasing-files.lock" "${links[@]}"
 
@@ -119,5 +121,8 @@ if [[ "$INTERACTIVE" = 1 ]]; then
 	fi
 
 	echo -e "Dotfiles Installed! Running 'exec bash'...\n"
-	exec bash
+
+	# execute the user's shell
+	ush="$(getent passwd $LOGNAME | cut -d: -f7)"
+	exec "$ush"
 fi