diff --git a/.helix/languages.toml b/.helix/languages.toml
index 0b818c8..e0979b3 100644
--- a/.helix/languages.toml
+++ b/.helix/languages.toml
@@ -3,6 +3,7 @@ auto-format = true
 file-types = ["nix"]
 name = "nix"
 scope = "source.nix"
+language-servers = ["nixd", "nil"]
 
 [language.formatter]
 args = ["-"]
diff --git a/lib/colors.nix b/lib/colors.nix
index cb68567..57c7f05 100644
--- a/lib/colors.nix
+++ b/lib/colors.nix
@@ -1,101 +1,104 @@
-{lib, ...}: {
-  schemes = let
-    mkColorScheme = scheme @ {
-      scheme-name,
-      bg,
-      bg2,
-      bg3,
-      bg4,
-      bg5,
-      fg,
-      fg2,
-      fg3,
-      fgdim,
-      # pink,
-      purple,
-      red,
-      orange,
-      yellow,
-      green,
-      # teal,
-      blue,
-    }: let
-      base =
-        {
-          text = fg;
-          primary = blue;
-          urgent = red;
+{ lib, ... }:
+{
+  schemes =
+    let
+      mkColorScheme =
+        scheme@{
+          scheme-name,
+          bg,
+          bg2,
+          bg3,
+          bg4,
+          bg5,
+          fg,
+          fg2,
+          fg3,
+          fgdim,
+          # pink,
+          purple,
+          red,
+          orange,
+          yellow,
+          green,
+          # teal,
+          blue,
+        }:
+        let
+          base = {
+            text = fg;
+            primary = blue;
+            urgent = red;
 
-          # blacks
-          "0" = bg4;
-          "8" = bg5;
+            # blacks
+            "0" = bg4;
+            "8" = bg5;
 
-          "1" = red;
-          "9" = red;
-          "2" = green;
-          "10" = green;
-          "3" = orange;
-          "11" = orange;
-          "4" = blue;
-          "12" = blue;
-          "5" = purple;
-          "13" = purple;
-          "6" = yellow;
-          "14" = yellow;
+            "1" = red;
+            "9" = red;
+            "2" = green;
+            "10" = green;
+            "3" = orange;
+            "11" = orange;
+            "4" = blue;
+            "12" = blue;
+            "5" = purple;
+            "13" = purple;
+            "6" = yellow;
+            "14" = yellow;
 
-          # whites
-          "7" = fg2;
-          "15" = fg3;
-        }
-        // scheme;
+            # whites
+            "7" = fg2;
+            "15" = fg3;
+          } // scheme;
+        in
+        base
+        // {
+          withHashPrefix = lib.mapAttrs (_: value: "#${value}") base;
+        };
     in
-      base
-      // {
-        withHashPrefix = lib.mapAttrs (_: value: "#${value}") base;
+    {
+      donokai = mkColorScheme {
+        scheme-name = "donokai";
+        bg = "110f0a";
+        bg2 = "181818";
+        bg3 = "222222";
+        bg4 = "292929";
+        bg5 = "333333";
+
+        fg = "f8f8f8";
+        fg2 = "d8d8d8";
+        fg3 = "c8c8c8";
+        fgdim = "666666";
+
+        red = "f92672";
+        green = "a6e22e";
+        yellow = "f4bf75";
+        blue = "66d9ef";
+        purple = "ae81ff";
+        # teal = "a1efe4";
+        orange = "fab387";
       };
-  in {
-    donokai = mkColorScheme {
-      scheme-name = "donokai";
-      bg = "110f0a";
-      bg2 = "181818";
-      bg3 = "222222";
-      bg4 = "292929";
-      bg5 = "333333";
+      catppuccin-mocha-sapphire = mkColorScheme {
+        scheme-name = "catppuccin-mocha-sapphire";
+        bg = "1e1e2e";
+        bg2 = "181825";
+        bg3 = "313244";
+        bg4 = "45475a";
+        bg5 = "585b70";
 
-      fg = "f8f8f8";
-      fg2 = "d8d8d8";
-      fg3 = "c8c8c8";
-      fgdim = "666666";
+        fg = "cdd6f4";
+        fg2 = "bac2de";
+        fg3 = "a6adc8";
+        fgdim = "6c7086";
 
-      red = "f92672";
-      green = "a6e22e";
-      yellow = "f4bf75";
-      blue = "66d9ef";
-      purple = "ae81ff";
-      # teal = "a1efe4";
-      orange = "fab387";
+        # pink = "f5e0dc";
+        purple = "cba6f7";
+        red = "f38ba8";
+        orange = "fab387";
+        yellow = "f9e2af";
+        green = "a6e3a1";
+        # teal = "94e2d5";
+        blue = "74c7ec";
+      };
     };
-    catppuccin-mocha-sapphire = mkColorScheme {
-      scheme-name = "catppuccin-mocha-sapphire";
-      bg = "1e1e2e";
-      bg2 = "181825";
-      bg3 = "313244";
-      bg4 = "45475a";
-      bg5 = "585b70";
-
-      fg = "cdd6f4";
-      fg2 = "bac2de";
-      fg3 = "a6adc8";
-      fgdim = "6c7086";
-
-      # pink = "f5e0dc";
-      purple = "cba6f7";
-      red = "f38ba8";
-      orange = "fab387";
-      yellow = "f9e2af";
-      green = "a6e3a1";
-      # teal = "94e2d5";
-      blue = "74c7ec";
-    };
-  };
 }
diff --git a/lib/default.nix b/lib/default.nix
index 702f2d3..0b8cee5 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -1,11 +1,19 @@
-{self, ...}: let
+{ self, ... }:
+let
   forSelfOverlay =
-    if builtins.hasAttr "overlays" self && builtins.hasAttr "forSelf" self.overlays
-    then self.overlays.forSelf
-    else (_: p: p);
-in rec {
-  systems = ["aarch64-linux" "aarch64-darwin" "x86_64-darwin" "x86_64-linux"];
+    if builtins.hasAttr "overlays" self && builtins.hasAttr "forSelf" self.overlays then
+      self.overlays.forSelf
+    else
+      (_: p: p);
+in
+rec {
+  systems = [
+    "aarch64-linux"
+    "aarch64-darwin"
+    "x86_64-darwin"
+    "x86_64-linux"
+  ];
   forSystems = nixpkgs: nixpkgs.lib.genAttrs systems;
-  pkgsFor = nixpkgs: system: (import nixpkgs {inherit system;}).extend forSelfOverlay;
+  pkgsFor = nixpkgs: system: (import nixpkgs { inherit system; }).extend forSelfOverlay;
   genPkgs = nixpkgs: func: (forSystems nixpkgs (system: func (pkgsFor nixpkgs system)));
 }
diff --git a/lib/disko/default.nix b/lib/disko/default.nix
index 8ba7b20..20e2259 100644
--- a/lib/disko/default.nix
+++ b/lib/disko/default.nix
@@ -1,12 +1,14 @@
-{nixpkgs-unstable, ...}: let
+{ nixpkgs-unstable, ... }:
+let
   # TODO: This file needs some serious cleaning up.
   lib = nixpkgs-unstable.lib;
   inherit (lib.attrsets) mapAttrs' filterAttrs;
-  ESP = inputs @ {
-    size ? "4G",
-    label ? "ESP",
-    name ? "ESP",
-  }:
+  ESP =
+    inputs@{
+      size ? "4G",
+      label ? "ESP",
+      name ? "ESP",
+    }:
     {
       priority = 1;
       start = "1M";
@@ -24,68 +26,75 @@
       };
     }
     // inputs;
-in rec {
-  standardWithHibernateSwap = {
-    esp ? {
-      label = "ESP";
-      size = "4G";
-      name = "ESP";
-    },
-    rootfsName ? "/rootfs",
-    homeName ? "/home",
-    disk,
-    swapSize,
-    ...
-  }: {
-    /*
-    this is my standard partitioning scheme for my machines which probably want hibernation capabilities
-    a UEFI-compatible boot partition
-    it includes an LUKS-encrypted btrfs volume
-    a swap partition big enough to dump all the machine's RAM into
-    */
+in
+rec {
+  standardWithHibernateSwap =
+    {
+      esp ? {
+        label = "ESP";
+        size = "4G";
+        name = "ESP";
+      },
+      rootfsName ? "/rootfs",
+      homeName ? "/home",
+      disk,
+      swapSize,
+      ...
+    }:
+    {
+      /*
+        this is my standard partitioning scheme for my machines which probably want hibernation capabilities
+        a UEFI-compatible boot partition
+        it includes an LUKS-encrypted btrfs volume
+        a swap partition big enough to dump all the machine's RAM into
+      */
 
-    disko.devices = {
-      disk = {
-        primary = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "gpt";
-            partitions = {
-              ESP = ESP esp;
-              swap = {
-                size = swapSize;
-                content = {
-                  type = "swap";
-                  discardPolicy = "both";
-                  resumeDevice = true; # resume from hiberation from this device
-                };
-              };
-              luks = {
-                size = "100%";
-                content = {
-                  type = "luks";
-                  name = "crypted";
-                  # if you want to use the key for interactive login be sure there is no trailing newline
-                  # for example use `echo -n "password" > /tmp/secret.key`
-                  keyFile = "/tmp/secret.key"; # Interactive
-                  # settings.keyFile = "/tmp/password.key";
-                  # additionalKeyFiles = ["/tmp/additionalSecret.key"];
+      disko.devices = {
+        disk = {
+          primary = {
+            type = "disk";
+            device = disk;
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = ESP esp;
+                swap = {
+                  size = swapSize;
                   content = {
-                    type = "btrfs";
-                    extraArgs = ["-f"];
-                    subvolumes = {
-                      ${rootfsName} = {
-                        mountpoint = "/";
-                        mountOptions = ["compress=zstd"];
-                      };
-                      ${homeName} = {
-                        mountpoint = "/home";
-                        mountOptions = ["compress=zstd"];
-                      };
-                      "/nix" = {
-                        mountpoint = "/nix";
-                        mountOptions = ["compress=zstd" "noatime"];
+                    type = "swap";
+                    discardPolicy = "both";
+                    resumeDevice = true; # resume from hiberation from this device
+                  };
+                };
+                luks = {
+                  size = "100%";
+                  content = {
+                    type = "luks";
+                    name = "crypted";
+                    # if you want to use the key for interactive login be sure there is no trailing newline
+                    # for example use `echo -n "password" > /tmp/secret.key`
+                    keyFile = "/tmp/secret.key"; # Interactive
+                    # settings.keyFile = "/tmp/password.key";
+                    # additionalKeyFiles = ["/tmp/additionalSecret.key"];
+                    content = {
+                      type = "btrfs";
+                      extraArgs = [ "-f" ];
+                      subvolumes = {
+                        ${rootfsName} = {
+                          mountpoint = "/";
+                          mountOptions = [ "compress=zstd" ];
+                        };
+                        ${homeName} = {
+                          mountpoint = "/home";
+                          mountOptions = [ "compress=zstd" ];
+                        };
+                        "/nix" = {
+                          mountpoint = "/nix";
+                          mountOptions = [
+                            "compress=zstd"
+                            "noatime"
+                          ];
+                        };
                       };
                     };
                   };
@@ -96,7 +105,6 @@ in rec {
         };
       };
     };
-  };
 
   foxtrot = standardWithHibernateSwap {
     disk = "nvme0n1";
@@ -109,51 +117,57 @@ in rec {
     };
   };
 
-  standard = {
-    esp ? {
-      label = "ESP";
-      size = "4G";
-      name = "ESP";
-    },
-    disk,
-    ...
-  }: {
-    # this is my standard partitioning scheme for my machines: an LUKS-encrypted
-    # btrfs volume
-    disko.devices = {
-      disk = {
-        primary = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "gpt";
-            partitions = {
-              ESP = ESP esp;
-              luks = {
-                size = "100%";
-                content = {
-                  type = "luks";
-                  name = "crypted";
-                  # if you want to use the key for interactive login be sure there is no trailing newline
-                  # for example use `echo -n "password" > /tmp/secret.key`
-                  keyFile = "/tmp/secret.key"; # Interactive
-                  # settings.keyFile = "/tmp/password.key";
-                  # additionalKeyFiles = ["/tmp/additionalSecret.key"];
+  standard =
+    {
+      esp ? {
+        label = "ESP";
+        size = "4G";
+        name = "ESP";
+      },
+      disk,
+      ...
+    }:
+    {
+      # this is my standard partitioning scheme for my machines: an LUKS-encrypted
+      # btrfs volume
+      disko.devices = {
+        disk = {
+          primary = {
+            type = "disk";
+            device = disk;
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = ESP esp;
+                luks = {
+                  size = "100%";
                   content = {
-                    type = "btrfs";
-                    extraArgs = ["-f"];
-                    subvolumes = {
-                      "/root" = {
-                        mountpoint = "/";
-                        mountOptions = ["compress=zstd"];
-                      };
-                      "/home" = {
-                        mountpoint = "/home";
-                        mountOptions = ["compress=zstd"];
-                      };
-                      "/nix" = {
-                        mountpoint = "/nix";
-                        mountOptions = ["compress=zstd" "noatime"];
+                    type = "luks";
+                    name = "crypted";
+                    # if you want to use the key for interactive login be sure there is no trailing newline
+                    # for example use `echo -n "password" > /tmp/secret.key`
+                    keyFile = "/tmp/secret.key"; # Interactive
+                    # settings.keyFile = "/tmp/password.key";
+                    # additionalKeyFiles = ["/tmp/additionalSecret.key"];
+                    content = {
+                      type = "btrfs";
+                      extraArgs = [ "-f" ];
+                      subvolumes = {
+                        "/root" = {
+                          mountpoint = "/";
+                          mountOptions = [ "compress=zstd" ];
+                        };
+                        "/home" = {
+                          mountpoint = "/home";
+                          mountOptions = [ "compress=zstd" ];
+                        };
+                        "/nix" = {
+                          mountpoint = "/nix";
+                          mountOptions = [
+                            "compress=zstd"
+                            "noatime"
+                          ];
+                        };
                       };
                     };
                   };
@@ -164,7 +178,6 @@ in rec {
         };
       };
     };
-  };
 
   thablet = standard {
     disk = "nvme0n1";
@@ -175,34 +188,40 @@ in rec {
     };
   };
 
-  unencrypted = {disk, ...}: {
-    disko.devices = {
-      disk = {
-        primary = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "gpt";
-            partitions = {
-              ESP = ESP {size = "5G";};
-              root = {
-                size = "100%";
-                content = {
-                  type = "btrfs";
-                  extraArgs = ["-f"];
-                  mountpoint = "/partition-root";
-                  subvolumes = {
-                    "/rootfs" = {
-                      mountpoint = "/";
-                      mountOptions = ["compress=zstd"];
-                    };
-                    "/home" = {
-                      mountpoint = "/home";
-                      mountOptions = ["compress=zstd"];
-                    };
-                    "/nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = ["compress=zstd" "noatime"];
+  unencrypted =
+    { disk, ... }:
+    {
+      disko.devices = {
+        disk = {
+          primary = {
+            type = "disk";
+            device = disk;
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = ESP { size = "5G"; };
+                root = {
+                  size = "100%";
+                  content = {
+                    type = "btrfs";
+                    extraArgs = [ "-f" ];
+                    mountpoint = "/partition-root";
+                    subvolumes = {
+                      "/rootfs" = {
+                        mountpoint = "/";
+                        mountOptions = [ "compress=zstd" ];
+                      };
+                      "/home" = {
+                        mountpoint = "/home";
+                        mountOptions = [ "compress=zstd" ];
+                      };
+                      "/nix" = {
+                        mountpoint = "/nix";
+                        mountOptions = [
+                          "compress=zstd"
+                          "noatime"
+                        ];
+                      };
                     };
                   };
                 };
@@ -212,242 +231,253 @@ in rec {
         };
       };
     };
-  };
 
-  beefcake = let
-    zpools = {
-      zroot = {
-        /*
-        TODO: at the time of writing, disko does not support draid6
-        so I'm building/managing the array manually for the time being
-        the root pool is just a single disk right now
-        */
-        name = "zroot";
-        config = {
-          type = "zpool";
-          # mode = "draid6";
-          rootFsOptions = {
-            compression = "zstd";
-            "com.sun:auto-snapshot" = "false";
-          };
-          mountpoint = "/";
-          postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot@blank$' || zfs snapshot zroot@blank";
+  beefcake =
+    let
+      zpools = {
+        zroot = {
+          /*
+            TODO: at the time of writing, disko does not support draid6
+            so I'm building/managing the array manually for the time being
+            the root pool is just a single disk right now
+          */
+          name = "zroot";
+          config = {
+            type = "zpool";
+            # mode = "draid6";
+            rootFsOptions = {
+              compression = "zstd";
+              "com.sun:auto-snapshot" = "false";
+            };
+            mountpoint = "/";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot@blank$' || zfs snapshot zroot@blank";
 
-          datasets = {
-            zfs_fs = {
-              type = "zfs_fs";
-              mountpoint = "/zfs_fs";
-              options."com.sun:auto-snapshot" = "true";
-            };
-            zfs_unmounted_fs = {
-              type = "zfs_fs";
-              options.mountpoint = "none";
-            };
-            zfs_legacy_fs = {
-              type = "zfs_fs";
-              options.mountpoint = "legacy";
-              mountpoint = "/zfs_legacy_fs";
-            };
-            zfs_testvolume = {
-              type = "zfs_volume";
-              size = "10M";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/ext4onzfs";
+            datasets = {
+              zfs_fs = {
+                type = "zfs_fs";
+                mountpoint = "/zfs_fs";
+                options."com.sun:auto-snapshot" = "true";
               };
-            };
-            encrypted = {
-              type = "zfs_fs";
-              options = {
-                mountpoint = "none";
-                encryption = "aes-256-gcm";
-                keyformat = "passphrase";
-                keylocation = "file:///tmp/secret.key";
+              zfs_unmounted_fs = {
+                type = "zfs_fs";
+                options.mountpoint = "none";
               };
-              # use this to read the key during boot
-              /*
-              postCreateHook = ''
-                zfs set keylocation="prompt" "zroot/$name";
-              '';
-              */
-            };
-            "encrypted/test" = {
-              type = "zfs_fs";
-              mountpoint = "/zfs_crypted";
-            };
-          };
-        };
-      };
-      zstorage = {
-        /*
-        PARITY_COUNT=3 NUM_DRIVES=8 HOT_SPARES=2 sudo -E zpool create -f -O mountpoint=none -O compression=on -O xattr=sa -O acltype=posixacl -o ashift=12 -O atime=off -O recordsize=64K zstorage draid{$PARITY_COUNT}:{$NUM_DRIVES}c:{$HOT_SPARES}s /dev/disk/by-id/scsi-35000039548cb637c /dev/disk/by-id/scsi-35000039548cb7c8c /dev/disk/by-id/scsi-35000039548cb85c8 /dev/disk/by-id/scsi-35000039548d9b504 /dev/disk/by-id/scsi-35000039548da2b08 /dev/disk/by-id/scsi-35000039548dad2fc /dev/disk/by-id/scsi-350000399384be921 /dev/disk/by-id/scsi-35000039548db096c
-        sudo zfs create -o mountpoint=legacy zstorage/nix
-        sudo zfs create -o canmount=on -o mountpoint=/storage zstorage/storage
-        */
-        name = "zstorage";
-        config = {};
-      };
-    };
-    diskClass = {
-      storage = {
-        type = "zfs";
-        pool = zpools.zroot.name;
-      };
-      boot = {
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
+              zfs_legacy_fs = {
+                type = "zfs_fs";
+                options.mountpoint = "legacy";
+                mountpoint = "/zfs_legacy_fs";
               };
-            };
-            zfs = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = zpools.zroot.name;
+              zfs_testvolume = {
+                type = "zfs_volume";
+                size = "10M";
+                content = {
+                  type = "filesystem";
+                  format = "ext4";
+                  mountpoint = "/ext4onzfs";
+                };
+              };
+              encrypted = {
+                type = "zfs_fs";
+                options = {
+                  mountpoint = "none";
+                  encryption = "aes-256-gcm";
+                  keyformat = "passphrase";
+                  keylocation = "file:///tmp/secret.key";
+                };
+                # use this to read the key during boot
+                /*
+                  postCreateHook = ''
+                    zfs set keylocation="prompt" "zroot/$name";
+                  '';
+                */
+              };
+              "encrypted/test" = {
+                type = "zfs_fs";
+                mountpoint = "/zfs_crypted";
               };
             };
           };
         };
+        zstorage = {
+          /*
+            PARITY_COUNT=3 NUM_DRIVES=8 HOT_SPARES=2 sudo -E zpool create -f -O mountpoint=none -O compression=on -O xattr=sa -O acltype=posixacl -o ashift=12 -O atime=off -O recordsize=64K zstorage draid{$PARITY_COUNT}:{$NUM_DRIVES}c:{$HOT_SPARES}s /dev/disk/by-id/scsi-35000039548cb637c /dev/disk/by-id/scsi-35000039548cb7c8c /dev/disk/by-id/scsi-35000039548cb85c8 /dev/disk/by-id/scsi-35000039548d9b504 /dev/disk/by-id/scsi-35000039548da2b08 /dev/disk/by-id/scsi-35000039548dad2fc /dev/disk/by-id/scsi-350000399384be921 /dev/disk/by-id/scsi-35000039548db096c
+            sudo zfs create -o mountpoint=legacy zstorage/nix
+            sudo zfs create -o canmount=on -o mountpoint=/storage zstorage/storage
+          */
+          name = "zstorage";
+          config = { };
+        };
       };
-    };
-    bootDisks = {
-      "/dev/sdi" = {
-        name = "i";
-        enable = true;
-      };
-      "/dev/sdj" = {
-        name = "j";
-        enable = true;
-      }; # TODO: join current boot drive to new boot pool
-    };
-    storageDisks = {
-      "/dev/sda" = {
-        enable = true;
-        name = "a";
-      };
-      "/dev/sdb" = {
-        enable = true;
-        name = "b";
-      };
-      "/dev/sdc" = {
-        enable = true;
-        name = "c";
-      };
-      "/dev/sdd" = {
-        enable = true;
-        name = "d";
-      };
-
-      # TODO: start small
-      "/dev/sde" = {
-        enable = false;
-        name = "e";
-      };
-      "/dev/sdf" = {
-        enable = false;
-        name = "f";
-      };
-      "/dev/sdg" = {
-        enable = false;
-        name = "g";
-      };
-      "/dev/sdh" = {
-        enable = false;
-        name = "h";
-      };
-
-      # gap for two boot drives
-
-      "/dev/sdk" = {
-        enable = false;
-        name = "k";
-      };
-      "/dev/sdl" = {
-        enable = false;
-        name = "l";
-      };
-      "/dev/sdm" = {
-        enable = false;
-        name = "m";
-      };
-      "/dev/sdn" = {
-        # TODO: this is my holding cell for random stuff right now
-        enable = false;
-        name = "n";
-      };
-    };
-
-    diskoBoot = mapAttrs' (device: {name, ...}: {
-      name = "boot-${name}";
-      value = {
-        inherit device;
-        type = "disk";
-        content = diskClass.boot.content;
-      };
-    }) (filterAttrs (_: {enable, ...}: enable) bootDisks);
-
-    diskoStorage = mapAttrs' (device: {name, ...}: {
-      name = "storage-${name}";
-      value = {
-        inherit device;
-        type = "disk";
-        content = diskClass.storage.content;
-      };
-    }) (filterAttrs (_: {enable, ...}: enable) storageDisks);
-  in {
-    disko.devices = {
-      disk = diskoBoot // diskoStorage;
-      zpool = {
-        zroot = zpools.zroot.config;
-      };
-    };
-  };
-
-  legacy = {disks, ...}: {
-    disko.devices = {
-      disk = {
-        primary = {
-          device = builtins.elemAt disks 0;
-          type = "disk";
+      diskClass = {
+        storage = {
+          type = "zfs";
+          pool = zpools.zroot.name;
+        };
+        boot = {
           content = {
-            type = "table";
-            format = "gpt";
-            partitions = [
-              {
-                label = "EFI";
-                name = "ESP";
-                size = "512M";
-                bootable = true;
+            type = "gpt";
+            partitions = {
+              ESP = {
+                size = "1G";
+                type = "EF00";
                 content = {
                   type = "filesystem";
                   format = "vfat";
                   mountpoint = "/boot";
                 };
-              }
-              {
-                name = "root";
-                start = "500M";
-                end = "100%";
-                part-type = "primary";
-                bootable = true;
+              };
+              zfs = {
+                size = "100%";
                 content = {
-                  type = "filesystem";
-                  format = "ext4";
-                  mountpoint = "/";
+                  type = "zfs";
+                  pool = zpools.zroot.name;
                 };
-              }
-            ];
+              };
+            };
+          };
+        };
+      };
+      bootDisks = {
+        "/dev/sdi" = {
+          name = "i";
+          enable = true;
+        };
+        "/dev/sdj" = {
+          name = "j";
+          enable = true;
+        }; # TODO: join current boot drive to new boot pool
+      };
+      storageDisks = {
+        "/dev/sda" = {
+          enable = true;
+          name = "a";
+        };
+        "/dev/sdb" = {
+          enable = true;
+          name = "b";
+        };
+        "/dev/sdc" = {
+          enable = true;
+          name = "c";
+        };
+        "/dev/sdd" = {
+          enable = true;
+          name = "d";
+        };
+
+        # TODO: start small
+        "/dev/sde" = {
+          enable = false;
+          name = "e";
+        };
+        "/dev/sdf" = {
+          enable = false;
+          name = "f";
+        };
+        "/dev/sdg" = {
+          enable = false;
+          name = "g";
+        };
+        "/dev/sdh" = {
+          enable = false;
+          name = "h";
+        };
+
+        # gap for two boot drives
+
+        "/dev/sdk" = {
+          enable = false;
+          name = "k";
+        };
+        "/dev/sdl" = {
+          enable = false;
+          name = "l";
+        };
+        "/dev/sdm" = {
+          enable = false;
+          name = "m";
+        };
+        "/dev/sdn" = {
+          # TODO: this is my holding cell for random stuff right now
+          enable = false;
+          name = "n";
+        };
+      };
+
+      diskoBoot = mapAttrs' (
+        device:
+        { name, ... }:
+        {
+          name = "boot-${name}";
+          value = {
+            inherit device;
+            type = "disk";
+            content = diskClass.boot.content;
+          };
+        }
+      ) (filterAttrs (_: { enable, ... }: enable) bootDisks);
+
+      diskoStorage = mapAttrs' (
+        device:
+        { name, ... }:
+        {
+          name = "storage-${name}";
+          value = {
+            inherit device;
+            type = "disk";
+            content = diskClass.storage.content;
+          };
+        }
+      ) (filterAttrs (_: { enable, ... }: enable) storageDisks);
+    in
+    {
+      disko.devices = {
+        disk = diskoBoot // diskoStorage;
+        zpool = {
+          zroot = zpools.zroot.config;
+        };
+      };
+    };
+
+  legacy =
+    { disks, ... }:
+    {
+      disko.devices = {
+        disk = {
+          primary = {
+            device = builtins.elemAt disks 0;
+            type = "disk";
+            content = {
+              type = "table";
+              format = "gpt";
+              partitions = [
+                {
+                  label = "EFI";
+                  name = "ESP";
+                  size = "512M";
+                  bootable = true;
+                  content = {
+                    type = "filesystem";
+                    format = "vfat";
+                    mountpoint = "/boot";
+                  };
+                }
+                {
+                  name = "root";
+                  start = "500M";
+                  end = "100%";
+                  part-type = "primary";
+                  bootable = true;
+                  content = {
+                    type = "filesystem";
+                    format = "ext4";
+                    mountpoint = "/";
+                  };
+                }
+              ];
+            };
           };
         };
       };
     };
-  };
 }
diff --git a/lib/modules/home/eww/scripts/workspaces/default.nix b/lib/modules/home/eww/scripts/workspaces/default.nix
index f485d1e..d03d180 100644
--- a/lib/modules/home/eww/scripts/workspaces/default.nix
+++ b/lib/modules/home/eww/scripts/workspaces/default.nix
@@ -1,4 +1,7 @@
-{pkgs ? import <nixpkgs> {}}: let
+{
+  pkgs ? import <nixpkgs> { },
+}:
+let
   # lock = builtins.fromJSON (builtins.readFile ../../../../../flake.lock);
   # nixpkgsRev = lock.nodes.nixpkgs.locked.rev;
   # pkgs = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgsRev}.tar.gz") {};
@@ -6,15 +9,15 @@
   version = "1.0.0";
   src = ./src;
 in
-  pkgs.rustPlatform.buildRustPackage {
-    inherit pname version src;
-    cargoHash = "sha256-6Wl3cOIxlPJjzEuzNhCBZJXayL8runQfAxPruvzh2Vc=";
-    # cargoHash = pkgs.lib.fakeHash;
-    checkType = "release";
-    postBuild = ''
-      # pushd target/*/release
-      # ls -la
-      # ${pkgs.upx}/bin/upx --best --lzma hyprland-workspaces-eww
-      # popd
-    '';
-  }
+pkgs.rustPlatform.buildRustPackage {
+  inherit pname version src;
+  cargoHash = "sha256-6Wl3cOIxlPJjzEuzNhCBZJXayL8runQfAxPruvzh2Vc=";
+  # cargoHash = pkgs.lib.fakeHash;
+  checkType = "release";
+  postBuild = ''
+    # pushd target/*/release
+    # ls -la
+    # ${pkgs.upx}/bin/upx --best --lzma hyprland-workspaces-eww
+    # popd
+  '';
+}
diff --git a/lib/modules/home/hyprland.nix b/lib/modules/home/hyprland.nix
index 85fd14d..422f016 100644
--- a/lib/modules/home/hyprland.nix
+++ b/lib/modules/home/hyprland.nix
@@ -5,9 +5,11 @@
   lib,
   # font,
   ...
-}: let
+}:
+let
   inherit (style) colors;
-in {
+in
+{
   # TODO: Hyprland seems to sometimes use a ton of CPU?
 
   home.packages = with pkgs; [
@@ -64,9 +66,9 @@ in {
         kb_options = "ctrl:nocaps";
 
         /*
-        kb_variant =
-        kb_model =
-        kb_rules =
+          kb_variant =
+          kb_model =
+          kb_rules =
         */
 
         follow_mouse = 2;
@@ -114,10 +116,10 @@ in {
         rounding_power = 4.0;
 
         /*
-        blur = "no";
-        blur_size = 3
-        blur_passes = 1
-        blur_new_optimizations = on
+          blur = "no";
+          blur_size = 3
+          blur_passes = 1
+          blur_new_optimizations = on
         */
 
         shadow = {
@@ -134,8 +136,8 @@ in {
       bind = [
         # See https://wiki.hyprland.org/Configuring/Keywords/ for more
         /*
-        "$mod, return, exec, wezterm"
-        "$mod SHIFT, return, exec, wezterm"
+          "$mod, return, exec, wezterm"
+          "$mod SHIFT, return, exec, wezterm"
         */
         "$mod, return, exec, wezterm"
         "$mod SHIFT, return, exec, [float] wezterm start --always-new-process"
@@ -217,7 +219,10 @@ in {
       ];
 
       # Move/resize windows with mod + LMB/RMB and dragging
-      bindm = ["$mod, mouse:272, movewindow" "$mod, mouse:273, resizewindow"];
+      bindm = [
+        "$mod, mouse:272, movewindow"
+        "$mod, mouse:273, resizewindow"
+      ];
     };
 
     extraConfig = ''
@@ -376,55 +381,57 @@ in {
     };
   };
 
-  services.hypridle = let
-    secondsPerMinute = 60;
-    lockSeconds = 10 * secondsPerMinute;
-  in {
-    enable = true;
-    settings = {
-      general = {
-        after_sleep_cmd = "hyprctl dispatch dpms on";
-        before_sleep_cmd = "loginctl lock-session";
-        ignore_dbus_inhibit = false;
-        lock_cmd = "pidof hyprlock || hyprlock";
-      };
+  services.hypridle =
+    let
+      secondsPerMinute = 60;
+      lockSeconds = 10 * secondsPerMinute;
+    in
+    {
+      enable = true;
+      settings = {
+        general = {
+          after_sleep_cmd = "hyprctl dispatch dpms on";
+          before_sleep_cmd = "loginctl lock-session";
+          ignore_dbus_inhibit = false;
+          lock_cmd = "pidof hyprlock || hyprlock";
+        };
 
-      listener = [
-        {
-          timeout = lockSeconds - 300;
-          on-timeout = ''notify-send "Auto-locking in 5 minutes"'';
-          on-resume = ''notify-send "Auto-locking cancelled"'';
-        }
-        {
-          timeout = lockSeconds - 180;
-          on-timeout = ''notify-send "Auto-locking in 3 minutes"'';
-        }
-        {
-          timeout = lockSeconds - 120;
-          on-timeout = ''notify-send "Auto-locking in 2 minutes"'';
-        }
-        {
-          timeout = lockSeconds - 60;
-          on-timeout = ''notify-send "Auto-locking in 1 minute"'';
-        }
-        {
-          timeout = lockSeconds - 30;
-          on-timeout = ''notify-send "Auto-locking in 30 seconds"'';
-        }
-        {
-          timeout = lockSeconds - 10;
-          on-timeout = ''notify-send -u critical "Auto-locking in 10 seconds"'';
-        }
-        {
-          timeout = lockSeconds;
-          on-timeout = ''loginctl lock-session'';
-        }
-        {
-          timeout = lockSeconds + 5;
-          on-timeout = ''hyprctl dispatch dpms off'';
-          on-resume = ''hyprctl dispatch dpms on'';
-        }
-      ];
+        listener = [
+          {
+            timeout = lockSeconds - 300;
+            on-timeout = ''notify-send "Auto-locking in 5 minutes"'';
+            on-resume = ''notify-send "Auto-locking cancelled"'';
+          }
+          {
+            timeout = lockSeconds - 180;
+            on-timeout = ''notify-send "Auto-locking in 3 minutes"'';
+          }
+          {
+            timeout = lockSeconds - 120;
+            on-timeout = ''notify-send "Auto-locking in 2 minutes"'';
+          }
+          {
+            timeout = lockSeconds - 60;
+            on-timeout = ''notify-send "Auto-locking in 1 minute"'';
+          }
+          {
+            timeout = lockSeconds - 30;
+            on-timeout = ''notify-send "Auto-locking in 30 seconds"'';
+          }
+          {
+            timeout = lockSeconds - 10;
+            on-timeout = ''notify-send -u critical "Auto-locking in 10 seconds"'';
+          }
+          {
+            timeout = lockSeconds;
+            on-timeout = ''loginctl lock-session'';
+          }
+          {
+            timeout = lockSeconds + 5;
+            on-timeout = ''hyprctl dispatch dpms off'';
+            on-resume = ''hyprctl dispatch dpms on'';
+          }
+        ];
+      };
     };
-  };
 }
diff --git a/lib/modules/home/kitty.nix b/lib/modules/home/kitty.nix
index 61b62b6..57cb93a 100644
--- a/lib/modules/home/kitty.nix
+++ b/lib/modules/home/kitty.nix
@@ -2,10 +2,11 @@
   colors,
   font,
   ...
-}: {
+}:
+{
   programs.kitty = {
     enable = true;
-    darwinLaunchOptions = ["--single-instance"];
+    darwinLaunchOptions = [ "--single-instance" ];
     shellIntegration = {
       enableFishIntegration = true;
     };
diff --git a/lib/modules/home/plasma-manager.nix b/lib/modules/home/plasma-manager.nix
index 5b3f78d..d204ddc 100644
--- a/lib/modules/home/plasma-manager.nix
+++ b/lib/modules/home/plasma-manager.nix
@@ -2,7 +2,7 @@
   programs.plasma = {
     enable = true;
     shortcuts = {
-      "ActivityManager"."switch-to-activity-851c180f-d52d-4fe4-b7ed-a10e70cf4ce8" = [];
+      "ActivityManager"."switch-to-activity-851c180f-d52d-4fe4-b7ed-a10e70cf4ce8" = [ ];
       # "KDE Keyboard Layout Switcher"."Switch to Last-Used Keyboard Layout" = "Meta+Alt+L";
       # "KDE Keyboard Layout Switcher"."Switch to Next Keyboard Layout" = "Meta+Alt+K";
       # "kaccess"."Toggle Screen Reader On and Off" = "Meta+Alt+S";
@@ -15,10 +15,19 @@
       "kmix"."increase_microphone_volume" = "Microphone Volume Up";
       "kmix"."increase_volume" = "Volume Up";
       "kmix"."increase_volume_small" = "Shift+Volume Up";
-      "kmix"."mic_mute" = ["Microphone Mute" "Meta+Volume Mute,Microphone Mute" "Meta+Shift+V" "Meta+Volume Mute,Mute Microphone"];
+      "kmix"."mic_mute" = [
+        "Microphone Mute"
+        "Meta+Volume Mute,Microphone Mute"
+        "Meta+Shift+V"
+        "Meta+Volume Mute,Mute Microphone"
+      ];
       "kmix"."mute" = "Volume Mute";
       # "ksmserver"."Halt Without Confirmation" = "none,,Shut Down Without Confirmation";
-      "ksmserver"."Lock Session" = ["Meta+Ctrl+Shift+L" "Screensaver,Meta+L" "Screensaver,Lock Session"];
+      "ksmserver"."Lock Session" = [
+        "Meta+Ctrl+Shift+L"
+        "Screensaver,Meta+L"
+        "Screensaver,Lock Session"
+      ];
       # "ksmserver"."Log Out" = "Ctrl+Alt+Del";
       # "ksmserver"."Log Out Without Confirmation" = "none,,Log Out Without Confirmation";
       # "ksmserver"."LogOut" = "none,,Log Out";
@@ -31,19 +40,23 @@
       # "kwin"."Decrease Opacity" = "none,,Decrease Opacity of Active Window by 5%";
       # "kwin"."Edit Tiles" = "Meta+T";
       "kwin"."Expose" = "Ctrl+F9";
-      "kwin"."ExposeAll" = ["Ctrl+F10" "Launch (C),Ctrl+F10" "Launch (C),Toggle Present Windows (All desktops)"];
+      "kwin"."ExposeAll" = [
+        "Ctrl+F10"
+        "Launch (C),Ctrl+F10"
+        "Launch (C),Toggle Present Windows (All desktops)"
+      ];
       "kwin"."ExposeClass" = "Ctrl+F7";
-      "kwin"."ExposeClassCurrentDesktop" = [];
+      "kwin"."ExposeClassCurrentDesktop" = [ ];
       "kwin"."Grid View" = "Meta+G";
       "kwin"."Increase Opacity" = "none,,Increase Opacity of Active Window by 5%";
       "kwin"."Kill Window" = "Meta+Ctrl+Esc";
-      "kwin"."Move Tablet to Next Output" = [];
+      "kwin"."Move Tablet to Next Output" = [ ];
       "kwin"."MoveMouseToCenter" = "Meta+F6";
       "kwin"."MoveMouseToFocus" = "Meta+F5";
-      "kwin"."MoveZoomDown" = [];
-      "kwin"."MoveZoomLeft" = [];
-      "kwin"."MoveZoomRight" = [];
-      "kwin"."MoveZoomUp" = [];
+      "kwin"."MoveZoomDown" = [ ];
+      "kwin"."MoveZoomLeft" = [ ];
+      "kwin"."MoveZoomRight" = [ ];
+      "kwin"."MoveZoomUp" = [ ];
       "kwin"."Overview" = "Meta+W";
       "kwin"."Setup Window Shortcut" = "none,,Setup Window Shortcut";
       "kwin"."Show Desktop" = "Meta+D";
@@ -91,16 +104,19 @@
       "kwin"."Switch to Screen Below" = "none,,Switch to Screen Below";
       "kwin"."Switch to Screen to the Left" = "none,,Switch to Screen to the Left";
       "kwin"."Switch to Screen to the Right" = "none,,Switch to Screen to the Right";
-      "kwin"."Toggle Night Color" = [];
+      "kwin"."Toggle Night Color" = [ ];
       "kwin"."Toggle Window Raise/Lower" = "none,,Toggle Window Raise/Lower";
       "kwin"."Walk Through Windows" = "Alt+Tab";
       "kwin"."Walk Through Windows (Reverse)" = "Alt+Shift+Tab";
       "kwin"."Walk Through Windows Alternative" = "none,,Walk Through Windows Alternative";
-      "kwin"."Walk Through Windows Alternative (Reverse)" = "none,,Walk Through Windows Alternative (Reverse)";
+      "kwin"."Walk Through Windows Alternative (Reverse)" =
+        "none,,Walk Through Windows Alternative (Reverse)";
       "kwin"."Walk Through Windows of Current Application" = "Alt+`";
       "kwin"."Walk Through Windows of Current Application (Reverse)" = "Alt+~";
-      "kwin"."Walk Through Windows of Current Application Alternative" = "none,,Walk Through Windows of Current Application Alternative";
-      "kwin"."Walk Through Windows of Current Application Alternative (Reverse)" = "none,,Walk Through Windows of Current Application Alternative (Reverse)";
+      "kwin"."Walk Through Windows of Current Application Alternative" =
+        "none,,Walk Through Windows of Current Application Alternative";
+      "kwin"."Walk Through Windows of Current Application Alternative (Reverse)" =
+        "none,,Walk Through Windows of Current Application Alternative (Reverse)";
       "kwin"."Window Above Other Windows" = "none,,Keep Window Above Others";
       "kwin"."Window Below Other Windows" = "none,,Keep Window Below Others";
       "kwin"."Window Close" = "Alt+F4";
@@ -175,7 +191,11 @@
       "kwin"."Window to Screen 6" = "none,,Move Window to Screen 6";
       "kwin"."Window to Screen 7" = "none,,Move Window to Screen 7";
       "kwin"."view_actual_size" = "Meta+0";
-      "kwin"."view_zoom_in" = ["Meta++" "Meta+=,Meta++" "Meta+=,Zoom In"];
+      "kwin"."view_zoom_in" = [
+        "Meta++"
+        "Meta+=,Meta++"
+        "Meta+=,Zoom In"
+      ];
       "kwin"."view_zoom_out" = "Meta+-";
       "mediacontrol"."mediavolumedown" = "none,,Media volume down";
       "mediacontrol"."mediavolumeup" = "none,,Media volume up";
@@ -196,9 +216,17 @@
       "org_kde_powerdevil"."PowerOff" = "Power Off";
       "org_kde_powerdevil"."Sleep" = "Sleep";
       "org_kde_powerdevil"."Toggle Keyboard Backlight" = "Keyboard Light On/Off";
-      "org_kde_powerdevil"."Turn Off Screen" = [];
-      "org_kde_powerdevil"."powerProfile" = ["Battery" "Meta+B,Battery" "Meta+B,Switch Power Profile"];
-      "plasmashell"."activate application launcher" = ["Meta" "Alt+F1,Meta" "Alt+F1,Activate Application Launcher"];
+      "org_kde_powerdevil"."Turn Off Screen" = [ ];
+      "org_kde_powerdevil"."powerProfile" = [
+        "Battery"
+        "Meta+B,Battery"
+        "Meta+B,Switch Power Profile"
+      ];
+      "plasmashell"."activate application launcher" = [
+        "Meta"
+        "Alt+F1,Meta"
+        "Alt+F1,Activate Application Launcher"
+      ];
       "plasmashell"."activate task manager entry 1" = "Meta+1";
       "plasmashell"."activate task manager entry 10" = "none,Meta+0,Activate Task Manager Entry 10";
       "plasmashell"."activate task manager entry 2" = "Meta+2";
@@ -228,7 +256,8 @@
     };
     configFile = {
       "baloofilerc"."General"."dbVersion" = 2;
-      "baloofilerc"."General"."exclude filters" = "*~,*.part,*.o,*.la,*.lo,*.loT,*.moc,moc_*.cpp,qrc_*.cpp,ui_*.h,cmake_install.cmake,CMakeCache.txt,CTestTestfile.cmake,libtool,config.status,confdefs.h,autom4te,conftest,confstat,Makefile.am,*.gcode,.ninja_deps,.ninja_log,build.ninja,*.csproj,*.m4,*.rej,*.gmo,*.pc,*.omf,*.aux,*.tmp,*.po,*.vm*,*.nvram,*.rcore,*.swp,*.swap,lzo,litmain.sh,*.orig,.histfile.*,.xsession-errors*,*.map,*.so,*.a,*.db,*.qrc,*.ini,*.init,*.img,*.vdi,*.vbox*,vbox.log,*.qcow2,*.vmdk,*.vhd,*.vhdx,*.sql,*.sql.gz,*.ytdl,*.tfstate*,*.class,*.pyc,*.pyo,*.elc,*.qmlc,*.jsc,*.fastq,*.fq,*.gb,*.fasta,*.fna,*.gbff,*.faa,po,CVS,.svn,.git,_darcs,.bzr,.hg,CMakeFiles,CMakeTmp,CMakeTmpQmake,.moc,.obj,.pch,.uic,.npm,.yarn,.yarn-cache,__pycache__,node_modules,node_packages,nbproject,.terraform,.venv,venv,core-dumps,lost+found";
+      "baloofilerc"."General"."exclude filters" =
+        "*~,*.part,*.o,*.la,*.lo,*.loT,*.moc,moc_*.cpp,qrc_*.cpp,ui_*.h,cmake_install.cmake,CMakeCache.txt,CTestTestfile.cmake,libtool,config.status,confdefs.h,autom4te,conftest,confstat,Makefile.am,*.gcode,.ninja_deps,.ninja_log,build.ninja,*.csproj,*.m4,*.rej,*.gmo,*.pc,*.omf,*.aux,*.tmp,*.po,*.vm*,*.nvram,*.rcore,*.swp,*.swap,lzo,litmain.sh,*.orig,.histfile.*,.xsession-errors*,*.map,*.so,*.a,*.db,*.qrc,*.ini,*.init,*.img,*.vdi,*.vbox*,vbox.log,*.qcow2,*.vmdk,*.vhd,*.vhdx,*.sql,*.sql.gz,*.ytdl,*.tfstate*,*.class,*.pyc,*.pyo,*.elc,*.qmlc,*.jsc,*.fastq,*.fq,*.gb,*.fasta,*.fna,*.gbff,*.faa,po,CVS,.svn,.git,_darcs,.bzr,.hg,CMakeFiles,CMakeTmp,CMakeTmpQmake,.moc,.obj,.pch,.uic,.npm,.yarn,.yarn-cache,__pycache__,node_modules,node_packages,nbproject,.terraform,.venv,venv,core-dumps,lost+found";
       "baloofilerc"."General"."exclude filters version" = 9;
       "dolphinrc"."General"."ViewPropsTimestamp" = "2025,1,11,13,50,1.5779999999999998";
       "dolphinrc"."KFileDialog Settings"."Places Icons Auto-resize" = false;
@@ -247,7 +276,8 @@
       "kwinrc"."Desktops"."Number" = 1;
       "kwinrc"."Desktops"."Rows" = 1;
       "kwinrc"."Tiling"."padding" = 4;
-      "kwinrc"."Tiling/f18ce12b-2106-508f-9542-e4e6c6fbf75f"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling/f18ce12b-2106-508f-9542-e4e6c6fbf75f"."tiles" =
+        "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
       "kwinrc"."Xwayland"."Scale" = 1.75;
       "plasma-localerc"."Formats"."LANG" = "en_US.UTF-8";
     };
diff --git a/lib/modules/home/sway.nix b/lib/modules/home/sway.nix
index 1a60fe5..e49ad93 100644
--- a/lib/modules/home/sway.nix
+++ b/lib/modules/home/sway.nix
@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   programs.foot = {
     enable = true;
   };
@@ -21,21 +22,21 @@
 
   wayland.windowManager.sway = {
     /*
-    TODO:
-    + Super+r should rotate the selected group of windows.
-    + Super+Control+{1-9} should control the size of the preselect space.
-    + Super+Shift+b should balance the size of all selected nodes.
-    set $tilers "(wezterm.*|kitty.*|firefox.*|slack.*|Slack.*|thunar.*|Alacritty.*|alacritty.*|Discord.*|discord.*)"
-    for_window [title=".*"] floating enable
-    for_window [app_id=$tilers] floating disable
+      TODO:
+      + Super+r should rotate the selected group of windows.
+      + Super+Control+{1-9} should control the size of the preselect space.
+      + Super+Shift+b should balance the size of all selected nodes.
+      set $tilers "(wezterm.*|kitty.*|firefox.*|slack.*|Slack.*|thunar.*|Alacritty.*|alacritty.*|Discord.*|discord.*)"
+      for_window [title=".*"] floating enable
+      for_window [app_id=$tilers] floating disable
 
-    # for_window [title=".*"] opacity $opacity
+      # for_window [title=".*"] opacity $opacity
 
-    # TODO: I forget why I needed this - could google it I expect?
-    exec /usr/lib/polkit-kde-authentication-agent-1
+      # TODO: I forget why I needed this - could google it I expect?
+      exec /usr/lib/polkit-kde-authentication-agent-1
 
-    # prevent all windows from stealing focus
-    no_focus [class=".*"]
+      # prevent all windows from stealing focus
+      no_focus [class=".*"]
     */
 
     enable = true;
@@ -70,9 +71,9 @@
 
       workspaceOutputAssign = [
         /*
-        {
-          output = "eDP";
-          workspace = "1";
+          {
+            output = "eDP";
+            workspace = "1";
         */
       ];
 
@@ -100,8 +101,8 @@
       };
 
       startup = [
-        {command = "kdeconnect-indicator";}
-        {command = "mako";}
+        { command = "kdeconnect-indicator"; }
+        { command = "mako"; }
         {
           command = "swaybg -i $HOME/.wallpaper";
         }
@@ -175,152 +176,154 @@
           # pointer_accel
         };
       };
-      keybindings = let
-        mod = config.wayland.windowManager.sway.config.modifier;
-        menu = "tofi-run | xargs swaymsg exec --";
-      in {
-        "${mod}+control+space" = "exec makoctl dismiss";
-        "${mod}+shift+space" = "exec makoctl invoke";
-        # "${mod}+return" = "exec kitty --single-instance";
-        "${mod}+return" = "exec wezterm";
-        "${mod}+shift+return" = "exec floating-term";
-        "${mod}+shift+alt+return" = "exec kitty";
-        "${mod}+c" = "kill";
-        "${mod}+shift+c" = "kill # TODO: kill -9?";
-        "${mod}+alt+space" = "exec wofi --show drun";
-        "${mod}" = "exec ${menu}";
-        "${mod}+space" = "exec ${menu}";
-        "${mod}+shift+s" = "exec clipshot";
-        "${mod}+e" = "exec thunar";
-        "${mod}+shift+r" = "reload";
-        "${mod}+control+Escape" = "exit";
-        "${mod}+shift+e" = "exit";
-        "${mod}+shift+p" = "exec pass-chooser";
-        "${mod}+control+j" = "split v";
-        "${mod}+control+l" = "split h";
-        "${mod}+control+f" = "focus mode_toggle";
+      keybindings =
+        let
+          mod = config.wayland.windowManager.sway.config.modifier;
+          menu = "tofi-run | xargs swaymsg exec --";
+        in
+        {
+          "${mod}+control+space" = "exec makoctl dismiss";
+          "${mod}+shift+space" = "exec makoctl invoke";
+          # "${mod}+return" = "exec kitty --single-instance";
+          "${mod}+return" = "exec wezterm";
+          "${mod}+shift+return" = "exec floating-term";
+          "${mod}+shift+alt+return" = "exec kitty";
+          "${mod}+c" = "kill";
+          "${mod}+shift+c" = "kill # TODO: kill -9?";
+          "${mod}+alt+space" = "exec wofi --show drun";
+          "${mod}" = "exec ${menu}";
+          "${mod}+space" = "exec ${menu}";
+          "${mod}+shift+s" = "exec clipshot";
+          "${mod}+e" = "exec thunar";
+          "${mod}+shift+r" = "reload";
+          "${mod}+control+Escape" = "exit";
+          "${mod}+shift+e" = "exit";
+          "${mod}+shift+p" = "exec pass-chooser";
+          "${mod}+control+j" = "split v";
+          "${mod}+control+l" = "split h";
+          "${mod}+control+f" = "focus mode_toggle";
 
-        "${mod}+h" = "focus left";
-        "${mod}+j" = "focus down";
-        "${mod}+k" = "focus up";
-        "${mod}+l" = "focus right";
+          "${mod}+h" = "focus left";
+          "${mod}+j" = "focus down";
+          "${mod}+k" = "focus up";
+          "${mod}+l" = "focus right";
 
-        "${mod}+left" = "focus left";
-        "${mod}+down" = "focus down";
-        "${mod}+up" = "focus up";
-        "${mod}+right" = "focus right";
+          "${mod}+left" = "focus left";
+          "${mod}+down" = "focus down";
+          "${mod}+up" = "focus up";
+          "${mod}+right" = "focus right";
 
-        "${mod}+shift+h" = "move left";
-        "${mod}+shift+j" = "move down";
-        "${mod}+shift+k" = "move up";
-        "${mod}+shift+l" = "move right";
+          "${mod}+shift+h" = "move left";
+          "${mod}+shift+j" = "move down";
+          "${mod}+shift+k" = "move up";
+          "${mod}+shift+l" = "move right";
 
-        "${mod}+shift+left" = "move left";
-        "${mod}+shift+down" = "move down";
-        "${mod}+shift+up" = "move up";
-        "${mod}+shift+right" = "move right";
+          "${mod}+shift+left" = "move left";
+          "${mod}+shift+down" = "move down";
+          "${mod}+shift+up" = "move up";
+          "${mod}+shift+right" = "move right";
 
-        "${mod}+1" = "workspace 1";
-        "${mod}+2" = "workspace 2";
-        "${mod}+3" = "workspace 3";
-        "${mod}+4" = "workspace 4";
-        "${mod}+5" = "workspace 5";
-        "${mod}+6" = "workspace 6";
-        "${mod}+7" = "workspace 7";
-        "${mod}+8" = "workspace 8";
-        "${mod}+9" = "workspace 9";
-        "${mod}+0" = "workspace 10";
+          "${mod}+1" = "workspace 1";
+          "${mod}+2" = "workspace 2";
+          "${mod}+3" = "workspace 3";
+          "${mod}+4" = "workspace 4";
+          "${mod}+5" = "workspace 5";
+          "${mod}+6" = "workspace 6";
+          "${mod}+7" = "workspace 7";
+          "${mod}+8" = "workspace 8";
+          "${mod}+9" = "workspace 9";
+          "${mod}+0" = "workspace 10";
 
-        "${mod}+shift+1" = "move container to workspace 1";
-        "${mod}+shift+2" = "move container to workspace 2";
-        "${mod}+shift+3" = "move container to workspace 3";
-        "${mod}+shift+4" = "move container to workspace 4";
-        "${mod}+shift+5" = "move container to workspace 5";
-        "${mod}+shift+6" = "move container to workspace 6";
-        "${mod}+shift+7" = "move container to workspace 7";
-        "${mod}+shift+8" = "move container to workspace 8";
-        "${mod}+shift+9" = "move container to workspace 9";
-        "${mod}+shift+0" = "move container to workspace 10";
+          "${mod}+shift+1" = "move container to workspace 1";
+          "${mod}+shift+2" = "move container to workspace 2";
+          "${mod}+shift+3" = "move container to workspace 3";
+          "${mod}+shift+4" = "move container to workspace 4";
+          "${mod}+shift+5" = "move container to workspace 5";
+          "${mod}+shift+6" = "move container to workspace 6";
+          "${mod}+shift+7" = "move container to workspace 7";
+          "${mod}+shift+8" = "move container to workspace 8";
+          "${mod}+shift+9" = "move container to workspace 9";
+          "${mod}+shift+0" = "move container to workspace 10";
 
-        "${mod}+b" = "splith";
-        "${mod}+v" = "splitv";
+          "${mod}+b" = "splith";
+          "${mod}+v" = "splitv";
 
-        "${mod}+shift+f" = "fullscreen toggle";
-        "${mod}+f" = "floating toggle";
-        "${mod}+s" = "floating disable";
-        "${mod}+alt+f" = "focus mode_toggle";
-        "${mod}+p" = "focus parent";
-        "${mod}+period" = "focus child";
-        "${mod}+comma" = "focus child";
+          "${mod}+shift+f" = "fullscreen toggle";
+          "${mod}+f" = "floating toggle";
+          "${mod}+s" = "floating disable";
+          "${mod}+alt+f" = "focus mode_toggle";
+          "${mod}+p" = "focus parent";
+          "${mod}+period" = "focus child";
+          "${mod}+comma" = "focus child";
 
-        "${mod}+tab" = "workspace back_and_forth";
-        "alt+tab" = "workspace back_and_forth";
+          "${mod}+tab" = "workspace back_and_forth";
+          "alt+tab" = "workspace back_and_forth";
 
-        "${mod}+minus" = "gaps inner current minus 5";
-        "${mod}+plus" = "gaps inner current plus 5";
-        "${mod}+control+alt+h" = "gaps horizontal current minus 5";
-        "${mod}+control+alt+l" = "gaps horizontal current plus 5";
-        "${mod}+control+alt+j" = "gaps vertical current minus 5";
-        "${mod}+control+alt+k" = "gaps vertical current plus 5";
+          "${mod}+minus" = "gaps inner current minus 5";
+          "${mod}+plus" = "gaps inner current plus 5";
+          "${mod}+control+alt+h" = "gaps horizontal current minus 5";
+          "${mod}+control+alt+l" = "gaps horizontal current plus 5";
+          "${mod}+control+alt+j" = "gaps vertical current minus 5";
+          "${mod}+control+alt+k" = "gaps vertical current plus 5";
 
-        # TODO: this should also reset the horizontal and vertical gaps?
-        "${mod}+control+equal" = "gaps inner current set 0";
+          # TODO: this should also reset the horizontal and vertical gaps?
+          "${mod}+control+equal" = "gaps inner current set 0";
 
-        "${mod}+shift+v" = "exec swayosd-client --input-volume mute-toggle";
-        "${mod}+F1" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
-        "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise";
-        "XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower";
-        "XF86AudioMute" = "exec swayosd-client --output-volume mute-toggle";
-        "XF86AudioMicMute" = "exec swayosd-client --input-volume mute-toggle";
-        "XF86MonBrightnessUp" = "exec swayosd-client --brightness raise";
-        "XF86MonBrightnessDown" = "exec swayosd-client --brightness lower";
-        "control+XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +1%";
-        "control+XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -1%";
-        "XF86AudioPlay" = "exec playerctl play-pause";
-        "XF86AudioNext" = "exec playerctl next";
-        "XF86AudioPrev" = "exec playerctl previous";
-        "--locked ${mod}+shift+v" = "exec swayosd-client --input-volume mute-toggle";
-        "--locked ${mod}+F1" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
-        "--locked XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise";
-        "--locked XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower";
-        "--locked XF86AudioMute" = "exec swayosd-client --output-volume mute-toggle";
-        "--locked XF86AudioMicMute" = "exec swayosd-client --input-volume mute-toggle";
-        "--locked XF86MonBrightnessUp" = "exec swayosd-client --brightness raise";
-        "--locked XF86MonBrightnessDown" = "exec swayosd-client --brightness lower";
-        "--locked control+XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +1%";
-        "--locked control+XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -1%";
-        "--locked XF86AudioPlay" = "exec playerctl play-pause";
-        "--locked XF86AudioNext" = "exec playerctl next";
-        "--locked XF86AudioPrev" = "exec playerctl previous";
+          "${mod}+shift+v" = "exec swayosd-client --input-volume mute-toggle";
+          "${mod}+F1" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
+          "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise";
+          "XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower";
+          "XF86AudioMute" = "exec swayosd-client --output-volume mute-toggle";
+          "XF86AudioMicMute" = "exec swayosd-client --input-volume mute-toggle";
+          "XF86MonBrightnessUp" = "exec swayosd-client --brightness raise";
+          "XF86MonBrightnessDown" = "exec swayosd-client --brightness lower";
+          "control+XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +1%";
+          "control+XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -1%";
+          "XF86AudioPlay" = "exec playerctl play-pause";
+          "XF86AudioNext" = "exec playerctl next";
+          "XF86AudioPrev" = "exec playerctl previous";
+          "--locked ${mod}+shift+v" = "exec swayosd-client --input-volume mute-toggle";
+          "--locked ${mod}+F1" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
+          "--locked XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise";
+          "--locked XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower";
+          "--locked XF86AudioMute" = "exec swayosd-client --output-volume mute-toggle";
+          "--locked XF86AudioMicMute" = "exec swayosd-client --input-volume mute-toggle";
+          "--locked XF86MonBrightnessUp" = "exec swayosd-client --brightness raise";
+          "--locked XF86MonBrightnessDown" = "exec swayosd-client --brightness lower";
+          "--locked control+XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +1%";
+          "--locked control+XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -1%";
+          "--locked XF86AudioPlay" = "exec playerctl play-pause";
+          "--locked XF86AudioNext" = "exec playerctl next";
+          "--locked XF86AudioPrev" = "exec playerctl previous";
 
-        /*
-        "XF86MonBrightnessUp" = " exec swayosd-client --brightness 10";
-        "XF86MonBrightnessDown" = "exec swayosd-client --brightness -10";
-        "XF86AudioMute" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
-        "XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +5%";
-        "XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -5%";
-        "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume 15";
-        "XF86AudioLowerVolume" = "exec swayosd-client --output-volume -15";
-        "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise --max-volume 120";
-        "XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower --max-volume 120";
-        "XF86AudioRaiseVolume" = "exec  swayosd-client --output-volume +10 --device alsa_output.pci-0000_11_00.4.analog-stereo.monitor";
-        "XF86AudioLowerVolume" = "exec  swayosd-client --output-volume -10 --device alsa_output.pci-0000_11_00.4.analog-stereo.monitor";
-        "XF86AudioMicMute" = "exec pactl set-source-mute @DEFAULT_SOURCE@ toggle";
-        "XF86MonBrightnessDown" = "exec brightnessctl set 10%-";
-        "XF86MonBrightnessUp" = "exec brightnessctl set +10%";
-        "shift+XF86MonBrightnessDown" = "exec brightnessctl set 1%";
-        "shift+XF86MonBrightnessUp" = "exec brightnessctl set 100%";
-        "control+XF86MonBrightnessDown" = "exec brightnessctl set 1%-";
-        "control+XF86MonBrightnessUp" = "exec brightnessctl set +1%";
-        "${mod}+shift+v" = "exec pactl set-source-mute @DEFAULT_SOURCE@ toggle";
-        */
+          /*
+            "XF86MonBrightnessUp" = " exec swayosd-client --brightness 10";
+            "XF86MonBrightnessDown" = "exec swayosd-client --brightness -10";
+            "XF86AudioMute" = "exec pactl set-sink-mute @DEFAULT_SINK@ toggle";
+            "XF86AudioRaiseVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ +5%";
+            "XF86AudioLowerVolume" = "exec pactl set-sink-volume @DEFAULT_SINK@ -5%";
+            "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume 15";
+            "XF86AudioLowerVolume" = "exec swayosd-client --output-volume -15";
+            "XF86AudioRaiseVolume" = "exec swayosd-client --output-volume raise --max-volume 120";
+            "XF86AudioLowerVolume" = "exec swayosd-client --output-volume lower --max-volume 120";
+            "XF86AudioRaiseVolume" = "exec  swayosd-client --output-volume +10 --device alsa_output.pci-0000_11_00.4.analog-stereo.monitor";
+            "XF86AudioLowerVolume" = "exec  swayosd-client --output-volume -10 --device alsa_output.pci-0000_11_00.4.analog-stereo.monitor";
+            "XF86AudioMicMute" = "exec pactl set-source-mute @DEFAULT_SOURCE@ toggle";
+            "XF86MonBrightnessDown" = "exec brightnessctl set 10%-";
+            "XF86MonBrightnessUp" = "exec brightnessctl set +10%";
+            "shift+XF86MonBrightnessDown" = "exec brightnessctl set 1%";
+            "shift+XF86MonBrightnessUp" = "exec brightnessctl set 100%";
+            "control+XF86MonBrightnessDown" = "exec brightnessctl set 1%-";
+            "control+XF86MonBrightnessUp" = "exec brightnessctl set +1%";
+            "${mod}+shift+v" = "exec pactl set-source-mute @DEFAULT_SOURCE@ toggle";
+          */
 
-        "${mod}+control+shift+l" = "exec swaylock";
+          "${mod}+control+shift+l" = "exec swaylock";
 
-        "${mod}+shift+alt+f" = "for_window [class=$tilers] floating toggle";
-      };
-      assigns = {};
-      bars = [];
+          "${mod}+shift+alt+f" = "for_window [class=$tilers] floating toggle";
+        };
+      assigns = { };
+      bars = [ ];
       colors = with style.colors; {
         background = bg;
         focused = {
@@ -364,55 +367,55 @@
 
   # this doesn't work due to weird quoting bugs AFAICT
   /*
-  services.swayidle = let
-    bins = rec {
-      swaylock = builtins.trace "${pkgs.swaylock}/bin/swaylock" "${pkgs.swaylock}/bin/swaylock";
-      swaymsg = "${pkgs.sway}/bin/swaymsg";
-      notify-send = "${swaymsg} exec -- ${pkgs.libnotify}/bin/notify-send";
-    };
-  in (with bins; {
-    enable = true;
+    services.swayidle = let
+      bins = rec {
+        swaylock = builtins.trace "${pkgs.swaylock}/bin/swaylock" "${pkgs.swaylock}/bin/swaylock";
+        swaymsg = "${pkgs.sway}/bin/swaymsg";
+        notify-send = "${swaymsg} exec -- ${pkgs.libnotify}/bin/notify-send";
+      };
+    in (with bins; {
+      enable = true;
 
-    events = [
-      {
-        event = "before-sleep";
-        command = swaylock;
-      }
-    ];
+      events = [
+        {
+          event = "before-sleep";
+          command = swaylock;
+        }
+      ];
 
-    timeouts = [
-      {
-        timeout = 5;
-        command = "${notify-send} \\\"Idling in 300 seconds\\\"";
-        resumeCommand = "${notify-send} \\\"Idling cancelled.\\\"";
-      }
-      {
-        # timeout = 540;
-        timeout = 6;
-        command = "${notify-send} 'Idling in 90 seconds'";
-      }
-      {
-        # timeout = 570;
-        timeout = 7;
-        command = "${notify-send} 'Idling in 60 seconds'";
-      }
-      {
-        # timeout = 600;
-        timeout = 8;
-        command = "${notify-send} 'Idling in 30 seconds...'";
-      }
-      {
-        # timeout = 630;
-        timeout = 9;
-        command = "${swaylock} -f";
-      }
-      {
-        # timeout = 660;
-        timeout = 10;
-        command = "${swaymsg} 'output * dpms off'";
-        resumeCommand = "${swaymsg} 'output * dpms on' & ${swaymsg} exec -- maybe-good-morning &";
-      }
-    ];
-  });
+      timeouts = [
+        {
+          timeout = 5;
+          command = "${notify-send} \\\"Idling in 300 seconds\\\"";
+          resumeCommand = "${notify-send} \\\"Idling cancelled.\\\"";
+        }
+        {
+          # timeout = 540;
+          timeout = 6;
+          command = "${notify-send} 'Idling in 90 seconds'";
+        }
+        {
+          # timeout = 570;
+          timeout = 7;
+          command = "${notify-send} 'Idling in 60 seconds'";
+        }
+        {
+          # timeout = 600;
+          timeout = 8;
+          command = "${notify-send} 'Idling in 30 seconds...'";
+        }
+        {
+          # timeout = 630;
+          timeout = 9;
+          command = "${swaylock} -f";
+        }
+        {
+          # timeout = 660;
+          timeout = 10;
+          command = "${swaymsg} 'output * dpms off'";
+          resumeCommand = "${swaymsg} 'output * dpms on' & ${swaymsg} exec -- maybe-good-morning &";
+        }
+      ];
+    });
   */
 }
diff --git a/lib/modules/home/swaylock.nix b/lib/modules/home/swaylock.nix
index 8e62d33..0e878aa 100644
--- a/lib/modules/home/swaylock.nix
+++ b/lib/modules/home/swaylock.nix
@@ -1,4 +1,5 @@
-{style, ...}: {
+{ style, ... }:
+{
   programs.swaylock = {
     enable = true;
     settings = {
diff --git a/lib/modules/home/waybar.nix b/lib/modules/home/waybar.nix
index 55bbd3e..ee4f9e1 100644
--- a/lib/modules/home/waybar.nix
+++ b/lib/modules/home/waybar.nix
@@ -2,21 +2,25 @@
   pkgs,
   style,
   ...
-}: {
+}:
+{
   programs.waybar = {
     enable = true;
     settings = {
       mainBar = {
         "layer" = "top";
         "position" = "bottom";
-        "output" = ["eDP-1" "DP-3"];
+        "output" = [
+          "eDP-1"
+          "DP-3"
+        ];
         "height" = 50;
         "modules-left" = [
           "idle_inhibitor"
           "sway/workspaces"
           "sway/window"
         ];
-        "modules-center" = [];
+        "modules-center" = [ ];
         "modules-right" = [
           "privacy"
           "power-profiles-daemon"
@@ -83,9 +87,9 @@
         };
         "temperature" = {
           /*
-          "thermal-zone" = 2;
-          "hwmon-path" = "/sys/class/hwmon/hwmon2/temp1_input";
-          "format-critical" = "{temperatureC}°C {icon}";
+            "thermal-zone" = 2;
+            "hwmon-path" = "/sys/class/hwmon/hwmon2/temp1_input";
+            "format-critical" = "{temperatureC}°C {icon}";
           */
           "critical-threshold" = 80;
           "format" = "{temperatureC}\n°C";
@@ -94,7 +98,10 @@
         "backlight" = {
           # "device" = "acpi_video1";
           "format" = "{percent}%\n{icon}";
-          "format-icons" = ["" ""];
+          "format-icons" = [
+            ""
+            ""
+          ];
           "justify" = "center";
         };
         "battery" = {
@@ -129,9 +136,9 @@
         };
         "pulseaudio" = {
           /*
-          "scroll-step" = 1, # %, can be a floa;
-          "format" = "{volume}% {icon} {format_source}";
-          "format-muted" = " {format_source}";
+            "scroll-step" = 1, # %, can be a floa;
+            "format" = "{volume}% {icon} {format_source}";
+            "format-muted" = " {format_source}";
           */
           "format" = "{volume}%\n{format_source}";
           "format-muted" = "MUTE\n{format_source}";
@@ -145,10 +152,12 @@
         };
       };
     };
-    style = let
-      border-width = "0px";
-    in
-      with style.colors.withHashPrefix; ''
+    style =
+      let
+        border-width = "0px";
+      in
+      with style.colors.withHashPrefix;
+      ''
         * {
         	border-radius: 0;
         	font-family: "${style.font.name}", "Symbols Nerd Font Mono", sans-serif;
diff --git a/lib/modules/nixos/conduwuit.nix b/lib/modules/nixos/conduwuit.nix
index dbebd47..f82b147 100644
--- a/lib/modules/nixos/conduwuit.nix
+++ b/lib/modules/nixos/conduwuit.nix
@@ -4,14 +4,16 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.services.conduwuit;
   defaultUser = "conduwuit";
   defaultGroup = "conduwuit";
-  format = pkgs.formats.toml {};
+  format = pkgs.formats.toml { };
   configFile = format.generate "conduwuit.toml" cfg.settings;
-in {
-  meta.maintainers = with lib.maintainers; [niklaskorz];
+in
+{
+  meta.maintainers = with lib.maintainers; [ niklaskorz ];
   options.services.conduwuit = {
     enable = lib.mkEnableOption "conduwuit";
 
@@ -34,13 +36,13 @@ in {
     extraEnvironment = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
       description = "Extra Environment variables to pass to the conduwuit server.";
-      default = {};
+      default = { };
       example = {
         RUST_BACKTRACE = "yes";
       };
     };
 
-    package = lib.mkPackageOption pkgs.unstable-packages "conduwuit" {};
+    package = lib.mkPackageOption pkgs.unstable-packages "conduwuit" { };
 
     settings = lib.mkOption {
       type = lib.types.submodule {
@@ -66,7 +68,7 @@ in {
           };
           global.port = lib.mkOption {
             type = lib.types.listOf lib.types.port;
-            default = [6167];
+            default = [ 6167 ];
             description = ''
               The port(s) conduwuit will be running on.
               You need to set up a reverse proxy in your web server (e.g. apache or nginx),
@@ -125,7 +127,7 @@ in {
           };
           global.trusted_servers = lib.mkOption {
             type = lib.types.listOf lib.types.nonEmptyStr;
-            default = ["matrix.org"];
+            default = [ "matrix.org" ];
             description = ''
               Servers listed here will be used to gather public keys of other servers
               (notary trusted key servers).
@@ -158,7 +160,7 @@ in {
           };
         };
       };
-      default = {};
+      default = { };
       # TOML does not allow null values, so we use null to omit those fields
       apply = lib.filterAttrsRecursive (_: v: v != null);
       description = ''
@@ -198,17 +200,17 @@ in {
     };
 
     users.groups = lib.mkIf (cfg.group == defaultGroup) {
-      ${defaultGroup} = {};
+      ${defaultGroup} = { };
     };
 
     systemd.services.conduwuit = {
       description = "Conduwuit Matrix Server";
-      documentation = ["https://conduwuit.puppyirl.gay/"];
-      wantedBy = ["multi-user.target"];
-      wants = ["network-online.target"];
-      after = ["network-online.target"];
+      documentation = [ "https://conduwuit.puppyirl.gay/" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
       environment = lib.mkMerge [
-        {CONDUWUIT_CONFIG = configFile;}
+        { CONDUWUIT_CONFIG = configFile; }
         cfg.extraEnvironment
       ];
       startLimitBurst = 5;
diff --git a/lib/modules/nixos/default.nix b/lib/modules/nixos/default.nix
index aa0f7a4..9cc13c5 100644
--- a/lib/modules/nixos/default.nix
+++ b/lib/modules/nixos/default.nix
@@ -1,8 +1,15 @@
-{self, ...}: let
+{ self, ... }:
+let
   inherit (self) outputs;
-  inherit (outputs) nixosModules homeManagerModules overlays constants;
+  inherit (outputs)
+    nixosModules
+    homeManagerModules
+    overlays
+    constants
+    ;
   inherit (constants) pubkey;
-in {
+in
+{
   shell-defaults-and-applications = import ./shell-config.nix;
   deno-netlify-ddns-client = import ./deno-netlify-ddns-client.nix;
 
@@ -29,12 +36,12 @@ in {
   # module has the incorrect file permissions out of the box
   # environment.etc = {
   /*
-  "kanidm" = {
-  enable = true;
-    user = "nobody";
-    group = "users";
-    mode = "0755";
-  };
+    "kanidm" = {
+    enable = true;
+      user = "nobody";
+      group = "users";
+      mode = "0755";
+    };
   */
   #   "kanidm/unixd" = {
   #     user = "kanidm-unixd";
@@ -48,378 +55,417 @@ in {
   #   };
   # };
 
-  ewwbar = {pkgs, ...}: {
-    # imports = with nixosModules;  [];
-    environment.systemPackages = with pkgs; [eww upower jq];
-
-    # TODO: include the home-manager modules for daniel?
-  };
-
-  niri = {pkgs, ...}: {
-    environment.systemPackages = with pkgs; [niri];
-
-    systemd.user.services.polkit = {
-      description = "PolicyKit Authentication Agent";
-      wantedBy = ["niri.service"];
-      after = ["graphical-session.target"];
-      partOf = ["graphical-session.target"];
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${pkgs.libsForQt5.polkit-kde-agent}/libexec/polkit-kde-authentication-agent-1";
-        Restart = "on-failure";
-        RestartSec = 1;
-        TimeoutStopSec = 10;
-      };
-    };
-
-    # security.pam.services.swaylock = {};
-    programs.dconf.enable = pkgs.lib.mkDefault true;
-    fonts.enableDefaultPackages = pkgs.lib.mkDefault true;
-    security.polkit.enable = true;
-    services.gnome.gnome-keyring.enable = true;
-  };
-
-  hyprland = {pkgs, ...}: {
-    imports = with nixosModules; [
-      ewwbar
-      pipewire
-    ];
-
-    programs.hyprland = {
-      enable = true;
-    };
-    environment.systemPackages = with pkgs; [hyprpaper xwaylandvideobridge netcat-openbsd];
-
-    home-manager.users.daniel = {
-      imports = with homeManagerModules; [
-        hyprland
+  ewwbar =
+    { pkgs, ... }:
+    {
+      # imports = with nixosModules;  [];
+      environment.systemPackages = with pkgs; [
+        eww
+        upower
+        jq
       ];
+
+      # TODO: include the home-manager modules for daniel?
     };
 
-    # TODO: include the home-manager modules for daniel?
-  };
+  niri =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [ niri ];
 
-  sway = {pkgs, ...}: {
-    imports = with nixosModules; [
-      pipewire
-    ];
-
-    systemd.user.services."wait-for-full-path" = {
-      description = "wait for systemd units to have full PATH";
-      wantedBy = ["xdg-desktop-portal.service"];
-      before = ["xdg-desktop-portal.service"];
-      path = with pkgs; [systemd coreutils gnugrep];
-      script = ''
-        ispresent () {
-          systemctl --user show-environment | grep -E '^PATH=.*/.nix-profile/bin'
-        }
-        while ! ispresent; do
-          sleep 0.1;
-        done
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        TimeoutStartSec = "60";
-      };
-    };
-
-    home-manager.users.daniel = {
-      imports = with homeManagerModules; [
-        sway
-      ];
-    };
-
-    programs.sway = {
-      enable = true;
-      wrapperFeatures.gtk = true;
-    };
-
-    # services.xserver.libinput.enable = true;
-
-    # TODO: a lot of this probably needs de-duping with hyprland?
-
-    services.gnome.gnome-keyring.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      wlr.enable = true;
-      # gtk.enable = true;
-
-      extraPortals = with pkgs; [
-        xdg-desktop-portal-wlr
-        xdg-desktop-portal-gtk
-      ];
-    };
-
-    services.dbus.enable = true;
-    security.polkit.enable = true; # needed for home-manager integration
-
-    programs.thunar = {
-      enable = true;
-      plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
-    };
-
-    services.gvfs = {
-      enable = true;
-    };
-
-    environment = {
-      variables = {
-        VISUAL = "hx";
-      };
-
-      systemPackages = with pkgs; [
-        brightnessctl
-        feh
-        grim
-        libinput
-        libinput-gestures
-        libnotify
-        mako
-        noto-fonts
-        pamixer
-        playerctl
-        pulseaudio
-        pulsemixer
-        slurp
-        swaybg
-        swayidle
-        swaylock
-        swayosd
-        tofi
-        waybar
-        wl-clipboard
-        zathura
-
-        /*
-        gimp
-        inkscape
-        krita
-        lutris
-        nil
-        nixpkgs-fmt
-        pavucontrol
-        rclone
-        restic
-        steam
-        vlc
-        vulkan-tools
-        weechat
-        wine
-        */
-      ];
-    };
-  };
-
-  remote-disk-key-entry-on-boot = {
-    lib,
-    pkgs,
-    ...
-  }: {
-    /*
-    https://nixos.wiki/wiki/Remote_disk_unlocking
-    "When using DHCP, make sure your computer is always attached to the network and is able to get an IP adress, or the boot process will hang."
-    ^ seems less than ideal
-    */
-    boot.kernelParams = ["ip=dhcp"];
-    boot.initrd = {
-      # availableKernelModules = ["r8169"]; # ethernet drivers
-      systemd.users.root.shell = "/bin/cryptsetup-askpass";
-      network = {
-        enable = true;
-        ssh = {
-          enable = true;
-          port = 22;
-          authorizedKeys = [pubkey];
-          hostKeys = ["/etc/secrets/initrd/ssh_host_rsa_key"];
+      systemd.user.services.polkit = {
+        description = "PolicyKit Authentication Agent";
+        wantedBy = [ "niri.service" ];
+        after = [ "graphical-session.target" ];
+        partOf = [ "graphical-session.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.libsForQt5.polkit-kde-agent}/libexec/polkit-kde-authentication-agent-1";
+          Restart = "on-failure";
+          RestartSec = 1;
+          TimeoutStopSec = 10;
         };
       };
+
+      # security.pam.services.swaylock = {};
+      programs.dconf.enable = pkgs.lib.mkDefault true;
+      fonts.enableDefaultPackages = pkgs.lib.mkDefault true;
+      security.polkit.enable = true;
+      services.gnome.gnome-keyring.enable = true;
     };
-  };
 
-  laptop = {pkgs, ...}: {
-    imports = with nixosModules; [
-      family-users
-      wifi
-    ];
-
-    environment.systemPackages = with pkgs; [
-      acpi
-    ];
-
-    services.udev.extraRules = ''
-      ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness"
-      ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chmod g+w /sys/class/backlight/%k/brightness"
-    '';
-
-    services.upower.enable = true;
-
-    # NOTE: I previously let plasma settings handle this
-    services.logind = {
-      lidSwitch = "suspend-then-hibernate";
-      extraConfig = ''
-        KillUserProcesses=no
-        HandlePowerKey=suspend
-        HandlePowerKeyLongPress=poweroff
-        HandleRebootKey=reboot
-        HandleRebootKeyLongPress=poweroff
-        HandleSuspendKey=suspend
-        HandleSuspendKeyLongPress=hibernate
-        HandleHibernateKey=hibernate
-        HandleHibernateKeyLongPress=ignore
-        HandleLidSwitch=suspend
-        HandleLidSwitchExternalPower=suspend
-        HandleLidSwitchDocked=suspend
-        HandleLidSwitchDocked=suspend
-        IdleActionSec=11m
-        IdleAction=ignore
-      '';
-    };
-  };
-
-  touchscreen = {pkgs, ...}: {
-    environment.systemPackages = with pkgs; [
-      wvkbd # on-screen keyboard
-      flakeInputs.iio-hyprland.outputs.packages.${system}.default # auto-rotate hyprland displays
-      flakeInputs.hyprgrass.outputs.packages.${system}.hyprgrass # hyprland touch gestures
-    ];
-  };
-
-  emacs = {pkgs, ...}: {
-    environment.systemPackages = with pkgs; [
-      emacs
-    ];
-
-    home-manager.users.daniel = {
-      imports = with homeManagerModules; [
-        emacs
+  hyprland =
+    { pkgs, ... }:
+    {
+      imports = with nixosModules; [
+        ewwbar
+        pipewire
       ];
+
+      programs.hyprland = {
+        enable = true;
+      };
+      environment.systemPackages = with pkgs; [
+        hyprpaper
+        xwaylandvideobridge
+        netcat-openbsd
+      ];
+
+      home-manager.users.daniel = {
+        imports = with homeManagerModules; [
+          hyprland
+        ];
+      };
+
+      # TODO: include the home-manager modules for daniel?
     };
-  };
 
-  development-tools = {
-    pkgs,
-    lib,
-    ...
-  }: {
-    imports = with nixosModules; [
-      postgres
-      podman
-      troubleshooting-tools
-      emacs
-    ];
+  sway =
+    { pkgs, ... }:
+    {
+      imports = with nixosModules; [
+        pipewire
+      ];
 
-    environment.sessionVariables.NIXOS_OZONE_WL = "1";
-    programs.neovim = {
-      enable = true;
+      systemd.user.services."wait-for-full-path" = {
+        description = "wait for systemd units to have full PATH";
+        wantedBy = [ "xdg-desktop-portal.service" ];
+        before = [ "xdg-desktop-portal.service" ];
+        path = with pkgs; [
+          systemd
+          coreutils
+          gnugrep
+        ];
+        script = ''
+          ispresent () {
+            systemctl --user show-environment | grep -E '^PATH=.*/.nix-profile/bin'
+          }
+          while ! ispresent; do
+            sleep 0.1;
+          done
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          TimeoutStartSec = "60";
+        };
+      };
+
+      home-manager.users.daniel = {
+        imports = with homeManagerModules; [
+          sway
+        ];
+      };
+
+      programs.sway = {
+        enable = true;
+        wrapperFeatures.gtk = true;
+      };
+
+      # services.xserver.libinput.enable = true;
+
+      # TODO: a lot of this probably needs de-duping with hyprland?
+
+      services.gnome.gnome-keyring.enable = true;
+
+      xdg.portal = {
+        enable = true;
+        wlr.enable = true;
+        # gtk.enable = true;
+
+        extraPortals = with pkgs; [
+          xdg-desktop-portal-wlr
+          xdg-desktop-portal-gtk
+        ];
+      };
+
+      services.dbus.enable = true;
+      security.polkit.enable = true; # needed for home-manager integration
+
+      programs.thunar = {
+        enable = true;
+        plugins = with pkgs.xfce; [
+          thunar-archive-plugin
+          thunar-volman
+        ];
+      };
+
+      services.gvfs = {
+        enable = true;
+      };
+
+      environment = {
+        variables = {
+          VISUAL = "hx";
+        };
+
+        systemPackages = with pkgs; [
+          brightnessctl
+          feh
+          grim
+          libinput
+          libinput-gestures
+          libnotify
+          mako
+          noto-fonts
+          pamixer
+          playerctl
+          pulseaudio
+          pulsemixer
+          slurp
+          swaybg
+          swayidle
+          swaylock
+          swayosd
+          tofi
+          waybar
+          wl-clipboard
+          zathura
+
+          /*
+            gimp
+            inkscape
+            krita
+            lutris
+            nil
+            nixpkgs-fmt
+            pavucontrol
+            rclone
+            restic
+            steam
+            vlc
+            vulkan-tools
+            weechat
+            wine
+          */
+        ];
+      };
+    };
+
+  remote-disk-key-entry-on-boot =
+    {
+      lib,
+      pkgs,
+      ...
+    }:
+    {
       /*
-      plugins = [
-        pkgs.vimPlugins.nvim-treesitter.withAllGrammars
-      ];
+        https://nixos.wiki/wiki/Remote_disk_unlocking
+        "When using DHCP, make sure your computer is always attached to the network and is able to get an IP adress, or the boot process will hang."
+        ^ seems less than ideal
       */
-    };
-
-    hardware.gpgSmartcards.enable = true;
-
-    # services.udev.packages = with pkgs; [
-    #   # TODO: I think these get the whole package pulled in... should find out
-    #   # if there's a way to get just the rules and not 4 chromes
-    #   platformio
-    #   openocd
-    #   pkgs.yubikey-personalization
-    #   via
-    # ];
-
-    # programs.adb.enable = true;
-    # users.users.daniel.extraGroups = ["adbusers"];
-
-    home-manager.users.daniel = {
-      programs.direnv.mise = {
-        enable = true;
-      };
-
-      programs.mise = {
-        enable = true;
-        enableFishIntegration = true;
-        enableBashIntegration = true;
-        enableZshIntegration = true;
-      };
-
-      programs.thunderbird = {
-        enable = false;
-
-        profiles = {
-          daniel = {
-            isDefault = true;
-            # name = "daniel";
+      boot.kernelParams = [ "ip=dhcp" ];
+      boot.initrd = {
+        # availableKernelModules = ["r8169"]; # ethernet drivers
+        systemd.users.root.shell = "/bin/cryptsetup-askpass";
+        network = {
+          enable = true;
+          ssh = {
+            enable = true;
+            port = 22;
+            authorizedKeys = [ pubkey ];
+            hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
           };
         };
       };
+    };
 
-      programs.nushell = {
-        enable = false;
+  laptop =
+    { pkgs, ... }:
+    {
+      imports = with nixosModules; [
+        family-users
+        wifi
+      ];
+
+      environment.systemPackages = with pkgs; [
+        acpi
+      ];
+
+      services.udev.extraRules = ''
+        ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness"
+        ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chmod g+w /sys/class/backlight/%k/brightness"
+      '';
+
+      services.upower.enable = true;
+
+      # NOTE: I previously let plasma settings handle this
+      services.logind = {
+        lidSwitch = "suspend-then-hibernate";
+        extraConfig = ''
+          KillUserProcesses=no
+          HandlePowerKey=suspend
+          HandlePowerKeyLongPress=poweroff
+          HandleRebootKey=reboot
+          HandleRebootKeyLongPress=poweroff
+          HandleSuspendKey=suspend
+          HandleSuspendKeyLongPress=hibernate
+          HandleHibernateKey=hibernate
+          HandleHibernateKeyLongPress=ignore
+          HandleLidSwitch=suspend
+          HandleLidSwitchExternalPower=suspend
+          HandleLidSwitchDocked=suspend
+          HandleLidSwitchDocked=suspend
+          IdleActionSec=11m
+          IdleAction=ignore
+        '';
       };
+    };
 
-      programs.jujutsu = {
-        enable = lib.mkDefault true;
+  touchscreen =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        wvkbd # on-screen keyboard
+        flakeInputs.iio-hyprland.outputs.packages.${system}.default # auto-rotate hyprland displays
+        flakeInputs.hyprgrass.outputs.packages.${system}.hyprgrass # hyprland touch gestures
+      ];
+    };
+
+  emacs =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        emacs
+      ];
+
+      home-manager.users.daniel = {
+        imports = with homeManagerModules; [
+          emacs
+        ];
       };
+    };
 
-      programs.k9s = {
-        enable = false;
-      };
+  development-tools =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = with nixosModules; [
+        postgres
+        podman
+        troubleshooting-tools
+        emacs
+      ];
 
-      programs.vscode = {
-        enable = false;
-      };
-
-      programs.jq = {
-        enable = false;
-      };
-
-      programs.btop = {
+      environment.sessionVariables.NIXOS_OZONE_WL = "1";
+      programs.neovim = {
         enable = true;
-        package = pkgs.btop.override {
-          rocmSupport = true;
+        /*
+          plugins = [
+            pkgs.vimPlugins.nvim-treesitter.withAllGrammars
+          ];
+        */
+      };
+
+      hardware.gpgSmartcards.enable = true;
+
+      # services.udev.packages = with pkgs; [
+      #   # TODO: I think these get the whole package pulled in... should find out
+      #   # if there's a way to get just the rules and not 4 chromes
+      #   platformio
+      #   openocd
+      #   pkgs.yubikey-personalization
+      #   via
+      # ];
+
+      # programs.adb.enable = true;
+      # users.users.daniel.extraGroups = ["adbusers"];
+
+      home-manager.users.daniel = {
+        programs.direnv.mise = {
+          enable = true;
+        };
+
+        programs.mise = {
+          enable = true;
+          enableFishIntegration = true;
+          enableBashIntegration = true;
+          enableZshIntegration = true;
+        };
+
+        programs.thunderbird = {
+          enable = false;
+
+          profiles = {
+            daniel = {
+              isDefault = true;
+              # name = "daniel";
+            };
+          };
+        };
+
+        programs.nushell = {
+          enable = false;
+        };
+
+        programs.jujutsu = {
+          enable = lib.mkDefault true;
+        };
+
+        programs.k9s = {
+          enable = false;
+        };
+
+        programs.vscode = {
+          enable = false;
+        };
+
+        programs.jq = {
+          enable = false;
+        };
+
+        programs.btop = {
+          enable = true;
+          package = pkgs.btop.override {
+            rocmSupport = true;
+          };
         };
       };
     };
-  };
 
-  troubleshooting-tools = {pkgs, ...}: {
-    environment.systemPackages = with pkgs; [
-      iftop
-      bottom
-      btop
-      dnsutils
-      dogdns
-      htop
-      inetutils
-      nmap
-      pciutils
-      hexyl
-      pkgs.unixtools.xxd
-      usbutils
-      comma
-    ];
-  };
-
-  music-consumption = {pkgs, ...}: {
-    environment = {
-      systemPackages = with pkgs; [
-        spotube
-        spotdl
+  troubleshooting-tools =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        iftop
+        bottom
+        btop
+        dnsutils
+        dogdns
+        htop
+        inetutils
+        nmap
+        pciutils
+        hexyl
+        pkgs.unixtools.xxd
+        usbutils
+        comma
       ];
     };
-  };
 
-  video-tools = {pkgs, ...}: {
-    environment = {
-      systemPackages = with pkgs; [
-        ffmpeg-full
-        obs-studio
-      ];
+  music-consumption =
+    { pkgs, ... }:
+    {
+      environment = {
+        systemPackages = with pkgs; [
+          spotube
+          spotdl
+        ];
+      };
+    };
+
+  video-tools =
+    { pkgs, ... }:
+    {
+      environment = {
+        systemPackages = with pkgs; [
+          ffmpeg-full
+          obs-studio
+        ];
+      };
     };
-  };
 
   # android-dev = {pkgs, ...}: {
   #   services.udev.packages = [
@@ -428,249 +474,265 @@ in {
   #   environment.systemPackages = [pkgs.android-studio];
   # };
 
-  graphical-workstation = {
-    pkgs,
-    lib,
-    options,
-    config,
-    ...
-  }: {
-    imports = with nixosModules; [
-      sway
-      # hyprland
-      enable-flatpaks-and-appimages
-      fonts
-      development-tools
-      printing
-      music-consumption
-      kde-connect
-      # plasma6
-      gnome
-      video-tools
-      radio-tools
-      # android-dev
-    ];
+  graphical-workstation =
+    {
+      pkgs,
+      lib,
+      options,
+      config,
+      ...
+    }:
+    {
+      imports = with nixosModules; [
+        sway
+        # hyprland
+        enable-flatpaks-and-appimages
+        fonts
+        development-tools
+        printing
+        music-consumption
+        kde-connect
+        # plasma6
+        gnome
+        video-tools
+        radio-tools
+        # android-dev
+      ];
 
-    xdg.portal.enable = true;
+      xdg.portal.enable = true;
 
-    hardware =
-      if builtins.hasAttr "graphics" options.hardware
-      then {
-        graphics = {
-          enable = true;
-          enable32Bit = true;
+      hardware =
+        if builtins.hasAttr "graphics" options.hardware then
+          {
+            graphics = {
+              enable = true;
+              enable32Bit = true;
+              /*
+                driSupport32Bit = true;
+                driSupport = true;
+              */
+            };
+          }
+        else
+          {
+            opengl = {
+              enable = true;
+              driSupport32Bit = true;
+              driSupport = true;
+            };
+          };
+      environment = {
+        systemPackages = with pkgs; [
+          firefox
+          google-chrome
+          libnotify
+          slides
+          slack
+          discord
+        ];
+        variables = {
           /*
-          driSupport32Bit = true;
-          driSupport = true;
+            GTK_THEME = "Catppuccin-Mocha-Compact-Sapphire-Dark";
+            GTK_USE_PORTAL = "1";
           */
         };
-      }
-      else {
-        opengl = {
+      };
+    };
+
+  gnome =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = with nixosModules; [ pipewire ];
+
+      services = {
+        xserver = {
           enable = true;
-          driSupport32Bit = true;
-          driSupport = true;
+          displayManager.gdm.enable = true;
+          desktopManager.gnome.enable = true;
         };
+        udev.packages = [ pkgs.gnome-settings-daemon ];
       };
-    environment = {
-      systemPackages = with pkgs; [
-        firefox
-        google-chrome
-        libnotify
-        slides
-        slack
-        discord
-      ];
-      variables = {
-        /*
-        GTK_THEME = "Catppuccin-Mocha-Compact-Sapphire-Dark";
-        GTK_USE_PORTAL = "1";
-        */
+
+      environment = {
+        variables.GSK_RENDERER = "gl";
+        systemPackages = with pkgs; [
+          bitwarden
+          # adwaita-gtk-theme
+          papirus-icon-theme
+          adwaita-icon-theme
+          adwaita-icon-theme-legacy
+          hydrapaper
+        ];
       };
-    };
-  };
 
-  gnome = {
-    pkgs,
-    lib,
-    ...
-  }: {
-    imports = with nixosModules; [pipewire];
-
-    services = {
-      xserver = {
+      programs.kdeconnect = {
         enable = true;
-        displayManager.gdm.enable = true;
-        desktopManager.gnome.enable = true;
+        package = pkgs.gnomeExtensions.gsconnect;
       };
-      udev.packages = [pkgs.gnome-settings-daemon];
-    };
 
-    environment = {
-      variables.GSK_RENDERER = "gl";
-      systemPackages = with pkgs; [
-        bitwarden
-        # adwaita-gtk-theme
-        papirus-icon-theme
-        adwaita-icon-theme
-        adwaita-icon-theme-legacy
-        hydrapaper
-      ];
-    };
+      networking.firewall = rec {
+        allowedTCPPortRanges = [
+          {
+            from = 1714;
+            to = 1764;
+          }
+        ];
+        allowedUDPPortRanges = allowedTCPPortRanges;
+      };
 
-    programs.kdeconnect = {
-      enable = true;
-      package = pkgs.gnomeExtensions.gsconnect;
-    };
+      home-manager.users.daniel = {
+        imports = with homeManagerModules; [
+          gnome
+        ];
 
-    networking.firewall = rec {
-      allowedTCPPortRanges = [
-        {
-          from = 1714;
-          to = 1764;
-        }
-      ];
-      allowedUDPPortRanges = allowedTCPPortRanges;
-    };
-
-    home-manager.users.daniel = {
-      imports = with homeManagerModules; [
-        gnome
-      ];
-
-      home.file.".face" = {
-        enable = true;
-        source = builtins.fetchurl {
-          url = "https://lyte.dev/img/avatar3-square-512.png";
-          sha256 = "sha256:15zwbwisrc01m7ad684rsyq19wl4s33ry9xmgzmi88k1myxhs93x";
+        home.file.".face" = {
+          enable = true;
+          source = builtins.fetchurl {
+            url = "https://lyte.dev/img/avatar3-square-512.png";
+            sha256 = "sha256:15zwbwisrc01m7ad684rsyq19wl4s33ry9xmgzmi88k1myxhs93x";
+          };
         };
       };
     };
-  };
 
-  radio-tools = {pkgs, ...}: {
-    environment = {
-      systemPackages = with pkgs; [
-        chirp
-      ];
+  radio-tools =
+    { pkgs, ... }:
+    {
+      environment = {
+        systemPackages = with pkgs; [
+          chirp
+        ];
+      };
     };
-  };
 
   kde-connect = {
     programs.kdeconnect.enable = true;
 
     /*
-    # handled by enabling
-    networking.firewall = {
-    allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
-    allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
-    };
+      # handled by enabling
+      networking.firewall = {
+      allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
+      allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
+      };
     */
   };
 
-  fonts = {pkgs, ...}: {
-    fonts.packages = [
-      (
-        # allow nixpkgs 24.11 and unstable to both work
-        if builtins.hasAttr "nerd-fonts" pkgs
-        then (pkgs.nerd-fonts.symbols-only)
-        else (pkgs.nerdfonts.override {fonts = ["NerdFontsSymbolsOnly"];})
-      )
-      pkgs.iosevkaLyteTerm
-    ];
-  };
+  fonts =
+    { pkgs, ... }:
+    {
+      fonts.packages = [
+        (
+          # allow nixpkgs 24.11 and unstable to both work
+          if builtins.hasAttr "nerd-fonts" pkgs then
+            (pkgs.nerd-fonts.symbols-only)
+          else
+            (pkgs.nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
+        )
+        pkgs.iosevkaLyteTerm
+      ];
+    };
 
-  plasma6 = {
-    pkgs,
-    lib,
-    ...
-  }: {
-    imports = with nixosModules; [
-      kde-connect
-      pipewire
-    ];
+  plasma6 =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = with nixosModules; [
+        kde-connect
+        pipewire
+      ];
 
-    services.xserver.enable = true;
+      services.xserver.enable = true;
 
-    services.displayManager.sddm = {
-      enable = true;
-      # package = lib.mkForce pkgs.kdePackages.sddm;
-      settings = {};
-      # theme = "";
-      enableHidpi = true;
-      wayland = {
+      services.displayManager.sddm = {
         enable = true;
-        compositor = "weston";
+        # package = lib.mkForce pkgs.kdePackages.sddm;
+        settings = { };
+        # theme = "";
+        enableHidpi = true;
+        wayland = {
+          enable = true;
+          compositor = "weston";
+        };
+      };
+
+      services.desktopManager.plasma6.enable = true;
+      programs.dconf.enable = true;
+
+      services.xrdp.enable = false;
+      services.xrdp.defaultWindowManager = "plasma";
+      services.xrdp.openFirewall = false;
+
+      environment.systemPackages = with pkgs; [
+        wl-clipboard
+        inkscape
+        krita
+        noto-fonts
+        vlc
+        wl-clipboard
+
+        kdePackages.qtvirtualkeyboard
+        maliit-keyboard
+        maliit-framework
+
+        kdePackages.kate
+        kdePackages.kcalc
+        kdePackages.filelight
+        kdePackages.krdc
+        kdePackages.krfb
+        kdePackages.kclock
+        kdePackages.kweather
+        kdePackages.ktorrent
+        kdePackages.kdeplasma-addons
+
+        unstable-packages.kdePackages.krdp
+
+        /*
+          kdePackages.kdenlive
+          kdePackages.merkuro
+          kdePackages.neochat
+          kdePackages.kdevelop
+          kdePackages.kdialog
+        */
+      ];
+
+      programs.gnupg.agent.pinentryPackage = lib.mkForce pkgs.pinentry-qt;
+    };
+
+  lutris =
+    { pkgs, ... }:
+    {
+      environment = {
+        systemPackages = with pkgs; [
+          wineWowPackages.waylandFull
+          lutris
+          winetricks
+        ];
       };
     };
 
-    services.desktopManager.plasma6.enable = true;
-    programs.dconf.enable = true;
-
-    services.xrdp.enable = false;
-    services.xrdp.defaultWindowManager = "plasma";
-    services.xrdp.openFirewall = false;
-
-    environment.systemPackages = with pkgs; [
-      wl-clipboard
-      inkscape
-      krita
-      noto-fonts
-      vlc
-      wl-clipboard
-
-      kdePackages.qtvirtualkeyboard
-      maliit-keyboard
-      maliit-framework
-
-      kdePackages.kate
-      kdePackages.kcalc
-      kdePackages.filelight
-      kdePackages.krdc
-      kdePackages.krfb
-      kdePackages.kclock
-      kdePackages.kweather
-      kdePackages.ktorrent
-      kdePackages.kdeplasma-addons
-
-      unstable-packages.kdePackages.krdp
-
-      /*
-      kdePackages.kdenlive
-      kdePackages.merkuro
-      kdePackages.neochat
-      kdePackages.kdevelop
-      kdePackages.kdialog
-      */
-    ];
-
-    programs.gnupg.agent.pinentryPackage = lib.mkForce pkgs.pinentry-qt;
-  };
-
-  lutris = {pkgs, ...}: {
-    environment = {
-      systemPackages = with pkgs; [
-        wineWowPackages.waylandFull
-        lutris
-        winetricks
+  gaming =
+    { pkgs, ... }:
+    {
+      imports = with nixosModules; [
+        # lutris # use the flatpak
+        steam # TODO: use the flatpak?
       ];
-    };
-  };
 
-  gaming = {pkgs, ...}: {
-    imports = with nixosModules; [
-      # lutris # use the flatpak
-      steam # TODO: use the flatpak?
-    ];
-
-    environment = {
-      systemPackages = with pkgs; [
-        ludusavi
-        # ludusavi uses rclone
-        rclone
-      ];
+      environment = {
+        systemPackages = with pkgs; [
+          ludusavi
+          # ludusavi uses rclone
+          rclone
+        ];
+      };
     };
-  };
 
   pipewire = {
     services.pipewire = {
@@ -685,7 +747,12 @@ in {
           "bluez5.enable-sbc-xq" = true;
           "bluez5.enable-msbc" = true;
           "bluez5.enable-hw-volume" = true;
-          "bluez5.roles" = ["hsp_hs" "hsp_ag" "hfp_hf" "hfp_ag"];
+          "bluez5.roles" = [
+            "hsp_hs"
+            "hsp_ag"
+            "hfp_hf"
+            "hfp_ag"
+          ];
         };
       };
       extraConfig.pipewire."91-null-sinks" = {
@@ -723,14 +790,14 @@ in {
         ];
       };
       /*
-      extraConfig.pipewire."92-low-latency" = {
-      context.properties = {
-      default.clock.rate = 48000;
-      default.clock.quantum = 32;
-      default.clock.min-quantum = 32;
-      default.clock.max-quantum = 32;
-      };
-      };
+        extraConfig.pipewire."92-low-latency" = {
+        context.properties = {
+        default.clock.rate = 48000;
+        default.clock.quantum = 32;
+        default.clock.min-quantum = 32;
+        default.clock.max-quantum = 32;
+        };
+        };
       */
     };
 
@@ -738,368 +805,406 @@ in {
     security.rtkit.enable = true;
 
     /*
-    services.pipewire = {
-      enable = true;
-
-      wireplumber.enable = true;
-      pulse.enable = true;
-      jack.enable = true;
-
-      alsa = {
+      services.pipewire = {
         enable = true;
-        support32Bit = true;
+
+        wireplumber.enable = true;
+        pulse.enable = true;
+        jack.enable = true;
+
+        alsa = {
+          enable = true;
+          support32Bit = true;
+        };
       };
-    };
 
-    hardware = {
-      pulseaudio = {
-        enable = false;
-        support32Bit = true;
+      hardware = {
+        pulseaudio = {
+          enable = false;
+          support32Bit = true;
+        };
       };
-    };
 
-    security = {
-      # I forget why I need these exactly...
-      polkit.enable = true;
+      security = {
+        # I forget why I need these exactly...
+        polkit.enable = true;
 
-      rtkit.enable = true;
-    };
+        rtkit.enable = true;
+      };
     */
   };
 
-  podman = {
-    pkgs,
-    config,
-    lib,
-    ...
-  }: {
-    config = lib.mkIf config.virtualisation.podman.enable {
-      environment = {
-        systemPackages = with pkgs; [
-          podman-compose
-        ];
-      };
-
-      virtualisation = {
-        podman = {
-          dockerCompat = config.virtualisation.podman.enable;
-          dockerSocket.enable = true;
-          defaultNetwork.settings.dns_enabled = true;
+  podman =
+    {
+      pkgs,
+      config,
+      lib,
+      ...
+    }:
+    {
+      config = lib.mkIf config.virtualisation.podman.enable {
+        environment = {
+          systemPackages = with pkgs; [
+            podman-compose
+          ];
         };
 
-        oci-containers = {
-          backend = "podman";
-        };
-      };
+        virtualisation = {
+          podman = {
+            dockerCompat = config.virtualisation.podman.enable;
+            dockerSocket.enable = true;
+            defaultNetwork.settings.dns_enabled = true;
+          };
 
-      networking = {
-        extraHosts = ''
-          127.0.0.1 host.docker.internal
-          ::1 host.docker.internal
-          127.0.0.1 host.containers.internal
-          ::1 host.containers.internal
-        '';
-      };
-    };
-  };
-
-  virtual-machines = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: {
-    config = lib.mkIf config.virtualisation.libvirtd.enable {
-      users.users.daniel.extraGroups = ["libvirtd"];
-    };
-  };
-
-  postgres = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: {
-    config = lib.mkIf config.services.postgresql.enable {
-      # this is really just for development usage
-      services.postgresql = {
-        ensureDatabases = ["daniel"];
-        ensureUsers = [
-          {
-            name = "daniel";
-            ensureDBOwnership = true;
-          }
-        ];
-        # enableTCPIP = true;
-        # package = pkgs.postgresql_15;
-
-        authentication = pkgs.lib.mkOverride 10 ''
-          #type database  DBuser    auth-method
-          local all       postgres  peer map=superuser_map
-          local all       daniel    peer map=superuser_map
-          local sameuser  all       peer map=superuser_map
-
-          # lan ipv4
-          host  all       all     10.0.0.0/24   trust
-          host  all       all     127.0.0.1/32  trust
-
-          # tailnet ipv4
-          host       all       all     100.64.0.0/10 trust
-        '';
-
-        identMap = ''
-          # ArbitraryMapName systemUser DBUser
-          superuser_map      root       postgres
-          superuser_map      postgres   postgres
-          superuser_map      daniel     postgres
-
-          superuser_map      /^(.*)$    \1       # Let other names login as themselves
-        '';
-      };
-
-      environment.systemPackages = with pkgs; [
-        pgcli
-      ];
-    };
-  };
-
-  desktop = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: let
-    cfg = config.lyte.desktop;
-  in {
-    options = {
-      lyte = {
-        desktop = {
-          enable = lib.mkEnableOption "Enable my default desktop configuration and applications";
-        };
-      };
-    };
-    config = lib.mkIf cfg.enable {
-      home-manager.users.daniel = {
-        imports = with homeManagerModules; [
-          firefox-no-tabs
-          linux-desktop-environment-config
-        ];
-      };
-      services.flatpak.enable = true;
-      programs.appimage.binfmt = true;
-      services.printing.enable = true;
-      programs.virt-manager.enable = config.virtualization.libvirtd.enable;
-    };
-  };
-
-  printing = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: {
-    config = lib.mkIf config.services.printing.enable {
-      services.printing.browsing = true;
-      services.printing.browsedConf = ''
-        BrowseDNSSDSubTypes _cups,_print
-        BrowseLocalProtocols all
-        BrowseRemoteProtocols all
-        CreateIPPPrinterQueues All
-
-        BrowseProtocols all
-      '';
-      services.printing.drivers = [pkgs.gutenprint];
-    };
-  };
-
-  wifi = {
-    lib,
-    config,
-    ...
-  }: let
-    inherit (lib) mkDefault;
-    cfg = config.networking.wifi;
-  in {
-    options = {
-      networking.wifi.enable = lib.mkEnableOption "Enable wifi via NetworkManager";
-    };
-    config = lib.mkIf cfg.enable {
-      networking.networkmanager = {
-        enable = true;
-        # ensureProfiles = {
-        #   profiles = {
-        #     home-wifi = {
-        #     id="home-wifi";
-        #     permissions = "";
-        #     type = "wifi";
-        #     };
-        #     wifi = {
-        #     ssid = "";
-        #     };
-        #     wifi-security = {
-        #     # auth-alg = "";
-        #     # key-mgmt = "";
-        #     psk = "";
-        #     };
-        #   };
-        # };
-      };
-      systemd.services.NetworkManager-wait-online.enable = mkDefault false;
-
-      /*
-      TODO: networking.networkmanager.wifi.backend = "iwd"; ?
-      TODO: powersave?
-      TODO: can I pre-configure my usual wifi networks with SSIDs and PSKs loaded from secrets?
-      */
-      hardware.wirelessRegulatoryDatabase = true;
-      boot.extraModprobeConfig = ''
-        options cfg80211 ieee80211_regdom="US"
-      '';
-    };
-  };
-
-  steam = {pkgs, ...}: {
-    programs.gamescope.enable = true;
-
-    programs.steam = {
-      enable = true;
-
-      extest.enable = true;
-      gamescopeSession.enable = true;
-
-      extraPackages = with pkgs; [
-        gamescope
-      ];
-
-      extraCompatPackages = with pkgs; [
-        proton-ge-bin
-      ];
-
-      localNetworkGameTransfers.openFirewall = true;
-      remotePlay.openFirewall = true;
-    };
-
-    hardware.steam-hardware.enable = true;
-    services.udev.packages = with pkgs; [steam];
-
-    environment.systemPackages = with pkgs; [
-      dualsensectl # for interfacing with dualsense controllers programmatically
-    ];
-
-    # remote play ports - should be unnecessary due to programs.steam.remotePlay.openFirewall = true;
-    /*
-    networking.firewall.allowedUDPPortRanges = [ { from = 27031; to = 27036; } ];
-    networking.firewall.allowedTCPPortRanges = [ { from = 27036; to = 27037; } ];
-    */
-  };
-
-  root = {
-    pkgs,
-    lib,
-    ...
-  }: {
-    users.users.root = {
-      home = "/root";
-      createHome = true;
-      openssh.authorizedKeys.keys = [pubkey];
-      shell = lib.mkForce pkgs.fish;
-    };
-    home-manager.users.root = {
-      imports = [homeManagerModules.common];
-
-      home = {
-        username = "root";
-        homeDirectory = "/root";
-        stateVersion = pkgs.lib.mkDefault "24.05";
-      };
-    };
-  };
-
-  daniel = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: let
-    username = "daniel";
-  in {
-    imports = [
-      {
-        config = lib.mkIf config.lyte.shell.enable {
-          home-manager.users.${username} = {
-            imports = with homeManagerModules; [
-              senpai
-              iex
-              cargo
-            ];
+          oci-containers = {
+            backend = "podman";
           };
         };
-      }
-    ];
-    users.groups.${username} = {};
-    users.users.${username} = {
-      isNormalUser = true;
-      home = "/home/${username}/.home";
-      createHome = true;
-      openssh.authorizedKeys.keys = [pubkey];
-      group = username;
-      extraGroups = ["users" "wheel" "video" "dialout" "uucp" "kvm"];
-      packages = [];
-    };
-    home-manager.users.daniel = {
-      imports = [homeManagerModules.common];
 
-      home = {
-        username = "daniel";
-        homeDirectory = "/home/daniel/.home";
-        stateVersion = config.system.stateVersion;
-      };
-
-      accounts.email.accounts = {
-        primary = {
-          primary = true;
-          address = "daniel@lyte.dev";
-        };
-        legacy = {
-          address = "wraithx2@gmail.com";
-        };
-        io = {
-          # TODO: finalize deprecation
-          address = "daniel@lytedev.io";
+        networking = {
+          extraHosts = ''
+            127.0.0.1 host.docker.internal
+            ::1 host.docker.internal
+            127.0.0.1 host.containers.internal
+            ::1 host.containers.internal
+          '';
         };
       };
     };
-  };
 
-  valerie = let
-    username = "valerie";
-  in {
-    users.groups.${username} = {};
-    users.users.${username} = {
-      isNormalUser = true;
-      home = "/home/${username}";
-      createHome = true;
-      openssh.authorizedKeys.keys = [pubkey];
-      group = username;
-      extraGroups = ["users" "video"];
-      packages = [];
+  virtual-machines =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    {
+      config = lib.mkIf config.virtualisation.libvirtd.enable {
+        users.users.daniel.extraGroups = [ "libvirtd" ];
+      };
     };
-  };
 
-  flanfam = let
-    username = "flanfam";
-  in {
-    users.groups.${username} = {};
-    users.users.${username} = {
-      isNormalUser = true;
-      home = "/home/${username}";
-      createHome = true;
-      openssh.authorizedKeys.keys = [pubkey];
-      group = username;
-      extraGroups = ["users" "video"];
-      packages = [];
+  postgres =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    {
+      config = lib.mkIf config.services.postgresql.enable {
+        # this is really just for development usage
+        services.postgresql = {
+          ensureDatabases = [ "daniel" ];
+          ensureUsers = [
+            {
+              name = "daniel";
+              ensureDBOwnership = true;
+            }
+          ];
+          # enableTCPIP = true;
+          # package = pkgs.postgresql_15;
+
+          authentication = pkgs.lib.mkOverride 10 ''
+            #type database  DBuser    auth-method
+            local all       postgres  peer map=superuser_map
+            local all       daniel    peer map=superuser_map
+            local sameuser  all       peer map=superuser_map
+
+            # lan ipv4
+            host  all       all     10.0.0.0/24   trust
+            host  all       all     127.0.0.1/32  trust
+
+            # tailnet ipv4
+            host       all       all     100.64.0.0/10 trust
+          '';
+
+          identMap = ''
+            # ArbitraryMapName systemUser DBUser
+            superuser_map      root       postgres
+            superuser_map      postgres   postgres
+            superuser_map      daniel     postgres
+
+            superuser_map      /^(.*)$    \1       # Let other names login as themselves
+          '';
+        };
+
+        environment.systemPackages = with pkgs; [
+          pgcli
+        ];
+      };
+    };
+
+  desktop =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      cfg = config.lyte.desktop;
+    in
+    {
+      options = {
+        lyte = {
+          desktop = {
+            enable = lib.mkEnableOption "Enable my default desktop configuration and applications";
+          };
+        };
+      };
+      config = lib.mkIf cfg.enable {
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            firefox-no-tabs
+            linux-desktop-environment-config
+          ];
+        };
+        services.flatpak.enable = true;
+        programs.appimage.binfmt = true;
+        services.printing.enable = true;
+        programs.virt-manager.enable = config.virtualization.libvirtd.enable;
+      };
+    };
+
+  printing =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    {
+      config = lib.mkIf config.services.printing.enable {
+        services.printing.browsing = true;
+        services.printing.browsedConf = ''
+          BrowseDNSSDSubTypes _cups,_print
+          BrowseLocalProtocols all
+          BrowseRemoteProtocols all
+          CreateIPPPrinterQueues All
+
+          BrowseProtocols all
+        '';
+        services.printing.drivers = [ pkgs.gutenprint ];
+      };
+    };
+
+  wifi =
+    {
+      lib,
+      config,
+      ...
+    }:
+    let
+      inherit (lib) mkDefault;
+      cfg = config.networking.wifi;
+    in
+    {
+      options = {
+        networking.wifi.enable = lib.mkEnableOption "Enable wifi via NetworkManager";
+      };
+      config = lib.mkIf cfg.enable {
+        networking.networkmanager = {
+          enable = true;
+          # ensureProfiles = {
+          #   profiles = {
+          #     home-wifi = {
+          #     id="home-wifi";
+          #     permissions = "";
+          #     type = "wifi";
+          #     };
+          #     wifi = {
+          #     ssid = "";
+          #     };
+          #     wifi-security = {
+          #     # auth-alg = "";
+          #     # key-mgmt = "";
+          #     psk = "";
+          #     };
+          #   };
+          # };
+        };
+        systemd.services.NetworkManager-wait-online.enable = mkDefault false;
+
+        /*
+          TODO: networking.networkmanager.wifi.backend = "iwd"; ?
+          TODO: powersave?
+          TODO: can I pre-configure my usual wifi networks with SSIDs and PSKs loaded from secrets?
+        */
+        hardware.wirelessRegulatoryDatabase = true;
+        boot.extraModprobeConfig = ''
+          options cfg80211 ieee80211_regdom="US"
+        '';
+      };
+    };
+
+  steam =
+    { pkgs, ... }:
+    {
+      programs.gamescope.enable = true;
+
+      programs.steam = {
+        enable = true;
+
+        extest.enable = true;
+        gamescopeSession.enable = true;
+
+        extraPackages = with pkgs; [
+          gamescope
+        ];
+
+        extraCompatPackages = with pkgs; [
+          proton-ge-bin
+        ];
+
+        localNetworkGameTransfers.openFirewall = true;
+        remotePlay.openFirewall = true;
+      };
+
+      hardware.steam-hardware.enable = true;
+      services.udev.packages = with pkgs; [ steam ];
+
+      environment.systemPackages = with pkgs; [
+        dualsensectl # for interfacing with dualsense controllers programmatically
+      ];
+
+      # remote play ports - should be unnecessary due to programs.steam.remotePlay.openFirewall = true;
+      /*
+        networking.firewall.allowedUDPPortRanges = [ { from = 27031; to = 27036; } ];
+        networking.firewall.allowedTCPPortRanges = [ { from = 27036; to = 27037; } ];
+      */
+    };
+
+  root =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      users.users.root = {
+        home = "/root";
+        createHome = true;
+        openssh.authorizedKeys.keys = [ pubkey ];
+        shell = lib.mkForce pkgs.fish;
+      };
+      home-manager.users.root = {
+        imports = [ homeManagerModules.common ];
+
+        home = {
+          username = "root";
+          homeDirectory = "/root";
+          stateVersion = pkgs.lib.mkDefault "24.05";
+        };
+      };
+    };
+
+  daniel =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      username = "daniel";
+    in
+    {
+      imports = [
+        {
+          config = lib.mkIf config.lyte.shell.enable {
+            home-manager.users.${username} = {
+              imports = with homeManagerModules; [
+                senpai
+                iex
+                cargo
+              ];
+            };
+          };
+        }
+      ];
+      users.groups.${username} = { };
+      users.users.${username} = {
+        isNormalUser = true;
+        home = "/home/${username}/.home";
+        createHome = true;
+        openssh.authorizedKeys.keys = [ pubkey ];
+        group = username;
+        extraGroups = [
+          "users"
+          "wheel"
+          "video"
+          "dialout"
+          "uucp"
+          "kvm"
+        ];
+        packages = [ ];
+      };
+      home-manager.users.daniel = {
+        imports = [ homeManagerModules.common ];
+
+        home = {
+          username = "daniel";
+          homeDirectory = "/home/daniel/.home";
+          stateVersion = config.system.stateVersion;
+        };
+
+        accounts.email.accounts = {
+          primary = {
+            primary = true;
+            address = "daniel@lyte.dev";
+          };
+          legacy = {
+            address = "wraithx2@gmail.com";
+          };
+          io = {
+            # TODO: finalize deprecation
+            address = "daniel@lytedev.io";
+          };
+        };
+      };
+    };
+
+  valerie =
+    let
+      username = "valerie";
+    in
+    {
+      users.groups.${username} = { };
+      users.users.${username} = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        createHome = true;
+        openssh.authorizedKeys.keys = [ pubkey ];
+        group = username;
+        extraGroups = [
+          "users"
+          "video"
+        ];
+        packages = [ ];
+      };
+    };
+
+  flanfam =
+    let
+      username = "flanfam";
+    in
+    {
+      users.groups.${username} = { };
+      users.users.${username} = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        createHome = true;
+        openssh.authorizedKeys.keys = [ pubkey ];
+        group = username;
+        extraGroups = [
+          "users"
+          "video"
+        ];
+        packages = [ ];
+      };
     };
-  };
 
   family-users = {
     imports = with nixosModules; [
diff --git a/lib/modules/nixos/deno-netlify-ddns-client.nix b/lib/modules/nixos/deno-netlify-ddns-client.nix
index e75c359..2a208b1 100644
--- a/lib/modules/nixos/deno-netlify-ddns-client.nix
+++ b/lib/modules/nixos/deno-netlify-ddns-client.nix
@@ -3,11 +3,18 @@
   config,
   pkgs,
   ...
-}: let
-  inherit (lib) mkEnableOption mkOption types mkIf;
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
   inherit (lib.strings) optionalString;
   cfg = config.services.deno-netlify-ddns-client;
-in {
+in
+{
   options.services.deno-netlify-ddns-client = {
     enable = mkEnableOption "Enable the deno-netlify-ddns client.";
     username = mkOption {
@@ -48,8 +55,8 @@ in {
   config = {
     systemd.timers.deno-netlify-ddns-client = {
       enable = mkIf cfg.enable true;
-      after = ["network.target"];
-      wantedBy = ["timers.target"];
+      after = [ "network.target" ];
+      wantedBy = [ "timers.target" ];
       timerConfig = {
         OnBootSec = cfg.afterBootTime;
         OnUnitActiveSec = cfg.every;
@@ -59,7 +66,7 @@ in {
 
     systemd.services.deno-netlify-ddns-client = {
       enable = mkIf cfg.enable true;
-      after = ["network.target"];
+      after = [ "network.target" ];
       script = ''
         set -eu
         password="$(cat "${cfg.passwordFile}")"
diff --git a/lib/modules/nixos/gnome.nix b/lib/modules/nixos/gnome.nix
index 83a1514..e2174ff 100644
--- a/lib/modules/nixos/gnome.nix
+++ b/lib/modules/nixos/gnome.nix
@@ -2,8 +2,9 @@
   pkgs,
   lib,
   ...
-}: {
-  imports = [./pipewire.nix];
+}:
+{
+  imports = [ ./pipewire.nix ];
 
   # mkForce is used liberally to take precedence over KDE Plasma
   # so I can have both "usable" at once
@@ -21,7 +22,7 @@
   services.xserver.desktopManager.gnome = {
     enable = lib.mkDefault true;
 
-    extraGSettingsOverridePackages = [pkgs.gnome.mutter];
+    extraGSettingsOverridePackages = [ pkgs.gnome.mutter ];
     extraGSettingsOverrides = ''
       [org.gnome.mutter]
       experimental-features=['scale-monitor-framebuffer']
@@ -65,18 +66,18 @@
       wl-clipboard
       zathura
       /*
-      gimp
-      inkscape
-      krita
-      pavucontrol
-      pulseaudio
-      rclone
-      restic
-      steam
-      vlc
-      vulkan-tools
-      weechat
-      wine
+        gimp
+        inkscape
+        krita
+        pavucontrol
+        pulseaudio
+        rclone
+        restic
+        steam
+        vlc
+        vulkan-tools
+        weechat
+        wine
       */
     ];
   };
diff --git a/lib/modules/nixos/shell-config.nix b/lib/modules/nixos/shell-config.nix
index 94668d6..0d916f2 100644
--- a/lib/modules/nixos/shell-config.nix
+++ b/lib/modules/nixos/shell-config.nix
@@ -3,9 +3,11 @@
   pkgs,
   config,
   ...
-}: let
+}:
+let
   cfg = config.lyte.shell;
-in {
+in
+{
   options = {
     lyte = {
       shell = {
diff --git a/lib/overlays/default.nix b/lib/overlays/default.nix
index 49b2ea0..88c2aec 100644
--- a/lib/overlays/default.nix
+++ b/lib/overlays/default.nix
@@ -3,7 +3,8 @@
   nixpkgs,
   nixpkgs-unstable,
   ...
-} @ inputs: {
+}@inputs:
+{
   default = final: _prev: {
     overlays = with self.overlays; [
       additions
@@ -14,13 +15,16 @@
 
   additions = final: prev: (prev // self.outputs.packages.${prev.system});
 
-  modifications = final: prev: let
-    inherit (inputs) helix ghostty;
-  in {
-    ghostty = ghostty.outputs.packages.${prev.system}.default;
-    helix = helix.outputs.packages.${prev.system}.default;
-    bitwarden = self.outputs.packages.${prev.system}.bitwarden;
-  };
+  modifications =
+    final: prev:
+    let
+      inherit (inputs) helix ghostty;
+    in
+    {
+      ghostty = ghostty.outputs.packages.${prev.system}.default;
+      helix = helix.outputs.packages.${prev.system}.default;
+      bitwarden = self.outputs.packages.${prev.system}.bitwarden;
+    };
 
   unstable-packages = final: _prev: {
     unstable-packages = import nixpkgs-unstable {
diff --git a/lib/templates/deno/flake.nix b/lib/templates/deno/flake.nix
index 323a903..efc9913 100644
--- a/lib/templates/deno/flake.nix
+++ b/lib/templates/deno/flake.nix
@@ -1,34 +1,41 @@
 {
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-  outputs = {
-    self,
-    nixpkgs,
-  }: let
-    inherit (self) outputs;
-    supportedSystems = [
-      "x86_64-linux"
-      "aarch64-linux"
+  outputs =
+    {
+      self,
+      nixpkgs,
+    }:
+    let
+      inherit (self) outputs;
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
 
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-    forEachSupportedSystem = nixpkgs.lib.genAttrs supportedSystems;
-  in {
-    devShells = forEachSupportedSystem (system: let
-      pkgs = import nixpkgs {inherit system;};
-    in {
-      deno-dev = pkgs.mkShell {
-        buildInputs = with pkgs; [
-          vscode-langservers-extracted
-          deno
-          curl
-          xh
-          sqlite
-        ];
-      };
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forEachSupportedSystem = nixpkgs.lib.genAttrs supportedSystems;
+    in
+    {
+      devShells = forEachSupportedSystem (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          deno-dev = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              vscode-langservers-extracted
+              deno
+              curl
+              xh
+              sqlite
+            ];
+          };
 
-      default = outputs.devShells.${system}.deno-dev;
-    });
-  };
+          default = outputs.devShells.${system}.deno-dev;
+        }
+      );
+    };
 }
diff --git a/lib/templates/elixir/flake.nix b/lib/templates/elixir/flake.nix
index 7d30b37..2586442 100644
--- a/lib/templates/elixir/flake.nix
+++ b/lib/templates/elixir/flake.nix
@@ -5,12 +5,15 @@
     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs: let
-    inherit (import nix/boilerplate.nix inputs) call;
-  in {
-    overlays = import nix/overlays.nix;
-    packages = call (import nix/packages.nix);
-    checks = call (import nix/checks.nix);
-    devShells = call (import nix/shells.nix);
-  };
+  outputs =
+    inputs:
+    let
+      inherit (import nix/boilerplate.nix inputs) call;
+    in
+    {
+      overlays = import nix/overlays.nix;
+      packages = call (import nix/packages.nix);
+      checks = call (import nix/checks.nix);
+      devShells = call (import nix/shells.nix);
+    };
 }
diff --git a/lib/templates/elixir/nix/boilerplate.nix b/lib/templates/elixir/nix/boilerplate.nix
index 2778326..1807c36 100644
--- a/lib/templates/elixir/nix/boilerplate.nix
+++ b/lib/templates/elixir/nix/boilerplate.nix
@@ -1,16 +1,21 @@
-inputs @ {
+inputs@{
   nixpkgs,
   self,
   ...
-}: let
+}:
+let
   forSelfOverlay =
-    if builtins.hasAttr "forSelf" self.overlays
-    then self.overlays.forSelf
-    else (_: p: p);
-in rec {
-  systems = ["aarch64-linux" "x86_64-linux" "x86_64-darwin" "aarch64-darwin"];
+    if builtins.hasAttr "forSelf" self.overlays then self.overlays.forSelf else (_: p: p);
+in
+rec {
+  systems = [
+    "aarch64-linux"
+    "x86_64-linux"
+    "x86_64-darwin"
+    "aarch64-darwin"
+  ];
   forSystems = nixpkgs.lib.genAttrs systems;
-  pkgsFor = system: ((import nixpkgs {inherit system;}).extend forSelfOverlay);
+  pkgsFor = system: ((import nixpkgs { inherit system; }).extend forSelfOverlay);
   genPkgs = func: (forSystems (system: func (pkgsFor system)));
-  call = imported: genPkgs (pkgs: imported (inputs // {inherit pkgs;}));
+  call = imported: genPkgs (pkgs: imported (inputs // { inherit pkgs; }));
 }
diff --git a/lib/templates/elixir/nix/checks.nix b/lib/templates/elixir/nix/checks.nix
index c88dd7d..fe719b6 100644
--- a/lib/templates/elixir/nix/checks.nix
+++ b/lib/templates/elixir/nix/checks.nix
@@ -2,28 +2,32 @@
   git-hooks,
   pkgs,
   ...
-}: let
-  hook = {
-    command,
-    stages ? ["pre-commit"],
-    ...
-  }: {
-    inherit stages;
-    enable = true;
-    name = command;
-    entry = command;
-    pass_filenames = false;
-  };
-in {
+}:
+let
+  hook =
+    {
+      command,
+      stages ? [ "pre-commit" ],
+      ...
+    }:
+    {
+      inherit stages;
+      enable = true;
+      name = command;
+      entry = command;
+      pass_filenames = false;
+    };
+in
+{
   git-hooks = git-hooks.lib.${pkgs.system}.run {
     src = ./..;
     hooks = {
       alejandra.enable = true;
       convco.enable = true;
-      credo = hook {command = "mix credo --strict";};
-      formatting = hook {command = "mix format --check-formatted";};
-      dialyzer = hook {command = "mix dialyzer";};
-      test = hook {command = "mix test";};
+      credo = hook { command = "mix credo --strict"; };
+      formatting = hook { command = "mix format --check-formatted"; };
+      dialyzer = hook { command = "mix dialyzer"; };
+      test = hook { command = "mix test"; };
     };
   };
 }
diff --git a/lib/templates/elixir/nix/overlays.nix b/lib/templates/elixir/nix/overlays.nix
index 50d4f1f..63f105e 100644
--- a/lib/templates/elixir/nix/overlays.nix
+++ b/lib/templates/elixir/nix/overlays.nix
@@ -2,8 +2,8 @@
   forSelf = final: prev: {
     erlang = prev.beam.packagesWith prev.beam.interpreters.erlang_27;
     elixir = final.erlang.elixir_1_17;
-    mixRelease = final.erlang.mixRelease.override {elixir = final.elixir;};
-    fetchMixDeps = final.erlang.fetchMixDeps.override {elixir = final.elixir;};
-    elixir-ls = prev.elixir-ls.override {elixir = final.elixir;};
+    mixRelease = final.erlang.mixRelease.override { elixir = final.elixir; };
+    fetchMixDeps = final.erlang.fetchMixDeps.override { elixir = final.elixir; };
+    elixir-ls = prev.elixir-ls.override { elixir = final.elixir; };
   };
 }
diff --git a/lib/templates/elixir/nix/packages.nix b/lib/templates/elixir/nix/packages.nix
index 3be71ed..d0820f2 100644
--- a/lib/templates/elixir/nix/packages.nix
+++ b/lib/templates/elixir/nix/packages.nix
@@ -2,11 +2,13 @@
   pkgs,
   self,
   ...
-}: let
+}:
+let
   version = "1.0.0";
   src = ../.;
   pname = "my-package";
-in {
+in
+{
   ${pname} = pkgs.mixRelease {
     inherit pname version src;
     mixFodDeps = pkgs.fetchMixDeps {
diff --git a/lib/templates/elixir/nix/shells.nix b/lib/templates/elixir/nix/shells.nix
index 91dcd91..75a5796 100644
--- a/lib/templates/elixir/nix/shells.nix
+++ b/lib/templates/elixir/nix/shells.nix
@@ -2,7 +2,8 @@
   pkgs,
   self,
   ...
-}: {
+}:
+{
   elixir-dev = pkgs.mkShell {
     shellHook = ''
       ${self.checks.${pkgs.system}.git-hooks.shellHook}
diff --git a/lib/templates/gleam/flake.nix b/lib/templates/gleam/flake.nix
index 5367c9f..fe62b9f 100644
--- a/lib/templates/gleam/flake.nix
+++ b/lib/templates/gleam/flake.nix
@@ -1,27 +1,35 @@
 {
   inputs.nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-  outputs = {
-    self,
-    nixpkgs,
-    ...
-  }: let
-    systems = ["aarch64-linux" "x86_64-linux" "x86_64-darwin" "aarch64-darwin"];
-    forSystems = nixpkgs.lib.genAttrs systems;
-    pkgsFor = system: (import nixpkgs {inherit system;}).extend self.outputs.overlays.default;
-    genPkgs = func: (forSystems (system: func (pkgsFor system)));
-  in {
-    overlays.default = final: prev: {
-      erlangPackages = prev.beam.packagesWith prev.erlang_27;
-      erlang = final.erlangPackages.erlang;
-    };
-    devShells = genPkgs (pkgs: {
-      default = pkgs.mkShell {
-        buildInputs = with pkgs; [
-          erlang
-          gleam
-          rebar3
-        ];
+  outputs =
+    {
+      self,
+      nixpkgs,
+      ...
+    }:
+    let
+      systems = [
+        "aarch64-linux"
+        "x86_64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forSystems = nixpkgs.lib.genAttrs systems;
+      pkgsFor = system: (import nixpkgs { inherit system; }).extend self.outputs.overlays.default;
+      genPkgs = func: (forSystems (system: func (pkgsFor system)));
+    in
+    {
+      overlays.default = final: prev: {
+        erlangPackages = prev.beam.packagesWith prev.erlang_27;
+        erlang = final.erlangPackages.erlang;
       };
-    });
-  };
+      devShells = genPkgs (pkgs: {
+        default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            erlang
+            gleam
+            rebar3
+          ];
+        };
+      });
+    };
 }
diff --git a/lib/templates/godot/flake.nix b/lib/templates/godot/flake.nix
index 09c833e..4daba10 100644
--- a/lib/templates/godot/flake.nix
+++ b/lib/templates/godot/flake.nix
@@ -1,32 +1,42 @@
 {
   inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
-  outputs = {
-    self,
-    nixpkgs,
-    ...
-  }: let
-    inherit (self) outputs;
-    supportedSystems = [
-      "x86_64-linux"
-      "aarch64-linux"
+  outputs =
+    {
+      self,
+      nixpkgs,
+      ...
+    }:
+    let
+      inherit (self) outputs;
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
 
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
 
-    forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-  in {
-    devShells = forAllSystems (system: let
-      pkgs = import nixpkgs {inherit system;};
-    in {
-      default = outputs.devShells.${system}.godot;
-      godot = pkgs.mkShell {
-        buildInputs = with pkgs; [godot_4 gdtoolkit];
-        shellHook = ''
-          echo -e "\e[0;30m\e[43m Use 'godot4 -e' to run the editor for this project. \e[0;30m\e[0m"
-        '';
-      };
-    });
-  };
+      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          default = outputs.devShells.${system}.godot;
+          godot = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              godot_4
+              gdtoolkit
+            ];
+            shellHook = ''
+              echo -e "\e[0;30m\e[43m Use 'godot4 -e' to run the editor for this project. \e[0;30m\e[0m"
+            '';
+          };
+        }
+      );
+    };
 }
diff --git a/lib/templates/nim/flake.nix b/lib/templates/nim/flake.nix
index daf4697..550cced 100644
--- a/lib/templates/nim/flake.nix
+++ b/lib/templates/nim/flake.nix
@@ -1,31 +1,38 @@
 {
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-  outputs = {
-    self,
-    nixpkgs,
-  }: let
-    inherit (self) outputs;
-    supportedSystems = [
-      "x86_64-linux"
-      "aarch64-linux"
+  outputs =
+    {
+      self,
+      nixpkgs,
+    }:
+    let
+      inherit (self) outputs;
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
 
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-    forEachSupportedSystem = nixpkgs.lib.genAttrs supportedSystems;
-  in {
-    devShells = forEachSupportedSystem (system: let
-      pkgs = import nixpkgs {inherit system;};
-    in {
-      nim-dev = pkgs.mkShell {
-        buildInputs = with pkgs; [
-          nim
-          nimble
-          nimlangserver
-        ];
-      };
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forEachSupportedSystem = nixpkgs.lib.genAttrs supportedSystems;
+    in
+    {
+      devShells = forEachSupportedSystem (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          nim-dev = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              nim
+              nimble
+              nimlangserver
+            ];
+          };
 
-      default = outputs.devShells.${system}.nim-dev;
-    });
-  };
+          default = outputs.devShells.${system}.nim-dev;
+        }
+      );
+    };
 }
diff --git a/lib/templates/rust/flake.nix b/lib/templates/rust/flake.nix
index 2340be6..cafceea 100644
--- a/lib/templates/rust/flake.nix
+++ b/lib/templates/rust/flake.nix
@@ -2,13 +2,16 @@
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
   inputs.git-hooks.url = "github:cachix/git-hooks.nix";
   inputs.git-hooks.inputs.nixpkgs.follows = "nixpkgs";
-  outputs = inputs: let
-    inherit (import nix/boilerplate.nix inputs) call genPkgs;
-  in {
-    # overlays = import nix/overlays.nix;
-    checks = call (import nix/checks.nix);
-    packages = call (import nix/packages.nix);
-    devShells = call (import nix/shells.nix);
-    formatter = genPkgs (p: p.alejandra);
-  };
+  outputs =
+    inputs:
+    let
+      inherit (import nix/boilerplate.nix inputs) call genPkgs;
+    in
+    {
+      # overlays = import nix/overlays.nix;
+      checks = call (import nix/checks.nix);
+      packages = call (import nix/packages.nix);
+      devShells = call (import nix/shells.nix);
+      formatter = genPkgs (p: p.alejandra);
+    };
 }
diff --git a/lib/templates/rust/nix/boilerplate.nix b/lib/templates/rust/nix/boilerplate.nix
index e0b4acd..c50b912 100644
--- a/lib/templates/rust/nix/boilerplate.nix
+++ b/lib/templates/rust/nix/boilerplate.nix
@@ -1,16 +1,24 @@
-inputs @ {
+inputs@{
   nixpkgs,
   self,
   ...
-}: let
+}:
+let
   forSelfOverlay =
-    if builtins.hasAttr "overlays" self && builtins.hasAttr "forSelf" self.overlays
-    then self.overlays.forSelf
-    else (_: p: p);
-in rec {
-  systems = ["aarch64-linux" "x86_64-linux" "x86_64-darwin" "aarch64-darwin"];
+    if builtins.hasAttr "overlays" self && builtins.hasAttr "forSelf" self.overlays then
+      self.overlays.forSelf
+    else
+      (_: p: p);
+in
+rec {
+  systems = [
+    "aarch64-linux"
+    "x86_64-linux"
+    "x86_64-darwin"
+    "aarch64-darwin"
+  ];
   forSystems = nixpkgs.lib.genAttrs systems;
-  pkgsFor = system: ((import nixpkgs {inherit system;}).extend forSelfOverlay);
+  pkgsFor = system: ((import nixpkgs { inherit system; }).extend forSelfOverlay);
   genPkgs = func: (forSystems (system: func (pkgsFor system)));
-  call = imported: genPkgs (pkgs: imported (inputs // {inherit pkgs;}));
+  call = imported: genPkgs (pkgs: imported (inputs // { inherit pkgs; }));
 }
diff --git a/lib/templates/rust/nix/checks.nix b/lib/templates/rust/nix/checks.nix
index 6d6b07b..a484e7d 100644
--- a/lib/templates/rust/nix/checks.nix
+++ b/lib/templates/rust/nix/checks.nix
@@ -2,7 +2,8 @@
   pkgs,
   git-hooks,
   ...
-}: {
+}:
+{
   git-hooks = git-hooks.lib.${pkgs.system}.run {
     src = ./..;
     hooks = {
@@ -16,7 +17,7 @@
         # types = ["rust"];
         # language = "rust";
         pass_filenames = false;
-        stages = ["pre-commit"];
+        stages = [ "pre-commit" ];
       };
       clippy.enable = true;
       rustfmt.enable = true;
diff --git a/lib/templates/rust/nix/packages.nix b/lib/templates/rust/nix/packages.nix
index bf515cf..c4a1c40 100644
--- a/lib/templates/rust/nix/packages.nix
+++ b/lib/templates/rust/nix/packages.nix
@@ -1,4 +1,5 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
+let
   inherit (builtins) fromTOML readFile;
   pname = "my-package";
   src = ./..;
@@ -8,19 +9,20 @@
     # or for workspaces: version = (fromTOML (readFile "${src}/${pname}/Cargo.toml")).package.version;
 
     /*
-    nativeBuildInputs = with pkgs; [
-    pkg-config
-    clang
-    ];
+      nativeBuildInputs = with pkgs; [
+      pkg-config
+      clang
+      ];
 
-    buildInputs = with pkgs; [
-    ];
+      buildInputs = with pkgs; [
+      ];
     */
 
     cargoHash = pkgs.lib.fakeHash;
     useFetchCargoVendor = true;
   };
-in {
+in
+{
   ${pname} = main-package;
   default = main-package;
 }
diff --git a/lib/templates/rust/nix/shells.nix b/lib/templates/rust/nix/shells.nix
index 7e4499c..bd00b9e 100644
--- a/lib/templates/rust/nix/shells.nix
+++ b/lib/templates/rust/nix/shells.nix
@@ -2,12 +2,14 @@
   self,
   pkgs,
   ...
-}: let
+}:
+let
   inherit (pkgs) system;
-in {
+in
+{
   default = pkgs.mkShell {
     inherit (self.checks.${system}.git-hooks) shellHook;
-    inputsFrom = [self.packages.${system}.default];
+    inputsFrom = [ self.packages.${system}.default ];
     packages = with pkgs; [
       convco
       rustPackages.clippy
diff --git a/nix/boilerplate.nix b/nix/boilerplate.nix
deleted file mode 100644
index 8b13789..0000000
--- a/nix/boilerplate.nix
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/nix/constants.nix b/nix/constants.nix
index 3d83ad0..b02be68 100644
--- a/nix/constants.nix
+++ b/nix/constants.nix
@@ -1,6 +1,7 @@
-{nixpkgs, ...}: {
+{ nixpkgs, ... }:
+{
   style = {
-    colors = (import ./lib/colors.nix {inherit (nixpkgs) lib;}).schemes.catppuccin-mocha-sapphire;
+    colors = (import ./lib/colors.nix { inherit (nixpkgs) lib; }).schemes.catppuccin-mocha-sapphire;
 
     font = {
       name = "IosevkaLyteTerm";
@@ -9,11 +10,11 @@
   };
 
   /*
-  moduleArgs = {
-    # inherit style;
-    inherit helix slippi hyprland hardware disko home-manager;
-    inherit (outputs) nixosModules homeManagerModules diskoConfigurations overlays;
-  };
+    moduleArgs = {
+      # inherit style;
+      inherit helix slippi hyprland hardware disko home-manager;
+      inherit (outputs) nixosModules homeManagerModules diskoConfigurations overlays;
+    };
   */
 
   pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAPLXOjupz3ScYjgrF+ehrbp9OvGAWQLI6fplX6w9Ijb daniel@lyte.dev";
diff --git a/nix/machines.nix b/nix/machines.nix
index c783165..6120f5b 100644
--- a/nix/machines.nix
+++ b/nix/machines.nix
@@ -1,438 +1,438 @@
+{
+  beefcake =
+    let
+      system = "x86_64-linux";
+    in
+    nixpkgs.lib.nixosSystem {
+      inherit system;
+      modules = with nixosModules; [
+        home-manager-defaults
+        conduwuit
 
-      beefcake = let
-        system = "x86_64-linux";
-      in
-        nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = with nixosModules; [
-            home-manager-defaults
-            conduwuit
+        # TODO: disko?
+        hardware.nixosModules.common-cpu-intel
 
-            # TODO: disko?
-            hardware.nixosModules.common-cpu-intel
+        outputs.nixosModules.deno-netlify-ddns-client
+        {
+          services.deno-netlify-ddns-client = {
+            enable = true;
+            username = "beefcake.h";
+            # TODO: router doesn't even do ipv6 yet...
+            ipv6 = false;
+          };
+        }
 
-            outputs.nixosModules.deno-netlify-ddns-client
-            {
-              services.deno-netlify-ddns-client = {
-                enable = true;
-                username = "beefcake.h";
-                # TODO: router doesn't even do ipv6 yet...
-                ipv6 = false;
-              };
-            }
+        family-users
+        common
+        podman
+        troubleshooting-tools
+        virtual-machines
+        virtual-machines-gui
+        linux
+        fonts
 
-            family-users
-            common
-            podman
-            troubleshooting-tools
-            virtual-machines
-            virtual-machines-gui
-            linux
-            fonts
+        ./nixos/beefcake.nix
 
-            ./nixos/beefcake.nix
-
-            {
-              services.kanidm.package = (unstable.pkgsFor system).kanidm;
-            }
-          ];
-        };
-
-
-      htpc = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-defaults
-
-          hardware.nixosModules.common-pc-ssd
-          common
-          gaming
-          graphical-workstation
-
-          ./nixos/htpc.nix
-
-          {
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                linux-desktop-environment-config
-              ];
-            };
-          }
-        ];
-      };
-
-      steamdeck1 = nixpkgs-unstable.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-unstable-defaults
-
-          outputs.diskoConfigurations.unencrypted
-          hardware.nixosModules.common-pc-ssd
-          common
-          gaming
-          graphical-workstation
-          # plasma6
-
-          jovian.outputs.nixosModules.jovian
-
-          {
-            networking.hostName = "steamdeck1";
-            boot.loader.systemd-boot.enable = true;
-            boot.loader.efi.canTouchEfiVariables = true;
-            hardware.bluetooth.enable = true;
-            networking.networkmanager.enable = true;
-
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                firefox-no-tabs
-                linux-desktop-environment-config
-              ];
-            };
-          }
-        ];
-      };
-
-      foxtrot = nixpkgs-unstable.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-unstable-defaults
-
-          outputs.diskoConfigurations.foxtrot
-          hardware.nixosModules.framework-13-7040-amd
-
-          common
-          kde-connect
-          password-manager
-          graphical-workstation
-          # plasma6
-          # virtual-machines
-          # virtual-machines-gui
-          laptop
-          gaming
-          cross-compiler
-
-          ./nixos/foxtrot.nix
-
-          ({pkgs, ...}: {
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                senpai
-                iex
-                niri
-                cargo
-                firefox-no-tabs
-                linux-desktop-environment-config
-              ];
-            };
-            environment.systemPackages = with pkgs; [
-              fw-ectool
-              (writeShellApplication
-                {
-                  name = "reset-wifi-module";
-                  runtimeInputs = with pkgs; [kmod];
-                  text = ''
-                    modprobe -rv mt7921e
-                    modprobe -v mt7921e
-                  '';
-                })
-              (writeShellApplication
-                {
-                  name = "perfmode";
-                  # we use command -v $cmd here because we only want to invoke these calls _if_ the related package is installed on the system
-                  # otherwise, they will likely have no effect anyways
-                  text = ''
-                    command -v powerprofilesctl &>/dev/null && bash -x -c 'powerprofilesctl set balanced'
-                    command -v swaymsg &>/dev/null && bash -x -c 'swaymsg output eDP-1 mode 2880x1920@120Hz'
-                  '';
-                })
-              (writeShellApplication
-                {
-                  name = "battmode";
-                  text = ''
-                    command -v powerprofilesctl &>/dev/null && bash -x -c 'powerprofilesctl set power-saver'
-                    command -v swaymsg &>/dev/null && bash -x -c 'swaymsg output eDP-1 mode 2880x1920@60Hz'
-                  '';
-                })
-            ];
-          })
-        ];
-      };
-
-      thablet = nixpkgs-unstable.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-unstable-defaults
-          {
-            _module.args = {
-              disk = "nvme0n1";
-              esp = {
-                label = "ESP";
-                size = "4G";
-                name = "ESP";
-              };
-            };
-          }
-          outputs.diskoConfigurations.standard
-          hardware.nixosModules.lenovo-thinkpad-x1-yoga
-
-          common
-          password-manager
-          graphical-workstation
-          # plasma6
-          music-production
-          laptop
-          touchscreen
-          gaming
-
-          ./nixos/thablet.nix
-
-          {
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                senpai
-                iex
-                cargo
-                firefox-no-tabs
-                linux-desktop-environment-config
-                # slippi.homeManagerModules.default
-              ];
-            };
-          }
-        ];
-      };
-
-      /*
-      grablet = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          common
-
-          outputs.diskoConfigurations.standard
-          hardware.nixosModules.common-cpu-intel-kaby-lake
-          hardware.nixosModules.common-pc-laptopp-ssd
-          graphical-workstation
-          laptop
-          gaming
-
-          ./nixos/thablet.nix
-
-          {
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                iex
-                cargo
-                linux-desktop-environment-config
-              ];
-            };
-
-            powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
-          }
-        ];
-      };
-      */
-
-      thinker = nixpkgs-unstable.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-unstable-defaults
-
-          {
-            _module.args = {
-              disks = ["/dev/nvme0n1"];
-              swapSize = "32G";
-            };
-          }
-          outputs.diskoConfigurations.standard
-          hardware.nixosModules.lenovo-thinkpad-t480
-          hardware.nixosModules.common-pc-laptop-ssd
-
-          music-production
-          common
-          password-manager
-          graphical-workstation
-          # plasma6
-          laptop
-          gaming
-
-          ./nixos/thinker.nix
-
-          {
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                senpai
-                iex
-                cargo
-                firefox-no-tabs
-                linux-desktop-environment-config
-                slippi.homeManagerModules.default
-              ];
-            };
-          }
-        ];
-      };
-
-      musicbox = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-defaults
-
-          {
-            _module.args = {
-              disks = ["/dev/sda"];
-              # swapSize = "8G";
-            };
-            esp = {};
-          }
-          outputs.diskoConfigurations.unencrypted
-          hardware.nixosModules.common-pc-laptop-ssd
-
-          music-production
-          common
-          graphical-workstation
-          wifi
-
-          # ./nixos/musicbox.nix
-
-          {
-            boot.loader.systemd-boot.enable = true;
-            boot.loader.efi.canTouchEfiVariables = true;
-            hardware.bluetooth.enable = true;
-            networking.networkmanager.enable = true;
-
-            home-manager.users.daniel = {
-              imports = with homeManagerModules; [
-                firefox-no-tabs
-                linux-desktop-environment-config
-              ];
-            };
-          }
-        ];
-      };
-
-      rascal = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-defaults
-          hardware.nixosModules.common-cpu-amd
-          common
-          linux
-          ./nixos/rascal.nix
-        ];
-      };
-
-      router = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = with nixosModules; [
-          home-manager-defaults
-          common
-          linux
-          troubleshooting-tools
-
-          outputs.nixosModules.deno-netlify-ddns-client
-          {
-            services.deno-netlify-ddns-client = {
-              enable = true;
-              username = "router.h";
-              # TODO: ipv6
-              ipv6 = false;
-            };
-          }
-
-          /*
-          NOTE: maybe use this someday, but I think I need more concrete
-          networking knowledge before I know how to use it well. Additionally,
-          I can use my existing firewall configuration more easily if I manage
-          it directly.
-          nnf.nixosModules.default
-          */
-
-          ./nixos/router.nix
-        ];
-      };
-
-      # pinephone-image =
-      #   (import "${mobile-nixos}/lib/eval-with-configuration.nix" {
-      #     configuration = with nixosModules; [
-      #       linux
-      #       home-manager-defaults
-
-      #       # outputs.diskoConfigurations.unencrypted # can I even disko with an image-based installation?
-      #       common
-      #       wifi
-
-      #       # TODO: how do I get a minimally useful mobile environment?
-      #       # for me, this means an on-screen keyboard and suspend support I think?
-      #       # I can live in a tty if needed and graphical stuff can all evolve later
-      #       # not worried about modem
-      #       # maybe/hopefully I can pull in or define my own sxmo via nix?
-      #     ];
-      #     device = "pine64-pinephone";
-      #     pkgs = pkgsFor "aarch64-linux";
-      #   })
-      #   .outputs
-      #   .disk-image;
-
-      pinephone = let
-        inherit (nixpkgs-unstable) lib;
-      in
-        lib.nixosSystem {
-          system = "aarch64-linux";
-          # lib.nixosSystem {
-
-          modules = with nixosModules; [
-            {
-              imports = [
-                (import "${mobile-nixos}/lib/configuration.nix" {
-                  device = "pine64-pinephone";
-                })
-              ];
-
-              # nixpkgs.hostPlatform.system = "aarch64-linux";
-              nixpkgs.buildPlatform = "x86_64-linux";
-
-              # TODO: quirk: since the pinephone kernel doesn't seem to have "rpfilter" support, firewall ain't working
-              networking.firewall.enable = lib.mkForce false;
-
-              # TODO: quirk: since git send-email requires perl support, which we don't seem to have on the pinephone, we're just disabling git for now
-              # TODO: would likely be easier/better to somehow ignore the assertion? probably a way to do that...
-              programs.git.enable = lib.mkForce false;
-
-              # this option is conflicted, presumably due to some assumption in my defaults/common config
-              # the sd-image module we're importing above has this set to true, so we better go with that?
-              # that said, I think the mobile-nixos bootloader module has this set to false, so...
-              # TODO: what does this mean?
-              boot.loader.generic-extlinux-compatible.enable = lib.mkForce true;
-
-              # another conflicting option since I think I default to NetworkManager and this conflicts with networking.wireless.enable
-              networking.networkmanager.enable = lib.mkForce false;
-              networking.wireless.enable = lib.mkForce true;
-            }
-
-            # TODO: how do I build this as a .img to flash to an SD card?
-
-            # for testing, this seems to work `nixos-rebuild build --impure --flake .#pinephone`
-
-            # TODO: would like to use the mobile-nixos installer?
-            "${nixpkgs-unstable}/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix"
-
-            linux
-            home-manager-unstable-defaults
-
-            # outputs.diskoConfigurations.unencrypted # can I even disko with an image-based installation?
-            common
-            wifi
-
-            {
-              system.stateVersion = "24.11";
-            }
-
-            {
-              # nixpkgs.buildPlatform = "x86_64-linux";
-              # nixpkgs.hostPlatform = lib.systems.examples.aarch64-multiplatform;
-              # nixpkgs.localSystem.system = lib.systems.examples.x86_64-linux;
-              # nixpkgs.crossSystem = lib.mkForce null;
-            }
-          ];
-        };
+        {
+          services.kanidm.package = (unstable.pkgsFor system).kanidm;
+        }
+      ];
     };
 
+  htpc = nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-defaults
+
+      hardware.nixosModules.common-pc-ssd
+      common
+      gaming
+      graphical-workstation
+
+      ./nixos/htpc.nix
+
+      {
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            linux-desktop-environment-config
+          ];
+        };
+      }
+    ];
+  };
+
+  steamdeck1 = nixpkgs-unstable.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-unstable-defaults
+
+      outputs.diskoConfigurations.unencrypted
+      hardware.nixosModules.common-pc-ssd
+      common
+      gaming
+      graphical-workstation
+      # plasma6
+
+      jovian.outputs.nixosModules.jovian
+
+      {
+        networking.hostName = "steamdeck1";
+        boot.loader.systemd-boot.enable = true;
+        boot.loader.efi.canTouchEfiVariables = true;
+        hardware.bluetooth.enable = true;
+        networking.networkmanager.enable = true;
+
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            firefox-no-tabs
+            linux-desktop-environment-config
+          ];
+        };
+      }
+    ];
+  };
+
+  foxtrot = nixpkgs-unstable.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-unstable-defaults
+
+      outputs.diskoConfigurations.foxtrot
+      hardware.nixosModules.framework-13-7040-amd
+
+      common
+      kde-connect
+      password-manager
+      graphical-workstation
+      # plasma6
+      # virtual-machines
+      # virtual-machines-gui
+      laptop
+      gaming
+      cross-compiler
+
+      ./nixos/foxtrot.nix
+
+      (
+        { pkgs, ... }:
+        {
+          home-manager.users.daniel = {
+            imports = with homeManagerModules; [
+              senpai
+              iex
+              niri
+              cargo
+              firefox-no-tabs
+              linux-desktop-environment-config
+            ];
+          };
+          environment.systemPackages = with pkgs; [
+            fw-ectool
+            (writeShellApplication {
+              name = "reset-wifi-module";
+              runtimeInputs = with pkgs; [ kmod ];
+              text = ''
+                modprobe -rv mt7921e
+                modprobe -v mt7921e
+              '';
+            })
+            (writeShellApplication {
+              name = "perfmode";
+              # we use command -v $cmd here because we only want to invoke these calls _if_ the related package is installed on the system
+              # otherwise, they will likely have no effect anyways
+              text = ''
+                command -v powerprofilesctl &>/dev/null && bash -x -c 'powerprofilesctl set balanced'
+                command -v swaymsg &>/dev/null && bash -x -c 'swaymsg output eDP-1 mode 2880x1920@120Hz'
+              '';
+            })
+            (writeShellApplication {
+              name = "battmode";
+              text = ''
+                command -v powerprofilesctl &>/dev/null && bash -x -c 'powerprofilesctl set power-saver'
+                command -v swaymsg &>/dev/null && bash -x -c 'swaymsg output eDP-1 mode 2880x1920@60Hz'
+              '';
+            })
+          ];
+        }
+      )
+    ];
+  };
+
+  thablet = nixpkgs-unstable.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-unstable-defaults
+      {
+        _module.args = {
+          disk = "nvme0n1";
+          esp = {
+            label = "ESP";
+            size = "4G";
+            name = "ESP";
+          };
+        };
+      }
+      outputs.diskoConfigurations.standard
+      hardware.nixosModules.lenovo-thinkpad-x1-yoga
+
+      common
+      password-manager
+      graphical-workstation
+      # plasma6
+      music-production
+      laptop
+      touchscreen
+      gaming
+
+      ./nixos/thablet.nix
+
+      {
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            senpai
+            iex
+            cargo
+            firefox-no-tabs
+            linux-desktop-environment-config
+            # slippi.homeManagerModules.default
+          ];
+        };
+      }
+    ];
+  };
+
+  /*
+    grablet = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = with nixosModules; [
+        common
+
+        outputs.diskoConfigurations.standard
+        hardware.nixosModules.common-cpu-intel-kaby-lake
+        hardware.nixosModules.common-pc-laptopp-ssd
+        graphical-workstation
+        laptop
+        gaming
+
+        ./nixos/thablet.nix
+
+        {
+          home-manager.users.daniel = {
+            imports = with homeManagerModules; [
+              iex
+              cargo
+              linux-desktop-environment-config
+            ];
+          };
+
+          powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+        }
+      ];
+    };
+  */
+
+  thinker = nixpkgs-unstable.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-unstable-defaults
+
+      {
+        _module.args = {
+          disks = [ "/dev/nvme0n1" ];
+          swapSize = "32G";
+        };
+      }
+      outputs.diskoConfigurations.standard
+      hardware.nixosModules.lenovo-thinkpad-t480
+      hardware.nixosModules.common-pc-laptop-ssd
+
+      music-production
+      common
+      password-manager
+      graphical-workstation
+      # plasma6
+      laptop
+      gaming
+
+      ./nixos/thinker.nix
+
+      {
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            senpai
+            iex
+            cargo
+            firefox-no-tabs
+            linux-desktop-environment-config
+            slippi.homeManagerModules.default
+          ];
+        };
+      }
+    ];
+  };
+
+  musicbox = nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-defaults
+
+      {
+        _module.args = {
+          disks = [ "/dev/sda" ];
+          # swapSize = "8G";
+        };
+        esp = { };
+      }
+      outputs.diskoConfigurations.unencrypted
+      hardware.nixosModules.common-pc-laptop-ssd
+
+      music-production
+      common
+      graphical-workstation
+      wifi
+
+      # ./nixos/musicbox.nix
+
+      {
+        boot.loader.systemd-boot.enable = true;
+        boot.loader.efi.canTouchEfiVariables = true;
+        hardware.bluetooth.enable = true;
+        networking.networkmanager.enable = true;
+
+        home-manager.users.daniel = {
+          imports = with homeManagerModules; [
+            firefox-no-tabs
+            linux-desktop-environment-config
+          ];
+        };
+      }
+    ];
+  };
+
+  rascal = nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-defaults
+      hardware.nixosModules.common-cpu-amd
+      common
+      linux
+      ./nixos/rascal.nix
+    ];
+  };
+
+  router = nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = with nixosModules; [
+      home-manager-defaults
+      common
+      linux
+      troubleshooting-tools
+
+      outputs.nixosModules.deno-netlify-ddns-client
+      {
+        services.deno-netlify-ddns-client = {
+          enable = true;
+          username = "router.h";
+          # TODO: ipv6
+          ipv6 = false;
+        };
+      }
+
+      /*
+        NOTE: maybe use this someday, but I think I need more concrete
+        networking knowledge before I know how to use it well. Additionally,
+        I can use my existing firewall configuration more easily if I manage
+        it directly.
+        nnf.nixosModules.default
+      */
+
+      ./nixos/router.nix
+    ];
+  };
+
+  # pinephone-image =
+  #   (import "${mobile-nixos}/lib/eval-with-configuration.nix" {
+  #     configuration = with nixosModules; [
+  #       linux
+  #       home-manager-defaults
+
+  #       # outputs.diskoConfigurations.unencrypted # can I even disko with an image-based installation?
+  #       common
+  #       wifi
+
+  #       # TODO: how do I get a minimally useful mobile environment?
+  #       # for me, this means an on-screen keyboard and suspend support I think?
+  #       # I can live in a tty if needed and graphical stuff can all evolve later
+  #       # not worried about modem
+  #       # maybe/hopefully I can pull in or define my own sxmo via nix?
+  #     ];
+  #     device = "pine64-pinephone";
+  #     pkgs = pkgsFor "aarch64-linux";
+  #   })
+  #   .outputs
+  #   .disk-image;
+
+  pinephone =
+    let
+      inherit (nixpkgs-unstable) lib;
+    in
+    lib.nixosSystem {
+      system = "aarch64-linux";
+      # lib.nixosSystem {
+
+      modules = with nixosModules; [
+        {
+          imports = [
+            (import "${mobile-nixos}/lib/configuration.nix" {
+              device = "pine64-pinephone";
+            })
+          ];
+
+          # nixpkgs.hostPlatform.system = "aarch64-linux";
+          nixpkgs.buildPlatform = "x86_64-linux";
+
+          # TODO: quirk: since the pinephone kernel doesn't seem to have "rpfilter" support, firewall ain't working
+          networking.firewall.enable = lib.mkForce false;
+
+          # TODO: quirk: since git send-email requires perl support, which we don't seem to have on the pinephone, we're just disabling git for now
+          # TODO: would likely be easier/better to somehow ignore the assertion? probably a way to do that...
+          programs.git.enable = lib.mkForce false;
+
+          # this option is conflicted, presumably due to some assumption in my defaults/common config
+          # the sd-image module we're importing above has this set to true, so we better go with that?
+          # that said, I think the mobile-nixos bootloader module has this set to false, so...
+          # TODO: what does this mean?
+          boot.loader.generic-extlinux-compatible.enable = lib.mkForce true;
+
+          # another conflicting option since I think I default to NetworkManager and this conflicts with networking.wireless.enable
+          networking.networkmanager.enable = lib.mkForce false;
+          networking.wireless.enable = lib.mkForce true;
+        }
+
+        # TODO: how do I build this as a .img to flash to an SD card?
+
+        # for testing, this seems to work `nixos-rebuild build --impure --flake .#pinephone`
+
+        # TODO: would like to use the mobile-nixos installer?
+        "${nixpkgs-unstable}/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix"
+
+        linux
+        home-manager-unstable-defaults
+
+        # outputs.diskoConfigurations.unencrypted # can I even disko with an image-based installation?
+        common
+        wifi
+
+        {
+          system.stateVersion = "24.11";
+        }
+
+        {
+          # nixpkgs.buildPlatform = "x86_64-linux";
+          # nixpkgs.hostPlatform = lib.systems.examples.aarch64-multiplatform;
+          # nixpkgs.localSystem.system = lib.systems.examples.x86_64-linux;
+          # nixpkgs.crossSystem = lib.mkForce null;
+        }
+      ];
+    };
+}
diff --git a/nix/users.nix b/nix/users.nix
index 047f166..5ac05ab 100644
--- a/nix/users.nix
+++ b/nix/users.nix
@@ -1,8 +1,9 @@
 {
-  "deck" = let
-    system = "x86_64-linux";
-    pkgs = unstable.pkgsFor system;
-  in
+  "deck" =
+    let
+      system = "x86_64-linux";
+      pkgs = unstable.pkgsFor system;
+    in
     home-manager-unstable.lib.homeManagerConfiguration {
       inherit pkgs;
       modules = with homeManagerModules; [
diff --git a/packages/default.nix b/packages/default.nix
index f1a88c1..f0c820c 100644
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -1,6 +1,8 @@
-{pkgs, ...}: let
-  iosevkaLyteTerm = pkgs.callPackage ./iosevkaLyteTerm.nix {};
-in {
+{ pkgs, ... }:
+let
+  iosevkaLyteTerm = pkgs.callPackage ./iosevkaLyteTerm.nix { };
+in
+{
   inherit iosevkaLyteTerm;
 
   iosevkaLyteTermSubset = pkgs.callPackage ./iosevkaLyteTermSubset.nix {
diff --git a/packages/hosts/base.nix b/packages/hosts/base.nix
index 79fe271..411baac 100644
--- a/packages/hosts/base.nix
+++ b/packages/hosts/base.nix
@@ -2,7 +2,8 @@
   config,
   outputs,
   ...
-}: {
+}:
+{
   # a minimal, familiar setup that I can bootstrap atop
   imports = with outputs.nixosModules; [
     # may need to be tweaked based on the machine's paritioning scheme
diff --git a/packages/hosts/beefcake.nix b/packages/hosts/beefcake.nix
index 069bfab..32f3341 100644
--- a/packages/hosts/beefcake.nix
+++ b/packages/hosts/beefcake.nix
@@ -1,22 +1,23 @@
 /*
-if ur fans get loud:
+  if ur fans get loud:
 
-# enable manual fan control
-sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x01 0x00
+  # enable manual fan control
+  sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x01 0x00
 
-# set fan speed to last byte as decimal
-sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
+  # set fan speed to last byte as decimal
+  sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
 */
 {
   /*
-  inputs,
-  outputs,
+    inputs,
+    outputs,
   */
   lib,
   config,
   pkgs,
   ...
-}: {
+}:
+{
   system.stateVersion = "24.05";
   home-manager.users.daniel.home.stateVersion = "24.05";
   networking.hostName = "beefcake";
@@ -27,7 +28,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       networking.hostId = "541ede55";
       boot = {
         zfs = {
-          extraPools = ["zstorage"];
+          extraPools = [ "zstorage" ];
         };
         supportedFilesystems = {
           zfs = true;
@@ -36,9 +37,14 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           zfs = true;
         };
         # kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-        initrd.availableKernelModules = ["ehci_pci" "mpt3sas" "usbhid" "sd_mod"];
-        kernelModules = ["kvm-intel"];
-        kernelParams = ["nohibernate"];
+        initrd.availableKernelModules = [
+          "ehci_pci"
+          "mpt3sas"
+          "usbhid"
+          "sd_mod"
+        ];
+        kernelModules = [ "kvm-intel" ];
+        kernelParams = [ "nohibernate" ];
         loader.systemd-boot.enable = true;
         loader.efi.canTouchEfiVariables = true;
       };
@@ -51,15 +57,18 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       fileSystems."/boot" = {
         device = "/dev/disk/by-uuid/B6C4-7CF4";
         fsType = "vfat";
-        options = ["fmask=0022" "dmask=0022"];
+        options = [
+          "fmask=0022"
+          "dmask=0022"
+        ];
       };
 
       /*
-      # should be mounted by auto-import; see boot.zfs.extraPools
-      fileSystems."/storage" = {
-        device = "zstorage/storage";
-        fsType = "zfs";
-      };
+        # should be mounted by auto-import; see boot.zfs.extraPools
+        fileSystems."/storage" = {
+          device = "zstorage/storage";
+          fsType = "zfs";
+        };
       */
 
       fileSystems."/nix" = {
@@ -73,34 +82,38 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       # TODO: nfs with zfs?
       # services.nfs.server.enable = true;
     }
-    ({
-      options,
-      config,
-      ...
-    }: let
-      inherit (lib) mkOption types;
-    in {
-      options.services.restic.commonPaths = mkOption {
-        type = types.nullOr (types.listOf types.str);
-        default = [];
-        description = ''
-          Which paths to backup, in addition to ones specified via
-          `dynamicFilesFrom`.  If null or an empty array and
-          `dynamicFilesFrom` is also null, no backup command will be run.
-           This can be used to create a prune-only job.
-        '';
-        example = [
-          "/var/lib/postgresql"
-          "/home/user/backup"
-        ];
-      };
-    })
+    (
+      {
+        options,
+        config,
+        ...
+      }:
+      let
+        inherit (lib) mkOption types;
+      in
+      {
+        options.services.restic.commonPaths = mkOption {
+          type = types.nullOr (types.listOf types.str);
+          default = [ ];
+          description = ''
+            Which paths to backup, in addition to ones specified via
+            `dynamicFilesFrom`.  If null or an empty array and
+            `dynamicFilesFrom` is also null, no backup command will be run.
+             This can be used to create a prune-only job.
+          '';
+          example = [
+            "/var/lib/postgresql"
+            "/home/user/backup"
+          ];
+        };
+      }
+    )
     {
       # sops secrets config
       sops = {
         defaultSopsFile = ../secrets/beefcake/secrets.yml;
         age = {
-          sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+          sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
           keyFile = "/var/lib/sops-nix/key.txt";
           generateKey = true;
         };
@@ -108,7 +121,9 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
     }
     {
       sops.secrets = {
-        netlify-ddns-password = {mode = "0400";};
+        netlify-ddns-password = {
+          mode = "0400";
+        };
       };
       services.deno-netlify-ddns-client = {
         passwordFile = config.sops.secrets.netlify-ddns-password.path;
@@ -117,7 +132,9 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
     {
       # nix binary cache
       sops.secrets = {
-        nix-cache-priv-key = {mode = "0400";};
+        nix-cache-priv-key = {
+          mode = "0400";
+        };
       };
       services.nix-serve = {
         enable = true; # TODO: true
@@ -136,7 +153,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       # regularly build this flake so we have stuff in the cache
       # TODO: schedule this for nightly builds instead of intervals based on boot time
       systemd.timers."build-lytedev-flake" = {
-        wantedBy = ["timers.target"];
+        wantedBy = [ "timers.target" ];
         timerConfig = {
           OnBootSec = "30m"; # 30 minutes after booting
           OnUnitActiveSec = "1d"; # every day afterwards
@@ -166,7 +183,11 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           # build main laptop configuration
           nixos-rebuild build --flake git+https://git.lyte.dev/lytedev/nix.git#foxtrot --accept-flake-config
         '';
-        path = with pkgs; [openssh git nixos-rebuild];
+        path = with pkgs; [
+          openssh
+          git
+          nixos-rebuild
+        ];
         serviceConfig = {
           # TODO: mkdir -p...?
           WorkingDirectory = "/home/daniel/.home/.cache/nightly-flake-builds";
@@ -217,13 +238,16 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           reverse_proxy http://localhost:${toString config.services.headscale.port}
         '';
       };
-      networking.firewall.allowedUDPPorts = lib.mkIf config.services.headscale.enable [3478];
+      networking.firewall.allowedUDPPorts = lib.mkIf config.services.headscale.enable [ 3478 ];
     }
     {
-      services.restic.commonPaths = ["/var/lib/soju" "/var/lib/private/soju"];
+      services.restic.commonPaths = [
+        "/var/lib/soju"
+        "/var/lib/private/soju"
+      ];
       services.soju = {
         enable = true;
-        listen = ["irc+insecure://:6667"];
+        listen = [ "irc+insecure://:6667" ];
       };
       networking.firewall.allowedTCPPorts = [
         6667
@@ -236,7 +260,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         createHome = false;
         group = "nextcloud";
       };
-      users.groups.nextcloud = {};
+      users.groups.nextcloud = { };
       sops.secrets = {
         nextcloud-admin-password = {
           owner = "nextcloud";
@@ -259,7 +283,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         "/storage/nextcloud"
       ];
       services.postgresql = {
-        ensureDatabases = ["nextcloud"];
+        ensureDatabases = [ "nextcloud" ];
         ensureUsers = [
           {
             name = "nextcloud";
@@ -274,7 +298,13 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         extraAppsEnable = true;
         autoUpdateApps.enable = true;
         extraApps = with config.services.nextcloud.package.packages.apps; {
-          inherit calendar contacts notes onlyoffice tasks;
+          inherit
+            calendar
+            contacts
+            notes
+            onlyoffice
+            tasks
+            ;
         };
         package = pkgs.nextcloud28;
         home = "/storage/nextcloud";
@@ -311,10 +341,11 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         };
       };
 
-      services.caddy.virtualHosts."nextcloud.h.lyte.dev" = let
-        fpm-nextcloud-pool = config.services.phpfpm.pools.nextcloud;
-        root = config.services.nginx.virtualHosts.${config.services.nextcloud.hostName}.root;
-      in
+      services.caddy.virtualHosts."nextcloud.h.lyte.dev" =
+        let
+          fpm-nextcloud-pool = config.services.phpfpm.pools.nextcloud;
+          root = config.services.nginx.virtualHosts.${config.services.nextcloud.hostName}.root;
+        in
         lib.mkIf config.services.nextcloud.enable {
           extraConfig = ''
             encode zstd gzip
@@ -374,7 +405,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
     {
       # plausible
       services.postgresql = {
-        ensureDatabases = ["plausible"];
+        ensureDatabases = [ "plausible" ];
         ensureUsers = [
           {
             name = "plausible";
@@ -388,7 +419,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         group = "plausible";
       };
       users.extraGroups = {
-        "plausible" = {};
+        "plausible" = { };
       };
       services.plausible = {
         enable = true;
@@ -472,7 +503,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
     {
       # family storage
       users.extraGroups = {
-        "family" = {};
+        "family" = { };
       };
       systemd.tmpfiles.settings = {
         "10-family" = {
@@ -517,8 +548,8 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           };
         };
       };
-      users.groups.daniel.members = ["daniel"];
-      users.groups.nixadmin.members = ["daniel"];
+      users.groups.daniel.members = [ "daniel" ];
+      users.groups.nixadmin.members = [ "daniel" ];
       users.users.daniel = {
         extraGroups = [
           # "nixadmin" # write access to /etc/nixos/ files
@@ -536,7 +567,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       ];
 
       services.postgresql = {
-        ensureDatabases = ["daniel"];
+        ensureDatabases = [ "daniel" ];
         ensureUsers = [
           {
             name = "daniel";
@@ -593,26 +624,26 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         extraConfig = ''reverse_proxy :8096'';
       };
       /*
-      NOTE: this server's xeon chips DO NOT seem to support quicksync or graphics in general
-      but I can probably throw in a crappy GPU (or a big, cheap ebay GPU for ML
-      stuff, too?) and get good transcoding performance
+        NOTE: this server's xeon chips DO NOT seem to support quicksync or graphics in general
+        but I can probably throw in a crappy GPU (or a big, cheap ebay GPU for ML
+        stuff, too?) and get good transcoding performance
       */
 
       # jellyfin hardware encoding
       /*
-      hardware.graphics = {
-        enable = true;
-        extraPackages = with pkgs; [
-          intel-media-driver
-          vaapiIntel
-          vaapiVdpau
-          libvdpau-va-gl
-          intel-compute-runtime
-        ];
-      };
-      nixpkgs.config.packageOverrides = pkgs: {
-        vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
-      };
+        hardware.graphics = {
+          enable = true;
+          extraPackages = with pkgs; [
+            intel-media-driver
+            vaapiIntel
+            vaapiVdpau
+            libvdpau-va-gl
+            intel-compute-runtime
+          ];
+        };
+        nixpkgs.config.packageOverrides = pkgs: {
+          vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+        };
       */
     }
     {
@@ -637,31 +668,31 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         # https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
         # TODO: give the "daniel" user access to all databases
         /*
-        authentication = pkgs.lib.mkOverride 10 ''
-          #type database  user      auth-method    auth-options
-          local all       postgres  peer           map=superuser_map
-          local all       daniel    peer           map=superuser_map
-          local sameuser  all       peer           map=superuser_map
+          authentication = pkgs.lib.mkOverride 10 ''
+            #type database  user      auth-method    auth-options
+            local all       postgres  peer           map=superuser_map
+            local all       daniel    peer           map=superuser_map
+            local sameuser  all       peer           map=superuser_map
 
-          # lan ipv4
-          host  all       daniel    192.168.0.0/16 trust
-          host  all       daniel    10.0.0.0/24    trust
+            # lan ipv4
+            host  all       daniel    192.168.0.0/16 trust
+            host  all       daniel    10.0.0.0/24    trust
 
-          # tailnet ipv4
-          host  all       daniel    100.64.0.0/10 trust
-        '';
+            # tailnet ipv4
+            host  all       daniel    100.64.0.0/10 trust
+          '';
         */
 
         /*
-        identMap = ''
-          # map            system_user db_user
-          superuser_map    root        postgres
-          superuser_map    postgres    postgres
-          superuser_map    daniel      postgres
+          identMap = ''
+            # map            system_user db_user
+            superuser_map    root        postgres
+            superuser_map    postgres    postgres
+            superuser_map    daniel      postgres
 
-          # Let other names login as themselves
-          superuser_map    /^(.*)$     \1
-        '';
+            # Let other names login as themselves
+            superuser_map    /^(.*)$     \1
+          '';
         */
       };
 
@@ -680,7 +711,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       # friends
       users.users.ben = {
         isNormalUser = true;
-        packages = [pkgs.vim];
+        packages = [ pkgs.vim ];
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUfLZ+IX85p9355Po2zP1H2tAxiE0rE6IYb8Sf+eF9T ben@benhany.com"
         ];
@@ -688,14 +719,16 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
 
       users.users.alan = {
         isNormalUser = true;
-        packages = [pkgs.vim];
+        packages = [ pkgs.vim ];
         # openssh.authorizedKeys.keys = [];
       };
     }
     {
       # restic backups
       sops.secrets = {
-        restic-ssh-priv-key-benland = {mode = "0400";};
+        restic-ssh-priv-key-benland = {
+          mode = "0400";
+        };
         restic-rascal-passphrase = {
           mode = "0400";
         };
@@ -703,15 +736,15 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           mode = "0400";
         };
       };
-      users.groups.restic = {};
+      users.groups.restic = { };
       users.users.restic = {
         # used for other machines to backup to
         isSystemUser = true;
         createHome = true;
         home = "/storage/backups/restic";
         group = "restic";
-        extraGroups = ["sftponly"];
-        openssh.authorizedKeys.keys = [] ++ config.users.users.daniel.openssh.authorizedKeys.keys;
+        extraGroups = [ "sftponly" ];
+        openssh.authorizedKeys.keys = [ ] ++ config.users.users.daniel.openssh.authorizedKeys.keys;
       };
       services.openssh.extraConfig = ''
         Match Group sftponly
@@ -730,44 +763,41 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           };
         };
       };
-      services.restic.backups = let
-        # TODO: How do I set things up so that a compromised server doesn't have access to my backups so that it can corrupt or ransomware them?
-        defaults = {
-          passwordFile = config.sops.secrets.restic-rascal-passphrase.path;
-          paths =
-            config.services.restic.commonPaths
-            ++ [
+      services.restic.backups =
+        let
+          # TODO: How do I set things up so that a compromised server doesn't have access to my backups so that it can corrupt or ransomware them?
+          defaults = {
+            passwordFile = config.sops.secrets.restic-rascal-passphrase.path;
+            paths = config.services.restic.commonPaths ++ [
             ];
-          initialize = true;
-          exclude = [];
-          timerConfig = {
-            OnCalendar = ["04:45" "17:45"];
+            initialize = true;
+            exclude = [ ];
+            timerConfig = {
+              OnCalendar = [
+                "04:45"
+                "17:45"
+              ];
+            };
           };
-        };
-      in {
-        local =
-          defaults
-          // {
+        in
+        {
+          local = defaults // {
             repository = "/storage/backups/local";
           };
-        rascal =
-          defaults
-          // {
+          rascal = defaults // {
             extraOptions = [
               ''sftp.command="ssh beefcake@rascal.hare-cod.ts.net -i ${config.sops.secrets.restic-rascal-ssh-private-key.path} -s sftp"''
             ];
             repository = "sftp://beefcake@rascal.hare-cod.ts.net://storage/backups/beefcake";
           };
-        # TODO: add ruby?
-        benland =
-          defaults
-          // {
+          # TODO: add ruby?
+          benland = defaults // {
             extraOptions = [
               ''sftp.command="ssh daniel@n.benhaney.com -p 10022 -i ${config.sops.secrets.restic-ssh-priv-key-benland.path} -s sftp"''
             ];
             repository = "sftp://daniel@n.benhaney.com://storage/backups/beefcake";
           };
-      };
+        };
     }
     {
       systemd.tmpfiles.settings = {
@@ -813,28 +843,28 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         # acmeCA = "https://acme-staging-v02.api.letsencrypt.org/directory";
       };
     }
-    ({...}: let
-      theme = pkgs.fetchzip {
-        url = "https://github.com/catppuccin/gitea/releases/download/v1.0.1/catppuccin-gitea.tar.gz";
-        sha256 = "sha256-et5luA3SI7iOcEIQ3CVIu0+eiLs8C/8mOitYlWQa/uI=";
-      };
-      logos = {
-        png = pkgs.fetchurl {
-          url = "https://lyte.dev/icon.png";
-          sha256 = "sha256-o/iZDohzXBGbpJ2PR1z23IF4FZignTAK88QwrfgTwlk=";
+    (
+      { ... }:
+      let
+        theme = pkgs.fetchzip {
+          url = "https://github.com/catppuccin/gitea/releases/download/v1.0.1/catppuccin-gitea.tar.gz";
+          sha256 = "sha256-et5luA3SI7iOcEIQ3CVIu0+eiLs8C/8mOitYlWQa/uI=";
         };
-        svg = pkgs.fetchurl {
-          url = "https://lyte.dev/img/logo.svg";
-          sha256 = "sha256-G9leVXNanoaCizXJaXn++JzaVcYOgRc3dJKhTQsMhVs=";
+        logos = {
+          png = pkgs.fetchurl {
+            url = "https://lyte.dev/icon.png";
+            sha256 = "sha256-o/iZDohzXBGbpJ2PR1z23IF4FZignTAK88QwrfgTwlk=";
+          };
+          svg = pkgs.fetchurl {
+            url = "https://lyte.dev/img/logo.svg";
+            sha256 = "sha256-G9leVXNanoaCizXJaXn++JzaVcYOgRc3dJKhTQsMhVs=";
+          };
+          svg-with-background = pkgs.fetchurl {
+            url = "https://lyte.dev/img/logo-with-background.svg";
+            sha256 = "sha256-CdMTRXoQ3AI76aHW/sTqvZo1q/0XQdnQs9V1vGmiffY=";
+          };
         };
-        svg-with-background = pkgs.fetchurl {
-          url = "https://lyte.dev/img/logo-with-background.svg";
-          sha256 = "sha256-CdMTRXoQ3AI76aHW/sTqvZo1q/0XQdnQs9V1vGmiffY=";
-        };
-      };
-      forgejoCustomCss =
-        pkgs.writeText "iosevkalyte.css"
-        ''
+        forgejoCustomCss = pkgs.writeText "iosevkalyte.css" ''
           @font-face {
             font-family: ldiosevka;
             font-style: normal;
@@ -862,15 +892,11 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
             --fonts-monospace: ldiosevka, ui-monospace, SFMono-Regular, "SF Mono", Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace, var(--fonts-emoji);
           }
         '';
-      forgejoCustomHeaderTmpl =
-        pkgs.writeText "header.tmpl"
-        ''
+        forgejoCustomHeaderTmpl = pkgs.writeText "header.tmpl" ''
           <link rel="stylesheet" href="/assets/css/iosevkalyte.css" />
           <script async="" defer="" data-domain="git.lyte.dev" src="https://a.lyte.dev/js/script.js"></script>
         '';
-      forgejoCustomHomeTmpl =
-        pkgs.writeText "home.tmpl"
-        ''
+        forgejoCustomHomeTmpl = pkgs.writeText "home.tmpl" ''
           {{template "base/head" .}}
           <div role="main" aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="page-content home">
           	<div class="tw-mb-8 tw-px-8">
@@ -923,153 +949,157 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           </div>
           {{template "base/footer" .}}
         '';
-    in {
-      # systemd.tmpfiles.settings = {
-      #   "10-forgejo" = {
-      #     "/storage/forgejo" = {
-      #       "d" = {
-      #         mode = "0700";
-      #         user = "forgejo";
-      #         group = "nogroup";
-      #       };
-      #     };
-      #   };
-      # };
-      services.forgejo = {
-        enable = true;
-        package = pkgs.unstable-packages.forgejo;
-        stateDir = "/storage/forgejo";
-        settings = {
-          DEFAULT = {
-            APP_NAME = "git.lyte.dev";
-          };
-          server = {
-            ROOT_URL = "https://git.lyte.dev";
-            HTTP_ADDR = "127.0.0.1";
-            HTTP_PORT = 3088;
-            DOMAIN = "git.lyte.dev";
-          };
-          migrations = {
-            ALLOWED_DOMAINS = "*.github.com,github.com,gitlab.com,*.gitlab.com";
-          };
-          actions = {
-            ENABLED = true;
-          };
-          service = {
-            DISABLE_REGISTRATION = true;
-          };
-          session = {
-            COOKIE_SECURE = true;
-          };
-          log = {
-            # LEVEL = "Debug";
-          };
-          ui = {
-            THEMES = "catppuccin-mocha-sapphire,forgejo-auto,forgejo-light,forgejo-dark";
-            DEFAULT_THEME = "catppuccin-mocha-sapphire";
-          };
-          indexer = {
-            REPO_INDEXER_ENABLED = "true";
-            REPO_INDEXER_PATH = "indexers/repos.bleve";
-            MAX_FILE_SIZE = "1048576";
-            # REPO_INDEXER_INCLUDE =
-            REPO_INDEXER_EXCLUDE = "resources/bin/**";
-          };
-          "markup.asciidoc" = {
-            ENABLED = true;
-            NEED_POSTPROCESS = true;
-            FILE_EXTENSIONS = ".adoc,.asciidoc";
-            RENDER_COMMAND = "${pkgs.asciidoctor}/bin/asciidoctor --embedded --safe-mode=secure --out-file=- -";
-            IS_INPUT_FILE = false;
-          };
-        };
-        lfs = {
+      in
+      {
+        # systemd.tmpfiles.settings = {
+        #   "10-forgejo" = {
+        #     "/storage/forgejo" = {
+        #       "d" = {
+        #         mode = "0700";
+        #         user = "forgejo";
+        #         group = "nogroup";
+        #       };
+        #     };
+        #   };
+        # };
+        services.forgejo = {
           enable = true;
-        };
-        dump = {
-          enable = false;
-        };
-        database = {
-          # TODO: move to postgres?
-          type = "sqlite3";
-        };
-      };
-      services.restic.commonPaths = [
-        config.services.forgejo.stateDir
-      ];
-      sops.secrets = {
-        "forgejo-runner.env" = {mode = "0400";};
-      };
-      systemd.services.gitea-runner-beefcake.after = ["sops-nix.service"];
-
-      systemd.services.forgejo = {
-        preStart = lib.mkAfter ''
-          rm -rf ${config.services.forgejo.stateDir}/custom/public
-          mkdir -p ${config.services.forgejo.stateDir}/custom/public/
-          mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/
-          mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/img/
-          mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/css/
-          mkdir -p ${config.services.forgejo.stateDir}/custom/templates/custom/
-          ln -sf ${logos.png} ${config.services.forgejo.stateDir}/custom/public/assets/img/logo.png
-          ln -sf ${logos.svg} ${config.services.forgejo.stateDir}/custom/public/assets/img/logo.svg
-          ln -sf ${logos.png} ${config.services.forgejo.stateDir}/custom/public/assets/img/favicon.png
-          ln -sf ${logos.svg-with-background} ${config.services.forgejo.stateDir}/custom/public/assets/img/favicon.svg
-          ln -sf ${theme}/theme-catppuccin-mocha-sapphire.css ${config.services.forgejo.stateDir}/custom/public/assets/css/
-          ln -sf ${forgejoCustomCss} ${config.services.forgejo.stateDir}/custom/public/assets/css/iosevkalyte.css
-          ln -sf ${forgejoCustomHeaderTmpl} ${config.services.forgejo.stateDir}/custom/templates/custom/header.tmpl
-          ln -sf ${forgejoCustomHomeTmpl} ${config.services.forgejo.stateDir}/custom/templates/home.tmpl
-        '';
-      };
-
-      services.gitea-actions-runner = {
-        # TODO: simple git-based automation would be dope? maybe especially for
-        # mirroring to github super easy?
-        package = pkgs.forgejo-runner;
-        instances."beefcake" = {
-          enable = true;
-          name = "beefcake";
-          url = "https://git.lyte.dev";
+          package = pkgs.unstable-packages.forgejo;
+          stateDir = "/storage/forgejo";
           settings = {
-            container = {
-              # use the shared network which is bridged by default
-              # this lets us hit git.lyte.dev just fine
-              network = "podman";
+            DEFAULT = {
+              APP_NAME = "git.lyte.dev";
+            };
+            server = {
+              ROOT_URL = "https://git.lyte.dev";
+              HTTP_ADDR = "127.0.0.1";
+              HTTP_PORT = 3088;
+              DOMAIN = "git.lyte.dev";
+            };
+            migrations = {
+              ALLOWED_DOMAINS = "*.github.com,github.com,gitlab.com,*.gitlab.com";
+            };
+            actions = {
+              ENABLED = true;
+            };
+            service = {
+              DISABLE_REGISTRATION = true;
+            };
+            session = {
+              COOKIE_SECURE = true;
+            };
+            log = {
+              # LEVEL = "Debug";
+            };
+            ui = {
+              THEMES = "catppuccin-mocha-sapphire,forgejo-auto,forgejo-light,forgejo-dark";
+              DEFAULT_THEME = "catppuccin-mocha-sapphire";
+            };
+            indexer = {
+              REPO_INDEXER_ENABLED = "true";
+              REPO_INDEXER_PATH = "indexers/repos.bleve";
+              MAX_FILE_SIZE = "1048576";
+              # REPO_INDEXER_INCLUDE =
+              REPO_INDEXER_EXCLUDE = "resources/bin/**";
+            };
+            "markup.asciidoc" = {
+              ENABLED = true;
+              NEED_POSTPROCESS = true;
+              FILE_EXTENSIONS = ".adoc,.asciidoc";
+              RENDER_COMMAND = "${pkgs.asciidoctor}/bin/asciidoctor --embedded --safe-mode=secure --out-file=- -";
+              IS_INPUT_FILE = false;
             };
           };
-          labels = [
-            # type ":host" does not depend on docker/podman/lxc
-            "podman"
-            "nix:docker://git.lyte.dev/lytedev/nix:latest"
-            "beefcake:host"
-            "nixos-host:host"
-          ];
-          tokenFile = config.sops.secrets."forgejo-runner.env".path;
-          hostPackages = with pkgs; [
-            nix
-            bash
-            coreutils
-            curl
-            gawk
-            gitMinimal
-            gnused
-            nodejs
-            gnutar # needed for cache action
-            wget
-          ];
+          lfs = {
+            enable = true;
+          };
+          dump = {
+            enable = false;
+          };
+          database = {
+            # TODO: move to postgres?
+            type = "sqlite3";
+          };
         };
-      };
-      # environment.systemPackages = with pkgs; [nodejs];
-      services.caddy.virtualHosts."git.lyte.dev" = {
-        extraConfig = ''
-          reverse_proxy :${toString config.services.forgejo.settings.server.HTTP_PORT}
-        '';
-      };
-      services.caddy.virtualHosts."http://git.beefcake.lan" = {
-        extraConfig = ''
-          reverse_proxy :${toString config.services.forgejo.settings.server.HTTP_PORT}
-        '';
-      };
-    })
+        services.restic.commonPaths = [
+          config.services.forgejo.stateDir
+        ];
+        sops.secrets = {
+          "forgejo-runner.env" = {
+            mode = "0400";
+          };
+        };
+        systemd.services.gitea-runner-beefcake.after = [ "sops-nix.service" ];
+
+        systemd.services.forgejo = {
+          preStart = lib.mkAfter ''
+            rm -rf ${config.services.forgejo.stateDir}/custom/public
+            mkdir -p ${config.services.forgejo.stateDir}/custom/public/
+            mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/
+            mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/img/
+            mkdir -p ${config.services.forgejo.stateDir}/custom/public/assets/css/
+            mkdir -p ${config.services.forgejo.stateDir}/custom/templates/custom/
+            ln -sf ${logos.png} ${config.services.forgejo.stateDir}/custom/public/assets/img/logo.png
+            ln -sf ${logos.svg} ${config.services.forgejo.stateDir}/custom/public/assets/img/logo.svg
+            ln -sf ${logos.png} ${config.services.forgejo.stateDir}/custom/public/assets/img/favicon.png
+            ln -sf ${logos.svg-with-background} ${config.services.forgejo.stateDir}/custom/public/assets/img/favicon.svg
+            ln -sf ${theme}/theme-catppuccin-mocha-sapphire.css ${config.services.forgejo.stateDir}/custom/public/assets/css/
+            ln -sf ${forgejoCustomCss} ${config.services.forgejo.stateDir}/custom/public/assets/css/iosevkalyte.css
+            ln -sf ${forgejoCustomHeaderTmpl} ${config.services.forgejo.stateDir}/custom/templates/custom/header.tmpl
+            ln -sf ${forgejoCustomHomeTmpl} ${config.services.forgejo.stateDir}/custom/templates/home.tmpl
+          '';
+        };
+
+        services.gitea-actions-runner = {
+          # TODO: simple git-based automation would be dope? maybe especially for
+          # mirroring to github super easy?
+          package = pkgs.forgejo-runner;
+          instances."beefcake" = {
+            enable = true;
+            name = "beefcake";
+            url = "https://git.lyte.dev";
+            settings = {
+              container = {
+                # use the shared network which is bridged by default
+                # this lets us hit git.lyte.dev just fine
+                network = "podman";
+              };
+            };
+            labels = [
+              # type ":host" does not depend on docker/podman/lxc
+              "podman"
+              "nix:docker://git.lyte.dev/lytedev/nix:latest"
+              "beefcake:host"
+              "nixos-host:host"
+            ];
+            tokenFile = config.sops.secrets."forgejo-runner.env".path;
+            hostPackages = with pkgs; [
+              nix
+              bash
+              coreutils
+              curl
+              gawk
+              gitMinimal
+              gnused
+              nodejs
+              gnutar # needed for cache action
+              wget
+            ];
+          };
+        };
+        # environment.systemPackages = with pkgs; [nodejs];
+        services.caddy.virtualHosts."git.lyte.dev" = {
+          extraConfig = ''
+            reverse_proxy :${toString config.services.forgejo.settings.server.HTTP_PORT}
+          '';
+        };
+        services.caddy.virtualHosts."http://git.beefcake.lan" = {
+          extraConfig = ''
+            reverse_proxy :${toString config.services.forgejo.settings.server.HTTP_PORT}
+          '';
+        };
+      }
+    )
     {
       services.restic.commonPaths = [
         config.services.vaultwarden.backupDir
@@ -1083,9 +1113,9 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           ROCKET_ADDRESS = "127.0.0.1";
           ROCKET_PORT = 8222;
           /*
-          TODO: smtp setup?
-          right now, I think I configured this manually by temporarily setting ADMIN_TOKEN
-          and then configuring in https://bw.lyte.dev/admin
+            TODO: smtp setup?
+            right now, I think I configured this manually by temporarily setting ADMIN_TOKEN
+            and then configuring in https://bw.lyte.dev/admin
           */
         };
       };
@@ -1100,10 +1130,10 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         group = "atuin";
       };
       users.extraGroups = {
-        "atuin" = {};
+        "atuin" = { };
       };
       services.postgresql = {
-        ensureDatabases = ["atuin"];
+        ensureDatabases = [ "atuin" ];
         ensureUsers = [
           {
             name = "atuin";
@@ -1132,396 +1162,414 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
     {
       # jland minecraft server
       /*
-        users.groups.jland = {
-          gid = 982;
-        };
-        users.users.jland = {
-          uid = 986;
+          users.groups.jland = {
+            gid = 982;
+          };
+          users.users.jland = {
+            uid = 986;
+            isSystemUser = true;
+            createHome = false;
+            group = "jland";
+          };
+          virtualisation.oci-containers.containers.minecraft-jland = {
+            autoStart = false;
+
+            # sending commands: https://docker-minecraft-server.readthedocs.io/en/latest/commands/
+            image = "docker.io/itzg/minecraft-server";
+            # user = "${toString config.users.users.jland.uid}:${toString config.users.groups.jland.gid}";
+            extraOptions = [
+              "--tty"
+              "--interactive"
+            ];
+            environment = {
+              EULA = "true";
+              ## UID = toString config.users.users.jland.uid;
+              ## GID = toString config.users.groups.jland.gid;
+              STOP_SERVER_ANNOUNCE_DELAY = "20";
+              TZ = "America/Chicago";
+              VERSION = "1.20.1";
+              MEMORY = "8G";
+              MAX_MEMORY = "16G";
+              TYPE = "FORGE";
+              FORGE_VERSION = "47.1.3";
+              ALLOW_FLIGHT = "true";
+              ENABLE_QUERY = "true";
+
+              MODPACK = "/data/origination-files/Server-Files-0.2.14.zip";
+
+              ## TYPE = "AUTO_CURSEFORGE";
+              ## CF_SLUG = "monumental-experience";
+              ## CF_FILE_ID = "4826863"; # 2.2.53
+
+              ## due to
+              ## Nov 02 13:45:22 beefcake minecraft-jland[2738672]: me.itzg.helpers.errors.GenericException: The modpack authors have indicated this file is not allowed for project distribution. Please download the client zip file from https://www.curseforge.com/minecraft/modpacks/monumental-experience and pass via CF_MODPACK_ZIP environment variable or place indownloads repo directory.
+              ## we must upload manually
+              ## CF_MODPACK_ZIP = "/data/origination-files/Monumental+Experience-2.2.53.zip";
+
+              ## ENABLE_AUTOPAUSE = "true"; # TODO: must increate or disable max-tick-time
+              ## May also have mod/loader incompatibilities?
+              ## https://docker-minecraft-server.readthedocs.io/en/latest/misc/autopause-autostop/autopause/
+            };
+            environmentFiles = [
+              # config.sops.secrets."jland.env".path
+            ];
+            ports = ["26965:25565"];
+            volumes = [
+              "/storage/jland/data:/data"
+              "/storage/jland/worlds:/worlds"
+            ];
+          };
+          networking.firewall.allowedTCPPorts = [
+            26965
+          ];
+        }
+        {
+          # dawncraft minecraft server
+          systemd.tmpfiles.rules = [
+            "d /storage/dawncraft/ 0770 1000 1000 -"
+            "d /storage/dawncraft/data/ 0770 1000 1000 -"
+            "d /storage/dawncraft/worlds/ 0770 1000 1000 -"
+            "d /storage/dawncraft/downloads/ 0770 1000 1000 -"
+          ];
+          virtualisation.oci-containers.containers.minecraft-dawncraft = {
+            autoStart = false;
+
+            # sending commands: https://docker-minecraft-server.readthedocs.io/en/latest/commands/
+            image = "docker.io/itzg/minecraft-server";
+            extraOptions = [
+              "--tty"
+              "--interactive"
+            ];
+            environment = {
+              EULA = "true";
+
+              STOP_SERVER_ANNOUNCE_DELAY = "20";
+              TZ = "America/Chicago";
+              VERSION = "1.18.2";
+              MEMORY = "8G";
+              MAX_MEMORY = "32G";
+
+              ALLOW_FLIGHT = "true";
+              ENABLE_QUERY = "true";
+              SERVER_PORT = "26968";
+              QUERY_PORT = "26968";
+
+              TYPE = "AUTO_CURSEFORGE";
+              CF_SLUG = "dawn-craft";
+
+              CF_EXCLUDE_MODS = "368398";
+              CF_FORCE_SYNCHRONIZE = "true";
+              # CF_FILE_ID = "5247696"; # 2.0.7 server
+            };
+            environmentFiles = [
+              config.sops.secrets."dawncraft.env".path
+            ];
+            ports = ["26968:26968/tcp" "26968:26968/udp"];
+            volumes = [
+              "/storage/dawncraft/data:/data"
+              "/storage/dawncraft/worlds:/worlds"
+              "/storage/dawncraft/downloads:/downloads"
+            ];
+          };
+          networking.firewall.allowedTCPPorts = [
+            26968
+          ];
+      */
+    }
+    (
+      { ... }:
+      let
+        port = 26969;
+        dir = "/storage/flanilla";
+        user = "flanilla";
+      in
+      # uid = config.users.users.flanilla.uid;
+      # gid = config.users.groups.flanilla.gid;
+      {
+        # flanilla family minecraft server
+        users.groups.${user} = { };
+        users.users.${user} = {
           isSystemUser = true;
           createHome = false;
-          group = "jland";
+          home = dir;
+          group = user;
         };
-        virtualisation.oci-containers.containers.minecraft-jland = {
+        virtualisation.oci-containers.containers.minecraft-flanilla = {
           autoStart = false;
 
-          # sending commands: https://docker-minecraft-server.readthedocs.io/en/latest/commands/
-          image = "docker.io/itzg/minecraft-server";
-          # user = "${toString config.users.users.jland.uid}:${toString config.users.groups.jland.gid}";
-          extraOptions = [
-            "--tty"
-            "--interactive"
-          ];
-          environment = {
-            EULA = "true";
-            ## UID = toString config.users.users.jland.uid;
-            ## GID = toString config.users.groups.jland.gid;
-            STOP_SERVER_ANNOUNCE_DELAY = "20";
-            TZ = "America/Chicago";
-            VERSION = "1.20.1";
-            MEMORY = "8G";
-            MAX_MEMORY = "16G";
-            TYPE = "FORGE";
-            FORGE_VERSION = "47.1.3";
-            ALLOW_FLIGHT = "true";
-            ENABLE_QUERY = "true";
-
-            MODPACK = "/data/origination-files/Server-Files-0.2.14.zip";
-
-            ## TYPE = "AUTO_CURSEFORGE";
-            ## CF_SLUG = "monumental-experience";
-            ## CF_FILE_ID = "4826863"; # 2.2.53
-
-            ## due to
-            ## Nov 02 13:45:22 beefcake minecraft-jland[2738672]: me.itzg.helpers.errors.GenericException: The modpack authors have indicated this file is not allowed for project distribution. Please download the client zip file from https://www.curseforge.com/minecraft/modpacks/monumental-experience and pass via CF_MODPACK_ZIP environment variable or place indownloads repo directory.
-            ## we must upload manually
-            ## CF_MODPACK_ZIP = "/data/origination-files/Monumental+Experience-2.2.53.zip";
-
-            ## ENABLE_AUTOPAUSE = "true"; # TODO: must increate or disable max-tick-time
-            ## May also have mod/loader incompatibilities?
-            ## https://docker-minecraft-server.readthedocs.io/en/latest/misc/autopause-autostop/autopause/
-          };
           environmentFiles = [
             # config.sops.secrets."jland.env".path
           ];
-          ports = ["26965:25565"];
-          volumes = [
-            "/storage/jland/data:/data"
-            "/storage/jland/worlds:/worlds"
-          ];
-        };
-        networking.firewall.allowedTCPPorts = [
-          26965
-        ];
-      }
-      {
-        # dawncraft minecraft server
-        systemd.tmpfiles.rules = [
-          "d /storage/dawncraft/ 0770 1000 1000 -"
-          "d /storage/dawncraft/data/ 0770 1000 1000 -"
-          "d /storage/dawncraft/worlds/ 0770 1000 1000 -"
-          "d /storage/dawncraft/downloads/ 0770 1000 1000 -"
-        ];
-        virtualisation.oci-containers.containers.minecraft-dawncraft = {
-          autoStart = false;
-
-          # sending commands: https://docker-minecraft-server.readthedocs.io/en/latest/commands/
           image = "docker.io/itzg/minecraft-server";
+          # user = "${toString uid}:${toString gid}";
           extraOptions = [
             "--tty"
             "--interactive"
           ];
           environment = {
             EULA = "true";
-
+            MOTD = "Flanilla Survival! Happy hunting!";
+            # UID = toString uid;
+            # GID = toString gid;
             STOP_SERVER_ANNOUNCE_DELAY = "20";
             TZ = "America/Chicago";
-            VERSION = "1.18.2";
+            VERSION = "1.21";
+            OPS = "lytedev";
+            MODE = "survival";
+            DIFFICULTY = "easy";
+            ONLINE_MODE = "false";
             MEMORY = "8G";
-            MAX_MEMORY = "32G";
-
+            MAX_MEMORY = "16G";
             ALLOW_FLIGHT = "true";
             ENABLE_QUERY = "true";
-            SERVER_PORT = "26968";
-            QUERY_PORT = "26968";
-
-            TYPE = "AUTO_CURSEFORGE";
-            CF_SLUG = "dawn-craft";
-
-            CF_EXCLUDE_MODS = "368398";
-            CF_FORCE_SYNCHRONIZE = "true";
-            # CF_FILE_ID = "5247696"; # 2.0.7 server
+            ENABLE_COMMAND_BLOCK = "true";
           };
-          environmentFiles = [
-            config.sops.secrets."dawncraft.env".path
-          ];
-          ports = ["26968:26968/tcp" "26968:26968/udp"];
+          ports = [ "${toString port}:25565" ];
+
           volumes = [
-            "/storage/dawncraft/data:/data"
-            "/storage/dawncraft/worlds:/worlds"
-            "/storage/dawncraft/downloads:/downloads"
+            "${dir}/data:/data"
+            "${dir}/worlds:/worlds"
           ];
         };
+        systemd.services.podman-minecraft-flanilla.serviceConfig = {
+          User = user;
+          Group = user;
+        };
+        systemd.tmpfiles.settings = {
+          "10-${user}-survival" = {
+            "${dir}/data" = {
+              "d" = {
+                mode = "0770";
+                user = user;
+                group = user;
+              };
+            };
+            "${dir}/worlds" = {
+              "d" = {
+                mode = "0770";
+                user = user;
+                group = user;
+              };
+            };
+          };
+        };
+        services.restic.commonPaths = [ dir ];
         networking.firewall.allowedTCPPorts = [
-          26968
+          port
         ];
-      */
-    }
-    ({...}: let
-      port = 26969;
-      dir = "/storage/flanilla";
-      user = "flanilla";
+      }
+    )
+    (
+      { ... }:
+      let
+        port = 26968;
+        dir = "/storage/flanilla-creative";
+        user = "flanilla";
+      in
       # uid = config.users.users.flanilla.uid;
       # gid = config.users.groups.flanilla.gid;
-    in {
-      # flanilla family minecraft server
-      users.groups.${user} = {};
-      users.users.${user} = {
-        isSystemUser = true;
-        createHome = false;
-        home = dir;
-        group = user;
-      };
-      virtualisation.oci-containers.containers.minecraft-flanilla = {
-        autoStart = false;
+      {
+        # flanilla family minecraft server
+        users.groups.${user} = { };
+        users.users.${user} = {
+          isSystemUser = true;
+          createHome = false;
+          home = lib.mkForce dir;
+          group = user;
+        };
+        virtualisation.oci-containers.containers.minecraft-flanilla-creative = {
+          autoStart = true;
+          image = "docker.io/itzg/minecraft-server";
+          # user = "${toString uid}:${toString gid}";
+          extraOptions = [
+            "--tty"
+            "--interactive"
+          ];
+          environment = {
+            EULA = "true";
+            MOTD = "Flanilla Creative! Have fun building!";
+            # UID = toString uid;
+            # GID = toString gid;
+            STOP_SERVER_ANNOUNCE_DELAY = "20";
+            TZ = "America/Chicago";
+            VERSION = "1.21";
+            OPS = "lytedev";
+            MODE = "creative";
+            DIFFICULTY = "peaceful";
+            ONLINE_MODE = "false";
+            MEMORY = "8G";
+            MAX_MEMORY = "16G";
+            ALLOW_FLIGHT = "true";
+            ENABLE_QUERY = "true";
+            ENABLE_COMMAND_BLOCK = "true";
+          };
+          ports = [ "${toString port}:25565" ];
 
-        environmentFiles = [
-          # config.sops.secrets."jland.env".path
+          volumes = [
+            "${dir}/data:/data"
+            "${dir}/worlds:/worlds"
+          ];
+        };
+        # systemd.services.podman-minecraft-flanilla-creative.serviceConfig = {
+        #   User = user;
+        #   Group = user;
+        # };
+        systemd.tmpfiles.settings = {
+          "10-${user}-creative" = {
+            "${dir}/data" = {
+              "d" = {
+                mode = "0770";
+                user = user;
+                group = user;
+              };
+            };
+            "${dir}/worlds" = {
+              "d" = {
+                mode = "0770";
+                user = user;
+                group = user;
+              };
+            };
+          };
+        };
+        services.restic.commonPaths = [ dir ];
+        networking.firewall.allowedTCPPorts = [
+          port
         ];
-        image = "docker.io/itzg/minecraft-server";
-        # user = "${toString uid}:${toString gid}";
-        extraOptions = ["--tty" "--interactive"];
-        environment = {
-          EULA = "true";
-          MOTD = "Flanilla Survival! Happy hunting!";
-          # UID = toString uid;
-          # GID = toString gid;
-          STOP_SERVER_ANNOUNCE_DELAY = "20";
-          TZ = "America/Chicago";
-          VERSION = "1.21";
-          OPS = "lytedev";
-          MODE = "survival";
-          DIFFICULTY = "easy";
-          ONLINE_MODE = "false";
-          MEMORY = "8G";
-          MAX_MEMORY = "16G";
-          ALLOW_FLIGHT = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_COMMAND_BLOCK = "true";
-        };
-        ports = ["${toString port}:25565"];
-
-        volumes = [
-          "${dir}/data:/data"
-          "${dir}/worlds:/worlds"
-        ];
-      };
-      systemd.services.podman-minecraft-flanilla.serviceConfig = {
-        User = user;
-        Group = user;
-      };
-      systemd.tmpfiles.settings = {
-        "10-${user}-survival" = {
-          "${dir}/data" = {
-            "d" = {
-              mode = "0770";
-              user = user;
-              group = user;
-            };
-          };
-          "${dir}/worlds" = {
-            "d" = {
-              mode = "0770";
-              user = user;
-              group = user;
-            };
-          };
-        };
-      };
-      services.restic.commonPaths = [dir];
-      networking.firewall.allowedTCPPorts = [
-        port
-      ];
-    })
-    ({...}: let
-      port = 26968;
-      dir = "/storage/flanilla-creative";
-      user = "flanilla";
-      # uid = config.users.users.flanilla.uid;
-      # gid = config.users.groups.flanilla.gid;
-    in {
-      # flanilla family minecraft server
-      users.groups.${user} = {};
-      users.users.${user} = {
-        isSystemUser = true;
-        createHome = false;
-        home = lib.mkForce dir;
-        group = user;
-      };
-      virtualisation.oci-containers.containers.minecraft-flanilla-creative = {
-        autoStart = true;
-        image = "docker.io/itzg/minecraft-server";
-        # user = "${toString uid}:${toString gid}";
-        extraOptions = ["--tty" "--interactive"];
-        environment = {
-          EULA = "true";
-          MOTD = "Flanilla Creative! Have fun building!";
-          # UID = toString uid;
-          # GID = toString gid;
-          STOP_SERVER_ANNOUNCE_DELAY = "20";
-          TZ = "America/Chicago";
-          VERSION = "1.21";
-          OPS = "lytedev";
-          MODE = "creative";
-          DIFFICULTY = "peaceful";
-          ONLINE_MODE = "false";
-          MEMORY = "8G";
-          MAX_MEMORY = "16G";
-          ALLOW_FLIGHT = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_COMMAND_BLOCK = "true";
-        };
-        ports = ["${toString port}:25565"];
-
-        volumes = [
-          "${dir}/data:/data"
-          "${dir}/worlds:/worlds"
-        ];
-      };
-      # systemd.services.podman-minecraft-flanilla-creative.serviceConfig = {
-      #   User = user;
-      #   Group = user;
-      # };
-      systemd.tmpfiles.settings = {
-        "10-${user}-creative" = {
-          "${dir}/data" = {
-            "d" = {
-              mode = "0770";
-              user = user;
-              group = user;
-            };
-          };
-          "${dir}/worlds" = {
-            "d" = {
-              mode = "0770";
-              user = user;
-              group = user;
-            };
-          };
-        };
-      };
-      services.restic.commonPaths = [dir];
-      networking.firewall.allowedTCPPorts = [
-        port
-      ];
-    })
-    ({
-      config,
-      options,
-      ...
-    }: let
-      domain = "idm.h.lyte.dev";
-      name = "kanidm";
-      user = name;
-      group = name;
-      storage = "/storage/${name}";
-    in {
-      # kanidm
-      config = {
-        # reload certs from caddy every 5 minutes
-        # TODO: ideally some kind of file watcher service would make way more sense here?
-        # or we could simply setup the permissions properly somehow?
-        systemd.timers."copy-kanidm-certificates-from-caddy" = {
-          wantedBy = ["timers.target"];
-          timerConfig = {
-            OnBootSec = "10m"; # 10 minutes after booting
-            OnUnitActiveSec = "5m"; # every 5 minutes afterwards
-            Unit = "copy-kanidm-certificates-from-caddy.service";
-          };
-        };
-
-        systemd.services."copy-kanidm-certificates-from-caddy" = {
-          # get the certificates that caddy provisions for us
-          script = ''
-            umask 077
-            # this line should be unnecessary now that we have this in tmpfiles
-            install -d -m 0700 -o "${name}" -g "${name}" "${storage}/data" "${storage}/certs"
-            cd /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev
-            install -m 0700 -o "${name}" -g "${name}" idm.h.lyte.dev.key idm.h.lyte.dev.crt "${storage}/certs"
-          '';
-          path = with pkgs; [rsync];
-          serviceConfig = {
-            Type = "oneshot";
-            User = "root";
-          };
-        };
-
-        systemd.tmpfiles.settings."10-kanidm" = {
-          "${config.services.kanidm.serverSettings.online_backup.path}".d = {
-            user = name;
-            group = name;
-            mode = "0700";
-          };
-          "${storage}/data".d = {
-            inherit user group;
-            mode = "0700";
-          };
-          "${storage}/certs".d = {
-            inherit user group;
-            mode = "0700";
-          };
-        };
-
-        services.kanidm = {
-          enableServer = true;
-          serverSettings = {
-            inherit domain;
-            origin = "https://${domain}";
-            bindaddress = "127.0.0.1:8443";
-            tls_chain = "${storage}/certs/idm.h.lyte.dev.crt";
-            tls_key = "${storage}/certs/idm.h.lyte.dev.key";
-            log_level = "info";
-            online_backup = {
-              path = "${storage}/backups/";
-              schedule = "00 22 * * *";
-              versions = 50;
+      }
+    )
+    (
+      {
+        config,
+        options,
+        ...
+      }:
+      let
+        domain = "idm.h.lyte.dev";
+        name = "kanidm";
+        user = name;
+        group = name;
+        storage = "/storage/${name}";
+      in
+      {
+        # kanidm
+        config = {
+          # reload certs from caddy every 5 minutes
+          # TODO: ideally some kind of file watcher service would make way more sense here?
+          # or we could simply setup the permissions properly somehow?
+          systemd.timers."copy-kanidm-certificates-from-caddy" = {
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "10m"; # 10 minutes after booting
+              OnUnitActiveSec = "5m"; # every 5 minutes afterwards
+              Unit = "copy-kanidm-certificates-from-caddy.service";
             };
           };
 
-          enablePam = false;
-          unixSettings = {
-            # pam_allowed_login_groups = [];
+          systemd.services."copy-kanidm-certificates-from-caddy" = {
+            # get the certificates that caddy provisions for us
+            script = ''
+              umask 077
+              # this line should be unnecessary now that we have this in tmpfiles
+              install -d -m 0700 -o "${name}" -g "${name}" "${storage}/data" "${storage}/certs"
+              cd /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev
+              install -m 0700 -o "${name}" -g "${name}" idm.h.lyte.dev.key idm.h.lyte.dev.crt "${storage}/certs"
+            '';
+            path = with pkgs; [ rsync ];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "root";
+            };
           };
 
-          enableClient = true;
-          clientSettings = {
-            uri = "https://idm.h.lyte.dev";
+          systemd.tmpfiles.settings."10-kanidm" = {
+            "${config.services.kanidm.serverSettings.online_backup.path}".d = {
+              user = name;
+              group = name;
+              mode = "0700";
+            };
+            "${storage}/data".d = {
+              inherit user group;
+              mode = "0700";
+            };
+            "${storage}/certs".d = {
+              inherit user group;
+              mode = "0700";
+            };
           };
 
-          provision = {
-            # enable = true;
-            # instanceUrl = "https://${domain}";
-            # adminPasswordFile = config.sops.secrets.kanidm-admin-password-file.path
-            # idmAdminPasswordFile = config.sops.secrets.kanidm-admin-password-file.path
-            # autoRemove = true;
-            # groups = {
-            #   myGroup = {
-            #     members = ["myUser" /* ...*/];
-            #   }
-            # };
-            # persons = {
-            #   myUser = {
-            #     displayName = "display name";
-            #     legalName = "My User";
-            #     mailAddresses = ["myuser@example.com"];
-            #     groups = ["myGroup"];
-            #   }
-            # };
-            # systems = {
-            #   oauth2 = {
-            #     mySystem = {
-            #       enableLegacyCrypto = false;
-            #       enableLocalhostRedirects = true; # only for public
-            #       allowInsecureClientDisablePkce = false;
-            #       basicSecretFile = config.sops.secrets.basic-secret-file...
-            #       claimMap = {};
-            #     };
-            #   };
-            # };
+          services.kanidm = {
+            enableServer = true;
+            serverSettings = {
+              inherit domain;
+              origin = "https://${domain}";
+              bindaddress = "127.0.0.1:8443";
+              tls_chain = "${storage}/certs/idm.h.lyte.dev.crt";
+              tls_key = "${storage}/certs/idm.h.lyte.dev.key";
+              log_level = "info";
+              online_backup = {
+                path = "${storage}/backups/";
+                schedule = "00 22 * * *";
+                versions = 50;
+              };
+            };
+
+            enablePam = false;
+            unixSettings = {
+              # pam_allowed_login_groups = [];
+            };
+
+            enableClient = true;
+            clientSettings = {
+              uri = "https://idm.h.lyte.dev";
+            };
+
+            provision = {
+              # enable = true;
+              # instanceUrl = "https://${domain}";
+              # adminPasswordFile = config.sops.secrets.kanidm-admin-password-file.path
+              # idmAdminPasswordFile = config.sops.secrets.kanidm-admin-password-file.path
+              # autoRemove = true;
+              # groups = {
+              #   myGroup = {
+              #     members = ["myUser" /* ...*/];
+              #   }
+              # };
+              # persons = {
+              #   myUser = {
+              #     displayName = "display name";
+              #     legalName = "My User";
+              #     mailAddresses = ["myuser@example.com"];
+              #     groups = ["myGroup"];
+              #   }
+              # };
+              # systems = {
+              #   oauth2 = {
+              #     mySystem = {
+              #       enableLegacyCrypto = false;
+              #       enableLocalhostRedirects = true; # only for public
+              #       allowInsecureClientDisablePkce = false;
+              #       basicSecretFile = config.sops.secrets.basic-secret-file...
+              #       claimMap = {};
+              #     };
+              #   };
+              # };
+            };
+          };
+
+          services.caddy.virtualHosts."idm.h.lyte.dev" = {
+            extraConfig = ''reverse_proxy https://idm.h.lyte.dev:8443'';
+          };
+
+          networking = {
+            extraHosts = ''
+              ::1 idm.h.lyte.dev
+              127.0.0.1 idm.h.lyte.dev
+            '';
           };
         };
-
-        services.caddy.virtualHosts."idm.h.lyte.dev" = {
-          extraConfig = ''reverse_proxy https://idm.h.lyte.dev:8443'';
-        };
-
-        networking = {
-          extraHosts = ''
-            ::1 idm.h.lyte.dev
-            127.0.0.1 idm.h.lyte.dev
-          '';
-        };
-      };
-    })
+      }
+    )
     {
       systemd.tmpfiles.settings = {
         "10-audiobookshelf" = {
@@ -1548,7 +1596,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
           };
         };
       };
-      users.groups.audiobookshelf = {};
+      users.groups.audiobookshelf = { };
       users.users.audiobookshelf = {
         isSystemUser = true;
         group = "audiobookshelf";
@@ -1584,13 +1632,25 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
             job_name = "beefcake";
             static_configs = [
               {
-                targets = let inherit (config.services.prometheus.exporters.node) port listenAddress; in ["${listenAddress}:${toString port}"];
+                targets =
+                  let
+                    inherit (config.services.prometheus.exporters.node) port listenAddress;
+                  in
+                  [ "${listenAddress}:${toString port}" ];
               }
               {
-                targets = let inherit (config.services.prometheus.exporters.zfs) port listenAddress; in ["${listenAddress}:${toString port}"];
+                targets =
+                  let
+                    inherit (config.services.prometheus.exporters.zfs) port listenAddress;
+                  in
+                  [ "${listenAddress}:${toString port}" ];
               }
               {
-                targets = let inherit (config.services.prometheus.exporters.postgres) port listenAddress; in ["${listenAddress}:${toString port}"];
+                targets =
+                  let
+                    inherit (config.services.prometheus.exporters.postgres) port listenAddress;
+                  in
+                  [ "${listenAddress}:${toString port}" ];
               }
             ];
           }
@@ -1615,15 +1675,15 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         };
       };
       /*
-      TODO: promtail?
-      idrac exporter?
-      restic exporter?
-      smartctl exporter?
-      systemd exporter?
-      NOTE: we probably don't want this exposed
-      services.caddy.virtualHosts."prometheus.h.lyte.dev" = {
-        extraConfig = ''reverse_proxy :${toString config.services.prometheus.port}'';
-      };
+        TODO: promtail?
+        idrac exporter?
+        restic exporter?
+        smartctl exporter?
+        systemd exporter?
+        NOTE: we probably don't want this exposed
+        services.caddy.virtualHosts."prometheus.h.lyte.dev" = {
+          extraConfig = ''reverse_proxy :${toString config.services.prometheus.port}'';
+        };
       */
     }
     {
@@ -1754,8 +1814,8 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         containers.actual = {
           image = "ghcr.io/actualbudget/actual-server:25.2.1";
           autoStart = true;
-          ports = ["5006:5006"];
-          volumes = ["/storage/actual:/data"];
+          ports = [ "5006:5006" ];
+          volumes = [ "/storage/actual:/data" ];
         };
       };
 
@@ -1769,7 +1829,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         package = pkgs.factorio-headless.override {
           versionsJson = ./factorio-versions.json;
         };
-        admins = ["lytedev"];
+        admins = [ "lytedev" ];
         autosave-interval = 5;
         game-name = "Flanwheel Online";
         description = "Space Age 2.0";
@@ -1783,52 +1843,58 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         extraSettingsFile = config.sops.secrets.factorio-server-settings.path;
       };
       sops.secrets = {
-        factorio-server-settings = {mode = "0777";};
-      };
-    }
-    ({
-      pkgs,
-      config,
-      ...
-    }: let
-      port = builtins.head config.services.conduwuit.settings.global.port;
-      sPort = toString port;
-    in {
-      sops.secrets.matrix-registration-token-file.mode = "0400";
-      services.conduwuit = {
-        enable = true;
-        settings = {
-          global = {
-            allow_check_for_updates = true;
-            allow_federation = false;
-            registration_token_file = config.sops.secrets.matrix-registration-token-file.path;
-            server_name = "lyte.dev";
-          };
+        factorio-server-settings = {
+          mode = "0777";
         };
       };
-      services.caddy.virtualHosts."matrix.lyte.dev".extraConfig = ''
-        reverse_proxy /_matrix/* :${sPort}
-        reverse_proxy /_synapse/client/* :${sPort}
-      '';
-      services.caddy.virtualHosts."lyte.dev:8448".extraConfig = ''
-        reverse_proxy /_matrix/* :${sPort}
-      '';
-      # TODO: backups
-      # TODO: reverse proxy
-    })
+    }
+    (
+      {
+        pkgs,
+        config,
+        ...
+      }:
+      let
+        port = builtins.head config.services.conduwuit.settings.global.port;
+        sPort = toString port;
+      in
+      {
+        sops.secrets.matrix-registration-token-file.mode = "0400";
+        services.conduwuit = {
+          enable = true;
+          settings = {
+            global = {
+              allow_check_for_updates = true;
+              allow_federation = false;
+              registration_token_file = config.sops.secrets.matrix-registration-token-file.path;
+              server_name = "lyte.dev";
+            };
+          };
+        };
+        services.caddy.virtualHosts."matrix.lyte.dev".extraConfig = ''
+          reverse_proxy /_matrix/* :${sPort}
+          reverse_proxy /_synapse/client/* :${sPort}
+        '';
+        services.caddy.virtualHosts."lyte.dev:8448".extraConfig = ''
+          reverse_proxy /_matrix/* :${sPort}
+        '';
+        # TODO: backups
+        # TODO: reverse proxy
+      }
+    )
   ];
 
   /*
-  TODO: non-root processes and services that access secrets need to be part of
-  the 'keys' group
+    TODO: non-root processes and services that access secrets need to be part of
+    the 'keys' group
 
-  systemd.services.some-service = {
-    serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
-  };
-  or
-  users.users.example-user.extraGroups = [ config.users.groups.keys.name ];
+    systemd.services.some-service = {
+      serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
+    };
+    or
+    users.users.example-user.extraGroups = [ config.users.groups.keys.name ];
 
-  TODO: declarative directory quotas? for storage/$USER and /home/$USER
+    TODO: declarative directory quotas? for storage/$USER and /home/$USER
   */
 
   environment.systemPackages = with pkgs; [
@@ -1846,34 +1912,34 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
   services.tailscale.useRoutingFeatures = "server";
 
   /*
-  # https://github.com/NixOS/nixpkgs/blob/04af42f3b31dba0ef742d254456dc4c14eedac86/nixos/modules/services/misc/lidarr.nix#L72
-  services.lidarr = {
-    enable = true;
-    dataDir = "/storage/lidarr";
-  };
+    # https://github.com/NixOS/nixpkgs/blob/04af42f3b31dba0ef742d254456dc4c14eedac86/nixos/modules/services/misc/lidarr.nix#L72
+    services.lidarr = {
+      enable = true;
+      dataDir = "/storage/lidarr";
+    };
 
-  services.radarr = {
-    enable = true;
-    dataDir = "/storage/radarr";
-  };
+    services.radarr = {
+      enable = true;
+      dataDir = "/storage/radarr";
+    };
 
-  services.sonarr = {
-    enable = true;
-    dataDir = "/storage/sonarr";
-  };
+    services.sonarr = {
+      enable = true;
+      dataDir = "/storage/sonarr";
+    };
 
-  services.bazarr = {
-    enable = true;
-    listenPort = 6767;
-  };
+    services.bazarr = {
+      enable = true;
+      listenPort = 6767;
+    };
 
-  networking.firewall.allowedTCPPorts = [9876 9877];
-  networking.firewall.allowedUDPPorts = [9876 9877];
-  networking.firewall.allowedUDPPortRanges = [
-    {
-      from = 27000;
-      to = 27100;
-    }
-  ];
+    networking.firewall.allowedTCPPorts = [9876 9877];
+    networking.firewall.allowedUDPPorts = [9876 9877];
+    networking.firewall.allowedUDPPortRanges = [
+      {
+        from = 27000;
+        to = 27100;
+      }
+    ];
   */
 }
diff --git a/packages/hosts/bigtower.nix b/packages/hosts/bigtower.nix
index 8ad667a..df77948 100644
--- a/packages/hosts/bigtower.nix
+++ b/packages/hosts/bigtower.nix
@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   system.stateVersion = "24.05";
   home-manager.users.daniel.home.stateVersion = "24.05";
   networking.hostName = "bigtower";
@@ -14,22 +15,25 @@
       fileSystems."/" = {
         device = "/dev/disk/by-uuid/5b6c2d65-2704-4ed1-b06d-5ee7110b3d28";
         fsType = "btrfs";
-        options = ["subvol=root"];
+        options = [ "subvol=root" ];
       };
       fileSystems."/nix" = {
         device = "/dev/disk/by-uuid/5b6c2d65-2704-4ed1-b06d-5ee7110b3d28";
         fsType = "btrfs";
-        options = ["subvol=nix"];
+        options = [ "subvol=nix" ];
       };
       fileSystems."/home" = {
         device = "/dev/disk/by-uuid/5b6c2d65-2704-4ed1-b06d-5ee7110b3d28";
         fsType = "btrfs";
-        options = ["subvol=home"];
+        options = [ "subvol=home" ];
       };
       fileSystems."/boot" = {
         device = "/dev/disk/by-uuid/CE80-4623";
         fsType = "vfat";
-        options = ["fmask=0022" "dmask=0022"];
+        options = [
+          "fmask=0022"
+          "dmask=0022"
+        ];
       };
     }
   ];
@@ -43,9 +47,14 @@
     # kernelPackages = pkgs.linuxPackages_zen;
     loader.efi.canTouchEfiVariables = true;
     loader.systemd-boot.enable = true;
-    initrd.availableKernelModules = ["xhci_pci" "nvme" "ahci" "usbhid"];
-    kernelModules = ["kvm-amd"];
-    supportedFilesystems = ["ntfs"];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "nvme"
+      "ahci"
+      "usbhid"
+    ];
+    kernelModules = [ "kvm-amd" ];
+    supportedFilesystems = [ "ntfs" ];
   };
 
   hardware.bluetooth = {
diff --git a/packages/hosts/default.nix b/packages/hosts/default.nix
index 0e2dd15..c3df17b 100644
--- a/packages/hosts/default.nix
+++ b/packages/hosts/default.nix
@@ -8,170 +8,187 @@
   nixpkgs-unstable,
   home-manager-unstable,
   ...
-}: let
-  baseHost = {
-    nixpkgs,
-    home-manager,
-    ...
-  }: (path: ({system ? "x86_64-linux"}: (nixpkgs.lib.nixosSystem {
-    inherit system;
-    modules = [
-      ({
-        config,
-        lib,
-        pkgs,
-        modulesPath,
-        ...
-      }: {
-        imports = with self.outputs.nixosModules; [
-          (modulesPath + "/installer/scan/not-detected.nix")
-          home-manager.nixosModules.home-manager
-          sops-nix.nixosModules.sops
-          disko.nixosModules.disko
-          deno-netlify-ddns-client
-          shell-defaults-and-applications
-          wifi
-          printing
-          podman
-          virtual-machines
-          postgres
-          gaming
-          gnome
-          daniel
-          root
-        ];
-
-        config = {
-          lyte.shell.enable = lib.mkDefault true;
-          nixpkgs.config.allowUnfree = lib.mkDefault true;
-
-          sops = {
-            age = {
-              sshKeyPaths = lib.mkDefault ["/etc/ssh/ssh_host_ed25519_key"];
-              keyFile = lib.mkDefault "/var/lib/sops-nix/key.txt";
-              generateKey = lib.mkDefault true;
-            };
-          };
-
-          nix = {
-            nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry;
-            registry = lib.mapAttrs (_: value: {flake = value;}) self.inputs;
-
-            settings =
+}:
+let
+  baseHost =
+    {
+      nixpkgs,
+      home-manager,
+      ...
+    }:
+    (
+      path:
+      (
+        {
+          system ? "x86_64-linux",
+        }:
+        (nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [
+            (
               {
-                trusted-users = lib.mkDefault ["@wheel"];
-                extra-experimental-features = lib.mkDefault ["nix-command" "flakes"];
-                auto-optimise-store = lib.mkDefault true;
+                config,
+                lib,
+                pkgs,
+                modulesPath,
+                ...
+              }:
+              {
+                imports = with self.outputs.nixosModules; [
+                  (modulesPath + "/installer/scan/not-detected.nix")
+                  home-manager.nixosModules.home-manager
+                  sops-nix.nixosModules.sops
+                  disko.nixosModules.disko
+                  deno-netlify-ddns-client
+                  shell-defaults-and-applications
+                  wifi
+                  printing
+                  podman
+                  virtual-machines
+                  postgres
+                  gaming
+                  gnome
+                  daniel
+                  root
+                ];
+
+                config = {
+                  lyte.shell.enable = lib.mkDefault true;
+                  nixpkgs.config.allowUnfree = lib.mkDefault true;
+
+                  sops = {
+                    age = {
+                      sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
+                      keyFile = lib.mkDefault "/var/lib/sops-nix/key.txt";
+                      generateKey = lib.mkDefault true;
+                    };
+                  };
+
+                  nix = {
+                    nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry;
+                    registry = lib.mapAttrs (_: value: { flake = value; }) self.inputs;
+
+                    settings = {
+                      trusted-users = lib.mkDefault [ "@wheel" ];
+                      extra-experimental-features = lib.mkDefault [
+                        "nix-command"
+                        "flakes"
+                      ];
+                      auto-optimise-store = lib.mkDefault true;
+                    } // self.nixConfig;
+                  };
+
+                  systemd.services.nix-daemon.environment.TMPDIR = lib.mkDefault "/var/tmp"; # TODO: why did I do this again?
+                  boot.tmp.cleanOnBoot = lib.mkDefault true;
+                  programs.gnupg.agent.enable = lib.mkDefault true;
+                  time.timeZone = lib.mkDefault "America/Chicago";
+                  i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
+                  hardware.enableRedistributableFirmware = lib.mkDefault true;
+
+                  home-manager.useGlobalPkgs = lib.mkDefault true;
+                  home-manager.backupFileExtension = lib.mkDefault "hm-backup";
+
+                  users.users.root = {
+                    openssh.authorizedKeys.keys = lib.mkDefault [ self.constants.pubkey ];
+                  };
+
+                  services = {
+                    openssh = {
+                      enable = lib.mkDefault true;
+
+                      settings = {
+                        PasswordAuthentication = lib.mkDefault false;
+                        KbdInteractiveAuthentication = lib.mkDefault false;
+                        PermitRootLogin = lib.mkForce "prohibit-password";
+                      };
+
+                      openFirewall = lib.mkDefault true;
+
+                      /*
+                        listenAddresses = [
+                          { addr = "0.0.0.0"; port = 22; }
+                        ];
+                      */
+                    };
+                    avahi = {
+                      enable = lib.mkDefault true;
+                      reflector = lib.mkDefault true;
+                      openFirewall = lib.mkDefault true;
+                      nssmdns4 = lib.mkDefault true;
+                    };
+                    tailscale = {
+                      enable = lib.mkDefault true;
+                      useRoutingFeatures = lib.mkDefault "client";
+                    };
+                    journald.extraConfig = lib.mkDefault "SystemMaxUse=1G";
+                    xserver.xkb = {
+                      layout = lib.mkDefault "us";
+
+                      # have the caps-lock key instead be a ctrl key
+                      options = lib.mkDefault "ctrl:nocaps";
+                    };
+                    smartd.enable = lib.mkDefault true;
+                    fwupd.enable = lib.mkDefault true;
+                  };
+
+                  console = {
+                    useXkbConfig = lib.mkDefault true;
+                    earlySetup = lib.mkDefault true;
+
+                    colors =
+                      with self.constants.style.colors;
+                      lib.mkDefault [
+                        bg
+                        red
+                        green
+                        orange
+                        blue
+                        purple
+                        yellow
+                        fg3
+                        fgdim
+                        red
+                        green
+                        orange
+                        blue
+                        purple
+                        yellow
+                        fg
+                      ];
+                  };
+
+                  networking = {
+                    hostName = lib.mkDefault "set-a-hostname-dingus";
+
+                    useDHCP = lib.mkDefault true;
+                    firewall = {
+                      enable = lib.mkDefault true;
+                      allowPing = lib.mkDefault true;
+                    };
+                  };
+                };
               }
-              // self.nixConfig;
-          };
+            )
 
-          systemd.services.nix-daemon.environment.TMPDIR = lib.mkDefault "/var/tmp"; # TODO: why did I do this again?
-          boot.tmp.cleanOnBoot = lib.mkDefault true;
-          programs.gnupg.agent.enable = lib.mkDefault true;
-          time.timeZone = lib.mkDefault "America/Chicago";
-          i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
-          hardware.enableRedistributableFirmware = lib.mkDefault true;
-
-          home-manager.useGlobalPkgs = lib.mkDefault true;
-          home-manager.backupFileExtension = lib.mkDefault "hm-backup";
-
-          users.users.root = {
-            openssh.authorizedKeys.keys = lib.mkDefault [self.constants.pubkey];
-          };
-
-          services = {
-            openssh = {
-              enable = lib.mkDefault true;
-
-              settings = {
-                PasswordAuthentication = lib.mkDefault false;
-                KbdInteractiveAuthentication = lib.mkDefault false;
-                PermitRootLogin = lib.mkForce "prohibit-password";
+            {
+              _module.args = {
+                hardware = hardware.outputs.nixosModules;
+                diskoConfigurations = self.outputs.diskoConfigurations;
               };
-
-              openFirewall = lib.mkDefault true;
-
-              /*
-              listenAddresses = [
-                { addr = "0.0.0.0"; port = 22; }
-              ];
-              */
-            };
-            avahi = {
-              enable = lib.mkDefault true;
-              reflector = lib.mkDefault true;
-              openFirewall = lib.mkDefault true;
-              nssmdns4 = lib.mkDefault true;
-            };
-            tailscale = {
-              enable = lib.mkDefault true;
-              useRoutingFeatures = lib.mkDefault "client";
-            };
-            journald.extraConfig = lib.mkDefault "SystemMaxUse=1G";
-            xserver.xkb = {
-              layout = lib.mkDefault "us";
-
-              # have the caps-lock key instead be a ctrl key
-              options = lib.mkDefault "ctrl:nocaps";
-            };
-            smartd.enable = lib.mkDefault true;
-            fwupd.enable = lib.mkDefault true;
-          };
-
-          console = {
-            useXkbConfig = lib.mkDefault true;
-            earlySetup = lib.mkDefault true;
-
-            colors = with self.constants.style.colors;
-              lib.mkDefault [
-                bg
-                red
-                green
-                orange
-                blue
-                purple
-                yellow
-                fg3
-                fgdim
-                red
-                green
-                orange
-                blue
-                purple
-                yellow
-                fg
-              ];
-          };
-
-          networking = {
-            hostName = lib.mkDefault "set-a-hostname-dingus";
-
-            useDHCP = lib.mkDefault true;
-            firewall = {
-              enable = lib.mkDefault true;
-              allowPing = lib.mkDefault true;
-            };
-          };
-        };
-      })
-
-      {
-        _module.args = {
-          hardware = hardware.outputs.nixosModules;
-          diskoConfigurations = self.outputs.diskoConfigurations;
-        };
-      }
-      (import path)
-    ];
-  })));
-  stableHost = baseHost {inherit nixpkgs home-manager;};
+            }
+            (import path)
+          ];
+        })
+      )
+    );
+  stableHost = baseHost { inherit nixpkgs home-manager; };
   host = baseHost {
     nixpkgs = nixpkgs-unstable;
     home-manager = home-manager-unstable;
   };
-in {
-  beefcake = stableHost ./beefcake.nix {};
-  dragon = host ./dragon.nix {};
-  arm-dragon = host ./dragon.nix {system = "aarch64-linux";};
+in
+{
+  beefcake = stableHost ./beefcake.nix { };
+  dragon = host ./dragon.nix { };
+  arm-dragon = host ./dragon.nix { system = "aarch64-linux"; };
 }
diff --git a/packages/hosts/dragon.nix b/packages/hosts/dragon.nix
index 37a3580..4d416d1 100644
--- a/packages/hosts/dragon.nix
+++ b/packages/hosts/dragon.nix
@@ -5,7 +5,8 @@
   hardware,
   diskoConfigurations,
   ...
-}: {
+}:
+{
   system.stateVersion = "24.11";
   home-manager.users.daniel.home.stateVersion = "24.11";
   networking.hostName = "dragon";
@@ -14,19 +15,26 @@
     kernelPackages = pkgs.linuxPackages_latest;
     loader.efi.canTouchEfiVariables = true;
     loader.systemd-boot.enable = true;
-    initrd.availableKernelModules = ["xhci_pci" "nvme" "ahci" "usbhid"];
-    kernelModules = ["kvm-amd"];
-    supportedFilesystems = ["ntfs"];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "nvme"
+      "ahci"
+      "usbhid"
+    ];
+    kernelModules = [ "kvm-amd" ];
+    supportedFilesystems = [ "ntfs" ];
   };
 
   imports = with hardware; [
-    (diskoConfigurations.unencrypted {disk = "/dev/nvme0n1";})
+    (diskoConfigurations.unencrypted { disk = "/dev/nvme0n1"; })
     common-cpu-amd
     common-gpu-amd
     common-pc-ssd
   ];
 
-  sops.secrets.ddns-pass = {mode = "0400";};
+  sops.secrets.ddns-pass = {
+    mode = "0400";
+  };
   services.deno-netlify-ddns-client = {
     passwordFile = config.sops.secrets.ddns-pass.path;
     enable = true;
diff --git a/packages/hosts/foxtrot.nix b/packages/hosts/foxtrot.nix
index 0e2dbcf..2d959d5 100644
--- a/packages/hosts/foxtrot.nix
+++ b/packages/hosts/foxtrot.nix
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   imports = [
     {
       system.stateVersion = "24.11";
@@ -10,16 +11,16 @@
         # TODO: move this to disko?
         # NOTE(oninstall):
         /*
-        sudo btrfs subvolume create /swap
-        sudo btrfs filesystem mkswapfile --size 32g --uuid clear /swap/swapfile
-        sudo swapon /swap/swapfile
+          sudo btrfs subvolume create /swap
+          sudo btrfs filesystem mkswapfile --size 32g --uuid clear /swap/swapfile
+          sudo swapon /swap/swapfile
         */
       ];
       # findmnt -no UUID -T /swap/swapfile
       # boot.resumeDevice = "/dev/disk/by-uuid/81c3354a-f629-4b6b-a249-7705aeb9f0d5";
       # systemd.sleep.extraConfig = "HibernateDelaySec=180m";
       services.fwupd.enable = true;
-      services.fwupd.extraRemotes = ["lvfs-testing"];
+      services.fwupd.extraRemotes = [ "lvfs-testing" ];
     }
   ];
 
@@ -75,19 +76,21 @@
         }
       ];
     };
-    services.hypridle = let
-      secondsPerMinute = 60;
-      lockSeconds = 10 * secondsPerMinute;
-    in {
-      settings = {
-        listener = [
-          {
-            timeout = lockSeconds + 55;
-            on-timeout = ''systemctl suspend'';
-          }
-        ];
+    services.hypridle =
+      let
+        secondsPerMinute = 60;
+        lockSeconds = 10 * secondsPerMinute;
+      in
+      {
+        settings = {
+          listener = [
+            {
+              timeout = lockSeconds + 55;
+              on-timeout = ''systemctl suspend'';
+            }
+          ];
+        };
       };
-    };
 
     wayland.windowManager.hyprland = {
       settings = {
@@ -117,19 +120,19 @@
           };
 
           /*
-          "BOE 0x0BCA Unknown" = {
-            mode = "2256x1504@60Hz";
-            position = "0,0";
-            scale = toString scale;
-          };
+            "BOE 0x0BCA Unknown" = {
+              mode = "2256x1504@60Hz";
+              position = "0,0";
+              scale = toString scale;
+            };
 
-          "Dell Inc. DELL U2720Q D3TM623" = {
-            # desktop left vertical monitor
-            mode = "1920x1080@60Hz";
-            # transform = "90";
-            # scale = "1.5";
-            position = "${toString (builtins.floor (2256 / scale))},0";
-          };
+            "Dell Inc. DELL U2720Q D3TM623" = {
+              # desktop left vertical monitor
+              mode = "1920x1080@60Hz";
+              # transform = "90";
+              # scale = "1.5";
+              position = "${toString (builtins.floor (2256 / scale))},0";
+            };
           */
         };
       };
@@ -163,15 +166,15 @@
 
     # https://github.com/void-linux/void-packages/issues/50417#issuecomment-2131802836 fix framework 13 not shutting down
     /*
-    kernelPatches = [
-      {
-        name = "framework13shutdownfix";
-        patch = builtins.fetchurl {
-          url = "https://github.com/void-linux/void-packages/files/15445612/0001-Add-hopefully-a-solution-for-shutdown-regression.PATCH";
-          sha256 = "sha256:10zcnzy5hkam2cnxx441b978gzhvnqlcc49k7bpz9dc28xyjik50";
-        };
-      }
-    ];
+      kernelPatches = [
+        {
+          name = "framework13shutdownfix";
+          patch = builtins.fetchurl {
+            url = "https://github.com/void-linux/void-packages/files/15445612/0001-Add-hopefully-a-solution-for-shutdown-regression.PATCH";
+            sha256 = "sha256:10zcnzy5hkam2cnxx441b978gzhvnqlcc49k7bpz9dc28xyjik50";
+          };
+        }
+      ];
     */
 
     loader = {
@@ -189,10 +192,10 @@
 
     # NOTE(oninstall):
     /*
-    sudo filefrag -v /swap/swapfile | awk '$1=="0:" {print substr($4, 1, length($4)-2)}'
-    the above won't work for btrfs, instead you need btrfs inspect-internal map-swapfile -r /swap/swapfile
-    https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation_into_swap_file
-    many of these come from https://wiki.archlinux.org/title/Framework_Laptop_13#Suspend
+      sudo filefrag -v /swap/swapfile | awk '$1=="0:" {print substr($4, 1, length($4)-2)}'
+      the above won't work for btrfs, instead you need btrfs inspect-internal map-swapfile -r /swap/swapfile
+      https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation_into_swap_file
+      many of these come from https://wiki.archlinux.org/title/Framework_Laptop_13#Suspend
     */
     kernelParams = [
       "rtc_cmos.use_acpi_alarm=1"
@@ -205,8 +208,12 @@
       # NOTE(oninstall):
       "resume_offset=3421665"
     ];
-    initrd.availableKernelModules = ["xhci_pci" "nvme" "thunderbolt"];
-    kernelModules = ["kvm-amd"];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "nvme"
+      "thunderbolt"
+    ];
+    kernelModules = [ "kvm-amd" ];
   };
   hardware.bluetooth = {
     enable = true;
@@ -214,26 +221,26 @@
     # simply resume the power state at the time of hibernation
     powerOnBoot = false;
 
-    package = pkgs.bluez.overrideAttrs (finalAttrs: previousAttrs: rec {
-      version = "5.78";
-      src = pkgs.fetchurl {
-        url = "mirror://kernel/linux/bluetooth/bluez-${version}.tar.xz";
-        sha256 = "sha256-gw/tGRXF03W43g9eb0X83qDcxf9f+z0x227Q8A1zxeM=";
-      };
-      patches = [];
-      buildInputs =
-        previousAttrs.buildInputs
-        ++ [
+    package = pkgs.bluez.overrideAttrs (
+      finalAttrs: previousAttrs: rec {
+        version = "5.78";
+        src = pkgs.fetchurl {
+          url = "mirror://kernel/linux/bluetooth/bluez-${version}.tar.xz";
+          sha256 = "sha256-gw/tGRXF03W43g9eb0X83qDcxf9f+z0x227Q8A1zxeM=";
+        };
+        patches = [ ];
+        buildInputs = previousAttrs.buildInputs ++ [
           pkgs.python3Packages.pygments
         ];
-    });
+      }
+    );
   };
   powerManagement.cpuFreqGovernor = "ondemand";
   /*
-  powerManagement.resumeCommands = ''
-    modprobe -rv mt7921e
-    modprobe -v mt7921e
-  '';
+    powerManagement.resumeCommands = ''
+      modprobe -rv mt7921e
+      modprobe -v mt7921e
+    '';
   */
 
   services.power-profiles-daemon = {
@@ -253,38 +260,42 @@
   };
 
   /*
-  services.tlp = {
-    enable = true;
-    settings = {
-      CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
-      CPU_SCALING_GOVERNOR_ON_BAT = "ondemand";
-      CPU_MIN_PERF_ON_BAT = 0;
-      CPU_MAX_PERF_ON_BAT = 80;
+    services.tlp = {
+      enable = true;
+      settings = {
+        CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
+        CPU_SCALING_GOVERNOR_ON_BAT = "ondemand";
+        CPU_MIN_PERF_ON_BAT = 0;
+        CPU_MAX_PERF_ON_BAT = 80;
 
-      CPU_SCALING_GOVERNOR_ON_AC = "performance";
-      CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
-      CPU_MIN_PERF_ON_AC = 0;
-      CPU_MAX_PERF_ON_AC = 100;
+        CPU_SCALING_GOVERNOR_ON_AC = "performance";
+        CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
+        CPU_MIN_PERF_ON_AC = 0;
+        CPU_MAX_PERF_ON_AC = 100;
+      };
     };
-  };
   */
 
-  networking.firewall.allowedTCPPorts = let
-    stardewValley = 24642;
-    factorio = 34197;
-  in [
-    8000 # dev stuff
-    factorio
-    stardewValley
-    7777
-  ];
-  networking.firewall.allowedUDPPorts = let
-    stardewValley = 24642;
-    factorio = 34197;
-  in [
-    8000 # dev stuff
-    factorio
-    stardewValley
-    7777
-  ];
+  networking.firewall.allowedTCPPorts =
+    let
+      stardewValley = 24642;
+      factorio = 34197;
+    in
+    [
+      8000 # dev stuff
+      factorio
+      stardewValley
+      7777
+    ];
+  networking.firewall.allowedUDPPorts =
+    let
+      stardewValley = 24642;
+      factorio = 34197;
+    in
+    [
+      8000 # dev stuff
+      factorio
+      stardewValley
+      7777
+    ];
 }
diff --git a/packages/hosts/htpc.nix b/packages/hosts/htpc.nix
index f1b1025..2e6321d 100644
--- a/packages/hosts/htpc.nix
+++ b/packages/hosts/htpc.nix
@@ -3,7 +3,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   networking.hostName = "htpc";
 
   networking.networkmanager.enable = true;
@@ -12,9 +13,18 @@
   boot.loader.grub.device = "/dev/sda";
   boot.loader.grub.useOSProber = true;
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = ["8821au" "8812au"];
-  boot.kernelModules = ["kvm-intel"];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "8821au"
+    "8812au"
+  ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [
     # pkgs.rtl8811au
     config.boot.kernelPackages.rtl8812au
@@ -26,7 +36,7 @@
     fsType = "ext4";
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   hardware.bluetooth = {
     enable = true;
diff --git a/packages/hosts/htpifour.nix b/packages/hosts/htpifour.nix
index ddd0c0d..66d6932 100644
--- a/packages/hosts/htpifour.nix
+++ b/packages/hosts/htpifour.nix
@@ -5,7 +5,8 @@
   outputs,
   modulesPath,
   ...
-}: {
+}:
+{
   nixpkgs.hostPlatform = "aarch64-linux";
   networking.hostName = "htpifour";
 
@@ -31,11 +32,15 @@
   console.enable = false;
 
   home-manager.users.daniel = {
-    imports = with outputs.homeManagerModules; [linux-desktop wallpaper-manager];
+    imports = with outputs.homeManagerModules; [
+      linux-desktop
+      wallpaper-manager
+    ];
   };
 
-  environment.systemPackages = with pkgs;
-  #with pkgs;
+  environment.systemPackages =
+    with pkgs;
+    #with pkgs;
     [
       # libcec
       libraspberrypi
@@ -59,17 +64,17 @@
 
   nixpkgs.overlays = [
     /*
-    nixos-22.05
-    (self: super: { libcec = super.libcec.override { inherit (self) libraspberrypi; }; })
-    nixos-22.11
-    (self: super: {libcec = super.libcec.override {withLibraspberrypi = true;};})
+      nixos-22.05
+      (self: super: { libcec = super.libcec.override { inherit (self) libraspberrypi; }; })
+      nixos-22.11
+      (self: super: {libcec = super.libcec.override {withLibraspberrypi = true;};})
     */
   ];
 
   # Workaround for GNOME autologin: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
   /*
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
+    systemd.services."getty@tty1".enable = false;
+    systemd.services."autovt@tty1".enable = false;
   */
 
   # hardware
@@ -82,7 +87,11 @@
 
   boot = {
     kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
-    initrd.availableKernelModules = ["xhci_pci" "usbhid" "usb_storage"];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "usbhid"
+      "usb_storage"
+    ];
     loader = {
       grub.enable = false;
       generic-extlinux-compatible.enable = true;
@@ -99,43 +108,43 @@
       allowedTCPPorts = [
         22 # ssh
       ];
-      allowedUDPPorts = [];
+      allowedUDPPorts = [ ];
     };
   };
 
   /*
-  services.udev.extraRules = ''
-    # allow access to raspi cec device for video group (and optionally register it as a systemd device, used below)
-    SUBSYSTEM=="vchiq", GROUP="video", MODE="0660", TAG+="systemd", ENV{SYSTEMD_ALIAS}="/dev/vchiq"
-  '';
+    services.udev.extraRules = ''
+      # allow access to raspi cec device for video group (and optionally register it as a systemd device, used below)
+      SUBSYSTEM=="vchiq", GROUP="video", MODE="0660", TAG+="systemd", ENV{SYSTEMD_ALIAS}="/dev/vchiq"
+    '';
 
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+    powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
-  optional: attach a persisted cec-client to `/run/cec.fifo`, to avoid the CEC ~1s startup delay per command
-  scan for devices: `echo 'scan' &gt; /run/cec.fifo ; journalctl -u cec-client.service`
-  set pi as active source: `echo 'as' &gt; /run/cec.fifo`
-  systemd.sockets."cec-client" = {
-    after = ["dev-vchiq.device"];
-    bindsTo = ["dev-vchiq.device"];
-    wantedBy = ["sockets.target"];
-    socketConfig = {
-      ListenFIFO = "/run/cec.fifo";
-      SocketGroup = "video";
-      SocketMode = "0660";
+    optional: attach a persisted cec-client to `/run/cec.fifo`, to avoid the CEC ~1s startup delay per command
+    scan for devices: `echo 'scan' &gt; /run/cec.fifo ; journalctl -u cec-client.service`
+    set pi as active source: `echo 'as' &gt; /run/cec.fifo`
+    systemd.sockets."cec-client" = {
+      after = ["dev-vchiq.device"];
+      bindsTo = ["dev-vchiq.device"];
+      wantedBy = ["sockets.target"];
+      socketConfig = {
+        ListenFIFO = "/run/cec.fifo";
+        SocketGroup = "video";
+        SocketMode = "0660";
+      };
     };
-  };
-  systemd.services."cec-client" = {
-    after = ["dev-vchiq.device"];
-    bindsTo = ["dev-vchiq.device"];
-    wantedBy = ["multi-user.target"];
-    serviceConfig = {
-      ExecStart = ''${pkgs.libcec}/bin/cec-client -d 1'';
-      ExecStop = ''/bin/sh -c "echo q &gt; /run/cec.fifo"'';
-      StandardInput = "socket";
-      StandardOutput = "journal";
-      Restart = "no";
+    systemd.services."cec-client" = {
+      after = ["dev-vchiq.device"];
+      bindsTo = ["dev-vchiq.device"];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        ExecStart = ''${pkgs.libcec}/bin/cec-client -d 1'';
+        ExecStop = ''/bin/sh -c "echo q &gt; /run/cec.fifo"'';
+        StandardInput = "socket";
+        StandardOutput = "journal";
+        Restart = "no";
+      };
     };
-  };
   */
 
   hardware.graphics.driSupport32Bit = lib.mkForce false;
diff --git a/packages/hosts/rascal.nix b/packages/hosts/rascal.nix
index a7cf744..b58d1a2 100644
--- a/packages/hosts/rascal.nix
+++ b/packages/hosts/rascal.nix
@@ -2,13 +2,21 @@
   config,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "ehci_pci" "usbhid" "uas" "sd_mod"];
-  boot.kernelModules = ["kvm-amd"];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.kernelModules = [ "kvm-amd" ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/2e2ad73a-6264-4a7b-8439-9c05295d903d";
@@ -25,26 +33,30 @@
     device = "/dev/sda";
   };
 
-  users.groups.beefcake = {};
+  users.groups.beefcake = { };
   users.users = {
     beefcake = {
       isSystemUser = true;
       createHome = true;
       home = "/storage/backups/beefcake";
       group = "beefcake";
-      extraGroups = ["sftponly"];
-      openssh.authorizedKeys.keys =
-        config.users.users.daniel.openssh.authorizedKeys.keys
-        ++ [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7HrojwoyHED+A/FzRjYmIL0hzofwBd9IYHH6yV0oPO root@beefcake"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOEI82VdbyR1RYqSnFtlffHBtHFdXO0v9RmQH7GkfXo restic@beefcake"
-        ];
+      extraGroups = [ "sftponly" ];
+      openssh.authorizedKeys.keys = config.users.users.daniel.openssh.authorizedKeys.keys ++ [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7HrojwoyHED+A/FzRjYmIL0hzofwBd9IYHH6yV0oPO root@beefcake"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOEI82VdbyR1RYqSnFtlffHBtHFdXO0v9RmQH7GkfXo restic@beefcake"
+      ];
     };
 
     daniel = {
       # used for restic backups
       isNormalUser = true;
-      extraGroups = ["users" "wheel" "video" "dialout" "uucp"];
+      extraGroups = [
+        "users"
+        "wheel"
+        "video"
+        "dialout"
+        "uucp"
+      ];
       openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAPLXOjupz3ScYjgrF+ehrbp9OvGAWQLI6fplX6w9Ijb daniel@lyte.dev"
       ];
@@ -68,7 +80,7 @@
     firewall = {
       enable = true;
       allowPing = true;
-      allowedTCPPorts = [22];
+      allowedTCPPorts = [ 22 ];
     };
   };
 
diff --git a/packages/hosts/router.nix b/packages/hosts/router.nix
index 2707f49..873918e 100644
--- a/packages/hosts/router.nix
+++ b/packages/hosts/router.nix
@@ -4,15 +4,16 @@
   # outputs,
   pkgs,
   ...
-}: let
+}:
+let
   /*
-  NOTE: My goal is to be able to apply most of the common tweaks to the router
-  either live on the system for ad-hoc changes (such as forwarding a port for a
-  multiplayer game) or to tweak these values just below without reaching deeper
-  into the modules' implementation of these configuration values
-  NOTE: I could turn this into a cool NixOS module?
-  TODO: review https://francis.begyn.be/blog/nixos-home-router
-  TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
+    NOTE: My goal is to be able to apply most of the common tweaks to the router
+    either live on the system for ad-hoc changes (such as forwarding a port for a
+    multiplayer game) or to tweak these values just below without reaching deeper
+    into the modules' implementation of these configuration values
+    NOTE: I could turn this into a cool NixOS module?
+    TODO: review https://francis.begyn.be/blog/nixos-home-router
+    TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
   */
   hostname = "router";
   domain = "h.lyte.dev";
@@ -83,7 +84,8 @@
     "net.ipv6.conf.${interfaces.wan.name}.use_tempaddr" = 2;
     # "net.ipv6.conf.${interfaces.wan.name}.addr_gen_mode" = 2;
   };
-in {
+in
+{
   imports = [
     {
       # hardware
@@ -92,31 +94,34 @@ in {
           efi.canTouchEfiVariables = true;
           systemd-boot.enable = true;
         };
-        initrd.availableKernelModules = ["xhci_pci"];
-        initrd.kernelModules = [];
-        kernelModules = ["kvm-intel"];
-        extraModulePackages = [];
+        initrd.availableKernelModules = [ "xhci_pci" ];
+        initrd.kernelModules = [ ];
+        kernelModules = [ "kvm-intel" ];
+        extraModulePackages = [ ];
       };
 
       fileSystems."/" = {
         device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
         fsType = "btrfs";
-        options = ["subvol=root"];
+        options = [ "subvol=root" ];
       };
       fileSystems."/nix" = {
         device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
         fsType = "btrfs";
-        options = ["subvol=nix"];
+        options = [ "subvol=nix" ];
       };
       fileSystems."/home" = {
         device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
         fsType = "btrfs";
-        options = ["subvol=home"];
+        options = [ "subvol=home" ];
       };
       fileSystems."/boot" = {
         device = "/dev/disk/by-uuid/7F78-7AE8";
         fsType = "vfat";
-        options = ["fmask=0022" "dmask=0022"];
+        options = [
+          "fmask=0022"
+          "dmask=0022"
+        ];
       };
       nixpkgs.hostPlatform = "x86_64-linux";
       powerManagement.cpuFreqGovernor = "performance";
@@ -131,22 +136,22 @@ in {
   sops = {
     defaultSopsFile = ../secrets/router/secrets.yml;
     age = {
-      sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
       keyFile = "/var/lib/sops-nix/key.txt";
       generateKey = true;
     };
     secrets = {
-      netlify-ddns-password = {mode = "0400";};
+      netlify-ddns-password = {
+        mode = "0400";
+      };
     };
   };
   services.deno-netlify-ddns-client = {
     passwordFile = config.sops.secrets.netlify-ddns-password.path;
   };
 
-  boot.kernel.sysctl =
-    sysctl-entries
-    // {
-    };
+  boot.kernel.sysctl = sysctl-entries // {
+  };
 
   networking = {
     hostName = hostname;
@@ -174,173 +179,175 @@ in {
 
     # the main meat and potatoes for most routers, the firewall configuration
     # TODO: IPv6
-    nftables = let
-      inf = {
-        lan = interfaces.lan.name;
-        wan = interfaces.wan.name;
+    nftables =
+      let
+        inf = {
+          lan = interfaces.lan.name;
+          wan = interfaces.wan.name;
+        };
+      in
+      {
+        enable = true;
+        checkRuleset = true;
+        flushRuleset = true;
+        ruleset = with inf; ''
+          table inet filter {
+            ## set LANv4 {
+            ##   type ipv4_addr
+            ##   flags interval
+            ##   elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
+            ## }
+            ## set LANv6 {
+            ##   type ipv6_addr
+            ##   flags interval
+            ##   elements = { fd00::/8, fe80::/10 }
+            ## }
+            ## TODO: maybe tailnet?
+
+            ## chain my_input_lan {
+            ##   udp sport 1900 udp dport >= 1024 meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
+            ##   udp sport netbios-ns udp dport >= 1024 meta pkttype unicast accept comment "Accept Samba Workgroup browsing replies"
+            ## }
+
+            chain input {
+              type filter hook input priority 0; policy drop;
+
+              iif lo accept comment "Accept any localhost traffic"
+              ct state invalid drop comment "Drop invalid connections"
+              ct state established,related accept comment "Accept traffic originated from us"
+
+              meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
+              meta l4proto icmp accept comment "Accept ICMP"
+              ip protocol igmp accept comment "Accept IGMP"
+
+              ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit accept
+              ip6 nexthdr icmpv6 icmpv6 type nd-router-advert  accept comment "Accept IPv6 router advertisements"
+              udp dport dhcpv6-client accept comment "IPv6 DHCP"
+
+              ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept comment "Accept IPv6 ICMP and meta stuff"
+              ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept comment "Accept IPv4 ICMP and meta stuff"
+              ip protocol icmpv6 accept
+              ip protocol icmp accept
+              meta l4proto ipv6-icmp counter accept
+              udp dport dhcpv6-client counter accept
+
+              udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS"
+              udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS"
+
+              tcp dport 2201 accept comment "Accept SSH on port 2201"
+              tcp dport 53 accept comment "Accept DNS"
+              udp dport 53 accept comment "Accept DNS"
+
+              tcp dport { 80, 443 } accept comment "Allow HTTP/HTTPS to server (see nat prerouting)"
+              udp dport { 80, 443 } accept comment "Allow QUIC to server (see nat prerouting)"
+              tcp dport { 22 } accept comment "Allow SSH to server (see nat prerouting)"
+              tcp dport { 25565 } accept comment "Allow Minecraft server connections (see nat prerouting)"
+              udp dport { 34197 } accept comment "Allow Factorio server connections (see nat prerouting)"
+
+              iifname "${lan}" accept comment "Allow local network to access the router"
+              iifname "tailscale0" accept comment "Allow local network to access the router"
+
+              ## ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges"
+              ## ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges"
+
+              iifname "${wan}" counter drop comment "Drop all other unsolicited traffic from wan"
+            }
+
+            chain output {
+              type filter hook output priority 0;
+              accept
+            }
+
+            chain forward {
+              type filter hook forward priority 0;
+              accept
+            }
+
+            ## chain forward {
+            ##   type filter hook forward priority filter; policy drop;
+
+            ##   iifname { "${lan}" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
+            ##   iifname { "tailscale0" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
+            ##   iifname { "${wan}" } oifname { "${lan}" } ct state { established, related } accept comment "Allow established back to LAN"
+            ## }
+          }
+
+          table ip nat {
+            chain prerouting {
+              type nat hook prerouting priority dstnat;
+
+              iifname ${lan} accept
+              iifname tailscale0 accept
+
+              iifname ${wan} tcp dport {22} dnat to ${hosts.beefcake.ip}
+              iifname ${wan} tcp dport {80, 443} dnat to ${hosts.beefcake.ip}
+              iifname ${wan} udp dport {80, 443} dnat to ${hosts.beefcake.ip}
+              iifname ${wan} tcp dport {26966} dnat to ${hosts.beefcake.ip}
+              iifname ${wan} tcp dport {25565} dnat to ${hosts.bald.ip}
+              iifname ${wan} udp dport {25565} dnat to ${hosts.bald.ip}
+              iifname ${wan} udp dport {34197} dnat to ${hosts.beefcake.ip}
+            }
+
+            chain postrouting {
+              type nat hook postrouting priority 100; policy accept;
+              oifname "${wan}" masquerade
+            }
+          }
+        '';
       };
-    in {
-      enable = true;
-      checkRuleset = true;
-      flushRuleset = true;
-      ruleset = with inf; ''
-        table inet filter {
-          ## set LANv4 {
-          ##   type ipv4_addr
-          ##   flags interval
-          ##   elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          ## }
-          ## set LANv6 {
-          ##   type ipv6_addr
-          ##   flags interval
-          ##   elements = { fd00::/8, fe80::/10 }
-          ## }
-          ## TODO: maybe tailnet?
-
-          ## chain my_input_lan {
-          ##   udp sport 1900 udp dport >= 1024 meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
-          ##   udp sport netbios-ns udp dport >= 1024 meta pkttype unicast accept comment "Accept Samba Workgroup browsing replies"
-          ## }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-
-            iif lo accept comment "Accept any localhost traffic"
-            ct state invalid drop comment "Drop invalid connections"
-            ct state established,related accept comment "Accept traffic originated from us"
-
-            meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
-            meta l4proto icmp accept comment "Accept ICMP"
-            ip protocol igmp accept comment "Accept IGMP"
-
-            ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit accept
-            ip6 nexthdr icmpv6 icmpv6 type nd-router-advert  accept comment "Accept IPv6 router advertisements"
-            udp dport dhcpv6-client accept comment "IPv6 DHCP"
-
-            ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept comment "Accept IPv6 ICMP and meta stuff"
-            ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept comment "Accept IPv4 ICMP and meta stuff"
-            ip protocol icmpv6 accept
-            ip protocol icmp accept
-            meta l4proto ipv6-icmp counter accept
-            udp dport dhcpv6-client counter accept
-
-            udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS"
-            udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS"
-
-            tcp dport 2201 accept comment "Accept SSH on port 2201"
-            tcp dport 53 accept comment "Accept DNS"
-            udp dport 53 accept comment "Accept DNS"
-
-            tcp dport { 80, 443 } accept comment "Allow HTTP/HTTPS to server (see nat prerouting)"
-            udp dport { 80, 443 } accept comment "Allow QUIC to server (see nat prerouting)"
-            tcp dport { 22 } accept comment "Allow SSH to server (see nat prerouting)"
-            tcp dport { 25565 } accept comment "Allow Minecraft server connections (see nat prerouting)"
-            udp dport { 34197 } accept comment "Allow Factorio server connections (see nat prerouting)"
-
-            iifname "${lan}" accept comment "Allow local network to access the router"
-            iifname "tailscale0" accept comment "Allow local network to access the router"
-
-            ## ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges"
-            ## ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges"
-
-            iifname "${wan}" counter drop comment "Drop all other unsolicited traffic from wan"
-          }
-
-          chain output {
-            type filter hook output priority 0;
-            accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0;
-            accept
-          }
-
-          ## chain forward {
-          ##   type filter hook forward priority filter; policy drop;
-
-          ##   iifname { "${lan}" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
-          ##   iifname { "tailscale0" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
-          ##   iifname { "${wan}" } oifname { "${lan}" } ct state { established, related } accept comment "Allow established back to LAN"
-          ## }
-        }
-
-        table ip nat {
-          chain prerouting {
-            type nat hook prerouting priority dstnat;
-
-            iifname ${lan} accept
-            iifname tailscale0 accept
-
-            iifname ${wan} tcp dport {22} dnat to ${hosts.beefcake.ip}
-            iifname ${wan} tcp dport {80, 443} dnat to ${hosts.beefcake.ip}
-            iifname ${wan} udp dport {80, 443} dnat to ${hosts.beefcake.ip}
-            iifname ${wan} tcp dport {26966} dnat to ${hosts.beefcake.ip}
-            iifname ${wan} tcp dport {25565} dnat to ${hosts.bald.ip}
-            iifname ${wan} udp dport {25565} dnat to ${hosts.bald.ip}
-            iifname ${wan} udp dport {34197} dnat to ${hosts.beefcake.ip}
-          }
-
-          chain postrouting {
-            type nat hook postrouting priority 100; policy accept;
-            oifname "${wan}" masquerade
-          }
-        }
-      '';
-    };
 
     # NOTE: see flake.nix 'nnf.nixosModules.default'
     /*
-    nftables.firewall = let
-      me = config.networking.nftables.firewall.localZoneName;
-    in {
-      enable = true;
-      snippets.nnf-common.enable = true;
+      nftables.firewall = let
+        me = config.networking.nftables.firewall.localZoneName;
+      in {
+        enable = true;
+        snippets.nnf-common.enable = true;
 
-      zones = {
-        ${interfaces.wan.name} = {
-          interfaces = [interfaces.wan.name interfaces.lan.name];
+        zones = {
+          ${interfaces.wan.name} = {
+            interfaces = [interfaces.wan.name interfaces.lan.name];
+          };
+          ${interfaces.lan.name} = {
+            parent = interfaces.wan.name;
+            ipv4Addresses = [cidr];
+          };
+          ## banned = {
+          ##   ingressExpression = [
+          ##     "ip saddr @banlist"
+          ##     "ip6 saddr @banlist6"
+          ##   ];
+          ##   egressExpression = [
+          ##     "ip daddr @banlist"
+          ##     "ip6 daddr @banlist6"
+          ##   ];
+          ## };
         };
-        ${interfaces.lan.name} = {
-          parent = interfaces.wan.name;
-          ipv4Addresses = [cidr];
-        };
-        ## banned = {
-        ##   ingressExpression = [
-        ##     "ip saddr @banlist"
-        ##     "ip6 saddr @banlist6"
-        ##   ];
-        ##   egressExpression = [
-        ##     "ip daddr @banlist"
-        ##     "ip6 daddr @banlist6"
-        ##   ];
-        ## };
-      };
 
-      rules = {
-        dhcp = {
-          from = "all";
-          to = [hosts.beefcake.ip];
-          allowedTCPPorts = [67];
-          allowedUDPPorts = [67];
-        };
-        http = {
-          from = "all";
-          to = [me];
-          allowedTCPPorts = [80 443];
-        };
-        router-ssh = {
-          from = "all";
-          to = [me];
-          allowedTCPPorts = [2201];
-        };
-        server-ssh = {
-          from = "all";
-          to = [hosts.beefcake.ip];
-          allowedTCPPorts = [22];
+        rules = {
+          dhcp = {
+            from = "all";
+            to = [hosts.beefcake.ip];
+            allowedTCPPorts = [67];
+            allowedUDPPorts = [67];
+          };
+          http = {
+            from = "all";
+            to = [me];
+            allowedTCPPorts = [80 443];
+          };
+          router-ssh = {
+            from = "all";
+            to = [me];
+            allowedTCPPorts = [2201];
+          };
+          server-ssh = {
+            from = "all";
+            to = [hosts.beefcake.ip];
+            allowedTCPPorts = [22];
+          };
         };
       };
-    };
     */
   };
 
@@ -394,11 +401,11 @@ in {
       };
 
       /*
-      WAN configuration requires DHCP to get addresses
-      we also disable some options to be certain we retain as much networking
-      control as we reasonably can, such as not letting the ISP determine our
-      hostname or DNS configuration
-      TODO: IPv6 (prefix delegation)
+        WAN configuration requires DHCP to get addresses
+        we also disable some options to be certain we retain as much networking
+        control as we reasonably can, such as not letting the ISP determine our
+        hostname or DNS configuration
+        TODO: IPv6 (prefix delegation)
       */
       "40-${interfaces.wan.name}" = {
         matchConfig.Name = "${interfaces.wan.name}";
@@ -406,17 +413,17 @@ in {
           Description = "WAN network - connection to fiber ISP jack";
           DHCP = true;
           /*
-          IPv6AcceptRA = true;
-          IPv6PrivacyExtensions = true;
-          IPForward = true;
+            IPv6AcceptRA = true;
+            IPv6PrivacyExtensions = true;
+            IPForward = true;
           */
         };
         dhcpV6Config = {
           /*
-          ForceDHCPv6PDOtherInformation = true;
-          UseHostname = false;
-          UseDNS = false;
-          UseNTP = false;
+            ForceDHCPv6PDOtherInformation = true;
+            UseHostname = false;
+            UseDNS = false;
+            UseNTP = false;
           */
           PrefixDelegationHint = "::/56";
         };
@@ -444,9 +451,9 @@ in {
   services.resolved.enable = false;
 
   /*
-  dnsmasq serves as our DHCP and DNS server
-  almost all the configuration should be derived from the values at the top of
-  this file
+    dnsmasq serves as our DHCP and DNS server
+    almost all the configuration should be derived from the values at the top of
+    this file
   */
   services.dnsmasq = {
     enable = true;
@@ -455,12 +462,16 @@ in {
       port = 53;
 
       /*
-      dhcp-authoritative = true;
-      dnssec = true;
+        dhcp-authoritative = true;
+        dnssec = true;
       */
       enable-ra = true;
 
-      server = ["1.1.1.1" "9.9.9.9" "8.8.8.8"];
+      server = [
+        "1.1.1.1"
+        "9.9.9.9"
+        "8.8.8.8"
+      ];
 
       domain-needed = true;
       bogus-priv = true;
@@ -477,28 +488,36 @@ in {
       dhcp-host =
         [
         ]
-        ++ (lib.attrsets.mapAttrsToList (name: {
-          ip,
-          identifier ? name,
-          time ? "12h",
-          ...
-        }: "${name},${ip},${identifier},${time}")
-        hosts);
+        ++ (lib.attrsets.mapAttrsToList (
+          name:
+          {
+            ip,
+            identifier ? name,
+            time ? "12h",
+            ...
+          }:
+          "${name},${ip},${identifier},${time}"
+        ) hosts);
 
       address =
         [
           "/${hostname}.${domain}/${ip}"
         ]
-        ++ (lib.lists.flatten (lib.attrsets.mapAttrsToList (name: {
-            ip,
-            additionalHosts ? [],
-            identifier ? name,
-            time ? "12h",
-          }: [
-            "/${name}.${domain}/${ip}"
-            (lib.lists.forEach additionalHosts (h: "/${h}/${ip}"))
-          ])
-          hosts));
+        ++ (lib.lists.flatten (
+          lib.attrsets.mapAttrsToList (
+            name:
+            {
+              ip,
+              additionalHosts ? [ ],
+              identifier ? name,
+              time ? "12h",
+            }:
+            [
+              "/${name}.${domain}/${ip}"
+              (lib.lists.forEach additionalHosts (h: "/${h}/${ip}"))
+            ]
+          ) hosts
+        ));
 
       # local domains
       local = "/lan/";
@@ -511,8 +530,8 @@ in {
   };
 
   /*
-  since the home network reserves port 22 for ssh to the big server and to
-  gitea, the router uses port 2201 for ssh
+    since the home network reserves port 22 for ssh to the big server and to
+    gitea, the router uses port 2201 for ssh
   */
   services.openssh.listenAddresses = [
     {
@@ -538,253 +557,253 @@ in {
   system.stateVersion = "24.05";
 
   /*
-  NOTE: everything from here on is deprecated or old stuff
+    NOTE: everything from here on is deprecated or old stuff
 
-  TODO: may not be strictly necessary for IPv6?
-  TODO: also may not even be the best implementation?
-  services.radvd = {
-    enable = false;
-    ## NOTE: this config is just the default arch linux config I think and may
-    ## need tweaking? this is what I had on the arch linux router, though :shrug:
-    config = ''
-      interface lo
-      {
-        AdvSendAdvert on;
-        MinRtrAdvInterval 3;
-        MaxRtrAdvInterval 10;
-        AdvDefaultPreference low;
-        AdvHomeAgentFlag off;
-
-        prefix 2001:db8:1:0::/64
+    TODO: may not be strictly necessary for IPv6?
+    TODO: also may not even be the best implementation?
+    services.radvd = {
+      enable = false;
+      ## NOTE: this config is just the default arch linux config I think and may
+      ## need tweaking? this is what I had on the arch linux router, though :shrug:
+      config = ''
+        interface lo
         {
-          AdvOnLink on;
-          AdvAutonomous on;
-          AdvRouterAddr off;
+          AdvSendAdvert on;
+          MinRtrAdvInterval 3;
+          MaxRtrAdvInterval 10;
+          AdvDefaultPreference low;
+          AdvHomeAgentFlag off;
+
+          prefix 2001:db8:1:0::/64
+          {
+            AdvOnLink on;
+            AdvAutonomous on;
+            AdvRouterAddr off;
+          };
+
+          prefix 0:0:0:1234::/64
+          {
+            AdvOnLink on;
+            AdvAutonomous on;
+            AdvRouterAddr off;
+            Base6to4Interface ppp0;
+            AdvPreferredLifetime 120;
+            AdvValidLifetime 300;
+          };
+
+          route 2001:db0:fff::/48
+          {
+            AdvRoutePreference high;
+            AdvRouteLifetime 3600;
+          };
+
+          RDNSS 2001:db8::1 2001:db8::2
+          {
+            AdvRDNSSLifetime 30;
+          };
+
+          DNSSL branch.example.com example.com
+          {
+            AdvDNSSLLifetime 30;
+          };
         };
-
-        prefix 0:0:0:1234::/64
-        {
-          AdvOnLink on;
-          AdvAutonomous on;
-          AdvRouterAddr off;
-          Base6to4Interface ppp0;
-          AdvPreferredLifetime 120;
-          AdvValidLifetime 300;
-        };
-
-        route 2001:db0:fff::/48
-        {
-          AdvRoutePreference high;
-          AdvRouteLifetime 3600;
-        };
-
-        RDNSS 2001:db8::1 2001:db8::2
-        {
-          AdvRDNSSLifetime 30;
-        };
-
-        DNSSL branch.example.com example.com
-        {
-          AdvDNSSLLifetime 30;
-        };
-      };
-    '';
-  };
-
-  TODO: old config, should be deleted ASAP
-  services.dnsmasq = {
-    enable = false;
-    settings = {
-      # server endpoints
-      listen-address = "::1,127.0.0.1,${ip}";
-      port = "53";
-
-      # DNS cache entries
-      cache-size = "10000";
-
-      # local domain entries
-      local = "/lan/";
-      domain = "lan";
-      expand-hosts = true;
-
-      dhcp-authoritative = true;
-
-      conf-file = "/usr/share/dnsmasq/trust-anchors.conf";
-      dnssec = true;
-
-      except-interface = "${wan_if}";
-      interface = "${lan_if}";
-
-      enable-ra = true;
-
-      # dhcp-option = "121,${cidr},${ip}";
-
-      dhcp-range = [
-        "lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m"
-        "tag:${lan_if},::1,constructor:${lan_if},ra-names,12h"
-      ];
-
-      dhcp-host = [
-        "${hosts.dragon.host},${hosts.dragon.ip},12h"
-        "${hosts.beefcake.host},${hosts.beefcake.ip},12h"
-      ];
-
-      # may need to go in /etc/hosts (networking.extraHosts), too?
-      address = [
-        "/video.lyte.dev/192.168.0.9"
-        "/git.lyte.dev/192.168.0.9"
-        "/bw.lyte.dev/192.168.0.9"
-        "/files.lyte.dev/192.168.0.9"
-        "/vpn.h.lyte.dev/192.168.0.9"
-        "/.h.lyte.dev/192.168.0.9"
-      ];
-
-      server = [
-        "${ip}"
-        "8.8.8.8"
-        "8.8.4.4"
-        "1.1.1.1"
-        "1.0.0.1"
-      ];
+      '';
     };
-  };
 
-  TODO: old config, should be deleted ASAP
-  nftables = {
-    enable = false;
-    flushRuleset = true;
+    TODO: old config, should be deleted ASAP
+    services.dnsmasq = {
+      enable = false;
+      settings = {
+        # server endpoints
+        listen-address = "::1,127.0.0.1,${ip}";
+        port = "53";
 
-    tables = {
-      filter = {
-        family = "inet";
-        content = ''
-          chain input {
-            # type filter hook input priority filter; policy accept;
-            type filter hook input priority 0;
+        # DNS cache entries
+        cache-size = "10000";
 
-            # anything from loopback interface
-            iifname "lo" accept
+        # local domain entries
+        local = "/lan/";
+        domain = "lan";
+        expand-hosts = true;
 
-            # accept traffic we originated
-            ct state { established, related } counter accept
-            ct state invalid counter drop
+        dhcp-authoritative = true;
 
-            # ICMP
-            ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
-            ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
-            ip protocol icmpv6 counter accept
-            ip protocol icmp counter accept
-            meta l4proto ipv6-icmp counter accept
-            udp dport dhcpv6-client counter accept
+        conf-file = "/usr/share/dnsmasq/trust-anchors.conf";
+        dnssec = true;
 
-            tcp dport { 64022, 22, 53, 67, 25565 } counter accept
-            udp dport { 64020, 22, 53, 67 } counter accept
+        except-interface = "${wan_if}";
+        interface = "${lan_if}";
 
-            ## iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
-            ## iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
-            iifname "${lan_if}" tcp dport { llmnr } counter accept
-            iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
+        enable-ra = true;
 
-            counter drop
-          }
+        # dhcp-option = "121,${cidr},${ip}";
 
-          # allow all outgoing
-          chain output {
-            type filter hook output priority 0;
-            accept
-          }
+        dhcp-range = [
+          "lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m"
+          "tag:${lan_if},::1,constructor:${lan_if},ra-names,12h"
+        ];
 
-          chain forward {
-            type filter hook forward priority 0;
-            accept
-          }
-        '';
-      };
+        dhcp-host = [
+          "${hosts.dragon.host},${hosts.dragon.ip},12h"
+          "${hosts.beefcake.host},${hosts.beefcake.ip},12h"
+        ];
 
-      nat = {
-        family = "ip";
-        content = ''
-          set masq_saddr {
-            type ipv4_addr
-            flags interval
-            elements = { ${cidr} }
-          }
+        # may need to go in /etc/hosts (networking.extraHosts), too?
+        address = [
+          "/video.lyte.dev/192.168.0.9"
+          "/git.lyte.dev/192.168.0.9"
+          "/bw.lyte.dev/192.168.0.9"
+          "/files.lyte.dev/192.168.0.9"
+          "/vpn.h.lyte.dev/192.168.0.9"
+          "/.h.lyte.dev/192.168.0.9"
+        ];
 
-          map map_port_ipport {
-            type inet_proto . inet_service : ipv4_addr . inet_service
-          }
-
-          chain prerouting {
-            iifname ${lan_if} accept
-
-            type nat hook prerouting priority dstnat + 1; policy accept;
-            fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
-
-            iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
-            iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
-
-            ## iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
-            ## iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
-
-            ## router
-            iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
-          }
-
-          chain output {
-            type nat hook output priority -99; policy accept;
-            ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
-          }
-
-          chain postrouting {
-            type nat hook postrouting priority srcnat + 1; policy accept;
-            oifname ${lan_if} masquerade
-            ip saddr @masq_saddr masquerade
-          }
-        '';
+        server = [
+          "${ip}"
+          "8.8.8.8"
+          "8.8.4.4"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
       };
     };
-  };
 
-  TODO: also want to try to avoid using dhcpcd for IPv6 since systemd-networkd
-  should be sufficient?
-  dhcpcd = {
-    enable = false;
-    extraConfig = ''
-      duid
+    TODO: old config, should be deleted ASAP
+    nftables = {
+      enable = false;
+      flushRuleset = true;
 
-      ## No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
-      ## issues caused by guests with oneplus devices
-      noarp
+      tables = {
+        filter = {
+          family = "inet";
+          content = ''
+            chain input {
+              # type filter hook input priority filter; policy accept;
+              type filter hook input priority 0;
 
-      persistent
-      vendorclassid
+              # anything from loopback interface
+              iifname "lo" accept
 
-      option domain_name_servers, domain_name, domain_search
-      option classless_static_routes
-      option interface_mtu
-      option host_name
-      #option ntp_servers
+              # accept traffic we originated
+              ct state { established, related } counter accept
+              ct state invalid counter drop
 
-      require dhcp_server_identifier
-      slaac private
-      noipv4ll
-      noipv6rs
+              # ICMP
+              ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
+              ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
+              ip protocol icmpv6 counter accept
+              ip protocol icmp counter accept
+              meta l4proto ipv6-icmp counter accept
+              udp dport dhcpv6-client counter accept
 
-      static domain_name_servers=${ip}
+              tcp dport { 64022, 22, 53, 67, 25565 } counter accept
+              udp dport { 64020, 22, 53, 67 } counter accept
 
-      interface ${wan_if}
-        gateway
-        ipv6rs
-        iaid 1
-        ## option rapid_commit
-        ## ia_na 1
-        ia_pd 1 ${lan_if}
+              ## iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
+              ## iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
+              iifname "${lan_if}" tcp dport { llmnr } counter accept
+              iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
+
+              counter drop
+            }
+
+            # allow all outgoing
+            chain output {
+              type filter hook output priority 0;
+              accept
+            }
+
+            chain forward {
+              type filter hook forward priority 0;
+              accept
+            }
+          '';
+        };
+
+        nat = {
+          family = "ip";
+          content = ''
+            set masq_saddr {
+              type ipv4_addr
+              flags interval
+              elements = { ${cidr} }
+            }
+
+            map map_port_ipport {
+              type inet_proto . inet_service : ipv4_addr . inet_service
+            }
+
+            chain prerouting {
+              iifname ${lan_if} accept
+
+              type nat hook prerouting priority dstnat + 1; policy accept;
+              fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
+
+              iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
+              iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
+
+              ## iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
+              ## iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
+
+              ## router
+              iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
+            }
+
+            chain output {
+              type nat hook output priority -99; policy accept;
+              ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
+            }
+
+            chain postrouting {
+              type nat hook postrouting priority srcnat + 1; policy accept;
+              oifname ${lan_if} masquerade
+              ip saddr @masq_saddr masquerade
+            }
+          '';
+        };
+      };
+    };
+
+    TODO: also want to try to avoid using dhcpcd for IPv6 since systemd-networkd
+    should be sufficient?
+    dhcpcd = {
+      enable = false;
+      extraConfig = ''
+        duid
+
+        ## No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
+        ## issues caused by guests with oneplus devices
+        noarp
+
+        persistent
+        vendorclassid
+
+        option domain_name_servers, domain_name, domain_search
+        option classless_static_routes
+        option interface_mtu
+        option host_name
+        #option ntp_servers
+
+        require dhcp_server_identifier
+        slaac private
+        noipv4ll
+        noipv6rs
 
-      interface ${lan_if}
-        static ip_address=${cidr}
-        static routers=${ip}
         static domain_name_servers=${ip}
-    '';
-  };
+
+        interface ${wan_if}
+          gateway
+          ipv6rs
+          iaid 1
+          ## option rapid_commit
+          ## ia_na 1
+          ia_pd 1 ${lan_if}
+
+        interface ${lan_if}
+          static ip_address=${cidr}
+          static routers=${ip}
+          static domain_name_servers=${ip}
+      '';
+    };
   */
 }
diff --git a/packages/hosts/thablet.nix b/packages/hosts/thablet.nix
index f72bac9..aed8be9 100644
--- a/packages/hosts/thablet.nix
+++ b/packages/hosts/thablet.nix
@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   networking.hostName = "thablet";
 
   boot.loader.systemd-boot.enable = true;
@@ -17,7 +18,7 @@
 
   environment.systemPackages =
     #with pkgs;
-    [];
+    [ ];
 
   # https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Yoga_(Gen_3)#Using_acpi_call
   systemd.services.activate-touch-hack = {
@@ -25,7 +26,12 @@
     description = "Touch wake Thinkpad X1 Yoga 3rd gen hack";
 
     unitConfig = {
-      After = ["suspend.target" "hibernate.target" "hybrid-sleep.target" "suspend-then-hibernate.target"];
+      After = [
+        "suspend.target"
+        "hibernate.target"
+        "hybrid-sleep.target"
+        "suspend-then-hibernate.target"
+      ];
     };
 
     serviceConfig = {
@@ -34,13 +40,26 @@
       '';
     };
 
-    wantedBy = ["suspend.target" "hibernate.target" "hybrid-sleep.target" "suspend-then-hibernate.target"];
+    wantedBy = [
+      "suspend.target"
+      "hibernate.target"
+      "hybrid-sleep.target"
+      "suspend-then-hibernate.target"
+    ];
   };
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel" "acpi_call"];
-  boot.extraModulePackages = with config.boot.kernelPackages; [acpi_call];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-intel"
+    "acpi_call"
+  ];
+  boot.extraModulePackages = with config.boot.kernelPackages; [ acpi_call ];
 
   hardware = {
     cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
@@ -65,13 +84,21 @@
   };
 
   networking = {
-    firewall = let
-      terraria = 7777;
-      stardew-valley = 24642;
-    in {
-      allowedTCPPorts = [terraria stardew-valley];
-      allowedUDPPorts = [terraria stardew-valley];
-    };
+    firewall =
+      let
+        terraria = 7777;
+        stardew-valley = 24642;
+      in
+      {
+        allowedTCPPorts = [
+          terraria
+          stardew-valley
+        ];
+        allowedUDPPorts = [
+          terraria
+          stardew-valley
+        ];
+      };
   };
 
   home-manager.users.daniel = {
@@ -104,19 +131,21 @@
       ];
     };
 
-    services.hypridle = let
-      secondsPerMinute = 60;
-      lockSeconds = 10 * secondsPerMinute;
-    in {
-      settings = {
-        listener = [
-          {
-            timeout = lockSeconds + 55;
-            on-timeout = ''systemctl suspend'';
-          }
-        ];
+    services.hypridle =
+      let
+        secondsPerMinute = 60;
+        lockSeconds = 10 * secondsPerMinute;
+      in
+      {
+        settings = {
+          listener = [
+            {
+              timeout = lockSeconds + 55;
+              on-timeout = ''systemctl suspend'';
+            }
+          ];
+        };
       };
-    };
 
     wayland.windowManager.hyprland = {
       settings = {
diff --git a/packages/hosts/thinker.nix b/packages/hosts/thinker.nix
index a695440..5267d9c 100644
--- a/packages/hosts/thinker.nix
+++ b/packages/hosts/thinker.nix
@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   networking.hostName = "thinker";
 
   boot = {
@@ -7,13 +8,17 @@
       systemd-boot.enable = true;
     };
     /*
-    sudo filefrag -v /swap/swapfile | awk '$1=="0:" {print substr($4, 1, length($4)-2)}'
-    the above won't work for btrfs, instead you need
-    btrfs inspect-internal map-swapfile -r /swap/swapfile
-    https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation_into_swap_file
+      sudo filefrag -v /swap/swapfile | awk '$1=="0:" {print substr($4, 1, length($4)-2)}'
+      the above won't work for btrfs, instead you need
+      btrfs inspect-internal map-swapfile -r /swap/swapfile
+      https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation_into_swap_file
     */
     # kernelParams = ["boot.shell_on_fail"];
-    initrd.availableKernelModules = ["xhci_pci" "nvme" "ahci"];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "nvme"
+      "ahci"
+    ];
   };
 
   home-manager.users.daniel = {
@@ -39,19 +44,21 @@
         }
       ];
     };
-    services.hypridle = let
-      secondsPerMinute = 60;
-      lockSeconds = 10 * secondsPerMinute;
-    in {
-      settings = {
-        listener = [
-          {
-            timeout = lockSeconds + 55;
-            on-timeout = ''systemctl suspend'';
-          }
-        ];
+    services.hypridle =
+      let
+        secondsPerMinute = 60;
+        lockSeconds = 10 * secondsPerMinute;
+      in
+      {
+        settings = {
+          listener = [
+            {
+              timeout = lockSeconds + 55;
+              on-timeout = ''systemctl suspend'';
+            }
+          ];
+        };
       };
-    };
 
     wayland.windowManager.hyprland = {
       settings = {
diff --git a/packages/iosevkaLyteTerm.nix b/packages/iosevkaLyteTerm.nix
index a869845..36aacfb 100644
--- a/packages/iosevkaLyteTerm.nix
+++ b/packages/iosevkaLyteTerm.nix
@@ -1,6 +1,9 @@
-{iosevka, ...}: let
+{ iosevka, ... }:
+let
   set = "LyteTerm";
-in ((iosevka.override {
+in
+(
+  (iosevka.override {
     inherit set;
 
     privateBuildPlan = ''
@@ -122,8 +125,8 @@ in ((iosevka.override {
       question = 'smooth'
       punctuation-dot = 'round'
     '';
-  })
-  .overrideAttrs {
+  }).overrideAttrs
+  {
     buildPhase = ''
       export HOME=$TMPDIR
       runHook preBuild
@@ -142,4 +145,5 @@ in ((iosevka.override {
       install "dist/$pname/WOFF2"/* "$wfontdir"
       runHook postInstall
     '';
-  })
+  }
+)
diff --git a/packages/iosevkaLyteTermSubset.nix b/packages/iosevkaLyteTermSubset.nix
index c26bc06..5bf777d 100644
--- a/packages/iosevkaLyteTermSubset.nix
+++ b/packages/iosevkaLyteTermSubset.nix
@@ -9,8 +9,13 @@ pkgs.stdenvNoCC.mkDerivation {
   inherit (iosevkaLyteTerm) version;
 
   pname = "${iosevkaLyteTerm.pname}Subset";
-  buildInputs = [parallel] ++ (with python311Packages; [fonttools brotli]);
-  PYTHONPATH = pkgs.python3.withPackages (pp: with pp; [brotli]);
+  buildInputs =
+    [ parallel ]
+    ++ (with python311Packages; [
+      fonttools
+      brotli
+    ]);
+  PYTHONPATH = pkgs.python3.withPackages (pp: with pp; [ brotli ]);
   src = iosevkaLyteTerm;
 
   installPhase = ''