edit packages list

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
Edit helium configuration
2026-07-07 00:22:33 +02:00 · 2026-05-26 20:45:40 +02:00 · 2026-05-26 20:38:27 +02:00 · 2026-05-26 20:38:19 +02:00 · 2026-05-26 01:18:23 +02:00 · 2026-05-22 09:20:58 +02:00
100 changed files with 2471 additions and 1860 deletions
@@ -119,6 +119,8 @@ sudo nixos-rebuild switch --flake ~/.config/nixos#yourhostname
 - [THEMES](docs/THEMES.md): How themes work and how to create your own
 - [WALLPAPERS](https://github.com/anotherhadi/awesome-wallpapers): An awesome
  collection of wallpapers
+- [NEOVIM](docs/NEOVIM.md): How to use the Neovim config in your own flake
+- [GROUPS](docs/GROUPS.md): Reusable package groups (dev, cybersecurity)

 - [CONTRIBUTING](docs/CONTRIBUTING.md): How to contribute
 - [LICENSE](LICENSE): MIT License
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2024 Hadi
+Copyright (c) 2026 Hadi

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -129,6 +129,8 @@ sudo nixos-rebuild switch --flake ~/.config/nixos#yourhostname
 - [THEMES](docs/THEMES.md): How themes work and how to create your own
 - [WALLPAPERS](https://github.com/anotherhadi/awesome-wallpapers): An awesome
  collection of wallpapers
+- [NEOVIM](docs/NEOVIM.md): How to use the Neovim config in your own flake
+- [GROUPS](docs/GROUPS.md): Reusable package groups (dev, cybersecurity)

 - [CONTRIBUTING](docs/CONTRIBUTING.md): How to contribute
 - [LICENSE](LICENSE): MIT License
@@ -0,0 +1,44 @@
+# Groups
+
+Groups are curated sets of packages exposed as flake outputs. Each group has two forms:
+
+- **`homeManagerModules.<group>`** — full home-manager module (packages + files + systemd units)
+- **`packages.<group>`** — standalone environment for `nix shell` (packages only)
+
+## Available groups
+
+- dev (go, bun, air, ...)
+- cybersecurity (nmap, john, dirb, ffuf, ...)
+
+For the Cybersecurity group, the home-manager module also sets up:
+
+- `~/Cyber/wordlists/` with SecLists, fuzz4bounty, and hashcat rules
+- `~/Cyber/tmp/` as a temporary workspace
+
+## Use in another flake
+
+Add this repo as an input:
+
+```nix
+inputs.nixy.url = "github:anotherhadi/nixy";
+```
+
+Import the home-manager module in your home configuration:
+
+```nix
+{ inputs, ... }: {
+  imports = [
+    inputs.nixy.homeManagerModules.cybersecurity
+    # inputs.nixy.homeManagerModules.dev
+  ];
+}
+```
+
+## Quick shell without installing
+
+```sh
+nix shell github:anotherhadi/nixy#cybersecurity
+nix shell github:anotherhadi/nixy#dev
+```
+
+This drops you into a shell with all tools in `PATH`. No home-manager required, no wordlists or systemd units.
@@ -0,0 +1,40 @@
+# Neovim
+
+The Neovim configuration is built with [nvf](https://github.com/notashelf/nvf) and exposed as a standalone flake output.
+It can be used in three ways: run it directly, import it into another flake's home-manager setup, or use it as part of this config.
+
+## Run directly
+
+No installation needed:
+
+```sh
+nix run github:anotherhadi/nixy#nvim
+```
+
+## Use in another flake
+
+Add this repo as an input:
+
+```nix
+inputs.nixy.url = "github:anotherhadi/nixy";
+```
+
+Then import the home-manager module in your home configuration:
+
+```nix
+{ inputs, ... }: {
+  imports = [ inputs.nixy.homeManagerModules.nvim ];
+}
+```
+
+## What's included
+
+| File            | Description                                                            |
+| --------------- | ---------------------------------------------------------------------- |
+| `options.nix`   | Core settings: theme (catppuccin mocha), clipboard, indentation, folds |
+| `languages.nix` | LSP, treesitter, formatters, diagnostics, and per-language config      |
+| `keymaps.nix`   | All key mappings (leader: `space`)                                     |
+| `picker.nix`    | Snacks picker + oil.nvim                                               |
+| `snacks.nix`    | Snacks extras: image preview, zen mode, git signs, statuscolumn        |
+| `utils.nix`     | Bufferline, lualine, copilot, lazygit, toggleterm, autocomplete        |
+| `mini.nix`      | Mini.nvim suite: pairs, comment, icons, indentscope, diff, git         |
@@ -14,6 +14,8 @@
    sops-nix.url = "github:Mic92/sops-nix";
    nvf.url = "github:notashelf/nvf";
    bun2nix.url = "github:nix-community/bun2nix";
+    usbguard-tui.url = "github:anotherhadi/usbguard-tui";
+    jwt-tui.url = "github:anotherhadi/jwt-tui";

    nix-index-database = {
      url = "github:nix-community/nix-index-database";
@@ -43,100 +45,39 @@
    blog.url = "github:anotherhadi/blog";
    awesome-wallpapers.url = "github:anotherhadi/awesome-wallpapers";
    iknowyou.url = "github:anotherhadi/iknowyou";
-
-    # Qutebrowser userscripts (greasemonkey)
-    qs-return-youtube-dislike = {
-      url = "https://update.greasyfork.org/scripts/436115/Return%20YouTube%20Dislike.user.js";
-      flake = false;
-    };
-    qs-sponsorblock-lite = {
-      url = "https://update.greasyfork.org/scripts/560869/SponsorBlock%20Lite.user.js";
-      flake = false;
-    };
-    qs-dont-track-me-google = {
-      url = "https://update.greasyfork.org/scripts/428243/Don%27t%20track%20me%20Google.user.js";
-      flake = false;
-    };
-    qs-i-dont-care-about-cookies = {
-      url = "https://update.greasyfork.org/scripts/522645/I%20don%27t%20care%20about%20cookies.user.js";
-      flake = false;
-    };
-    qs-tracking-token-stripper = {
-      url = "https://github.com/doggy8088/TrackingTokenStripper/raw/refs/heads/master/TrackingTokenStripper.user.js";
-      flake = false;
-    };
-    qs-bypass-paywalls-clean = {
-      url = "https://gitflic.ru/project/magnolia1234/bypass-paywalls-clean-filters/blob/raw?file=userscript/bpc.en.user.js";
-      flake = false;
-    };
-    qs-anti-adblock-fuckoff = {
-      url = "https://update.greasyfork.org/scripts/397070/Anti-AdBlocker%20Fuckoff.user.js";
-      flake = false;
-    };
+    spilltea.url = "github:anotherhadi/spilltea";
+    helium-browser.url = "github:oxcl/nix-flake-helium-browser";
  };

-  outputs = inputs @ {nixpkgs, ...}: {
+  outputs = inputs @ {
+    nixpkgs,
+    nixpkgs-stable,
+    ...
+  }: let
+    system = "x86_64-linux";
+    pkgs = nixpkgs.legacyPackages.${system};
+    args = {
+      inherit
+        inputs
+        nixpkgs
+        system
+        pkgs
+        ;
+      pkgs-stable = nixpkgs-stable.legacyPackages.${system};
+    };
+    merge = nixpkgs.lib.foldl nixpkgs.lib.recursiveUpdate {};
+  in
+    merge [
+      (import ./home/programs/nvf/flake.nix args)
+      (import ./home/programs/group/flake.nix args)
+      (import ./home/programs/nixy/flake.nix args)
+      {
+        formatter.${system} = pkgs.alejandra;
        nixosConfigurations = {
-      h-laptop =
-        # CHANGEME: This should match the 'hostname' in your variables.nix file
-        nixpkgs.lib.nixosSystem {
-          modules = [
-            {
-              nixpkgs.overlays = [
-                (final: prev: {
-                  # FIXME: Workaround: Mesa crash with AMD GPU + Wayland + Qt 6.11.0
-                  qutebrowser = prev.symlinkJoin {
-                    name = "qutebrowser";
-                    paths = [prev.qutebrowser];
-                    buildInputs = [prev.makeWrapper];
-                    postBuild = ''
-                      wrapProgram $out/bin/qutebrowser \
-                        --set LIBGL_ALWAYS_SOFTWARE 1
-                    '';
-                  };
-                })
-              ];
-              _module.args = {
-                inherit inputs;
+          h-laptop = import ./hosts/laptop/flake.nix args;
+          h-work = import ./hosts/work/flake.nix args;
+          jack = import ./hosts/server/flake.nix args;
        };
      }
-            inputs.nixos-hardware.nixosModules.omen-16-n0005ne # CHANGEME: check https://github.com/NixOS/nixos-hardware
-            inputs.home-manager.nixosModules.home-manager
-            inputs.stylix.nixosModules.stylix
-            inputs.nix-index-database.nixosModules.default
-            ./hosts/laptop/configuration.nix # CHANGEME: change the path to match your host folder
    ];
-        };
-
-      h-work = nixpkgs.lib.nixosSystem {
-        modules = [
-          {
-            nixpkgs.overlays = [];
-            _module.args = {
-              inherit inputs;
-            };
-          }
-          inputs.home-manager.nixosModules.home-manager
-          inputs.stylix.nixosModules.stylix
-          inputs.nix-index-database.nixosModules.default
-          ./hosts/work/configuration.nix
-        ];
-      };
-
-      # Jack is my server
-      jack = nixpkgs.lib.nixosSystem {
-        modules = [
-          {_module.args = {inherit inputs;};}
-          inputs.home-manager.nixosModules.home-manager
-          inputs.stylix.nixosModules.stylix
-          inputs.sops-nix.nixosModules.sops
-          inputs.nixarr.nixosModules.default
-          # inputs.eleakxir.nixosModules.eleakxir
-          inputs.nix-index-database.nixosModules.default
-          inputs.default-creds.nixosModules.default
-          ./hosts/server/configuration.nix
-        ];
-      };
-    };
-  };
 }
@@ -1,78 +0,0 @@
-{
-  programs.brave = {
-    enable = true;
-    commandLineArgs = [
-      # Wayland Native
-      "--enable-features=UseOzonePlatform"
-      "--ozone-platform=wayland"
-
-      # Hardware Acceleration (NVIDIA optimized)
-      "--enable-accelerated-video-decode"
-      "--enable-gpu-rasterization"
-      "--enable-zero-copy"
-      "--ignore-gpu-blocklist"
-
-      # Performance
-      "--enable-features=VaapiVideoDecoder"
-      "--enable-features=VaapiVideoEncoder"
-      "--enable-features=CanvasOopRasterization"
-      "--disable-features=UseChromeOSDirectVideoDecoder"
-
-      # Privacy & Security
-      "--disable-features=MediaRouter" # Disable Chromecast
-      "--disable-features=OptimizationHints" # No Google suggestions
-      "--disable-features=AutofillSavePaymentMethods"
-      "--disable-background-networking" # No telemetry
-      "--disable-sync" # Manual sync control
-
-      # Wayland-specific fixes
-      "--disable-features=WaylandWpColorManagerV1" # Color management fix
-
-      # UI/UX
-      "--force-dark-mode" # Match Stylix theme
-      "--enable-features=WebUIDarkMode"
-      "--no-default-browser-check"
-    ];
-    extensions = let
-      ids = [
-      ];
-    in
-      map (id: {inherit id;}) ids;
-  };
-
-  xdg.configFile."BraveSoftware/Brave-Browser/Policies/managed/policy.json".text = builtins.toJSON {
-    BraveShieldsAdControl = 2;
-    BraveShieldsTrackersBlocked = 1;
-    BraveShieldsHttpsEverywhere = 1;
-    BraveRewardsDisabled = 1;
-    BraveWalletDisabled = 1;
-    BraveVPNDisabled = 1;
-    BraveAIChatEnabled = 0;
-    PasswordManagerEnabled = 0;
-    BravePlaylistEnabled = 0;
-    BraveWebDiscoveryEnabled = 0;
-    BraveStatsPingEnabled = 0;
-    DnsOverHttpsMode = "automatic";
-    BraveDarkMode = 1;
-  };
-
-  xdg.desktopEntries = {
-    brave-incognito = {
-      name = "Brave (Private window)";
-      genericName = "Navigateur Web";
-      exec = "brave --incognito";
-      icon = "brave-browser";
-      terminal = false;
-      categories = ["Network" "WebBrowser"];
-      mimeType = ["text/html" "text/xml"];
-    };
-    brave-tor = {
-      name = "Brave (Private window w/Tor)";
-      genericName = "Navigateur Web";
-      exec = "brave --tor";
-      icon = "brave-browser";
-      terminal = false;
-      categories = ["Network" "WebBrowser"];
-    };
-  };
-}
@@ -1,7 +1,16 @@
-{
+{pkgs, ...}: let
+  cursorShaders = pkgs.fetchFromGitHub {
+    owner = "sahaj-b";
+    repo = "ghostty-cursor-shaders";
+    rev = "06d4e90fb5410e9c4d0b3131584060adddf89406";
+    hash = "sha256-G/UIr1bKnxn1AcHl/4FL/jou6b7M2VeREslYVELxdmw=";
+  };
+in {
  home.sessionVariables = {
    TERMINAL = "ghostty";
    TERM = "ghostty";
+    XMODIFIERS = "@im=none";
+    GTK_IM_MODULE = "simple";
  };

  programs.ghostty = {
@@ -16,15 +25,17 @@
      clipboard-write = "allow";
      copy-on-select = "clipboard";
      app-notifications = false;
+      custom-shader = "${cursorShaders}/cursor_warp.glsl";
+      custom-shader-animation = "always";
      keybind = [
-        "ctrl+j=goto_split:left"
-        "ctrl+i=goto_split:up"
-        "ctrl+k=goto_split:down"
-        "ctrl+l=goto_split:right"
-        "shift+ctrl+h=new_split:left"
-        "shift+ctrl+j=new_split:down"
-        "shift+ctrl+k=new_split:up"
-        "shift+ctrl+l=new_split:right"
+        # "ctrl+j=goto_split:left"
+        # "ctrl+i=goto_split:up"
+        # "ctrl+k=goto_split:down"
+        # "ctrl+l=goto_split:right"
+        # "shift+ctrl+h=new_split:left"
+        # "shift+ctrl+j=new_split:down"
+        # "shift+ctrl+k=new_split:up"
+        # "shift+ctrl+l=new_split:right"
        "shift+ctrl+tab=new_tab"
      ];
    };
@@ -44,10 +44,8 @@ in {
        st = "status";
        br = "branch";
        df = "!git hist | peco | awk '{print $2}' | xargs -I {} git diff {}^ {}";
-        hist = ''
-          log --pretty=format:"%Cgreen%h %Creset%cd %Cblue[%cn] %Creset%s%C(yellow)%d%C(reset)" --graph --date=relative --decorate --all'';
-        llog = ''
-          log --graph --name-status --pretty=format:"%C(red)%h %C(reset)(%cd) %C(green)%an %Creset%s %C(yellow)%d%Creset" --date=relative'';
+        hist = ''log --pretty=format:"%Cgreen%h %Creset%cd %Cblue[%cn] %Creset%s%C(yellow)%d%C(reset)" --graph --date=relative --decorate --all'';
+        llog = ''log --graph --name-status --pretty=format:"%C(red)%h %C(reset)(%cd) %C(green)%an %Creset%s %C(yellow)%d%Creset" --date=relative'';
        edit-unmerged = "!f() { git ls-files --unmerged | cut -f2 | sort -u ; }; hx `f`";
      };
    };
@@ -21,7 +21,10 @@ in {
      };
      gui = {
        theme = {
-          activeBorderColor = [accent "bold"];
+          activeBorderColor = [
+            accent
+            "bold"
+          ];
          inactiveBorderColor = [muted];
        };
        showListFooter = false;
@@ -1,11 +1,6 @@
-{
-  pkgs,
-  pkgs-stable,
-  ...
-}: {
+{pkgs-stable, ...}: {
  home.packages = with pkgs-stable; [
    vlc # Video player
-    blanket # White-noise app
    obsidian # Note taking app
    textpieces # Manipulate texts
    resources # Ressource monitor
@@ -16,6 +11,6 @@
    onlyoffice-desktopeditors # Office suite

    signal-desktop # Messaging app
-    element-desktop # Messaging app
+    librewolf
  ];
 }
@@ -0,0 +1,39 @@
+{
+  pkgs,
+  pkgs-stable,
+  inputs,
+  system,
+}:
+(with pkgs-stable; [
+  httpie
+  trufflehog
+  sttr
+  wireshark
+  nmap
+  john
+  hashcat
+  metasploit
+  haiti
+  hydra
+  dnsrecon
+  whois
+  dig
+  nosqli
+  jwt-cli
+  nuclei
+  caido
+  gobuster
+  dirb
+  ffuf
+  sqlmap
+  katana
+  inetutils
+  samba
+  openvpn
+  mariadb
+  redis
+])
++ [
+  inputs.spilltea.packages.${system}.default
+  inputs.jwt-tui.packages.${system}.default
+]
@@ -1,38 +1,13 @@
 {
+  inputs,
  pkgs-stable,
  pkgs,
  ...
 }: {
-  home.packages = with pkgs-stable; [
-    wireshark
-    nmap
-    john
-    hashcat
-    metasploit
-    haiti
-    hydra
-    dnsrecon
-    whois
-    dig
-    nosqli
-    jwt-cli
-    nuclei
-
-    # Web
-    caido
-    nuclei
-    gobuster
-    dirb
-    ffuf
-    sqlmap
-
-    # Utils
-    inetutils
-    samba
-    openvpn
-    mariadb
-    redis
-  ];
+  home.packages = import ./cybersecurity-packages.nix {
+    inherit pkgs pkgs-stable inputs;
+    system = pkgs.stdenv.hostPlatform.system;
+  };

  systemd.user.tmpfiles.rules = [
    "d %h/Cyber/tmp 0755 - - -"
@@ -41,23 +16,19 @@
  ];

  home.file = {
-    "Cyber/wordlists/seclists" = {
-      source = pkgs.fetchFromGitHub {
+    "Cyber/wordlists/seclists".source = pkgs.fetchFromGitHub {
      owner = "danielmiessler";
      repo = "SecLists";
      rev = "47aa98053fce8670c6489e4f6fb57dc34881d8bd";
      hash = "sha256-ojXLB/TXap1Qi0MtV5/WJlJpjNIDYx/sLY2KHm0uFKI=";
    };
-    };

-    "Cyber/wordlists/fuzz4bounty" = {
-      source = pkgs.fetchFromGitHub {
+    "Cyber/wordlists/fuzz4bounty".source = pkgs.fetchFromGitHub {
      owner = "0xPugal";
      repo = "fuzz4bounty";
      rev = "a805f6b434033f054312da0ddc2bc3021cc9a3b0";
      hash = "sha256-wMhx1CcxIyw2E7gJXQxXAFc7m5nYt0FXNkoTZqFMQh4=";
    };
-    };

    # RULES
    "Cyber/wordlists/rules/oneruletorulethemstill".source = pkgs.fetchFromGitHub {
@@ -67,11 +38,9 @@
      hash = "sha256-h7MeymIXS/6wlPRt4lzsIEqOOssP0lDx9nQip65cwZw=";
    };

-    "Cyber/wordlists/rules/best64.rule" = {
-      source = pkgs.fetchurl {
+    "Cyber/wordlists/rules/best64.rule".source = pkgs.fetchurl {
      url = "https://raw.githubusercontent.com/CarlosLannister/OwadeReborn/refs/heads/master/owade/fileAnalyze/hashcatLib/best64.rule%7E";
      hash = "sha256-T0XkMHJZQiy63/j25nGTkaiDFjc+blmgEVGTAFgVylU=";
    };
  };
-  };
 }
@@ -0,0 +1,22 @@
+{
+  pkgs,
+  pkgs-stable,
+  inputs,
+  system,
+}:
+(with pkgs; [
+  go
+  bun
+  nodejs
+  claude-code
+  inputs.bun2nix.packages.${system}.default
+])
++ (with pkgs-stable; [
+  air
+  duckdb
+  docker
+  python3
+  jq
+  just
+  nix-prefetch-github
+])
@@ -4,21 +4,8 @@
  inputs,
  ...
 }: {
-  home.packages =
-    (with pkgs; [
-      # Unstable: latest toolchain versions preferred for dev
-      go
-      bun
-      nodejs
-      air
-      duckdb
-      claude-code
-      inputs.bun2nix.packages.${stdenv.hostPlatform.system}.default
-    ])
-    ++ (with pkgs-stable; [
-      docker
-      python3
-      jq
-      just
-    ]);
+  home.packages = import ./dev-packages.nix {
+    inherit pkgs pkgs-stable inputs;
+    system = pkgs.stdenv.hostPlatform.system;
+  };
 }
@@ -0,0 +1,21 @@
+{
+  inputs,
+  pkgs,
+  pkgs-stable,
+  system,
+  ...
+}: let
+  devPackages = import ./dev-packages.nix {inherit pkgs pkgs-stable inputs system;};
+  cyberPackages = import ./cybersecurity-packages.nix {inherit pkgs pkgs-stable inputs system;};
+in {
+  packages.${system} = {
+    dev = pkgs.buildEnv {
+      name = "dev-tools";
+      paths = devPackages;
+    };
+    cybersecurity = pkgs.buildEnv {
+      name = "cybersecurity-tools";
+      paths = cyberPackages;
+    };
+  };
+}
@@ -1,9 +1,14 @@
-{pkgs-stable, ...}: {
+{
+  pkgs-stable,
+  inputs,
+  ...
+}: {
  home.packages = with pkgs-stable; [
    peaclock
    cbonsai
    pipes
    cmatrix
    fastfetch
+    inputs.usbguard-tui.packages.${system}.default
  ];
 }
@@ -0,0 +1,459 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  bookmarkList =
+    (import ./general.nix)
+    ++ (import ./tools.nix)
+    ++ (import ./entertainment.nix)
+    ++ (import ./infosec.nix)
+    ++ (import ./other.nix)
+    ++ (import ./jack.nix);
+
+  c = config.lib.stylix.colors;
+
+  stripProtocol = url: lib.removePrefix "https://" (lib.removePrefix "http://" url);
+  stripDomain = url: builtins.head (lib.splitString "/" (stripProtocol url));
+
+  mkCard = item: let
+    domain = stripDomain item.url;
+    initial = builtins.substring 0 1 item.name;
+  in ''
+    <a href="${item.url}" class="card">
+      <div class="favicon-wrapper">
+        <img class="favicon" src="https://icons.duckduckgo.com/ip3/${domain}.ico" alt="" aria-hidden="true" loading="lazy" onerror="this.style.display='none';this.nextElementSibling.style.display='flex'">
+        <span class="favicon-fallback" style="display:none">${initial}</span>
+      </div>
+      <div class="card-info">
+        <span class="card-name">${item.name}</span>
+        <span class="card-url">${stripProtocol item.url}</span>
+      </div>
+    </a>'';
+
+  mkFolderContent = items: let
+    step = acc: item:
+      if item ? url
+      then acc // {pending = acc.pending ++ [item];}
+      else {
+        chunks =
+          acc.chunks
+          ++ lib.optional (acc.pending != []) {
+            isCards = true;
+            items = acc.pending;
+          }
+          ++ [
+            {
+              isCards = false;
+              folder = item;
+            }
+          ];
+        pending = [];
+      };
+    result =
+      lib.foldl' step {
+        chunks = [];
+        pending = [];
+      }
+      items;
+    chunks =
+      result.chunks
+      ++ lib.optional (result.pending != []) {
+        isCards = true;
+        items = result.pending;
+      };
+  in
+    lib.concatMapStrings (
+      chunk:
+        if chunk.isCards
+        then ''
+          <div class="cards">
+            ${lib.concatMapStrings mkCard chunk.items}
+          </div>''
+        else mkFolder chunk.folder
+    )
+    chunks;
+
+  mkFolder = folder: let
+    iconHtml =
+      if folder ? icon
+      then ''<span class="material-symbols-outlined folder-icon" aria-hidden="true">${folder.icon}</span>''
+      else "";
+  in ''
+    <details class="folder-section" open>
+      <summary class="folder-title">
+        ${iconHtml}<span class="folder-name">${folder.name}</span>
+        <svg class="chevron" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="6 9 12 15 18 9"/></svg>
+      </summary>
+      <div class="folder-content">
+        ${mkFolderContent folder.bookmarks}
+      </div>
+    </details>'';
+
+  grouped = let
+    step = acc: item:
+      if item ? url
+      then acc // {pending = acc.pending ++ [item];}
+      else {
+        groups =
+          acc.groups
+          ++ lib.optional (acc.pending != []) {
+            isRoot = true;
+            items = acc.pending;
+          }
+          ++ [
+            {
+              isRoot = false;
+              inherit item;
+            }
+          ];
+        pending = [];
+      };
+    result =
+      lib.foldl' step {
+        groups = [];
+        pending = [];
+      }
+      bookmarkList;
+  in
+    result.groups
+    ++ lib.optional (result.pending != []) {
+      isRoot = true;
+      items = result.pending;
+    };
+
+  mkSection = group:
+    if group.isRoot
+    then ''
+      <div class="root-section">
+        <div class="cards">
+          ${lib.concatMapStrings mkCard group.items}
+        </div>
+      </div>''
+    else mkFolder group.item;
+in {
+  home.file.".local/share/helium-startpage/index.html".text = ''
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>Bookmarks</title>
+      <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,300,0,0">
+      <style>
+        *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+        body {
+          background-color: #${c.base00};
+          color: #${c.base05};
+          font-family: 'Source Sans Pro', sans-serif;
+          font-size: 14px;
+          min-height: 100vh;
+          padding: 2.5rem 2rem;
+        }
+
+        .header {
+          max-width: 1100px;
+          margin: 0 auto 2rem;
+          display: flex;
+          align-items: center;
+          gap: 1.5rem;
+        }
+
+        .page-title {
+          font-size: 1.3rem;
+          font-weight: 700;
+          color: #${c.base0D};
+          letter-spacing: -0.01em;
+          flex-shrink: 0;
+        }
+
+        .search-bar {
+          flex: 1;
+          background-color: #${c.base01};
+          border: 1px solid #${c.base02};
+          border-radius: 8px;
+          color: #${c.base05};
+          font-family: 'Source Sans Pro', sans-serif;
+          font-size: 0.9rem;
+          padding: 0.5rem 0.9rem;
+          outline: none;
+          transition: border-color 0.15s ease;
+        }
+
+        .search-bar::placeholder { color: #${c.base03}; }
+        .search-bar:focus { border-color: #${c.base0D}; }
+
+        .collapse-btn {
+          flex-shrink: 0;
+          background: none;
+          border: 1px solid #${c.base02};
+          border-radius: 8px;
+          color: #${c.base03};
+          cursor: pointer;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          padding: 0.47rem;
+          transition: color 0.15s ease, border-color 0.15s ease;
+        }
+
+        .collapse-btn:hover {
+          color: #${c.base0D};
+          border-color: #${c.base0D};
+        }
+
+        .collapse-btn svg { width: 16px; height: 16px; }
+
+        .bookmarks-container {
+          max-width: 1100px;
+          margin: 0 auto;
+          display: flex;
+          flex-direction: column;
+          gap: 0.75rem;
+        }
+
+        .root-section { margin-bottom: 1rem; }
+
+        details.folder-section { border-radius: 8px; }
+
+        details.folder-section > summary {
+          list-style: none;
+          cursor: pointer;
+          display: flex;
+          align-items: center;
+          gap: 0.5rem;
+          padding: 0.45rem 0.5rem;
+          border-radius: 8px;
+          user-select: none;
+          transition: background-color 0.12s ease;
+        }
+
+        details.folder-section > summary::-webkit-details-marker { display: none; }
+
+        details.folder-section > summary:hover {
+          background-color: #${c.base01};
+          color: #${c.base0D};
+        }
+
+        details.folder-section > summary:hover .folder-name { color: #${c.base0D}; }
+        details.folder-section > summary:hover .folder-icon { color: #${c.base0D}; }
+
+        .folder-icon {
+          font-size: 14px;
+          line-height: 1;
+          flex-shrink: 0;
+          color: #${c.base04};
+          user-select: none;
+        }
+
+        .folder-name {
+          font-size: 0.72rem;
+          font-weight: 700;
+          letter-spacing: 0.12em;
+          text-transform: uppercase;
+          color: #${c.base03};
+          flex: 1;
+        }
+
+        .chevron {
+          width: 13px;
+          height: 13px;
+          color: #${c.base03};
+          transition: transform 0.2s ease;
+          flex-shrink: 0;
+        }
+
+        details[open] > summary > .chevron { transform: rotate(180deg); }
+
+        .folder-content {
+          padding: 0.4rem 0 0.5rem 0;
+          display: flex;
+          flex-direction: column;
+          gap: 0.25rem;
+        }
+
+        .folder-content > details.folder-section > summary { padding-left: 1.2rem; }
+        .folder-content > details.folder-section > .folder-content { padding-left: 1rem; }
+
+        .cards {
+          display: grid;
+          grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
+          gap: 0.4rem;
+        }
+
+        .card {
+          display: flex;
+          align-items: center;
+          gap: 0.7rem;
+          padding: 0.6rem 0.8rem;
+          background-color: #${c.base01};
+          border: 1px solid #${c.base02};
+          border-radius: 10px;
+          text-decoration: none;
+          transition: background-color 0.12s ease, border-color 0.12s ease;
+          overflow: hidden;
+        }
+
+        .card:hover {
+          background-color: #${c.base02};
+          border-color: #${c.base0D};
+        }
+
+        .favicon-wrapper { position: relative; width: 18px; height: 18px; flex-shrink: 0; }
+
+        .favicon {
+          position: absolute;
+          inset: 0;
+          width: 100%;
+          height: 100%;
+          object-fit: contain;
+          border-radius: 3px;
+        }
+
+        .favicon-fallback {
+          position: absolute;
+          inset: 0;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          background-color: #${c.base02};
+          border-radius: 4px;
+          color: #${c.base04};
+          font-size: 10px;
+          font-weight: 700;
+          text-transform: uppercase;
+          user-select: none;
+        }
+
+        .card-info {
+          display: flex;
+          flex-direction: column;
+          gap: 0.05rem;
+          overflow: hidden;
+          flex: 1;
+        }
+
+        .card-name {
+          color: #${c.base05};
+          font-size: 0.86rem;
+          font-weight: 500;
+          white-space: nowrap;
+          overflow: hidden;
+          text-overflow: ellipsis;
+          transition: color 0.12s ease;
+        }
+
+        .card:hover .card-name { color: #${c.base0D}; }
+
+        .card-url {
+          color: #${c.base03};
+          font-family: 'Maple Mono NF', monospace;
+          font-size: 0.7rem;
+          white-space: nowrap;
+          overflow: hidden;
+          text-overflow: ellipsis;
+        }
+
+        .no-results {
+          color: #${c.base03};
+          font-size: 0.9rem;
+          padding: 0.5rem 0.2rem;
+          display: none;
+        }
+      </style>
+    </head>
+    <body>
+      <div class="header">
+        <h1 class="page-title">Bookmarks</h1>
+        <input id="search" class="search-bar" type="text" placeholder="Search…" autocomplete="off" spellcheck="false">
+        <button id="collapse-btn" class="collapse-btn" title="Collapse all folders" aria-label="Collapse all folders">
+          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <polyline points="4 14 10 14 10 20"/><polyline points="20 10 14 10 14 4"/><line x1="10" y1="14" x2="3" y2="21"/><line x1="21" y1="3" x2="14" y2="10"/>
+          </svg>
+        </button>
+      </div>
+      <div class="bookmarks-container">
+        <p id="no-results" class="no-results">No results</p>
+        ${lib.concatMapStrings mkSection grouped}
+      </div>
+      <script>
+        window.addEventListener('DOMContentLoaded', function () {
+          const input = document.getElementById('search');
+          const noResults = document.getElementById('no-results');
+          const collapseBtn = document.getElementById('collapse-btn');
+
+          input.focus();
+
+          collapseBtn.addEventListener('click', function () {
+            document.querySelectorAll('details.folder-section').forEach(function (d) {
+              d.open = false;
+            });
+          });
+
+          input.addEventListener('input', function () {
+            const query = this.value.toLowerCase().trim();
+            let anyVisible = false;
+
+            if (query) {
+              document.querySelectorAll('details.folder-section').forEach(function (d) {
+                d.open = true;
+              });
+            }
+
+            document.querySelectorAll('.folder-section, .root-section').forEach(function (section) {
+              let sectionVisible = false;
+              section.querySelectorAll('.card').forEach(function (card) {
+                const name = card.querySelector('.card-name').textContent.toLowerCase();
+                const url = card.querySelector('.card-url').textContent.toLowerCase();
+                const match = !query || name.includes(query) || url.includes(query);
+                card.style.display = match ? ''' : 'none';
+                if (match) { sectionVisible = true; anyVisible = true; }
+              });
+              section.style.display = sectionVisible ? ''' : 'none';
+            });
+
+            noResults.style.display = anyVisible || !query ? 'none' : 'block';
+          });
+
+          input.addEventListener('keydown', function (e) {
+            if (e.key === 'Enter') {
+              const val = this.value.trim();
+              const isUrl = /^https?:\/\//i.test(val) || /^[a-zA-Z0-9-]+(\.[a-zA-Z]{2,})(\/.*)?$/.test(val);
+              if (isUrl) {
+                location.href = /^https?:\/\//i.test(val) ? val : 'https://' + val;
+              } else {
+                const first = document.querySelector('.card:not([style*="none"])');
+                if (first) {
+                  location.href = first.href;
+                } else {
+                  const q = encodeURIComponent(val);
+                  if (q) location.href = 'https://duckduckgo.com/?q=' + q;
+                }
+              }
+            }
+            if (e.key === 'Escape') {
+              this.value = ''';
+              this.dispatchEvent(new Event('input'));
+            }
+          });
+        });
+      </script>
+    </body>
+    </html>
+  '';
+
+  systemd.user.services.helium-startpage = {
+    Unit = {
+      Description = "Helium startpage HTTP server";
+      After = ["network.target"];
+    };
+    Service = {
+      Type = "simple";
+      ExecStart = "${pkgs.darkhttpd}/bin/darkhttpd %h/.local/share/helium-startpage --port 8888 --addr 127.0.0.1 --no-listing";
+      Restart = "on-failure";
+    };
+    Install.WantedBy = ["default.target"];
+  };
+}
@@ -7,14 +7,6 @@
    name = "Proton Drive";
    url = "https://drive.proton.me";
  }
-  {
-    name = "Proton Lumo";
-    url = "https://lumo.proton.me";
-  }
-  {
-    name = "Proton Calendar";
-    url = "https://calendar.proton.me";
-  }
  {
    name = "Github";
    url = "https://github.com";
@@ -0,0 +1,137 @@
+{
+  inputs,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  c = config.lib.stylix.colors;
+  rgb = base: map lib.strings.toInt [c."${base}-rgb-r" c."${base}-rgb-g" c."${base}-rgb-b"];
+
+  themeId = "abcadngacjlikcpkhleafekcdjmddegk";
+  themeKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6t46VoE3mdV1QNMgybpmQLi5PtYHejnNrSj4DkBZyiTzMzs7Yyvg64f78w3QubZA5cTXSQ7FVhVHvv30I8ym/jNzsSN6reh1t4PtKsFjFRugAty8bfKJGD404HZLOFN2z3G9UPVLBBgzDH3DWbb/kcOq60Mlo/QDCIjsieZg0G3EYMl4efoThzYPWoyv0UEoiliwrE/AChxbgipQetUZ48bFhTCsmnYzCze7clssfTobzWtJJG0qFx76LauHKymRS5OTFfgsovKqHUSFJ202Q53vFdUPP/j8PjSPr1kZeg1NYc7Ba3MoA49EwtJf5ol9oYu05EEnSQ5+1AoYVmdE8QIDAQAB";
+
+  themeManifest = builtins.toJSON {
+    manifest_version = 2;
+    name = "Stylix Theme";
+    version = "1.0";
+    key = themeKey;
+    theme.colors = {
+      frame = rgb "base00";
+      frame_inactive = rgb "base00";
+      frame_incognito = rgb "base00";
+      frame_incognito_inactive = rgb "base00";
+      toolbar = rgb "base00";
+      toolbar_button_icon = rgb "base05";
+      control_background = rgb "base00";
+      tab_text = rgb "base0D";
+      background_tab = rgb "base00";
+      tab_background_text = rgb "base04";
+      tab_background_text_inactive = rgb "base04";
+      ntp_background = rgb "base00";
+      ntp_text = rgb "base05";
+    };
+  };
+
+  heliumFlags = [
+    "--ozone-platform=wayland"
+    "--enable-features=UseOzonePlatform,VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization"
+    "--disable-features=UseChromeOSDirectVideoDecoder,WaylandWpColorManagerV1"
+    "--enable-accelerated-video-decode"
+    "--enable-gpu-rasterization"
+    "--use-gl=egl"
+    "--no-default-browser-check"
+    "--show-avatar-button=never"
+  ];
+
+  originalPkg = (inputs.helium-browser.packages.${pkgs.stdenv.hostPlatform.system}.helium).override {
+    flags = heliumFlags;
+  };
+
+  patchScript = pkgs.writeShellScript "helium-patch-prefs" ''
+    PROFILE="$HOME/.config/net.imput.helium/Default"
+    THEME_DIR="$PROFILE/Extensions/${themeId}/1.0_0"
+    PREFS="$PROFILE/Preferences"
+
+    mkdir -p "$THEME_DIR"
+    rm -f "$THEME_DIR/Cached Theme.pak"
+    printf '%s' '${themeManifest}' > "$THEME_DIR/manifest.json"
+
+    if [ -f "$PREFS" ]; then
+      tmp=$(mktemp)
+      ${lib.getExe pkgs.jq} \
+        --arg       id       "${themeId}" \
+        --slurpfile manifest "$THEME_DIR/manifest.json" \
+        '
+          .helium.browser.layout                       = 3     |
+          .helium.browser.minimal_location_bar        = true  |
+          .helium.browser.show_dynamic_new_tab_button = false |
+          .bookmark_bar.show_tab_groups               = false |
+          .extensions.settings[$id] = {
+            "active_permissions": {"api": [], "explicit_host": [], "manifest_permissions": [], "scriptable_host": []},
+            "creation_flags": 0,
+            "from_webstore":  false,
+            "install_time":   "13300000000000000",
+            "location":       1,
+            "manifest":       $manifest[0],
+            "path":           ($id + "/1.0_0"),
+            "state":          1,
+            "was_installed_by_default": false,
+            "was_installed_by_oem":     false
+          } |
+          .extensions.theme = {"id": $id, "use_system": false}
+        ' "$PREFS" > "$tmp" && mv "$tmp" "$PREFS"
+    fi
+  '';
+
+  baseWrapped = pkgs.symlinkJoin {
+    name = "helium-wrapped";
+    paths = [originalPkg];
+    nativeBuildInputs = [pkgs.makeWrapper];
+    postBuild = ''
+      wrapProgram $out/bin/helium \
+        --run ${lib.escapeShellArg (toString patchScript)}
+    '';
+  };
+
+  wrappedPkg = baseWrapped // {override = _: baseWrapped;};
+in {
+  imports = [
+    inputs.helium-browser.homeModules.default
+    ./bookmarks
+  ];
+
+  programs.helium = {
+    enable = true;
+    package = lib.mkForce wrappedPkg;
+  };
+
+  home.sessionVariables.BROWSER = "${config.programs.helium.package}/bin/helium";
+
+  xdg.desktopEntries.helium = {
+    name = "Helium";
+    genericName = "Navigateur Web";
+    exec = "${config.programs.helium.package}/bin/helium %U";
+    icon = "${config.programs.helium.package}/share/icons/hicolor/256x256/apps/helium.png";
+    terminal = false;
+    categories = ["Network" "WebBrowser"];
+    mimeType = [
+      "text/html"
+      "text/xml"
+      "application/xhtml+xml"
+      "x-scheme-handler/http"
+      "x-scheme-handler/https"
+      "x-scheme-handler/ftp"
+    ];
+  };
+
+  xdg.desktopEntries.helium-private = {
+    name = "Helium (Private window)";
+    genericName = "Navigateur Web";
+    exec = "${config.programs.helium.package}/bin/helium --incognito %U";
+    icon = "${config.programs.helium.package}/share/icons/hicolor/256x256/apps/helium.png";
+    terminal = false;
+    categories = ["Network" "WebBrowser"];
+    mimeType = ["text/html" "text/xml" "application/xhtml+xml"];
+  };
+}
@@ -0,0 +1,70 @@
+{...}: let
+  bookmarkList =
+    (import ./bookmarks/general.nix)
+    ++ (import ./bookmarks/tools.nix)
+    ++ (import ./bookmarks/entertainment.nix)
+    ++ (import ./bookmarks/infosec.nix)
+    ++ (import ./bookmarks/other.nix)
+    ++ (import ./bookmarks/jack.nix);
+
+  toChromium = items:
+    map (item:
+      if item ? url
+      then {inherit (item) name url;}
+      else {
+        name = item.name;
+        children = toChromium item.bookmarks;
+      })
+    items;
+in {
+  stylix.targets.chromium.enable = false;
+
+  programs.helium = {
+    enable = true;
+
+    policies = {
+      BrowserSignin = 0;
+      SyncDisabled = true;
+      SigninAllowed = false;
+
+      PasswordManagerEnabled = false;
+      AutofillAddressEnabled = false;
+      AutofillCreditCardEnabled = false;
+      SafeBrowsingEnabled = false;
+      MetricsReportingEnabled = false;
+      SpellCheckServiceEnabled = false;
+      DefaultCookiesSetting = 1;
+      DefaultGeolocationSetting = 2;
+      DefaultNotificationsSetting = 2;
+      DefaultPopupsSetting = 2;
+
+      DefaultBrowserSettingEnabled = false;
+      DeveloperToolsAvailability = 1;
+
+      DnsOverHttpsMode = "secure";
+      DnsOverHttpsTemplates = "https://dns.quad9.net/dns-query";
+
+      DefaultSearchProviderEnabled = true;
+      DefaultSearchProviderName = "Startpage";
+      DefaultSearchProviderSearchURL = "https://www.startpage.com/do/search?q={searchTerms}";
+      DefaultSearchProviderSuggestURL = "https://www.startpage.com/do/suggest?q={searchTerms}";
+
+      NewTabPageLocation = "http://127.0.0.1:8888";
+      HomepageIsNewTabPage = false;
+      HomepageLocation = "http://127.0.0.1:8888";
+      ShowHomeButton = false;
+      RestoreOnStartup = 4;
+
+      BookmarkBarEnabled = false;
+      ManagedBookmarks = toChromium bookmarkList;
+
+      ExtensionInstallForcelist = [
+        "dbepggeogbaibhgnhhndojpepiihcmeb" # Vimiu
+        "gcknhkkoolaabfmlnjonogaaifnjlfnp" # FoxyProxy
+        "ghmbeldphafepmbegfdlkpapadhbakde" # Proton Pass
+        "mdjildafknihdffpkfmmpnpoiajfjnjd" # Consent-O-Matic
+        "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # Privacy Badger
+      ];
+    };
+  };
+}
@@ -6,76 +6,26 @@
 #- - `nixy rebuild` - Rebuild the system.
 #- - `nixy ...` - ... see the script for more commands.
 {
-  pkgs,
  config,
+  lib,
+  pkgs,
  ...
-}: let
-  inherit (config.var) configDirectory;
+}: {
+  options.programs.nixy = {
+    enable = lib.mkEnableOption "nixy";
+    configDirectory = lib.mkOption {
+      type = lib.types.str;
+      default = "$HOME/.config/nixos";
+      description = "Path to the NixOS configuration directory";
+    };
+  };

-  nixy =
-    pkgs.writeShellScriptBin "nixy"
-    # bash
-    ''
-      EXTRA_ARGS="''${@:2}"
-
-      function exec() {
-        $@
-      }
-
-      function ui(){
-        DEFAULT_ICON="󰘳"
-
-        # "icon;name;command"[]
-        apps=(
-          "󰑓;Rebuild;nixy rebuild"
-          "󰐊;Test;nixy test"
-          "󰚰;Update;nixy update"
-          ";Collect Garbage;nixy gc"
-          "󰍜;Clean Boot Menu;nixy cb"
-          ";List generation;nixy listgen"
-        )
-
-        # Apply default icons if empty:
-        for i in "''${!apps[@]}"; do
-          apps[i]=$(echo "''${apps[i]}" | sed 's/^;/'$DEFAULT_ICON';/')
-        done
-
-        fzf_result=$(printf "%s\n" "''${apps[@]}" | awk -F ';' '{print $1" "$2}' | fzf)
-        [[ -z $fzf_result ]] && exit 0
-        fzf_result=''${fzf_result/ /;}
-        line=$(printf "%s\n" "''${apps[@]}" | grep "$fzf_result")
-        command=$(echo "$line" | sed 's/^[^;]*;//;s/^[^;]*;//')
-
-        exec "$command"
-        exit $?
-      }
-
-      [[ $1 == "" ]] && ui
-
-      if [[ $1 == "rebuild" ]];then
-        cd ${configDirectory} && git add . && sudo nixos-rebuild switch --flake . $EXTRA_ARGS
-      elif [[ $1 == "test" ]];then
-        cd ${configDirectory} && git add . && sudo nixos-rebuild test --flake . $EXTRA_ARGS
-      elif [[ $1 == "update" ]];then
-        cd ${configDirectory} && nix flake update $EXTRA_ARGS
-      elif [[ $1 == "gc" ]];then
-        echo "Starting Nix garbage collection..."
-        cd ${configDirectory} && \
-        echo "Cleaning up system garbage..." && \
-        sudo nix-collect-garbage -d && \
-        echo "Cleaning up user garbage..." && \
-        nix-collect-garbage -d && \
-        echo "Collecting garbage from Nix store..." && \
-        nix-store --gc && \
-        echo "Optimizing Nix store..." && \
-        nix-store --optimise
-        echo "Nix garbage collection complete."
-      elif [[ $1 == "cb" ]];then
-        sudo /run/current-system/bin/switch-to-configuration boot
-      elif [[ $1 == "listgen" ]];then
-        sudo nix-env -p /nix/var/nix/profiles/system --list-generations
-      else
-        echo "Unknown argument"
-      fi
-    '';
-in {home.packages = [nixy];}
+  config = lib.mkIf config.programs.nixy.enable {
+    home.packages = [
+      (import ./package.nix {
+        inherit pkgs;
+        inherit (config.programs.nixy) configDirectory;
+      })
+    ];
+  };
+}
@@ -0,0 +1,14 @@
+{
+  pkgs,
+  system,
+  ...
+}: {
+  packages.${system}.nixy = import ./package.nix {
+    inherit pkgs;
+    configDirectory = "$HOME/.config/nixos";
+  };
+
+  homeManagerModules.nixy = {
+    imports = [./default.nix];
+  };
+}
@@ -0,0 +1,69 @@
+{
+  pkgs,
+  configDirectory,
+}:
+pkgs.writeShellScriptBin "nixy"
+# bash
+''
+  EXTRA_ARGS="''${@:2}"
+
+  function exec() {
+    $@
+  }
+
+  function ui(){
+    DEFAULT_ICON="󰘳"
+
+    # "icon;name;command"[]
+    apps=(
+      "󰑓;Rebuild;nixy rebuild"
+      "󰐊;Test;nixy test"
+      "󰚰;Update;nixy update"
+      ";Collect Garbage;nixy gc"
+      "󰍜;Clean Boot Menu;nixy cb"
+      ";List generation;nixy listgen"
+    )
+
+    # Apply default icons if empty:
+    for i in "''${!apps[@]}"; do
+      apps[i]=$(echo "''${apps[i]}" | sed 's/^;/'$DEFAULT_ICON';/')
+    done
+
+    fzf_result=$(printf "%s\n" "''${apps[@]}" | awk -F ';' '{print $1" "$2}' | fzf)
+    [[ -z $fzf_result ]] && exit 0
+    fzf_result=''${fzf_result/ /;}
+    line=$(printf "%s\n" "''${apps[@]}" | grep "$fzf_result")
+    command=$(echo "$line" | sed 's/^[^;]*;//;s/^[^;]*;//')
+
+    exec "$command"
+    exit $?
+  }
+
+  [[ $1 == "" ]] && ui
+
+  if [[ $1 == "rebuild" ]];then
+    cd ${configDirectory} && git add . && sudo nixos-rebuild switch --flake . $EXTRA_ARGS
+  elif [[ $1 == "test" ]];then
+    cd ${configDirectory} && git add . && sudo nixos-rebuild test --flake . $EXTRA_ARGS
+  elif [[ $1 == "update" ]];then
+    cd ${configDirectory} && nix flake update $EXTRA_ARGS
+  elif [[ $1 == "gc" ]];then
+    echo "Starting Nix garbage collection..."
+    cd ${configDirectory} && \
+    echo "Cleaning up system garbage..." && \
+    sudo nix-collect-garbage -d && \
+    echo "Cleaning up user garbage..." && \
+    nix-collect-garbage -d && \
+    echo "Collecting garbage from Nix store..." && \
+    nix-store --gc && \
+    echo "Optimizing Nix store..." && \
+    nix-store --optimise
+    echo "Nix garbage collection complete."
+  elif [[ $1 == "cb" ]];then
+    sudo /run/current-system/bin/switch-to-configuration boot
+  elif [[ $1 == "listgen" ]];then
+    sudo nix-env -p /nix/var/nix/profiles/system --list-generations
+  else
+    echo "Unknown argument"
+  fi
+''
@@ -1,11 +1,13 @@
-# NVF is a Neovim configuration that provides a minimal setup with essential plugins and configurations.
 {
  inputs,
  pkgs,
  ...
 }: {
+  imports = [inputs.nvf.homeManagerModules.default];
+  programs.nvf = {
+    enable = true;
+    settings = {
      imports = [
-    inputs.nvf.homeManagerModules.default
        ./options.nix
        ./languages.nix
        ./picker.nix
@@ -14,8 +16,6 @@
        ./utils.nix
        ./mini.nix
      ];
-
-  programs.nvf = {
-    enable = true;
+    };
  };
 }
@@ -0,0 +1,37 @@
+{
+  inputs,
+  pkgs,
+  system,
+  ...
+}: let
+  nvimConfig = inputs.nvf.lib.neovimConfiguration {
+    inherit pkgs;
+    modules = [
+      ./options.nix
+      ./languages.nix
+      ./picker.nix
+      ./snacks.nix
+      ./keymaps.nix
+      ./utils.nix
+      ./mini.nix
+    ];
+  };
+in {
+  packages.${system}.nvim = nvimConfig.neovim;
+
+  apps.${system}.nvim = {
+    type = "app";
+    program = "${nvimConfig.neovim}/bin/nvim";
+  };
+  defaultApp.${system} = {
+    type = "app";
+    program = "${nvimConfig.neovim}/bin/nvim";
+  };
+
+  homeManagerModules.nvim = {
+    imports = [
+      inputs.nvf.homeManagerModules.default
+      ./default.nix
+    ];
+  };
+}
@@ -1,21 +1,13 @@
 {
-  programs.nvf.settings.vim = {
+  vim = {
    globals.mapleader = " ";
-    binds = {
-      whichKey = {
-        enable = true;
-        # TODO: registers
-        register = {};
-      };
-    };
    keymaps = [
-      # General Mappings
      {
        key = "s";
        mode = "n";
        silent = true;
-        action = "<cmd>lua require('flash').jump()<cr>";
-        desc = "Flash";
+        action = "<cmd>lua MiniJump2d.start(MiniJump2d.builtin_opts.single_character)<cr>";
+        desc = "Jump2d";
      }
      {
        key = "K";
@@ -32,52 +24,57 @@
        desc = "Next Buffer";
      }

-      # Disable Arrow Keys in Normal Mode and Middle click
+      # Format
      {
-        key = "<Up>";
+        key = "<leader>lf";
        mode = "n";
        silent = true;
-        action = "<Nop>";
-        desc = "Disable Up Arrow";
+        action = "<cmd>lua require('conform').format({ async = true, lsp_format = 'fallback' })<cr>";
+        desc = "Format file";
      }
+
+      # Terminal
      {
-        key = "<Down>";
+        key = "<leader>tt";
        mode = "n";
        silent = true;
-        action = "<Nop>";
-        desc = "Disable Down Arrow";
+        action = "<cmd>lua Snacks.terminal.toggle()<cr>";
+        desc = "Toggle terminal";
      }
      {
-        key = "<Left>";
+        key = "<leader>tf";
        mode = "n";
        silent = true;
-        action = "<Nop>";
-        desc = "Disable Left Arrow";
+        action = "<cmd>lua Snacks.terminal.toggle(nil, { style = 'float' })<cr>";
+        desc = "Toggle terminal (float)";
      }
      {
-        key = "<Right>";
+        key = "<leader>tg";
        mode = "n";
        silent = true;
-        action = "<Nop>";
-        desc = "Disable Right Arrow";
+        action = "<cmd>lua Snacks.lazygit()<cr>";
+        desc = "Lazygit";
      }
      {
-        key = "<MiddleMouse>";
-        mode = ["n" "i" "v"]; # Normal, Insert, Visual
-        action = "<nop>"; # No Operation
+        key = "<leader>ts";
+        mode = "v";
        silent = true;
+        action = ":<C-u>SttrTransform<CR>";
+        desc = "String Transform";
      }
      {
-        key = "<2-MiddleMouse>"; # Désactive aussi le double clic molette
-        mode = ["n" "i" "v"];
-        action = "<nop>";
+        key = "<leader>tj";
+        mode = "n";
        silent = true;
+        action = ":JwtTui<CR>";
+        desc = "JWT TUI";
      }
      {
-        key = "<3-MiddleMouse>"; # Désactive aussi le double clic molette
-        mode = ["n" "i" "v"];
-        action = "<nop>";
+        key = "<leader>tj";
+        mode = "v";
        silent = true;
+        action = ":<C-u>JwtTuiOpen<CR>";
+        desc = "JWT TUI";
      }

      # UI
@@ -138,27 +135,13 @@
        desc = "Hide tabline";
      }

-      # Windows
+      # Todos
      {
-        key = "<leader>ws";
+        key = "<leader>xt";
        mode = "n";
        silent = true;
-        action = "<cmd>split<cr>";
-        desc = "Split";
-      }
-      {
-        key = "<leader>wv";
-        mode = "n";
-        silent = true;
-        action = "<cmd>vsplit<cr>";
-        desc = "VSplit";
-      }
-      {
-        key = "<leader>wd";
-        mode = "n";
-        silent = true;
-        action = "<cmd>close<cr>";
-        desc = "Close";
+        action = "<cmd>TodoTrouble<cr>";
+        desc = "Todo (Trouble)";
      }

      # QOL
@@ -207,19 +190,14 @@
        desc = "Move to right window";
      }

-      # Format
-      {
-        key = "<leader>lf";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua require('conform').format({ async = true, lsp_format = 'fallback' })<cr>";
-        desc = "Format file";
-      }
-
      # Save
      {
        key = "<C-s>";
-        mode = ["n" "i" "v"];
+        mode = [
+          "n"
+          "i"
+          "v"
+        ];
        silent = true;
        action = "<cmd>w<cr>";
        desc = "Save file";
@@ -228,11 +206,75 @@
      # Deactivate "esc"
      {
        key = "<Esc>";
-        mode = ["n" "i" "v"];
+        mode = [
+          "n"
+          "i"
+          "v"
+        ];
        silent = true;
        action = "<Nop>";
        desc = "Disable Escape";
      }
+
+      # Disable Arrow Keys in Normal Mode and Middle click
+      {
+        key = "<Up>";
+        mode = "n";
+        silent = true;
+        action = "<Nop>";
+        desc = "Disable Up Arrow";
+      }
+      {
+        key = "<Down>";
+        mode = "n";
+        silent = true;
+        action = "<Nop>";
+        desc = "Disable Down Arrow";
+      }
+      {
+        key = "<Left>";
+        mode = "n";
+        silent = true;
+        action = "<Nop>";
+        desc = "Disable Left Arrow";
+      }
+      {
+        key = "<Right>";
+        mode = "n";
+        silent = true;
+        action = "<Nop>";
+        desc = "Disable Right Arrow";
+      }
+      {
+        key = "<MiddleMouse>";
+        mode = [
+          "n"
+          "i"
+          "v"
+        ];
+        action = "<nop>";
+        silent = true;
+      }
+      {
+        key = "<2-MiddleMouse>";
+        mode = [
+          "n"
+          "i"
+          "v"
+        ];
+        action = "<nop>";
+        silent = true;
+      }
+      {
+        key = "<3-MiddleMouse>";
+        mode = [
+          "n"
+          "i"
+          "v"
+        ];
+        action = "<nop>";
+        silent = true;
+      }
    ];
  };
 }
@@ -1,9 +1,5 @@
-{
-  lib,
-  pkgs,
-  ...
-}: {
-  programs.nvf.settings.vim = {
+{...}: {
+  vim = {
    diagnostics = {
      enable = true;
      config = {
@@ -17,19 +13,7 @@
        };
        underline = true;
        update_in_insert = true;
-        virtual_text = {
-          format =
-            lib.generators.mkLuaInline
-            /*
-            lua
-            */
-            ''
-              function(diagnostic)
-                return string.format("%s", diagnostic.message)
-                --return string.format("%s (%s)", diagnostic.message, diagnostic.source)
-              end
-            '';
-        };
+        virtual_text = true;
      };
      nvim-lint = {
        enable = true;
@@ -40,9 +24,6 @@
      autotagHtml = true;
      context.enable = true;
      highlight.enable = true;
-      grammars = with pkgs.vimPlugins.nvim-treesitter.builtGrammars; [
-        typescript # in language settings only tsx gets enabled, not typescript
-      ];
    };
    lsp = {
      enable = true;
@@ -54,11 +35,10 @@
      trouble.enable = true;
      lspSignature.enable = true;
      lspconfig.enable = true;
-      formatOnSave = true;
+      formatOnSave = false;
      mappings.format = null;
      inlayHints.enable = true;
-      null-ls.enable = true;
-      servers.nixd.settings.nil.nix.autoArchive = true;
+      servers.nil.settings.nix.autoArchive = true;
      otter-nvim = {
        enable = true;
        setupOpts = {
@@ -82,12 +62,11 @@
            sign = false;
            virtual_text = true;
          };
-          breadcrumbs.enable = false;
+          symbol_in_winbar.enable = false;
        };
      };
    };
    languages = {
-      enableDAP = true;
      enableExtraDiagnostics = true;
      enableFormat = true;
      enableTreesitter = true;
@@ -107,27 +86,29 @@
        extensions = {
          markview-nvim = {
            enable = true;
+            setupOpts = {
+              preview = {
+                hybrid_modes = ["n"];
+              };
+            };
          };
        };
        extraDiagnostics.enable = true;
      };
-      typescript = {
-        enable = true;
-        extensions.ts-error-translator.enable = true;
-      };
+      typescript.enable = true;
      css.enable = true;
-      svelte = {
-        enable = true;
-        format.enable = false;
-      };
+      svelte.enable = true;
      html.enable = true;
      bash.enable = true;
      nix.enable = true;
+      lua.enable = true;
    };
    formatter = {
      conform-nvim = {
        enable = true;
-        setupOpts.format_after_save = null;
+        setupOpts.format_on_save = {
+          lsp_format = "fallback";
+        };
      };
    };
  };
@@ -1,13 +1,48 @@
 {
-  programs.nvf.settings.vim.mini = {
+  vim.luaConfigRC.mini-clue = ''
+    local miniclue = require('mini.clue')
+    miniclue.setup({
+      triggers = {
+        { mode = 'n', keys = '<Leader>' },
+        { mode = 'x', keys = '<Leader>' },
+        { mode = 'n', keys = 'g' },
+        { mode = 'x', keys = 'g' },
+        { mode = 'n', keys = "'" },
+        { mode = 'n', keys = '`' },
+        { mode = 'n', keys = '"' },
+        { mode = 'i', keys = '<C-r>' },
+        { mode = 'c', keys = '<C-r>' },
+        { mode = 'n', keys = '<C-w>' },
+        { mode = 'n', keys = 'z' },
+      },
+      clues = {
+        miniclue.gen_clues.g(),
+        miniclue.gen_clues.marks(),
+        miniclue.gen_clues.registers(),
+        miniclue.gen_clues.windows({ submode_resize = true }),
+        miniclue.gen_clues.z(),
+        { mode = 'n', keys = '<Leader>f', desc = '+find' },
+        { mode = 'n', keys = '<Leader>s', desc = '+search' },
+        { mode = 'n', keys = '<Leader>t', desc = '+terminal' },
+        { mode = 'n', keys = '<Leader>u', desc = '+ui' },
+        { mode = 'n', keys = '<Leader>l', desc = '+lsp' },
+        { mode = 'n', keys = '<Leader>x', desc = '+trouble' },
+      },
+      window = { delay = 300 },
+    })
+  '';
+
+  vim.mini = {
+    ai.enable = true;
    starter.enable = true;
    comment.enable = true;
-    # cursorword.enable = true;
    icons.enable = true;
    indentscope.enable = true;
-    notify.enable = true;
    pairs.enable = true;
    diff.enable = true;
    git.enable = true;
+    jump2d.enable = true;
+    statusline.enable = true;
+    clue.enable = true;
  };
 }
@@ -1,9 +1,8 @@
 {lib, ...}: {
-  programs.nvf.settings.vim = {
+  vim = {
    viAlias = false;
    vimAlias = true;
    withNodeJs = true;
-    # syntaxHighlighting = true;
    options = {
      autoindent = true;
      smartindent = true;
@@ -18,17 +17,10 @@
      softtabstop = 2;
      wrap = false;
    };
-    globals = {
-      navic_silence = true; # navic tries to attach multiple LSPs and fails
-      suda_smart_edit = 1; # use super user write automatically
-      neovide_scale_factor = 0.7;
-      neovide_cursor_animation_length = 0.1;
-      neovide_cursor_short_animation_length = 0;
-    };
+    globals.navic_silence = true;
    clipboard = {
      enable = true;
      registers = "unnamedplus";
-      providers.wl-copy.enable = true;
    };
    luaConfigRC.osc52-clipboard = ''
      vim.g.clipboard = {
@@ -1,7 +1,6 @@
 {
-  programs.nvf.settings.vim = {
+  vim = {
    utility = {
-      oil-nvim.enable = true;
      snacks-nvim = {
        setupOpts = {
          picker.enabled = true;
@@ -18,27 +17,6 @@
        action = "<cmd>lua Snacks.picker.smart()<cr>";
        desc = "Smart Find Files";
      }
-      {
-        key = "<leader>,";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.buffers()<cr>";
-        desc = "Buffers";
-      }
-      {
-        key = "<leader>/";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.grep()<cr>";
-        desc = "Grep";
-      }
-      {
-        key = "<leader>:";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.command_history()<cr>";
-        desc = "Command History";
-      }
      {
        key = "<leader>e";
        mode = "n";
@@ -47,11 +25,11 @@
        desc = "File Explorer";
      }
      {
-        key = "-";
+        key = "<leader>/";
        mode = "n";
        silent = true;
-        action = "<cmd>Oil<cr>";
-        desc = "Oil";
+        action = "<cmd>lua Snacks.picker.lines()<cr>";
+        desc = "Buffer Lines";
      }

      # Find
@@ -62,14 +40,6 @@
        action = "<cmd>lua Snacks.picker.buffers()<cr>";
        desc = "Buffers";
      }
-      {
-        key = "<leader>fc";
-        mode = "n";
-        silent = true;
-        action = ''
-          <cmd>lua Snacks.picker.files({ cwd = vim.fn.stdpath("config") })<cr>'';
-        desc = "Find Config File";
-      }
      {
        key = "<leader>ff";
        mode = "n";
@@ -77,13 +47,6 @@
        action = "<cmd>lua Snacks.picker.files()<cr>";
        desc = "Find Files";
      }
-      {
-        key = "<leader>fg";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_files()<cr>";
-        desc = "Find Git Files";
-      }
      {
        key = "<leader>fp";
        mode = "n";
@@ -98,6 +61,13 @@
        action = "<cmd>lua Snacks.picker.recent()<cr>";
        desc = "Recent";
      }
+      {
+        key = "<leader>f:";
+        mode = "n";
+        silent = true;
+        action = "<cmd>lua Snacks.picker.command_history()<cr>";
+        desc = "Command History";
+      }
      {
        key = "<leader>fn";
        mode = "n";
@@ -105,65 +75,14 @@
        action = "<cmd>lua Snacks.picker.notifications()<cr>";
        desc = "Notification History";
      }
-      {
-        key = "<leader>fe";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.icons()<cr>";
-        desc = "Emoji";
-      }
-
-      # Git
-      {
-        key = "<leader>gb";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_branches()<cr>";
-        desc = "Git Branches";
-      }
-      {
-        key = "<leader>gL";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_log()<cr>";
-        desc = "Git Log Line";
-      }
-      {
-        key = "<leader>gs";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_status()<cr>";
-        desc = "Git Status";
-      }
-      {
-        key = "<leader>gS";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_stash()<cr>";
-        desc = "Git Stash";
-      }
-      {
-        key = "<leader>gd";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_diff()<cr>";
-        desc = "Git Diff (Hunks)";
-      }
-      {
-        key = "<leader>gf";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.git_log_file()<cr>";
-        desc = "Git Log File";
-      }

      # Grep
      {
-        key = "<leader>sb";
+        key = "<leader>sg";
        mode = "n";
        silent = true;
-        action = "<cmd>lua Snacks.picker.lines()<cr>";
-        desc = "Buffer Lines";
+        action = "<cmd>lua Snacks.picker.grep()<cr>";
+        desc = "Grep";
      }
      {
        key = "<leader>st";
@@ -172,20 +91,6 @@
        action = "<cmd>lua Snacks.picker.todo_comments()<cr>";
        desc = "Todos";
      }
-      {
-        key = "<leader>sB";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.grep_buffers()<cr>";
-        desc = "Grep Open Buffers";
-      }
-      {
-        key = "<leader>sg";
-        mode = "n";
-        silent = true;
-        action = "<cmd>lua Snacks.picker.grep()<cr>";
-        desc = "Grep";
-      }
      {
        key = "<leader>sw";
        mode = "n";
@@ -1,26 +1,18 @@
-{pkgs, ...}: {
-  home.packages = with pkgs; [
-    imagemagick
-    tree-sitter
-    ghostscript
-    tectonic
-    mermaid-cli
-  ];
-  programs.nvf.settings.vim.utility.snacks-nvim = {
+{
+  vim.utility.snacks-nvim = {
    enable = true;
    setupOpts = {
-      image = {
-        enabled = true;
-        doc = {
-          inline = false;
-          float = true;
-        };
-      };
      quickfile.enabled = true;
      statuscolumn.enabled = true;
      zen.enabled = true;
      bufdelete.enabled = true;
      gitsigns.enabled = true;
+      animate.enabled = true;
+      lazygit = {
+        enabled = true;
+        configure = false;
+      };
+      terminal.enabled = true;
    };
  };
 }
@@ -1,17 +1,15 @@
 {pkgs, ...}: {
-  programs.nvf.settings.vim = {
+  vim = {
+    luaConfigRC.remove-todo-keymaps = ''
+      vim.keymap.del("n", "<leader>tdq")
+      vim.keymap.del("n", "<leader>tdt")
+    '';
    undoFile.enable = true;
-    utility = {
-      motion.flash-nvim.enable = true;
-      outline.aerial-nvim.enable = true;
-    };
-    tabline.nvimBufferline.enable = true;
    notes.todo-comments.enable = true;
    assistant.copilot = {
      enable = true;
      cmp.enable = true;
    };
-    statusline.lualine.enable = true;

    autocomplete = {
      nvim-cmp = {
@@ -31,21 +29,39 @@
      noice.enable = true;
      colorizer.enable = true;
    };
-    git = {
-      enable = true;
-      gitsigns.enable = true;
-    };
-    terminal.toggleterm = {
-      enable = true;
-      lazygit = {
-        enable = true;
-        mappings.open = "<leader>gl";
-      };
-    };
+
    visuals = {
      rainbow-delimiters.enable = true;
-      nvim-scrollbar = {
-        enable = false;
+    };
+
+    extraPlugins = {
+      sttr-nvim = {
+        package = pkgs.vimUtils.buildVimPlugin {
+          name = "sttr-nvim";
+          src = pkgs.fetchFromGitHub {
+            owner = "anotherhadi";
+            repo = "sttr.nvim";
+            rev = "b41f2f51372222e23efbe5df9d72391cd933d4d1";
+            hash = "sha256-JPv0NNNUUNPNJM5LHYjcmTvilbOKB3OxI2Q6wxVbTks=";
+          };
+        };
+        setup = ''
+          require("sttr").setup()
+        '';
+      };
+      jwt-tui-nvim = {
+        package = pkgs.vimUtils.buildVimPlugin {
+          name = "jwt-tui-nvim";
+          src = pkgs.fetchFromGitHub {
+            owner = "anotherhadi";
+            repo = "jwt-tui.nvim";
+            rev = "c5100cb2cdfaf333014076a1a5c4c6a778bf3983";
+            hash = "sha256-qnQYZuQwyWkezhuyOorM67KBtatUboubofuT9A6McJI=";
+          };
+        };
+        setup = ''
+          require("jwt-tui").setup()
+        '';
      };
    };
  };
@@ -1,4 +1,8 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  config,
+  ...
+}: {
  home.packages = with pkgs; [
    proton-vpn
    proton-pass
@@ -17,7 +21,7 @@
    };
    "Proton Calendar" = {
      name = "Proton Calendar";
-      exec = "${pkgs.qutebrowser}/bin/qutebrowser \"https://calendar.proton.me\"";
+      exec = ''${config.programs.helium.package}/bin/helium "https://calendar.proton.me"'';
      icon = "proton-calendar";
      type = "Application";
      categories = ["Utility"];
@@ -25,7 +29,7 @@
    };
    "Proton Mail" = {
      name = "Proton Mail";
-      exec = "${pkgs.qutebrowser}/bin/qutebrowser \"https://mail.proton.me/\"";
+      exec = ''${config.programs.helium.package}/bin/helium "https://mail.proton.me/"'';
      icon = "proton-mail";
      type = "Application";
      categories = ["Utility"];
@@ -1,488 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  bookmarkList =
-    (import ./general.nix)
-    ++ (import ./tools.nix)
-    ++ (import ./social.nix)
-    ++ (import ./infosec.nix)
-    ++ (import ./other.nix)
-    ++ (import ./jack.nix);
-
-  c = config.lib.stylix.colors;
-
-  stripProtocol = url:
-    lib.removePrefix "https://" (lib.removePrefix "http://" url);
-
-  stripDomain = url:
-    builtins.head (
-      lib.splitString "/" (stripProtocol url)
-    );
-
-  mkCard = item: let
-    domain = stripDomain item.url;
-    initial = builtins.substring 0 1 item.name;
-  in ''
-    <a href="${item.url}" class="card">
-      <div class="favicon-wrapper">
-        <img class="favicon" src="https://icons.duckduckgo.com/ip3/${domain}.ico" alt="" aria-hidden="true" loading="lazy" onerror="this.style.display='none';this.nextElementSibling.style.display='flex'">
-        <span class="favicon-fallback" style="display:none">${initial}</span>
-      </div>
-      <div class="card-info">
-        <span class="card-name">${item.name}</span>
-        <span class="card-url">${stripProtocol item.url}</span>
-      </div>
-    </a>'';
-
-  mkFolderContent = items: let
-    step = acc: item:
-      if item ? url
-      then acc // {pending = acc.pending ++ [item];}
-      else {
-        chunks =
-          acc.chunks
-          ++ lib.optional (acc.pending != []) {
-            isCards = true;
-            items = acc.pending;
-          }
-          ++ [
-            {
-              isCards = false;
-              folder = item;
-            }
-          ];
-        pending = [];
-      };
-    result =
-      lib.foldl' step {
-        chunks = [];
-        pending = [];
-      }
-      items;
-    chunks =
-      result.chunks
-      ++ lib.optional (result.pending != []) {
-        isCards = true;
-        items = result.pending;
-      };
-  in
-    lib.concatMapStrings (chunk:
-      if chunk.isCards
-      then ''
-        <div class="cards">
-          ${lib.concatMapStrings mkCard chunk.items}
-        </div>''
-      else mkFolder chunk.folder)
-    chunks;
-
-  mkFolder = folder: let
-    iconHtml =
-      if folder ? icon
-      then ''<span class="material-symbols-outlined folder-icon" aria-hidden="true">${folder.icon}</span>''
-      else "";
-  in ''
-    <details class="folder-section" open>
-      <summary class="folder-title">
-        ${iconHtml}<span class="folder-name">${folder.name}</span>
-        <svg class="chevron" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="6 9 12 15 18 9"/></svg>
-      </summary>
-      <div class="folder-content">
-        ${mkFolderContent folder.bookmarks}
-      </div>
-    </details>'';
-
-  grouped = let
-    step = acc: item:
-      if item ? url
-      then acc // {pending = acc.pending ++ [item];}
-      else {
-        groups =
-          acc.groups
-          ++ lib.optional (acc.pending != []) {
-            isRoot = true;
-            items = acc.pending;
-          }
-          ++ [
-            {
-              isRoot = false;
-              inherit item;
-            }
-          ];
-        pending = [];
-      };
-    result =
-      lib.foldl' step {
-        groups = [];
-        pending = [];
-      }
-      bookmarkList;
-  in
-    result.groups
-    ++ lib.optional (result.pending != []) {
-      isRoot = true;
-      items = result.pending;
-    };
-
-  mkSection = group:
-    if group.isRoot
-    then ''
-      <div class="root-section">
-        <div class="cards">
-          ${lib.concatMapStrings mkCard group.items}
-        </div>
-      </div>''
-    else mkFolder group.item;
-
-  collectBookmarks = prefix: items:
-    lib.concatMapStrings (
-      item:
-        if item ? url
-        then "${item.url} ${prefix}${item.name}\n"
-        else collectBookmarks "${prefix}${item.name}/" item.bookmarks
-    )
-    items;
-
-  publicBookmarks =
-    pkgs.writeText "qutebrowser-public-bookmarks"
-    (collectBookmarks "" bookmarkList);
-in {
-  config = {
-    xdg.dataFile."qutebrowser/bookmarks.html".text = ''
-      <!DOCTYPE html>
-      <html lang="en">
-      <head>
-        <meta charset="UTF-8">
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <title>Bookmarks</title>
-        <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,300,0,0">
-        <style>
-          *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
-
-          body {
-            background-color: #${c.base00};
-            color: #${c.base05};
-            font-family: 'Source Sans Pro', sans-serif;
-            font-size: 14px;
-            min-height: 100vh;
-            padding: 2.5rem 2rem;
-          }
-
-          .header {
-            max-width: 1100px;
-            margin: 0 auto 2rem;
-            display: flex;
-            align-items: center;
-            gap: 1.5rem;
-          }
-
-          .page-title {
-            font-size: 1.3rem;
-            font-weight: 700;
-            color: #${c.base0D};
-            letter-spacing: -0.01em;
-            flex-shrink: 0;
-          }
-
-          .search-bar {
-            flex: 1;
-            background-color: #${c.base01};
-            border: 1px solid #${c.base02};
-            border-radius: 8px;
-            color: #${c.base05};
-            font-family: 'Source Sans Pro', sans-serif;
-            font-size: 0.9rem;
-            padding: 0.5rem 0.9rem;
-            outline: none;
-            transition: border-color 0.15s ease;
-          }
-
-          .search-bar::placeholder { color: #${c.base03}; }
-          .search-bar:focus { border-color: #${c.base0D}; }
-
-          .collapse-btn {
-            flex-shrink: 0;
-            background: none;
-            border: 1px solid #${c.base02};
-            border-radius: 8px;
-            color: #${c.base03};
-            cursor: pointer;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            padding: 0.47rem;
-            transition: color 0.15s ease, border-color 0.15s ease;
-          }
-
-          .collapse-btn:hover {
-            color: #${c.base0D};
-            border-color: #${c.base0D};
-          }
-
-          .collapse-btn svg {
-            width: 16px;
-            height: 16px;
-          }
-
-          .bookmarks-container {
-            max-width: 1100px;
-            margin: 0 auto;
-            display: flex;
-            flex-direction: column;
-            gap: 0.75rem;
-          }
-
-          .root-section {
-            margin-bottom: 1rem;
-          }
-
-          details.folder-section {
-            border-radius: 8px;
-          }
-
-          details.folder-section > summary {
-            list-style: none;
-            cursor: pointer;
-            display: flex;
-            align-items: center;
-            gap: 0.5rem;
-            padding: 0.45rem 0.5rem;
-            border-radius: 8px;
-            user-select: none;
-            transition: background-color 0.12s ease;
-          }
-
-          details.folder-section > summary::-webkit-details-marker { display: none; }
-
-          details.folder-section > summary:hover {
-            background-color: #${c.base01};
-            color: #${c.base0D};
-          }
-
-          details.folder-section > summary:hover .folder-name {
-            color: #${c.base0D};
-          }
-
-          details.folder-section > summary:hover .folder-icon {
-            color: #${c.base0D};
-          }
-
-          .folder-icon {
-            font-size: 14px;
-            line-height: 1;
-            flex-shrink: 0;
-            color: #${c.base04};
-            user-select: none;
-          }
-
-          .folder-name {
-            font-size: 0.72rem;
-            font-weight: 700;
-            letter-spacing: 0.12em;
-            text-transform: uppercase;
-            color: #${c.base03};
-            flex: 1;
-          }
-
-          .chevron {
-            width: 13px;
-            height: 13px;
-            color: #${c.base03};
-            transition: transform 0.2s ease;
-            flex-shrink: 0;
-          }
-
-          details[open] > summary > .chevron {
-            transform: rotate(180deg);
-          }
-
-          .folder-content {
-            padding: 0.4rem 0 0.5rem 0;
-            display: flex;
-            flex-direction: column;
-            gap: 0.25rem;
-          }
-
-          .folder-content > details.folder-section > summary {
-            padding-left: 1.2rem;
-          }
-
-          .folder-content > details.folder-section > .folder-content {
-            padding-left: 1rem;
-          }
-
-          .cards {
-            display: grid;
-            grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
-            gap: 0.4rem;
-          }
-
-          .card {
-            display: flex;
-            align-items: center;
-            gap: 0.7rem;
-            padding: 0.6rem 0.8rem;
-            background-color: #${c.base01};
-            border: 1px solid #${c.base02};
-            border-radius: 10px;
-            text-decoration: none;
-            transition: background-color 0.12s ease, border-color 0.12s ease;
-            overflow: hidden;
-          }
-
-          .card:hover {
-            background-color: #${c.base02};
-            border-color: #${c.base0D};
-          }
-
-          .favicon-wrapper { position: relative; width: 18px; height: 18px; flex-shrink: 0; }
-
-          .favicon {
-            position: absolute;
-            inset: 0;
-            width: 100%;
-            height: 100%;
-            object-fit: contain;
-            border-radius: 3px;
-          }
-
-          .favicon-fallback {
-            position: absolute;
-            inset: 0;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            background-color: #${c.base02};
-            border-radius: 4px;
-            color: #${c.base04};
-            font-size: 10px;
-            font-weight: 700;
-            text-transform: uppercase;
-            user-select: none;
-          }
-
-          .card-info {
-            display: flex;
-            flex-direction: column;
-            gap: 0.05rem;
-            overflow: hidden;
-            flex: 1;
-          }
-
-          .card-name {
-            color: #${c.base05};
-            font-size: 0.86rem;
-            font-weight: 500;
-            white-space: nowrap;
-            overflow: hidden;
-            text-overflow: ellipsis;
-            transition: color 0.12s ease;
-          }
-
-          .card:hover .card-name { color: #${c.base0D}; }
-
-          .card-url {
-            color: #${c.base03};
-            font-family: 'Maple Mono NF', monospace;
-            font-size: 0.7rem;
-            white-space: nowrap;
-            overflow: hidden;
-            text-overflow: ellipsis;
-          }
-
-          .no-results {
-            color: #${c.base03};
-            font-size: 0.9rem;
-            padding: 0.5rem 0.2rem;
-            display: none;
-          }
-        </style>
-      </head>
-      <body>
-        <div class="header">
-          <h1 class="page-title">Bookmarks</h1>
-          <input id="search" class="search-bar" type="text" placeholder="Search…" autocomplete="off" spellcheck="false">
-          <button id="collapse-btn" class="collapse-btn" title="Collapse all folders" aria-label="Collapse all folders">
-            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-              <polyline points="4 14 10 14 10 20"/><polyline points="20 10 14 10 14 4"/><line x1="10" y1="14" x2="3" y2="21"/><line x1="21" y1="3" x2="14" y2="10"/>
-            </svg>
-          </button>
-        </div>
-        <div class="bookmarks-container">
-          <p id="no-results" class="no-results">No results</p>
-          ${lib.concatMapStrings mkSection grouped}
-        </div>
-        <script>
-          window.addEventListener('DOMContentLoaded', function () {
-            const input = document.getElementById('search');
-            const noResults = document.getElementById('no-results');
-            const collapseBtn = document.getElementById('collapse-btn');
-
-            input.focus();
-
-            collapseBtn.addEventListener('click', function () {
-              document.querySelectorAll('details.folder-section').forEach(function (d) {
-                d.open = false;
-              });
-            });
-
-            input.addEventListener('input', function () {
-              const query = this.value.toLowerCase().trim();
-              let anyVisible = false;
-
-              if (query) {
-                document.querySelectorAll('details.folder-section').forEach(function (d) {
-                  d.open = true;
-                });
-              }
-
-              document.querySelectorAll('.folder-section, .root-section').forEach(function (section) {
-                let sectionVisible = false;
-                section.querySelectorAll('.card').forEach(function (card) {
-                  const name = card.querySelector('.card-name').textContent.toLowerCase();
-                  const url = card.querySelector('.card-url').textContent.toLowerCase();
-                  const match = !query || name.includes(query) || url.includes(query);
-                  card.style.display = match ? ''' : 'none';
-                  if (match) { sectionVisible = true; anyVisible = true; }
-                });
-                section.style.display = sectionVisible ? ''' : 'none';
-              });
-
-              noResults.style.display = anyVisible || !query ? 'none' : 'block';
-            });
-
-            input.addEventListener('keydown', function (e) {
-              if (e.key === 'Enter') {
-                const val = this.value.trim();
-                const isUrl = /^https?:\/\//i.test(val) || /^[a-zA-Z0-9-]+(\.[a-zA-Z]{2,})(\/.*)?$/.test(val);
-                if (isUrl) {
-                  location.href = /^https?:\/\//i.test(val) ? val : 'https://' + val;
-                } else {
-                  const first = document.querySelector('.card:not([style*="none"])');
-                  if (first) {
-                    location.href = first.href;
-                  } else {
-                    const q = encodeURIComponent(val);
-                    if (q) location.href = 'https://www.startpage.com/sp/search?q=' + q;
-                  }
-                }
-              }
-              if (e.key === 'Escape') {
-                this.value = ''';
-                this.dispatchEvent(new Event('input'));
-              }
-            });
-          });
-        </script>
-      </body>
-      </html>
-    '';
-
-    home.activation.qutebrowserBookmarks = lib.hm.dag.entryAfter ["writeBoundary"] ''
-      mkdir -p ${config.home.homeDirectory}/.config/qutebrowser/bookmarks
-      cat ${publicBookmarks} > ${config.home.homeDirectory}/.config/qutebrowser/bookmarks/urls
-    '';
-  };
-}
@@ -1,37 +0,0 @@
-{...}: {
-  imports = [
-    ./bookmarks
-    ./search.nix
-    ./keybindings.nix
-    ./settings.nix
-    ./userscripts.nix
-  ];
-
-  home.sessionVariables = {
-    DEFAULT_BROWSER = "qutebrowser";
-    BROWSER = "qutebrowser";
-  };
-
-  xdg.mimeApps.defaultApplications = {
-    "text/html" = ["org.qutebrowser.qutebrowser.desktop"];
-    "text/xml" = ["org.qutebrowser.qutebrowser.desktop"];
-    "x-scheme-handler/http" = ["org.qutebrowser.qutebrowser.desktop"];
-    "x-scheme-handler/https" = ["org.qutebrowser.qutebrowser.desktop"];
-    "x-scheme-handler/unknown" = ["org.qutebrowser.qutebrowser.desktop"];
-    "x-scheme-handler/about" = ["org.qutebrowser.qutebrowser.desktop"];
-    "x-scheme-handler/qute" = ["org.qutebrowser.qutebrowser.desktop"];
-  };
-
-  xdg.desktopEntries.qutebrowser-private = {
-    name = "Qutebrowser (Temp session)";
-    genericName = "Web Browser";
-    exec = "qutebrowser --temp-basedir %U";
-    icon = "qutebrowser";
-    categories = ["Network" "WebBrowser"];
-  };
-
-  programs.qutebrowser = {
-    enable = true;
-    loadAutoconfig = true;
-  };
-}
@@ -1,17 +0,0 @@
-{config, ...}: {
-  programs.qutebrowser.keyBindings = {
-    normal."<Ctrl-w>" = "tab-close";
-    normal."<Ctrl-Tab>" = "tab-next";
-    normal."<Ctrl-Shift-Tab>" = "tab-prev";
-    normal."<Ctrl-b>" = "open file://${config.xdg.dataHome}/qutebrowser/bookmarks.html";
-
-    # Ctrl+c is used to leave the current mode and return to normal mode.
-    insert."<Ctrl-c>" = "mode-leave";
-    hint."<Ctrl-c>" = "mode-leave";
-    caret."<Ctrl-c>" = "mode-leave";
-    command."<Ctrl-c>" = "mode-leave";
-    prompt."<Ctrl-c>" = "mode-leave";
-    yesno."<Ctrl-c>" = "mode-leave";
-    register."<Ctrl-c>" = "mode-leave";
-  };
-}
@@ -1,30 +0,0 @@
-{
-  programs.qutebrowser.searchEngines = rec {
-    startpage = "https://www.startpage.com/sp/search?q={}";
-
-    mynixos = "https://mynixos.com/search?q={}";
-    duckduckgo = "https://duckduckgo.com/?q={}";
-    google = "https://google.com/search?hl=en&q={}";
-    yandex = "https://yandex.com/search/?text={}";
-    bing = "https://bing.com/search?q={}";
-    youtube = "https://youtube.com/results?search_query={}";
-    google-images = "https://google.com/search?hl=en&tbm=isch&q={}";
-
-    # AI
-    chatgpt = "https://chatgpt.com/?q={}";
-    claude = "https://claude.ai/new?q={}";
-    gemini = "https://gemini.google.com/app?q={}";
-
-    # Maps
-    amap = "https://maps.apple.com/?q={}";
-    gmap = "https://www.google.com/maps/search/{}";
-
-    # shortcuts
-    g = google;
-    n = mynixos;
-    gpt = chatgpt;
-    gem = gemini;
-    cla = claude;
-    DEFAULT = startpage;
-  };
-}
@@ -1,52 +0,0 @@
-{config, ...}: {
-  programs.qutebrowser = {
-    settings = {
-      url = rec {
-        default_page = "file://${config.xdg.dataHome}/qutebrowser/bookmarks.html";
-        start_pages = [default_page];
-      };
-      new_instance_open_target = "window";
-      "tabs.last_close" = "close";
-      "statusbar.widgets" = ["keypress" "url" "progress"];
-
-      # Adblock
-      "content.blocking.enabled" = true;
-      "content.blocking.method" = "adblock";
-      "content.blocking.adblock.lists" = [
-        "https://easylist.to/easylist/easylist.txt"
-        "https://easylist.to/easylist/easyprivacy.txt"
-        "https://secure.fanboy.co.nz/fanboy-cookiemonster.txt"
-      ];
-
-      # Clipboard access (needed for Excalidraw, Cyberchef, etc.)
-      "content.javascript.clipboard" = "access";
-
-      # Downloads
-      "downloads.location.directory" = "~/Downloads";
-      "downloads.location.prompt" = false;
-
-      # Editor (Ctrl+e in text fields)
-      "editor.command" = ["ghostty" "-e" "nvim" "{}"];
-
-      # Tabs
-      # "tabs.show" = "switching";
-      # "tabs.show_switching_delay" = 3000;
-
-      # Scrollbar
-      "scrolling.bar" = "never";
-
-      # Statusbar
-      "statusbar.show" = "in-mode";
-
-      # Privacy
-      "content.geolocation" = false;
-      "content.cookies.accept" = "no-3rdparty";
-    };
-
-    extraConfig = ''
-      c.statusbar.padding = {'top': 6, 'bottom': 6, 'left': 8, 'right': 8}
-      c.tabs.padding = {'top': 6, 'bottom': 6, 'left': 8, 'right': 8}
-      config.set('content.local_content_can_access_remote_urls', True, 'file://*')
-    '';
-  };
-}
@@ -1,37 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
-  xdg.dataFile = {
-    # Startpage: hide sponsored results (custom script, no upstream)
-    "qutebrowser/greasemonkey/startpage-no-ads.user.js".text = ''
-      // ==UserScript==
-      // @name        Startpage - Hide Ads
-      // @match       https://www.startpage.com/*
-      // @run-at      document-start
-      // ==/UserScript==
-
-      new MutationObserver(function(mutations) {
-        mutations.forEach((mutation) => {
-          if (mutation.type === 'childList') {
-            mutation.addedNodes.forEach((node) => {
-              if (node.nodeType === 1 && node.nodeName === 'DIV' && node.id === 'gcsa-top') {
-                node.remove();
-                this.disconnect();
-              }
-            });
-          }
-        });
-      }).observe(document, { childList: true, subtree: true });
-    '';
-
-    "qutebrowser/greasemonkey/return-youtube-dislike.user.js".source = inputs.qs-return-youtube-dislike;
-    "qutebrowser/greasemonkey/sponsorblock-lite.user.js".source = inputs.qs-sponsorblock-lite;
-    "qutebrowser/greasemonkey/dont-track-me-google.user.js".source = inputs.qs-dont-track-me-google;
-    "qutebrowser/greasemonkey/i-dont-care-about-cookies.user.js".source = inputs.qs-i-dont-care-about-cookies;
-    "qutebrowser/greasemonkey/tracking-token-stripper.user.js".source = inputs.qs-tracking-token-stripper;
-    "qutebrowser/greasemonkey/bypass-paywalls-clean.user.js".source = inputs.qs-bypass-paywalls-clean;
-    "qutebrowser/greasemonkey/anti-adblock-fuckoff.user.js".source = inputs.qs-anti-adblock-fuckoff;
-  };
-}
@@ -1,4 +1,11 @@
 # Import all shell configurations
 {
-  imports = [./fzf.nix ./zsh.nix ./starship.nix ./zoxide.nix ./eza.nix];
+  imports = [
+    ./fzf.nix
+    ./zsh.nix
+    ./starship.nix
+    ./zoxide.nix
+    ./eza.nix
+    ./direnv.nix
+  ];
 }
@@ -0,0 +1,6 @@
+{
+  programs.direnv = {
+    enable = true;
+    nix-direnv.enable = true;
+  };
+}
@@ -20,7 +20,9 @@ in {
        "$git_status"
        "$character"
      ];
-      directory = {style = accent;};
+      directory = {
+        style = accent;
+      };

      character = {
        success_symbol = "[❯](${accent})";
@@ -7,7 +7,12 @@
 }: let
  fetch = config.theme.fetch; # neofetch, nerdfetch, pfetch
 in {
-  home.packages = with pkgs; [bat ripgrep tldr witr];
+  home.packages = with pkgs; [
+    bat
+    ripgrep
+    tldr
+    witr
+  ];

  # Add go binaries to the PATH
  home.sessionPath = ["$HOME/go/bin"];
@@ -22,7 +27,14 @@ in {
    autosuggestion.enable = true;
    syntaxHighlighting = {
      enable = true;
-      highlighters = ["main" "brackets" "pattern" "regexp" "root" "line"];
+      highlighters = [
+        "main"
+        "brackets"
+        "pattern"
+        "regexp"
+        "root"
+        "line"
+      ];
    };
    historySubstringSearch.enable = true;

@@ -33,9 +45,7 @@ in {
    };

    profileExtra = lib.optionalString (config.home.sessionPath != []) ''
-      export PATH="$PATH''${PATH:+:}${
-        lib.concatStringsSep ":" config.home.sessionPath
-      }"
+      export PATH="$PATH''${PATH:+:}${lib.concatStringsSep ":" config.home.sessionPath}"
    '';

    shellAliases = {
@@ -1,10 +1,22 @@
 {
  programs.caelestia.settings = {
    session.commands = {
-      shutdown = ["systemctl" "poweroff"];
-      logout = ["loginctl" "lock-session"];
-      hibernate = ["systemctl" "hibernate"];
-      reboot = ["systemctl" "reboot"];
+      shutdown = [
+        "systemctl"
+        "poweroff"
+      ];
+      logout = [
+        "loginctl"
+        "lock-session"
+      ];
+      hibernate = [
+        "systemctl"
+        "hibernate"
+      ];
+      reboot = [
+        "systemctl"
+        "reboot"
+      ];
    };
    launcher = {
      actionPrefix = "/";
@@ -13,7 +25,10 @@
          name = "Calculator";
          icon = "calculate";
          description = "Do simple math equations (powered by Qalc)";
-          command = ["autocomplete" "calc"];
+          command = [
+            "autocomplete"
+            "calc"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -21,7 +36,10 @@
          name = "Shutdown";
          icon = "power_settings_new";
          description = "Shutdown the system";
-          command = ["systemctl" "poweroff"];
+          command = [
+            "systemctl"
+            "poweroff"
+          ];
          enabled = true;
          dangerous = true;
        }
@@ -29,7 +47,10 @@
          name = "Reboot";
          icon = "cached";
          description = "Reboot the system";
-          command = ["systemctl" "reboot"];
+          command = [
+            "systemctl"
+            "reboot"
+          ];
          enabled = true;
          dangerous = true;
        }
@@ -37,7 +58,11 @@
          name = "Logout";
          icon = "exit_to_app";
          description = "Log out of the current session";
-          command = ["loginctl" "terminate-user" ""];
+          command = [
+            "loginctl"
+            "terminate-user"
+            ""
+          ];
          enabled = true;
          dangerous = true;
        }
@@ -45,7 +70,10 @@
          name = "Lock";
          icon = "lock";
          description = "Lock the current session";
-          command = ["loginctl" "lock-session"];
+          command = [
+            "loginctl"
+            "lock-session"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -53,7 +81,10 @@
          name = "Sleep";
          icon = "bedtime";
          description = "Suspend then hibernate";
-          command = ["systemctl" "suspend-then-hibernate"];
+          command = [
+            "systemctl"
+            "suspend-then-hibernate"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -61,7 +92,12 @@
          name = "Restart caelestia";
          icon = "cached";
          description = "Restart caelestia";
-          command = ["hyprctl" "dispatch" "exec" "caelestia-shell kill | sleep 1 | caelestia-shell"];
+          command = [
+            "hyprctl"
+            "dispatch"
+            "exec"
+            "caelestia-shell kill | sleep 1 | caelestia-shell"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -69,7 +105,11 @@
          name = "Emoji Picker";
          icon = "mood";
          description = "Toggle the emoji picker";
-          command = ["caelestia" "emoji" "-p"];
+          command = [
+            "caelestia"
+            "emoji"
+            "-p"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -77,7 +117,10 @@
          name = "Clipboard History";
          icon = "content_paste";
          description = "Toggle the clipboard history";
-          command = ["caelestia" "clipboard"];
+          command = [
+            "caelestia"
+            "clipboard"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -85,7 +128,10 @@
          name = "Delete from Clipboard History";
          icon = "content_paste_off";
          description = "Delete a line from the clipboard history";
-          command = ["caelestia" "clipboard"];
+          command = [
+            "caelestia"
+            "clipboard"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -101,7 +147,10 @@
          name = "Hyprpicker";
          icon = "colorize";
          description = "Pick an hex color";
-          command = ["hyprpicker" "-a"];
+          command = [
+            "hyprpicker"
+            "-a"
+          ];
          enabled = true;
          dangerous = false;
        }
@@ -122,7 +122,9 @@

  colorsHash = builtins.hashString "sha256" (builtins.toJSON colors);

-  customCli = inputs.caelestia-cli.packages.${pkgs.stdenv.hostPlatform.system}.default.overrideAttrs (oldAttrs: {
+  customCli =
+    inputs.caelestia-cli.packages.${pkgs.stdenv.hostPlatform.system}.default.overrideAttrs
+    (oldAttrs: {
      name = "${oldAttrs.name or "caelestia-cli"}-themed-${colorsHash}";
      postUnpack = ''
        mkdir -p $sourceRoot/src/caelestia/data/schemes/custom/main
@@ -7,9 +7,8 @@
  colors = config.lib.stylix.colors;

  mkMenu = menu: let
-    configFile =
-      pkgs.writeText "config.yaml"
-      (lib.generators.toYAML {} {
+    configFile = pkgs.writeText "config.yaml" (
+      lib.generators.toYAML {} {
        anchor = "bottom-right";
        border = "#${colors.base0D}80";
        background = "#${colors.base01}EE";
@@ -19,7 +18,8 @@
        rows_per_column = 5;

        inherit menu;
-      });
+      }
+    );
  in
    pkgs.writeShellScriptBin "menu" ''
      exec ${lib.getExe pkgs.wlr-which-key} ${configFile}
@@ -32,7 +32,8 @@ in {
    bind =
      [
        # Applications
-        ("$shiftMod, A, exec, "
+        (
+          "$shiftMod, A, exec, "
          + lib.getExe (mkMenu [
            {
              key = "a";
@@ -52,12 +53,12 @@ in {
            {
              key = "c";
              desc = "Proton Calendar";
-              cmd = "${pkgs.qutebrowser}/bin/qutebrowser 'https://calendar.proton.me/'";
+              cmd = "${config.programs.helium.package}/bin/helium 'https://calendar.proton.me/'";
            }
            {
              key = "m";
              desc = "Proton Mail";
-              cmd = "${pkgs.qutebrowser}/bin/qutebrowser 'https://mail.proton.me/'";
+              cmd = "${config.programs.helium.package}/bin/helium 'https://mail.proton.me/'";
            }
            {
              key = "o";
@@ -76,22 +77,23 @@ in {
            }
            {
              key = "b";
-              desc = "Qutebrowser";
-              cmd = "${pkgs.qutebrowser}/bin/qutebrowser";
+              desc = "Helium";
+              cmd = "${config.programs.helium.package}/bin/helium";
            }
            {
              key = "i";
-              desc = "Qutebrowser (Temp session)";
-              cmd = "${pkgs.qutebrowser}/bin/qutebrowser --temp-basedir";
+              desc = "Helium (Incognito)";
+              cmd = "${config.programs.helium.package}/bin/helium --incognito";
            }
-          ]))
+          ])
+        )

-        # Web links
-        "$mod,B, exec, uwsm app -- ${pkgs.qutebrowser}/bin/qutebrowser" # Browser (Qutebrowser)
+        "$mod,B, exec, uwsm app -- ${config.programs.helium.package}/bin/helium" # Browser

        # Power
        "$mod, X, global, caelestia:session" # Powermenu
-        ("$shiftMod, X, exec, "
+        (
+          "$shiftMod, X, exec, "
          + lib.getExe (mkMenu [
            {
              key = "l";
@@ -123,7 +125,8 @@ in {
              desc = "Restart caelestia";
              cmd = "hyprctl dispatch exec 'caelestia-shell kill | sleep 1 | caelestia-shell'";
            }
-          ]))
+          ])
+        )

        # Quick launch
        "$mod,RETURN, exec, uwsm app -- ${pkgs.ghostty}/bin/ghostty" # Ghostty (terminal)
@@ -154,13 +157,17 @@ in {
        ", Print, global, caelestia:screenshotFreeze" # Capture region (freeze)
        "$shiftMod+Alt, S, global, caelestia:screenshot" # Capture region
      ]
-      ++ (builtins.concatLists (builtins.genList (i: let
+      ++ (builtins.concatLists (
+        builtins.genList (
+          i: let
            ws = i + 1;
          in [
            "$mod,code:1${toString i}, workspace, ${toString ws}"
            "$mod SHIFT,code:1${toString i}, movetoworkspace, ${toString ws}"
-        ])
-        9));
+          ]
+        )
+        9
+      ));

    bindm = [
      "$mod,mouse:272, movewindow" # Move Window (mouse)
@@ -62,9 +62,6 @@ in {
      ];

      monitor = [
-        "eDP-2,highres,0x0,1" # My internal laptop screen
-        "desc:AOC U34G2G1 0x00000E06,3440x1440@99.98,auto,1" # My external monitor
-        "desc:Philips Consumer Electronics Company PHL 221B8L ZV02144013987,highres,0x0,1"
        ",prefered,auto,1" # default
      ];

@@ -39,4 +39,6 @@
  '';

  command = "bash ${keyboard-backlight}/bin/keyboard-backlight &";
-in {wayland.windowManager.hyprland.settings.exec-once = [command];}
+in {
+  wayland.windowManager.hyprland.settings.exec-once = [command];
+}
@@ -8,8 +8,7 @@
      splash = false;
    };
  };
-  systemd.user.services.hyprpaper.Unit.After =
-    lib.mkForce "graphical-session.target";
+  systemd.user.services.hyprpaper.Unit.After = lib.mkForce "graphical-session.target";

  wayland.windowManager.hyprland.settings.exec-once = [
    "systemctl --user enable --now hyprpaper.service"
@@ -20,6 +20,7 @@ with lib; let
    pdf = ["zathura.desktop"];
    terminal = ["ghostty.desktop"];
    archive = ["xarchiver.desktop"];
+    browser = ["helium.desktop"];
  };

  mimeMap = {
@@ -110,6 +111,13 @@ with lib; let
      "application/7z"
      "application/*tar"
    ];
+    browser = [
+      "text/html"
+      "application/xhtml+xml"
+      "x-scheme-handler/http"
+      "x-scheme-handler/https"
+      "x-scheme-handler/ftp"
+    ];
  };

  nvim-ghostty = pkgs.makeDesktopItem {
@@ -117,14 +125,17 @@ with lib; let
    desktopName = "Neovim (Ghostty)";
    exec = ''ghostty --title="Neovim Editor" -e nvim %F'';
    terminal = false;
-    categories = ["Development" "TextEditor"];
+    categories = [
+      "Development"
+      "TextEditor"
+    ];
    mimeTypes = mimeMap.code ++ mimeMap.text;
  };

  associations = with lists;
-    listToAttrs (flatten (mapAttrsToList
-      (key: map (type: attrsets.nameValuePair type defaultApps."${key}"))
-      mimeMap));
+    listToAttrs (
+      flatten (mapAttrsToList (key: map (type: attrsets.nameValuePair type defaultApps."${key}")) mimeMap)
+    );
 in {
  home.packages = [nvim-ghostty];

@@ -12,6 +12,8 @@
    ../../nixos/users.nix
    ../../nixos/utils.nix
    ../../nixos/hyprland.nix
+    ../../nixos/usbguard.nix
+    ../../home/programs/helium/system.nix # I hate browser's configuration..

    ../../nixos/omen.nix # CHANGEME: For my laptop only, remove this (OMEN 16)

@@ -20,6 +22,35 @@
    ./variables.nix
  ];

+  # USBGuard:
+  # Allow all USB devices until a proper policy is configured.
+  # Run `sudo usbguard generate-policy` with your devices plugged in,
+  # then set rules = "<output>" and switch implicitPolicyTarget to "block".
+  # services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
+
+  services.usbguard.rules = ''
+    allow id 1d6b:0002 serial "0000:05:00.3" name "xHCI Host Controller" hash "4a4NgfdUaJO43rkCzmWRSeHHR/uUh5+SNsXnhosm9qs=" parent-hash "ldMchY4Tt4GPUYo30eNGvai+Fs/EdnVY3vMyxJUq4Nk=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:05:00.3" name "xHCI Host Controller" hash "d+DNGWARDtv9nEK2ZvnNOCtFernuMu5/e/oZ7kCppqQ=" parent-hash "ldMchY4Tt4GPUYo30eNGvai+Fs/EdnVY3vMyxJUq4Nk=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0002 serial "0000:05:00.4" name "xHCI Host Controller" hash "icotY3rI59mWiKsGxc59BGZZeBjfbuH0b4NUByj3cbQ=" parent-hash "tHvBfznK5rpQn+oa0PEEjHa29EAEvGyCcZixsfwA6W0=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:05:00.4" name "xHCI Host Controller" hash "UbEoCZW8HT2ldc3qDeiK+IiQlGeaBC7F63681OwmKhI=" parent-hash "tHvBfznK5rpQn+oa0PEEjHa29EAEvGyCcZixsfwA6W0=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0002 serial "0000:07:00.3" name "xHCI Host Controller" hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" parent-hash "DRyV2/31MYHdzkIEfbPQeb/1w4/PjOW6GqWrXkftf2I=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:07:00.3" name "xHCI Host Controller" hash "O6iOpcl9StImWT62SrbeXacqbG6N/mTIipTRc0ipCGM=" parent-hash "DRyV2/31MYHdzkIEfbPQeb/1w4/PjOW6GqWrXkftf2I=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0002 serial "0000:07:00.4" name "xHCI Host Controller" hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" parent-hash "l2vhvC+VGVKlkBUUK/usFu8jHJ/5bWOnJG6WzRexpt4=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:07:00.4" name "xHCI Host Controller" hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" parent-hash "l2vhvC+VGVKlkBUUK/usFu8jHJ/5bWOnJG6WzRexpt4=" with-interface 09:00:00 with-connect-type ""
+    allow id 0bda:c85c serial "00e04c000001" name "Bluetooth Radio" hash "Q/wlToV8WQgEYHBW/UIhnSwCCusCGqAR2D5gspSCImQ=" parent-hash "4a4NgfdUaJO43rkCzmWRSeHHR/uUh5+SNsXnhosm9qs=" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hardwired"
+    allow id 30c9:009f serial "01.00.00" name "HP True Vision FHD Camera" hash "eYW5fqReJd29tfHXkEktKC63dGfDpmlRMo5uMGUWwME=" parent-hash "icotY3rI59mWiKsGxc59BGZZeBjfbuH0b4NUByj3cbQ=" with-interface { 0e:01:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 fe:01:01 } with-connect-type "hardwired"
+    allow id 03f0:036b serial "" name "HP USB-C Dock G5" hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" parent-hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" via-port "7-1" with-interface { 09:00:01 09:00:02 } with-connect-type "hotplug"
+    allow id 03f0:066b serial "" name "HP USB-C Dock G5" hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" parent-hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" via-port "8-1" with-interface 09:00:00 with-connect-type "hotplug"
+    allow id 03f0:056b serial "201604140001" name "USB Audio" hash "OxQ8HQenW3/4HSGEBOSYFS15rXDTOaNDnjMbICweHgw=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" with-interface { 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 03:00:00 } with-connect-type "unknown"
+    allow id 03f0:086b serial "" name "USB2734" hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" via-port "7-1.3" with-interface { 09:00:01 09:00:02 } with-connect-type "unknown"
+    allow id 03f0:046b serial "11AD1D0A89EA2D08310E0B00" name "HP USB-C Dock G5" hash "DEGeuj1u4lwqrzp0UksFX7mSEY9JnGLxg7yxGbglAKE=" parent-hash "iPFGrgGz0sWgKQjWD/F8eNOhkeR728dTG8JJtkUSvuM=" with-interface { 11:00:00 ff:03:00 03:00:00 } with-connect-type "unknown"
+    allow id 03f0:076b serial "" name "USB5734" hash "BshoqybYo0IKgoDORYPRtbhhlmQrYAxPQb2EAm1JsWA=" parent-hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" via-port "8-1.3" with-interface 09:00:00 with-connect-type "unknown"
+    allow id 0bda:8153 serial "000001000000" name "USB 10/100/1000 LAN" hash "utEnXKJ57kRUbPcGUaNWhEyoOEbLOYAFxvlsyC0PZkk=" parent-hash "JHDjLFApQNqijjmuKdJSWH5+1oLL7S6LQ9QHTAk5fTk=" with-interface { ff:ff:00 02:06:00 0a:00:00 0a:00:00 } with-connect-type "unknown"
+    allow id 046d:0ab7 serial "2046BAB04T68" name "Blue Microphones" hash "cC6AQ2e1Q/BeFeostpbf1mH2WpoUmt6bhau4NlA3niU=" parent-hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" with-interface { 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 01:02:00 01:02:00 03:00:00 } with-connect-type "unknown"
+    allow id 1532:02a1 serial "" name "Razer Ornata V3" hash "wfuIjBhhGuge8gflyA526SKqKoy8rHJZQZ+2o6usMiE=" parent-hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" via-port "7-1.3.3" with-interface { 03:01:01 03:00:01 03:00:02 } with-connect-type "unknown"
+    allow id 13fd:5900 serial "50026B76861EE752    " name "External" hash "l/QvVV5hzZj1z6OUwB/kWl+WnH/7awrdMBoiNVx660M=" parent-hash "MSXcPAlZqkpTyZQylOhSIB8eMfST2AzVHV9EbrBGTWc=" with-interface { 08:06:50 08:06:62 } with-connect-type "unknown"
+  '';
+
  home-manager.users."${config.var.username}" = import ./home.nix;

  # Don't touch this
@@ -0,0 +1,20 @@
+{
+  inputs,
+  nixpkgs,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  modules = [
+    {
+      nixpkgs.overlays = [
+      ];
+      _module.args = {inherit inputs;};
+    }
+    inputs.nixos-hardware.nixosModules.omen-16-n0005ne
+    inputs.home-manager.nixosModules.home-manager
+    inputs.stylix.nixosModules.stylix
+    inputs.nix-index-database.nixosModules.default
+    inputs.helium-browser.nixosModules.default
+    ./configuration.nix
+  ];
+}
@@ -11,7 +11,13 @@
    (modulesPath + "/installer/scan/not-detected.nix")
  ];

-  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "uas" "usbhid" "sd_mod"];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "uas"
+    "usbhid"
+    "sd_mod"
+  ];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-amd"];
  boot.extraModulePackages = [];
@@ -24,7 +30,10 @@
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/5251-9B85";
    fsType = "vfat";
-    options = ["fmask=0077" "dmask=0077"];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
  };

  swapDevices = [];
@@ -1,7 +1,7 @@
 {config, ...}: {
  imports = [
    # Programs
-    ../../home/programs/brave
+    ../../home/programs/helium
    ../../home/programs/proton
    ../../home/programs/proton/auto-start-vpn.nix
    ../../home/programs/ghostty
@@ -14,7 +14,6 @@
    ../../home/programs/thunar
    ../../home/programs/nixy
    ../../home/programs/nightshift
-    ../../home/programs/qutebrowser
    ../../home/programs/nix-utils

    ../../home/programs/group/basic-apps.nix
@@ -36,7 +35,9 @@
  home = {
    inherit (config.var) username;
    homeDirectory = "/home/" + config.var.username;
-    file.".face" = {source = ./profile_picture.png;};
+    file.".face" = {
+      source = ./profile_picture.png;
+    };

    sessionVariables = {
      AQ_DRM_DEVICES = "/dev/dri/card2:/dev/dri/card1"; # CHANGEME: Related to the GPU
@@ -46,5 +47,16 @@
    stateVersion = "24.05";
  };

-  programs.home-manager.enable = true;
+  wayland.windowManager.hyprland.settings.monitor = [
+    "eDP-2,highres,0x0,1" # My internal laptop screen
+    "desc:AOC U34G2G1 0x00000E06,3440x1440@99.98,auto,1" # My external monitor
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    nixy = {
+      enable = true;
+      configDirectory = config.var.configDirectory;
+    };
+  };
 }
@@ -14,11 +14,21 @@ in {
    age.keyFile = "${home}/.config/sops/age/keys.txt";
    defaultSopsFile = ./secrets.yaml;
    secrets = {
-      ssh-config = {path = "${home}/.ssh/config";};
-      github-key = {path = "${home}/.ssh/github";};
-      jack-key = {path = "${home}/.ssh/jack";};
-      signing-key = {path = "${home}/.ssh/key";};
-      signing-pub-key = {path = "${home}/.ssh/key.pub";};
+      ssh-config = {
+        path = "${home}/.ssh/config";
+      };
+      github-key = {
+        path = "${home}/.ssh/github";
+      };
+      jack-key = {
+        path = "${home}/.ssh/jack";
+      };
+      signing-key = {
+        path = "${home}/.ssh/key";
+      };
+      signing-pub-key = {
+        path = "${home}/.ssh/key.pub";
+      };
    };
  };

@@ -42,7 +52,10 @@ in {
  '';

  systemd.user.services.mbsync.Unit.After = ["sops-nix.service"];
-  home.packages = with pkgs; [sops age];
+  home.packages = with pkgs; [
+    sops
+    age
+  ];

  wayland.windowManager.hyprland.settings.exec-once = ["systemctl --user start sops-nix"];
 }
@@ -11,10 +11,7 @@
  config.var = {
    hostname = "h-laptop";
    username = "hadi";
-    configDirectory =
-      "/home/"
-      + config.var.username
-      + "/.config/nixos"; # The path of the nixos configuration directory
+    configDirectory = "/home/" + config.var.username + "/.config/nixos"; # The path of the nixos configuration directory

    keyboardLayout = "fr";

@@ -0,0 +1,18 @@
+{
+  inputs,
+  nixpkgs,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  modules = [
+    {_module.args = {inherit inputs;};}
+    inputs.home-manager.nixosModules.home-manager
+    inputs.stylix.nixosModules.stylix
+    inputs.sops-nix.nixosModules.sops
+    inputs.nixarr.nixosModules.default
+    # inputs.eleakxir.nixosModules.eleakxir
+    inputs.nix-index-database.nixosModules.default
+    inputs.default-creds.nixosModules.default
+    ./configuration.nix
+  ];
+}
@@ -9,7 +9,14 @@
  ...
 }: {
  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
-  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
  boot.initrd.kernelModules = ["dm-snapshot"];
  boot.kernelModules = ["kvm-amd"];
  boot.extraModulePackages = [];
@@ -20,12 +27,18 @@
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/DD15-1125";
    fsType = "vfat";
-    options = ["fmask=0077" "dmask=0077"];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
  };
  fileSystems."/mnt/data" = {
    device = "/dev/disk/by-uuid/0b055155-0134-448c-b1ca-e81030ff064e";
    fsType = "btrfs";
-    options = ["subvol=/" "compress=zstd"]; # adapte selon si t'as des subvolumes
+    options = [
+      "subvol=/"
+      "compress=zstd"
+    ]; # adapte selon si t'as des subvolumes
  };
  swapDevices = [];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
@@ -35,6 +48,5 @@
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode =
-    lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -23,4 +23,9 @@
  };

  programs.home-manager.enable = true;
+
+  programs.nixy = {
+    enable = true;
+    configDirectory = config.var.configDirectory;
+  };
 }
@@ -26,5 +26,8 @@
    };
  };

-  environment.systemPackages = with pkgs; [sops age];
+  environment.systemPackages = with pkgs; [
+    sops
+    age
+  ];
 }
@@ -11,10 +11,7 @@
  config.var = {
    hostname = "jack";
    username = "hadi";
-    configDirectory =
-      "/home/"
-      + config.var.username
-      + "/.config/nixos"; # The path of the nixos configuration directory
+    configDirectory = "/home/" + config.var.username + "/.config/nixos"; # The path of the nixos configuration directory

    keyboardLayout = "fr";

@@ -1,4 +1,8 @@
-{config, ...}: {
+{
+  config,
+  lib,
+  ...
+}: {
  imports = [
    # Mostly system related configuration
    ../../nixos/audio.nix
@@ -8,9 +12,11 @@
    ../../nixos/nix.nix
    ../../nixos/systemd-boot.nix
    ../../nixos/sddm.nix
+    ../../nixos/usbguard.nix
    ../../nixos/users.nix
    ../../nixos/utils.nix
    ../../nixos/hyprland.nix
+    ../../home/programs/helium/system.nix # I hate browser's configuration..

    # You should let those lines as is
    ./hardware-configuration.nix
@@ -19,6 +25,18 @@

  home-manager.users."${config.var.username}" = import ./home.nix;

+  # USBGuard:
+  # Allow all USB devices until a proper policy is configured.
+  # Run `sudo usbguard generate-policy` with your devices plugged in,
+  # then set rules = "<output>" and switch implicitPolicyTarget to "block".
+  # services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
+  services.usbguard.rules = ''
+    allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "prM+Jby/bFHCn2lNjQdAMbgc6tse3xVx+hZwjOPHSdQ=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+    allow id 17ef:608d serial "" name "Lenovo USB Optical Mouse" hash "klpDZuv1jhWGNqZLOl+KXF+75Ir3PfBm6D6ncjoLRBU=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-7" with-interface 03:01:02 with-connect-type "hotplug"
+    allow id 17ef:6190 serial "" name "Lenovo Calliope USB Keyboard G2" hash "CfZ9R/aoXGm7BN/ojVEzKQwVoxCUtRWMuACrE7BL/5Y=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-10" with-interface { 03:01:01 03:00:00 } with-connect-type "hotplug"
+  '';
+
  networking.firewall.allowedTCPPorts = [9001];

  # Don't touch this
@@ -0,0 +1,17 @@
+{
+  inputs,
+  nixpkgs,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  modules = [
+    {
+      nixpkgs.overlays = [];
+      _module.args = {inherit inputs;};
+    }
+    inputs.home-manager.nixosModules.home-manager
+    inputs.stylix.nixosModules.stylix
+    inputs.nix-index-database.nixosModules.default
+    ./configuration.nix
+  ];
+}
@@ -12,7 +12,14 @@
    (modulesPath + "/installer/scan/not-detected.nix")
  ];

-  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod"];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-intel"];
  boot.extraModulePackages = [];
@@ -25,7 +32,10 @@
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/043E-1755";
    fsType = "vfat";
-    options = ["fmask=0077" "dmask=0077"];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
  };

  swapDevices = [];
@@ -1,8 +1,8 @@
 {config, ...}: {
  imports = [
    # Programs
-    ../../home/programs/brave
    ../../home/programs/proton
+    ../../home/programs/helium
    ../../home/programs/ghostty
    ../../home/programs/nvf
    ../../home/programs/shell
@@ -12,7 +12,6 @@
    ../../home/programs/thunar
    ../../home/programs/nixy
    ../../home/programs/nightshift
-    ../../home/programs/qutebrowser
    ../../home/programs/nix-utils

    ../../home/programs/group/basic-apps.nix
@@ -39,5 +38,15 @@
    stateVersion = "24.05";
  };

-  programs.home-manager.enable = true;
+  wayland.windowManager.hyprland.settings.monitor = [
+    "desc:Philips Consumer Electronics Company PHL 221B8L ZV02144013987,highres,0x0,1"
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    nixy = {
+      enable = true;
+      configDirectory = config.var.configDirectory;
+    };
+  };
 }
@@ -14,10 +14,18 @@ in {
    age.keyFile = "${home}/.config/sops/age/keys.txt";
    defaultSopsFile = ./secrets.yaml;
    secrets = {
-      ssh-config = {path = "${home}/.ssh/config";};
-      netrc = {path = "${home}/.netrc";};
-      github-key = {path = "${home}/.ssh/github";};
-      gitlab-key = {path = "${home}/.ssh/gitlab";};
+      ssh-config = {
+        path = "${home}/.ssh/config";
+      };
+      netrc = {
+        path = "${home}/.netrc";
+      };
+      github-key = {
+        path = "${home}/.ssh/github";
+      };
+      gitlab-key = {
+        path = "${home}/.ssh/gitlab";
+      };
    };
  };

@@ -41,7 +49,10 @@ in {
  '';

  systemd.user.services.mbsync.Unit.After = ["sops-nix.service"];
-  home.packages = with pkgs; [sops age];
+  home.packages = with pkgs; [
+    sops
+    age
+  ];

  wayland.windowManager.hyprland.settings.exec-once = ["systemctl --user start sops-nix"];
 }
@@ -11,10 +11,7 @@
  config.var = {
    hostname = "h-work";
    username = "hadrien";
-    configDirectory =
-      "/home/"
-      + config.var.username
-      + "/.config/nixos"; # The path of the nixos configuration directory
+    configDirectory = "/home/" + config.var.username + "/.config/nixos"; # The path of the nixos configuration directory

    keyboardLayout = "fr";

@@ -13,7 +13,9 @@
      enable = true;
      extraConfig = {
        "10-disable-camera" = {
-          "wireplumber.profiles" = {main."monitor.libcamera" = "disabled";};
+          "wireplumber.profiles" = {
+            main."monitor.libcamera" = "disabled";
+          };
        };
      };
    };
@@ -1,5 +1,9 @@
 # Home-manager configuration for NixOS
-{inputs, pkgs, ...}: {
+{
+  inputs,
+  pkgs,
+  ...
+}: {
  home-manager = {
    useGlobalPkgs = true;
    useUserPackages = true;
@@ -35,7 +35,10 @@ in {
    settings = {
      download-buffer-size = 262144000; # 250 MB (250 * 1024 * 1024)
      auto-optimise-store = true;
-      experimental-features = ["nix-command" "flakes"];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
      substituters = [
        # high priority since it's almost always used
        "https://cache.nixos.org?priority=10"
@@ -55,8 +55,7 @@ in {
        # Optimized configuration for switchable graphics laptops
        offload = {
          enable = true; # Mode optimized for power saving
-          enableOffloadCmd =
-            true; # Allows running applications with dedicated GPU
+          enableOffloadCmd = true; # Allows running applications with dedicated GPU
        };
        # sync.enable disabled as offload is generally better for laptops
        sync.enable = false;
@@ -5,9 +5,8 @@
  pkgs,
  ...
 }: let
-  hp-omen-linux-module =
-    pkgs.callPackage
-    ({
+  hp-omen-linux-module = pkgs.callPackage (
+    {
      kernel ? config.boot.kernelPackages.kernel,
      stdenv,
      fetchFromGitHub,
@@ -33,7 +32,8 @@
          install hp-wmi.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86/hp/
          runHook postInstall
        '';
-      })) {kernel = config.boot.kernelPackages.kernel;};
+      })
+  ) {kernel = config.boot.kernelPackages.kernel;};
 in {
  boot.extraModulePackages = [hp-omen-linux-module];
  boot.kernelModules = ["hp-wmi"];
@@ -11,8 +11,7 @@
      };
    };
    tmp.cleanOnBoot = true;
-    kernelPackages =
-      pkgs.linuxPackages_latest; # _zen, _hardened, _rt, _rt_latest, etc.
+    kernelPackages = pkgs.linuxPackages_latest; # _zen, _hardened, _rt, _rt_latest, etc.

    # Silent boot
    kernelParams = [
@@ -38,5 +37,7 @@
  };

  # To avoid systemd services hanging on shutdown
-  systemd.settings.Manager = { DefaultTimeoutStopSec = "10s"; };
+  systemd.settings.Manager = {
+    DefaultTimeoutStopSec = "10s";
+  };
 }
@@ -0,0 +1,10 @@
+{config, ...}: {
+  services.usbguard = {
+    enable = true;
+    implicitPolicyTarget = "block";
+    IPCAllowedUsers = [
+      "root"
+      config.var.username
+    ];
+  };
+}
@@ -13,7 +13,10 @@ in {
    users.${username} = {
      isNormalUser = true;
      description = "${username} account";
-      extraGroups = ["networkmanager" "wheel"];
+      extraGroups = [
+        "networkmanager"
+        "wheel"
+      ];
    };
  };
 }
@@ -21,11 +21,17 @@ in {
    enable = autoUpgrade;
    dates = "04:00";
    flake = "${configDir}";
-    flags = ["--update-input" "nixpkgs" "--commit-lock-file"];
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "--commit-lock-file"
+    ];
    allowReboot = false;
  };

-  time = {timeZone = timeZone;};
+  time = {
+    timeZone = timeZone;
+  };
  i18n.defaultLocale = defaultLocale;
  i18n.extraLocaleSettings = {
    LC_ADDRESS = extraLocale;
@@ -65,7 +71,10 @@ in {
    dbus = {
      enable = true;
      implementation = "broker";
-      packages = with pkgs; [gcr gnome-settings-daemon];
+      packages = with pkgs; [
+        gcr
+        gnome-settings-daemon
+      ];
    };
    gvfs.enable = true;
    upower.enable = true;
@@ -115,7 +124,10 @@ in {
    xdgOpenUsePortal = true;
    config = {
      common.default = ["gtk"];
-      hyprland.default = ["gtk" "hyprland"];
+      hyprland.default = [
+        "gtk"
+        "hyprland"
+      ];
    };

    extraPortals = [pkgs.xdg-desktop-portal-gtk];
@@ -49,7 +49,10 @@ in {
    };
  };

-  users.users.jellyfin.extraGroups = ["video" "render"];
+  users.users.jellyfin.extraGroups = [
+    "video"
+    "render"
+  ];

  services.cloudflared.tunnels."${config.var.tunnelId}".ingress = {
    "media.${config.var.domain}" = "http://localhost:8096";
@@ -1,19 +1,27 @@
-{ config, inputs, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  inputs,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  imports = [
    (mkContainer {
      name = "wallpapers";
      hostIp = "10.233.4.1";
      containerIp = "10.233.4.2";
-      nixosConfig = { pkgs, ... }: {
+      nixosConfig = {pkgs, ...}: {
        services.nginx = {
          enable = true;
          virtualHosts."wallpapers" = {
            root = "${inputs.awesome-wallpapers.packages.${pkgs.system}.default}/share/awesome-wallpapers";
-            listen = [{ addr = "0.0.0.0"; port = 8080; }];
+            listen = [
+              {
+                addr = "0.0.0.0";
+                port = 8080;
+              }
+            ];
            locations."/" = {
              tryFiles = "$uri $uri/ /index.html";
            };
@@ -23,7 +31,7 @@ in
            '';
          };
        };
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -25,12 +25,19 @@ in {
                }
              ];
              locations."/" = {
-                tryFiles = "$uri $uri/ /index.html";
+                tryFiles = "$uri $uri/ =404";
              };
              extraConfig = ''
                port_in_redirect off;
                absolute_redirect off;
+                error_page 403 /403.html;
+                error_page 404 /404.html;
+                error_page 500 /500.html;
+                error_page 503 /503.html;
                add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' data: https://umami.${domain}; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://git.${domain}; connect-src 'self' https://umami.${domain};" always;
+                add_header X-Frame-Options "SAMEORIGIN" always;
+                add_header X-Content-Type-Options "nosniff" always;
+                add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
              '';
            };
            "www-redirect" = {
@@ -44,7 +51,10 @@ in {
            };
          };
        };
-        networking.firewall.allowedTCPPorts = [8080 8081];
+        networking.firewall.allowedTCPPorts = [
+          8080
+          8081
+        ];
        system.stateVersion = "24.05";
      };
    })
@@ -1,22 +1,29 @@
-{ config, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  imports = [
    (mkContainer {
      name = "cyberchef";
      hostIp = "10.233.5.1";
      containerIp = "10.233.5.2";
-      nixosConfig = { pkgs, ... }: {
+      nixosConfig = {pkgs, ...}: {
        services.nginx = {
          enable = true;
          virtualHosts."cyberchef" = {
            root = "${pkgs.cyberchef}/share/cyberchef";
-            listen = [{ addr = "0.0.0.0"; port = 8080; }];
+            listen = [
+              {
+                addr = "0.0.0.0";
+                port = 8080;
+              }
+            ];
          };
        };
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -1,21 +1,24 @@
-{ config, inputs, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-  domain = config.var.domain;
-in
 {
+  config,
+  inputs,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+  domain = config.var.domain;
+in {
  imports = [
    (mkContainer {
      name = "def-creds";
      hostIp = "10.233.6.1";
      containerIp = "10.233.6.2";
-      nixosConfig = { ... }: {
-        imports = [ inputs.default-creds.nixosModules.default ];
+      nixosConfig = {...}: {
+        imports = [inputs.default-creds.nixosModules.default];
        services.default-creds = {
          enable = true;
          port = 8087;
        };
-        networking.firewall.allowedTCPPorts = [ 8087 ];
+        networking.firewall.allowedTCPPorts = [8087];
        systemd.services.default-creds.environment = {
          HOST = lib.mkForce "0.0.0.0";
          PUBLIC_UMAMI_URL = "https://umami.${domain}";
@@ -1,14 +1,17 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
  domain = config.var.domain;
  catppuccin-gitea = pkgs.fetchzip {
    url = "https://github.com/catppuccin/gitea/releases/download/v1.0.2/catppuccin-gitea.tar.gz";
    sha256 = "sha256-rZHLORwLUfIFcB6K9yhrzr+UwdPNQVSadsw6rg8Q7gs=";
    stripRoot = false;
  };
-in
-{
+in {
  imports = [
    (mkContainer {
      name = "gitea";
@@ -19,17 +22,19 @@ in
        hostPath = "/var/lib/gitea";
        isReadOnly = false;
      };
-      nixosConfig = { lib, ... }: {
+      nixosConfig = {lib, ...}: {
        users.users.gitea.uid = lib.mkForce 978;
        users.groups.gitea.gid = lib.mkForce 968;

        services.postgresql = {
          enable = true;
-          ensureDatabases = [ "gitea" ];
-          ensureUsers = [{
+          ensureDatabases = ["gitea"];
+          ensureUsers = [
+            {
              name = "gitea";
              ensureDBOwnership = true;
-          }];
+            }
+          ];
        };

        services.gitea = {
@@ -69,7 +74,7 @@ in
          ln -sfn ${catppuccin-gitea} /var/lib/gitea/custom/public/assets/css
        '';

-        networking.firewall.allowedTCPPorts = [ 3002 ];
+        networking.firewall.allowedTCPPorts = [3002];
        system.stateVersion = "24.05";
      };
    })
@@ -1,41 +1,87 @@
-{ config, lib, ... }:
-let
-  inherit (import ../mk-container.nix { inherit lib config; }) mkContainer;
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ../mk-container.nix {inherit lib config;}) mkContainer;
  domain = config.var.domain;
  hostIp = "10.233.12.1";

  # Convert 6-char hex color to "H S L" string for glance (integers, no % sign)
-  hexToGlanceHsl = hex:
-    let
+  hexToGlanceHsl = hex: let
    h = lib.toLower hex;
    d = c:
-        if c == "a" then 10 else if c == "b" then 11 else if c == "c" then 12
-        else if c == "d" then 13 else if c == "e" then 14 else if c == "f" then 15
+      if c == "a"
+      then 10
+      else if c == "b"
+      then 11
+      else if c == "c"
+      then 12
+      else if c == "d"
+      then 13
+      else if c == "e"
+      then 14
+      else if c == "f"
+      then 15
      else lib.toInt c;
    byte = pos: d (builtins.substring pos 1 h) * 16 + d (builtins.substring (pos + 1) 1 h);
-      ri = byte 0; gi = byte 2; bi = byte 4;
+    ri = byte 0;
+    gi = byte 2;
+    bi = byte 4;
    r = ri * 1.0 / 255.0;
    g = gi * 1.0 / 255.0;
    b = bi * 1.0 / 255.0;
-      mx = if r >= g && r >= b then "r" else if g >= b then "g" else "b";
-      mn = if r <= g && r <= b then "r" else if g <= b then "g" else "b";
-      cmax = if mx == "r" then r else if mx == "g" then g else b;
-      cmin = if mn == "r" then r else if mn == "g" then g else b;
+    mx =
+      if r >= g && r >= b
+      then "r"
+      else if g >= b
+      then "g"
+      else "b";
+    mn =
+      if r <= g && r <= b
+      then "r"
+      else if g <= b
+      then "g"
+      else "b";
+    cmax =
+      if mx == "r"
+      then r
+      else if mx == "g"
+      then g
+      else b;
+    cmin =
+      if mn == "r"
+      then r
+      else if mn == "g"
+      then g
+      else b;
    delta = cmax - cmin;
    l = (cmax + cmin) / 2.0;
-      s = if delta < 0.0001 then 0.0
-          else if l <= 0.5 then delta / (cmax + cmin)
+    s =
+      if delta < 0.0001
+      then 0.0
+      else if l <= 0.5
+      then delta / (cmax + cmin)
      else delta / (2.0 - cmax - cmin);
    hue =
-        if delta < 0.0001 then 0.0
-        else if mx == "r" then let raw = 60.0 * (g - b) / delta; in if raw < 0.0 then raw + 360.0 else raw
-        else if mx == "g" then 60.0 * ((b - r) / delta + 2.0)
+      if delta < 0.0001
+      then 0.0
+      else if mx == "r"
+      then let
+        raw = 60.0 * (g - b) / delta;
+      in
+        if raw < 0.0
+        then raw + 360.0
+        else raw
+      else if mx == "g"
+      then 60.0 * ((b - r) / delta + 2.0)
      else 60.0 * ((r - g) / delta + 4.0);
-    in "${toString (builtins.floor (hue + 0.5))} ${toString (builtins.floor (s * 100.0 + 0.5))} ${toString (builtins.floor (l * 100.0 + 0.5))}";
+  in "${toString (builtins.floor (hue + 0.5))} ${toString (builtins.floor (s * 100.0 + 0.5))} ${
+    toString (builtins.floor (l * 100.0 + 0.5))
+  }";

  c = config.stylix.base16Scheme;
-in
-{
+in {
  # 0444 so the glance user inside the container can read the bind-mounted file
  sops.secrets.adguard-pwd.mode = "0444";

@@ -49,10 +95,13 @@ in
        hostPath = config.sops.secrets.adguard-pwd.path;
        isReadOnly = true;
      };
-      nixosConfig = { lib, ... }: {
+      nixosConfig = {lib, ...}: {
        _module.args.domain = domain;
        _module.args.adguardUrl = "http://${hostIp}:3000";
-        imports = [ ./home.nix ./server.nix ];
+        imports = [
+          ./home.nix
+          ./server.nix
+        ];

        services.glance = {
          enable = true;
@@ -77,7 +126,12 @@ in
            proxy_cache_path /var/cache/nginx/glance levels=1:2 keys_zone=glance:1m inactive=30m max_size=100m;
          '';
          virtualHosts."glance" = {
-            listen = [{ addr = "0.0.0.0"; port = 8080; }];
+            listen = [
+              {
+                addr = "0.0.0.0";
+                port = 8080;
+              }
+            ];
            locations."/" = {
              proxyPass = "http://127.0.0.1:5678";
              extraConfig = ''
@@ -90,7 +144,7 @@ in
          };
        };

-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -1,4 +1,4 @@
-{ domain, ... }: {
+{domain, ...}: {
  services.glance.settings.pages = [
    {
      name = "Home";
@@ -1,15 +1,16 @@
-{ config, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  imports = [
    (mkContainer {
      name = "mazanoke";
      hostIp = "10.233.7.1";
      containerIp = "10.233.7.2";
-      nixosConfig = { pkgs, ... }:
-        let
+      nixosConfig = {pkgs, ...}: let
        version = "1.1.5";
        mazanoke-pkg = pkgs.stdenv.mkDerivation {
          inherit version;
@@ -25,17 +26,23 @@ in
            cp -r ./index.html ./favicon.ico ./manifest.json ./service-worker.js ./assets $out/share/mazanoke/
          '';
        };
-        in
-        {
+      in {
        services.nginx = {
          enable = true;
          virtualHosts."mazanoke" = {
            root = "${mazanoke-pkg}/share/mazanoke";
-              listen = [{ addr = "0.0.0.0"; port = 8080; }];
-              locations."/" = { index = "index.html"; };
+            listen = [
+              {
+                addr = "0.0.0.0";
+                port = 8080;
+              }
+            ];
+            locations."/" = {
+              index = "index.html";
            };
          };
-          networking.firewall.allowedTCPPorts = [ 8080 ];
+        };
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -1,20 +1,22 @@
-{ config, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  imports = [
    (mkContainer {
      name = "mealie";
      hostIp = "10.233.8.1";
      containerIp = "10.233.8.2";
      internet = true;
-      nixosConfig = { ... }: {
+      nixosConfig = {...}: {
        services.mealie = {
          enable = true;
          port = 8080;
        };
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -1,5 +1,7 @@
-{ lib, config }:
-
+{
+  lib,
+  config,
+}:
 # Returns a NixOS module (attrset), to be used in `imports`.
 #
 # Options:
@@ -7,16 +9,13 @@
 #   externalInterface - WAN interface for NAT, required when internet = true
 #   bindMounts        - host paths to mount into the container (see containers.<name>.bindMounts)
 #   config            - NixOS module for the container
-
 let
-  nginxHardening = { config, ... }: lib.mkIf config.services.nginx.enable {
+  nginxHardening = {config, ...}:
+    lib.mkIf config.services.nginx.enable {
      services.nginx.serverTokens = false;
    };
-in
-
-{
-  mkContainer =
-    {
+in {
+  mkContainer = {
    name,
    hostIp,
    containerIp,
@@ -25,8 +24,7 @@ in
    bindMounts ? {},
    nixosConfig,
  }:
-    assert lib.assertMsg
-      (lib.stringLength "ve-${name}" <= 15)
+    assert lib.assertMsg (lib.stringLength "ve-${name}" <= 15)
    "mkContainer: interface name 've-${name}' is ${toString (lib.stringLength "ve-${name}")} chars, max is 15";
      {
        containers.${name} = {
@@ -35,9 +33,15 @@ in
          hostAddress = hostIp;
          localAddress = containerIp;
          inherit bindMounts;
-        config = { ... }: {
-          imports = [ nixosConfig nginxHardening ];
-          networking.nameservers = lib.mkIf internet [ "1.1.1.1" "1.0.0.1" ];
+          config = {...}: {
+            imports = [
+              nixosConfig
+              nginxHardening
+            ];
+            networking.nameservers = lib.mkIf internet [
+              "1.1.1.1"
+              "1.0.0.1"
+            ];
          };
        };
      }
@@ -46,7 +50,7 @@ in
        networking.nat = {
          enable = true;
          externalInterface = externalInterface;
-        internalInterfaces = [ "ve-${name}" ];
+          internalInterfaces = ["ve-${name}"];
        };
        # CONTAINER-FWD (defined by another module) blocks all forwarding by default.
        # Insert rules in FORWARD before it: allow return traffic, block LAN, allow internet.
@@ -17,8 +17,14 @@ in {
      AllowTcpForwarding = false;
      ClientAliveInterval = 300;
      ClientAliveCountMax = 2;
-      KexAlgorithms = ["curve25519-sha256" "curve25519-sha256@libssh.org"];
-      Ciphers = ["chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com"];
+      KexAlgorithms = [
+        "curve25519-sha256"
+        "curve25519-sha256@libssh.org"
+      ];
+      Ciphers = [
+        "chacha20-poly1305@openssh.com"
+        "aes256-gcm@openssh.com"
+      ];
    };
  };

@@ -1,19 +1,21 @@
-{ config, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  imports = [
    (mkContainer {
      name = "stirling-pdf";
      hostIp = "10.233.9.1";
      containerIp = "10.233.9.2";
-      nixosConfig = { ... }: {
+      nixosConfig = {...}: {
        services.stirling-pdf = {
          enable = true;
          environment."SERVER_PORT" = "8080";
        };
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -1,8 +1,10 @@
-{ config, lib, ... }:
-let
-  inherit (import ./mk-container.nix { inherit lib config; }) mkContainer;
-in
 {
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+in {
  sops.secrets.umami-secret.mode = "0400";

  imports = [
@@ -14,7 +16,7 @@ in
        hostPath = config.sops.secrets.umami-secret.path;
        isReadOnly = true;
      };
-      nixosConfig = { ... }: {
+      nixosConfig = {...}: {
        services.umami = {
          enable = true;
          settings = {
@@ -27,7 +29,7 @@ in
        };
        # PrivateUsers breaks systemd-creds inside nspawn containers (nested user namespaces)
        systemd.services.umami.serviceConfig.PrivateUsers = lib.mkForce false;
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts = [8080];
        system.stateVersion = "24.05";
      };
    })
@@ -16,8 +16,7 @@
      border-size = 2;
      animation-speed = "medium"; # "fast" | "medium" | "slow"
      fetch = "none"; # "nerdfetch" | "neofetch" | "pfetch" | "none"
-      textColorOnWallpaper =
-        config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
+      textColorOnWallpaper = config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
    };
    description = "Theme configuration options";
  };
@@ -16,8 +16,7 @@
      border-size = 4;
      animation-speed = "fast"; # "fast" | "medium" | "slow"
      fetch = "none"; # "nerdfetch" | "neofetch" | "pfetch" | "none"
-      textColorOnWallpaper =
-        config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
+      textColorOnWallpaper = config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
    };
    description = "Theme configuration options";
  };
@@ -16,8 +16,7 @@
      border-size = 4;
      animation-speed = "medium"; # "fast" | "medium" | "slow"
      fetch = "none"; # "nerdfetch" | "neofetch" | "pfetch" | "none"
-      textColorOnWallpaper =
-        config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
+      textColorOnWallpaper = config.lib.stylix.colors.base00; # Color of the text displayed on the wallpaper (Lockscreen, display manager, ...)
    };
    description = "Theme configuration options";
  };
Author	SHA1	Message	Date
Hadi	922e916a7a	edit packages list Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-26 20:45:40 +02:00
Hadi	7c8a552730	Edit helium configuration Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-26 20:38:27 +02:00
Hadi	a15bc11625	Add JWT TUI Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-26 20:38:19 +02:00
Hadi	d233ae904f	from qutebrowser to helium.. Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-26 01:18:23 +02:00
Hadi	5f72e16819	add spilltea, sttr, httpie & trufflehog Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-22 09:20:58 +02:00
Hadi	2954349fee	add nix-prefetch-github Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-22 09:20:12 +02:00
Hadi	4b79b7689a	Add Sttr.nvim Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-22 09:20:06 +02:00
Hadi	5dff7ceb12	remove useless shortcuts Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-21 13:21:36 +02:00
Hadi	a90a3809ce	edit nvf config: use more mini & snacks Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-21 13:21:28 +02:00
Hadi	fe1247f121	cursor animations Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-21 11:04:40 +02:00
Hadi	313f3c0b87	add direnv support Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-21 10:03:37 +02:00
Hadi	93152a5dcb	add lua support Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-21 10:03:22 +02:00
Hadi	edf013bb08	update flake Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-12 11:35:30 +02:00
Hadi	cb323223f8	USBGuard rules for work Signed-off-by: Hadi <hadi@example.com>	2026-05-07 09:47:53 +02:00
Hadi	d1462de38c	Update LICENSE Signed-off-by: Hadi <hadi@example.com>	2026-05-06 14:23:30 +02:00
Hadi	8419542ea2	fix accent Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-05 21:46:16 +02:00
Hadi	2740475af1	edit usbguard rules Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-05 20:40:22 +02:00
Hadi	5e9b5ad633	Moove greasemonkey's script to home.activation Signed-off-by: Hadi <hadi@example.com>	2026-05-05 10:00:41 +02:00
Hadi	0452f40b25	Add usbguard-tui Signed-off-by: Hadi <hadi@example.com>	2026-05-05 09:54:52 +02:00
Hadi	d71c9d8169	Nix fmt Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-04 20:40:09 +02:00
Hadi	e805c868a7	Add usbguard service Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-04 19:51:01 +02:00
Hadi	0fd0a73e92	Move monitor to host's home.nix file Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-05-04 19:50:35 +02:00
Hadi	cd2896eb5d	add home manager module Signed-off-by: Hadi <hadi@example.com>	2026-05-04 10:31:56 +02:00
Hadi	35b79af191	Merge branch 'main' of github.com:anotherhadi/nixy	2026-05-04 09:49:27 +02:00
Hadi	325cacc86f	update blog Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-04-29 22:44:05 +02:00
Hadi	7862c970fd	Add Security Headers Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-04-29 22:18:16 +02:00
Hadi	498ed902a2	Add error pages Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-04-29 19:43:59 +02:00
Hadi	3478a9a0a5	change nvf flake.nix Signed-off-by: Hadi <hadi@example.com>	2026-04-28 14:34:00 +02:00
Hadi	f6d056deb3	Add inputs via module.args Signed-off-by: Hadi <hadi@example.com>	2026-04-28 09:49:13 +02:00
Hadi	795621ada6	nixy to home manager module Signed-off-by: Hadi <hadi@example.com>	2026-04-28 09:45:47 +02:00
Hadi	31964cca35	Export nixy as a flake Signed-off-by: Hadi <hadi@example.com>	2026-04-28 09:41:17 +02:00
github-actions	abcadd4eaf	Update README.md (auto)	2026-04-27 19:14:25 +00:00
Hadi	5945a72b01	Refactor flakes Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>	2026-04-27 21:13:58 +02:00