diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 00000000..d9792794
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,12 @@
+keys:
+  users:
+    - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf
+    - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr
+    - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp
+creation_rules:
+  - path_regex: secrets/common/ssh.yaml$
+    key_groups:
+      - age:
+          - *rap_zion
+          - *kubex
+          - *firefly
diff --git a/README.md b/README.md
index b5bdfb25..a113cc32 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,9 @@ nh home switch -c nix@firefly .
 # nix build installer iso
 nix build .#nixosConfigurations.vinox.config.system.build.isoImage
 
-# nh remote switch
-nh os switch --hostname kubex . -d always --target-host kubex
-nh os switch --hostname nixberry . -d always --target-host <IP>
+# nh remote switch / update
+nh os boot --hostname kubex . -d always --target-host kubex
+nh os boot --hostname nixberry . -d always --target-host <IP>
 
 # nix remote switch
 nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo
diff --git a/TASK.md b/TASK.md
new file mode 100644
index 00000000..75612586
--- /dev/null
+++ b/TASK.md
@@ -0,0 +1,26 @@
+# Sway Home-Manager Module Task List
+
+- [x] Inspect the existing Hyprland Home Manager module and keybinding file to identify the small shared surface worth migrating.
+- [x] Confirm first-iteration scope:
+  - Sway is additive alongside Hyprland.
+  - Do not migrate Hyprland addons or wallpapers.
+  - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent.
+  - Ignore the `configOnly` options its only for hyprland
+- [x] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland.
+- [x] Keep the Sway role option surface intentionally small for the first pass:
+  - `enable`
+  - `autostart`
+  - package option only if needed by the Home Manager Sway module
+- [x] Translate the relevant Hyprland core config into Sway equivalents:
+  - session environment variables
+  - keyboard layout / variant / repeat settings
+  - gaps and border settings
+  - basic floating / assignment rules where Sway supports an equivalent
+- [x] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent.
+- [x] Keep side-by-side enablement conflict-aware:
+  - avoid migrating portal config unless Sway specifically needs separate wiring
+  - avoid addon-specific services and wallpaper handling
+- [x] Enable the Sway role in the target Home Manager host configuration without removing Hyprland.
+- [x] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass.
+- [x] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only.
+- [x] Update the docs for firefly, to create all necessary files outside of Home-Manager.
diff --git a/docs/firefly.md b/docs/firefly.md
index 7b5dfe76..f046e308 100644
--- a/docs/firefly.md
+++ b/docs/firefly.md
@@ -26,14 +26,24 @@ nix develop
 switch-firefly
 ```
 
-4. Create `hyprland` desktop file.
+4. Create compositor desktop files.
+
+`firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly.
+
+`firefly` also uses `roles.desktop.sway.package = null`, so Home Manager writes Sway configuration without installing or wrapping Sway. Sway and the display manager session file must exist on the host.
 
 ```bash
 echo "[Desktop Entry]
 Name=Hyprland
 Comment=An intelligent dynamic tiling Wayland compositor
-Exec=/home/$USER/.nix-profile/bin/start-hyprland
+Exec=/usr/bin/Hyprland
 Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop
+
+echo "[Desktop Entry]
+Name=Sway
+Comment=An i3-compatible Wayland compositor
+Exec=/usr/bin/sway
+Type=Application" | sudo tee /usr/share/wayland-sessions/sway.desktop
 ```
 
 5. Copy user-certificate to firefox
@@ -82,12 +92,33 @@ dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name
 Those programs are installed via apt, since they do not work within `nix`.
 
 ```bash
-# TODO: Check why hyprlock not working
 sudo add-apt-repository ppa:cppiber/hyprland
 sudo apt update
 sudo apt -y install \
-  xdg-desktop-portal-wlr \
+  hyprland \
+  sway \
+  xdg-desktop-portal \
+  xdg-desktop-portal-hyprland \
+  xdg-desktop-portal-gtk \
   mumble \
   swaylock \
   podman
 ```
+
+Home Manager must not manage Hyprland, Sway, or portal packages on `firefly`. Verify the active setup after switching:
+
+```bash
+readlink -f "$(command -v Hyprland)"
+readlink -f "$(command -v sway)"
+systemctl --user cat xdg-desktop-portal*.service
+systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR
+find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null
+```
+
+Expected results:
+
+- `Hyprland` resolves to `/usr/bin/Hyprland`.
+- `sway` resolves to `/usr/bin/sway`.
+- Portal services come from the host packages, not Home Manager-generated user units.
+- `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment.
+- The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`.
diff --git a/docs/k3s.md b/docs/k3s.md
index dd6cd7bc..56e5d049 100644
--- a/docs/k3s.md
+++ b/docs/k3s.md
@@ -31,6 +31,13 @@ sudo zpool create -f \
     raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd
 ```
 
+The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main`
+if needed, then loads its encryption key from `rap@nixberry` before `k3s.service`
+starts.
+
+Because the unit runs non-interactively, `kubex` is configured for passwordless sudo
+for members of the `wheel` group.
+
 ## Copy kubeconfig
 
 ```bash
diff --git a/docs/new-host.md b/docs/new-host.md
index d148f236..459cbbad 100644
--- a/docs/new-host.md
+++ b/docs/new-host.md
@@ -5,16 +5,33 @@ option.
 
 ## Sops-nix
 
-In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied
-over to the `.sops.yaml` config.
+In order to access secrets via `sops-nix`, this repo uses an `age` identity file by default. For a YubiKey-backed
+setup, point the host at an `age-plugin-yubikey` identity file instead.
 
-```
-# Connect to the new host, and copy the public key of the autogenerated age-key.
-sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key"
+This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`:
+
+- NixOS hosts get them from `modules/nixos/system/sops.nix`
+- standalone Home Manager hosts get them from `modules/home/services/sops.nix`
+- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files
 
-# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule.
-# Then a rekey for the secrets.yaml is necessary.
-sops updatekeys secrets/secrets.yaml
+```
+# Install the tools needed for a YubiKey-backed age identity.
+services.pcscd.enable = true;
+environment.systemPackages = with pkgs; [
+  age
+  age-plugin-yubikey
+];
+
+# Generate a YubiKey identity and use it in the host config.
+age-plugin-yubikey --generate \
+  --name swiss \
+  --slot 82 \
+  --pin-policy once \
+  --touch-policy cached \
+  > ~/.config/sops/age/yubikey-identity.txt
+
+# The corresponding recipient can then be added to `.sops.yaml`.
+age-plugin-yubikey --list
 ```
 
 ## Github action
diff --git a/flake.lock b/flake.lock
index e54688b8..49ffa5d5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778857089,
-        "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=",
+        "lastModified": 1782073106,
+        "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8",
+        "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457",
         "type": "github"
       },
       "original": {
@@ -38,11 +38,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1780833533,
-        "narHash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw=",
+        "lastModified": 1782648384,
+        "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de",
+        "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -180,6 +180,24 @@
         "type": "github"
       }
     },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -252,11 +270,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1780679734,
-        "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=",
+        "lastModified": 1782657028,
+        "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b2b7db486e06e098711dc291bb25db82850e1d16",
+        "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "tflow",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783222121,
+        "narHash": "sha256-E/ElL373TO8lQ2aMvYyzN+k4xkVaUGoRqoa8AtM71tI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "a1645f40777620c4bd2b6d854b290c2fc354a266",
         "type": "github"
       },
       "original": {
@@ -310,11 +349,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776426399,
-        "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=",
+        "lastModified": 1782566056,
+        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84",
+        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
         "type": "github"
       },
       "original": {
@@ -342,11 +381,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1780768552,
-        "narHash": "sha256-J2gBzBBE9C6LMMJec8buysLAQl7QmqtP/oMrPfVioYc=",
+        "lastModified": 1782658834,
+        "narHash": "sha256-OYjcMSNogYWLbeP4nxpUVJaO72o6yIK00bDYaAuQI2Y=",
         "owner": "hyprwm",
         "repo": "hyprland",
-        "rev": "20ee7553c95dd1fa30a00564561f40f7986ffbc7",
+        "rev": "75f558a536f8003bf80af5cb1a3e91529e78cb6b",
         "type": "github"
       },
       "original": {
@@ -388,11 +427,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776426575,
-        "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=",
+        "lastModified": 1782563850,
+        "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=",
         "owner": "hyprwm",
         "repo": "hyprland-guiutils",
-        "rev": "a968d211048e3ed538e47b84cb3649299578f19d",
+        "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178",
         "type": "github"
       },
       "original": {
@@ -494,11 +533,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772462885,
-        "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=",
+        "lastModified": 1782554491,
+        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
         "owner": "hyprwm",
         "repo": "hyprtoolkit",
-        "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998",
+        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
         "type": "github"
       },
       "original": {
@@ -519,11 +558,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779475241,
-        "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=",
+        "lastModified": 1782035033,
+        "narHash": "sha256-pUtCphVzH1iNUTMGdJr4+e/yzUXA6/DZwsn+cyfIVJU=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "3cd3972b2ee658a14d2610d8494e09259e530124",
+        "rev": "9d8bf6e810597152eef8906c670b96679af2faec",
         "type": "github"
       },
       "original": {
@@ -645,15 +684,15 @@
         "pre-commit-hooks": "pre-commit-hooks_2"
       },
       "locked": {
-        "lastModified": 1780865186,
-        "narHash": "sha256-GXjj3r00JhjYtVZZtDTz99ZPcJqTTcrsF1NS+jEdDhk=",
-        "owner": "rgroemmer",
+        "lastModified": 1782657946,
+        "narHash": "sha256-drO3tcL528kWQpktth5PeT6jVQRPJge24y/7KMFAe5g=",
+        "owner": "rapsnx",
         "repo": "neonix",
-        "rev": "16a56ef334a7117f1124b4082121fbe6787f94d9",
+        "rev": "4bc7283e07684c468e7139135fb8ee2a5297d6d0",
         "type": "github"
       },
       "original": {
-        "owner": "rgroemmer",
+        "owner": "rapsnx",
         "repo": "neonix",
         "type": "github"
       }
@@ -692,11 +731,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1780694373,
-        "narHash": "sha256-wuj6QmOlLsGjBOut+Ki/hiOT/H5ONzBePqOkOolsNfo=",
+        "lastModified": 1782592242,
+        "narHash": "sha256-kgINba6Ilpj3rdTi2BeKlQBs6ZxTdu3Gb49U5gDUVhg=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "8f7043c852210cd0875a1bbe9ca872c90ab5ac74",
+        "rev": "9e26dfe0fb8d61475b6f9e8d63477fe92509f1db",
         "type": "github"
       },
       "original": {
@@ -725,11 +764,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1780637332,
-        "narHash": "sha256-FeKyLRxLZu2EUnhifijZPDZRl0sVnPVHMtizAINNiN4=",
+        "lastModified": 1781781064,
+        "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "f717ae030fe56fc52522ebef69f17f3f09064ac4",
+        "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36",
         "type": "github"
       },
       "original": {
@@ -743,11 +782,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1780310866,
-        "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
+        "lastModified": 1782562157,
+        "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "4ed851c979641e28597a05086332d75cdc9e395f",
+        "rev": "a9cf7546a938c737b079e738de73934a13de9784",
         "type": "github"
       },
       "original": {
@@ -759,11 +798,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780365719,
-        "narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=",
-        "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f",
+        "lastModified": 1782175435,
+        "narHash": "sha256-8d2wCNWKnd86GzKZvbuqqlS+HqMrheXkvRf0qGJ/oA0=",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1020805.89570f24e97e/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -772,11 +811,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1780511130,
-        "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=",
+        "lastModified": 1782498288,
+        "narHash": "sha256-8/X3yyTXiE82b38n32ItbOqfWOVBl+gKa8fILyZfR4Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "535f3e6942cb1cead3929c604320d3db54b542b9",
+        "rev": "3cac626ec5e3703e835f227687e88aa9e2f25701",
         "type": "github"
       },
       "original": {
@@ -788,11 +827,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
@@ -817,11 +856,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
         "type": "github"
       },
       "original": {
@@ -841,11 +880,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1780849525,
-        "narHash": "sha256-yjtMubbmPi4Y4pgDSdmytqUutGJ+LJLcPgXGNNdXiUs=",
+        "lastModified": 1782254890,
+        "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "98acb923e5882a6a6a2b660d99e8c5124e08b838",
+        "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554",
         "type": "github"
       },
       "original": {
@@ -864,11 +903,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -887,11 +926,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -909,11 +948,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -935,7 +974,29 @@
         "niri": "niri",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_4",
-        "pre-commit-hooks": "pre-commit-hooks_3"
+        "pre-commit-hooks": "pre-commit-hooks_3",
+        "sops-nix": "sops-nix",
+        "tflow": "tflow"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782165805,
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {
@@ -999,6 +1060,43 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "tflow": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783282777,
+        "narHash": "sha256-ePQa0pLCHtPEL/vPgMd4EHrGoBorejRExJ+iCmSv3Es=",
+        "owner": "rapsnx",
+        "repo": "tflow",
+        "rev": "84b4bc0aa8623c8ea5a1542026bd426151654123",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rapsnx",
+        "repo": "tflow",
+        "type": "github"
+      }
+    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [
@@ -1027,11 +1125,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778265244,
-        "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=",
+        "lastModified": 1782311043,
+        "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968",
+        "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a",
         "type": "github"
       },
       "original": {
@@ -1060,11 +1158,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1779745227,
-        "narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=",
+        "lastModified": 1781226823,
+        "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2",
+        "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 0ebaf259..e80f72b0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,12 +12,20 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     neonix = {
-      url = "github:rgroemmer/neonix";
+      url = "github:rapsnx/neonix";
+    };
+    sops-nix = {
+      url = "github:mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
     krewfile = {
       url = "github:brumhard/krewfile";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    tflow = {
+      url = "github:rapsnx/tflow";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -76,6 +84,7 @@
       nixosModules = [
         inputs.catppuccin.nixosModules.catppuccin
         inputs.niri.nixosModules.niri
+        inputs.sops-nix.nixosModules.sops
         (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos)
         ./modules/nix.nix
       ];
@@ -84,7 +93,9 @@
         inputs.catppuccin.homeModules.catppuccin
         inputs.neonix.homeManagerModules.neonix
         inputs.krewfile.homeManagerModules.krewfile
+        inputs.tflow.homeManagerModules.default
         inputs.niri.homeModules.niri
+        inputs.sops-nix.homeManagerModules.sops
         (inputs.import-tree.match ".*/default\\.nix" ./modules/home)
         ./modules/nix.nix
       ];
diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix
index cde409df..0efd4efd 100644
--- a/hosts/firefly/home.nix
+++ b/hosts/firefly/home.nix
@@ -24,9 +24,9 @@
     desktop = {
       hyprland = {
         enable = true;
-        package = pkgs.hyprland;
+        configOnly = true;
 
-        hyprlock.enable = true;
+        hyprlock.enable = false;
         hypridle = {
           enable = true;
           cmd = "/usr/bin/swaylock";
@@ -37,6 +37,16 @@
           "chromium"
         ];
       };
+
+      sway = {
+        enable = true;
+        package = null;
+        autostart = [
+          "sleep 3 && mumble" # Need to sleep for tray icon
+          "firefox"
+          "chromium"
+        ];
+      };
     };
 
     cli = {
diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix
index fc3c4c0c..200e3a08 100644
--- a/hosts/kubex/default.nix
+++ b/hosts/kubex/default.nix
@@ -20,10 +20,6 @@
     user = {
       name = "kubex";
       initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/";
-      keys = [
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi@rapsn.me"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn"
-      ];
       extraOptions = { };
       extraGroups = [ ];
     };
@@ -38,6 +34,12 @@
     hostId = "5851308f"; # Required by zfs
   };
 
+  boot.zfs.forceImportRoot = false;
+
+  security = {
+    sudo.wheelNeedsPassword = false;
+  };
+
   environment = {
     variables = {
       PROMPT = "%m@%n> ";
diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix
index 0f32d00d..aec94dd4 100644
--- a/hosts/nixberry/default.nix
+++ b/hosts/nixberry/default.nix
@@ -13,9 +13,6 @@
     user = {
       name = "rap";
       initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/";
-      keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn"
-      ];
       extraOptions = { };
       extraGroups = [ ];
     };
diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix
index faf32ae6..4e0f7d02 100644
--- a/hosts/vinox/default.nix
+++ b/hosts/vinox/default.nix
@@ -24,7 +24,6 @@
       initialHashedPassword = "";
       extraOptions = { };
       extraGroups = [ ];
-      keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v" ];
     };
   };
 
diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix
index db650f31..90cef8ed 100644
--- a/hosts/zion/default.nix
+++ b/hosts/zion/default.nix
@@ -22,7 +22,6 @@
       extraOptions = {
         initialHashedPassword = "$y$j9T$DZQaaK3xGqarN8KE8qnw..$dvgiS7dso5LboGRRf0dcyct/LQUFp4J0LUo2ZRRdTr8";
       };
-      keys = [ ];
     };
 
     services = {
@@ -54,7 +53,11 @@
   };
 
   environment = {
-    systemPackages = [ pkgs.qt6.qtwayland ];
+    systemPackages = [
+      pkgs.age
+      pkgs.age-plugin-yubikey
+      pkgs.qt6.qtwayland
+    ];
 
     sessionVariables = {
       WLR_NO_HARDWARE_CURSORS = "1";
@@ -64,7 +67,9 @@
 
   hardware.i2c.enable = true;
 
-  services.udev.packages = [
-    pkgs.qmk-udev-rules
-  ];
+  services.udev = {
+    packages = [
+      pkgs.qmk-udev-rules
+    ];
+  };
 }
diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix
index 1912ee81..6546fd8d 100644
--- a/hosts/zion/home.nix
+++ b/hosts/zion/home.nix
@@ -11,6 +11,11 @@
     stateVersion = lib.mkDefault "22.05";
   };
 
+  sops.age = {
+    generateKey = false;
+    keyFile = "${config.home.homeDirectory}/.config/sops/age/yubikey-identity.txt";
+  };
+
   roles = {
     work = false;
     email = "mail@rapsn.me";
diff --git a/modules/home/browsers/chromium/default.nix b/modules/home/browsers/chromium/default.nix
index e866c3e6..d91b26b1 100644
--- a/modules/home/browsers/chromium/default.nix
+++ b/modules/home/browsers/chromium/default.nix
@@ -9,6 +9,7 @@
     commandLineArgs = [
       "--enable-features=UseOzonePlatform"
       "--ozone-platform=wayland"
+      "--disable-features=WebRtcAllowInputVolumeAdjustment"
     ];
   };
 }
diff --git a/modules/home/browsers/firefox/default.nix b/modules/home/browsers/firefox/default.nix
index 28d0ff2f..a88e79a9 100644
--- a/modules/home/browsers/firefox/default.nix
+++ b/modules/home/browsers/firefox/default.nix
@@ -10,6 +10,7 @@ in
 {
   programs.firefox = {
     enable = true;
+    configPath = ".mozilla/firefox";
     profiles.default = {
       name = "Default";
 
@@ -40,6 +41,8 @@ in
 
         "widget.use-xdg-desktop-portal.file-picker" = 0; # Use new gtk file picker instead of legacy one
 
+        "widget.wayland.fractional-scale.enabled" = false; # Disable buggy scaling
+
         "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
         "layers.acceleration.force-enabled" = true;
         "gfx.webrender.all" = true;
diff --git a/modules/home/cli/tools/atuin/default.nix b/modules/home/cli/atuin/default.nix
similarity index 100%
rename from modules/home/cli/tools/atuin/default.nix
rename to modules/home/cli/atuin/default.nix
diff --git a/modules/home/cli/tools/core/packages.nix b/modules/home/cli/core/default.nix
similarity index 79%
rename from modules/home/cli/tools/core/packages.nix
rename to modules/home/cli/core/default.nix
index cb8d269b..1841188d 100644
--- a/modules/home/cli/tools/core/packages.nix
+++ b/modules/home/cli/core/default.nix
@@ -51,8 +51,20 @@
       # Clipboard
       wl-clipboard
 
+      # AI Shit
+      codex
+
       # Monitor / I2C com
       ddcutil
       ;
   };
+  programs = {
+    bat.enable = true;
+    fzf.enable = true;
+    btop.enable = true;
+
+    zoxide.enable = true;
+    neonix.enable = true;
+    eza.enable = true;
+  };
 }
diff --git a/modules/home/cli/tools/custom/default.nix b/modules/home/cli/custom/default.nix
similarity index 100%
rename from modules/home/cli/tools/custom/default.nix
rename to modules/home/cli/custom/default.nix
diff --git a/modules/home/cli/tools/custom/shell-scripts.nix b/modules/home/cli/custom/shell-scripts.nix
similarity index 100%
rename from modules/home/cli/tools/custom/shell-scripts.nix
rename to modules/home/cli/custom/shell-scripts.nix
diff --git a/modules/home/cli/tools/direnv/default.nix b/modules/home/cli/direnv/default.nix
similarity index 100%
rename from modules/home/cli/tools/direnv/default.nix
rename to modules/home/cli/direnv/default.nix
diff --git a/modules/home/cli/tools/git/default.nix b/modules/home/cli/git/default.nix
similarity index 100%
rename from modules/home/cli/tools/git/default.nix
rename to modules/home/cli/git/default.nix
diff --git a/modules/home/cli/tools/k8s/default.nix b/modules/home/cli/k8s/default.nix
similarity index 100%
rename from modules/home/cli/tools/k8s/default.nix
rename to modules/home/cli/k8s/default.nix
diff --git a/modules/home/cli/tools/k8s/k9s.nix b/modules/home/cli/k8s/k9s.nix
similarity index 67%
rename from modules/home/cli/tools/k8s/k9s.nix
rename to modules/home/cli/k8s/k9s.nix
index a4b97ba2..a1ed7961 100644
--- a/modules/home/cli/tools/k8s/k9s.nix
+++ b/modules/home/cli/k8s/k9s.nix
@@ -4,6 +4,23 @@
   ...
 }:
 let
+  gardenerScopes = [
+    "shoots"
+    # all resources in extensions.gardener.cloud/v1alpha1
+    "backupbuckets"
+    "backupentries"
+    "bastions"
+    "clusters"
+    "containerruntimes"
+    "controlplanes"
+    "dnsrecords"
+    "extensions"
+    "infrastructures"
+    "networks"
+    "operatingsystemconfigs"
+    "workers"
+  ];
+
   defaultPlugins = {
     edit-secret = {
       description = "Edit Decoded Secret";
@@ -23,22 +40,7 @@ let
     reconcile = {
       description = "Reconcile resource";
       shortCut = "r";
-      scopes = [
-        "shoots"
-        # all resources in extensions.gardener.cloud/v1alpha1
-        "backupbuckets"
-        "backupentries"
-        "bastions"
-        "clusters"
-        "containerruntimes"
-        "controlplanes"
-        "dnsrecords"
-        "extensions"
-        "infrastructures"
-        "networks"
-        "operatingsystemconfigs"
-        "workers"
-      ];
+      scopes = gardenerScopes;
       command = "kubectl";
       background = true;
       args = [
@@ -51,6 +53,38 @@ let
       ];
     };
 
+    suspend = {
+      description = "Suspend resource";
+      shortCut = "s";
+      scopes = gardenerScopes;
+      command = "kubectl";
+      background = true;
+      args = [
+        "annotate"
+        "-n"
+        "$NAMESPACE"
+        "$RESOURCE_NAME"
+        "$NAME"
+        "gardener.cloud/operation=suspend"
+      ];
+    };
+
+    resume = {
+      description = "Resume resource";
+      shortCut = "u";
+      scopes = gardenerScopes;
+      command = "kubectl";
+      background = true;
+      args = [
+        "annotate"
+        "-n"
+        "$NAMESPACE"
+        "$RESOURCE_NAME"
+        "$NAME"
+        "gardener.cloud/operation=resume"
+      ];
+    };
+
     reconcile-seed = {
       description = "Reconcile seed";
       shortCut = "r";
diff --git a/modules/home/cli/tools/k8s/krewfile.nix b/modules/home/cli/k8s/krewfile.nix
similarity index 100%
rename from modules/home/cli/tools/k8s/krewfile.nix
rename to modules/home/cli/k8s/krewfile.nix
diff --git a/modules/home/cli/tools/k8s/kubecolor.nix b/modules/home/cli/k8s/kubecolor.nix
similarity index 100%
rename from modules/home/cli/tools/k8s/kubecolor.nix
rename to modules/home/cli/k8s/kubecolor.nix
diff --git a/modules/home/cli/tools/langs/default.nix b/modules/home/cli/langs/default.nix
similarity index 100%
rename from modules/home/cli/tools/langs/default.nix
rename to modules/home/cli/langs/default.nix
diff --git a/modules/home/cli/tools/langs/go.nix b/modules/home/cli/langs/go.nix
similarity index 91%
rename from modules/home/cli/tools/langs/go.nix
rename to modules/home/cli/langs/go.nix
index b2375cd0..f45ca07b 100644
--- a/modules/home/cli/tools/langs/go.nix
+++ b/modules/home/cli/langs/go.nix
@@ -9,6 +9,7 @@
     package = pkgs.go;
     env = {
       GOPATH = "${config.home.homeDirectory}/go";
+      CGO_ENABLED = "0";
       GOPRIVATE = [
         "github.com/stackitcloud"
         "dev.azure.com/*"
diff --git a/modules/home/cli/tools/langs/rust.nix b/modules/home/cli/langs/rust.nix
similarity index 100%
rename from modules/home/cli/tools/langs/rust.nix
rename to modules/home/cli/langs/rust.nix
diff --git a/modules/home/cli/tools/lazygit/default.nix b/modules/home/cli/lazygit/default.nix
similarity index 100%
rename from modules/home/cli/tools/lazygit/default.nix
rename to modules/home/cli/lazygit/default.nix
diff --git a/modules/home/cli/tools/pet/default.nix b/modules/home/cli/pet/default.nix
similarity index 63%
rename from modules/home/cli/tools/pet/default.nix
rename to modules/home/cli/pet/default.nix
index b8090478..470b5b89 100644
--- a/modules/home/cli/tools/pet/default.nix
+++ b/modules/home/cli/pet/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  inputs,
+  config,
   ...
 }:
 {
@@ -8,7 +8,7 @@
     enable = true;
     settings = {
       General = lib.mkForce {
-        snippetfile = "${inputs.self.outPath}/extra/snippet.toml";
+        snippetfile = "${config.home.homeDirectory}/Projects/rapsnx/dotfiles/extra/snippet.toml";
         selectcmd = "fzf --ansi";
         color = true;
       };
diff --git a/modules/home/cli/tools/starship/default.nix b/modules/home/cli/starship/default.nix
similarity index 100%
rename from modules/home/cli/tools/starship/default.nix
rename to modules/home/cli/starship/default.nix
diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix
index 2ac151fd..4b10569f 100644
--- a/modules/home/cli/terminals/alacritty/default.nix
+++ b/modules/home/cli/terminals/alacritty/default.nix
@@ -35,7 +35,17 @@
 
           binding = {
             key = "H";
-            mods = "Control|Shift";
+            mods = "Control";
+          };
+        }
+        {
+          action = "Copy";
+          post_processing = true;
+          regex = "[a-z0-9]+(?:--?[a-z0-9]+)*(?:-[a-z0-9]+)*";
+
+          binding = {
+            key = "G";
+            mods = "Control";
           };
         }
       ];
diff --git a/modules/home/cli/terminals/tmux/default.nix b/modules/home/cli/terminals/tmux/default.nix
new file mode 100644
index 00000000..94466145
--- /dev/null
+++ b/modules/home/cli/terminals/tmux/default.nix
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+{
+  programs.tmux = {
+    enable = true;
+    package = pkgs.tmux;
+
+    shell = "${pkgs.zsh}/bin/zsh";
+    terminal = "xterm-256color";
+    mouse = true;
+    keyMode = "vi";
+    clock24 = true;
+    historyLimit = 100000;
+    escapeTime = 10;
+
+    extraConfig = ''
+      set -g focus-events on
+      set -g set-clipboard on
+      set -g allow-passthrough on
+      set -ga terminal-features ',alacritty:RGB'
+      set -ga terminal-features ',xterm-256color:RGB'
+      set -ga terminal-features ',tmux-256color:RGB'
+
+      set -g update-environment "DISPLAY WAYLAND_DISPLAY SSH_AUTH_SOCK XAUTHORITY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_CONFIG_HOME XDG_DATA_HOME XDG_CACHE_HOME KUBECONFIG"
+    '';
+  };
+}
diff --git a/modules/home/cli/tflow/default.nix b/modules/home/cli/tflow/default.nix
new file mode 100644
index 00000000..7364d5a8
--- /dev/null
+++ b/modules/home/cli/tflow/default.nix
@@ -0,0 +1,6 @@
+{ inputs, pkgs, ... }: {
+  programs.tflow = {
+    enable = true;
+    package = inputs.tflow.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  };
+}
diff --git a/modules/home/cli/tools/core/default.nix b/modules/home/cli/tools/core/default.nix
deleted file mode 100644
index ccf22c23..00000000
--- a/modules/home/cli/tools/core/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  imports = [
-    ./packages.nix
-    ./programs.nix
-  ];
-}
diff --git a/modules/home/cli/tools/core/programs.nix b/modules/home/cli/tools/core/programs.nix
deleted file mode 100644
index 889d1a85..00000000
--- a/modules/home/cli/tools/core/programs.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  # catppuccin = {
-  #   bat.enable = true;
-  #   fzf.enable = true;
-  #   btop.enable = true;
-  # };
-
-  programs = {
-    bat.enable = true;
-    fzf.enable = true;
-    btop.enable = true;
-
-    zoxide.enable = true;
-    neonix.enable = true;
-    eza.enable = true;
-  };
-}
diff --git a/modules/home/cli/shells/zsh/default.nix b/modules/home/cli/zsh/default.nix
similarity index 97%
rename from modules/home/cli/shells/zsh/default.nix
rename to modules/home/cli/zsh/default.nix
index 00dfde98..5f85bbd5 100644
--- a/modules/home/cli/shells/zsh/default.nix
+++ b/modules/home/cli/zsh/default.nix
@@ -13,6 +13,10 @@
       inherit (pkgs) zsh-completions;
     };
 
+    home.sessionPath = [
+      "$HOME/.local/bin"
+    ];
+
     programs.zsh = {
       enable = true;
 
diff --git a/modules/home/common/default.nix b/modules/home/common/default.nix
index 48666c57..688d6c8a 100644
--- a/modules/home/common/default.nix
+++ b/modules/home/common/default.nix
@@ -7,6 +7,7 @@
 
   catppuccin = {
     enable = true;
+    autoEnable = true;
     flavor = "mocha";
   };
 
diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix
index 3ff4b50b..991267ed 100644
--- a/modules/home/desktops/addons/kanshi/default.nix
+++ b/modules/home/desktops/addons/kanshi/default.nix
@@ -1,43 +1,67 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  self,
+  config,
+  ...
+}:
 {
   services.kanshi =
     let
-      hyprctl = lib.getExe' pkgs.hyprland "hyprctl";
-
-      # Pins Hyprland workspaces to monitors.
-      # Args: primary matcher, optional secondary matcher.
-      # Writes workspace config for hyprland, reloads it, and sets focus.
-      workspaceSetup = pkgs.writeShellScriptBin "workspaceSetup" ''
-        set -euo pipefail
-
-        monitors="$(${hyprctl} monitors -j)"
-
-        match_monitor() {
-          ${lib.getExe pkgs.jq} -r --arg matcher "$1" '
-            [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors"
-        }
-
-        primary="$(match_monitor "''${1:?missing primary monitor matcher}")"
-        secondary="$(match_monitor "''${2:-$1}")"
-
-        cat > "$HOME/.config/hypr/workspaces.conf" <<EOF
-        workspace = 1, monitor:$primary, default:true
-        workspace = 2, monitor:$primary
-        workspace = 3, monitor:$secondary, default:true
-        workspace = 4, monitor:$secondary
-        EOF
-
-        ${hyprctl} reload
-
-        ${hyprctl} dispatch moveworkspacetomonitor "1 $primary"
-        ${hyprctl} dispatch moveworkspacetomonitor "2 $primary"
-        ${hyprctl} dispatch moveworkspacetomonitor "3 $secondary"
-        ${hyprctl} dispatch moveworkspacetomonitor "4 $secondary"
-
-        ${hyprctl} dispatch focusmonitor "$primary"
-        ${hyprctl} dispatch workspace 1
-        systemctl --user restart waybar.service
-      '';
+      hyprlandCfg = config.roles.desktop.hyprland;
+      hyprctl =
+        if hyprlandCfg.enable && hyprlandCfg.configOnly then
+          "/usr/bin/hyprctl"
+        else
+          lib.getExe' pkgs.hyprland "hyprctl";
+      workspaceSetup =
+        let
+          wallpaperPath = "${self.outPath}/extra/wallpapers";
+          wallpapers = builtins.attrNames (builtins.readDir wallpaperPath);
+        in
+        pkgs.writeShellScriptBin "workspaceSetup" ''
+          set -euo pipefail
+
+          primary_desc="''${1:?missing primary monitor description}"
+          secondary_desc="''${2:-""}"
+          monitors="$(${hyprctl} monitors -j)"
+
+          # get_output gets the output name of a monitor description.
+          get_output() {
+            ${lib.getExe pkgs.jq} -r --arg matcher "$1" '
+              [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors"
+          }
+
+          primary="$(get_output $primary_desc)"
+          secondary="$(get_output $secondary_desc)"
+
+          # Generate workspace config
+          cat > "$HOME/.config/hypr/workspaces.conf" <<EOF
+          # Generated by kanshi on $(date +"%d-%m-%Y at %H:%M:%S"). Do not edit manually.
+
+          workspace = 1, monitor:$primary, default:true
+          workspace = 2, monitor:$primary
+          workspace = 3, monitor:$secondary, default:true
+          workspace = 4, monitor:$secondary
+          EOF
+
+          ${hyprctl} reload
+          ${hyprctl} dispatch moveworkspacetomonitor "1 $primary"
+          ${hyprctl} dispatch moveworkspacetomonitor "2 $primary"
+          ${hyprctl} dispatch moveworkspacetomonitor "3 $secondary"
+          ${hyprctl} dispatch moveworkspacetomonitor "4 $secondary"
+
+          # Set random wallpaper
+
+          wall_one=$(shuf -n 1 -e ${toString wallpapers})
+          wall_two=$(shuf -n 1 -e ${toString wallpapers})
+          ${hyprctl} hyprpaper wallpaper "$primary, ${wallpaperPath}/$(shuf -n 1 -e ${toString wallpapers})"
+          ${hyprctl} hyprpaper wallpaper "$secondary, ${wallpaperPath}/$(shuf -n 1 -e ${toString wallpapers})"
+
+          ${hyprctl} dispatch focusmonitor "$primary"
+          ${hyprctl} dispatch workspace 1
+          systemctl --user restart waybar.service
+        '';
 
       # mkExec collects all outputs and creates args out of it, the workspaceSetup script only takes the first two.
       mkExec =
diff --git a/modules/home/desktops/hyprland/addons/hyprlock.nix b/modules/home/desktops/hyprland/addons/hyprlock.nix
index aaefa210..c6142abc 100644
--- a/modules/home/desktops/hyprland/addons/hyprlock.nix
+++ b/modules/home/desktops/hyprland/addons/hyprlock.nix
@@ -32,7 +32,6 @@ in
           {
             size = "200, 50";
             position = "0, -80";
-            monitor = "";
             dots_center = true;
             fade_on_empty = false;
             font_color = "rgb(202, 211, 245)";
diff --git a/modules/home/desktops/hyprland/addons/hyprpaper.nix b/modules/home/desktops/hyprland/addons/hyprpaper.nix
deleted file mode 100644
index 55837270..00000000
--- a/modules/home/desktops/hyprland/addons/hyprpaper.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  self,
-  ...
-}:
-{
-  services.hyprpaper =
-    let
-      papersDir = "${self.outPath}/extra/wallpapers";
-      papers = builtins.attrNames (builtins.readDir papersDir);
-      paperPaths = map (paper: "${papersDir}/${paper}") papers;
-    in
-    {
-      enable = true;
-      settings = {
-        splash = false;
-
-        preload = paperPaths;
-
-        wallpaper = map (p: ",${p}") paperPaths;
-      };
-    };
-}
diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix
index 57a6c42e..fcf79472 100644
--- a/modules/home/desktops/hyprland/default.nix
+++ b/modules/home/desktops/hyprland/default.nix
@@ -10,7 +10,17 @@ let
 in
 {
   options.roles.desktop.hyprland = {
-    enable = lib.mkEnableOption "Enable hyprland";
+    enable = lib.mkEnableOption "Enable Hyprland";
+
+    configOnly = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Generate Hyprland configuration without installing or managing the
+        compositor or portal packages. Systemd session integration stays enabled
+        so user services can bind to hyprland-session.target.
+      '';
+    };
 
     package = lib.mkPackageOption pkgs "hyprland" {
       nullable = true;
@@ -31,96 +41,124 @@ in
   imports = [
     ./addons/hypridle.nix
     ./addons/hyprlock.nix
-
     ./keybinds.nix
   ];
 
-  config = lib.mkIf cfg.enable {
-
-    home.packages = builtins.attrValues {
-      inherit (pkgs) hyprland-qtutils rofimoji slurp;
-    };
-
-    # environment.d defines environment variables for the user session, beyond shell level.
-    # It is processed by `systemd --user`, basically after login.
-    xdg.configFile."environment.d/envvars.conf".text = ''
-      PATH="$HOME/.nix-profile/bin:$PATH"
-    '';
-
-    # TODO: remove this when changed to lua
-    catppuccin.hyprland.enable = false;
-    wayland.windowManager.hyprland = {
-      enable = true;
-      inherit (cfg) package;
-      systemd.enable = true;
-
-      settings = {
-        general = {
-          gaps_in = 8;
-          gaps_out = 10;
-          border_size = 3;
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        catppuccin.hyprland.enable = false;
+        catppuccin.hyprlock.enable = false;
+
+        services.hyprpaper.enable = true;
+
+        xdg.configFile."hypr/xdph.conf".text = ''
+          screencopy {
+              force_shm = true
+          }
+        '';
+
+        home.packages = builtins.attrValues {
+          inherit (pkgs)
+            rofimoji
+            slurp
+            ;
         };
 
-        # Source autogenerated configs
-        source = [
-          "${config.xdg.configHome}/hypr/monitors.conf"
-          "${config.xdg.configHome}/hypr/workspaces.conf"
-        ];
+        xdg.configFile."environment.d/envvars.conf".text = ''
+          PATH="$HOME/.nix-profile/bin:$PATH"
+        '';
 
-        # Auto tile new windows
-        dwindle = {
-          preserve_split = "yes";
-          special_scale_factor = 0.8;
-        };
+        programs.waybar.systemd.targets = lib.mkDefault [ "hyprland-session.target" ];
 
-        input = {
-          kb_layout = "eu,de,de";
-          kb_variant = ",neo_qwertz,";
-          repeat_rate = 45;
-          repeat_delay = 150;
-          accel_profile = "flat";
-          sensitivity = 1; # -1.0 - 1.0, 0 means no modification.
-        };
+        wayland.windowManager.hyprland = {
+          enable = true;
+          configType = "hyprlang";
 
-        xwayland = {
-          force_zero_scaling = true;
-        };
+          inherit (cfg) package;
 
-        decoration = {
-          blur = {
-            enabled = true;
-            size = 3;
-            passes = 2;
-            ignore_opacity = true;
-            new_optimizations = true;
+          systemd = {
+            enable = true;
+            variables = [ "--all" ];
           };
-          rounding = 5;
-          active_opacity = 0.98;
-          inactive_opacity = 0.85;
-        };
 
-        # Autostart
-        exec-once = [
-          "[ workspace special:scratchy silent ] alacritty -t scratchy"
-
-          "[ workspace special:aux silent ] sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga"
-        ]
-        ++ cfg.autostart;
-
-        windowrule = [
-          "match:class ^(firefox)$, workspace 3"
-          "match:class ^(chromium-browser)$, workspace 4"
-
-          "match:class ^(.*mumble.*)$, workspace special:aux silent"
-          "match:class ^(.*keepassxc.*)$, workspace special:aux silent"
-
-          # Force floating
-          "match:class steam, float yes"
-          "match:class ^(.*nextcloud.*)$, float yes"
-        ];
+          settings = {
+            env = [
+              "XDG_CURRENT_DESKTOP,Hyprland"
+              "XDG_SESSION_DESKTOP,Hyprland"
+              "XDG_SESSION_TYPE,wayland"
+            ];
+
+            general = {
+              gaps_in = 8;
+              gaps_out = 10;
+              border_size = 3;
+            };
+
+            source = [
+              "${config.xdg.configHome}/hypr/monitors.conf"
+              "${config.xdg.configHome}/hypr/workspaces.conf"
+            ];
+
+            dwindle = {
+              preserve_split = "yes";
+              special_scale_factor = 0.8;
+            };
+
+            input = {
+              kb_layout = "eu,de,de";
+              kb_variant = ",neo_qwertz,";
+              repeat_rate = 40;
+              repeat_delay = 250;
+              accel_profile = "flat";
+              sensitivity = 1;
+            };
+
+            xwayland = {
+              force_zero_scaling = true;
+            };
+
+            decoration = {
+              blur = {
+                enabled = true;
+                size = 3;
+                passes = 2;
+                ignore_opacity = true;
+                new_optimizations = true;
+              };
+
+              rounding = 5;
+            };
+
+            exec-once = [
+              "[ workspace special:scratchy silent ] alacritty -t scratchy"
+              # todoist app
+              "[ workspace special:aux silent ] sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga"
+            ]
+            ++ cfg.autostart;
+
+            windowrule = [
+              "match:class ^(firefox)$, workspace 3"
+              "match:class ^(chromium-browser)$, workspace 4"
+
+              "match:class ^(.*mumble.*)$, workspace special:aux silent"
+              "match:class ^(.*keepassxc.*)$, workspace special:aux silent"
+
+              "match:class steam, float yes"
+              "match:class ^(.*nextcloud.*)$, float yes"
+            ];
+          };
+        };
+      }
 
-      };
-    };
+      (lib.mkIf cfg.configOnly {
+        wayland.windowManager.hyprland = {
+          package = lib.mkForce null;
+          portalPackage = lib.mkForce null;
+        };
 
-  };
+        xdg.portal.enable = lib.mkForce false;
+      })
+    ]
+  );
 }
diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix
index bf9b38f4..7954b132 100644
--- a/modules/home/desktops/hyprland/keybinds.nix
+++ b/modules/home/desktops/hyprland/keybinds.nix
@@ -1,10 +1,32 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 let
   cfg = config.roles.desktop.hyprland;
+  toggleFirefox = pkgs.writeShellScriptBin "toggleFirefox" ''
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    CLASS="firefox"
+    DEDICATED_WS="3"
+
+    current_ws="$(hyprctl activeworkspace -j | jq -r '.id')"
+
+    firefox_on_current="$(
+      hyprctl clients -j | jq -r --arg class "$CLASS" --argjson ws "$current_ws" '
+        any(.[]; (.class | ascii_downcase) == $class and .workspace.id == $ws)
+      '
+    )"
+
+    if [[ "$firefox_on_current" == "true" ]]; then
+      hyprctl dispatch movetoworkspacesilent "$DEDICATED_WS,class:$CLASS"
+    else
+      hyprctl dispatch movetoworkspace "+0,class:$CLASS"
+    fi
+  '';
 in
 {
   config = lib.mkIf cfg.enable {
@@ -45,10 +67,6 @@ in
         "SUPER,3, workspace, 3"
         "SUPER,4, workspace, 4"
         "SUPER,5, workspace, 5"
-        "SUPER,6, workspace, 6"
-        "SUPER,7, workspace, 7"
-        "SUPER,8, workspace, 8"
-        "SUPER,9, workspace, 9"
 
         # Workpace handling sratchy
         "SUPER,O, togglespecialworkspace, scratchy"
@@ -57,16 +75,15 @@ in
         "SUPER SHIFT,M, movetoworkspace, special:aux"
 
         # -- Programs
-
         # Mumble
         "SUPER,Z, exec, mumble rpc togglemute"
         "SUPER+SHIFT,Z, exec, mumble rpc toggledeaf"
 
         # Emoji picker
-        "SUPER,period, exec, rofimoji --action copy --action type"
+        "SUPER,period, exec, rofimoji --action copy type"
 
-        # Emoji picker
-        "SUPER,I, exec, systemctl restart --user kanshi.service"
+        # Reload kanshi
+        "SUPER+SHIFT,I, exec, systemctl restart --user kanshi.service"
       ];
 
       extraConfig = ''
@@ -91,10 +108,8 @@ in
           bind = , escape, submap, reset
         submap = reset
 
-
         # Window mode
         bind = SUPER, G, submap, windows
-
         submap = windows
           bind = , Q, movetoworkspace, 1
           bind = , Q, submap, reset
@@ -108,21 +123,12 @@ in
           bind = , R, movetoworkspace, 4
           bind = , R, submap, reset
 
-          bind = , B, movetoworkspace, +0,class:firefox
-          bind = , B, submap, reset
-
-          bind = SHIFT, B, movetoworkspacesilent, 3,class:firefox
-          bind = SHIFT, B, submap, reset
+          # Special app toggle
+          bing = , B, exec, ${lib.getExe toggleFirefox}"
 
           bind = , return, submap, reset
           bind = , escape, submap, reset
         submap = reset
-
-        # Lid closed: disable internal laptop display
-        bindl = , switch:on:Lid Switch, exec, hyprctl keyword monitor "eDP-1, disable"
-
-        # Lid opened: enable internal laptop display again
-        bindl = , switch:off:Lid Switch, exec, hyprctl keyword monitor "eDP-1, 1920x1200@60, 0x0, 1"
       '';
     };
   };
diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix
new file mode 100644
index 00000000..f2e9b44d
--- /dev/null
+++ b/modules/home/desktops/sway/default.nix
@@ -0,0 +1,189 @@
+{
+  pkgs,
+  lib,
+  mylib,
+  config,
+  ...
+}:
+let
+  cfg = config.roles.desktop.sway;
+  modifier = "Mod4";
+in
+{
+  options.roles.desktop.sway = {
+    enable = lib.mkEnableOption "Enable Sway";
+
+    package = lib.mkPackageOption pkgs "sway" {
+      nullable = true;
+    };
+
+    autostart = mylib.mkOpt (lib.types.listOf lib.types.str) "autostart";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = builtins.attrValues {
+      inherit (pkgs)
+        rofimoji
+        slurp
+        ;
+    };
+
+    xdg.configFile."environment.d/envvars.conf".text = ''
+      PATH="$HOME/.nix-profile/bin:$PATH"
+    '';
+
+    programs.waybar.systemd.targets = lib.mkDefault [ "sway-session.target" ];
+
+    wayland.windowManager.sway = {
+      enable = true;
+
+      inherit (cfg) package;
+
+      systemd = {
+        enable = true;
+        variables = [ "--all" ];
+        xdgAutostart = true;
+      };
+
+      extraSessionCommands = ''
+        export XDG_CURRENT_DESKTOP=sway
+        export XDG_SESSION_DESKTOP=sway
+        export XDG_SESSION_TYPE=wayland
+      '';
+
+      config = {
+        inherit modifier;
+
+        terminal = "alacritty";
+        menu = "fuzzel";
+        bars = [ ];
+
+        gaps = {
+          inner = 8;
+          outer = 10;
+        };
+
+        window = {
+          border = 3;
+          titlebar = false;
+          commands = [
+            {
+              command = "move scratchpad";
+              criteria.title = "scratchy";
+            }
+            {
+              command = "move scratchpad";
+              criteria.class = ".*mumble.*";
+            }
+            {
+              command = "move scratchpad";
+              criteria.class = ".*keepassxc.*";
+            }
+          ];
+        };
+
+        input = {
+          "type:keyboard" = {
+            xkb_layout = "eu,de,de";
+            xkb_variant = ",neo_qwertz,";
+            repeat_rate = "45";
+            repeat_delay = "150";
+          };
+
+          "type:pointer" = {
+            accel_profile = "flat";
+            pointer_accel = "1";
+          };
+        };
+
+        startup = [
+          { command = "alacritty -t scratchy"; }
+          {
+            command = "sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga";
+          }
+        ]
+        ++ map (command: { inherit command; }) cfg.autostart;
+
+        assigns = {
+          "3" = [ { class = "^firefox$"; } ];
+          "4" = [ { class = "^chromium-browser$"; } ];
+        };
+
+        floating.criteria = [
+          { class = "^steam$"; }
+          { class = "^.*nextcloud.*$"; }
+        ];
+
+        keybindings = lib.mkOptionDefault {
+          "${modifier}+Return" = "exec alacritty";
+          "${modifier}+e" = "exec fuzzel";
+          "${modifier}+p" = "exec wlogout";
+          "${modifier}+q" = "kill";
+
+          "${modifier}+n" = "exec swaync-client -t";
+
+          "${modifier}+f" = "fullscreen toggle";
+          "${modifier}+Shift+f" = "fullscreen toggle global";
+
+          "${modifier}+h" = "focus left";
+          "${modifier}+j" = "focus down";
+          "${modifier}+k" = "focus up";
+          "${modifier}+l" = "focus right";
+
+          "${modifier}+Shift+h" = "move left";
+          "${modifier}+Shift+j" = "move down";
+          "${modifier}+Shift+k" = "move up";
+          "${modifier}+Shift+l" = "move right";
+
+          "${modifier}+t" = "layout toggle split";
+          "${modifier}+u" = "floating toggle";
+
+          "${modifier}+1" = "workspace number 1";
+          "${modifier}+2" = "workspace number 2";
+          "${modifier}+3" = "workspace number 3";
+          "${modifier}+4" = "workspace number 4";
+          "${modifier}+5" = "workspace number 5";
+
+          "${modifier}+o" = "scratchpad show";
+          "${modifier}+Shift+o" = "move scratchpad";
+
+          "${modifier}+z" = "exec mumble rpc togglemute";
+          "${modifier}+Shift+z" = "exec mumble rpc toggledeaf";
+
+          "${modifier}+period" = "exec rofimoji --action copy type";
+          "${modifier}+Shift+i" = "exec systemctl restart --user kanshi.service";
+
+          "${modifier}+r" = "mode resize";
+          "${modifier}+g" = "mode windows";
+        };
+
+        modes = {
+          resize = {
+            h = "resize shrink width 60 px";
+            j = "resize grow height 60 px";
+            k = "resize shrink height 60 px";
+            l = "resize grow width 60 px";
+
+            "Shift+h" = "resize shrink width 20 px";
+            "Shift+j" = "resize grow height 20 px";
+            "Shift+k" = "resize shrink height 20 px";
+            "Shift+l" = "resize grow width 20 px";
+
+            Return = "mode default";
+            Escape = "mode default";
+          };
+
+          windows = {
+            q = "move container to workspace number 1; mode default";
+            w = "move container to workspace number 2; mode default";
+            e = "move container to workspace number 3; mode default";
+            r = "move container to workspace number 4; mode default";
+
+            Return = "mode default";
+            Escape = "mode default";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/home/programs/default.nix b/modules/home/programs/default.nix
index 1a9fd6eb..5e56457c 100644
--- a/modules/home/programs/default.nix
+++ b/modules/home/programs/default.nix
@@ -1,5 +1,30 @@
+{ pkgs, ... }:
 {
-  imports = [
-    ./guis
-  ];
+  home.packages = builtins.attrValues {
+    # Audio
+    inherit (pkgs)
+      pavucontrol
+      spek
+      vlc
+
+      # Screenshot / Recording
+      grimblast
+      wf-recorder
+
+      # Tools
+      nwg-displays
+      nwg-look
+      gparted
+      gnome-disk-utility
+
+      # Explorer
+      thunar
+
+      # Note taking
+      obsidian
+
+      # Keyboard
+      zmk-studio
+      ;
+  };
 }
diff --git a/modules/home/programs/guis/default.nix b/modules/home/programs/guis/default.nix
deleted file mode 100644
index 0f50d4ca..00000000
--- a/modules/home/programs/guis/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = builtins.attrValues {
-    # Audio
-    inherit (pkgs)
-      pavucontrol
-      spek
-      vlc
-
-      # Screenshot / Recording
-      grimblast
-      wf-recorder
-
-      # Tools
-      nwg-displays
-      nwg-look
-      gparted
-      gnome-disk-utility
-
-      # Explorer
-      thunar
-
-      # Note taking
-      obsidian
-      ;
-  };
-}
diff --git a/modules/home/services/default.nix b/modules/home/services/default.nix
index a699bd63..099be714 100644
--- a/modules/home/services/default.nix
+++ b/modules/home/services/default.nix
@@ -1,6 +1,7 @@
 {
   imports = [
     ./ssh.nix
+    ./sops.nix
     ./tray.nix
     ./keyring.nix
     ./nextcloud.nix
diff --git a/modules/home/services/keyring.nix b/modules/home/services/keyring.nix
index 8d27aa7f..111e8d49 100644
--- a/modules/home/services/keyring.nix
+++ b/modules/home/services/keyring.nix
@@ -1,12 +1,14 @@
-{ pkgs, ... }:
 {
-  services.gnome-keyring = {
-    enable = true;
-    components = [
-      "pkcs11"
-      "secrets"
-    ];
-  };
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  # On NixOS, PAM starts and unlocks the login keyring. On generic Linux hosts,
+  # Home Manager still needs to provide the user service.
+  services.gnome-keyring.enable = lib.mkForce config.targets.genericLinux.enable;
+
   home.packages = builtins.attrValues {
     inherit (pkgs) gcr seahorse;
   };
diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix
new file mode 100644
index 00000000..88c5eac4
--- /dev/null
+++ b/modules/home/services/sops.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  config,
+  ...
+}:
+lib.mkIf (config ? targets && config.targets ? genericLinux && config.targets.genericLinux.enable) {
+  sops = {
+    age = {
+      generateKey = lib.mkDefault true;
+      keyFile = lib.mkDefault "${config.home.homeDirectory}/.config/sops/age/keys.txt";
+    };
+
+    defaultSopsFile = ../../../secrets/common/ssh.yaml;
+
+    # TODO: Use this on firefly when adding it to the key
+    # secrets = {
+    #   ssh_config = {
+    #     path = "${config.home.homeDirectory}/.ssh/config";
+    #     mode = "0600";
+    #   };
+    #
+    #   swiss = {
+    #     path = "${config.home.homeDirectory}/.ssh/swiss";
+    #     mode = "0600";
+    #   };
+    #
+    #   "swiss.pub" = {
+    #     path = "${config.home.homeDirectory}/.ssh/swiss.pub";
+    #     mode = "0644";
+    #   };
+    #
+    #   yubi = {
+    #     path = "${config.home.homeDirectory}/.ssh/yubi";
+    #     mode = "0600";
+    #   };
+    #
+    #   "yubi.pub" = {
+    #     path = "${config.home.homeDirectory}/.ssh/yubi.pub";
+    #     mode = "0644";
+    #   };
+    # };
+  };
+}
diff --git a/modules/nixos/roles/desktop/default.nix b/modules/nixos/roles/desktop/default.nix
index 502715d1..ef9c9b52 100644
--- a/modules/nixos/roles/desktop/default.nix
+++ b/modules/nixos/roles/desktop/default.nix
@@ -1,3 +1,11 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.hostConfig.roles.desktop;
+in
 {
   imports = [
     ./hyprland.nix
@@ -5,4 +13,13 @@
     ./power.nix
     ./explorer.nix
   ];
+
+  config = lib.mkIf cfg {
+    services.gnome.gnome-keyring.enable = true;
+
+    security.pam.services = {
+      greetd.enableGnomeKeyring = true;
+      login.enableGnomeKeyring = true;
+    };
+  };
 }
diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix
index c9d854f1..9ef2ae48 100644
--- a/modules/nixos/roles/desktop/hyprland.nix
+++ b/modules/nixos/roles/desktop/hyprland.nix
@@ -6,9 +6,54 @@
 }:
 let
   cfg = config.hostConfig.roles.desktop;
+
+  tuigreetTheme = lib.concatStringsSep ";" [
+    "container=black"
+    "text=white"
+    "border=magenta"
+    "title=magenta"
+    "greet=cyan"
+    "prompt=blue"
+    "input=magenta"
+    "time=green"
+    "action=yellow"
+    "button=red"
+  ];
+
+  tuigreetCommand = lib.escapeShellArgs [
+    "${pkgs.tuigreet}/bin/tuigreet"
+    "--sessions"
+    "${config.services.displayManager.sessionData.desktops}/share/wayland-sessions"
+    "--session-wrapper"
+    "${config.services.displayManager.sessionData.wrapper}"
+    "--time"
+    "--remember"
+    "--remember-user-session"
+    "--asterisks"
+    "--theme"
+    tuigreetTheme
+  ];
 in
 {
   config = lib.mkIf cfg {
+    boot.plymouth.enable = true;
+
+    console = {
+      font = "ter-v32n";
+      packages = [ pkgs.terminus_font ];
+    };
+
+    catppuccin = {
+      enable = true;
+      autoEnable = true;
+      flavor = "macchiato";
+      accent = "mauve";
+
+      cursors.enable = true;
+      plymouth.enable = true;
+      tty.enable = true;
+    };
+
     programs.hyprland = {
       enable = true;
       withUWSM = false;
@@ -18,14 +63,16 @@ in
 
     services.greetd = {
       enable = true;
+      useTextGreeter = true;
+
+      settings = {
+        terminal.vt = 1;
 
-      settings.default_session.command = ''
-        ${pkgs.tuigreet}/bin/tuigreet \
-          --time \
-          --remember \
-          --theme 'border=magenta;text=cyan;prompt=green;time=red;action=blue;button=yellow;container=black;input=red' \
-          --cmd start-hyprland
-      '';
+        default_session = {
+          command = tuigreetCommand;
+          user = "greeter";
+        };
+      };
     };
   };
 }
diff --git a/modules/nixos/roles/k3s/default.nix b/modules/nixos/roles/k3s/default.nix
index 9f843074..4f877fbb 100644
--- a/modules/nixos/roles/k3s/default.nix
+++ b/modules/nixos/roles/k3s/default.nix
@@ -16,6 +16,7 @@ in
   imports = [
     ./service.nix
     ./network.nix
+    ./zfs.nix
   ];
 
   options.hostConfig.roles.k3s = lib.mkEnableOption "Enable k3s cluster configuration.";
diff --git a/modules/nixos/roles/k3s/zfs.nix b/modules/nixos/roles/k3s/zfs.nix
new file mode 100644
index 00000000..c4a7c5be
--- /dev/null
+++ b/modules/nixos/roles/k3s/zfs.nix
@@ -0,0 +1,63 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.hostConfig.roles.k3s;
+  poolName = "kubex-main";
+in
+{
+  config = lib.mkIf cfg {
+    systemd.services.wait-for-zfs-pool = {
+      description = "Prepare ZFS pool ${poolName} for k3s";
+      before = [ "k3s.service" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = config.hostConfig.user.name;
+        RemainAfterExit = true;
+        TimeoutStartSec = "infinity";
+      };
+      script = ''
+        set -euo pipefail
+
+        pool="${poolName}"
+        key_source="rap@nixberry"
+
+        echo "Ensuring ZFS pool $pool is imported"
+        if ! ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; then
+          ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zpool import -aN
+        fi
+
+        until ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; do
+          echo "Waiting for ZFS pool $pool to appear"
+          sleep 2
+        done
+
+        echo "Loading encryption key for $pool from $key_source"
+        while true; do
+          if key="$(${pkgs.openssh}/bin/ssh \
+            -o BatchMode=yes \
+            -o ConnectTimeout=10 \
+            -o StrictHostKeyChecking=accept-new \
+            "$key_source" ulock-agent get)"; then
+            break
+          fi
+
+          echo "Waiting for SSH access to $key_source"
+          sleep 5
+        done
+
+        printf '%s\n' "$key" | ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zfs load-key "$pool"
+      '';
+    };
+
+    systemd.services.k3s = {
+      requires = [ "wait-for-zfs-pool.service" ];
+      after = [ "wait-for-zfs-pool.service" ];
+    };
+  };
+}
diff --git a/modules/nixos/services/nh.nix b/modules/nixos/services/nh.nix
index b0f9f4ac..34d06270 100644
--- a/modules/nixos/services/nh.nix
+++ b/modules/nixos/services/nh.nix
@@ -3,6 +3,6 @@
     enable = true;
     clean.enable = true;
     clean.extraArgs = "--keep 5 --keep-since 5d";
-    flake = "/home/rap/Projects/rgroemmer/dotfiles";
+    flake = "/home/rap/Projects/rapsnx/dotfiles";
   };
 }
diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix
index 244a8961..946bc878 100644
--- a/modules/nixos/system/boot.nix
+++ b/modules/nixos/system/boot.nix
@@ -26,7 +26,6 @@ in
 
       kernelParams = [
         "quiet"
-        "splash"
         "boot.shell_on_fail"
         "udev.log_priority=3"
         "rd.systemd.show_status=auto"
diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix
index 89a3a136..ad8e35be 100644
--- a/modules/nixos/system/default.nix
+++ b/modules/nixos/system/default.nix
@@ -4,6 +4,7 @@
     ./boot.nix
     ./user.nix
     ./locale.nix
+    ./sops.nix
     ./zsh.nix
   ];
 }
diff --git a/modules/nixos/system/env.nix b/modules/nixos/system/env.nix
index 5cfa7f83..b066a974 100644
--- a/modules/nixos/system/env.nix
+++ b/modules/nixos/system/env.nix
@@ -26,10 +26,12 @@
           ;
       }
       # TODO: wtf?
-      ++ lib.optionals (!config.hostConfig.roles.desktop) (lib.attrValues {
-        inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini;
-        inherit (pkgs) jq tmux;
-      });
+      ++ lib.optionals (!config.hostConfig.roles.desktop) (
+        lib.attrValues {
+          inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini;
+          inherit (pkgs) jq;
+        }
+      );
     variables = {
       EDITOR = "vim";
       VISUAL = "vim";
diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix
new file mode 100644
index 00000000..468d9c76
--- /dev/null
+++ b/modules/nixos/system/sops.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  config,
+  ...
+}:
+lib.mkIf (config.hostConfig.user.name != "root") {
+  sops = {
+    age = {
+      generateKey = lib.mkDefault false;
+      keyFile = lib.mkDefault "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt";
+    };
+
+    defaultSopsFile = ../../../secrets/common/ssh.yaml;
+
+    secrets = {
+      ssh_config = {
+        path = "/home/${config.hostConfig.user.name}/.ssh/config";
+        owner = config.hostConfig.user.name;
+        mode = "0600";
+      };
+
+      swiss = {
+        path = "/home/${config.hostConfig.user.name}/.ssh/swiss";
+        owner = config.hostConfig.user.name;
+        mode = "0600";
+      };
+
+      "swiss.pub" = {
+        path = "/home/${config.hostConfig.user.name}/.ssh/swiss.pub";
+        owner = config.hostConfig.user.name;
+        mode = "0644";
+      };
+
+      yubi = {
+        path = "/home/${config.hostConfig.user.name}/.ssh/yubi";
+        owner = config.hostConfig.user.name;
+        mode = "0600";
+      };
+
+      "yubi.pub" = {
+        path = "/home/${config.hostConfig.user.name}/.ssh/yubi.pub";
+        owner = config.hostConfig.user.name;
+        mode = "0644";
+      };
+    };
+  };
+}
diff --git a/modules/nixos/system/user.nix b/modules/nixos/system/user.nix
index 7fe57285..7566bfc6 100644
--- a/modules/nixos/system/user.nix
+++ b/modules/nixos/system/user.nix
@@ -12,7 +12,6 @@ in
   options.hostConfig.user = {
     name = mylib.mkOpt lib.types.str "Name of user.";
     initialHashedPassword = mylib.mkOpt lib.types.str "Password of user.";
-    keys = mylib.mkOpt (lib.types.listOf lib.types.str) "Public SSH keys of user.";
     extraGroups = mylib.mkOpt' (lib.types.listOf lib.types.str) [ ] "Additional groups for the user.";
     extraOptions = mylib.mkOpt lib.types.attrs "Additional options for the user.";
   };
@@ -24,7 +23,10 @@ in
       shell = pkgs.zsh;
 
       initialHashedPassword = lib.mkForce cfg.initialHashedPassword;
-      openssh.authorizedKeys.keys = cfg.keys;
+      openssh.authorizedKeys.keys = [
+        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss"
+        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi"
+      ];
 
       extraGroups = [
         "wheel"
diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml
new file mode 100644
index 00000000..e7af406f
--- /dev/null
+++ b/secrets/common/ssh.yaml
@@ -0,0 +1,38 @@
+ssh_config: ENC[AES256_GCM,data:jy99anNQWbZG41aa6HeTdGsKsjDWg2B72RTQk2MmeLlhQhBOMn4639G4ibkWFlCTkmRtz+XCHTiuUUnvChLxtFz7/osGGpKmBr6mVBG78Hftbf97UP88Ydt5zOLWRIb2U1i5dzLxiLFfbYl0bVKd7DHrsM9KLRlWtpGOJ2WW1Qubg1MrXjQc0Wcv/hYjoLfysyNYeBRAHDmuAVlsqrWvXT/hs11xHxLeyBU1NjkmdKjtQ54y6yoS4bYbMAXa2WDsM1iZVsrBvadkOn+/C02QWI/nugPb5ycTaWLbu342ixBrDyyvZkmX+HHkR0h4yjqDGfYT62be4lTn3iyFjNno/VgORat8VTFzBubpnpm+AfhdG+4EqqBu5sJejZbGTIa0kfkfTG0pCzLNvh1HyvO38Ccjluhx8pbSHdlbK0Gj0Lu1+WMVxlXCYNTTJWKuS3isZhtA6Mk5HJNwpdQZo8XD2OJGKWQKLPHmp/K4x7HfLmRYyB+p+EPfT/CMFisYVKiQZle0tHq5aQ0czzeZpXSwi4J06UF3W2hPLMN2Eup9bRF8gg39+6gh5Ceji7RCqc9iw/CVUdq7KvlR1tky7jQP8VRrFUAjMYm8dy8Lrmbs/BT0kDlqkaReIHpSXJn2z19O86Si7yEEbLIyUWEaMhzW4lEkbel6X6ZOc8SRIlDak7JcPSagDDZo1LTjgDvyzQNkfEV4v2JKJTVNI+bqXzC34ss5sUs0cHSwWeQ7ja88ef4Fe74ySea/unt7qbkzkdzWg9i4jfPRA/clZ7CYSpLU0v5/H3zijZbrGmsgskVsJHUHxptsgzkFI4eu4ISeQUyiP3IjkfmL4UEVO4dvpNFBa1kourh0FyEfvN1hb1C3Vg18i1ltvj8kCUntmXGHMJxz7idSPP8Hl/dYG+y8fWa45cvgDRVs+bNm50qr2zyPLOpIdRt8hPFLKGFJT3113h1D/BAn2765kbO3jZ7KGG6wVIitEYwgmPitq41C3rIa+J+tYANQ47rK82nyacnRCVphnZl6hsd7LNtrDx+BkLNoM7BPpKK2i4yml1v9amgqWRc58y3e8X797AGCkJZJroqytdXmamuAUlc9kZ0VTI7YXDJuIg3ysll5Hv61Zg1eW6m/NZqsy0fHfMJmpDFvyqF4gATqN3Rfsdn5YFv7hF6VY5Q=,iv:oAOfe0qlOanFFgH4CjKtHYPAUujM4xid+U3zKQhtJbI=,tag:mxYZxlsv/WLQYRGdoeh+9g==,type:str]
+swiss: ENC[AES256_GCM,data:zDBhSsPOguZuD6Kx+rMYR9KAjXxycbjXMhL5MZabZShKV+1ICZBsfnWOnBcfxX281hXf2K/TNbphC3KLnTaV0+Ti43BKunSDJp8qyEKgG3xsd7Zf8/i/eMQJygMphCF3XvJJjc3wBEUf/mZ1ObJKYueqtTdSZzx4orR6X93Vdt13GgFJLaX4/8XYsAeBXf4RwYD5gsVjg2QI0t48vnvlU0xN6oFvJAYedvyxgPL3z1pGv+0k/85XtaCfy38LQ5ddOYGxH+XKDzCfkskhd3X6cUeMbDfLrelGwvTB967wHAulgilBR1ObhV1SoUiz6K1a1PRy9XjuzwTbFG8fjFrGk+9yJtucFp1Vgtf6L+pgLxc5HzkC+f9tEldslJQC6y1045s/OWp+ghL+auzFuJGhDuq8JJUSF9Pk0LeDOb67wIrW+2250PTYJbINk2Sdo09Bj7GUCCBkrDHT+IcA/qF0saQ25QTE/BtPLEMiPhwgkYAhrL1uz7s6+HfuUiFPKY0jOn0q0xTxfV00G+wGJFp7,iv:uZxwZQZhmBKUQnAPuf6NFk9TRWH16PmVu5RoTmmxN9Y=,tag:hbvkjfxuSUM2MOyrUzhDrg==,type:str]
+swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str]
+yubi: ENC[AES256_GCM,data:cUO0Yf06ZCIDXe6XBAvHcF+4/rFz3iC8rkgWKtyp5e8nJ80jXF9U00g8zns1yfnRG92QfHNH9hewDepSjkNY/j3SjhUbJynKjJpMTxZURVURJtrVwVbtlN/PvPyffxjolEFzzjM62wCNUCtF4lSZn1p8RQ/G38MI3wTP2JSAOFn4cA2nvJ5rL1vs05pElBfT19hDUfImFR4L5A7Q/bkfIpO7bO0D2qBbiCO6NI0epYXPUp0yize2+hu1mDPCLPIL29P3q7ycVJAXFqxyTvweo72qY7he1dqNEKu/hIFDuHMS+n9fhzf6Qn+5eJcljMofeYLXcLQn57TtUMFkiMRc9t50sip/S0DuPrFO87zf7FZYeHaRKs35gKktVPKl3Vgb+On6BO3A4oU1Ru/EiCdRiYL8d7yTKe9CcU7Hghz41ToAH6PEvx+uCFNvWvmIOlTfGHCik4uwPa35H/aUzLAd736AtcrjyNfvISx6MdtbS83+UFi+clM6ZDvLn/YShEBiipWzJuhK6ZjVq47kDxKFW1ym6ybihL/c+dXS7NcNigkJgpEpZMuFvPDyk/thmyhE3GgBExC/Lms=,iv:XmGbA9MElvTgd4cyjtPAy7uKC0GTqpQksX/8UBl1r+k=,tag:Ox8HK8XVRFGc8CYcnwKn5w==,type:str]
+yubi.pub: ENC[AES256_GCM,data:MdT+SaIQ4Uf+7SXPTE9dKo9pLdfP299qUSeg5XITB5APs7jOleh6VIZXXamitYm9YQLHrwIZJdTql66SfNyRp0YbkEbd5VGBYKSkHj1taDqFoEG8HCv9DTBj/CiNEimrVcbAFU4zgc6S4jAbY4C3WIDiJ2+GsNjZJgIKOtYwCVKxheRW,iv:TwkpyyiFvOtiKxrtcxn6vgP5yCfW/1bDRGUpCSrJw84=,tag:+1YVdIqiY5VQnfOJK1Syzw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VHNVeE1hWWw2K3RDTEdv
+            UXlyMHRuVVhtSHF1VVRkcEE5VFNFcVFDelRNCkJSd1hwWXZNSWE4MWxLeEhWNmdw
+            bUg4S0ptSW1MZTV2NVlweUdyTFhGVEkKLS0tIHJuYWI2YjkrVU5LSU44MHZrYVVq
+            OHp6dUlaVkh3SGlJVUdIbkFvQVBJMWcKyivsQOeFIt19FqMdNrwphoUbbVmHZEL0
+            auPp4D2lfZeN+qThhSqlL7gwAMgYII07Bxy+zdfRzDgZG4Vu9wSkOw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdG1RRGFMbk11KzJBMnU2
+            YW1GeFBzYUVURDlsenFldlZ5Q0FxUHdCU0RZCnIvUnlmKzlzSUtMVzlMSHVib2Zp
+            eEl0dlRNZlpqWTVKQVV1N2pVcTZwazQKLS0tIDM0Q1pMNFhVVlRoSDRkOUVnd0JI
+            cHVTZmpYcjk5ZTBMT09wbkNEY05hSlEKsDWV8a0HjyOgpusWHVKEkmt8yKAofVTD
+            LWmnHHwKMmORSke7Sv2w8HnLc3yBMJ7kIXdqzNL+qoD8ntxI/LkxaQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRnJ1Nkw2bXQwSUYxR29i
+            cGsweXpKNEFObUROVjU4TmtJWjhib2ZuckRvCkg5MHkwdVlnQnBYMmpseEhxMXI3
+            Rm5tMmpFSzd6ZEZTWW5IWW1zWC9JL2sKLS0tIFpSc1EvckhuVTdqOFBia0RkTjBl
+            N0Y2anMzSm9mU1ZnZU9wN3h2Q0lud3cKKB3WZzhBM2scG0tBDa+QOxt9IcHFQw9T
+            4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp
+    lastmodified: "2026-06-28T14:28:58Z"
+    mac: ENC[AES256_GCM,data:9ImIbWTSPIhFpgx+DhICpgTF2feJ9tlikEdlbpEMz5d9zpxHq4O2zxJwmUg8m547lhz5EN9ZwT+Al002DR2396n+tg6NsLCbUNMcf2BelW+2EWSsEPt3tNzazEW4EQIKHWS4y1FPXnQBpPtXPNHBuhWabMwCICk8uD2TFe+snL0=,iv:a0ZbRl6GqbOcSkUvavi0lTQkFEUcK1kgKWtVO1o0kRc=,tag:bL9M9kw7Q/o1K/+pYgRSFA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1