From b44499c92e15d7c7e558b65b2844656afe92a6bf Mon Sep 17 00:00:00 2001
From: truxnell <19149206+truxnell@users.noreply.github.com>
Date: Tue, 26 Mar 2024 21:11:56 +1100
Subject: [PATCH] fix: finish hax?

---
 .taskfiles/nix/Taskfile.yaml                  |   5 +-
 dns01.qcow2                                   | Bin 0 -> 1441792 bytes
 nixos/hosts/citadel/default.nix               |   8 -
 nixos/hosts/common/optional/chrony.nix        |  11 --
 .../hosts/common/optional/dnscrypt-proxy2.nix |  41 -----
 .../optional/editors/vscode/default.nix       | 139 --------------
 .../optional/editors/vscode/extensions.nix    | 174 ------------------
 nixos/hosts/common/optional/firefox.nix       |   9 -
 nixos/hosts/common/optional/gnome.nix         |  68 -------
 nixos/hosts/common/optional/maddy.nix         |  22 ---
 nixos/hosts/dns01/default.nix                 |  11 +-
 nixos/hosts/rickenbacker/default.nix          |  10 +-
 nixos/modules/nixos/browser/default.nix       |   5 +
 nixos/modules/nixos/browser/firefox.nix       |  22 +++
 nixos/modules/nixos/de/default.nix            |   6 +
 nixos/modules/nixos/de/gnome.nix              |  81 ++++++++
 nixos/modules/nixos/default.nix               |   3 +
 nixos/modules/nixos/editor/default.nix        |   6 +
 nixos/modules/nixos/editor/vscodium.nix       | 154 ++++++++++++++++
 .../services/cloudflare-dyndns/default.nix    |   6 +-
 nixos/modules/nixos/services/default.nix      |   2 +
 .../services/dnscrypt-proxy2/default.nix      |  48 +++++
 .../dnscrypt-proxy2.sops.yaml                 |   0
 .../modules/nixos/services/maddy/default.nix  |  30 +++
 .../nixos/services/maddy}/maddy.conf          |   0
 .../nixos/services/maddy}/maddy.sops.yaml     |   0
 nixos/profiles/role-worstation.nix            |  12 +-
 27 files changed, 381 insertions(+), 492 deletions(-)
 create mode 100644 dns01.qcow2
 delete mode 100644 nixos/hosts/common/optional/chrony.nix
 delete mode 100644 nixos/hosts/common/optional/dnscrypt-proxy2.nix
 delete mode 100644 nixos/hosts/common/optional/editors/vscode/default.nix
 delete mode 100644 nixos/hosts/common/optional/editors/vscode/extensions.nix
 delete mode 100644 nixos/hosts/common/optional/firefox.nix
 delete mode 100644 nixos/hosts/common/optional/gnome.nix
 delete mode 100644 nixos/hosts/common/optional/maddy.nix
 create mode 100644 nixos/modules/nixos/browser/default.nix
 create mode 100644 nixos/modules/nixos/browser/firefox.nix
 create mode 100644 nixos/modules/nixos/de/default.nix
 create mode 100644 nixos/modules/nixos/de/gnome.nix
 create mode 100644 nixos/modules/nixos/editor/default.nix
 create mode 100644 nixos/modules/nixos/editor/vscodium.nix
 create mode 100644 nixos/modules/nixos/services/dnscrypt-proxy2/default.nix
 rename nixos/{hosts/common/optional => modules/nixos/services/dnscrypt-proxy2}/dnscrypt-proxy2.sops.yaml (100%)
 create mode 100644 nixos/modules/nixos/services/maddy/default.nix
 rename nixos/{hosts/common/optional => modules/nixos/services/maddy}/maddy.conf (100%)
 rename nixos/{hosts/common/optional => modules/nixos/services/maddy}/maddy.sops.yaml (100%)

diff --git a/.taskfiles/nix/Taskfile.yaml b/.taskfiles/nix/Taskfile.yaml
index 5ab4a44..c3f637c 100644
--- a/.taskfiles/nix/Taskfile.yaml
+++ b/.taskfiles/nix/Taskfile.yaml
@@ -45,7 +45,8 @@ tasks:
       vars:
         - host
     cmds:
-      - echo "This will dry-run your config."
+      - echo "This will dry-run your config and add your untracked git files."
+      - git add .
       - nixos-rebuild dry-run --flake "{{.ROOT_DIR}}/#{{.host}}" --impure
     preconditions:
       - sh: which nix
@@ -61,7 +62,9 @@ tasks:
       vars:
         - host
     cmds:
+      - git add .
       - nixos-rebuild build --flake "{{.ROOT_DIR}}/#{{.host}}" --impure
+      - nvd diff /run/current-system result
     preconditions:
       - sh: which nix
         msg: "nix not found"
diff --git a/dns01.qcow2 b/dns01.qcow2
new file mode 100644
index 0000000000000000000000000000000000000000..22c5606b60318796d5f90e530c471a98dc261d6f
GIT binary patch
literal 1441792
zcmeI)U65C0ekbtXIdlsGzKt-B62sq!A;d677~>c<VASz#j4?!vAw(H$oED@NFz6W5
zkFTKk_Ma_vORrY9LU|EtiwiFH#?c!q7nV0x%Cb^cZc@AD))qy%)T&z+`#b$I^9TOT
zIy(*nhtHY%_IdxG^L(CXy873T&8<JU;r~R$v`p`Edb6|q7f0%`&B?2(vAyxHzqn?q
zt${po|K!OZPy77#h^j=~J-lhl!<`=uZ<#!G<aM=nWYeYx@89xu@2H0!+A_3h<C+bf
zyVq=4(^)sXVd#htn6`H0zWX-~ZQeXQvaz$};row#b;LmP`5W&Zy1VnkC7q#-TQ&_3
zZ9c*Ss@SmRCl7Zv4Xs-{^5DiTN4j+EQ|d^W`_|n5|GaSGnRT^k&DPFAZ9c-=I7NT}
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5;&DFo^%jyp_%009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RktE
zKowvAe<zNLmJ%R9fB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkL{gcB%Diw7dc*57J&ECdJ;AV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlya3TtnrqP2DW9yS9*3&1}GbYw2PpoH7tY=NEXHTq8nOL9N
ze3*p*0RjXF5I9i;O4HEOPL$SaCjkNk2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U`1J~u=HpNQ^*+O=6Cgl<009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7csfn!~uG%t9@vHq6cj{pGz1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfIwRXs%+RmEL|Eg^!~Kie_*_wb*`F3nMfzsx$JnoUKerTz>2+9G<S~gkDVIZ
zZ?<MNU-IM?xq3H0Wc@(I>QA=J`Rbf&w!OA@@$Mz_wr|}y{Lske=DKfm89nUNX7n8S
zXlUiGohxtLwQX?On{QmdXSk}C$LxvoO*>|OR;5JG(rLEG6nYLGar2;yJJIQT_dwdr
zJ?P3Ke&%s;^5rGR#cO)W9)ZUPh6a0fZ4w|rfB*pkCy2mf+0JJ&-OTXF{`vL9PrzS(
zx^L(H`HNOf#jtzV^gYeF$1~4ny7}|$=xF}H8`E=dV(HwwaB_31^%HqwN2c5S;9U;A
zf6o_F-8Xss$=rA@(><x*^WR!NdEHd&r}D(}nQl`k+|@jP{70g<OYV2xdnLd2UEcX%
z{P5GcdLh%D+3)!acK5xx=is*7ezCc~DMSuy|K}TeF73OyJ&(SW>7F|I{PFjn)yQ{V
z-PiY~Joxd4Q=M^~009C72oNAZfB*pk1llN2mz?1$Ri@5NYhx3&i2wlt1PBlyK!5-N
z0t5)0@B-6H#I&scr)B*=P5pnuj|Tt*2oNAZfB*pk1PBly&`yDYl7Ic1_5VQD{{!m(
zun-_XfB*pk1PBlyK!5;&HVO=u{EPRj{|B@FA5{Ohv5U2d009C72oNAZfB*pk1PH`Q
zB{Ef}&iMO(LxKPS0t5&UAV7cs0RjXFv{7Js$$zmw>;LIl|4&!{x3P=0i2wlt1PBly
zK!5-N0t5)ej1rkDQ)kTo8xjNv5FkK+009C72oNAZpp612mxz<I{y#bE|C81KZR}!g
zB0zuu0RjXF5FkK+009CqvqYxK)EV>th6Diu1PBlyK!5-N0t5&UXrsWa5-}_5|5;i8
z&r<)lv5U2d009C72oNAZfB*pk1PH|J5}7JfXUzW_5(EekAV7cs0RjXF5FkLHjRL2X
zh*PruKPBt`Q`G-$>|$*qK!5-N0t5&UAV7cs0RnMqiA<HLGv@yd2?7KN5FkK+009C7
z2oNC9MuF2x#A#XopO*FiY3lzrcCj`QAV7cs0RjXF5FkK+0D(BYM5fBr8T0>!1OWmB
z2oNAZfB*pk1PBmlqre#@;*6~S&&c}!4E28-yI7kD5FkK+009C72oNAZfIxh!M5fBr
z8T0>!1OWmB2oNAZfB*pk1PBmlqrjOZ;>@i7&&>M&O!a>oyI7kD5FkK+009C72oNAZ
zfI!SCk*P9u#{9n_L4W`O0t5&UAV7cs0RjZtC@{A~%+30LZr1;E)&FhmVr?QofB*pk
z1PBlyK!5-N0`ct<nJQCf%>Nq_1PBlyK!5-N0t5&UAV8pv0%w(ov$Fm_E9?KW)c<Yl
zVr?QofB*pk1PBlyK!5-N0`Z*^nJQCf%>Nq_1PBlyK!5-N0t5&UAV8pv0%w<qv$Os`
zJL~_m)&FhmVr?QofB*pk1PBlyK!5-N0&z}>OqHoK=Kl=|0t5&UAV7cs0RjXF5FpS-
zfq5ljUe^Efvi_f^{%>O!YZCzi1PBlyK!5-N0t5&Uh~FxasWNrO{J$YVfB*pk1PBly
zK!5-N0tDJ9aBhh>H|zg%v;IF<{olqe)+Pc32oNAZfB*pk1PBly5Wig_Q)TLm`F}%#
z009C72oNAZfB*pk1PHWIV19|1pY{LztpDe$|J&Hb+C+c=0RjXF5FkK+009C7qEjMM
zW$KLie?x)*0RjXF5FkK+009C72((e)yb^I<*8k^a{ePbNzl~k2O#}!KAV7cs0RjXF
z5FkJxey2pH%G4S2|Aqts0t5&UAV7cs0RjXF5NM;o`6c4~tpCr?`u}|Oe;d14n+Omf
zK!5-N0t5&UAV7dXEGUtwGIhrMzac?@009C72oNAZfB*pk1llNYL5a8^>;DU~{=Y!|
z-^MQ1CISQq5FkK+009C72oN9;zgr?xW$KLie?x)*0RjXF5FkK+009C72((dPVTo9n
z_5Z@G{}-zN+t|h0M1TMR0t5&UAV7cs0RjZ#_ex}{Or0_RZ%7azK!5-N0t5&UAV7cs
zfi?;(DiMpa{$G^!|04B&8@pJW2oNAZfB*pk1PBlyK!8B}eu+$#sWayP4G97S2oNAZ
zfB*pk1PBly&_;m^OT>j)|6iE(|Ap%RHg>T#5g<T-009C72oNAZfB=E`gA$o4Q)kTo
z8xjNv5FkK+009C72oNAZpp62HOT^-={}*TdzgYd>#xB+-0t5&UAV7cs0RjXF5FilW
zEs?1*b;kU^Awhru0RjXF5FkK+009C7+9+^QiMS~1|BJHzzexSx#xB+-0t5&UAV7cs
z0RjXF5FikLSRzwp>Wuk+LxKPS0t5&UAV7cs0RjXFv{B&V5^-_X{}*Tdf3f<%ja{rw
z1PBlyK!5-N0t5&UAV46Nl*m+>I%EFdkRU*S009C72oNAZfB*pkZ4_8qB9><TzclOr
zrRx7ScCj`QAV7cs0RjXF5FkK+0D<^kiA<HLGv@yd2?7KN5FkK+009C72oNC9MuAI8
z#3fn(Uy}9zCF=h+cCj`QAV7cs0RjXF5FkK+0D<_U5}7JfXUzW_5(EekAV7cs0RjXF
z5FkLHjRKdJh)c8nzclOrOV$5v>|$*qK!5-N0t5&UAV7cs0Rr*;5}7JfXUzW_5(Eek
zAV7cs0RjXF5FkLHjRKdIh|9A6zbxzj%hdmE>|$*qK!5-N0t5&UAV7cs0Rr*IB{Ef}
z&Y1r<BnS{7K!5-N0t5&UAV7dX8wD;e5tnEEe|gsbm#hEV*u~mJfB*pk1PBlyK!5-N
z0tDiU5}7JfXUzW_5(EekAV7cs0RjXF5FkLHjRIGeh%2-HzcTCpE7kvP>|$*qK!5-N
z0t5&UAV7cs0Rr(SB{Ef}&Y1r<BnS{7K!5-N0t5&UAV7dX8wHk?h-F#-FU$IWnfkwt
zU93$62oNAZfB*pk1PBlyKp>Wv$W)m+WB%WeAV7cs0RjXF5FkK+009DR6u7EHT$T0z
zRayUErT%YY7i$v%0t5&UAV7cs0RjXF5Qsl5k*P9u#{9n_L4W`O0t5&UAV7cs0RjZt
zC~$R&xH{|qtF!*UTK(U~F4iUj1PBlyK!5-N0t5&UAQ0D-$W)m+WB%WeAV7cs0RjXF
z5FkK+009DR6u7oTT$}a(wORjPtNw3e7i$v%0t5&UAV7cs0RjXF5Qra?$W)m+WB%We
zAV7cs0RjXF5FkK+009DR6u7QLT$lC#by@#kr~Yqa7i$v%0t5&UAV7cs0RjXF5Qytb
zWU5S^G5>E!5FkK+009C72oNAZfB=Cu3fxd4ZpixohOGZ@Q2)2Fi?xXW0RjXF5FkK+
z009C72*iygGF7I|nEy8<2oNAZfB*pk1PBlyK!89S1#T)4H)Z{QQ`Y}CssG#9#o9!G
z009C72oNAZfB*pk1mcG!GF7I|nEy8<2oNAZfB*pk1PBlyK!89S1#T`8H)s8SbJqVi
ztN+{B#o9!G009C72oNAZfB*pk1me$1WU5S^G5>E!5FkK+009C72oNAZfB=Cu3fxj6
zZpr%pmaPA8QUABGi?xXW0RjXF5FkK+009C72*jV4$W)m+WB%WeAV7cs0RjXF5FkK+
z009DR6u7lS+?w_Oty%xys{U_d7i$v%0t5&UAV7cs0RjXF5Qx7hk*P9u#{9n_L4W`O
z0t5&UAV7cs0RjZtD6pbLtjPL*Mb`f-)c<YlVr?QofB*pk1PBlyK!5-N0`Zq6GF7I|
znEy8<2oNAZfB*pk1PBlyK!89S1#T-5w`Ki*Th{-#ssG#9#o9!G009C72oNAZfB*pk
z1Y%{0OqHoK=Kl=|0t5&UAV7cs0RjXF5FpS-f!j;O?OFfdp7sCj>i;%&u{IGPK!5-N
z0t5&UAV7csf%vNunJQCf%>Nq_1PBlyK!5-N0t5&UAV8pv0(X>%JF@=2BkTV=)c<Yl
zVr?QofB*pk1PBlyK!5-N0`b=+GF7I|nEy8<2oNAZfB*pk1PBlyK!89S1y+@aRayV9
z%KCqm`oE1`tW5+65FkK+009C72oNAZApWLArpnYA^Z$kf0RjXF5FkK+009C72oPwa
z!0HmQI_v+{S^uwA|F^M=wTS=$0t5&UAV7cs0RjXF#NU?4RGB(s{@;)wK!5-N0t5&U
zAV7cs0Rn9lxU)punf3pjS^wXu{%>O!YZCzi1PBlyK!5-N0t5&Uh`UN;s!W|R|8GbT
zAV7cs0RjXF5FkK+0D(3NtSJ#|vi@I__5T|6e;d14n+OmfK!5-N0t5&UAV7dX{HR2x
z%G4S2|Aqts0t5&UAV7cs0RjXF5NM;o+7hug>;JV`|F2d5x3P=0i2wlt1PBlyK!5-N
z0t5)e-6b+rrp`<wLVy4P0t5&UAV7cs0RjXFv`}EEL=0v9Ka}<Vkov!cJ*-It2oNAZ
zfB*pk1PBlyKp<jWX;NkCjQM|Kf&c*m1PBlyK!5-N0t5)OQQ)2uaZlF&_hkKlkNUrj
zU93$62oNAZfB*pk1PBlyKp=ixB2#7RjQM{<f&c*m1PBlyK!5-N0t5)OQDC@43}^j6
zob~^(`oE1`tW5+65FkK+009C72oNAZAnq-ZsWNrO{J$YVfB*pk1PBlyK!5-N0tDJ9
zu)ajB&-#CT*8l6(|84AIZ6ZK`009C72oNAZfB*pkv7tn!%G4S2|Aqts0t5&UAV7cs
z0RjXF5NM;oeI??)tpD%J`u{%le;d14n+OmfK!5-N0t5&UAV7dXY%GzfGIhrMzac?@
z009C72oNAZfB*pk1llMtQX)pO{vXNue?<M?#xB+-0t5&UAV7cs0RjXF5Filum&jC^
zI%EFdkRU*S009C72oNAZfB*pkZ4`K*L_Co7{{vb7KcN0^V;5@^0RjXF5FkK+009C7
z2oQ)(B{Ef}&Y1r<BnS{7K!5-N0t5&UAV7dX8wEC(h|O95Z_fIEv--b{U93$62oNAZ
zfB*pk1PBlyKp?i1$W)m+WB%WeAV7cs0RjXF5FkK+009DR6nL;iJec+WgIWJSsQzzb
z7i$v%0t5&UAV7cs0RjXF5Qx7kk*P9u#{9n_L4W`O0t5&UAV7cs0RjZtD6q9eY|Z+A
zYu5i;)&FhmVr?QofB*pk1PBlyK!5-N0`X9ZOqHoK=Kl=|0t5&UAV7cs0RjXF5FpS-
zfrm@P!&(17ob~_1>i;%&u{IGPK!5-N0t5&UAV7csf%r*@OqHoK=Kl=|0t5&UAV7cs
z0RjXF5FpS-fk#TjBU%4HlJ);1>i;%&u{IGPK!5-N0t5&UAV7csf%y9pnJQCf%>Nq_
z1PBlyK!5-N0t5&UAV8pv0*{u6N3;HaH0%FI)&FhmVr?QofB*pk1PBlyK!5-N0`U(e
zGF7I|nEy8<2oNAZfB*pk1PBlyK!89S1x8E6Xx9IuS^tl!|J&Hb+C+c=0RjXF5FkK+
z009C7qLj!~nL1<s-;f|cfB*pk1PBlyK!5-N0&NsHU?Fgjz-SwXxi%3XK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZ;FuRU=uf}x5Fl_u2^{m^pu8Xf0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0Rlf4IP^buu6};T1_1&D2oNAZfB*pk1PBly&=!FM)7#P#
z?I1wlmlZhl_kZ>Y5FkK+009C72oPwmz%N@bxSjw30t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXFoX7$@
zUa!|p=4d(m`}IfbNmD=Pe_oa6PLG&ud$S(DdRojF+Zg{k^Rp@jdOoJg?QY)pt1N>X
zB0BMd!QRjK#q)cQwsZS`f3KbG`ns(;_dk5yE8BV9inrR?uCLpw$Nt;bz4F(0U3n}&
z`)AAheE+NB-_HEip8Lun-yfUrnY~N>S@Zqx+szyNd^y_R|Hj%MQ6K*Ozj@mx{lEX`
zi|0}|U;e+B7r)=Mf9N~CA8@qW-}~&Ny*=-zNBfD#*7N@PUw`xO^Ruh+9hUd|`KKNq
z;!}+O=4YXw9`gV1U$!;>bW$_^KRaj?oJiyUm-TWz0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB=D`El}qJXGc|k
zH`n9ab^YDknU(whdfLo-!^q|>7p@z5aO2%a`^`L$009C72oNAZfB*pk1PBoLRRv~8
ze6r}u6;CyFesBH%-%lH_|9{obcRv9F1PBlyK!5-N0t5&UAn=<PXzKsx>wjF+yvhGM
z?Kl5E-hcoB0t5&UAV7cs0RjXF5cuW=n)-k3f`3`se6srgoA>pJ1PBlyK!5-N0t5&U
zAVA<)5K#Xg3%%eS2oNAZfB*pk1PBlyK!CunSD?54Z~ooCX_<k{VCJOE^vsOR$(fm%
z@qZ^E;*{JzHPigb!0DMYGT+LanVFNBoB4L;tju>ZXJ^jI%**^%=G@G0XXa-*ne#Hg
zlQ}=LAag<HcQXq!zn58*`Tfj=nLo%Z&NTm4;YFE0%v_vVl4<@!hVNxA$^22~(#-cW
zmu3Dqb9v^9%$1ox$t=q(&s>%H)6CVGYckhnevr8?bA9H9%#E3wGC$1RocXiNEtx;h
z+?x4|%!<rkW^T)@%-o*&tIQplzs{`6{7q(c=5I51X70)~e}M6$%-T%zPb>~))@AO=
z{5Uh5xi_;uvmtX|W@Ba~bART6%%;rd%$Cf9nZL_y%{-KOIP;UtBbmR?Jev83%xI=$
zECdJ;AV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBmlk3f}88HlAzBZl6e7W)s3x2(=plPDAE<T{rfuh;7$
z4jfpqH=?<7e1GiJ*nYD$tNBt@aYe4)%@0{W5V87`Epxs)=bCM=?OnWk$-M1bHx55E
zvbnkL8(l^Z`?MK7M?M-_xohXj8+UCRT=wQ0*Y6pws^u|z;(XJNnV(fD(X(`#?J<R(
zgGbyv=;BUv`rbW|aB~m3@`#^#T%3G)$#L<TUb07E+I|1&zxM3fBtU=w0RjXF5FkLH
z<pPgo`<}^kGs7eM=hqVz@Ry(N+qr-KqE%BhfA_BGdzy2PXP(V;vz{Ft&4M?k=ibE9
zxp(2@=2Yt^^2Clzw<)~Kq4)3kVygQlk3X3k&t<wN^?UwX%O|g!YW-B6cs|o@eo=5&
z^Zdcwh<Ll?m(F{yG~4}_cRm<D`gE>d$aH7+d;Wsm{qF5Owk>yFZ0>J<5ph`iKi|-M
zZNKg9dGMu7_teSfkH7z{M!xgvzJB*K$3FgWsxyugAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkKcDuF6b48+o<5kv1!i~R@2
zud8#_B+5iOxz1(B>-D;b0|!>@jcD#1-yb_Qw%=^cYQ9v{;)-0on;)`%AY%0=TjqRq
z&NbU!+q-!8l6l*=ZXAASWOH-fH@b`-_GvSEj(jw<a@Wq4H}2Xtxa`e0uHQ3URm)@c
z#QCNjGe4_RqG#ze+hYnn2amXU(8ZnT^u2o^;pQH6<q<#gxH$RplH=kvy=0HTm7o8Q
z1wFeq2@oJafB*pk1PBmlxxi!DzGpJs%<#zm`SnBv{N<<ncJ80QXw_8B-@R-4p61-+
znP)TItY=3@v*3;Cxi_(N?p-*!Io0}!Jh3CwZ3^#l=>2=XnCiaC<4@+sbD8c*{ht5U
z^2zI_T0fO1p3iifUliQcJby4ZBHk|frSsk^&33=#oe##3KAo!<GToW|p1)vszk7R+
zZOfe(oBNwzL>$)s&o}g5+i!b&9(*a&J$3T=<L^JKk?*{^uirh*v5!BT>Wt$A2oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBo5
zFHoApXZAnmC;<Wl2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5Fl`L1WNOmIY;MNo<e{C0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0tAj#fzrI#+++3aycYoi1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oN|i
z1b%k;W&bf-Ixyba({t5nHmiv=+XpSHKiM+pt8=c|_S)XXyO+${zBNxa*IEb=AV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK;XC+sImnEv2<y~(EHP3|AFxa)wyaCWg?wi=d$DVdR@eU
z11t7MG<S~gkDVIZZ?<MNU#h{lB3JL`hpZonSpCVCIbWS~&9>L}F5bOl-uA5<haVc*
z++6pKE~AHi+Kiqf9}TVCwR7c-yS5E3d-IL!_Y7Cn@|ZnwzG=tI&#IK@Svt-3m_pCN
zBW@maaVI)`?;c3Fxd&Z&#Lqk~PQJY4xOh!3*(316#UDM<vul$80RjXF5FkK+0D+bZ
zJeKWyCezIfkL;gcPgKBPe!6ex{`remP1XF}yQc4H&OM%aHq*^|c62lg-k6?y6HDjb
zg_E08t(yX5N2c2p-sRBy_k1zceUrzZ%#G(V-IMw~|E=Yd*G;v4Do;G0={CP8xT|^o
zU~WXbUGhuky;qv;e#<)_j30eES1)9`Gy6S%!R~(d_8!}oJ1;i(H@}EDto@&F=)Jbz
z_VzsZQl@+A<nzbhe^w*kd39gEdzxb(e>l|{#|aQ1K!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UATX6cl_v&b>C%Xy_ov1F1LN1#
zxoQ$+BAs04vg7r7UBrO{EA~b-caHCmof_M3wq`Y7s_Ah>uHMZLSw9f5`jahlzB=cc
zZLjTJynD&K?OQhvKQywrx$YZXMi2Y689hfn8d|w)=gJ#*Z5v$n<{Q`V8Lq13F?-^C
z(~g;+RVmT4beiokg`R^)+&t*wPIUU-J&<s754!S*pLtxIe0j-n@tR(;N8rEw=bxV2
zvul$80RjXF5FkK+0D+bZJeKWyCezIfkL;gcPgKBPe!6ex{`remP1XF}yQc4H&OM%a
zHq*^|c62lg-k6?y6HDjbg_E08t)IvfJ2Ks-@Gghmzvqjo?wdURWNti{>7LZ@`EM<s
zyl$%XQ+eX~Ot<+(!ClSs2XiCh?UG+Q@4eD&_gmiiVEpLQxq2bfo!RgC3wHOrxA)k#
z+<CFNzxhSPVeS8XL+`cywzucOmonW`C!at5{<9kS&a3<S-P0WV_`|8rI8J~70RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+0D=Aj
F{}-z^(O3Wg

literal 0
HcmV?d00001

diff --git a/nixos/hosts/citadel/default.nix b/nixos/hosts/citadel/default.nix
index dedbcfb..35e7ff2 100644
--- a/nixos/hosts/citadel/default.nix
+++ b/nixos/hosts/citadel/default.nix
@@ -6,14 +6,6 @@
 , pkgs
 , ...
 }: {
-  imports = [
-
-    # Common imports
-    ../common/optional/gnome.nix
-    ../common/optional/editors/vscode
-    ../common/optional/firefox.nix
-
-  ];
 
 
   config = {
diff --git a/nixos/hosts/common/optional/chrony.nix b/nixos/hosts/common/optional/chrony.nix
deleted file mode 100644
index e9a42cf..0000000
--- a/nixos/hosts/common/optional/chrony.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ inputs
-, outputs
-, config
-, ...
-}: {
-  # Time
-  networking.timeServers = [ "10.8.10.1" ];
-  services.chrony = {
-    enable = true;
-  };
-}
diff --git a/nixos/hosts/common/optional/dnscrypt-proxy2.nix b/nixos/hosts/common/optional/dnscrypt-proxy2.nix
deleted file mode 100644
index 9c8ebeb..0000000
--- a/nixos/hosts/common/optional/dnscrypt-proxy2.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-# Ref: https://nixos.wiki/wiki/Encrypted_DNS#dnscrypt-proxy2
-{ inputs
-, outputs
-, pkgs
-, config
-, ...
-}: {
-  # Disable resolvd to ensure it doesnt re-write /etc/resolv.conf
-  config.services.resolved.enable = false;
-
-  # Fix this devices DNS resolv.conf else resolvd will point it to dnscrypt
-  # causing a risk of no dns if service fails.
-  config.networking = {
-    nameservers = [ "10.8.10.1" ]; # TODO make varible IP
-
-    dhcpcd.extraConfig = "nohook resolv.conf";
-  };
-
-  # configure secret for forwarding rules
-  config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".sopsFile = ./dnscrypt-proxy2.sops.yaml;
-  config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".mode = "0444"; # This is world-readable but theres nothing security related in the file
-
-  # Restart dnscrypt when secret changes
-  config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".restartUnits = [ "dnscrypt-proxy2" ];
-
-  config.services.dnscrypt-proxy2 = {
-    enable = true;
-    settings = {
-      require_dnssec = true;
-      forwarding_rules = config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".path;
-      listen_addresses = [ "0.0.0.0:53" ];
-      server_names = [ "NextDNS" ];
-
-      static = {
-        "NextDNS" = {
-          stamp = "sdns://AgEAAAAAAAAAAAAOZG5zLm5leHRkbnMuaW8HL2Y2ZmUzNQ";
-        };
-      };
-    };
-  };
-}
diff --git a/nixos/hosts/common/optional/editors/vscode/default.nix b/nixos/hosts/common/optional/editors/vscode/default.nix
deleted file mode 100644
index 5a3f682..0000000
--- a/nixos/hosts/common/optional/editors/vscode/default.nix
+++ /dev/null
@@ -1,139 +0,0 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
-  # TODO add USER settings.json
-  # Enable vscode & addons
-  environment.systemPackages = with pkgs; [
-    (vscode-with-extensions.override {
-      vscode = vscodium;
-      vscodeExtensions = with vscode-extensions;
-        [
-          bbenoist.nix
-          mkhl.direnv
-
-        ]
-        ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
-          {
-            name = "prettier-vscode";
-            publisher = "esbenp";
-            version = "10.1.0";
-            sha256 = "01s0vi2h917mqfpdrhqhp2ijwkibw95yk2js0l587wvajbbry2s9";
-          }
-
-          {
-            name = "vscode-docker";
-            publisher = "ms-azuretools";
-            version = "1.28.0";
-            sha256 = "0nmc3pdgxpmr6k2ksdczkv9bbwszncfczik0xjympqnd2k0ra9h0";
-          }
-
-          {
-            name = "gitlens";
-            publisher = "eamodio";
-            version = "14.7.0";
-            sha256 = "07f9fryaci8lsrdahgll5yhlzf5rhscpy1zd258hi211ymvkxlmy";
-          }
-
-          {
-            name = "remote-containers";
-            publisher = "ms-vscode-remote";
-            version = "0.327.0";
-            sha256 = "0asswm55bx5gpz08cgpmgfvnb0494irj0gsvzx5nwknqfzpj07lz";
-          }
-
-          {
-            name = "remote-ssh";
-            publisher = "ms-vscode-remote";
-            version = "0.107.1";
-            sha256 = "1q9xp8id9afhjx67zc7a61zb572f296apvdz305xd5v4brqd9xrf";
-          }
-
-          {
-            name = "vscode-yaml";
-            publisher = "redhat";
-            version = "1.14.0";
-            sha256 = "0pww9qndd2vsizsibjsvscz9fbfx8srrj67x4vhmwr581q674944";
-          }
-
-          {
-            name = "todo-tree";
-            publisher = "gruntfuggly";
-            version = "0.0.226";
-            sha256 = "0yrc9qbdk7zznd823bqs1g6n2i5xrda0f9a7349kknj9wp1mqgqn";
-          }
-
-          {
-            name = "path-autocomplete";
-            publisher = "ionutvmi";
-            version = "1.25.0";
-            sha256 = "0jjqh3p456p1aafw1gl6xgxw4cqqzs3hssr74mdsmh77bjizcgcb";
-          }
-
-          {
-            name = "even-better-toml";
-            publisher = "tamasfe";
-            version = "0.19.2";
-            sha256 = "0q9z98i446cc8bw1h1mvrddn3dnpnm2gwmzwv2s3fxdni2ggma14";
-          }
-
-          {
-            name = "linter";
-            publisher = "fnando";
-            version = "0.0.19";
-            sha256 = "13bllbxd7sy4qlclh37qvvnjp1v13al11nskcf2a8pmnmj455v4g";
-          }
-
-          {
-            name = "catppuccin-vsc";
-            publisher = "catppuccin";
-            version = "3.11.0";
-            sha256 = "12bzx1pv9pxbm08dhvl8pskpz1vg2whxmasl0qk2x54swa2rhi4d";
-          }
-
-          {
-            name = "catppuccin-vsc-icons";
-            publisher = "catppuccin";
-            version = "1.8.0";
-            sha256 = "12sw9f00vnmppmvhwbamyjcap3acjs1f67mdmyv6ka52mav58z8z";
-          }
-
-          {
-            name = "nix-ide";
-            publisher = "jnoortheen";
-            version = "0.2.2";
-            sha256 = "1264027sjh9a112si0y0p3pk3y36shj5b4qkpsj207z7lbxqq0wg";
-          }
-
-          {
-            name = "vscode-swissknife";
-            publisher = "luisfontes19";
-            version = "1.8.1";
-            sha256 = "1rpk8zayzkn2kg4jjdd2fy6xl50kib71dqg73v46326cr4dwxa7c";
-          }
-
-          {
-            name = "pre-commit-helper";
-            publisher = "elagil";
-            version = "0.5.0";
-            sha256 = "05cs1ndnha9dgv1ys23z81ajk300wpixqmks0lfmrj1zwyjg2wlj";
-          }
-
-          {
-            name = "sops-edit";
-            publisher = "shipitsmarter";
-            version = "1.0.0";
-            sha256 = "0b2z9khiwrpf6gxdb9y315ayqkibvgixmvx82in5rlp8pndb6sq4";
-          }
-
-          {
-            name = "json5-for-vscode";
-            publisher = "tudoudou";
-            version = "0.0.3";
-            sha256 = "1d1c18mr91ll5fsp0l0aszyi7nx0ad352ssm0fm40z81m4dmzm0w";
-          }
-        ];
-    })
-  ];
-}
diff --git a/nixos/hosts/common/optional/editors/vscode/extensions.nix b/nixos/hosts/common/optional/editors/vscode/extensions.nix
deleted file mode 100644
index 9b24a06..0000000
--- a/nixos/hosts/common/optional/editors/vscode/extensions.nix
+++ /dev/null
@@ -1,174 +0,0 @@
-# Warning, this file is autogenerated by nix4vscode. Don't modify this manually.
-{ pkgs }:
-let
-  vscode-utils = pkgs.vscode-utils;
-in
-{
-  "ms-python"."python" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "python";
-    publisher = "ms-python";
-    version = "2024.0.0";
-    sha256 = "0sy1z2r6b0m1lkivjyrcf41dbgj9m5zkjy6yncpji1hisjcbgq6n";
-  };
-
-  "ms-python"."vscode-pylance" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "vscode-pylance";
-    publisher = "ms-python";
-    version = "2023.12.1";
-    sha256 = "03fr9zanhdsf3wirv65vb41swvdnxxaz8lviyjdbmzcw9yihf8dv";
-  };
-
-  "esbenp"."prettier-vscode" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "prettier-vscode";
-    publisher = "esbenp";
-    version = "10.1.0";
-    sha256 = "01s0vi2h917mqfpdrhqhp2ijwkibw95yk2js0l587wvajbbry2s9";
-  };
-
-  "ms-azuretools"."vscode-docker" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "vscode-docker";
-    publisher = "ms-azuretools";
-    version = "1.28.0";
-    sha256 = "0nmc3pdgxpmr6k2ksdczkv9bbwszncfczik0xjympqnd2k0ra9h0";
-  };
-
-  "eamodio"."gitlens" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "gitlens";
-    publisher = "eamodio";
-    version = "14.7.0";
-    sha256 = "07f9fryaci8lsrdahgll5yhlzf5rhscpy1zd258hi211ymvkxlmy";
-  };
-
-  "ms-vscode-remote"."remote-containers" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "remote-containers";
-    publisher = "ms-vscode-remote";
-    version = "0.327.0";
-    sha256 = "0asswm55bx5gpz08cgpmgfvnb0494irj0gsvzx5nwknqfzpj07lz";
-  };
-
-  "ms-vscode-remote"."remote-ssh" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "remote-ssh";
-    publisher = "ms-vscode-remote";
-    version = "0.107.1";
-    sha256 = "1q9xp8id9afhjx67zc7a61zb572f296apvdz305xd5v4brqd9xrf";
-  };
-
-  "redhat"."vscode-yaml" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "vscode-yaml";
-    publisher = "redhat";
-    version = "1.14.0";
-    sha256 = "0pww9qndd2vsizsibjsvscz9fbfx8srrj67x4vhmwr581q674944";
-  };
-
-  "github"."copilot" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "copilot";
-    publisher = "github";
-    version = "1.156.0";
-    sha256 = "16nzwazfbh895kmc2887b17zzbbcjyk8fhiphk5xmy1nm9qxszk0";
-  };
-
-  "golang"."go" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "go";
-    publisher = "golang";
-    version = "0.40.3";
-    sha256 = "15kicpv9xpn7l3w9mbmsjdzjmavh88p3skkim0a9prg9p40bsq0m";
-  };
-
-  "gruntfuggly"."todo-tree" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "todo-tree";
-    publisher = "gruntfuggly";
-    version = "0.0.226";
-    sha256 = "0yrc9qbdk7zznd823bqs1g6n2i5xrda0f9a7349kknj9wp1mqgqn";
-  };
-
-  "ms-kubernetes-tools"."vscode-kubernetes-tools" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "vscode-kubernetes-tools";
-    publisher = "ms-kubernetes-tools";
-    version = "1.3.15";
-    sha256 = "1x6npc90p6b1wx5sd1hd0x0djahmffr6lw9cxh2zg10rbpq48w8i";
-  };
-
-  "hashicorp"."terraform" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "terraform";
-    publisher = "hashicorp";
-    version = "2.29.3";
-    sha256 = "sha256-cYYtBZaWgtT6vS6In+tbpLfp/GdyWodBXyHsxn8ZZrU=";
-  };
-
-  "ionutvmi"."path-autocomplete" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "path-autocomplete";
-    publisher = "ionutvmi";
-    version = "1.25.0";
-    sha256 = "0jjqh3p456p1aafw1gl6xgxw4cqqzs3hssr74mdsmh77bjizcgcb";
-  };
-
-  "tamasfe"."even-better-toml" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "even-better-toml";
-    publisher = "tamasfe";
-    version = "0.19.2";
-    sha256 = "0q9z98i446cc8bw1h1mvrddn3dnpnm2gwmzwv2s3fxdni2ggma14";
-  };
-
-  "redhat"."ansible" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "ansible";
-    publisher = "redhat";
-    version = "2.9.118";
-    sha256 = "0yndj2r0w2zxc5firxgfrykkc5ajy9gsmrfmkz80kfhwk33n9y1p";
-  };
-
-  "fnando"."linter" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "linter";
-    publisher = "fnando";
-    version = "0.0.19";
-    sha256 = "13bllbxd7sy4qlclh37qvvnjp1v13al11nskcf2a8pmnmj455v4g";
-  };
-
-  "catppuccin"."catppuccin-vsc" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "catppuccin-vsc";
-    publisher = "catppuccin";
-    version = "3.11.0";
-    sha256 = "12bzx1pv9pxbm08dhvl8pskpz1vg2whxmasl0qk2x54swa2rhi4d";
-  };
-
-  "catppuccin"."catppuccin-vsc-icons" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "catppuccin-vsc-icons";
-    publisher = "catppuccin";
-    version = "1.8.0";
-    sha256 = "12sw9f00vnmppmvhwbamyjcap3acjs1f67mdmyv6ka52mav58z8z";
-  };
-
-  "jnoortheen"."nix-ide" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "nix-ide";
-    publisher = "jnoortheen";
-    version = "0.2.2";
-    sha256 = "1264027sjh9a112si0y0p3pk3y36shj5b4qkpsj207z7lbxqq0wg";
-  };
-
-  "luisfontes19"."vscode-swissknife" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "vscode-swissknife";
-    publisher = "luisfontes19";
-    version = "1.8.1";
-    sha256 = "1rpk8zayzkn2kg4jjdd2fy6xl50kib71dqg73v46326cr4dwxa7c";
-  };
-
-  "elagil"."pre-commit-helper" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "pre-commit-helper";
-    publisher = "elagil";
-    version = "0.5.0";
-    sha256 = "05cs1ndnha9dgv1ys23z81ajk300wpixqmks0lfmrj1zwyjg2wlj";
-  };
-
-  "shipitsmarter"."sops-edit" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "sops-edit";
-    publisher = "shipitsmarter";
-    version = "1.0.0";
-    sha256 = "0b2z9khiwrpf6gxdb9y315ayqkibvgixmvx82in5rlp8pndb6sq4";
-  };
-
-  "tudoudou"."json5-for-vscode" = vscode-utils.extensionFromVscodeMarketplace {
-    name = "json5-for-vscode";
-    publisher = "tudoudou";
-    version = "0.0.3";
-    sha256 = "1d1c18mr91ll5fsp0l0aszyi7nx0ad352ssm0fm40z81m4dmzm0w";
-  };
-}
diff --git a/nixos/hosts/common/optional/firefox.nix b/nixos/hosts/common/optional/firefox.nix
deleted file mode 100644
index e15318c..0000000
--- a/nixos/hosts/common/optional/firefox.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
-  programs.firefox = {
-    enable = true;
-  };
-}
diff --git a/nixos/hosts/common/optional/gnome.nix b/nixos/hosts/common/optional/gnome.nix
deleted file mode 100644
index 5259b79..0000000
--- a/nixos/hosts/common/optional/gnome.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
-  # Ref: https://nixos.wiki/wiki/GNOME
-
-  # GNOME plz
-  services.xserver = {
-    enable = true;
-    displayManager =
-      {
-        gdm.enable = true;
-        defaultSession = "gnome"; # TODO move to config overlay
-
-        autoLogin.enable = true;
-        autoLogin.user = "truxnell"; # TODO move to config overlay
-      };
-    desktopManager = {
-      # GNOME
-      gnome.enable = true;
-    };
-
-    layout = "us"; # `localctl` will give you
-  };
-
-  # TODO remove this when possible
-  # workaround for GNOME autologin
-  # https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-  # TODO tidy this
-  # port forward for GNOME when using RDP***REMOVED***
-  
-  networking.firewall.allowedTCPPorts = [
-    3389
-  ];
-
-  # And dconf
-  programs.dconf.enable = true;
-
-  # https://github.com/NixOS/nixpkgs/issues/114514
-  # dconf write /org/gnome/mutter/experimental-features "['scale-monitor-framebuffer']" TODO hack for GNOME 45
-
-
-  # Exclude default GNOME packages that dont interest me.
-  environment.gnome.excludePackages =
-    (with pkgs; [
-      gnome-photos
-      gnome-tour
-    ])
-    ++ (with pkgs.gnome; [
-      cheese # webcam tool
-      gnome-music
-      gnome-terminal
-      gedit # text editor
-      epiphany # web browser
-      geary # email reader
-      evince # document viewer
-      gnome-characters
-      totem # video player
-      tali # poker game
-      iagno # go game
-      hitori # sudoku game
-      atomix # puzzle game
-    ]);
-}
diff --git a/nixos/hosts/common/optional/maddy.nix b/nixos/hosts/common/optional/maddy.nix
deleted file mode 100644
index 6043ae1..0000000
--- a/nixos/hosts/common/optional/maddy.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ inputs
-, outputs
-, config
-, ...
-}: {
-  # init secret
-  config.sops.secrets."system/mail/maddy/envFile" = {
-    sopsFile = ./maddy.sops.yaml;
-    owner = "maddy";
-    group = "maddy";
-  };
-
-  # Restart dnscrypt when secret changes
-  config.sops.secrets."system/mail/maddy/envFile".restartUnits = [ "maddy" ];
-
-  #
-  config.services.maddy = {
-    enable = true;
-    secrets = [ config.sops.secrets."system/mail/maddy/envFile".path ];
-    config = builtins.readFile ./maddy.conf;
-  };
-}
diff --git a/nixos/hosts/dns01/default.nix b/nixos/hosts/dns01/default.nix
index e7cda43..dc87959 100644
--- a/nixos/hosts/dns01/default.nix
+++ b/nixos/hosts/dns01/default.nix
@@ -8,10 +8,15 @@
 }: {
   imports = [
 
-    ../common/optional/dnscrypt-proxy2.nix
-    ../common/optional/maddy.nix
+
   ];
-  mySystem.services.cfddns.enable = true;
+
+  mySystem = {
+    services.maddy.enable = true;
+    services.dnscrypt-proxy.enable = true;
+    services.cfDdns.enable = true;
+  };
+
   networking.hostName = "dns01"; # Define your hostname.
   networking.useDHCP = lib.mkDefault true;
 
diff --git a/nixos/hosts/rickenbacker/default.nix b/nixos/hosts/rickenbacker/default.nix
index 3a99a2c..bafde50 100644
--- a/nixos/hosts/rickenbacker/default.nix
+++ b/nixos/hosts/rickenbacker/default.nix
@@ -5,15 +5,7 @@
 }: {
 
   # hardware-configuration.nix is missing as I've abstracted out the parts
-  # into various areas like my global/hardware profiles, etc.
-  imports = [
-
-    # Common imports
-    ../common/optional/gnome.nix
-    ../common/optional/editors/vscode
-    ../common/optional/firefox.nix
-
-  ];
+  
   config.mySystem = {
     services.openssh.enable = true;
     security.wheelNeedsSudoPassword = false;
diff --git a/nixos/modules/nixos/browser/default.nix b/nixos/modules/nixos/browser/default.nix
new file mode 100644
index 0000000..1c7c3ee
--- /dev/null
+++ b/nixos/modules/nixos/browser/default.nix
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./firefox.nix
+  ];
+}
diff --git a/nixos/modules/nixos/browser/firefox.nix b/nixos/modules/nixos/browser/firefox.nix
new file mode 100644
index 0000000..58b22a3
--- /dev/null
+++ b/nixos/modules/nixos/browser/firefox.nix
@@ -0,0 +1,22 @@
+{ lib
+, config
+, ...
+}:
+
+with lib;
+let
+  cfg = config.mySystem.browser.firefox;
+in
+{
+  options.mySystem.browser.firefox.enable = mkEnableOption "Firefox";
+
+  config = mkIf cfg.enable {
+
+    programs.firefox = {
+      enable = true;
+    };
+
+  };
+
+
+}
diff --git a/nixos/modules/nixos/de/default.nix b/nixos/modules/nixos/de/default.nix
new file mode 100644
index 0000000..6ce4870
--- /dev/null
+++ b/nixos/modules/nixos/de/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./gnome.nix
+
+  ];
+}
diff --git a/nixos/modules/nixos/de/gnome.nix b/nixos/modules/nixos/de/gnome.nix
new file mode 100644
index 0000000..9301423
--- /dev/null
+++ b/nixos/modules/nixos/de/gnome.nix
@@ -0,0 +1,81 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+
+with lib;
+let
+  cfg = config.mySystem.de.gnome;
+in
+{
+  options.mySystem.de.gnome.enable = mkEnableOption "GNOME";
+
+  config = mkIf cfg.enable {
+
+    # Ref: https://nixos.wiki/wiki/GNOME
+
+    # GNOME plz
+    services.xserver = {
+      enable = true;
+      displayManager =
+        {
+          gdm.enable = true;
+          defaultSession = "gnome"; # TODO move to config overlay
+
+          autoLogin.enable = true;
+          autoLogin.user = "truxnell"; # TODO move to config overlay
+        };
+      desktopManager = {
+        # GNOME
+        gnome.enable = true;
+      };
+
+      layout = "us"; # `localctl` will give you
+    };
+
+    # TODO remove this when possible
+    # workaround for GNOME autologin
+    # https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
+    systemd.services."getty@tty1".enable = false;
+    systemd.services."autovt@tty1".enable = false;
+
+    # TODO tidy this
+    # port forward for GNOME when using RDP***REMOVED***
+
+    networking.firewall.allowedTCPPorts = [
+      3389
+    ];
+
+    # And dconf
+    programs.dconf.enable = true;
+
+    # https://github.com/NixOS/nixpkgs/issues/114514
+    # dconf write /org/gnome/mutter/experimental-features "['scale-monitor-framebuffer']" TODO hack for GNOME 45
+
+
+    # Exclude default GNOME packages that dont interest me.
+    environment.gnome.excludePackages =
+      (with pkgs; [
+        gnome-photos
+        gnome-tour
+      ])
+      ++ (with pkgs.gnome; [
+        cheese # webcam tool
+        gnome-music
+        gnome-terminal
+        gedit # text editor
+        epiphany # web browser
+        geary # email reader
+        evince # document viewer
+        gnome-characters
+        totem # video player
+        tali # poker game
+        iagno # go game
+        hitori # sudoku game
+        atomix # puzzle game
+      ]);
+  };
+
+
+}
diff --git a/nixos/modules/nixos/default.nix b/nixos/modules/nixos/default.nix
index e1f6e80..08ba128 100644
--- a/nixos/modules/nixos/default.nix
+++ b/nixos/modules/nixos/default.nix
@@ -3,6 +3,9 @@
     ./system
     ./programs
     ./services
+    ./browser
+    ./de
+    ./editor
 
   ];
 }
diff --git a/nixos/modules/nixos/editor/default.nix b/nixos/modules/nixos/editor/default.nix
new file mode 100644
index 0000000..20df622
--- /dev/null
+++ b/nixos/modules/nixos/editor/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./vscodium.nix
+
+  ];
+}
diff --git a/nixos/modules/nixos/editor/vscodium.nix b/nixos/modules/nixos/editor/vscodium.nix
new file mode 100644
index 0000000..2e055bf
--- /dev/null
+++ b/nixos/modules/nixos/editor/vscodium.nix
@@ -0,0 +1,154 @@
+{ lib
+, config
+, pkgs
+
+, ...
+}:
+
+with lib;
+let
+  cfg = config.mySystem.editor.vscodium;
+in
+{
+  options.mySystem.editor.vscodium.enable = mkEnableOption "Vscodium";
+
+  config = mkIf cfg.enable {
+
+    # TODO add USER settings.json
+    # Enable vscode & addons
+    environment.systemPackages = with pkgs; [
+      (vscode-with-extensions.override {
+        vscode = vscodium;
+        vscodeExtensions = with vscode-extensions;
+          [
+            bbenoist.nix
+            mkhl.direnv
+
+          ]
+          ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
+            {
+              name = "prettier-vscode";
+              publisher = "esbenp";
+              version = "10.1.0";
+              sha256 = "01s0vi2h917mqfpdrhqhp2ijwkibw95yk2js0l587wvajbbry2s9";
+            }
+
+            {
+              name = "vscode-docker";
+              publisher = "ms-azuretools";
+              version = "1.28.0";
+              sha256 = "0nmc3pdgxpmr6k2ksdczkv9bbwszncfczik0xjympqnd2k0ra9h0";
+            }
+
+            {
+              name = "gitlens";
+              publisher = "eamodio";
+              version = "14.7.0";
+              sha256 = "07f9fryaci8lsrdahgll5yhlzf5rhscpy1zd258hi211ymvkxlmy";
+            }
+
+            {
+              name = "remote-containers";
+              publisher = "ms-vscode-remote";
+              version = "0.327.0";
+              sha256 = "0asswm55bx5gpz08cgpmgfvnb0494irj0gsvzx5nwknqfzpj07lz";
+            }
+
+            {
+              name = "remote-ssh";
+              publisher = "ms-vscode-remote";
+              version = "0.107.1";
+              sha256 = "1q9xp8id9afhjx67zc7a61zb572f296apvdz305xd5v4brqd9xrf";
+            }
+
+            {
+              name = "vscode-yaml";
+              publisher = "redhat";
+              version = "1.14.0";
+              sha256 = "0pww9qndd2vsizsibjsvscz9fbfx8srrj67x4vhmwr581q674944";
+            }
+
+            {
+              name = "todo-tree";
+              publisher = "gruntfuggly";
+              version = "0.0.226";
+              sha256 = "0yrc9qbdk7zznd823bqs1g6n2i5xrda0f9a7349kknj9wp1mqgqn";
+            }
+
+            {
+              name = "path-autocomplete";
+              publisher = "ionutvmi";
+              version = "1.25.0";
+              sha256 = "0jjqh3p456p1aafw1gl6xgxw4cqqzs3hssr74mdsmh77bjizcgcb";
+            }
+
+            {
+              name = "even-better-toml";
+              publisher = "tamasfe";
+              version = "0.19.2";
+              sha256 = "0q9z98i446cc8bw1h1mvrddn3dnpnm2gwmzwv2s3fxdni2ggma14";
+            }
+
+            {
+              name = "linter";
+              publisher = "fnando";
+              version = "0.0.19";
+              sha256 = "13bllbxd7sy4qlclh37qvvnjp1v13al11nskcf2a8pmnmj455v4g";
+            }
+
+            {
+              name = "catppuccin-vsc";
+              publisher = "catppuccin";
+              version = "3.11.0";
+              sha256 = "12bzx1pv9pxbm08dhvl8pskpz1vg2whxmasl0qk2x54swa2rhi4d";
+            }
+
+            {
+              name = "catppuccin-vsc-icons";
+              publisher = "catppuccin";
+              version = "1.8.0";
+              sha256 = "12sw9f00vnmppmvhwbamyjcap3acjs1f67mdmyv6ka52mav58z8z";
+            }
+
+            {
+              name = "nix-ide";
+              publisher = "jnoortheen";
+              version = "0.2.2";
+              sha256 = "1264027sjh9a112si0y0p3pk3y36shj5b4qkpsj207z7lbxqq0wg";
+            }
+
+            {
+              name = "vscode-swissknife";
+              publisher = "luisfontes19";
+              version = "1.8.1";
+              sha256 = "1rpk8zayzkn2kg4jjdd2fy6xl50kib71dqg73v46326cr4dwxa7c";
+            }
+
+            {
+              name = "pre-commit-helper";
+              publisher = "elagil";
+              version = "0.5.0";
+              sha256 = "05cs1ndnha9dgv1ys23z81ajk300wpixqmks0lfmrj1zwyjg2wlj";
+            }
+
+            {
+              name = "sops-edit";
+              publisher = "shipitsmarter";
+              version = "1.0.0";
+              sha256 = "0b2z9khiwrpf6gxdb9y315ayqkibvgixmvx82in5rlp8pndb6sq4";
+            }
+
+            {
+              name = "json5-for-vscode";
+              publisher = "tudoudou";
+              version = "0.0.3";
+              sha256 = "1d1c18mr91ll5fsp0l0aszyi7nx0ad352ssm0fm40z81m4dmzm0w";
+            }
+          ];
+      })
+    ];
+
+  };
+
+
+}
diff --git a/nixos/modules/nixos/services/cloudflare-dyndns/default.nix b/nixos/modules/nixos/services/cloudflare-dyndns/default.nix
index 40fe5ea..4334f3c 100644
--- a/nixos/modules/nixos/services/cloudflare-dyndns/default.nix
+++ b/nixos/modules/nixos/services/cloudflare-dyndns/default.nix
@@ -22,13 +22,13 @@ in
 
     # TODO add notifications on IP change
     # init secret
-    config.sops.secrets."system/networking/cloudflare-dyndns/apiTokenFile".sopsFile = ./cloudflare-dyndns.sops.yaml;
+    sops.secrets."system/networking/cloudflare-dyndns/apiTokenFile".sopsFile = ./cloudflare-dyndns.sops.yaml;
 
     # Restart when secret changes
-    config.sops.secrets."system/networking/cloudflare-dyndns/apiTokenFile".restartUnits = [ "cloudflare-dyndns" ];
+    sops.secrets."system/networking/cloudflare-dyndns/apiTokenFile".restartUnits = [ "cloudflare-dyndns" ];
 
     # Cloudflare dynamic dns to keep my DNS records pointed at home
-    config.services.cloudflare-dyndns = {
+    services.cloudflare-dyndns = {
       enable = true;
       ipv6 = false;
       proxied = true;
diff --git a/nixos/modules/nixos/services/default.nix b/nixos/modules/nixos/services/default.nix
index f9ea679..7871bb5 100644
--- a/nixos/modules/nixos/services/default.nix
+++ b/nixos/modules/nixos/services/default.nix
@@ -3,5 +3,7 @@
     ./monitoring.nix
     ./reboot-required-check.nix
     ./cloudflare-dyndns
+    ./maddy
+    ./dnscrypt-proxy2
   ];
 }
diff --git a/nixos/modules/nixos/services/dnscrypt-proxy2/default.nix b/nixos/modules/nixos/services/dnscrypt-proxy2/default.nix
new file mode 100644
index 0000000..de96e6c
--- /dev/null
+++ b/nixos/modules/nixos/services/dnscrypt-proxy2/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, config
+, ...
+}:
+
+with lib;
+let
+  cfg = config.mySystem.services.dnscrypt-proxy;
+in
+{
+  options.mySystem.services.dnscrypt-proxy.enable = mkEnableOption "Cloudflare ddns";
+
+  config = mkIf cfg.enable {
+    # Disable resolvd to ensure it doesnt re-write /etc/resolv.conf
+    services.resolved.enable = false;
+
+    # Fix this devices DNS resolv.conf else resolvd will point it to dnscrypt
+    # causing a risk of no dns if service fails.
+    networking = {
+      nameservers = [ "10.8.10.1" ]; # TODO make varible IP
+
+      dhcpcd.extraConfig = "nohook resolv.conf";
+    };
+
+    # configure secret for forwarding rules
+    sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".sopsFile = ./dnscrypt-proxy2.sops.yaml;
+    sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".mode = "0444"; # This is world-readable but theres nothing security related in the file
+
+    # Restart dnscrypt when secret changes
+    sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".restartUnits = [ "dnscrypt-proxy2" ];
+
+    services.dnscrypt-proxy2 = {
+      enable = true;
+      settings = {
+        require_dnssec = true;
+        forwarding_rules = config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".path;
+        listen_addresses = [ "0.0.0.0:53" ];
+        server_names = [ "NextDNS" ];
+
+        static = {
+          "NextDNS" = {
+            stamp = "sdns://AgEAAAAAAAAAAAAOZG5zLm5leHRkbnMuaW8HL2Y2ZmUzNQ";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/hosts/common/optional/dnscrypt-proxy2.sops.yaml b/nixos/modules/nixos/services/dnscrypt-proxy2/dnscrypt-proxy2.sops.yaml
similarity index 100%
rename from nixos/hosts/common/optional/dnscrypt-proxy2.sops.yaml
rename to nixos/modules/nixos/services/dnscrypt-proxy2/dnscrypt-proxy2.sops.yaml
diff --git a/nixos/modules/nixos/services/maddy/default.nix b/nixos/modules/nixos/services/maddy/default.nix
new file mode 100644
index 0000000..37cc87e
--- /dev/null
+++ b/nixos/modules/nixos/services/maddy/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, config
+, ...
+}:
+
+with lib;
+let
+  cfg = config.mySystem.services.maddy;
+in
+{
+  options.mySystem.services.maddy.enable = mkEnableOption "Maddy SMTP Client (Relay)";
+
+  config = mkIf cfg.enable {
+
+    sops.secrets."system/mail/maddy/envFile" = {
+      sopsFile = ./maddy.sops.yaml;
+      owner = "maddy";
+      group = "maddy";
+    };
+
+    sops.secrets."system/mail/maddy/envFile".restartUnits = [ "maddy" ];
+
+    services.maddy = {
+      enable = true;
+      secrets = [ config.sops.secrets."system/mail/maddy/envFile".path ];
+      config = builtins.readFile ./maddy.conf;
+    };
+
+  };
+}
diff --git a/nixos/hosts/common/optional/maddy.conf b/nixos/modules/nixos/services/maddy/maddy.conf
similarity index 100%
rename from nixos/hosts/common/optional/maddy.conf
rename to nixos/modules/nixos/services/maddy/maddy.conf
diff --git a/nixos/hosts/common/optional/maddy.sops.yaml b/nixos/modules/nixos/services/maddy/maddy.sops.yaml
similarity index 100%
rename from nixos/hosts/common/optional/maddy.sops.yaml
rename to nixos/modules/nixos/services/maddy/maddy.sops.yaml
diff --git a/nixos/profiles/role-worstation.nix b/nixos/profiles/role-worstation.nix
index 12bb03d..909d6f2 100644
--- a/nixos/profiles/role-worstation.nix
+++ b/nixos/profiles/role-worstation.nix
@@ -3,16 +3,20 @@
 # Covers desktops/laptops, expected to have a GUI and do worloads
 # Will have home-manager installs
 
-with lib;
+with config;
 {
 
-  config.boot = {
+  mySystem.de.gnome.enable = true;
+  mySystem.editor.vscodium.enable = true;
+  mySystem.browser.firefox.enable = true;
+
+  boot = {
 
     binfmt.emulatedSystems = [ "aarch64-linux" ]; # Enabled for raspi4 compilation
     plymouth.enable = true; # hide console with splash screen
   };
 
-  config.nix.settings = {
+  nix.settings = {
     # TODO factor out into mySystem
     # Avoid disk full issues
     max-free = lib.mkDefault (1000 * 1000 * 1000);
@@ -20,7 +24,7 @@ with lib;
   };
 
   # set xserver videodrivers if used
-  config.services.xserver.enable = true;
+  services.xserver.enable = true;
 
   # Laptop so ill likely use wireles
   # very likely to be set by GUI packages but lets