revamped flake.nix, removed homelab specific modulesstaging

68 files changed, 0 insertions, 4549 deletions

diff --git a/os/core/audio.nix b/os/core/audio.nix
deleted file mode 100644
index a7fb5db..0000000
--- a/os/core/audio.nix
+++ /dev/null
@@ -1,146 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.core.audio;
-  toggleMuteNotify = pkgs.writeShellScriptBin "toggle-mute-notify" ''
-    IS_MUTED=$(${pkgs.wireplumber}/bin/wpctl get-volume @DEFAULT_AUDIO_SOURCE@ | grep -c "MUTED")
-
-    if [ "$IS_MUTED" -eq 1 ]; then
-        ${pkgs.libnotify}/bin/notify-send -a "MuteIndicator" -t 0 -u critical "Microphone Muted" "Mic is currently OFF"
-    else
-        ${pkgs.mako}/bin/makoctl dismiss -a "MuteIndicator"
-    fi
-  '';
-in
-{
-  options.os.core.audio = {
-    enable = lib.mkEnableOption "audio support";
-    disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      services.pulseaudio.enable = false;
-      security.rtkit.enable = true;
-
-      services = {
-        pipewire = {
-          enable = true;
-          audio.enable = true;
-          pulse.enable = true;
-          alsa = {
-            enable = true;
-            support32Bit = true;
-          };
-          jack.enable = true;
-          wireplumber = {
-            enable = true;
-            extraConfig = {
-              "99-lock-microphone-gain" = {
-                "pulse.rules" = [
-                  {
-                    matches = [
-                      { "application.name" = "~*cord*"; }
-                    ];
-                    actions = {
-                      quirks = [ "no-source-volume" ];
-                    };
-                  }
-                ];
-              };
-              "99-disable-suspend" = {
-                "monitor.alsa.rules" = [
-                  {
-                    matches = [
-                      { "node.name" = "~alsa_input.*"; }
-                      { "node.name" = "~alsa_output.*"; }
-                    ];
-                    actions.update-props = {
-                      "session.suspend-timeout-seconds" = 0;
-                    };
-                  }
-                ];
-              };
-              "10-bluetooth-policy" = {
-                "wireplumber.profiles" = {
-                  "main" = {
-                    "policy.bluetooth" = "enabled";
-                  };
-                };
-                "monitor.bluez.properties" = {
-                  "bluez5.roles" = [
-                    "a2dp_sink"
-                    "a2dp_source"
-                    "bap_sink"
-                    "bap_source"
-                    "hfp_hf"
-                    "hsp_hs"
-                  ];
-                  "bluez5.codecs" = [
-                    "sbc"
-                    "sbc_xq"
-                    "aac"
-                    "ldac"
-                    "aptx"
-                    "aptx_hd"
-                  ];
-                };
-              };
-            };
-          };
-        };
-        playerctld.enable = true;
-      };
-
-      systemd.user.services.pipewire-quantum = {
-        description = "Set strict low-latency PipeWire quantum";
-        after = [ "wireplumber.service" ];
-        bindsTo = [ "pipewire.service" ];
-        wantedBy = [ "wireplumber.service" ];
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = [
-            "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512"
-            "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512"
-          ];
-        };
-      };
-
-      programs.noisetorch.enable = true;
-
-      systemd.user.services.pipewire-pulse = {
-        serviceConfig = {
-          Environment = [ "LADSPA_PATH=/tmp" ];
-        };
-      };
-
-      environment.systemPackages = with pkgs; [
-        toggleMuteNotify
-        pulsemixer
-        pavucontrol
-        crosspipe
-        alsa-utils
-      ];
-    })
-
-    (lib.mkIf cfg.disable-devices.enable {
-      services.pipewire.wireplumber.extraConfig = {
-        "99-disable-useless-devices"."monitor.alsa.rules" = [
-          {
-            matches = [
-              { "device.name" = "~alsa_card.pci-0000_03_00.1*"; }
-              { "device.description" = "~USB Audio*"; }
-            ];
-            actions.update-props = {
-              "device.disabled" = true;
-            };
-          }
-        ];
-      };
-    })
-  ];
-}
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
deleted file mode 100644
index e8dfc11..0000000
--- a/os/core/bootloader.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.os.core.bootloader;
-in
-{
-  options.os.core.bootloader = {
-    type = lib.mkOption {
-      type = lib.types.enum [
-        "systemd-boot"
-        "grub"
-        "none"
-      ];
-      default = "systemd-boot";
-      description = "Which bootloader to use";
-    };
-
-    efi = lib.mkOption {
-      type = lib.types.bool;
-      default = if cfg.grub.device == "nodev" then true else false;
-      description = "Whether the system uses UEFI or Legacy BIOS";
-    };
-
-    timeout = lib.mkOption {
-      type = lib.types.int;
-      default = 3;
-      description = "Boot menu timeout in seconds";
-    };
-
-    grub = {
-      device = lib.mkOption {
-        type = lib.types.str;
-        default = "nodev";
-        description = "Device to install GRUB to (e.g. /dev/nvme0n1). Use 'nodev' for UEFI.";
-      };
-      useOSProber = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Scan for other operating systems";
-      };
-      defaultEntry = lib.mkOption {
-        type = lib.types.int;
-        default = 0;
-        description = "Index of the default boot entry";
-      };
-    };
-
-    #TODO add boot.initrd.luks.reusePassphrases = true; somewhere
-    luks.enable = lib.mkEnableOption "LUKS encryption support";
-  };
-
-  config = lib.mkMerge [
-    # 1. Common Kernel & Initrd Settings
-    {
-      boot = {
-        loader = {
-          timeout = cfg.timeout;
-          efi.canTouchEfiVariables = lib.mkDefault cfg.efi;
-        };
-        supportedFilesystems = [
-          "ntfs"
-          "btrfs"
-        ];
-        kernelParams = [
-          "quiet"
-          "splash"
-        ];
-        consoleLogLevel = 0;
-        initrd.availableKernelModules = [
-          "aesni_intel"
-          "cryptd"
-        ];
-      };
-      systemd.settings.Manager.DefaultTimeoutStopSec = "5s";
-    }
-
-    # 2. Systemd-boot Implementation
-    (lib.mkIf (cfg.type == "systemd-boot") {
-      boot.loader.systemd-boot = {
-        enable = true;
-        editor = false;
-        consoleMode = "max";
-      };
-    })
-
-    # 3. GRUB Implementation
-    (lib.mkIf (cfg.type == "grub") {
-      boot.loader.grub = {
-        enable = true;
-        efiSupport = cfg.efi;
-        useOSProber = cfg.grub.useOSProber;
-        default = cfg.grub.defaultEntry;
-        enableCryptodisk = cfg.luks.enable;
-      };
-    })
-  ];
-}
diff --git a/os/core/default.nix b/os/core/default.nix
deleted file mode 100644
index 963436b..0000000
--- a/os/core/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.core;
-in
-{
-  imports = [
-    ./audio.nix
-    ./bootloader.nix
-    ./drivers.nix
-    ./fonts.nix
-    ./greet.nix
-    ./home-manager.nix
-    ./localization.nix
-    ./memory.nix
-    ./networking.nix
-    ./power.nix
-    ./security.nix
-    ./storage.nix
-    ./users.nix
-    ./zfs.nix
-  ];
-
-  options.os.core = {
-    allowUnfree.enable = lib.mkEnableOption "unfree software";
-    flatpak.enable = lib.mkEnableOption "Flatpak support";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.allowUnfree.enable {
-      nixpkgs.config.allowUnfree = true;
-    })
-    (lib.mkIf cfg.flatpak.enable {
-      services.flatpak.enable = true;
-    })
-  ];
-}
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
deleted file mode 100644
index 6e74e98..0000000
--- a/os/core/drivers.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.core.drivers;
-in
-{
-  options.os.core.drivers = {
-    enable = lib.mkEnableOption "enables hardware drivers";
-
-    cpu = lib.mkOption {
-      type = lib.types.enum [
-        "intel"
-        "amd"
-        "none"
-      ];
-      default = "none";
-      description = "cpu manufacturer for microcode and platform-specific drivers";
-    };
-
-    graphics = {
-      enable = lib.mkEnableOption "graphics support";
-      amdgpu.enable = lib.mkEnableOption "amd specific gpu features";
-    };
-
-    kernel = lib.mkOption {
-      type = lib.types.enum [
-        "stable"
-        "zen"
-        "zfs"
-        "hardened"
-      ];
-      default = "stable";
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        hardware.enableAllFirmware = true;
-        services = {
-          smartd.enable = true;
-          fwupd.enable = true;
-        };
-        environment.systemPackages = [ pkgs.rivalcfg ];
-      }
-
-      (lib.mkIf (cfg.cpu == "amd") {
-        hardware.cpu.amd.updateMicrocode = true;
-        programs.coolercontrol.enable = true;
-      })
-
-      (lib.mkIf (cfg.cpu == "intel") {
-        hardware.cpu.intel.updateMicrocode = true;
-        services.thermald.enable = true;
-      })
-
-      (lib.mkIf cfg.graphics.enable {
-        hardware.graphics = {
-          enable = true;
-          enable32Bit = true;
-        };
-        hardware.sensor.iio.enable = true;
-      })
-
-      (lib.mkIf (cfg.graphics.enable && cfg.graphics.amdgpu.enable) {
-        services = {
-          lact.enable = true;
-          hardware.openrgb.enable = true;
-        };
-        hardware = {
-          amdgpu = {
-            initrd.enable = true;
-            overdrive.enable = true;
-          };
-          graphics.extraPackages = with pkgs; [
-            rocmPackages.clr.icd
-            libva-utils
-          ];
-        };
-      })
-      {
-        boot.kernelPackages =
-          let
-            kernels = {
-              "stable" = pkgs.linuxPackages_latest;
-              "zen" = pkgs.linuxPackages_zen;
-              "hardened" = pkgs.linuxPackages_hardened;
-              "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages;
-            };
-          in
-          kernels.${cfg.kernel} or kernels."stable";
-      }
-    ]
-  );
-}
diff --git a/os/core/fonts.nix b/os/core/fonts.nix
deleted file mode 100644
index ee61591..0000000
--- a/os/core/fonts.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.core.fonts;
-in
-{
-  options.os.core.fonts.enable = lib.mkEnableOption "system-wide font and console configuration";
-
-  config = lib.mkIf cfg.enable {
-    console = {
-      keyMap = "pl";
-      earlySetup = true;
-      font = "ter-v32n";
-      packages = with pkgs; [ terminus_font ];
-    };
-
-    fonts.packages = with pkgs; [
-      terminus_font
-      nerd-fonts.jetbrains-mono
-      nerd-fonts.fira-mono
-      nerd-fonts.fira-code
-      noto-fonts
-      noto-fonts-cjk-sans
-      noto-fonts-cjk-serif
-      noto-fonts-color-emoji
-    ];
-  };
-}
diff --git a/os/core/greet.nix b/os/core/greet.nix
deleted file mode 100644
index 1c01b68..0000000
--- a/os/core/greet.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.core.greet;
-in
-{
-  options.os.core.greet.enable = lib.mkEnableOption "enables greetd daemon with tuigreet";
-  config = lib.mkIf cfg.enable {
-    services.greetd = {
-      enable = true;
-      settings = {
-        default_session = {
-          user = "greeter";
-          command = lib.concatStringsSep " " [
-            "${pkgs.tuigreet}/bin/tuigreet"
-            "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions"
-            "--remember"
-            "--remember-user-session"
-            "--asterisks"
-            "--greeting 'Welcome to NixOS!'"
-            "--time"
-          ];
-        };
-      };
-    };
-    security.pam.services.greetd.enableGnomeKeyring = true;
-  };
-}
diff --git a/os/core/home-manager.nix b/os/core/home-manager.nix
deleted file mode 100644
index 63f3dfd..0000000
--- a/os/core/home-manager.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  inputs,
-  config,
-  lib,
-  username,
-  ...
-}:
-let
-  cfg = config.os.core.home-manager;
-in
-{
-  imports = [ inputs.home-manager.nixosModules.home-manager ];
-
-  options.os.core.home-manager = {
-    enable = lib.mkEnableOption "home Manager configuration";
-
-    users = lib.mkOption {
-      default = { };
-      description = "Attribute set of users and their home-manager configurations";
-      type = lib.types.attrsOf (
-        lib.types.submodule {
-          options = {
-            path = lib.mkOption {
-              type = lib.types.path;
-              description = "Path to the user's home.nix file";
-            };
-          };
-        }
-      );
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    home-manager = {
-      extraSpecialArgs = { inherit inputs username; };
-      useGlobalPkgs = true;
-      useUserPackages = true;
-      backupFileExtension = "bak";
-
-      users = lib.mapAttrs (name: userCfg: {
-        imports = [ userCfg.path ];
-      }) cfg.users;
-    };
-  };
-}
diff --git a/os/core/localization.nix b/os/core/localization.nix
deleted file mode 100644
index 49933fa..0000000
--- a/os/core/localization.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.core.locale;
-in
-{
-  options.os.core.locale = {
-    enable = lib.mkEnableOption "system localization (timezone and language)";
-
-    timeZone = lib.mkOption {
-      type = lib.types.str;
-      default = "Europe/Warsaw";
-      description = "the system timezone.";
-    };
-
-    format = lib.mkOption {
-      type = lib.types.str;
-      default = "pl_PL.UTF-8";
-      description = "the locale used for numbers, time, and measurements.";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    time.timeZone = cfg.timeZone;
-
-    i18n = {
-      defaultLocale = "en_US.UTF-8";
-
-      extraLocaleSettings = {
-        LC_TIME = cfg.format;
-        LC_NUMERIC = cfg.format;
-        LC_MONETARY = cfg.format;
-        LC_PAPER = cfg.format;
-        LC_MEASUREMENT = cfg.format;
-        LC_COLLATE = cfg.format;
-        LC_NAME = cfg.format;
-        LC_ADDRESS = cfg.format;
-        LC_TELEPHONE = cfg.format;
-        LC_IDENTIFICATION = cfg.format;
-      };
-    };
-  };
-}
diff --git a/os/core/memory.nix b/os/core/memory.nix
deleted file mode 100644
index b20ec8a..0000000
--- a/os/core/memory.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.core.memory;
-in
-{
-  options.os.core.memory = {
-    zram = {
-      enable = lib.mkEnableOption "enables zram compression";
-      percent = lib.mkOption {
-        type = lib.types.int;
-        default = 25;
-      };
-    };
-
-    swapfile = {
-      enable = lib.mkEnableOption "enables a swapfile";
-      size = lib.mkOption {
-        type = lib.types.int;
-        default = 8;
-      };
-    };
-  };
-  config = lib.mkMerge [
-    (lib.mkIf cfg.zram.enable {
-      zramSwap = {
-        enable = true;
-        algorithm = "zstd";
-        memoryPercent = cfg.zram.percent;
-        priority = 100;
-      };
-    })
-
-    (lib.mkIf cfg.swapfile.enable {
-      swapDevices = [ {
-        device = "/.swapvol/swapfile";
-        size = cfg.swapfile.size * 1024; 
-        priority = 0;
-      } ];
-    })
-  ];
-}
diff --git a/os/core/networking.nix b/os/core/networking.nix
deleted file mode 100644
index 9e4c329..0000000
--- a/os/core/networking.nix
+++ /dev/null
@@ -1,186 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.core.network;
-in
-{
-  options.os.core.network = {
-    enable = lib.mkEnableOption "system-wide networking setup";
-    enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers";
-
-    isVM = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host.";
-    };
-
-    ips = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      default = {
-        bare-metal = "10.0.0.2";
-        opnsense-vm = "10.0.0.1";
-        gateway-vm = "10.0.0.3";
-        auth-vm = "10.0.0.4";
-        database-vm = "10.0.0.5";
-        monitor-vm = "10.0.0.6";
-        media-vm = "10.0.0.7";
-        torrent-vm = "10.0.0.8";
-        storage-vm = "10.0.0.9";
-        web-vm = "10.0.0.10";
-        comm-vm = "10.0.0.11";
-        mail-vm = "10.0.0.12";
-        relay-vm = "10.0.0.13";
-        gameserver-vm = "10.0.0.14";
-      };
-      description = "Central registry of static IP allocations for the cluster.";
-    };
-
-    profile = lib.mkOption {
-      type = lib.types.enum [
-        "client"
-        "server"
-      ];
-      default = "client";
-      description = "Which networking profile configuration to apply";
-    };
-
-    lan = lib.mkOption {
-      description = "Physical Home Local Area Network configuration parameters.";
-      type = lib.types.submodule {
-        options = {
-          ip = lib.mkOption {
-            type = lib.types.str;
-            default = "10.0.0.2";
-            description = "The local static or leased IP assigned to this machine on the home network.";
-          };
-          range = lib.mkOption {
-            type = lib.types.str;
-            default = "10.0.0.0/24";
-            description = "The broader subnet block representing the physical home network.";
-          };
-        };
-      };
-    };
-
-    wg = lib.mkOption {
-      description = "Standard WireGuard VPN tunnel configuration parameters.";
-      type = lib.types.submodule {
-        options = {
-          ip = lib.mkOption {
-            type = lib.types.str;
-            default = "10.3.0.1";
-            description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
-          };
-          range = lib.mkOption {
-            type = lib.types.str;
-            default = "10.3.0.0/24";
-            description = "The total addressable IP space assigned to the WireGuard network pool.";
-          };
-        };
-      };
-    };
-
-    hs = lib.mkOption {
-      description = "Headscale mesh overlay network configuration parameters.";
-      type = lib.types.submodule {
-        options = {
-          ip = lib.mkOption {
-            type = lib.types.str;
-            default = "10.4.0.1";
-            description = "The explicit mesh network IP address assigned to this machine via Headscale.";
-          };
-          range = lib.mkOption {
-            type = lib.types.str;
-            default = "10.4.0.0/24";
-            description = "The full mesh overlay allocation subnet block.";
-          };
-        };
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        services.resolved.enable = true;
-      }
-
-      (lib.mkIf (cfg.profile == "client") {
-        networking.networkmanager = {
-          enable = true;
-          dns = "systemd-resolved";
-          wifi.macAddress = "random";
-          wifi.backend = "iwd";
-          ethernet.macAddress = "random";
-        };
-
-        systemd.services."NetworkManager-wait-online".enable = false;
-
-        environment.systemPackages = [
-          pkgs.impala
-        ];
-      })
-
-      (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) {
-        networking = {
-          firewall.enable = true;
-          nftables.enable = true;
-        };
-      })
-
-      (lib.mkIf (cfg.profile == "server") {
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-        };
-        systemd.network = {
-          enable = true;
-          wait-online.enable = lib.mkIf (!cfg.isVM) false;
-
-          netdevs = lib.mkIf (!cfg.isVM) {
-            "10-br-srv" = {
-              netdevConfig = {
-                Name = "br-srv";
-                Kind = "bridge";
-              };
-            };
-          };
-          networks."20-host-management" = {
-            matchConfig.Name = if cfg.isVM then "eth0" else "br-srv";
-            address = [ "${cfg.lan.ip}/24" ];
-            gateway = [ cfg.ips.router ];
-            networkConfig.LinkLocalAddressing = "no";
-          };
-        };
-        boot.kernel.sysctl = {
-          "net.ipv4.ip_nonlocal_bind" = 1;
-          "net.ipv4.ip_forward" = 1;
-        };
-      })
-      (lib.mkIf
-        (
-          cfg.profile == "server"
-          && cfg.enableFirewall
-          && cfg.isVM
-          && config.networking.hostName != "vm2-gateway"
-        )
-        {
-          networking.nftables.enable = true;
-          networking.firewall = {
-            enable = true;
-            extraCommands = ''
-              nft add table ip nat 2>/dev/null || true
-              nft flush table ip nat
-              nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; }
-              nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect
-            '';
-          };
-        }
-      )
-    ]
-  );
-}
diff --git a/os/core/persistance.nix b/os/core/persistance.nix
deleted file mode 100644
index 89f3702..0000000
--- a/os/core/persistance.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-let
-  cfg = config.os.srv.persistance;
-in
-{
-  imports = [ inputs.impermanence.nixosModules.impermanence ];
-
-  options.os.srv.persistance.enable = lib.mkEnableOption "enables persistance drive maintnance";
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      environment.persistence."/persist" = {
-        hideMounts = true;
-        directories = [
-          "/var/lib/nixos"
-          "/var/lib/systemd"
-          "/var/lib/microvm"
-        ];
-        files = [
-          "/etc/machine-id"
-        ];
-      };
-    })
-    (lib.mkIf (cfg.enable && config.os.srv.ssh.server.enable) {
-      environment.persistence."/persist" = {
-        files = [
-          "/etc/ssh/ssh_host_ed25519_key"
-          "/etc/ssh/ssh_host_ed25519_key.pub"
-        ];
-      };
-    })
-    (lib.mkIf (cfg.enable && config.os.srv.crowdsec.agent.enable) {
-      environment.persistence."/persist" = lib.mkIf cfg.agent.enable {
-        hideMounts = true;
-        directories = [
-          {
-            directory = "/var/lib/crowdsec";
-            user = "crowdsec";
-            group = "crowdsec";
-            mode = "0750";
-          }
-        ];
-      };
-    })
-  ];
-}
diff --git a/os/core/power.nix b/os/core/power.nix
deleted file mode 100644
index b3dbf91..0000000
--- a/os/core/power.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.os.core.power;
-in
-{
-  options.os.core.power = {
-    enable = lib.mkEnableOption "enables power management";
-    mode = lib.mkOption {
-      type = lib.types.enum [
-        "amd"
-        "intel"
-        "none"
-      ];
-      default = "none";
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        powerManagement.powertop.enable = true;
-        boot.kernelParams = [ "nvme_core.default_ps_max_latency_us=0" ];
-      }
-
-      (lib.mkIf (cfg.mode == "amd") {
-        services.power-profiles-daemon.enable = true;
-        boot.kernelParams = [ "amd_pstate=active" ];
-      })
-
-      (lib.mkIf (cfg.mode == "intel") {
-        services = {
-          power-profiles-daemon.enable = false;
-
-          thermald.enable = true;
-          tlp = {
-            enable = true;
-            settings = {
-              START_CHARGE_THRESH_BAT0 = 75;
-              STOP_CHARGE_THRESH_BAT0 = 80;
-              START_CHARGE_THRESH_BAT1 = 75;
-              STOP_CHARGE_THRESH_BAT1 = 80;
-              CPU_SCALING_GOVERNOR_ON_AC = "performance";
-              CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
-            };
-          };
-        };
-      })
-    ]
-  );
-}
diff --git a/os/core/security.nix b/os/core/security.nix
deleted file mode 100644
index 33aa919..0000000
--- a/os/core/security.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-let
-  cfg = config.os.core.security;
-in
-{
-  options.os.core.security = {
-    enable = lib.mkEnableOption "core security services";
-    antivirus.enable = lib.mkEnableOption "enables clamav antivirus";
-    sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff";
-  };
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        security = {
-          polkit.enable = true;
-          rtkit.enable = true;
-          doas = {
-            enable = true;
-            extraRules = [
-              {
-                users = [ username ];
-                keepEnv = true;
-                persist = true;
-              }
-            ];
-          };
-          # sudo.enable = false;
-          pam.services = {
-            swaylock = { };
-            login.enableGnomeKeyring = true;
-          };
-        };
-        # environment.systemPackages = [ pkgs.doas-sudo-shim ];
-      }
-      (lib.mkIf cfg.sandboxing.enable {
-        security.apparmor = {
-          enable = true;
-          enableCache = true;
-          killUnconfinedConfinables = true;
-          packages = with pkgs; [
-            apparmor-profiles
-            roddhjav-apparmor-rules
-          ];
-        };
-        services.dbus.apparmor = "enabled";
-        specialisation.no-apparmor.configuration.security.apparmor.enable = lib.mkForce false;
-
-        programs.firejail.enable = true;
-        environment.systemPackages = with pkgs; [
-          apparmor-utils
-          apparmor-parser
-          apparmor-bin-utils
-        ];
-      })
-      {
-        services.gnome.gnome-keyring.enable = true;
-
-        environment.systemPackages = with pkgs; [
-          veracrypt
-          gocryptfs
-          keepassxc
-        ];
-      }
-    ]
-  );
-}
diff --git a/os/core/storage.nix b/os/core/storage.nix
deleted file mode 100644
index 8527bac..0000000
--- a/os/core/storage.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.core.storage;
-in
-{
-  options.os.core.storage = {
-    enable = lib.mkEnableOption "enables storage management";
-  };
-  config = lib.mkIf cfg.enable {
-    nix.settings.auto-optimise-store = true;
-    services.fstrim.enable = true;
-    services.btrfs.autoScrub = {
-      enable = true;
-      fileSystems = [ "/" ];
-    };
-    boot.tmp = {
-      useTmpfs = true;
-      tmpfsSize = "50%";
-    };
-  };
-}
diff --git a/os/core/users.nix b/os/core/users.nix
deleted file mode 100644
index ff45a99..0000000
--- a/os/core/users.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-let
-  cfg = config.os.core.users;
-in
-{
-  options.os.core.users.enable = lib.mkEnableOption "enables user accounts";
-  config = lib.mkIf cfg.enable {
-    programs.fish.enable = true;
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "required for storing the ssh key";
-      }
-    ];
-    sops.secrets = {
-      "users/root_password".neededForUsers = true;
-      "users/main_password".neededForUsers = true;
-      # "users/opc_password".neededForUsers = true;
-    };
-    users = {
-      mutableUsers = false;
-
-      users = {
-        "${username}" = {
-          isNormalUser = true;
-          hashedPasswordFile = config.sops.secrets."users/main_password".path;
-          shell = pkgs.fish;
-          extraGroups = lib.mkMerge [
-            [
-              "wheel"
-              "input"
-              "uinput"
-            ]
-
-            (lib.mkIf (config.os.core.drivers.graphics.enable or false) [
-              "video"
-              "render"
-            ])
-            (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ])
-            (lib.mkIf (config.os.srv.virtualization.kvm.enable or false) [ "libvirtd" ])
-            (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
-          ];
-        };
-        root.hashedPasswordFile = config.sops.secrets."users/root_password".path;
-      };
-    };
-  };
-}
diff --git a/os/core/zfs.nix b/os/core/zfs.nix
deleted file mode 100644
index 771644d..0000000
--- a/os/core/zfs.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.zfs;
-in
-{
-  options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance";
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.core.drivers.kernel == "zfs";
-        message = "ZFS requires the zfs supported kernel";
-      }
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "required for storing the ntfy token";
-      }
-    ];
-
-    sops.secrets."ntfy/zed".neededForUsers = false;
-
-    boot = {
-      kernelParams = [ "zfs.zfs_arc_max=${toString (32 * 1024 * 1024 * 1024)}" ];
-      zfs = {
-        # requestEncryptionCredentials = [ "zroot" ];
-        # useKeyringForCredentials = true;
-        extraPools = [ "tank" ];
-      };
-      supportedFilesystems = [ "zfs" ];
-      initrd.supportedFilesystems = [ "zfs" ];
-    };
-    services.zfs = {
-      expandOnBoot = "all";
-      autoScrub.enable = true;
-      trim.enable = true;
-      autoSnapshot = {
-        enable = true;
-        flags = "-k -p --utc";
-      };
-      zed = {
-        settings = {
-          ZED_DEBUG_LOG = "/var/log/zed.debug.log";
-
-          ZED_NOTIFY_INTERVAL_SECS = 3600;
-          ZED_NOTIFY_VERBOSE = 0;
-
-          ZED_USE_ENCLOSURE_LEDS = 1;
-          ZED_SCRUB_AFTER_RESILVER = 1;
-          ZED_POWER_OFF_ENCLOSURE_SLOT_ON_FAULT = 1;
-          ZED_POWER_OFF_ENCLOSURE_SLOT_ON_DEADMAN = 1;
-
-          ZED_NTFY_TOPIC = "zed-alerts-bibus-lab";
-          ZED_NTFY_URL = "http://${config.os.core.network.ips.monitor-vm}:8085";
-        };
-      };
-    };
-    systemd.services.zfs-zed.serviceConfig.EnvironmentFile = config.sops.secrets."ntfy/zed".path;
-    networking.hostId = "4e3e22e1";
-
-  };
-}
diff --git a/os/default.nix b/os/default.nix
deleted file mode 100644
index 5c55a8f..0000000
--- a/os/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./core/default.nix
-    ./srv/default.nix
-    ./wm/default.nix
-    ./vms/microvms.nix
-  ];
-}
diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix
deleted file mode 100644
index 2c42b0a..0000000
--- a/os/srv/authelia.nix
+++ /dev/null
@@ -1,179 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.authelia;
-  computedBaseDN = lib.concatStringsSep "," (
-    map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain)
-  );
-in
-{
-  options.os.srv.authelia.enable =
-    lib.mkEnableOption "enables authelia authentication gateway instance";
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "sops must be enabled for secure cryptographic token storage";
-      }
-      {
-        assertion = config.os.core.network.enableFirewall;
-        message = "Requires firewall";
-      }
-    ];
-
-    sops.secrets = {
-      "authelia/jwt_secret" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/session_secret" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/encryption_key" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-
-      "authelia/oidc_hmac" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/oidc_private_key" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-
-      "postgres/authelia_password" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "redis/password" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-    };
-
-    services.authelia.instances.main = {
-      enable = true;
-
-      secrets = {
-        jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
-        sessionSecretFile = config.sops.secrets."authelia/session_secret".path;
-        storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path;
-
-        oidcHmacSecretFile = config.sops.secrets."authelia/oidc_hmac".path;
-        oidcIssuerPrivateKeyFile = config.sops.secrets."authelia/oidc_private_key".path;
-      };
-
-      settings = {
-        theme = "dark";
-        default_2fa_method = "totp";
-
-        log = {
-          level = "info";
-          format = "json";
-          path = "/var/log/authelia/authelia.log";
-          keep_stdout = true;
-        };
-
-        server.address = "tcp://127.0.0.1:9091";
-
-        telemetry.metrics = {
-          enabled = true;
-          address = "tcp://127.0.0.1:9959";
-        };
-
-        storage = {
-          postgres = {
-            host = config.os.core.network.ips.database-vm;
-            port = 5432;
-            database = "authelia";
-            username = "authelia";
-            timeout = "5s";
-            schema = "public";
-          };
-        };
-
-        session = {
-          name = "authelia_session";
-          expiration = "1h";
-          inactivity = "15m";
-          remember_me = "1M";
-          provider = {
-            redis = {
-              host = config.os.core.network.ips.database-vm;
-              port = 6379;
-              database = 0;
-              timeout = "5s";
-            };
-          };
-        };
-
-        authentication_backend = {
-          ldap = {
-            address = "ldap://${config.os.core.network.ips.gateway-vm}:3890";
-            implementation = "lldap";
-            base_dn = computedBaseDN;
-            user = "uid=authelia,ou=people,${computedBaseDN}";
-          };
-        };
-
-        identity_providers = {
-          oidc = {
-            cors.allowed_origins = map (domain: "https://${domain}") (
-              builtins.attrNames config.os.cluster.nginxProxies
-            );
-
-            clients = config.os.cluster.oidcClients;
-          };
-        };
-
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            {
-              domain = "auth.${masterDomain}";
-              policy = "bypass";
-            }
-          ]
-          ++ config.os.cluster.autheliaRules;
-        };
-
-        session.domain = masterDomain;
-      };
-
-      environmentVariables = {
-        AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."lldap/password".path;
-        AUTHELIA_SESSION_REDIS_PASSWORD_FILE = config.sops.secrets."redis/password".path;
-        AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."postreg/authelia_password".path;
-      };
-    };
-
-    os.cluster.nginxProxies."auth.${masterDomain}" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://${config.os.core.network.ips.gateway-vm}:9091";
-        extraConfig = securityTemplates.restrictToInternal;
-      };
-    };
-
-    networking.firewall.extraInputRules = ''
-      ip saddr ${config.os.core.network.ips.monitor-vm} tcp dport 9959 accept
-    '';
-  };
-}
diff --git a/os/srv/avahi.nix b/os/srv/avahi.nix
deleted file mode 100644
index f14b33a..0000000
--- a/os/srv/avahi.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.avahi;
-in
-{
-  options.os.srv.avahi.enable = lib.mkEnableOption "enables avahis";
-  config = lib.mkIf cfg.enable {
-    services.avahi = {
-      enable = true;
-      ipv4 = true;
-
-      publish = {
-        enable = true;
-        addresses = true;
-        workstation = true;
-      };
-
-      nssmdns4 = true;
-
-      extraServiceFiles = {
-        nfs = ''
-          <?xml version="1.0" standalone='no'?>
-          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
-          <service-group>
-            <name replace-wildcards="yes">NFS Share on %h</name>
-            <service>
-              <type>_nfs._tcp</type>
-              <port>2049</port>
-              <txt-record>path=/data/vault</txt-record>
-            </service>
-            <service>
-                <type>_nfs._tcp</type>
-                <port>2049</port>
-                <txt-record>path=/data/media</txt-record>
-              </service>
-          </service-group>
-        '';
-      };
-    };
-  };
-}
diff --git a/os/srv/backup.nix b/os/srv/backup.nix
deleted file mode 100644
index e7c07f9..0000000
--- a/os/srv/backup.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.replication;
-  pgLockScript = pkgs.writeScriptBin "pg-lock" ''
-    #!/bin/sh
-    microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_start('sanoid_snap');"
-  '';
-
-  pgUnlockScript = pkgs.writeScriptBin "pg-unlock" ''
-    #!/bin/sh
-    microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_stop();"
-  '';
-in
-{
-  options.os.srv.replication.enable = lib.mkEnableOption "enables replications";
-  config = lib.mkIf cfg.enable {
-    services = {
-      sanoid = {
-        enable = true;
-        templates.production = {
-          autosnap = true;
-          autoprune = true;
-          hourly = 24;
-          daily = 7;
-          weekly = 4;
-          monthly = 3;
-        };
-        datasets = {
-          "zroot/rpool/appdata/db/postgres" = {
-            useTemplate = [ "production" ];
-
-            pre_snapshot_script = "${pgLockScript}/bin/pg-lock";
-            post_snapshot_script = "${pgUnlockScript}/bin/pg-unlock";
-            no_inconsistent_snapshot = true;
-            force_post_snapshot_script = true;
-            script_timeout = 30;
-          };
-
-          "zroot/rpool/appdata/db/redis".useTemplate = [ "production" ];
-
-          "zroot/rpool/appdata/db/couchdb".useTemplate = [ "production" ];
-
-          "zroot/rpool/appdata/cfg".useTemplate = [ "production" ];
-
-          "zroot/rpool/appdata/games".useTemplate = [ "production" ];
-
-          "zroot/rpool/appdata/mail".useTemplate = [ "production" ];
-
-          "zroot/rpool/containers".useTemplate = [ "production" ];
-        };
-      };
-
-      syncoid = {
-        enable = true;
-        commonArgs = [
-          "-c"
-          "-p"
-          "--delete-target-snapshots"
-          "--use-hold"
-          "--no-sync-snap"
-        ];
-        commands = {
-          "sync-databases" = {
-            source = "zroot/rpool/appdata/db";
-            target = "tank/ztank/backup/nvme/db";
-            recursive = true;
-          };
-
-          "sync-config" = {
-            source = "zroot/rpool/appdata/cfg";
-            target = "tank/ztank/backup/nvme/cfg";
-          };
-
-          "sync-games" = {
-            source = "zroot/rpool/appdata/games";
-            target = "tank/ztank/backup/nvme/games";
-          };
-
-          "sync-mail" = {
-            source = "zroot/rpool/appdata/mail";
-            target = "tank/ztank/backup/nvme/mail";
-          };
-
-          "sync-docker" = {
-            source = "zroot/rpool/containers";
-            target = "tank/ztank/backup/nvme/containers";
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/bluetooth.nix b/os/srv/bluetooth.nix
deleted file mode 100644
index 1705db6..0000000
--- a/os/srv/bluetooth.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.bluetooth;
-in
-{
-  options.os.srv.bluetooth.enable = lib.mkEnableOption "enables bluetooth support";
-  config = lib.mkIf cfg.enable {
-    hardware.bluetooth = {
-      enable = true;
-      powerOnBoot = true;
-    };
-    environment.systemPackages = [ pkgs.bluetui ];
-  };
-}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
deleted file mode 100644
index d2dc49f..0000000
--- a/os/srv/clamav.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.clamav;
-in
-{
-  options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning";
-  config = lib.mkIf cfg.enable {
-    services.clamav = {
-      daemon = {
-        enable = true;
-        settings = {
-          MaxThreads = 20;
-          MaxQueue = 100;
-        };
-      };
-      scanner.enable = true;
-      updater.enable = true;
-      fangfrisch.enable = true;
-    };
-  };
-}
diff --git a/os/srv/cluster.nix b/os/srv/cluster.nix
deleted file mode 100644
index 6e54ee2..0000000
--- a/os/srv/cluster.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ lib, ... }: {
-  options.os.cluster = {
-    nginxProxies = lib.mkOption {
-      type = lib.types.attrsOf lib.types.attrs;
-      default = { };
-    };
-    autheliaRules = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      default = [ ];
-    };
-    oidcClients = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      default = [ ];
-    };
-  };
-}
diff --git a/os/srv/compat.nix b/os/srv/compat.nix
deleted file mode 100644
index 1ea6105..0000000
--- a/os/srv/compat.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.compat;
-in
-{
-  options.os.srv.compat.enable = lib.mkEnableOption "enables compatibility with windows & x11";
-  config = lib.mkIf cfg.enable {
-    programs.xwayland = {
-      enable = true;
-      package = pkgs.xwayland-satellite;
-    };
-
-    environment.systemPackages = with pkgs; [
-      wineWow64Packages.stagingFull
-      winetricks
-    ];
-
-    environment.sessionVariables = {
-      NIXOS_OZONE_WL = "1";
-      ELECTRON_ENABLE_WAYLAND = "1";
-    };
-  };
-}
diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
deleted file mode 100644
index c3df81b..0000000
--- a/os/srv/crowdsec.nix
+++ /dev/null
@@ -1,181 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.security.crowdsec;
-in
-{
-  options.os.srv.security.crowdsec = {
-    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
-
-    aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network";
-    agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node";
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.networking.nftables.enable;
-        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
-      }
-      {
-        assertion = cfg.agent.enable || cfg.aggregator.enable;
-        message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'.";
-      }
-    ];
-
-    sops = {
-      secrets."crowdsec/env" = {
-        owner = "crowdsec";
-        group = "crowdsec";
-        restartUnits = [ "crowdsec.service" ];
-      };
-
-      templates."local_api_credentials.yaml" = {
-        owner = "crowdsec";
-        group = "crowdsec";
-        restartUnits = [ "crowdsec.service" ];
-        content = ''
-          url: http://${config.os.core.network.ips.gateway-vm}:8080
-          login: ${config.networking.hostName}
-          password: ${config.sops.placeholder."crowdsec/client_password"}
-        '';
-      };
-    };
-
-    systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path;
-
-    services.crowdsec = {
-      enable = true;
-      autoUpdateService = true;
-
-      openFirewall = true;
-
-      settings = {
-        common = {
-          compress_logs = true;
-          log_format = "json";
-        };
-        prometheus = {
-          enabled = true;
-          level = "full";
-          listen_addr = "0.0.0.0";
-          listen_port = 6060;
-        };
-        db_config = {
-          type = "postgresql";
-          host = config.os.core.network.ips.database-vm;
-          port = 5432;
-          db_name = "crowdsec";
-          user = "crowdsec";
-          password = "$CROWDSEC_DB_PASSWORD";
-          sslmode = "require";
-        };
-
-        api = {
-          server = {
-            enable = cfg.aggregator.enable;
-            listen_uri = "0.0.0.0:8080";
-            trusted_ips = [
-              "127.0.0.1"
-              "10.0.0.0/24"
-            ];
-
-            auto_registration = {
-              enabled = cfg.aggregator.enable;
-              token = "$CROWDSEC_REGISTER_TOKEN";
-              allowed_ranges = [ "10.0.0.0/24" ];
-            };
-          };
-          client.credentials_path = config.sops.templates."local_api_credentials.yaml".path;
-        };
-        lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
-      };
-
-      hub = lib.mkIf cfg.agent.enable {
-        collections = [
-          "crowdsecurity/linux"
-          "crowdsecurity/nginx"
-          "crowdsecurity/authelia"
-          "crowdsecurity/sshd"
-        ];
-      };
-
-      localConfig = {
-        acquisitions = lib.mkIf cfg.agent.enable [
-          {
-            source = "journalctl";
-            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-            labels.type = "syslog";
-          }
-          {
-            source = "file";
-            filenames = [ "/var/log/nginx/*.log" ];
-            labels.type = "nginx";
-          }
-          {
-            source = "file";
-            filenames = [ "/var/log/authelia/authelia.log" ];
-            labels.type = "authelia";
-          }
-        ];
-
-        parsers.s02Enrich = lib.mkIf cfg.agent.enable [
-          {
-            name = "myips/whitelist";
-            description = "Prevent local address ranges from triggering bans";
-            whitelist = {
-              reason = "Internal private subnets";
-              cidr = [
-                "10.0.0.0/24"
-                "10.1.0.0/24"
-                "10.3.0.0/24"
-                "10.4.0.0/24"
-              ];
-            };
-          }
-        ];
-
-        notifications = lib.mkIf cfg.aggregator.enable [
-          {
-            name = "ntfy_alerts";
-            type = "http";
-            method = "POST";
-            url = "https://ntfy.${masterDomain}/crowdsec-alerts";
-            headers = {
-              Title = "CrowdSec Alert on Bibus-Lab";
-              Priority = "high";
-              Authorization = "$NTFY_AUTH_TOKEN";
-            };
-            format = ''
-              {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}}
-            '';
-            log_level = "info";
-          }
-        ];
-      };
-    };
-
-    services.crowdsec-firewall-bouncer = {
-      enable = true;
-
-      registerBouncer.enable = cfg.aggregator.enable;
-
-      settings = {
-        mode = "nftables";
-        update_frequency = "10s";
-        api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
-        api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY";
-      };
-    };
-
-    users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [
-      "systemd-journal"
-      "nginx"
-      "authelia-main"
-    ];
-  };
-}
diff --git a/os/srv/default.nix b/os/srv/default.nix
deleted file mode 100644
index c89d029..0000000
--- a/os/srv/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./authelia.nix
-    ./backup.nix
-    ./bluetooth.nix
-    ./clamav.nix
-    ./cluster.nix
-    ./compat.nix
-    ./crowdsec.nix
-    ./dns.nix
-    ./files.nix
-    ./gaming.nix
-    ./grafana.nix
-    ./headscale.nix
-    ./i2p.nix
-    ./kea.nix
-    ./lldap.nix
-    ./loki.nix
-    ./mailserver.nix
-    ./monero.nix
-    ./netdata.nix
-    ./nfs.nix
-    ./nginx.nix
-    ./nix-helper.nix
-    ./ntfy.nix
-    ./ntopng.nix
-    ./oci.nix
-    ./omnisearch.nix
-    ./postgres.nix
-    ./prometheus.nix
-    ./redis.nix
-    ./scrutiny.nix
-    ./simplex.nix
-    ./sops.nix
-    ./ssh.nix
-    ./sunshine.nix
-    ./syncthing.nix
-    ./tailscale.nix
-    ./tor.nix
-    ./ups.nix
-    ./uptime-kuma.nix
-    ./vector.nix
-    ./virtualization.nix
-    ./wireguard.nix
-    ./yggdrasil.nix
-  ];
-}
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
deleted file mode 100644
index b8a973f..0000000
--- a/os/srv/dns.nix
+++ /dev/null
@@ -1,286 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.dns;
-  unboundPort = 5335;
-in
-{
-  options.os.srv.dns = {
-    enable = lib.mkEnableOption "enables dns scanning";
-    adguardProxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.unbound = {
-      enable = true;
-      settings = {
-        server = {
-          interface = [ "127.0.0.1" ];
-          port = unboundPort;
-
-          do-ip4 = true;
-          do-ip6 = false;
-          do-udp = true;
-          do-tcp = true;
-
-          num-threads = 4;
-          msg-cache-slabs = 4;
-          rrset-cache-slabs = 4;
-          infra-cache-slabs = 4;
-          key-cache-slabs = 4;
-
-          msg-cache-size = "256m";
-          rrset-cache-size = "512m";
-          infra-cache-numhosts = 20000;
-
-          so-rcvbuf = "8m";
-          so-sndbuf = "8m";
-          so-reuseport = true;
-
-          qname-minimisation = true;
-          prefetch = true;
-          prefetch-key = true;
-          harden-glue = true;
-          harden-dnssec-stripped = true;
-          hide-identity = true;
-          hide-version = true;
-          use-caps-for-id = false; # might try this later
-          edns-buffer-size = 1232;
-
-          access-control = [
-            "127.0.0.0/8 allow"
-            "0.0.0.0/0 deny"
-          ];
-        };
-      };
-    };
-
-    services.adguardhome = {
-      enable = true;
-      mutableSettings = true;
-
-      settings = {
-        http.address = "0.0.0.0:3000";
-        dns = {
-          bind_hosts = [
-            "127.0.0.1"
-            config.os.core.network.lan.ip
-            config.os.core.network.wg.ip
-            config.os.core.network.hs.ip
-          ];
-          rewrites = [
-            {
-              domain = "router.lan";
-              answer = config.os.core.network.ips.opnsense-vm;
-            }
-            {
-              domain = "nas.lan";
-              answer = config.os.core.network.ips.bare-metal;
-            }
-            {
-              domain = "ldap.${masterDomain}";
-              answer = config.os.core.network.ips.gateway-vm;
-            }
-          ];
-          port = 53;
-          upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
-          fallback_dns = [ "9.9.9.9" ];
-          bootstrap_dns = [ "9.9.9.9" ];
-          cache_size = 536870912;
-          anonymize_client_ip = true;
-        };
-
-        filtering = {
-          filtering_enabled = true;
-          interval = 24;
-        };
-        filters = [
-          {
-            enabled = true;
-            name = "Black Mirror Blocklist";
-            url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt";
-          }
-          {
-            enabled = true;
-            name = "Scam Blocklist by DurableNapkin";
-            url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt";
-          }
-          {
-            enabled = true;
-            name = "Neo Dev Host Blocklist";
-            url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker";
-          }
-          {
-            enabled = true;
-            name = "hBlock Blocklist";
-            url = "https://hblock.molinero.dev/hosts_adblock.txt";
-          }
-          {
-            enabled = true;
-            name = "OISD Big Blocklist";
-            url = "https://big.oisd.nl";
-          }
-          {
-            enabled = true;
-            name = "StevenBlack Unified";
-            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
-          }
-          {
-            enabled = true;
-            name = "StevenBlack Fakenews";
-            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts";
-          }
-          {
-            enabled = true;
-            name = "StevenBlack Gambling";
-            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts";
-          }
-
-          #-----------------------------------------------------------------------------
-
-          # HaGeZi's Blocklists
-
-          {
-            enabled = true;
-            name = "HaGeZi's Ultimate Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt";
-          }
-          {
-            enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive
-            name = "HaGeZi's Pro++ DNS Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Fake DNS Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Dynamic DNS Blocklsit";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Badware Hoster Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's URL Shortener Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's DNS Rebind Protection";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Gambling DNS Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt";
-          }
-
-          #-----------------------------------------------------------------------------
-
-          # NEWLY REGISTERED DOMAINS / ENTROPY DGAs
-
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt";
-          }
-          {
-            enabled = true;
-            name = "HaGeZi's Newly Registered High Entropy Domains";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt";
-          }
-
-          #-----------------------------------------------------------------------------
-
-          # DNS BYPASS BLOCKLISTS
-
-          {
-            enabled = true;
-            name = "HaGeZi's DNS Bypass Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt";
-          }
-          {
-            enabled = true;
-            name = "DNS HTTPS Blocklist";
-            url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt";
-          }
-
-          #-----------------------------------------------------------------------------
-
-          # NSFW DNS BLOCKLISTS
-
-          {
-            enabled = true;
-            name = "HaGeZi's NSFW DNS Blocklist";
-            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt";
-          }
-          {
-            enabled = true;
-            name = "oisd NSFW";
-            url = "https://nsfw.oisd.nl";
-          }
-          {
-            enabled = true;
-            name = "StevenBlack NSFW Blocklist";
-            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts";
-          }
-        ];
-      };
-    };
-
-    os.srv.dns.adguardProxyConfig = {
-      "adguard.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
-          extraConfig = securityTemplates.restrictToInternal;
-        };
-      };
-    };
-
-    networking.firewall = {
-      allowedUDPPorts = [ 53 ];
-      allowedTCPPorts = [ 53 ];
-    };
-  };
-}
diff --git a/os/srv/files.nix b/os/srv/files.nix
deleted file mode 100644
index 777a394..0000000
--- a/os/srv/files.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.files;
-in
-{
-  options.os.srv.files = {
-    enable = lib.mkEnableOption "enables general file management stuff";
-    localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally";
-    krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh";
-  };
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      # programs.thunar = {
-      #   enable = true;
-      #   plugins = with pkgs; [
-      #     ffmpegthumbnailer
-      #     libgsf
-      #     poppler
-      #     freetype
-      #     webp-pixbuf-loader
-      #     thunar-volman
-      #     thunar-archive-plugin
-      #   ];
-      # };
-      services = {
-        tumbler.enable = true;
-        gvfs.enable = true;
-      };
-      environment.systemPackages = with pkgs; [
-        pcmanfm
-        file-roller
-        gdu
-        pxz
-        ripunzip
-      ];
-    })
-    (lib.mkIf cfg.localsend.enable {
-      programs.localsend = {
-        enable = true;
-        openFirewall = true;
-      };
-    })
-    (lib.mkIf cfg.krusader.enable {
-      environment.systemPackages = with pkgs; [
-        krusader
-        kdePackages.kio-extras
-      ];
-    })
-  ];
-}
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
deleted file mode 100644
index b9b6766..0000000
--- a/os/srv/gaming.nix
+++ /dev/null
@@ -1,145 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  inputs,
-  ...
-}:
-let
-  cfg = config.os.srv.gaming;
-in
-{
-  options.os.srv.gaming = {
-    enable = lib.mkEnableOption "enables general gaming support";
-
-    tools.enable = lib.mkEnableOption "enables performance tools" // {
-      default = cfg.enable;
-    };
-    launchers.enable = lib.mkEnableOption "enables 3rd party launchers" // {
-      default = cfg.enable;
-    };
-    games.enable = lib.mkEnableOption "enables specific native games";
-    steam = {
-      enable = lib.mkEnableOption "enables the steam launcher";
-      enableSls = lib.mkEnableOption "enables the SLS Steam library modification";
-    };
-    vr.enable = lib.mkEnableOption "enables vr support";
-  };
-
-  config = lib.mkMerge [
-    # --- PERFORMANCE & TOOLING ---
-    (lib.mkIf cfg.tools.enable {
-      hardware.xone.enable = true;
-      programs = {
-        gamescope = {
-          enable = true;
-          capSysNice = true;
-        };
-
-        gamemode = {
-          enable = true;
-          enableRenice = true;
-          settings = {
-            general.renice = 10;
-          };
-        };
-      };
-      environment = {
-        sessionVariables = {
-          OPTISCALER_ShortcutKey = "0x24"; # sets the optiscaler shortcut key to be home by default
-        };
-
-        systemPackages = with pkgs; [
-          mangohud
-          theclicker
-          ludusavi
-          protonplus
-        ];
-      };
-    })
-
-    # --- EXTERNAL LAUNCHERS ---
-    (lib.mkIf cfg.launchers.enable {
-      environment.systemPackages = with pkgs; [
-        heroic
-        (prismlauncher.override {
-          additionalLibs = with pkgs; [ ocl-icd ];
-          jdks = with pkgs; [ javaPackages.compiler.temurin-bin.jdk-26 ];
-        })
-      ];
-    })
-
-    # --- SPECIFIC GAMES ---
-    (lib.mkIf cfg.games.enable {
-      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [
-        (pkgs.openttd-jgrpp)
-
-        # OpenMW Specific
-        (pkgs.openmw)
-        (pkgs.tes3cmd)
-        delta-plugin
-        groundcoverify
-        momw-configurator
-        openmw-validator
-        s3lightfixes
-        umo
-      ];
-    })
-
-    # --- STEAM ---
-    (lib.mkIf cfg.steam.enable (
-      lib.mkMerge [
-        {
-          programs.steam = {
-            enable = true;
-            localNetworkGameTransfers.openFirewall = true;
-            dedicatedServer.openFirewall = true;
-            remotePlay.openFirewall = false;
-            extest.enable = true;
-            protontricks.enable = true;
-          };
-          environment.systemPackages = with pkgs; [ steamtinkerlaunch ];
-        }
-
-        (lib.mkIf cfg.steam.enableSls {
-          environment.systemPackages = [
-            inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped
-          ];
-          home-manager.users.${username} = {
-            xdg.desktopEntries = {
-              steam = {
-                name = "Steam";
-                comment = "Library modified Steam client";
-                exec = "${
-                  lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam"
-                } %U";
-                icon = "steam";
-                terminal = false;
-                type = "Application";
-                categories = [
-                  "Game"
-                  "Utility"
-                ];
-                mimeType = [ "x-scheme-handler/steamcmd" ];
-              };
-            };
-          };
-        })
-      ]
-    ))
-
-    # --- VR SUPPORT ---
-    (lib.mkIf cfg.vr.enable {
-      services.wivrn = {
-        enable = true;
-        openFirewall = true;
-        highPriority = true;
-        steam.importOXRRuntimes = true;
-        # defaultRuntime = true;
-      };
-      environment.systemPackages = [ pkgs.android-tools ];
-      users.users.${username}.extraGroups = [ "adbusers" ];
-    })
-  ];
-}
diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix
deleted file mode 100644
index 5428818..0000000
--- a/os/srv/grafana.nix
+++ /dev/null
@@ -1,109 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.grafana;
-in
-{
-  options.os.srv.grafana = {
-    enable = lib.mkEnableOption "enables grafana";
-    proxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.grafana = {
-      enable = true;
-      openFirewall = true;
-
-      # Might use later
-      # declarativePlugins = [ ];
-
-      settings = {
-        server = {
-          protocol = "http";
-          http_port = 3000;
-          http_addr = "0.0.0.0";
-          domain = "grafana.${masterDomain}";
-          root_url = "https://grafana.${masterDomain}";
-          enforceDomain = true;
-          enable_gzip = true;
-        };
-        database = {
-          wal = true;
-        };
-        security = {
-          admin_user = "opc";
-          # TODO: Generate password to use in sops-nix
-          # admin_password = "sops"
-          admin_email = "adikro@disroot.org";
-          # TODO generate secret key and put it in sops-nix
-          # secret_key = "sops";
-          disable_gravatar = true;
-          cookie_secure = true;
-          cookie_samesite = "lax";
-          # security
-          allow_embedding = false;
-          strict_transport_security = true;
-
-          disable_initial_admin_creation = false;
-          disable_brute_force_login_protection = false;
-        };
-        # TODO setup mailing
-        # smtp = { enabled = true; };
-        analytics.feedback_links_enabled = false;
-      };
-      provision = {
-        enable = true;
-        datasources.settings = {
-          prune = true;
-
-          datasources = [
-            {
-              name = "Prometheus";
-              type = "prometheus";
-              url = "http://127.0.0.1:9090";
-              access = "proxy";
-              isDefault = true;
-              editable = false;
-            }
-            {
-              name = "Loki";
-              type = "loki";
-              url = "http://127.0.0.1:3100";
-              access = "proxy";
-              editable = false;
-            }
-          ];
-        };
-      };
-      # dashboards.settings = {
-      #   providers = [
-      #     {
-      #       name = "default";
-      #       type = "file";
-      #       options.path = "/var/lib/grafana/dashboards";
-      #     }
-      #   ];
-      # };
-    };
-
-    os.srv.grafana.proxyConfig = {
-      "grafana.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
-          proxyWebsockets = true;
-          extraConfig = securityTemplates.restrictToInternal;
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix
deleted file mode 100644
index 01fc06c..0000000
--- a/os/srv/headscale.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.headscale;
-  aclPolicy = pkgs.writeText "headscale-policy.json" (
-    builtins.toJSON {
-      groups = {
-        "group:admin" = [ "your-device-name" ];
-        "group:friends" = [ "friend-device-name" ];
-      };
-
-      hosts = {
-        "server" = "10.4.0.1";
-      };
-
-      acls = [
-        {
-          action = "accept";
-          src = [ "group:admin" ];
-          dst = [ "*:*" ];
-        }
-
-        {
-          action = "accept";
-          src = [ "group:friends" ];
-          dst = [
-            "server:18080"
-            "server:18081"
-            "server:25565"
-          ];
-        }
-      ];
-    }
-  );
-in
-{
-  options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales";
-
-  config = lib.mkIf cfg.enable {
-    services.headscale = {
-      enable = true;
-      address = "127.0.0.1";
-      port = 8080;
-
-      settings = {
-        server_url = "https://vpn.${masterDomain}";
-
-        policy.path = "${aclPolicy}";
-
-        dns = {
-          magic_dns = true;
-          base_domain = "vpn";
-          nameservers = [ config.os.core.network.ips.vm2-gateway ];
-        };
-
-        ip_prefixes = [
-          "10.4.0.0/16"
-        ];
-      };
-    };
-
-    services.nginx.virtualHosts."vpn.${masterDomain}" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:8080";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}
diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix
deleted file mode 100644
index 5e36c20..0000000
--- a/os/srv/i2p.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.i2p;
-in
-{
-  options.os.srv.i2p = {
-    enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile";
-
-    mode = lib.mkOption {
-      type = lib.types.enum [
-        "server"
-        "client"
-      ];
-      default = "client";
-      description = "";
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        services.i2pd = {
-          enable = true;
-          enableIPv6 = true;
-          reseed.verify = true;
-
-          yggdrasil.enable = true;
-
-          proto = {
-            http.enable = true;
-            httpProxy.enable = true;
-            socksProxy = {
-              enable = true;
-              outproxyEnable = true;
-            };
-            sam.enable = true;
-            i2pControl.enable = true;
-          };
-        };
-      }
-
-      (lib.mkIf (cfg.mode == "server") {
-        services.i2pd = {
-          bandwidth = 4096;
-
-          ntcp2.published = true;
-          ssu2.published = true;
-
-          #TODO add address
-          yggdrasil.address = "";
-        };
-
-        os.cluster.nginxProxies."i2p.${masterDomain}" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070";
-            extraConfig = securityTemplates.restrictToInternal;
-          };
-        };
-      })
-
-      (lib.mkIf (cfg.mode == "client") {
-        services.i2pd = {
-          bandwidth = 512;
-
-          ntcp2.published = false;
-          ssu2.published = false;
-
-          yggdrasil.address = "";
-        };
-      })
-    ]
-  );
-}
diff --git a/os/srv/kea.nix b/os/srv/kea.nix
deleted file mode 100644
index 168590e..0000000
--- a/os/srv/kea.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.kea;
-in
-{
-  options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server";
-  config = lib.mkIf cfg.enable {
-    services.kea.dhcp4 = {
-      enable = true;
-      settings = {
-        interfaces-config = {
-          # To be used in a VM
-          interfaces = [ "eth0" ];
-          dhcp-socket-type = "udp";
-        };
-
-        lease-database = {
-          type = "memfile";
-          persist = true;
-          name = "/var/lib/kea/dhcp4.leases";
-        };
-
-        subnet4 = [
-          {
-            id = 1;
-            subnet = "10.1.0.0/24";
-            pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ];
-            option-data = [
-              {
-                name = "routers";
-                data = "10.1.0.1";
-              }
-              {
-                name = "domain-name-servers";
-                data = "10.0.0.3";
-              }
-            ];
-          }
-          {
-            id = 2;
-            subnet = "10.2.0.0/24";
-            pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ];
-            option-data = [
-              {
-                name = "routers";
-                data = "10.2.0.1";
-              }
-              {
-                name = "domain-name-servers";
-                data = "10.0.0.3";
-              }
-            ];
-          }
-        ];
-      };
-    };
-  };
-}
diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix
deleted file mode 100644
index 6755dfe..0000000
--- a/os/srv/lldap.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.lldap;
-  computedBaseDN = lib.concatStringsSep "," (
-    map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain)
-  );
-in
-{
-  options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning";
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "Required for password secure password storing";
-      }
-      {
-        assertion = config.os.core.network.enableFirewall;
-        message = "Requires firewall";
-      }
-    ];
-
-    sops.secrets = {
-      "lldap/password" = {
-        owner = "lldap";
-        group = "lldap";
-      };
-      "lldap/env_file" = {
-        owner = "lldap";
-        group = "lldap";
-      };
-    };
-
-    services.lldap = {
-      enable = true;
-      settings = {
-        ldap_base_dn = computedBaseDN;
-        http_host = "127.0.0.1";
-        http_url = "https://lldap.${masterDomain}";
-        ldap_user_email = "adikro@disroot.org";
-        ldap_user_pass_file = config.sops.secrets."lldap/password".path;
-        silenceForceUserPassResetWarning = true;
-      };
-      environmentFile = config.sops.secrets."lldap/env_file".path;
-    };
-
-    networking.firewall.extraInputRules = ''
-      ip saddr 10.0.0.0/24 tcp dport 3890 accept
-    '';
-  };
-}
diff --git a/os/srv/loki.nix b/os/srv/loki.nix
deleted file mode 100644
index 84b94d8..0000000
--- a/os/srv/loki.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.loki;
-in
-{
-  options.os.srv.loki.enable = lib.mkEnableOption "enables loki";
-  config = lib.mkIf cfg.enable {
-    services.loki = {
-      enable = true;
-      configuration = {
-        server = {
-          http_listen_address = "0.0.0.0";
-          http_compress_responses = true;
-        };
-
-        common = {
-          instance_addr = "127.0.0.1";
-          path_prefix = "/var/lib/loki";
-          replication_factor = 1;
-
-          storage.filesystem = {
-            chunks_directory = "/var/lib/loki/chunks";
-            rules_directory = "/var/lib/loki/rules";
-          };
-        };
-
-        schema_config.configs = [
-          {
-            from = "2026-01-01";
-            store = "tsdb";
-            object_store = "filesystem";
-            schema = "v13";
-            index = {
-              prefix = "loki_index_";
-              period = "24h";
-            };
-          }
-        ];
-
-        ingester.wal.enabled = true;
-
-        limits_config = {
-          max_entries_limit_per_query = 10000;
-          reject_old_samples_max_age = "720h";
-          retention_period = "90d";
-          volume_enabled = true;
-        };
-
-        compactor = {
-          enabled = true;
-          retention_enabled = true;
-          retention_delete_delay = "1h";
-          compactor_window = "168h";
-        };
-
-        querier.query_timeout = "5m";
-        query_range.out_of_order_time_shifting = "5m";
-        analytics.reporting_enabled = false;
-      };
-    };
-  };
-}
diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix
deleted file mode 100644
index 7bcd008..0000000
--- a/os/srv/mailserver.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.mailserver;
-in
-{
-  options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning";
-  imports = [ inputs.nixos-mailserver.nixosModules.mailserver ];
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "Required for password secure password storing";
-      }
-      {
-        assertion = config.os.srv.lldap.enable;
-        message = "required for user accounts";
-      }
-    ];
-    mailserver = {
-      enable = true;
-      fqdn = "mail.${masterDomain}";
-      domains = [ masterDomain ];
-
-      # TODO setup ldap
-      ldap = {
-        enable = true;
-        uris = [ "ldap://127.0.0.1:3890" ];
-        base = "ou=people,dc=yourdomain,dc=com";
-
-        bind = {
-          dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com";
-          passwordFile = "/var/src/secrets/ldap-mail-password";
-        };
-
-        attributes = {
-          username = "uid";
-          mail = "mail";
-          password = "userPassword";
-          uuid = "entryUUID";
-        };
-
-        dovecot = {
-          userFilter = "(|(mail=%{user})(uid=%{user}))";
-          passFilter = "(uid=%{user})";
-        };
-
-        postfix = {
-          filter = "(mail=%s)";
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
deleted file mode 100644
index eb21abc..0000000
--- a/os/srv/monero.nix
+++ /dev/null
@@ -1,124 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.monero;
-  banlist1 = pkgs.fetchurl {
-    url = "https://gui.xmr.pm/files/block.txt";
-    hash = "sha256-0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
-  };
-  banlist2 = pkgs.fetchurl {
-    url = "https://raw.githubusercontent.com/Boog900/monero-ban-list/refs/heads/main/ban_list.txt";
-    hash = "sh256-01z4wm2mp4z1wq2wdkrm66j50gwk3r82m2ml4n0pwjcbajxkdc87";
-  };
-
-  combinedBanlist = pkgs.writeText "combined-monero-banlist.txt" ''
-    ${builtins.readFile banlist1}
-    ${builtins.readFile banlist2}
-  '';
-in
-{
-  options.os.srv.monero = {
-    wallet.enable = lib.mkEnableOption "enables the monero wallet";
-    service = {
-      enable = lib.mkEnableOption "enables hosting a monero node";
-      public = lib.mkEnableOption "makes the RPC node public (disables authentication for general wallet syncing)";
-      tor.enable = lib.mkEnableOption "exposes monero RPC via Tor Onion Service";
-      i2p.enable = lib.mkEnableOption "exposes monero RPC via I2P Tunnel";
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.wallet.enable {
-      environment.systemPackages = [ pkgs.monero-cli ];
-    })
-    (lib.mkIf cfg.service.enable {
-      assertions = [
-        {
-          assertion = if (!cfg.service.public) then config.os.srv.sops.enable else true;
-          message = "sops must be enabled";
-        }
-        {
-          assertion = if cfg.service.tor.enable then config.os.srv.tor.enable else true;
-          message = "tor must be enabled";
-        }
-        {
-          assertion = if cfg.service.i2p.enable then config.os.srv.i2p.enable else true;
-          message = "i2p must be enabled";
-        }
-      ];
-
-      sops.secrets."monero/rpc-password" = {
-        owner = "monero";
-        restartUnits = [ "monero.service" ];
-      };
-
-      services.monero = {
-        enable = true;
-        prune = true;
-        banlist = combinedBanlist;
-
-        limits = {
-          upload = 1250;
-          download = 12500;
-          threads = 8;
-        };
-
-        rpc = {
-          address = "0.0.0.0";
-        }
-        // lib.optionalAttrs (!cfg.service.public) {
-          restricted = true;
-          user = "admin";
-          password = config.sops.secrets."monero/rpc-password".path;
-        };
-
-      };
-
-      services.tor = lib.mkIf cfg.service.tor.enable {
-        # onionServices."xmr-rpc" = {
-        #   to = [
-        #     {
-        #       port = 18081;
-        #       address = config.os.core.network.ips.relay-vm;
-        #     }
-        #   ];
-        # };
-      };
-
-      services.i2pd = lib.mkIf cfg.service.i2p.enable {
-        # tunnels.server."xmr-rpc" = {
-        #   port = 18081;
-        #   address = config.os.core.network.ips.relay-vm;
-        #   keys = "xmr-rpc-key.dat";
-        #   inbound.length = 3;
-        #   outbound.length = 3;
-        # };
-      };
-
-      os.cluster.nginxProxies."xmr.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081";
-          extraConfig = ''
-            proxy_read_timeout 600s;
-            proxy_send_timeout 600s;
-            client_max_body_size 50m;
-
-            ${securityTemplates.restrictToInternal}
-          '';
-        };
-      };
-
-      # Left open for P2P syncing
-      networking.firewall.allowedTCPPorts = [ 18080 ];
-    })
-  ];
-}
diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix
deleted file mode 100644
index a7b4300..0000000
--- a/os/srv/netdata.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.netdata;
-in
-{
-  options.os.srv.netdata = {
-    enable = lib.mkEnableOption "enables netdata monitoring";
-    proxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.netdata = {
-      enable = true;
-      config.web."bind to" = "127.0.0.1";
-
-      python = {
-        enable = true;
-        recommendedPythonPackages = true;
-      };
-    };
-
-    os.srv.netdata.proxyConfig = {
-      "netdata.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.host}:19999";
-          extraConfig = securityTemplates.restrictToInternal;
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix
deleted file mode 100644
index 07f331e..0000000
--- a/os/srv/nfs.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.nfs;
-in
-{
-  options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing";
-  config = lib.mkIf cfg.enable {
-    services.nfs.server = {
-      enable = true;
-      nproc = 4; # Lowered due to low traffic for a home server
-      createMountPoints = true;
-
-      exports = ''
-        /data/media  10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \
-                     10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \
-                     10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check)
-
-        /data/vault  10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \
-                     10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \
-                     10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check)
-      '';
-    };
-
-    networking.firewall.allowedTCPPorts = [ 2049 ];
-  };
-}
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
deleted file mode 100644
index 2194ecb..0000000
--- a/os/srv/nginx.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.os.srv.nginx;
-in
-{
-  options.os.srv.nginx = {
-    enable = lib.mkEnableOption "the NGINX reverse proxy service";
-
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Whether to open ports 80 and 443 in the firewall.";
-    };
-  };
-
-  config = lib.mkMerge [
-    {
-      _module.args.securityTemplates.restrictToInternal = ''
-        allow 127.0.0.1;
-        allow ::1;
-
-        allow ${config.os.core.network.lan.range};
-        allow 10.1.0.0/24;
-        allow ${config.os.core.network.wg.range};
-        allow ${config.os.core.network.hs.range};
-
-        deny all;
-      '';
-    }
-
-    (lib.mkIf cfg.enable {
-      services.nginx = {
-        enable = true;
-        package = pkgs.nginx.override { openssl = pkgs.libressl; };
-
-        recommendedProxySettings = true;
-        recommendedTlsSettings = true;
-        recommendedOptimisation = true;
-        recommendedGzipSettings = true;
-        virtualHosts = lib.mkMerge [
-          {
-            "_" = {
-              default = true;
-              rejectSSL = true;
-              locations."/".return = "444";
-            };
-          }
-          config.os.cluster.nginxProxies
-        ];
-      };
-
-      security.acme = {
-        acceptTerms = true;
-        defaults.email = "adikro@disroot.org";
-      };
-
-      users.users.nginx.extraGroups = [ "acme" ];
-
-      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
-        80
-        443
-      ];
-
-      systemd.tmpfiles.rules = [
-        "d /var/log/nginx 0750 nginx adm -"
-      ];
-    })
-  ];
-}
diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix
deleted file mode 100644
index 5e5e133..0000000
--- a/os/srv/nix-helper.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-let
-  cfg = config.os.srv.nix-helper;
-in
-{
-  options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper";
-  config = lib.mkIf cfg.enable {
-    nix.settings = {
-      trusted-users = [
-        "root"
-        "${username}"
-      ];
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-    };
-
-    programs.nh = {
-      enable = true;
-      flake = "/etc/nixos";
-      clean.extraArgs = "--keep 5";
-    };
-
-    environment.sessionVariables = {
-      NH_OS_FLAKE = "/etc/nixos";
-    };
-
-    environment.systemPackages = with pkgs; [
-      nix-output-monitor
-      nvd
-    ];
-  };
-}
diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix
deleted file mode 100644
index 1417c81..0000000
--- a/os/srv/ntfy.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.ntfy;
-in
-{
-  options.os.srv.ntfy = {
-    enable = lib.mkEnableOption "enables ntfy";
-    proxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.ntfy-sh = {
-      enable = true;
-      settings = {
-        base-url = "https://ntfy.${masterDomain}";
-
-        listen-http = "127.0.0.1:2586";
-
-        cache-file = "/var/lib/ntfy/cache.db";
-        cache-duration = "72h";
-
-        attachment-cache-dir = "/var/lib/ntfy/attachments";
-        attachment-total-size-limit = "5G";
-        attachment-file-size-limit = "15M";
-        attachment-expiry-duration = "3h";
-
-        behind-proxy = true;
-      };
-    };
-
-    os.srv.ntfy.proxyConfig = {
-      "uptime-kuma.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001";
-          extraConfig = ''
-            proxy_set_header Connection "";
-            proxy_connect_timeout 1m;
-            proxy_send_timeout 1m;
-            proxy_read_timeout 24h;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-            chunked_transfer_encoding on;
-          '';
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix
deleted file mode 100644
index 692fe2c..0000000
--- a/os/srv/ntopng.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.ntopng;
-in
-{
-  options.os.srv.ntopng = {
-    enable = lib.mkEnableOption "enables ntopng monitoring";
-    proxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.ntopng = {
-      enable = true;
-      extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community";
-
-      # TODO fill interfaces
-      interfaces = [
-        "" # WAN Interface
-        "" # LAN Interface
-        "" # Virtual Bridge
-      ];
-    };
-    os.srv.ntopng.proxyConfig = {
-      "ntopng.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
-          extraConfig = securityTemplates.restrictToInternal;
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/oci.nix b/os/srv/oci.nix
deleted file mode 100644
index ea680fd..0000000
--- a/os/srv/oci.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.oci;
-in
-{
-  options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman";
-  config = lib.mkIf cfg.enable {
-    virtualisation = {
-      containers = {
-        enable = true;
-        storage.settings.driver = "zfs";
-      };
-      podman = {
-        enable = true;
-        dockerCompat = true;
-        defaultNetwork.settings.dns_enabled = true;
-        autoPrune = {
-          enable = true;
-          dates = "weekly";
-          flags = [ "--all" ];
-        };
-      };
-      oci-containers.backend = "podman";
-    };
-
-    environment.systemPackages = with pkgs; [
-      podman-tui
-      podman-compose
-    ];
-  };
-}
diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix
deleted file mode 100644
index ac36184..0000000
--- a/os/srv/omnisearch.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  masterDomain,
-  templates,
-  ...
-}:
-let
-  cfg = config.os.srv.omnisearch;
-in
-{
-  imports = [ inputs.omnisearch.nixosModules.default ];
-
-  options.os.srv.omnisearch = {
-    enable = lib.mkEnableOption "enables omnisearch tracking infrastructure";
-
-    role = lib.mkOption {
-      type = lib.types.enum [
-        "server"
-        "standalone"
-      ];
-      default = "standalone";
-      description = "Designates the deployment method";
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        services.omnisearch = {
-          enable = true;
-          settings = {
-            server = {
-              host = "127.0.0.1";
-              port = 8087;
-              locale = "en";
-              domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087";
-            };
-            proxy = {
-              max_retries = 3;
-              randomize_username = true;
-              randomize_password = true;
-            };
-            cache = {
-              dir = "/var/cache/omnisearch";
-              ttl_search = 1800;
-              ttl_infobox = 86400;
-            };
-          };
-        };
-      }
-
-      (lib.mkIf (cfg.role == "server") {
-        assertions = [
-          {
-            assertion = config.os.srv.nginx.enable;
-            message = "Required for proxying";
-          }
-        ];
-        services.nginx.virtualHosts."search.${masterDomain}" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:8087";
-            proxyWebsockets = true;
-            extraConfig = templates.restrictToInternal;
-          };
-        };
-      })
-    ]
-  );
-}
diff --git a/os/srv/postgres.nix b/os/srv/postgres.nix
deleted file mode 100644
index f669f63..0000000
--- a/os/srv/postgres.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.postgres;
-in
-{
-  options.os.srv.postgres.enable = lib.mkEnableOption "";
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "Required for password secure password storing";
-      }
-      {
-        assertion = config.os.core.network.enableFirewall;
-        message = "Requires firewall";
-      }
-    ];
-
-    sops.secrets."postgres/authelia_password" = {
-      owner = "postgres";
-      group = "postgres";
-      restartUnits = [ "postgresql.service" ];
-    };
-
-    services.postgresql = {
-      enable = true;
-      package = pkgs.postgresql_18;
-
-      extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ];
-
-      settings = {
-        listen_addresses = config.os.core.network.ips.database-vm;
-
-        max_connections = 100;
-        shared_buffers = "256MB";
-        work_mem = "4MB";
-      };
-
-      ensureDatabases = [ "authelia" ];
-      ensureUsers = [
-        {
-          name = "authelia";
-          ensureDBOwnership = true;
-        }
-      ];
-
-      initialScript = pkgs.writeText "init-postgres-passwords.sql" ''
-        CREATE USER authelia;
-        ALTER USER authelia WITH PASSWORD 'scram-sha-256';
-      '';
-
-      authentication = pkgs.lib.mkForce ''
-        local   all             all                                     trust
-        host    all             all             10.0.0.0/24             scram-sha-256
-      '';
-    };
-
-    systemd.services.postgresql.postStart = lib.mkAfter ''
-      PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path})
-      ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';"
-    '';
-
-    networking.firewall.extraInputRules = ''
-      ip saddr 10.0.0.0/24 tcp dport 5432 accept
-    '';
-  };
-}
diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix
deleted file mode 100644
index 5b133be..0000000
--- a/os/srv/prometheus.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.prometheus;
-in
-{
-  options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus";
-  config = lib.mkIf cfg.enable {
-    services.prometheus = {
-      enable = true;
-      port = 9090;
-
-      scrapeConfigs = [
-        {
-          job_name = "prometheus";
-          static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
-        }
-        {
-          job_name = "node-hardware";
-          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
-        }
-        {
-          job_name = "node_exporter";
-          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
-        }
-        {
-          job_name = "bare_metal_host_netdata";
-          scheme = "https";
-          metrics_path = "/api/v1/allmetrics";
-          params = {
-            format = [ "prometheus" ];
-          };
-          static_configs = [
-            { targets = [ "netdata.${masterDomain}" ]; }
-          ];
-        }
-        {
-          job_name = "uptime_kuma";
-          metrics_path = "/metrics";
-          static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ];
-        }
-        {
-          job_name = "network-latency";
-          static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ];
-        }
-      ];
-      exporters = {
-        node = {
-          enable = true;
-          enableCollectors = [ "systemd" ];
-          port = 9100;
-        };
-
-        smokeping = {
-          enable = true;
-          listenAddress = "127.0.0.1";
-
-          hosts = [
-            "10.0.0.1" # Personal Router
-            "192.168.0.1" # ISP Modem Box
-            "84.116.254.69" # First ISP Hop
-            "185.182.244.39" # Regional Katowice Hub
-            "1.1.1.1" # Cloudflare DNS
-            "8.8.8.8" # Google DNS
-            "130.162.223.123" # OCI Instance
-          ];
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/redis.nix b/os/srv/redis.nix
deleted file mode 100644
index a51f9db..0000000
--- a/os/srv/redis.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.redis;
-in
-{
-  options.os.srv.redis.enable = lib.mkEnableOption "";
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "Required for password secure password storing";
-      }
-      {
-        assertion = config.os.core.network.enableFirewall;
-        message = "Requires firewall";
-      }
-    ];
-
-    sops.secrets."redis/password" = {
-      owner = "redis-main";
-      restartUnits = [ "redis-servers-main.service" ];
-    };
-
-    services.redis.servers."main" = {
-      enable = true;
-      bind = config.os.core.network.ips.database-vm;
-      port = 6379;
-
-      requirePassFile = config.sops.secrets."redis/password".path;
-    };
-
-    networking.firewall.extraInputRules = ''
-      ip saddr 10.0.0.0/24 tcp dport 6379 accept
-    '';
-
-  };
-}
diff --git a/os/srv/restic.nix b/os/srv/restic.nix
deleted file mode 100644
index fb2bd19..0000000
--- a/os/srv/restic.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.restic;
-in
-{
-  options.os.srv.restic.enable = lib.mkEnableOption "enables restic backups";
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-    ];
-  };
-}
diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix
deleted file mode 100644
index ffe8c39..0000000
--- a/os/srv/scrutiny.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.scrutiny;
-in
-{
-  options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring";
-  config = lib.mkIf cfg.enable {
-    services.scrutiny = {
-      enable = true;
-      settings.web.listen.host = "127.0.0.1";
-
-      collector = {
-        enable = true;
-        schedule = "hourly";
-        settings.host.id = "bibus-lab";
-      };
-    };
-
-    services.nginx.virtualHosts."scrutiny.${masterDomain}" = {
-      enableACME = true;
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:8080";
-        extraConfig = securityTemplates.restrictToInternal;
-      };
-    };
-  };
-}
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
deleted file mode 100644
index ca22192..0000000
--- a/os/srv/simplex.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.simplex;
-  internalSmpPort = 5223;
-  internalXftpPort = 5224;
-in
-{
-  options.os.srv.simplex = {
-    enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman";
-    tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX";
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        assertions = [
-          {
-            assertion = config.os.srv.oci.enable;
-            message = "SimpleX requires os.srv.oci to be enabled to run containers.";
-          }
-          {
-            assertion = config.os.srv.nginx.enable;
-            message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
-          }
-          {
-            assertion = config.os.srv.sops.enable;
-            message = "SimpleX requires sops for managing container passwords securely.";
-          }
-        ];
-
-        sops.secrets."simplex/smp-env" = { };
-        sops.secrets."simplex/xftp-env" = { };
-
-        virtualisation.oci-containers.containers = {
-          simplex-smp = {
-            image = "simplexchat/smp-server:latest";
-            ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
-
-            environment = {
-              ADDR = "smp.${masterDomain}";
-              CONFIG_DIR = "/etc/opt/simplex";
-            };
-
-            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
-
-            volumes = [
-              "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
-              "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
-              "/var/lib/simplex/certs:/certificates:ro"
-            ];
-          };
-
-          simplex-xftp = {
-            image = "simplexchat/xftp-server:latest";
-            ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
-
-            environment = {
-              ADDR = "xftp.${masterDomain}";
-              QUOTA = "10gb";
-            };
-
-            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
-            volumes = [
-              "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
-              "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
-              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
-            ];
-          };
-        };
-
-        systemd.tmpfiles.rules = [
-          "d /var/lib/simplex/smp/config 0755 root root -"
-          "d /var/lib/simplex/smp/logs 0755 root root -"
-          "d /var/lib/simplex/rsa_certs 0755 root root -"
-
-          "d /var/lib/simplex/xftp/config 0755 root root -"
-          "d /var/lib/simplex/xftp/logs 0755 root root -"
-          "d /var/lib/simplex/xftp/files 0755 root root -"
-        ];
-
-        networking.firewall.allowedTCPPorts = [
-          5223
-          5224
-        ];
-      }
-
-      (lib.mkIf cfg.tor.enable {
-        assertions = [
-          {
-            assertion = config.os.srv.tor.enable;
-            message = "SimpleX Tor support requires os.srv.tor to be enabled.";
-          }
-        ];
-
-        services.tor.relay.onionServices = {
-          simplex-smp = {
-            version = 3;
-            map = [
-              {
-                port = 5223;
-                target = {
-                  addr = "127.0.0.1";
-                  port = internalSmpPort;
-                };
-              }
-            ];
-          };
-          simplex-xftp = {
-            version = 3;
-            map = [
-              {
-                port = 5224;
-                target = {
-                  addr = "127.0.0.1";
-                  port = internalXftpPort;
-                };
-              }
-            ];
-          };
-        };
-      })
-    ]
-  );
-}
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
deleted file mode 100644
index 3ca2d16..0000000
--- a/os/srv/sops.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  username,
-  ...
-}:
-let
-  cfg = config.os.srv.sops;
-in
-{
-  imports = [ inputs.sops-nix.nixosModules.sops ];
-
-  options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix";
-  config = lib.mkIf cfg.enable {
-    sops = {
-      defaultSopsFile = ../../secrets/common.yaml;
-      defaultSopsFormat = "yaml";
-      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-      secrets = {
-        # "syncthing/gui_password".owner = username;
-        "syncthing/encryption/keepass".owner = username;
-        "syncthing/encryption/sync".owner = username;
-        "obs/websocket_password".owner = username;
-      };
-    };
-
-    environment.systemPackages = with pkgs; [
-      sops
-      age
-      ssh-to-age
-    ];
-  };
-}
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
deleted file mode 100644
index 63b2034..0000000
--- a/os/srv/ssh.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  config,
-  lib,
-  username,
-  ...
-}:
-let
-  cfg = config.os.srv.ssh;
-  keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
-in
-{
-  options.os.srv.ssh = {
-    server.enable = lib.mkEnableOption "enables the ssh server module";
-    client = {
-      enable = lib.mkEnableOption "enables the ssh client module";
-      createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts";
-    };
-    enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.server.enable {
-      services.openssh = {
-        enable = true;
-
-        listenAddresses = [
-          {
-            addr = "127.0.0.1";
-            port = 22;
-          }
-        ]
-        ++ lib.optional (config.os.core.network ? lan.ip) {
-          addr = config.os.core.network.lan.ip;
-          port = 22;
-        }
-        ++ lib.optional (config.os.core.network ? wg.ip) {
-          addr = config.os.core.network.wg.ip;
-          port = 22;
-        }
-        ++ lib.optional (config.os.core.network ? hs.ip) {
-          addr = config.os.core.network.hs.ip;
-          port = 22;
-        };
-        hostKeys = [
-          {
-            path = "/etc/ssh/ssh_host_ed25519_key";
-            type = "ed25519";
-          }
-        ];
-        settings = {
-          PasswordAuthentication = false;
-          KbdInteractiveAuthentication = false;
-          PermitRootLogin = "no";
-
-          PubkeyAcceptedAlgorithms = "ssh-ed25519";
-        };
-      };
-
-      users.users = (
-        lib.optionalAttrs (username != "" && username != null) {
-          ${username}.openssh.authorizedKeys.keys = [
-            "${keys.main} adikro@disroot.org"
-          ];
-        }
-      );
-    })
-
-    (lib.mkIf cfg.client.enable {
-      programs.ssh.startAgent = true;
-      services.gnome.gcr-ssh-agent.enable = false;
-    })
-
-    (lib.mkIf (cfg.client.enable && cfg.client.createAliases) {
-      # TODO use hjem
-      programs.ssh.extraConfig = ''
-        Host github.com codeberg.org
-          IdentityFile /home/${username}/.ssh/main_id_ed25519.pub
-          IdentitiesOnly yes
-          User git
-
-        Host oci
-          HostName 130.162.223.123
-          User opc
-      '';
-      systemd.tmpfiles.rules = [
-        "d /home/${username}/.ssh 0700 ${username} users - -"
-        "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}"
-      ];
-    })
-
-    (lib.mkIf cfg.enableSigning {
-      environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}";
-    })
-  ];
-}
diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix
deleted file mode 100644
index a347568..0000000
--- a/os/srv/sunshine.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-let
-  cfgSunshine = config.os.srv.sunshine;
-  cfgMoonlight = config.os.srv.moonlight;
-in
-{
-  options.os.srv = {
-    sunshine.enable = lib.mkEnableOption "enables sunshine streaming server";
-    moonlight.enable = lib.mkEnableOption "enables moonlight streaming client";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfgSunshine.enable {
-      services.sunshine = {
-        enable = true;
-        capSysAdmin = true;
-        openFirewall = true;
-        autoStart = false;
-      };
-
-      hardware.uinput.enable = true;
-
-      users.users.${username}.extraGroups = [
-        "video"
-        "input"
-        "render"
-      ];
-    })
-
-    (lib.mkIf cfgMoonlight.enable {
-      environment.systemPackages = [
-        pkgs.moonlight-qt
-      ];
-    })
-  ];
-}
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
deleted file mode 100644
index 0c5e53e..0000000
--- a/os/srv/syncthing.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-  config,
-  lib,
-  username,
-  ...
-}:
-let
-  cfg = config.os.srv.syncthing;
-  allFolders = {
-    "openmw-config" = {
-      path = "/home/${username}/.config/openmw";
-      id = "openmw-config";
-      devices = [ "oci" ];
-      versioning = {
-        type = "simple";
-        params.keep = "3";
-      };
-      ignorePatterns = [
-        "settings.cfg"
-        "*.log"
-      ];
-    };
-
-    "openmw-mods" = {
-      path = "/home/${username}/games/openmw";
-      id = "openmw-mods";
-      devices = [ "oci" ];
-      versioning = {
-        type = "trashcan";
-        params.cleanoutDays = "7";
-      };
-    };
-
-    "game-saves" = {
-      path = "/home/${username}/.saves";
-      id = "game-saves";
-      devices = [ "oci" ];
-      versioning = {
-        type = "staggered";
-        params = {
-          cleanInterval = "3600";
-          maxAge = "2592000";
-        };
-      };
-    };
-
-    "keepass" = {
-      path = "/home/${username}/.keepass";
-      id = "keepass";
-      devices = [
-        {
-          name = "oci";
-          encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path;
-        }
-      ];
-      versioning = {
-        type = "staggered";
-        params = {
-          cleanInterval = "3600";
-          maxAge = "31536000";
-        };
-      };
-    };
-
-    "sync" = {
-      path = "/home/${username}/sync";
-      id = "sync";
-      devices = [
-        {
-          name = "oci";
-          encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path;
-        }
-      ];
-      versioning = {
-        type = "staggered";
-        params = {
-          cleanInterval = "3600";
-          maxAge = "15552000";
-        };
-      };
-    };
-
-    "music" = {
-      path = "/storage/music";
-      id = "music";
-      devices = [ "oci" ];
-      versioning = {
-        type = "trashcan";
-        params.cleanoutDays = "14";
-      };
-    };
-  };
-  activeFoldersSet = lib.filterAttrs (name: _: builtins.elem name cfg.activeFolders) allFolders;
-
-  syncDirs = lib.mapAttrsToList (_: folder: folder.path) activeFoldersSet;
-in
-{
-  options.os.srv.syncthing = {
-    enable = lib.mkEnableOption "enables syncthing syncing";
-
-    activeFolders = lib.mkOption {
-      type = lib.types.listOf (
-        lib.types.enum [
-          "openmw-config"
-          "openmw-mods"
-          "game-saves"
-          "keepass"
-          "sync"
-          "music"
-        ]
-      );
-      default = [
-        "keepass"
-        "sync"
-      ];
-      description = "List of Syncthing folders to enable and sync on this specific machine.";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs;
-
-    services.syncthing = {
-      enable = true;
-      user = username;
-      dataDir = "/home/${username}/.local/share/syncthing";
-      configDir = "/home/${username}/.config/syncthing";
-      # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path;
-
-      settings = {
-        devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ";
-
-        folders = activeFoldersSet;
-      };
-    };
-  };
-}
diff --git a/os/srv/tailscale.nix b/os/srv/tailscale.nix
deleted file mode 100644
index 5c8d72e..0000000
--- a/os/srv/tailscale.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.tailscale;
-in
-{
-  options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
-
-  config = lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      openFirewall = true;
-      useRoutingFeatures = "client";
-    };
-    networking.firewall = {
-      trustedInterfaces = [ "tailscale0" ];
-      checkReversePath = "loose";
-    };
-  };
-}
diff --git a/os/srv/tor.nix b/os/srv/tor.nix
deleted file mode 100644
index 8777fba..0000000
--- a/os/srv/tor.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.tor;
-in
-{
-  options.os.srv.tor = {
-    enable = lib.mkEnableOption "enables tor services";
-    enableBrowser = lib.mkEnableOption "enables the tor browser";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      services.tor = {
-        enable = true;
-        client = {
-          enable = true;
-          dns.enable = true;
-          transparentProxy.enable = true;
-        };
-      };
-    })
-    (lib.mkIf cfg.enableBrowser {
-      environment.systemPackages = [ pkgs.tor-browser ];
-    })
-  ];
-}
diff --git a/os/srv/ups.nix b/os/srv/ups.nix
deleted file mode 100644
index 260f346..0000000
--- a/os/srv/ups.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.ups;
-in
-{
-  options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss";
-  config = lib.mkIf cfg.enable {
-    power.ups = {
-      enable = true;
-      mode = "standalone";
-
-      ups.main = {
-        driver = "usbhid-ups";
-        port = "auto";
-        description = "Main Server UPS";
-      };
-      users.upsmon = {
-        # TODO make password
-        passwordFile = "sops";
-        upsmon = "master";
-      };
-      upsmon.monitor.main = {
-        system = "main@localhost";
-        user = "upsmon";
-        # TODO password
-        passwordFile = "sops";
-        type = "master";
-      };
-      # settings = {
-      #   MINSUPPLIES = 1;
-      #   POWERDOWNFLAG = "/run/killpower";
-      # };
-    };
-  };
-}
diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix
deleted file mode 100644
index 7bf8dd0..0000000
--- a/os/srv/uptime-kuma.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.uptime-kuma;
-in
-{
-  options.os.srv.uptime-kuma = {
-    enable = lib.mkEnableOption "enables uptime-kuma";
-    proxyConfig = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.uptime-kuma = {
-      enable = true;
-      appriseSupport = true;
-      settings = {
-        HOST = "127.0.0.1";
-        UPTIME_KUMA_DB_TYPE = "sqlite";
-      };
-    };
-
-    os.srv.uptime-kuma.proxyConfig = {
-      "uptime-kuma.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001";
-          extraConfig = securityTemplates.restrictToInternal;
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/vector.nix b/os/srv/vector.nix
deleted file mode 100644
index a216a19..0000000
--- a/os/srv/vector.nix
+++ /dev/null
@@ -1,79 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.srv.vector;
-in
-{
-  options.os.srv.vector = {
-    enable = lib.mkEnableOption "Vector observability data framework";
-    agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream";
-    aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.vector = {
-      enable = true;
-      journaldAccess = lib.mkIf cfg.agent.enable true;
-      validateConfig = true;
-
-      settings = lib.mkMerge [
-        (lib.mkIf cfg.agent.enable {
-          sources.systemd_journal = {
-            type = "journald";
-            exclude_units = [ "vector.service" ];
-          };
-
-          transforms.filter_logs = {
-            type = "filter";
-            inputs = [ "systemd_journal" ];
-            condition = ''.status != "debug" && .status != "trace"'';
-          };
-
-          sinks.to_aggregator = {
-            type = "vector";
-            inputs = [ "filter_logs" ];
-            address = "${config.os.core.network.ips.vm3-monitor}:9000";
-          };
-        })
-
-        (lib.mkIf cfg.aggregator.enable {
-          sources.upstream_agents = {
-            type = "vector";
-            address = "0.0.0.0:9000";
-            version = "2";
-          };
-
-          sources.opnsense_syslog = {
-            type = "syslog";
-            address = "${cfg.aggregator.listenAddress}:5140";
-            mode = "udp";
-          };
-
-          sinks.loki_backend = {
-            type = "loki";
-            inputs = [
-              "upstream_agents"
-              "opnsense_syslog"
-            ];
-            endpoint = "http://127.0.0.1:3100";
-            labels = {
-              host = "{{ host }}";
-              unit = "{{`{{_SYSTEMD_UNIT}}`}}";
-              source_type = "{{ type }}";
-            };
-            buffer = {
-              type = "disk";
-              max_size = 5 * (1024 * 1024 * 1024);
-              when_full = "block";
-            };
-          };
-          encoding.codec = "json";
-        })
-      ];
-    };
-
-    networking.firewall = lib.mkIf cfg.aggregator.enable {
-      allowedTCPPorts = [ 9000 ];
-      allowedUDPPorts = [ 5140 ];
-    };
-  };
-}
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
deleted file mode 100644
index 8ff9f3f..0000000
--- a/os/srv/virtualization.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.virtualization;
-in
-{
-  options.os.srv.virtualization = {
-    kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
-    waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
-  };
-  config = lib.mkMerge [
-    (lib.mkIf cfg.kvm.enable {
-      virtualisation.libvirtd = {
-        enable = true;
-        qemu.package = pkgs.qemu_kvm;
-        qemu.swtpm.enable = true;
-      };
-      systemd.services.libvirt-guests.enable = false;
-      programs.virt-manager.enable = true;
-
-      boot.initrd.kernelModules =
-        (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
-        ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
-    })
-    (lib.mkIf cfg.waydroid.enable {
-      virtualisation.waydroid = {
-        enable = true;
-        package = pkgs.waydroid-nftables;
-      };
-
-      environment.systemPackages = with pkgs; [
-        waydroid-helper
-      ];
-    })
-  ];
-}
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
deleted file mode 100644
index c758174..0000000
--- a/os/srv/wireguard.nix
+++ /dev/null
@@ -1,152 +0,0 @@
-{
-  config,
-  lib,
-  hostname,
-  masterDomain,
-  ...
-}:
-let
-  cfg = config.os.srv.wireguard;
-in
-{
-  options.os.srv.wireguard = {
-    enable = lib.mkEnableOption "enables wireguard vpn";
-
-    role = lib.mkOption {
-      type = lib.types.enum [
-        "server"
-        "client"
-      ];
-      default = "client";
-      description = "where the machine is accepting connections or connecting";
-    };
-
-    server = {
-      externalInterface = lib.mkOption {
-        type = lib.types.str;
-        default = "eth0";
-        description = "The public WAN interface of the server";
-      };
-      publicKey = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "The public key of your primary WireGuard server node.";
-      };
-
-      peers = lib.mkOption {
-        type = lib.types.listOf (
-          lib.types.submodule {
-            options = {
-              name = lib.mkOption { type = lib.types.str; };
-              publicKey = lib.mkOption { type = lib.types.str; };
-            };
-          }
-        );
-        default = [ ];
-        description = "List of client peers authorized to connect to this server";
-      };
-    };
-
-    client = {
-      index = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "The assigned host index number for the client IP address";
-      };
-
-      routeAllTraffic = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Routes 100% of your internet traffic through the server when active";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        assertions = [
-          {
-            assertion = config.os.srv.sops.enable;
-            message = "required for wg private key";
-          }
-        ];
-
-        sops.secrets."wg_private_key/${hostname}" = {
-          owner = "root";
-          group = "root";
-          mode = "0600";
-        };
-      }
-
-      (lib.mkIf (cfg.role == "server") {
-        assertions = [
-          {
-            assertion = config.os.srv.firewall.enable;
-            message = "required for opening ports and passthrough";
-          }
-        ];
-        boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-        networking.firewall.allowedUDPPorts = [ 51280 ];
-
-        networking.nftables = {
-          tables.wg-nat = {
-            family = "inet";
-            content = ''
-              chain forward {
-                type filter hook forward priority 0; policy accept;
-                iifname "wg0" accept
-                oifname "wg0" accept
-              }
-              chain postrouting {
-                type nat hook postrouting priority 100; policy accept;
-                oifname "${cfg.server.externalInterface}" masquerade
-              }
-            '';
-          };
-        };
-
-        networking.wireguard.interfaces.wg0 = {
-          ips = [ "10.3.0.1/24" ];
-          listenPort = 51280;
-          privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
-
-          peers = lib.imap1 (i: peer: {
-            publicKey = peer.publicKey;
-            allowedIPs = [ "10.3.0.${toString (i + 1)}/32" ];
-            persistentKeepalive = 25;
-          }) cfg.server.peers;
-        };
-      })
-
-      (lib.mkIf (cfg.role == "client") {
-        assertions = [
-          {
-            assertion = cfg.client.index != null;
-            message = "WireGuard client role requires a valid 'client.index' integer designation.";
-          }
-        ];
-
-        networking.nameservers = [
-          config.os.core.network.ips.vm2-gateway
-          "9.9.9.9"
-        ];
-
-        networking.wireguard.interfaces.wg0 = {
-          ips = [ "10.3.0.${toString cfg.client.index + 1}/24" ];
-          privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
-
-          peers = [
-            {
-              publicKey = cfg.server.publicKey;
-              endpoint = "${masterDomain}:51280";
-              persistentKeepalive = 25;
-
-              allowedIPs = if cfg.client.routeAllTraffic then [ "0.0.0.0/0" ] else [ "10.255.0.0/16" ];
-            }
-          ];
-        };
-      })
-    ]
-  );
-}
diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix
deleted file mode 100644
index 6fe91af..0000000
--- a/os/srv/yggdrasil.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.os.srv.yggdrasil;
-in
-{
-  options.os.srv.yggdrasil.enable = lib.mkEnableOption "enables yggdrasil";
-
-  config = lib.mkIf cfg.enable {
-    services = {
-      yggdrasil = {
-        enable = true;
-        openMulticastPort = true;
-
-        settings = {
-          # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path;
-          IfName = "ygg0";
-          NodeInfoPrivacy = true;
-          Peers = [
-            "tcp://ip6.fvm.mywire.org:8080?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217"
-            "tcp://ygg1.mk16.de:1337?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
-            "tcp://62.210.85.80:39565"
-
-            "tls://ygg1.mk16.de:1338?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
-            "tls://103.109.234.106:443?key=000000035621c71b5610434589df051aed2688510f904ae79860668dc0fbf182"
-            "tls://s2.i2pd.xyz:39575"
-
-            "quic://ygg1.mk16.de:1339?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a"
-            "quic://ygg6.mk16.de:1339?key=0000005e5ced06fd4d465bc651c5deb6d70cbe82d36efb68c0450268eaaa5384"
-            "quic://[2a0b:4142:e9e::2]:65535"
-          ];
-          Listen = [
-            "tls://0.0.0.0:0"
-            "tcp://[::]:9001"
-          ];
-        };
-      };
-      yggdrasil-jumper.enable = true;
-    };
-  };
-}
diff --git a/os/vms/microvms.nix b/os/vms/microvms.nix
deleted file mode 100644
index e2e1a0f..0000000
--- a/os/vms/microvms.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-let
-  cfg = config.os.vms;
-  sharedSecrets = [
-    {
-      tag = "shared-secrets";
-      proto = "virtiofs";
-      source = "/etc/nixos/secrets";
-      mountPoint = "/etc/nixos/secrets";
-    }
-  ];
-in
-{
-  imports = [ inputs.microvm.nixosModules.host ];
-
-  options.os.vms = {
-    net-core.enable = lib.mkEnableOption "enables the net-core virtual machine";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.net-core.enable {
-      microvm.vms.net-core = {
-        autostart = true;
-        config = {
-          imports = [ ../vms/net-core.nix ];
-          microvm.shares = sharedSecrets;
-        };
-      };
-    })
-
-  ];
-}
diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix
deleted file mode 100644
index a9a1c47..0000000
--- a/os/vms/net-core.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ pkgs, inputs, ... }:
-{
-  system.stateVersion = "26.11";
-
-  imports = [
-    inputs.microvm.nixosModules.microvm
-    ../core/default.nix
-  ];
-
-  os = {
-    core = {
-      allowUnfree.enable = true;
-      locale.enable = true;
-    };
-    srv = {
-      ssh = {
-        server = {
-          enable = true;
-          microvm = true;
-        };
-      };
-      firewall.enable = true;
-      sops.enable = true;
-    };
-  };
-
-  networking.hostName = "net-core";
-
-  environment.systemPackages = [ pkgs.vis ];
-}
diff --git a/os/vms/opnsense.nix b/os/vms/opnsense.nix
deleted file mode 100644
index b9f2978..0000000
--- a/os/vms/opnsense.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-let
-  cfg = config.os.srv.opnsense;
-  makePciArgs =
-    ids:
-    builtins.concatLists (
-      map (id: [
-        "-device"
-        "vfio-pci,host=${id},rombar=0"
-      ]) ids
-    );
-in
-{
-  imports = [ inputs.microvm.nixosModules.host ];
-
-  options.os.srv.opnsense = {
-    enable = lib.mkEnableOption "enables an opnsense microvm";
-
-    pciIDs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "03:00.0"
-        "03:00.1"
-      ];
-      description = "List of PCI bus addresses to pass through directly to OPNsense.";
-    };
-
-    vendorIDs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [ "8086:1563" ];
-      description = "List of Vendor:Device IDs to bind explicitly to the vfio-pci driver.";
-    };
-
-    imagePath = lib.mkOption {
-      type = lib.types.path;
-      default = /var/lib/microvm/images/opnsense.qcow2;
-      description = "Path to the OPNsense qcow2 drive image block.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    boot = {
-      kernelParams = [
-        "intel_iommu=on"
-        "iommu=pt"
-      ];
-      kernelModules = [
-        "vfio_pci"
-        "vfio"
-        "vfio_iommu_type1"
-      ];
-      extraModprobeConfig = ''
-        options vfio-pci ids=${lib.concatStringsSep "," (lib.unique cfg.vendorIDs)}
-      '';
-    };
-
-    microvm.vms.opnsense = {
-      autostart = true;
-      config = {
-        imports = [ inputs.microvm.nixosModules.microvm ];
-
-        networking.hostName = "opnsense";
-
-        microvm = {
-          vcpu = 4;
-          mem = 4096;
-          hypervisor = "qemu";
-
-          interfaces = [
-            {
-              type = "bridge";
-              id = "vtnet0";
-              bridge = "br-srv";
-            }
-          ];
-
-          qemu.extraArgs = [
-            "-machine"
-            "q35,accel=kvm,kernel-irqchip=on"
-            "-cpu"
-            "host,migratable=off,+invtsc"
-          ]
-          ++ (makePciArgs cfg.pciIDs);
-        };
-      };
-    };
-  };
-}
diff --git a/os/wm/default.nix b/os/wm/default.nix
deleted file mode 100644
index a470171..0000000
--- a/os/wm/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.wm;
-in
-{
-  imports = [ ./niri.nix ];
-
-  options.os.wm.enable = lib.mkEnableOption "enables shared wm features";
-
-  config = lib.mkIf cfg.enable {
-    services.dbus.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      xdgOpenUsePortal = true;
-
-      extraPortals = [
-        pkgs.xdg-desktop-portal-gnome
-        pkgs.xdg-desktop-portal-gtk
-      ];
-
-      config = {
-        common.default = [ "gtk" ];
-        niri = {
-          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
-          "org.freedesktop.impl.portal.Screenshot" = [ "gnome" ];
-          "default" = [ "gtk" ];
-        };
-      };
-    };
-  };
-}
diff --git a/os/wm/niri.nix b/os/wm/niri.nix
deleted file mode 100644
index 58d27af..0000000
--- a/os/wm/niri.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  inputs,
-  config,
-  lib,
-  username,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.wm.niri;
-in
-{
-  imports = [ inputs.niri.nixosModules.niri ];
-
-  options.os.wm.niri.enable = lib.mkEnableOption "Niri";
-
-  config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [ inputs.niri.overlays.niri ];
-
-    programs.niri = {
-      enable = true;
-      package = pkgs.niri-unstable;
-    };
-
-    os.srv.compat.enable = true;
-    home-manager.users.${username}.hm.env.niri.enable = true;
-  };
-}