something is seriously broken rn

27 files changed, 237 insertions, 343 deletions

diff --git a/flake.lock b/flake.lock
index b0bd35a..fe0cf9e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -199,7 +199,7 @@
     "geolite-db": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-5eN2/D67TBIgV5dMW9YkfLSxFU+3cpr9y/Jmye95S9k=",
+        "narHash": "sha256-//69KnJRLfYmlS9MATxnuHrj2zvHirpA+zmORSGItho=",
         "type": "file",
         "url": "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb"
       },
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index 08a779b..06ca720 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -36,6 +36,11 @@
     };
   };
 
+  # merge logs from subdomains
+  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
+    output file /var/log/caddy/access-williamsfam.us.com.log
+  '';
+
   collinux.services.glance.homelabServices."website" = {
     url = "https://williamsfam.us.com";
     icon = "mdi:web";
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index ed397ef..92eddee 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -28,19 +28,6 @@
       };
     };
 
-    system.network = {
-      dns.areYouAServer = true;
-      static = {
-        ip = "192.168.50.2/24";
-        gateway = "192.168.50.1";
-      };
-
-      wireless.static = {
-        ssid = "williams";
-        pskFile = config.collinux.secrets."williams-psk".path;
-      };
-    };
-
     services = {
       sshd.enable = true; # :22
       minecraft.enable = true; # :19132
diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix
new file mode 100644
index 0000000..082068c
--- /dev/null
+++ b/hosts/ganymede/networking.nix
@@ -0,0 +1,80 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  static = {
+    ssid = "williams";
+    pskFile = config.collinux.secrets."williams-psk".path;
+    ip = "192.168.50.2/24";
+    gateway = "192.168.50.1";
+  };
+in {
+  networking = {
+    dhcpcd.enable = false;
+    useDHCP = false;
+    networkmanager.enable = false;
+
+    useNetworkd = true;
+
+    firewall = {
+      enable = true;
+      checkReversePath = "loose";
+    };
+
+    resolvconf.enable = true;
+    nameservers = ["127.0.0.1"];
+
+    wireless = {
+      enable = true;
+      networks.${static.ssid}.pskRaw = "ext:psk";
+      secretsFile = static.pskFile;
+    };
+  };
+  systemd = {
+    services."disable-wifi-powersave" = {
+      description = "Disable wifi powersaving using iw";
+      after = ["network.target"];
+      serviceConfig.ExecStart = "${lib.getExe pkgs.iw} dev wlp108s0 set power_save off";
+      wantedBy = ["default.target"];
+    };
+
+    network = {
+      enable = true;
+      wait-online = {
+        enable = true;
+        anyInterface = true;
+      };
+
+      networks."11-default" = {
+        name = "wl*";
+        networkConfig = {
+          Address = static.ip;
+          Gateway = static.gateway;
+          DHCP = "no";
+        };
+      };
+    };
+  };
+
+  services = {
+    resolved.enable = false;
+
+    unbound = {
+      enable = true;
+      settings.server = {
+        interface = ["0.0.0.0"];
+        port = 53;
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.100.0.0/24 allow"
+          "0.0.0.0/0 refuse"
+        ];
+
+        local-zone = [''"ganymede." redirect''];
+        local-data = [''"ganymede. IN A 10.100.0.1"''];
+      };
+    };
+  };
+}
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 873cd2f..314b72a 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,31 +1,15 @@
-{
-  config,
-  pkgs,
-  lib,
-  inputs,
-  ...
-}: {
+{inputs, ...}: {
   imports = [
     inputs.disko.nixosModules.disko
     inputs.nixos-facter-modules.nixosModules.facter
     ./disks.nix
     ./caddy.nix
+
+    ./networking.nix
     ./wireguard.nix
   ];
 
   facter.reportPath = ./facter.json;
 
-  systemd.services."disable-wifi-powersave" = {
-    description = "Disable wifi powersaving using iw";
-    after = ["network.target"];
-    serviceConfig.ExecStart = "${pkgs.iw}/bin/iw dev wlp108s0 set power_save off";
-    wantedBy = ["default.target"];
-  };
-
   services.fail2ban.enable = true;
-
-  # merge logs from subdomains
-  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
-    output file /var/log/caddy/access-williamsfam.us.com.log
-  '';
 }
diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index de7afb5..3c3f1d6 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -2,6 +2,7 @@
   config,
   hosts,
   pkgs,
+  lib,
   ...
 }: {
   environment.systemPackages = [pkgs.wireguard-tools];
@@ -10,19 +11,36 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
-    trustedInterfaces = ["wg0"]; # bypass firewall inside wireguard
+    allowedTCPPorts = [51843];
+
+    trustedInterfaces = ["wg0"];
+  };
+
+  systemd.services.udp2raw-server = {
+    description = "udp2raw WireGuard transport";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
   };
 
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = "1300";
+      MTUBytes = 1200;
     };
+
     wireguardConfig = {
       PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
       ListenPort = 51820;
     };
+
     wireguardPeers = [
       {
         PublicKey = hosts.mercury.wg_pubkey;
@@ -34,9 +52,12 @@
       }
     ];
   };
+
   systemd.network.networks."wg0" = {
     matchConfig.Name = "wg0";
+
     address = ["${hosts.ganymede.wg_ip}/24"];
+
     networkConfig = {
       IPMasquerade = "ipv4";
       IPv4Forwarding = true;
diff --git a/hosts/mercury/battery.nix b/hosts/mercury/battery.nix
index 0aaa3cd..24de65b 100644
--- a/hosts/mercury/battery.nix
+++ b/hosts/mercury/battery.nix
@@ -1,4 +1,4 @@
-{...}: {
+{pkgs, ...}: {
   # auto-cpufreq
   services.power-profiles-daemon.enable = false; # conflicts with auto-cpufreq
   services.tlp.enable = false; # conflicts with auto-cpufreq
@@ -20,28 +20,28 @@
   };
 
   # Undervolt (BROKEN)
-  # services.undervolt = {
-  #   enable = true;
-  #   useTimer = false;
-  #   # power-limit-long
-  #   p1 = {
-  #     window = 1; # no clue what this means
-  #     limit = 40;
-  #   };
+  services.undervolt = {
+    enable = true;
+    useTimer = false;
+    # power-limit-long
+    p1 = {
+      window = 1; # no clue what this means
+      limit = 40;
+    };
 
-  #   # power-limit-short
-  #   p2 = {
-  #     window = 1;
-  #     limit = 50;
-  #   };
+    # power-limit-short
+    p2 = {
+      window = 1;
+      limit = 50;
+    };
 
-  #   coreOffset = -50; # also applied to cache
-  #   gpuOffset = -10;
-  # };
+    coreOffset = -50; # also applied to cache
+    gpuOffset = -10;
+  };
 
-  # environment.systemPackages = with pkgs; [
-  #   undervolt
-  #   s-tui
-  #   stress
-  # ];
+  environment.systemPackages = with pkgs; [
+    undervolt
+    s-tui
+    stress
+  ];
 }
diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index ef383d7..923f7ff 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -1,4 +1,8 @@
-{config, ...}: {
+{
+  config,
+  pkgs,
+  ...
+}: {
   collinux = {
     theme = "catppuccin";
 
@@ -12,30 +16,25 @@
     user.useRun0 = true;
 
     desktop = {
-      wallpaper =
-        if (config.collinux.theme == "catppuccin")
-        then ./wallpapers/astronaut.jpg
-        else ./wallpapers/hintergrund2.png;
+      wallpaper = "${pkgs.gnome-backgrounds}/share/backgrounds/gnome/blobs-d.svg";
+
       gtk.enable = true;
       qt.enable = true;
 
       greetd = {
         enable = true;
         autologin.enable = true;
-        # cosmic-greeter.enable = true;
       };
 
       wm = {
         niri.enable = true;
         kdeDesktopPortal.enable = true;
-
         components.fuzzel.enable = true; # noctalia launcher SUCKS
       };
 
       programs = {
         firefox.enable = true;
         research.enable = true;
-
         foot.enable = true;
       };
     };
@@ -47,7 +46,7 @@
         secureBoot.enable = true;
       };
 
-      network.wireless.dynamic = true;
+      # network.wireless.dynamic = true;
 
       audio.enable = true;
       bluetooth.enable = true;
diff --git a/hosts/mercury/mercury-wg-key.age b/hosts/mercury/mercury-wg-key.age
deleted file mode 100644
index 397f99c..0000000
--- a/hosts/mercury/mercury-wg-key.age
+++ /dev/null
@@ -1,6 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 azBilg t589gal+hWbEiNH9vFQFb94UU2ElhLUwBpSg+6516wg
-ZmRj3LLDctDPpDKGg3HvI4r7Ex6Sf0ERcPJlqUJXv0w
---- IpOHjk3TkNRT8aW1ocgCie/ljv/sWWFRuaYGhxlf948
-0��:��,̅��������;ǛTɿ��NR���Akll�
D�����:�5%�{���.��
-V8��Ƀ�8nBR��
\ No newline at end of file
diff --git a/hosts/mercury/networking.nix b/hosts/mercury/networking.nix
new file mode 100644
index 0000000..cc1f995
--- /dev/null
+++ b/hosts/mercury/networking.nix
@@ -0,0 +1,42 @@
+{
+  networking = {
+    useDHCP = false;
+    networkmanager.enable = false;
+    dhcpcd.enable = false;
+    resolvconf.enable = false;
+
+    useNetworkd = true; # tells other services that we're using networkd (ex. tailscale)
+
+    wireless.iwd = {
+      enable = true;
+      settings = {
+        General.EnableNetworkConfiguration = false; # delegate to networkd
+        Network.NameResolvingService = "systemd"; # delegate to systemd-resolved
+      };
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+
+    networks."11-default" = {
+      name = "wl*";
+      networkConfig.DHCP = "yes";
+
+      # never accept dhcp dns
+      # dhcpV4Config.UseDNS = "no";
+      # dhcpV6Config.UseDNS = "no";
+    };
+  };
+
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      # DNSOverTLS = true;
+      # DNSSEC = "allow-downgrade";
+
+      # LLMNR = false;
+      # MulticastDNS = false;
+    };
+  };
+}
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 5937aeb..4fe5756 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -4,6 +4,7 @@
     ./battery.nix
 
     ./wireguard.nix
+    ./networking.nix
 
     inputs.nixos-facter-modules.nixosModules.facter
     inputs.lanzaboote.nixosModules.lanzaboote
diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix
index 627e649..105d10b 100644
--- a/hosts/mercury/wireguard.nix
+++ b/hosts/mercury/wireguard.nix
@@ -2,15 +2,29 @@
   config,
   hosts,
   pkgs,
+  lib,
   ...
 }: {
   environment.systemPackages = [pkgs.wireguard-tools];
 
+  systemd.services.udp2raw-client = {
+    description = "udp2raw WireGuard transport";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -c -l 127.0.0.1:51820 -r 70.130.121.193:51843 -k shared-secret -a";
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
+  };
+
   systemd.network.netdevs."10-wg" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = "1300";
+      MTUBytes = 1200;
     };
     wireguardConfig = {
       PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
@@ -20,7 +34,7 @@
       {
         PublicKey = hosts.ganymede.wg_pubkey;
         AllowedIPs = ["10.100.0.0/24"];
-        Endpoint = "williamsfam.us.com:51820";
+        Endpoint = "127.0.0.1:51820";
       }
     ];
   };
diff --git a/modules/desktop/hjem/programs/foot.nix b/modules/desktop/hjem/programs/foot.nix
index 74bb8a6..988ee94 100644
--- a/modules/desktop/hjem/programs/foot.nix
+++ b/modules/desktop/hjem/programs/foot.nix
@@ -9,10 +9,11 @@
   settings = {
     main = {
       font = "Iosevka Nerd Font:size=12";
-      shell = "fish -c '${pkgs.broot}/bin/broot'";
+      # shell = "fish -c '${pkgs.broot}/bin/broot'";
+      shell = lib.getExe pkgs.fish;
     };
 
-    # key-bindings.spawn-terminal = "Control+Return";
+    key-bindings.spawn-terminal = "Control+Return";
 
     colors-dark = with config.collinux.palette; {
       alpha = "0.85";
diff --git a/modules/desktop/nixos/gnome.nix b/modules/desktop/nixos/gnome.nix
index 335815a..8736991 100644
--- a/modules/desktop/nixos/gnome.nix
+++ b/modules/desktop/nixos/gnome.nix
@@ -5,18 +5,21 @@
   ...
 }: let
   cfg = config.collinux.desktop.gnome;
+
+  shellExtensions = with pkgs.gnomeExtensions; [blur-my-shell dash-to-dock];
 in
   lib.mkIf cfg.enable {
-    services.desktopManager.gnome.enable = true;
-
-    services.gnome.gcr-ssh-agent.enable = false; # conflicts with normal ssh-agent
+    services = {
+      desktopManager.gnome.enable = true;
+      gnome.gcr-ssh-agent.enable = false; # conflicts with normal ssh-agent
+    };
 
     environment.gnome.excludePackages = with pkgs; [
       orca
       evince
       # file-roller
       geary
-      # gnome-disk-utility
+      gnome-disk-utility
       seahorse
       # sushi
       # sysprof
@@ -33,23 +36,23 @@ in
       # glib # for gsettings program
       # gnome-menus
       # gtk3.out # for gtk-launch program
-      # xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
-      # xdg-user-dirs-gtk # Used to create the default bookmarks
-      #
+      xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
+      xdg-user-dirs-gtk # Used to create the default bookmarks
+
       baobab
       epiphany
       gnome-text-editor
       gnome-calculator
       gnome-calendar
       gnome-characters
-      # gnome-clocks
+      gnome-clocks
       gnome-console
       gnome-contacts
       gnome-font-viewer
       gnome-logs
       gnome-maps
       gnome-music
-      # gnome-system-monitor
+      gnome-system-monitor
       gnome-weather
       # loupe
       # nautilus
@@ -61,7 +64,7 @@ in
       gnome-software
     ];
 
-    hjem.users."${config.collinux.user.name}".packages = with pkgs.gnomeExtensions; [blur-my-shell dash-to-dock] ++ [pkgs.wl-clipboard];
+    environment.systemPackages = shellExtensions ++ [pkgs.wl-clipboard];
 
     programs.dconf = {
       enable = true;
@@ -103,17 +106,14 @@ in
 
             # Background
             "org/gnome/desktop/background" = rec {
-              picture-uri = "file://${pkgs.gnome-backgrounds}/share/backgrounds/gnome/blobs-d.svg";
+              picture-uri = "file://${config.collinux.desktop.wallpaper}";
               picture-uri-dark = picture-uri;
             };
 
             # Extensions
             "org/gnome/shell" = {
               disable-user-extensions = false;
-              enabled-extensions = with pkgs.gnomeExtensions; [
-                blur-my-shell.extensionUuid
-                dash-to-dock.extensionUuid
-              ];
+              enabled-extensions = shellExtensions |> map (x: x.extensionUuid);
             };
 
             "org/gnome/shell/extensions/dash-to-dock" = {
diff --git a/modules/desktop/nixos/greeters/gdm.nix b/modules/desktop/nixos/greeters/gdm.nix
index 598114a..fae4eba 100644
--- a/modules/desktop/nixos/greeters/gdm.nix
+++ b/modules/desktop/nixos/greeters/gdm.nix
@@ -6,8 +6,5 @@
   cfg = config.collinux.desktop.gdm;
 in
   lib.mkIf cfg.enable {
-    services.displayManager.gdm = {
-      enable = true;
-      wayland = true;
-    };
+    services.displayManager.gdm.enable = true;
   }
diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix
index 8267857..30a74b4 100644
--- a/modules/desktop/nixos/programs/firefox.nix
+++ b/modules/desktop/nixos/programs/firefox.nix
@@ -24,21 +24,20 @@ in
         OverridePostUpdatePage = "";
 
         SearchEngines.Default = "DuckDuckGo";
-        Homepage = {
-          URL = "https://home.ganymede";
-          Locked = true;
-          StartPage = "homepage-locked";
-        };
+        # Homepage = {
+        #   URL = "https://home.ganymede";
+        #   Locked = true;
+        #   StartPage = "homepage-locked";
+        # };
 
-        AIControls = {
-          Default = {
-            Value = "blocked";
-            Locked = true;
-          };
-          Translations = {
-            Value = "available";
+        AIControls = let
+          opt = Value: {
+            inherit Value;
             Locked = true;
           };
+        in {
+          Default = opt "blocked";
+          Translations = opt "available";
         };
 
         Preferences = let
@@ -54,7 +53,7 @@ in
 
           "browser.theme.content-theme" = opt 0;
           "browser.theme.toolbar-theme" = opt 0;
-          "browser.display.background_color.dark" = opt "${config.collinux.palette.base00}";
+          "browser.display.background_color.dark" = opt config.collinux.palette.base00;
 
           "browser.tabs.loadBookmarksInTabs" = opt true;
           "browser.toolbars.bookmarks.visibility" = opt "never";
diff --git a/modules/desktop/nixos/qt.nix b/modules/desktop/nixos/qt.nix
index 5f5c630..712c0af 100644
--- a/modules/desktop/nixos/qt.nix
+++ b/modules/desktop/nixos/qt.nix
@@ -39,13 +39,6 @@ in
       KVANTUM_THEME = "catppuccin-mocha-blue";
     };
 
-    systemd.user.extraConfig = lib.optionalString isCatppuccin ''
-      DefaultEnvironment=KVANTUM_THEME=catppuccin-mocha-blue
-      DefaultEnvironment=QT_STYLE_OVERRIDE=kvantum
-      DefaultEnvironment=QT_QPA_PLATFORMTHEME=kde
-      DefaultEnvironment=KDE_COLOR_SCHEME=CatppuccinMochaBlue
-    '';
-
     systemd.user.services.plasma-xdg-desktop-portal-kde = lib.mkIf isCatppuccin {
       overrideStrategy = "asDropin";
       serviceConfig.Environment = [
diff --git a/modules/networking/nixos/default.nix b/modules/networking/nixos/default.nix
deleted file mode 100644
index f869670..0000000
--- a/modules/networking/nixos/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  imports = [
-    ./resolved.nix
-    ./unbound.nix
-    ./networkd.nix
-    ./iwd.nix
-    ./wpasupplicant.nix
-  ];
-
-  networking = {
-    firewall = {
-      enable = true;
-      checkReversePath = "loose";
-    };
-
-    # Disable default networking stuff
-    resolvconf.enable = false;
-    dhcpcd.enable = false;
-    useDHCP = false;
-    networkmanager.enable = false;
-  };
-}
diff --git a/modules/networking/nixos/iwd.nix b/modules/networking/nixos/iwd.nix
deleted file mode 100644
index 0c5bdfa..0000000
--- a/modules/networking/nixos/iwd.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.system.network;
-  enabled = cfg.wireless.dynamic;
-in
-  lib.mkIf enabled {
-    networking = {
-      wireless.iwd = {
-        enable = true;
-        settings = {
-          General = {
-            EnableNetworkConfiguration = false; # always let networkd handle this
-            AddressRandomization = "once";
-            AddressRandomizationRange = "full";
-          };
-          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
-        };
-      };
-    };
-  }
diff --git a/modules/networking/nixos/networkd.nix b/modules/networking/nixos/networkd.nix
deleted file mode 100644
index 2c7f580..0000000
--- a/modules/networking/nixos/networkd.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  # lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.system.network;
-  dhcp_enabled = cfg.static == null;
-
-  device =
-    if (cfg.wireless == null)
-    then "eth0"
-    else "wl*";
-in {
-  networking.useNetworkd = true;
-  systemd.network = {
-    enable = true;
-
-    wait-online = {
-      enable = true;
-      ignoredInterfaces = ["docker0"];
-      anyInterface = true;
-    };
-
-    networks."11-default" =
-      if dhcp_enabled
-      then {
-        name = device;
-        networkConfig.DHCP = "yes";
-
-        # never accept dhcp dns
-        dhcpV4Config.UseDNS = "no";
-        dhcpV6Config.UseDNS = "no";
-      }
-      else {
-        name = device;
-        networkConfig = {
-          Address = cfg.static.ip;
-          Gateway = cfg.static.gateway;
-          DHCP = "no";
-          # DNS is managed by systemd-resolved (not specified here)
-        };
-      };
-  };
-}
diff --git a/modules/networking/nixos/resolved.nix b/modules/networking/nixos/resolved.nix
deleted file mode 100644
index 01e75e2..0000000
--- a/modules/networking/nixos/resolved.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.system.network.dns;
-in
-  lib.mkIf (!cfg.areYouAServer) {
-    networking.nameservers = [
-      "9.9.9.9#dns.quad9.net"
-      "149.112.112.112#dns.quad9.net"
-    ];
-
-    services.resolved = {
-      enable = true;
-      settings.Resolve = {
-        DNSOverTLS = true;
-        DNSSEC = "allow-downgrade";
-
-        LLMNR = false;
-        MulticastDNS = false;
-      };
-    };
-  }
diff --git a/modules/networking/nixos/unbound.nix b/modules/networking/nixos/unbound.nix
deleted file mode 100644
index b8b1e0b..0000000
--- a/modules/networking/nixos/unbound.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.system.network.dns;
-in
-  lib.mkIf cfg.areYouAServer {
-    networking = {
-      nameservers = ["127.0.0.1"];
-      resolvconf.enable = lib.mkForce true; # we disabled this earlier
-    };
-    services.resolved.enable = false;
-
-    services.unbound = {
-      enable = true;
-      settings.server = {
-        interface = ["0.0.0.0"];
-        port = 53;
-        access-control = [
-          "127.0.0.0/8 allow"
-          "10.100.0.0/24 allow"
-          "0.0.0.0/0 refuse"
-        ];
-
-        local-zone = [''"ganymede." redirect''];
-        local-data = [''"ganymede. IN A 10.100.0.1"''];
-      };
-    };
-  }
diff --git a/modules/networking/nixos/wpasupplicant.nix b/modules/networking/nixos/wpasupplicant.nix
deleted file mode 100644
index 8314095..0000000
--- a/modules/networking/nixos/wpasupplicant.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.system.network.wireless;
-  enabled = cfg.static != null;
-in
-  lib.mkIf enabled {
-    networking.wireless = {
-      enable = true;
-      networks.${cfg.static.ssid}.pskRaw = "ext:psk";
-      secretsFile = cfg.static.pskFile;
-    };
-  }
diff --git a/modules/networking/options.nix b/modules/networking/options.nix
deleted file mode 100644
index cc4864b..0000000
--- a/modules/networking/options.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  my-lib,
-  ...
-}: let
-  inherit (my-lib.netTypes {inherit lib;}) ipAddr ipAddrCidr;
-  inherit (lib) mkOption mkEnableOption;
-in {
-  options.collinux.system.network = {
-    dns.areYouAServer = mkEnableOption "Set up unbound with the *.ganymede resolver and disable resolved stub";
-
-    static = lib.mkOption {
-      description = "Set a static IP address for this device on this network. Leave unset to use DHCP";
-      type = lib.types.nullOr (lib.types.submodule {
-        options = {
-          ip = mkOption {
-            description = "IP address";
-            type = ipAddrCidr;
-          };
-          gateway = mkOption {
-            description = "default gateway";
-            type = ipAddr;
-          };
-        };
-      });
-      default = null;
-    };
-
-    wireless = {
-      static = lib.mkOption {
-        description = "Set a preconfigured SSID and PSK for the wireless config";
-        type = lib.types.nullOr (lib.types.submodule {
-          options = {
-            ssid = mkOption {
-              description = "SSID for this network";
-              type = lib.types.str;
-            };
-            pskFile = mkOption {
-              description = "Absolute path to a file containing the pre-shared key for this network in the form `psk:<wifi psk>`";
-              type = lib.types.str;
-              example = "/run/secrets.d/wifi-psk";
-            };
-          };
-        });
-        default = null;
-      };
-      dynamic = mkEnableOption "Enable dynamically joining wireless networks with iwd";
-    };
-
-    wireguard = {
-      enable = mkEnableOption "Whether to enable Wireguard on this device";
-      # peers = lib.types.listOf (lib.types.submodule {
-      #   options = {
-      #   };
-      # });
-    };
-  };
-}
diff --git a/modules/system/nixos/boot.nix b/modules/system/nixos/boot.nix
index aefc6da..3b095ab 100644
--- a/modules/system/nixos/boot.nix
+++ b/modules/system/nixos/boot.nix
@@ -74,7 +74,7 @@ in {
       };
     });
 
-  system.etc.overlay.enable = true;
+  # system.etc.overlay.enable = true;
   system.nixos-init.enable = true;
 
   # store journald logs in memory
diff --git a/modules/system/options.nix b/modules/system/options.nix
index cbc8cd1..931565f 100644
--- a/modules/system/options.nix
+++ b/modules/system/options.nix
@@ -29,14 +29,4 @@ in {
     bluetooth.enable = mkEnableOption "bluetooth";
     printing.enable = mkEnableOption "cups printing server";
   };
-
-  config.assertions = [
-    {
-      assertion = let
-        cfg = config.collinux.system.network.wireless;
-      in
-        !(cfg.static != null && cfg.dynamic);
-      message = "Configure a static wireless connection or a dynamic one; not both.";
-    }
-  ];
 }
diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix
index 68238d6..239f7ce 100644
--- a/modules/user/nixos/default.nix
+++ b/modules/user/nixos/default.nix
@@ -26,7 +26,10 @@ in {
         Defaults pwfeedback
       '';
     };
-    run0.enableSudoAlias = cfg.useRun0;
+    run0 = {
+      enable = cfg.useRun0;
+      enableSudoAlias = cfg.useRun0;
+    };
   };
 
   time.timeZone = "America/Chicago";