feat: Add fingerprint scanner support and modularize work configurations

- Add fingerprint.nix hardware module with TOD driver support
- Create separate laptop-work configuration with Cisco, Himmelblau, and MDATP work modules
- Move work-specific modules from shared to laptop-work profile
- Change work module enable defaults to false for better security-by-default
- Add MDATP support with enhanced modular structure

flake.lock

@@ -1,52 +1,5 @@
 {
   "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": [
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1770165109,
-        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -138,6 +91,24 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "git-hooks-nix": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -181,24 +152,24 @@
         "type": "github"
       }
     },
-    "home-manager": {
+    "himmelblau": {
       "inputs": {
         "nixpkgs": [
-          "agenix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1745494811,
+        "lastModified": 1783966245,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "narHash": "sha256-yFLScy0bxU6GLf4ZUoYCzZiyh5AGTT85evjw6xpG++g=",
-        "owner": "nix-community",
+        "owner": "himmelblau-idm",
-        "repo": "home-manager",
+        "repo": "himmelblau",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "rev": "00b27a924c2a42d54320b9ebc012c22d8dd95e28",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "himmelblau-idm",
-        "repo": "home-manager",
+        "ref": "main",
+        "repo": "himmelblau",
         "type": "github"
       }
     },
@@ -217,6 +188,27 @@
         "type": "github"
       }
     },
+    "mdatp": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747306795,
+        "narHash": "sha256-PF4ptTqa3gLzb9ac9SGrFyy4KHd2Z47aUUzkaYmrtvM=",
+        "owner": "epetousis",
+        "repo": "nix-mdatp",
+        "rev": "30936772fbc654604004b7049b727f42a0da6c2f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "epetousis",
+        "repo": "nix-mdatp",
+        "type": "github"
+      }
+    },
     "nix-index-db": {
       "inputs": {
         "nixpkgs": [
@@ -303,20 +295,21 @@
     },
     "root": {
       "inputs": {
-        "agenix": "agenix",
         "disko": "disko",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
         "git-hooks-nix": "git-hooks-nix",
         "helium": "helium",
+        "himmelblau": "himmelblau",
         "import-tree": "import-tree",
+        "mdatp": "mdatp",
         "nix-index-db": "nix-index-db",
         "nixos-24-05": "nixos-24-05",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix",
-        "systems": "systems_2",
+        "systems": "systems_3",
         "zen-browser": "zen-browser"
       }
     },
@@ -356,6 +349,21 @@
       }
     },
     "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",

flake.nix

@@ -82,14 +82,6 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     # rest of inputs, alphabetical order
-    agenix = {
-      url = "github:ryantm/agenix";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        systems.follows = "systems";
-      };
-    };
-
     import-tree.url = "github:vic/import-tree";
 
     zen-browser = {
@@ -102,6 +94,16 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    himmelblau = {
+      url = "github:himmelblau-idm/himmelblau/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    mdatp = {
+      url = "github:epetousis/nix-mdatp";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nix-index-db = {
       url = "github:Mic92/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";

home/terminal/software/ssh.nix

@@ -1,25 +1,47 @@
 {
-  config,
   pkgs,
+  config,
   ...
 }: {
   users.users.someone.packages = with pkgs; [
     openssh
   ];
 
-  xdg.configFile."ssh/config" = {
+  home.file.".ssh/config".text = ''
-    source = config.sops.secrets.ssh_config.path;
+    AddKeysToAgent yes
-  };
+    CheckHostIP yes
+    Compression no
+    ControlMaster no
+    ControlPath ~/.ssh/master-%r@%n:%p
+    ControlPersist no
+    HashKnownHosts yes
+    IdentitiesOnly yes
+    PasswordAuthentication no
+    ForwardAgent no
+    ForwardX11 no
+    ForwardX11Trusted no
+    ServerAliveInterval 60
+    ServerAliveCountMax 3
+    UserKnownHostsFile ~/.ssh/known_hosts
 
-  home.file.".ssh/config" = {
+    Host git.severijnse.eu
-    source = config.xdg.configHome + "/ssh/config";
+      HostName git.severijnse.eu
-    mutable = false;
+      Port 222
-  };
+      User git
+      IdentityFile /run/secrets/gitea_laptop
 
-  environment.sessionVariables = {
+    Host hetzner
-    SSH_AUTH_SOCK = "${config.xdg.runtimeDir}/gnupg/S.gpg-agent.ssh";
+      HostName severijnse.eu
-    SSH_CONFIG = "${config.xdg.configHome}/ssh/config";
+      User admin
-  };
+      IdentityFile /run/secrets/hetzner_server
+
+    Host github.com
+      HostName github.com
+      User git
+      IdentityFile /run/secrets/github_laptop
+
+    Include ~/.ssh/config.d/*
+  '';
 
   systemd.user.services.ssh-agent = {
     description = "SSH agent service";

hosts/aesthetic/default.nix

@@ -168,40 +168,23 @@
 
   boot.loader.limine.bootMode = lib.mkDefault "bios";
 
-  # sops-nix configuration
+  # sops-nix configuration — uses SSH host keys automatically, no age key file needed
   sops = {
     defaultSopsFile = ./../../secrets/secrets.yaml;
-    age.keyFile = "/etc/age/keys.txt";
-    # Explicitly define secrets to ensure they're generated
     secrets = {
-      discordo = { owner = "someone"; group = "users"; mode = "0440"; };
-      openrouter = { owner = "someone"; group = "users"; mode = "0440"; };
-      github = { owner = "someone"; group = "users"; mode = "0440"; };
-      twt = { owner = "someone"; group = "users"; mode = "0440"; };
-      gemini = { owner = "someone"; group = "users"; mode = "0440"; };
-      context7 = { owner = "someone"; group = "users"; mode = "0440"; };
-      exa = { owner = "someone"; group = "users"; mode = "0440"; };
-      ssh_config = { owner = "someone"; group = "users"; mode = "0440"; };
       gitea_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
+      github_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
       hetzner_server = { owner = "someone"; group = "users"; mode = "0400"; };
     };
   };
 
-  environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
+  nixpkgs.config.allowUnfree = true;
 
-  # Provide age private key for sops decryption at activation time
+  nixpkgs.overlays = [
-  systemd.tmpfiles.rules = [
+    (self: super: {
-    "d /etc/age 0700 root root -"
+      cisco-secure-client = super.callPackage ../../pkgs/cisco-secure-client {};
-    "w /etc/age/keys.txt 0600 root root - # created by activation script"
+    })
   ];
 
-  # Activation script to write age key
+  environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
-  system.activationScripts.write-age-key = ''
-        cat > /etc/age/keys.txt << 'AGEEOF'
-    # created: 2026-07-12T10:20:38+02:00
-    # public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
-    AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC
-    AGEEOF
-        chmod 600 /etc/age/keys.txt
-  '';
 }

hosts/default.nix

@@ -18,12 +18,13 @@
   # get these into the module system
   specialArgs = {inherit inputs self;};
 
-  # shared modules for all configurations
+  # shared modules for all configurations (personal + work)
   sharedModules = [
     ./aesthetic
     "${mod}/services/gnome-services.nix"
     "${mod}/core/limine.nix"
     "${home}"
+    "${self}/work"
     inputs.sops-nix.nixosModules.sops
   ];
 in {
@@ -80,6 +81,22 @@ in {
         ];
     };
 
+    # Laptop work: laptop profile + work modules (himmelblau, cisco, mdatp)
+    laptop-work = nixosSystem {
+      inherit specialArgs;
+      modules =
+        laptop
+        ++ sharedModules
+        ++ [
+          "${mod}/services/location.nix"
+          {
+            work.cisco.enable = true;
+            work.himmelblau.enable = true;
+            work.mdatp.enable = true;
+          }
+        ];
+    };
+
     # Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
     # Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
     hetzner = nixosSystem24 {

pkgs/cisco-secure-client/default.nix

@@ -0,0 +1,126 @@
+{ lib, stdenv, fetchurl, dpkg, makeWrapper, patchelf
+, coreutils, systemd, glib, zlib, xz, curl, libxml2
+}:
+
+let
+  version = "5.1.17.3394";
+  # libxml2's "out" output has lib/libxml2.so.16
+  libxml2_out = libxml2.out;
+
+  # System library RPATH for all bundled ELF binaries (cisco's own lib dir is
+  # appended during fixupPhase via $out)
+  sysRpath = lib.makeLibraryPath [
+    systemd glib zlib xz stdenv.cc.cc.lib curl libxml2_out
+  ];
+in stdenv.mkDerivation {
+  pname = "cisco-secure-client";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://archive.org/download/cisco-secure-client-linux64-${version}/cisco-secure-client-linux64-${version}-predeploy-deb-k9.tgz";
+    sha256 = "5c4cafb4694e64cbf041481f5df3d70389399926f8aa2a469d480c0555b58c2c";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper patchelf ];
+
+  buildInputs = [
+    systemd glib zlib xz stdenv.cc.cc.lib curl libxml2_out
+  ];
+
+  dontStrip = true;
+  dontAutoPatchelf = true;
+
+  unpackPhase = ''
+    tar xzf "$src"
+    DEB_FILE=$(ls cisco-secure-client-vpn-cli_*_amd64.deb 2>/dev/null || true)
+    if [ -z "$DEB_FILE" ]; then
+      DEB_FILE=$(ls cisco-secure-client-vpn_*_amd64.deb 2>/dev/null || true)
+    fi
+    if [ -z "$DEB_FILE" ]; then
+      echo "ERROR: No .deb file found"
+      exit 1
+    fi
+    dpkg-deb -x "$DEB_FILE" .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out"
+    cp -r opt/* "$out/"
+    runHook postInstall
+  '';
+
+  # fixupPhase: patchelf corrupts Cisco's embedded code signatures on ALL
+  # shipped ELF binaries and .so plugins. We skip patchelf entirely and
+  # instead rely on LD_LIBRARY_PATH wrappers for system library resolution.
+  # The binaries' original RPATH of /opt/cisco/secureclient/lib resolves
+  # correctly at runtime via the /opt/cisco/secureclient -> store symlink.
+  fixupPhase = ''
+    runHook preFixup
+
+    # Fix absolute symlinks — the deb assumes install under /opt/cisco/secureclient/
+    # but nix puts it in the store. Convert to relative symlinks.
+    for link in $(find "$out" -type l); do
+      target=$(readlink "$link")
+      if echo "$target" | grep -q "^/opt/"; then
+        rel=$(basename "$target")
+        ln -sf "$rel" "$link"
+      fi
+    done
+
+    for f in "$out"/cisco/secureclient/bin/* "$out"/cisco/secureclient/lib/*.so*; do
+      chmod +x "$f" 2>/dev/null || true
+    done
+
+    # Create libxml2.so.2 symlink (SONAME mismatch: Cisco wants .2, nixpkgs provides .16)
+    libxml2_so=$(find ${libxml2_out}/lib -name "libxml2.so.16*" 2>/dev/null | head -1)
+    if [ -n "$libxml2_so" ]; then
+      ln -sf "$libxml2_so" "$out/cisco/secureclient/lib/libxml2.so.2"
+    fi
+
+    # NO patchelf on Cisco ELFs — their embedded code signatures are
+    # verified at runtime (especially plugins loaded by vpnagentd).
+    # All ELFs keep their original RPATH /opt/cisco/secureclient/lib
+    # which resolves via the tmpfiles symlink.
+    # System libs are provided via LD_LIBRARY_PATH in wrappers below.
+
+    ldPath="$out/cisco/secureclient/lib:${sysRpath}"
+
+    # Wrap vpn CLI — wrapProgram renames the original to .vpn-wrapped
+    wrapProgram "$out/cisco/secureclient/bin/vpn" \
+      --prefix LD_LIBRARY_PATH : "$ldPath" \
+      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
+
+    # Create $out/bin/ wrappers for all user-facing executables
+    mkdir -p "$out/bin"
+
+    makeWrapper "$out/cisco/secureclient/bin/vpn" "$out/bin/vpn" \
+      --prefix LD_LIBRARY_PATH : "$ldPath" \
+      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
+
+    makeWrapper "$out/cisco/secureclient/bin/vpnagentd" "$out/bin/vpnagentd" \
+      --prefix LD_LIBRARY_PATH : "$ldPath" \
+      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
+
+    for cli in acinstallhelper manifesttool_vpn vpndownloader-cli; do
+      if [ -f "$out/cisco/secureclient/bin/$cli" ]; then
+        makeWrapper "$out/cisco/secureclient/bin/$cli" "$out/bin/$cli" \
+          --prefix LD_LIBRARY_PATH : "$ldPath"
+      fi
+    done
+
+    runHook postFixup
+  '';
+
+  meta = with lib; {
+    description = "Cisco Secure Client (AnyConnect successor) VPN client";
+    homepage = "https://www.cisco.com/site/us/en/products/security/secure-client/index.html";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = {
+      name = "Cisco Secure Client EULA — proprietary, not redistributable";
+      url = "https://www.cisco.com/c/en/us/products/security/secure-client/eula.html";
+    };
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ ];
+  };
+}

secrets/age.key

@@ -1,3 +0,0 @@
-# created: 2026-07-12T10:20:38+02:00
-# public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
-AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC

secrets/hetzner_server.age

@@ -1,6 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 o3KszQ O4xOtTDK/DH+r81x55jFRFtPAFpTpvCiUcUBy/bm320
-K8kjoDS2ODYJdNZCUmhTfQOWFHEFCkb90d9K5fEnxYo
---- j1a/Uo7QXWC0dnbSGKaRj/T9GkChC7BQf6kYC0HN8f4
-êßçé}N
-,âôxoT#c„d¸b,­¥Á›�o¶wšah@Z˜&àWU]S6T	�þôá”ó¾þº)Yõg

secrets/secrets.nix

@@ -1,22 +0,0 @@
-let
-  host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICL0B9moxOPY4XYim8826M+Tf0sWErwWljz1gkDZPwuF";
-in {
-  "gitea_laptop.age".publicKeys = [
-    host
-  ];
-  "hetzner_server.age".publicKeys = [
-    host
-  ];
-  "aur.age".publicKeys = [
-    host
-  ];
-  "ssh_config.age".publicKeys = [
-    host
-  ];
-  "github_key.age".publicKeys = [
-    host
-  ];
-  "sporestack_server.age".publicKeys = [
-    host
-  ];
-}

secrets/secrets.yaml

@@ -1,25 +1,18 @@
-discordo: ""
+gitea_laptop: ENC[AES256_GCM,data:nfiUKIe/+4CuHcv9oBNRFL+gGx2XEvjZlllOVhQYKd00rlffCh1k2BHChdXYziaPVo7SvFkZUX1OLLYqtKC90qMocfSq+6j7hJiTO7RH+DUaAzUEY1bANd6mwh2gl63Xcq3Z65VFRnYvXigJS3QZGykeXNancXjs3TK5pjJZDXgXef7gKzs7yLlnr41Ntk2eiOv08334aa046Qjr6kDjtGd/uUkTzuetMPfGadr/I0VBf0S/SjwSRSzM12CTa7vIz+AbY4pOrZYV+s0bHtuVfE0Xv9WqjC2rA9rqhzrcVfzdbhIEIpADoyhezImcZTzUFQFgaPRoH6ko8GhZKUXPRAmLeMvuzHy1y4kXjsfSixMM2doEfh2lKJTAf1DtAt4OrzXLYt+n5gxCuXdcIMHGP/wfbfmC+Lb1iPZ1ywzICBmBXugNw1KoIMnnr/DjRdqjNQiGQtEd8ylu3VpK7a5OHb0/kW6YQCvtPy5xgYn19LYJUIp8xb4bA2Ty2Bi0FbnfDQbtejUK1bfgz14SQXK6,iv:O+8iWBbXSiyagkfRjzYDxMukBZHfCgxxsEx6C1OBjjQ=,tag:KyzATKtgjutfDmHjR5Gq9g==,type:str]
-openrouter: ""
+github_laptop: ENC[AES256_GCM,data:sIiuxSVQyxNIM1BDXx/Wjtdjl7CS9Hdq8tQu9Qdu9fcoDVwNpuidflhb7K7jXmynLJDcAgqSJIBuVngU6mf7nA/k/EmWc8T/+Pl8RUqR/Z85F0Bby/PEULf8pljxiqbolm9fIe9ayThxFJux6tq+cfXiN/omHWxJuMNWgroX6xoxmBla/TDI8VdO1z60wogAJDd0XWp766tFX11iXMuTJhFUKO4Ah3CCHTuIvmXhfMrqdykrulbRgkhoOl/ufNZnJA0cMeg3hjb/yZU29TNaKHXZyeIbP2B/dvEJjNgBQnVoqEL3K4ZZOp4Bo52pdw+wLQ9bQY1hN/XYwi5qNC6G5A0i9r3tmYGeR+6lHIWGaQ0LbFiGmnLQGIeYOU0b7CweJFqJzBDkmfPnglnsRNJtVb7UgBJYGFcLPS0XfVYUVjN0OTqUugeTJSUCAMnWnBlsIgWbrclwe9ilNRPELf7bqXC+Lfcl5vgH1JJRB1Q8m//v+2j764m04Oo4uVZRHqkhA0Jdq/58E2NQpBSM1UNY,iv:cFyGuGa9dWITfJY5rvYe6WIZDouU1ZQ1Lj5x9mU/9wc=,tag:dH5XDlbi4LE8uyAVDMT6dw==,type:str]
-github: ""
+hetzner_server: ENC[AES256_GCM,data:YW3eiBJ+4hqBY3BVIcoJicSRz2L+9iZzwVdhpRl/BARtwkkPEohRUUIXY15HqS/DqhcKaojh1YqlUzFh5Z+FKTnizhPNHwWN+Dnz4d9dNTyIdzRkKOp31uYTJi2v2uwoYc60y4wkhHO5dAvWKdHz2qdvXCS9uspfaVpc2k/HasnBmpUODZSfUnLq2bInifDf+lPuJqTVAH0QXo93Nx6IqbgOA0WLfdi6xC3PemzwtqL6dhXUPehF3N4aULfbph/JHnxqQ3LqvDnr8wQsqBfePpFfxpod0rtYnYOwQ/TDEErLIG8d7Idvlzgmr8WFBpgYQuoMyYuDr9PYenpNnbeIF3JesCocsBEw4jpoQT7K1Pd0iVTuvp/41X7gPmYrPviVbWx9X99FeHzUDxhOcNSc/QZ4UtPoLMprlmPK2XQPbQBJyy9KXGNMBW/jERE7Et0cmlx/TVA7tN8T6/Y2vrBlgtmE3m6Fn7ZhtiNFZs4GMbK9KGtmgxwN75yJML3x77Wsleco6nrBcYEghf3LoviwQVjw9KKgwSVLJzW+,iv:rhp4eqmAzmQOAtPy9+ATqth5IKKzk3evJyVw5UtDrSc=,tag:TP/2plD04GU9zKfpesLqeA==,type:str]
-twt: ""
-gemini: ""
-context7: ""
-exa: ""
-gitea_laptop: ""
-ssh_config: ENC[AES256_GCM,data:TqAUIElmt9nmVC9GuPoo+4/K1VSjxyJdqKe2ra38cJjC66aozIBk5dHyJPgMai/V7jPfYGk366cQUmkE1cvzz/DCw19Xa06YPM2qr93g0FOq0YFu33Vn+33Sx5UAM2QeaTHlIOqqZDBYhJpiOH/5WwCZ/Ai2qInj2G5lH28FiJU5frpImqY2Sq0E6Mhwt3++4+tAcaam+jp1V+PfdcroCULOjpJkbIpNx34TPZPmAtEN/fkkKr6NLj1Jh4RnmdMSW20FHzKSeDKIuDbFdUODRd+jRGo1G6DyujrWV10JrggxR24cfXA15C4nFaEZ6ZHshU1IXoq2msalGqaAHhLetaJaybsWTVpbpkMEozswrkmHiGSHHmq1b6A15i3QVApvFkT02D2Rihs4i3wTPav3zsPdUEUVTGOKI/VQcbJIfckZLZLxLUQjpX+Y62pbsIjtdfF6c/PvCSp5B0+KSZOGvOmZj/RvpDLLeeg5l0tSz5HBaaNPC5LHNuI9Fjabja6EjLhtmZdffOF0yyHjau0AwYYelyjao87gXSz9SuAt5NBvvkB6QifvLJZS6PaNl38OMkDvl1W5n89S8bJVZfmV/1nDZqDdpAPidn0AtT+iKP8As6tuTWnRKATALNqFKMpac3NOAuDWxzB2awhdGBFOJlwjTeepUVZrAbk9sqr9TsNXv8Kr8CyAW59ZL3GmbEik6JN0yuWJioHL4G6TiYbkAK4iIfjhnoyyyUtQhw==,iv:UsyEPs3PbY4rqS2ovBsUUv50ksVUp6UJyKn39i6G5O8=,tag:7s0iZKcLtlUiP7AIP+d5dA==,type:str]
-hetzner_server: ENC[AES256_GCM,data:Cb/oa7oDO6nsbxEQmqYHqPP6AEqUHQzHc49axXPJWOkvOb4WMAMh93xVdFzdgPIR1MjLusrD0q2azE6gEQtT+qPbhB0A0/RN/DR49U04UGzWAPltDGlJX+0Z01CL34Kvy6lzOeaVgWLD5Uzg628uGNqL3PKHceJI6Q9lWbH9E19jBGOq86ceXerVlzwDQNyLyrT75O3zOXFy3V0OmG0WDi6pI61ReZVx5HZe3nmxkAMTsRjs+FxA/Yr6hZa0QVqczoZ+i/+qI3RBrWxqUko/A6CGWM/PzMkhw9FCVRoMwRANKoaom2MX+DSDIbg1Bg2JvhUR9oxtNRpO9mj0R6wLlFzA31h9tle0q+7pNxW68G9YDhWUFcxcvb/xFjpSJ7C1kfGQJADpLJoIgT+Fo1XvyiyRKwIXDN2wvAGoCF6gtZcVesN/xhMbmLHPOedHdNrUbSNhZGvR4/mzSlmSLkixddI+r9cXbH/VH+rXd0cCOaqcMEv2FmSRW9z1/y9dPZrpdwg88oouSNzVIE0ANxoARyF8x7mEGNwGHBG1,iv:AreeGiJvChbJDqBdR1L0c/7aqqrfcsQ7ApBpg+0hYOQ=,tag:1lnO8QlFad56basn0NpYmg==,type:str]
 sops:
     age:
-        - recipient: age1vtlutzzhgsy4ef8jd97jaay30zwygj68jwgn0zx64m2d5u57sqzsngy7lf
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1WUlMWE93cGJxbDY4VzNB
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYVGxBMmhqdDBmRjlSY2Jp
-            VkVMMXFqZTVXaTFXeFNWdHNJUjV2OE84YVZFClhhK0tUQVlSUXF2NWJFVHFKQXF2
+            TVlFKzc3dnM4YUwzZm1iTXY0Q1ROazZQTWc4CjZQZzRIeFYxaGlrSmZTVEFNb21T
-            VUJ5d0t6Um43bmQ5RmExd1QzZ1BxN0EKLS0tIGNnWlZwUkhxbndSRkxia0dFVjVB
+            M2xGN1ozaEdOak5kQTRYRENXZFpNRmcKLS0tIFhCNHVWejFpeGtCL1cwNi9lU0pq
-            TnNEOFBIbU5kSWRCSERQR2hPWnJQM1EKvGPbq3jltkJXL6ExowUeuZ6/WYaBuojX
+            dzJLbGRzZTlnZVAra2x0SXAvclcrelkKZdnhAPvrqixSbUNfn1Tj7ZYaeCUxfZnf
-            XzUaNchtd22IhWB50V4IDyl79gb4y0felRS4qe5LQvnvXnjCTwoqyQ==
+            T9KxEukEKRXMPfCANiQvlG3bM6pPM7L2l8TjTzWOSN/M31cgbiLjyg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-07-12T08:59:50Z"
+          recipient: age1vtlutzzhgsy4ef8jd97jaay30zwygj68jwgn0zx64m2d5u57sqzsngy7lf
-    mac: ENC[AES256_GCM,data:3faasx6fkL6wv9oDDXlxlcbvGIj1D9l2FpkDhYHhyCjN8ZZeRCX4qznos5eLMnDAQUhUZgyvCCXidlHJsYUZcj11p7T0YcGnr+6lzi/p9VkETA2v42BlgXgz0M9nLY0mB6kbAY8JhaJ5fO59DDEhSZRKNgIvzFv2Rv/SoyjpV10=,iv:J1g5R43LOKMSy0V0/cO8eUiuF52ML+2G8gp1WZeOFNM=,tag:PobaSjf5ZPVcNDYmaX02vA==,type:str]
+    lastmodified: "2026-07-12T19:19:12Z"
+    mac: ENC[AES256_GCM,data:iF2a+wQXiWw4vqOedlZyWda3x66lonwh6WFcB5DdZyXbZzxq8Nvz4POGVYS4ZDwDlWrDhS9RTCX/UyclrHxBslu+rkSUqnOITOABWlnwFPTjGRz4EVMk1MGpRHXL9c8N2O1SS0LnkL8O6+9qsIROkNQVi4nyo4zIYTEfcdxDx+w=,iv:qPf6pl8d4egPitSCheccfiek+WPJVx33cZe81HggBio=,tag:4zXI+g6+vPo0YWOoyud8vw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.2

system/default.nix

@@ -21,9 +21,10 @@ let
     ./services/pipewire.nix # audio
   ];
 
-  # Laptop-specific modules (battery, bluetooth)
+  # Laptop-specific modules (battery, bluetooth, fingerprint)
   laptop = [
     ./hardware/bluetooth.nix
+    ./hardware/fingerprint.nix
     ./services/power.nix
   ];
 in {

system/hardware/fingerprint.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+# Fingerprint scanner configuration
+#
+# Enable on laptops with a fingerprint reader:
+#   hardware.fingerprint.enable = true;
+#
+# For some sensors (Goodix, Elan, Synaptics), you may also need to set
+# the TOD driver:
+#   hardware.fingerprint.todDriver = pkgs.libfprint-2-tod1-goodix;
+#
+# Reference: https://wiki.nixos.org/wiki/Fingerprint_scanner
+
+let
+  cfg = config.hardware.fingerprint;
+in {
+  options.hardware.fingerprint = {
+    enable = lib.mkEnableOption "fingerprint scanner support (fprintd)";
+
+    todDriver = lib.mkOption {
+      description = "Touch OEM Drivers (TOD) package to use for the fingerprint sensor";
+      type = lib.types.nullOr lib.types.package;
+      default = null;
+      example = lib.literalExpression "pkgs.libfprint-2-tod1-goodix";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fprintd.enable = true;
+
+    services.fprintd.tod = lib.mkIf (cfg.todDriver != null) {
+      enable = true;
+      driver = cfg.todDriver;
+    };
+  };
+}

work/cisco.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, self, ... }:
+
+# Cisco Secure Client (proprietary VPN client, successor to AnyConnect)
+#
+# Package: pkgs/cisco-secure-client — fetches the Linux pre-deployment .tgz
+# from archive.org and extracts the bundled .deb.
+#
+# The user can override the source by passing a different package:
+#   work.cisco.package = pkgs.cisco-secure-client.overrideAttrs (_: {
+#     src = /path/to/local/cisco-secure-client-linux64-5.1.17.3394-predeploy-deb-k9.tgz;
+#   });
+#
+# Reference: https://github.com/NixOS/nixpkgs/issues/265443
+
+let
+  cfg = config.work.cisco;
+in {
+  options.work.cisco = {
+    enable = lib.mkEnableOption "Cisco Secure Client" // {
+      default = false;
+    };
+
+    package = lib.mkOption {
+      description = "cisco-secure-client package to use";
+      type = lib.types.package;
+      default = pkgs.cisco-secure-client;
+      defaultText = "pkgs.cisco-secure-client";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      cfg.package
+    ];
+
+    # The vpnagentd binary has /opt/cisco/secureclient/ hardcoded for runtime
+    # config paths (openssl.cnf, ossl-modules/). Create a symlink to the Nix store.
+    systemd.tmpfiles.rules = [
+      "d /opt 0755 root root -"
+      "L+ /opt/cisco/secureclient - - - - ${cfg.package}/cisco/secureclient"
+    ];
+
+    # Load the tun module required by the VPN client
+    boot.kernelModules = [ "tun" ];
+
+    systemd.services.cisco-vpnagentd = {
+      description = "Cisco Secure Client VPN Agent Daemon";
+      # vpnagentd daemonizes itself; tracked via PID file.
+      after = [ "network-online.target" "NetworkManager.service" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = "/run/vpnagentd.pid";
+        # Use the wrapper (sets LD_LIBRARY_PATH) — the raw binary was restored
+        # from backup to preserve its embedded Cisco code signature, so it has
+        # no RPATH and needs the env var to find its bundled .so files.
+        ExecStart = "${cfg.package}/bin/vpnagentd";
+        Restart = "on-failure";
+        RestartSec = "5";
+
+        # Minimal capability set for VPN operation
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_RAW"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_FOWNER"
+        ];
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_RAW"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_FOWNER"
+        ];
+        DeviceAllow = [ "/dev/net/tun rw" ];
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = false;
+        NoNewPrivileges = false;
+      };
+    };
+  };
+}

work/default.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }: {
+  imports = [
+    ./overlay.nix
+    ./cisco.nix
+    ./himmelblau.nix
+    ./mdatp.nix
+  ];
+
+  # Create the work directory for the user
+  systemd.tmpfiles.rules = [
+    "d /home/someone/work 0755 someone users -"
+  ];
+}

work/himmelblau.nix

@@ -0,0 +1,51 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Himmelblau: Microsoft Entra ID authentication for Linux
+#
+# Authenticates Linux users against the digistate.nl Entra ID tenant.
+# Users log in with their Entra ID credentials via OIDC Device Authorization
+# Grant flow (browser-based) or the native PAM orchestrator.
+#
+# Requires:
+#   - A working Entra ID tenant with digistate.nl as a verified domain
+#   - An OIDC app registration (Himmelblau client) in the tenant
+#   - Network connectivity to login.microsoftonline.com
+#
+# References:
+#   - https://himmelblau-idm.org/docs/
+#   - https://github.com/himmelblau-idm/himmelblau
+
+let
+  cfg = config.work.himmelblau;
+in {
+  imports = [
+    inputs.himmelblau.nixosModules.himmelblau
+  ];
+
+  options.work.himmelblau = {
+    enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.himmelblau = {
+      enable = true;
+      settings = {
+        domain = [ "digistate.nl" ];
+        # Uncomment and set to Entra ID group Object IDs or names to
+        # restrict which users can authenticate:
+        # pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
+      };
+    };
+
+    # Himmelblau registers an NSS module (system.nssModules) for user/group lookups,
+    # which requires nscd to be enabled. Keep it on.
+    # services.nscd.enable = lib.mkForce false;
+
+    # Expose the aad-tool CLI for diagnostics and enrollment
+    environment.systemPackages = [
+      inputs.himmelblau.packages.${pkgs.system}.aad-tool
+    ];
+  };
+}

work/mdatp.nix

@@ -0,0 +1,22 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Microsoft Defender for Endpoint
+#
+# References:
+#   - https://github.com/epetousis/nix-mdatp
+
+let
+  cfg = config.work.mdatp;
+in {
+  imports = [
+    inputs.mdatp.nixosModules.mdatp
+  ];
+
+  options.work.mdatp = {
+    enable = lib.mkEnableOption "Microsoft Defender for Endpoint";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.mdatp.enable = true;
+  };
+}

work/overlay.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+{
+  # Overlay to add cisco-secure-client to pkgs
+  nixpkgs.overlays = [
+    (self: super: {
+      cisco-secure-client = super.callPackage ./pkgs/cisco-secure-client {};
+    })
+  ];
+}