diff --git a/flake.nix b/flake.nix
index 92aaa5a..a97505c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,7 +9,7 @@
     nixpkgs,
     ...
   } @ inputs: let
-    mkNixosSystem = name: hostPath:
+    mkNixosSystem = _name: hostPath:
       nixos-stable.lib.nixosSystem {
         modules = [
           hostPath
@@ -18,7 +18,7 @@
         specialArgs = {inherit self inputs;};
       };
 
-    mkDarwinSystem = name: hostPath:
+    mkDarwinSystem = _name: hostPath:
       nix-darwin.lib.darwinSystem {
         modules = [
           hostPath
diff --git a/hosts/anemone/default.nix b/hosts/anemone/default.nix
index 9e6d19d..f5522ed 100644
--- a/hosts/anemone/default.nix
+++ b/hosts/anemone/default.nix
@@ -18,24 +18,11 @@
 
   disabledModules = ["profiles/base.nix"];
 
-  settings = {
-    programs = {
-      enable = false;
-      cli.enable = true;
-      tui.enable = true;
-      categories = {
-        enable = false;
-        core.enable = true;
-      };
-    };
-    system = {
-      hostName = "anemone";
-      services = {
-        enable = false;
-        networking.enable = true;
-      };
-    };
-    desktop.enable = false;
+  profile = "server";
+  nest = {
+    system.hostName = "anemone";
+    services.enable = false;
+    programs.enable = false;
   };
 
   services.openssh = {
diff --git a/hosts/earthy/default.nix b/hosts/earthy/default.nix
index 13eba60..25d4066 100644
--- a/hosts/earthy/default.nix
+++ b/hosts/earthy/default.nix
@@ -9,17 +9,17 @@
     "${self}/modules/nixos"
   ];
 
-  settings = {
-    system = {
-      hostName = "earthy";
-      services.sync.enable = true;
+  profile = "desktop";
+  nest = {
+    system.hostName = "earthy";
+    services = {
+      syncthing.enable = true;
+      selfhost = {
+        mpd.enable = true;
+      };
     };
-  };
-
-  services.openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = "yes";
+    programs = {
+      terminal.emulator.alacritty.enable = true;
     };
   };
 
@@ -34,21 +34,28 @@
     in ["${automount_opts},credentials=${config.age.secrets.samba.path}"];
   };
 
-  # tlp
-  services.tlp = {
-    enable = true;
-    settings = {
-      CPU_ENERGY_PERF_POLICY_AC = "performance";
-      CPU_ENERGY_PERF_POLICY_ON_BAT = "balance_power";
-      PLATFORM_PROFILE_ON_AC = "performance";
-      PLATFORM_PROFILE_ON_BAT = "low-power";
-      WIFI_PWR_ON_AC = "off"; # default: off
-      WIFI_PWR_ON_BAT = "off"; # default: on  todo)) trying to resolve samba frozen unit session slice issue
+  services = {
+    tlp = {
+      enable = true;
+      settings = {
+        CPU_ENERGY_PERF_POLICY_AC = "performance";
+        CPU_ENERGY_PERF_POLICY_ON_BAT = "balance_power";
+        PLATFORM_PROFILE_ON_AC = "performance";
+        PLATFORM_PROFILE_ON_BAT = "low-power";
+        WIFI_PWR_ON_AC = "off"; # default: off
+        WIFI_PWR_ON_BAT = "off"; # default: on  todo)) trying to resolve samba frozen unit session slice issue
+      };
     };
-  };
 
-  # fwupd
-  services.fwupd = {
-    enable = true;
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "yes";
+      };
+    };
+
+    fwupd = {
+      enable = true;
+    };
   };
 }
diff --git a/hosts/starling/default.nix b/hosts/starling/default.nix
index c395632..ae333ac 100644
--- a/hosts/starling/default.nix
+++ b/hosts/starling/default.nix
@@ -4,7 +4,7 @@
   config,
   ...
 }: let
-  cfg = config.settings;
+  cfg = config.nest;
 in {
   imports = [
     "${self}/modules/darwin"
@@ -16,7 +16,8 @@ in {
     hostName = "starling";
   };
 
-  settings = {
+  profile = "desktop";
+  nest = {
     system = {
       user = let
         home = "/Users/${cfg.system.user.name}";
@@ -30,8 +31,9 @@ in {
         group = "staff";
         flakeDir = "${home}/Documents/git/flake";
       };
-      services.sync.enable = true;
     };
+    services.syncthing.enable = true; # TODO enable syncthing (disabled in module) - requires disabling syncthing network which is flagged
+    programs.terminal.emulator.alacritty.enable = true;
   };
 
   nix = {
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index 44a9337..67852e2 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -1,13 +1,15 @@
 {config, ...}: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 in {
   imports = [
-    ../shared
     ./desktop
     ./home
     ./homebrew.nix
     ./nix
     ./services
+
+    ../shared
+    ../lib
   ];
 
   users.users.${user.name}.home = user.home;
diff --git a/modules/darwin/desktop/aerospace.nix b/modules/darwin/desktop/aerospace.nix
index 3f53c09..1f672ed 100644
--- a/modules/darwin/desktop/aerospace.nix
+++ b/modules/darwin/desktop/aerospace.nix
@@ -3,11 +3,11 @@
     enable = false;
 
     settings = {
-      gaps = {
-        outer.left = 8;
-        outer.bottom = 8;
-        outer.top = 8;
-        outer.right = 8;
+      gaps.outer = {
+        left = 8;
+        bottom = 8;
+        top = 8;
+        right = 8;
       };
       mode.main.binding =
         {
diff --git a/modules/darwin/home/default.nix b/modules/darwin/home/default.nix
index d7faff5..118e647 100644
--- a/modules/darwin/home/default.nix
+++ b/modules/darwin/home/default.nix
@@ -1,5 +1,5 @@
 {config, ...}: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 in {
   home-manager.users.${user.name} = {
     imports = [
diff --git a/modules/darwin/home/glide-wm.nix b/modules/darwin/home/glide-wm.nix
index c66b3da..76ddfd5 100644
--- a/modules/darwin/home/glide-wm.nix
+++ b/modules/darwin/home/glide-wm.nix
@@ -4,7 +4,7 @@
   osConfig,
   ...
 }: let
-  inherit (osConfig.settings.system.user) flakeDir;
+  inherit (osConfig.nest.system.user) flakeDir;
   mkLink = config.lib.file.mkOutOfStoreSymlink;
   settingsFile = mkLink "${flakeDir}/modules/darwin/home/glide.toml";
 in {
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
new file mode 100644
index 0000000..5ec2fb1
--- /dev/null
+++ b/modules/lib/default.nix
@@ -0,0 +1,89 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkEnableOption toUpper getAttrFromPath concatStringsSep optionalString;
+
+  traceLogs = true;
+  trace = msg: x:
+    if traceLogs
+    then builtins.trace msg x
+    else x;
+in {
+  _module.args.lib' = {
+    # __functor allows a description to be optionally attached
+    # e.g. lib'.programType.cli "description" or lib'.programType.cli
+    programType = let
+      base = type: {
+        programType = type;
+        description = null;
+        __functor = self: description: self // {inherit description;};
+      };
+    in {
+      cli = base "cli";
+      gui = base "gui";
+    };
+
+    # group constructor (so the tree walker knows its a group)
+    mkProgramGroup = name: children: {inherit name children;};
+
+    mkProgramOptions = tree: let
+      # resolve a list-path against the final merged config
+      # e.g. ["nest" "programs" "shell" "git" "enable"]
+      get = path: getAttrFromPath path config;
+
+      # walk the tree recursively
+      #
+      # treePath:
+      # relative path from tree root
+      # grows on every decent (groups + plain attrsets)
+      # e.g. ["terminal" "tools"]
+      #
+      # parentEnablePaths:
+      # paths of every parent group enable
+      # grows on group nodes (mkProgramGroup)
+      # e.g. [["nest" "programs" "terminal" "tools" "enable"]]
+      #
+      # plain attrsets don't add parentEnablePaths, but treePath still advances
+      walk = treePath: parentEnablePaths:
+        builtins.mapAttrs (
+          name: value:
+            if value ? programType
+            # leaf node (program)
+            then let
+              typ = value.programType;
+              desc = value.description or "${toUpper typ} program ${name}";
+              default =
+                config.nest.programs.enable # global master
+                && config.nest.programs.${typ} # type (e.g. nest.programs.cli)
+                && builtins.all (x: x) (map get parentEnablePaths); # all parent groups enabled
+              defaultText =
+                "nest.programs.enable and nest.programs.${typ}"
+                + optionalString (parentEnablePaths != [])
+                (" and " + concatStringsSep " and " (map (concatStringsSep ".") parentEnablePaths));
+            in
+              trace "PROGRAM: name=${name}, treePath=[${concatStringsSep "," treePath}], parentEnablePaths=[${concatStringsSep "; " (map (concatStringsSep ".") parentEnablePaths)}], default=${builtins.toString default}"
+              {enable = mkEnableOption desc // {inherit default defaultText;};}
+              // builtins.removeAttrs value ["programType" "description" "__functor"]
+            # group node
+            else if value ? children
+            then let
+              fullPath = treePath ++ [name]; # e.g. ["terminal" "tools" "ripgrep"]
+              ancestorPath = ["nest" "programs"] ++ fullPath ++ ["enable"];
+            in
+              trace "GROUP: name=${value.name}, fullPath=[${concatStringsSep "," fullPath}], ancestorPath=[${concatStringsSep "," ancestorPath}]"
+              {enable = mkEnableOption value.name;}
+              // walk fullPath (parentEnablePaths ++ [ancestorPath]) (value.children)
+            # plain attrset (structural grouping without option)
+            else if builtins.isAttrs value
+            then
+              trace "ATTRSET: name=${name}, treePath=[${concatStringsSep "," treePath}] recursing"
+              (walk (treePath ++ [name]) parentEnablePaths value)
+            # pass through unchanged
+            else trace "VALUE: name=${name} (non-attrs, passing through)" value
+        );
+    in
+      walk [] [] tree;
+  };
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 1fd4591..e861187 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -4,7 +4,7 @@
   config,
   ...
 }: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 
   keys = [
     "${self}/keys/anemone.pub"
@@ -22,13 +22,20 @@ in {
     ./themes
 
     ../shared
+    ../lib
   ];
 
   users.users.${user.name} = {
     inherit (user) home;
     isNormalUser = true;
     extraGroups = ["networkmanager" "wheel" "dialout"];
-    shell = pkgs.zsh;
+    shell =
+      if user.shell == "zsh"
+      then pkgs.zsh
+      else if user.shell == "nushell"
+      then pkgs.nushell
+      else pkgs.bash;
+
     initialHashedPassword = "";
     openssh.authorizedKeys.keyFiles = keys;
   };
diff --git a/modules/nixos/desktop/niri.nix b/modules/nixos/desktop/niri.nix
index 7e6ed24..49f2b7d 100644
--- a/modules/nixos/desktop/niri.nix
+++ b/modules/nixos/desktop/niri.nix
@@ -5,11 +5,11 @@
   lib,
   ...
 }: let
-  cfg = config.settings.desktop.niri;
+  cfg = config.nest.desktop;
 in {
   imports = [inputs.niri.nixosModules.niri];
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && cfg.niri.enable) {
     niri-flake.cache.enable = true;
     nixpkgs.overlays = [inputs.niri.overlays.niri];
 
diff --git a/modules/nixos/home/default.nix b/modules/nixos/home/default.nix
index e7f6b1a..ca77332 100644
--- a/modules/nixos/home/default.nix
+++ b/modules/nixos/home/default.nix
@@ -1,5 +1,5 @@
 {config, ...}: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 in {
   home-manager.users.${user.name} = {
     imports = [
diff --git a/modules/nixos/home/desktop/niri/binds.nix b/modules/nixos/home/desktop/niri/binds.nix
index 0514d02..4695f9c 100644
--- a/modules/nixos/home/desktop/niri/binds.nix
+++ b/modules/nixos/home/desktop/niri/binds.nix
@@ -5,10 +5,10 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.desktop.niri;
+  cfg = osConfig.nest.desktop;
   wpctl = lib.getExe' pkgs.wireplumber "wpctl";
 in {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && cfg.niri.enable) {
     programs.niri.settings.binds =
       {
         # ==== Actions ====
diff --git a/modules/nixos/home/desktop/niri/default.nix b/modules/nixos/home/desktop/niri/default.nix
index 91eb382..fc73c14 100644
--- a/modules/nixos/home/desktop/niri/default.nix
+++ b/modules/nixos/home/desktop/niri/default.nix
@@ -5,13 +5,13 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.desktop.niri;
+  cfg = osConfig.nest.desktop;
 in {
   imports = [
     ./binds.nix
   ];
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && cfg.niri.enable) {
     programs.niri.settings = {
       animations.enable = true;
       prefer-no-csd = true;
diff --git a/modules/nixos/home/programs/cli/default.nix b/modules/nixos/home/programs/cli/default.nix
index 38a268b..3decff3 100644
--- a/modules/nixos/home/programs/cli/default.nix
+++ b/modules/nixos/home/programs/cli/default.nix
@@ -5,30 +5,30 @@
   lib,
   ...
 }: let
-  inherit (lib) optionals concatLists;
-  cfg = osConfig.settings.programs;
+  inherit (lib) optionals;
+  cfg = osConfig.nest;
 in {
   imports = [
     ./hyfetch.nix
+    ./ncmpcpp.nix
     ./nushell.nix
+    ./yazi.nix
+    ./lazygit.nix
   ];
-  config = lib.mkIf cfg.cli.enable {
+  config = lib.mkIf cfg.programs.cli {
     home.packages = with pkgs;
     with inputs;
-      concatLists [
-        (optionals cfg.categories.tools.enable [
-          brightnessctl
-          ddcutil
-          grim
-          killall
-          playerctl
-          slurp
-          wl-clipboard
-        ])
-        (optionals cfg.categories.dev.enable [
-          # nix
-          nix-output-monitor
-        ])
+      [
+        nix-output-monitor
+      ]
+      ++ optionals cfg.desktop.enable [
+        brightnessctl
+        ddcutil
+        grim
+        killall
+        playerctl
+        slurp
+        wl-clipboard
       ];
   };
 }
diff --git a/modules/nixos/home/programs/cli/hyfetch.nix b/modules/nixos/home/programs/cli/hyfetch.nix
index d9aeaa5..720111b 100644
--- a/modules/nixos/home/programs/cli/hyfetch.nix
+++ b/modules/nixos/home/programs/cli/hyfetch.nix
@@ -4,10 +4,9 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.tools.enable) {
+  config = lib.mkIf cfg.cli {
     programs.hyfetch = {
       enable = true;
       settings = {
diff --git a/modules/nixos/home/programs/cli/lazygit.nix b/modules/nixos/home/programs/cli/lazygit.nix
new file mode 100644
index 0000000..9ece197
--- /dev/null
+++ b/modules/nixos/home/programs/cli/lazygit.nix
@@ -0,0 +1,11 @@
+{
+  osConfig,
+  lib,
+  ...
+}: let
+  cfg = osConfig.nest.programs;
+in {
+  config = lib.mkIf cfg.cli {
+    programs.lazygit.enable = true;
+  };
+}
diff --git a/modules/nixos/home/programs/tui/ncmpcpp.nix b/modules/nixos/home/programs/cli/ncmpcpp.nix
similarity index 95%
rename from modules/nixos/home/programs/tui/ncmpcpp.nix
rename to modules/nixos/home/programs/cli/ncmpcpp.nix
index 19a9b99..80ebd94 100644
--- a/modules/nixos/home/programs/tui/ncmpcpp.nix
+++ b/modules/nixos/home/programs/cli/ncmpcpp.nix
@@ -4,10 +4,10 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.music.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.media.enable) {
     programs.ncmpcpp = {
       enable = true;
       package = pkgs.ncmpcpp.override {
diff --git a/modules/nixos/home/programs/cli/nushell.nix b/modules/nixos/home/programs/cli/nushell.nix
index 45145de..438a2ff 100644
--- a/modules/nixos/home/programs/cli/nushell.nix
+++ b/modules/nixos/home/programs/cli/nushell.nix
@@ -4,12 +4,12 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.tools.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.terminal.shell.nushell.enable) {
     programs.nushell = {
-      enable = false;
+      enable = true;
       extraConfig = ''
         $env.config = {
           show_banner: false,
diff --git a/modules/nixos/home/programs/cli/yazi.nix b/modules/nixos/home/programs/cli/yazi.nix
new file mode 100644
index 0000000..8c43535
--- /dev/null
+++ b/modules/nixos/home/programs/cli/yazi.nix
@@ -0,0 +1,11 @@
+{
+  osConfig,
+  lib,
+  ...
+}: let
+  cfg = osConfig.nest.programs;
+in {
+  config = lib.mkIf cfg.cli {
+    programs.yazi.enable = true;
+  };
+}
diff --git a/modules/nixos/home/programs/default.nix b/modules/nixos/home/programs/default.nix
index 8b2c7a5..e836b86 100644
--- a/modules/nixos/home/programs/default.nix
+++ b/modules/nixos/home/programs/default.nix
@@ -2,6 +2,5 @@
   imports = [
     ./cli
     ./gui
-    ./tui
   ];
 }
diff --git a/modules/nixos/home/programs/gui/browsers/chromium.nix b/modules/nixos/home/programs/gui/browsers/chromium.nix
index bc9feb3..97c8495 100644
--- a/modules/nixos/home/programs/gui/browsers/chromium.nix
+++ b/modules/nixos/home/programs/gui/browsers/chromium.nix
@@ -3,9 +3,9 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs.categories.web;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.gui && cfg.browsers.chromium.enable) {
     programs.chromium = {
       enable = true;
       extensions = [
diff --git a/modules/nixos/home/programs/gui/browsers/firefox/default.nix b/modules/nixos/home/programs/gui/browsers/firefox/default.nix
index a82bb62..0fa9324 100644
--- a/modules/nixos/home/programs/gui/browsers/firefox/default.nix
+++ b/modules/nixos/home/programs/gui/browsers/firefox/default.nix
@@ -4,7 +4,7 @@
   inputs,
   ...
 }: let
-  cfg = osConfig.settings.programs.categories.web;
+  cfg = osConfig.nest.programs;
   ffConfig = {
     "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
     "browser.ml.chat.enabled" = false;
@@ -23,7 +23,7 @@ in {
     ./policies.nix
   ];
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.gui && cfg.browsers.firefox.enable) {
     programs.firefox = {
       enable = true;
 
diff --git a/modules/nixos/home/programs/gui/browsers/floorp.nix b/modules/nixos/home/programs/gui/browsers/floorp.nix
index 47632d2..de24e2e 100644
--- a/modules/nixos/home/programs/gui/browsers/floorp.nix
+++ b/modules/nixos/home/programs/gui/browsers/floorp.nix
@@ -3,9 +3,9 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs.categories.web;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.gui && cfg.browsers.chromium.enable) {
     programs.floorp = {
       enable = true;
       profiles.default = {
diff --git a/modules/nixos/home/programs/gui/default.nix b/modules/nixos/home/programs/gui/default.nix
index f44699b..e3f1c40 100644
--- a/modules/nixos/home/programs/gui/default.nix
+++ b/modules/nixos/home/programs/gui/default.nix
@@ -5,87 +5,76 @@
   ...
 }: let
   inherit (lib) optionals concatLists;
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
   imports = [
     ./browsers
-    ./waybar # core
-    # ./cura.nix # 3dp
-    # ./lightburn.nix # cnc
-    # ./obs-studio.nix # media
-    ./quickshell.nix # core
-    ./spicetify.nix # music
-    ./thunderbird.nix # mail
-    ./tofi.nix # core
-    ./zed # dev
+    ./waybar
+    # ./lightburn.nix
+    # ./obs-studio.nix
+    ./quickshell.nix
+    ./spicetify.nix
+    ./thunderbird.nix
+    ./tofi.nix
+    ./zed
   ];
 
-  config = lib.mkIf cfg.gui.enable {
+  config = lib.mkIf cfg.gui {
     home.packages = with pkgs;
       concatLists [
-        (optionals cfg.categories.tools.enable [
+        [
           keepassxc
           localsend
           polkit_gnome
           popsicle
-          qbittorrent
-        ])
+          nautilus
+        ]
 
-        (optionals cfg.categories.fun.enable [
-          calibre
+        (optionals cfg.games.enable [
           prismlauncher
-          vesktop
-          hexchat
-          (discord.override {
-            withOpenASAR = true;
-          })
         ])
 
-        (optionals cfg.categories.privacy.enable [
+        (optionals cfg.privacy.enable [
           tor-browser
         ])
 
-        (optionals cfg.categories.media.enable [
+        (optionals cfg.media.enable [
           # darktable
           eog
           mpv
-        ])
-
-        (optionals cfg.categories.fs.enable [
-          nautilus
-        ])
-
-        # (optionals cfg.categories.dev.enable [
-        #   vscode
-        # ])
+          calibre
+          qbittorrent
 
-        (optionals cfg.categories.design.enable [
-          # graphic design
+          # TODO split up into design category
           aseprite
           inkscape
-
-          # 3D design
-          # blender
           openscad
         ])
 
-        (optionals cfg.categories.edu.enable [
-          # drawio
-          # ganttproject-bin
+        (optionals cfg.social.enable [
+          vesktop
+          hexchat
+          (discord.override {
+            withOpenASAR = true;
+          })
+        ])
+
+        (optionals cfg.productivity.enable [
           libreoffice
-          # logseq
           qalculate-qt
-          # blanket
         ])
       ]
       ++ (with pkgs.unstable;
         concatLists [
-          (optionals cfg.categories.tools.enable [
-            obsidian
+          (optionals cfg.privacy.enable [
             veracrypt
           ])
 
-          (optionals cfg.categories.design.enable [
+          (optionals cfg.productivity.enable [
+            obsidian
+          ])
+
+          (optionals cfg.media.enable [
             cura-appimage
           ])
         ]);
diff --git a/modules/nixos/home/programs/gui/lightburn.nix b/modules/nixos/home/programs/gui/lightburn.nix
index 248c515..d11b5f5 100644
--- a/modules/nixos/home/programs/gui/lightburn.nix
+++ b/modules/nixos/home/programs/gui/lightburn.nix
@@ -4,10 +4,9 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.gui {
     home.packages = [
       (
         let
diff --git a/modules/nixos/home/programs/gui/obs-studio.nix b/modules/nixos/home/programs/gui/obs-studio.nix
index 2726945..87ac06c 100644
--- a/modules/nixos/home/programs/gui/obs-studio.nix
+++ b/modules/nixos/home/programs/gui/obs-studio.nix
@@ -4,10 +4,10 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.media.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.media.enable) {
     programs.obs-studio = {
       enable = true;
       plugins = with pkgs.obs-studio-plugins; [
diff --git a/modules/nixos/home/programs/gui/quickshell.nix b/modules/nixos/home/programs/gui/quickshell.nix
index e4bb5ae..5fbde00 100644
--- a/modules/nixos/home/programs/gui/quickshell.nix
+++ b/modules/nixos/home/programs/gui/quickshell.nix
@@ -5,10 +5,9 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.gui {
     home.packages = [
       inputs.quickshell.packages.${pkgs.stdenv.hostPlatform.system}.default
     ];
diff --git a/modules/nixos/home/programs/gui/spicetify.nix b/modules/nixos/home/programs/gui/spicetify.nix
index 8216ab1..7027b47 100644
--- a/modules/nixos/home/programs/gui/spicetify.nix
+++ b/modules/nixos/home/programs/gui/spicetify.nix
@@ -5,13 +5,13 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
   spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.stdenv.hostPlatform.system};
 in {
   imports = [inputs.spicetify-nix.homeManagerModules.default];
 
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.music.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.media.enable) {
     programs.spicetify = {
       enable = true;
       enabledExtensions = with spicePkgs.extensions; [
diff --git a/modules/nixos/home/programs/gui/thunderbird.nix b/modules/nixos/home/programs/gui/thunderbird.nix
index ce5a782..b7f17c4 100644
--- a/modules/nixos/home/programs/gui/thunderbird.nix
+++ b/modules/nixos/home/programs/gui/thunderbird.nix
@@ -3,10 +3,10 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.mail.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.productivity.enable) {
     programs.thunderbird = {
       enable = true;
       profiles."default" = {
diff --git a/modules/nixos/home/programs/gui/tofi.nix b/modules/nixos/home/programs/gui/tofi.nix
index 95a3fff..a059b37 100644
--- a/modules/nixos/home/programs/gui/tofi.nix
+++ b/modules/nixos/home/programs/gui/tofi.nix
@@ -4,10 +4,9 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.gui {
     programs.tofi = {
       enable = true;
       settings = {
diff --git a/modules/nixos/home/programs/gui/waybar/default.nix b/modules/nixos/home/programs/gui/waybar/default.nix
index cadc804..3fc6d17 100644
--- a/modules/nixos/home/programs/gui/waybar/default.nix
+++ b/modules/nixos/home/programs/gui/waybar/default.nix
@@ -3,10 +3,9 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.gui {
     programs.waybar = {
       enable = true;
       style = builtins.readFile ./style.css;
diff --git a/modules/nixos/home/programs/gui/zed/default.nix b/modules/nixos/home/programs/gui/zed/default.nix
index ff2fdf3..67cb4b2 100644
--- a/modules/nixos/home/programs/gui/zed/default.nix
+++ b/modules/nixos/home/programs/gui/zed/default.nix
@@ -5,12 +5,12 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.dev.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.devtools.enable) {
     home = let
-      inherit (osConfig.settings.system.user) flakeDir;
+      inherit (osConfig.nest.system.user) flakeDir;
       mkLink = config.lib.file.mkOutOfStoreSymlink;
       settingsFile = mkLink "${flakeDir}/modules/nixos/programs/gui/zed/settings.json";
       keymapFile = mkLink "${flakeDir}/modules/nixos/programs/gui/zed/keymap.json";
diff --git a/modules/nixos/home/programs/tui/default.nix b/modules/nixos/home/programs/tui/default.nix
deleted file mode 100644
index 380c08b..0000000
--- a/modules/nixos/home/programs/tui/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  pkgs,
-  osConfig,
-  lib,
-  ...
-}: let
-  inherit (lib) optionals concatLists;
-  cfg = osConfig.settings.programs;
-in {
-  imports = [
-    # ./lazygit.nix # dev
-    ./ncmpcpp.nix
-    ./yazi.nix
-  ];
-
-  config = lib.mkIf cfg.tui.enable {
-    home.packages = with pkgs;
-      concatLists [
-        (optionals cfg.categories.tools.enable [
-          peaclock
-        ])
-      ];
-  };
-}
diff --git a/modules/nixos/home/programs/tui/lazygit.nix b/modules/nixos/home/programs/tui/lazygit.nix
deleted file mode 100644
index d2b5388..0000000
--- a/modules/nixos/home/programs/tui/lazygit.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  osConfig,
-  lib,
-  ...
-}: let
-  cfg = osConfig.settings.programs;
-in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.dev.enable) {
-    programs.lazygit.enable = true;
-  };
-}
diff --git a/modules/nixos/home/programs/tui/yazi.nix b/modules/nixos/home/programs/tui/yazi.nix
deleted file mode 100644
index 6ed35e1..0000000
--- a/modules/nixos/home/programs/tui/yazi.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  osConfig,
-  lib,
-  ...
-}: let
-  cfg = osConfig.settings.programs;
-in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.fs.enable) {
-    programs.yazi.enable = true;
-  };
-}
diff --git a/modules/nixos/home/services/mpd.nix b/modules/nixos/home/services/mpd.nix
index 745a9fd..85a1bef 100644
--- a/modules/nixos/home/services/mpd.nix
+++ b/modules/nixos/home/services/mpd.nix
@@ -5,7 +5,7 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs.categories.music;
+  cfg = osConfig.nest.services.selfhost.mpd;
 in {
   config = lib.mkIf cfg.enable {
     services = {
diff --git a/modules/nixos/home/themes/gtk.nix b/modules/nixos/home/themes/gtk.nix
index 5423c66..e52499a 100644
--- a/modules/nixos/home/themes/gtk.nix
+++ b/modules/nixos/home/themes/gtk.nix
@@ -3,7 +3,7 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.desktop;
+  cfg = osConfig.nest.desktop;
 in {
   config = lib.mkIf cfg.enable {
     gtk = {
diff --git a/modules/nixos/home/themes/qt.nix b/modules/nixos/home/themes/qt.nix
index e5f5543..9af6335 100644
--- a/modules/nixos/home/themes/qt.nix
+++ b/modules/nixos/home/themes/qt.nix
@@ -3,7 +3,7 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.desktop;
+  cfg = osConfig.nest.desktop;
 in {
   config = lib.mkIf cfg.enable {
     qt = {
diff --git a/modules/nixos/home/themes/stylix.nix b/modules/nixos/home/themes/stylix.nix
index 99d334e..4b92d3e 100644
--- a/modules/nixos/home/themes/stylix.nix
+++ b/modules/nixos/home/themes/stylix.nix
@@ -5,7 +5,7 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.desktop;
+  cfg = osConfig.nest.desktop;
 in {
   imports = [inputs.stylix.homeModules.stylix];
 
diff --git a/modules/nixos/programs/default.nix b/modules/nixos/programs/default.nix
index 1119575..43e3efd 100644
--- a/modules/nixos/programs/default.nix
+++ b/modules/nixos/programs/default.nix
@@ -1,8 +1,6 @@
-{
-  lib,
-  config,
-  ...
-}: {
+{config, ...}: let
+  cfg = config.nest.programs;
+in {
   imports = [
     ./fonts.nix
   ];
@@ -13,7 +11,7 @@
       clean.enable = true;
       clean.extraArgs = "--keep-since 4d --keep 3";
     };
-    steam.enable = lib.mkDefault config.settings.desktop.enable;
-    zsh.enable = true;
+    steam.enable = cfg.games.enable;
+    zsh.enable = cfg.terminal.shell.zsh.enable;
   };
 }
diff --git a/modules/nixos/programs/fonts.nix b/modules/nixos/programs/fonts.nix
index 7fb7da3..b6d85ed 100644
--- a/modules/nixos/programs/fonts.nix
+++ b/modules/nixos/programs/fonts.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.desktop;
+  cfg = config.nest.desktop;
 in {
   config = lib.mkIf cfg.enable {
     fonts = {
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 0d5e3c2..69c4857 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -4,21 +4,22 @@
   config,
   ...
 }: let
-  cfg = config.settings.system.services;
+  cfg = config.nest.services;
 in {
   imports = [
     ./i18n.nix
     ./mpdscribble.nix
     ./pipewire.nix
     ./printing.nix
-    ./privacy.nix
     ./restic.nix
+    ./tor.nix
     # ./sddm.nix
     # ./xfce.nix
   ];
 
   config = lib.mkIf cfg.enable {
     services = {
+      # TODO some of these can probably be disabled for server environments
       gnome.gnome-keyring.enable = true;
       dbus.enable = true; # D-Bus message bus
       fstrim.enable = true; # SSD TRIM
diff --git a/modules/nixos/services/mpdscribble.nix b/modules/nixos/services/mpdscribble.nix
index 500e6cd..e0a0063 100644
--- a/modules/nixos/services/mpdscribble.nix
+++ b/modules/nixos/services/mpdscribble.nix
@@ -3,7 +3,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.programs.categories.music;
+  cfg = config.nest.services.selfhost.mpd;
 in {
   config = lib.mkIf cfg.enable {
     services.mpdscribble = {
diff --git a/modules/nixos/services/pipewire.nix b/modules/nixos/services/pipewire.nix
index 5d2c74c..e187a08 100644
--- a/modules/nixos/services/pipewire.nix
+++ b/modules/nixos/services/pipewire.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.system.services.sound;
+  cfg = config.nest.services.sound;
 in {
   config = lib.mkIf cfg.enable {
     # Enable sound with pipewire
diff --git a/modules/nixos/services/printing.nix b/modules/nixos/services/printing.nix
index 7c875e6..e650464 100644
--- a/modules/nixos/services/printing.nix
+++ b/modules/nixos/services/printing.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.system.services.printing;
+  cfg = config.nest.services.printing;
 in {
   config = lib.mkIf cfg.enable {
     services.printing = {
@@ -23,7 +23,7 @@ in {
       openFirewall = true;
     };
 
-    hardware.printers = {
+    hardware.printers = lib.mkIf cfg.profiles.enable {
       ensurePrinters = [
         {
           # http://localhost:631/printers/Brother-HL-5340D
diff --git a/modules/nixos/services/privacy.nix b/modules/nixos/services/privacy.nix
deleted file mode 100644
index 841dba5..0000000
--- a/modules/nixos/services/privacy.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.settings.system.services.privacy;
-in {
-  config = lib.mkIf cfg.enable {
-    # services.tor = {
-    #   enable = true;
-    #   client.enable = true;
-    #   client.dns.enable = true;
-    #   torsocks.enable = true;
-    # };
-  };
-}
diff --git a/modules/nixos/services/restic.nix b/modules/nixos/services/restic.nix
index 84dc491..1ea7709 100644
--- a/modules/nixos/services/restic.nix
+++ b/modules/nixos/services/restic.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.system.services.backups;
+  cfg = config.nest.services.backups;
 in {
   config = lib.mkIf cfg.enable {
     users = {
@@ -26,6 +26,7 @@ in {
     services.restic.backups = {
       remotebackup = {
         passwordFile = "${config.age.secrets.restic.path}";
+        # TODO move these to config (per-device and required)
         paths = [
           "/mnt/shared/docs"
           "/mnt/shared/git"
diff --git a/modules/nixos/services/tor.nix b/modules/nixos/services/tor.nix
new file mode 100644
index 0000000..57c59ee
--- /dev/null
+++ b/modules/nixos/services/tor.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.nest.services.networking.tor;
+in {
+  config = lib.mkIf cfg.enable {
+    services.tor = {
+      enable = true;
+      client.enable = true;
+      client.dns.enable = true;
+      torsocks.enable = true;
+    };
+  };
+}
diff --git a/modules/nixos/system/network.nix b/modules/nixos/system/network.nix
index 85f52a2..c2b1ae0 100644
--- a/modules/nixos/system/network.nix
+++ b/modules/nixos/system/network.nix
@@ -1,14 +1,17 @@
 {
   config,
   pkgs,
+  lib,
   ...
-}: {
+}: let
+  cfg = config.nest.services.networking;
+in {
   networking = {
-    inherit (config.settings.system) hostName;
+    inherit (config.nest.system) hostName;
     networkmanager = {
       enable = true;
       # https://github.com/Janik-Haag/nm2nix
-      ensureProfiles = {
+      ensureProfiles = lib.mkIf cfg.profiles.enable {
         environmentFiles = [config.age.secrets.wifi.path];
 
         # https://github.com/alyraffauf/nixcfg/blob/4ccc90fe11c63702879cf50b888ee460c185400d/common/wifi.nix
diff --git a/modules/nixos/themes/catppuccin.nix b/modules/nixos/themes/catppuccin.nix
index dbe554f..47cb4a6 100644
--- a/modules/nixos/themes/catppuccin.nix
+++ b/modules/nixos/themes/catppuccin.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.settings.desktop;
+  cfg = config.nest.desktop;
 in {
   imports = [
     inputs.catppuccin.nixosModules.catppuccin
diff --git a/modules/shared/home/default.nix b/modules/shared/home/default.nix
index 5dd655b..6a9de3e 100644
--- a/modules/shared/home/default.nix
+++ b/modules/shared/home/default.nix
@@ -3,7 +3,7 @@
   config,
   ...
 }: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 in {
   home-manager = {
     useGlobalPkgs = true;
diff --git a/modules/shared/home/home.nix b/modules/shared/home/home.nix
index 2b562cd..f92ca40 100644
--- a/modules/shared/home/home.nix
+++ b/modules/shared/home/home.nix
@@ -1,5 +1,5 @@
 {osConfig, ...}: let
-  inherit (osConfig.settings.system) user;
+  inherit (osConfig.nest.system) user;
 in {
   imports = [
     ./programs
diff --git a/modules/shared/home/programs/cli/atuin.nix b/modules/shared/home/programs/cli/atuin.nix
index e98f70b..ec9e377 100644
--- a/modules/shared/home/programs/cli/atuin.nix
+++ b/modules/shared/home/programs/cli/atuin.nix
@@ -4,11 +4,11 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
   # TODO: sync and dedicated server
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.terminal.shell.atuin.enable) {
     programs.atuin = {
       enable = true;
 
diff --git a/modules/shared/home/programs/cli/bat.nix b/modules/shared/home/programs/cli/bat.nix
index 6ea2a38..46bc691 100644
--- a/modules/shared/home/programs/cli/bat.nix
+++ b/modules/shared/home/programs/cli/bat.nix
@@ -3,10 +3,9 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
-    programs.bat.enable = true;
+  config = lib.mkIf cfg.cli {
+    programs.bat.enable = cfg.terminal.tools.bat.enable;
   };
 }
diff --git a/modules/shared/home/programs/cli/beets.nix b/modules/shared/home/programs/cli/beets.nix
index 16985c2..d207257 100644
--- a/modules/shared/home/programs/cli/beets.nix
+++ b/modules/shared/home/programs/cli/beets.nix
@@ -5,11 +5,12 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
   inherit (pkgs) stdenv;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.music.enable) {
+  # TODO different config setting
+  config = lib.mkIf (cfg.cli
+    && cfg.media.enable) {
     systemd.user.services.mpdstats =
       lib.mkIf (stdenv.isLinux
         && config.services.mpd.enable)
diff --git a/modules/shared/home/programs/cli/btop.nix b/modules/shared/home/programs/cli/btop.nix
new file mode 100644
index 0000000..8c19b1a
--- /dev/null
+++ b/modules/shared/home/programs/cli/btop.nix
@@ -0,0 +1,11 @@
+{
+  osConfig,
+  lib,
+  ...
+}: let
+  cfg = osConfig.nest.programs;
+in {
+  config = lib.mkIf cfg.cli {
+    programs.btop.enable = true;
+  };
+}
diff --git a/modules/shared/home/programs/cli/bun.nix b/modules/shared/home/programs/cli/bun.nix
index 88621b9..c1c2311 100644
--- a/modules/shared/home/programs/cli/bun.nix
+++ b/modules/shared/home/programs/cli/bun.nix
@@ -3,10 +3,9 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.dev.enable) {
+  config = {
     programs.bun.enable = true;
   };
 }
diff --git a/modules/shared/home/programs/cli/default.nix b/modules/shared/home/programs/cli/default.nix
index aeb4a48..7c2a436 100644
--- a/modules/shared/home/programs/cli/default.nix
+++ b/modules/shared/home/programs/cli/default.nix
@@ -6,37 +6,40 @@
   ...
 }: let
   inherit (lib) optionals concatLists;
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
   imports = [
     ./atuin.nix
     ./bat.nix
     ./beets.nix
+    ./btop.nix
     ./bun.nix
     ./direnv.nix
     ./eza.nix
     ./fzf.nix
     ./git.nix
+    ./gitui.nix
+    ./helix
     ./ripgrep.nix
     ./starship.nix
     ./zoxide.nix
     ./zsh.nix
   ];
 
-  config = lib.mkIf cfg.cli.enable {
+  config = lib.mkIf cfg.cli {
     home.packages = with pkgs;
     with inputs;
       concatLists [
-        (optionals cfg.categories.tools.enable [
+        [
           catppuccin.packages."${pkgs.stdenv.hostPlatform.system}".catwalk
           catppuccin.packages."${pkgs.stdenv.hostPlatform.system}".whiskers
 
-          # archivebox
           just
           tldr
           typst
-        ])
-        (optionals cfg.categories.dev.enable [
+        ]
+        (optionals cfg.devtools.enable [
+          # TODO use categories
           pnpm
 
           # nix
diff --git a/modules/shared/home/programs/cli/direnv.nix b/modules/shared/home/programs/cli/direnv.nix
index d88763a..83ef966 100644
--- a/modules/shared/home/programs/cli/direnv.nix
+++ b/modules/shared/home/programs/cli/direnv.nix
@@ -4,10 +4,10 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.dev.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.devtools.nix.enable) {
     programs.direnv = {
       enable = true;
       silent = true;
diff --git a/modules/shared/home/programs/cli/eza.nix b/modules/shared/home/programs/cli/eza.nix
index c486d76..7a41376 100644
--- a/modules/shared/home/programs/cli/eza.nix
+++ b/modules/shared/home/programs/cli/eza.nix
@@ -4,10 +4,9 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.tools.enable) {
+  config = lib.mkIf (cfg.cli) {
     programs.eza = {
       enable = true;
       icons = "auto";
diff --git a/modules/shared/home/programs/cli/fzf.nix b/modules/shared/home/programs/cli/fzf.nix
index dd14e8d..fba83f5 100644
--- a/modules/shared/home/programs/cli/fzf.nix
+++ b/modules/shared/home/programs/cli/fzf.nix
@@ -4,10 +4,10 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.tools.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.terminal.tools.fzf.enable) {
     programs.fzf = {
       enable = true;
       enableBashIntegration = config.programs.bash.enable;
diff --git a/modules/shared/home/programs/cli/git.nix b/modules/shared/home/programs/cli/git.nix
index c305148..71f0842 100644
--- a/modules/shared/home/programs/cli/git.nix
+++ b/modules/shared/home/programs/cli/git.nix
@@ -4,17 +4,19 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.cli {
     programs.git = {
       enable = true;
       lfs.enable = true;
 
       settings = {
-        user.name = "willow";
-        user.email = "42willow" + "@" + "pm.me";
+        user = {
+          name = "willow";
+          email = "42willow" + "@" + "pm.me";
+          signingkey = osConfig.age.secrets.gh.path;
+        };
 
         alias = {
           co = "checkout";
@@ -51,7 +53,6 @@ in {
         # commit signing
         commit.gpgsign = true;
         gpg.format = "ssh";
-        user.signingkey = osConfig.age.secrets.gh.path;
         gpg.ssh.allowedSignersFile = "${config.home.homeDirectory}/.ssh/allowed_signers";
       };
     };
diff --git a/modules/shared/home/programs/tui/gitui.nix b/modules/shared/home/programs/cli/gitui.nix
similarity index 84%
rename from modules/shared/home/programs/tui/gitui.nix
rename to modules/shared/home/programs/cli/gitui.nix
index f9fcf99..4a6f94e 100644
--- a/modules/shared/home/programs/tui/gitui.nix
+++ b/modules/shared/home/programs/cli/gitui.nix
@@ -3,10 +3,9 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.dev.enable) {
+  config = lib.mkIf cfg.cli {
     programs.gitui = {
       enable = true;
 
diff --git a/modules/shared/home/programs/tui/helix/default.nix b/modules/shared/home/programs/cli/helix/default.nix
similarity index 95%
rename from modules/shared/home/programs/tui/helix/default.nix
rename to modules/shared/home/programs/cli/helix/default.nix
index 5bc45b4..5deb69a 100644
--- a/modules/shared/home/programs/tui/helix/default.nix
+++ b/modules/shared/home/programs/cli/helix/default.nix
@@ -5,13 +5,14 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.core.enable) {
-    xdg.configFile.".prettierrc.json".text = builtins.toJSON (import ./prettier.nix {inherit pkgs;});
-    xdg.configFile.".dprint.jsonc".text = builtins.toJSON (import ./dprint.nix {inherit pkgs;});
-    xdg.configFile."moxide/settings.toml".source = ./moxide.toml;
+  config = lib.mkIf cfg.cli {
+    xdg.configFile = {
+      ".dprint.jsonc".text = builtins.toJSON (import ./dprint.nix {inherit pkgs;});
+      ".prettierrc.json".text = builtins.toJSON (import ./prettier.nix {inherit pkgs;});
+      "moxide/settings.toml".source = ./moxide.toml;
+    };
 
     programs.helix = {
       enable = true;
diff --git a/modules/shared/home/programs/tui/helix/dprint.nix b/modules/shared/home/programs/cli/helix/dprint.nix
similarity index 96%
rename from modules/shared/home/programs/tui/helix/dprint.nix
rename to modules/shared/home/programs/cli/helix/dprint.nix
index 440278b..03a0987 100644
--- a/modules/shared/home/programs/tui/helix/dprint.nix
+++ b/modules/shared/home/programs/cli/helix/dprint.nix
@@ -8,7 +8,7 @@
   };
   plugins = with pkgs;
     dprint-plugins.getPluginList (
-      plugins:
+      _plugins:
         with dprint-plugins; [
           dprint-plugin-json
           dprint-plugin-markdown
diff --git a/modules/shared/home/programs/tui/helix/moxide.toml b/modules/shared/home/programs/cli/helix/moxide.toml
similarity index 100%
rename from modules/shared/home/programs/tui/helix/moxide.toml
rename to modules/shared/home/programs/cli/helix/moxide.toml
diff --git a/modules/shared/home/programs/tui/helix/prettier.nix b/modules/shared/home/programs/cli/helix/prettier.nix
similarity index 100%
rename from modules/shared/home/programs/tui/helix/prettier.nix
rename to modules/shared/home/programs/cli/helix/prettier.nix
diff --git a/modules/shared/home/programs/cli/ripgrep.nix b/modules/shared/home/programs/cli/ripgrep.nix
index 372f597..5ac410a 100644
--- a/modules/shared/home/programs/cli/ripgrep.nix
+++ b/modules/shared/home/programs/cli/ripgrep.nix
@@ -2,11 +2,8 @@
   lib,
   osConfig,
   ...
-}: let
-  cfg = osConfig.settings.programs;
-in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.tools.enable) {
+}: {
+  config = lib.mkIf osConfig.nest.programs.terminal.tools.ripgrep.enable {
     programs.ripgrep = {
       enable = true;
 
diff --git a/modules/shared/home/programs/cli/starship.nix b/modules/shared/home/programs/cli/starship.nix
index 9d07cd3..ef9a48c 100644
--- a/modules/shared/home/programs/cli/starship.nix
+++ b/modules/shared/home/programs/cli/starship.nix
@@ -5,7 +5,6 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
   # ss = symbol: style: {
   #   inherit symbol;
   #   format = "[$symbol ](${style})";
@@ -15,8 +14,7 @@
     format = "via [$symbol](${style})";
   };
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf osConfig.nest.programs.terminal.shell.starship.enable {
     programs.starship = {
       enable = true;
       enableBashIntegration = config.programs.bash.enable;
diff --git a/modules/shared/home/programs/cli/zoxide.nix b/modules/shared/home/programs/cli/zoxide.nix
index 8d352ec..eea30c2 100644
--- a/modules/shared/home/programs/cli/zoxide.nix
+++ b/modules/shared/home/programs/cli/zoxide.nix
@@ -4,10 +4,10 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf (cfg.cli
+    && cfg.terminal.tools.zoxide.enable) {
     programs.zoxide = {
       enable = true;
       enableBashIntegration = config.programs.bash.enable;
diff --git a/modules/shared/home/programs/cli/zsh.nix b/modules/shared/home/programs/cli/zsh.nix
index d274a09..6565514 100644
--- a/modules/shared/home/programs/cli/zsh.nix
+++ b/modules/shared/home/programs/cli/zsh.nix
@@ -4,10 +4,10 @@
   config,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.cli.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf cfg.cli {
+    # TODO options
     programs.zsh = {
       enable = true;
       enableCompletion = true;
diff --git a/modules/shared/home/programs/default.nix b/modules/shared/home/programs/default.nix
index 8b2c7a5..e836b86 100644
--- a/modules/shared/home/programs/default.nix
+++ b/modules/shared/home/programs/default.nix
@@ -2,6 +2,5 @@
   imports = [
     ./cli
     ./gui
-    ./tui
   ];
 }
diff --git a/modules/shared/home/programs/gui/terminals/alacritty.nix b/modules/shared/home/programs/gui/terminals/alacritty.nix
index f030e29..6efd136 100644
--- a/modules/shared/home/programs/gui/terminals/alacritty.nix
+++ b/modules/shared/home/programs/gui/terminals/alacritty.nix
@@ -3,10 +3,10 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.terminal.emulator.alacritty.enable) {
     programs.alacritty = {
       enable = true;
       settings = {
diff --git a/modules/shared/home/programs/gui/terminals/ghostty.nix b/modules/shared/home/programs/gui/terminals/ghostty.nix
index d3ab30d..3351734 100644
--- a/modules/shared/home/programs/gui/terminals/ghostty.nix
+++ b/modules/shared/home/programs/gui/terminals/ghostty.nix
@@ -5,10 +5,10 @@
   pkgs,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.terminal.emulator.ghostty.enable) {
     programs.ghostty = {
       enable = true;
 
diff --git a/modules/shared/home/programs/gui/terminals/kitty.nix b/modules/shared/home/programs/gui/terminals/kitty.nix
index 33e3ae5..64edbe5 100644
--- a/modules/shared/home/programs/gui/terminals/kitty.nix
+++ b/modules/shared/home/programs/gui/terminals/kitty.nix
@@ -3,10 +3,10 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.core.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.terminal.emulator.kitty.enable) {
     programs.kitty = {
       enable = false;
       settings = {
diff --git a/modules/shared/home/programs/gui/zathura.nix b/modules/shared/home/programs/gui/zathura.nix
index 331c447..27928b2 100644
--- a/modules/shared/home/programs/gui/zathura.nix
+++ b/modules/shared/home/programs/gui/zathura.nix
@@ -3,10 +3,10 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs;
+  cfg = osConfig.nest.programs;
 in {
-  config = lib.mkIf (cfg.gui.enable
-    && cfg.categories.media.enable) {
+  config = lib.mkIf (cfg.gui
+    && cfg.media.enable) {
     programs.zathura = {
       enable = false;
 
diff --git a/modules/shared/home/programs/tui/btop.nix b/modules/shared/home/programs/tui/btop.nix
deleted file mode 100644
index cbaa69a..0000000
--- a/modules/shared/home/programs/tui/btop.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  osConfig,
-  lib,
-  ...
-}: let
-  cfg = osConfig.settings.programs;
-in {
-  config = lib.mkIf (cfg.tui.enable
-    && cfg.categories.core.enable) {
-    programs.btop.enable = true;
-  };
-}
diff --git a/modules/shared/home/programs/tui/default.nix b/modules/shared/home/programs/tui/default.nix
deleted file mode 100644
index 80f86ad..0000000
--- a/modules/shared/home/programs/tui/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  imports = [
-    ./helix
-    ./btop.nix
-    ./gitui.nix
-  ];
-}
diff --git a/modules/shared/home/scripts/spotdl.nix b/modules/shared/home/scripts/spotdl.nix
index eb00b19..b1d2835 100644
--- a/modules/shared/home/scripts/spotdl.nix
+++ b/modules/shared/home/scripts/spotdl.nix
@@ -4,9 +4,9 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.programs.categories.music;
+  cfg = osConfig.nest.programs.media;
 
-  # TODO)) Add queuing for multiple URLs
+  # TODO Add queuing for multiple URLs
   bdl = pkgs.writeShellScriptBin "bdl" ''
     echo "Please enter the Spotify URL:"
     ${lib.getExe pkgs.unstable.spotdl} --version
diff --git a/modules/shared/home/services/syncthing.nix b/modules/shared/home/services/syncthing.nix
index 5616583..7a0af0a 100644
--- a/modules/shared/home/services/syncthing.nix
+++ b/modules/shared/home/services/syncthing.nix
@@ -4,7 +4,7 @@
   osConfig,
   ...
 }: let
-  cfg = osConfig.settings.system.services.sync;
+  cfg = osConfig.nest.services.syncthing;
 
   devices = {
     starling.id = "3NK35IK-ZONOPLB-R277NP3-MUTEU33-PFKOWCZ-U3SB6ZO-YPIBVY5-UTCTIQK";
diff --git a/modules/shared/home/themes/catppuccin.nix b/modules/shared/home/themes/catppuccin.nix
index 0915b5a..15a31a7 100644
--- a/modules/shared/home/themes/catppuccin.nix
+++ b/modules/shared/home/themes/catppuccin.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = osConfig.settings.desktop;
+  cfg = osConfig.nest.desktop;
 in {
   imports = [
     inputs.catppuccin.homeModules.catppuccin
diff --git a/modules/shared/nix/age.nix b/modules/shared/nix/age.nix
index 323760a..f5eb61a 100644
--- a/modules/shared/nix/age.nix
+++ b/modules/shared/nix/age.nix
@@ -5,7 +5,7 @@
   config,
   ...
 }: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
 
   sshDir = user.home + "/.ssh";
 
diff --git a/modules/shared/nix/default.nix b/modules/shared/nix/default.nix
index dec986c..8100ffb 100644
--- a/modules/shared/nix/default.nix
+++ b/modules/shared/nix/default.nix
@@ -3,7 +3,7 @@
   self,
   ...
 }: let
-  inherit (config.settings.system) user;
+  inherit (config.nest.system) user;
   inherit (self) outputs;
 in {
   imports = [
diff --git a/modules/shared/options/default.nix b/modules/shared/options/default.nix
index d18a9dc..8707aeb 100644
--- a/modules/shared/options/default.nix
+++ b/modules/shared/options/default.nix
@@ -1,142 +1,9 @@
 {
-  lib,
-  config,
-  ...
-}: let
-  inherit (lib) mkEnableOption mkOption types;
-
-  cfg = config.settings;
-in {
-  options.settings = {
-    programs = {
-      enable =
-        mkEnableOption "Enable all programs"
-        // {default = true;};
-
-      cli.enable =
-        mkEnableOption "Enable CLI programs"
-        // {default = cfg.programs.enable;};
-      tui.enable =
-        mkEnableOption "Enable TUI programs"
-        // {default = cfg.programs.enable;};
-      gui.enable =
-        mkEnableOption "Enable GUI programs"
-        // {default = cfg.desktop.enable;};
-
-      categories = {
-        enable =
-          mkEnableOption "Enable all program categories"
-          // {default = cfg.programs.enable;};
-        core.enable =
-          mkEnableOption "Enable core programs"
-          // {default = cfg.programs.categories.enable;};
-        design.enable =
-          mkEnableOption "Enable design programs"
-          // {default = cfg.programs.categories.enable;};
-        dev.enable =
-          mkEnableOption "Enable development programs"
-          // {default = cfg.programs.categories.enable;};
-        edu.enable =
-          mkEnableOption "Enable educational programs"
-          // {default = cfg.programs.categories.enable;};
-        fs.enable =
-          mkEnableOption "Enable file management programs"
-          // {default = cfg.programs.categories.enable;};
-        fun.enable =
-          mkEnableOption "Enable fun programs"
-          // {default = cfg.programs.categories.enable;};
-        gaming.enable =
-          mkEnableOption "Enable gaming programs"
-          // {default = cfg.programs.categories.enable;};
-        mail.enable =
-          mkEnableOption "Enable email programs"
-          // {default = cfg.programs.categories.enable;};
-        media.enable =
-          mkEnableOption "Enable multimedia programs"
-          // {default = cfg.programs.categories.enable;};
-        music.enable =
-          mkEnableOption "Enable music programs"
-          // {default = cfg.programs.categories.enable;};
-        printing.enable =
-          mkEnableOption "Enable 3D printing programs"
-          // {default = cfg.programs.categories.enable;};
-        privacy.enable =
-          mkEnableOption "Enable privacy programs"
-          // {default = cfg.programs.categories.enable;};
-        tools.enable =
-          mkEnableOption "Enable QOL programs"
-          // {default = cfg.programs.categories.enable;};
-        web.enable =
-          mkEnableOption "Enable browsers"
-          // {default = cfg.programs.categories.enable;};
-      };
-    };
-
-    system = {
-      user = {
-        name = mkOption {
-          type = types.str;
-          description = "The username of the main user for your system";
-          default = "willow";
-        };
-        home = mkOption {
-          type = types.path;
-          description = "The home directory of the main user for your system";
-          default = "/home/${cfg.system.user.name}";
-        };
-        group = mkOption {
-          type = types.str;
-          description = "The group of the main user for your system";
-          default = "users";
-        };
-        flakeDir = mkOption {
-          type = types.path;
-          description = "The directory of this flake, used for symlinks";
-          default = "${cfg.system.user.home}/flake";
-        };
-      };
-
-      hostName = mkOption {
-        type = types.str;
-        description = "The hostname of your system";
-        default = "nixos";
-      };
-
-      services = {
-        enable =
-          mkEnableOption "Enable system services"
-          // {default = true;};
-        bluetooth.enable =
-          mkEnableOption "Enable Bluetooth"
-          // {default = cfg.system.services.enable;};
-        sound.enable =
-          mkEnableOption "Enable sound"
-          // {default = cfg.system.services.enable;};
-        sync.enable =
-          mkEnableOption "Enable syncthing"
-          // {default = false;};
-        printing.enable =
-          mkEnableOption "Enable printing"
-          // {default = cfg.system.services.enable;};
-        networking.enable =
-          mkEnableOption "Enable networking"
-          // {default = cfg.system.services.enable;};
-        security.enable =
-          mkEnableOption "Enable security"
-          // {default = cfg.system.services.enable;};
-        backups.enable =
-          mkEnableOption "Enable restic"
-          // {default = false;};
-      };
-    };
-
-    desktop = {
-      enable =
-        mkEnableOption "Enable desktop environment"
-        // {default = true;};
-      niri.enable =
-        mkEnableOption "Enable Niri twm"
-        // {default = cfg.desktop.enable;};
-    };
-  };
+  imports = [
+    ./desktop.nix
+    ./profiles.nix
+    ./programs.nix
+    ./services.nix
+    ./system.nix
+  ];
 }
diff --git a/modules/shared/options/desktop.nix b/modules/shared/options/desktop.nix
new file mode 100644
index 0000000..abcf01d
--- /dev/null
+++ b/modules/shared/options/desktop.nix
@@ -0,0 +1,9 @@
+{lib, ...}: let
+  inherit (lib) mkEnableOption;
+in {
+  options.nest.desktop = {
+    enable = mkEnableOption "desktop environment";
+    niri.enable = mkEnableOption "Niri";
+    hyprland.enable = mkEnableOption "Hyprland";
+  };
+}
diff --git a/modules/shared/options/profiles.nix b/modules/shared/options/profiles.nix
new file mode 100644
index 0000000..d93aec4
--- /dev/null
+++ b/modules/shared/options/profiles.nix
@@ -0,0 +1,82 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkOption types recursiveUpdate;
+
+  # base config for desktop and server profiles
+  # the default (no profile) is just the defaults outlined in the options
+  base = {
+    programs = {
+      enable = lib.mkDefault true;
+      cli = lib.mkDefault true;
+      terminal = {
+        shell = {
+          atuin.enable = lib.mkDefault true;
+          starship.enable = lib.mkDefault true;
+          zsh.enable = lib.mkDefault true;
+        };
+        tools.enable = lib.mkDefault true;
+      };
+    };
+    system = {
+      user.shell = lib.mkDefault "zsh";
+    };
+    services = {
+      enable = lib.mkDefault true;
+      networking.enable = lib.mkDefault true;
+    };
+  };
+
+  profiles = {
+    desktop = recursiveUpdate base {
+      programs = {
+        gui = lib.mkDefault true;
+
+        games.enable = lib.mkDefault true;
+        media.enable = lib.mkDefault true;
+        privacy.enable = lib.mkDefault true;
+        productivity.enable = lib.mkDefault true;
+        social.enable = lib.mkDefault true;
+
+        browsers = {
+          helium.enable = lib.mkDefault true;
+          firefox.enable = lib.mkDefault true;
+          chromium.enable = lib.mkDefault true;
+        };
+
+        terminal = {
+          emulator.ghostty.enable = lib.mkDefault true;
+        };
+
+        devtools.enable = true;
+      };
+      services = {
+        enable = lib.mkDefault true;
+        bluetooth.enable = lib.mkDefault true;
+        printing.enable = lib.mkDefault true;
+        sound.enable = lib.mkDefault true;
+      };
+      desktop = {
+        enable = lib.mkDefault true;
+        niri.enable = lib.mkDefault true;
+      };
+    };
+
+    server = recursiveUpdate base {
+      services.ssh.enable = lib.mkDefault true;
+    };
+  };
+in {
+  options.profile = mkOption {
+    type = types.nullOr (types.enum ["desktop" "server"]);
+    default = null;
+    description = "The system profile preset to apply. If null, the system falls back to the minimal defaults.";
+  };
+
+  config.nest =
+    if config.profile != null
+    then profiles.${config.profile}
+    else {};
+}
diff --git a/modules/shared/options/programs.nix b/modules/shared/options/programs.nix
new file mode 100644
index 0000000..eb86d2f
--- /dev/null
+++ b/modules/shared/options/programs.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  lib',
+  config,
+  ...
+}: let
+  inherit (lib) mkEnableOption;
+  inherit (lib') mkProgramOptions programType mkProgramGroup;
+  cfg = config.nest;
+in {
+  options.nest.programs =
+    {
+      enable = mkEnableOption "programs" // {default = true;};
+      cli = mkEnableOption "CLI programs" // {default = true;};
+      gui = mkEnableOption "GUI programs" // {default = cfg.desktop.enable;};
+    }
+    // (with programType;
+      mkProgramOptions {
+        games = mkProgramGroup "games" {};
+        media = mkProgramGroup "media and creative tools" {};
+        privacy = mkProgramGroup "privacy programs" {};
+        productivity = mkProgramGroup "productivity programs" {};
+        social = mkProgramGroup "social programs" {};
+
+        browsers = {
+          chromium = gui;
+          firefox = gui // {extensions.enable = mkEnableOption "firefox extensions";};
+          floorp = gui;
+          helium = gui; # TODO not in nixpkgs yet
+        };
+
+        terminal = {
+          emulator = {
+            ghostty = gui;
+            alacritty = gui;
+            kitty = gui;
+          };
+          shell = {
+            atuin = cli "shell history";
+            starship = cli "terminal prompt";
+            zsh = cli;
+            nushell = cli;
+          };
+          tools = mkProgramGroup "modern terminal utilities" {
+            bat = cli "modern cat";
+            eza = cli "modern ls";
+            fzf = cli "fuzzy finder";
+            ripgrep = cli "modern grep";
+            zoxide = cli "modern cd";
+          };
+        };
+
+        devtools = mkProgramGroup "developer tools" {
+          haskell = mkProgramGroup "haskell tooling" {};
+          nix = mkProgramGroup "nix tooling" {};
+          openscad = mkProgramGroup "openscad tooling" {};
+          python = mkProgramGroup "python tooling" {};
+          rust = mkProgramGroup "rust tooling" {};
+          typst = mkProgramGroup "typst tooling" {};
+          zig = mkProgramGroup "zig tooling" {};
+
+          web = mkProgramGroup "web development tooling" {
+            pnpm = cli "pnpm package manager";
+            bun = cli "bun runtime and toolchain";
+          };
+        };
+      });
+}
diff --git a/modules/shared/options/services.nix b/modules/shared/options/services.nix
new file mode 100644
index 0000000..254fa8b
--- /dev/null
+++ b/modules/shared/options/services.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkEnableOption;
+  cfg = config.nest;
+in {
+  options.nest.services = {
+    enable = mkEnableOption "core system services" // {default = true;}; # TODO clarify what these are and if this option is needed
+    backups = {
+      # TODO: move this to shared/
+      enable = mkEnableOption "backups via restic";
+    };
+    bluetooth.enable = mkEnableOption "Bluetooth";
+    # not available on darwin
+    networking = {
+      enable = mkEnableOption "networking" // {default = cfg.system.services.enable;};
+      profiles.enable = mkEnableOption "NetworkManager profiles" // {default = true;};
+      tailscale.enable = mkEnableOption "tailscale";
+      tor.enable = mkEnableOption "tor network";
+    };
+    # not available on darwin
+    printing = {
+      enable = mkEnableOption "printing";
+      profiles.enable = mkEnableOption "printing profiles" // {default = true;};
+    };
+    # not available on darwin
+    sound.enable = mkEnableOption "sound";
+    ssh.enable = mkEnableOption "SSH server";
+    syncthing.enable = mkEnableOption "syncthing";
+
+    selfhost = {
+      # caddy.enable = mkEnableOption "caddy"; not needed with cloudflared
+      mpd.enable = mkEnableOption "mpd";
+      kanidm.enable = mkEnableOption "kanidm";
+      cloudflared.enable = mkEnableOption "cloudflared";
+      pihole.enable = mkEnableOption "pihole"; # TODO or coredns or adguard home for "split horizon DNS" maybe?
+
+      atuin.enable = mkEnableOption "atuin";
+      pds.enable = mkEnableOption "pds";
+      tangled.knot.enable = mkEnableOption "tangled knot";
+      glance.enable = mkEnableOption "tangled knot";
+      printing3d = {
+        enable = mkEnableOption "3D printing"; # TODO
+        klipper.enable = mkEnableOption "klipper";
+        mainsail.enable = mkEnableOption "mainsail";
+      };
+      navidrome.enable = mkEnableOption "navidrome";
+    };
+  };
+}
diff --git a/modules/shared/options/system.nix b/modules/shared/options/system.nix
new file mode 100644
index 0000000..231347e
--- /dev/null
+++ b/modules/shared/options/system.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption types;
+  cfg = config.nest;
+in {
+  options.nest.system = {
+    hostName = mkOption {
+      type = types.str;
+      description = "The hostname of your system.";
+    };
+
+    user = {
+      name = mkOption {
+        type = types.str;
+        default = "willow";
+      };
+      home = mkOption {
+        type = types.path;
+        default = "/home/${cfg.system.user.name}";
+      };
+      group = mkOption {
+        type = types.str;
+        default = "users";
+      };
+      shell = mkOption {
+        type = lib.types.enum ["zsh" "nushell" "bash"];
+        default = "zsh";
+        description = "The primary interactive shell the user account.";
+      };
+      flakeDir = mkOption {
+        type = types.path;
+        default = "${cfg.system.user.home}/flake";
+      };
+    };
+  };
+}