From 2b619a2be2306d6f6b4bf44568f1f0e97c9830b8 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sat, 14 Feb 2026 14:06:29 +1000
Subject: [PATCH 01/34] add extraSpecialArgs

---
 cerulean/nixos-module/home-manager.nix | 39 ++++++++++++++------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/cerulean/nixos-module/home-manager.nix b/cerulean/nixos-module/home-manager.nix
index e693ac9..97e4530 100644
--- a/cerulean/nixos-module/home-manager.nix
+++ b/cerulean/nixos-module/home-manager.nix
@@ -13,6 +13,7 @@
 # limitations under the License.
 {
   root,
+  system,
   config,
   lib,
   specialArgs,
@@ -25,25 +26,27 @@
     pathExists
     ;
 in {
-  home-manager = {
-    users =
-      config.users.users
-      |> attrNames
-      |> filter (x: pathExists (root + "/homes/${x}"))
-      |> (x: lib.genAttrs x (y: import (root + "/homes/${y}")));
+  config = {
+    home-manager = {
+      users =
+        config.users.users
+        |> attrNames
+        |> filter (x: pathExists (root + "/homes/${x}"))
+        |> (x: lib.genAttrs x (y: import (root + "/homes/${y}")));
 
-    # extraSpecialArgs = specialArgs;
-    sharedModules = [
-      # user configuration
-      # (import (root + "/nixpkgs.nix"))
-      (import (root + "/nixpkgs.nix"))
-      # options declarations
-      # (import ./nixpkgs.nix (args // {contextName = "homes";}))
-      (import ./nixpkgs.nix (args // {contextName = "homes";}))
-    ];
+      extraSpecialArgs = {inherit root system;} // (specialArgs.inputs or {});
+      sharedModules = [
+        # user configuration
+        # (import (root + "/nixpkgs.nix"))
+        (import (root + "/nixpkgs.nix"))
+        # options declarations
+        # (import ./nixpkgs.nix (args // {contextName = "homes";}))
+        (import ./nixpkgs.nix (args // {contextName = "homes";}))
+      ];
 
-    # disable home-manager trying anything fancy
-    # we control the pkgs now!!
-    # useGlobalPkgs = true;
+      # disable home-manager trying anything fancy
+      # we control the pkgs now!!
+      # useGlobalPkgs = true;
+    };
   };
 }

From b7838874d89671d7a42d070f2366b35c00d8c0aa Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sat, 14 Feb 2026 14:42:02 +1000
Subject: [PATCH 02/34] fix overlays bad type

---
 cerulean/nixos-module/nixpkgs.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cerulean/nixos-module/nixpkgs.nix b/cerulean/nixos-module/nixpkgs.nix
index c5a97f7..5bf925f 100644
--- a/cerulean/nixos-module/nixpkgs.nix
+++ b/cerulean/nixos-module/nixpkgs.nix
@@ -21,6 +21,7 @@
   inherit
     (builtins)
     mapAttrs
+    typeOf
     ;
 
   cfg = config.nixpkgs.channels;
@@ -107,7 +108,8 @@ in {
       else if contextName == "homes"
       then {
         config = decl.pkgs.config or {};
-        overlays = decl.pkgs.overlays or {};
+        # XXX: WARNING: TODO: modify options so overlays must always be given as the correct type
+        overlays = decl.pkgs.overlays or [];
       }
       else {};
   };

From 93aa29dc1038cf679547cd0975c4d9ae15491dde Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sat, 14 Feb 2026 16:00:34 +1000
Subject: [PATCH 03/34] support nixpkgs.channels.*.default

---
 cerulean/nixos-module/home-manager.nix |  2 --
 cerulean/nixos-module/nixpkgs.nix      | 43 +++++++++-----------------
 2 files changed, 14 insertions(+), 31 deletions(-)

diff --git a/cerulean/nixos-module/home-manager.nix b/cerulean/nixos-module/home-manager.nix
index 97e4530..21ee78c 100644
--- a/cerulean/nixos-module/home-manager.nix
+++ b/cerulean/nixos-module/home-manager.nix
@@ -37,10 +37,8 @@ in {
       extraSpecialArgs = {inherit root system;} // (specialArgs.inputs or {});
       sharedModules = [
         # user configuration
-        # (import (root + "/nixpkgs.nix"))
         (import (root + "/nixpkgs.nix"))
         # options declarations
-        # (import ./nixpkgs.nix (args // {contextName = "homes";}))
         (import ./nixpkgs.nix (args // {contextName = "homes";}))
       ];
 
diff --git a/cerulean/nixos-module/nixpkgs.nix b/cerulean/nixos-module/nixpkgs.nix
index 5bf925f..65db5a5 100644
--- a/cerulean/nixos-module/nixpkgs.nix
+++ b/cerulean/nixos-module/nixpkgs.nix
@@ -21,7 +21,6 @@
   inherit
     (builtins)
     mapAttrs
-    typeOf
     ;
 
   cfg = config.nixpkgs.channels;
@@ -52,11 +51,6 @@ in {
     };
   };
 
-  # or abort ''
-  #         `nixpkgs.channels.${contextName}` does not exist, but neither does `nixpkgs.channels.default`!
-  #         A channel configuration must be declared for module context "${contextName}".
-  #       ''
-
   config = let
     # TODO: use lib.types.submodule to restrict what options
     # TODO: can be given to `nixpkgs.channels.${moduleName}.${name}`
@@ -68,7 +62,6 @@ in {
       |> mapAttrs (
         name: args:
           lib.mkForce (
-            # builtins.trace "SAVE ME GOT NAME: ${name}" (
             assert args ? source
             || abort ''
               ${toString ./.}
@@ -77,39 +70,31 @@ in {
               ((removeAttrs args ["source"])
                 // {inherit system;})
               |> import args.source
-            # DEBUG: |> lib.mkOverride 200
           )
-        # )
       );
   in {
     # NOTE: _module.args is a special option that allows us to
     # NOTE: set extend specialArgs from inside the modules.
-    # "pkgs" is unique since the nix module system already handles it
-    # DEBUG: _module.args = lib.mkOverride 200 (
-    # _module.args = (
-    #   if contextName == "hosts"
-    #   then repos
-    #   else
-    #     assert (
-    #       repos
-    #       |> builtins.attrNames
-    #       |> map (x: "\"${x}\"")
-    #       |> builtins.concatStringsSep " "
-    #       |> (x: "FUCK YOU SO BAD: { ${x} }")
-    #       |> abort
-    #     );
-    #       removeAttrs repos ["pkgs"]
-    # );
     _module.args = repos;
 
-    nixpkgs =
+    nixpkgs = let
+      defaultPkgs =
+        decl.default or (throw ''
+          Your `nixpkgs.nix` file does not declare a default package source.
+          Ensure you set `nixpkgs.channels.*.default = ...;`
+        '');
+    in
       if contextName == "hosts"
-      then {flake.source = lib.mkIf (decl ? pkgs) (lib.mkOverride 200 decl.pkgs.source);}
+      then {
+        flake.source = lib.mkOverride 200 defaultPkgs.source;
+        config = lib.mkOverride 200 defaultPkgs.config;
+      }
       else if contextName == "homes"
       then {
-        config = decl.pkgs.config or {};
+        # XXX: XXX: XXX: OH OH OH OMG, its because aurora never defines pkgs
+        config = lib.mkOverride 200 (defaultPkgs.config or {});
         # XXX: WARNING: TODO: modify options so overlays must always be given as the correct type
-        overlays = decl.pkgs.overlays or [];
+        overlays = lib.mkOverride 200 (defaultPkgs.overlays or []);
       }
       else {};
   };

From 07ad32475ff2bf25f14060dd368fa005361dcc74 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 13:43:19 +1000
Subject: [PATCH 04/34] only inherit inputs

---
 cerulean/default.nix     | 10 ++--------
 cerulean/nexus/nexus.nix |  8 ++++----
 flake.nix                | 15 +++++++++------
 3 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/cerulean/default.nix b/cerulean/default.nix
index d7797c4..6ec21cc 100644
--- a/cerulean/default.nix
+++ b/cerulean/default.nix
@@ -13,7 +13,7 @@
 # limitations under the License.
 {
   mix,
-  deploy-rs,
+  inputs,
   ...
 } @ args:
 mix.newMixture args (mixture: {
@@ -31,12 +31,6 @@ mix.newMixture args (mixture: {
   overlays = [
     # build deploy-rs as a package not from the flake input,
     # hence we can rely on a nixpkg binary cache.
-    deploy-rs.overlays.default
-    # (self: super: {
-    #   deploy-rs = {
-    #     inherit (super) deploy-rs;
-    #     lib = super.deploy-rs.lib;
-    #   };
-    # })
+    inputs.deploy-rs.overlays.default
   ];
 })
diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 7466bb8..29d7387 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -16,7 +16,7 @@
   this,
   nt,
   lib,
-  deploy-rs,
+  inputs,
   ...
 }: let
   inherit
@@ -192,7 +192,7 @@ in {
                 // {
                   inherit root specialArgs;
                   inherit (node) system;
-                  _deploy-rs = deploy-rs;
+                  _deploy-rs = inputs.deploy-rs;
                 };
             in
               specialArgs;
@@ -220,7 +220,7 @@ in {
           user
           ;
 
-        nixosFor = system: deploy-rs.lib.${system}.activate.nixos;
+        nixosFor = system: inputs.deploy-rs.lib.${system}.activate.nixos;
       in {
         hostname = ssh.host;
 
@@ -256,7 +256,7 @@ in {
         };
       });
 
-      checks = mapAttrs (system: deployLib: deployLib.deployChecks deploy) deploy-rs.lib;
+      checks = mapAttrs (system: deployLib: deployLib.deployChecks deploy) inputs.deploy-rs.lib;
     };
   in
     outputs // customOutputs;
diff --git a/flake.nix b/flake.nix
index ff430bc..1a3f46e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,7 +22,10 @@
 
     nt.url = "github:cry128/nt";
 
-    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs = {
+      url = "github:serokell/deploy-rs";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {
@@ -31,9 +34,9 @@
     ...
   } @ inputs:
     import ./cerulean
-    (inputs
-      // {
-        inherit (nixpkgs) lib;
-        inherit (nt) mix;
-      });
+    {
+      inherit inputs;
+      inherit (nixpkgs) lib;
+      inherit (nt) mix;
+    };
 }

From c244c9791984eebb49bd65f36b9a81968a966bda Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 13:43:37 +1000
Subject: [PATCH 05/34] remove nixpkgs-unstable

---
 flake.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 1a3f46e..24c43ac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -16,10 +16,7 @@
 
   inputs = {
     systems.url = "github:nix-systems/default";
-
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-
     nt.url = "github:cry128/nt";
 
     deploy-rs = {

From b33730c06852ffb57e957c8aa6f743b326ecfee5 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 13:45:39 +1000
Subject: [PATCH 06/34] auto-import home-manager and microvm nixosModules

---
 cerulean/nexus/nexus.nix |  8 +++++++-
 flake.nix                | 10 ++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 29d7387..88f2863 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -197,7 +197,13 @@ in {
             in
               specialArgs;
             modules =
-              [self.nixosModules.default (findImport (root + "/hosts/${nodeName}"))]
+              [
+                self.nixosModules.default
+                (findImport (root + "/hosts/${nodeName}"))
+
+                inputs.home-manager.nixosModules.default
+                inputs.microvm.nixosModules.microvm
+              ]
               ++ (getGroupModules root nodeName node)
               ++ node.extraModules
               ++ nexus.extraModules;
diff --git a/flake.nix b/flake.nix
index 24c43ac..6d911c5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -19,10 +19,20 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nt.url = "github:cry128/nt";
 
+    home-manager = {
+      url = "github:nix-community/home-manager/release-25.11";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     deploy-rs = {
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    microvm = {
+      url = "github:microvm-nix/microvm.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {

From b5c2338456a2f326ff56fae9454b5f24e5a74b88 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 17:34:12 +1000
Subject: [PATCH 07/34] remove overlays

overlays is no longer configured this way
---
 cerulean/nexus/nodes.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index 3d49434..ed1c8ad 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -30,7 +30,6 @@ in rec {
     groups = [];
     extraModules = [];
     specialArgs = Terminal {};
-    overlays = [];
 
     deploy = {
       user = "root";

From 536d48c8c3cdad1542e67b4c85e348e85fdbc1d3 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 17:34:29 +1000
Subject: [PATCH 08/34] add new TODO.md

---
 TODO.md | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/TODO.md b/TODO.md
index 25f6f1b..f5e657d 100755
--- a/TODO.md
+++ b/TODO.md
@@ -1,8 +1,14 @@
-Allow `Cerulean.mkNexus` to be an alias for `flake-parts.lib.mkFlake`
-also rename `Cerulean` to `cerulean` in Nix to maintain the naming convention.
+- [ ] use the Nix module system instead of projectOnto for `cerulean.mkNexus`
+- [ ] find an alternative to `nix.settings.trusted-users` probably
+- [ ] add support for github:microvm-nix/microvm.nix
+- [ ] add support for sops-nix
 
-Using `flake-parts` ensures Cerulean is usable without restricting
-yourself only to the Cerulean ecosystem.
+- [ ] create an alternative to nixos-install called cerulean-install that
+      allows people to easily bootstrap new machines
 
-- [ ] extend the options.nixpkgs to allow any number of package repositories!!
-- [x] auto-propagate the same specialArgs for hosts to home-manager
+
+- [ ] rename nixos-modules/ to nixos/
+
+
+- [ ] add the ceru-build user
+- [ ] ensure all machines are in groups.all by default

From 16d9062e694e6a1de802beabc26731687ba596fd Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 17:34:35 +1000
Subject: [PATCH 09/34] v0.2.1-alpha

---
 cerulean/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cerulean/default.nix b/cerulean/default.nix
index 6ec21cc..449028b 100644
--- a/cerulean/default.nix
+++ b/cerulean/default.nix
@@ -21,7 +21,7 @@ mix.newMixture args (mixture: {
     ./nexus
   ];
 
-  version = "0.2.0";
+  version = "0.2.1";
 
   nixosModules = rec {
     default = cerulean;

From c5c867b43fd25d0aceb12e393d01c3d621a98796 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 17:35:18 +1000
Subject: [PATCH 10/34] always use root group

---
 cerulean/nexus/nexus.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 88f2863..41ef28b 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -133,7 +133,12 @@
       Cerulean Nexus node "${nodeName}" does not declare group membership as a list, got "${typeOf node.groups}" instead!
       Ensure `nexus.nodes.${nodeName}.groups` is a list under your call to `cerulean.mkNexus`.
     '';
-      node.groups
+    # ensure root group is always added
+      (node.groups
+        ++ {
+          _parent = null;
+          _name = ROOT_GROUP_NAME;
+        })
       # ensure all members are actually groups
       |> map (group: let
         got =

From e07047ab50d5328701c628c56d8ef24635b03f6b Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 17:46:37 +1000
Subject: [PATCH 11/34] move nixos-modules/ -> nixos/

---
 cerulean/default.nix                              | 2 +-
 cerulean/{nixos-module => nixos}/default.nix      | 0
 cerulean/{nixos-module => nixos}/home-manager.nix | 0
 cerulean/{nixos-module => nixos}/nixpkgs.nix      | 0
 4 files changed, 1 insertion(+), 1 deletion(-)
 rename cerulean/{nixos-module => nixos}/default.nix (100%)
 rename cerulean/{nixos-module => nixos}/home-manager.nix (100%)
 rename cerulean/{nixos-module => nixos}/nixpkgs.nix (100%)

diff --git a/cerulean/default.nix b/cerulean/default.nix
index 449028b..f24bb5a 100644
--- a/cerulean/default.nix
+++ b/cerulean/default.nix
@@ -25,7 +25,7 @@ mix.newMixture args (mixture: {
 
   nixosModules = rec {
     default = cerulean;
-    cerulean = ./nixos-module;
+    cerulean = ./nixos;
   };
 
   overlays = [
diff --git a/cerulean/nixos-module/default.nix b/cerulean/nixos/default.nix
similarity index 100%
rename from cerulean/nixos-module/default.nix
rename to cerulean/nixos/default.nix
diff --git a/cerulean/nixos-module/home-manager.nix b/cerulean/nixos/home-manager.nix
similarity index 100%
rename from cerulean/nixos-module/home-manager.nix
rename to cerulean/nixos/home-manager.nix
diff --git a/cerulean/nixos-module/nixpkgs.nix b/cerulean/nixos/nixpkgs.nix
similarity index 100%
rename from cerulean/nixos-module/nixpkgs.nix
rename to cerulean/nixos/nixpkgs.nix

From 9127e64fedbc488ed9140b9c9acbf1e389035f4b Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Sun, 15 Feb 2026 23:29:41 +1000
Subject: [PATCH 12/34] more TODO.md

---
 TODO.md | 39 ++++++++++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/TODO.md b/TODO.md
index f5e657d..995ed69 100755
--- a/TODO.md
+++ b/TODO.md
@@ -1,14 +1,39 @@
 - [ ] use the Nix module system instead of projectOnto for `cerulean.mkNexus`
+- [ ] create an alternative to nixos-install called cerulean-install that
+      allows people to easily bootstrap new machines (and host it on dobutterfliescry.net)
+
 - [ ] find an alternative to `nix.settings.trusted-users` probably
+- [ ] add the ceru-build user, 
 - [ ] add support for github:microvm-nix/microvm.nix
 - [ ] add support for sops-nix
 
-- [ ] create an alternative to nixos-install called cerulean-install that
-      allows people to easily bootstrap new machines
+- [ ] it would be cool to enable/disable groups and hosts
+- [ ] find a standard for how nixpkgs.nix can have a different base per group
+
+- [X] rename nixos-modules/ to nixos/
+- [X] ensure all machines are in groups.all by default
+
+## Low Priority
+- [ ] rename extraModules to modules?
+- [ ] rename specialArgs to args?
+
+- [ ] make an extension to the nix module system (different to mix)
+      that allows transformations (ie a stop post config, ie outputs, which
+      it then returns instead of config)
 
 
-- [ ] rename nixos-modules/ to nixos/
-
-
-- [ ] add the ceru-build user
-- [ ] ensure all machines are in groups.all by default
+```
+vms = {
+  home-assistant = {
+    autostart = true;
+    # matches in vms/*
+    image = "home-assistant";
+    options = {
+      mem = 2048;
+    };
+  };
+  equinox = {
+    image = "home-assistant";
+  };
+};
+```

From 2cff3119cd2b9ab29a0936ecf5598eb639b8a477 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 08:17:33 +1000
Subject: [PATCH 13/34] fix nt not propagated

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 6d911c5..220e732 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,7 +42,7 @@
   } @ inputs:
     import ./cerulean
     {
-      inherit inputs;
+      inherit inputs nt;
       inherit (nixpkgs) lib;
       inherit (nt) mix;
     };

From 803f759472aa34d7a4bdbb5d763655893833640b Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 08:19:07 +1000
Subject: [PATCH 14/34] fix self not propagated

---
 flake.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 220e732..8fcd0e0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -36,13 +36,14 @@
   };
 
   outputs = {
+    self,
     nixpkgs,
     nt,
     ...
   } @ inputs:
     import ./cerulean
     {
-      inherit inputs nt;
+      inherit inputs self nt;
       inherit (nixpkgs) lib;
       inherit (nt) mix;
     };

From c24cc9d46f92d2eaa6dc55f43574201aec579708 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 08:20:24 +1000
Subject: [PATCH 15/34] fix [] ++ {} (im oopid)

---
 cerulean/nexus/nexus.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 41ef28b..d17cfdb 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -96,7 +96,7 @@
     assert isAttrs nexus
     || abort ''
       Cerulean Nexus config must be provided as an attribute set, got "${typeOf nexus}" instead!
-      Ensure all the `nexus` declaration is an attribute set under your call to `cerulean.mkNexus`.
+      Ensure the `nexus` declaration is an attribute set under your call to `cerulean.mkNexus`.
     ''; let
       base = nt.projectOnto templateNexus nexus;
     in
@@ -135,10 +135,12 @@
     '';
     # ensure root group is always added
       (node.groups
-        ++ {
-          _parent = null;
-          _name = ROOT_GROUP_NAME;
-        })
+        ++ [
+          {
+            _parent = null;
+            _name = ROOT_GROUP_NAME;
+          }
+        ])
       # ensure all members are actually groups
       |> map (group: let
         got =

From 8dc975fc89c543c9e98cfe3c6dfcd98a41531419 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 08:21:50 +1000
Subject: [PATCH 16/34] fix dont use microvm.nixosModules.microvm by default

---
 TODO.md                           |   6 ++
 cerulean/nexus/nexus.nix          |   2 +-
 cerulean/nexus/nodes.nix          |   1 +
 cerulean/nexus/snow.nix           | 108 ++++++++++++++++++++++++++++++
 cerulean/nixos/microvm-child.nix  |  13 ++++
 cerulean/nixos/microvm-parent.nix |  13 ++++
 6 files changed, 142 insertions(+), 1 deletion(-)
 create mode 100644 cerulean/nexus/snow.nix
 create mode 100644 cerulean/nixos/microvm-child.nix
 create mode 100644 cerulean/nixos/microvm-parent.nix

diff --git a/TODO.md b/TODO.md
index 995ed69..b80f03c 100755
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,12 @@
       it then returns instead of config)
 
 
+- [ ] what if we automated the process of replacing windows with Nix??
+      then push this to nixos-anywhere or nix-infect lmaooo
+
+- [ ] patch microvm so that acpi=off https://github.com/microvm-nix/microvm.nix/commit/b59a26962bb324cc0a134756a323f3e164409b72
+      cause otherwise 2GB causes a failure
+
 ```
 vms = {
   home-assistant = {
diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index d17cfdb..f03d1ce 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -209,7 +209,7 @@ in {
                 (findImport (root + "/hosts/${nodeName}"))
 
                 inputs.home-manager.nixosModules.default
-                inputs.microvm.nixosModules.microvm
+                # inputs.microvm.nixosModules.microvm
               ]
               ++ (getGroupModules root nodeName node)
               ++ node.extraModules
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index ed1c8ad..1687e46 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -26,6 +26,7 @@ in rec {
       Terminal
       ;
   in {
+    enabled = true;
     system = "x86_64-linux"; # sane default (i hope...)
     groups = [];
     extraModules = [];
diff --git a/cerulean/nexus/snow.nix b/cerulean/nexus/snow.nix
new file mode 100644
index 0000000..1316ee3
--- /dev/null
+++ b/cerulean/nexus/snow.nix
@@ -0,0 +1,108 @@
+# Copyright 2026 Emile Clark-Boman
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+{
+  inputs,
+  lib,
+  ...
+}: {
+  # nexus
+  options = let
+    inherit
+      (lib)
+      mkOption
+      types
+      ;
+  in {
+    extraModules = mkOption {
+      type = types.listOf types.path;
+    };
+    specialArgs = mkOption {
+      type = types.attrs;
+    };
+
+    groups = mkOption {
+      type = types.attrs;
+    };
+
+    nodes = mkOption {
+      type = types.attrsOf (types.submoduleWith ({...}: {
+        options = {
+          enabled = mkOption {
+            type = types.bool;
+            default = true;
+          };
+          system = mkOption {
+            type = types.enum inputs.systems;
+          };
+          groups = mkOption {
+            type = types.list;
+          };
+          modules = mkOption {
+            type = types.list;
+          };
+          args = mkOption {
+            type = types.attrs;
+          };
+
+          deploy = {
+            user = mkOption {
+              type = types.str;
+            };
+            sudoCmd = mkOption {
+              type = types.str;
+            };
+            interactiveSudo = mkOption {
+              type = types.bool;
+            };
+
+            remoteBuild = mkOption {
+              type = types.bool;
+            };
+            autoRollback = mkOption {
+              type = types.bool;
+            };
+            magicRollback = mkOption {
+              type = types.bool;
+            };
+
+            activationTimeout = mkOption {
+              type = types.int;
+            };
+            confirmTimeout = mkOption {
+              type = types.int;
+            };
+
+            ssh = {
+              host = mkOption {
+                type = types.str;
+              };
+              user = mkOption {
+                type = types.str;
+              };
+              port = mkOption {
+                type = types.int;
+              };
+              opts = mkOption {
+                type = types.listOf types.str;
+              };
+            };
+          };
+        };
+      }));
+    };
+  };
+
+  config = {
+  };
+}
diff --git a/cerulean/nixos/microvm-child.nix b/cerulean/nixos/microvm-child.nix
new file mode 100644
index 0000000..2b6a12e
--- /dev/null
+++ b/cerulean/nixos/microvm-child.nix
@@ -0,0 +1,13 @@
+# Copyright 2026 Emile Clark-Boman
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
diff --git a/cerulean/nixos/microvm-parent.nix b/cerulean/nixos/microvm-parent.nix
new file mode 100644
index 0000000..2b6a12e
--- /dev/null
+++ b/cerulean/nixos/microvm-parent.nix
@@ -0,0 +1,13 @@
+# Copyright 2026 Emile Clark-Boman
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

From dc37c482a8c71e63a7a10704e1c170abd8f1c7c3 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 18:56:34 +1000
Subject: [PATCH 17/34] remove nixpkgs dependency

YIPPIE YIPPIE YIPPIE
---
 TODO.md                  |  3 +++
 cerulean/nexus/nexus.nix | 23 +++++++++++++----------
 cerulean/nexus/nodes.nix | 32 +++++++++++++++++++++++++++++---
 flake.nix                |  4 +---
 4 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/TODO.md b/TODO.md
index b80f03c..e86d610 100755
--- a/TODO.md
+++ b/TODO.md
@@ -13,6 +13,9 @@
 - [X] rename nixos-modules/ to nixos/
 - [X] ensure all machines are in groups.all by default
 
+- [X] fix nixpkgs.nix not working (default not respected)
+- [X] remove dependence on nixpkgs
+
 ## Low Priority
 - [ ] rename extraModules to modules?
 - [ ] rename specialArgs to args?
diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index f03d1ce..24a0b75 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -15,7 +15,6 @@
   self,
   this,
   nt,
-  lib,
   inputs,
   ...
 }: let
@@ -50,13 +49,8 @@
       (nt.naive.terminal)
       Terminal
       ;
-
-    missing = msg: path:
-      Terminal (abort ''
-        Each Cerulean Nexus node is required to specify ${msg}!
-        Ensure `nexus.${path}` exists under your call to `cerulean.mkNexus`.
-      '');
   in {
+    base = null;
     extraModules = [];
     specialArgs = Terminal {};
 
@@ -188,8 +182,13 @@ in {
     customOutputs = removeAttrs decl ["nexus"];
 
     outputs = rec {
-      nixosConfigurations = mapNodes nexus.nodes (
-        nodeName: node: let
+      nixosConfigurations = mapNodes nexus (
+        {
+          lib,
+          nodeName,
+          node,
+          ...
+        }: let
           nixosDecl = lib.nixosSystem {
             system = node.system;
             specialArgs = let
@@ -219,7 +218,11 @@ in {
           nixosDecl
       );
 
-      deploy.nodes = mapNodes nexus.nodes (nodeName: node: let
+      deploy.nodes = mapNodes nexus ({
+        nodeName,
+        node,
+        ...
+      }: let
         inherit
           (node.deploy)
           activationTimeout
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index 1687e46..fa0bc0b 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -25,6 +25,12 @@ in rec {
       (nt.naive.terminal)
       Terminal
       ;
+
+    missing = msg: path:
+      Terminal (abort ''
+        Each Cerulean Nexus node is required to specify ${msg}!
+        Ensure `nexus.${path}` exists under your call to `cerulean.mkNexus`.
+      '');
   in {
     enabled = true;
     system = "x86_64-linux"; # sane default (i hope...)
@@ -32,6 +38,8 @@ in rec {
     extraModules = [];
     specialArgs = Terminal {};
 
+    base = null;
+
     deploy = {
       user = "root";
       sudo = "sudo -u";
@@ -67,7 +75,25 @@ in rec {
     in
       nt.projectOnto templateAttrs nodeAttrs;
 
-  mapNodes = nodes: f:
-    nodes
-    |> mapAttrs (nodeName: nodeAttrs: f nodeName (parseNode nodeName nodeAttrs));
+  mapNodes = nexus: f:
+    nexus.nodes
+    |> mapAttrs (nodeName: nodeAttrs: let
+      node = parseNode nodeName nodeAttrs;
+
+      # use per-node base or default to nexus base
+      base =
+        if node.base != null
+        then node.base
+        else if nexus.base != null
+        then nexus.base
+        else
+          abort ''
+            Cerulean cannot construct nexus node "${nodeName}" without a base package source.
+            Ensure `nexus.nodes.*.base` or `nexus.base` is a flake reference to the github:NixOS/nixpkgs repository.
+          '';
+    in
+      f {
+        inherit nodeName node;
+        lib = base.lib;
+      });
 }
diff --git a/flake.nix b/flake.nix
index 8fcd0e0..6682de0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -16,7 +16,7 @@
 
   inputs = {
     systems.url = "github:nix-systems/default";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nt.url = "github:cry128/nt";
 
     home-manager = {
@@ -37,14 +37,12 @@
 
   outputs = {
     self,
-    nixpkgs,
     nt,
     ...
   } @ inputs:
     import ./cerulean
     {
       inherit inputs self nt;
-      inherit (nixpkgs) lib;
       inherit (nt) mix;
     };
 }

From 272b03aa6efff55b2ed98b9f6d881c8248f3a788 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 18:56:51 +1000
Subject: [PATCH 18/34] update TODO

---
 TODO.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/TODO.md b/TODO.md
index e86d610..a12b8c3 100755
--- a/TODO.md
+++ b/TODO.md
@@ -1,3 +1,5 @@
+- [ ] deploy port should default to the first port given to `services.openssh`
+
 - [ ] use the Nix module system instead of projectOnto for `cerulean.mkNexus`
 - [ ] create an alternative to nixos-install called cerulean-install that
       allows people to easily bootstrap new machines (and host it on dobutterfliescry.net)
@@ -10,12 +12,16 @@
 - [ ] it would be cool to enable/disable groups and hosts
 - [ ] find a standard for how nixpkgs.nix can have a different base per group
 
+- [ ] go through all flake inputs (recursively) and ENSURE we remove all duplicates by using follows!!
+
 - [X] rename nixos-modules/ to nixos/
 - [X] ensure all machines are in groups.all by default
 
 - [X] fix nixpkgs.nix not working (default not respected)
 - [X] remove dependence on nixpkgs
 
+- [ ] allow multiple privesc methods, the standard is pam_ssh_agent_auth
+
 ## Low Priority
 - [ ] rename extraModules to modules?
 - [ ] rename specialArgs to args?
@@ -31,7 +37,11 @@
 - [ ] patch microvm so that acpi=off https://github.com/microvm-nix/microvm.nix/commit/b59a26962bb324cc0a134756a323f3e164409b72
       cause otherwise 2GB causes a failure
 
-```
+- [ ] rewrite the ceru cli in rust
+- [ ] make `ceru` do local and remote deployments
+
+```nix
+# REF: foxora
 vms = {
   home-assistant = {
     autostart = true;

From fd3b11c7cf88684544df6b90decf80fcbd8456cf Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 19:25:23 +1000
Subject: [PATCH 19/34] force system to be specified

---
 cerulean/nexus/nodes.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index fa0bc0b..ccb5c20 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -33,7 +33,7 @@ in rec {
       '');
   in {
     enabled = true;
-    system = "x86_64-linux"; # sane default (i hope...)
+    system = missing "its system architecture" "system";
     groups = [];
     extraModules = [];
     specialArgs = Terminal {};

From a2ac6b5da35cd6031e2e8c24bcda070d6d9be4fc Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Mon, 16 Feb 2026 19:37:21 +1000
Subject: [PATCH 20/34] ok maybe leave nixpkgs...

we won't depend on it (i force that)
but it's good to allow following
---
 flake.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 6682de0..89ce6b4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -16,7 +16,11 @@
 
   inputs = {
     systems.url = "github:nix-systems/default";
-    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+
+    # WARNING: nixpkgs is ONLY included so flakes using Cerulean can
+    # WARNING: force Cerulean's inputs to follow a specific revision.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+
     nt.url = "github:cry128/nt";
 
     home-manager = {

From c5ef764e27581d7049df51f42fa95833143e4acc Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 11:12:21 +1000
Subject: [PATCH 21/34] update README

---
 README.md | 39 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index b62396e..474239b 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,6 @@
+![enbyware](https://pride-badges.pony.workers.dev/static/v1?label=enbyware&labelColor=%23555&stripeWidth=8&stripeColors=FCF434%2CFFFFFF%2C9C59D1%2C2C2C2C)
+![repo size](https://img.shields.io/github/repo-size/cry128/cerulean)
+
 >[!WARNING]
 > ✨ **Under Construction** ✨
 > Cerulean has lived rent free in my head for the last 12 months.
@@ -5,15 +8,41 @@
 > for use at my workplace. **Be not afraid!** It's only a matter
 > of time until Cerulean is ready for use!
 
+# 🌌 🚀 Cerulean Nexus
+The culmination of 2 years designing better Nix flakes. Cerulean removes the boilerplate of managing
+NixOS infrastructure by declaring each machine as a **node** and their relationships as *"Nexus Networks"*,
+virtual networks of servers that Cerulean can manage. Each Nexus is **very powerful**. Allowing for simple
+distributed computing, automatic construction of VPNs, DNS for local hostnames, and that's just scratching the surface...
+
+- Is your node a VPS? Set `deploy.ssh.host = "example.com"` and Cerulean will configure custom build users,
+  ssh deployment via custom PAM modules, etc etc
+- Is your node a VM? Set `vms = [ nodes.VM_NODE ]` on your host node, and Cerulean will configure
+  all the bridging, NAT, and other networking you so desire!
+
+## 🩷💜 Motivation
+Nix is intended as a non-restrictive & unopinionated system, which is amazing, but it also means
+every user develops their own standards to simplify their config. Cerulean however is very much
+opinionated and contains all the standards I personally believe should be sane defaults for every NixOS machine.
+
+> Flakes are not designed for NixOS, they're designed for Nix, and that's an important distinction.
+
+Flakes and NixOS don't offer anything to simplify managing interconnected nodes of machines.
+But this ends with *extremely messy configs* with **a lot of footguns**. You shouldn't have to spend
+days reading about networking and learning to work with other peoples' modules.
+
+Finally, the Nix module system assumes you only use one channel of `github:NixOS/nixpkgs` but this
+just isn't realistic. Most people have both `inputs.nixpkgs` and `inputs.nixpkgs-unstable` defined.
+So cerulean declares the `nixpkgs.channels.*` option so you don't have to import your channels
+manually!
+
 ## 💙 Same Colour, More Control
-Cerulean is what you wish Azure could be. An expansive collection of microservices, pre-configured systems,
+>[!NOTE]
+> This section is *mostly* for the business minded people.
+
+Cerulean is what you wish Azure could be. Providing an expansive collection of microservices, pre-configured systems,
 and entirely self-hosted! Cerulean is built using NixOS as a foundation so you know it's never going to break randomly.
 NixOS backing makes Cerulean **extremely scalable**! Just rent a new VPS and Cerulean will build an ISO of your configuration.
 
 No stress, no hassle!
 Say goodbye to Azure! And say goodbye to Kubernetes! You're taking life into your own hands 💙
 
-### 🌌 🚀 Nexus
-Cerulean allows you to declare *"Nexus Networks"*, virtual networks of servers that Cerulean can manage.
-Each Nexus is **very powerful**. Allowing for simple distributed computing, automatic construction of a wireguard
-VPN, distributed DNS for local hostnames, and that's just scratching the surface...

From ce996f99562a86e81f5dc17185d4bd5715493e7e Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 11:18:11 +1000
Subject: [PATCH 22/34] update construction README

---
 README.md | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 474239b..b1362ae 100644
--- a/README.md
+++ b/README.md
@@ -3,10 +3,13 @@
 
 >[!WARNING]
 > ✨ **Under Construction** ✨
-> Cerulean has lived rent free in my head for the last 12 months.
-> I'm developing this project for personal use and especially
-> for use at my workplace. **Be not afraid!** It's only a matter
-> of time until Cerulean is ready for use!
+>
+> Cerulean is in an **experimental alpha release stage**.<br/>
+> **Be not afraid!** It's only a matter of time until Cerulean is ready for use!
+>
+> If you're curious about or want to use Cerulean then<br/>
+> *please please please* contact me on Bluesky [@dobutterfliescry.net](https://bsky.app/profile/dobutterfliescry.net).<br/>
+> (i would actually *melt* and fall in love with you...)
 
 # 🌌 🚀 Cerulean Nexus
 The culmination of 2 years designing better Nix flakes. Cerulean removes the boilerplate of managing

From af1da3dbc383872836864d8595e596ddf707d0f6 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 11:42:59 +1000
Subject: [PATCH 23/34] rename specialArgs -> args

---
 cerulean/nexus/nexus.nix | 23 ++++++++++-------------
 cerulean/nexus/nodes.nix |  2 +-
 cerulean/nexus/snow.nix  |  2 +-
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 24a0b75..2424cd2 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -52,7 +52,7 @@
   in {
     base = null;
     extraModules = [];
-    specialArgs = Terminal {};
+    args = Terminal {};
 
     groups = Terminal {};
     nodes = Terminal {};
@@ -189,19 +189,16 @@ in {
           node,
           ...
         }: let
-          nixosDecl = lib.nixosSystem {
+          nixosDecl = lib.nixosSystem rec {
             system = node.system;
-            specialArgs = let
-              specialArgs =
-                nexus.specialArgs
-                // node.specialArgs
-                // {
-                  inherit root specialArgs;
-                  inherit (node) system;
-                  _deploy-rs = inputs.deploy-rs;
-                };
-            in
-              specialArgs;
+            specialArgs =
+              nexus.args
+              // node.args
+              // {
+                inherit root specialArgs;
+                inherit (node) system;
+                _deploy-rs = inputs.deploy-rs;
+              };
             modules =
               [
                 self.nixosModules.default
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index ccb5c20..46b9add 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -36,7 +36,7 @@ in rec {
     system = missing "its system architecture" "system";
     groups = [];
     extraModules = [];
-    specialArgs = Terminal {};
+    args = Terminal {};
 
     base = null;
 
diff --git a/cerulean/nexus/snow.nix b/cerulean/nexus/snow.nix
index 1316ee3..6704710 100644
--- a/cerulean/nexus/snow.nix
+++ b/cerulean/nexus/snow.nix
@@ -27,7 +27,7 @@
     extraModules = mkOption {
       type = types.listOf types.path;
     };
-    specialArgs = mkOption {
+    args = mkOption {
       type = types.attrs;
     };
 

From 0d85fe39a678701e1419f0ee750725255029e374 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 11:46:59 +1000
Subject: [PATCH 24/34] rename extraModules -> modules

---
 cerulean/nexus/nexus.nix | 6 +++---
 cerulean/nexus/nodes.nix | 2 +-
 cerulean/nexus/snow.nix  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 2424cd2..22424ba 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -51,7 +51,7 @@
       ;
   in {
     base = null;
-    extraModules = [];
+    modules = [];
     args = Terminal {};
 
     groups = Terminal {};
@@ -208,8 +208,8 @@ in {
                 # inputs.microvm.nixosModules.microvm
               ]
               ++ (getGroupModules root nodeName node)
-              ++ node.extraModules
-              ++ nexus.extraModules;
+              ++ node.modules
+              ++ nexus.modules;
           };
         in
           nixosDecl
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index 46b9add..a1b6117 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -35,7 +35,7 @@ in rec {
     enabled = true;
     system = missing "its system architecture" "system";
     groups = [];
-    extraModules = [];
+    modules = [];
     args = Terminal {};
 
     base = null;
diff --git a/cerulean/nexus/snow.nix b/cerulean/nexus/snow.nix
index 6704710..28496ca 100644
--- a/cerulean/nexus/snow.nix
+++ b/cerulean/nexus/snow.nix
@@ -24,7 +24,7 @@
       types
       ;
   in {
-    extraModules = mkOption {
+    modules = mkOption {
       type = types.listOf types.path;
     };
     args = mkOption {

From 04d6bd04c3988d5719a7906879e11f180570f0d1 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 11:47:49 +1000
Subject: [PATCH 25/34] v0.2.2-alpha

---
 cerulean/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cerulean/default.nix b/cerulean/default.nix
index f24bb5a..202fdf9 100644
--- a/cerulean/default.nix
+++ b/cerulean/default.nix
@@ -21,7 +21,7 @@ mix.newMixture args (mixture: {
     ./nexus
   ];
 
-  version = "0.2.1";
+  version = "0.2.2";
 
   nixosModules = rec {
     default = cerulean;

From 59d1028e19d9ac5f43122d08119e90d77e56a7da Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 12:41:53 +1000
Subject: [PATCH 26/34] add CHANGELOG.md

---
 CHANGELOG.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..1c7a9a3
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,25 @@
+# Changelog
+
+## v0.2.0-alpha
+Initial "stable" release. Cerulean is currently usable and supports:
+1. local & remote deployment configuration
+2. nixos/homemanager module-level support for any number of nixpkg branches
+3. use of the [nix-systems standard](https://github.com/nix-systems/nix-systems), the introduction of the `snow/flake` standard, and the introduction of the `nixpkgs.nix` standard module.
+4. hierarchical groups for NixOS hosts via `snow.nix`
+
+This is still a alpha-build of Cerulean. Everything will break in the future as I change the internals a bunch. I'll aim to write documentation in future cause currently there's no guide.
+
+## v0.2.1-alpha
+Minor patches
+- cerulean no longer has a `inputs.nixpkgs-unstable` (the `nixpkgs.nix` is the new alternative)
+- `home-manager.nixosModules.default` and `microvm.nixosModules.microvm` are added as default modules
+- fixed `groups.all` not being added to nodes with `groups = []`
+
+## v0.2.2-alpha
+Minor patches
+- fixed `nexus.groups.all` not added to empty `nexus.nodes.*.groups` declarations
+- fixed bad propagation of inputs
+- forced system architecture to be specified per node
+- cerulean no longer depends on `nixpkgs`,  `base` package set should be set instead
+- rename `extraModules` -> `modules`
+- rename `specialArgs` -> `args`

From d85a6b963f85ae81904c94789167ae337891c6d2 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 17:00:09 +1000
Subject: [PATCH 27/34] restruct args into specialArgs._cerulean

---
 TODO.md                         |  4 +++
 cerulean/nexus/nexus.nix        | 55 +++++++++++++++++++++------------
 cerulean/nexus/nodes.nix        |  4 +--
 cerulean/nixos/default.nix      |  6 ++--
 cerulean/nixos/home-manager.nix |  9 ++----
 5 files changed, 46 insertions(+), 32 deletions(-)

diff --git a/TODO.md b/TODO.md
index a12b8c3..5536d7f 100755
--- a/TODO.md
+++ b/TODO.md
@@ -1,3 +1,7 @@
+- [ ] base should automatically be set as the default (dont do anything with the default)
+- [ ] try to remove common foot guns, ie abort if the user provides the home-manager or microvm nixosModules
+      since cerulean ALREADY provides these
+
 - [ ] deploy port should default to the first port given to `services.openssh`
 
 - [ ] use the Nix module system instead of projectOnto for `cerulean.mkNexus`
diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index 22424ba..b30647d 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -20,6 +20,7 @@
 }: let
   inherit
     (builtins)
+    all
     attrNames
     concatLists
     concatStringsSep
@@ -184,33 +185,47 @@ in {
     outputs = rec {
       nixosConfigurations = mapNodes nexus (
         {
+          base,
           lib,
           nodeName,
           node,
           ...
         }: let
-          nixosDecl = lib.nixosSystem rec {
-            system = node.system;
-            specialArgs =
-              nexus.args
-              // node.args
-              // {
-                inherit root specialArgs;
-                inherit (node) system;
-                _deploy-rs = inputs.deploy-rs;
+          nixosDecl = let
+            userArgs = nexus.args // node.args;
+            ceruleanArgs = {
+              inherit root base;
+              inherit (node) system;
+              _cerulean = {
+                inherit inputs userArgs;
+                args = ceruleanArgs;
               };
-            modules =
-              [
-                self.nixosModules.default
-                (findImport (root + "/hosts/${nodeName}"))
+            };
+            specialArgs = assert (userArgs
+              |> attrNames
+              |> all (argName:
+                ! ceruleanArgs ? argName
+                || abort ''
+                  `specialArgs` are like super important to Cerulean my love... </3
+                  But `args.${argName}` is a reserved argument name :(
+                ''));
+              userArgs // ceruleanArgs;
+          in
+            lib.nixosSystem {
+              inherit (node) system;
+              inherit specialArgs;
+              modules =
+                [
+                  self.nixosModules.default
+                  (findImport (root + "/hosts/${nodeName}"))
 
-                inputs.home-manager.nixosModules.default
-                # inputs.microvm.nixosModules.microvm
-              ]
-              ++ (getGroupModules root nodeName node)
-              ++ node.modules
-              ++ nexus.modules;
-          };
+                  inputs.home-manager.nixosModules.default
+                  # inputs.microvm.nixosModules.microvm
+                ]
+                ++ (getGroupModules root nodeName node)
+                ++ node.modules
+                ++ nexus.modules;
+            };
         in
           nixosDecl
       );
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index a1b6117..25b4bb3 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -93,7 +93,7 @@ in rec {
           '';
     in
       f {
-        inherit nodeName node;
-        lib = base.lib;
+        inherit nodeName node base;
+        inherit (base) lib;
       });
 }
diff --git a/cerulean/nixos/default.nix b/cerulean/nixos/default.nix
index f15b236..bd8d03d 100644
--- a/cerulean/nixos/default.nix
+++ b/cerulean/nixos/default.nix
@@ -14,7 +14,7 @@
 {
   root,
   system,
-  _deploy-rs,
+  _cerulean,
   ...
 } @ args: {
   imports = [
@@ -26,7 +26,7 @@
     ./home-manager.nix
   ];
 
-  environment.systemPackages = [
-    _deploy-rs.packages.${system}.default
+  environment.systemPackages = with _cerulean.inputs; [
+    deploy-rs.packages.${system}.default
   ];
 }
diff --git a/cerulean/nixos/home-manager.nix b/cerulean/nixos/home-manager.nix
index 21ee78c..7c3d12d 100644
--- a/cerulean/nixos/home-manager.nix
+++ b/cerulean/nixos/home-manager.nix
@@ -13,10 +13,9 @@
 # limitations under the License.
 {
   root,
-  system,
   config,
   lib,
-  specialArgs,
+  _cerulean,
   ...
 } @ args: let
   inherit
@@ -34,17 +33,13 @@ in {
         |> filter (x: pathExists (root + "/homes/${x}"))
         |> (x: lib.genAttrs x (y: import (root + "/homes/${y}")));
 
-      extraSpecialArgs = {inherit root system;} // (specialArgs.inputs or {});
+      extraSpecialArgs = _cerulean.args;
       sharedModules = [
         # user configuration
         (import (root + "/nixpkgs.nix"))
         # options declarations
         (import ./nixpkgs.nix (args // {contextName = "homes";}))
       ];
-
-      # disable home-manager trying anything fancy
-      # we control the pkgs now!!
-      # useGlobalPkgs = true;
     };
   };
 }

From 0c5387fd61b55266831f488d3e9c5f329c8508f6 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Tue, 17 Feb 2026 17:27:31 +1000
Subject: [PATCH 28/34] nixpkgs.channels disregards contextName

---
 cerulean/nixos/nixpkgs.nix | 47 +++++++++++++++-----------------------
 1 file changed, 19 insertions(+), 28 deletions(-)

diff --git a/cerulean/nixos/nixpkgs.nix b/cerulean/nixos/nixpkgs.nix
index 65db5a5..41ee0ab 100644
--- a/cerulean/nixos/nixpkgs.nix
+++ b/cerulean/nixos/nixpkgs.nix
@@ -26,46 +26,38 @@
   cfg = config.nixpkgs.channels;
 in {
   options.nixpkgs.channels = lib.mkOption {
-    type = lib.types.attrsOf (lib.types.attrs);
+    type = lib.types.attrs;
     default = {};
-    description = "Declare package repositories per module context (nixos, home-manager, etc)";
+    description = "Declare package repositories";
     example = {
-      "homes" = {
-        "pkgs" = {
-          source = "inputs.nixpkgs";
-          system = "x86-64-linux";
-          config = {
-            allowUnfree = true;
-            allowBroken = false;
-          };
+      "pkgs" = {
+        source = "inputs.nixpkgs";
+        system = "x86-64-linux";
+        config = {
+          allowUnfree = true;
+          allowBroken = false;
         };
-        "upkgs" = {
-          source = "inputs.nixpkgs-unstable";
-          system = "x86-64-linux";
-          config = {
-            allowUnfree = true;
-            allowBroken = false;
-          };
+      };
+      "upkgs" = {
+        source = "inputs.nixpkgs-unstable";
+        system = "x86-64-linux";
+        config = {
+          allowUnfree = false;
+          allowBroken = true;
         };
       };
     };
   };
 
   config = let
-    # TODO: use lib.types.submodule to restrict what options
-    # TODO: can be given to `nixpkgs.channels.${moduleName}.${name}`
-    decl =
-      cfg.${contextName} or cfg.default;
-
     repos =
-      decl
+      cfg
       |> mapAttrs (
         name: args:
           lib.mkForce (
             assert args ? source
             || abort ''
-              ${toString ./.}
-              `nixpkgs.channels.${contextName}.${name}` missing required attribute "source"
+              `nixpkgs.channels.${name}` missing required attribute "source"
             '';
               ((removeAttrs args ["source"])
                 // {inherit system;})
@@ -78,8 +70,9 @@ in {
     _module.args = repos;
 
     nixpkgs = let
+      # XXX: TODO: would it work to use `base` instead of having default?
       defaultPkgs =
-        decl.default or (throw ''
+        cfg.default or (throw ''
           Your `nixpkgs.nix` file does not declare a default package source.
           Ensure you set `nixpkgs.channels.*.default = ...;`
         '');
@@ -91,9 +84,7 @@ in {
       }
       else if contextName == "homes"
       then {
-        # XXX: XXX: XXX: OH OH OH OMG, its because aurora never defines pkgs
         config = lib.mkOverride 200 (defaultPkgs.config or {});
-        # XXX: WARNING: TODO: modify options so overlays must always be given as the correct type
         overlays = lib.mkOverride 200 (defaultPkgs.overlays or []);
       }
       else {};

From 870bbb1f3738736ea248c171685bffdb242e294a Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 17:24:28 +1000
Subject: [PATCH 29/34] i cried

---
 cerulean/nexus/nexus.nix        |  6 +++---
 cerulean/nixos/home-manager.nix | 30 +++++++++++++++---------------
 cerulean/nixos/nixpkgs.nix      | 32 +++++++++++++++++---------------
 3 files changed, 35 insertions(+), 33 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index b30647d..f3cf38a 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -197,8 +197,8 @@ in {
               inherit root base;
               inherit (node) system;
               _cerulean = {
-                inherit inputs userArgs;
-                args = ceruleanArgs;
+                inherit inputs userArgs ceruleanArgs;
+                specialArgs = userArgs // ceruleanArgs;
               };
             };
             specialArgs = assert (userArgs
@@ -209,7 +209,7 @@ in {
                   `specialArgs` are like super important to Cerulean my love... </3
                   But `args.${argName}` is a reserved argument name :(
                 ''));
-              userArgs // ceruleanArgs;
+              ceruleanArgs._cerulean.specialArgs;
           in
             lib.nixosSystem {
               inherit (node) system;
diff --git a/cerulean/nixos/home-manager.nix b/cerulean/nixos/home-manager.nix
index 7c3d12d..1d281cb 100644
--- a/cerulean/nixos/home-manager.nix
+++ b/cerulean/nixos/home-manager.nix
@@ -25,21 +25,21 @@
     pathExists
     ;
 in {
-  config = {
-    home-manager = {
-      users =
-        config.users.users
-        |> attrNames
-        |> filter (x: pathExists (root + "/homes/${x}"))
-        |> (x: lib.genAttrs x (y: import (root + "/homes/${y}")));
+  home-manager = {
+    users =
+      config.users.users
+      |> attrNames
+      |> filter (x: pathExists (root + "/homes/${x}"))
+      |> (x:
+        lib.genAttrs x (y:
+          import (root + "/homes/${y}")));
 
-      extraSpecialArgs = _cerulean.args;
-      sharedModules = [
-        # user configuration
-        (import (root + "/nixpkgs.nix"))
-        # options declarations
-        (import ./nixpkgs.nix (args // {contextName = "homes";}))
-      ];
-    };
+    extraSpecialArgs = _cerulean.specialArgs;
+    sharedModules = [
+      # user configuration
+      (import (root + "/nixpkgs.nix"))
+      # options declarations
+      (import ./nixpkgs.nix (args // {contextName = "homes";}))
+    ];
   };
 }
diff --git a/cerulean/nixos/nixpkgs.nix b/cerulean/nixos/nixpkgs.nix
index 41ee0ab..b43dbbc 100644
--- a/cerulean/nixos/nixpkgs.nix
+++ b/cerulean/nixos/nixpkgs.nix
@@ -52,6 +52,7 @@ in {
   config = let
     repos =
       cfg
+      |> (xs: removeAttrs xs ["default"])
       |> mapAttrs (
         name: args:
           lib.mkForce (
@@ -59,29 +60,30 @@ in {
             || abort ''
               `nixpkgs.channels.${name}` missing required attribute "source"
             '';
-              ((removeAttrs args ["source"])
-                // {inherit system;})
-              |> import args.source
+              import args.source ({inherit system;} // (removeAttrs args ["source"]))
           )
       );
+
+    # XXX: TODO: would it work to use `base` instead of having default?
+    defaultPkgs =
+      cfg.default or (throw ''
+        Your `nixpkgs.nix` file does not declare a default package source.
+        Ensure you set `nixpkgs.channels.*.default = ...;`
+      '');
   in {
     # NOTE: _module.args is a special option that allows us to
     # NOTE: set extend specialArgs from inside the modules.
     _module.args = repos;
 
-    nixpkgs = let
-      # XXX: TODO: would it work to use `base` instead of having default?
-      defaultPkgs =
-        cfg.default or (throw ''
-          Your `nixpkgs.nix` file does not declare a default package source.
-          Ensure you set `nixpkgs.channels.*.default = ...;`
-        '');
-    in
+    nixpkgs =
       if contextName == "hosts"
-      then {
-        flake.source = lib.mkOverride 200 defaultPkgs.source;
-        config = lib.mkOverride 200 defaultPkgs.config;
-      }
+      then
+        # DEBUG: defaultPkgs
+        {
+          flake.source = lib.mkOverride 200 (defaultPkgs.source or null);
+          overlays = lib.mkOverride 200 (defaultPkgs.overlays or {});
+          config = lib.mkOverride 200 (defaultPkgs.config or {});
+        }
       else if contextName == "homes"
       then {
         config = lib.mkOverride 200 (defaultPkgs.config or {});

From f34c2fba39acd2544635e2b847214ce3aa2c1a27 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 20:12:58 +1000
Subject: [PATCH 30/34] rename base -> decl (easily confusable)

---
 cerulean/nexus/nexus.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index f3cf38a..ea8997e 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -93,13 +93,13 @@
       Cerulean Nexus config must be provided as an attribute set, got "${typeOf nexus}" instead!
       Ensure the `nexus` declaration is an attribute set under your call to `cerulean.mkNexus`.
     ''; let
-      base = nt.projectOnto templateNexus nexus;
+      decl = nt.projectOnto templateNexus nexus;
     in
       # XXX: TODO: create a different version of nt.projectOnto that can actually
       # XXX: TODO: handle applying a transformation to the result of each datapoint
-      base
+      decl
       // {
-        groups = parseGroupDecl base.groups;
+        groups = parseGroupDecl decl.groups;
       };
 
   parseDecl = outputsBuilder: let

From 232837d34adcab3dc70e08fc492c158d83b63d20 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 20:13:05 +1000
Subject: [PATCH 31/34] update TODO

---
 TODO.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/TODO.md b/TODO.md
index 5536d7f..1dde662 100755
--- a/TODO.md
+++ b/TODO.md
@@ -27,8 +27,8 @@
 - [ ] allow multiple privesc methods, the standard is pam_ssh_agent_auth
 
 ## Low Priority
-- [ ] rename extraModules to modules?
-- [ ] rename specialArgs to args?
+- [X] rename extraModules to modules?
+- [X] rename specialArgs to args?
 
 - [ ] make an extension to the nix module system (different to mix)
       that allows transformations (ie a stop post config, ie outputs, which
@@ -44,6 +44,8 @@
 - [ ] rewrite the ceru cli in rust
 - [ ] make `ceru` do local and remote deployments
 
+- [ ] support `legacyImports` 
+
 ```nix
 # REF: foxora
 vms = {

From 18e1a2c8909b84cc2199533f3d5b76ddcefc6b0f Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 20:13:36 +1000
Subject: [PATCH 32/34] don't add pkgs to _module.args

---
 cerulean/nixos/nixpkgs.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cerulean/nixos/nixpkgs.nix b/cerulean/nixos/nixpkgs.nix
index b43dbbc..5475e0b 100644
--- a/cerulean/nixos/nixpkgs.nix
+++ b/cerulean/nixos/nixpkgs.nix
@@ -73,7 +73,8 @@ in {
   in {
     # NOTE: _module.args is a special option that allows us to
     # NOTE: set extend specialArgs from inside the modules.
-    _module.args = repos;
+    # WARNING: pkgs is a reserved specialArg
+    _module.args = removeAttrs repos ["pkgs"];
 
     nixpkgs =
       if contextName == "hosts"

From d5211287bd3cb96078f2053488d67d557848a8f2 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 20:13:43 +1000
Subject: [PATCH 33/34] TEMP: use base

---
 cerulean/nixos/nixpkgs.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/cerulean/nixos/nixpkgs.nix b/cerulean/nixos/nixpkgs.nix
index 5475e0b..0376f47 100644
--- a/cerulean/nixos/nixpkgs.nix
+++ b/cerulean/nixos/nixpkgs.nix
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 {
+  base,
   lib,
   system,
   config,
@@ -78,13 +79,11 @@ in {
 
     nixpkgs =
       if contextName == "hosts"
-      then
-        # DEBUG: defaultPkgs
-        {
-          flake.source = lib.mkOverride 200 (defaultPkgs.source or null);
-          overlays = lib.mkOverride 200 (defaultPkgs.overlays or {});
-          config = lib.mkOverride 200 (defaultPkgs.config or {});
-        }
+      then {
+        flake.source = lib.mkOverride 200 base; # DEBUG: temp while getting base to work
+        overlays = lib.mkOverride 200 (defaultPkgs.overlays or {});
+        config = lib.mkOverride 200 (defaultPkgs.config or {});
+      }
       else if contextName == "homes"
       then {
         config = lib.mkOverride 200 (defaultPkgs.config or {});

From 087f679e67005b4c8fda93f139eb05c78c644130 Mon Sep 17 00:00:00 2001
From: _cry64 <them@dobutterfliescry.net>
Date: Wed, 18 Feb 2026 23:56:05 +1000
Subject: [PATCH 34/34] add modifiable homeManager

---
 cerulean/nexus/nexus.nix   | 10 ++++-
 cerulean/nexus/nodes.nix   |  2 +
 cerulean/nixos/default.nix | 20 ++++++----
 flake.lock                 | 81 +++++++++++++++++++++-----------------
 flake.nix                  |  5 ---
 5 files changed, 66 insertions(+), 52 deletions(-)

diff --git a/cerulean/nexus/nexus.nix b/cerulean/nexus/nexus.nix
index ea8997e..5d0ca02 100644
--- a/cerulean/nexus/nexus.nix
+++ b/cerulean/nexus/nexus.nix
@@ -54,6 +54,7 @@
     base = null;
     modules = [];
     args = Terminal {};
+    homeManager = null;
 
     groups = Terminal {};
     nodes = Terminal {};
@@ -192,12 +193,17 @@ in {
           ...
         }: let
           nixosDecl = let
+            homeManager =
+              if node.homeManager != null
+              then node.homeManager
+              else nexus.homeManager;
+
             userArgs = nexus.args // node.args;
             ceruleanArgs = {
               inherit root base;
               inherit (node) system;
               _cerulean = {
-                inherit inputs userArgs ceruleanArgs;
+                inherit inputs userArgs ceruleanArgs homeManager;
                 specialArgs = userArgs // ceruleanArgs;
               };
             };
@@ -219,9 +225,9 @@ in {
                   self.nixosModules.default
                   (findImport (root + "/hosts/${nodeName}"))
 
-                  inputs.home-manager.nixosModules.default
                   # inputs.microvm.nixosModules.microvm
                 ]
+                ++ (homeManager.nixosModules.default or [])
                 ++ (getGroupModules root nodeName node)
                 ++ node.modules
                 ++ nexus.modules;
diff --git a/cerulean/nexus/nodes.nix b/cerulean/nexus/nodes.nix
index 25b4bb3..13ced2f 100644
--- a/cerulean/nexus/nodes.nix
+++ b/cerulean/nexus/nodes.nix
@@ -38,6 +38,8 @@ in rec {
     modules = [];
     args = Terminal {};
 
+    homeManager = null;
+
     base = null;
 
     deploy = {
diff --git a/cerulean/nixos/default.nix b/cerulean/nixos/default.nix
index bd8d03d..ea7c359 100644
--- a/cerulean/nixos/default.nix
+++ b/cerulean/nixos/default.nix
@@ -17,14 +17,18 @@
   _cerulean,
   ...
 } @ args: {
-  imports = [
-    # user configuration
-    (import (root + "/nixpkgs.nix"))
-    # options declarations
-    (import ./nixpkgs.nix (args // {contextName = "hosts";}))
-
-    ./home-manager.nix
-  ];
+  imports =
+    [
+      # user configuration
+      (import (root + "/nixpkgs.nix"))
+      # options declarations
+      (import ./nixpkgs.nix (args // {contextName = "hosts";}))
+    ]
+    ++ (
+      if _cerulean.homeManager != null
+      then [./home-manager.nix]
+      else []
+    );
 
   environment.systemPackages = with _cerulean.inputs; [
     deploy-rs.packages.${system}.default
diff --git a/flake.lock b/flake.lock
index 0dd06b1..fc8e402 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,7 +3,9 @@
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "utils": "utils"
       },
       "locked": {
@@ -58,6 +60,27 @@
         "type": "github"
       }
     },
+    "microvm": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1771365290,
+        "narHash": "sha256-1XJOslVyF7yzf6yd/yl1VjGLywsbtwmQh3X1LuJcLI4=",
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "rev": "789c90b164b55b4379e7a94af8b9c01489024c18",
+        "type": "github"
+      },
+      "original": {
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -105,38 +128,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1743014863,
-        "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "bd3bac8bfb542dbde7ffffb6987a1a1f9d41699f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1768305791,
-        "narHash": "sha256-AIdl6WAn9aymeaH/NvBj0H9qM+XuAuYbGMZaP0zcXAQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "1412caf7bf9e660f2f962917c14b1ea1c3bc695e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1768323494,
         "narHash": "sha256-yBXJLE6WCtrGo7LKiB6NOt6nisBEEkguC/lq/rP3zRQ=",
@@ -152,7 +143,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1767313136,
         "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
@@ -171,7 +162,7 @@
     "nt": {
       "inputs": {
         "nix-unit": "nix-unit",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "systems": "systems_2"
       },
       "locked": {
@@ -191,12 +182,28 @@
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
-        "nixpkgs": "nixpkgs_2",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "microvm": "microvm",
+        "nixpkgs": "nixpkgs",
         "nt": "nt",
         "systems": "systems_3"
       }
     },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1759482047,
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "ref": "refs/heads/main",
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "revCount": 996,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 89ce6b4..c1a5498 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,11 +23,6 @@
 
     nt.url = "github:cry128/nt";
 
-    home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     deploy-rs = {
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";