treewide: Align modules with server directory

17 files changed, 314 insertions, 181 deletions

diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
index 7795c5f4..9de2bce1 100644
--- a/modules/by-name/co/constants/module.nix
+++ b/modules/by-name/co/constants/module.nix
@@ -1,59 +1,114 @@
 # This file is inspired by the `nixos/modules/misc/ids.nix`
 # file in nixpkgs.
-{lib, ...}: {
-  options.soispha.constants = {
+{
+  lib,
+  config,
+  ...
+}: {
+  options.vhack.constants = {
     ids.uids = lib.mkOption {
       internal = true;
       description = ''
-        The user IDs used in this nixos config.
+        The user IDs used in the vhack.eu nixos config.
       '';
-      type = lib.types.attrsOf (lib.types.ints.between 0 1000);
+      type = lib.types.attrsOf (lib.types.ints.between 0 400);
     };
     ids.gids = lib.mkOption {
       internal = true;
       description = ''
-        The group IDs used in this nixos config.
+        The group IDs used in the vhack.eu nixos config.
       '';
-      type = lib.types.attrsOf (lib.types.ints.between 0 1000);
+      type = lib.types.attrsOf (lib.types.ints.between 0 400);
     };
   };
 
-  config.soispha.constants = {
+  config.vhack.constants = {
     ids.uids = {
       # Keep this sorted with `!sort --numeric-sort --key=2 --field-separator="="`
-
-      wpa_supplicant = 986;
-      mandb = 991;
-      dhcpcd = 992;
-      systemd-oom = 993;
-      sshd = 994;
-      rtkit = 995;
-      nscd = 996;
-      nm-iodine = 997;
-      fwupd-refresh = 998;
-      avahi = 999;
+      systemd-coredump = 151; # GROUP
+      opendkim = 221;
+      mautrix-whatsapp = 222;
+      etebase-server = 223;
+      matrix-synapse = 224;
+      rspamd = 225;
+      knot-resolver = 226;
+      peertube = 231;
+      redis-mastodon = 232;
+      redis-peertube = 233;
+      redis-rspamd = 234;
+      redis-stalwart-mail = 235;
+      mastodon = 236;
+      stalwart-mail = 238;
+      acme = 328;
+      dhcpcd = 329;
+      nscd = 330;
+      sshd = 331;
+      systemd-oom = 332;
+      resolvconf = 333; # GROUP
+      nix-sync = 334;
+      nextcloud = 335;
+      redis-nextcloud = 336;
+      taskchampion = 337;
+      stalwart-mail-certificates = 338; # GROUP
+      sharkey = 339;
+      redis-sharkey = 340;
+      grocy = 341;
+      anubis = 342;
+      postfix-tlspol = 343;
+      rocie = 344;
+      fluent-bit = 345;
+      loki = 346;
+      grafana = 347;
+      node-exporter = 348;
+      smartctl-exporter-access = 349;
+      fail2ban = 350;
 
       # As per the NixOS file, the uids should not be greater or equal to 400;
     };
-    ids.gids = {
+    ids.gids = let
+      inherit (config.vhack.constants.ids) uids;
+    in {
       # Please add your groups to the users and inherit them here.
       # This avoids having an user/group id mismatch.
-
-      wpa_supplicant = 986;
-      dhcpcd = 987;
-      lpadmin = 988;
-      resolvconf = 989;
-      systemd-oom = 990;
-      systemd-coredump = 991;
-      sshd = 992;
-      rtkit = 993;
-      polkituser = 994;
-      nscd = 995;
-      mandb = 996;
-      msr = 996;
-      fwupd-refresh = 997;
-      avahi = 998;
-      adbusers = 999;
+      inherit
+        (uids)
+        acme
+        anubis
+        dhcpcd
+        etebase-server
+        knot-resolver
+        mastodon
+        matrix-synapse
+        mautrix-whatsapp
+        nextcloud
+        nix-sync
+        nscd
+        opendkim
+        peertube
+        postfix-tlspol
+        redis-mastodon
+        redis-nextcloud
+        redis-peertube
+        redis-rspamd
+        redis-stalwart-mail
+        rspamd
+        sshd
+        stalwart-mail
+        systemd-oom
+        sharkey
+        redis-sharkey
+        grocy
+        systemd-coredump # matches systemd-coredump user
+        resolvconf # This group is not matched to an user?
+        stalwart-mail-certificates # This group is used to connect nginx and stalwart-mail
+        rocie
+        fluent-bit
+        loki
+        grafana
+        node-exporter
+        smartctl-exporter-access
+        fail2ban
+        ;
 
       # The gid should match the uid. Thus should not be >= 400;
     };
diff --git a/modules/by-name/co/coredump/module.nix b/modules/by-name/co/coredump/module.nix
index 79e764eb..5b5ed92b 100644
--- a/modules/by-name/co/coredump/module.nix
+++ b/modules/by-name/co/coredump/module.nix
@@ -3,15 +3,15 @@
   lib,
   ...
 }: let
-  cfg = config.soispha.systemd.coredump;
+  cfg = config.vhack.systemd.coredump;
 in {
-  options.soispha.systemd.coredump = {
+  options.vhack.systemd.coredump = {
     enable = (lib.mkEnableOption "oomd") // {default = config.systemd.coredump.enable;};
   };
 
   config = lib.mkIf cfg.enable {
     users = {
-      groups.systemd-coredump.gid = config.soispha.constants.ids.gids.systemd-coredump;
+      groups.systemd-coredump.gid = config.vhack.constants.ids.gids.systemd-coredump;
     };
   };
 }
diff --git a/modules/by-name/dh/dhcpcd/module.nix b/modules/by-name/dh/dhcpcd/module.nix
index 5fee0100..396550f5 100644
--- a/modules/by-name/dh/dhcpcd/module.nix
+++ b/modules/by-name/dh/dhcpcd/module.nix
@@ -3,19 +3,19 @@
   lib,
   ...
 }: let
-  cfg = config.soispha.dhcpcd;
+  cfg = config.vhack.dhcpcd;
 in {
-  options.soispha.dhcpcd = {
+  options.vhack.dhcpcd = {
     enable = (lib.mkEnableOption "dhcpcd") // {default = config.networking.dhcpcd.enable;};
   };
 
   config = lib.mkIf cfg.enable {
     users = {
       users.dhcpcd = {
-        uid = config.soispha.constants.ids.uids.dhcpcd;
+        uid = config.vhack.constants.ids.uids.dhcpcd;
         group = "dhcpcd";
       };
-      groups.dhcpcd.gid = config.soispha.constants.ids.gids.dhcpcd;
+      groups.dhcpcd.gid = config.vhack.constants.ids.gids.dhcpcd;
     };
   };
 }
diff --git a/modules/by-name/fi/fish/module.nix b/modules/by-name/fi/fish/module.nix
index 590df8b9..a0b383b3 100644
--- a/modules/by-name/fi/fish/module.nix
+++ b/modules/by-name/fi/fish/module.nix
@@ -47,6 +47,8 @@ in {
       package = pkgs.fish-patched;
     };
 
+    users.users.soispha.shell = config.programs.fish.package;
+
     home-manager.users.soispha = {
       home.sessionPath = lib.mkForce [];
 
diff --git a/modules/by-name/im/impermanence/module.nix b/modules/by-name/im/impermanence/module.nix
index 43943363..be3bacdc 100644
--- a/modules/by-name/im/impermanence/module.nix
+++ b/modules/by-name/im/impermanence/module.nix
@@ -13,9 +13,15 @@
   modules,
   ...
 }: let
-  cfg = config.soispha.impermanence;
+  cfg = config.vhack.impermanence;
+
+  userDirectories = lib.debug.traceValSeqN 2 (lib.mapAttrs (_: dirs: {
+      directories =
+        dirs;
+    })
+    cfg.userDirectories);
 in {
-  options.soispha.impermanence = {
+  options.vhack.impermanence = {
     enable = lib.mkEnableOption "persisting directories and files with impermanence";
 
     directories = lib.mkOption {
@@ -33,7 +39,7 @@ in {
     };
 
     userDirectories = lib.mkOption {
-      type = lib.types.listOf (lib.types.either lib.types.str (lib.types.submodule {
+      type = lib.attrsOf lib.types.listOf (lib.types.either lib.types.str (lib.types.submodule {
         options = {
           directory = lib.mkOption {
             type = lib.types.str;
@@ -44,7 +50,7 @@ in {
         };
       }));
       default = [];
-      description = "The directories to persist";
+      description = "The directories to persist, for each user.";
     };
   };
 
@@ -53,36 +59,15 @@ in {
   ];
 
   config = lib.mkIf cfg.enable {
-    environment.persistence = {
-      "/srv" = {
-        hideMounts = true;
-        inherit (cfg) directories;
-
-        users.soispha = {
-          directories =
-            [
-              # TODO: These should all be moved to their respective modules <2024-12-08>
-              ".local/share"
+    environment.persistence."/srv" = {
+      hideMounts = true;
+      inherit (cfg) directories;
 
-              ".local/state/nvim"
-              ".local/state/mpv"
-              ".local/state/wireplumber"
-
-              ".config/Signal"
-
-              ".cache"
-
-              "media"
-              "repos"
-              "documents"
-            ]
-            ++ cfg.userDirectories;
-        };
+      users = userDirectories;
 
-        files = [
-          "/etc/machine-id"
-        ];
-      };
+      files = [
+        "/etc/machine-id"
+      ];
     };
   };
 }
diff --git a/modules/by-name/mp/mpv/module.nix b/modules/by-name/mp/mpv/module.nix
index 496dcd47..fed2074d 100644
--- a/modules/by-name/mp/mpv/module.nix
+++ b/modules/by-name/mp/mpv/module.nix
@@ -23,6 +23,9 @@ in {
     soispha.services.unison.pathsToSync = [
       "~/.local/state/mpv"
     ];
+    soispha.impermanance.userDirectories = [
+      ".local/state/mpv"
+    ];
 
     home-manager.users.soispha = {
       programs.mpv = {
diff --git a/modules/by-name/ns/nscd/module.nix b/modules/by-name/ns/nscd/module.nix
index 94ca4874..3db80faf 100644
--- a/modules/by-name/ns/nscd/module.nix
+++ b/modules/by-name/ns/nscd/module.nix
@@ -3,16 +3,16 @@
   lib,
   ...
 }: let
-  cfg = config.soispha.nscd;
+  cfg = config.vhack.nscd;
 in {
-  options.soispha.nscd = {
+  options.vhack.nscd = {
     enable = (lib.mkEnableOption "nscd") // {default = config.services.nscd.enableNsncd;};
   };
 
   config = lib.mkIf cfg.enable {
     users = {
-      users.nscd.uid = config.soispha.constants.ids.uids.nscd;
-      groups.nscd.gid = config.soispha.constants.ids.gids.nscd;
+      users.nscd.uid = config.vhack.constants.ids.uids.nscd;
+      groups.nscd.gid = config.vhack.constants.ids.gids.nscd;
     };
   };
 }
diff --git a/modules/by-name/nv/nvim/module.nix b/modules/by-name/nv/nvim/module.nix
index 860610bd..f6f9ba95 100644
--- a/modules/by-name/nv/nvim/module.nix
+++ b/modules/by-name/nv/nvim/module.nix
@@ -45,6 +45,9 @@ in {
     soispha.services.unison.pathsToSync = [
       "~/.local/state/nvim"
     ];
+    soispha.impermanence.userDiretories = [
+      ".local/state/nvim"
+    ];
 
     home-manager.users.soispha = {
       imports = [
diff --git a/modules/by-name/oo/oomd/module.nix b/modules/by-name/oo/oomd/module.nix
index ca332939..e0ff5a4a 100644
--- a/modules/by-name/oo/oomd/module.nix
+++ b/modules/by-name/oo/oomd/module.nix
@@ -3,16 +3,16 @@
   lib,
   ...
 }: let
-  cfg = config.soispha.systemd.oomd;
+  cfg = config.vhack.systemd.oomd;
 in {
-  options.soispha.systemd.oomd = {
+  options.vhack.systemd.oomd = {
     enable = (lib.mkEnableOption "oomd") // {default = config.systemd.oomd.enable;};
   };
 
   config = lib.mkIf cfg.enable {
     users = {
-      users.systemd-oom.uid = config.soispha.constants.ids.uids.systemd-oom;
-      groups.systemd-oom.gid = config.soispha.constants.ids.gids.systemd-oom;
+      users.systemd-oom.uid = config.vhack.constants.ids.uids.systemd-oom;
+      groups.systemd-oom.gid = config.vhack.constants.ids.gids.systemd-oom;
     };
   };
 }
diff --git a/modules/by-name/op/openssh/module.nix b/modules/by-name/op/openssh/module.nix
index f77c357b..3182f7ba 100644
--- a/modules/by-name/op/openssh/module.nix
+++ b/modules/by-name/op/openssh/module.nix
@@ -1,42 +1,59 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   config,
   lib,
   libraries,
   ...
 }: let
-  cfg = config.soispha.services.openssh;
+  cfg = config.vhack.openssh;
 in {
-  options.soispha.services.openssh = {
+  options.vhack.openssh = {
     enable = libraries.base.options.mkEnable "openssh";
   };
 
   config = lib.mkIf cfg.enable {
+    /*
+     FIXME(@bpeetz):
+      This results in a boot error, as the `/var/lib/sshd` directory
+      is only mounted _after_ the stage 2 init and with it the system
+      activation. `agenix` needs the sshd hostkey however to decrypt the
+      secrets and thus we have to ensure that this directory is mounted
+      _before_ the system activation. Alas the only way I see to achieve
+      that is to store the ssh hostkey directly on /srv, which is mounted
+      before (it's marked as 'neededForBoot' after all).
+
+      It should be possible to achieve this with impermanence however,
+      as `/var/log` is mounted in the stage 1 init; The problem is that
+      I have no idea _why_ only this is mounted and nothing else.
+
+
+    vhack.persist.directories = [
+      {
+        directory = "/var/lib/sshd";
+        user = "root";
+        group = "root";
+        mode = "0755";
+      }
+    ];
+    */
+
+    users = {
+      users.sshd.uid = config.vhack.constants.ids.uids.sshd;
+      groups.sshd.gid = config.vhack.constants.ids.gids.sshd;
+    };
+
     services.openssh = {
       enable = true;
+      settings.PasswordAuthentication = false;
       hostKeys = [
         {
-          path = "/srv/sshd/ssh_host_ed25519_key";
+          # FIXME: Remove the dependency on `/srv` this workaround.
+          # See the explanation for using `/srv` above.
+          path = "/srv/var/lib/sshd/ssh_host_ed25519_key";
+
           rounds = 1000;
           type = "ed25519";
         }
       ];
-
-      settings = {
-        PasswordAuthentication = false;
-      };
-    };
-    users = {
-      users.sshd.uid = config.soispha.constants.ids.uids.sshd;
-      groups.sshd.gid = config.soispha.constants.ids.gids.sshd;
     };
   };
 }
diff --git a/modules/by-name/pi/pipewire/module.nix b/modules/by-name/pi/pipewire/module.nix
new file mode 100644
index 00000000..57610806
--- /dev/null
+++ b/modules/by-name/pi/pipewire/module.nix
@@ -0,0 +1,27 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  config,
+  lib,
+  libraries,
+  ...
+}: let
+  cfg = config.soispha.pipewire;
+in {
+  options.soispha.pipewire = {
+    enable = libraries.base.options.mkEnable "pipewire and wireplumber";
+  };
+
+  config = lib.mkIf cfg.enable {
+    soispha.impermanence.userDirectories = [
+      ".local/state/wireplumber"
+    ];
+  };
+}
diff --git a/modules/by-name/po/postgresql/module.nix b/modules/by-name/po/postgresql/module.nix
index 5cdf6c77..319c3ac5 100644
--- a/modules/by-name/po/postgresql/module.nix
+++ b/modules/by-name/po/postgresql/module.nix
@@ -1,30 +1,19 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   config,
   lib,
   ...
 }: let
-  cfg = config.soispha.services.postgresql;
+  cfg = config.vhack.postgresql;
 in {
-  options.soispha.services.postgresql = {
+  options.vhack.postgresql = {
     enable = lib.mkEnableOption "postgresql";
   };
 
   config = lib.mkIf cfg.enable {
-    soispha.impermanence.directories = [
+    vhack.persist.directories = [
       "/var/lib/postgresql"
     ];
 
-    services.postgresql = {
-      enable = true;
-    };
+    services.postgresql.enable = true;
   };
 }
diff --git a/modules/by-name/re/resolvconf/module.nix b/modules/by-name/re/resolvconf/module.nix
index e1817e2b..69bd6fbb 100644
--- a/modules/by-name/re/resolvconf/module.nix
+++ b/modules/by-name/re/resolvconf/module.nix
@@ -3,13 +3,13 @@
   lib,
   ...
 }: let
-  cfg = config.soispha.resolvconf;
+  cfg = config.vhack.resolvconf;
 in {
-  options.soispha.resolvconf = {
+  options.vhack.resolvconf = {
     enable = lib.mkEnableOption "resolvconf" // {default = config.networking.resolvconf.enable;};
   };
 
   config = lib.mkIf cfg.enable {
-    users.groups.resolvconf.gid = config.soispha.constants.ids.gids.resolvconf;
+    users.groups.resolvconf.gid = config.vhack.constants.ids.gids.resolvconf;
   };
 }
diff --git a/modules/by-name/si/signal/module.nix b/modules/by-name/si/signal/module.nix
new file mode 100644
index 00000000..0e9c4437
--- /dev/null
+++ b/modules/by-name/si/signal/module.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  libraries,
+  ...
+}: let
+  cfg = config.soispha.signal;
+in {
+  options.soispha.signal = {
+    enable = libraries.base.options.mkEnable "signal";
+  };
+  config = lib.mkIf cfg.enable {
+    soispha.impermanence.userDirectories = [
+      ".config/Signal"
+    ];
+  };
+}
diff --git a/modules/by-name/us/users/module.nix b/modules/by-name/us/users/module.nix
index d9097fe1..0f84b58b 100644
--- a/modules/by-name/us/users/module.nix
+++ b/modules/by-name/us/users/module.nix
@@ -1,80 +1,90 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }: let
-  cfg = config.soispha.users;
-in {
-  options.soispha.users = {
-    enable = lib.mkEnableOption "user set-up for soispha";
+  cfg = config.vhack.users;
 
-    hashedPassword = lib.mkOption {
-      type = lib.types.str;
-      example = lib.literalExpression "$y$jFT$ONrCqZIJKB7engmfA4orD/$0GO58/wV5wrYWj0cyONhyujZPjFmbT0XKtx2AvXLG0B";
-      description = "The hashed password of the user";
-    };
-    groups = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = ["wheel" "audio"];
-      description = "The groups the soispha user should be part of";
+  mkUser = {
+    name,
+    hashedPassword,
+    uid,
+    sshKey,
+  }: {
+    inherit name;
+    value = {
+      inherit name uid hashedPassword;
+      isNormalUser = true;
+      createHome = true;
+      home = "/home/${name}";
+      extraGroups = cfg.groups ++ lib.optional cfg.enableDeprecatedPlugdev "plugdev";
+      openssh.authorizedKeys.keys = [
+        sshKey
+      ];
     };
-
-    # Although deprecated, this helps with old udev rules, that still use this group.
-    # TODO: Try to find a way to remove this option (i.e. set it always to false).
-    enableDeprecatedPlugdev = lib.mkEnableOption "the deprecated plugdev group for the user";
   };
 
-  config = lib.mkIf cfg.enable {
-    users = {
-      mutableUsers = false;
+  extraUsers = lib.listToAttrs (
+    builtins.map mkUser cfg.users
+  );
+in {
+  options.vhack.users = {
+    enable = lib.mkEnableOption "user setup";
+    users = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+            description = "User name";
+          };
 
-      users = {
-        soispha = {
-          isNormalUser = true;
-          home = "/home/soispha";
-          createHome = true;
-          shell = config.home-manager.users.soispha.programs.fish.package;
-          initialHashedPassword = cfg.hashedPassword;
-          extraGroups = cfg.groups ++ lib.optional cfg.enableDeprecatedPlugdev "plugdev";
+          groups = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = ["wheel"];
+            description = "The groups the user should be part of";
+          };
 
-          uid = 1000;
-          openssh.authorizedKeys.keys = [
-            # TODO: This should be parameterized. <2024-05-16>
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz"
-          ];
-        };
+          # Although deprecated, this helps with old udev rules, that still use this group.
+          # TODO: Try to find a way to remove this option (i.e. set it always to false).
+          enableDeprecatedPlugdev = lib.mkEnableOption "the deprecated plugdev group for the user";
 
-        root = {
-          hashedPassword = lib.mkForce null; # to lock root
-          openssh.authorizedKeys.keys = lib.mkForce [];
+          hashedPassword = lib.mkOption {
+            type = lib.types.str;
+            description = "Hashed user password.";
+          };
+          sshKey = lib.mkOption {
+            type = lib.types.str;
+            description = "public ssh key, for ssh access.";
+          };
+          uid = lib.mkOption {
+            type = lib.types.int;
+            description = "UNIQUE user id, ideally greater than 1000.";
+          };
         };
-      };
+      });
+      description = "Users";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.fish = {
+      enable = true;
+      useBabelfish = true;
     };
 
-    home-manager.users = {
-      soispha.home = {
-        username = "soispha";
-        homeDirectory = config.users.users.soispha.home;
-        stateVersion = "23.05";
-        enableNixpkgsReleaseCheck = true;
-      };
+    users = {
+      mutableUsers = false;
+      defaultUserShell = config.programs.fish.package;
 
-      root.home = {
-        username = "root";
-        homeDirectory = config.users.users.root.home;
-        stateVersion = "23.05";
-        enableNixpkgsReleaseCheck = true;
-      };
+      users =
+        {
+          root = {
+            hashedPassword = lib.mkForce null; # to lock root
+            openssh.authorizedKeys.keys = lib.mkForce [];
+          };
+        }
+        // extraUsers;
     };
   };
 }
diff --git a/modules/by-name/xd/xdg/module.nix b/modules/by-name/xd/xdg/module.nix
index 9430d82f..1478ebff 100644
--- a/modules/by-name/xd/xdg/module.nix
+++ b/modules/by-name/xd/xdg/module.nix
@@ -49,6 +49,15 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    soispha.impermanance.userDirectories = [
+      ".local/share"
+      ".cache"
+
+      "media"
+      "repos"
+      "documents"
+    ];
+
     home-manager.users.soispha.xdg = {
       enable = true;
 
diff --git a/modules/common/default.nix b/modules/common/default.nix
index 4855c7ab..facc9e9f 100644
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -17,6 +17,22 @@
 }: {
   # TODO(@bpeetz): Move this file to default options in their respective modules. <2025-05-31>
 
+  home-manager.users = {
+    soispha.home = {
+      username = "soispha";
+      homeDirectory = config.users.users.soispha.home;
+      stateVersion = "23.05";
+      enableNixpkgsReleaseCheck = true;
+    };
+
+    root.home = {
+      username = "root";
+      homeDirectory = config.users.users.root.home;
+      stateVersion = "23.05";
+      enableNixpkgsReleaseCheck = true;
+    };
+  };
+
   soispha = {
     age.enable = true;
     boot.enable = true;