10 files changed, 667 insertions, 74 deletions
diff --git a/modules/by-name/ni/nix-index/command_not_found.fish b/modules/by-name/ni/nix-index/command_not_found.fish
new file mode 100644
index 00000000..bbdb2230
--- /dev/null
+++ b/modules/by-name/ni/nix-index/command_not_found.fish
@@ -0,0 +1,111 @@
+#!/usr/bin/env fish
+
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+
+# This was taken from the
+# `${pkgs.nix-index}/etc/profile.d/command-not-found.sh` file on 2024-02-28
+
+function _log
+    printf $argv >&2
+end
+
+function _bail
+    __fish_default_command_not_found_handler $argv
+    return "$status"
+end
+
+function _common_prefix
+    set --function prefix
+
+    for str in $argv
+        set position 1
+        for c in (string split '' "$str")
+            if test -z $prefix[$position]
+                set prefix[$position] "$c"
+            else if test $prefix[$position] != "$c"
+                if test $position = 1
+                    # The first letter of the prefix mis-matched.
+                    # As such there is no shared prefix, and we can simple bail early.
+                    echo ""
+                    return
+                else
+                    set prefix $prefix[1..(math $position - 1)]
+                end
+                break
+            end
+
+            set position (math $position + 1)
+        end
+    end
+
+    echo "$(string join "" $prefix)"
+end
+
+function fish_command_not_found
+    # Only run if it's an interactive shell
+    if not status is-interactive
+        return (_bail $argv)
+    end
+
+    # The nixpkgs flake should always be available on NixOS
+    set --local toplevel nixpkgs
+    set --local cmd "$argv[1]"
+
+    set --local attrs "$(nix-locate --minimal --no-group --type x --type s --whole-name --at-root "/bin/$cmd")"
+
+    if test -n "$attrs"
+        set --function len "$(echo "$attrs" | count)"
+    else
+        set --function len 0
+    end
+
+    switch "$len"
+    case 0
+    case 1 or '*'
+        _log "The program '%s' is currently not installed.\n" "$cmd"
+    end
+
+    switch "$len"
+    case 0
+        return (_bail $argv)
+    case 1
+        # If only one package provides this, then we can invoke it
+        # without asking the user.
+
+        # These will not return 127 if they worked correctly.
+
+        _log "A shell will be opened with it.\n"
+
+        if nix build "$toplevel#$attrs" --no-link
+            nix shell "$toplevel#$attrs"
+            return "$status"
+        else
+            _log "Failed to build: '%s#%s'\n" "$toplevel" "$attrs"
+            return (_bail $argv)
+        end
+    case '*'
+        _log "It is provided by several packages. You can run it load it with:\n"
+
+        set --local counter 0
+        set --local attrs $(echo $attrs)
+        for attr in $attrs
+            _log "%3s)" "$counter"
+            _log " nix shell %s#%s\n" "$toplevel" "$attr";
+
+            set counter "$(math "$counter" + 1)"
+        end
+
+        commandline "nix shell $toplevel#$(_common_prefix $attrs)"
+    end
+
+    # command not found should always exit with 127
+    return 127
+end
diff --git a/modules/by-name/zs/zsh/config/command_not_found/command_not_found.sh b/modules/by-name/ni/nix-index/command_not_found.zsh
index fb21b676..579f9db4 100644
--- a/modules/by-name/zs/zsh/config/command_not_found/command_not_found.sh
+++ b/modules/by-name/ni/nix-index/command_not_found.zsh
@@ -1,5 +1,15 @@
 #!/usr/bin/env dash
 
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+
 # This was taken from the
 # `${pkgs.nix-index}/etc/profile.d/command-not-found.sh` file on 2024-02-28
 
@@ -16,12 +26,12 @@ command_not_found_handle() {
 
     toplevel=nixpkgs # nixpkgs should always be available even in NixOS
     cmd="$1"
-    attrs=$(nix-locate --minimal --no-group --type x --type s --top-level --whole-name --at-root "/bin/$cmd")
+    attrs=$(nix-locate --minimal --no-group --type x --type s --whole-name --at-root "/bin/$cmd")
     len=$(if [ -n "$attrs" ]; then echo "$attrs" | wc -l; else echo 0; fi)
 
     case "$len" in
     0)
-        eprintln "$cmd: command not found"
+        printf "%s: command not found\n" "$cmd" >&2
         ;;
     1)
         # If only one package provides this, then we can invoke it
@@ -48,7 +58,7 @@ EOF
 The program '$cmd' is currently not installed. It is provided by
 several packages. You can run it once with:
 EOF
-        awk --assign=toplevel="$toplevel" 'BEGIN{counter=0} {printf("%3s)", counter); printf("  nix shell %s#%s\n", toplevel, $1); counter+=1}' "$(ptmp "$attrs")"
+        echo "$attrs" | awk --assign=toplevel="$toplevel" 'BEGIN{counter=0} {printf("%3s)", counter); printf("  nix shell %s#%s\n", toplevel, $1); counter+=1}'
         ;;
     esac
 
diff --git a/modules/by-name/ni/nix-index/module.nix b/modules/by-name/ni/nix-index/module.nix
new file mode 100644
index 00000000..72be6b52
--- /dev/null
+++ b/modules/by-name/ni/nix-index/module.nix
@@ -0,0 +1,48 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  config,
+  lib,
+  modules,
+  ...
+}: let
+  cfg = config.soispha.programs.nix-index;
+in {
+  options.soispha.programs.nix-index = {
+    enable = lib.mkEnableOption "nix-index";
+  };
+
+  config = lib.mkIf cfg.enable {
+    soispha.programs = {
+      zsh.integrations.nix-index = ./command_not_found.zsh;
+      fish.integrations.nix-index = ./command_not_found.fish;
+    };
+
+    home-manager.users.soispha = {
+      imports = [
+        modules.nix-index-database.homeModules.nix-index
+      ];
+
+      programs.nix-index = {
+        enable = true;
+        symlinkToCacheHome = true;
+
+        # Handled by myself (and the script is overridden)
+        enableBashIntegration = false;
+        enableZshIntegration = false;
+        enableFishIntegration = false;
+      };
+
+      programs.nix-index-database = {
+        comma.enable = false;
+      };
+    };
+  };
+}
diff --git a/modules/by-name/ni/nix/module.nix b/modules/by-name/ni/nix/module.nix
index 48834b2d..b7e64989 100644
--- a/modules/by-name/ni/nix/module.nix
+++ b/modules/by-name/ni/nix/module.nix
@@ -1,63 +1,82 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   pkgs,
+  libraries,
+  config,
+  lib,
   # flakes
-  nixpkgs_as_input,
-  templates,
+  sources,
   self,
   system,
+  externalDependencies,
   ...
-}: {
-  # TODO(@bpeetz): Modularize <2025-02-08>
+}: let
+  inherit (sources) nixpkgs;
 
-  nix = {
-    package = pkgs.lix;
+  cfg = config.soispha.nix;
+in {
+  options.soispha.nix = {
+    enable = libraries.base.options.mkEnable "nix";
+  };
 
-    # Disable nix channels  (this is a remnant of old days)
-    channel.enable = false;
+  config = lib.mkIf cfg.enable {
+    nix = {
+      package = pkgs.lixPackageSets.latest.lix;
 
-    registry = {
-      nixpkgs.flake = nixpkgs_as_input;
-      n.flake =
-        nixpkgs_as_input
-        // {
-          # Otherwise nixpkgs's config and overlays are not available:
+      # Disable nix channels  (this is a remnant of old days)
+      channel.enable = false;
 
-          # Both attrs exists, so we just override both and hope
-          outputs.legacyPackages."${system}" = pkgs;
-          legacyPackages."${system}" = pkgs;
-        };
+      registry = {
+        nixpkgs.flake = nixpkgs;
+        n.flake =
+          nixpkgs
+          // {
+            # Otherwise nixpkgs's config and overlays are not available:
 
-      t.flake = templates;
+            # Both attrs exists, so we just override both and hope
+            outputs.legacyPackages."${system}" = pkgs;
+            legacyPackages."${system}" = pkgs;
+          };
 
-      my_flake.flake = self;
-      m.flake = self;
-    };
+        t.flake = externalDependencies.templates;
 
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
+        my_flake.flake = self;
+        m.flake = self;
+      };
+
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 7d";
+      };
 
-    settings = {
-      auto-optimise-store = true;
-      experimental-features = [
-        "nix-command"
-        "flakes"
-        #"ca-derivations"
-      ];
+      settings = {
+        # Don't warn about dirty git trees (It is usually absolutely useless)
+        warn-dirty = false;
 
-      use-xdg-base-directories = true;
+        auto-optimise-store = true;
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
 
-      #substituters = ["https://cache.ngi0.nixos.org/"];
-      #trusted-public-keys = ["cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="];
+        use-xdg-base-directories = true;
 
-      fallback = true; # Build from source, if binary can't be substituted
+        fallback = true; # Build from source, if binary can't be substituted
 
-      keep-failed = false; # keep failed tmp build dirs
-      pure-eval = true; # restrict file system and network access to hash
+        keep-failed = false; # keep failed tmp build dirs
+        pure-eval = true; # restrict file system and network access to hash
 
-      sandbox-fallback = false; # Don't disable the sandbox, if the kernel doesn't support it
+        sandbox-fallback = false; # Don't disable the sandbox, if the kernel doesn't support it
+      };
     };
   };
 }
diff --git a/modules/by-name/ni/nixos-option/module.nix b/modules/by-name/ni/nixos-option/module.nix
new file mode 100644
index 00000000..0053d357
--- /dev/null
+++ b/modules/by-name/ni/nixos-option/module.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  libraries,
+  ...
+}: let
+  cfg = config.soispha.programs.nixos-option;
+in {
+  options.soispha.programs.nixos-option = {
+    enable = libraries.base.options.mkEnable "nixos-option";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # NOTE: We disable nixos-option here explicitly, because I never used it, and it
+    # depends on cppnix. <2025-12-11>
+    system.tools.nixos-option.enable = false;
+  };
+}
diff --git a/modules/by-name/ni/nixos-shell/module.nix b/modules/by-name/ni/nixos-shell/module.nix
new file mode 100644
index 00000000..1a0190c8
--- /dev/null
+++ b/modules/by-name/ni/nixos-shell/module.nix
@@ -0,0 +1,129 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Jörg Thalheim and contributors
+# SPDX-License-Identifier: MIT
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  lib,
+  config,
+  pkgs,
+  sources,
+  ...
+}: let
+  cfg = config.soispha.nixos-shell;
+  inherit (sources) nixpkgs;
+in {
+  options.soispha.nixos-shell = {
+    enable = lib.mkEnableOption "nixos-shell";
+
+    user_name = lib.mkOption {
+      type = lib.types.str;
+      default = "soispha";
+      description = "The user to auto-login into the vm.";
+    };
+
+    configuration = {
+      specialArgs = lib.mkOption {
+        type = lib.types.attrsOf lib.types.anything;
+        default = {};
+        description = ''
+          The arguments to pass to the `specialArgs` attribute set.
+        '';
+      };
+      value = lib.mkOption {
+        type = lib.types.deferredModule;
+        default = {};
+        description = ''
+          Additional NixOS configuration to load into the VM's config.
+        '';
+      };
+    };
+
+    mounts = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
+        options = {
+          target = lib.mkOption {
+            type = lib.types.path;
+            description = "Target on the guest.";
+          };
+
+          cache_mode = lib.mkOption {
+            type = lib.types.enum ["none" "loose" "fscache" "mmap"];
+            default = "loose"; # bad idea? Well, at least it is fast!1!!
+            description = "9p caching policy";
+          };
+
+          readOnly =
+            (lib.mkEnableOption "mount this disk in read-only mode")
+            // {
+              default = true;
+            };
+
+          tag = lib.mkOption {
+            type = lib.types.str;
+            internal = true;
+          };
+        };
+
+        config.tag = lib.mkDefault (
+          builtins.substring 0 31 ( # tags must be shorter than 32 bytes
+            "a"
+            + # tags must not begin with a digit
+            builtins.hashString "md5" config._module.args.name
+          )
+        );
+      }));
+      default = {};
+      description = ''
+        Extra paths to make available in the vm.
+        These will be mounted ro to their `target.`
+      '';
+    };
+  };
+
+  config = let
+    vmSystem = nixpkgs.lib.nixosSystem {
+      inherit (cfg.configuration) specialArgs;
+
+      modules = [
+        {
+          # TODO(@bpeetz): This should be bumped each release. <2025-05-17>
+          system.stateVersion = "25.11";
+        }
+
+        cfg.configuration.value
+
+        (import ./shell_setup.nix {inherit cfg;})
+      ];
+    };
+
+    nixos-shell = pkgs.writeShellApplication {
+      name = "nixos-shell";
+      text = builtins.readFile ./nixos-shell.sh;
+
+      # We need to keep the PATH, as we otherwise can't pass it along.
+      inheritPath = true;
+
+      runtimeInputs = [
+        vmSystem.config.system.build.vm
+        pkgs.mktemp
+        pkgs.coreutils
+        pkgs.moreutils # for sponge
+      ];
+      runtimeEnv = {
+        HOST_NAME = vmSystem.config.system.name;
+      };
+    };
+  in
+    lib.mkIf cfg.enable {
+      environment.systemPackages = [
+        nixos-shell
+      ];
+
+      system.build.nixos-shell = vmSystem.config.system.build.vm;
+    };
+}
diff --git a/modules/by-name/ni/nixos-shell/nixos-shell.sh b/modules/by-name/ni/nixos-shell/nixos-shell.sh
new file mode 100755
index 00000000..3b34019a
--- /dev/null
+++ b/modules/by-name/ni/nixos-shell/nixos-shell.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env dash
+
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Jörg Thalheim and contributors
+# SPDX-License-Identifier: MIT
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+
+SHARED_DIR="$(mktemp -t --directory "nixos_shell_XXXXXXXXX")"
+cleanup() {
+    rm --recursive "$SHARED_DIR"
+}
+trap cleanup EXIT
+export SHARED_DIR
+
+TMPDIR="$SHARED_DIR"
+export TMPDIR
+
+cat <<EOF >"$SHARED_DIR/.env_variables"
+{
+    "pwd": "$PWD",
+    "term": "$TERM",
+    "path": "$PATH"
+}
+EOF
+
+mk_tag() {
+    additional_path="$1"
+
+    # tags must be shorter than 32 bytes
+    # and must not begin with a digit.
+    {
+        printf "a"
+        echo "$additional_path" | sha256sum | head -c 30
+    }
+}
+
+for raw_additional_path in "$@"; do
+    additional_path="$(realpath "$raw_additional_path")"
+    tag="$(mk_tag "$additional_path")"
+
+    if [ "$(jq --arg mount "$tag" '.mount.[$mount]' "$SHARED_DIR/.env_variables")" != "null" ]; then
+        echo "Path '$additional_path' alread added."
+        shift 1
+        continue
+    fi
+
+    jq --arg mount "$tag" --arg target "$additional_path" \
+        '. + {mount: {$mount: $target}}' "$SHARED_DIR/.env_variables" | sponge "$SHARED_DIR/.env_variables"
+
+    set -- "$@" -virtfs "local,path=$additional_path,security_model=none,readonly=on,mount_tag=$tag"
+    shift 1
+done
+
+# Do not exec here, as we don't want to lose our cleanup hooks.
+"run-$HOST_NAME-vm" "$@"
diff --git a/modules/by-name/ni/nixos-shell/shell_setup.nix b/modules/by-name/ni/nixos-shell/shell_setup.nix
new file mode 100644
index 00000000..75af0678
--- /dev/null
+++ b/modules/by-name/ni/nixos-shell/shell_setup.nix
@@ -0,0 +1,191 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Jörg Thalheim and contributors
+# SPDX-License-Identifier: MIT
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+# This file contains the code that is used to setup the VM shell.
+{cfg}: {
+  lib,
+  config,
+  pkgs,
+  modulesPath,
+  ...
+}: let
+  mkVMDefault = lib.mkOverride 970;
+
+  env_file = "/tmp/shared/.env_variables";
+in {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/virtualisation/qemu-vm.nix")
+  ];
+
+  config = {
+    assertions = [
+      {
+        assertion = builtins.elem cfg.user_name (lib.mapAttrsToList (name: value: name) config.users.users);
+        message = ''
+          Your user ${cfg.user_name} is not a recorded user in `config.users.users`.
+          Auto-login will not work.
+        '';
+      }
+    ];
+
+    # Lock root login.
+    users.users.root.hashedPassword = "";
+
+    # Remove unneeded clutter.
+    system.switch.enable = false;
+
+    virtualisation = {
+      # See https://wiki.qemu.org/Documentation/9psetup#Performance_Considerations.
+      # It is effectively a balance between ram and IO speed.
+      msize = let
+        kib = x: x * 1024;
+      in
+        mkVMDefault (kib 512);
+
+      graphics = mkVMDefault false;
+      memorySize = mkVMDefault 1700; # in MB
+      cores = mkVMDefault 16;
+
+      # Do not persist this VM.
+      diskImage = mkVMDefault null;
+
+      fileSystems =
+        lib.mapAttrs'
+        (_: mount: {
+          name = mount.target;
+
+          value = {
+            device = mount.tag;
+            fsType = "9p";
+            options =
+              [
+                "trans=virtio"
+                "version=9p2000.L"
+                "cache=${mount.cache_mode}"
+                "msize=${toString config.virtualisation.msize}"
+              ]
+              ++ lib.optionals mount.readOnly ["ro"];
+          };
+        })
+        cfg.mounts;
+
+      qemu = {
+        consoles = lib.mkIf (!config.virtualisation.graphics) ["tty0" "hvc0"];
+
+        options = let
+          mkMount = options: "-virtfs " + (builtins.concatStringsSep "," options);
+        in
+          lib.optionals (!config.virtualisation.graphics) [
+            "-serial null"
+            "-device virtio-serial"
+            "-chardev stdio,mux=on,id=char0,signal=off"
+            "-mon chardev=char0,mode=readline"
+            "-device virtconsole,chardev=char0,nr=0"
+          ]
+          ++ (lib.mapAttrsToList
+            (hostPath: mount:
+              mkMount [
+                "local"
+                "path=${builtins.toString hostPath}"
+                "security_model=none"
+                "readonly=on"
+                "mount_tag=${mount.tag}"
+              ])
+            cfg.mounts);
+      };
+    };
+
+    services = {
+      getty.helpLine = ''
+        If you are connect via serial console:
+        Type Ctrl-a c to switch to the qemu console
+        and `quit` to stop the VM.
+      '';
+
+      getty.autologinUser = cfg.user_name;
+    };
+
+    system.activationScripts = {
+      mountAdditionalPaths =
+        # bash
+        ''
+          PATH="${pkgs.jq}/bin:${pkgs.util-linux}/bin:$PATH"
+          export PATH
+
+          max_index="$(jq '.mount | keys | length' --raw-output ${env_file})"
+          index=0
+
+          mount --mkdir --type=tmpfs none "/.rw" --options=rw,relatime,mode=0755
+          while [ "$index" -lt "$max_index" ]; do
+            what="$(jq --argjson index "$index" '.mount | keys | map(.)[$index]' --raw-output ${env_file})"
+            where="$(jq --argjson index "$index" '.mount | map(.)[$index]' --raw-output ${env_file})"
+
+            mkdir "/.rw/$what"
+            mount --mkdir "$what" "/.ro/$what" \
+              --type=9p \
+              --options=ro,trans=virtio,version=9p2000.L,msize=${toString config.virtualisation.msize},x-systemd.requires=modprobe@9pnet_virtio.service
+
+            mkdir "/.rw/work-$what"
+            mount --mkdir --type=overlay overlay \
+              --options=rw,relatime,lowerdir="/.ro/$what",upperdir="/.rw/$what",workdir="/.rw/work-$what",uuid=on \
+              "/.ov/$what"
+
+            index="$((index + 1))"
+          done
+        '';
+    };
+
+    systemd.services.mountAdditionalPaths = {
+      after = ["local-fs.target"];
+      wantedBy = ["multi-user.target"];
+      path = [pkgs.jq];
+      script =
+        # bash
+        ''
+          max_index="$(jq '.mount | keys | length' --raw-output ${env_file})"
+          index=0
+
+          while [ "$index" -lt "$max_index" ]; do
+            what="$(jq --argjson index "$index" '.mount | keys | map(.)[$index]' --raw-output ${env_file})"
+            where="$(jq --argjson index "$index" '.mount | map(.)[$index]' --raw-output ${env_file})"
+
+            systemd-mount --type none "/.ov/$what" "$where" --options=bind
+
+            # HACK(@bpeetz): Nearly all of the paths are in $HOME anyways. So simply avoid
+            # the permission issue.
+            # Ideally, we would pass the original owners along with the mount. <2025-05-17>
+            chown --recursive soispha:users "/home/soispha"
+
+            index="$((index + 1))"
+          done
+        '';
+    };
+
+    environment = {
+      systemPackages = [
+        pkgs.jq
+      ];
+
+      sessionVariables = {
+        IN_NIXOS_SHELL = "true";
+      };
+
+      loginShellInit =
+        # bash
+        ''
+          cd "$(jq '.pwd' --raw-output ${env_file})"
+          export TERM="$(jq '.term' --raw-output ${env_file})"
+          export PATH="$(jq '.path' --raw-output ${env_file}):$PATH"
+        '';
+    };
+
+    networking.firewall.enable = mkVMDefault true;
+  };
+}
diff --git a/modules/by-name/ni/nixpkgs/config.nix b/modules/by-name/ni/nixpkgs/config.nix
deleted file mode 100644
index 1a24444d..00000000
--- a/modules/by-name/ni/nixpkgs/config.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  cfg,
-  myPkgs,
-  lib,
-  ...
-}: let
-  myPkgsOverlay = self: super: myPkgs;
-in {
-  nixpkgs = {
-    hostPlatform = cfg.systemName;
-
-    overlays = [
-      myPkgsOverlay
-    ];
-
-    config = {
-      # TODO: this fails because of the root tempsize, which should be increased
-      # contentAddressedByDefault = true;
-
-      hostSystem = cfg.systemName;
-
-      allowUnfreePredicate = pkg:
-        builtins.elem (lib.getName pkg) [
-          "pypemicro" # required by pynitrokey
-        ];
-    };
-  };
-}
diff --git a/modules/by-name/ni/nixpkgs/module.nix b/modules/by-name/ni/nixpkgs/module.nix
index eda3ac89..1ded8444 100644
--- a/modules/by-name/ni/nixpkgs/module.nix
+++ b/modules/by-name/ni/nixpkgs/module.nix
@@ -1,8 +1,18 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   lib,
   config,
+  packageSets,
   ...
-} @ args: let
+}: let
   cfg = config.soispha.nixpkgs;
 in {
   options.soispha.nixpkgs = {
@@ -12,6 +22,31 @@ in {
       example = "x86_64-linux";
       type = lib.types.str;
     };
+    unfreePackageNames = lib.mkOption {
+      description = "Names of unfree packages to allow";
+      example = "[ steam steam-unwrapped ]";
+      type = lib.types.listOf lib.types.str;
+    };
   };
-  config = lib.mkIf cfg.enable (import ./config.nix (args // {inherit cfg;}));
+
+  config = let
+    myPkgsOverlay = self: super: packageSets.soispha;
+  in
+    lib.mkIf cfg.enable
+    {
+      nixpkgs = {
+        hostPlatform = cfg.systemName;
+
+        overlays = [
+          myPkgsOverlay
+        ];
+
+        config = {
+          hostSystem = cfg.systemName;
+
+          allowUnfreePredicate = pkg:
+            builtins.elem (lib.getName pkg) cfg.unfreePackageNames;
+        };
+      };
+    };
 }