diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b52b1c1
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+home/private.nix
diff --git a/bashrc b/bashrc
deleted file mode 100644
index 2d1c7a4..0000000
--- a/bashrc
+++ /dev/null
@@ -1,228 +0,0 @@
-# vars
-#PATH=$HOME/.scripts:/opt:/home/shihaam/.local/bin:$HOME/.shortcuts/wineprograms:$HOME/Applications:$PATH
-HISTSIZE=999999
-HISTFILESIZE=999962
-HISTCONTROL=ignoreboth:erasedups
-
-export GPG_TTY=$(tty) #Set GPG_TTY veriable, needed for signing git commits other gpg stuff
-export COMPOSE_DOCKER_CLI_BUILD=1
-export DOCKER_BUILDKIT=1
-
-#export SSH_CA_FILES=/home/shihaam/git/alliedmaldives/ops/ssh-ca
-export SSH_CA_FILES=$HOME/.ssh
-export SSH_CA_REVOCATION_LIST=$HOME/git/allied/ops/ssh-ca/revoked_keys
-export SSL_FILES=$HOME/git/allied/ops/ssl-certs
-export ALLIED_MYSQL_CA_REPO=$HOME/git/allied/ops/mysql-ca
-
-export OMEGATECH_SSL_FILES=$HOME/container/genssl/certs/omegatechsolution.org
-export GTK_IM_MODULE=ibus
-export QT_IM_MODULE=ibus
-export XMODIFIERS=@im=ibus
-
-
-export EDITOR=nano
-export BITWARDENCLI_APPDATA_DIR=$HOME/.config/bitwarden-cli
-#export BW_SESSION=$(bw unlock --passwordfile ~/.local/share/bitwarden-cli/allied.txt --raw)
-#load ble.sh
-#source ~/.local/share/blesh/ble.sh
-source $(blesh-share)/ble.sh
-#source -- "$(blesh-share)"/ble.sh --attach=none
-
-#load seafly prompt
-source ~/.bash-seafly-prompt/command_prompt.bash
-
-eval "$(direnv hook bash)"
-
-#always open last dir
-cd(){ builtin cd "$@" && pwd > ~/.cache/whereami;}
-cdl(){ cd $(cat ~/.cache/whereami);};cdl
-
-ip(){
- if [[ $1 == "info"  ]]
- then
-   curl -s https://ipinfo.io/$2 | jq
- else
-   command ip "$@"
- fi
-}
-
-bw(){
-  if [[ $1 == "pinunlock" ]]; then
-    local PIN
-    read -srp "Enter PIN: " PIN
-    echo ""
-    local BW_PASSWORD=$(openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 -in ~/.local/share/bitwarden-cli/allied-encrypted -pass pass:"$PIN" 2>/dev/null)
-    export BW_SESSION=$(BW_PASSWORD="$BW_PASSWORD" bw unlock --raw --passwordenv BW_PASSWORD)
-    [ -z "$BW_SESSION" ] && return 1
-    echo "Bitwarden vault unlocked."
-  else
-    command bw "$@"
-  fi
-}
-
-####### ALIASES ##########
-# add features
-#alias nano='nano -l'
-alias hdd='cd /mnt/hdd'
-alias drag=ripdrag
-
-#Adding output colors
-alias ls='ls --color=always'
-alias grep='grep --color=auto'
-alias less='less -R'
-alias ping='ping -O'
-# fix typos
-alias ckear=clear
-alias sl=ls
-alias ks=ls
-alias dc=cd
-
-alias claude='docker run --rm -it -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json -v $PWD:$PWD -w $PWD git.shihaam.dev/dockerfiles/ccc'
-#########################
-
-#docker(){
-#   if [[ $1 == "compose" && $2 == "up" && $# -eq 2 ]]; then
-#        docker compose up -d && docker compose logs -f
-#    else
-#        command docker "$@"
-#    fi
-#}
-##################### Some cool funcations hehe ###############################
-letmein(){ mkdir -p $1 && cd $1;}
-# do math in shell
-math(){ echo $1 | bc;}
-# Simpleway to see IP resolved to DNS record
-checkip(){ dig $1 +short;}
-# search for term and edit first file with that specific text
-edit(){ nano $(grep $1 * -R | awk '{print $1}'|cut -f1 -d ':' | head -n1);}
-#root(){ su -c "$@";}
-# view md file on cli
-catmd() { pandoc $1 | lynx -stdin;}
-# replace white spaces in file name with underscores
-rmspace() { for file in *; do mv -- "$file" "${file// /_}"; done;}
-yq() {
-  podman run --rm -i -v "${PWD}":/workdir mikefarah/yq "$@"
-}
-###############################################################################
-
-### Enter container
-#enter () {
-#    local container="$(echo "$1" | cut -d'_' -f1)"
-#    if docker ps | grep "$container" >/dev/null 2>&1; then
-#        docker exec -it "$container" bash
-#    elif podman ps | grep "$container" >/dev/null 2>&1; then
-#        podman exec -it "$container" bash
-#    else
-#        echo "Error: Container '$container' not found" >&2
-#        return 1
-#    fi
-#}
-
-enter () {
-    local container="$1"
-#    local container="$(echo "$1" | cut -d'_' -f1)"
-    if docker ps | grep "$container" >/dev/null 2>&1; then
-        docker exec -it "$container" bash
-    elif podman ps | grep "$container" >/dev/null 2>&1; then
-        podman exec -it "$container" bash
-    else
-        echo "Error: Container '$container' not found" >&2
-        return 1
-    fi
-}
-
-extract() {
-    if [ -f "$1" ] ; then
-        local folder_name=$(basename "$1" | sed -e 's/\..*$//')
-        mkdir -p "$folder_name"
-        case "$1" in
-            *.tar.bz2)   tar xvjf "$1" -C "$folder_name" ;;
-            *.tar.gz)    tar xvzf "$1" -C "$folder_name" ;;
-            *.bz2)       bunzip2 -k "$1" && mv "${1%.*}" "$folder_name" ;;
-            *.rar)       unrar x "$1" "$folder_name" ;;
-            *.gz)        gunzip -k "$1" && mv "${1%.*}" "$folder_name" ;;
-            *.tar)       tar xvf "$1" -C "$folder_name" ;;
-            *.tbz2)      tar xvjf "$1" -C "$folder_name" ;;
-            *.tgz)       tar xvzf "$1" -C "$folder_name" ;;
-            *.zip)       unzip "$1" -d "$folder_name" ;;
-            *.Z)         uncompress "$1" && mv "${1%.*}" "$folder_name" ;;
-            *.7z)        7z x "$1" -o"$folder_name" ;;
-            *.xz)        xz --decompress --keep "$1" && mv "${1%.*}" "$folder_name" ;;
-            *)           echo "'$1' cannot be extracted via extract()" ;;
-        esac
-    else
-        echo "'$1' is not a valid file"
-    fi
-}
-
-
-fix-paru() {
-    local tmp_dir="/tmp/paru-install-$$"
-    
-    if ! git clone https://aur.archlinux.org/paru.git "$tmp_dir"; then
-        echo "Error: Failed to clone paru repository"
-        return 1
-    fi
-    
-    cd "$tmp_dir" || return 1
-    
-    if ! makepkg -si; then
-        echo "Error: Installation failed"
-        cd - > /dev/null
-        rm -rf "$tmp_dir"
-        return 1
-    fi
-}
-
-#load neofetch
-#neofetch
-
-PATH=$PATH:/home/shihaam/.wine/drive_c/users/shihaam/AppData/Roaming/.tlauncher/legacy/Minecraft
-shopt -s cdspell
-#fastfetch
-#source ~/.local/share/blesh/ble.sh
-
-
-alias sudo=doas
-#alias cp="advcp -gR"
-#alias mv="advmv -g"
-#cd /home/shihaam/container/sentinel
-#docker compose exec la2410 bash
-
-# Added by LM Studio CLI (lms)
-export PATH="$PATH:/home/shihaam/.lmstudio/bin"
-# End of LM Studio CLI section
-
-arch() {
-    local user_flag=""
-    if [[ "$1" == "root" ]]; then
-        user_flag="-u root"
-        shift
-    fi
-
-    local cmd=("bash")
-    [[ $# -gt 0 ]] && cmd=("$@")
-
-    podman run --rm -it \
-        --name "archlinux-$$" \
-        --network host \
-        --workdir "$PWD" \
-        $user_flag \
-        -e USER="$USER" \
-        -e HOME="$HOME" \
-        -e TERM="${TERM:-xterm-256color}" \
-        -v "$HOME:$HOME" \
-        -v "$PWD:$PWD" \
-        -v /tmp:/tmp \
-        -v arch-usr:/usr \
-        -v arch-bin:/bin \
-        -v arch-lib:/lib \
-        -v arch-lib64:/lib64 \
-        -v arch-etc:/etc \
-        -v arch-var:/var \
-        -v arch-opt:/opt \
-        archlinux-local "${cmd[@]}"
-}
-
-# add Pulumi to the PATH
-export PATH=$PATH:/home/shihaam/.pulumi/bin
diff --git a/home/bash.nix b/home/bash.nix
new file mode 100644
index 0000000..b9bd867
--- /dev/null
+++ b/home/bash.nix
@@ -0,0 +1,142 @@
+{ config, pkgs, ... }:
+
+let
+  bash-seafly-prompt = pkgs.fetchFromGitHub {
+    owner = "bluz71";
+    repo = "bash-seafly-prompt";
+    rev = "4970ba54e5e9d932d94f5e6be32ecf277a68f596";
+    hash = "sha256-3q0s1eg6iEdZ0GyQuYpzWIUqggcZ9Kr/UL9pHr+PqN8=";
+  };
+in
+{
+  home.packages = [ pkgs.blesh ];
+  programs.direnv = {
+    enable = true;
+    enableBashIntegration = true;
+    nix-direnv.enable = true;
+  };
+
+  programs.bash = {
+    enable = true;
+
+    historySize = 999999;
+    historyFileSize = 999962;
+    historyControl = [ "ignoredups" "ignorespace" "erasedups" ];
+    shellOptions = [
+      "histappend"
+      "checkwinsize"
+      "extglob"
+      "globstar"
+      "checkjobs"
+      "cdspell"
+    ];
+
+    shellAliases = {
+      drag = "ripdrag";
+
+      #Adding output colors
+      ls = "ls --color=always";
+      grep = "grep --color=auto";
+      less = "less -R";
+      ping = "ping -O";
+
+      # fix typos
+      ckear = "clear";
+      sl = "ls";
+      ks = "ls";
+      dc = "cd";
+
+      sudo = "doas";
+
+      claude = "docker run --rm -it"
+        + " -v ${config.home.homeDirectory}/.claude:/root/.claude"
+        + " -v ${config.home.homeDirectory}/.claude.json:/root/.claude.json"
+        + " -v $PWD:$PWD -w $PWD git.shihaam.dev/dockerfiles/ccc";
+    };
+
+    initExtra = ''
+      # ---- ble.sh --------------------------------------------------------
+      source "$(blesh-share)/ble.sh"
+      # ---- prompt --------------------------------------------------------
+      source ${bash-seafly-prompt}/command_prompt.bash
+      # needed for gpg-sign
+      export GPG_TTY=$(tty)
+
+      # ---- always reopen the last directory ------------------------------
+      cd() { builtin cd "$@" && pwd > ~/.cache/whereami; }
+      cdl() {
+        local d
+        d=$(cat ~/.cache/whereami 2>/dev/null)
+        [ -d "$d" ] && cd "$d"
+      }
+      cdl
+
+      # ---- wrappers ------------------------------------------------------
+      ip() {
+        if [[ $1 == "info" ]]; then
+          curl -s https://ipinfo.io/$2 | jq
+        else
+          command ip "$@"
+        fi
+      }
+
+      # ---- helpers -------------------------------------------------------
+      math() { echo $1 | bc; }
+      extract() {
+        if [ -f "$1" ] ; then
+          local folder_name=$(basename "$1" | sed -e 's/\..*$//')
+          mkdir -p "$folder_name"
+          case "$1" in
+            *.tar.bz2)   tar xvjf "$1" -C "$folder_name" ;;
+            *.tar.gz)    tar xvzf "$1" -C "$folder_name" ;;
+            *.bz2)       bunzip2 -k "$1" && mv "''${1%.*}" "$folder_name" ;;
+            *.rar)       unrar x "$1" "$folder_name" ;;
+            *.gz)        gunzip -k "$1" && mv "''${1%.*}" "$folder_name" ;;
+            *.tar)       tar xvf "$1" -C "$folder_name" ;;
+            *.tbz2)      tar xvjf "$1" -C "$folder_name" ;;
+            *.tgz)       tar xvzf "$1" -C "$folder_name" ;;
+            *.zip)       unzip "$1" -d "$folder_name" ;;
+            *.Z)         uncompress "$1" && mv "''${1%.*}" "$folder_name" ;;
+            *.7z)        7z x "$1" -o"$folder_name" ;;
+            *.xz)        xz --decompress --keep "$1" && mv "''${1%.*}" "$folder_name" ;;
+            *)           echo "'$1' cannot be extracted via extract()" ;;
+          esac
+        else
+          echo "'$1' is not a valid file"
+        fi
+      }
+
+      # ---- throwaway arch container --------------------------------------
+      arch() {
+        local user_flag=""
+        if [[ "$1" == "root" ]]; then
+          user_flag="-u root"
+          shift
+        fi
+
+        local cmd=("bash")
+        [[ $# -gt 0 ]] && cmd=("$@")
+
+        podman run --rm -it \
+          --name "archlinux-$$" \
+          --network host \
+          --workdir "$PWD" \
+          $user_flag \
+          -e USER="$USER" \
+          -e HOME="$HOME" \
+          -e TERM="''${TERM:-xterm-256color}" \
+          -v "$HOME:$HOME" \
+          -v "$PWD:$PWD" \
+          -v /tmp:/tmp \
+          -v arch-usr:/usr \
+          -v arch-bin:/bin \
+          -v arch-lib:/lib \
+          -v arch-lib64:/lib64 \
+          -v arch-etc:/etc \
+          -v arch-var:/var \
+          -v arch-opt:/opt \
+          archlinux-local "''${cmd[@]}"
+      }
+    '';
+  };
+}
diff --git a/home/packages.nix b/home/packages.nix
new file mode 100644
index 0000000..2540aef
--- /dev/null
+++ b/home/packages.nix
@@ -0,0 +1,25 @@
+# User-level packages: things installed for user rather than system-wide.
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    ripdrag
+    fastfetch
+    p7zip
+    unrar # unfree
+    httptoolkit
+    libreoffice
+    anydesk
+    ffmpeg
+    jre
+    feh
+    mpv
+    _64gram
+    glab
+    vlc
+    obs-studio
+    brave
+    firefox
+    wireshark
+  ];
+}
diff --git a/home/private.nix.example b/home/private.nix.example
new file mode 100644
index 0000000..f623554
--- /dev/null
+++ b/home/private.nix.example
@@ -0,0 +1,11 @@
+# Template. Copy to private.nix and fill in; private.nix is gitignored.
+#
+#   cp home/private.nix.example home/private.nix
+#
+{ config, ... }:
+
+{
+  home.sessionVariables = {
+    # HELLO=WORLD 
+  };
+}
diff --git a/home/shihaam.nix b/home/shihaam.nix
new file mode 100644
index 0000000..c04ff58
--- /dev/null
+++ b/home/shihaam.nix
@@ -0,0 +1,36 @@
+# Imported from /etc/nixos/configuration.nix
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./bash.nix
+    ./packages.nix
+  ] ++ (
+    # import non public vars
+    if builtins.pathExists ./private.nix
+    then [ ./private.nix ]
+    else lib.warn "home/private.nix not found -- private session variables will be unset" [ ]
+  );
+
+  home.username = "shihaam";
+  home.homeDirectory = "/home/shihaam";
+  home.stateVersion = "26.05";
+
+  #############################################################################
+  # Environment
+  #############################################################################
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    COMPOSE_DOCKER_CLI_BUILD = "1";
+    DOCKER_BUILDKIT = "1";
+    # ibus input method (Dhivehi). Set at session level, not in bashrc, so
+    GTK_IM_MODULE = "ibus";
+    QT_IM_MODULE = "ibus";
+    XMODIFIERS = "@im=ibus";
+    BITWARDENCLI_APPDATA_DIR = "${config.xdg.configHome}/bitwarden-cli";
+  };
+
+  home.sessionPath = [
+  ];
+}