Merge branch 'massive-refactoring'

65 files changed, 696 insertions, 435 deletions

diff --git a/modules/communication/neomutt/account/assertions.nix b/modules/communication/neomutt/account/assertions.nix
index c19ab72..5c30311 100644
--- a/modules/communication/neomutt/account/assertions.nix
+++ b/modules/communication/neomutt/account/assertions.nix
@@ -5,12 +5,12 @@
     {
       assertion =
         !config.communication.neomutt.enable
-        || !lib.any (account: account.enable && account.passwordGopassSecret != null) (
+        || !lib.any (account: account.enable && account.password-gopass-secret != null) (
           lib.attrValues config.communication.neomutt.accounts
         )
         || config.security.gopass.enable;
       message = ''
-        An enabled communication.neomutt account uses passwordGopassSecret but security.gopass.enable is not set.
+        An enabled communication.neomutt account uses password-gopass-secret but security.gopass.enable is not set.
         Enable security.gopass to provide the account password command.
       '';
     }
diff --git a/modules/communication/neomutt/account/default.nix b/modules/communication/neomutt/account/default.nix
index e2d92eb..61256e1 100644
--- a/modules/communication/neomutt/account/default.nix
+++ b/modules/communication/neomutt/account/default.nix
@@ -21,17 +21,19 @@
 
   config = lib.mkIf config.communication.neomutt.enable {
     accounts.email.accounts = lib.mapAttrs (accountName: accountInformation: {
-      inherit (accountInformation) realName address primary;
+      inherit (accountInformation) address primary;
+
+      realName = accountInformation.real-name;
 
       userName =
-        if accountInformation.userName != null then
-          accountInformation.userName
+        if accountInformation.username != null then
+          accountInformation.username
         else
           accountInformation.address;
 
       passwordCommand =
-        if accountInformation.passwordGopassSecret != null then
-          "${lib.getExe config.security.gopass.package} -o ${accountInformation.passwordGopassSecret}"
+        if accountInformation.password-gopass-secret != null then
+          "${lib.getExe config.security.gopass.package} -o ${accountInformation.password-gopass-secret}"
         else
           null;
 
@@ -50,7 +52,7 @@
 
       neomutt = {
         enable = true;
-        mailboxType = accountInformation.neomutt.mailboxType;
+        mailboxType = accountInformation.neomutt.mailbox-type;
         extraConfig = accountInformation.neomutt.extraConfig;
       };
 
@@ -71,7 +73,7 @@
         enable = true;
         neomutt = {
           enable = true;
-          virtualMailboxes = accountInformation.notmuch.neomutt.virtualMailboxes;
+          virtualMailboxes = accountInformation.notmuch.neomutt.virtual-mailboxes;
         };
       };
 
@@ -80,7 +82,7 @@
         port = accountInformation.imap.port;
         tls = {
           enable = accountInformation.imap.tls.enable;
-          useStartTls = accountInformation.imap.tls.useStartTls;
+          useStartTls = accountInformation.imap.tls.use-start-tls;
         };
       };
 
@@ -89,14 +91,14 @@
         port = accountInformation.smtp.port;
         tls = {
           enable = accountInformation.smtp.tls.enable;
-          useStartTls = accountInformation.smtp.tls.useStartTls;
+          useStartTls = accountInformation.smtp.tls.use-start-tls;
         };
       };
 
       gpg = lib.optionalAttrs (accountInformation.gpg.key != null) {
         key = accountInformation.gpg.key;
-        signByDefault = accountInformation.gpg.signByDefault;
-        encryptByDefault = accountInformation.gpg.encryptByDefault;
+        signByDefault = accountInformation.gpg.sign-by-default;
+        encryptByDefault = accountInformation.gpg.encrypt-by-default;
       };
 
       signature =
@@ -105,7 +107,7 @@
           {
             text = accountInformation.signature.text;
             command = accountInformation.signature.command;
-            showSignature = accountInformation.signature.showSignature;
+            showSignature = accountInformation.signature.show-signature;
           };
     }) (lib.filterAttrs (n: a: a.enable) config.communication.neomutt.accounts);
   };
diff --git a/modules/communication/neomutt/account/flavors/gmail/default.nix b/modules/communication/neomutt/account/flavors/gmail/default.nix
index 66d7db3..5b3c098 100644
--- a/modules/communication/neomutt/account/flavors/gmail/default.nix
+++ b/modules/communication/neomutt/account/flavors/gmail/default.nix
@@ -32,7 +32,7 @@
 
     neomutt.extraConfig = lib.mkBefore (builtins.readFile ./.muttrc);
 
-    notmuch.neomutt.virtualMailboxes = lib.mkDefault [
+    notmuch.neomutt.virtual-mailboxes = lib.mkDefault [
       {
         name = "All Mail";
         query = "folder:${name}/Inbox or folder:\"${name}/[Gmail]/Sent Mail\"";
diff --git a/modules/communication/neomutt/account/options.nix b/modules/communication/neomutt/account/options.nix
index 45e6744..676f8b0 100644
--- a/modules/communication/neomutt/account/options.nix
+++ b/modules/communication/neomutt/account/options.nix
@@ -6,7 +6,7 @@
       default = true;
     };
 
-    realName = lib.mkOption {
+    real-name = lib.mkOption {
       type = lib.types.str;
       description = "Name displayed when sending mails.";
     };
@@ -16,13 +16,13 @@
       description = "Email address of this account.";
     };
 
-    userName = lib.mkOption {
+    username = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
       description = "Server username. Defaults to address if null.";
     };
 
-    passwordGopassSecret = lib.mkOption {
+    password-gopass-secret = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
       description = "Gopass secret path (e.g. mail/user@gmail.com). Constructs passwordCommand automatically.";
@@ -81,7 +81,7 @@
     };
 
     neomutt = {
-      mailboxType = lib.mkOption {
+      mailbox-type = lib.mkOption {
         type = lib.types.enum [
           "maildir"
           "imap"
@@ -178,7 +178,7 @@
 
     notmuch = {
       neomutt = {
-        virtualMailboxes = lib.mkOption {
+        virtual-mailboxes = lib.mkOption {
           type = lib.types.listOf (
             lib.types.submodule {
               options = {
@@ -237,7 +237,7 @@
           description = "Enable TLS.";
         };
 
-        useStartTls = lib.mkOption {
+        use-start-tls = lib.mkOption {
           type = lib.types.bool;
           default = false;
           description = "Use STARTTLS.";
@@ -265,7 +265,7 @@
           description = "Enable TLS.";
         };
 
-        useStartTls = lib.mkOption {
+        use-start-tls = lib.mkOption {
           type = lib.types.bool;
           default = false;
           description = "Use STARTTLS.";
@@ -280,13 +280,13 @@
         description = "GPG key to use.";
       };
 
-      signByDefault = lib.mkOption {
+      sign-by-default = lib.mkOption {
         type = lib.types.bool;
         default = false;
         description = "Sign messages by default.";
       };
 
-      encryptByDefault = lib.mkOption {
+      encrypt-by-default = lib.mkOption {
         type = lib.types.bool;
         default = false;
         description = "Encrypt messages by default.";
@@ -306,7 +306,7 @@
         description = "Command that generates a signature.";
       };
 
-      showSignature = lib.mkOption {
+      show-signature = lib.mkOption {
         type = lib.types.nullOr (
           lib.types.enum [
             "append"
diff --git a/modules/communication/neomutt/default.nix b/modules/communication/neomutt/default.nix
index 018555f..e091a7d 100644
--- a/modules/communication/neomutt/default.nix
+++ b/modules/communication/neomutt/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.communication.neomutt;
+
   neomuttSyncScript = pkgs.writeShellApplication {
     name = "neomutt-sync";
     runtimeInputs = [
@@ -61,13 +63,15 @@ in
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.communication.neomutt.enable {
+    (lib.mkIf cfg.enable {
       accounts.email.maildirBasePath = "${config.home.homeDirectory}/.local/share/mail";
       home.sessionVariables.MAILDIR = config.accounts.email.maildirBasePath;
 
       xdg.configFile."neomutt/mailcap".text =
         builtins.replaceStrings [ "@@HTML_VIEWER@@" ] [ (lib.getExe config.web.chawan.package) ]
           (builtins.readFile ./mailcap);
+      home.file.".local/share/icons/hicolor/scalable/apps/neomutt.svg".source =
+        config.lib.file.mkOutOfStoreSymlink "${config.programs.neomutt.package}/share/neomutt/logo/neomutt.svg";
       programs.neomutt = {
         enable = true;
         package = pkgs.symlinkJoin {
@@ -93,11 +97,11 @@ in
         );
       };
     })
-    (lib.mkIf (config.communication.neomutt.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."neomutt" = {
         name = "NeoMutt";
         exec = "${lib.getExe config.terminal.kitty.package} --class neomutt -e ${lib.getExe config.programs.neomutt.package}";
-        icon = "${config.programs.neomutt.package}/share/neomutt/logo/neomutt.svg";
+        icon = "neomutt";
         categories = [
           "Network"
           "Email"
diff --git a/modules/communication/senpai/assertions.nix b/modules/communication/senpai/assertions.nix
index ed2cce8..8e74367 100644
--- a/modules/communication/senpai/assertions.nix
+++ b/modules/communication/senpai/assertions.nix
@@ -13,8 +13,9 @@
     }
     {
       assertion =
-        config.communication.senpai.identity.passwordGopassSecret == null || config.security.gopass.enable;
-      message = "communication.senpai.identity.passwordGopassSecret requires security.gopass.enable.";
+        config.communication.senpai.identity.password-gopass-secret == null
+        || config.security.gopass.enable;
+      message = "communication.senpai.identity.password-gopass-secret requires security.gopass.enable.";
     }
   ];
 }
diff --git a/modules/communication/senpai/default.nix b/modules/communication/senpai/default.nix
index 56bb7ab..49f82d9 100644
--- a/modules/communication/senpai/default.nix
+++ b/modules/communication/senpai/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.communication.senpai;
+in
 {
   imports = [ ./assertions.nix ];
 
@@ -17,48 +20,60 @@
       description = "The senpai package to use.";
     };
 
-    server = {
-      address = lib.mkOption {
-        type = lib.types.str;
-        description = "IRC server address (host[:port]). Supports irc://, ircs://, irc+insecure:// URLs.";
+    server = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          address = lib.mkOption {
+            type = lib.types.str;
+            description = "IRC server address (host[:port]). Supports irc://, ircs://, irc+insecure:// URLs.";
+          };
+        };
       };
+      default = { };
+      description = "IRC server configuration.";
     };
 
-    identity = {
-      nickname = lib.mkOption {
-        type = lib.types.str;
-        description = "Your IRC nickname (no spaces or colons).";
-      };
+    identity = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          nickname = lib.mkOption {
+            type = lib.types.str;
+            description = "Your IRC nickname (no spaces or colons).";
+          };
 
-      passwordGopassSecret = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "Gopass secret path for SASL password (e.g. irc/user@server). Constructs password-cmd automatically.";
+          password-gopass-secret = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Gopass secret path for SASL password (e.g. irc/user@server). Constructs password-cmd automatically.";
+          };
+        };
       };
+      default = { };
+      description = "Identity configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.communication.senpai.enable {
+    (lib.mkIf cfg.enable {
       programs.senpai = {
         enable = true;
-        package = config.communication.senpai.package;
+        package = cfg.package;
         config = {
-          address = config.communication.senpai.server.address;
-          nickname = config.communication.senpai.identity.nickname;
-          password-cmd = lib.mkIf (config.communication.senpai.identity.passwordGopassSecret != null) [
+          address = cfg.server.address;
+          nickname = cfg.identity.nickname;
+          password-cmd = lib.mkIf (cfg.identity.password-gopass-secret != null) [
             (lib.getExe config.security.gopass.package)
             "show"
             "-o"
-            config.communication.senpai.identity.passwordGopassSecret
+            cfg.identity.password-gopass-secret
           ];
         };
       };
     })
-    (lib.mkIf (config.communication.senpai.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."senpai" = {
         name = "Senpai";
-        exec = "${lib.getExe config.terminal.kitty.package} --class senpai -e ${lib.getExe config.communication.senpai.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class senpai -e ${lib.getExe cfg.package}";
         icon = "senpai";
         categories = [
           "Network"
diff --git a/modules/desktop/eww/default.nix b/modules/desktop/eww/default.nix
index be6236f..a0727cd 100644
--- a/modules/desktop/eww/default.nix
+++ b/modules/desktop/eww/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.desktop.eww;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -46,10 +47,10 @@ in
               [
                 config.fonts.normal
                 (toString config.fonts.size)
-                (toString config.fonts.iconSize)
-                (toString config.fonts.labelSize)
-                (toString config.fonts.smallSize)
-                (toString config.fonts.idxSize)
+                (toString config.fonts.icon-size)
+                (toString config.fonts.label-size)
+                (toString config.fonts.small-size)
+                (toString config.fonts.idx-size)
               ]
               (builtins.readFile ./eww.scss);
         in
@@ -67,9 +68,9 @@ in
       Service = {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = "${lib.getExe config.desktop.eww.package} open bar";
-        ExecReload = "${lib.getExe config.desktop.eww.package} reload && ${lib.getExe config.desktop.eww.package} open bar";
-        ExecStop = "${lib.getExe config.desktop.eww.package} kill";
+        ExecStart = "${lib.getExe cfg.package} open bar";
+        ExecReload = "${lib.getExe cfg.package} reload && ${lib.getExe cfg.package} open bar";
+        ExecStop = "${lib.getExe cfg.package} kill";
         Restart = "on-failure";
       };
       Install.WantedBy = [ "graphical-session.target" ];
diff --git a/modules/desktop/mako/default.nix b/modules/desktop/mako/default.nix
index 2123b57..a918d02 100644
--- a/modules/desktop/mako/default.nix
+++ b/modules/desktop/mako/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.desktop.mako;
+in
 {
   imports = [ ./colors.nix ];
 
@@ -18,7 +21,7 @@
     };
   };
 
-  config = lib.mkIf config.desktop.mako.enable {
+  config = lib.mkIf cfg.enable {
     services.mako = {
       enable = true;
       settings = {
diff --git a/modules/desktop/niri/default.nix b/modules/desktop/niri/default.nix
index a5de8d8..b17ea12 100644
--- a/modules/desktop/niri/default.nix
+++ b/modules/desktop/niri/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.desktop;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -15,19 +16,43 @@ in
   ];
 
   options.desktop = {
-    niri.package = lib.mkOption {
-      type = lib.types.package;
-      readOnly = true;
-      default = config.wayland.windowManager.niri.package;
-      description = "The niri package to use.";
+    niri = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          package = lib.mkOption {
+            type = lib.types.package;
+            readOnly = true;
+            default = config.wayland.windowManager.niri.package;
+            description = "The niri package to use.";
+          };
+        };
+      };
+      default = { };
+      description = "Niri window manager configuration.";
     };
     hardware.gpu = {
-      nvidia.enable = lib.mkEnableOption "Nvidia GPU Wayland optimizations";
-      amd.enable = lib.mkEnableOption "AMD GPU Wayland optimizations";
+      nvidia = lib.mkOption {
+        type = lib.types.submodule {
+          options = {
+            enable = lib.mkEnableOption "Nvidia GPU Wayland optimizations";
+          };
+        };
+        default = { };
+        description = "NVIDIA GPU configuration.";
+      };
+      amd = lib.mkOption {
+        type = lib.types.submodule {
+          options = {
+            enable = lib.mkEnableOption "AMD GPU Wayland optimizations";
+          };
+        };
+        default = { };
+        description = "AMD GPU configuration.";
+      };
     };
   };
 
-  config = lib.mkIf config.desktop.enable {
+  config = lib.mkIf cfg.enable {
     home.sessionVariables = lib.mkMerge [
       {
         NIXOS_OZONE_WL = "1";
@@ -38,7 +63,7 @@ in
         QT_SCALE_FACTOR = "1";
       }
 
-      (lib.mkIf config.desktop.hardware.gpu.nvidia.enable {
+      (lib.mkIf cfg.hardware.gpu.nvidia.enable {
         LIBVA_DRIVER_NAME = "nvidia";
         __GLX_VENDOR_LIBRARY_NAME = "nvidia";
         GBM_BACKEND = "nvidia-drm";
@@ -46,7 +71,7 @@ in
         __GL_VRR_ALLOWED = "0";
       })
 
-      (lib.mkIf config.desktop.hardware.gpu.amd.enable {
+      (lib.mkIf cfg.hardware.gpu.amd.enable {
         AMD_VULKAN_ICD = "RADV";
         MESA_VK_DEVICE_SELECT = "1002:";
       })
diff --git a/modules/desktop/rofi/default.nix b/modules/desktop/rofi/default.nix
index a15ce0a..ed1cf05 100644
--- a/modules/desktop/rofi/default.nix
+++ b/modules/desktop/rofi/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.desktop.rofi;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -31,7 +32,7 @@ in
               ]
               [
                 ''"${config.fonts.normal} Bold ${toString config.fonts.size}"''
-                ''"${config.fonts.normal} Bold ${toString config.fonts.idxSize}"''
+                ''"${config.fonts.normal} Bold ${toString config.fonts.idx-size}"''
               ]
               (builtins.readFile ./theme.rasi);
         in
diff --git a/modules/desktop/swayidle/default.nix b/modules/desktop/swayidle/default.nix
index e1acaa0..e2877b6 100644
--- a/modules/desktop/swayidle/default.nix
+++ b/modules/desktop/swayidle/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.desktop.swayidle;
+in
 {
   options.desktop.swayidle = {
     enable = lib.mkEnableOption "Enables swayidle.";
@@ -16,10 +19,10 @@
     };
   };
 
-  config = lib.mkIf config.desktop.swayidle.enable {
+  config = lib.mkIf cfg.enable {
     services.swayidle = {
       enable = true;
-      package = config.desktop.swayidle.package;
+      package = cfg.package;
       systemdTargets = [ "graphical-session.target" ];
       timeouts = [
         {
diff --git a/modules/desktop/wl-clipboard/default.nix b/modules/desktop/wl-clipboard/default.nix
index 956a792..678e241 100644
--- a/modules/desktop/wl-clipboard/default.nix
+++ b/modules/desktop/wl-clipboard/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.desktop.wl-clipboard;
+in
 {
   options.desktop.wl-clipboard = {
     package = lib.mkOption {
@@ -16,6 +19,6 @@
   };
 
   config = lib.mkIf config.desktop.enable {
-    home.packages = [ config.desktop.wl-clipboard.package ];
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/desktop/xdg/default.nix b/modules/desktop/xdg/default.nix
index 7f46d37..72b0290 100644
--- a/modules/desktop/xdg/default.nix
+++ b/modules/desktop/xdg/default.nix
@@ -6,10 +6,11 @@
   ...
 }:
 let
+  cfg = config.desktop;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
-  config = lib.mkIf config.desktop.enable {
+  config = lib.mkIf cfg.enable {
     dconf.enable = true;
 
     xdg.portal = {
@@ -37,7 +38,7 @@ in
         enable = true;
         font = {
           name = config.fonts.normal;
-          size = config.fonts.uiSize;
+          size = config.fonts.ui-size;
         };
         theme = {
           name = "Adwaita-dark";
diff --git a/modules/development/bruno/default.nix b/modules/development/bruno/default.nix
index 7c7afa2..fc08f3c 100644
--- a/modules/development/bruno/default.nix
+++ b/modules/development/bruno/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.development.bruno;
+in
 {
   options.development.bruno = {
     enable = lib.mkEnableOption "Enables bruno.";
@@ -16,8 +19,8 @@
     };
   };
 
-  config = lib.mkIf config.development.bruno.enable {
-    home.packages = [ config.development.bruno.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
 
     xdg.mimeApps.defaultApplications = {
       "x-scheme-handler/bruno" = "bruno.desktop";
diff --git a/modules/development/delta/default.nix b/modules/development/delta/default.nix
index e3daeb3..b4922fe 100644
--- a/modules/development/delta/default.nix
+++ b/modules/development/delta/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.development.delta;
+in
 {
   options.development.delta = {
     enable = lib.mkEnableOption "Enables delta.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.development.delta.enable {
+  config = lib.mkIf cfg.enable {
     programs.delta = {
       enable = true;
       options = {
diff --git a/modules/development/direnv/default.nix b/modules/development/direnv/default.nix
index b16258a..db65145 100644
--- a/modules/development/direnv/default.nix
+++ b/modules/development/direnv/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.development.direnv;
+in
 {
   options.development.direnv = {
     enable = lib.mkEnableOption "Enables direnv.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.development.direnv.enable {
+  config = lib.mkIf cfg.enable {
     programs.direnv = {
       enable = true;
       enableZshIntegration = lib.mkIf config.terminal.zsh.enable true;
diff --git a/modules/development/git/assertions.nix b/modules/development/git/assertions.nix
index c66714a..2baeced 100644
--- a/modules/development/git/assertions.nix
+++ b/modules/development/git/assertions.nix
@@ -3,24 +3,24 @@
 {
   assertions = [
     {
-      assertion = !config.development.git.signing.signByDefault || config.development.git.enable;
+      assertion = !config.development.git.signing.sign-by-default || config.development.git.enable;
       message = ''
-        development.git.signing.signByDefault is enabled but development.git.enable is not.
+        development.git.signing.sign-by-default is enabled but development.git.enable is not.
         Enable development.git before enabling commit signing.
       '';
     }
     {
       assertion =
-        !config.development.git.signing.signByDefault || config.development.git.signing.key != null;
+        !config.development.git.signing.sign-by-default || config.development.git.signing.key != null;
       message = ''
-        development.git.signing.signByDefault is enabled but development.git.signing.key is not set.
+        development.git.signing.sign-by-default is enabled but development.git.signing.key is not set.
         Set a GPG key ID before enabling commit signing by default.
       '';
     }
     {
-      assertion = !config.development.git.signing.signByDefault || config.security.gpg.enable;
+      assertion = !config.development.git.signing.sign-by-default || config.security.gpg.enable;
       message = ''
-        development.git.signing.signByDefault is enabled but security.gpg.enable is not.
+        development.git.signing.sign-by-default is enabled but security.gpg.enable is not.
         Commit signing requires the managed GPG configuration. Please enable security.gpg.
       '';
     }
diff --git a/modules/development/git/default.nix b/modules/development/git/default.nix
index 15dcc80..f2a0d64 100644
--- a/modules/development/git/default.nix
+++ b/modules/development/git/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.development.git;
+in
 {
   imports = [
     ./assertions.nix
@@ -30,29 +34,35 @@
       description = "Git email.";
     };
 
-    signing = {
-      key = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "GPG key ID used for signing commits.";
-      };
+    signing = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          key = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "GPG key ID used for signing commits.";
+          };
 
-      signByDefault = lib.mkEnableOption "Sign commits by default.";
+          sign-by-default = lib.mkEnableOption "Sign commits by default.";
+        };
+      };
+      default = { };
+      description = "Git commit signing configuration.";
     };
   };
 
-  config = lib.mkIf config.development.git.enable {
+  config = lib.mkIf cfg.enable {
     programs.git = {
       enable = true;
       signing = {
-        key = config.development.git.signing.key;
-        signByDefault = config.development.git.signing.signByDefault;
+        key = cfg.signing.key;
+        signByDefault = cfg.signing.sign-by-default;
       };
       settings = lib.mkMerge [
         {
           user = {
-            name = config.development.git.username;
-            email = config.development.git.email;
+            name = cfg.username;
+            email = cfg.email;
           };
           core = {
             askPass = "";
diff --git a/modules/development/lazygit/default.nix b/modules/development/lazygit/default.nix
index c2e6be8..95d2bf1 100644
--- a/modules/development/lazygit/default.nix
+++ b/modules/development/lazygit/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.development.lazygit;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -22,7 +23,7 @@ in
     };
   };
   config = lib.mkMerge [
-    (lib.mkIf config.development.lazygit.enable {
+    (lib.mkIf cfg.enable {
       programs.lazygit = {
         enable = true;
         enableBashIntegration = false;
@@ -66,9 +67,9 @@ in
             commitHashLength = 4;
             showBranchCommitHash = true;
             showDivergenceFromBaseBranch = "arrowAndNumber";
-            autoFetch = false;
           };
           git = {
+            autoFetch = false;
             overrideGpg = config.security.gpg.enable;
             diffRenderers = lib.mkIf config.development.delta.enable [
               {
@@ -85,10 +86,10 @@ in
         source = ../../../assets/icons/apps/git.svg;
       };
     })
-    (lib.mkIf (config.development.lazygit.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."lazygit" = {
         name = "lazygit";
-        exec = "${lib.getExe config.terminal.kitty.package} --class lazygit -e ${lib.getExe config.development.lazygit.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class lazygit -e ${lib.getExe cfg.package}";
         icon = "git";
         categories = [ "Development" ];
         comment = "A simple terminal UI for git commands";
diff --git a/modules/development/nixvim/default.nix b/modules/development/nixvim/default.nix
index 00712cc..a294788 100644
--- a/modules/development/nixvim/default.nix
+++ b/modules/development/nixvim/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.development.nixvim;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -25,7 +26,7 @@ in
     };
   };
 
-  config = lib.mkIf config.development.nixvim.enable {
+  config = lib.mkIf cfg.enable {
     programs.nixvim = {
       enable = true;
       defaultEditor = true;
diff --git a/modules/development/opencode/default.nix b/modules/development/opencode/default.nix
index 011582e..8b61ff9 100644
--- a/modules/development/opencode/default.nix
+++ b/modules/development/opencode/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.development.opencode;
+in
 {
   options.development.opencode = {
     enable = lib.mkEnableOption "Enables opencode.";
@@ -17,7 +20,7 @@
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.development.opencode.enable {
+    (lib.mkIf cfg.enable {
       home.file.".local/share/icons/hicolor/scalable/apps/opencode.svg" = {
         source = ../../../assets/icons/apps/opencode.svg;
       };
@@ -27,10 +30,10 @@
         package = pkgs.opencode;
       };
     })
-    (lib.mkIf (config.development.opencode.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."opencode" = {
         name = "opencode";
-        exec = "${lib.getExe config.terminal.kitty.package} --class opencode -e ${lib.getExe config.development.opencode.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class opencode -e ${lib.getExe cfg.package}";
         icon = "opencode";
         categories = [ "Development" ];
         comment = "AI-powered coding assistant";
diff --git a/modules/development/qemu/default.nix b/modules/development/qemu/default.nix
index db5f7cf..4dea421 100644
--- a/modules/development/qemu/default.nix
+++ b/modules/development/qemu/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.development.qemu;
+in
 {
   options.development.qemu = {
     enable = lib.mkEnableOption "Enables qemu.";
@@ -23,7 +26,7 @@
     };
   };
 
-  config = lib.mkIf config.development.qemu.enable {
-    home.packages = [ config.development.qemu.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/development/ripgrep/default.nix b/modules/development/ripgrep/default.nix
index 16c70d0..b00f61a 100644
--- a/modules/development/ripgrep/default.nix
+++ b/modules/development/ripgrep/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.development.ripgrep;
+in
 {
   options.development.ripgrep = {
     enable = lib.mkEnableOption "Enables ripgrep.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.development.ripgrep.enable {
+  config = lib.mkIf cfg.enable {
     programs.ripgrep = {
       enable = true;
     };
diff --git a/modules/development/vscodium/default.nix b/modules/development/vscodium/default.nix
index b365768..b8de8ca 100644
--- a/modules/development/vscodium/default.nix
+++ b/modules/development/vscodium/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.development.vscodium;
+in
 {
   options.development.vscodium = {
     enable = lib.mkEnableOption "Enables vscodium.";
@@ -16,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.development.vscodium.enable {
+  config = lib.mkIf cfg.enable {
     programs.vscodium = {
       enable = true;
       package = pkgs.vscodium;
diff --git a/modules/file-management/eza/default.nix b/modules/file-management/eza/default.nix
index f22b435..b4f2b3a 100644
--- a/modules/file-management/eza/default.nix
+++ b/modules/file-management/eza/default.nix
@@ -1,5 +1,13 @@
 # Modern ls replacement with icons and colors
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.file-management.eza;
+in
 {
   options.file-management.eza = {
     enable = lib.mkEnableOption "Enables eza.";
@@ -12,7 +20,7 @@
     };
   };
 
-  config = lib.mkIf config.file-management.eza.enable {
+  config = lib.mkIf cfg.enable {
     programs.eza = {
       enable = true;
       icons = "always";
diff --git a/modules/file-management/ouch/default.nix b/modules/file-management/ouch/default.nix
index c8986fe..461e3cf 100644
--- a/modules/file-management/ouch/default.nix
+++ b/modules/file-management/ouch/default.nix
@@ -1,10 +1,13 @@
 # CLI tool for compressing and decompressing various formats
 {
-  pkgs,
-  lib,
   config,
+  lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.file-management.ouch;
+in
 {
   options.file-management.ouch = {
     enable = lib.mkEnableOption "Enables ouch.";
@@ -18,7 +21,7 @@
     };
   };
 
-  config = lib.mkIf config.file-management.ouch.enable {
-    home.packages = [ config.file-management.ouch.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/file-management/usb/default.nix b/modules/file-management/usb/default.nix
index 4b8deb9..4596266 100644
--- a/modules/file-management/usb/default.nix
+++ b/modules/file-management/usb/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.file-management.usb;
+in
 {
   options.file-management.usb = {
     enable = lib.mkEnableOption "Enables USB device mounting tools.";
@@ -22,7 +25,7 @@
     };
   };
 
-  config = lib.mkIf config.file-management.usb.enable {
-    home.packages = [ config.file-management.usb.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/file-management/yazi/default.nix b/modules/file-management/yazi/default.nix
index ba1c020..72a4568 100644
--- a/modules/file-management/yazi/default.nix
+++ b/modules/file-management/yazi/default.nix
@@ -6,11 +6,13 @@
   ...
 }:
 let
+  cfg = config.file-management.yazi;
+
   yaziFileChooserScript = pkgs.writeShellApplication {
     name = "yazi-file-chooser";
     runtimeInputs = [
       config.terminal.bash.package
-      config.file-management.yazi.package
+      cfg.package
       config.terminal.kitty.package
     ];
     text = builtins.readFile ./file-chooser.sh;
@@ -32,19 +34,25 @@ in
       description = "The yazi package to use. Defaults to the wrapped finalPackage from programs.yazi.";
     };
 
-    file-chooser = {
-      enable = lib.mkEnableOption "Enables the yazi-file-chooser script.";
-      package = lib.mkOption {
-        type = lib.types.package;
-        readOnly = true;
-        default = yaziFileChooserScript;
-        description = "The yazi-file-chooser script package.";
+    file-chooser = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enables the yazi-file-chooser script.";
+          package = lib.mkOption {
+            type = lib.types.package;
+            readOnly = true;
+            default = yaziFileChooserScript;
+            description = "The yazi-file-chooser script package.";
+          };
+        };
       };
+      default = { };
+      description = "File chooser integration configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.file-management.yazi.enable {
+    (lib.mkIf cfg.enable {
       programs.yazi = {
         enable = true;
         shellWrapperName = "yy";
@@ -57,17 +65,17 @@ in
       };
 
       home.file.".local/share/icons/hicolor/scalable/apps/yazi.png" = {
-        source = config.lib.file.mkOutOfStoreSymlink "${config.file-management.yazi.package}/share/pixmaps/yazi.png";
+        source = config.lib.file.mkOutOfStoreSymlink "${cfg.package}/share/pixmaps/yazi.png";
       };
 
       home.sessionVariables = {
         TERMCMD = lib.mkIf config.terminal.kitty.enable "${lib.getExe config.terminal.kitty.package} --class file-explorer --title 'Yazi'";
       };
     })
-    (lib.mkIf (config.file-management.yazi.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."yazi" = {
         name = "Yazi";
-        exec = "${lib.getExe config.terminal.kitty.package} --class yazi -e ${lib.getExe config.file-management.yazi.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class yazi -e ${lib.getExe cfg.package}";
         icon = "yazi";
         categories = [ "Utility" ];
         comment = "Terminal file manager";
@@ -84,9 +92,9 @@ in
         "application/x-rar-compressed" = "yazi.desktop";
       };
     })
-    (lib.mkIf config.file-management.yazi.file-chooser.enable {
+    (lib.mkIf cfg.file-chooser.enable {
       home.file.".config/xdg-desktop-portal-termfilechooser/config" = {
-        source = lib.getExe config.file-management.yazi.file-chooser.package;
+        source = lib.getExe cfg.file-chooser.package;
       };
     })
   ];
diff --git a/modules/fonts/default.nix b/modules/fonts/default.nix
index 2df7b88..b7d78df 100644
--- a/modules/fonts/default.nix
+++ b/modules/fonts/default.nix
@@ -1,7 +1,7 @@
 # Font configuration
 {
-  lib,
   config,
+  lib,
   pkgs,
   ...
 }:
@@ -30,31 +30,31 @@
       default = 18;
     };
 
-    uiSize = lib.mkOption {
+    ui-size = lib.mkOption {
       type = lib.types.int;
       description = "Default desktop UI (GTK) font size.";
       default = 11;
     };
 
-    iconSize = lib.mkOption {
+    icon-size = lib.mkOption {
       type = lib.types.int;
       description = "Font size for icons (base size + 6).";
       default = 24;
     };
 
-    labelSize = lib.mkOption {
+    label-size = lib.mkOption {
       type = lib.types.int;
       description = "Font size for labels (base size - 2).";
       default = 16;
     };
 
-    smallSize = lib.mkOption {
+    small-size = lib.mkOption {
       type = lib.types.int;
       description = "Font size for small text (base size - 6).";
       default = 12;
     };
 
-    idxSize = lib.mkOption {
+    idx-size = lib.mkOption {
       type = lib.types.int;
       description = "Font size for index numbers (base size - 4).";
       default = 14;
diff --git a/modules/gaming/heroic/default.nix b/modules/gaming/heroic/default.nix
index ccdebed..61eceb5 100644
--- a/modules/gaming/heroic/default.nix
+++ b/modules/gaming/heroic/default.nix
@@ -1,10 +1,13 @@
 # Epic, GOG and Amazon game launcher
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.gaming.heroic;
+in
 {
   options.gaming.heroic = {
     enable = lib.mkEnableOption "Enables Heroic Games Launcher.";
@@ -28,13 +31,16 @@
     };
   };
 
-  config = lib.mkIf config.gaming.heroic.enable {
-    home.packages = [ config.gaming.heroic.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
+
+    home.file.".local/share/icons/hicolor/scalable/apps/com.heroicgameslauncher.hgl.svg".source =
+      config.lib.file.mkOutOfStoreSymlink "${pkgs.heroic}/share/icons/hicolor/scalable/apps/com.heroicgameslauncher.hgl.svg";
 
     xdg.desktopEntries."heroic" = {
       name = "Heroic Games Launcher";
-      exec = "${lib.getExe' config.gaming.heroic.package "heroic"} %u";
-      icon = "${pkgs.heroic}/share/icons/hicolor/scalable/apps/com.heroicgameslauncher.hgl.svg";
+      exec = "${lib.getExe' cfg.package "heroic"} %u";
+      icon = "com.heroicgameslauncher.hgl";
       comment = "An Open Source Launcher for GOG, Epic Games and Amazon Games";
       categories = [ "Game" ];
       mimeType = [ "x-scheme-handler/heroic" ];
diff --git a/modules/gaming/steam/default.nix b/modules/gaming/steam/default.nix
index 5662656..a8f7fbc 100644
--- a/modules/gaming/steam/default.nix
+++ b/modules/gaming/steam/default.nix
@@ -1,10 +1,13 @@
 # Game store
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.gaming.steam;
+in
 {
   options.gaming.steam = {
     enable = lib.mkEnableOption "Enables steam.";
@@ -15,7 +18,7 @@
     };
   };
 
-  config = lib.mkIf config.gaming.steam.enable {
-    home.packages = [ config.gaming.steam.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/media/playerctl/default.nix b/modules/media/playerctl/default.nix
index bf71f06..efea754 100644
--- a/modules/media/playerctl/default.nix
+++ b/modules/media/playerctl/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.media.playerctl;
+in
 {
   options.media.playerctl = {
     enable = lib.mkEnableOption "Enables playerctl.";
@@ -16,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.media.playerctl.enable {
-    home.packages = [ config.media.playerctl.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/media/screen-recording/default.nix b/modules/media/screen-recording/default.nix
index d9ae89e..768ec22 100644
--- a/modules/media/screen-recording/default.nix
+++ b/modules/media/screen-recording/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.media.screen-recording;
+
   screenRecordingScript = pkgs.writeShellApplication {
     name = "screen-recording";
     runtimeInputs = [
@@ -48,7 +50,7 @@ in
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.media.screen-recording.enable {
+    (lib.mkIf cfg.enable {
       home.packages = [ scriptPkg ];
 
       assertions = import ./assertions.nix { inherit config lib; };
@@ -57,7 +59,7 @@ in
         source = ../../../assets/icons/apps/obs.svg;
       };
     })
-    (lib.mkIf (config.media.screen-recording.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries.screen-recording = {
         name = "Screen Recording";
         exec = "${lib.getExe config.terminal.kitty.package} --class screen-recording -e ${lib.getExe scriptPkg}";
diff --git a/modules/media/slurp/default.nix b/modules/media/slurp/default.nix
index d1d8e32..5996ab3 100644
--- a/modules/media/slurp/default.nix
+++ b/modules/media/slurp/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.media.slurp;
+in
 {
   options.media.slurp = {
     enable = lib.mkEnableOption "Enables slurp.";
@@ -16,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.media.slurp.enable {
-    home.packages = [ config.media.slurp.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/media/swayimg/default.nix b/modules/media/swayimg/default.nix
index 8531fd9..3d53b5f 100644
--- a/modules/media/swayimg/default.nix
+++ b/modules/media/swayimg/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.media.swayimg;
+in
 {
   options.media.swayimg = {
     enable = lib.mkEnableOption "Enables swayimg.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.media.swayimg.enable {
+  config = lib.mkIf cfg.enable {
     programs.swayimg = {
       enable = true;
       initLua = builtins.readFile ./init.lua;
diff --git a/modules/media/vlc/default.nix b/modules/media/vlc/default.nix
index 34d8fb8..c661f09 100644
--- a/modules/media/vlc/default.nix
+++ b/modules/media/vlc/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.media.vlc;
+in
 {
   options.media.vlc = {
     enable = lib.mkEnableOption "Enables vlc.";
@@ -16,8 +19,8 @@
     };
   };
 
-  config = lib.mkIf config.media.vlc.enable {
-    home.packages = [ config.media.vlc.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
 
     xdg.mimeApps.defaultApplications = {
       "x-scheme-handler/vlc" = "vlc.desktop";
diff --git a/modules/media/wf-recorder/default.nix b/modules/media/wf-recorder/default.nix
index 5c2cbd6..7d0d3bc 100644
--- a/modules/media/wf-recorder/default.nix
+++ b/modules/media/wf-recorder/default.nix
@@ -1,10 +1,13 @@
 # Screen recording utility for wlroots Wayland compositors
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.media.wf-recorder;
+in
 {
   options.media.wf-recorder = {
     enable = lib.mkEnableOption "Enables wf-recorder.";
@@ -16,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.media.wf-recorder.enable {
-    home.packages = [ config.media.wf-recorder.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/networking/bluetui/default.nix b/modules/networking/bluetui/default.nix
index 304ab4d..b715247 100644
--- a/modules/networking/bluetui/default.nix
+++ b/modules/networking/bluetui/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.networking.bluetui;
+in
 {
   imports = [
     ./assertions.nix
@@ -20,14 +23,14 @@
     };
   };
 
-  config = lib.mkIf config.networking.bluetui.enable {
+  config = lib.mkIf cfg.enable {
     home.file.".local/share/icons/hicolor/scalable/apps/bluetooth.svg" = {
       source = ../../../assets/icons/apps/bluetooth.svg;
     };
 
     xdg.desktopEntries."bluetui" = {
       name = "bluetui";
-      exec = "${lib.getExe config.terminal.kitty.package} -e ${lib.getExe config.networking.bluetui.package}";
+      exec = "${lib.getExe config.terminal.kitty.package} -e ${lib.getExe cfg.package}";
       icon = "bluetooth";
       categories = [ "Network" ];
       comment = "Bluetooth TUI client";
@@ -35,7 +38,7 @@
       type = "Application";
     };
     home.packages = [
-      config.networking.bluetui.package
+      cfg.package
     ];
   };
 }
diff --git a/modules/networking/impala/default.nix b/modules/networking/impala/default.nix
index aa62e08..f00ed58 100644
--- a/modules/networking/impala/default.nix
+++ b/modules/networking/impala/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.networking.impala;
+in
 {
   imports = [
     ./assertions.nix
@@ -20,14 +23,14 @@
     };
   };
 
-  config = lib.mkIf config.networking.impala.enable {
+  config = lib.mkIf cfg.enable {
     home.file.".local/share/icons/hicolor/scalable/apps/network-wireless.svg" = {
       source = ../../../assets/icons/apps/network-wireless.svg;
     };
 
     xdg.desktopEntries."impala" = {
       name = "impala";
-      exec = "${lib.getExe config.terminal.kitty.package} -e ${lib.getExe config.networking.impala.package}";
+      exec = "${lib.getExe config.terminal.kitty.package} -e ${lib.getExe cfg.package}";
       icon = "network-wireless";
       categories = [ "Network" ];
       comment = "TUI for managing wifi on Linux";
@@ -35,7 +38,7 @@
       type = "Application";
     };
     home.packages = [
-      config.networking.impala.package
+      cfg.package
     ];
 
     xdg.mimeApps.defaultApplications = {
diff --git a/modules/networking/usque/default.nix b/modules/networking/usque/default.nix
index 93ab7e5..aa3304c 100644
--- a/modules/networking/usque/default.nix
+++ b/modules/networking/usque/default.nix
@@ -1,15 +1,17 @@
 # Open-source reimplementation of the Cloudflare WARP client's MASQUE protocol
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
 let
+  cfg = config.networking.usque;
+
   usqueWarpScript = pkgs.writeShellApplication {
     name = "usque-warp";
     runtimeInputs = [
-      config.networking.usque.package
+      cfg.package
       config.terminal.bash.package
     ];
     text = builtins.readFile ./usque-warp.sh;
@@ -45,23 +47,29 @@ in
       description = "The usque package to use.";
     };
 
-    warp = {
-      enable = lib.mkEnableOption "Enables the usque-warp script.";
-      package = lib.mkOption {
-        type = lib.types.package;
-        readOnly = true;
-        default = usqueWarpScriptPkg;
-        description = "The usque-warp script package.";
+    warp = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enables the usque-warp script.";
+          package = lib.mkOption {
+            type = lib.types.package;
+            readOnly = true;
+            default = usqueWarpScriptPkg;
+            description = "The usque-warp script package.";
+          };
+        };
       };
+      default = { };
+      description = "WARP script configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.networking.usque.enable {
-      home.packages = [ config.networking.usque.package ];
+    (lib.mkIf cfg.enable {
+      home.packages = [ cfg.package ];
     })
-    (lib.mkIf config.networking.usque.warp.enable {
-      home.packages = [ config.networking.usque.warp.package ];
+    (lib.mkIf cfg.warp.enable {
+      home.packages = [ cfg.warp.package ];
     })
   ];
 }
diff --git a/modules/office/calcurse/default.nix b/modules/office/calcurse/default.nix
index 6e3e855..c4053da 100644
--- a/modules/office/calcurse/default.nix
+++ b/modules/office/calcurse/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.office.calcurse;
+
   calcurseSync = pkgs.writeShellScriptBin "calcurse-sync" (builtins.readFile ./calcurse-sync.sh);
 
   calcurse = pkgs.symlinkJoin {
@@ -16,13 +18,13 @@ let
       pkgs.libnotify
     ]
     ++ lib.optionals config.development.nixvim.enable [ config.development.nixvim.package ]
-    ++ lib.optionals config.office.calcurse.sync.enable [ calcurseSync ];
+    ++ lib.optionals cfg.sync.enable [ calcurseSync ];
     nativeBuildInputs = [ pkgs.makeWrapper ];
     postBuild = ''
       ${lib.optionalString config.development.nixvim.enable ''
         wrapProgram $out/bin/calcurse --set PAGER "nvim"
       ''}
-      ${lib.optionalString config.office.calcurse.sync.enable ''
+      ${lib.optionalString cfg.sync.enable ''
         wrapProgram $out/bin/calcurse-sync \
           --prefix PATH : ${
             lib.makeBinPath [
@@ -31,8 +33,8 @@ let
               pkgs.gnused
             ]
           } \
-          ${lib.optionalString (config.office.calcurse.sync.remote != null) ''
-            --set CALCURSE_SYNC_REMOTE ${lib.escapeShellArg config.office.calcurse.sync.remote}
+          ${lib.optionalString (cfg.sync.remote != null) ''
+            --set CALCURSE_SYNC_REMOTE ${lib.escapeShellArg cfg.sync.remote}
           ''}
       ''}
     '';
@@ -52,35 +54,47 @@ in
       default = calcurse;
       description = "The calcurse package to use.";
     };
-    sync = {
-      enable = lib.mkEnableOption "Enables git-backed syncing of the calcurse data directory (builds calcurse-sync, installs the sync hooks, and runs an initial 'calcurse-sync init' on activation).";
-      remote = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "Git remote URL for the calcurse data directory. Use an https:// URL if 'credential' is configured. When set, calcurse-sync uses it automatically on first init instead of prompting.";
-      };
-      credential = {
-        username = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "Username for HTTPS git authentication against the calcurse remote.";
-        };
-        passwordGopassPath = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "gopass entry path holding the password or token used for HTTPS git authentication against the calcurse remote. E.g. 'git/calcurse-sync'.";
+    sync = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enables git-backed syncing of the calcurse data directory (builds calcurse-sync, installs the sync hooks, and runs an initial 'calcurse-sync init' on activation).";
+          remote = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Git remote URL for the calcurse data directory. Use an https:// URL if 'credential' is configured. When set, calcurse-sync uses it automatically on first init instead of prompting.";
+          };
+          credential = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                username = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = "Username for HTTPS git authentication against the calcurse remote.";
+                };
+                password-gopass-secret = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = "gopass entry path holding the password or token used for HTTPS git authentication against the calcurse remote. E.g. 'git/calcurse-sync'.";
+                };
+              };
+            };
+            default = { };
+            description = "Credentials for HTTPS git authentication.";
+          };
         };
       };
+      default = { };
+      description = "Git-backed syncing configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.office.calcurse.enable {
+    (lib.mkIf cfg.enable {
       home.file.".local/share/icons/hicolor/scalable/apps/calcurse.svg" = {
         source = ../../../assets/icons/apps/calcurse.svg;
       };
 
-      home.packages = [ config.office.calcurse.package ];
+      home.packages = [ cfg.package ];
       xdg.configFile."calcurse/conf" = {
         text =
           builtins.replaceStrings [ "@@CALCURSE_ICON@@" ] [ "${../../../assets/icons/apps/calcurse.svg}" ]
@@ -92,10 +106,10 @@ in
         force = true;
       };
     })
-    (lib.mkIf (config.office.calcurse.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."calcurse" = {
         name = "calcurse";
-        exec = "${lib.getExe config.terminal.kitty.package} --class calcurse -e ${lib.getExe config.office.calcurse.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class calcurse -e ${lib.getExe cfg.package}";
         icon = "calcurse";
         categories = [
           "Office"
@@ -106,7 +120,7 @@ in
         type = "Application";
       };
     })
-    (lib.mkIf config.office.calcurse.sync.enable {
+    (lib.mkIf cfg.sync.enable {
       xdg.configFile."calcurse/hooks/pre-load" = {
         source = ./hooks/pre-load;
         executable = true;
@@ -129,14 +143,14 @@ in
             commit.gpgSign = false;
             tag.gpgSign = false;
           }
-          // lib.optionalAttrs (config.office.calcurse.sync.credential.passwordGopassPath != null) {
-            credential.helper = "!f() { echo username=${lib.escapeShellArg config.office.calcurse.sync.credential.username}; echo password=\"$(${lib.getExe config.security.gopass.package} show -o ${lib.escapeShellArg config.office.calcurse.sync.credential.passwordGopassPath})\"; }; f";
+          // lib.optionalAttrs (cfg.sync.credential.password-gopass-secret != null) {
+            credential.helper = "!f() { echo username=${lib.escapeShellArg cfg.sync.credential.username}; echo password=\"$(${lib.getExe config.security.gopass.package} show -o ${lib.escapeShellArg cfg.sync.credential.password-gopass-secret})\"; }; f";
           };
         }
       ];
 
       home.activation.calcurseSyncInit = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-        run ${config.office.calcurse.package}/bin/calcurse-sync init || true
+        run ${lib.getExe cfg.package} init || true
       '';
     })
   ];
diff --git a/modules/office/zathura/default.nix b/modules/office/zathura/default.nix
index db742ec..dd49c72 100644
--- a/modules/office/zathura/default.nix
+++ b/modules/office/zathura/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.office.zathura;
+in
 {
   options.office.zathura = {
     enable = lib.mkEnableOption "Enables zathura.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.office.zathura.enable {
+  config = lib.mkIf cfg.enable {
     programs.zathura = {
       enable = true;
     };
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index 616baeb..173318b 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.security.gopass;
+in
 {
   imports = [ ./assertions.nix ];
 
@@ -16,33 +19,51 @@
       default = config.programs.password-store.package;
       description = "The gopass package to use.";
     };
-    sync = {
-      enable = lib.mkEnableOption "Enables git-backed syncing of the gopass data directory.";
-      remote = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "Git remote URL for the gopass data directory. Use an https:// URL if 'credential' is configured.";
-      };
-      credential = {
-        username = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "Username for HTTPS git authentication against the gopass remote.";
-        };
-        passwordGopassPath = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "gopass entry path holding the password or token used.";
+    sync = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enables git-backed syncing of the gopass data directory.";
+          remote = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Git remote URL for the gopass data directory. Use an https:// URL if 'credential' is configured.";
+          };
+          credential = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                username = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = "Username for HTTPS git authentication against the gopass remote.";
+                };
+                password-gopass-secret = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = "gopass entry path holding the password or token used.";
+                };
+              };
+            };
+            default = { };
+            description = "Credentials for HTTPS git authentication.";
+          };
         };
       };
+      default = { };
+      description = "Git-backed syncing configuration.";
     };
-    creation-templates = {
-      enable = lib.mkEnableOption "Enables gopass entry creation templates. New entry creation templates for gopass new or gopass create commands.";
+    creation-templates = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enables gopass entry creation templates. New entry creation templates for gopass new or gopass create commands.";
+        };
+      };
+      default = { };
+      description = "Creation templates configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.security.gopass.enable {
+    (lib.mkIf cfg.enable {
       programs.password-store = {
         enable = true;
         package = pkgs.gopass.override { passAlias = true; };
@@ -68,15 +89,9 @@
               gpgSign = false;
             };
           }
-          //
-            lib.optionalAttrs
-              (
-                config.security.gopass.sync.enable
-                && config.security.gopass.sync.credential.passwordGopassPath != null
-              )
-              {
-                credential.helper = "!f() { echo username=${lib.escapeShellArg config.security.gopass.sync.credential.username}; echo password=\"$(${config.security.gopass.package}/bin/gopass show -o ${lib.escapeShellArg config.security.gopass.sync.credential.passwordGopassPath})\"; }; f";
-              };
+          // lib.optionalAttrs (cfg.sync.enable && cfg.sync.credential.password-gopass-secret != null) {
+            credential.helper = "!f() { echo username=${lib.escapeShellArg cfg.sync.credential.username}; echo password=\"$(${lib.getExe cfg.package} show -o ${lib.escapeShellArg cfg.sync.credential.password-gopass-secret})\"; }; f";
+          };
         }
       ];
 
@@ -88,20 +103,18 @@
         source = ../../../assets/icons/apps/gopass.svg;
       };
 
-      home.activation.copyCreationTemplatesForGopass =
-        lib.mkIf config.security.gopass.creation-templates.enable
-          (
-            lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-              $DRY_RUN_CMD mkdir -p $VERBOSE_ARG "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
-              $DRY_RUN_CMD rm -rf ${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create
-              $DRY_RUN_CMD cp -r $VERBOSE_ARG --no-preserve=mode ${./creation-templates} "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
-            ''
-          );
+      home.activation.copyCreationTemplatesForGopass = lib.mkIf cfg.creation-templates.enable (
+        lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+          $DRY_RUN_CMD mkdir -p $VERBOSE_ARG "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
+          $DRY_RUN_CMD rm -rf ${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create
+          $DRY_RUN_CMD cp -r $VERBOSE_ARG --no-preserve=mode ${./creation-templates} "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
+        ''
+      );
     })
-    (lib.mkIf (config.security.gopass.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."gopass" = {
         name = "gopass";
-        exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe cfg.package}";
         icon = "gopass";
         comment = "Standard Unix password manager (Go implementation)";
         categories = [ "Utility" ];
@@ -109,7 +122,7 @@
         type = "Application";
       };
     })
-    (lib.mkIf config.security.gopass.sync.enable {
+    (lib.mkIf cfg.sync.enable {
       home.activation.gopassSyncInit =
         let
           gopassSyncInit = pkgs.writeShellApplication {
@@ -121,7 +134,7 @@
             text =
               builtins.replaceStrings
                 [ "@@PASSWORD_STORE_DIR@@" "@@REMOTE_REPO_URL@@" ]
-                [ config.programs.password-store.settings.PASSWORD_STORE_DIR config.security.gopass.sync.remote ]
+                [ config.programs.password-store.settings.PASSWORD_STORE_DIR cfg.sync.remote ]
                 (builtins.readFile ./gopass-sync-init.sh);
           };
         in
diff --git a/modules/security/gpg-tui/default.nix b/modules/security/gpg-tui/default.nix
index bc4ac4f..2a5e61f 100644
--- a/modules/security/gpg-tui/default.nix
+++ b/modules/security/gpg-tui/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.security.gpg-tui;
+in
 {
   options.security.gpg-tui = {
     enable = lib.mkEnableOption "Enables gpg-tui.";
@@ -17,17 +20,17 @@
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.security.gpg-tui.enable {
+    (lib.mkIf cfg.enable {
       home.file.".local/share/icons/hicolor/scalable/apps/gpg.svg" = {
         source = ../../../assets/icons/apps/gpg.svg;
       };
 
-      home.packages = [ config.security.gpg-tui.package ];
+      home.packages = [ cfg.package ];
     })
-    (lib.mkIf (config.security.gpg-tui.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."gpg-tui" = {
         name = "gpg-tui";
-        exec = "${lib.getExe config.terminal.kitty.package} --class gpg-tui -e ${lib.getExe config.security.gpg-tui.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class gpg-tui -e ${lib.getExe cfg.package}";
         icon = "gpg";
         categories = [ "Security" ];
         comment = "Terminal UI for GnuPG";
diff --git a/modules/security/gpg/default.nix b/modules/security/gpg/default.nix
index 3047f59..8fa7348 100644
--- a/modules/security/gpg/default.nix
+++ b/modules/security/gpg/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.security.gpg;
+
   gpgBackupScript = pkgs.writeShellApplication {
     name = "gpg-backup";
     runtimeInputs = [
@@ -51,19 +53,25 @@ in
       description = "The gpg package to use.";
     };
 
-    backup = {
-      enable = lib.mkEnableOption "Enable the gpg-backup script";
-      package = lib.mkOption {
-        type = lib.types.package;
-        readOnly = true;
-        default = gpgBackupScriptPkg;
-        description = "The package for the gpg-backup script";
+    backup = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enable the gpg-backup script";
+          package = lib.mkOption {
+            type = lib.types.package;
+            readOnly = true;
+            default = gpgBackupScriptPkg;
+            description = "The package for the gpg-backup script";
+          };
+        };
       };
+      default = { };
+      description = "GPG backup script configuration.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.security.gpg.enable {
+    (lib.mkIf cfg.enable {
       programs.gpg = {
         enable = true;
         homedir = "${config.xdg.dataHome}/gnupg";
@@ -82,8 +90,8 @@ in
         pinentry.package = pkgs.pinentry-rofi;
       };
     })
-    (lib.mkIf config.security.gpg.backup.enable {
-      home.packages = [ config.security.gpg.backup.package ];
+    (lib.mkIf cfg.backup.enable {
+      home.packages = [ cfg.backup.package ];
     })
   ];
 }
diff --git a/modules/security/ssh/default.nix b/modules/security/ssh/default.nix
index e18b933..ed93e27 100644
--- a/modules/security/ssh/default.nix
+++ b/modules/security/ssh/default.nix
@@ -6,13 +6,15 @@
   ...
 }:
 let
+  cfg = config.security.ssh;
+
   gpgSshKeyLoad = pkgs.writeShellApplication {
     name = "gpg-ssh-key-load";
     runtimeInputs = [
       config.terminal.bash.package
       config.security.gopass.package
       config.security.gpg.package
-      config.security.ssh.package
+      cfg.package
       pkgs.coreutils
     ];
     text =
@@ -22,7 +24,7 @@ let
           "@@GNUPGHOME@@"
         ]
         [
-          config.security.ssh.sshKeyGopassPath
+          cfg.ssh-key-gopass-secret
           config.home.sessionVariables.GNUPGHOME
         ]
         (builtins.readFile ./gpg-ssh-key-load.sh);
@@ -38,7 +40,7 @@ in
       description = "The ssh package to use.";
     };
 
-    sshKeyGopassPath = lib.mkOption {
+    ssh-key-gopass-secret = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
@@ -50,8 +52,8 @@ in
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.security.ssh.enable {
-      home.packages = [ config.security.ssh.package ];
+    (lib.mkIf cfg.enable {
+      home.packages = [ cfg.package ];
 
       assertions = [
         {
@@ -64,7 +66,7 @@ in
       ];
     })
 
-    (lib.mkIf (config.security.ssh.enable && config.security.ssh.sshKeyGopassPath != null) {
+    (lib.mkIf (cfg.enable && cfg.ssh-key-gopass-secret != null) {
       home.activation.gpgSshKeyLoad = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
         run ${lib.getExe gpgSshKeyLoad} || true
       '';
diff --git a/modules/system/brightnessctl/default.nix b/modules/system/brightnessctl/default.nix
index af5746a..34e9a24 100644
--- a/modules/system/brightnessctl/default.nix
+++ b/modules/system/brightnessctl/default.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.system.brightnessctl;
+in
 {
   options.system.brightnessctl = {
     enable = lib.mkEnableOption "Enables brightnessctl.";
@@ -16,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.system.brightnessctl.enable {
-    home.packages = [ config.system.brightnessctl.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/system/btop/default.nix b/modules/system/btop/default.nix
index 4f84036..453bafb 100644
--- a/modules/system/btop/default.nix
+++ b/modules/system/btop/default.nix
@@ -1,39 +1,58 @@
 # Cross-platform graphical process and system monitor
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.system.btop;
+in
 {
   imports = [ ./assertions.nix ];
 
   options.system.btop = {
     enable = lib.mkEnableOption "Enables btop.";
-    nvidia.enable = lib.mkEnableOption "Build btop with NVIDIA GPU monitoring support (CUDA).";
-    amd.enable = lib.mkEnableOption "Build btop with AMD GPU monitoring support (ROCm).";
+    nvidia = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Build btop with NVIDIA GPU monitoring support (CUDA).";
+        };
+      };
+      default = { };
+      description = "NVIDIA GPU monitoring configuration.";
+    };
+    amd = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Build btop with AMD GPU monitoring support (ROCm).";
+        };
+      };
+      default = { };
+      description = "AMD GPU monitoring configuration.";
+    };
     package = lib.mkOption {
       type = lib.types.package;
       readOnly = true;
       default = pkgs.btop.override {
-        cudaSupport = config.system.btop.nvidia.enable;
-        rocmSupport = config.system.btop.amd.enable;
+        cudaSupport = cfg.nvidia.enable;
+        rocmSupport = cfg.amd.enable;
       };
       description = "The btop package to use.";
     };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.system.btop.enable {
+    (lib.mkIf cfg.enable {
       programs.btop = {
         enable = true;
-        package = config.system.btop.package;
+        package = cfg.package;
       };
     })
-    (lib.mkIf (config.system.btop.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."btop" = {
         name = "btop++";
-        exec = "${lib.getExe config.terminal.kitty.package} --class btop -e ${lib.getExe config.system.btop.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class btop -e ${lib.getExe cfg.package}";
         icon = "btop";
         categories = [
           "System"
diff --git a/modules/system/deep-clean/default.nix b/modules/system/deep-clean/default.nix
index 99b4617..1942837 100644
--- a/modules/system/deep-clean/default.nix
+++ b/modules/system/deep-clean/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.system.deep-clean;
+
   deepCleanScript = pkgs.writeShellApplication {
     name = "deep-clean";
     runtimeInputs = [ config.terminal.bash.package ];
@@ -24,7 +26,7 @@ in
     };
   };
 
-  config = lib.mkIf config.system.deep-clean.enable {
-    home.packages = [ config.system.deep-clean.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/system/nix-update/default.nix b/modules/system/nix-update/default.nix
index 9f93a4e..fb9151d 100644
--- a/modules/system/nix-update/default.nix
+++ b/modules/system/nix-update/default.nix
@@ -6,6 +6,8 @@
   ...
 }:
 let
+  cfg = config.system.nix-update;
+
   nixUpdateScript = pkgs.writeShellApplication {
     name = "nix-update";
     runtimeInputs = [
@@ -48,7 +50,7 @@ in
     };
   };
 
-  config = lib.mkIf config.system.nix-update.enable {
-    home.packages = [ config.system.nix-update.package ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
   };
 }
diff --git a/modules/system/systemctl-tui/default.nix b/modules/system/systemctl-tui/default.nix
index 17b7ec4..66b23a6 100644
--- a/modules/system/systemctl-tui/default.nix
+++ b/modules/system/systemctl-tui/default.nix
@@ -1,10 +1,13 @@
 # TUI for systemctl
 {
   config,
-  pkgs,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.system.systemctl-tui;
+in
 {
   options.system.systemctl-tui = {
     enable = lib.mkEnableOption "Enables systemctl-tui.";
@@ -17,17 +20,17 @@
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.system.systemctl-tui.enable {
+    (lib.mkIf cfg.enable {
       home.file.".local/share/icons/hicolor/scalable/apps/systemd.svg" = {
         source = ../../../assets/icons/apps/systemd.svg;
       };
 
-      home.packages = [ config.system.systemctl-tui.package ];
+      home.packages = [ cfg.package ];
     })
-    (lib.mkIf (config.system.systemctl-tui.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."systemctl-tui" = {
         name = "systemctl-tui";
-        exec = "${lib.getExe config.terminal.kitty.package} --class systemctl-tui -e ${lib.getExe config.system.systemctl-tui.package}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class systemctl-tui -e ${lib.getExe cfg.package}";
         icon = "systemd";
         categories = [ "System" ];
         comment = "TUI for systemctl";
diff --git a/modules/terminal/bat/default.nix b/modules/terminal/bat/default.nix
index 69045bc..735f08f 100644
--- a/modules/terminal/bat/default.nix
+++ b/modules/terminal/bat/default.nix
@@ -6,6 +6,7 @@
   ...
 }:
 let
+  cfg = config.terminal.bat;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
 in
 {
@@ -19,7 +20,7 @@ in
     };
   };
 
-  config = lib.mkIf config.terminal.bat.enable {
+  config = lib.mkIf cfg.enable {
     programs.bat = {
       enable = true;
       config = {
diff --git a/modules/terminal/fzf/default.nix b/modules/terminal/fzf/default.nix
index a7cc2f5..080e6a2 100644
--- a/modules/terminal/fzf/default.nix
+++ b/modules/terminal/fzf/default.nix
@@ -6,7 +6,12 @@
   ...
 }:
 let
+  cfg = config.terminal.fzf;
   base16Colors = import ../../colors/base16 { inherit config lib pkgs; };
+
+  shellIntegration = ''
+    ${if config.terminal.zsh.enable then "eval \"$(fzf --zsh)\"" else "eval \"$(fzf --bash)\""}
+  '';
 in
 {
   imports = [ ./assertions.nix ];
@@ -21,48 +26,42 @@ in
     };
   };
 
-  config =
-    let
-      shellIntegration = ''
-        ${if config.terminal.zsh.enable then "eval \"$(fzf --zsh)\"" else "eval \"$(fzf --bash)\""}
-      '';
-    in
-    lib.mkIf config.terminal.fzf.enable {
-      programs.fzf = {
-        enable = true;
-        defaultOptions = [
-          "--height 100%"
-          "--layout=reverse"
-          "--pointer='󰠁 '"
-          "--header=' '"
-          "--prompt='󰎕 '"
-          "--marker='✓ '"
-          "--border=none"
-          "--cycle"
-          "--no-info"
-          "--margin='1,2'"
-        ];
+  config = lib.mkIf cfg.enable {
+    programs.fzf = {
+      enable = true;
+      defaultOptions = [
+        "--height 100%"
+        "--layout=reverse"
+        "--pointer='󰠁 '"
+        "--header=' '"
+        "--prompt='󰎕 '"
+        "--marker='✓ '"
+        "--border=none"
+        "--cycle"
+        "--no-info"
+        "--margin='1,2'"
+      ];
 
-        colors = with base16Colors.colorsWithHashPrefix; {
-          fg = base05;
-          bg = "-1";
-          hl = base0D;
+      colors = with base16Colors.colorsWithHashPrefix; {
+        fg = base05;
+        bg = "-1";
+        hl = base0D;
 
-          "fg+" = base07;
-          "bg+" = "-1";
-          "hl+" = base0D;
+        "fg+" = base07;
+        "bg+" = "-1";
+        "hl+" = base0D;
 
-          gutter = "-1";
+        gutter = "-1";
 
-          info = base0B;
-          border = base03;
-          prompt = base0A;
-          pointer = base0F;
-          marker = base0C;
-          spinner = base0C;
-        };
+        info = base0B;
+        border = base03;
+        prompt = base0A;
+        pointer = base0F;
+        marker = base0C;
+        spinner = base0C;
       };
-
-      programs.zsh.initContent = lib.mkIf config.terminal.zsh.enable (lib.mkAfter shellIntegration);
     };
+
+    programs.zsh.initContent = lib.mkIf config.terminal.zsh.enable (lib.mkAfter shellIntegration);
+  };
 }
diff --git a/modules/terminal/kitty/default.nix b/modules/terminal/kitty/default.nix
index e7a5fbb..7e4c701 100644
--- a/modules/terminal/kitty/default.nix
+++ b/modules/terminal/kitty/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.terminal.kitty;
+in
 {
   imports = [
     ./colors.nix
@@ -20,7 +24,7 @@
     };
   };
 
-  config = lib.mkIf config.terminal.kitty.enable {
+  config = lib.mkIf cfg.enable {
     xdg.mimeApps.defaultApplications = {
       "x-scheme-handler/terminal" = "kitty.desktop";
     };
diff --git a/modules/terminal/less/default.nix b/modules/terminal/less/default.nix
index 66ddce9..d8b0993 100644
--- a/modules/terminal/less/default.nix
+++ b/modules/terminal/less/default.nix
@@ -1,5 +1,13 @@
 # Terminal pager
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.terminal.less;
+in
 {
   options.terminal.less = {
     enable = lib.mkEnableOption "Enables less.";
@@ -11,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.terminal.less.enable {
+  config = lib.mkIf cfg.enable {
     programs.less = {
       enable = true;
       options = [
diff --git a/modules/terminal/starship/default.nix b/modules/terminal/starship/default.nix
index 6aa83d6..3a7d8af 100644
--- a/modules/terminal/starship/default.nix
+++ b/modules/terminal/starship/default.nix
@@ -1,5 +1,15 @@
 # Minimal, blazing-fast shell prompt
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.terminal.starship;
+
+  mkSegment = content: ''[┄\[](red)[${content}]($style)[\]](red)'';
+in
 {
   options.terminal.starship = {
     enable = lib.mkEnableOption "Enables starship.";
@@ -11,63 +21,59 @@
     };
   };
 
-  config = lib.mkIf config.terminal.starship.enable {
+  config = lib.mkIf cfg.enable {
     programs.starship = {
       enable = true;
       enableZshIntegration = config.terminal.zsh.enable;
-      settings =
-        let
-          mkSegment = content: ''[┄\[](red)[${content}]($style)[\]](red)'';
-        in
-        {
-          add_newline = true;
+      settings = {
+        add_newline = true;
 
-          format = ''''\n[╭─\[](red)$username[@](red)$hostname[\]](red)$directory$git_branch$git_status$nix_shell''\n[╰─](red)$status$character ''\n'';
+        format = ''''\n[╭─\[](red)$username[@](red)$hostname[\]](red)$directory$git_branch$git_status$nix_shell''\n[╰─](red)$status$character ''\n'';
 
-          character.format = "[](red)";
+        character.format = "[](red)";
 
-          username = {
-            style_user = "blue";
-            style_root = "red bold";
-            format = "[$user]($style)";
-            show_always = true;
-          };
+        username = {
+          style_user = "blue";
+          style_root = "red bold";
+          format = "[$user]($style)";
+          show_always = true;
+        };
 
-          hostname = {
-            ssh_only = false;
-            style = "green";
-            format = "[$hostname]($style)";
-          };
+        hostname = {
+          ssh_only = false;
+          style = "green";
+          format = "[$hostname]($style)";
+        };
 
-          directory = {
-            style = "purple";
-            truncate_to_repo = false;
-            format = mkSegment "$path";
-          };
+        directory = {
+          style = "purple";
+          truncate_to_repo = false;
+          format = mkSegment "$path";
+        };
 
-          git_branch = {
-            style = "bold yellow";
-            format = ''[┄\[](red)[$symbol$branch(:$remote_branch)]($style)'';
-          };
+        git_branch = {
+          style = "bold yellow";
+          format = ''[┄\[](red)[$symbol$branch(:$remote_branch)]($style)'';
+        };
 
-          git_status = {
-            style = "cyan";
-            format = ''( [$all_status$ahead_behind]($style))[\]](red)'';
-          };
+        git_status = {
+          style = "cyan";
+          format = ''( [$all_status$ahead_behind]($style))[\]](red)'';
+        };
 
-          nix_shell = {
-            format = mkSegment "$symbol $state( \($name\))";
-            symbol = "󱄅";
-            impure_msg = "󰻌";
-            pure_msg = "󰕥";
-          };
+        nix_shell = {
+          format = mkSegment "$symbol $state( \($name\))";
+          symbol = "󱄅";
+          impure_msg = "󰻌";
+          pure_msg = "󰕥";
+        };
 
-          status = {
-            disabled = false;
-            format = "${mkSegment "$symbol $status"}[┄─](red)";
-            style = "white";
-          };
+        status = {
+          disabled = false;
+          format = "${mkSegment "$symbol $status"}[┄─](red)";
+          style = "white";
         };
+      };
     };
   };
 }
diff --git a/modules/terminal/tmux/default.nix b/modules/terminal/tmux/default.nix
index c9ea17b..b122c87 100644
--- a/modules/terminal/tmux/default.nix
+++ b/modules/terminal/tmux/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.terminal.tmux;
+in
 {
   options.terminal.tmux = {
     enable = lib.mkEnableOption "Enables tmux.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.terminal.tmux.enable {
+  config = lib.mkIf cfg.enable {
     programs.tmux = {
       enable = true;
     };
diff --git a/modules/terminal/zsh/default.nix b/modules/terminal/zsh/default.nix
index 8b7897c..4764618 100644
--- a/modules/terminal/zsh/default.nix
+++ b/modules/terminal/zsh/default.nix
@@ -2,8 +2,14 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.terminal.zsh;
+
+  nixCommandWrappers = builtins.readFile ./nix-aliases.sh;
+in
 {
   options.terminal.zsh = {
     enable = lib.mkEnableOption "Enables zsh.";
@@ -15,21 +21,17 @@
     };
   };
 
-  config =
-    let
-      nixCommandWrappers = builtins.readFile ./nix-aliases.sh;
-    in
-    lib.mkIf config.terminal.zsh.enable {
-      programs.zsh = {
-        enable = true;
-        dotDir = "${config.xdg.configHome}/zsh";
-        history.path = "${config.xdg.cacheHome}/zsh/history";
-        enableCompletion = true;
-        initContent = builtins.replaceStrings [ "@@NIX_COMMAND_WRAPPERS@@" ] [ nixCommandWrappers ] (
-          builtins.readFile ./init.sh
-        );
-      };
-
-      home.sessionVariables.SHELL = "${lib.getExe config.terminal.zsh.package}";
+  config = lib.mkIf cfg.enable {
+    programs.zsh = {
+      enable = true;
+      dotDir = "${config.xdg.configHome}/zsh";
+      history.path = "${config.xdg.cacheHome}/zsh/history";
+      enableCompletion = true;
+      initContent = builtins.replaceStrings [ "@@NIX_COMMAND_WRAPPERS@@" ] [ nixCommandWrappers ] (
+        builtins.readFile ./init.sh
+      );
     };
+
+    home.sessionVariables.SHELL = "${lib.getExe cfg.package}";
+  };
 }
diff --git a/modules/web/aria2/default.nix b/modules/web/aria2/default.nix
index 800f178..60e92c6 100644
--- a/modules/web/aria2/default.nix
+++ b/modules/web/aria2/default.nix
@@ -1,9 +1,13 @@
 # Command line download manager
 {
-  lib,
   config,
+  lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.web.aria2;
+in
 {
   options.web.aria2 = {
     enable = lib.mkEnableOption "Enables aria2.";
@@ -15,7 +19,7 @@
     };
   };
 
-  config = lib.mkIf config.web.aria2.enable {
+  config = lib.mkIf cfg.enable {
     programs.aria2 = {
       enable = true;
       settings = {
diff --git a/modules/web/chawan/default.nix b/modules/web/chawan/default.nix
index f3f0a30..0f1256d 100644
--- a/modules/web/chawan/default.nix
+++ b/modules/web/chawan/default.nix
@@ -2,8 +2,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  cfg = config.web.chawan;
+in
 {
   imports = [
     ./assertions.nix
@@ -17,7 +21,7 @@
       default = config.programs.chawan.package;
       description = "Package to use for chawan.";
     };
-    homeUrl = lib.mkOption {
+    home-url = lib.mkOption {
       type = lib.types.str;
       default = "https://searx.space";
       description = "The first page to open when chawan is launched.";
@@ -25,7 +29,7 @@
   };
 
   config = lib.mkMerge [
-    (lib.mkIf config.web.chawan.enable {
+    (lib.mkIf cfg.enable {
       home.file.".local/share/icons/hicolor/scalable/apps/internet-web-browser.svg" = {
         source = ../../../assets/icons/apps/internet-web-browser.svg;
       };
@@ -50,13 +54,13 @@
         };
       };
       home.packages = [
-        config.web.chawan.package
+        cfg.package
       ];
     })
-    (lib.mkIf (config.web.chawan.enable && config.terminal.kitty.enable) {
+    (lib.mkIf (cfg.enable && config.terminal.kitty.enable) {
       xdg.desktopEntries."chawan" = {
         name = "Chawan";
-        exec = "${lib.getExe config.terminal.kitty.package} --class chawan -e ${lib.getExe config.web.chawan.package} ${config.web.chawan.homeUrl}";
+        exec = "${lib.getExe config.terminal.kitty.package} --class chawan -e ${lib.getExe cfg.package} ${cfg.home-url}";
         icon = "internet-web-browser";
         categories = [ "Network" ];
         comment = "Text-based web browser";
diff --git a/modules/web/chromium/assertions.nix b/modules/web/chromium/assertions.nix
index 465ebbd..79a9ba1 100644
--- a/modules/web/chromium/assertions.nix
+++ b/modules/web/chromium/assertions.nix
@@ -3,8 +3,8 @@
 {
   assertions = [
     {
-      assertion = !config.web.chromium.useOpenGL || config.web.chromium.enable;
-      message = "web.chromium.useOpenGL requires web.chromium.enable.";
+      assertion = !config.web.chromium.use-opengl || config.web.chromium.enable;
+      message = "web.chromium.use-opengl requires web.chromium.enable.";
     }
   ];
 }
diff --git a/modules/web/chromium/default.nix b/modules/web/chromium/default.nix
index 1e3608c..ae9e97e 100644
--- a/modules/web/chromium/default.nix
+++ b/modules/web/chromium/default.nix
@@ -4,6 +4,10 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.web.chromium;
+  extensionDirs = lib.concatStringsSep "," (lib.mapAttrsToList (_: ext: ext.drv) cfg.extensions);
+in
 {
   imports = [
     ./assertions.nix
@@ -20,32 +24,26 @@
       defaultText = lib.literalExpression "config.programs.chromium.finalPackage";
       description = "Package to use for chromium. Defaults to the wrapped finalPackage from programs.chromium.";
     };
-    useOpenGL = lib.mkEnableOption ''
+    use-opengl = lib.mkEnableOption ''
       Use OpenGL APIs for graphics acceleration
     '';
   };
 
-  config = lib.mkIf config.web.chromium.enable {
+  config = lib.mkIf cfg.enable {
     programs.chromium = {
       enable = true;
       package = pkgs.ungoogled-chromium;
-      commandLineArgs =
-        let
-          extensionDirs = lib.concatStringsSep "," (
-            lib.mapAttrsToList (_: ext: ext.drv) config.web.chromium.extensions
-          );
-        in
-        [
-          "--force-dark-mode"
-          "--force-device-scale-factor=1.15"
-          # Don't use the gnome password store
-          "--password-store=basic"
-          "--load-extension=${extensionDirs}"
-        ]
-        ++ lib.optionals config.web.chromium.useOpenGL [
-          "--use-angle=opengl"
-          "--use-cmd-decoder=passthrough"
-        ];
+      commandLineArgs = [
+        "--force-dark-mode"
+        "--force-device-scale-factor=1.15"
+        # Don't use the gnome password store
+        "--password-store=basic"
+        "--load-extension=${extensionDirs}"
+      ]
+      ++ lib.optionals cfg.use-opengl [
+        "--use-angle=opengl"
+        "--use-cmd-decoder=passthrough"
+      ];
     };
 
     xdg.mimeApps.defaultApplications = {
@@ -94,10 +92,10 @@
         credentials_enable_autosignin = false;
         extensions = {
           pinned_extensions = [
-            config.web.chromium.extensions.browserpass.id
-            config.web.chromium.extensions.darkreader.id
-            config.web.chromium.extensions.ublockOrigin.id
-            config.web.chromium.extensions.vimium.id
+            cfg.extensions.browserpass.id
+            cfg.extensions.darkreader.id
+            cfg.extensions.ublockOrigin.id
+            cfg.extensions.vimium.id
           ];
           theme = {
             id = "";
diff --git a/users/arpit/default.nix b/users/arpit/default.nix
index c2dec0e..7b02d30 100644
--- a/users/arpit/default.nix
+++ b/users/arpit/default.nix
@@ -36,7 +36,7 @@
   development.delta.enable = true;
   development.direnv.enable = true;
   development.git.enable = true;
-  development.git.signing.signByDefault = true;
+  development.git.signing.sign-by-default = true;
   development.lazygit.enable = true;
   development.nixvim.enable = true;
   development.opencode.enable = true;
@@ -101,7 +101,7 @@
   web.aria2.enable = true;
   web.chawan.enable = true;
   web.chromium.enable = true;
-  web.chromium.useOpenGL = false;
+  web.chromium.use-opengl = false;
 
   programs.home-manager.enable = true;
 }
diff --git a/users/arpit/private.example.nix b/users/arpit/private.example.nix
index 3752f68..c854982 100644
--- a/users/arpit/private.example.nix
+++ b/users/arpit/private.example.nix
@@ -5,16 +5,16 @@
     remote = "YOUR_REPOSITORY_URL";
     credential = {
       username = "example";
-      passwordGopassPath = "websites/github.com/example/tokens/calendar";
+      password-gopass-secret = "websites/github.com/example/tokens/calendar";
     };
   };
 
   # Email - Template for configuring neomutt email accounts
   config.communication.neomutt.accounts = {
     "example@gmail.com" = {
-      realName = "Example User";
+      real-name = "Example User";
       address = "user@gmail.com";
-      passwordGopassSecret = "mail/user@gmail.com";
+      password-gopass-secret = "mail/user@gmail.com";
       flavor = "gmail.com";
       primary = true;
       neomutt.extraConfig = ''
@@ -22,8 +22,8 @@
       '';
       gpg = {
         key = "YOUR_GPG_KEY_ID";
-        signByDefault = true;
-        encryptByDefault = false; # set true only if you also want auto-encrypt
+        sign-by-default = false;
+        encrypt-by-default = false; # set true only if you also want auto-encrypt
       };
     };
   };
@@ -35,7 +35,7 @@
     };
     identity = {
       nickname = "example";
-      passwordGopassSecret = "irc/user@irc.example.com";
+      password-gopass-secret = "irc/user@irc.example.com";
     };
   };
 
@@ -45,19 +45,19 @@
     email = "you@example.com";
     signing = {
       key = "EXAMPLE_GPG_KEY_ID";
-      signByDefault = true;
+      sign-by-default = true;
     };
   };
 
   # SSH key to load into the gpg-agent from gopass (entry in the gopass store)
-  config.security.ssh.sshKeyGopassPath = "ssh/hostname/username";
+  config.security.ssh.ssh-key-gopass-secret = "ssh/hostname/username";
 
   # Gopass - Template for configuring gopass, specially syncing
   config.security.gopass.sync = {
     remote = "YOUR_REPOSITORY_URL";
     credential = {
       username = "example";
-      passwordGopassPath = "websites/github.com/example/tokens/calendar";
+      password-gopass-secret = "websites/github.com/example/tokens/calendar";
     };
   };
 }