diff --git a/modules/capabilities/desktop-defaults.nix b/modules/capabilities/desktop-defaults.nix
index e795b5c..fbb0647 100644
--- a/modules/capabilities/desktop-defaults.nix
+++ b/modules/capabilities/desktop-defaults.nix
@@ -1,20 +1,47 @@
-{ config, ... }:
+{ ... }:
 let
-  repo = config.repo;
+  mkPrimaryDesktopApplication =
+    {
+      name,
+      package,
+      command,
+      desktopId,
+    }:
+    { pkgs, ... }:
+    {
+      meta.desktop.${name} = {
+        inherit command desktopId;
+        package = package pkgs;
+      };
+    };
 in
 {
+  flake.modules.homeManager.primary-browser-vivaldi = mkPrimaryDesktopApplication {
+    name = "browser";
+    package = pkgs: pkgs.vivaldi;
+    command = "vivaldi";
+    desktopId = "vivaldi-stable.desktop";
+  };
+
+  flake.modules.homeManager.primary-file-manager-nautilus = mkPrimaryDesktopApplication {
+    name = "fileManager";
+    package = pkgs: pkgs.nautilus;
+    command = "nautilus";
+    desktopId = "org.gnome.Nautilus.desktop";
+  };
+
   flake.modules.homeManager.desktop-defaults =
     { config, pkgs, ... }:
     let
-      browserPackage = pkgs.${repo.desktop.browser.packageAttr};
-      fileManagerPackage = pkgs.${repo.desktop.fileManager.packageAttr};
+      browser = config.meta.desktop.browser;
+      fileManager = config.meta.desktop.fileManager;
       homeDir = config.home.homeDirectory;
       localDir = "${homeDir}/.local";
       mediaDir = "${homeDir}/media";
     in
     {
       home.preferXdgDirectories = true;
-      home.sessionVariables.BROWSER = repo.desktop.browser.command;
+      home.sessionVariables.BROWSER = browser.command;
 
       home.packages =
         with pkgs;
@@ -28,8 +55,8 @@ in
           dbeaver-bin
         ]
         ++ [
-          browserPackage
-          fileManagerPackage
+          browser.package
+          fileManager.package
         ];
 
       programs.imv.enable = true;
@@ -69,8 +96,8 @@ in
               neovim
             ]
             ++ [
-              browserPackage
-              fileManagerPackage
+              fileManager.package
+              browser.package
             ];
         };
       };
diff --git a/modules/capabilities/networking.nix b/modules/capabilities/networking.nix
index c8d4354..011a2b6 100644
--- a/modules/capabilities/networking.nix
+++ b/modules/capabilities/networking.nix
@@ -1,15 +1,23 @@
+{ config, ... }:
+let
+  nixosModules = config.flake.modules.nixos;
+in
 {
-  flake.modules.nixos.server-firewall = {
-    networking = {
-      firewall.enable = true;
-      firewall.allowPing = false;
-    };
+  flake.modules.nixos.nftables-firewall = {
+    networking.nftables.enable = true;
   };
 
   flake.modules.nixos.network-manager = {
-    networking = {
-      nftables.enable = true;
-      networkmanager.enable = true;
-    };
+    networking.networkmanager.enable = true;
   };
+
+  flake.modules.nixos.server-firewall =
+    { ... }:
+    {
+      imports = [
+        nixosModules.nftables-firewall
+      ];
+
+      networking.firewall.allowPing = false;
+    };
 }
diff --git a/modules/capabilities/niri/default.nix b/modules/capabilities/niri/default.nix
index f517835..b74331e 100644
--- a/modules/capabilities/niri/default.nix
+++ b/modules/capabilities/niri/default.nix
@@ -32,9 +32,9 @@ in
     }:
     let
       repoTheme = repo.theme.kanagawa;
-      browserCommand = repo.desktop.browser.command;
-      fileManagerPackage = pkgs.${repo.desktop.fileManager.packageAttr};
-      terminalCommand = config.repo.terminal.primary.command;
+      browserCommand = config.meta.desktop.browser.command;
+      fileManagerPackage = config.meta.desktop.fileManager.package;
+      terminalCommand = config.meta.terminal.command;
       outputs = lib.mapAttrs (
         _: display:
         {
diff --git a/modules/capabilities/noctalia/default.nix b/modules/capabilities/noctalia/default.nix
index 22ff1c1..1b9026b 100644
--- a/modules/capabilities/noctalia/default.nix
+++ b/modules/capabilities/noctalia/default.nix
@@ -68,7 +68,7 @@ in
       baseSettings = mkBaseSettings {
         inherit lib;
         homeDirectory = config.home.homeDirectory;
-        terminal = config.repo.terminal.primary;
+        terminal = config.meta.terminal;
       };
       settings =
         if baseSettings == { } || !osConfig.meta.machine.portable then
diff --git a/modules/capabilities/passwords.nix b/modules/capabilities/passwords.nix
index f4c97a5..c527f59 100644
--- a/modules/capabilities/passwords.nix
+++ b/modules/capabilities/passwords.nix
@@ -5,20 +5,31 @@
 let
   repo = config.repo;
   account = repo.account;
+  homeModules = config.flake.modules.homeManager;
 in
 {
+  flake.modules.homeManager.pinentry =
+    { pkgs, ... }:
+    {
+      meta.pinentry.package = pkgs.pinentry-gnome3;
+    };
+
   flake.modules.homeManager.passwords =
     {
-      pkgs,
+      config,
       ...
     }:
     {
+      imports = [
+        homeModules.pinentry
+      ];
+
       programs.rbw = {
         enable = true;
         settings = {
           base_url = repo.services.vaultwarden.url;
           email = account.primaryEmail.address;
-          pinentry = pkgs.pinentry-gnome3;
+          pinentry = config.meta.pinentry.package;
         };
       };
     };
diff --git a/modules/capabilities/terminal.nix b/modules/capabilities/terminal.nix
index b855560..f5d1454 100644
--- a/modules/capabilities/terminal.nix
+++ b/modules/capabilities/terminal.nix
@@ -2,7 +2,7 @@
 let
   repo = config.repo;
 
-  mkPrimaryTerminal =
+  mkTerminal =
     {
       desktopId,
       packageFor,
@@ -16,7 +16,7 @@ let
       imports = [ terminalModule ];
 
       config = {
-        repo.terminal.primary = {
+        meta.terminal = {
           inherit
             desktopId
             package
@@ -155,13 +155,13 @@ in
       };
     };
 
-  flake.modules.homeManager.primary-terminal-foot = mkPrimaryTerminal {
+  flake.modules.homeManager.primary-terminal-foot = mkTerminal {
     desktopId = "foot.desktop";
     packageFor = pkgs: pkgs.foot;
     terminalModule = config.flake.modules.homeManager.terminal-foot;
   };
 
-  flake.modules.homeManager.primary-terminal-kitty = mkPrimaryTerminal {
+  flake.modules.homeManager.primary-terminal-kitty = mkTerminal {
     desktopId = "kitty.desktop";
     packageFor = pkgs: pkgs.kitty;
     terminalModule = config.flake.modules.homeManager.terminal-kitty;
diff --git a/modules/data.nix b/modules/data.nix
index 393ac4a..ce128a5 100644
--- a/modules/data.nix
+++ b/modules/data.nix
@@ -24,19 +24,6 @@
       };
     };
 
-    desktop = {
-      browser = {
-        command = "vivaldi";
-        packageAttr = "vivaldi";
-      };
-
-      fileManager = {
-        command = "nautilus";
-        packageAttr = "nautilus";
-      };
-
-    };
-
     services = {
       actual = {
         domain = "finance.jelles.net";
diff --git a/modules/lib/schema.nix b/modules/lib/schema.nix
index 934d2d1..49cbe78 100644
--- a/modules/lib/schema.nix
+++ b/modules/lib/schema.nix
@@ -81,35 +81,21 @@ let
     }
   );
 
-  desktopApplicationType = lib.types.submodule (
-    { ... }:
-    {
-      options = {
-        command = lib.mkOption {
-          type = lib.types.str;
-        };
-
-        packageAttr = lib.mkOption {
-          type = lib.types.str;
-        };
+  desktopApplicationType = lib.types.submodule {
+    options = {
+      package = lib.mkOption {
+        type = lib.types.package;
       };
-    }
-  );
 
-  desktopType = lib.types.submodule (
-    { ... }:
-    {
-      options = {
-        browser = lib.mkOption {
-          type = desktopApplicationType;
-        };
-
-        fileManager = lib.mkOption {
-          type = desktopApplicationType;
-        };
+      command = lib.mkOption {
+        type = lib.types.str;
       };
-    }
-  );
+
+      desktopId = lib.mkOption {
+        type = lib.types.str;
+      };
+    };
+  };
 
   displayType = lib.types.submodule (
     { ... }:
@@ -194,7 +180,7 @@ let
     }
   );
 
-  terminalPrimaryType = lib.types.submodule {
+  terminalType = lib.types.submodule {
     options = {
       package = lib.mkOption {
         type = lib.types.package;
@@ -226,10 +212,6 @@ in
       default = { };
     };
 
-    desktop = lib.mkOption {
-      type = desktopType;
-    };
-
     services = lib.mkOption {
       type = lib.types.raw;
       default = { };
@@ -249,11 +231,23 @@ in
       };
     };
 
-  config.flake.modules.homeManager.repo-schema =
+  config.flake.modules.homeManager.meta =
     { ... }:
     {
-      options.repo.terminal.primary = lib.mkOption {
-        type = terminalPrimaryType;
+      options.meta.terminal = lib.mkOption {
+        type = terminalType;
+      };
+
+      options.meta.desktop.browser = lib.mkOption {
+        type = desktopApplicationType;
+      };
+
+      options.meta.desktop.fileManager = lib.mkOption {
+        type = desktopApplicationType;
+      };
+
+      options.meta.pinentry.package = lib.mkOption {
+        type = lib.types.package;
       };
     };
 
diff --git a/modules/profiles/host-base.nix b/modules/profiles/host-base.nix
index c54228d..f888088 100644
--- a/modules/profiles/host-base.nix
+++ b/modules/profiles/host-base.nix
@@ -22,7 +22,7 @@ in
       backupFileExtension = "bak";
       extraSpecialArgs = { inherit inputs; };
       sharedModules = [
-        hmModules.repo-schema
+        hmModules.meta
         hmModules.syncthing
         hmModules.shell
         hmModules.neovim
diff --git a/modules/profiles/workstation-base.nix b/modules/profiles/workstation-base.nix
index 43f43b0..6808b29 100644
--- a/modules/profiles/workstation-base.nix
+++ b/modules/profiles/workstation-base.nix
@@ -14,6 +14,7 @@ in
       nixosModules.flatpak
       nixosModules.fonts
       nixosModules.network-manager
+      nixosModules.nftables-firewall
       nixosModules.niri
       nixosModules.plymouth
       nixosModules.printing
@@ -40,6 +41,8 @@ in
       homeModules.passwords
       homeModules.clipboard
       homeModules.dev-tools
+      homeModules.primary-browser-vivaldi
+      homeModules.primary-file-manager-nautilus
       homeModules.desktop-defaults
       homeModules.email
       homeModules.mpv