diff --git a/modules/capabilities/desktop-defaults.nix b/modules/capabilities/desktop-defaults.nix
index e795b5c..1ee69e4 100644
--- a/modules/capabilities/desktop-defaults.nix
+++ b/modules/capabilities/desktop-defaults.nix
@@ -1,20 +1,44 @@
-{ config, ... }:
+{ ... }:
 let
-  repo = config.repo;
+  mkPrimaryDesktopApplication =
+    {
+      name,
+      package,
+      desktopEntryName,
+    }:
+    { pkgs, ... }:
+    {
+      meta.desktop.${name} = {
+        inherit desktopEntryName;
+        package = package pkgs;
+      };
+    };
 in
 {
+  flake.modules.homeManager.primary-browser-vivaldi = mkPrimaryDesktopApplication {
+    name = "browser";
+    package = pkgs: pkgs.vivaldi;
+    desktopEntryName = "vivaldi-stable";
+  };
+
+  flake.modules.homeManager.primary-file-manager-nautilus = mkPrimaryDesktopApplication {
+    name = "fileManager";
+    package = pkgs: pkgs.nautilus;
+    desktopEntryName = "org.gnome.Nautilus";
+  };
+
   flake.modules.homeManager.desktop-defaults =
     { config, pkgs, ... }:
     let
-      browserPackage = pkgs.${repo.desktop.browser.packageAttr};
-      fileManagerPackage = pkgs.${repo.desktop.fileManager.packageAttr};
+      browser = config.meta.desktop.browser;
+      fileManager = config.meta.desktop.fileManager;
       homeDir = config.home.homeDirectory;
       localDir = "${homeDir}/.local";
       mediaDir = "${homeDir}/media";
     in
     {
       home.preferXdgDirectories = true;
-      home.sessionVariables.BROWSER = repo.desktop.browser.command;
+      home.sessionVariables.BROWSER = browser.command;
 
       home.packages =
         with pkgs;
@@ -28,8 +52,8 @@ in
           dbeaver-bin
         ]
         ++ [
-          browserPackage
-          fileManagerPackage
+          browser.package
+          fileManager.package
         ];
 
       programs.imv.enable = true;
@@ -69,8 +93,8 @@ in
               neovim
             ]
             ++ [
-              browserPackage
-              fileManagerPackage
+              fileManager.package
+              browser.package
             ];
         };
       };
diff --git a/modules/capabilities/networking.nix b/modules/capabilities/networking.nix
index c8d4354..011a2b6 100644
--- a/modules/capabilities/networking.nix
+++ b/modules/capabilities/networking.nix
@@ -1,15 +1,23 @@
+{ config, ... }:
+let
+  nixosModules = config.flake.modules.nixos;
+in
 {
-  flake.modules.nixos.server-firewall = {
-    networking = {
-      firewall.enable = true;
-      firewall.allowPing = false;
-    };
+  flake.modules.nixos.nftables-firewall = {
+    networking.nftables.enable = true;
   };
 
   flake.modules.nixos.network-manager = {
-    networking = {
-      nftables.enable = true;
-      networkmanager.enable = true;
-    };
+    networking.networkmanager.enable = true;
   };
+
+  flake.modules.nixos.server-firewall =
+    { ... }:
+    {
+      imports = [
+        nixosModules.nftables-firewall
+      ];
+
+      networking.firewall.allowPing = false;
+    };
 }
diff --git a/modules/capabilities/niri/default.nix b/modules/capabilities/niri/default.nix
index f517835..cc5b063 100644
--- a/modules/capabilities/niri/default.nix
+++ b/modules/capabilities/niri/default.nix
@@ -32,9 +32,9 @@ in
     }:
     let
       repoTheme = repo.theme.kanagawa;
-      browserCommand = repo.desktop.browser.command;
-      fileManagerPackage = pkgs.${repo.desktop.fileManager.packageAttr};
-      terminalCommand = config.repo.terminal.primary.command;
+      browserCommand = config.meta.desktop.browser.command;
+      fileManagerPackage = config.meta.desktop.fileManager.package;
+      terminalCommand = config.meta.desktop.terminal.command;
       outputs = lib.mapAttrs (
         _: display:
         {
diff --git a/modules/capabilities/noctalia/_noctalia-config.nix b/modules/capabilities/noctalia/_noctalia-config.nix
index ed594d1..5a48195 100644
--- a/modules/capabilities/noctalia/_noctalia-config.nix
+++ b/modules/capabilities/noctalia/_noctalia-config.nix
@@ -1,7 +1,7 @@
 {
   homeDirectory,
   lib,
-  terminal,
+  terminalCommand,
 }:
 {
   settingsVersion = 53;
@@ -260,7 +260,7 @@
     pinnedApps = [ ];
     useApp2Unit = false;
     sortByMostUsed = true;
-    terminalCommand = lib.concatStringsSep " " ([ terminal.command ] ++ terminal.execArgs);
+    inherit terminalCommand;
     customLaunchPrefixEnabled = false;
     customLaunchPrefix = "";
     viewMode = "grid";
diff --git a/modules/capabilities/noctalia/default.nix b/modules/capabilities/noctalia/default.nix
index 22ff1c1..5e87c5c 100644
--- a/modules/capabilities/noctalia/default.nix
+++ b/modules/capabilities/noctalia/default.nix
@@ -8,13 +8,13 @@ let
     {
       homeDirectory,
       lib,
-      terminal,
+      terminalCommand,
     }:
     import ./_noctalia-config.nix {
       inherit
         homeDirectory
         lib
-        terminal
+        terminalCommand
         ;
     };
 
@@ -22,13 +22,13 @@ let
     {
       homeDirectory,
       lib,
-      terminal,
+      terminalCommand,
     }:
     mkNoctaliaSettings {
       inherit
         homeDirectory
         lib
-        terminal
+        terminalCommand
         ;
     };
 
@@ -68,7 +68,7 @@ in
       baseSettings = mkBaseSettings {
         inherit lib;
         homeDirectory = config.home.homeDirectory;
-        terminal = config.repo.terminal.primary;
+        terminalCommand = lib.getExe pkgs.xdg-terminal-exec;
       };
       settings =
         if baseSettings == { } || !osConfig.meta.machine.portable then
diff --git a/modules/capabilities/passwords.nix b/modules/capabilities/passwords.nix
index f4c97a5..c527f59 100644
--- a/modules/capabilities/passwords.nix
+++ b/modules/capabilities/passwords.nix
@@ -5,20 +5,31 @@
 let
   repo = config.repo;
   account = repo.account;
+  homeModules = config.flake.modules.homeManager;
 in
 {
+  flake.modules.homeManager.pinentry =
+    { pkgs, ... }:
+    {
+      meta.pinentry.package = pkgs.pinentry-gnome3;
+    };
+
   flake.modules.homeManager.passwords =
     {
-      pkgs,
+      config,
       ...
     }:
     {
+      imports = [
+        homeModules.pinentry
+      ];
+
       programs.rbw = {
         enable = true;
         settings = {
           base_url = repo.services.vaultwarden.url;
           email = account.primaryEmail.address;
-          pinentry = pkgs.pinentry-gnome3;
+          pinentry = config.meta.pinentry.package;
         };
       };
     };
diff --git a/modules/capabilities/terminal.nix b/modules/capabilities/terminal.nix
index b855560..a188592 100644
--- a/modules/capabilities/terminal.nix
+++ b/modules/capabilities/terminal.nix
@@ -2,13 +2,13 @@
 let
   repo = config.repo;
 
-  mkPrimaryTerminal =
+  mkTerminal =
     {
-      desktopId,
+      desktopEntryName,
       packageFor,
       terminalModule,
     }:
-    { lib, pkgs, ... }:
+    { config, pkgs, ... }:
     let
       package = packageFor pkgs;
     in
@@ -16,18 +16,13 @@ let
       imports = [ terminalModule ];
 
       config = {
-        repo.terminal.primary = {
-          inherit
-            desktopId
-            package
-            ;
-          command = lib.getExe package;
-          execArgs = [ "-e" ];
+        meta.desktop.terminal = {
+          inherit desktopEntryName package;
         };
 
         xdg.terminal-exec = {
           enable = true;
-          settings.default = [ desktopId ];
+          settings.default = [ config.meta.desktop.terminal.desktopId ];
         };
       };
     };
@@ -155,14 +150,14 @@ in
       };
     };
 
-  flake.modules.homeManager.primary-terminal-foot = mkPrimaryTerminal {
-    desktopId = "foot.desktop";
+  flake.modules.homeManager.primary-terminal-foot = mkTerminal {
+    desktopEntryName = "foot";
     packageFor = pkgs: pkgs.foot;
     terminalModule = config.flake.modules.homeManager.terminal-foot;
   };
 
-  flake.modules.homeManager.primary-terminal-kitty = mkPrimaryTerminal {
-    desktopId = "kitty.desktop";
+  flake.modules.homeManager.primary-terminal-kitty = mkTerminal {
+    desktopEntryName = "kitty";
     packageFor = pkgs: pkgs.kitty;
     terminalModule = config.flake.modules.homeManager.terminal-kitty;
   };
diff --git a/modules/data.nix b/modules/data.nix
index 393ac4a..ce128a5 100644
--- a/modules/data.nix
+++ b/modules/data.nix
@@ -24,19 +24,6 @@
       };
     };
 
-    desktop = {
-      browser = {
-        command = "vivaldi";
-        packageAttr = "vivaldi";
-      };
-
-      fileManager = {
-        command = "nautilus";
-        packageAttr = "nautilus";
-      };
-
-    };
-
     services = {
       actual = {
         domain = "finance.jelles.net";
diff --git a/modules/lib/schema.nix b/modules/lib/schema.nix
index 934d2d1..7d0ace7 100644
--- a/modules/lib/schema.nix
+++ b/modules/lib/schema.nix
@@ -82,30 +82,27 @@ let
   );
 
   desktopApplicationType = lib.types.submodule (
-    { ... }:
+    { config, ... }:
     {
       options = {
+        package = lib.mkOption {
+          type = lib.types.package;
+        };
+
         command = lib.mkOption {
           type = lib.types.str;
+          default = lib.getExe config.package;
+          defaultText = lib.literalExpression "lib.getExe config.package";
         };
 
-        packageAttr = lib.mkOption {
+        desktopEntryName = lib.mkOption {
           type = lib.types.str;
         };
-      };
-    }
-  );
 
-  desktopType = lib.types.submodule (
-    { ... }:
-    {
-      options = {
-        browser = lib.mkOption {
-          type = desktopApplicationType;
-        };
-
-        fileManager = lib.mkOption {
-          type = desktopApplicationType;
+        desktopId = lib.mkOption {
+          type = lib.types.str;
+          default = "${config.desktopEntryName}.desktop";
+          defaultText = lib.literalExpression ''"${config.desktopEntryName}.desktop"'';
         };
       };
     }
@@ -193,27 +190,6 @@ let
       };
     }
   );
-
-  terminalPrimaryType = lib.types.submodule {
-    options = {
-      package = lib.mkOption {
-        type = lib.types.package;
-      };
-
-      command = lib.mkOption {
-        type = lib.types.str;
-      };
-
-      desktopId = lib.mkOption {
-        type = lib.types.str;
-      };
-
-      execArgs = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-      };
-    };
-  };
 in
 {
   options.repo = {
@@ -226,10 +202,6 @@ in
       default = { };
     };
 
-    desktop = lib.mkOption {
-      type = desktopType;
-    };
-
     services = lib.mkOption {
       type = lib.types.raw;
       default = { };
@@ -249,11 +221,23 @@ in
       };
     };
 
-  config.flake.modules.homeManager.repo-schema =
+  config.flake.modules.homeManager.meta =
     { ... }:
     {
-      options.repo.terminal.primary = lib.mkOption {
-        type = terminalPrimaryType;
+      options.meta.desktop.browser = lib.mkOption {
+        type = desktopApplicationType;
+      };
+
+      options.meta.desktop.fileManager = lib.mkOption {
+        type = desktopApplicationType;
+      };
+
+      options.meta.desktop.terminal = lib.mkOption {
+        type = desktopApplicationType;
+      };
+
+      options.meta.pinentry.package = lib.mkOption {
+        type = lib.types.package;
       };
     };
 
diff --git a/modules/profiles/host-base.nix b/modules/profiles/host-base.nix
index c54228d..f888088 100644
--- a/modules/profiles/host-base.nix
+++ b/modules/profiles/host-base.nix
@@ -22,7 +22,7 @@ in
       backupFileExtension = "bak";
       extraSpecialArgs = { inherit inputs; };
       sharedModules = [
-        hmModules.repo-schema
+        hmModules.meta
         hmModules.syncthing
         hmModules.shell
         hmModules.neovim
diff --git a/modules/profiles/workstation-base.nix b/modules/profiles/workstation-base.nix
index 43f43b0..6808b29 100644
--- a/modules/profiles/workstation-base.nix
+++ b/modules/profiles/workstation-base.nix
@@ -14,6 +14,7 @@ in
       nixosModules.flatpak
       nixosModules.fonts
       nixosModules.network-manager
+      nixosModules.nftables-firewall
       nixosModules.niri
       nixosModules.plymouth
       nixosModules.printing
@@ -40,6 +41,8 @@ in
       homeModules.passwords
       homeModules.clipboard
       homeModules.dev-tools
+      homeModules.primary-browser-vivaldi
+      homeModules.primary-file-manager-nautilus
       homeModules.desktop-defaults
       homeModules.email
       homeModules.mpv