diff --git a/nixos-configs/common/default.nix b/nixos-configs/common/default.nix
new file mode 100644
index 0000000..8b45a12
--- /dev/null
+++ b/nixos-configs/common/default.nix
@@ -0,0 +1,37 @@
+# common/default.nix
+
+# inputs to this NixOS module. We don't use any here
+# so we can ignore them all.
+{ ... }:
+
+{
+  imports = [
+    # User account definitions
+    ./users
+  ];
+
+  # clean /tmp on boot.
+  boot.cleanTmpDir = true;
+
+  # Automatically optimize the Nix store to save space
+  # by hard-linking identical files together. These savings
+  # add up.
+  #nix.settings.autoOptimiseStore = true;
+
+  # Limit the systemd journal to 100 MB of disk or the
+  # last 7 days of logs, whichever happens first.
+  services.journald.extraConfig = ''
+    SystemMaxUse=100M
+    MaxFileSec=7day
+  '';
+
+  # Use systemd-resolved for DNS lookups, but disable
+  # its dnssec support because it is kinda broken in
+  # surprising ways.
+
+  # Who is surprised that dnssec is broken? no one.
+  # services.resolved = {
+  #   enable = true;
+  #   dnssec = "false";
+  # };
+}
diff --git a/nixos-configs/common/users/default.nix b/nixos-configs/common/users/default.nix
new file mode 100644
index 0000000..1fb1a9d
--- /dev/null
+++ b/nixos-configs/common/users/default.nix
@@ -0,0 +1,35 @@
+# common/users/default.nix
+
+# Inputs to this NixOS module, in this case we are
+# using `pkgs` so I can configure my favorite shell fish
+# and `config` so we can make my SSH key also work with
+# the root user.
+{ config, pkgs, ... }:
+
+{
+  # The block that specifies my user account.
+  users.users.josiah = {
+    isNormalUser = true;
+    shell = pkgs.bash;
+
+    # My SSH keys.
+    openssh.authorizedKeys.keys = [
+      # Replace this with your SSH key!
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAZhFDzl1lbhWJ7MiTV3+Z1EY8M5b4cH/+ju4uo1d91 admin"
+    ];
+  };
+  users.users.alice = {
+    isNormalUser = true;
+    shell = pkgs.bash;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    # My SSH keys.
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAZhFDzl1lbhWJ7MiTV3+Z1EY8M5b4cH/+ju4uo1d91 admin"
+    ];
+    packages = with pkgs; [ emacs vim ];
+  };
+
+  # Use my SSH keys for logging in as root.
+  users.users.root.openssh.authorizedKeys.keys =
+    config.users.users.alice.openssh.authorizedKeys.keys;
+}
diff --git a/nixos-configs/deploy-rs/flake.nix b/nixos-configs/deploy-rs/flake.nix
new file mode 100644
index 0000000..6ed952a
--- /dev/null
+++ b/nixos-configs/deploy-rs/flake.nix
@@ -0,0 +1,23 @@
+{
+  description = "Test deployment for my server cluster";
+
+  # For accessing `deploy-rs`'s utility Nix functions
+  inputs.deploy-rs.url = "github:serokell/deploy-rs";
+
+  outputs = { self, nixpkgs, deploy-rs }: {
+    nixosConfigurations.seraph = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [ ../hosts/seraph/configuration.nix ];
+    };
+
+    deploy.nodes.seraph.profiles.system = {
+      user = "alice";
+      sshUser = "alice";
+      remoteBuild = false;
+      path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.some-random-system;
+    };
+
+    # This is highly advised, and will prevent many possible mistakes
+    checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+  };
+}
diff --git a/nixos-configs/hosts/hoyden/configuration.nix b/nixos-configs/hosts/hoyden/configuration.nix
new file mode 100644
index 0000000..82d606f
--- /dev/null
+++ b/nixos-configs/hosts/hoyden/configuration.nix
@@ -0,0 +1,293 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+let
+  unstableTarball = fetchTarball
+    "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+
+in {
+  imports = [ # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "hoyden"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Set your time zone.
+  time.timeZone = "US/Central";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.eno1.useDHCP = true;
+  networking.interfaces.wlp0s20f3.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  # };
+  fonts.fonts = with pkgs; [
+    # Serif fonts
+    roboto
+    ttf_bitstream_vera
+    liberation_ttf
+    dejavu_fonts
+
+    # Emoji
+    openmoji-color
+  ];
+
+  fonts.fontconfig = { defaultFonts = { emoji = [ "OpenMoji Color" ]; }; };
+
+  # Enable the X11 windowing system.
+  services.xserver = {
+    enable = true;
+    autoRepeatDelay = 150;
+    # autoRepeatInterval = something; # this is configurable so i'm leaving it here, but not sure that i need it.
+    displayManager.sddm.enable = true;
+    desktopManager.plasma5.enable = true;
+    windowManager.awesome = {
+      enable = true;
+      luaModules = with pkgs.luaPackages; [
+        luarocks # is the package manager for Lua modules
+        luadbi-mysql # Database abstraction layer
+      ];
+    };
+  };
+  services.flatpak.enable = true;
+
+  # try and handle some of the dumb long term storage optimiztaion issues with nixos:
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  # This is probalby not gonna work, but is a rough analogue to what I did before
+  # pkgs.writeTextFile {
+  #   name = "plasma-awesome-xsession";
+  #   destination = "/share/xsessions/plasma-awesome.desktop";
+  #   text = ''
+  #   [Desktop Entry]
+  #   Type=XSession
+  #   Exec=env KDEWM=/run/current-system/sw/bin/awesome /run/current-system/sw/bin/startplasma-x11
+  #   DesktopNames=KDE (awesome)
+  #   Name=Plasma (awesome)
+  #   Comment=Plasma by KDE w/awesome
+  #   '';
+  # } // {
+  #   providedSessions = [ "plasma-awesome" ];
+  # }
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  sound.enable = true;
+  hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # enable docker, virtualbox, virtualization shit
+  virtualisation.docker.enable = true;
+  virtualisation.virtualbox.host.enable = false;
+  virtualisation.virtualbox.host.enableExtensionPack = false;
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.josiah = {
+    isNormalUser = true;
+    extraGroups =
+      [ "wheel" "audio" "sound" "video" "docker" "vboxusers" "adbusers" ];
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+
+  nixpkgs.config = {
+    packageOverrides = pkgs: {
+      unstable = import unstableTarball { config = config.nixpkgs.config; };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    # build shit
+    morph
+    autoconf
+    yarn
+    automake
+    gnumake
+    wget
+    gcc-arm-embedded
+    xorg.libX11
+    vim
+    konsole
+    patchelf
+    docker
+    # jlj dev
+    # python-language-server
+    # python38Packages.python-language-server
+    # jlj utils
+    darktable
+    digikam
+    offlineimap
+    unzip
+    ansible
+    python38
+    python38Packages.pip
+    python38Packages.setuptools
+    pipenv
+    bitwarden
+    chromium
+    magic-wormhole
+    firefox
+    unstable.nyxt
+    emacs
+    emacsPackages.flyspell-correct
+    nixfmt
+    mu
+    ispell
+    obsidian
+    zeal
+    git
+    keychain
+    os-prober
+    lsof
+    wireguard-tools
+    tailscale
+    fortune
+    youtube-dl
+    gcc8
+    dfu-util
+    scrot
+    qbittorrent
+    obs-studio
+    texlive.combined.scheme-full
+    # jlj sound
+    pavucontrol
+    # jlj comms
+    unstable.element-desktop
+    slack
+    discord
+    konversation
+    unstable.signal-desktop
+    newsflash # same maker as feedreader, newer, less features, actively maintained.
+    zoom-us
+    spectral
+    jitsi-meet-electron
+    # jlj de
+    syncthingtray
+    unstable.synology-drive-client
+    barrier
+    pinentry
+    acpi
+    awesome
+    networkmanagerapplet
+    arc-icon-theme
+    rofi
+    i3lock
+    vlc
+    unstable.thunderbird
+    birdtray # tray icon for thunderbird
+    peruse
+    libsForQt5.ark
+    # tauon # this is a good music player but it doesn't come bundled proper in nixos; install via flatpak you bitch
+    # rsi stuff
+    rsibreak
+    workrave
+    espanso # text expander
+    xclip # c&p from cli / required for espanso
+    libnotify # required for espanso
+    arc-icon-theme
+    # kde specific stuff
+    kde-gtk-config
+    libsForQt5.kde-cli-tools
+    arc-kde-theme
+    # jlj games
+    lutris
+    steam
+    vulkan-tools
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryFlavor = "qt";
+  };
+
+  programs.adb.enable = true;
+
+  # List services that you want to enable:
+
+  services = {
+    syncthing = {
+      enable = true;
+      user = "josiah";
+      dataDir = "/home/josiah/dhd"; # Default folder for new synced folders
+      configDir =
+        "/home/josiah/.config/syncthing"; # Folder for Syncthing's settings and keys
+    };
+    tailscale.enable = true;
+    openssh.enable = true;
+  };
+
+  # this works properly
+  fileSystems."/home/josiah/network-share/syn-nas/usenet" = {
+    device = "192.168.1.221:/volume1/usenet";
+    fsType = "nfs";
+  };
+
+  fileSystems."/home/josiah/network-share/sainthood/homes" = {
+    device = "sainthood.home.jowj.net:/volume3/homes/";
+    options = [ "nfsvers=3" ];
+    fsType = "nfs";
+  };
+
+  # this doens't work right
+  # fileSystems."/home/josiah/network-share/sainthood/homes" = {
+  #   #device = "//sainthood.home.jowj.net/volume3/homes/";
+  #   device = "//sainthood.home.jowj.net//volume3/homes/";
+  #   fsType = "cifs";
+  #   options = let
+  #     # this line prevents hanging on network split
+  #     automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+  #   in ["${automount_opts},credentials=/etc/nixos/smb-secrets"];
+  # };
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?
+
+}
diff --git a/nixos-configs/hosts/hoyden/hardware-configuration.nix b/nixos-configs/hosts/hoyden/hardware-configuration.nix
new file mode 100644
index 0000000..b8b910c
--- /dev/null
+++ b/nixos-configs/hosts/hoyden/hardware-configuration.nix
@@ -0,0 +1,34 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4dd471ee-c6af-40d4-b9af-b0f99466af02";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/D357-6F39";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/a5f80549-0f7b-484b-a951-18d12138af67"; }
+    ];
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}
diff --git a/nixos-configs/hosts/seraph/configuration.nix b/nixos-configs/hosts/seraph/configuration.nix
new file mode 100644
index 0000000..4244cda
--- /dev/null
+++ b/nixos-configs/hosts/seraph/configuration.nix
@@ -0,0 +1,96 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports = [ # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "seraph"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable =
+    true; # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  time.timeZone = "US/Central";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkbOptions in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.layout = "us";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services = {
+    tailscale.enable = true;
+    openssh.enable = true;
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  networking.firewall.checkReversePath = "loose";
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.11"; # Did you read the comment?
+
+}
diff --git a/nixos-configs/hosts/seraph/hardware-configuration.nix b/nixos-configs/hosts/seraph/hardware-configuration.nix
new file mode 100644
index 0000000..d5cb604
--- /dev/null
+++ b/nixos-configs/hosts/seraph/hardware-configuration.nix
@@ -0,0 +1,37 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/3662ca72-d69f-42fe-a049-0f1ed2b81334";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/97D6-2BED";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/nixos-configs/ops/home/.gcroots/network.nix b/nixos-configs/ops/home/.gcroots/network.nix
new file mode 120000
index 0000000..b12f2a2
--- /dev/null
+++ b/nixos-configs/ops/home/.gcroots/network.nix
@@ -0,0 +1 @@
+/nix/store/mfkpmn5rfvpj05gggrc10nr8w5xb75d1-morph
\ No newline at end of file
diff --git a/nixos-configs/ops/home/cache-priv-key.pem b/nixos-configs/ops/home/cache-priv-key.pem
new file mode 100644
index 0000000..bddaa78
--- /dev/null
+++ b/nixos-configs/ops/home/cache-priv-key.pem
@@ -0,0 +1 @@
+hoyden:mzRpcmjuqPqre3Si990zXvAeD9xwqRJMezGsxdXV2vTayggi7ycd8bhQlPQGg3u2YhjbaztvTo1bogdeAlI/bg==
\ No newline at end of file
diff --git a/nixos-configs/ops/home/cache-pub-key.pem b/nixos-configs/ops/home/cache-pub-key.pem
new file mode 100644
index 0000000..8695142
--- /dev/null
+++ b/nixos-configs/ops/home/cache-pub-key.pem
@@ -0,0 +1 @@
+hoyden:2soIIu8nHfG4UJT0BoN7tmIY22s7b06NW6IHXgJSP24=
\ No newline at end of file
diff --git a/nixos-configs/ops/home/network.nix b/nixos-configs/ops/home/network.nix
new file mode 100644
index 0000000..ad3bddc
--- /dev/null
+++ b/nixos-configs/ops/home/network.nix
@@ -0,0 +1,28 @@
+# ops/home/network.nix
+
+{
+  # Configuration for the network in general.
+  network = { description = "home.jowj.net cluster definition"; };
+
+  # This specifies the configuration for
+  # `seraph` as a NixOS module.
+
+  "seraph" = { config, pkgs, lib, ... }: {
+    deployment.targetUser = "alice";
+    deployment.targetHost = "seraph";
+
+    # Import seraph configuration.nix
+    imports = [
+      ../../hosts/seraph/configuration.nix
+      ../../common ];
+  };
+
+  # "hoyden" = { config, pkgs, lib, ... }: {
+  #   deployment.targetUser = "josiah";
+  #   deployment.targetHost = "hoyden";
+
+  #   # Import seraph configuration.nix
+  #   imports = [ ../../hosts/hoyden/configuration.nix ];
+  # };  
+
+}
diff --git a/nixos-configs/ops/home/push.sh b/nixos-configs/ops/home/push.sh
new file mode 100755
index 0000000..15798ef
--- /dev/null
+++ b/nixos-configs/ops/home/push.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+
+# Specify the packages we are using in this
+# script as well as the fact that we are running it
+# in bash.
+#! nix-shell -p morph -i bash
+
+# Explode on any error.
+set -e
+
+# Build the system configurations for every
+# machine in this network and register them as
+# garbage collector roots so `nix-collect-garbage`
+# doesn't sweep them away.
+morph build --keep-result ~/Documents/projects/adc/nixos-configs/ops/home/network.nix
+
+# Push the config to the hosts.
+morph push ~/Documents/projects/adc/nixos-configs/ops/home/network.nix
+
+# Activate the NixOS configuration on the
+# network.
+morph deploy ~/Documents/projects/adc/nixos-configs/ops/home/network.nix test
diff --git a/nixos-configs/ops/home/simple.nix b/nixos-configs/ops/home/simple.nix
new file mode 100644
index 0000000..40b36f0
--- /dev/null
+++ b/nixos-configs/ops/home/simple.nix
@@ -0,0 +1,40 @@
+let
+  pkgs = import (import ../nixpkgs.nix) {};
+in
+{
+  network =  {
+    inherit pkgs;
+    description = "simple hosts";
+    ordering = {
+      tags = [ "db" "web" ];
+    };
+  };
+
+  "web01" = { config, pkgs, ... }: {
+    deployment.tags = [ "web" ];
+
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    services.nginx.enable = true;
+
+    fileSystems = {
+        "/" = { label = "nixos"; fsType = "ext4"; };
+        "/boot" = { label = "boot"; fsType = "vfat"; };
+    };
+  };
+
+  "db01" = { config, pkgs, ... }: {
+    deployment.tags = [ "db" ];
+
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    services.postgresql.enable = true;
+
+    fileSystems = {
+        "/" = { label = "nixos"; fsType = "ext4"; };
+        "/boot" = { label = "boot"; fsType = "vfat"; };
+    };
+  };
+}