diff --git a/.config/git/config b/.config/git/config
index 4faf001..30d92a4 100644
--- a/.config/git/config
+++ b/.config/git/config
@@ -1,8 +1,7 @@
-[user]
-	name = surtur
-	email = a_mirre@utb.cz
 [commit]
 	gpgsign = true
+[gpg]
+    format = ssh
 [oh-my-zsh]
 	hide-status = 1
 [cola]
diff --git a/.config/kitty/current-theme.conf b/.config/kitty/current-theme.conf
new file mode 100644
index 0000000..6933de9
--- /dev/null
+++ b/.config/kitty/current-theme.conf
@@ -0,0 +1,42 @@
+## name: Dracula
+## author: Keegan Carruthers-Smith
+## license: MIT
+## upstream: https://raw.githubusercontent.com/dracula/kitty/master/dracula.conf
+
+foreground            #f8f8f2
+background            #282a36
+selection_foreground  #ffffff
+selection_background  #44475a
+url_color #8be9fd
+color0  #21222c
+color8  #6272a4
+color1  #ff5555
+color9  #ff6e6e
+color2  #50fa7b
+color10 #69ff94
+color3  #f1fa8c
+color11 #ffffa5
+color4  #bd93f9
+color12 #d6acff
+color5  #ff79c6
+color13 #ff92df
+color6  #8be9fd
+color14 #a4ffff
+color7  #f8f8f2
+color15 #ffffff
+cursor            #f8f8f2
+cursor_text_color background
+active_tab_foreground   #282a36
+# active_tab_background   #f8f8f2
+active_tab_background   #ab86e0
+# inactive_tab_foreground #282a36
+# inactive_tab_background #6272a4
+# alt
+# inactive_tab_background #2c2f3a
+# alt2
+# inactive_tab_foreground #6272a4
+inactive_tab_foreground #a0cff7
+# inactive_tab_background #2b2b2b
+inactive_tab_background #282a36
+tab_bar_background #282a36
+mark1_foreground #282a36
diff --git a/flake.nix b/flake.nix
index 5bbc6a4..4da480e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -44,5 +44,19 @@
       # Optionally use extraSpecialArgs
       # to pass through arguments to home.nix
     };
+
+    homeConfigurations.leo = home-manager.lib.homeManagerConfiguration {
+      inherit pkgs;
+
+      # Specify your home configuration modules here, for example,
+      # the path to your home.nix.
+      modules = [
+        ./home-leo.nix
+        homeage.homeManagerModules.homeage
+      ];
+
+      # Optionally use extraSpecialArgs
+      # to pass through arguments to home.nix
+    };
   };
 }
diff --git a/home-leo.nix b/home-leo.nix
new file mode 100644
index 0000000..952f608
--- /dev/null
+++ b/home-leo.nix
@@ -0,0 +1,447 @@
+{
+  config,
+  lib,
+  pkgs,
+  homeage,
+  ...
+}: let
+  hostName = "leo";
+in {
+  home.username = "$USER";
+  home.sessionVariables.HOSTNAME = "${hostName}";
+  home.homeDirectory = "/home/$USER";
+  home.stateVersion = "22.11";
+
+  #home.activation = {
+  #  checkBemenuDraculaInZshDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
+  #    $DRY_RUN_CMD test -d .zsh/bemenu-dracula || echo "TODO: link bemenu-dracula to .zsh"
+  #  '';
+  #};
+
+  homeage = {
+    # Absolute path to identity (created not through home-manager)
+    identityPaths = [
+      "~/.ssh/theEd"
+    ];
+
+    # "activation" if system doesn't support systemd
+    #installationType = "activation";
+    installationType = "systemd";
+
+    file."sops-age-keys.txt" = {
+      # Path to encrypted file tracked by the git repository
+      source = ./secrets/sops-keys.age;
+      # can be "copies" or "symlink"
+      symlinks = [".config/sops/age/keys.txt"];
+    };
+  };
+
+  # build a configuration and switch:
+  # ➜ home-manager switch --no-out-link -b backup --flake ~/src/dotfiles#$USER
+
+  # instead, install with:
+  #   nix profile install --priority 0 home-manager
+  # hit the issue described here, waiting until resolved:
+  #   https://github.com/nix-community/home-manager/issues/2848
+  programs.home-manager.enable = false;
+  programs.home-manager.path = "$HOME/src/dotfiles";
+
+  imports = [
+    ./nix/programs.nix
+  ];
+
+  home.file = {
+    ".config/kitty/kitty.conf" = {
+      source = .config/kitty/kitty.conf;
+    };
+
+    ".vimrc" = {
+      source = ./.vim/vimrc;
+    };
+    ".vim/deoplete.vimrc.vim" = {
+      source = ./.vim/deoplete.vimrc.vim;
+    };
+    ".vim/gotags.vimrc.vim" = {
+      source = ./.vim/gotags.vimrc.vim;
+    };
+
+    ".config/sway/config" = {
+      source = ./.config/sway/config;
+    };
+    ".config/sway/env" = {
+      source = ./.config/sway/env;
+    };
+    ".config/waybar/config" = {
+      source = ./.config/waybar/config;
+    };
+    ".config/waybar/style.css" = {
+      source = ./.config/waybar/style.css;
+    };
+    ".config/waybar/modules/storage.sh" = {
+      source = ./.config/waybar/modules/storage.sh;
+    };
+    ".config/kanshi/config" = {
+      source = ./.config/kanshi/config;
+    };
+    ".local/bin/swws.py" = {
+      source = ./bin/swws.py;
+    };
+    ".local/bin/sway-locker" = {
+      source = ./bin/sway-locker;
+    };
+
+    ".config/fusuma/config-wl.yml" = {
+      source = ./.config/fusuma/config-wl.yml;
+    };
+    ".config/fusuma/config.yml" = {
+      source = ./.config/fusuma/config.yml;
+    };
+
+    ".config/git/config-common" = {
+      source = ./.config/git/config;
+    };
+    # host-specific gitconfig.
+    ".config/git/config.${hostName}" = {
+      text = ''
+        [user]
+            name = ${hostName}
+            email = wanderer@dotya.ml
+            signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKwshTdBgLzwY4d8N7VainZCngH88OwvPGhZ6bm87rBO
+      '';
+    };
+    ".config/git/config" = {
+      text = ''
+        [include]
+          path = ~/.config/git/config-common
+        [include]
+          path = ~/.config/git/config.${hostName}
+        '';
+    };
+
+    # begin zsh-related.
+    ".zshrc" = {
+      source = ./.zshrc;
+    };
+    ".zshenv" = {
+      source = ./.zshenv;
+    };
+    ".zprofile" = {
+      source = ./.zprofile;
+    };
+    ".zsh" = {
+      source = ./.zsh;
+      recursive = true;
+    };
+    ".zsh/bemenu-dracula" = {
+      source = pkgs.fetchFromGitHub {
+        owner = "dracula";
+        repo = "bemenu";
+        rev = "9b1165b3d97e3b2a74c6ce220781b78d8a11febf";
+        sha256 = "sha256-TwfkEZ1aTkHur+jCqRsaqvzOw6qpH0L4pvYqkx7iCDk=";
+      };
+    };
+    # end zsh-related.
+
+    ".cargo/config.toml" = {
+      source = .cargo/config.toml;
+    };
+
+    ".config/swaylock/config" = {
+      source = .config/swaylock/config;
+    };
+    ".config/tridactyl/tridactylrc" = {
+      source = .config/tridactyl/tridactylrc;
+    };
+
+    ".local/bin/battery.sh" = {
+      source = bin/battery.sh;
+      executable = true;
+    };
+    ".local/bin/localbsync" = {
+      source = bin/localbsync;
+      executable = true;
+    };
+    ".local/bin/mgp" = {
+      source = bin/mgp;
+      executable = true;
+    };
+    ".local/bin/parec-wr" = {
+      source = bin/parec-wr;
+      executable = true;
+    };
+    ".local/bin/pscbg" = {
+      source = bin/pscbg;
+      executable = true;
+    };
+    ".local/bin/qst_up" = {
+      source = bin/qst_up;
+      executable = true;
+    };
+    ".local/bin/v4l2pls" = {
+      source = bin/v4l2pls;
+      executable = true;
+    };
+    ".local/bin/winprint.sh" = {
+      source = bin/winprint.sh;
+      executable = true;
+    };
+
+    ".local/bin/authenticator.sh" = {
+      text = ''
+        #!/bin/sh
+
+        # adopted from https://wiki.archlinux.org/index.php/Google_Authenticator
+        # This is the path to the Google Authenticator app file.  It's typically located
+        # in /data under Android.  Copy it to your PC in a safe location and specify the
+        # path to it here.
+        #DB="/path/to/com.google.android.apps.authenticator/databases/databases"
+        DB="$1"
+
+
+        if [ $# -ne 1 ]; then
+            printf "authenticator\n"
+            printf "usage: authenticator <path/to/org.authenticator/databases/databases>\n"
+            printf "\tThis is the path to the Authenticator app owned SQLite db file.\n"
+            printf "\tCopy it to your PC to a safe location and specify the path to it here.\n"
+            exit 1
+        fi
+
+
+        # On most Android systems with sufficient user access, the Google Authenticator
+        # database can be copied off the device and accessed directly, as it is an
+        # sqlite3 database. This shell script will read a Google Authenticator database
+        # and generate live codes for each key found:
+
+
+        sqlite3 "$DB" 'SELECT email,secret FROM accounts;' | while read A
+        do
+                NAME=`echo "$A" | cut -d '|' -f 1`
+                KEY=`echo "$A" | cut -d '|' -f 2`
+                CODE=`oathtool --totp -b "$KEY"`
+                echo -e "\e[1;32m$CODE\e[0m - \e[1;33m$NAME\e[0m"
+        done
+      '';
+      executable = true;
+    };
+    ".local/bin/createarchive.sh" = {
+      text = ''
+        #!/bin/bash
+
+        if [ $# -ne 1 ]; then
+            printf "createarchive\n"
+            printf "usage: createarchive <folder to be archived>\n"
+            printf "warning: the archive will be moved to "backups" directory (`echo $dest`)\n"
+            exit 1
+        fi
+
+
+        # what this does in short: tar, compress, timestamp, shred the tar, mv .xz to pwd and display it
+        logdate="$(date +%Y%m%dT%H%M%S)"
+        basedir="$1"
+        tmpdir=$(mktemp -d "${TMPDIR:-/tmp/}$(basename $0).XXXXXXXXXX")
+        #/run/user/$(id -u) tmpfs 0700 perms
+        f="`cd $basedir; pwd | tr '/' ' ' | sed 's/^.* / /' | cut -c2-`" > /dev/null
+        g="$logdate-$f.tar"
+        dest=~/MEGA/Private/backups
+
+        doathing() {
+            cd $basedir/..
+            tar cfv "$tmpdir/$g" "$f" && \
+            xz -vzk9e "$tmpdir/$g" -S .xz && \
+            rsync -avP "$tmpdir/$g.xz" "$dest" && \
+            shred -zuv "$tmpdir/$g" "$tmpdir/$g.xz" && \
+            printf "\n"
+            ls -latr "$dest/$g.xz"
+        }
+
+        if [ ! -d $1 ]; then
+            echo "$1 is not a directory"
+            exit 1
+        else
+            echo `pwd`
+            echo "$f"
+            echo "$1"
+
+            doathing
+            trap "rm -rfv $tmpdir" 0 1 3 15
+            exit $?
+        fi
+      '';
+      executable = true;
+    };
+    ".config/qutebrowser/userscripts/localhost" = {
+      executable = true;
+      text = ''
+        #!/usr/bin/env bash
+
+        export BEMENU_OPTS="--tb '#6272a4' --tf '#f8f8f2' --fb '#282a36' --ff '#f8f8f2'
+        --nb '#282a36' --nf '#6272a4' --hb '#44475a' --hf '#50fa7b' --sb '#44475a' --sf
+        '#50fa7b' --scb '#282a36' --scf '#ff79c6' -p 'localhost:<port> ▶' --fork -l 5
+        --fn 'FiraCode Retina 17'"
+
+        if [[ $1 -eq 'list' ]] && [[ -z $QUTE_COUNT ]];
+        then
+            PORTS="$(ss -nltp | tail -n +2 |  awk '{print $4}' | awk -F: '{print $2}')"
+            QUTE_COUNT=$(echo "$PORTS" | bemenu -n )
+        fi
+
+        # echo open -t localhost:''${QUTE_COUNT:-8080} > $QUTE_FIFO
+        [ -n "$QUTE_COUNT" ] && echo open -t localhost:"''${QUTE_COUNT}" > $QUTE_FIFO
+      '';
+    };
+    ".config/qutebrowser/userscripts/speak" = {
+      executable = true;
+      text = ''
+        #!/bin/bash
+        export IFS=$'\n'
+        pkill -f qute_speak || {
+                ~/.local/bin/gtts-cli "$QUTE_SELECTED_TEXT" | mpv --no-video --speed=1.26 -
+                # ~/.local/bin/gtts-cli "$QUTE_SELECTED_TEXT" > /tmp/qute_speak.mp3
+                # mpv /tmp/qute_speak.mp3
+        }
+      '';
+    };
+    ".config/qutebrowser/userscripts/dark_mode.user" = {
+      executable = true;
+      text = ''
+        #!/bin/zsh
+
+        # on a new system cp DR.js DarkReader.user.js
+        darkreader_file="$HOME/.config/qutebrowser/greasemonkey/DarkReader.user.js"
+        enabled="^//DarkReader.disable();"
+        darkreader_enabled="$(grep -q -e "$enabled" $darkreader_file; echo $?)"
+        # echo $darkreader_enabled
+
+        if [[ "$(echo $darkreader_enabled)" == "1" ]]; then
+            # enable DarkReader by commenting out the line that disables it.
+            sed -i --follow-symlink 's/DarkReader.disable()/\/\/DarkReader.disable()/' "$darkreader_file"
+        else
+            # disable DarkReader
+            sed -i --follow-symlink 's/\/\/DarkReader.disable()/DarkReader.disable()/' "$darkreader_file"
+        fi
+      '';
+    };
+    ".config/qutebrowser/greasemonkey/DR.js" = {
+      text = ''
+        // ==UserScript==
+        // @name          Dark Reader (Unofficial)
+        // @icon          https://darkreader.org/images/darkreader-icon-256x256.png
+        // @namespace     DarkReader
+        // @description	 Inverts the brightness of pages to reduce eye strain
+        // @version       4.9.52
+        // @author        https://github.com/darkreader/darkreader#contributors
+        // @homepageURL   https://darkreader.org/ | https://github.com/darkreader/darkreader
+        // @run-at        document-end
+        // @grant         none
+        // @exclude       https://git.dotya.ml*
+        // @exclude       https://dotya.ml*
+        // @exclude       https://status.dotya.ml*
+        // @exclude       https://searxng.dotya.ml*
+        // @exclude       https://grafana.dotya.ml*
+        // @exclude       https://github.com*
+        // @exclude       https://dnswatch.com*
+        // @exclude       https://docs.immudb.io*
+        // @exclude       https://woodpecker-ci.org*
+        // @exclude       https://duckduckgo.com*
+        // @exclude       https://www.redit.com*
+        // @exclude       https://codeberg.org*
+        // @include       http*
+        // @require       https://cdn.jsdelivr.net/npm/darkreader/darkreader.min.js
+        // @noframes
+        // ==/UserScript==
+
+        DarkReader.enable({
+            brightness: 105,
+            contrast: 105,
+            sepia: 0
+        });
+        DarkReader.disable();
+      '';
+    };
+    ".config/qutebrowser/userscripts/code_select.py" = {
+      executable = true;
+      source = .local/share/qutebrowser/userscripts/code_select.py;
+    };
+    ".config/qutebrowser/userscripts/getbib" = {
+      executable = true;
+      source = .local/share/qutebrowser/userscripts/getbib;
+    };
+    ".config/qutebrowser/userscripts/qute-gemini" = {
+      executable = true;
+      source = .local/share/qutebrowser/userscripts/qute-gemini;
+    };
+    ".config/qutebrowser/userscripts/qute-gemini-tab" = {
+      executable = true;
+      source = .local/share/qutebrowser/userscripts/qute-gemini;
+    };
+    ".config/qutebrowser/config.py" = {
+      source = .config/qutebrowser/config.py;
+    };
+
+    ".local/bin/workqb" = {
+      text = ''
+        #!/bin/zsh
+
+        qutebrowser \
+          --restore work \
+          --config ~/.config/qutebrowser/config.py \
+          --basedir ~/.config/qutebrowser-work \
+          &
+        disown
+      '';
+      executable = true;
+    };
+  };
+
+  xdg = {
+    configFile."kitty/config.d" = {
+      source = ./.config/kitty/config.d;
+    };
+    configFile."kitty/current-theme.conf" = {
+      source = ./.config/kitty/current-theme.conf;
+    };
+
+    configFile."aerc/aerc.conf" = {
+      source = ./.config/aerc/aerc.conf;
+    };
+    configFile."aerc/binds.conf" = {
+      source = ./.config/aerc/binds.conf;
+    };
+
+    configFile."sway/config.d" = {
+      source = ./.config/sway/config.d;
+    };
+
+    configFile."sheldon/plugins.toml" = {
+      source = ./.config/sheldon/plugins.toml;
+    };
+
+    configFile."starship.toml" = {
+      source = ./.config/starship.toml;
+    };
+
+    configFile."zathura/zathurarc" = {
+      source = ./.config/zathura/zathurarc;
+    };
+    configFile."zathura/dracula-zathura" = {
+      source = pkgs.fetchFromGitHub {
+        owner = "dracula";
+        repo = "zathura";
+        rev = "b597b1537aa125e8829bef2cc57a0b0c6a6b35a1";
+        sha256 = "sha256-g6vxwPw0Q9QFJBc3d4R3ZsHnnEvU5o1f4DSuyLeN5XQ=";
+      };
+    };
+
+    configFile."qutebrowser/dracula" = {
+      source = pkgs.fetchFromGitHub {
+        owner = "dracula";
+        repo = "qutebrowser-dracula-theme";
+        rev = "ba5bd6589c4bb8ab35aaaaf7111906732f9764ef";
+        sha256 = "sha256-av6laQezAOrBt6P+F2eHWFqAnTEENfDrvzEfhn2dDNY=";
+      };
+    };
+    configFile."qutebrowser/stylesheets" = {
+      source = ./.config/qutebrowser/stylesheets;
+    };
+  };
+}