I can't really fully encapsulate it in a comment really, but I can give you some advice: 1. Use flakes to set up your system and do work with. It sometimes fee

I can't really fully encapsulate it in a comment really, but I can give you some advice: 1. Use flakes to set up your system and do work with. It sometimes feels underdocumented, but it's worth some headscratching imo. 2. Don't worry about putting everything in the base system. Stick to services (Tailscale, Syncthing, etc) and system/base desktop software. It's easy enough to use nix run, or Podman, or flatpak, or even AppImage to a degree. 3. Want to configure something declaratively? Before pulling out HomeManager or another user tool, consider configuring software at the system level. I do this for Zsh, SwayWM, etc. As a bonus, you can easily block off shell startup files and chown them to root so that malware can't trivially insert themselves there. (It's a weak protection, but definitely doesn't hurt in addition to other approaches.) There's more (I recommend using Nix-ld to support AppImage and raw binaries better) but these things go a long way.