Nice. I like Nix because it allows me to build custom systemd services that just work. I was able to build a systemd service I call “homebeacon” which tells my laptop whether it’s actually on my home network, cryptographically. A responder on my server signs a challenge with an Ed25519 key; the laptop checks four cheap network signals first, then does the handshake. The signature covers the server’s address so it can’t be relayed from outside. The verdict raises or lowers a systemd target. NAS mounts arm when home and go inert when away, so the filesystem doesn’t hang. Battery charges to 80% at the desk, 100% travelling. It doesn’t drive firewall rules, keyring unlock, disk unlock; Nothing a spoofed “home” could turn into access.