diff --git a/hosts/default.nix b/hosts/default.nix
index 37cebd8..4924419 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -63,26 +63,14 @@ in {
     laptop = mkSystem {
       hostname = "laptop";
       username = "nickolaj";
-      modules = [
-        ../legacy_modules/graphical.nix
-        ../legacy_modules/devenv.nix
-      ];
     };
     desktop = mkSystem {
       hostname = "desktop";
       username = "nickolaj";
-      modules = [
-        ../legacy_modules/graphical.nix
-        ../legacy_modules/devenv.nix
-      ];
     };
     work = mkSystem {
       hostname = "work";
       username = "nickolaj";
-      modules = [
-        ../legacy_modules/graphical.nix
-        ../legacy_modules/devenv.nix
-      ];
     };
     homelab = mkSystem {
       hostname = "homelab";
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index f12460b..03bcbaf 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -1,3 +1,5 @@
 {
   fireproof.desktop.enable = true;
-}
\ No newline at end of file
+  fireproof.work.enable = true;
+  fireproof.dev.enable = true;
+}
diff --git a/hosts/homelab/configuration.nix b/hosts/homelab/configuration.nix
index 591a6df..730d1d0 100644
--- a/hosts/homelab/configuration.nix
+++ b/hosts/homelab/configuration.nix
@@ -3,6 +3,8 @@
   lib,
   ...
 }: {
+  fireproof.dev.enable = true;
+
   boot = {
     # Use grub as bootloader as it works better with mdadm
     loader.grub.enable = true;
diff --git a/hosts/laptop/configuration copy.nix b/hosts/laptop/configuration copy.nix
deleted file mode 100644
index f12460b..0000000
--- a/hosts/laptop/configuration copy.nix	
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  fireproof.desktop.enable = true;
-}
\ No newline at end of file
diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix
index 5529d9f..cd9a6f7 100644
--- a/hosts/laptop/configuration.nix
+++ b/hosts/laptop/configuration.nix
@@ -1,4 +1,7 @@
 {pkgs, ...}: {
+  fireproof.desktop.enable = true;
+  fireproof.work.enable = true;
+  fireproof.dev.enable = true;
   # Enable OpenGL
   hardware.graphics = {
     enable = true;
diff --git a/hosts/work/configuration.nix b/hosts/work/configuration.nix
index f12460b..03bcbaf 100644
--- a/hosts/work/configuration.nix
+++ b/hosts/work/configuration.nix
@@ -1,3 +1,5 @@
 {
   fireproof.desktop.enable = true;
-}
\ No newline at end of file
+  fireproof.work.enable = true;
+  fireproof.dev.enable = true;
+}
diff --git a/legacy_modules/apps/chromium.nix b/legacy_modules/apps/chromium.nix
deleted file mode 100644
index 8a3ab11..0000000
--- a/legacy_modules/apps/chromium.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{pkgsUnstable, ...}: {
-  fireproof.home-manager.programs.chromium = {
-    enable = true;
-    package = pkgsUnstable.chromium;
-    extensions = [
-      "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
-      "nngceckbapebfimnlniiiahkandclblb" # Bitwarden
-    ];
-  };
-}
diff --git a/legacy_modules/apps/ferdium.nix b/legacy_modules/apps/ferdium.nix
deleted file mode 100644
index 03ede04..0000000
--- a/legacy_modules/apps/ferdium.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.ferdium
-  ];
-}
diff --git a/legacy_modules/apps/firefox.nix b/legacy_modules/apps/firefox.nix
deleted file mode 100644
index 3d6bc95..0000000
--- a/legacy_modules/apps/firefox.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  pkgsUnstable,
-  inputs,
-  pkgs,
-  ...
-}: let
-  nur = inputs.nur.legacyPackages.${pkgs.system};
-  extensions = nur.repos.rycee.firefox-addons;
-in {
-  programs.firefox = {
-    enable = true;
-    package = pkgsUnstable.firefox;
-  };
-
-  xdg.mime.defaultApplications = {
-    "text/html" = "firefox.desktop";
-    "x-scheme-handler/http" = "firefox.desktop";
-    "x-scheme-handler/https" = "firefox.desktop";
-    "x-scheme-handler/about" = "firefox.desktop";
-    "x-scheme-handler/unknown" = "firefox.desktop";
-  };
-
-  fireproof.home-manager = {
-    programs.firefox = {
-      enable = true;
-      package = pkgsUnstable.firefox;
-      profiles.default = {
-        extensions.packages = with extensions; [
-          # Privacy
-          ublock-origin
-          clearurls
-          libredirect
-          smartproxy
-
-          # Security
-          bitwarden
-
-          # Media
-          dearrow
-          sponsorblock
-
-          # Search
-          kagi-search
-
-          # Productivity
-          new-tab-override
-
-          # Social
-          reddit-enhancement-suite
-
-          # Development
-          react-devtools
-          refined-github
-        ];
-
-        settings = {
-          "browser.startup.homepage" = "https://flame.nickolaj.com";
-        };
-      };
-    };
-  };
-}
diff --git a/legacy_modules/apps/ghostty.nix b/legacy_modules/apps/ghostty.nix
deleted file mode 100644
index 282871e..0000000
--- a/legacy_modules/apps/ghostty.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: {
-  environment.systemPackages = with pkgs; [
-    ghostty
-  ];
-  fireproof.home-manager = {
-    programs.ghostty = {
-      enable = true;
-      enableFishIntegration = config.programs.fish.enable;
-      settings = {
-        window-decoration = false;
-        theme = "fireproof";
-        font-size = 11;
-        font-family = "Hack Nerd Font";
-        window-inherit-font-size = false;
-      };
-      themes = {
-        fireproof = {
-          background = "1C1B1A";
-          cursor-color = "DAD8CE";
-          foreground = "DAD8CE";
-          palette = [
-            "0=#100F0F"
-            "1=#AF3029"
-            "2=#66800B"
-            "3=#AD8301"
-            "4=#205EA6"
-            "5=#A02F6F"
-            "6=#24837B"
-            "7=#DAD8CE"
-            "8=#878580"
-            "9=#D14D41"
-            "10=#879A39"
-            "11=#D0A215"
-            "12=#4385BE"
-            "13=#CE5D97"
-            "14=#3AA99F"
-            "15=#F2F0E5"
-          ];
-          selection-background = "403E3C";
-          selection-foreground = "DAD8CE";
-        };
-      };
-    };
-  };
-  fireproof.base.defaults.terminal = "ghostty";
-}
diff --git a/legacy_modules/apps/obsidian.nix b/legacy_modules/apps/obsidian.nix
deleted file mode 100644
index a205197..0000000
--- a/legacy_modules/apps/obsidian.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.obsidian
-  ];
-}
diff --git a/legacy_modules/apps/slack.nix b/legacy_modules/apps/slack.nix
deleted file mode 100644
index a6d4e69..0000000
--- a/legacy_modules/apps/slack.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.slack
-  ];
-}
diff --git a/legacy_modules/apps/spotify.nix b/legacy_modules/apps/spotify.nix
deleted file mode 100644
index 37b631b..0000000
--- a/legacy_modules/apps/spotify.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  username,
-  pkgs,
-  ...
-}: {
-  environment.systemPackages = with pkgs; [
-    spotify
-  ];
-
-  age.secrets.spotify-player = {
-    rekeyFile = ../../secrets/spotify-player.age;
-    path = "/home/${username}/.cache/spotify-player/credentials.json";
-    mode = "0600";
-    owner = username;
-  };
-
-  fireproof.home-manager = {
-    programs.spotify-player = {
-      enable = true;
-    };
-  };
-}
diff --git a/legacy_modules/apps/sublime-merge.nix b/legacy_modules/apps/sublime-merge.nix
deleted file mode 100644
index e49b840..0000000
--- a/legacy_modules/apps/sublime-merge.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.sublime-merge
-  ];
-}
diff --git a/legacy_modules/apps/vscode.nix b/legacy_modules/apps/vscode.nix
deleted file mode 100644
index 2257b5d..0000000
--- a/legacy_modules/apps/vscode.nix
+++ /dev/null
@@ -1,128 +0,0 @@
-{
-  pkgsUnstable,
-  pkgs,
-  inputs,
-  config,
-  lib,
-  ...
-}: let
-  vscodePackage = pkgsUnstable.vscode;
-
-  vscode-extensions = inputs.nix-vscode-extensions.extensions.${pkgs.system};
-  vscodePkgs = vscode-extensions.vscode-marketplace // vscode-extensions.vscode-marketplace-release; # Prefer release over pre-release
-
-  mkFormatter = formatter: languages: {
-    "[${lib.concatStringsSep "][" languages}]" = {
-      "editor.defaultFormatter" = formatter;
-    };
-  };
-
-  # I can't get nix-vscode-extensions to respect allowUnfree, so this is a workaround
-  allowUnfree = ext: ext.override {meta.license = [];};
-in {
-  fireproof.home-manager = {
-    programs.vscode = {
-      enable = true;
-      package = vscodePackage;
-      profiles.default = {
-        enableUpdateCheck = true;
-        enableExtensionUpdateCheck = true;
-        keybindings = [
-          {
-            "key" = "ctrl+shift+p";
-            "command" = "editor.action.formatDocument";
-          }
-        ];
-        userSettings = lib.mkMerge [
-          {
-            # General
-            "extensions.ignoreRecommendations" = true;
-            "telemetry.telemetryLevel" = "off";
-
-            # Editor
-            "editor.linkedEditing" = true;
-            "files.exclude" = {
-              "**/*.egg-info" = true;
-              "**/__pycache__" = true;
-            };
-            "workbench.editor.wrapTabs" = true;
-
-            # Files
-            "files.autoSave" = "afterDelay";
-
-            # Remote
-            "remote.SSH.useLocalServer" = false;
-            "remote.SSH.remotePlatform" = lib.mapAttrs (_name: _value: "linux") config.fireproof.home-manager.programs.ssh.matchBlocks;
-
-            # AI
-            "github.copilot.enable" = {
-              "*" = true;
-              "plaintext" = true;
-              "markdown" = true;
-              "scminput" = true;
-            };
-            "chat.agent.enabled" = true;
-            "github.copilot.chat.agent.thinkingTool" = true;
-            "github.copilot.chat.codesearch.enabled" = true;
-            "github.copilot.nextEditSuggestions.enabled" = true;
-            "githubPullRequests.codingAgent.uiIntegration" = true;
-            "githubPullRequests.pullBranch" = "always";
-
-            # Theme
-            "workbench.colorTheme" = "Darcula Theme from IntelliJ";
-            "window.titleBarStyle" = "custom";
-            "editor.fontFamily" = "'Hack Nerd Font', 'Hack', 'monospace', monospace";
-
-            # Keybindings
-            "workbench.commandPalette.experimental.suggestCommands" = true; # Emulates IntelliJ's "Search Everywhere"
-
-            # nix-ide
-            "nix.enableLanguageServer" = true;
-            "nix.serverPath" = lib.getExe pkgs.nil;
-            "nix.serverSettings" = {
-              nil.formatting.command = ["nix" "fmt" "--" "--"];
-            };
-
-            # Other extensions
-            "biome.suggestInstallingGlobally" = false;
-          }
-          (mkFormatter "esbenp.prettier-vscode" ["json" "jsonc" "markdown" "css" "scss" "typescript" "typescriptreact" "html" "yaml"])
-          (mkFormatter "charliermarsh.ruff" ["python"])
-        ];
-        extensions = with vscodePkgs; [
-          # Remote
-          (allowUnfree ms-vscode-remote.remote-ssh)
-
-          # AI
-          (allowUnfree github.copilot)
-          (allowUnfree github.copilot-chat)
-
-          # Git(hub)
-          github.vscode-pull-request-github
-
-          # Python
-          ms-pyright.pyright
-          ms-python.python
-          charliermarsh.ruff
-
-          # JavaScript
-          dbaeumer.vscode-eslint
-          esbenp.prettier-vscode
-
-          # Nix
-          jnoortheen.nix-ide
-
-          # Other languages
-          nefrob.vscode-just-syntax
-          redhat.vscode-yaml
-
-          # Theme
-          trinm1709.dracula-theme-from-intellij
-
-          # Keybindings
-          k--kato.intellij-idea-keybindings
-        ];
-      };
-    };
-  };
-}
diff --git a/legacy_modules/apps/zed.nix b/legacy_modules/apps/zed.nix
deleted file mode 100644
index 7f5e53c..0000000
--- a/legacy_modules/apps/zed.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{pkgsUnstable, ...}: {
-  fireproof.home-manager.programs.zed-editor = {
-    enable = true;
-    package = pkgsUnstable.zed-editor;
-    extensions = [
-      "basedpyright"
-      "biome"
-      "css-modules-kit"
-      "dockerfile"
-      "env"
-      "fish"
-      "jetbrains-themes"
-      "just-ls"
-      "mcp-server-linear"
-      "nix"
-    ];
-    userSettings = {
-      base_keymap = "JetBrains";
-      theme = {
-        mode = "dark";
-        light = "JetBrains Light";
-        dark = "JetBrains Dark";
-      };
-      ui_font_family = "Hack Nerd Font";
-      buffer_font_family = "Hack Nerd Font";
-      buffer_font_size = 13;
-      buffer_line_height = "standard";
-    };
-  };
-}
diff --git a/legacy_modules/dev/clickhouse.nix b/legacy_modules/dev/clickhouse.nix
deleted file mode 100644
index 5452840..0000000
--- a/legacy_modules/dev/clickhouse.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.clickhouse
-    pkgsUnstable.envsubst
-  ];
-}
diff --git a/legacy_modules/dev/javascript.nix b/legacy_modules/dev/javascript.nix
deleted file mode 100644
index 9e8a3a3..0000000
--- a/legacy_modules/dev/javascript.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  pkgs,
-  pkgsUnstable,
-  ...
-}: {
-  environment.systemPackages = [
-    pkgs.nodejs
-    pkgsUnstable.pnpm
-    pkgs.turbo-unwrapped
-  ];
-}
diff --git a/legacy_modules/dev/just.nix b/legacy_modules/dev/just.nix
deleted file mode 100644
index d5ff3f0..0000000
--- a/legacy_modules/dev/just.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.just
-  ];
-}
diff --git a/legacy_modules/dev/k8s.nix b/legacy_modules/dev/k8s.nix
deleted file mode 100644
index d908ce3..0000000
--- a/legacy_modules/dev/k8s.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  pkgs,
-  username,
-  config,
-  ...
-}: {
-  environment.systemPackages = [
-    pkgs.kubectl
-  ];
-
-  age.secrets.k8s-ao-dev = {
-    rekeyFile = ../../secrets/k8s/ao-dev.age;
-    path = "/home/${username}/.kube/config.ao-dev";
-    mode = "0600";
-    owner = username;
-  };
-
-  age.secrets.k8s-ao-prod = {
-    rekeyFile = ../../secrets/k8s/ao-prod.age;
-    path = "/home/${username}/.kube/config.ao-prod";
-    mode = "0600";
-    owner = username;
-  };
-
-  fireproof.home-manager = {
-    home.sessionVariables = {
-      KUBECONFIG = "${config.age.secrets.k8s-ao-dev.path}:${config.age.secrets.k8s-ao-prod.path}:$HOME/.kube/config";
-    };
-  };
-}
diff --git a/legacy_modules/dev/nats.nix b/legacy_modules/dev/nats.nix
deleted file mode 100644
index d6dfe10..0000000
--- a/legacy_modules/dev/nats.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.natscli
-  ];
-}
diff --git a/legacy_modules/dev/playwright.nix b/legacy_modules/dev/playwright.nix
deleted file mode 100644
index 675bac6..0000000
--- a/legacy_modules/dev/playwright.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{pkgsUnstable, ...}: {
-  fireproof.home-manager.programs.fish.shellInit = ''
-    set -xg PLAYWRIGHT_BROWSERS_PATH ${pkgsUnstable.playwright-driver.browsers}
-    set -xg PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS true
-  '';
-}
diff --git a/legacy_modules/dev/postgres.nix b/legacy_modules/dev/postgres.nix
deleted file mode 100644
index 49d397e..0000000
--- a/legacy_modules/dev/postgres.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [
-    pkgs.postgresql
-  ];
-}
diff --git a/legacy_modules/dev/tilt.nix b/legacy_modules/dev/tilt.nix
deleted file mode 100644
index d4daa95..0000000
--- a/legacy_modules/dev/tilt.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{pkgsUnstable, ...}: {
-  environment.systemPackages = [
-    pkgsUnstable.tilt
-  ];
-}
diff --git a/legacy_modules/devenv.nix b/legacy_modules/devenv.nix
deleted file mode 100644
index 1b355b5..0000000
--- a/legacy_modules/devenv.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  imports = [
-    ./apps/pycharm.nix
-    ./apps/vscode.nix
-    ./apps/sublime-merge.nix
-    ./dev/python.nix
-    ./dev/javascript.nix
-    ./dev/k8s.nix
-    ./dev/docker.nix
-    ./dev/tilt.nix
-    ./dev/postgres.nix
-    ./dev/clickhouse.nix
-    ./dev/playwright.nix
-    ./dev/nats.nix
-  ];
-}
diff --git a/legacy_modules/graphical.nix b/legacy_modules/graphical.nix
deleted file mode 100644
index 16035d3..0000000
--- a/legacy_modules/graphical.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  imports = [
-    ./apps/spotify.nix
-    ./apps/firefox.nix
-    ./apps/chromium.nix
-    ./apps/zed.nix
-    ./apps/ghostty.nix
-    ./apps/slack.nix
-    ./apps/obsidian.nix
-    ./apps/ferdium.nix
-  ];
-}
diff --git a/modules/desktop/audio.nix b/modules/desktop/audio.nix
index c4b7ac5..be22eea 100644
--- a/modules/desktop/audio.nix
+++ b/modules/desktop/audio.nix
@@ -1,4 +1,8 @@
-{ lib, config, ... }: {
+{
+  lib,
+  config,
+  ...
+}: {
   config = lib.mkIf config.fireproof.desktop.enable {
     security.rtkit.enable = true;
     services.pipewire = {
diff --git a/modules/desktop/niri.nix b/modules/desktop/niri.nix
index eae2735..c80419b 100644
--- a/modules/desktop/niri.nix
+++ b/modules/desktop/niri.nix
@@ -44,7 +44,7 @@ in {
           color: #DAD8CE;
           border-bottom: 2px solid #CF6A4C;
         }
-        
+              
         #workspaces button.focused {
           background: #CF6A4C;
           color: #1C1B1A;
diff --git a/modules/programs/chromium.nix b/modules/programs/chromium.nix
new file mode 100644
index 0000000..ed1ad6c
--- /dev/null
+++ b/modules/programs/chromium.nix
@@ -0,0 +1,18 @@
+# Enabled when: desktop
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.desktop.enable {
+    fireproof.home-manager.programs.chromium = {
+      enable = true;
+      package = pkgsUnstable.chromium;
+      extensions = [
+        "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
+        "nngceckbapebfimnlniiiahkandclblb" # Bitwarden
+      ];
+    };
+  };
+}
diff --git a/modules/programs/clickhouse.nix b/modules/programs/clickhouse.nix
new file mode 100644
index 0000000..bea88bb
--- /dev/null
+++ b/modules/programs/clickhouse.nix
@@ -0,0 +1,14 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgsUnstable.clickhouse
+      pkgsUnstable.envsubst
+    ];
+  };
+}
diff --git a/modules/programs/default.nix b/modules/programs/default.nix
index 1968c11..b863bab 100644
--- a/modules/programs/default.nix
+++ b/modules/programs/default.nix
@@ -1,4 +1,9 @@
-_: {
+{lib, ...}: {
+  options.fireproof = {
+    work.enable = lib.mkEnableOption "Enable work-related applications and tools";
+    dev.enable = lib.mkEnableOption "Enable development tools and applications";
+  };
+
   imports = [
     ./fish/default.nix
     ./claude.nix
@@ -12,5 +17,29 @@ _: {
     ./zoxide.nix
     ./systemd-manager-tui.nix
     ./llm.nix
+
+    # Apps (migrated from legacy_modules/apps)
+    ./chromium.nix
+    ./ferdium.nix
+    ./firefox.nix
+    ./ghostty.nix
+    ./obsidian.nix
+    ./pycharm.nix
+    ./slack.nix
+    ./spotify.nix
+    ./sublime-merge.nix
+    ./vscode.nix
+    ./zed.nix
+
+    # Dev tools (migrated from legacy_modules/dev)
+    ./clickhouse.nix
+    ./docker.nix
+    ./javascript.nix
+    ./k8s.nix
+    ./nats.nix
+    ./playwright.nix
+    ./postgres.nix
+    ./python.nix
+    ./tilt.nix
   ];
 }
diff --git a/legacy_modules/dev/docker.nix b/modules/programs/docker.nix
similarity index 93%
rename from legacy_modules/dev/docker.nix
rename to modules/programs/docker.nix
index 3eb3d6e..6d2df2e 100644
--- a/legacy_modules/dev/docker.nix
+++ b/modules/programs/docker.nix
@@ -1,3 +1,4 @@
+# Enabled when: always
 {
   username,
   pkgs,
diff --git a/modules/programs/ferdium.nix b/modules/programs/ferdium.nix
new file mode 100644
index 0000000..6593733
--- /dev/null
+++ b/modules/programs/ferdium.nix
@@ -0,0 +1,13 @@
+# Enabled when: desktop & work
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.work.enable) {
+    environment.systemPackages = [
+      pkgsUnstable.ferdium
+    ];
+  };
+}
diff --git a/modules/programs/firefox.nix b/modules/programs/firefox.nix
new file mode 100644
index 0000000..fb4b8c6
--- /dev/null
+++ b/modules/programs/firefox.nix
@@ -0,0 +1,67 @@
+# Enabled when: desktop
+{
+  config,
+  lib,
+  pkgsUnstable,
+  inputs,
+  pkgs,
+  ...
+}: let
+  nur = inputs.nur.legacyPackages.${pkgs.system};
+  extensions = nur.repos.rycee.firefox-addons;
+in {
+  config = lib.mkIf config.fireproof.desktop.enable {
+    programs.firefox = {
+      enable = true;
+      package = pkgsUnstable.firefox;
+    };
+
+    xdg.mime.defaultApplications = {
+      "text/html" = "firefox.desktop";
+      "x-scheme-handler/http" = "firefox.desktop";
+      "x-scheme-handler/https" = "firefox.desktop";
+      "x-scheme-handler/about" = "firefox.desktop";
+      "x-scheme-handler/unknown" = "firefox.desktop";
+    };
+
+    fireproof.home-manager = {
+      programs.firefox = {
+        enable = true;
+        package = pkgsUnstable.firefox;
+        profiles.default = {
+          extensions.packages = with extensions; [
+            # Privacy
+            ublock-origin
+            clearurls
+            libredirect
+            smartproxy
+
+            # Security
+            bitwarden
+
+            # Media
+            dearrow
+            sponsorblock
+
+            # Search
+            kagi-search
+
+            # Productivity
+            new-tab-override
+
+            # Social
+            reddit-enhancement-suite
+
+            # Development
+            react-devtools
+            refined-github
+          ];
+
+          settings = {
+            "browser.startup.homepage" = "https://flame.nickolaj.com";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/programs/ghostty.nix b/modules/programs/ghostty.nix
new file mode 100644
index 0000000..f8dfaaa
--- /dev/null
+++ b/modules/programs/ghostty.nix
@@ -0,0 +1,54 @@
+# Enabled when: desktop
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.desktop.enable {
+    environment.systemPackages = with pkgs; [
+      ghostty
+    ];
+    fireproof.home-manager = {
+      programs.ghostty = {
+        enable = true;
+        enableFishIntegration = config.programs.fish.enable;
+        settings = {
+          window-decoration = false;
+          theme = "fireproof";
+          font-size = 11;
+          font-family = "Hack Nerd Font";
+          window-inherit-font-size = false;
+        };
+        themes = {
+          fireproof = {
+            background = "1C1B1A";
+            cursor-color = "DAD8CE";
+            foreground = "DAD8CE";
+            palette = [
+              "0=#100F0F"
+              "1=#AF3029"
+              "2=#66800B"
+              "3=#AD8301"
+              "4=#205EA6"
+              "5=#A02F6F"
+              "6=#24837B"
+              "7=#DAD8CE"
+              "8=#878580"
+              "9=#D14D41"
+              "10=#879A39"
+              "11=#D0A215"
+              "12=#4385BE"
+              "13=#CE5D97"
+              "14=#3AA99F"
+              "15=#F2F0E5"
+            ];
+            selection-background = "403E3C";
+            selection-foreground = "DAD8CE";
+          };
+        };
+      };
+    };
+    fireproof.base.defaults.terminal = "ghostty";
+  };
+}
diff --git a/modules/programs/javascript.nix b/modules/programs/javascript.nix
new file mode 100644
index 0000000..16c112e
--- /dev/null
+++ b/modules/programs/javascript.nix
@@ -0,0 +1,16 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgs,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgs.nodejs
+      pkgsUnstable.pnpm
+      pkgs.turbo-unwrapped
+    ];
+  };
+}
diff --git a/modules/programs/k8s.nix b/modules/programs/k8s.nix
new file mode 100644
index 0000000..120b3bb
--- /dev/null
+++ b/modules/programs/k8s.nix
@@ -0,0 +1,34 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgs.kubectl
+    ];
+
+    age.secrets.k8s-ao-dev = {
+      rekeyFile = ../../secrets/k8s/ao-dev.age;
+      path = "/home/${username}/.kube/config.ao-dev";
+      mode = "0600";
+      owner = username;
+    };
+
+    age.secrets.k8s-ao-prod = {
+      rekeyFile = ../../secrets/k8s/ao-prod.age;
+      path = "/home/${username}/.kube/config.ao-prod";
+      mode = "0600";
+      owner = username;
+    };
+
+    fireproof.home-manager = {
+      home.sessionVariables = {
+        KUBECONFIG = "${config.age.secrets.k8s-ao-dev.path}:${config.age.secrets.k8s-ao-prod.path}:$HOME/.kube/config";
+      };
+    };
+  };
+}
diff --git a/modules/programs/nats.nix b/modules/programs/nats.nix
new file mode 100644
index 0000000..8bdc931
--- /dev/null
+++ b/modules/programs/nats.nix
@@ -0,0 +1,13 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgsUnstable.natscli
+    ];
+  };
+}
diff --git a/modules/programs/obsidian.nix b/modules/programs/obsidian.nix
new file mode 100644
index 0000000..da2a45e
--- /dev/null
+++ b/modules/programs/obsidian.nix
@@ -0,0 +1,13 @@
+# Enabled when: desktop
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.desktop.enable {
+    environment.systemPackages = [
+      pkgsUnstable.obsidian
+    ];
+  };
+}
diff --git a/modules/programs/playwright.nix b/modules/programs/playwright.nix
new file mode 100644
index 0000000..ad82155
--- /dev/null
+++ b/modules/programs/playwright.nix
@@ -0,0 +1,14 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    fireproof.home-manager.programs.fish.shellInit = ''
+      set -xg PLAYWRIGHT_BROWSERS_PATH ${pkgsUnstable.playwright-driver.browsers}
+      set -xg PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS true
+    '';
+  };
+}
diff --git a/modules/programs/postgres.nix b/modules/programs/postgres.nix
new file mode 100644
index 0000000..c59e4ed
--- /dev/null
+++ b/modules/programs/postgres.nix
@@ -0,0 +1,13 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgs.postgresql
+    ];
+  };
+}
diff --git a/legacy_modules/apps/pycharm.nix b/modules/programs/pycharm.nix
similarity index 61%
rename from legacy_modules/apps/pycharm.nix
rename to modules/programs/pycharm.nix
index 5186318..8189023 100644
--- a/legacy_modules/apps/pycharm.nix
+++ b/modules/programs/pycharm.nix
@@ -1,4 +1,10 @@
-{pkgsUnstable, ...}: let
+# Enabled when: desktop & dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: let
   pycharmPkg = pkgsUnstable.jetbrains.pycharm-professional.override {
     # -Dide.browser.jcef.enabled causes crashes on wayland
     vmopts = ''
@@ -11,7 +17,9 @@
   #   "github-copilot"
   # ];
 in {
-  environment.systemPackages = [
-    pycharmPkg
-  ];
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.dev.enable) {
+    environment.systemPackages = [
+      pycharmPkg
+    ];
+  };
 }
diff --git a/legacy_modules/dev/python.nix b/modules/programs/python.nix
similarity index 55%
rename from legacy_modules/dev/python.nix
rename to modules/programs/python.nix
index d9dc724..8418720 100644
--- a/legacy_modules/dev/python.nix
+++ b/modules/programs/python.nix
@@ -1,6 +1,8 @@
+# Enabled when: dev
 {
-  pkgs,
+  config,
   lib,
+  pkgs,
   pkgsUnstable,
   ...
 }: let
@@ -19,17 +21,19 @@
       '';
     };
 in {
-  environment.systemPackages = [
-    (mkWrapLDLibraryPath pkgsUnstable.uv)
-    (mkWrapLDLibraryPath pkgsUnstable.rye)
-    (mkWrapLDLibraryPath pkgs.python3)
-    (mkWrapLDLibraryPath pkgsUnstable.prek)
-  ];
-
-  # uv tool adds executable to $HOME/.local/bin, so add it to PATH
-  fireproof.home-manager = {
-    home.sessionPath = [
-      "$HOME/.local/bin"
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      (mkWrapLDLibraryPath pkgsUnstable.uv)
+      (mkWrapLDLibraryPath pkgsUnstable.rye)
+      (mkWrapLDLibraryPath pkgs.python3)
+      (mkWrapLDLibraryPath pkgsUnstable.prek)
     ];
+
+    # uv tool adds executable to $HOME/.local/bin, so add it to PATH
+    fireproof.home-manager = {
+      home.sessionPath = [
+        "$HOME/.local/bin"
+      ];
+    };
   };
 }
diff --git a/modules/programs/slack.nix b/modules/programs/slack.nix
new file mode 100644
index 0000000..66f8d5e
--- /dev/null
+++ b/modules/programs/slack.nix
@@ -0,0 +1,13 @@
+# Enabled when: desktop & work
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.work.enable) {
+    environment.systemPackages = [
+      pkgsUnstable.slack
+    ];
+  };
+}
diff --git a/modules/programs/spotify.nix b/modules/programs/spotify.nix
new file mode 100644
index 0000000..f8bd46c
--- /dev/null
+++ b/modules/programs/spotify.nix
@@ -0,0 +1,27 @@
+# Enabled when: desktop
+{
+  config,
+  lib,
+  username,
+  pkgs,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.desktop.enable {
+    environment.systemPackages = with pkgs; [
+      spotify
+    ];
+
+    age.secrets.spotify-player = {
+      rekeyFile = ../../secrets/spotify-player.age;
+      path = "/home/${username}/.cache/spotify-player/credentials.json";
+      mode = "0600";
+      owner = username;
+    };
+
+    fireproof.home-manager = {
+      programs.spotify-player = {
+        enable = true;
+      };
+    };
+  };
+}
diff --git a/modules/programs/sublime-merge.nix b/modules/programs/sublime-merge.nix
new file mode 100644
index 0000000..ed61422
--- /dev/null
+++ b/modules/programs/sublime-merge.nix
@@ -0,0 +1,13 @@
+# Enabled when: desktop & dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.dev.enable) {
+    environment.systemPackages = [
+      pkgsUnstable.sublime-merge
+    ];
+  };
+}
diff --git a/modules/programs/tilt.nix b/modules/programs/tilt.nix
new file mode 100644
index 0000000..6445544
--- /dev/null
+++ b/modules/programs/tilt.nix
@@ -0,0 +1,13 @@
+# Enabled when: dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf config.fireproof.dev.enable {
+    environment.systemPackages = [
+      pkgsUnstable.tilt
+    ];
+  };
+}
diff --git a/modules/programs/vscode.nix b/modules/programs/vscode.nix
new file mode 100644
index 0000000..b6f3676
--- /dev/null
+++ b/modules/programs/vscode.nix
@@ -0,0 +1,131 @@
+# Enabled when: desktop & dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  pkgs,
+  inputs,
+  ...
+}: let
+  vscodePackage = pkgsUnstable.vscode;
+
+  vscode-extensions = inputs.nix-vscode-extensions.extensions.${pkgs.system};
+  vscodePkgs = vscode-extensions.vscode-marketplace // vscode-extensions.vscode-marketplace-release; # Prefer release over pre-release
+
+  mkFormatter = formatter: languages: {
+    "[${lib.concatStringsSep "][" languages}]" = {
+      "editor.defaultFormatter" = formatter;
+    };
+  };
+
+  # I can't get nix-vscode-extensions to respect allowUnfree, so this is a workaround
+  allowUnfree = ext: ext.override {meta.license = [];};
+in {
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.dev.enable) {
+    fireproof.home-manager = {
+      programs.vscode = {
+        enable = true;
+        package = vscodePackage;
+        profiles.default = {
+          enableUpdateCheck = true;
+          enableExtensionUpdateCheck = true;
+          keybindings = [
+            {
+              "key" = "ctrl+shift+p";
+              "command" = "editor.action.formatDocument";
+            }
+          ];
+          userSettings = lib.mkMerge [
+            {
+              # General
+              "extensions.ignoreRecommendations" = true;
+              "telemetry.telemetryLevel" = "off";
+
+              # Editor
+              "editor.linkedEditing" = true;
+              "files.exclude" = {
+                "**/*.egg-info" = true;
+                "**/__pycache__" = true;
+              };
+              "workbench.editor.wrapTabs" = true;
+
+              # Files
+              "files.autoSave" = "afterDelay";
+
+              # Remote
+              "remote.SSH.useLocalServer" = false;
+              "remote.SSH.remotePlatform" = lib.mapAttrs (_name: _value: "linux") config.fireproof.home-manager.programs.ssh.matchBlocks;
+
+              # AI
+              "github.copilot.enable" = {
+                "*" = true;
+                "plaintext" = true;
+                "markdown" = true;
+                "scminput" = true;
+              };
+              "chat.agent.enabled" = true;
+              "github.copilot.chat.agent.thinkingTool" = true;
+              "github.copilot.chat.codesearch.enabled" = true;
+              "github.copilot.nextEditSuggestions.enabled" = true;
+              "githubPullRequests.codingAgent.uiIntegration" = true;
+              "githubPullRequests.pullBranch" = "always";
+
+              # Theme
+              "workbench.colorTheme" = "Darcula Theme from IntelliJ";
+              "window.titleBarStyle" = "custom";
+              "editor.fontFamily" = "'Hack Nerd Font', 'Hack', 'monospace', monospace";
+
+              # Keybindings
+              "workbench.commandPalette.experimental.suggestCommands" = true; # Emulates IntelliJ's "Search Everywhere"
+
+              # nix-ide
+              "nix.enableLanguageServer" = true;
+              "nix.serverPath" = lib.getExe pkgs.nil;
+              "nix.serverSettings" = {
+                nil.formatting.command = ["nix" "fmt" "--" "--"];
+              };
+
+              # Other extensions
+              "biome.suggestInstallingGlobally" = false;
+            }
+            (mkFormatter "esbenp.prettier-vscode" ["json" "jsonc" "markdown" "css" "scss" "typescript" "typescriptreact" "html" "yaml"])
+            (mkFormatter "charliermarsh.ruff" ["python"])
+          ];
+          extensions = with vscodePkgs; [
+            # Remote
+            (allowUnfree ms-vscode-remote.remote-ssh)
+
+            # AI
+            (allowUnfree github.copilot)
+            (allowUnfree github.copilot-chat)
+
+            # Git(hub)
+            github.vscode-pull-request-github
+
+            # Python
+            ms-pyright.pyright
+            ms-python.python
+            charliermarsh.ruff
+
+            # JavaScript
+            dbaeumer.vscode-eslint
+            esbenp.prettier-vscode
+
+            # Nix
+            jnoortheen.nix-ide
+
+            # Other languages
+            nefrob.vscode-just-syntax
+            redhat.vscode-yaml
+
+            # Theme
+            trinm1709.dracula-theme-from-intellij
+
+            # Keybindings
+            k--kato.intellij-idea-keybindings
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/modules/programs/zed.nix b/modules/programs/zed.nix
new file mode 100644
index 0000000..3e1206d
--- /dev/null
+++ b/modules/programs/zed.nix
@@ -0,0 +1,38 @@
+# Enabled when: desktop & dev
+{
+  config,
+  lib,
+  pkgsUnstable,
+  ...
+}: {
+  config = lib.mkIf (config.fireproof.desktop.enable && config.fireproof.dev.enable) {
+    fireproof.home-manager.programs.zed-editor = {
+      enable = true;
+      package = pkgsUnstable.zed-editor;
+      extensions = [
+        "basedpyright"
+        "biome"
+        "css-modules-kit"
+        "dockerfile"
+        "env"
+        "fish"
+        "jetbrains-themes"
+        "just-ls"
+        "mcp-server-linear"
+        "nix"
+      ];
+      userSettings = {
+        base_keymap = "JetBrains";
+        theme = {
+          mode = "dark";
+          light = "JetBrains Light";
+          dark = "JetBrains Dark";
+        };
+        ui_font_family = "Hack Nerd Font";
+        buffer_font_family = "Hack Nerd Font";
+        buffer_font_size = 13;
+        buffer_line_height = "standard";
+      };
+    };
+  };
+}