diff --git a/secrets/develMobi.key.pub b/secrets/develMobi.key.pub
new file mode 100644
index 0000000..f2bf466
--- /dev/null
+++ b/secrets/develMobi.key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUIHFy8lBU8Iy5253Lglw0v67k9ozxjLWprjTjwTsrm dusk@devel.mobi
diff --git a/secrets/develMobiNetbirdClientKey.age b/secrets/develMobiNetbirdClientKey.age
new file mode 100644
index 0000000000000000000000000000000000000000..c607fac2e3cbf0975b56d4175cd39e14f2f0df85
GIT binary patch
literal 960
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zOv)`wOy?@93i0&L^D)u)
zO^FEgNH23T^Dy%&$xq9+%uCBj%!(+8Oe?8KHq9wb^v`n53<_{{3Jj=nGjh~VE_N*U
zPx0U~P08@hGD|i{HV-N;s`ATC3l0v__AboLEcbCrEB6m@^Dc5W&CM+KjBtx|P1KIC
z^z_b+EHVg5&B;qmbIVWXa?kh5%y4!x%+b$HvB)zH2{5xX^0hQiHMb1WcJ@wn4lH)^
ztu(JNv@lF^wybjW3`ovQH!Jrk)_2R#EGw`m=Ss^=4)IJb$aYWnE%YuiC@b;L_VmcC
zO4H9O_BQqnH8iL&FEA_%Ow*6Z&9O|%^GeQ5F)S@I3eEM-wlK}jFz2!~%*ZVY({{<y
zxA4#O_cwR*N-E9v3eI!MEw$9Q$jVKuOfPpf%Sg)c4T>lXa8J$lOAd|7aCgei2?^CN
zH?HE+PV;vvDamyTDhmuO^0SOciZV{lFe>#mElM`BaCQ$)E-6b1GtDtA&j|I(@e3{r
zt2FS=vIzIAa87bI4X-NZ%Jelgt1v6iD^E0VtMK#7Oew4^405zIa?SR1tjZ{?u<-LO
zE>DUyNlGuwD2O!AD0C|eDKqwWDJl#qwQwv6=5p6IGb|_!EeLiB&v7$K3rP<#4Yu$v
z(>C?ZGW9G<^UwA&%+IJy&nk8*^VF{jD~m`mb`Np)@dykxE-7;|%j0q~NQ!jH%SpFP
zGb_qYa`p6$%n1%mPY?6+^$d3NwG1}Q4=*tFH?0WBDt7fOFN^dp%<<LE4NTQfj12M)
zwanluFmcaLPxVc#O7rt7a`iO!G6^oIEOc`;tnkQmHY%zt&#rPa$gj-ucPtJrG`IBE
z&M?R<%}6Z?3~_P}b`MJA%GY*I@d$AZOUX0LGW2%x3(615OfK~?DRfCT3o;6|$jyzi
z^fz@gHFfiZrQ_5TBU4jDON9V~l-zJfh4j*5KO>*AlFUq(5bvUllG60js<eE=jQq5+
zToW_Pv?|~5Ji|1<itvzhuJEE%$EwWK96y&-{Sc4x0?S}CH+>JEEDLit!>};dh`a*l
zs*sGTNK=1DE?r$+g;Y<&ijcsRQ2$czVh<lv^Y9YKitxg8(@KBG{Is0Fk}wy4&y<v^
zz`)8#F5Qb8-k5E;<jA<iaPEiCbJJGZ&My9X`)81&x48AOn%LcpOD;8<gfVPVkeS0@
eapw`2#i8Sy7H`$Np7D3xtt)LdIhQZoOauTXt4v1#

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index f6425e8..f4ddb7a 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,6 +1,7 @@
 let
   yusdacra = builtins.readFile ./yusdacra.key.pub;
   wolumonde = builtins.readFile ./wolumonde.key.pub;
+  develMobi = builtins.readFile ./develMobi.key.pub;
 in
 {
   "bernbotToken.age".publicKeys = [
@@ -69,4 +70,8 @@ in
     yusdacra
     wolumonde
   ];
+  "develMobiNetbirdClientKey.age".publicKeys = [
+    yusdacra
+    develMobi
+  ];
 }
diff --git a/users/dusk@devel.mobi/default.nix b/users/dusk@devel.mobi/default.nix
index cf790f4..bd7ac91 100644
--- a/users/dusk@devel.mobi/default.nix
+++ b/users/dusk@devel.mobi/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   lib,
   tlib,
@@ -22,6 +23,7 @@ in
           "fzf"
           "direnv"
           "nushell"
+          "netbird"
         ]
         # dev stuff
         [
@@ -32,20 +34,41 @@ in
       ];
     in
     l.flatten [
+      inputs.agenix.homeManagerModules.default
       ../../modules/persist/null.nix
       (tlib.prefixStrings "${inputs.self}/users/modules/" modulesToEnable)
     ];
 
+  age.identityPaths = ["${config.home.homeDirectory}/.ssh/id_ed25519"];
   home = {
     homeDirectory = "/home/dusk";
     username = "dusk";
     stateVersion = "25.11";
-    # file.".ssh/authorized_keys".text = ''
-    #   ${signKeyText}
-    # '';
+    # shell
+    shell.enableShellIntegration = true;
+    shellAliases = {
+      ctl = "systemctl --user";
+      jtl = "journalctl --user";
+      jtlu = "journalctl --user --unit";
+    };
+  };
+
+  age.secrets.netbirdClientKey = {
+    file = ../../secrets/develMobiNetbirdClientKey.age;
+    mode = "600";
+  };
+  services.netbird = {
+    enable = true;
+    managementUrl = "https://bird.gaze.systems";
+    setupKeyFile = config.age.secrets.netbirdClientKey.path;
   };
 
   programs = {
+    bash = {
+      enable = true;
+      enableCompletion = true;
+    };
+    tealdeer.enable = true;
     git = {
       userName = name;
       userEmail = email;
@@ -56,8 +79,4 @@ in
       };
     };
   };
-
-  services.podman = {
-    enable = true;
-  };
 }
diff --git a/users/modules/netbird/default.nix b/users/modules/netbird/default.nix
new file mode 100644
index 0000000..7aead73
--- /dev/null
+++ b/users/modules/netbird/default.nix
@@ -0,0 +1,72 @@
+{lib, config, pkgs, ...}: let
+  l = lib;
+  t = l.types;
+  cfg = config.services.netbird;
+  wrapped = pkgs.writers.writeBashBin "netbird" ''
+    ${pkgs.netbird}/bin/netbird \
+      --daemon-addr "unix://netbird.sock" \
+      --config "${config.xdg.configHome}/netbird/config.json" $@
+  '';
+  proxychainsCfg = pkgs.writers.writeText "proxychains.conf" ''
+    proxy_dns
+    quiet_mode
+    [ProxyList]
+    socks5 127.0.0.1 1080
+  '';
+  wrappedProxychains = pkgs.writers.writeBashBin "netbird-proxychains" ''
+    ${pkgs.proxychains-ng}/bin/proxychains4 \
+      -f "${proxychainsCfg}" \
+      $@
+  '';
+in {
+  options = {
+    services.netbird = {
+      enable = l.mkEnableOption "netbird client";
+      managementUrl = l.mkOption {
+        type = t.str;
+        default = "https://api.netbird.cloud";
+        description = "NetBird management URL";
+      };
+      setupKeyFile = l.mkOption {
+        type = t.str;
+        description = "Path to the setup key file";
+      };
+      proxyScript = l.mkOption {
+        type = t.package;
+        description = "path to a script that uses proxychains to proxy traffic";
+        readOnly = true;
+      };
+    };
+  };
+  config = l.mkIf cfg.enable {
+    home.packages = [ wrapped wrappedProxychains ];
+    services.netbird.proxyScript = wrappedProxychains;
+    systemd.user.services.netbird = {
+      Unit = {
+        Description = "NetBird Client";
+        After = [ "network.target" ];
+      };
+
+      Service = {
+        ExecStart = "${pkgs.netbird}/bin/netbird up -F";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        Environment = l.mapAttrsToList (k: v: "${k}=${toString v}") {
+          PATH = "${pkgs.coreutils}/bin:$PATH";
+          NB_WG_KERNEL_DISABLE = "true";
+          NB_USE_NETSTACK_MODE = "true";
+          NB_ENABLE_NETSTACK_LOCAL_FORWARDING = "true";
+          NB_NETSTACK_SKIP_PROXY = "false";
+          NB_SOCKS5_LISTENER_PORT = 1080;
+          NB_DISABLE_DNS = "false";
+          NB_SETUP_KEY_FILE = l.replaceString "\${XDG_RUNTIME_DIR}" "%t" cfg.setupKeyFile;
+          NB_MANAGEMENT_URL = cfg.managementUrl;
+          NB_CONFIG = "${config.xdg.configHome}/netbird/config.json";
+          NB_DAEMON_ADDR = "unix://%t/netbird.sock";
+        };
+      };
+
+      Install.WantedBy = [ "network.target" ];
+    };
+  };
+}