diff --git a/hosts/default.nix b/hosts/default.nix
index fdc4bbc..3ed1c6d 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -22,6 +22,9 @@ let
     home-manager.useGlobalPkgs = true; # go brrr, reuse overrides
     home-manager.extraSpecialArgs = { inherit inputs; };
     home-manager.sharedModules = [
+      ({lib, ...}: {
+        nixpkgs = lib.mkForce {}; # ignored when home-manager.useGlobalPkgs
+      })
       inputs.sops-nix.homeManagerModules.sops
       (
         inputs.nix-index-database.homeModules.nix-index
diff --git a/hosts/nixos/nord/configuration.nix b/hosts/nixos/nord/configuration.nix
index 5b1903d..bfde022 100644
--- a/hosts/nixos/nord/configuration.nix
+++ b/hosts/nixos/nord/configuration.nix
@@ -53,6 +53,7 @@
     ../../../profiles/desktop/steam.nix
     ../../../profiles/desktop/retroarch.nix
     ../../../profiles/desktop/flatpak.nix
+    # ../../../profiles/desktop/waydroid.nix
 
     ../../../profiles/known-hosts
     #../../../profiles/domeneshop-dyndns.nix # handled by noximilien
diff --git a/justfile b/justfile
index 220d792..a532745 100644
--- a/justfile
+++ b/justfile
@@ -108,22 +108,39 @@ push $hostname=`just _a_host` cmd=`gum choose test switch boot --header "Select
     set -x; NIX_NO_NOM=1 nixos-rebuild {{cmd}} --flake .#"$hostname" --target-host "root@$target_host" --use-substitutes
   fi
 
-home-build *_:
+home-eval:
   #!/usr/bin/env -S bash -euo pipefail
-  # home-manager build --flake .#nixosConfigurations.$(hostname).config.home-manager.users.$(whoami)
-  nix build .#nixosConfigurations."$(hostname)".config.home-manager.users."$(whoami)".home.activationPackage "${@:1}"
+  hostname="$(hostname)"
+  username="$(whoami)"
+  set -x
+  nix eval --log-format raw .#nixosConfigurations."${hostname}".config.home-manager.users."${username}".home.activationPackage
   # TODO: fallback to .#homeConfigurations.$(whoami) ?
   # TODO: alternative behaviour for system-manager and nix-darwin
 
-home-build-diff: home-build
+home-build *_:
   #!/usr/bin/env -S bash -euo pipefail
-  # nvd diff /home/pbsds/.local/state/home-manager/gcroots/current-home result # python based, slow
-  dix /home/pbsds/.local/state/home-manager/gcroots/current-home result # rust based, fast, nixos-unstable only
+  hostname="$(hostname)"
+  username="$(whoami)"
+  set -x
+  nom build .#nixosConfigurations."${hostname}".config.home-manager.users."${username}".home.activationPackage "${@:1}"
+  # TODO: fallback to .#homeConfigurations.$(whoami) ?
+  # TODO: alternative behaviour for system-manager and nix-darwin
+
+home-build-diff *_: home-build
+  #!/usr/bin/env -S bash -euo pipefail
+  current_home="${XDG_STATE_HOME:-"$HOME/.local/state"}/home-manager/gcroots/current-home"
+  new_home="$(just home-build --print-out-paths "${@:1}")"
+  set -x
+  # nvd diff "$current_home" "$new_home" # python based, slow
+  dix "$current_home" "$new_home" # rust based, fast, nixos-unstable only
 
 home-switch *_:
   #!/usr/bin/env -S bash -euo pipefail
   # home-manager switch --flake .#nixosConfigurations.$(hostname).config.home-manager.users.$(whoami)
-  nix run .#nixosConfigurations."$(hostname)".config.home-manager.users."$(whoami)".home.activationPackage "${@:1}"
+  new_home="$(just home-build --print-out-paths "${@:1}")"
+  set -x
+  # ./result/activate
+  "$new_home"/activate
 
 # test-files $hostname=`just _a_host` *filenames:
 #   #!/usr/bin/env -S bash -euo pipefail
diff --git a/profiles/base/default.nix b/profiles/base/default.nix
index 94b3cb3..49c9b13 100644
--- a/profiles/base/default.nix
+++ b/profiles/base/default.nix
@@ -84,8 +84,10 @@
   #networking.networkmanager.wifi.backend = "iwd"; # default is wpa_supplicant, iwd doesn't support eduroam
   networking.firewall.logRefusedConnections = false; # too spammy, rotates dmesg too quickly
 
+  # nixos-rebuild switch --specialisation no-firewall
   specialisation.no-firewall.configuration = {
     networking.firewall.enable = false;
+    services.fail2ban.enable = false; # requires firewall
   };
 
   security.sudo.execWheelOnly = true;
diff --git a/profiles/desktop/default.nix b/profiles/desktop/default.nix
index 4ad5eb2..9260beb 100644
--- a/profiles/desktop/default.nix
+++ b/profiles/desktop/default.nix
@@ -1,10 +1,20 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
 
-  /* programs.firefox.enable = true; */
+  # invasive as fuck
+  # https://github.com/NixOS/nixpkgs/blob/89c2b2330e733d6cdb5eae7b899326930c2c0648/nixos/modules/programs/firefox.nix#L13-L20
+  # programs.firefox.enable = true;
 
-  environment.systemPackages = with pkgs; [
-    gparted
+  environment.systemPackages = [
+    # instead of programs.firefox.enable
+    (if !config.services.gnome.gnome-browser-connector.enable
+      then pkgs.firefox
+      else pkgs.firefox.override {
+          nativeMessagingHosts = [ pkgs.gnome-browser-connector ];
+        }
+    )
+
+    pkgs.gparted
   ];
 
   # used by gparted?
diff --git a/profiles/desktop/gnome/default.nix b/profiles/desktop/gnome/default.nix
index 93ead74..3a54bec 100644
--- a/profiles/desktop/gnome/default.nix
+++ b/profiles/desktop/gnome/default.nix
@@ -1,55 +1,84 @@
-{ config, pkgs, ... }:
-{
+{ config, lib, pkgs, ... }:
+lib.mkMerge [
+/*
+
+https://wiki.nixos.org/wiki/GNOME
+
+*/
+
+
+(lib.optionalAttrs (lib.versionOlder lib.version "25.11") {
   services.xserver.enable = true;
   services.xserver.displayManager.gdm.enable = true;
   services.xserver.displayManager.gdm.wayland = true;
   services.xserver.desktopManager.gnome.enable = true;
+})
+(lib.optionalAttrs (lib.versionAtLeast lib.version "25.11") {
+  services.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
+})
+
+{
+  # services.xserver.enable = true;
+  # services.xserver.displayManager.gdm.enable = true;
+  # services.xserver.displayManager.gdm.wayland = true;
+  # services.xserver.desktopManager.gnome.enable = true;
+
   #services.printing.enable = true; # CUPS, done in printing.nix
   programs.xwayland.enable = true;
   xdg.portal.enable = true;
 
+  qt.enable = true;
+  qt.platformTheme = "gnome";
+  qt.style = "adwaita-dark";
+
+  # support GConf-based applications
+  # services.dbus.packages = [ pkgs.gnome2.GConf ];
+
+  # Enable system tray icons (will also require the appindicator gnome-extension)
+  # environment.systemPackages = [ pkgs.gnomeExtensions.appindicator  ];
   services.udev.packages = [
     (pkgs.gnome-settings-daemon or pkgs.gnome.gnome-settings-daemon)
   ];
 
+  # programs.dconf.profiles.user.databases = [
+  #   {
+  #     settings."org/gnome/mutter".experimental-features = [
+  #       # "scale-monitor-framebuffer" # Enables fractional scaling (125% 150% 175%)
+  #       # "variable-refresh-rate" # Enables Variable Refresh Rate (VRR) on compatible displays
+  #       # "xwayland-native-scaling" # Scales Xwayland applications to look crisp on HiDPI screens
+  #     ];
+  #   }
+  # ];
+
   programs.gnome-terminal.enable = false;
 
   services.tumbler.enable = true; # TODO: needed when we have ffmpegthumbnailer?
-  services.gnome.sushi.enable = true;
-  services.gnome.gnome-online-accounts.enable = true;
+  services.gnome.sushi.enable = true; # quick previewer for nautilus
+  # services.gnome.gnome-online-accounts.enable = true; # Gnome SSO service
 
+  # for managing gnome extensions with firefox, assumes programs.firefox.enable
   services.gnome.gnome-browser-connector.enable  = true;
 
-  /* programs.firefox.enable = true; # spooky? */
-  #nixpkgs.overlays = [(final: prev: {
-  #  firefox = prev.firefox.override {
-  #    # Gnome shell native connector
-  #    cfg.enableGnomeExtensions = true;
-  #    # ^ should also be enabled by `programs.firefox.enable` +
-  #    # `programs.firefox.enableGnomeExtensions` in hm, but it is kinda spooky
-  #  };
-  #})];
-  nixpkgs.config.firefox.enableGnomeExtensions = true;
-
-  environment.systemPackages = with pkgs; [
-    firefox
-    pavucontrol
-    lxterminal # TODO: remove?
-    ghostty
+  environment.systemPackages = [
+    pkgs.pavucontrol
+    pkgs.lxterminal # TODO: remove?
+    pkgs.ghostty
     (pkgs.gnome-tweaks or pkgs.gnome.gnome-tweaks)
+    pkgs.refine # Tweak various aspects of GNOME
     # TODO: shadow gnome-terminal
-    ffmpegthumbnailer
-    libheif # HEIF thumbnails
-    gnomeExtensions.appindicator
+    pkgs.ffmpegthumbnailer
+    pkgs.libheif # HEIF thumbnails
+    pkgs.gnomeExtensions.appindicator
 
-    decibels
-    dconf-editor
+    pkgs.decibels
+    pkgs.dconf-editor
 
-    loupe
-    gnome-clocks
-    shotwell # image editor
+    pkgs.loupe
+    pkgs.gnome-clocks
+    pkgs.shotwell # image editor
 
-    desktop-file-utils # update-desktop-database
+    pkgs.desktop-file-utils # update-desktop-database
   ];
 
   # an attempt to make nautilus discover new files, but it proved to be a freebsd-linux incompatiblity
@@ -85,3 +114,5 @@
     (pkgs.atomix or pkgs.gnome.atomix) # puzzle game
   ];
 }
+
+]
diff --git a/profiles/desktop/waydroid.nix b/profiles/desktop/waydroid.nix
index abc9169..9ea900c 100644
--- a/profiles/desktop/waydroid.nix
+++ b/profiles/desktop/waydroid.nix
@@ -1,3 +1,59 @@
+{ pkgs, ... }:
+/*
+  = setup: =
+
+  $ sudo waydroid init
+  $ sudo waydroid init -S GAPPS -f
+
+  $ sudo systemctl start waydroid-container
+  $ sudo journalctl -u waydroid-container -e
+
+  $ waydroid session start
+
+  = maintanance: =
+
+  $ sudo waydroid upgrade
+
+  = wipe: =
+
+  $ sudo systemctl stop waydroid-container
+  $ sudo rm -r /var/lib/waydroid/* ~/.local/share/waydroid
+*/
 {
-    virtualisation.waydroid.enable = true;
+  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/virtualisation/waydroid.nix
+  virtualisation.waydroid.enable = true; # will enable virtualisation.lxc.enable
+  environment.systemPackages = [ pkgs.wl-clipboard-timeout ];
+  # environment.systemPackages = [ (pkgs.wl-clipboard-timeout or pkgs.wl-clipboard) ];
+
+  # https://wiki.nixos.org/wiki/Waydroid
+
+  /** /
+  # waydroid-helper GUI:
+  environment.systemPackages = [ pkgs.waydroid-helper ];
+  systemd.packages = [ pkgs.waydroid-helper ];
+  systemd.services.waydroid-mount.wantedBy = [ "multi-user.target" ];
+  # required at runtime:
+  # $ systemctl --user start waydroid-monitor
+  # TODO: one of
+  # systemd.user.targets.multi-user.wants = [ "multi-user.target" ];
+  # systemd.user.services.waydroid-monitor.wantedBy = [ "waydroid-monitor.service" ];
+  /**/
+
+
+  # https://github.com/SCLorentz/NixOS-config/blob/abf4eefd8d8797878b3620faedfcdb3db696e7aa/modules/android.nix
+
+  systemd.services."waydroid-set-props" = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "waydroid-container.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      # https://docs.waydro.id/usage/waydroid-prop-options
+      ExecStart = pkgs.writeShellScript "set-waydroid-props" ''
+          	  	${pkgs.waydroid}/bin/waydroid prop set persist.waydroid.multi_windows true
+          	  	# ${pkgs.waydroid}/bin/waydroid prop set persist.waydroid.reverse_scrolling true
+          	  	${pkgs.waydroid}/bin/waydroid prop set persist.sys.nativebridge 1
+          	  	${pkgs.waydroid}/bin/waydroid prop set ro.hardware ranchu
+        	  	'';
+    };
+  };
 }
diff --git a/todos.md b/todos.md
index 8bd4e84..7e3b9c8 100644
--- a/todos.md
+++ b/todos.md
@@ -101,11 +101,15 @@
 * [ ] [gpg](https://github.com/jakehamilton/config/blob/579827c699d9c78bd42e73f543eafb05a0d6c374/modules/security/gpg/default.nix)
 * [ ] [keyring](https://github.com/jakehamilton/config/blob/579827c699d9c78bd42e73f543eafb05a0d6c374/modules/security/keyring/default.nix)
 # home/pbsds
+* [ ] kdf-connect?
+  * https://github.com/GSConnect/gnome-shell-extension-gsconnect
+  * https://userbase.kde.org/KDEConnect
 * [ ] wrap windowmanager in nixGL on non-nixos https://github.com/dali99/nix-dotfiles/blob/85dcafb4e0b8382a3d04b9a5f63afd01a4144143/profiles/xsession/default.nix#LL138C1-L138C1
   * [ ] requires GNOME xstart in home-manager
   * [ ] https://github.com/dali99/nix-dotfiles/blob/85dcafb4e0b8382a3d04b9a5f63afd01a4144143/machines/pvv-terminal.nix#L3
 * [ ] users/pbsds: Support multiple profiles, like headless, nixpkgs-dev, various desktops, hpc, pvv, etc
 * [x] lxterminal
+* [x] ghostty
 * [ ] replace gnome terminal
 * [x] themes
 * [x] shortcuts
diff --git a/users/pbsds/default.nix b/users/pbsds/default.nix
index b7659b1..626b57d 100644
--- a/users/pbsds/default.nix
+++ b/users/pbsds/default.nix
@@ -21,6 +21,9 @@
   programs.bash.shellAliases."ed" = "\${EDITOR:-micro}";
   environment.variables."EDITOR"  = "micro";
 
+  # autologin:
+  # services.displayManager.autoLogin.enable  = true;
+  # services.displayManager.autoLogin.user = "pbsds";
 
   # user and home-manager
 
diff --git a/users/pbsds/home/profiles/bashrc.d/adb-tailscale-connect.sh b/users/pbsds/home/profiles/bashrc.d/adb-tailscale-connect.sh
index 42cbb68..6dcd4bf 100644
--- a/users/pbsds/home/profiles/bashrc.d/adb-tailscale-connect.sh
+++ b/users/pbsds/home/profiles/bashrc.d/adb-tailscale-connect.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+if command -v adb >/dev/null; then
+
 # problem:
 adb-tailscale-connect() {
   if ! command -v adb >/dev/null; then
@@ -42,3 +44,5 @@ adb-tailscale-connect() {
     fi
   )
 }
+
+fi
diff --git a/users/pbsds/home/profiles/desktop/default.nix b/users/pbsds/home/profiles/desktop/default.nix
index b234254..368a635 100644
--- a/users/pbsds/home/profiles/desktop/default.nix
+++ b/users/pbsds/home/profiles/desktop/default.nix
@@ -65,7 +65,7 @@
     vlc
 
     f3d
-    firefox
+    # firefox # we assume the host has this
     zotero
     (pkgs.loupe or pkgs.gnome.eog)
     papers
@@ -84,7 +84,9 @@
     zoom-us
   ];
 
-  /* programs.firefox.enable = true; */
+  # programs.firefox.enable = true; # likely also very invasive, we assume the host has firefox
+  home.sessionVariables.MOZ_ENABLE_WAYLAND = "1";
+  home.sessionVariables.MOZ_USE_XINPUT2 = "1"; # smooth scrolling
 
   home.shellAliases.eog = lib.mkIf (pkgs?loupe) "loupe";
 
diff --git a/users/pbsds/home/profiles/desktop/ghostty/default.nix b/users/pbsds/home/profiles/desktop/ghostty/default.nix
index fe9d9ae..5e36b37 100644
--- a/users/pbsds/home/profiles/desktop/ghostty/default.nix
+++ b/users/pbsds/home/profiles/desktop/ghostty/default.nix
@@ -4,9 +4,10 @@
   home.file.".config/ghostty/config".source = ./ghosty.config;
   home.file.".config/ghostty/config".force = true;
 
-  dconf.settings."org/gnome/desktop/default-applications/terminal" = {
-    /* exec = lib.getExe pkgs.ghostty; */
+  # dconf.settings."org/gnome/desktop/default-applications/terminal" = {
+  dconf.settings."org/gnome/desktop/default/applications/terminal" = {
+    # exec = lib.getExe pkgs.ghostty;
     exec = "ghostty";
-    exec-arg = "-e";
+    # exec-arg = "-e";
   };
 }
diff --git a/users/pbsds/home/profiles/desktop/mime.nix b/users/pbsds/home/profiles/desktop/mime.nix
index 9060b9f..cee0886 100644
--- a/users/pbsds/home/profiles/desktop/mime.nix
+++ b/users/pbsds/home/profiles/desktop/mime.nix
@@ -97,19 +97,30 @@ let
       wine-ini = "application/x-wine-extension-ini";
       ics = "text/calendar";
     };
+
+    vtty = {
+      x-terminal-emulator-1 = "application/x-terminal-emulator";
+      x-terminal-emulator-2 = "x-terminal-emulator";
+      x-terminal-emulator-3 = "x-scheme-handler/terminal";
+    };
   };
 
   # Applications
   app-map = {
+    # ls ~/.nix-profile/share/applications/
+    # ls ~/.local/share/applications/
+    # ls /run/current-system/sw/share/applications/
+    # ls /usr/share/applications/
     image = ["org.gnome.Loupe.desktop" "org.gnome.eog.desktop"];
     audio = ["mpv.desktop" "vlc.desktop" "ZXTune.desktop"];
-    video = ["mpv.desktop"];
+    video = ["mpv.desktop" "vlc.desktop"];
     fonts = ["org.gnome.font-viewer.desktop"];
     docs = ["org.gnome.Papers.desktop" "org.gnome.Evince.desktop"];
     web = ["firefox.desktop"];
-    /* code = ["Pulsar.desktop"]; */
-    /* code = ["micro.desktop"]; */
+    # code = ["Pulsar.desktop"];
+    # code = ["micro.desktop"];
     code = ["dev.zed.Zed.desktop"];
+    vtty = ["com.mitchellh.ghostty.desktop" "lxterminal.desktop"];
   };
 in {
   xdg.configFile."mimeapps.list".force = true;
diff --git a/users/pbsds/home/profiles/desktop/zed/default.nix b/users/pbsds/home/profiles/desktop/zed/default.nix
index 28612a7..d4f8b7c 100644
--- a/users/pbsds/home/profiles/desktop/zed/default.nix
+++ b/users/pbsds/home/profiles/desktop/zed/default.nix
@@ -18,6 +18,7 @@
     Service.ExecStart = toString (
       # TODO: do I want to clone it if missing? Requires git keys, I should clone on OnActiveSec
       pkgs.writers.writeBash "update-zed-config" { } ''
+        set -euo pipefail
         PATH="${lib.makeBinPath [ pkgs.git ]}''${PATH:+":$PATH"}"
         if [[ -e "$HOME"/.config/zed/.git ]]; then
           cd "$HOME"/.config/zed/
diff --git a/users/pbsds/home/profiles/shell.nix b/users/pbsds/home/profiles/shell.nix
index 812f50d..5c01089 100644
--- a/users/pbsds/home/profiles/shell.nix
+++ b/users/pbsds/home/profiles/shell.nix
@@ -207,6 +207,7 @@ in
     wget
 
     wakeonlan
+    android-tools # adb
 
     #tldr
     stress # brrr