diff --git a/flake.lock b/flake.lock
index a7deef2..7828d1f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -135,11 +135,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1657470464,
-        "narHash": "sha256-eMA+/7XzUJpCuDJZRPc/0OMWA6CNisDLSZh3bFYCybo=",
+        "lastModified": 1659072681,
+        "narHash": "sha256-vvdQHhnJIxrIh8phbJRM/h8GgZBXj7Lc9yK05t52yCg=",
         "owner": "helix-editor",
         "repo": "helix",
-        "rev": "0cb0c306183be94b9d42c3fae22b805850f87584",
+        "rev": "a8b123fe177d8cd7f5a610a0a50c16c9f64069bd",
         "type": "github"
       },
       "original": {
diff --git a/hosts/tkaronto/default.nix b/hosts/tkaronto/default.nix
index bbaaf2b..ddfea82 100644
--- a/hosts/tkaronto/default.nix
+++ b/hosts/tkaronto/default.nix
@@ -4,11 +4,9 @@
   pkgs,
   inputs,
   ...
-}:
-let
+}: let
   byLabel = label: "/dev/disk/by-label/${label}";
-in
-{
+in {
   imports = with inputs;
   with nixos-hardware.nixosModules; [
     nixpkgs.nixosModules.notDetected
@@ -124,20 +122,19 @@ in
         libva
         vulkan-loader
       ];
-      extraPackages32 = with pkgs.pkgsi686Linux;
-        [
-          libvdpau-va-gl
-          vaapiVdpau
-          libva
-          vulkan-loader
-        ];
+      extraPackages32 = with pkgs.pkgsi686Linux; [
+        libvdpau-va-gl
+        vaapiVdpau
+        libva
+        vulkan-loader
+      ];
     };
     pulseaudio = {
       enable = false;
       support32Bit = true;
     };
   };
-  
+
   programs.light.enable = true;
 
   fonts = {
@@ -150,7 +147,14 @@ in
     systemPackages = [pkgs.ntfs3g];
     pathsToLink = ["/share/zsh"];
     persistence."${config.system.persistDir}" = {
-      directories = ["/etc/nixos"];
+      directories = lib.flatten [
+        "/etc/nixos"
+        (
+          lib.optional
+          config.virtualisation.docker.enable
+          ["/var/lib/docker" "/var/lib/containers"]
+        )
+      ];
       files = ["/etc/machine-id"];
     };
   };
@@ -170,6 +174,7 @@ in
   virtualisation = {
     waydroid.enable = false;
     podman.enable = false;
+    docker.enable = true;
     libvirtd.enable = false;
   };
 
diff --git a/modules/base/hm-system-defaults.nix b/modules/base/hm-system-defaults.nix
index 272b0d8..f85b4c4 100644
--- a/modules/base/hm-system-defaults.nix
+++ b/modules/base/hm-system-defaults.nix
@@ -10,6 +10,7 @@
       home.sessionVariables = {inherit (config.environment.sessionVariables) NIX_PATH;};
       xdg.configFile."nix/registry.json".text = config.environment.etc."nix/registry.json".text;
       xdg.configFile."nix/nix.conf".source = config.environment.etc."nix/nix.conf".source;
+      xdg.configFile."nix/netrc".source = config.environment.etc."nix/netrc".source;
     }
   ];
   home-manager.extraSpecialArgs = {inherit inputs;};
diff --git a/modules/base/nix.nix b/modules/base/nix.nix
index f7aae73..72aac6b 100644
--- a/modules/base/nix.nix
+++ b/modules/base/nix.nix
@@ -2,6 +2,7 @@
   pkgs,
   lib,
   inputs,
+  config,
   ...
 }: {
   nix = {
@@ -19,6 +20,7 @@
       fallback = true
       extra-experimental-features = nix-command flakes
       builders-use-substitutes = true
+      netrc-file = /etc/nix/netrc
     '';
     nixPath = ["nixpkgs=${inputs.nixpkgs}" "home-manager=${inputs.home}"];
   };
@@ -28,4 +30,7 @@
     trusted-users = ["root" "@wheel"];
     auto-optimise-store = true;
   };
+  environment.etc."nix/netrc".text = ''
+    machine private-ardanalabs.cachix.org password ${config.environment.sessionVariables.CACHIX_AUTH_TOKEN}
+  '';
 }
diff --git a/pkgs-set/overlays/helix.nix b/pkgs-set/overlays/helix.nix
index 494ac99..41649e6 100644
--- a/pkgs-set/overlays/helix.nix
+++ b/pkgs-set/overlays/helix.nix
@@ -1,3 +1,8 @@
 {inputs}: final: prev: {
-  helix = inputs.helix.packages.${prev.system}.default;
+  helix = inputs.helix.packages.${prev.system}.default.override {
+    includeGrammarIf = grammar:
+      prev.lib.any
+      (name: grammar.name == name)
+      ["toml" "rust" "nix" "protobuf" "yaml" "json" "markdown"];
+  };
 }
diff --git a/pkgs-set/overlays/steam.nix b/pkgs-set/overlays/steam.nix
index caf438b..958ef99 100644
--- a/pkgs-set/overlays/steam.nix
+++ b/pkgs-set/overlays/steam.nix
@@ -1,9 +1,9 @@
 final: prev: {
   steam = prev.steam.override {
     extraLibraries = pkgs: with pkgs; [mimalloc pipewire vulkan-loader wayland wayland-protocols];
-    extraProfile = ''
-      unset VK_ICD_FILENAMES
-      export VK_ICD_FILENAMES="/run/opengl-driver/share/vulkan/icd.d:/run/opengl-driver-32/share/vulkan/icd.d"
-    '';
+    # extraProfile = ''
+    #   unset VK_ICD_FILENAMES
+    #   export VK_ICD_FILENAMES="/run/opengl-driver/share/vulkan/icd.d:/run/opengl-driver-32/share/vulkan/icd.d"
+    # '';
   };
 }
diff --git a/secrets/default.nix b/secrets/default.nix
index 67fea32..304184b 100644
Binary files a/secrets/default.nix and b/secrets/default.nix differ
diff --git a/users/patriot/default.nix b/users/patriot/default.nix
index c3c8565..56707be 100644
--- a/users/patriot/default.nix
+++ b/users/patriot/default.nix
@@ -21,17 +21,23 @@ in {
     isNormalUser = true;
     createHome = true;
     home = "/home/patriot";
-    extraGroups = [
+    extraGroups = l.flatten [
       "wheel"
       "adbusers"
       "dialout"
       "video"
+      (l.optional nixosConfig.virtualisation.docker.enable "docker")
     ];
     shell = pkgs.zsh;
     hashedPassword = "$6$spzqhAyJfhHy$iHgLBlhjGn1l8PnbjJdWTn1GPvcjMqYNKUzdCe/7IrX6sHNgETSr/Nfpdmq9FCXLhrAfwHOd/q/8SvfeIeNX4/";
   };
   environment = {
-    persistence.${config.system.persistDir}.directories = ["/home/patriot/.local/share/Steam"];
+    persistence.${config.system.persistDir}.directories = l.flatten [
+      (lib.optional nixosConfig.programs.steam.enable "/home/patriot/.local/share/Steam")
+      "/home/patriot/.cargo"
+      "/home/patriot/proj"
+      "/home/patriot/games"
+    ];
     systemPackages = [pkgs.qt5.qtwayland];
     shells = with pkgs; [bashInteractive zsh];
   };
@@ -100,7 +106,6 @@ in {
       directories =
         l.flatten [
           "Downloads"
-          "proj"
           # "smos"
           ".wine"
           # ssh / gpg / keys
@@ -109,7 +114,6 @@ in {
           "keys"
           # caches / history stuff
           ".directory_history"
-          ".cargo"
           ".cache"
         ]
         ++ mkPaths ".local/share" [
@@ -179,6 +183,7 @@ in {
           discord-open-asar
           gamescope
           protontricks
+          genymotion
         ];
       shellAliases =
         nixosConfig.environment.shellAliases