diff --git a/modules/_home/default.nix b/modules/_home/default.nix
index 5ba328b..f516112 100644
--- a/modules/_home/default.nix
+++ b/modules/_home/default.nix
@@ -8,7 +8,6 @@ in {
     kitty
     claude-code
     mpv
-    obsidian
   ];
 
   # Symlinks in ~/.jdks/ - path scanned by IntelliJ on Linux by default
diff --git a/modules/_home/niri.nix b/modules/_home/niri.nix
index ef309d0..7dd6123 100644
--- a/modules/_home/niri.nix
+++ b/modules/_home/niri.nix
@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 let
-  wallpaper = "${../../wallpapers/astronaut.png}";
+  wallpaper = "${config.home.homeDirectory}/repos/nixos/wallpapers/astronaut.png";
 in {
   services.swayidle = {
     enable = true;
@@ -69,6 +69,7 @@ in {
     text = ''
       #!/usr/bin/env bash
       swww-daemon &
+      sleep 0.5
       swww img "${wallpaper}" --transition-type none
     '';
   };
diff --git a/modules/_home/theme.nix b/modules/_home/theme.nix
index c5afbd1..9750acc 100644
--- a/modules/_home/theme.nix
+++ b/modules/_home/theme.nix
@@ -16,6 +16,11 @@
       name = "Gruvbox-Plus-Dark";
       package = pkgs.gruvbox-plus-icons;
     };
+    cursorTheme = {
+      name = "Bibata-Modern-Ice";
+      package = pkgs.bibata-cursors;
+      size = 24;
+    };
   };
 
   qt = {
diff --git a/modules/core.nix b/modules/core.nix
index 3c60281..b812945 100644
--- a/modules/core.nix
+++ b/modules/core.nix
@@ -23,7 +23,10 @@
       memoryPercent = 300;
     };
 
-    services.xserver.enable = false;
+    services.xserver = {
+      enable = false;
+      xkb.layout = "en";
+    };
 
     environment.systemPackages = with pkgs; [
       curl
@@ -34,6 +37,7 @@
       unrar
       p7zip
       nvd
+      obsidian
     ]; 
 
     networking.networkmanager.enable = true;
diff --git a/modules/den.nix b/modules/den.nix
index faf9bf8..5ab8526 100644
--- a/modules/den.nix
+++ b/modules/den.nix
@@ -26,10 +26,8 @@ in {
     includes = [
       den.provides.hostname
       den.aspects.core
-      den.aspects.services
       den.aspects.wayland
       den.aspects.niri
-      den.aspects.portable
       den.aspects.notebook-specific
       den.aspects.dev
       den.aspects.creative
@@ -44,10 +42,8 @@ in {
     includes = [
       den.provides.hostname
       den.aspects.core
-      den.aspects.services
       den.aspects.wayland
       den.aspects.niri
-      den.aspects.portable
       den.aspects.work-specific
       den.aspects.secrets
       den.aspects.dev
@@ -61,7 +57,6 @@ in {
     includes = [
       den.provides.hostname
       den.aspects.core
-      den.aspects.services
       den.aspects.wayland
       den.aspects.niri
       den.aspects.desktop-specific
@@ -97,6 +92,7 @@ in {
         backupFileExtension  = "backup";
         extraSpecialArgs = { inherit inputs identity; };
       };
+      security.sudo.wheelNeedsPassword = false;
     };
     homeManager = {
       imports = [
diff --git a/modules/desktop.nix b/modules/desktop.nix
index 0363d86..38ef7d6 100644
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -28,8 +28,6 @@
       };
     };
 
-    security.sudo.wheelNeedsPassword = false;
-
     services.xserver.videoDrivers = [ "nvidia" ];
 
     boot = {
diff --git a/modules/dev.nix b/modules/dev.nix
index 350452e..477b3e9 100644
--- a/modules/dev.nix
+++ b/modules/dev.nix
@@ -5,7 +5,7 @@ in {
   den.aspects.dev.nixos = { pkgs, ... }:
   let
     pkgs-unstable = import inputs.nixpkgs-unstable {
-      system = pkgs.stdenv.hostPlatform.system;
+      system = pkgs.system;
       config.allowUnfree = true;
     };
   in {
@@ -24,7 +24,6 @@ in {
 
       # Infrastructure
       docker-compose
-      jq
 
       # IDE
       jetbrains.idea
@@ -68,6 +67,23 @@ in {
       JAVA_HOME = "${pkgs-unstable.openjdk8}";
     };
 
+    systemd.tmpfiles.rules = [
+      "d /var/lib/payara41 0755 ${username} users -"
+    ];
+
+    system.activationScripts.payaraJava = ''
+      asenv=/var/lib/payara41/glassfish/config/asenv.conf
+      if [ -f "$asenv" ]; then
+        ${pkgs.gnused}/bin/sed -i '/^AS_JAVA=/d' "$asenv"
+        echo 'AS_JAVA="${pkgs-unstable.openjdk8}"' >> "$asenv"
+      fi
+
+      domain_xml=/var/lib/payara41/glassfish/domains/domain1/config/domain.xml
+      if [ -f "$domain_xml" ]; then
+        ${pkgs.gnused}/bin/sed -i 's|java-home="[^"]*"|java-home="${pkgs-unstable.openjdk8}/lib/openjdk"|' "$domain_xml"
+      fi
+    '';
+
     virtualisation.docker.enable = true;
     users.users.${username}.extraGroups = [ "docker" ];
   };
diff --git a/modules/notebook.nix b/modules/notebook.nix
index 6b90a5a..c4f9064 100644
--- a/modules/notebook.nix
+++ b/modules/notebook.nix
@@ -1,4 +1,4 @@
-{ den, inputs, ... }: {
+{ den, inputs, lib, ... }: {
   den.aspects.notebook-specific.nixos = { pkgs, ... }: {
     imports = [
       ./_hardware/notebook-hardware.nix
@@ -11,7 +11,24 @@
       enable32Bit = true;
     };
 
+    security.sudo.wheelNeedsPassword = lib.mkForce true;
+
+    networking.firewall = {
+      enable          = true;
+      allowedTCPPorts = [];
+      allowedUDPPorts = [];
+    };
+
     services.thermald.enable = true;
+    powerManagement.enable   = true;
+
+    services.tlp = {
+      enable   = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC  = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+      };
+    };
 
     boot = {
       initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
diff --git a/modules/portable.nix b/modules/portable.nix
deleted file mode 100644
index d004034..0000000
--- a/modules/portable.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ den, lib, ... }: {
-  den.aspects.portable.nixos = {
-    security.sudo.wheelNeedsPassword = lib.mkForce true;
-
-    networking.firewall.enable = true;
-
-    powerManagement.enable = true;
-
-    services.tlp = {
-      enable   = true;
-      settings = {
-        CPU_SCALING_GOVERNOR_ON_AC  = "performance";
-        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
-      };
-    };
-  };
-}
diff --git a/modules/services.nix b/modules/services.nix
index da94b56..7ca5f8f 100644
--- a/modules/services.nix
+++ b/modules/services.nix
@@ -1,5 +1,5 @@
 { den, ... }: {
-  den.aspects.services.nixos = {
+  den.aspects.core.nixos = { pkgs, ... }: {
     services = {
       libinput.enable = true;
       fstrim.enable = true;
@@ -14,10 +14,10 @@
         jack.enable = true;
         extraConfig.pipewire."92-low-latency" = {
           "content.properties" = {
-            "default.clock.rate"        = 48000;
-            "default.clock.quantum"     = 256;
-            "default.clock.min-quantum" = 256;
-            "default.clock.max-quantum" = 256;
+          "default.clock.rate" = 48000;
+          "default.clock.quantum" = 256;
+          "default.clock.min-quantum" = 256;
+          "default.clock.max-quantum" = 256;
           };
         };
         extraConfig.pipewire-pulse."92-low-latency" = {
@@ -25,9 +25,9 @@
             {
               name = "libpipewire-module-protocol-pulse";
               args = {
-                pulse.min.req     = "256/48000";
+                pulse.min.req = "256/48000";
                 pulse.default.req = "256/48000";
-                pulse.max.req     = "256/48000";
+                pulse.max.req = "256/48000";
                 pulse.min.quantum = "256/48000";
                 pulse.max.quantum = "256/48000";
               };
@@ -36,5 +36,5 @@
         };
       };
     };
-  };
+  };   
 }
diff --git a/modules/wayland.nix b/modules/wayland.nix
index 7f4fc18..ca43e30 100644
--- a/modules/wayland.nix
+++ b/modules/wayland.nix
@@ -8,6 +8,7 @@
 
       # Browser / Electron Wayland backends
       MOZ_ENABLE_WAYLAND           = "1";
+      MOZ_USE_XINPUT2              = "1";
       ELECTRON_OZONE_PLATFORM_HINT = "wayland";
       NIXOS_OZONE_WL               = "1";
 
diff --git a/modules/work.nix b/modules/work.nix
index 759b4dd..b2e8f13 100644
--- a/modules/work.nix
+++ b/modules/work.nix
@@ -1,4 +1,4 @@
-{ den, inputs, ... }: {
+{ den, inputs, lib, config, ... }: {
   den.aspects.work-specific.nixos = { pkgs, config, ... }: {
     imports = [
       ./_hardware/work-hardware.nix
@@ -41,6 +41,24 @@
       __GLX_VENDOR_LIBRARY_NAME = "nvidia";
     };
 
+    security.sudo.wheelNeedsPassword = lib.mkForce true;
+
+    networking.firewall = {
+      enable          = true;
+      allowedTCPPorts = [];
+      allowedUDPPorts = [];
+    };
+
+    powerManagement.enable = true;
+
+    services.tlp = {
+      enable   = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC  = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+      };
+    };
+
     boot = {
       initrd.kernelModules = [ "amdgpu" ];
       kernelModules        = [ "kvm-amd" "nvidia" "nvidia_modeset" "nvidia_uvm" "nvidia_drm" ];