diff --git a/modules/hosts/box/box.nix b/modules/hosts/box/box.nix
index 7ba8dd8..45e1ea1 100644
--- a/modules/hosts/box/box.nix
+++ b/modules/hosts/box/box.nix
@@ -21,14 +21,13 @@
       openssh
       gitea
 
-
-      (den.provides.cloudflared-tunnel "tvtun"   3001)
-      (den.provides.cloudflared-tunnel "search"  8888)
-      (den.provides.cloudflared-tunnel "files"   3210)
-      (den.provides.cloudflared-tunnel "tube"    3030)
-      (den.provides.cloudflared-tunnel "monitor" 61208)
-      (den.provides.cloudflared-tunnel "reddit"  8975)
-      (den.provides.cloudflared-tunnel "git"     3000)
+      (tunnel 3001 "tvtun")
+      (tunnel 8888 "search")
+      (tunnel 3210 "files")
+      (tunnel 3030 "tube")
+      (tunnel 8975 "reddit")
+      (tunnel 3002 "git")
+      (tunnel 61208 "monitor")
     ];
 
     nixos = {
diff --git a/modules/hosts/laptop/laptop.nix b/modules/hosts/laptop/laptop.nix
index 2df5c95..0cb35ae 100644
--- a/modules/hosts/laptop/laptop.nix
+++ b/modules/hosts/laptop/laptop.nix
@@ -1,28 +1,28 @@
 
 { den, ... }: {
   den.aspects.laptop = {
-    includes = [
+    includes = with den.aspects; [
       den.default
-      <amdgpu>
-      <cosmic>
-      <firefox>
-      <audio>
+      den.aspects.amdgpu
+      cosmic
+      firefox
+      audio
 
       den.provides.home-manager
-      <stylix>
-      <syncthing>
-      <swap>
-      <cloudflare-warp>
-      <packages>
-      <development>
-      <cad>
-      <mpd>
-      <virtualisation>
-      <flatpak>
-      <fish>
-      <dns>
-      <openssh>
-      <beets>
+      stylix
+      syncthing
+      swap
+      cloudflare-warp
+      packages
+      development
+      cad
+      mpd
+      virtualisation
+      flatpak
+      fish
+      dns
+      openssh
+      beets
     ];
 
     nixos = {
@@ -32,6 +32,8 @@
         HandleLidSwitch = "ignore";
         HandleLidSwitchDocked = "ignore";
       };
+
+      users.users.bug.extraGroups = [ "networkmanager" "wheel" "audio" "video" "libvirtd" "ydotool" "dialout" ];
     };
   };
 }
diff --git a/modules/infra/cloudflare-tunnel.nix b/modules/infra/cloudflare-tunnel.nix
deleted file mode 100644
index c33f7f3..0000000
--- a/modules/infra/cloudflare-tunnel.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-# cloudflared/battery.nix
-{ den, ... }:
-let
-
-  description = ''
-    Configures a Cloudflare tunnel ingress rule for a given subdomain and port.
-    Assumes the tunnel UUID and credentials are fixed for this machine.
-
-    Usage:
-
-      den.aspects.bug.includes = [
-        (den.provides.cloudflared-tunnel "search" 8888)
-        (den.provides.cloudflared-tunnel "tube"   3030)
-        (den.provides.cloudflared-tunnel "git"    3000)
-      ];
-
-    Each call adds one ingress entry: <subdomain>.bug.tools -> http://127.0.0.1:<port>
-    The base tunnel setup (enable, credentials, default) is included every time
-    and merges safely via the NixOS module system.
-  '';
-
-  TUNNEL_UUID = "4118935e-359b-4dd2-95bd-eb27f7b0c5bb";
-  DOMAIN      = "bug.tools";
-  CREDS_PATH  = "/home/bug/.cloudflared/${TUNNEL_UUID}.json";
-
-  tunnelNixos = subdomain: port: { pkgs, ... }: {
-    environment.systemPackages = [ pkgs.cloudflared ];
-
-    environment.etc."cloudflared/${TUNNEL_UUID}.json".source = CREDS_PATH;
-
-    services.cloudflared = {
-      enable = true;
-
-      tunnels.${TUNNEL_UUID} = {
-        credentialsFile = "/etc/cloudflared/${TUNNEL_UUID}.json";
-        default = "http_status:404";
-
-        ingress = {
-          "${subdomain}.${DOMAIN}" = "http://127.0.0.1:${toString port}";
-        };
-      };
-    };
-  };
-
-in
-{
-  den.provides.cloudflared-tunnel =
-    subdomain: port:
-    den.lib.parametric {
-      inherit description;
-      includes = [
-        (_: { nixos = tunnelNixos subdomain port; })
-      ];
-    };
-}
diff --git a/modules/infra/cloudflared.nix b/modules/infra/cloudflared.nix
index bf269c4..22ce519 100644
--- a/modules/infra/cloudflared.nix
+++ b/modules/infra/cloudflared.nix
@@ -1,36 +1,30 @@
-/*
-{
-  den.aspects.cloudflared = {
-    nixos = { pkgs, ...}: let
-      TUNNEL_UUID = "4118935e-359b-4dd2-95bd-eb27f7b0c5bb";
-    in {
-      environment.systemPackages = [ pkgs.cloudflared ];
+{ den, ... }: let
+  tunnel_uuid = "4118935e-359b-4dd2-95bd-eb27f7b0c5bb";
+  domain = "bug.tools";
+  creds  = "/home/bug/.cloudflared/${tunnel_uuid}.json";
 
-      environment.etc."cloudflared/${TUNNEL_UUID}.json".source = "/home/bug/.cloudflared/${TUNNEL_UUID}.json";
+  tunnel = port: subdomain: { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.cloudflared ];
 
-      services.cloudflared = {
-        enable = true;
+    environment.etc."cloudflared/${tunnel_uuid}.json".source = creds;
 
-        tunnels."${TUNNEL_UUID}" = {
-          credentialsFile = "/etc/cloudflared/${TUNNEL_UUID}.json";
-          default = "http_status:404";
+    services.cloudflared = {
+      enable = true;
 
-          ingress = {
-            "tvtun.bug.tools" = "http://127.0.0.1:3001";
-            "search.bug.tools" = "http://127.0.0.1:8888";
-            "files.bug.tools" = "http://127.0.0.1:3210";
-            "tube.bug.tools" = "http://127.0.0.1:3030";
-            "monitor.bug.tools" = "http://127.0.0.1:61208";
-            "reddit.bug.tools" = "http://127.0.0.1:8975";
-            #"matrix.bug.tools" = "http://127.0.0.1:8008";
-            #"bug.tools" = "http://127.0.0.1:8080";
-            "git.bug.tools" = "http://127.0.0.1:3000";
-          };
+      tunnels.${tunnel_uuid} = {
+        credentialsFile = "/etc/cloudflared/${tunnel_uuid}.json";
+        default = "http_status:404";
+
+        ingress = {
+          "${subdomain}.${domain}" = "http://127.0.0.1:${toString port}";
         };
       };
     };
   };
+in {
+  den.aspects.tunnel = port: subdomain: den.lib.parametric {
+    includes = [
+      (_: { nixos = tunnel port subdomain; })
+    ];
+  };
 }
-*/
-
-{}
diff --git a/modules/services/glances.nix b/modules/services/glances.nix
index 7c67e9b..f510c81 100644
--- a/modules/services/glances.nix
+++ b/modules/services/glances.nix
@@ -1,4 +1,4 @@
-{
+{ den, ...}: {
   den.aspects.glances = {
     nixos = { pkgs, ... }: {
       environment.systemPackages = [ pkgs.glances ];
diff --git a/modules/services/mailserver.nix b/modules/services/mailserver.nix
index 34dfd7e..d7ee81d 100644
--- a/modules/services/mailserver.nix
+++ b/modules/services/mailserver.nix
@@ -2,7 +2,7 @@
   den.aspects.mailserver = {
     nixos = {
       imports = [
-        (builtins.fetchTarball {
+        (fetchTarball {
           url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/master.tar.gz";
           sha256 = "0rm5f749xakmkqrpkl5ay1pydbnlinr50pvwg1vm795js2infmj5";
         })