diff --git a/flake.nix b/flake.nix
index a883bb0..3e739a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,14 @@
           }
         ];
       };
+      nuc = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs.inputs = attrs;
+        modules = [
+          ./hosts/nuc
+          sops-nix.nixosModules.sops
+        ];
+      };
     };
   };
 }
diff --git a/hosts/nuc/default.nix b/hosts/nuc/default.nix
new file mode 100644
index 0000000..cbecb38
--- /dev/null
+++ b/hosts/nuc/default.nix
@@ -0,0 +1,62 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../shared/vim.nix
+      # ../../shared/sops.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot = {
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+    supportedFilesystems = [ "zfs" ];
+  };
+
+  networking.hostName = "nuc"; # Define your hostname.
+  networking.hostId = "795a4952";
+
+  time.timeZone = "Europe/Berlin";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "dvorak";
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    htop
+  ];
+  programs.git = {
+    enable = true;
+    config = {
+      user.name = "Rouven Seifert";
+      user.email = "rouven@rfive.de";
+    };
+  };
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keyFiles = [
+    ../../keys/ssh/rouven-thinkpad
+    ../../keys/ssh/rouven-pixel
+    # ../../keys/ssh/rouven-smartcard
+  ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+
+}
+
diff --git a/hosts/nuc/hardware-configuration.nix b/hosts/nuc/hardware-configuration.nix
new file mode 100644
index 0000000..7df90da
--- /dev/null
+++ b/hosts/nuc/hardware-configuration.nix
@@ -0,0 +1,56 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "rpool/nixos/root";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/var/lib" =
+    {
+      device = "rpool/nixos/var/lib";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/var/log" =
+    {
+      device = "rpool/nixos/var/log";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/7026-251E";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/a861a381-3a9d-4fc7-a4d0-facbe130c219"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/keys/ssh/rouven@pixel-4a b/keys/ssh/rouven-pixel
similarity index 100%
rename from keys/ssh/rouven@pixel-4a
rename to keys/ssh/rouven-pixel
diff --git a/keys/ssh/rouven@openpgp-0xE7980120 b/keys/ssh/rouven-smartcard
similarity index 100%
rename from keys/ssh/rouven@openpgp-0xE7980120
rename to keys/ssh/rouven-smartcard
diff --git a/keys/ssh/rouven-thinkpad b/keys/ssh/rouven-thinkpad
new file mode 100644
index 0000000..012cadb
--- /dev/null
+++ b/keys/ssh/rouven-thinkpad
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILkxTuzjS3EswMfj+wSKu9ciRyStvjDlDUXzkqEUGDaP rouven@thinkpad
diff --git a/keys/ssh/rouven@thinkpad b/keys/ssh/rouven@thinkpad
deleted file mode 100644
index b0f503e..0000000
--- a/keys/ssh/rouven@thinkpad
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDGP2m7ccMts/y/PFtYQraFQ7P7GEJlSGueM+9WS9UeT rouven@thinkpad