diff --git a/hosts/callisto/configuration.nix b/hosts/callisto/configuration.nix
index 387a949..8612a45 100755
--- a/hosts/callisto/configuration.nix
+++ b/hosts/callisto/configuration.nix
@@ -14,6 +14,17 @@
     # ./apple-silicon-support
   ];
 
+  liminalOS = {
+    system = {
+      audio.enable = true;
+      networking = {
+        enable = true;
+        firewallPresets.vite = true;
+        cloudflareNameservers.enable = true;
+      };
+    };
+  };
+
   boot = {
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = false;
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..7a93bd2
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,30 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.liminalOS;
+in
+{
+  imports = [
+    ./linux
+  ];
+  options.liminalOS = {
+    linux.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable liminalOS's default modules and options for Linux.
+      '';
+    };
+    darwin.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable liminalOS's default modules and options for Darwin.
+      '';
+    };
+  };
+}
diff --git a/modules/linux/audio-prod/default.nix b/modules/linux/audio-prod/default.nix
index e44a7ad..3bccf05 100644
--- a/modules/linux/audio-prod/default.nix
+++ b/modules/linux/audio-prod/default.nix
@@ -1,11 +1,25 @@
-{ pkgs, ... }:
 {
-  imports = [
-    ../wine
-  ];
-  environment.systemPackages = with pkgs; [
-    reaper
-    yabridge
-    yabridgectl
-  ];
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.liminalOS.system.audio.prod;
+in
+{
+  options.liminalOS.system.audio.prod.enable = lib.mkEnableOption "audio production";
+
+  config = lib.mkIf cfg.enable {
+    liminalOS = {
+      programs.wine.enable = true;
+      system.audio.enable = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      reaper
+      yabridge
+      yabridgectl
+    ];
+  };
 }
diff --git a/modules/linux/audio/default.nix b/modules/linux/audio/default.nix
index fc4b7dd..ddb1a0a 100755
--- a/modules/linux/audio/default.nix
+++ b/modules/linux/audio/default.nix
@@ -1,14 +1,27 @@
+{ lib, config, ... }:
+let
+  cfg = config.liminalOS.system.audio;
+in
 {
-  # Enable sound with pipewire.
-  hardware.pulseaudio.enable = false;
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    jack.enable = true;
+  options.liminalOS.system.audio.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = config.liminalOS.linux.enable;
+    description = ''
+      Whether to set up PipeWire and default audio utilities.
+    '';
   };
 
-  services.playerctld.enable = true;
+  config = {
+    services.playerctld.enable = lib.mkIf cfg.enable true;
+    hardware.pulseaudio.enable = lib.mkIf cfg.enable false;
+    # TODO: move to other file
+    security.rtkit.enable = true;
+    services.pipewire = lib.mkIf cfg.enable {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
+  };
 }
diff --git a/modules/linux/default.nix b/modules/linux/default.nix
new file mode 100644
index 0000000..c5df2b9
--- /dev/null
+++ b/modules/linux/default.nix
@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  imports = [
+    ./audio
+    ./audio-prod
+    ./core
+    ./desktop-portal
+    ./distrobox
+    ./flatpak
+    ./fonts
+    ./gaming
+    ./greeter
+    ./hamachi
+    ./networking
+    ./spotifyd
+    ./stylix
+    ./wine
+    ./wsl
+  ];
+}
diff --git a/modules/linux/networking/default.nix b/modules/linux/networking/default.nix
index 3af770e..58c7473 100755
--- a/modules/linux/networking/default.nix
+++ b/modules/linux/networking/default.nix
@@ -1,35 +1,53 @@
+{ lib, config, ... }:
 let
-  universalAllowedPorts = [
-    27016 # grim dawn
-    42805 # grim dawn
-    42852 # grim dawn
-    42872 # grim dawn
-    27015 # grim dawn
-    27036 # grim dawn
+  cfg = config.liminalOS.system.networking;
 
-    5173 # vite test server
-    4173 # vite test server
-  ];
+  universalAllowedPorts =
+    (lib.optionals cfg.firewallPresets.grimDawn [
+      27016 # grim dawn
+      42805 # grim dawn
+      42852 # grim dawn
+      42872 # grim dawn
+      27015 # grim dawn
+      27036 # grim dawn
+    ])
+    ++ (lib.optionals cfg.firewallPresets.vite [
+      5173 # vite test server
+      4173 # vite test server
+    ]);
   universalAllowedRanges = [ ];
 in
 {
-  services.openssh.enable = true;
-
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = universalAllowedPorts;
-    allowedUDPPorts = universalAllowedPorts;
-    allowedUDPPortRanges = universalAllowedRanges ++ [
-      {
-        from = 27031;
-        to = 27036;
-      }
-    ];
-    allowedTCPPortRanges = universalAllowedRanges;
+  options.liminalOS.system.networking = {
+    enable = lib.mkEnableOption "networking";
+    firewallPresets = {
+      grimDawn = lib.mkEnableOption "firewall ports for Grim Dawn";
+      vite = lib.mkEnableOption "firewall ports for Vite";
+    };
+    cloudflareNameservers.enable = lib.mkEnableOption "Cloudflare DNS servers";
   };
 
-  networking.nameservers = [
-    "1.1.1.1"
-    "1.0.0.1"
-  ];
+  config = lib.mkIf cfg.enable {
+    services.openssh.enable = true;
+
+    networking.firewall = {
+      enable = true;
+      allowedTCPPorts = universalAllowedPorts;
+      allowedUDPPorts = universalAllowedPorts;
+      allowedUDPPortRanges =
+        universalAllowedRanges
+        ++ (lib.optionals cfg.firewallPresets.grimDawn [
+          {
+            from = 27031;
+            to = 27036;
+          }
+        ]);
+      allowedTCPPortRanges = universalAllowedRanges;
+    };
+
+    networking.nameservers = lib.mkIf cfg.cloudflareNameservers.enable [
+      "1.1.1.1"
+      "1.0.0.1"
+    ];
+  };
 }
diff --git a/modules/linux/spotifyd/default.nix b/modules/linux/spotifyd/default.nix
deleted file mode 100644
index d7657e1..0000000
--- a/modules/linux/spotifyd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-{
-  services.spotifyd = {
-    enable = true;
-    settings = {
-      global = {
-        bitrate = 320;
-        use_mpris = true;
-        device_type = "computer";
-      };
-    };
-  };
-}
diff --git a/modules/linux/wine/default.nix b/modules/linux/wine/default.nix
index efc4227..1e9479b 100644
--- a/modules/linux/wine/default.nix
+++ b/modules/linux/wine/default.nix
@@ -1,12 +1,27 @@
-{ pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
-    winetricks
-    wine
-  ];
-  nixpkgs.overlays = [
-    (self: super: {
-      wine = super.wineWowPackages.stable;
-    })
-  ];
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.liminalOS.programs.wine;
+in
+{
+  options.liminalOS.programs.wine.enable = lib.mkEnableOption "wine";
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = (
+      with pkgs;
+      [
+        winetricks
+        wine
+      ]
+    );
+    nixpkgs.overlays = [
+      (self: super: {
+        wine = super.wineWowPackages.stable;
+      })
+    ];
+  };
 }
diff --git a/modules/linux/wsl/default.nix b/modules/linux/wsl/default.nix
index da6d488..a3ac317 100644
--- a/modules/linux/wsl/default.nix
+++ b/modules/linux/wsl/default.nix
@@ -1,12 +1,31 @@
-{ inputs, ... }:
 {
-  imports = [
+  inputs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.liminalOS.wsl;
+in
+{
+  imports = lib.mkIf cfg.enable [
     inputs.nixos-wsl.nixosModules.default
   ];
 
-  wsl = {
+  options = {
+    enable = lib.mkEnableOption "wsl";
+    module = lib.mkOption {
+      type = lib.types.submodule;
+      default = inputs.nixos-wsl.nixosModules.default;
+      description = ''
+        NixOS WSL module. Defaults to <https://github.com/nix-community/NixOS-WSL>
+      '';
+    };
+  };
+
+  config.wsl = lib.mkIf cfg.enable {
     enable = true;
-    defaultUser = "youwen";
+    defaultUser = config.liminalOS.username;
     useWindowsDriver = true;
   };
 }