@penny honestly i think in general nixos shit just expects you to compile it if its 3rd party, its just usually the software is like lanzaboote or sops-nix, thats a sysutil. not a tangled knot yknow.
the knot was pretty okay but not ssh access because cf tunnels don't allow for that so i stop bothering. I probably will when i start proxying to a VPS tho
