diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index f1c6949..e85d839 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -14,5 +14,5 @@ jobs:
       - uses: cachix/install-nix-action@v19
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      - run: nix flake check
+      - run: nix flake check --show-trace
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
diff --git a/flake.nix b/flake.nix
index c7a5dc9..b59d2c1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,7 +54,7 @@
           system = "x86_64-linux";
           modules = [
             home-manager.nixosModules.home-manager
-            ./machines/common.nix
+            ./machines/common
             ./machines/futomaki
 
             ({config, ...}: {
@@ -77,7 +77,7 @@
           system = "x86_64-linux";
           modules = [
             home-manager.nixosModules.home-manager
-            ./machines/common.nix
+            ./machines/common
             ./machines/bento
 
             ({config, ...}: {
@@ -103,7 +103,7 @@
 
           modules = [
             home-manager.darwinModules.home-manager
-            ./machines/common.nix
+            ./machines/common
             ./machines/sashimi
 
             ({config, ...}: {
diff --git a/machines/bento/default.nix b/machines/bento/default.nix
index 72a6b2b..ca90053 100644
--- a/machines/bento/default.nix
+++ b/machines/bento/default.nix
@@ -5,21 +5,14 @@
 }: let
   mainUser = "w";
 in {
-  imports = [./hardware.nix ../traefik.nix ../network.nix];
+  imports = [
+    ./hardware.nix
+    ../common/linux
+  ];
 
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
-    loader.efi.canTouchEfiVariables = true;
-    loader.systemd-boot.enable = true;
-
-    # plymouth
-    plymouth = {
-      enable = true;
-      theme = "catppuccin-mocha";
-      themePackages = [pkgs.nur.repos.nekowinston.plymouth-theme-catppuccin];
-    };
     kernelParams = ["quiet" "splash"];
-    initrd.systemd.enable = true;
   };
 
   hardware = {
@@ -35,83 +28,10 @@ in {
   time.timeZone = "Europe/Vienna";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  environment.systemPackages = with pkgs; [
-    # file management
-    p7zip
-    unzip
-    zip
-    gnome.file-roller
-
-    # thumbnails
-    webp-pixbuf-loader
-    ffmpegthumbnailer
-  ];
-  programs = {
-    dconf.enable = true;
-    nix-ld.enable = true;
-    noisetorch.enable = true;
-    thunar = {
-      enable = true;
-      plugins = with pkgs.xfce; [
-        thunar-archive-plugin
-        thunar-volman
-      ];
-    };
-  };
-
-  security = {
-    polkit.enable = true;
-    rtkit.enable = true;
-  };
-  systemd = {
-    packages = [pkgs.polkit_gnome];
-    user.services.polkit-gnome-authentication-agent-1 = {
-      unitConfig = {
-        Description = "polkit-gnome-authentication-agent-1";
-        Wants = ["graphical-session.target"];
-        WantedBy = ["graphical-session.target"];
-        After = ["graphical-session.target"];
-      };
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-        Restart = "on-failure";
-        RestartSec = 1;
-        TimeoutStopSec = 10;
-      };
-    };
-  };
-
   services = {
-    # mounting
-    gvfs.enable = true;
-    udisks2.enable = true;
-    devmon.enable = true;
-
-    # thunbnails
-    tumbler.enable = true;
-
-    # desktop
     blueman.enable = true;
-    gnome.gnome-keyring.enable = true;
-    mullvad-vpn.enable = true;
-    pipewire = {
-      enable = true;
-      pulse.enable = true;
-    };
-
     openssh.enable = true;
     pcscd.enable = true;
-
-    xserver = {
-      enable = true;
-      desktopManager.xterm.enable = false;
-      displayManager.gdm.enable = true;
-      displayManager.gdm.wayland = false;
-      libinput.enable = true;
-      windowManager.i3.enable = true;
-      xkbOptions = "caps:ctrl_modifier";
-    };
   };
 
   virtualisation.docker.enable = true;
diff --git a/machines/common.nix b/machines/common/default.nix
similarity index 100%
rename from machines/common.nix
rename to machines/common/default.nix
diff --git a/machines/common/linux/boot.nix b/machines/common/linux/boot.nix
new file mode 100644
index 0000000..40d01d4
--- /dev/null
+++ b/machines/common/linux/boot.nix
@@ -0,0 +1,13 @@
+{pkgs, ...}: {
+  boot = {
+    loader.efi.canTouchEfiVariables = true;
+    loader.systemd-boot.enable = true;
+    initrd.systemd.enable = true;
+
+    plymouth = {
+      enable = true;
+      theme = "catppuccin-mocha";
+      themePackages = [pkgs.nur.repos.nekowinston.plymouth-theme-catppuccin];
+    };
+  };
+}
diff --git a/machines/common/linux/default.nix b/machines/common/linux/default.nix
new file mode 100644
index 0000000..3e568c9
--- /dev/null
+++ b/machines/common/linux/default.nix
@@ -0,0 +1,8 @@
+{...}: {
+  imports = [
+    ./boot.nix
+    ./network.nix
+    ./sound.nix
+    ./xsession.nix
+  ];
+}
diff --git a/machines/network.nix b/machines/common/linux/network.nix
similarity index 100%
rename from machines/network.nix
rename to machines/common/linux/network.nix
diff --git a/machines/common/linux/sound.nix b/machines/common/linux/sound.nix
new file mode 100644
index 0000000..6bd7465
--- /dev/null
+++ b/machines/common/linux/sound.nix
@@ -0,0 +1,11 @@
+{
+  security = {
+    rtkit.enable = true;
+  };
+  services = {
+    pipewire = {
+      enable = true;
+      pulse.enable = true;
+    };
+  };
+}
diff --git a/machines/traefik.nix b/machines/common/linux/traefik.nix
similarity index 88%
rename from machines/traefik.nix
rename to machines/common/linux/traefik.nix
index 7bc5254..9d4b035 100644
--- a/machines/traefik.nix
+++ b/machines/common/linux/traefik.nix
@@ -1,17 +1,10 @@
-# this is half baked, so it's not enabled yet
 {
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit (pkgs.stdenv.hostPlatform) isLinux;
-in {
   # add the traefik user to the docker group for socket access
-  users = lib.mkIf isLinux {
+  users = {
     users.traefik.extraGroups = ["docker"];
   };
 
-  services = lib.mkIf isLinux {
+  services = {
     traefik = {
       enable = true;
 
diff --git a/machines/common/linux/xsession.nix b/machines/common/linux/xsession.nix
new file mode 100644
index 0000000..291131d
--- /dev/null
+++ b/machines/common/linux/xsession.nix
@@ -0,0 +1,64 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    # file management
+    p7zip
+    unzip
+    zip
+    gnome.file-roller
+
+    # thumbnails
+    webp-pixbuf-loader
+    ffmpegthumbnailer
+  ];
+  programs = {
+    dconf.enable = true;
+    noisetorch.enable = true;
+    thunar = {
+      enable = true;
+      plugins = with pkgs.xfce; [
+        thunar-archive-plugin
+        thunar-volman
+      ];
+    };
+  };
+
+  services = {
+    # mounting
+    gvfs.enable = true;
+    udisks2.enable = true;
+    devmon.enable = true;
+
+    # thumbnails
+    tumbler.enable = true;
+
+    gnome.gnome-keyring.enable = true;
+    xserver = {
+      enable = true;
+      desktopManager.xterm.enable = false;
+      displayManager.gdm.enable = true;
+      libinput.enable = true;
+      windowManager.i3.enable = true;
+      xkbOptions = "caps:ctrl_modifier";
+    };
+  };
+
+  security.polkit.enable = true;
+  systemd = {
+    packages = [pkgs.polkit_gnome];
+    user.services.polkit-gnome-authentication-agent-1 = {
+      unitConfig = {
+        Description = "polkit-gnome-authentication-agent-1";
+        Wants = ["graphical-session.target"];
+        WantedBy = ["graphical-session.target"];
+        After = ["graphical-session.target"];
+      };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
+        Restart = "on-failure";
+        RestartSec = 1;
+        TimeoutStopSec = 10;
+      };
+    };
+  };
+}
diff --git a/machines/futomaki/default.nix b/machines/futomaki/default.nix
index a544f5e..d5b19cf 100644
--- a/machines/futomaki/default.nix
+++ b/machines/futomaki/default.nix
@@ -5,24 +5,16 @@
 }: let
   mainUser = "winston";
 in {
-  imports = [./hardware.nix ../traefik.nix ../network.nix];
+  imports = [
+    ./hardware.nix
+    ../common/linux
+  ];
 
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
-    loader.efi.canTouchEfiVariables = true;
-    loader.systemd-boot.enable = true;
-
-    # for nvidia & minimalism
+    # for nvidia
     loader.systemd-boot.consoleMode = "0";
-
-    # plymouth
-    plymouth = {
-      enable = true;
-      theme = "catppuccin-mocha";
-      themePackages = [pkgs.nur.repos.nekowinston.plymouth-theme-catppuccin];
-    };
     kernelParams = ["quiet" "splash" "vt.global_cursor_default=0"];
-    initrd.systemd.enable = true;
   };
 
   hardware = {
@@ -38,81 +30,10 @@ in {
   time.timeZone = "Europe/Vienna";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  environment.systemPackages = with pkgs; [
-    # file management
-    p7zip
-    unzip
-    zip
-    gnome.file-roller
-
-    # thumbnails
-    webp-pixbuf-loader
-    ffmpegthumbnailer
-  ];
-  programs = {
-    dconf.enable = true;
-    nix-ld.enable = true;
-    noisetorch.enable = true;
-    thunar = {
-      enable = true;
-      plugins = with pkgs.xfce; [
-        thunar-archive-plugin
-        thunar-volman
-      ];
-    };
-  };
-
-  security = {
-    polkit.enable = true;
-    rtkit.enable = true;
-  };
-  systemd = {
-    packages = [pkgs.polkit_gnome];
-    user.services.polkit-gnome-authentication-agent-1 = {
-      unitConfig = {
-        Description = "polkit-gnome-authentication-agent-1";
-        Wants = ["graphical-session.target"];
-        WantedBy = ["graphical-session.target"];
-        After = ["graphical-session.target"];
-      };
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-        Restart = "on-failure";
-        RestartSec = 1;
-        TimeoutStopSec = 10;
-      };
-    };
-  };
-
   services = {
-    # mounting
-    gvfs.enable = true;
-    udisks2.enable = true;
-    devmon.enable = true;
-
-    # thunbnails
-    tumbler.enable = true;
-
-    # desktop
     blueman.enable = true;
-    gnome.gnome-keyring.enable = true;
-    pipewire = {
-      enable = true;
-      pulse.enable = true;
-    };
-
     openssh.enable = true;
     pcscd.enable = true;
-
-    xserver = {
-      enable = true;
-      desktopManager.xterm.enable = false;
-      displayManager.gdm.enable = true;
-      libinput.enable = true;
-      windowManager.i3.enable = true;
-      xkbOptions = "caps:ctrl_modifier";
-    };
   };
 
   virtualisation.docker.enable = true;