diff --git a/flake.lock b/flake.lock
index 44eb3c7..76f7636 100644
--- a/flake.lock
+++ b/flake.lock
@@ -49,6 +49,27 @@
         "type": "github"
       }
     },
+    "hm": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1624228557,
+        "narHash": "sha256-wwOqe73BsrXfRv1PhyXQFNC8iTET50KvE/HitdkRgxs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "35a24648d155843a4d162de98c17b1afd5db51e4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-21.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1618628710,
@@ -96,6 +117,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "hm": "hm",
         "nixpkgs": "nixpkgs_2",
         "snm": "snm",
         "utils": "utils_2"
diff --git a/flake.nix b/flake.nix
index 60e43c0..9b0bf2c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,6 +3,11 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-21.05-small";
     utils.url = "github:gytis-ivaskevicius/flake-utils-plus/staging";
 
+    hm = {
+      url = "github:nix-community/home-manager/release-21.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # simple mailserver
     snm = {
       url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
@@ -13,7 +18,7 @@
     # age for nix to store encrypted passwords conveniently
     agenix.url = "github:ryantm/agenix";
   };
-  outputs = { self, nixpkgs, agenix, ... }@inputs: {
+  outputs = { self, hm, nixpkgs, agenix, ... }@inputs: {
     inherit self inputs;
     nixosConfigurations."thrall" = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
@@ -22,6 +27,12 @@
 	./modules/security.nix
 	./hosts/thrall
         agenix.nixosModules.age
+	hm.nixosModules.home-manager
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          home-manager.users.alex = import ./home/cli.nix;
+        }
       ];
     };
   };
diff --git a/home/cli.nix b/home/cli.nix
new file mode 100644
index 0000000..e3bcab3
--- /dev/null
+++ b/home/cli.nix
@@ -0,0 +1,78 @@
+{ config, pkgs, ... }:
+
+# minimal config, suitable for servers
+
+{
+  imports = [
+    # shell config
+    #./modules/shell
+  ];
+
+  programs.home-manager.enable = true;
+  home = {
+    username = "alex";
+    homeDirectory = "/home/alex";
+    stateVersion = "21.05";
+  };
+
+  home.packages = with pkgs; [
+    # archives
+    #p7zip
+    #unrar
+    # nix tools
+    nix-index
+    nixpkgs-fmt
+    # misc
+    fd # better find
+    file # info about files
+    gotop
+    ripgrep # better grep
+  ];
+  home.extraOutputsToInstall = [ "doc" "info" "devdoc" ];
+
+  xdg.enable = true;
+
+  programs = {
+    direnv = {
+      enable = true;
+      nix-direnv = {
+        enable = true;
+        enableFlakes = true;
+      };
+      enableZshIntegration = true;
+    };
+
+    gh = {
+      enable = true;
+      gitProtocol = "ssh";
+    };
+
+    git = {
+      enable = true;
+      ignores = [ "*~" "*.swp" "result" ];
+      userEmail = "me@jakalx.net";
+      userName = "Alexander Kobjolke";
+    };
+
+    gpg = {
+      enable = true;
+      settings = { homedir = "~/.local/share/gnupg"; };
+    };
+
+    password-store = {
+      enable = true;
+      package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
+      settings = { PASSWORD_STORE_DIR = "$HOME/.local/share/password-store"; };
+    };
+
+    ssh.enable = true;
+  };
+
+  services.gpg-agent = {
+    enable = true;
+    enableSshSupport = true;
+    defaultCacheTtl = 300;
+    defaultCacheTtlSsh = 300;
+  };
+}
+