diff --git a/flake.nix b/flake.nix
index 58215e9..52e621a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -61,22 +61,7 @@
 
       apps =
         agenix-rekey.defineApps self pkgs self.nodes
-        // {
-          generate-initrd-keys = flake-utils.mkApp {
-            drv = let
-              generateHostKey = node: ''
-                if [[ ! -f ${node.config.rekey.secrets.initrd_host_ed25519_key.file} ]]; then
-                  ssh-keygen -t ed25519 -N "" -f /tmp/1
-                  TODO
-                fi
-              '';
-            in
-              pkgs.writeShellScript "generate-initrd-keys" ''
-                set -euo pipefail
-                ${pkgs.lib.concatStringsSep "\n" (pkgs.lib.mapAttrsToList generateHostKey self.nodes)}
-              '';
-          };
-        };
+        // import ./nix/apps.nix inputs system;
       checks = import ./nix/checks.nix inputs system;
       devShells.default = import ./nix/dev-shell.nix inputs system;
       formatter = pkgs.alejandra;
diff --git a/hosts/nom/meta.nix b/hosts/nom/meta.nix
index df2fdb0..4e0cb6a 100644
--- a/hosts/nom/meta.nix
+++ b/hosts/nom/meta.nix
@@ -1,4 +1,8 @@
 {
   type = "nixos";
   system = "x86_64-linux";
+  physical_connections = {
+    "10-lan1" = "LAN 1";
+    "10-wlan1" = "WiFi";
+  };
 }
diff --git a/hosts/nom/net.nix b/hosts/nom/net.nix
index d7f37da..0b13f0e 100644
--- a/hosts/nom/net.nix
+++ b/hosts/nom/net.nix
@@ -5,14 +5,14 @@
   };
 
   systemd.network.networks = {
-    "10-lan0" = {
+    "10-lan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = "00:00:00:00:00:00";
       networkConfig.IPv6PrivacyExtensions = "kernel";
       dhcpV4Config.RouteMetric = 10;
       dhcpV6Config.RouteMetric = 10;
     };
-    "10-wlan0" = {
+    "10-wlan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = "00:00:00:00:00:00";
       networkConfig.IPv6PrivacyExtensions = "kernel";
diff --git a/hosts/ward/meta.nix b/hosts/ward/meta.nix
index df2fdb0..238009b 100644
--- a/hosts/ward/meta.nix
+++ b/hosts/ward/meta.nix
@@ -1,4 +1,8 @@
 {
   type = "nixos";
   system = "x86_64-linux";
+  physical_connections = {
+    "10-lan1" = "LAN 1";
+    "10-lan2" = "LAN 2";
+  };
 }
diff --git a/hosts/ward/net.nix b/hosts/ward/net.nix
index e871ef6..03c7a3d 100644
--- a/hosts/ward/net.nix
+++ b/hosts/ward/net.nix
@@ -4,14 +4,14 @@
   };
 
   systemd.network.networks = {
-    "10-lan0" = {
+    "10-lan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = "00:00:00:00:00:00";
       networkConfig.IPv6PrivacyExtensions = "kernel";
       dhcpV4Config.RouteMetric = 10;
       dhcpV6Config.RouteMetric = 10;
     };
-    "10-lan1" = {
+    "10-lan2" = {
       DHCP = "yes";
       matchConfig.MACAddress = "00:00:00:00:00:00";
       networkConfig.IPv6PrivacyExtensions = "kernel";
diff --git a/nix/apps.nix b/nix/apps.nix
new file mode 100644
index 0000000..6208205
--- /dev/null
+++ b/nix/apps.nix
@@ -0,0 +1,48 @@
+{self, ...}: system: let
+  mkApp = drv: {
+    type = "app";
+    program = "${drv}";
+  };
+  pkgs = self.pkgs.${system};
+  mapAttrsToLines = f: attrs: pkgs.lib.concatStringsSep "\n" (pkgs.lib.mapAttrsToList f attrs);
+  filterMapAttrsToLines = filter: f: attrs: pkgs.lib.concatStringsSep "\n" (pkgs.lib.mapAttrsToList f (pkgs.lib.filterAttrs filter attrs));
+in
+  with pkgs.lib; {
+    draw-graph = let
+      renderNode = nodeName: node: let
+        renderNic = nicName: nic: ''
+          nic_${nicName}: ${
+            if hasInfix "wlan" nicName
+            then "📶"
+            else "🖧"
+          } ${self.hosts.${nodeName}.physical_connections.${nicName}} {
+            shape: sql_table
+            MAC: ${nic.matchConfig.MACAddress}
+          }
+        '';
+      in ''
+        ${nodeName}: {
+          ${filterMapAttrsToLines (_: v: v.matchConfig ? MACAddress) renderNic node.config.systemd.network.networks}
+        }
+      '';
+      graph = ''
+        ${mapAttrsToLines renderNode self.nodes}
+      '';
+    in
+      mkApp (pkgs.writeShellScript "draw-graph" ''
+        set -euo pipefail
+        echo "${graph}"
+      '');
+    generate-initrd-keys = let
+      generateHostKey = node: ''
+        if [[ ! -f ${node.config.rekey.secrets.initrd_host_ed25519_key.file} ]]; then
+          ssh-keygen -t ed25519 -N "" -f /tmp/1
+          TODO
+        fi
+      '';
+    in
+      mkApp (pkgs.writeShellScript "generate-initrd-keys" ''
+        set -euo pipefail
+        ${mapAttrsToLines generateHostKey self.nodes}
+      '');
+  }
diff --git a/users/common/fish.nix b/users/common/fish.nix
index 6bcfcdc..1ad4f10 100644
--- a/users/common/fish.nix
+++ b/users/common/fish.nix
@@ -15,8 +15,6 @@ with lib; {
       (mkBefore ''
         set -g ATUIN_NOBIND true
         set -g fish_greeting
-        #set -g fish_autosuggestion_enabled 0
-        set -g FZF_COMPLETE 2
       '')
       (mkAfter ''
         bind \cr _atuin_search
@@ -30,10 +28,10 @@ with lib; {
       {
         name = "fzf";
         src = pkgs.fetchFromGitHub {
-          owner = "jethrokuan";
-          repo = "fzf";
-          rev = "479fa67d7439b23095e01b64987ae79a91a4e283";
-          sha256 = "0k6l21j192hrhy95092dm8029p52aakvzis7jiw48wnbckyidi6v";
+          owner = "oddlama";
+          repo = "fzf.fish";
+          rev = "63c8f8e65761295da51029c5b6c9e601571837a1";
+          sha256 = "036n50zr9kyg6ad408zn7wq2vpfwhmnfwab465km4dk60ywmrlcb";
         };
       }
     ];
diff --git a/users/myuser/dev.nix b/users/myuser/dev.nix
index e149b97..758528d 100644
--- a/users/myuser/dev.nix
+++ b/users/myuser/dev.nix
@@ -7,7 +7,10 @@
         set auto-load safe-path /
       '';
     };
-    packages = with pkgs; [git-lfs];
+    packages = with pkgs; [
+      git-lfs
+      d2
+    ];
   };
 
   programs = {
diff --git a/users/myuser/yubikey.pub.age b/users/myuser/yubikey.pub.age
deleted file mode 100644
index e9305db..0000000
Binary files a/users/myuser/yubikey.pub.age and /dev/null differ