diff --git a/docs/poppy.md b/docs/poppy.md
index bf3ca82..5d4be2d 100644
--- a/docs/poppy.md
+++ b/docs/poppy.md
@@ -27,8 +27,3 @@ darwin-rebuild switch --flake .#poppy
 | `switch` | `darwin-rebuild switch --flake .#poppy` |
 | `update` | `nix flake update && darwin-rebuild switch --flake .#poppy` |
 | `cleanup` | `nix-collect-garbage -d` |
-
-## TODO
-
-- [ ] telegram mcp aliases (tg-login, tg-reset)
-- [ ] apple music tools (gamdl)
diff --git a/garden.md b/garden.md
index fe3c455..b0d72a9 100644
--- a/garden.md
+++ b/garden.md
@@ -91,3 +91,16 @@ currently `flake.nix` has `rosemary` commented out. need to:
   - сначала создать репы на всех 3 хостах
   - потом настроить через `pass git remote add`
   - алиасы в zsh для каждого origin
+
+### FIDO2 / Ledger Security Key
+
+Ledger поддерживает FIDO2 через `app-security-key` (open source). SSH-ключ создан
+на токене (ed25519-sk), работает локально (sign/verify). Задачи — см. `docs/ssh.md`.
+
+### sops-nix для секретов
+
+`flake.nix` уже содержит `sops-nix` в inputs. Нужно:
+- создать age ключ (`age-keygen -o ~/.config/sops/age/keys.txt`)
+- настроить `secrets/secrets.yaml` с SOPS config
+- сконфигурировать `SOPS_AGE_KEY_FILE` (уже в `home/sessionVariables`)
+- переместить `OPENROUTER_API_KEY` из plain text в encrypted
diff --git a/home/cli.nix b/home/cli.nix
index e69de29..046b318 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -0,0 +1,84 @@
+{ pkgs, ... }:
+{
+  # Universal CLI tools for all hosts
+  home.packages = with pkgs; [
+    # File navigation & viewing
+    eza
+    bat
+    ripgrep
+    fd
+    fzf
+    tree
+    wget  # download files and recursive sites
+
+    # System info
+    htop
+    tldr
+    fastfetch
+    tree
+
+    # Editor
+    micro
+
+    # Node
+    pnpm  # fast node package manager
+
+    # Secrets
+    (pass.withExtensions (ext: [ ext.pass-otp ]))
+    gpgme
+    gnupg
+
+    # Extras
+    ollama          # CLI для LLM
+    delta           # красивый git diff (synonym: git-delta)
+    alejandra       # nix-форматтер
+    broot           # tree с превью
+    trash-cli       # rm с корзиной
+    texliveFull     # LaTeX (~4GB, для математики)
+    gita            # manage multiple git repos
+  ];
+
+  # TODO: global npm/pnpm packages not managed by nix for now
+  # install manually: pnpm i -g @mariozechner/pi-coding-agent
+
+  # GPG agent is configured in home/pass.nix (only for pass)
+
+  # FZF fuzzy finder
+  programs.fzf = {
+    enable = true;
+    enableZshIntegration = true;
+    defaultCommand = "fd --type f --hidden --exclude .git";
+    defaultOptions = [
+      "--height 40%"
+      "--layout=reverse"
+      "--border"
+    ];
+  };
+
+  # Zoxide - smarter cd
+  programs.zoxide = {
+    enable = true;
+    enableZshIntegration = true;
+    options = [ "--cmd cd" ];
+  };
+
+  # Bat - cat with syntax highlighting
+  programs.bat = {
+    enable = true;
+    config = {
+      theme = "Catppuccin Macchiato";
+      italic-text = "always";
+      style = "numbers,changes,header";
+    };
+  };
+
+  # Eza - modern ls replacement
+  programs.eza = {
+    enable = true;
+    icons = "auto";
+    git = true;
+  };
+
+  # Fastfetch - system info (using package only, no home-manager module)
+  # Config is in ~/.config/fastfetch/config.jsonc manually for now
+}
diff --git a/home/syncthing.nix b/home/syncthing.nix
index 7566f39..6e23142 100644
--- a/home/syncthing.nix
+++ b/home/syncthing.nix
@@ -15,7 +15,7 @@
     config = {
       ProgramArguments = [
         "${pkgs.syncthing}/bin/syncthing"
-        "-no-browser"
+        "serve"
       ];
       RunAtLoad = true;
       KeepAlive = true;
diff --git a/hosts/poppy/apps.nix b/hosts/poppy/apps.nix
new file mode 100644
index 0000000..1ae197b
--- /dev/null
+++ b/hosts/poppy/apps.nix
@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  # All poppy apps (brew casks + nix GUI packages)
+  # импортируется только в hosts/poppy/default.nix
+
+  # Brew casks (приложения которых нет в nixpkgs)
+  homebrew = {
+    enable = true;
+    onActivation.cleanup = "none";  # "none" для безопасности, "zap" после полного аудита
+    taps = [];
+
+    brews = [
+      "kew"
+    ];
+
+    casks = [
+      "google-chrome"
+      "google-drive"
+      "marta"
+      "vscodium"
+      "github"
+      "docker-desktop"
+      "ollama-app"
+      "obsidian"
+      "anki"
+      "calibre"
+      "telegram"
+      "maccy"
+      "mos"
+      "caffeine"
+      "lunacy"
+      "skim"
+      "markedit"
+      "amneziavpn"
+      "element"
+      "prismlauncher"
+    ];
+  };
+
+  # Nix GUI пакеты (нет в brew)
+  home.packages = with pkgs; [
+    aseprite     # пиксельный редактор
+    pureref      # reference board
+  ];
+}
diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix
index f601478..a1a0834 100644
--- a/hosts/poppy/default.nix
+++ b/hosts/poppy/default.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }: {
-  imports = [ ./homebrew.nix ./system.nix ];
+  imports = [ ./apps.nix ./system.nix ];
 
   networking.hostName = "poppy";
   system.primaryUser = "michaotic";
diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix
deleted file mode 100644
index 74b7b94..0000000
--- a/hosts/poppy/homebrew.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  homebrew.enable = true;
-  homebrew.onActivation.cleanup = "zap";
-
-  homebrew.taps = [];
-
-  homebrew.brews = [
-    "kew"
-  ];
-
-  homebrew.casks = [
-    "google-chrome"
-    "google-drive"
-    "marta"
-    "vscodium"
-    "github"
-    "docker-desktop"
-    "ollama-app"
-    "microsoft-word"
-    "microsoft-excel"
-    "microsoft-powerpoint"
-    "obsidian"
-    "anki"
-    "calibre"
-    "telegram"
-    "maccy"
-    "mos"
-    "caffeine"
-    "lunacy"
-    "skim"
-    "markedit"
-  ];
-}