diff --git a/flake.nix b/flake.nix
index 65dd8a0..3109786 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,26 +27,40 @@
     let
       system = "x86_64-linux";
       username = "poslop";
+      lib = nixpkgs.lib;
+
+      # mkHost <hostname> <role list>
+      # roles resolve to ./roles/<name>.nix; list entries may also be
+      # inline attrsets or paths, which load after (and override) roles.
+      # hosts/<host>/custom.nix, if present, always loads last.
       mkHost =
-        host: modules:
+        name: roles:
         nixpkgs.lib.nixosSystem {
-          modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules;
+          modules =
+            [ { nixpkgs.hostPlatform = system; } ]
+            ++ [ ./hosts/${name}/configuration.nix ]
+            ++ map (
+              role:
+              if builtins.isString role then ./roles/${role}.nix else role
+            ) roles
+            ++ lib.optional (builtins.pathExists ./hosts/${name}/custom.nix)
+              ./hosts/${name}/custom.nix;
           specialArgs = {
             inherit
               self
               inputs
               username
-              host
               ;
+            host = name;
           };
         };
     in
     {
       nixosConfigurations = {
-        nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ];
-        qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ];
-        goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ];
-        hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ];
+        nixos-vm2 = mkHost "nixos-vm2" [ "core" ];
+        qemu-vm = mkHost "qemu-vm" [ "core" ];
+        goyplex-vm = mkHost "goyplex-vm" [ "k3s-server" ];
+        hermes-vm = mkHost "hermes-vm" [ "hermes" ];
       };
     };
 }
diff --git a/hosts/goyplex-vm/configuration.nix b/hosts/goyplex-vm/configuration.nix
index ec77758..1f679a6 100644
--- a/hosts/goyplex-vm/configuration.nix
+++ b/hosts/goyplex-vm/configuration.nix
@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
-    ../../modules/k3s/k3s.nix
   ];
 
   boot.loader.systemd-boot.enable = true;
diff --git a/hosts/hermes-vm/configuration.nix b/hosts/hermes-vm/configuration.nix
index a3d6a2d..1f679a6 100644
--- a/hosts/hermes-vm/configuration.nix
+++ b/hosts/hermes-vm/configuration.nix
@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules/core
-    ../../modules/hermes
   ];
 
   boot.loader.systemd-boot.enable = true;
diff --git a/hosts/nixos-vm2/configuration.nix b/hosts/nixos-vm2/configuration.nix
index fd54cb1..9b1c8dd 100644
--- a/hosts/nixos-vm2/configuration.nix
+++ b/hosts/nixos-vm2/configuration.nix
@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;
diff --git a/hosts/qemu-vm/configuration.nix b/hosts/qemu-vm/configuration.nix
index 866fe4e..62ebaa4 100644
--- a/hosts/qemu-vm/configuration.nix
+++ b/hosts/qemu-vm/configuration.nix
@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;
diff --git a/roles/core.nix b/roles/core.nix
new file mode 100644
index 0000000..5db7cb9
--- /dev/null
+++ b/roles/core.nix
@@ -0,0 +1,6 @@
+{
+  # shared baseline: core system + home manager config
+  imports = [
+    ../modules
+  ];
+}
diff --git a/roles/hermes.nix b/roles/hermes.nix
new file mode 100644
index 0000000..ebe73a8
--- /dev/null
+++ b/roles/hermes.nix
@@ -0,0 +1,7 @@
+{
+  # hermes agent host: core + hermes container + secrets
+  imports = [
+    ./core.nix
+    ../modules/hermes
+  ];
+}
diff --git a/roles/k3s-server.nix b/roles/k3s-server.nix
new file mode 100644
index 0000000..e7331bb
--- /dev/null
+++ b/roles/k3s-server.nix
@@ -0,0 +1,7 @@
+{
+  # k3s server node (goyplex-vm): k3s + manifests + firewall
+  imports = [
+    ./core.nix
+    ../modules/k3s/k3s.nix
+  ];
+}