Protonvpn and onlykey apps are both mandatory part of my workflow and both busted in nixos after 3 days of messing around. I've decided give up and do manjaro with BTRFS snapshots instead. Nuke completed, paving now.