diff --git a/cheatsheet.md b/cheatsheet.md
new file mode 100644
index 0000000..cb27db5
--- /dev/null
+++ b/cheatsheet.md
@@ -0,0 +1,225 @@
+You’ll also need to import the modules in your host config (they aren’t wired in `flake.nix` yet), e.g.:
+
+```nix
+imports = [
+  ./hardware-configuration.nix
+  ../../modules/core
+  ../../modules/networking
+  ../../modules/virtualization
+];
+```
+
+---
+
+## `homelab.core`
+
+Base system setup: kernel, bootloader, primary user, SSH, unfree packages.
+
+| Option                          | Type                                             | Default          | Notes                                                                |
+| ------------------------------- | ------------------------------------------------ | ---------------- | -------------------------------------------------------------------- |
+| `kernel`                        | `"stable"` \| `"lts"` \| `"latest"`              | `"lts"`          | Maps to `linuxPackages`, `linuxPackages_lts`, `linuxPackages_latest` |
+| `bootloader.type`               | `"grub"` \| `"systemd"`                          | `"grub"`         | Which bootloader path to use                                         |
+| `bootloader.grub.enable`        | bool                                             | `false`          | Set `true` when `type = "grub"`                                      |
+| `bootloader.grub.device`        | string                                           | `"nodev"`        | GRUB install target, e.g. `"/dev/sda"`                               |
+| `bootloader.systemd.enable`     | bool                                             | `false`          | Set `true` when `type = "systemd"`                                   |
+| `bootloader.systemd.efiSupport` | bool                                             | `true`           |                                                                      |
+| `user.name`                     | string                                           | `"river"`        |                                                                      |
+| `user.fullName`                 | string                                           | `"Maaz Khokhar"` |                                                                      |
+| `user.shell`                    | string (typed as list in options — likely a bug) | `"fish"`         | Used as `programs.${shell}.enable`                                   |
+| `allowUnfree`                   | bool                                             | `true`           |                                                                      |
+| `ssh.permitRootLogin`           | bool                                             | `false`          |                                                                      |
+
+**Minimal core block:**
+
+```nix
+homelab.core = {
+  kernel = "lts";
+  bootloader = {
+    type = "systemd";
+    systemd.enable = true;
+  };
+  # user / allowUnfree / ssh all have sensible defaults
+};
+```
+
+**What you actually need to set:** bootloader details for your hardware (`grub.device` or `systemd.enable`). Everything else can stay default.
+
+---
+
+## `homelab.networking`
+
+Split into `core` (always active when module is imported), `wireguard`, and `tailscale`.
+
+### Top-level
+
+| Option | Type   | Default   |
+| ------ | ------ | --------- | --------------------------------- |
+| `user` | string | `"river"` | Used by Tailscale as `--operator` |
+
+### `homelab.networking.core` (always on)
+
+| Option               | Type                               | Default                                 |
+| -------------------- | ---------------------------------- | --------------------------------------- |
+| `firewall.allowPing` | bool                               | `true`                                  |
+| `firewall.ports.tcp` | list of ints                       | `[ 22 80 ]`                             |
+| `firewall.ports.udp` | list of ints                       | `[ 53 ]`                                |
+| `extraHosts`         | list of `{ ip_address, hostname }` | `[]`                                    |
+| `nameservers`        | list of strings                    | `["192.168.1.193" "1.1.1.1" "1.0.0.1"]` |
+
+**Required only when you add `extraHosts` entries:** `ip_address` and `hostname` (no defaults on those sub-options).
+
+**Minimal core block:**
+
+```nix
+homelab.networking = {
+  core = {
+    nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    # firewall defaults are usually fine
+  };
+};
+```
+
+### `homelab.networking.wireguard` (optional)
+
+| Option       | Type                         | Default                                       |
+| ------------ | ---------------------------- | --------------------------------------------- |
+| `enable`     | bool                         | `false`                                       |
+| `interfaces` | attrset of interface configs | _(no default — use `{}` or omit if disabled)_ |
+
+**Per interface** (`interfaces.<name>`):
+
+| Option           | Required?                        | Default |
+| ---------------- | -------------------------------- | ------- |
+| `enable`         | no                               | `false` |
+| `address`        | no                               | `[]`    |
+| `privateKeyFile` | **yes** (when interface enabled) | —       |
+| `peers`          | no                               | `[]`    |
+
+**Per peer:**
+
+| Option                | Required? | Default |
+| --------------------- | --------- | ------- |
+| `publicKey`           | **yes**   | —       |
+| `allowedIPs`          | no        | `[]`    |
+| `endpoint`            | no        | `""`    |
+| `persistentKeepalive` | no        | `null`  |
+
+**Example when enabled:**
+
+```nix
+homelab.networking.wireguard = {
+  enable = true;
+  interfaces.wg0 = {
+    enable = true;
+    address = [ "10.0.0.2/24" ];
+    privateKeyFile = "/path/to/private.key";
+    peers = [{
+      publicKey = "...";
+      allowedIPs = [ "0.0.0.0/0" ];
+      endpoint = "vpn.example.com:51820";
+    }];
+  };
+};
+```
+
+**Note:** `wireguard.nix` exists but is **not** imported in `modules/networking/default.nix` — only `core` and `tailscale` are. You’d need to add `./wireguard.nix` to that imports list for WireGuard to work.
+
+### `homelab.networking.tailscale` (optional)
+
+| Option   | Type | Default |
+| -------- | ---- | ------- |
+| `enable` | bool | `false` |
+
+**Minimal:**
+
+```nix
+homelab.networking.tailscale.enable = true;
+# uses homelab.networking.user (default "river") as operator
+```
+
+---
+
+## `homelab.virtualization`
+
+Split into `podman` and `qemu`.
+
+### Top-level
+
+| Option | Type   | Default   |
+| ------ | ------ | --------- | ----------------------------------------- |
+| `user` | string | `"river"` | Added to `libvirtd`/`kvm`/`podman` groups |
+
+### `homelab.virtualization.podman`
+
+| Option            | Type | Default |
+| ----------------- | ---- | ------- | ----------------------------------------------------- |
+| `enable`          | bool | `false` |
+| `packages.enable` | bool | `false` | Installs `podman`, `podman-compose`, `podman-desktop` |
+
+**Minimal:**
+
+```nix
+homelab.virtualization.podman = {
+  enable = true;
+  packages.enable = true;  # optional
+};
+```
+
+### `homelab.virtualization.qemu`
+
+| Option                | Type            | Default                     |
+| --------------------- | --------------- | --------------------------- | ----------------------------------------------------------------------------------------------- |
+| `enable`              | bool            | `false`                     |
+| `containers.enable`   | bool            | `false`                     | _(defined in options but not wired in `qemu.nix` — containers are always enabled when qemu is)_ |
+| `spiceUSBRedirection` | bool            | `false`                     |
+| `virtManager`         | bool            | `false`                     |
+| `bootModules`         | list of strings | `[ "kvm-intel" "kvm-amd" ]` |
+
+**Minimal:**
+
+```nix
+homelab.virtualization.qemu = {
+  enable = true;
+  virtManager = true;  # optional GUI
+};
+```
+
+When `qemu.enable = true`, the module sets up `libvirtd`, adds your user to `libvirtd`/`kvm`, and loads KVM modules.
+
+---
+
+## Full skeleton for `hosts/test/configuration.nix`
+
+```nix
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/core
+    ../../modules/networking
+    ../../modules/virtualization
+  ];
+
+  homelab.core = {
+    kernel = "lts";
+    bootloader = {
+      type = "systemd";
+      systemd.enable = true;
+    };
+  };
+
+  homelab.networking = {
+    core.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    tailscale.enable = true;
+  };
+
+  homelab.virtualization = {
+    podman.enable = true;
+    qemu = {
+      enable = true;
+      virtManager = true;
+    };
+  };
+}
+```
diff --git a/hosts/test/configuration.nix b/hosts/test/configuration.nix
index a9c0db7..4fdb6fb 100644
--- a/hosts/test/configuration.nix
+++ b/hosts/test/configuration.nix
@@ -1,10 +1,38 @@
 {
-  config,
-  lib,
-  pkgs,
   ...
 }:
 
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/core
+    ../../modules/networking
+    ../../modules/virtualization
+  ];
+
+  homelab = {
+    core = {
+      kernel = "lts";
+      bootloader = {
+        type = "grub";
+        grub = {
+          enable = true;
+          device = "nodev";
+        };
+      };
+    };
+
+    virtualization = {
+      podman = {
+        enable = true;
+        packages.enable = true;
+      };
+      qemu = {
+        enable = true;
+        virtManager = false;
+      };
+    };
+
+    networking.tailscale.enable = true;
+  };
 }