diff --git a/hosts/common/default.nix b/hosts/common/default.nix
new file mode 100644
index 0000000..fd71467
--- /dev/null
+++ b/hosts/common/default.nix
@@ -0,0 +1,159 @@
+# Shared base for all hosts (dogma-nixos, dogma-nixos-rtx, dogma-wsl)
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = "America/Phoenix";
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.secrets = {
+    "factorio/service_username" = {};
+    "factorio/service_token" = {};
+    "factorio/gamepassword" = {};
+    "backblaze/apikey" = {};
+    "google/gmail" = {};
+    "caddy/acme_email" = {};
+    "dedyn/dnstoken" = {};
+    "dedyn/dnsuser" = {};
+    "github/token" = {};
+    "gitlab/token" = {};
+    "mongodb/initial_password" = {};
+    "namecheap/ddyn_password" = {
+      restartUnits = ["ddclient.service"];
+    };
+  };
+
+  sops.templates."factorio.json".content = builtins.toJSON {
+    service_username = config.sops.placeholder."factorio/service_username";
+    service_token = config.sops.placeholder."factorio/service_token";
+    gamepassword = config.sops.placeholder."factorio/gamepassword";
+  };
+
+  sops.templates."duplicity.env".content = builtins.toJSON { };
+
+  sops.templates."caddy.env" = {
+    owner = "root";
+    mode = "0600";
+    restartUnits = ["caddy.service"];
+    content = ''
+      ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
+    '';
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+  services.getty.autologinUser = "mask";
+  users.users.mask = {
+    isNormalUser = true;
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+      "libvirtd"
+      "media"
+      "uinput"
+    ];
+  };
+
+  networking.networkmanager.enable = true;
+
+  # Keep firewall disabled as in original configuration.nix:424
+  networking.firewall.enable = false;
+
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      zlib
+      zstd
+      stdenv.cc.cc
+      curl
+      openssl
+      libssh
+      bzip2
+      libxml2
+      acl
+      libsodium
+      util-linux
+      xz
+      systemd
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    qbittorrent
+    pinentry-qt
+    ddclient
+    telegram-desktop
+    btop
+    doas
+    lan-mouse
+    stylua
+    gh
+    glab
+    gnupg
+    duplicity
+    wget
+    factorio-headless
+    dig
+    parted
+    tor-browser
+    jujutsu
+    caddy
+    clang
+    ansible
+    exiftool
+    gcc
+    home-manager
+    flaresolverr
+    docker-compose
+    virtio-win
+    spice
+    spice-gtk
+    OVMF
+    pigz
+    mpv
+    wofi
+    wayvnc
+    pcmanfm
+    htop
+    rsync
+    tmux
+    git
+    kitty
+    python3
+    deno
+    qbittorrent-nox
+    sonarr
+    radarr
+    jackett
+    jellyfin
+    curl
+    p7zip
+    dnsmasq
+    brave
+    keepassxc
+    sops
+    age
+    unzip
+  ];
+
+  services.openssh.enable = true;
+
+  system.stateVersion = "25.11";
+}