diff --git a/.gitignore b/.gitignore
index d715629..aef50a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-modules/usb-devices.nix
+#modules/usb-devices.nix
diff --git a/modules/packages.nix b/modules/packages.nix
index a5d11a9..0f2fc47 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -88,7 +88,7 @@
     awscli2
     # azure-cli
     google-cloud-sdk
-    docker-compose
+    podman-compose
     argocd
     fluxcd
     kubectx         # switch between contexts/namespaces
diff --git a/modules/programs.nix b/modules/programs.nix
index dff0b34..f90c40f 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -42,7 +42,4 @@
   # Virtualization (KVM/QEMU)
   virtualisation.libvirtd.enable = true;
   programs.virt-manager.enable = true;
-
-  # Docker
-  virtualisation.docker.enable = true;
 }
diff --git a/modules/security.nix b/modules/security.nix
index 31d2e11..2953030 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -49,6 +49,9 @@
     implicitPolicyTarget = "block";
   };
 
+  # OpenSnitch Application Firewall
+  services.opensnitch.enable = true;
+
   security.pam.loginLimits = [
     { domain = "*"; item = "core"; type = "-"; value = "0"; }
   ];
@@ -84,5 +87,7 @@
     lynis
     audit
     tcpdump
+    bandwhich
+    opensnitch-ui
   ];
 }
diff --git a/modules/usb-devices.nix b/modules/usb-devices.nix
new file mode 100644
index 0000000..133d9b0
--- /dev/null
+++ b/modules/usb-devices.nix
@@ -0,0 +1,12 @@
+{ ... }:
+
+{
+  services.usbguard.rules = ''
+allow id 1d6b:0002 serial "0000:07:00.3" name "xHCI Host Controller" hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0003 serial "0000:07:00.3" name "xHCI Host Controller" hash "O6iOpcl9StImWT62SrbeXacqbG6N/mTIipTRc0ipCGM=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0002 serial "0000:07:00.4" name "xHCI Host Controller" hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0003 serial "0000:07:00.4" name "xHCI Host Controller" hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
+allow id 2357:0604 serial "EC750C9EF6C2" name "TP-Link Bluetooth USB Adapter" hash "8yVJfhZNa1ezefblgi5rzbI/GwSPhCMRRHgbUgMtJ1I=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hotplug"
+allow id 058f:9540 serial "" name "EMV Smartcard Reader" hash "j6z/wqFtA1bZWwBIPmIr/g8KfsEQJ63vpgf4cBcNLbU=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" via-port "1-3" with-interface 0b:00:00 with-connect-type "not used"
+  '';
+}
diff --git a/modules/users.nix b/modules/users.nix
index 46dd89c..4857982 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -8,7 +8,7 @@
   users.users.asxpi = {
     isNormalUser = true;
     description = "Sergei P";
-    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "docker" ];
+    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "podman" ];
     shell = pkgs.zsh;
     packages = with pkgs; [
       # Internet