diff --git a/hosts/othalan/default.nix b/hosts/othalan/default.nix
index b8b8dff..2ae977c 100644
--- a/hosts/othalan/default.nix
+++ b/hosts/othalan/default.nix
@@ -5,7 +5,6 @@
   ...
 }: {
   imports = with inputs.self.nixosModules; [
-    common
     desktop
     hyprland
 
@@ -20,6 +19,9 @@
     node
     tex
   ];
+  services.vpn.enable = true;
+
+
   services.restic.backups.gdrive = {
     user = "daylin";
     repository = "rclone:g:archives/othalan";
@@ -31,9 +33,6 @@
     zk
     rclone
     quarto
-
-    expect
-    openconnect
   ];
 
   programs.gnupg.agent = {
diff --git a/modules/profiles/common.nix b/modules/roles/common.nix
similarity index 100%
rename from modules/profiles/common.nix
rename to modules/roles/common.nix
diff --git a/modules/profiles/desktop.nix b/modules/roles/desktop.nix
similarity index 94%
rename from modules/profiles/desktop.nix
rename to modules/roles/desktop.nix
index b692642..3276918 100644
--- a/modules/profiles/desktop.nix
+++ b/modules/roles/desktop.nix
@@ -8,6 +8,7 @@
     common
     gui
     vscode
+    vpn
     # qtile
   ];
 }
diff --git a/modules/vpn.nix b/modules/vpn.nix
new file mode 100644
index 0000000..b0db6d7
--- /dev/null
+++ b/modules/vpn.nix
@@ -0,0 +1,13 @@
+{config, lib,pkgs,...}:
+let
+  inherit (lib) mkEnableOption mkIf;
+  cfg = config.services.vpn;
+in {
+  options.services.vpn.enable = mkEnableOption ''
+    use openconnect vpn
+  '';
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [pkgs.openconnect];
+  };
+}