diff --git a/clanModules/borgbackup.nix b/clanModules/borgbackup.nix
index 03d6e1c0..e5bb6630 100644
--- a/clanModules/borgbackup.nix
+++ b/clanModules/borgbackup.nix
@@ -28,6 +28,7 @@ in
               default = "ssh -i ${
                 config.clanCore.facts.services.borgbackup.secret."borgbackup.ssh".path
               } -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
+              defaultText = "ssh -i \${config.clanCore.facts.services.borgbackup.secret.\"borgbackup.ssh\".path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
               description = "the rsh to use for the backup";
             };
           };
diff --git a/clanModules/localsend.nix b/clanModules/localsend.nix
index 3172b8dd..945238e3 100644
--- a/clanModules/localsend.nix
+++ b/clanModules/localsend.nix
@@ -17,28 +17,22 @@
     package = lib.mkPackageOption pkgs "localsend" { };
   };
 
-  imports =
-    if config.clan.localsend.enable then
-      [
-        {
-          clanCore.state.localsend.folders = [
-            "/var/localsend"
-            config.clan.localsend.defaultLocation
-          ];
-          environment.systemPackages = [ config.clan.localsend.package ];
+  config = lib.mkIf config.clan.localsend.enable {
+    clanCore.state.localsend.folders = [
+      "/var/localsend"
+      config.clan.localsend.defaultLocation
+    ];
+    environment.systemPackages = [ config.clan.localsend.package ];
 
-          networking.firewall.interfaces."zt+".allowedTCPPorts = [ 53317 ];
-          networking.firewall.interfaces."zt+".allowedUDPPorts = [ 53317 ];
+    networking.firewall.interfaces."zt+".allowedTCPPorts = [ 53317 ];
+    networking.firewall.interfaces."zt+".allowedUDPPorts = [ 53317 ];
 
-          #TODO: This is currently needed because there is no ipv6 multicasting support yet
-          #
-          systemd.network.networks."09-zerotier" = {
-            networkConfig = {
-              Address = "192.168.56.2/24";
-            };
-          };
-        }
-      ]
-    else
-      [ ];
+    #TODO: This is currently needed because there is no ipv6 multicasting support yet
+    #
+    systemd.network.networks."09-zerotier" = {
+      networkConfig = {
+        Address = "192.168.56.2/24";
+      };
+    };
+  };
 }
diff --git a/clanModules/syncthing.nix b/clanModules/syncthing.nix
index 7dbadaab..6e1cdd0d 100644
--- a/clanModules/syncthing.nix
+++ b/clanModules/syncthing.nix
@@ -10,6 +10,7 @@
       type = lib.types.nullOr lib.types.str;
       example = "BABNJY4-G2ICDLF-QQEG7DD-N3OBNGF-BCCOFK6-MV3K7QJ-2WUZHXS-7DTW4AS";
       default = config.clanCore.facts.services.syncthing.public."syncthing.pub".value or null;
+      defaultText = "config.clanCore.facts.services.syncthing.public.\"syncthing.pub\".value";
     };
     introducer = lib.mkOption {
       description = ''
diff --git a/docs/flake-module.nix b/docs/flake-module.nix
new file mode 100644
index 00000000..6de028ae
--- /dev/null
+++ b/docs/flake-module.nix
@@ -0,0 +1,72 @@
+{
+  self,
+  lib,
+  inputs,
+  ...
+}:
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+
+      allNixosModules = (import "${inputs.nixpkgs}/nixos/modules/module-list.nix") ++ [
+        "${inputs.nixpkgs}/nixos/modules/misc/assertions.nix"
+        { nixpkgs.hostPlatform = "x86_64-linux"; }
+      ];
+
+      clanCoreNixosModules = [ self.nixosModules.clanCore ] ++ allNixosModules;
+
+      # options = modules: (inputs.nixpkgs.legacyPackages.x86_64-linux.nixos { imports = modules; }).options;
+      options =
+        modules:
+        (lib.evalModules {
+          modules = modules;
+          # modules = modules ++ ["${inputs.nixpkgs}/nixos/modules/misc/assertions.nix"];
+          # specialArgs = { pkgs = pkgs; };
+        }).options;
+
+      docs =
+        options:
+        pkgs.nixosOptionsDoc {
+          options = options;
+          warningsAreErrors = false;
+          transformOptions =
+            opt:
+            opt
+            // {
+              declarations = lib.forEach opt.declarations (
+                decl:
+                if lib.hasPrefix "${self}" decl then
+                  let
+                    subpath = lib.removePrefix "${self}" decl;
+                  in
+                  {
+                    url = "https://git.clan.lol/clan/clan-core/src/branch/main/" + subpath;
+                    name = subpath;
+                  }
+                else
+                  decl
+              );
+            };
+        };
+
+      outputsFor = name: docs: { packages."docs-md-${name}" = docs.optionsCommonMark; };
+
+      clanModulesPages = lib.flip lib.mapAttrsToList self.clanModules (
+        name: module:
+        outputsFor "module-${name}" (
+          docs (options ([ module ] ++ clanCoreNixosModules)).clan.${name} or { }
+        )
+      );
+    in
+    {
+      imports =
+        clanModulesPages
+        # uncomment to render clanCore top-level options as extra pages
+        # ++ clanCorePages
+        ++ [
+          # renders all clanCore options as a single page
+          (outputsFor "core-options" (docs (options clanCoreNixosModules).clanCore))
+        ];
+    };
+}
diff --git a/flake.nix b/flake.nix
index 1f03f9cc..0326d066 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,15 +34,14 @@
         ];
         imports = [
           ./checks/flake-module.nix
-          ./devShell.nix
-          ./formatter.nix
-          ./templates/flake-module.nix
           ./clanModules/flake-module.nix
-
-          ./pkgs/flake-module.nix
-
+          ./devShell.nix
+          ./docs/flake-module.nix
+          ./formatter.nix
           ./lib/flake-module.nix
           ./nixosModules/flake-module.nix
+          ./pkgs/flake-module.nix
+          ./templates/flake-module.nix
           {
             options.flake = flake-parts.lib.mkSubmoduleOptions {
               clanInternals = lib.mkOption {
diff --git a/nixosModules/clanCore/facts/compat.nix b/nixosModules/clanCore/facts/compat.nix
index bbc83fbb..95f06654 100644
--- a/nixosModules/clanCore/facts/compat.nix
+++ b/nixosModules/clanCore/facts/compat.nix
@@ -40,6 +40,7 @@
     )
   ];
   options.clanCore.secrets = lib.mkOption {
+    visible = false;
     default = { };
     type = lib.types.attrsOf (
       lib.types.submodule (service: {