The composer configuration should also be maintained via home-manager. The files are added to this repo and added via xdg. The auth.json is crypted of course as it contains my personal tokens.
