wip: add specus VPN

2026-03-29 08:41:07 +02:00 · 2023-04-14 08:43:23 +02:00
69 changed files with 985 additions and 1207 deletions
--- a/.github/workflows/niveum.yml
+++ b/.github/workflows/niveum.yml
@@ -9,29 +9,6 @@ jobs:
      matrix:
        system: [makanek,manakish,kabsa,zaatar,ful]
    steps:
-    - uses: actions/checkout@v3
-    - name: Install QEMU (ARM)
-      run: sudo apt-get install -y qemu-user-static
-      if: ${{ matrix.system == 'ful' }}
-    - name: Install Nix (ARM)
-      uses: cachix/install-nix-action@v16
-      if: ${{ matrix.system == 'ful' }}
-      with:
-        extra_nix_config: |
-          system = aarch64-linux
-    - name: Install Nix (x86_64)
-      uses: cachix/install-nix-action@v16
-      if: ${{ matrix.system != 'ful' }}
-    - name: nixos-rebuild dry-build
-      run: |
-        # remove secrets: ref https://stackoverflow.com/questions/1260748/how-do-i-remove-a-submodule/36593218
-        git submodule deinit -f secrets
-        rm -rf .git/modules/secrets
-        git rm -f secrets
-
-        # recreate secrets
-        mkdir secrets
-        cat secrets.txt | while read -r path; do touch $path; done
-        git add secrets
-
-        nix run nixpkgs#nixos-rebuild -- dry-build  --flake $GITHUB_WORKSPACE#${{matrix.system}}
+    - uses: actions/checkout@v2
+    - uses: cachix/install-nix-action@v16
+    - run: nix run .?submodules=1#apps.nixinate.${{matrix.system}}-dry-run
--- a/configs/android.nix
+++ b/configs/android.nix
@@ -1,5 +0,0 @@
-{
-  programs.adb.enable = true;
-
-  users.users.me.extraGroups = ["adbusers"];
-}
--- a/configs/backup.nix
+++ b/configs/backup.nix
@@ -20,7 +20,6 @@ in {
    paths = [
      "/home/kfm/work"
      "/home/kfm/projects"
-      "/home/kfm/Zotero"
      "/home/kfm/notes"
      "/home/kfm/Maildir"
      "/home/kfm/cloud"
--- a/configs/bash.nix
+++ b/configs/bash.nix
@@ -1,7 +1,7 @@
-{pkgs, ...}: {
+{
  programs.bash = {
    promptInit = ''
-      PS1="$(${pkgs.ncurses}/bin/tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(${pkgs.ncurses}/bin/tput sgr0) "'';
+      PS1="$(tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(tput sgr0) "'';
    interactiveShellInit = ''
      set -o vi
    '';
--- a/configs/cloud.nix
+++ b/configs/cloud.nix
@@ -12,15 +12,23 @@ in {
      user = config.users.users.me.name;
      group = "users";
      mode = "0755";
-      argument = "${config.users.users.me.home}/cloud/nextcloud/Uni";
+      argument = "${config.users.users.me.home}/cloud/Seafile/Uni";
      path = "${config.users.users.me.home}/uni";
    }
+    {
+      type = "L+";
+      user = config.users.users.me.name;
+      group = "users";
+      mode = "0755";
+      argument = "${config.users.users.me.home}/cloud/syncthing/common/mahlzeit";
+      path = "${config.users.users.me.home}/mahlzeit";
+    }
  ];

  home-manager.users.me = {
-    services.gnome-keyring.enable = true;
+    services.gnome-keyring.enable = false;
    services.nextcloud-client = {
-      enable = true;
+      enable = false;
      startInBackground = true;
    };
    systemd.user.services.nextcloud-client = {
@@ -32,7 +40,7 @@ in {
  };

  systemd.user.services.nextcloud-syncer = {
-    enable = false;
+    enable = true;
    wants = ["network-online.target"];
    wantedBy = ["default.target"];
    startAt = "*:00/10";
@@ -40,7 +48,7 @@ in {
      kieran = {
        user = "kieran";
        passwordFile = config.age.secrets.nextcloud-password-kieran.path;
-        endpoint = "https://cloud.kmein.de";
+        endpoint = "https://cloud.xn--kiern-0qa.de";
        target = "${config.users.users.me.home}/notes";
      };
    in ''
@@ -58,7 +66,7 @@ in {
      set -efu
      book="$({
        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/syncthing/library -type f
-        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/nextcloud/Books -type f
+        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/Seafile/Books -type f
      } | ${pkgs.fzf}/bin/fzf)"
      exec ${pkgs.zathura}/bin/zathura "$book"
    '')
@@ -95,6 +103,16 @@ in {
    mode = "400";
  };

+  fileSystems."/media/moodle" = {
+    device = "zaatar.r:/moodle";
+    fsType = "nfs";
+    options = [
+      "x-systemd.idle-timeout=600"
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+
  services.syncthing = rec {
    enable = true;
    user = "kfm";
@@ -107,14 +125,9 @@ in {
    folders = let
      cloud-dir = "${config.users.users.me.home}/cloud";
    in {
-      "${cloud-dir}/syncthing/zotero".devices = ["kabsa" "manakish"];
      "${cloud-dir}/syncthing/common".devices = ["kabsa" "manakish"];
      "${cloud-dir}/syncthing/library".devices = ["kabsa" "manakish" "heym"];
      "${cloud-dir}/syncthing/mundoiu".devices = ["kabsa" "manakish" "heym"];
-      "${cloud-dir}/syncthing/obsidian" = {
-        devices = ["kabsa" "manakish" "heym"];
-        id = "3r1hu-3barr";
-      };
      "${cloud-dir}/syncthing/music" = {
        devices = ["kabsa" "manakish" "heym" "zaatar"];
        id = "music";
--- a/configs/default.nix
+++ b/configs/default.nix
@@ -31,7 +31,7 @@ in {
      };
    }
    {
-      boot.tmp.cleanOnBoot = true;
+      boot.cleanTmpDir = true;
      boot.loader.timeout = 1;
    }
    {
@@ -70,15 +70,11 @@ in {
      users.users.me = {
        name = "kfm";
        description = kieran.name;
-        passwordFile = config.age.secrets.kfm-password.path;
+        hashedPassword = "$6$w9hXyGFl/.IZBXk$5OiWzS1G.5hImhh1YQmZiCXYNAJhi3X6Y3uSLupJNYYXPLMsQpx2fwF4Xr2uYzGMV8Foqh8TgUavx1APD9rcb/";
        isNormalUser = true;
        uid = 1000;
      };

-      age.secrets = {
-        kfm-password.file = ../secrets/kfm-password.age;
-      };
-
      home-manager.users.me.xdg.enable = true;
    }
    {
@@ -225,10 +221,10 @@ in {
        };
      };
    }
-    ./android.nix
    ./alacritty.nix
    ./backup.nix
    ./bash.nix
+    ./beets.nix
    ./bluetooth.nix
    ./aerc.nix
    ./ccc.nix
@@ -267,7 +263,7 @@ in {
    ./retiolum.nix
    ./rofi.nix
    ./spacetime.nix
-    # ./seafile.nix
+    ./seafile.nix
    ./ssh.nix
    ./sshd.nix
    ./sound.nix
--- a/configs/fonts.nix
+++ b/configs/fonts.nix
@@ -68,7 +68,6 @@ in {
      corefonts
      crimson
      eb-garamond
-      ipaexfont
      jsesh
      egyptianHiero
      egyptianText
@@ -109,7 +108,7 @@ in {
    fontconfig.defaultFonts = rec {
      monospace = ["Noto Sans Mono"] ++ emoji;
      serif = ["Noto Serif" "Noto Naskh Arabic" "Noto Serif Devanagari"];
-      sansSerif = ["Noto Sans Display" "Noto Naskh Arabic" "Noto Sans Devanagari" "Noto Sans CJK JP" "Noto Sans Coptic"];
+      sansSerif = ["Noto Sans Display" "Noto Kufi Arabic" "Noto Sans Devanagari" "Noto Sans CJK JP"];
      emoji = ["Noto Color Emoji"];
    };
    # xelatex fails with woff files
--- a/configs/fzf.nix
+++ b/configs/fzf.nix
@@ -21,8 +21,17 @@
    };
  };

-  programs.fzf = {
-    fuzzyCompletion = true;
-    keybindings = true;
-  };
+  programs.zsh.interactiveShellInit = ''
+    if [[ $options[zle] = on ]]; then
+      . ${pkgs.fzf}/share/fzf/completion.zsh
+      . ${pkgs.fzf}/share/fzf/key-bindings.zsh
+    fi
+  '';
+
+  programs.bash.interactiveShellInit = ''
+    if [[ :$SHELLOPTS: =~ :(vi|emacs): ]]; then
+      . ${pkgs.fzf}/share/fzf/completion.bash
+      . ${pkgs.fzf}/share/fzf/key-bindings.bash
+    fi
+  '';
 }
--- a/configs/git.nix
+++ b/configs/git.nix
@@ -51,7 +51,6 @@ in {
        pull.ff = "only";
        rebase.autoStash = true;
        merge.autoStash = true;
-        push.autoSetupRemote = true;

        # # ref https://github.com/dandavison/delta
        # core.pager = "${pkgs.delta}/bin/delta";
--- a/configs/hledger.nix
+++ b/configs/hledger.nix
@@ -17,8 +17,8 @@
    '')
    (pkgs.writers.writeDashBin "hora-filli" ''
      ${pkgs.hledger}/bin/hledger -f "${timeLedger}" register fillidefilla -O csv \
-        -b "$(date -d "$(date +%Y-%m)-01 last month" +%Y-%m-%d)" \
-        -e "$(date -d "$(date +%Y-%m)-01" +%Y-%m-%d)" \
+        -b "$(date -d "$(date +%Y-%m)-20 last month" +%Y-%m-%d)" \
+        -e "$(date -d "$(date +%Y-%m)-20" +%Y-%m-%d)" \
        | sed 's/(fillidefilla:\(.*\))/\1/g' \
        | xsv select date,amount,total,account,description
    '')
--- a/configs/htop.nix
+++ b/configs/htop.nix
@@ -20,7 +20,7 @@
        show_thread_names = false;
        sort_descending = true;
        sort_key = "PERCENT_CPU";
-        tree_view = false;
+        tree_view = true;
        update_process_names = false;
        right_meters = ["Uptime" "Tasks" "LoadAverage" "Battery"];
        left_meters = ["LeftCPUs2" "RightCPUs2" "Memory" "Swap"];
--- a/configs/hu-berlin.nix
+++ b/configs/hu-berlin.nix
@@ -63,9 +63,6 @@ in {
    )
  ];

-  # ref https://github.com/NixOS/nixpkgs/issues/231038#issuecomment-1591888919
-  environment.etc."ppp/options".text = "ipcp-accept-remote";
-
  systemd.services.hu-vpn = {
    enable = true;
    wants = ["network-online.target"];
@@ -80,6 +77,7 @@ in {
          host = forti-ssl.vpn.hu-berlin.de
          port = 443
          username = meinhark
+          trusted-cert = 9e5dea8e077970d245900839f437ef7fb9551559501c7defd70af70ea568573d
        ''
      }
      fi
--- a/configs/i3.nix
+++ b/configs/i3.nix
@@ -50,9 +50,6 @@
      emojai = pkgs.writers.writeDash "emojai" ''
        ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
      '';
-      gpt = pkgs.writers.writeDash "gpt" ''
-        ${niveumPackages.gpt}/bin/gpt
-      '';
    };
  };

@@ -270,7 +267,25 @@ in {
        "${modifier}+0" = "exec ${niveumPackages.menu-calc}/bin/=";

        "${modifier}+d" = "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
-        "${modifier}+Shift+d" = "exec ${niveumPackages.notemenu}/bin/notemenu";
+        "${modifier}+Shift+d" = "exec ${
+          pkgs.writers.writeDash "notemenu" ''
+            set -efu
+            PATH=$PATH:${
+              lib.makeBinPath [pkgs.rofi pkgs.findutils pkgs.coreutils]
+            }
+
+            cd ~/notes
+            note_file=$({
+              echo diary/$(date -I).md
+              echo diary/$(date -I -d yesterday).md
+              find . ! -name '.*' -type f -printf "%T@ %p\n" | sort --reverse --numeric-sort | cut --delimiter=" " --fields=2-
+            } | rofi -dmenu -i -p 'notes')
+            if test "$note_file"
+            then
+              alacritty --working-directory ~/notes -e "$EDITOR" "$note_file"
+            fi
+          ''
+        }";
        "${modifier}+p" = "exec rofi-pass";
        "${modifier}+Shift+p" = "exec rofi-pass --insert";
        "${modifier}+u" = "exec ${niveumPackages.unicodmenu}/bin/unicodmenu";
--- a/configs/keyboard.nix
+++ b/configs/keyboard.nix
@@ -12,7 +12,6 @@
    ara = "buckwalter";
    cop = "";
    ave = "";
-    got = "";
    "in" = "san-kagapa";
    il = "phonetic";
  };
@@ -38,13 +37,6 @@ in {
              sha256 = "1l0h6aq536hyinrh0i0ia355y229bjrlibii0sya5bmqh46vycia";
            };
          }
-          {
-            name = "symbols/got";
-            path = pkgs.fetchurl {
-              url = "https://c.krebsco.de/got";
-              sha256 = "1i0jxghxi3rldlijw6gm2xawrv7f0pmm7a5cqbzzgjrg7ldk46gd";
-            };
-          }
          {
            name = "symbols/ave";
            path = pkgs.fetchurl {
--- a/configs/khal.nix
+++ b/configs/khal.nix
@@ -6,7 +6,7 @@
 }: let
  davHome = "~/.local/share/dav";
  kmeinCloud = {
-    davEndpoint = "https://cloud.kmein.de/remote.php/dav";
+    davEndpoint = "https://cloud.xn--kiern-0qa.de/remote.php/dav";
    username = "kieran";
    passwordFile = config.age.secrets.nextcloud-password-kieran.path;
  };
@@ -54,7 +54,8 @@ in {
    wantedBy = ["default.target"];
    startAt = "*:00/10";
    script = ''
-      ${pkgs.vdirsyncer}/bin/vdirsyncer sync && ${pkgs.khal}/bin/khal printcalendars # https://lostpackets.de/khal/configure.html#syncing
+      ${pkgs.vdirsyncer}/bin/vdirsyncer sync
+      ${pkgs.khal}/bin/khal printcalendars # https://lostpackets.de/khal/configure.html#syncing
    '';
    serviceConfig = {
      Type = "oneshot";
@@ -111,10 +112,6 @@ in {
        path = ${davHome}/calendar/personal
        color = "light cyan"

-        [[krebs]]
-        path = ${davHome}/calendar/krebs
-        color = "light red"
-
        [[uni]]
        path = ${davHome}/calendar/uni-1
        color = "yellow"
@@ -165,12 +162,6 @@ in {
        collections = ["personal", "alew", "uni-1"]
        conflict_resolution = "b wins"

-        [pair krebs]
-        a = "kalender_local"
-        b = "krebs_cloud"
-        collections = ["3edef929-d509-7944-2440-000a54f2d054"]
-        conflict_resolution = "b wins"
-
        [pair fysi]
        a = "kalender_local"
        b = "fysi_cloud"
@@ -199,12 +190,6 @@ in {
        username = "${kmeinCloud.username}"
        password.fetch = ["command", "cat", "${kmeinCloud.passwordFile}"]

-        [storage krebs_cloud]
-        type = "caldav"
-        url = "http://calendar.r/krebs/"
-        username = "krebs"
-        password = "krebs"
-
        [storage fysi_cloud]
        type = "caldav"
        url = "${fysiCloud.davEndpoint}/calendars/${fysiCloud.username}/"
--- a/configs/neovim.nix
+++ b/configs/neovim.nix
@@ -10,6 +10,64 @@

  environment.systemPackages = [
    (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
-    niveumPackages.vim
+    (pkgs.neovim.override {
+      configure = {
+        customRC = ''
+          source ${../lib/vim/init.vim}
+
+          luafile ${../lib/vim/init.lua}
+        '';
+        packages.nvim = with pkgs.vimPlugins; {
+          start = [
+            ale
+            fzf-vim
+            fzfWrapper
+            supertab
+            undotree
+            tabular
+            # vimwiki
+            niveumPackages.vimPlugins-vim-colors-paramount
+            nvim-lspconfig
+            vim-commentary
+            vim-css-color
+            vim-eunuch
+            niveumPackages.vimPlugins-vim-fetch
+            vim-fugitive
+            vim-gitgutter
+            vim-repeat
+            vim-sensible
+            vim-surround
+            (pkgs.vimUtils.buildVimPlugin rec {
+              pname = "vim-dim";
+              version = "1.1.0";
+              name = "${pname}-${version}";
+              src = pkgs.fetchFromGitHub {
+                owner = "jeffkreeftmeijer";
+                repo = pname;
+                rev = version;
+                sha256 = "sha256-lyTZUgqUEEJRrzGo1FD8/t8KBioPrtB3MmGvPeEVI/g=";
+              };
+            })
+          ];
+          opt = [
+            csv
+            elm-vim
+            emmet-vim
+            haskell-vim
+            niveumPackages.vimPlugins-icalendar-vim
+            niveumPackages.vimPlugins-jq-vim
+            rust-vim
+            typescript-vim
+            vim-javascript
+            vim-ledger
+            vim-nix
+            vimtex
+            vim-pandoc
+            vim-pandoc-syntax
+            niveumPackages.vimPlugins-vim-256noir
+          ];
+        };
+      };
+    })
  ];
 }
--- a/configs/nix.nix
+++ b/configs/nix.nix
@@ -1,14 +1,9 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
+{pkgs, ...}: {
  nixpkgs = {
    config.allowUnfree = true;
  };
  nix = {
    package = pkgs.nixFlakes;
    extraOptions = "experimental-features = nix-command flakes";
-    nixPath = ["nixpkgs=${inputs.nixpkgs}"];
  };
 }
--- a/configs/packages.nix
+++ b/configs/packages.nix
@@ -4,7 +4,6 @@
  lib,
  inputs,
  niveumPackages,
-  unstablePackages,
  ...
 }: let
  worldradio = pkgs.callPackage ../packages/worldradio.nix {};
@@ -96,7 +95,6 @@ in {
    genpass # generate passwords
    gdu # ncurses disk usage (ncdu is broken)
    rmlint # remove duplicate files
-    gcc
    python3Packages.jsonschema # json validation
    jq # json toolkit
    pup # html toolkit
@@ -125,7 +123,6 @@ in {
    electrum
    inkscape
    astrolog
-    obsidian
    anki-bin # flashcards
    jbofihe # lojbanic software
    zoom-us # video conferencing
@@ -180,9 +177,6 @@ in {
    (niveumPackages.mpv-radio.override {
      di-fm-key-file = config.age.secrets.di-fm-key.path;
    })
-    (niveumPackages.mpv-tuner.override {
-      di-fm-key-file = config.age.secrets.di-fm-key.path;
-    })
    # kmein.slide
    termdown
    niveumPackages.image-convert-tolino
@@ -227,12 +221,6 @@ in {
    niveumPackages.kpaste
    config.nur.repos.mic92.ircsink

-    (haskellPackages.ghcWithHoogle (hs: [
-      hs.text
-      hs.lens
-      hs.bytestring
-    ]))
-
    (python3.withPackages (py: [
      py.black
      # py.python-language-server
@@ -251,20 +239,16 @@ in {
    texlab
    nil
    rust-analyzer
-    elmPackages.elm-language-server
-    nodePackages.typescript-language-server
-    lua-language-server
-    nodePackages.vscode-langservers-extracted

    html-tidy
    nodePackages.csslint
    nodePackages.jsonlint
    nodePackages.prettier
    nodePackages.typescript
-    nodePackages.eslint
    nodePackages.yarn
    deno # better node.js
    nodejs
+    nodePackages.javascript-typescript-langserver
    texlive.combined.scheme-full
    latexrun
    (aspellWithDicts (dict: [dict.de dict.en dict.en-computers]))
@@ -277,7 +261,6 @@ in {
    dia
    pandoc
    niveumPackages.man-pandoc
-    typst
    # proselint
    asciidoctor
    wordnet
@@ -290,11 +273,6 @@ in {
    (pkgs.writers.writeDashBin "hass-cli" ''
      HASS_SERVER=http://zaatar.r:8123 HASS_TOKEN="$(cat ${config.age.secrets.home-assistant-token.path})"  exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
    '')
-
-    # xml
-    saxonb_9_1
-    libxml2
-    zotero
  ];

  age.secrets.home-assistant-token = {
--- a/configs/picom.nix
+++ b/configs/picom.nix
@@ -1,13 +1,13 @@
 {
  services.picom = {
    enable = true;
-    # activeOpacity = 1;
+    activeOpacity = 1;
    fade = true;
    fadeDelta = 1;
-    # inactiveOpacity = 0.9;
-    # shadow = true;
-    # menuOpacity = 0.9;
-    # shadowOpacity = 0.3;
+    inactiveOpacity = 0.9;
+    shadow = true;
+    menuOpacity = 0.9;
+    shadowOpacity = 0.3;
    fadeExclude = [
      "class_g = 'slock'" # don't want a transparent lock screen!
      "name *?= 'slock'"
--- a/configs/sshd.nix
+++ b/configs/sshd.nix
@@ -11,10 +11,8 @@ in {
  services.openssh = {
    enable = true;
    ports = [sshPort];
-    settings = {
-      PasswordAuthentication = false;
-      X11Forwarding = true;
-    };
+    passwordAuthentication = false;
+    forwardX11 = true;
  };

  users.users.root.openssh.authorizedKeys.keys = kieran.sshKeys pkgs;
--- a/configs/stardict.nix
+++ b/configs/stardict.nix
@@ -161,11 +161,11 @@
    turkish = {
      BabylonTurkishEnglish = pkgs.fetchzip {
        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_Turkish_English-2.4.2.tar.bz2";
-        sha256 = "1zpzgk3w0536gww31bj58cmn3imnkndyjwbcr7bay8ibq2kzv44z";
+        sha256 = "17rv46r95nkikg7aszqmfrbgdhz9ny52w423m8n01g3p93shdb4i";
      };
      BabylonEnglishTurkish = pkgs.fetchzip {
        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_English_Turkish-2.4.2.tar.bz2";
-        sha256 = "0myx31xzb7nrn5m657h0bwdgm5xp93ccwp6lcpbxgjxdjm3q0hc5";
+        sha256 = "063dl02s8ii8snsxgma8wi49xwr6afk6ysq0v986fygx5511353f";
      };
    };
  };
--- a/configs/telegram-bots/nachtischsatan.nix
+++ b/configs/telegram-bots/nachtischsatan.nix
@@ -8,22 +8,23 @@
    pkgs.writers.writePython3 "nachtischsatan-bot" {
      libraries = [pkgs.python3Packages.python-telegram-bot];
    } ''
-      from telegram.ext import Application, ContextTypes, MessageHandler, filters
-      from telegram import Update
+      from telegram.ext import Updater, MessageHandler
+      from telegram.ext.filters import Filters
      import random
      import time


-      async def flubber(update: Update, context: ContextTypes.DEFAULT_TYPE):
+      def flubber(update, context):
          time.sleep(random.randrange(4000) / 1000)
-          await update.message.reply_text("*flubberflubber*")
+          update.message.reply_text("*flubberflubber*")


      with open('${tokenFile}', 'r') as tokenFile:
-          token = tokenFile.read().strip()
-          application = Application.builder().token(token).build()
-          application.add_handler(MessageHandler(filters.ALL, flubber))
-          application.run_polling()
+          updater = Updater(tokenFile.read().strip())
+
+          updater.dispatcher.add_handler(MessageHandler(Filters.all, flubber))
+          updater.start_polling()
+          updater.idle()
    '';
 in {
  systemd.services.telegram-nachtischsatan = {
--- a/configs/themes.nix
+++ b/configs/themes.nix
@@ -19,7 +19,6 @@
      ${pkgs.coreutils}/bin/chown ${config.users.users.me.name}:users /var/theme/current_theme
      ${pkgs.xorg.xrdb}/bin/xrdb -merge /var/theme/config/xresources
      ${pkgs.procps}/bin/pkill -HUP xsettingsd
-      ${pkgs.glib}/bin/gsettings set org.gnome.desktop.interface gtk-theme "$(cat /var/theme/config/gtk-theme)" || :
    else
      echo "theme $1 not found"
    fi
@@ -55,9 +54,6 @@ in {
  };

  environment.etc = {
-    "themes/light/gtk-theme".text = ''
-      Adwaita
-    '';
    "themes/light/xsettings.conf".text = ''
      Net/ThemeName "Adwaita"
    '';
@@ -65,11 +61,8 @@ in {
      *background: #ffffff
      *foreground: #000000
    '';
-    "themes/dark/gtk-theme".text = ''
-      Dracula
-    '';
    "themes/dark/xsettings.conf".text = ''
-      Net/ThemeName "Dracula"
+      Net/ThemeName "Adwaita-dark"
    '';
    "themes/dark/xresources".text = ''
      *background: #000000
--- a/configs/wallpaper.nix
+++ b/configs/wallpaper.nix
@@ -3,7 +3,7 @@
  lib,
  ...
 }: let
-  url = "http://wallpaper.r/realwallpaper-krebs-stars-berlin.png";
+  url = "http://prism.r/realwallpaper-krebs-stars-berlin.png";
  stateDir = "~/.cache/wallpaper";
 in {
  systemd.user.services.wallpaper = {
--- a/flake.lock
+++ b/flake.lock
@@ -3,19 +3,16 @@
    "agenix": {
      "inputs": {
        "darwin": "darwin",
-        "home-manager": [
-          "home-manager"
-        ],
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1689334118,
-        "narHash": "sha256-djk5AZv1yU84xlKFaVHqFWvH73U7kIRstXwUAnDJPsk=",
+        "lastModified": 1680281360,
+        "narHash": "sha256-XdLTgAzjJNDhAG2V+++0bHpSzfvArvr2pW6omiFfEJk=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "0d8c5325fc81daf00532e3e26c6752f7bcde1143",
+        "rev": "e64961977f60388dd0b49572bb0fc453b871f896",
        "type": "github"
      },
      "original": {
@@ -67,11 +64,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
        "type": "github"
      },
      "original": {
@@ -81,6 +78,111 @@
      }
    },
    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1676283394,
+        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
+      "locked": {
+        "lastModified": 1676283394,
+        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_6": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_7": {
+      "locked": {
+        "lastModified": 1676283394,
+        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_8": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_9": {
      "locked": {
        "lastModified": 1676283394,
        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
@@ -99,19 +201,20 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1687871164,
-        "narHash": "sha256-bBFlPthuYX322xOlpJvkjUBz0C+MOBjZdDOOJJ+G2jU=",
+        "lastModified": 1681092193,
+        "narHash": "sha256-JerCqqOqbT2tBnXQW4EqwFl0hHnuZp21rIQ6lu/N4rI=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "07c347bb50994691d7b0095f45ebd8838cf6bc38",
+        "rev": "f9edbedaf015013eb35f8caacbe0c9666bbc16af",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-23.05",
+        "ref": "release-22.11",
        "repo": "home-manager",
        "type": "github"
      }
@@ -124,9 +227,37 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": [
-          "rust-overlay"
-        ]
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1677075142,
+        "narHash": "sha256-0RXVZcK2YtPckd/3+jb+yLpeXZ6jnQe25w9idztDXi8=",
+        "owner": "kmein",
+        "repo": "menstruation.rs",
+        "rev": "e34af4393963cdbadb456b7b9ae2e95e6db7b8a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kmein",
+        "repo": "menstruation.rs",
+        "type": "github"
+      }
+    },
+    "menstruation-backend_2": {
+      "inputs": {
+        "flake-utils": [
+          "menstruation-telegram",
+          "menstruation-backend",
+          "rust-overlay",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "menstruation-telegram",
+          "menstruation-backend",
+          "rust-overlay",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
        "lastModified": 1677075142,
@@ -144,15 +275,9 @@
    },
    "menstruation-telegram": {
      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "menstruation-backend": [
-          "menstruation-backend"
-        ],
-        "nixpkgs": [
-          "nixpkgs-old"
-        ]
+        "flake-utils": "flake-utils_3",
+        "menstruation-backend": "menstruation-backend_2",
+        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
        "lastModified": 1677075205,
@@ -168,56 +293,6 @@
        "type": "github"
      }
    },
-    "nix-formatter-pack": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-on-droid",
-          "nixpkgs"
-        ],
-        "nmd": "nmd",
-        "nmt": "nmt"
-      },
-      "locked": {
-        "lastModified": 1666720474,
-        "narHash": "sha256-iWojjDS1D19zpeZXbBdjWb9MiKmVVFQCqtJmtTXgPx8=",
-        "owner": "Gerschtli",
-        "repo": "nix-formatter-pack",
-        "rev": "14876cc8fe94a3d329964ecb073b4c988c7b61f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Gerschtli",
-        "repo": "nix-formatter-pack",
-        "type": "github"
-      }
-    },
-    "nix-on-droid": {
-      "inputs": {
-        "home-manager": [
-          "home-manager"
-        ],
-        "nix-formatter-pack": "nix-formatter-pack",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
-        "nmd": "nmd_2"
-      },
-      "locked": {
-        "lastModified": 1688144254,
-        "narHash": "sha256-8KL1l/7eP2Zm1aJjdVaSOk0W5kTnJo9kcgW03gqWuiI=",
-        "owner": "t184256",
-        "repo": "nix-on-droid",
-        "rev": "2301e01d48c90b60751005317de7a84a51a87eb6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "t184256",
-        "ref": "release-23.05",
-        "repo": "nix-on-droid",
-        "type": "github"
-      }
-    },
    "nixinate": {
      "inputs": {
        "nixpkgs": [
@@ -225,11 +300,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1688141737,
-        "narHash": "sha256-qHrNMYWukOKmKVf6wXOGKj1xxUnOGjvTRbt/PLLXuBE=",
+        "lastModified": 1671116920,
+        "narHash": "sha256-QmDGsUUmAGn77UTR7eQJmebl8f3IIUCtmbbAdJqKA3s=",
        "owner": "matthewcroughan",
        "repo": "nixinate",
-        "rev": "7902ae845e6cc5bd450e510cdf5e009a6e4a44d9",
+        "rev": "b4d17b8e2a4abc47e93e1a1c466e0286a63640d8",
        "type": "github"
      },
      "original": {
@@ -240,69 +315,100 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1689326639,
-        "narHash": "sha256-79zi0t83Dcc2dE0NuYZ+2hqtKXZN1yWVq5mtx8D2d7Y=",
+        "lastModified": 1665296151,
+        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9fdfaeb7b96f05e869f838c73cde8d98c640c649",
+        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-23.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-for-bootstrap": {
-      "locked": {
-        "lastModified": 1686921029,
-        "narHash": "sha256-J1bX9plPCFhTSh6E3TWn9XSxggBh/zDD4xigyaIQBy8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c7ff1b9b95620ce8728c0d7bd501c458e6da9e04",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c7ff1b9b95620ce8728c0d7bd501c458e6da9e04",
-        "type": "github"
-      }
-    },
-    "nixpkgs-old": {
-      "locked": {
-        "lastModified": 1682600000,
-        "narHash": "sha256-ha4BehR1dh8EnXSoE1m/wyyYVvHI9txjW4w5/oxsW5Y=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "50fc86b75d2744e1ab3837ef74b53f103a9b55a0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "50fc86b75d2744e1ab3837ef74b53f103a9b55a0",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1689455797,
-        "narHash": "sha256-CidyodHzHiu2QRVBLzZdln3xh0AhrBrHEARLRbXKaok=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6d6d83a475985a72e30a45c893c96b05ede11176",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1665296151,
+        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1669418739,
+        "narHash": "sha256-T86oFvcUIRwHWBWUt7WjaP4BP/3lDGbv5AppQSI1FkI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1681269223,
+        "narHash": "sha256-i6OeI2f7qGvmLfD07l1Az5iBL+bFeP0RHixisWtpUGo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "87edbd74246ccdfa64503f334ed86fa04010bab9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-22.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1677158633,
+        "narHash": "sha256-t7za78oRkDIjdFQF0PCilfCziFyhfowCgs9Ry+sEvE4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "129b6f78121802d18d215c9f9e04d7971c58ea0c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1665296151,
+        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1659446231,
        "narHash": "sha256-hekabNdTdgR/iLsgce5TGWmfIDZ86qjPhxDg/8TlzhE=",
@@ -318,61 +424,45 @@
        "type": "github"
      }
    },
-    "nmd": {
-      "flake": false,
+    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1666190571,
-        "narHash": "sha256-Z1hc7M9X6L+H83o9vOprijpzhTfOBjd0KmUTnpHAVjA=",
-        "owner": "rycee",
-        "repo": "nmd",
-        "rev": "b75d312b4f33bd3294cd8ae5c2ca8c6da2afc169",
-        "type": "gitlab"
+        "lastModified": 1665296151,
+        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
+        "type": "github"
      },
      "original": {
-        "owner": "rycee",
-        "repo": "nmd",
-        "type": "gitlab"
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
      }
    },
-    "nmd_2": {
-      "flake": false,
+    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1666190571,
-        "narHash": "sha256-Z1hc7M9X6L+H83o9vOprijpzhTfOBjd0KmUTnpHAVjA=",
-        "owner": "rycee",
-        "repo": "nmd",
-        "rev": "b75d312b4f33bd3294cd8ae5c2ca8c6da2afc169",
-        "type": "gitlab"
+        "lastModified": 1669418739,
+        "narHash": "sha256-T86oFvcUIRwHWBWUt7WjaP4BP/3lDGbv5AppQSI1FkI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
      },
      "original": {
-        "owner": "rycee",
-        "repo": "nmd",
-        "type": "gitlab"
-      }
-    },
-    "nmt": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1648075362,
-        "narHash": "sha256-u36WgzoA84dMVsGXzml4wZ5ckGgfnvS0ryzo/3zn/Pc=",
-        "owner": "rycee",
-        "repo": "nmt",
-        "rev": "d83601002c99b78c89ea80e5e6ba21addcfe12ae",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "rycee",
-        "repo": "nmt",
-        "type": "gitlab"
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
      }
    },
    "nur": {
      "locked": {
-        "lastModified": 1689454092,
-        "narHash": "sha256-qahG8Tb0LRyAnTqvcdC4axo+U1oM7X4I8KXWExjAV08=",
+        "lastModified": 1681454031,
+        "narHash": "sha256-JOamj7vKkFRp5mJ7FKt5dPfCmWj33sZLnBGDt15c/sc=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "df1c50504631272f5bd703d756d9a36643b4fa56",
+        "rev": "8a35714f0be00235e2a1c8b759e6dc3888763d8b",
        "type": "github"
      },
      "original": {
@@ -384,12 +474,8 @@
    "recht": {
      "inputs": {
        "blessings": "blessings",
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
        "lastModified": 1677165419,
@@ -407,11 +493,11 @@
    },
    "retiolum": {
      "locked": {
-        "lastModified": 1688896810,
-        "narHash": "sha256-GUw+eaHIiVfADRRI/ngGZ/XSm/pOIjfrQ2tmjfvlc1o=",
+        "lastModified": 1681246809,
+        "narHash": "sha256-3RUAwk0ApPjq2Ms8KiAh+gG6EJKWurIur612w2m3Zu8=",
        "ref": "refs/heads/master",
-        "rev": "966f656268a2d823ee5faf26954640e4b0b29aa7",
-        "revCount": 312,
+        "rev": "c8ddb36f3d85be762aeb1893a79da36014f55658",
+        "revCount": 296,
        "type": "git",
        "url": "https://git.thalheim.io/Mic92/retiolum"
      },
@@ -427,15 +513,11 @@
        "home-manager": "home-manager",
        "menstruation-backend": "menstruation-backend",
        "menstruation-telegram": "menstruation-telegram",
-        "nix-on-droid": "nix-on-droid",
        "nixinate": "nixinate",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-old": "nixpkgs-old",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs": "nixpkgs_4",
        "nur": "nur",
        "recht": "recht",
        "retiolum": "retiolum",
-        "rust-overlay": "rust-overlay",
        "scripts": "scripts",
        "telebots": "telebots",
        "tinc-graph": "tinc-graph",
@@ -445,19 +527,72 @@
    },
    "rust-overlay": {
      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1689388484,
-        "narHash": "sha256-cR8W4LZTk1SFGhDUGG4RF7qPZP7d9qFmltk7nFi7WMo=",
+        "lastModified": 1677033035,
+        "narHash": "sha256-w6XsKaW46kZNEk2vVfuoNIBEq/YzDy9kNk8cU0xJZEQ=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "15027511818ee595ca2ae6ec4b5f8f0e96c0fe47",
+        "rev": "6c9e8ea3ba73a9fed29ddc1cc52ade8e5c946a8d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1677033035,
+        "narHash": "sha256-w6XsKaW46kZNEk2vVfuoNIBEq/YzDy9kNk8cU0xJZEQ=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "6c9e8ea3ba73a9fed29ddc1cc52ade8e5c946a8d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_3": {
+      "inputs": {
+        "flake-utils": "flake-utils_6",
+        "nixpkgs": "nixpkgs_6"
+      },
+      "locked": {
+        "lastModified": 1677119371,
+        "narHash": "sha256-L0Da4eKzDZrsy8ysOS1lhgDjAgEqGvYGf/lXaRd5/YQ=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "c67c79ea25664d66e74ae91a6fa0d6c65d12d3a7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_4": {
+      "inputs": {
+        "flake-utils": "flake-utils_8",
+        "nixpkgs": "nixpkgs_8"
+      },
+      "locked": {
+        "lastModified": 1677119371,
+        "narHash": "sha256-L0Da4eKzDZrsy8ysOS1lhgDjAgEqGvYGf/lXaRd5/YQ=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "c67c79ea25664d66e74ae91a6fa0d6c65d12d3a7",
        "type": "github"
      },
      "original": {
@@ -469,21 +604,23 @@
    "scripts": {
      "inputs": {
        "flake-utils": [
+          "scripts",
+          "rust-overlay",
          "flake-utils"
        ],
        "nixpkgs": [
+          "scripts",
+          "rust-overlay",
          "nixpkgs"
        ],
-        "rust-overlay": [
-          "rust-overlay"
-        ]
+        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
-        "lastModified": 1689276466,
-        "narHash": "sha256-T+1f2GsTDzfiEasSPntbaSsJvpJxZ78a5g6CL4NyAK0=",
+        "lastModified": 1677271864,
+        "narHash": "sha256-BghYMB/lauerExMsDtGZNGZGdoGuF7LPtbmpyh9ycyA=",
        "owner": "kmein",
        "repo": "scripts",
-        "rev": "55dff522684f342f4e970116ab374ba999539288",
+        "rev": "79bffac7f9eda1b3be76f2a4ff18d81b44c74390",
        "type": "github"
      },
      "original": {
@@ -509,8 +646,8 @@
    },
    "telebots": {
      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_2"
+        "flake-utils": "flake-utils_7",
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
        "lastModified": 1677156381,
@@ -534,16 +671,14 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": [
-          "rust-overlay"
-        ]
+        "rust-overlay": "rust-overlay_4"
      },
      "locked": {
-        "lastModified": 1687504941,
-        "narHash": "sha256-wnCRcQn8izEHE8MfBpPkLezxAMIg7SVTq8CZsgkar54=",
+        "lastModified": 1677160040,
+        "narHash": "sha256-UhyZaIZ88vN/7fiBcamfV77eHjQnL8zSVznaqxLgbhs=",
        "owner": "kmein",
        "repo": "tinc-graph",
-        "rev": "91a3a85beaaec4ec43ea5a41322c3a5a6e04edc4",
+        "rev": "f705ca35e30ab0daf9cf52000e58931d7c5c42b5",
        "type": "github"
      },
      "original": {
@@ -554,12 +689,8 @@
    },
    "traadfri": {
      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs-old"
-        ]
+        "flake-utils": "flake-utils_9",
+        "nixpkgs": "nixpkgs_9"
      },
      "locked": {
        "lastModified": 1677165914,
@@ -575,14 +706,29 @@
        "type": "github"
      }
    },
+    "utils": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "voidrice": {
      "flake": false,
      "locked": {
-        "lastModified": 1689440232,
-        "narHash": "sha256-KSynhdyt+UoQEnJja2fWl8cU5dDDcdNmraZkJspn+XI=",
+        "lastModified": 1681301489,
+        "narHash": "sha256-5Zz33Q3E4A9nsEmxPQikYeX7Rvu3hM+PlXx/0SIqG34=",
        "owner": "Lukesmithxyz",
        "repo": "voidrice",
-        "rev": "9a85d328ccf29f4cebb104e4eeeba1b20a896f6b",
+        "rev": "d4ff2ebaf3e88efe20cae0d1e592fddfc433c96e",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -4,91 +4,43 @@
  inputs = {
    agenix.url = "github:ryantm/agenix";
    flake-utils.url = "github:numtide/flake-utils";
-    home-manager.url = "github:nix-community/home-manager/release-23.05";
+    home-manager.url = "github:nix-community/home-manager/release-22.11";
    menstruation-backend.url = "github:kmein/menstruation.rs";
    menstruation-telegram.url = "github:kmein/menstruation-telegram";
-    nix-on-droid.url = "github:t184256/nix-on-droid/release-23.05";
    nixinate.url = "github:matthewcroughan/nixinate";
-    nixpkgs-old.url = "github:NixOS/nixpkgs/50fc86b75d2744e1ab3837ef74b53f103a9b55a0";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
    nur.url = "github:nix-community/NUR";
    recht.url = "github:kmein/recht";
-    retiolum.url = "git+https://git.thalheim.io/Mic92/retiolum";
-    rust-overlay.url = "github:oxalica/rust-overlay";
    scripts.url = "github:kmein/scripts";
+    retiolum.url = "git+https://git.thalheim.io/Mic92/retiolum";
    telebots.url = "github:kmein/telebots";
    tinc-graph.url = "github:kmein/tinc-graph";
    traadfri.url = "github:kmein/traadfri";
    voidrice.url = "github:Lukesmithxyz/voidrice";

-    agenix.inputs.home-manager.follows = "home-manager";
    agenix.inputs.nixpkgs.follows = "nixpkgs";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
    menstruation-backend.inputs.flake-utils.follows = "flake-utils";
    menstruation-backend.inputs.nixpkgs.follows = "nixpkgs";
-    menstruation-backend.inputs.rust-overlay.follows = "rust-overlay";
-    menstruation-telegram.inputs.flake-utils.follows = "flake-utils";
-    menstruation-telegram.inputs.menstruation-backend.follows = "menstruation-backend";
-    menstruation-telegram.inputs.nixpkgs.follows = "nixpkgs-old";
-    nix-on-droid.inputs.nixpkgs.follows = "nixpkgs";
-    nix-on-droid.inputs.home-manager.follows = "home-manager";
    nixinate.inputs.nixpkgs.follows = "nixpkgs";
-    recht.inputs.flake-utils.follows = "flake-utils";
-    recht.inputs.nixpkgs.follows = "nixpkgs";
-    rust-overlay.inputs.flake-utils.follows = "flake-utils";
-    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
-    scripts.inputs.flake-utils.follows = "flake-utils";
-    scripts.inputs.nixpkgs.follows = "nixpkgs";
-    scripts.inputs.rust-overlay.follows = "rust-overlay";
    tinc-graph.inputs.flake-utils.follows = "flake-utils";
    tinc-graph.inputs.nixpkgs.follows = "nixpkgs";
-    tinc-graph.inputs.rust-overlay.follows = "rust-overlay";
-    traadfri.inputs.flake-utils.follows = "flake-utils";
-    traadfri.inputs.nixpkgs.follows = "nixpkgs-old";
    voidrice.flake = false;
  };

  outputs = inputs @ {
    self,
    nixpkgs,
-    nixpkgs-unstable,
    nur,
    home-manager,
    nixinate,
    agenix,
    retiolum,
    flake-utils,
-    nix-on-droid,
    ...
  }:
    {
-      apps =
-        nixinate.nixinate.x86_64-linux self
-        // {
-          x86_64-linux = let
-            pkgs = nixpkgs.legacyPackages.x86_64-linux;
-          in {
-            mock-secrets = {
-              type = "app";
-              program = toString (pkgs.writers.writeDash "mock-secrets" ''
-                ${pkgs.findutils}/bin/find secrets -not -path '*/.*' -type f  > secrets.txt
-              '');
-            };
-            deploy = {
-              type = "app";
-              program = toString (pkgs.writers.writeDash "deploy" ''
-                if [ $# -eq 0 ]
-                then
-                  systems='${toString (builtins.attrNames self.nixosConfigurations)}'
-                else
-                  systems=$*
-                fi
-                ${pkgs.parallel}/bin/parallel --line-buffer --tagstring '{}' 'nix run .\?submodules=1\#apps.nixinate.{}' ::: $systems
-              '');
-            };
-          };
-        };
+      apps = nixinate.nixinate.x86_64-linux self;

      nixosModules = {
        htgen = import modules/htgen.nix;
@@ -97,6 +49,7 @@
        passport = import modules/passport.nix;
        panoptikon = import modules/panoptikon.nix;
        power-action = import modules/power-action.nix;
+        specus = import modules/specus.nix;
        system-dependent = import modules/system-dependent.nix;
        telegram-bot = import modules/telegram-bot.nix;
        traadfri = import modules/traadfri.nix;
@@ -106,40 +59,14 @@
        panoptikon = import lib/panoptikon.nix;
      };

-      nixOnDroidConfigurations = {
-        moto = nix-on-droid.lib.nixOnDroidConfiguration {
-          modules = [systems/moto/configuration.nix];
-          pkgs = import nixpkgs {
-            system = "aarch64-linux";
-            overlays = [nix-on-droid.overlays.default];
-          };
-          extraSpecialArgs = { 
-            niveumPackages = inputs.self.packages.aarch64-linux;
-	    niveumLib = inputs.self.lib;
-            inherit inputs; 
-          };
-          home-manager-path = home-manager.outPath;
-        };
-      };
-
-      nixosConfigurations = let
-        niveumSpecialArgs = system: {
-          unstablePackages = import nixpkgs-unstable {
-            inherit system;
-            config.allowUnfreePredicate = pkg:
-              builtins.elem (nixpkgs-unstable.lib.getName pkg) [
-                "obsidian"
-              ];
-          };
-
-          niveumPackages = inputs.self.packages.${system};
-          niveumLib = inputs.self.lib;
-          inherit inputs;
-        };
-      in {
+      nixosConfigurations = {
        ful = nixpkgs.lib.nixosSystem rec {
          system = "aarch64-linux";
-          specialArgs = niveumSpecialArgs system;
+          specialArgs = {
+            niveumPackages = inputs.self.packages.${system};
+            niveumLib = inputs.self.lib;
+            inherit inputs;
+          };
          modules = [
            {
              _module.args.nixinate = {
@@ -153,6 +80,7 @@
            systems/ful/configuration.nix
            agenix.nixosModules.default
            inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
            inputs.self.nixosModules.panoptikon
            retiolum.nixosModules.retiolum
            nur.nixosModules.nur
@@ -160,7 +88,10 @@
        };
        zaatar = nixpkgs.lib.nixosSystem rec {
          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
+          specialArgs = {
+            niveumPackages = inputs.self.packages.${system};
+            inherit inputs;
+          };
          modules = [
            {
              _module.args.nixinate = {
@@ -180,7 +111,10 @@
        makanek = nixpkgs.lib.nixosSystem rec {
          system = "x86_64-linux";
          # for using inputs in other config files
-          specialArgs = niveumSpecialArgs system;
+          specialArgs = {
+            niveumPackages = inputs.self.packages.${system};
+            inherit inputs;
+          };
          modules = [
            {
              _module.args.nixinate = {
@@ -195,6 +129,7 @@
            inputs.self.nixosModules.telegram-bot
            inputs.self.nixosModules.htgen
            inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
            agenix.nixosModules.default
            retiolum.nixosModules.retiolum
            nur.nixosModules.nur
@@ -218,13 +153,16 @@
        };
        manakish = nixpkgs.lib.nixosSystem rec {
          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
+          specialArgs = {
+            niveumPackages = inputs.self.packages.${system};
+            inherit inputs;
+          };
          modules = [
            {
              _module.args.nixinate = {
                host = "manakish";
                sshUser = "root";
-                buildOn = "local";
+                buildOn = "remote";
                substituteOnTarget = true;
                hermetic = false;
              };
@@ -238,7 +176,10 @@
        };
        kabsa = nixpkgs.lib.nixosSystem rec {
          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
+          specialArgs = {
+            niveumPackages = inputs.self.packages.${system};
+            inherit inputs;
+          };
          modules = [
            {
              _module.args.nixinate = {
@@ -252,6 +193,7 @@
            systems/kabsa/configuration.nix
            agenix.nixosModules.default
            retiolum.nixosModules.retiolum
+            inputs.self.nixosModules.specus
            home-manager.nixosModules.home-manager
            nur.nixosModules.nur
          ];
@@ -296,7 +238,6 @@
        genius = pkgs.callPackage packages/genius.nix {};
        gfs-fonts = pkgs.callPackage packages/gfs-fonts.nix {};
        git-preview = pkgs.callPackage packages/git-preview.nix {};
-        gpt = pkgs.callPackage packages/gpt.nix {};
        hc = pkgs.callPackage packages/hc.nix {};
        heuretes = pkgs.callPackage packages/heuretes.nix {};
        htgen = pkgs.callPackage packages/htgen.nix {};
@@ -320,13 +261,11 @@
        menu-calc = pkgs.callPackage packages/menu-calc.nix {};
        meteo = pkgs.callPackage packages/meteo.nix {};
        mpv-radio = pkgs.callPackage packages/mpv-radio.nix {di-fm-key-file = "/dev/null";};
-        mpv-tuner = pkgs.callPackage packages/mpv-tuner.nix {di-fm-key-file = "/dev/null";};
        mpv-tv = pkgs.callPackage packages/mpv-tv.nix {};
        mpv-visualizer = pkgs.callPackage packages/mpv-visualizer.nix {};
        new-mac = pkgs.callPackage packages/new-mac.nix {};
        nix-git = pkgs.callPackage packages/nix-git.nix {};
        nix-index-update = pkgs.callPackage packages/nix-index-update.nix {inherit system;};
-        notemenu = pkgs.callPackage packages/notemenu.nix {niveumPackages = self.packages.${system};};
        opustags = pkgs.callPackage packages/opustags.nix {};
        pls = pkgs.callPackage packages/pls.nix {};
        qrpaste = pkgs.callPackage packages/qrpaste.nix {};
@@ -341,12 +280,9 @@
        unicodmenu = pkgs.callPackage packages/unicodmenu.nix {};
        untilport = pkgs.callPackage packages/untilport.nix {};
        vg = pkgs.callPackage packages/vg.nix {};
-        vim = pkgs.callPackage packages/vim.nix {niveumPackages = self.packages.${system};};
-        obsidian-vim = pkgs.callPackage packages/obsidian-vim.nix {};
        vimPlugins-cheat-sh-vim = pkgs.callPackage packages/vimPlugins/cheat-sh.nix {};
        vimPlugins-icalendar-vim = pkgs.callPackage packages/vimPlugins/icalendar-vim.nix {};
        vimPlugins-jq-vim = pkgs.callPackage packages/vimPlugins/jq-vim.nix {};
-        vimPlugins-typst-vim = pkgs.callPackage packages/vimPlugins/typst-vim.nix {};
        vimPlugins-vim-256noir = pkgs.callPackage packages/vimPlugins/vim-256noir.nix {};
        vimPlugins-vim-colors-paramount = pkgs.callPackage packages/vimPlugins/vim-colors-paramount.nix {};
        vimPlugins-vim-fetch = pkgs.callPackage packages/vimPlugins/vim-fetch.nix {};
--- a/lib/colours/owickstrom-dark.nix
+++ b/lib/colours/owickstrom-dark.nix
@@ -1,38 +1,37 @@
-{
-  # all dark colours are 20% darker than the bright ones
+rec {
  black = {
-    bright = "#4c5363"; # "#282c34";
-    dark = "#20232a";
+    bright = "#282c34";
+    dark = "#282c34";
  };
  red = {
-    bright = "#e68990"; #"#e06c75";
-    dark = "#d43541";
+    bright = "#e06c75";
+    dark = "#e06c75";
  };
  green = {
-    bright = "#acce93"; #"#98c379";
-    dark = "#77af4e";
+    bright = "#98c379";
+    dark = "#98c379";
  };
  yellow = {
-    bright = "#eacc95"; #"#e5c07b";
-    dark = "#d9a440";
+    bright = "#e5c07b";
+    dark = "#e5c07b";
  };
  blue = {
-    bright = "#80bff2"; #"#61afef";
-    dark = "#2490e9";
+    bright = "#61afef";
+    dark = "#61afef";
  };
  magenta = {
-    bright = "#d193e3"; #"#c678dd";
-    dark = "#af42cf";
+    bright = "#c678dd";
+    dark = "#c678dd";
  };
  cyan = {
-    bright = "#77c4ce"; #"#56b6c2";
-    dark = "#3b99a5";
+    bright = "#56b6c2";
+    dark = "#56b6c2";
  };
  white = {
-    bright = "#e3e5e9"; #"#dcdfe4";
-    dark = "#a9b1bd";
+    bright = "#dcdfe4";
+    dark = "#dcdfe4";
  };
-  background = "#282c34"; #black.dark;
-  foreground = "#dcdfe4"; #white.bright;
+  background = black.dark;
+  foreground = white.bright;
  cursor = "#a3b3cc";
 }
--- a/lib/colours/owickstrom-light.nix
+++ b/lib/colours/owickstrom-light.nix
@@ -29,9 +29,9 @@ rec {
  };
  white = {
    bright = "#8c00ec";
-    dark = "#bfbfbf";
+    dark = "#efefef";
  };
-  background = "#efefef";
+  background = white.dark;
  foreground = "#181818";
-  cursor = "#a3b3cc";
+  cursor = "#bbbbbb";
 }
--- a/lib/i3status-rust.nix
+++ b/lib/i3status-rust.nix
@@ -13,7 +13,7 @@
    '';
 in {
  theme = {
-    theme = "plain";
+    name = "plain";
    overrides = {
      critical_fg = colours.red.bright;
      good_fg = colours.green.bright;
@@ -30,14 +30,15 @@ in {
      separator_fg = colours.black.bright;
    };
  };
-  icons.icons = "awesome6";
+  icons.name = "awesome6";
+  icons.overrides.rss = "";
  icons.overrides.vpn = "";
  icons.overrides.irc = "";
  block = [
    {
      block = "weather";
      autolocate = true;
-      format = "$icon $location: $temp";
+      format = "{location}: {temp}C";
      service = {
        name = "openweathermap";
        city_id = "2950159";
@@ -72,6 +73,12 @@ in {
      info = ["total"];
      warning = ["mention" "review_requested" "team_mention" "manual" "invitation" "assign" "subscribed"];
    }
+    {
+      block = "custom";
+      interval = 10;
+      command = "newsboat-unread-count";
+      json = true;
+    }
    {
      block = "custom";
      interval = 10;
@@ -146,12 +153,6 @@ in {
      json = true;
      hide_when_empty = true;
    }
-    {
-      block = "service_status";
-      service = "hu-vpn";
-      active_format = "^icon_vpn";
-      inactive_format = "";
-    }
    {
      block = "custom";
      interval = 5;
@@ -167,7 +168,7 @@ in {
    {
      block = "net";
      device = wirelessInterface;
-      format = "$icon $ssid $signal_strength";
+      format = "{ssid} {signal_strength}";
    }
    {
      block = "battery";
@@ -175,19 +176,22 @@ in {
    }
    {
      block = "sound";
+      on_click = "pavucontrol";
    }
    {
      block = "disk_space";
-      format = "$icon $available";
+      format = "{icon} {available}";
    }
    {
      block = "memory";
-      format = "$icon $mem_used.eng(prefix:G)";
+      display_type = "memory";
+      format_mem = "{mem_used;G}";
+      clickable = false;
    }
    {block = "load";}
    {
      block = "custom";
-      interval = 10;
+      interval = 1;
      json = true;
      command = pkgs.writers.writeDash "time" ''
        ${pkgs.jq}/bin/jq -n \
--- a/lib/panoptikon.nix
+++ b/lib/panoptikon.nix
@@ -31,7 +31,7 @@
    nick ? ''"$PANOPTIKON_WATCHER"-watcher'',
  }:
    pkgs.writers.writeDash "kpaste-irc-reporter" ''
-      KPASTE_CONTENT_TYPE=text/plain ${niveumPackages.kpaste}/bin/kpaste \
+      ${niveumPackages.kpaste}/bin/kpaste \
        | ${pkgs.gnused}/bin/sed -n "${
        if retiolumLink
        then "2"
--- a/lib/streams.nix
+++ b/lib/streams.nix
@@ -34,7 +34,6 @@ let
    radiorecord = "radiorecord";
    rap = "rap";
    rock = "rock";
-    rekt = "rekt";
    russian = "russia";
    schlager = "schlager";
    soma = "soma";
@@ -55,26 +54,6 @@ let
  di-fm-name = name: "${name} | DI.FM";
  di-fm = name: "http://prem3.di.fm/${name}_hi?${di-fm-key}";

-  classicalradio-name = name: "${name} | ClassicalRadio";
-  classicalradio = name: "http://prem2.classicalradio.com:80/${name}?${di-fm-key}";
-  classicalradio-channels = ["20thcentury" "21stcentury" "adagios" "bach" "ballets" "baroqueperiod" "beethoven" "brahms" "celloworks" "chamberworks" "chopin" "choralworks" "classicalguitarworks" "classicalperiod" "classicalpianotrios" "classicalrelaxation" "concertos" "contemporaryperiod" "debussy" "easyclassical" "fluteworks" "gregorianchant" "grieg" "handel" "harpsichordworks" "haydn" "liszt" "medievalperiod" "mozart" "nocturnes" "operahighlights" "operas" "orchestralworks" "organworks" "overtures" "pianoworks" "relaxingflute" "relaxingpiano" "renaissanceperiod" "romanticperiod" "sacredworks" "schubert" "shostakovich" "soloinstruments" "solopiano" "sonatas" "songsnlieders" "stringworks" "symphonies" "tchaikovsky" "telemann" "trumpetworks" "violinworks" "vivaldi" "waltzespolkasnmarches" "windworks"];
-
-  rockradio-name = name: "${name} | RockRadio";
-  rockradio = name: "http://prem2.rockradio.com:80/${name}?${di-fm-key}";
-  rockradio-channels = ["00srock" "60srock" "70srock" "80srock" "90srock" "alternative80s" "alternative90s" "alternativerock" "blackmetal" "bluesrock" "classicfolkrock" "classichardrock" "classicmetal" "classicrock" "deathmetal" "grunge" "hairbands" "hardrock" "heavymetal" "indierock" "industrial" "melodicdeathmetal" "metal" "metalcore" "modernfolkrock" "modernrock" "numetal" "poprock" "powermetal" "progressiverock" "punkrock" "rockballads" "screamoemo" "softrock" "symphonicmetal" "thrashmetal" "yachtrock"];
-
-  jazzradio-name = name: "${name} | JazzRadio";
-  jazzradio = name: "http://prem2.jazzradio.com:80/${name}?${di-fm-key}";
-  jazzradio-channels = ["afrojazz" "bassjazz" "bebop" "blues" "bluesrock" "bossanova" "classicjazz" "cocktailjazz" "coffeejazz" "cooljazz" "currentjazz" "davekoz" "fusionlounge" "guitarjazz" "gypsyjazz" "hardbop" "jazzballads" "jazzhop" "latenightjazz" "latinjazz" "lovesmoothjazz" "mellowjazz" "mellowpianojazz" "mellowsmoothjazz" "modernbigband" "pariscafe" "pianojazz" "pianotrios" "saxophonejazz" "sinatrastyle" "smoothbossanova" "smoothjazz" "smoothjazz247" "smoothlounge" "smoothuptempo" "smoothvocals" "straightahead" "swingnbigband" "timelessclassics" "trumpetjazz" "vibraphonejazz" "vocaljazz" "vocallegends"];
-
-  zenradio-name = name: "${name} | ZenRadio";
-  zenradio = name: "http://prem4.zenradio.com:80/zr${name}?${di-fm-key}";
-  zenradio-channels = ["acousticvocalchillout" "ambient" "atmosphericdreams" "babysleep" "chillout" "chilloutdreams" "deepconcentration" "deepfocus" "downtempolounge" "eastasianmeditation" "lovenrelaxation" "meditation" "nativeamericanflute" "nature" "newage" "oceansounds" "peacefulhealing" "perfectsunsets" "pregnancyrelaxation" "reiki" "relaxation" "relaxingclassical" "relaxingflute" "relaxingguitar" "relaxingpiano" "relaxingspanmassage" "shamanicmusic" "sleeprelaxation" "soundsofrain" "spacedreams" "stressrelief" "studymusic" "tibetanmusic" "tibetansingingbowls" "tranquilitynhealing" "vocalchillout" "vocalnewage" "yoga" "zen"];
-
-  radiotunes-name = name: "${name} | RadioTunes";
-  radiotunes = name: "http://prem1.radiotunes.com:80/${name}_hi?${di-fm-key}";
-  radiotunes-channels = ["00scountry" "00sdance" "00srnb" "00srock" "60srock" "70srock" "80saltnnewwave" "80sdance" "80srock" "90scountry" "90sdance" "90srnb" "90srock" "altrock" "ambient" "americansongbook" "baroque" "bebop" "bluesrock" "bossanova" "cafedeparis" "chillntropicalhouse" "chillout" "christian" "classical" "classicalperiod" "classicalpianotrios" "classicmotown" "classicrap" "classicrock" "clubbollywood" "coffeejazz" "country" "cubanlounge" "dancehits" "datempolounge" "davekoz" "discoparty" "downtempolounge" "dreamscapes" "easylistening" "edmfest" "epicmusic" "eurodance" "guitar" "hardrock" "hit00s" "hit60s" "hit70s" "hit90s" "indiedance" "indierock" "jazzclassics" "jpop" "latinpophits" "lounge" "lovemusic" "meditation" "mellowjazz" "mellowsmoothjazz" "metal" "modernblues" "modernrock" "mozart" "nature" "newage" "oldies" "oldschoolfunknsoul" "pianojazz" "poprock" "reggaeton" "relaxation" "relaxingambientpiano" "romantic" "romantica" "romanticalatina" "rootsreggae" "salsa" "sleeprelaxation" "slowjams" "smoothbeats" "smoothbossanova" "smoothjazz" "smoothjazz247" "smoothlounge" "softrock" "solopiano" "soundtracks" "the80s" "tophits" "uptemposmoothjazz" "urbanjamz" "urbanpophits" "vocalchillout" "vocallounge" "vocalnewage" "vocalsmoothjazz" "world"];
-
  soma-fm-name = name: "${name} | soma.fm";
  soma-fm = name: "http://ice1.somafm.com/${name}-128-aac";

@@ -90,9 +69,6 @@ let
  rte-name = name: "RTÉ ${name}";
  rte = name: "https://www.rte.ie/manifests/${name}.m3u8";

-  rekt-name = name: "Rekt ${name}";
-  rekt = name: "https://stream.rekt.network/${name}.m4a";
-
  royal-name = name: "${name} | RoyalRadio";
  royal = name: "http://193.33.170.218:8000/${name}";

@@ -1961,51 +1937,12 @@ in
      station = "The Quran Radio";
      tags = [tags.arabic tags.text tags.holy];
    }
-    {
-      stream = "http://www.radioeins.de/livemp3";
-      station = "radioeins | RBB";
-      tags = [tags.top40 tags.pop];
-    }
  ]
  ++ map (name: {
    stream = "https://${name}.stream.publicradio.org/${name}.aac";
    station = "${name} | Your Classical";
    tags = [tags.classical];
  }) ["ycradio" "guitar" "cms" "relax" "lullabies" "choral" "favorites" "chambermusic" "concertband" "holiday"]
-  ++ map (name: {
-    stream = "https://stream.rekt.network/${name}.m4a";
-    station = "${name} | Rekt Network";
-    tags = [tags.rekt];
-  }) ["rekt" "rektory" "nightride" "chillsynth" "datawave" "spacesynth" "darksynth" "horrorsynth" "ebsm"]
-  ++ map (name: {
-    stream = radiotunes name;
-    station = radiotunes-name name;
-  })
-  radiotunes-channels
-  ++ map (name: {
-    stream = rockradio name;
-    station = rockradio-name name;
-    tags = [tags.rock];
-  })
-  rockradio-channels
-  ++ map (name: {
-    stream = jazzradio name;
-    station = jazzradio-name name;
-    tags = [tags.jazz];
-  })
-  jazzradio-channels
-  ++ map (name: {
-    stream = zenradio name;
-    station = zenradio-name name;
-    tags = [tags.chill];
-  })
-  zenradio-channels
-  ++ map (name: {
-    stream = classicalradio name;
-    station = classicalradio-name name;
-    tags = [tags.classical];
-  })
-  classicalradio-channels
 /*
      (caster-fm "TODO" "noasrv" 10182) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u
      (caster-fm "TODO" "shaincast" 20866) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u
@@ -2032,8 +1969,5 @@ http://n0b.radiojar.com/1pu7hhf8kfhvv

 Chillout from kassel
 https://server4.streamserver24.com:2199/tunein/ejanowsk.pls
-
-Jazz
- http://37.251.146.169:7800/stream
 */

--- a/lib/vim/init.lua
+++ b/lib/vim/init.lua
@@ -1,69 +1,29 @@
-local cmp = require'cmp'
-
-cmp.setup({
-    snippet = {
-    expand = function(args)
-      require("luasnip").lsp_expand(args.body)
-    end,
-  },
-  mapping = cmp.mapping.preset.insert({
-    ['<C-b>'] = cmp.mapping.scroll_docs(-4),
-    ['<C-f>'] = cmp.mapping.scroll_docs(4),
-    ['<C-Space>'] = cmp.mapping.complete(),
-    ['<C-e>'] = cmp.mapping.abort(),
-    ['<CR>'] = cmp.mapping.confirm({ select = true }), -- Accept currently selected item. Set `select` to `false` to only confirm explicitly selected items.
-  }),
-  sources = cmp.config.sources({
-    { name = 'nvim_lsp' },
-    { name = 'luasnip' },
-  }, {
-    --{ name = 'buffer' },
-  })
-})
-
-- -- Use buffer source for `/` and `?` (if you enabled `native_menu`, this won't work anymore).
-- cmp.setup.cmdline({ '/', '?' }, {
--   mapping = cmp.mapping.preset.cmdline(),
--   sources = {
--     { name = 'buffer' }
--   }
-- })
-
-- -- Use cmdline & path source for ':' (if you enabled `native_menu`, this won't work anymore).
-- cmp.setup.cmdline(':', {
--   mapping = cmp.mapping.preset.cmdline(),
--   sources = cmp.config.sources({
--     { name = 'path' }
--   })
-- })
-local capabilities = require('cmp_nvim_lsp').default_capabilities(vim.lsp.protocol.make_client_capabilities())
-
 local opts = { noremap=true, silent=true }
 vim.keymap.set('n', '<space>e', vim.diagnostic.open_float, opts)
-vim.keymap.set('n', '<space>dn', vim.diagnostic.goto_prev, opts)
-vim.keymap.set('n', '<space>dp', vim.diagnostic.goto_next, opts)
+vim.keymap.set('n', '[d', vim.diagnostic.goto_prev, opts)
+vim.keymap.set('n', ']d', vim.diagnostic.goto_next, opts)
 vim.keymap.set('n', '<space>q', vim.diagnostic.setloclist, opts)

 -- Use an on_attach function to only map the following keys
 -- after the language server attaches to the current buffer
 local on_attach = function(client, bufnr)
  -- Enable completion triggered by <c-x><c-o>
-  -- vim.api.nvim_buf_set_option(bufnr, 'omnifunc', 'v:lua.vim.lsp.omnifunc')
+  vim.api.nvim_buf_set_option(bufnr, 'omnifunc', 'v:lua.vim.lsp.omnifunc')
+
  -- Mappings.
  -- See `:help vim.lsp.*` for documentation on any of the below functions
  local bufopts = { noremap=true, silent=true, buffer=bufnr }
  vim.keymap.set('n', 'gD', vim.lsp.buf.declaration, bufopts)
  vim.keymap.set('n', 'gd', vim.lsp.buf.definition, bufopts)
-  vim.keymap.set('n', 'gt', vim.lsp.buf.type_definition, bufopts)
  vim.keymap.set('n', 'K', vim.lsp.buf.hover, bufopts)
  vim.keymap.set('n', 'gi', vim.lsp.buf.implementation, bufopts)
  vim.keymap.set('n', '<C-k>', vim.lsp.buf.signature_help, bufopts)
-  vim.keymap.set('n', '<space>f', vim.lsp.buf.format, bufopts)
  vim.keymap.set('n', '<space>wa', vim.lsp.buf.add_workspace_folder, bufopts)
  vim.keymap.set('n', '<space>wr', vim.lsp.buf.remove_workspace_folder, bufopts)
  vim.keymap.set('n', '<space>wl', function()
    print(vim.inspect(vim.lsp.buf.list_workspace_folders()))
  end, bufopts)
+  vim.keymap.set('n', '<space>D', vim.lsp.buf.type_definition, bufopts)
  vim.keymap.set('n', '<space>rn', vim.lsp.buf.rename, bufopts)
  vim.keymap.set('n', '<space>ca', vim.lsp.buf.code_action, bufopts)
  vim.keymap.set('n', 'gr', vim.lsp.buf.references, bufopts)
@@ -75,38 +35,20 @@ local lsp_flags = {
  debounce_text_changes = 150,
 }

-local language_servers = {
-  clangd = {},
+language_servers = {
  pyright = {}, -- pyright
-  tsserver = {}, -- typescript-language-server
-  cssls = {},
-  elmls = {}, -- elm-language-server
+  -- tsserver = {}, -- typescript-language-server
+  -- elmls = {}, -- elm-language-server
  -- denols = {}, -- deno built in
-  bashls = {}, -- bash-language-server
-  lua_ls = {
-    Lua = {
-      runtime = {
-        version = 'LuaJIT',
-      },
-      diagnostics = {
-        globals = {'vim'},
-      },
-      workspace = {
-        library = vim.api.nvim_get_runtime_file("", true)
-      },
-      telemetry = {
-        enable = false,
-      }
-    },
-  },
+  -- bashls = {}, -- bash-language-server
  hls = {}, -- haskell-language-server
-  html = {}, -- vscode-langservers-extracted
-  jsonls = {}, -- vscode-langservers-extracted
+  -- html = {}, -- vscode-langservers-extracted
+  -- jsonls = {}, -- vscode-langservers-extracted
  nil_ls = {}, -- github:oxalica/nil
  -- rnix = {}, -- rnix-lsp
-  jqls = {}, -- jq-lsp
+  -- jqls = {}, -- jq-lsp
  rust_analyzer = { ["rust-analyzer"] = {} },
-  eslint = {},
+  -- eslint?
  -- volar? vls?
  texlab = {
    texlab = {
@@ -140,6 +82,5 @@ for server, settings in pairs(language_servers) do
    on_attach = on_attach,
    flags = lsp_flags,
    settings = settings,
-    capabilities = capabilities
  }
 end
--- a/lib/vim/init.vim
+++ b/lib/vim/init.vim
@@ -3,12 +3,26 @@ vnoremap a= :Tabularize /=<CR>
 vnoremap a; :Tabularize /::<CR>
 vnoremap a- :Tabularize /-><CR>

+nnoremap <C-p> :FZF<CR>
+nnoremap <C-l> :Rg<CR>
+let g:fzf_layout = { 'down': '~15%' }
+
 colorscheme dim
+" transparent background
+hi Normal guibg=NONE ctermbg=NONE
+
+let mapleader = ","
+let maplocalleader="\\"

 " noremap <Leader>h :<C-u>split<CR>
 " noremap <Leader>v :<C-u>vsplit<CR>
 noremap <Leader>gs :Git<CR>
 noremap <Leader>gc :Git commit<CR>
+noremap <leader>n :bn<CR>
+noremap <leader>p :bp<CR>
+noremap <leader>c :bd<CR>
+noremap <leader>b :Buffers<CR>
+noremap <leader>t :Tags<CR>

 " reindent whole file
 noremap <leader>i mzgg=G`z
@@ -16,11 +30,18 @@ noremap <leader>i mzgg=G`z
 " replace all
 nnoremap S :%s//g<Left><Left>

+nnoremap <Leader>a <Plug>(ale_hover)
+nnoremap <Leader>d <Plug>(ale_go_to_definition_in_tab)
+nnoremap <Leader>rf <Plug>(ale_find_references)
+
 " Hit `%` on `if` to jump to `else`.
 runtime macros/matchit.vim

+filetype plugin indent on
+set autoindent
 set notitle
 set nospell
+set smartcase ignorecase " you need these two
 set backspace=indent,eol,start
 set hidden
 set ruler
@@ -30,26 +51,21 @@ set number
 set path+=**
 set splitbelow splitright
 set wildmenu wildmode=longest,list,full
-set shortmess+=ac
+set shortmess+=aI
+set nowritebackup noswapfile
+set mouse=a
 set showmatch
+set encoding=utf8 ffs=unix,dos,mac
 set smartindent
-set hlsearch
+set wrap
+set nohlsearch
+set clipboard=unnamedplus
+set nopaste
+set list listchars=tab:⇥\ ,extends:❯,precedes:❮,nbsp:␣,trail:· showbreak=¬
 set foldlevelstart=30

-nnoremap <C-H> <CMD>set nohlsearch<CR>
-
-fun! TrimWhitespace()
-  let l:save = winsaveview()
-  " remove trailing whitespace in lines
-  keeppatterns %s/\s\+$//e
-  " remove empty lines at file end
-  silent! %s#\($\n\s*\)\+\%$##
-  call winrestview(l:save)
-endfun
-command! TrimWhitespace call TrimWhitespace()
-autocmd BufWritePre * if !&binary && &ft !=# 'mail'
-      \|   call TrimWhitespace()
-      \| endif
+iabbrev ddate <C-R>=strftime("%F")<CR>
+iabbrev dtime <C-R>=strftime("%F %T")<CR>

 let g:netrw_banner=0
 let g:netrw_browse_split=4
@@ -110,7 +126,6 @@ augroup filetypes
  autocmd bufnewfile,bufread *.rust packadd rust-vim
  autocmd bufnewfile,bufread *.csv packadd csv.vim | set filetype=csv
  autocmd bufnewfile,bufread *.tex packadd vimtex | set filetype=tex
-  autocmd bufnewfile,bufread *.typ packadd typst.vim | set filetype=typst
  autocmd bufnewfile,bufread *.ics packadd icalendar.vim | set filetype=icalendar
  autocmd bufnewfile,bufread *.ts packadd typescript-vim | set filetype=typescript
  autocmd bufnewfile,bufread *.jq packadd jq.vim
@@ -133,9 +148,47 @@ autocmd bufreadpost *
      \ endif
 autocmd bufreadpre * setlocal foldmethod=indent

-set completeopt=menu,menuone,noselect
+set completeopt=noinsert,menuone,noselect
 set complete+=kspell

+let g:SuperTabDefaultCompletionType = 'context'
+
+let g:haskell_enable_quantification = 1
+let g:haskell_enable_recursivedo = 1
+let g:haskell_enable_arrowsyntax = 1
+let g:haskell_enable_pattern_synonyms = 1
+
 let g:pandoc#syntax#conceal#use = 0
 let g:pandoc#modules#disabled = []
 let g:pandoc#spell#default_langs = ['en', 'de']
+
+let g:ale_linters = {
+      \ 'css': ['csslint'],
+      \ 'haskell': ['ghc', 'cabal-ghc', 'hlint', 'ormolu'],
+      \ 'html': ['tidy', 'proselint'],
+      \ 'latex': ['lacheck', 'chktex', 'proselint'],
+      \ 'pandoc': ['proselint'],
+      \ 'ruby': ['rubocop'],
+      \ 'json': ['jsonlint'],
+      \ 'rust': ['cargo'],
+      \ 'python': ['pyls'],
+      \}
+let g:ale_fixers = {
+      \ '*': ['remove_trailing_lines', 'trim_whitespace'],
+      \ 'javascript': ['prettier'],
+      \ 'typescript': ['prettier'],
+      \ 'css': ['prettier'],
+      \ 'html': ['prettier'],
+      \ 'json': ['jq'],
+      \ 'python': ['black'],
+      \ 'rust': ['rustfmt']
+      \}
+let g:ale_set_quickfix = 1
+
+let g:ale_fix_on_save = 1
+autocmd bufnewfile,bufread elm.json let g:ale_fix_on_save = 0
+
+let g:ale_completion_enabled = 1
+
+let g:vimwiki_list = [{'path': '~/notes/',
+      \ 'syntax': 'markdown', 'ext': '.md'}]
--- a/lib/vim/shared.vim
+++ b/lib/vim/shared.vim
@@ -1,30 +0,0 @@
-nnoremap <C-p> :FZF<CR>
-nnoremap <C-l> :Rg<CR>
-let g:fzf_layout = { 'down': '~15%' }
-
-" transparent background
-hi Normal guibg=NONE ctermbg=NONE
-
-let mapleader = ","
-let maplocalleader="\\"
-noremap <leader>n :bn<CR>
-noremap <leader>p :bp<CR>
-noremap <leader>c :bd<CR>
-noremap <leader>b :Buffers<CR>
-noremap <leader>t :Tags<CR>
-
-set nocompatible
-syntax on
-filetype plugin indent on
-set autoindent
-set smartcase ignorecase " you need these two
-set nowritebackup noswapfile
-set mouse=a
-set encoding=utf8 ffs=unix,dos,mac
-set wrap
-set list listchars=tab:⇥\ ,extends:❯,precedes:❮,nbsp:␣,trail:· showbreak=¬
-set clipboard=unnamedplus
-set nopaste
-
-iabbrev ddate <C-R>=strftime("%F")<CR>
-iabbrev dtime <C-R>=strftime("%F %T")<CR>
--- a/modules/panoptikon.nix
+++ b/modules/panoptikon.nix
@@ -113,17 +113,16 @@
              set -efu

              ${watcherOptions.script} > ${watcherName}
+              ${pkgs.git}/bin/git add ${watcherName}
+              ${pkgs.git}/bin/git commit --message "${watcherName} / $(${pkgs.coreutils}/bin/date -Is)" || :

-              if [ -n "$(${pkgs.git}/bin/git diff -- ${watcherName})" ]; then
+              if [ -n "$(${pkgs.git}/bin/git diff HEAD^ -- ${watcherName})" ]; then
                ${lib.strings.concatMapStringsSep "\n" (reporter: ''
                  ${pkgs.git}/bin/git diff HEAD^ -- ${watcherName} | ${reporter}
                '')
                watcherOptions.reporters}
                :
              fi
-
-              ${pkgs.git}/bin/git add ${watcherName}
-              ${pkgs.git}/bin/git commit --message "${watcherName} / $(${pkgs.coreutils}/bin/date -Is)" || :
            '';
          })
        cfg.watchers;
--- a/modules/specus.nix
+++ b/modules/specus.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  specusMachines = {
+    servers = {
+      makanek = {
+        ipv4 = "10.100.0.1";
+        publicKey = "KhcScd4fBpdhQzK8Vc+1mEHQMQBpbKBUPB4oZ7skeSk=";
+      };
+      ful = {
+        ipv4 = "10.100.0.2";
+        publicKey = "0Y7+zoXkWJGVOWWnMjvYjtwP+WpggAlmkRbgMw0z8Dk=";
+      };
+    };
+    clients = {
+      kabsa = {
+        ipv4 = "10.100.0.101";
+        publicKey = "nRkzoRi9crKHF7263U37lt4GGL7/8637NBSKjifI9hY=";
+      };
+    };
+  };
+in {
+  options.services.specus = {
+    server = {
+      enable = lib.mkEnableOption "Specus private VPN (server)";
+    };
+    client = {
+      enable = lib.mkEnableOption "Specus private VPN (client)";
+    };
+    privateKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Private key file of the server/client machine";
+    };
+  };
+
+  config = let
+    cfg = config.services.specus;
+    specusPort = 22;
+  in
+    {
+      assertions = [
+        {
+          assertion =
+            !(cfg.server.enable && cfg.client.enable);
+          message = "specus: systems cannot be client and server at the same time";
+        }
+      ];
+    }
+    // lib.mkIf cfg.server.enable {
+      networking.nat = {
+        enable = true;
+        externalInterface = "eth0"; # TODO
+        internalInterfaces = ["specus"];
+      };
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces.specus = {
+        ips = ["${specusMachines.servers.${config.networking.hostName}.ipv4}/24"];
+        # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        listenPort = specusPort;
+        privateKeyFile = cfg.privateKeyFile;
+        peers =
+          lib.mapAttrsToList (clientName: clientConfig: {
+            publicKey = clientConfig.publicKey;
+            allowedIPs = ["${clientConfig.ipv4}/32"];
+          })
+          specusMachines.clients;
+      };
+    }
+    // lib.mkIf cfg.client.enable {
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces = lib.attrsets.mapAttrs' (serverName: serverConfig:
+        lib.nameValuePair "specus-${serverName}" {
+          ips = ["${specusMachines.clients.${config.networking.hostName}.ipv4}/24"];
+          listenPort = specusPort;
+          privateKeyFile = cfg.privateKeyFile;
+          peers = [
+            {
+              allowedIPs = ["0.0.0.0/0"];
+              endpoint = "${(import ../lib/external-network.nix).${serverName}}:${toString specusPort}";
+              persistentKeepalive = 25;
+              publicKey = serverConfig.publicKey;
+            }
+          ];
+        })
+      specusMachines.servers;
+    };
+}
--- a/packages/gpt.nix
+++ b/packages/gpt.nix
@@ -1,15 +0,0 @@
-{
-  curl,
-  writers,
-  jq,
-  apiKeyCommand ? "pass api-keys/openai.com",
-  model ? "gpt-3.5-turbo",
-}:
-writers.writeDashBin "gpt" ''
-  json=$(jq --slurp --raw-input '{model:"${model}", messages: [{role: "user", content: .}]}')
-  ${curl}/bin/curl -sSL https://api.openai.com/v1/chat/completions \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $(${apiKeyCommand})" \
-    -d "$json" \
-    | ${jq}/bin/jq -r '.choices[] | .message.content'
-''
--- a/packages/itl.nix
+++ b/packages/itl.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, cmake, lib }:
+stdenv.mkDerivation rec {
+  pname = "itl";
+  version = "0.8.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "ITL";
+    rev = "v${version}";
+    sha256 = "sha256-GTicTbZmFbPhzInFob3cfvtTxOpUZuqsQz1w9CoWu9w=";
+  };
+  nativeBuildInputs = [cmake];
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "Islamic Tools and Libraries";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}
--- a/packages/itools.nix
+++ b/packages/itools.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, itl, lib, autoreconfHook }:
+stdenv.mkDerivation rec {
+  pname = "itools";
+  version = "1.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "itools";
+    rev = version;
+    sha256 = "sha256-g9bsjupC4Sb5ywAgUNbjYLbHZ/i994lbNSnX2JyaP3g=";
+  };
+  preAutoreconf = "autoupdate";
+  nativeBuildInputs = [autoreconfHook];
+  buildInputs = [itl];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "The itools package is a set of user friendly applications utilizing Arabeyes' ITL library. ";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}
--- a/packages/klem.nix
+++ b/packages/klem.nix
@@ -49,6 +49,7 @@ in
        ${lib.concatStringsSep "\n" (lib.mapAttrsToList scriptCase cfg.scripts)}
        *) ${pkgs.coreutils}/bin/cat ;;
      esac \
+      | tr -d '\r\n' \
      | ${pkgs.xclip}/bin/xclip -selection ${cfg.selection} -in

    ${pkgs.libnotify}/bin/notify-send --app-name="klem" "Result copied to clipboard."
--- a/packages/kpaste.nix
+++ b/packages/kpaste.nix
@@ -4,7 +4,6 @@
  writers,
 }:
 writers.writeDashBin "kpaste" ''
-  ${curl}/bin/curl -sS http://p.r --data-binary @"''${1:--}" \
-    -H "Content-Type-Override: ''${KPASTE_CONTENT_TYPE-}" |
+  ${curl}/bin/curl -sS http://p.r --data-binary @"''${1:--}" |
  ${gnused}/bin/sed '$ {p;s|http://p.r|https://p.krebsco.de|}'
 ''
--- a/packages/mpv-radio.nix
+++ b/packages/mpv-radio.nix
@@ -20,9 +20,7 @@
  streams);
 in
  writers.writeDashBin "mpv-radio" ''
-    if [ -z ''${DI_FM_KEY} ]; then
-      DI_FM_KEY=$(cat "${di-fm-key-file}")
-    fi
+    export DI_FM_KEY=$(cat "${di-fm-key-file}")
    exec ${mpv}/bin/mpv --force-window=yes "$(
      ${dmenu}/bin/dmenu -i -l 5 < ${streams-tsv} \
        | ${coreutils}/bin/cut -f3 \
--- a/packages/mpv-tuner.nix
+++ b/packages/mpv-tuner.nix
@@ -1,22 +0,0 @@
-{
-  writeText,
-  lib,
-  writers,
-  mpv,
-  gnused,
-  di-fm-key-file,
-  findutils,
-}: let
-  streams = import ../lib/streams.nix {
-    di-fm-key = "%DI_FM_KEY%";
-  };
-  streams-list = writeText "streams.txt" (lib.concatMapStringsSep "\n" (station: station.stream) streams);
-in
-  writers.writeDashBin "mpv-tuner" ''
-    if [ -z ''${DI_FM_KEY} ]; then
-      DI_FM_KEY=$(cat "${di-fm-key-file}")
-    fi
-    shuf ${streams-list} \
-      | ${gnused}/bin/sed s/%DI_FM_KEY%/"$DI_FM_KEY"/ \
-      | ${findutils}/bin/xargs ${mpv}/bin/mpv
-  ''
--- a/packages/notemenu.nix
+++ b/packages/notemenu.nix
@@ -1,29 +0,0 @@
-{
-  writers,
-  lib,
-  rofi,
-  findutils,
-  coreutils,
-  noteDirectory ? "~/cloud/syncthing/obsidian",
-  currentDates ? false,
-  niveumPackages,
-}:
-writers.writeDashBin "notemenu" ''
-  set -efu
-  PATH=$PATH:${
-    lib.makeBinPath [rofi findutils coreutils]
-  }
-
-  cd ${noteDirectory}
-  note_file=$({
-    ${lib.optionalString currentDates ''
-    echo $(date -I).md
-    echo $(date -I -d yesterday).md
-  ''}
-    find . -not -path '*/.*' -type f -printf "%T@ %p\n" | sort --reverse --numeric-sort | cut --delimiter=" " --fields=2-
-  } | rofi -dmenu -i -p 'notes')
-  if test "$note_file"
-  then
-    alacritty --working-directory ${noteDirectory} -e ${niveumPackages.obsidian-vim}/bin/nvim "$note_file"
-  fi
-''
--- a/packages/obsidian-vim.nix
+++ b/packages/obsidian-vim.nix
@@ -1,37 +0,0 @@
-{
-  neovim,
-  vimPlugins,
-  obsidiantVaultDirectory ? "~/cloud/syncthing/obsidian/",
-  ...
-}:
-neovim.override {
-  configure = {
-    customRC = ''
-      source ${../lib/vim/shared.vim}
-
-      cd ${obsidiantVaultDirectory}
-
-      let g:vimwiki_auto_chdir = 1
-      let g:vimwiki_listsyms = ' X'
-      let g:vimwiki_commentstring = '<!--%s-->'
-
-      let g:vimwiki_list = [{
-        \ 'path': '${obsidiantVaultDirectory}',
-        \ 'syntax': 'markdown',
-        \ 'ext': '.md',
-        \ 'diary_rel_path' '.',
-        \}]
-
-      let NERDTreeSortOrder = ['[[-timestamp]]']
-
-      " Start NERDTree and put the cursor back in the other window.
-      autocmd VimEnter * NERDTree ${obsidiantVaultDirectory} | wincmd p
-    '';
-    packages.nvim.start = [
-      vimPlugins.vimwiki
-      vimPlugins.nerdtree
-      vimPlugins.fzf-vim
-      vimPlugins.fzfWrapper
-    ];
-  };
-}
--- a/packages/vim.nix
+++ b/packages/vim.nix
@@ -1,73 +0,0 @@
-{
-  neovim,
-  vimPlugins,
-  fetchFromGitHub,
-  vimUtils,
-  niveumPackages,
-  ...
-}: (neovim.override {
-  configure = {
-    customRC = ''
-      source ${../lib/vim/shared.vim}
-      source ${../lib/vim/init.vim}
-      luafile ${../lib/vim/init.lua}
-    '';
-    packages.nvim = with vimPlugins; {
-      start = [
-        nvim-cmp
-        cmp-buffer
-        cmp-path
-        cmp-nvim-lsp
-        cmp-cmdline
-        luasnip
-
-        fzf-vim
-        fzfWrapper
-        supertab
-        undotree
-        tabular
-        # vimwiki
-        niveumPackages.vimPlugins-vim-colors-paramount
-        nvim-lspconfig
-        vim-commentary
-        vim-css-color
-        vim-eunuch
-        niveumPackages.vimPlugins-vim-fetch
-        vim-fugitive
-        vim-gitgutter
-        vim-repeat
-        vim-sensible
-        vim-surround
-        (vimUtils.buildVimPlugin rec {
-          pname = "vim-dim";
-          version = "1.1.0";
-          name = "${pname}-${version}";
-          src = fetchFromGitHub {
-            owner = "jeffkreeftmeijer";
-            repo = pname;
-            rev = version;
-            sha256 = "sha256-lyTZUgqUEEJRrzGo1FD8/t8KBioPrtB3MmGvPeEVI/g=";
-          };
-        })
-      ];
-      opt = [
-        csv
-        elm-vim
-        emmet-vim
-        haskell-vim
-        niveumPackages.vimPlugins-icalendar-vim
-        niveumPackages.vimPlugins-jq-vim
-        rust-vim
-        typescript-vim
-        vim-javascript
-        vim-ledger
-        vim-nix
-        vimtex
-        vim-pandoc
-        vim-pandoc-syntax
-        niveumPackages.vimPlugins-vim-256noir
-        niveumPackages.vimPlugins-typst-vim
-      ];
-    };
-  };
-})
--- a/packages/vimPlugins/typst-vim.nix
+++ b/packages/vimPlugins/typst-vim.nix
@@ -1,14 +0,0 @@
-{
-  vimUtils,
-  fetchFromGitHub,
-}:
-vimUtils.buildVimPluginFrom2Nix {
-  pname = "typst.vim";
-  version = "2882f21";
-  src = fetchFromGitHub {
-    owner = "kaarmu";
-    repo = "typst.vim";
-    rev = "2882f211f1498c790bb857f8a912c8e86526a362";
-    sha256 = "0xr8k17ggqfdksf3kybimfl5djjz3h19k4479la06i5lnwvlhkh2";
-  };
-}
--- a/2
+++ b/2
--- a/secrets.txt
+++ b/secrets.txt
@@ -1,63 +0,0 @@
-secrets/secrets.nix
-secrets/email-password-cock.age
-secrets/telegram-token-nachtischsatan.age
-secrets/nextcloud-password-kieran.age
-secrets/kabsa-retiolum-privateKey-rsa.age
-secrets/manakish-syncthing-key.age
-secrets/hetzner-storagebox-credentials.age
-secrets/ful-retiolum-privateKey-rsa.age
-secrets/kfm-password.age
-secrets/maxmind-license-key.age
-secrets/kabsa-specus-privateKey.age
-secrets/mega-password.age
-secrets/traadfri-key.age
-secrets/zaatar-syncthing-key.age
-secrets/onlyoffice-jwt-key.age
-secrets/nextcloud-password-fysi.age
-secrets/miniflux-credentials.age
-secrets/openweathermap-api-key.age
-secrets/zaatar-retiolum-privateKey-rsa.age
-secrets/email-password-fsklassp.age
-secrets/telegram-token-reverse.age
-secrets/email-password-fysi.age
-secrets/manakish-retiolum-privateKey-rsa.age
-secrets/nextcloud-password-admin.age
-secrets/email-password-posteo.age
-secrets/ful-root.age
-secrets/makanek-specus-privateKey.age
-secrets/zaatar-ympd-basicAuth.age
-secrets/home-assistant-token.age
-secrets/email-password-dslalewa.age
-secrets/telegram-token-kmein.age
-secrets/tahina-retiolum-privateKey-ed25519.age
-secrets/kabsa-syncthing-cert.age
-secrets/email-password-meinhark.age
-secrets/ful-retiolum-privateKey-ed25519.age
-secrets/nextcloud-password-database.age
-secrets/telegram-token-menstruation.age
-secrets/tabula-retiolum-privateKey-rsa.age
-secrets/grafana-password-admin.age
-secrets/di-fm-key.age
-secrets/kabsa-retiolum-privateKey-ed25519.age
-secrets/email-password-meinhaki.age
-secrets/ful-specus-privateKey.age
-secrets/zaatar-syncthing-cert.age
-secrets/tahina-retiolum-privateKey-rsa.age
-secrets/spotify-password.age
-secrets/manakish-syncthing-cert.age
-secrets/makanek-retiolum-privateKey-rsa.age
-secrets/makanek-retiolum-privateKey-ed25519.age
-secrets/spotify-username.age
-secrets/telegram-token-betacode.age
-secrets/zaatar-moodle-dl-basicAuth.age
-secrets/zaatar-retiolum-privateKey-ed25519.age
-secrets/restic.age
-secrets/zaatar-moodle-dl-tokens.json.age
-secrets/cifs-credentials-hu-berlin.age
-secrets/alertmanager-token-reporters.age
-secrets/tabula-retiolum-privateKey-ed25519.age
-secrets/telegram-token-proverb.age
-secrets/github-token-i3status-rust.age
-secrets/weechat-sec.conf.age
-secrets/kabsa-syncthing-key.age
-secrets/manakish-retiolum-privateKey-ed25519.age
--- a/systems/ful/configuration.nix
+++ b/systems/ful/configuration.nix
@@ -49,6 +49,12 @@ in {
    };
    root.file = ../../secrets/ful-root.age;
    restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/ful-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
  };

  services.restic.backups.niveum = {
@@ -93,5 +99,5 @@ in {
  environment.systemPackages = [pkgs.vim pkgs.git pkgs.tmux pkgs.python3];

  # since 22.05 timeout fails?
-  # systemd.services.systemd-networkd-wait-online.enable = false;
+  systemd.services.systemd-networkd-wait-online.enable = false;
 }
--- a/systems/ful/panoptikon.nix
+++ b/systems/ful/panoptikon.nix
@@ -24,14 +24,7 @@ in {
    enable = true;
    watchers = {
      "github-meta" = {
-        script = panoptikon.urlJSON {
-          jqScript = ''
-            {
-              ssh_key_fingerprints: .ssh_key_fingerprints,
-              ssh_keys: .ssh_keys
-            }
-          '';
-        } "https://api.github.com/meta";
+        script = panoptikon.urlJSON {} "https://api.github.com/meta";
        reporters = [irc-xxx];
      };
      lammla = {
--- a/systems/kabsa/configuration.nix
+++ b/systems/kabsa/configuration.nix
@@ -40,10 +40,16 @@ in {
    restic.file = ../../secrets/restic.age;
    syncthing-cert.file = ../../secrets/kabsa-syncthing-cert.age;
    syncthing-key.file = ../../secrets/kabsa-syncthing-key.age;
+    specus.file = ../../secrets/kabsa-specus-privateKey.age;
  };

  environment.systemPackages = [pkgs.minecraft pkgs.zeroad];

+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    client.enable = false;
+  };
+
  networking = {
    hostName = "kabsa";
    wireless.interfaces = ["wlp3s0"];
--- a/systems/makanek/configuration.nix
+++ b/systems/makanek/configuration.nix
@@ -16,7 +16,6 @@ in {
    ./names.nix
    ./nextcloud.nix
    ./radio-news.nix
-    ./onlyoffice.nix
    ./retiolum-map.nix
    ./tarot.nix
    ./tt-rss.nix
@@ -45,7 +44,6 @@ in {
      config.services.grafana.dataDir
      config.services.gitea.stateDir
      config.services.weechat.root
-      config.services.nginx.virtualHosts."www.kmein.de".root
      "/var/lib/weechat"
      "/var/lib/codimd"
    ];
@@ -97,6 +95,12 @@ in {
      group = "tinc.retiolum";
    };
    restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/makanek-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
  };

  system.stateVersion = "20.03";
@@ -115,12 +119,6 @@ in {
    defaults.email = kieran.email;
  };

-  services.nginx.virtualHosts."www.kmein.de" = {
-    addSSL = true;
-    enableACME = true;
-    root = "/var/www/kmein.de";
-  };
-
  environment.systemPackages = [
    pkgs.vim
    pkgs.git
--- a/systems/makanek/gitea.nix
+++ b/systems/makanek/gitea.nix
@@ -4,9 +4,9 @@ let
 in {
  services.gitea = {
    enable = true;
+    rootUrl = domain;
    appName = "code.kmein.de";
    settings = {
-      server.ROOT_URL = domain;
      server.SSH_PORT = sshPort;
      service.DISABLE_REGISTRATION = true;
    };
--- a/systems/makanek/hardware-configuration.nix
+++ b/systems/makanek/hardware-configuration.nix
@@ -16,6 +16,7 @@
    extraModulePackages = [];
    loader.grub = {
      enable = true;
+      version = 2;
      devices = ["/dev/sda"];
      configurationLimit = 3;
    };
--- a/systems/makanek/moinbot.nix
+++ b/systems/makanek/moinbot.nix
@@ -7,13 +7,17 @@
    startAt = "7:00";
    script = ''
      greeting=$(echo "moin
-      MOIN" | shuf -n1)
+      oi
+      noim
+      MOIN
+      OI
+      moi" | shuf -n1)
      echo "$greeting" | ${config.nur.repos.mic92.ircsink}/bin/ircsink \
        --nick "$greeting""bot" \
        --server irc.hackint.org \
        --port 6697 \
        --secure \
-        --target '#hsmr' >/dev/null 2>&1
+        --target '#hsmr-moin' >/dev/null 2>&1
    '';
    serviceConfig.DynamicUser = true;
  };
--- a/systems/makanek/monitoring/default.nix
+++ b/systems/makanek/monitoring/default.nix
@@ -223,7 +223,8 @@ in {
          email_configs = let
            inherit (import ../../../lib) kieran;
            inherit (import ../../../lib/email.nix {inherit lib;}) cock;
-            cockConfig = {
+          in [
+            {
              send_resolved = true;
              to = kieran.email;
              from = cock.user;
@@ -231,8 +232,7 @@ in {
              auth_username = cock.user;
              auth_identity = cock.user;
              auth_password = "$EMAIL_PASSWORD";
-            };
-          in [
+            }
          ];
        }
      ];
@@ -306,7 +306,7 @@ in {
            "code.kmein.de"
            "radio.kmein.de"
            "tarot.kmein.de"
-            "cloud.kmein.de"
+            "cloud.xn--kiern-0qa.de"
            "grafana.kmein.r"
            # "names.kmein.r"
            "rrm.r"
--- a/systems/makanek/nextcloud.nix
+++ b/systems/makanek/nextcloud.nix
@@ -4,34 +4,9 @@
  lib,
  ...
 }: let
-  storageBoxMountPoint = "/mnt/storagebox";
+  inherit (import ../../lib) localAddresses;
 in {
-  # https://docs.hetzner.com/de/robot/storage-box/access/access-samba-cifs/
-  fileSystems.${storageBoxMountPoint} = {
-    device = "//u359050.your-storagebox.de/backup";
-    fsType = "cifs";
-    options = [
-      "iocharset=utf8"
-      "rw"
-      "credentials=${config.age.secrets.hetzner-storagebox-credentials.path}"
-      "uid=nextcloud"
-      "gid=nextcloud"
-      "file_mode=0660"
-      "dir_mode=0770"
-      "seal"
-      "mfsymlinks" # nextcloud-setup wants to create symlinks on cifs
-    ];
-  };
-
-  systemd.services.nextcloud-setup = {
-    wants = ["mnt-storagebox.mount" "postgresql.service"];
-    after = ["mnt-storagebox.mount" "postgresql.service"];
-  };
-
  age.secrets = {
-    hetzner-storagebox-credentials = {
-      file = ../../secrets/hetzner-storagebox-credentials.age;
-    };
    nextcloud-password-database = {
      file = ../../secrets/nextcloud-password-database.age;
      owner = "nextcloud";
@@ -48,7 +23,7 @@ in {

  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud26;
+    package = pkgs.nextcloud25;

    https = true;
    enableBrokenCiphersForSSE = false;
@@ -58,9 +33,7 @@ in {
      startAt = "05:00:00";
    };

-    hostName = "cloud.kmein.de";
-
-    datadir = "${storageBoxMountPoint}/nextcloud";
+    hostName = "cloud.xn--kiern-0qa.de";

    phpOptions."opcache.interned_strings_buffer" = "32"; # buffer size in MB

@@ -123,8 +96,14 @@ in {
    ];
  };

-  services.nginx.virtualHosts."cloud.kmein.de" = {
+  services.nginx.virtualHosts."cloud.xn--kiern-0qa.de" = {
    enableACME = true;
    forceSSL = true;
  };
+
+  # Ensure that postgres is running before running the setup
+  systemd.services."nextcloud-setup" = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
 }
--- a/systems/makanek/onlyoffice.nix
+++ b/systems/makanek/onlyoffice.nix
@@ -1,29 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: {
-  services.onlyoffice = {
-    enable = true;
-    port = 8111;
-    hostname = "onlyoffice.kmein.de";
-    jwtSecretFile = config.age.secrets.onlyoffice-key.path;
-  };
-
-  age.secrets.onlyoffice-key = {
-    file = ../../secrets/onlyoffice-jwt-key.age;
-    owner = "onlyoffice";
-  };
-
-  # otherwise this leads to nginx
-  # open() "/var/lib/onlyoffice/documentserver/App_Data/cache/files/data/conv_check_1138411943_docx/output.docx" failed (13: Permission denied)
-  # and mysterious 403 errors
-  system.activationScripts.onlyoffice-readable.text = ''
-    chmod a+x /var/lib/onlyoffice/documentserver/
-  '';
-
-  services.nginx.virtualHosts.${config.services.onlyoffice.hostname} = {
-    enableACME = true;
-    forceSSL = true;
-  };
-}
--- a/systems/makanek/retiolum-map.nix
+++ b/systems/makanek/retiolum-map.nix
@@ -20,7 +20,7 @@ in {
    script = ''
      ${tinc-graph}/bin/tinc-graph --geoip-file ${geo-ip-database-path} --network ${network} \
        | ${pkgs.coreutils}/bin/tee network.json \
-        | ${tinc-graph}/bin/tinc-midpoint > midpoint.json
+        | ${tinc-graph}/bin/tinc-statistics > statistics.json

      cp ${tinc-graph}/static/map.html map.html
      cp ${tinc-graph}/static/map.html index.html
--- a/systems/manakish/hdmi.nix
+++ b/systems/manakish/hdmi.nix
@@ -1,13 +1,52 @@
-{pkgs, ...}: {
-  services.xserver.displayManager.sessionCommands = let
-    intern = "LVDS-1";
-    extern = "HDMI-1";
-    pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
-    # pulseaudioProfile = "output:hdmi-stereo-extra2+input:analog-stereo";
-    pulseaudioProfile = "alsa_output.pci-0000_00_1b.0.analog-stereo";
-  in
-    toString (pkgs.writers.writeDash "hdmi-on" ''
-      ${pkgs.xorg.xrandr}/bin/xrandr --output ${intern} --primary --auto --output ${extern} --above ${intern} --auto
-      ${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} ${pulseaudioProfile}
-    '');
+{pkgs, ...}: let
+  pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
+  fingerprint = {
+    HDMI-1 = "00ffffffffffff004c2d320d48435030181a0103803c22782a5295a556549d250e5054bb8c00b30081c0810081809500a9c001010101023a801871382d40582c450056502100001e000000fd0032481e5111000a202020202020000000fc00433237463339300a2020202020000000ff00485451483630323132390a202001e402031af14690041f131203230907078301000066030c00100080011d00bc52d01e20b828554056502100001e8c0ad090204031200c4055005650210000188c0ad08a20e02d10103e9600565021000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061";
+    LVDS-1 = "00ffffffffffff0006af6c100000000000140104901c10780220e5925554922825505400000001010101010101010101010101010101121b56585000193030203600159c100000180000000f0000000000000000000000000020000000fe0041554f0a202020202020202020000000fe004231323558573031205630200a00ec";
+  };
+in {
+  home-manager.users.me = {
+    programs.autorandr = {
+      enable = true;
+      hooks.postswitch.wallpaper = "systemctl --user restart wallpaper";
+      profiles = {
+        single = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} alsa_output.pci-0000_00_1b.0.analog-stereo";
+          fingerprint = {inherit (fingerprint) LVDS-1;};
+          config = {
+            HDMI-1.enable = false;
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              primary = true;
+              rate = "60.10";
+            };
+          };
+        };
+        desk = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} output:hdmi-stereo+input:analog-stereo";
+          fingerprint = {inherit (fingerprint) HDMI-1 LVDS-1;};
+          config = {
+            HDMI-1 = {
+              enable = true;
+              crtc = 1;
+              mode = "1920x1080";
+              position = "0x0";
+              primary = true;
+              rate = "60.00";
+            };
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              rate = "60.10";
+            };
+          };
+        };
+      };
+    };
+  };
 }
--- a/systems/moto/configuration.nix
+++ b/systems/moto/configuration.nix
@@ -1,71 +0,0 @@
-{
-  pkgs,
-  niveumPackages,
-  inputs,
-  ...
-}: let
-  sshPort = 8022;
-in {
-  environment.packages = with pkgs; [
-    nil
-    bzip2
-    coreutils
-    curl
-    diffutils
-    findutils
-    git
-    gnugrep
-    gnupg
-    gnused
-    gnutar
-    gzip
-    hostname
-    iproute2
-    man
-    openssh
-    procps
-    tzdata
-    unzip
-    utillinux
-    vim
-    which
-    xz
-    zip
-    hledger
-    hledger-ui
-    niveumPackages.vim
-    gitAndTools.gh
-    ripgrep
-    (pkgs.writers.writeDashBin "start-ssh" ''
-      ${pkgs.openssh}/bin/sshd -f ${pkgs.writeText "sshd_config" ''
-        HostKey /data/data/com.termux.nix/files/home/.ssh/ssh_host_rsa_key
-        Port ${toString sshPort}
-      ''}
-    '')
-  ];
-
-  nix.nixPath = ["nixpkgs=${inputs.nixpkgs}"];
-
-  home-manager = {
-    useGlobalPkgs = true;
-    backupFileExtension = "hm-bak";
-    config = {pkgs, ...}: {
-      home.stateVersion = "23.05";
-      programs.tmux.enable = true;
-    };
-  };
-
-  environment.sessionVariables = {
-    LEDGER_FILE = "/data/data/com.termux.nix/files/home/src/ledger/privat.journal";
-  };
-
-  user.shell = "${pkgs.fish}/bin/fish";
-
-  environment.etcBackupExtension = ".bak";
-
-  system.stateVersion = "23.05";
-
-  nix.extraOptions = ''
-    experimental-features = nix-command flakes
-  '';
-}
--- a/systems/zaatar/atuin.nix
+++ b/systems/zaatar/atuin.nix
@@ -1,16 +1,58 @@
-{pkgs, ...}: {
+{
+  config,
+  pkgs,
+  ...
+}: let
+  inherit (import ../../lib) tmpfilesConfig;
+in {
+  services.postgresql = {
+    enable = true;
+    dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}";
+    ensureDatabases = ["atuin"];
+    ensureUsers = [
+      {
+        name = "atuin";
+        ensurePermissions."DATABASE atuin" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+
  services.postgresqlBackup = {
    enable = true;
    databases = ["atuin"];
  };

-  services.postgresql.package = pkgs.postgresql_14;
+  systemd.tmpfiles.rules = [
+    (tmpfilesConfig {
+      type = "d";
+      path = "/var/state/postgresql";
+      mode = "0700";
+      user = "postgres";
+      group = "postgres";
+    })
+  ];

-  services.atuin = {
-    host = "0.0.0.0";
-    openFirewall = true;
-    openRegistration = true;
-    port = 8888;
-    enable = true;
+  users.groups.atuin = {};
+  users.users.atuin = {
+    isSystemUser = true;
+    group = "atuin";
+    home = "/run/atuin";
+    createHome = true;
  };
+
+  systemd.services.atuin = {
+    wantedBy = ["multi-user.target"];
+    environment = {
+      ATUIN_HOST = "0.0.0.0";
+      ATUIN_PORT = "8888";
+      ATUIN_OPEN_REGISTRATION = "true";
+      ATUIN_DB_URI = "postgres:///atuin";
+    };
+    serviceConfig = {
+      User = "atuin";
+      ExecStart = "${pkgs.atuin}/bin/atuin server start";
+      Restart = "on-failure";
+    };
+  };
+  networking.firewall.allowedTCPPorts = [8888];
 }
--- a/systems/zaatar/configuration.nix
+++ b/systems/zaatar/configuration.nix
@@ -10,8 +10,8 @@ in {
    ./atuin.nix
    ./backup.nix
    ./gaslight.nix
-    ./kiosk.nix
    ./hardware-configuration.nix
+    ./kiosk.nix
    ./moodle-dl-meinhark.nix
    ./pulseaudio.nix
    ./home-assistant.nix
@@ -45,7 +45,7 @@ in {
    restic.file = ../../secrets/restic.age;
  };

-  services.restic.backups.niveum = {
+  services.restic.backups.moodle-dl = {
    initialize = true;
    inherit (restic) repository;
    timerConfig = {
@@ -82,7 +82,7 @@ in {
  ];

  # since 22.05 timeout fails?
-  # systemd.services.systemd-networkd-wait-online.enable = false;
+  systemd.services.systemd-networkd-wait-online.enable = false;

  networking = {
    hostName = "zaatar";
@@ -90,5 +90,5 @@ in {
    retiolum = retiolumAddresses.zaatar;
  };

-  system.stateVersion = "22.05";
+  system.stateVersion = "20.09";
 }
--- a/systems/zaatar/home-assistant.nix
+++ b/systems/zaatar/home-assistant.nix
@@ -1,6 +1,5 @@
-{config, ...}: let
+let
  port = 8123;
-  inherit (import ../../lib) restic;
 in {
  networking.firewall.allowedTCPPorts = [port];

@@ -10,28 +9,15 @@ in {
    };
  };

-  services.restic.backups.niveum = {
-    initialize = true;
-    inherit (restic) repository;
-    timerConfig = {
-      OnCalendar = "daily";
-      RandomizedDelaySec = "1h";
-    };
-    passwordFile = config.age.secrets.restic.path;
-    paths = [
-      "/var/lib/containers/storage/volumes/home-assistant.bak/_data/backups"
-    ];
-  };
-
  virtualisation.oci-containers = {
    backend = "podman";
    containers.homeassistant = {
-      volumes = ["home-assistant.bak:/config"];
+      volumes = ["home-assistant:/config"];
      environment.TZ = "Europe/Berlin";
      image = "ghcr.io/home-assistant/home-assistant:stable";
      extraOptions = [
        "--network=host"
-        "--device=/dev/ttyACM0:/dev/ttyACM0" # Example, change this to match your own hardware
+        # "--device=/dev/ttyUSB0:/dev/ttyACM0"  # Example, change this to match your own hardware
      ];
    };
  };
--- a/systems/zaatar/kiosk.nix
+++ b/systems/zaatar/kiosk.nix
@@ -9,7 +9,6 @@
    password = "";
    extraGroups = ["audio"];
  };
-  # TODO https://github.com/cage-kiosk/cage/issues/138
  services.cage = {
    enable = true;
    user = config.users.extraUsers.kiosk.name;
--- a/systems/zaatar/moodle-dl-meinhark.nix
+++ b/systems/zaatar/moodle-dl-meinhark.nix
@@ -7,18 +7,16 @@
  moodle-dl-package = pkgs.moodle-dl.overrideAttrs (old:
    old
    // {
-      # patches = [../../packages/moodle-dl/telegram-format.patch]; TODO?
+      patches = [../../packages/moodle-dl/telegram-format.patch];
    });
 in {
  age.secrets = {
-    /*
    moodle-dl-tokens = {
      file = ../../secrets/zaatar-moodle-dl-tokens.json.age;
      owner = "moodle-dl";
      group = "moodle-dl";
      mode = "400";
    };
-    */
    moodle-dl-basicAuth = {
      file = ../../secrets/zaatar-moodle-dl-basicAuth.age;
      owner = "nginx";
@@ -28,7 +26,7 @@ in {
  };

  services.moodle-dl = {
-    enable = false;
+    enable = true;
    startAt = "hourly";
    package = moodle-dl-package;
    tokensFile = config.age.secrets.moodle-dl-tokens.path;
@@ -97,16 +95,6 @@ in {
        # WS 2022
        115414 # Nonnos
        116108 # Dialektologie
-
-        # SS 2023
-        117967 # Archaische Lyrik
-        119658 # Dyskolos
-        118963 # Antike Biographie
-        92668 # Taa
-        120671 # Jiddisch
-        120720 # Sorbisch
-        118076 # X-Tutorial
-        120631 # Predigten
      ];
      download_submissions = true;
      download_descriptions = true;
--- a/systems/zaatar/mpd.nix
+++ b/systems/zaatar/mpd.nix
@@ -7,8 +7,6 @@
  firewall = (import ../../lib).firewall lib;
  inherit (import ../../lib) tmpfilesConfig;

-  mukkeMountPoint = "/mnt/mukke";
-
  streams = import ../../lib/streams.nix {
    di-fm-key = ""; # TODO lib.strings.fileContents <secrets/di.fm/key>;
  };
@@ -27,7 +25,7 @@ in {
    devices = {
      inherit ((import ../../lib).syncthing.devices) kabsa manakish heym;
    };
-    folders."${config.services.mpd.musicDirectory}/sync" = {
+    folders.${config.services.mpd.musicDirectory} = {
      devices = ["heym" "kabsa" "manakish"];
      id = "music";
      type = "receiveonly";
@@ -48,19 +46,6 @@ in {
    '';
  };

-  fileSystems.${mukkeMountPoint} = {
-    device = "//mukke.r/public";
-    fsType = "cifs";
-    options = [
-      "guest"
-      "nofail"
-      "noauto"
-      "ro"
-      "rsize=16777216"
-      "cache=loose"
-    ];
-  };
-
  environment.systemPackages = [pkgs.mpc_cli];

  networking.firewall = let
@@ -108,14 +93,6 @@ in {
        path = "/var/lib/mpd/playlists/all.m3u";
        argument = makePlaylist "all" streams;
      })
-      (tmpfilesConfig {
-        type = "L+";
-        mode = "0644";
-        user = "mpd";
-        group = "mpd";
-        path = "${config.services.mpd.musicDirectory}/mukke";
-        argument = mukkeMountPoint;
-      })
    ];

  services.ympd = {
--- a/systems/zaatar/spotifyd.nix
+++ b/systems/zaatar/spotifyd.nix
@@ -1,17 +1,15 @@
-{config, ...}: {
-  nixpkgs.config.packageOverrides = pkgs: {
-    # mpris is a dbus service for controlling all music players with e.g. playerctl
-    # I do not need this, because I only interact with the service via Spotify Connect
-    # otherẃise it will pull in DBus which fails without X11
-    spotifyd = pkgs.spotifyd.overrideAttrs {withMPris = false;};
-  };
-
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
  services.spotifyd = {
    enable = true;
    settings = {
      global = {
-        username_cmd = "cat $CREDENTIALS_DIRECTORY/username";
-        password_cmd = "cat $CREDENTIALS_DIRECTORY/password";
+        username_cmd = "cat ${config.age.secrets.spotify-username.path}";
+        password_cmd = "cat ${config.age.secrets.spotify-password.path}";
        backend = "pulseaudio";
        bitrate = 320;
        device_type = "s_t_b"; # set-top box
@@ -20,13 +18,6 @@
    };
  };

-  systemd.services.spotifyd = {
-    serviceConfig.LoadCredential = [
-      "username:${config.age.secrets.spotify-username.path}"
-      "password:${config.age.secrets.spotify-password.path}"
-    ];
-  };
-
  age.secrets = {
    spotify-username.file = ../../secrets/spotify-username.age;
    spotify-password.file = ../../secrets/spotify-password.age;
@@ -37,4 +28,6 @@
    unload-module module-native-protocol-unix
    load-module module-native-protocol-unix auth-anonymous=1
  '';
+
+  systemd.services.spotifyd.serviceConfig.Restart = "always";
 }