feat(networkmanager): declarative

This reverts commit 27a6c5833e.

.bin/256color

@@ -0,0 +1,38 @@
+#! /bin/sh
+set -euf
+
+pl() {
+  for i in $(seq $1 $(expr $2 - 1)); do
+    printf '\e[38;5;%sm%03i\e[m ' $i $i
+  done
+  printf '\e[38;5;%sm%03i\e[m\n' $2 $2
+}
+
+p() {
+  printf '\e[38;5;%sm%03i\e[m ' $1 $1
+}
+pn() {
+  printf '\e[38;5;%sm%03i\e[m\n' $1 $1
+}
+
+p6x6() {
+  for i in $(seq 0 5); do
+    for j in $(seq 0 5); do
+      p $(expr $1 + $i + $j \* 6)
+    done
+    echo
+  done
+}
+
+pl 0 7
+pl 8 15
+
+p6x6 16
+p6x6 52
+p6x6 88
+p6x6 124
+p6x6 160
+p6x6 196
+
+pl 232 243
+pl 244 255

.bin/browser

@@ -0,0 +1,24 @@
+#!/bin/sh -e
+#
+# Usage: browser
+#        pipe html to a browser
+# e.g.
+#  $ echo '<h1>hi mom!</h1>' | browser
+#  $ ron -5 man/rip.5.ron | browser   
+
+if [ -t 0 ]; then
+  if [ -n "$1" ]; then
+    open $1
+  else
+    cat <<usage
+Usage: browser
+       pipe html to a browser
+$ echo '<h1>hi mom!</h1>' | browser
+$ ron -5 man/rip.5.ron | browser
+usage
+fi
+else
+  f="/tmp/browser.$RANDOM.html"
+  cat /dev/stdin > $f
+  xdg-open $f
+fi

.bin/candyman

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -efu
+
+usage() {
+  echo >&2 "$0 add-{reddit,telegram,youtube,twitch,twitter} NAME"
+  exit 1
+}
+
+candyman() {
+  curl -fsSv http://news.r/api -H content-type:application/json -d "$(jq -n "
+    {
+      command: \"PRIVMSG\",
+      params: [\"#all\", \"candyman: $1 $2\"]
+    }
+  ")"
+}
+
+[ $# -ge 2 ] || usage
+
+case "$1" in
+  add-reddit|add-telegram|add-youtube|add-twitter|add-twitch)
+    candyman "$@"
+  ;;
+  *) usage;;
+esac

.bin/countdown

@@ -0,0 +1,13 @@
+#!/usr/bin/env -S awk -f
+function z() {
+  getline < "/proc/uptime"
+  close("/proc/uptime")
+  return $0
+}
+BEGIN {
+  x = z()
+  while (1) {
+    y = z()
+    printf "%02d:%05.2f\r", (y - x) / 60, (y - x) % 60
+  }
+}

.bin/horoscope.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -efu
+
+# Berlin:  -d lodeg=13 -d lomin=22 -d losec=41 -d lodir=E -d ladeg=52 -d lamin=27 -d lasec=42 -d ladir=N -d usecoords=1 \
+# Kassel:  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
+
+
+[ $# -eq 1 ] || {
+  echo >&2 Usage: "$0" TIMESTAMP
+  exit 1
+}
+
+export TZ=UTC
+
+chart_path="$(mktemp /tmp/chart_XXX.pdf)"
+
+timestamp="$1"
+
+year="$(date -d "@$timestamp" +%Y)"
+month="$(date -d "@$timestamp" +%m)"
+day="$(date -d "@$timestamp" +%d)"
+hour="$(date -d "@$timestamp" +%H)"
+minute="$(date -d "@$timestamp" +%M)"
+
+curl -sSL 'https://edifyingfellowship.org/astro/' \
+  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
+  -d ybyr="$year" -d ybmo="$month" -d ybdy="$day" -d ybhr="$hour" -d ybmi="$minute" -d ybsc=0 -d ybtz="$TZ" \
+  -d currenttime=0 \
+  -d title="$timestamp" \
+  -d options[]=VancouverWheel -d options[]=Arrow -d options[]=XBold -d options[]=HouseLabels -d options[]=Placidus \
+  -d options[]=Sun -d options[]=Moon -d options[]=Mercury -d options[]=Venus -d options[]=Mars -d options[]=Jupiter -d options[]=Saturn -d options[]=Uranus -d options[]=Neptune -d options[]=Pluto -d options[]=Ascendant -d options[]=MC -d options[]=Lilith -d options[]=MeanNode -d options[]=TrueNode \
+  -d aspectpct=100 -d format=PDF -d Submit= -o "$chart_path"
+
+zathura "$chart_path"

.bin/libib.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+session_id=7b638c194d9bda74f80043045018cc9e
+
+declare -A libraries
+
+libraries["Literatur"]=344428
+libraries["Sprache"]=344160
+libraries["Miscellanea"]=344427
+libraries["Wissenschaft"]=344429
+libraries["Relicta"]=565920
+
+for library in ${!libraries[@]}
+do
+  curl -sSL 'https://www.libib.com/library/functions/csv-export.php' -H "Cookie: PHPSESSID=$session_id" -d export="${libraries[$library]}" > "$library.csv"
+done

.bin/lieferando.sh

@@ -0,0 +1,81 @@
+#!/bin/sh
+set -efu
+
+if echo "$1" | grep -Eq '[[:digit:]]{5}'; then
+  PLZ="$1"
+else
+  echo >&2 "Usage: $0 PLZ"
+  exit 1
+fi
+
+lieferando_dir=/tmp/lieferando
+mkdir -p "$lieferando_dir/$PLZ"
+
+fetch_restaurants() {
+  cache_path="$lieferando_dir/$PLZ.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "http://www.lieferando.de/$PLZ" \
+      | gunzip \
+      | sed -n '/var restaurants/,/];$/p' \
+      | sed 's/var restaurants =//;$s/;$//' \
+      | prettier --parser=json \
+      | jq '
+        map({
+          name: .[30] | .name,
+          category: .[30] |.categories | split(", "),
+          url: "http://lieferando.de\(.[30] | .url)",
+          minutes: .[19],
+          minimum: .[10],
+          delivery: .[14]
+        })' \
+      | tee "$cache_path"
+  fi
+}
+
+fetch_menu() {
+  [ $# -eq 1 ] || exit 1
+
+  slug="$(echo "$1" | sed 's!.*/!!')"
+  cache_path="$lieferando_dir/$PLZ/$slug.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "$1" \
+      | gunzip \
+      | sed -n '/var MenucardProducts/,/\];/p' \
+      | sed 's/var MenucardProducts =//;s/;$//' \
+      | jq -r '
+        unique_by(.productId)
+        | group_by(.categoryId)
+        | flatten
+      ' \
+      | tee "$cache_path"
+  fi
+}
+
+data="$(fetch_restaurants)"
+
+# echo "$data" | jq -c '.[]' | while read -r restaurant; do
+#   fetch_menu "$(echo "$restaurant" | jq -r .url)"
+# done
+
+selected_categories="$(echo "$data" | jq -r 'map(.category) | flatten | unique | .[]' | fzf -m)"
+
+selected_restaurant_url="$(echo "$selected_categories" | jq --argjson restaurants "$data" -sRr '
+  split("\n")[:-1] as $categories
+  | $restaurants[]
+  | select(.category - $categories != .category)
+  | "\(.name) [🚴\(.minutes)min 💰\(.minimum)€ + \(.delivery)€] (\(.url))"
+  ' \
+  | fzf \
+  | sed 's/.*(//;s/)$//'
+)"
+
+fetch_menu "$selected_restaurant_url" \
+  | jq -r '.[] | "\(.price)\t\(.name)"' \
+  | fzf -m \
+  | awk '{print $0; sum += $1} END {print "-----"; print sum}'

.bin/lit.awk

@@ -0,0 +1,17 @@
+BEGIN {
+  if (!comment) comment = "--";
+  if (!begin) begin = "\\begin{code}";
+  if (!end) end = "\\end{code}";
+}
+{
+  if ($0 == begin) {
+    code = 1;
+    print comment, $0;
+  } else if ($0 == end) {
+    code = 0;
+    print comment, $0;
+  } else {
+    if (code) print $0;
+    else print comment, $0;
+  }
+}

.bin/mail-current-part

@@ -0,0 +1,3 @@
+#! /bin/sh
+set -efu
+exec curl -fSs --unix-socket /tmp/much.api.sock http://localhost/current/part

.bin/mail-current-query-find-part-by-name

@@ -0,0 +1,27 @@
+#! /bin/sh
+# usage: mail-current-query-find-part-by-name NAME
+set -efu
+
+name=$1
+
+query=$(mail-current-query)
+result=$(notmuch show --entire-thread=false --format=json "$query")
+
+part_id=$(printf %s "$result" | jq --arg name "$name" '
+  [
+    recurse |
+    select(type == "object") |
+    { id, name: .filename } |
+    select(.id != null and .name != null)
+  ] |
+  map(select(.name == $name))[0].id
+')
+
+if test "$part_id" = null; then
+  printf 'error: could not find part with name %s\n' \
+    "$name" \
+    >&2
+  exit 1
+fi
+
+exec notmuch show --part="$part_id" "$query"

.bin/mail-current-query-find-part-by-type

@@ -0,0 +1,39 @@
+#! /bin/sh
+# usage: mail-current-query-find-part-by-type TYPE
+set -efu
+
+type=$1
+
+query=$(mail-current-query)
+result=$(notmuch show --entire-thread=false --format=json "$query")
+
+part_id=$(printf %s "$result" | jq --arg type "$type" '
+  #flatten|map(select(.!=null))[0].body[0] |
+  #
+  #if .["content-type"] == $type then
+  #  .id
+  #elif .["content-type"] | test("^multipart/") then
+  #  .content|map(select(.["content-type"]==$type))[0].id
+  #else
+  #  null
+  #end
+
+  [
+    recurse |
+    select(type == "object") |
+    { id, type: .["content-type"] } |
+    select(.id != null and .type != null)
+  ] |
+  map(select(.type == $type))[0].id
+')
+
+if test "$part_id" = null; then
+  printf 'error: could not find part with type %s\n' \
+    "$type" \
+    >&2
+  exit 1
+fi
+
+exec notmuch show --part="$part_id" "$query"
+
+

.bin/pdf-ocr.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p poppler_utils tesseract4
+set -eu
+
+pdf_path="$(realpath "$1")"
+
+[ -f "$pdf_path" ] || {
+  echo "Usage: $0 FILE.pdf" >&2
+  exit 1
+}
+
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf $tmpdir' EXIT
+
+cd "$tmpdir"
+
+pdftoppm -png "$pdf_path" pdf-ocr
+for png in pdf-ocr*.png; do
+  tesseract "$png" "$png.txt" 2>/dev/null
+done
+
+cat pdf-ocr-*.txt

.bin/playlist_entries.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+youtube-dl -ij "$*" | jq -sr '.[] | .webpage_url'

.bin/proxies.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+curl -sSL https://www.netzwelt.de/proxy/index.html \
+  | pup ".tblc" \
+  | xml-to-json /dev/stdin \
+  | jq '
+    .div.table.tbody.tr
+    | map(
+      .td
+      | {
+        ip: .[0].a.value,
+        port: .[1],
+        country: .[2] | (if type == "string" then . else .a.value end),
+        security: .[3],
+        protocol: .[4]
+      }
+    )
+  '

.bin/readme

@@ -0,0 +1,4 @@
+#!/bin/sh
+curl -sSL "https://raw.githubusercontent.com/$*/master/README.md" \
+  | pandoc -f gfm -t man -s \
+  | man -l -

.gitignore

@@ -1,6 +1,6 @@
-secrets.nix
 result
 .direnv
 .envrc
 .history
-**/*.bak
+.todo
+node_modules

.todo/done.txt

@@ -1,2 +0,0 @@
-x 2020-04-27 2019-08-27 fix offlineimap password
-x 2020-04-27 2019-07-09 @package fzf wrappers

.todo/todo.txt

@@ -1,6 +0,0 @@
-(C) 2019-08-25 environment.etc."sshd/banner-line".text = config.networking.hostName;
-(C) 2019-08-25 fix man-pdf: man-pdf 1p env, man-pdf env: man $options -t $command | ps2pdf - $command.pdf
-
-
-(A) 2019-08-26 run services as their own @users
-(A) use lassulus xdg-open wrapper https://cgit.krebsco.de/stockholm/tree/lass/2configs/xdg-open.nix

.versions/home-manager.json

@@ -1,7 +1,10 @@
 {
-  "url": "https://github.com/rycee/home-manager.git",
-  "rev": "abaebf3b346c4bef500c5bd2fdebbed109261a0c",
-  "date": "2020-10-25T19:44:12+01:00",
-  "sha256": "1gcv2ni4nsicpmi4ain568msvgxch8cj04fxf6qgvhdklmh2y84k",
-  "fetchSubmodules": false
+  "url": "https://github.com/nix-community/home-manager.git",
+  "rev": "7d9ba15214004c979d2c8733f8be12ce6502cf8a",
+  "date": "2021-09-14T00:53:31+02:00",
+  "path": "/nix/store/83xlchpzj511c0db0whl99x1ww1apnb5-home-manager",
+  "sha256": "18kmvzinsi9xgm81dk5kyd03m3y5nn125kmbkxf66xasrg13yqdv",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/krops.json

@@ -1,7 +1,10 @@
 {
   "url": "https://cgit.krebsco.de/krops",
-  "rev": "55aa2c77ce8183f3d2b24f54efa33ab6a42e1e02",
-  "date": "2020-04-19T01:06:20+02:00",
-  "sha256": "00rvx9h596ync8wgic6xc9srzajzm28wlp9q7mv4z0jsb27l5bj8",
-  "fetchSubmodules": false
+  "rev": "cccebf3ff7a53336b3f106cb96dddd5892d427ed",
+  "date": "2021-03-23T22:47:37+01:00",
+  "path": "/nix/store/mz13xxnil35lwsf90hwnrm2agir7hb51-krops",
+  "sha256": "07mg3iaqjf1w49vmwfchi7b1w55bh7rvsbgicp2m47gnj9alwdb6",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/nixpkgs-mozilla.json

@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/mozilla/nixpkgs-mozilla",
+  "rev": "0510159186dd2ef46e5464484fbdf119393afa58",
+  "date": "2021-08-17T20:37:26+02:00",
+  "path": "/nix/store/w877m55xnigwaqrnadmnh2fkvfdxlan5-nixpkgs-mozilla",
+  "sha256": "1c6r5ldkh71v6acsfhni7f9sxvi7xrqzshcwd8w0hl2rrqyzi58w",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

.versions/nixpkgs-unstable.json

@@ -1,7 +1,10 @@
 {
   "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "0ead6f8cfd461c3a366c8bc9893037afd89f798d",
-  "date": "2020-10-27T18:30:26+01:00",
-  "sha256": "170kziw7bxfm4mwi8q5c2vdpayml0mini4zyxagbvbivivdj5hla",
-  "fetchSubmodules": false
+  "rev": "aee6aefa230479a9c35f5d9031786c83c2db19a2",
+  "date": "2021-09-14T21:10:26+08:00",
+  "path": "/nix/store/jmxwzpfb24z159rnpa29drgb8z2znjl9-nixpkgs",
+  "sha256": "0vy89mw8nd4jrv3byisynl7a3gsx0fsfpgqpaqz2z7vy60l1mkiq",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/nixpkgs.json

@@ -1,7 +1,10 @@
 {
   "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "95d26c9a9f2a102e25cf318a648de44537f42e09",
-  "date": "2020-10-24T10:37:53+02:00",
-  "sha256": "0ymhj252dq7z2ajdjsdz99h106ylm4vsmz5v3xiwsylcs4bz2nl8",
-  "fetchSubmodules": false
+  "rev": "b3083bc6933eb7fa4ee7bd4802e9f72b56f3e654",
+  "date": "2021-09-13T17:06:43+02:00",
+  "path": "/nix/store/18nwp35nj16hr2li3xbs6vczvw32rp5p-nixpkgs",
+  "sha256": "1cj8jmzgf2rpf8n8yjsh6qsh66rqpyxh8jhn65ll15578fh98gb9",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/nur.json

@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/nix-community/NUR",
+  "rev": "967dc2db6c7666d5d99113c10b3ff288bf515560",
+  "date": "2021-09-14T12:44:44+00:00",
+  "path": "/nix/store/pyxjrg05v2z9zfsqmhg1im7z1sxcya22-NUR",
+  "sha256": "1lqfny81k2kmsamrf745dm4iw1zk0kdr33hcyf37kvcn99vm870z",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

.versions/retiolum.json

@@ -1,7 +1,10 @@
 {
   "url": "https://github.com/krebs/retiolum",
-  "rev": "21244d55c10234b09a9f121015de1175f5facc69",
-  "date": "2020-10-25T17:02:11+01:00",
-  "sha256": "0jzifani14rd68zv728mjq97p04njk8syrqbmn2vjd3plphvl5y5",
-  "fetchSubmodules": false
+  "rev": "5384cff550036aa3581f8c6f851392329f28ffe8",
+  "date": "2021-09-19T09:32:14+02:00",
+  "path": "/nix/store/izzhb6p76h96zmlz5xdxa1xrpixhbk4s-retiolum",
+  "sha256": "07318jnkb8zycyi43fydrmrsrbq9ajhb2nnaahj1bxg77pb4wj7a",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/stockholm.json

@@ -1,7 +1,10 @@
 {
   "url": "https://cgit.krebsco.de/stockholm",
-  "rev": "b034f63f7a2e4361b32c33c0e1a980eecf1a5aa6",
-  "date": "2020-10-17T01:00:54+02:00",
-  "sha256": "1ji45h7xp3za5lq9qdg3f8gldrvqfpr8grinblzvf9iqxjgidr68",
-  "fetchSubmodules": false
+  "rev": "20e358043546482acfa8c6134f095c1a64ef144d",
+  "date": "2021-08-31T20:06:03+02:00",
+  "path": "/nix/store/a03pd46kdsfy9d2q9xlzapnzkj4vf20r-stockholm",
+  "sha256": "0cwl36zc68qjwcahjgc3vn9qpnyi351m6ngnq21wlncn0k2gqw4a",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

configs/alacritty.nix

@@ -1,45 +1,45 @@
 { pkgs, lib, config, ... }:
-let
-  colourNames =
-    [ "black" "red" "green" "yellow" "blue" "magenta" "cyan" "white" ];
-  colours = lib.getAttrs colourNames config.niveum.colours;
-  alacrittyConfig = {
-    background_opacity = 0.9;
-    colors = {
-      primary = { inherit (config.niveum.colours) background foreground; };
-      normal = lib.mapAttrs (_: colour: colour.dark) colours;
-      bright = lib.mapAttrs (_: colour: colour.bright) colours;
-    };
-    font = {
-      normal.family = "Monospace";
-      size = config.niveum.fonts.size - 2;
-    };
-    key_bindings = [
-      {
-        key = "Add";
-        mods = "Control";
-        action = "IncreaseFontSize";
-      }
-      {
-        key = "Minus";
-        mods = "Control";
-        action = "DecreaseFontSize";
-      }
-      {
-        key = "Key0";
-        mods = "Control";
-        action = "ResetFontSize";
-      }
-    ];
-  };
-in {
+{
   environment.variables.TERMINAL = "alacritty";
 
   environment.systemPackages = [
-    pkgs.unstable.alacritty
+    pkgs.alacritty
   ];
 
-  home-manager.users.me.xdg.configFile = {
-    "alacritty/alacritty.yml".text = builtins.toJSON alacrittyConfig;
+  home-manager.users.me.xdg.configFile =
+  let
+    inherit (import <niveum/lib>) colours;
+    colourNames = [ "black" "red" "green" "yellow" "blue" "magenta" "cyan" "white" ];
+    colourPairs = lib.getAttrs colourNames colours;
+  in {
+    "alacritty/alacritty.yml".source = (pkgs.formats.yaml {}).generate "alacritty.yml" {
+      background_opacity = 0.9;
+      colors = {
+        primary = { inherit (colours) background foreground; };
+        normal = lib.mapAttrs (_: colour: colour.dark) colourPairs;
+        bright = lib.mapAttrs (_: colour: colour.bright) colourPairs;
+      };
+      font = {
+        normal.family = "Monospace";
+        size = 6;
+      };
+      key_bindings = [
+        {
+          key = "Plus";
+          mods = "Control";
+          action = "IncreaseFontSize";
+        }
+        {
+          key = "Minus";
+          mods = "Control";
+          action = "DecreaseFontSize";
+        }
+        {
+          key = "Key0";
+          mods = "Control";
+          action = "ResetFontSize";
+        }
+      ];
+    };
   };
 }

configs/battery.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  boot.extraModulePackages = with config.boot.kernelPackages; [
+    tp_smapi
+    acpi_call
+  ];
+  boot.kernelModules = [ "tp_smapi" "acpi_call" ];
+  environment.systemPackages = [ pkgs.tpacpi-bat ];
+
+  services.tlp = {
+    enable = true;
+    settings = {
+      START_CHARGE_THRESH_BAT0 = 80;
+      STOP_CHARGE_THRESH_BAT0 = 95;
+    };
+  };
+}

configs/beets.nix

@@ -0,0 +1,11 @@
+{ lib, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.beets ];
+  home-manager.users.me.xdg.configFile = {
+    "beets/config.yaml".source = (pkgs.formats.yaml {}).generate "config.yaml" {
+      directory = "~/cloud/syncthing/music";
+      library = "~/cloud/syncthing/common/music.db";
+      plugins = lib.concatStringsSep " " [ "fetchart" "lastgenre" "lyrics" ];
+    };
+  };
+}

configs/bluetooth.nix

@@ -1,7 +1,7 @@
 { pkgs, lib, ... }: {
   hardware.bluetooth = {
     enable = true;
-    config.General.Enable =
+    settings.General.Enable =
       lib.concatStringsSep "," [ "Source" "Sink" "Media" "Socket" ];
   };
 

configs/calcurse.nix

@@ -1,44 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  environment.systemPackages = [ pkgs.calcurse ];
-
-  systemd.services.caldav-sync = {
-    enable = true;
-    wants = [ "network-online.target" ];
-    startAt = "*:0/15";
-    serviceConfig.User = "kfm";
-    script = "${pkgs.calcurse}/bin/calcurse-caldav";
-  };
-
-  home-manager.users.me = {
-    home.file = {
-      ".calcurse/conf".text = ''
-        appearance.calendarview=monthly
-        appearance.layout=1
-        daemon.enable=no
-        daemon.log=no
-        format.inputdate=4
-        format.outputdate=%F
-        general.confirmquit=no
-        general.confirmdelete=yes
-        general.firstdayofweek=monday
-        appearance.theme=default on default
-      '';
-      ".calcurse/caldav/config".text = lib.generators.toINI {} {
-        General = {
-          Binary = "${pkgs.calcurse}/bin/calcurse";
-          Hostname = "posteo.de:8443";
-          Path = "/calendars/kieran.meinhardt/default/";
-          InsecureSSL = "No";
-          DryRun = "No";
-          Verbose = "Yes";
-        };
-        Auth = {
-          Username = "kieran.meinhardt@posteo.net";
-          Password = lib.strings.fileContents <secrets/mail/posteo>;
-        };
-      };
-    };
-  };
-
-}

configs/chromium.nix

@@ -2,10 +2,11 @@
   programs.chromium = {
     enable = true;
     extensions = [
-      "hdokiejnpimakedhajhdlcegeplioahd" # LastPass
+      "nngceckbapebfimnlniiiahkandclblb" # BitWarden
       # "ihlenndgcmojhcghmfjfneahoeklbjjh" # cVim
       # "fpnmgdkabkmnadcjpehmlllkndpkmiak" # Wayback Machine
       "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
+      "khncfooichmfjbepaaaebmommgaepoid" # Remove YouTube Recommended Videos
     ];
   };
 

configs/cloud.nix

@@ -1,12 +1,10 @@
 { config, lib, pkgs, ... }: {
   imports = [
-    <niveum/modules/seafile.nix>
     <niveum/modules/dropbox.nix>
   ];
 
   niveum = {
-    dropbox.enable = true;
-    seafile.enable = true;
+    dropbox.enable = false;
   };
 
   system.activationScripts.home-symlinks = ''
@@ -19,6 +17,16 @@
     services.nextcloud-client.enable = true;
   };
 
+  fileSystems."/media/moodle" = {
+    device = "zaatar.r:/moodle";
+    fsType = "nfs";
+    options = [
+      "x-systemd.idle-timeout=600"
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+
   services.syncthing = rec {
     enable = true;
     user = "kfm";
@@ -28,26 +36,17 @@
     declarative = rec {
       cert = toString <system-secrets/syncthing/cert.pem>;
       key = toString <system-secrets/syncthing/key.pem>;
-      devices = {
-        homeros.id =
-          "HSOL72W-MMN346W-C3WCWCH-OTRKJYG-MY2WWV6-P7JUHN7-5WYYYRV-ZMH4KAA";
-        scardanelli.id =
-          "7CZYHEX-3CSFDQU-PEEMYHG-6XGQ2ZD-KGVUWH5-GFRB2XK-FP57ERX-7APZUQU";
-        rilke.id =
-          "NYNNHXP-7JMSTXG-SVNOPWD-RWXCCCL-CBOVBEI-X4QPLF4-NJA5G2P-RSGYRQQ";
-        wilde.id =
-          "R6DEBD7-G5RYDKN-VFA3HPO-WX4DNVI-373F7OQ-AW5MZTT-3L4BDVW-Y6ROEAF";
-        heym.id =
-          "HLQSG3D-WSKLA6S-MEYQ3EU-GDBGABE-PY53RQ6-SWQAP2I-Z5MVBVX-MYPJXAM";
-      };
+      inherit ((import <niveum/lib>).syncthing) devices;
       folders =
-        let syncthing-dir = "${config.users.users.me.home}/cloud/syncthing";
+        let cloud-dir = "${config.users.users.me.home}/cloud";
         in {
-          "${syncthing-dir}/common".devices =
-            [ "homeros" "scardanelli" "wilde" ];
-          "${syncthing-dir}/library".devices = lib.attrNames devices;
-          "${syncthing-dir}/mundoiu".devices = lib.attrNames devices;
-          "${syncthing-dir}/music".devices = lib.attrNames devices;
+          "${cloud-dir}/syncthing/common".devices = [ "kabsa" "manakish" ];
+          "${cloud-dir}/syncthing/library".devices = [ "kabsa" "manakish" "heym" ];
+          "${cloud-dir}/syncthing/mundoiu".devices = [ "kabsa" "manakish" "heym" ];
+          "${cloud-dir}/syncthing/music" = {
+            devices = [ "kabsa" "manakish" "heym" "zaatar" ];
+            id = "music";
+          };
         };
     };
   };

configs/default.nix

@@ -1,40 +1,14 @@
 { pkgs, lib, config, options, ... }:
 let
   inherit (lib.strings) makeBinPath;
-  inherit (import <niveum/lib>) localAddresses;
+  inherit (import <niveum/lib>) localAddresses kieran;
 in {
   imports = [
-    <niveum/modules/constants.nix>
     <home-manager/nixos>
+    <niveum/modules/system-dependent.nix>
     {
       boot.supportedFilesystems = [ "ntfs" ];
     }
-    {
-      niveum.user = {
-        github = "kmein";
-        email = "kmein@posteo.de";
-        name = "Kierán Meinhardt";
-      };
-
-      niveum.applications = rec {
-        fileManager = "$TERMINAL -e ${pkgs.ranger}/bin/ranger";
-      };
-
-      niveum.theme = {
-        gtk = {
-          name = "Adwaita-dark";
-          package = pkgs.gnome3.gnome-themes-extra;
-        };
-        icon = {
-          name = "Adwaita";
-          package = pkgs.gnome3.adwaita-icon-theme;
-        };
-        cursor = {
-          name = "capitaine-cursors-white";
-          package = pkgs.capitaine-cursors;
-        };
-      };
-    }
     {
       nix.nixPath = [
         "/var/src"
@@ -42,32 +16,15 @@ in {
       ];
     }
     { services.dbus.packages = [ pkgs.gnome3.dconf ]; }
-    {
-      environment.systemPackages = [
-        (pkgs.writers.writeDashBin "x-www-browser" ''
-          for browser in $BROWSER firefox chromium google-chrome google-chrome-stable opera vivaldi qupzilla iceweasel konqueror firefox-aurora google-chrome-beta opera-beta vivaldi-beta google-chrome-dev opera-developer vivaldi-snapshot luakit midori epiphany lynx w3m dillo elinks vimb; do
-            if command -v $browser > /dev/null 2>&1; then
-              exec $browser "$@"
-            fi
-          done
-          exit 1
-        '')
-      ];
-    }
     {
       nixpkgs = {
         config = {
           allowUnfree = true;
           packageOverrides = pkgs: {
-            nur = import (builtins.fetchTarball
-              "https://github.com/nix-community/NUR/archive/aea85375c7a82297d977904de8dd7f41baf2d59a.tar.gz") {
-                inherit pkgs;
-              };
+            nur = import <nur> { inherit pkgs; };
             writeDashBin = pkgs.writers.writeDashBin;
             writeDash = pkgs.writers.writeDash;
-            gfs-fonts = pkgs.callPackage <niveum/packages/gfs-fonts.nix> {
-              scardanelli = config.networking.hostName == "scardanelli";
-            };
+            gfs-fonts = pkgs.callPackage <niveum/packages/gfs-fonts.nix> {};
             iolanguage = pkgs.callPackage <niveum/packages/iolanguage.nix> { };
             ix = pkgs.callPackage <niveum/packages/ix.nix> { };
           };
@@ -76,7 +33,6 @@ in {
           (self: super: {
             scripts = import <niveum/packages/scripts> { pkgs = super; lib = super.lib; };
           })
-          (import <niveum/overlays/toml.nix>)
           (import <stockholm/krebs/5pkgs/haskell>)
           (import <stockholm/submodules/nix-writers/pkgs>)
           (import <stockholm/krebs/5pkgs/override>)
@@ -86,14 +42,6 @@ in {
     {
       boot.cleanTmpDir = true;
       boot.loader.timeout = 1;
-      boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ];
-    }
-    {
-      time.timeZone = "Europe/Berlin";
-      location = {
-        latitude = 52.517;
-        longitude = 13.3872;
-      };
     }
     {
       home-manager.users.me = {
@@ -113,23 +61,38 @@ in {
 
       users.users.me = {
         name = "kfm";
-        description = config.niveum.user.name;
+        description = kieran.name;
         hashedPassword =
           "$6$w9hXyGFl/.IZBXk$5OiWzS1G.5hImhh1YQmZiCXYNAJhi3X6Y3uSLupJNYYXPLMsQpx2fwF4Xr2uYzGMV8Foqh8TgUavx1APD9rcb/";
         isNormalUser = true;
+        uid = 1000;
       };
+
+      home-manager.users.me.xdg.enable = true;
     }
     {
       sound.enable = true;
 
       hardware.pulseaudio = {
         enable = true;
-        package = pkgs.pulseaudioFull; # for bluetooth sound output
+        package = pkgs.pulseaudioFull;
+        extraModules = [ pkgs.pulseaudio-modules-bt ];
+        # copy server:/run/pulse/.config/pulse/cookie to client:~/.config/pulse/cookie to authenticate a client machine
+        zeroconf.discovery.enable = true;
+        extraConfig = ''
+          load-module ${toString [
+            "module-tunnel-sink-new"
+            "server=zaatar.r"
+            "sink_name=zaatar"
+            "channels=2"
+            "rate=44100"
+          ]}
+        '';
       };
 
       users.users.me.extraGroups = [ "audio" ];
 
-      environment.systemPackages = [ pkgs.pavucontrol pkgs.pamixer ];
+      environment.systemPackages = [ pkgs.pavucontrol pkgs.ncpamixer pkgs.pamixer pkgs.pulsemixer ];
     }
     {
       environment.interactiveShellInit =
@@ -150,29 +113,27 @@ in {
         cat = "${pkgs.bat}/bin/bat --style=plain";
         chromium-incognito =
           "chromium --user-data-dir=$(mktemp -d /tmp/chr.XXXXXX) --no-first-run --incognito";
-        cp = "cp -i";
-        dig = "dig +short";
+        cp = "cp --interactive";
         ip = "${pkgs.iproute}/bin/ip -c";
-        l = "${pkgs.exa}/bin/exa -s type -a";
-        la = "${pkgs.exa}/bin/exa -s type -la";
-        ll = "${pkgs.exa}/bin/exa -s type -l";
-        ls = "${pkgs.exa}/bin/exa -s type";
-        mv = "mv -i";
+        l  = "ls --color=auto --time-style=long-iso --almost-all";
+        ls = "ls --color=auto --time-style=long-iso";
+        ll = "ls --color=auto --time-style=long-iso -l";
+        la = "ls --color=auto --time-style=long-iso --almost-all -l";
+        mv = "mv --interactive";
         nixi = "nix repl '<nixpkgs>'";
         ns = "nix-shell --run zsh";
         o = "${pkgs.xdg_utils}/bin/xdg-open";
         pbcopy = "${pkgs.xclip}/bin/xclip -selection clipboard -in";
         pbpaste = "${pkgs.xclip}/bin/xclip -selection clipboard -out";
-        rm = "rm -i";
+        rm = "rm --interactive";
         s = "${pkgs.systemd}/bin/systemctl";
         take = "source ${take}";
         tmux = "${pkgs.tmux}/bin/tmux -2";
-        tree = "${pkgs.exa}/bin/exa --tree";
         sxiv = swallow "${pkgs.sxiv}/bin/sxiv";
         zathura = swallow "${pkgs.zathura}/bin/zathura";
         us = "${pkgs.systemd}/bin/systemctl --user";
         wcd = "source ${wcd}";
-        weechat = "${pkgs.openssh}/bin/ssh kmein@prism.r -t tmux attach";
+        im = "${pkgs.openssh}/bin/ssh weechat@makanek -t tmux attach-session -t IM";
         where = "source ${where}";
         yt =
           "${pkgs.youtube-dl}/bin/youtube-dl --add-metadata -ic"; # Download video link
@@ -180,50 +141,6 @@ in {
           "${pkgs.youtube-dl}/bin/youtube-dl --add-metadata -xic"; # Download with audio
       };
     }
-    {
-      networking.wireless = {
-        enable = true;
-        userControlled.enable = true;
-        networks = {
-          "Aether" = {
-            pskRaw = "e1b18af54036c5c9a747fe681c6a694636d60a5f8450f7dec0d76bc93e2ec85a";
-            priority = 10;
-          };
-          "Asoziales Netzwerk" = {
-            pskRaw = "8e234041ec5f0cd1b6a14e9adeee9840ed51b2f18856a52137485523e46b0cb6";
-            priority = 10;
-          };
-          "Libertarian WiFi" = {
-            pskRaw = "e9beaae6ffa55d10e80b8a2e7d997411d676a3cc6f1f29d0b080391f04555050";
-            priority = 9;
-          };
-          "EasyBox-927376".pskRaw = "dbd490ab69b39bd67cfa06daf70fc3ef3ee90f482972a668ed758f90f5577c22";
-          "FlixBus Wi-Fi" = { };
-          "FlixBus" = { };
-          "FlixTrain" = { };
-          "BVG Wi-Fi" = { };
-          "wannseeforum" = { }; # login via curl -XPOST http://WannseeLancom.intern.:80/authen/login/ -d userid=$USER_ID -d password=$PASSWORD
-          "Hotel_Krone" = { }; # login: http://192.168.10.1/
-          "Ni/Schukajlow".pskRaw = "ffc47f6829da59c48aea878a32252223303f5c47a3859edc90971ffc63346781";
-          "WIFIonICE" = { }; # login: http://10.101.64.10/
-          "WLAN-914742".psk = "67647139648174545446";
-          "KDG-CEAA4".psk = "PBkBSmejcvM4";
-          "KDG-4ECF7".psk = "Gdbwh7afw2Bx";
-          "WLAN-XVMU6T".pskRaw =
-            "46ea807283255a3d7029233bd79c18837df582666c007c86a8d591f65fae17cc";
-          "c-base-public" = { };
-          "discord".psk = "baraustrinken";
-          "GoOnline".psk = "airbnbguest";
-          "security-by-obscurity".psk = "44629828256481964386";
-          "Mayflower".psk = "Fr31EsLan";
-          "Born11".psk = "56LMVLbw840EGNWk0RYRqvgicx3FSO";
-          "FactoryCommunityGuest".psk = "Factory4ever";
-          "krebs".psk = "aidsballs";
-        };
-      };
-
-      environment.systemPackages = [ pkgs.wpa_supplicant_gui ];
-    }
     { i18n.defaultLocale = "en_GB.UTF-8"; }
     { services.illum.enable = true; }
     {
@@ -254,13 +171,16 @@ in {
     {
       programs.gnupg.agent.enable = true;
 
-      environment.systemPackages = [ pkgs.gnupg pkgs.pass ];
+      environment.systemPackages = [
+        pkgs.gnupg
+        (pkgs.pass.withExtensions (e: [e.pass-otp]))
+      ];
     }
     {
       services.atd.enable = true;
     }
     {
-      services.mingetty = {
+      services.getty = {
         greetingLine = lib.mkForce "";
         helpLine = lib.mkForce "";
       };
@@ -273,10 +193,12 @@ in {
     }
     ./alacritty.nix
     ./bash.nix
+    ./beets.nix
     ./bluetooth.nix
     ./ccc.nix
-    ./kleiter.nix
-    ./calcurse.nix
+    # ./kleiter.nix
+    ./khal.nix
+    ./engiadina.nix
     ./chromium.nix
     ./cloud.nix
     ./compton.nix
@@ -295,35 +217,36 @@ in {
     ./i3.nix
     ./keybase.nix
     ./keyboard.nix
-    ./mail.nix
+    ./mail/client.nix
     ./mpv.nix
     ./mime.nix
     ./nano.nix
     ./neovim.nix
+    ./nix.nix
     ./newsboat.nix
     ./flameshot-once.nix
-    ./nixpkgs-unstable.nix
     ./packages
+    ./power-action.nix
     ./printing.nix
+    ./openweathermap.nix
     ./wallpaper.nix
     ./redshift.nix
     ./retiolum.nix
     ./rofi.nix
-    ./spotify.nix
+    ./spacetime.nix
+    ./seafile.nix
     ./ssh.nix
+    ./sshd.nix
     ./sudo.nix
     ./sxiv.nix
-    ./themes/mac-os.nix
     ./theming.nix
     ./tmux.nix
-    ./tor.nix
-    ./todo-txt.nix
+    # ./tor.nix
     ./traadfri.nix
     ./unclutter.nix
     ./version.nix
     ./vscode.nix
     ./watson.nix
-    ./xautolock.nix
     ./zsh.nix
   ];
 }

configs/docker.nix

@@ -1,5 +1,12 @@
-{ pkgs, ... }: {
-  virtualisation.docker.enable = true;
+{ lib, pkgs, ... }: {
+  virtualisation.docker = {
+    enable = true;
+    # for ICE wifi, ref https://gist.github.com/sunsided/7840e89ff4e11b64a2d7503fafa0290c
+    extraOptions = lib.concatStringsSep " " [
+      "--bip=172.39.1.5/24"
+      "--fixed-cidr=172.39.1.0/25"
+    ];
+  };
   users.users.me.extraGroups = [ "docker" ];
   environment.systemPackages = [ pkgs.docker pkgs.docker_compose ];
 }

configs/dunst.nix

@@ -1,12 +1,14 @@
 { config, pkgs, ... }:
-with config.niveum; {
+let
+  inherit (import <niveum/lib>) defaultApplications colours theme;
+in {
   home-manager.users.me.services.dunst = {
     enable = true;
-    iconTheme = theme.icon;
+    iconTheme = (theme pkgs).icon;
     settings = {
       global = {
         transparency = 10;
-        font = "Sans ${toString fonts.size}";
+        font = "Monospace 8";
         geometry = "200x5-30+20";
         frame_color = colours.foreground;
         follow = "mouse";
@@ -31,7 +33,7 @@ with config.niveum; {
         sticky_history = true;
         history_length = 20;
         dmenu = "${pkgs.rofi}/bin/rofi -display-run dunst -show run";
-        browser = "x-www-browser";
+        browser = (defaultApplications pkgs).browser;
         verbosity = "mesg";
         corner_radius = 0;
         mouse_left_click = "do_action";

configs/engiadina.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+let
+  inherit (import <niveum/lib>) tmpfilesConfig;
+  cdnRoot = "/var/lib/engiadina";
+in
+{
+  imports = [ <stockholm/krebs/3modules/permown.nix> ];
+
+  krebs.permown.${cdnRoot} = {
+    owner = config.users.users.me.name;
+    group = "users";
+    umask = "0002";
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts.default = {
+      root = cdnRoot;
+      listen = [{
+        addr = "0.0.0.0";
+        port = 3333;
+      }];
+    };
+  };
+
+  environment.shellAliases = {
+    engiadina-watch = "${pkgs.findutils}/bin/find extra-src src | ${pkgs.entr}/bin/entr -s 'build-component && ${pkgs.rsync}/bin/rsync -avu dist/*.js ${cdnRoot}/'";
+    engiadina-edit = "$EDITOR ${cdnRoot}/index.html";
+  };
+}

configs/flameshot-once.nix

@@ -1,24 +1,26 @@
-{ lib, pkgs, ... }:
-let
-  flameshot-once =
-    pkgs.callPackage <stockholm/krebs/5pkgs/simple/flameshot-once> {};
-in {
-  nixpkgs.overlays = [
-    (self: super: {
-      xwaitforwindow =
-        super.callPackage <stockholm/krebs/5pkgs/simple/xwaitforwindow.nix> { };
-    })
-  ];
+{ config, lib, pkgs, ... }:
+{
+  home-manager.users.me = {
+    services.flameshot.enable = true;
 
-  environment.systemPackages = [
-    (flameshot-once.override {
-      config.imgur = {
-        enable = true;
-        createUrl = "http://p.r/image";
-        deleteUrl = "http://p.r/image/delete/%1";
-        xdg-open.browser = "x-www-browser";
+    xdg.configFile."flameshot/flameshot.ini".source = (pkgs.formats.ini {}).generate "flameshot.ini" {
+      General = {
+        disabledTrayIcon = true;
+        checkForUpdates = false;
+        contrastOpacity = 188;
+        savePath = "/tmp";
+        savePathFixed = true;
+        drawThickness = 0;
+        showStartupLaunchMessage = false;
+        filenamePattern = "shot_%F_%T";
       };
-      config.timeout = 200;
-    })
-  ];
+    };
+
+    systemd.user.services.flameshot.Unit.Requires = lib.mkForce [];
+    systemd.user.services.flameshot.Environment = {
+      # IMGUR_CREATE_URL = "https://p.krebsco.de/image";
+      # IMGUR_DELETE_URL = "https://p.krebsco.de/image/delete/%1";
+      PATH = "${config.home-manager.users.me.home.profileDirectory}/bin";
+    };
+  };
 }

configs/flix.nix

@@ -5,6 +5,7 @@ let
   indexFilename = "index";
   flixUser = "flix";
   flixGroup = "users";
+  inherit (import <niveum/lib>) tmpfilesConfig;
 in {
   fileSystems.${flixLocation} = {
     device = "prism.r:/export";
@@ -24,7 +25,13 @@ in {
   };
 
   systemd.tmpfiles.rules = [
-    "d '${cacheLocation}' 0750 ${flixUser} ${flixGroup} - -"
+    (tmpfilesConfig {
+      type = "d";
+      path = cacheLocation;
+      mode = "0750";
+      user = flixUser;
+      group = flixGroup;
+    })
   ];
 
   systemd.services.flix-index = {
@@ -48,6 +55,16 @@ in {
   };
 
   environment.systemPackages = [
+    (pkgs.writeDashBin "mpv-simpsons" ''
+      set -efu
+      cd "${flixLocation}/download"
+      [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
+
+      cat "${cacheLocation}/${indexFilename}" \
+        | ${pkgs.gnugrep}/bin/grep -i 'simpsons.*mkv' \
+        | shuf \
+        | ${pkgs.findutils}/bin/xargs -d '\n' ${pkgs.mpv}/bin/mpv
+    '')
     (pkgs.writeDashBin "flixmenu" ''
       set -efu
       cd "${flixLocation}/download"

configs/fonts.nix

@@ -1,9 +1,9 @@
 { pkgs, ... }: {
-  niveum.fonts.size = 9;
+  nixpkgs.config.joypixels.acceptLicense = true;
 
   fonts = {
     enableDefaultFonts = true;
-    enableFontDir = true;
+    fontDir.enable = true;
     fonts = with pkgs; [
       corefonts
       eb-garamond
@@ -15,6 +15,8 @@
       libertine
       lmodern
       noto-fonts
+      noto-fonts-cjk
+      noto-fonts-emoji
       roboto
       roboto-mono
       roboto-slab
@@ -28,9 +30,9 @@
       joypixels
     ];
     fontconfig.defaultFonts = {
-      monospace = [ "JetBrains Mono" ];
-      serif = [ "Source Serif Pro" ];
-      sansSerif = [ "Source Sans Pro" ];
+      monospace = [ "JetBrains Mono" "JoyPixels" ];
+      serif = [ "Roboto Slab" ];
+      sansSerif = [ "Roboto" "Noto Sans" ];
       emoji = [ "JoyPixels" ];
     };
   };

configs/git.nix

@@ -1,4 +1,8 @@
-{ pkgs, config, lib, ... }: {
+{ pkgs, config, lib, ... }:
+let
+  inherit (import <niveum/lib>) kieran ignorePaths;
+in
+{
   environment.systemPackages = [
     pkgs.mr
     pkgs.git
@@ -6,7 +10,7 @@
     pkgs.gitAndTools.hub
     pkgs.gitAndTools.gh
     pkgs.gitAndTools.git-extras
-    pkgs.unstable.gitAndTools.git-trim
+    pkgs.gitAndTools.git-trim
     pkgs.gitstats
     pkgs.patch
     pkgs.patchutils
@@ -53,8 +57,8 @@
     programs.git = {
       enable = true;
       package = pkgs.gitAndTools.gitFull;
-      userName = config.niveum.user.name;
-      userEmail = config.niveum.user.email;
+      userName = kieran.name;
+      userEmail = kieran.email;
       aliases = {
         br = "branch";
         co = "checkout";
@@ -69,8 +73,11 @@
         graph =
           "log --graph --abbrev-commit --decorate --date=relative --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
       };
-      ignores = config.niveum.ignore;
+      ignores = ignorePaths;
       extraConfig = {
+        pull.ff = "only";
+        rebase.autoStash = true;
+        merge.autoStash = true;
         core.pager =
           "${pkgs.gitAndTools.diff-so-fancy}/bin/diff-so-fancy | ${pkgs.less}/bin/less --tabs=4 -RFX";
         color = {

configs/gitea.nix

@@ -0,0 +1,13 @@
+{
+  services.gitea = {
+    enable = true;
+    disableRegistration = true;
+    rootUrl = "https://code.xn--kiern-0qa.de";
+    appName = "code.kierán.de";
+  };
+  services.nginx.virtualHosts."code.xn--kiern-0qa.de" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".extraConfig = "proxy_pass http://localhost:3000;";
+  };
+}

configs/hass/default.nix

@@ -4,14 +4,9 @@ let
   inherit (import <niveum/lib>) localAddresses;
 in
 {
-  disabledModules = [
-    "services/misc/home-assistant.nix"
-  ];
-
   imports = [
     ./zigbee.nix
     ./frontend.nix
-    <nixpkgs-unstable/nixos/modules/services/misc/home-assistant.nix>
   ];
 
   services.home-assistant = {
@@ -22,8 +17,8 @@ in
     config = {
       homeassistant = {
         name = "Toum";
-        latitude = 52.461;
-        longitude = 13.378;
+        latitude = config.location.latitude;
+        longitude = config.location.longitude;
         elevation = 90; # TODO find out how high I live
         unit_system = "metric";
         time_zone = config.time.timeZone;

configs/hass/frontend.nix

@@ -2,15 +2,6 @@ let
   inherit (import ./lib.nix) triggers;
 in
 {
-  disabledModules = [
-    "services/misc/home-assistant.nix"
-  ];
-
-  imports = [
-    <nixpkgs-unstable/nixos/modules/services/misc/home-assistant.nix>
-  ];
-
-
   services.home-assistant.config = {
     frontend = {
       themes = {

configs/hass/zigbee.nix

@@ -1,63 +1,25 @@
 { config, pkgs, lib, ... }:
 let
-  inherit (import <stockholm/lib>) genid;
   inherit (import <niveum/lib>) localAddresses;
-  zigbee2mqttDevice = "/dev/ttyACM0";
-
-  zigbee2mqttConfig = {
-    permit_join = false;
-    homeassistant = true;
-    serial = {
-      port = zigbee2mqttDevice;
-      disable_led = true;
-    };
-    mqtt = {
-      discovery = true;
-      base_topic = "zigbee";
-      server = "mqtt://${localAddresses.toum}"; # Rasperry local IP
-      user = "albrecht";
-      password = lib.strings.fileContents <system-secrets/mosquitto>;
-    };
-  };
-  zigbee2mqtt_cfg = pkgs.writeText "zigbee2mqtt.json" (builtins.toJSON zigbee2mqttConfig);
 in
 {
-  disabledModules = [
-    "services/misc/home-assistant.nix"
-  ];
-
-  imports = [
-    <nixpkgs-unstable/nixos/modules/services/misc/home-assistant.nix>
-    <nixpkgs-unstable/nixos/modules/services/misc/zigbee2mqtt.nix>
-  ];
-
-  /*
-  ids = {
-    uids.zigbee2mqtt = genid "zigbee2mqtt";
-    gids.zigbee2mqtt = genid "zigbee2mqtt";
-  };
   services.zigbee2mqtt = {
     enable = true;
-    config = zigbee2mqttConfig;
-    package = pkgs.unstable.zigbee2mqtt;
-  };
-  */
-
-
-  system.activationScripts.installZigbee = ''
-    install -d /var/lib/zigbee2mqtt
-    install ${zigbee2mqtt_cfg} /var/lib/zigbee2mqtt/configuration.yaml
-  '';
-
-  # hack to restart docker container on config change
-  systemd.services.docker-zigbee2mqtt.environment.cfg = zigbee2mqtt_cfg;
-
-  docker-containers.zigbee2mqtt = {
-    image = "koenkk/zigbee2mqtt";
-    extraDockerOptions = [
-      "--device=${zigbee2mqttDevice}:${zigbee2mqttDevice}"
-    ];
-    volumes = ["/var/lib/zigbee2mqtt:/app/data"];
+    config = {
+      permit_join = false;
+      homeassistant = true;
+      serial = {
+        port = "/dev/ttyACM0";
+        disable_led = true;
+      };
+      mqtt = {
+        discovery = true;
+        base_topic = "zigbee";
+        server = "mqtt://${localAddresses.toum}";
+        user = "albrecht";
+        password = lib.strings.fileContents <system-secrets/mosquitto>;
+      };
+    };
   };
 
   services.mosquitto = {

configs/hedgedoc.nix

@@ -0,0 +1,65 @@
+{ pkgs, ... }:
+let
+  backupLocation = "/var/lib/codimd-backup";
+  stateLocation = "/var/lib/codimd/state.sqlite";
+  nixpkgs-unstable = import <nixpkgs-unstable> {};
+in
+{
+  imports = [ <stockholm/krebs/3modules/permown.nix> ];
+
+  services.nginx.virtualHosts."pad.xn--kiern-0qa.de" = {
+    enableACME = true;
+    addSSL = true;
+    locations."/".extraConfig = ''
+      client_max_body_size 4G;
+      proxy_set_header Host $host;
+      proxy_pass http://localhost:3091;
+    '';
+  };
+
+  services.hedgedoc = {
+    enable = true;
+    configuration = {
+      allowAnonymous = true;
+      allowGravatar = false;
+      allowFreeURL = true;
+      db = {
+        dialect = "sqlite";
+        storage = stateLocation;
+      };
+      port = 3091;
+    };
+  };
+
+  krebs.permown.${backupLocation} = { owner = "codimd"; group = "codimd"; umask = "0002"; };
+
+  systemd.services.hedgedoc-backup = {
+    description = "Hedgedoc backup service";
+    script = ''
+      ${nixpkgs-unstable.sqlite}/bin/sqlite3 -json ${stateLocation} "select shortid, alias, ownerId, content from Notes" \
+      | ${pkgs.writers.writePython3 "hedgedoc-json-to-fs.py" {} ''
+        import json
+        import pathlib
+        import sys
+
+        for note in json.load(sys.stdin):
+            user_directory = pathlib.Path()
+            if note["ownerId"]:
+                user_directory = pathlib.Path(note["ownerId"])
+                user_directory.mkdir(exist_ok=True)
+            file_path = user_directory / (
+                (note["alias"] if note["alias"] else note["shortid"]) + ".md"
+            )
+            file_path.write_text(note["content"])
+            print(f"✔ {file_path}", file=sys.stderr)
+      ''}
+    '';
+    startAt = "hourly";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "codimd";
+      Group = "codimd";
+      WorkingDirectory = backupLocation;
+    };
+  };
+}

configs/htop.nix

@@ -2,45 +2,28 @@
   home-manager.users.me = {
     programs.htop = {
       enable = true;
-      colorScheme = 0;
-      accountGuestInCpuMeter = true;
-      cpuCountFromZero = false;
-      delay = 15;
-      detailedCpuTime = false;
-      headerMargin = true;
-      hideKernelThreads = true;
-      hideThreads = false;
-      hideUserlandThreads = false;
-      highlightBaseName = true;
-      highlightMegabytes = true;
-      highlightThreads = true;
-      shadowOtherUsers = true;
-      showProgramPath = false;
-      showThreadNames = true;
-      sortDescending = true;
-      sortKey = "PERCENT_CPU";
-      treeView = true;
-      updateProcessNames = false;
-      meters = {
-        left = [
-          {
-            kind = "LeftCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "RightCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "Memory";
-            mode = 1;
-          }
-          {
-            kind = "Swap";
-            mode = 1;
-          }
-        ];
-        right = [ "Uptime" "Tasks" "LoadAverage" "Battery" ];
+      settings = {
+        color_scheme = 0;
+        account_guest_in_cpu_meter = true;
+        cpu_count_from_zero = false;
+        delay = 15;
+        detailed_cpu_time = false;
+        header_margin = true;
+        hide_kernel_threads = true;
+        hide_threads = true;
+        hide_userland_threads = true;
+        highlight_base_name = true;
+        highlight_megabytes = true;
+        highlight_threads = true;
+        shadow_other_users = true;
+        show_program_path = false;
+        show_thread_names = false;
+        sort_descending = true;
+        sort_key = "PERCENT_CPU";
+        tree_view = true;
+        update_process_names = false;
+        right_meters = [ "Uptime" "Tasks" "LoadAverage" "Battery" ];
+        left_meters = [ "LeftCPUs2" "RightCPUs2" "Memory" "Swap" ];
       };
     };
   };

configs/hu-berlin.nix

@@ -1,43 +1,69 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:
 let
   inherit (lib.strings) fileContents;
+  inherit (import <niveum/lib>) sshPort;
   eduroam = {
     identity = fileContents <secrets/eduroam/identity>;
     password = fileContents <secrets/eduroam/password>;
   };
-  eduroamAuth = ''
-    key_mgmt=WPA-EAP
-    eap=TTLS
-    proto=RSN
-    identity="${eduroam.identity}"
-    anonymous_identity="anonymous@wlan.hu-berlin.de"
-    altsubject_match="DNS:srv1-radius.cms.hu-berlin.de;DNS:srv2-radius.cms.hu-berlin.de"
-    password="${eduroam.password}"
-    ca_cert="${
-      pkgs.fetchurl {
-        url =
-          "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/t-telesec_globalroot_class_2.pem";
-        sha256 = "0if8aqd06sid7a0vw009zpa087wxcgdd2x6z2zs4pis5kvyqj2dk";
-      }
-    }"
-    phase2="auth=PAP"
-  '';
+  hu-berlin-cifs-options = [
+    "uid=${toString config.users.users.me.uid}"
+    "gid=${toString config.users.groups.users.gid}"
+    "sec=ntlmv2"
+    "workgroup=german"
+    "username=meinhaki"
+    "password=${lib.strings.fileContents <secrets/mail/meinhaki>}"
+    "noauto"
+    "x-systemd.requires=openvpn-hu-berlin.service"
+    "x-systemd.automount"
+    "x-systemd.device-timeout=1"
+    "x-systemd.idle-timeout=1min"
+  ];
 in {
-  networking.wireless.networks = {
-    eduroam_5GHz.auth = eduroamAuth;
-    eduroam.auth = eduroamAuth;
+  fileSystems."/media/hu-berlin/germpro2" = {
+    device = "//hugerm31c.user.hu-berlin.de/germpro2/ling";
+    fsType = "cifs";
+    options = hu-berlin-cifs-options;
+  };
+
+  fileSystems."/media/hu-berlin/germhome" = {
+    device = "//hugerm31c.user.hu-berlin.de/germhome/ling/meinhaki";
+    fsType = "cifs";
+    options = hu-berlin-cifs-options;
   };
 
   environment.systemPackages = [
-    (pkgs.writers.writeDashBin "hu-vpn" ''
-      ${pkgs.openfortivpn}/bin/openfortivpn -p "${eduroam.password}" -c ${pkgs.writeText "hu-berlin.config" ''
+    (pkgs.writers.writeDashBin "hu-ip" ''
+      ${pkgs.w3m}/bin/w3m -dump meineip.hu-berlin.de | head --lines=-4 | tail --lines=+3
+    '')
+    (pkgs.writers.writePython3Bin "hu-eduroam-install"
+      {
+        libraries = with pkgs.python3Packages; [ distro pyopenssl dbus-python ];
+        flakeIgnore = [ "E501" "E123" "W504" "E722" "F821" "E226" "E126" "E265" "W291" ];
+      }
+      (builtins.readFile (builtins.fetchurl {
+        url = "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/linux-installer/eduroam-linux-hub.py";
+        sha256 = "19x2kvwxx13265b2hj5fjf53g0liw6dw7xf9j9cav67cswmz60kf";
+      }))
+    )
+  ];
+
+  systemd.services.hu-vpn = {
+    enable = false;
+    wants = [ "network-online.target" ];
+    conflicts = [ "openvpn-hu-berlin.service" ];
+    script = ''
+      ${pkgs.openfortivpn}/bin/openfortivpn -c ${pkgs.writeText "hu-berlin.config" ''
         host = forti-ssl.vpn.hu-berlin.de
         port = 443
-        trusted-cert = e5a7d56543002ffe1e8962caa5fd6d94053aa702381458247b670877a66f3c6f
+        trusted-cert = 42193a913d276d9eb86217612956e1e6464d6f07bed5393a4787c87adc4bd359
         username = ${eduroam.identity}
+        password = ${eduroam.password}
       ''}
-    '')
-  ];
+    '';
+  };
+
+  systemd.services.openvpn-hu-berlin.conflicts = [ "hu-vpn.service" ];
 
   services.openvpn.servers.hu-berlin = {
     autoStart = false;

configs/i3.nix

@@ -1,5 +1,6 @@
 { config, pkgs, lib, ... }:
 let
+  inherit (import <niveum/lib>) defaultApplications colours;
   klem = import <niveum/packages/scripts/klem.nix> {
     inherit pkgs lib;
     config.scripts = {
@@ -26,6 +27,12 @@ let
       "betacode" = pkgs.writers.writeDash "betacode" ''
         ${pkgs.scripts.betacode}/bin/betacode
       '';
+      "devanagari" = pkgs.writers.writeDash "devanagari" ''
+        ${pkgs.scripts.devanagari}/bin/devanagari
+      '';
+      "curl" = pkgs.writers.writeDash "curl" ''
+        ${pkgs.curl}/bin/curl -fSs "$(${pkgs.coreutils}/bin/cat)"
+      '';
     };
   };
 
@@ -36,30 +43,7 @@ let
     i3-msg move container to workspace $(($(i3-msg -t get_workspaces | tr , '\n' | grep '"num":' | cut -d : -f 2 | sort -rn | head -1) + 1))
   '';
 
-  # https://github.com/LukeSmithxyz/voidrice/blob/9fe6802122f6e0392c7fe20eefd30437771d7f8e/.local/bin/dmenuunicode
-  emoji-menu = let
-    emoji-file = pkgs.fetchurl {
-      url =
-        "https://raw.githubusercontent.com/LukeSmithxyz/voidrice/master/.local/share/larbs/emoji";
-      sha256 = "09m2rgb9d5jpiy8q4jz3dw36gkpb4ng2pl7xi7ppsrzzzdvq85qk";
-    };
-  in with pkgs;
-  writers.writeDashBin "emoji-menu" ''
-    PATH=${lib.makeBinPath [ coreutils dmenu gnused libnotify xclip xdotool ]}
-    chosen=$(cut -d ';' -f1 ${emoji-file} | dmenu -i -l 10 | sed "s/ .*//")
-
-    [ "$chosen" != "" ] || exit
-
-    echo "$chosen" | tr -d '\n' | xclip -selection clipboard
-
-    if [ -n "$1" ]; then
-      xdotool key Shift+Insert
-    else
-      notify-send --app-name="emoji-menu" "'$chosen' copied to clipboard." &
-    fi
-  '';
-
-in with config.niveum; {
+in {
   services.xserver = {
     displayManager.defaultSession = "none+i3";
     windowManager.i3 = {
@@ -68,10 +52,25 @@ in with config.niveum; {
     };
   };
 
+  services.xserver = {
+    monitorSection = ''Option "DPMS" "false"'';
+    serverFlagsSection = ''
+      Option "BlankTime" "0"
+      Option "StandbyTime" "0"
+      Option "SuspendTime" "0"
+      Option "OffTime" "0"
+    '';
+    extraConfig = ''
+      Section "Extensions"
+        Option "DPMS" "Disable"
+      EndSection
+    '';
+  };
+
   home-manager.users.me.xsession.windowManager.i3 = {
     enable = true;
     config = rec {
-      fonts = [ "Monospace ${toString config.niveum.fonts.size}" ];
+      fonts = {names = ["Sans"]; size = 10.0;};
       modifier = "Mod4";
       window = {
         titlebar = false;
@@ -110,9 +109,9 @@ in with config.niveum; {
         };
       in rec {
         focused = scheme // {
-          border = colours.foreground;
-          indicator = colours.foreground;
-          childBorder = colours.foreground;
+          border = colours.cyan.bright;
+          indicator = colours.cyan.bright;
+          childBorder = colours.cyan.bright;
         };
         unfocused = scheme // {
           border = colours.background;
@@ -133,7 +132,7 @@ in with config.niveum; {
       };
       bars = [{
         workspaceButtons = false;
-        fonts = [ "Monospace ${toString (config.niveum.fonts.size - 1)}" ];
+        fonts = {names = ["Sans"]; size = 8.0;};
         mode = "hide"; # "dock"
         position = "bottom";
         colors = rec {
@@ -147,10 +146,9 @@ in with config.niveum; {
           };
         };
         statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs ${
-            pkgs.writeTOML (import <niveum/dot/i3status-rust.nix> {
-              wifi-interface = networkInterfaces.wireless;
-              batteryBlock = batteryBlocks.default;
-              inherit (config.niveum) colours;
+            (pkgs.formats.toml {}).generate "i3status-rust.toml" (import <niveum/lib/i3status-rust.nix> {
+              inherit (config.niveum) batteryName wirelessInterface;
+              inherit colours;
               inherit pkgs;
             })
           }";
@@ -164,17 +162,15 @@ in with config.niveum; {
         "l" = "resize grow width 10 px or 5 ppt";
       };
       keybindings = {
-        "${modifier}+Shift+h" = "move left";
-        "${modifier}+Shift+j" = "move down";
-        "${modifier}+Shift+k" = "move up";
-        "${modifier}+Shift+l" = "move right";
+        "${modifier}+Shift+h" = "move left 25 px";
+        "${modifier}+Shift+j" = "move down 25 px";
+        "${modifier}+Shift+k" = "move up 25 px";
+        "${modifier}+Shift+l" = "move right 25 px";
         "${modifier}+h" = "focus left";
         "${modifier}+j" = "focus down";
         "${modifier}+k" = "focus up";
         "${modifier}+l" = "focus right";
 
-        "${modifier}+Menu" = "exec ${klem}/bin/klem";
-
         "${modifier}+Shift+b" = "move window to workspace prev";
         "${modifier}+Shift+n" = "move window to workspace next";
         "${modifier}+Shift+x" = "exec --no-startup-id ${move-to-new-workspace}";
@@ -186,22 +182,26 @@ in with config.niveum; {
         "${modifier}+Shift+q" = "kill";
         "${modifier}+Shift+r" = "restart";
 
-        "${modifier}+Shift+s" = "sticky toggle";
+        "${modifier}+z" = "sticky toggle";
         "${modifier}+Shift+z" = "floating toggle";
+
+        "${modifier}+s" = "scratchpad show";
+        "${modifier}+Shift+s" = "move scratchpad";
+
         "${modifier}+c" = "split h";
         "${modifier}+e" = "layout toggle split";
         "${modifier}+f" = "fullscreen toggle";
         "${modifier}+r" = "mode resize";
-        "${modifier}+s" = "layout stacking";
         "${modifier}+v" = "split v";
         "${modifier}+w" = "layout tabbed";
 
-        "${modifier}+Return" = "exec i3-sensible-terminal";
         # "${modifier}+Shift+y" = "exec ${pkgs.qutebrowser}/bin/qutebrowser";
-        "${modifier}+t" = "exec ${applications.fileManager}";
-        "${modifier}+y" = "exec x-www-browser";
+        "${modifier}+Return" = "exec ${(defaultApplications pkgs).terminal}";
+        "${modifier}+t" = "exec ${(defaultApplications pkgs).fileManager}";
+        "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
+        "${modifier}+0" = "exec ${pkgs.scripts.menu-calc}/bin/=";
 
-        "${modifier}+Shift+w" = "exec ${pkgs.xautolock}/bin/xautolock -locknow";
+        "${modifier}+Shift+w" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
         "${modifier}+a" =
           "exec --no-startup-id ${pkgs.rofi}/bin/rofi -display-window — -show window";
         "${modifier}+d" = "exec --no-startup-id ${pkgs.dmenu}/bin/dmenu_run";
@@ -221,31 +221,26 @@ in with config.niveum; {
             ''
           }";
         "${modifier}+p" = "exec --no-startup-id ${pkgs.pass}/bin/passmenu -l 5";
-        "${modifier}+u" = "exec ${emoji-menu}/bin/emoji-menu";
+        "${modifier}+u" = "exec ${pkgs.scripts.unicodmenu}/bin/unicodmenu";
 
         "${modifier}+F7" = "exec ${pkgs.scripts.showkeys-toggle}/bin/showkeys-toggle";
         "${modifier}+F8" = "exec ${pkgs.xorg.xkill}/bin/xkill";
         "${modifier}+F9" = "exec ${pkgs.redshift}/bin/redshift -O 4000 -b 0.85";
         "${modifier}+F10" = "exec ${pkgs.redshift}/bin/redshift -x";
         "${modifier}+F11" = "exec ${pkgs.xcalib}/bin/xcalib -invert -alter";
+        "${modifier}+F12" = "exec ${klem}/bin/klem";
 
-        "Print" = "exec flameshot-once";
-        "XF86AudioLowerVolume" =
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -d 5";
+        "Print" = "exec flameshot gui -p /tmp";
+        "XF86AudioLowerVolume" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -d 5";
         "XF86AudioMute" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -t";
-        "XF86AudioRaiseVolume" =
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -i 5";
-        "XF86Calculator" =
-          "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
-        "XF86AudioPause" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl pause";
-        "XF86AudioPlay" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioNext" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl next";
-        "XF86AudioPrev" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86ScreenSaver" = "exec ${pkgs.xautolock}/bin/xautolock -locknow";
+        "XF86AudioRaiseVolume" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -i 5";
+        "XF86Calculator" = "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
+        "XF86AudioPause" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl pause";
+        "XF86AudioPlay" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl play-pause";
+        "XF86AudioNext" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl next";
+        "XF86AudioPrev" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl previous";
+        "XF86AudioStop" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl stop";
+        "XF86ScreenSaver" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
 
         "XF86Display" = "exec ${pkgs.scripts.dmenurandr}/bin/dmenurandr";
 

configs/khal.nix

@@ -0,0 +1,123 @@
+{ config, pkgs, lib, ... }:
+let
+  davHome = "~/.local/share/dav";
+  davEndpoint = "https://cloud.xn--kiern-0qa.de/remote.php/dav";
+  username = "kieran";
+  password = lib.fileContents <secrets/nextcloud/password>;
+in
+{
+  environment.systemPackages = [ pkgs.khal pkgs.vdirsyncer pkgs.khard pkgs.todoman ];
+
+  systemd.user.services.vdirsyncer = {
+    enable = true;
+    wants = [ "network-online.target" ];
+    wantedBy = [ "default.target" ];
+    startAt = "*:00/10";
+    script = ''
+      ${pkgs.vdirsyncer}/bin/vdirsyncer sync
+      ${pkgs.khal}/bin/khal printcalendars # https://lostpackets.de/khal/configure.html#syncing
+    '';
+  };
+
+  home-manager.users.me = {
+    xdg.configFile = {
+      "khard/khard.conf".text = ''
+        [addressbooks]
+        [[contacts]]
+        path = ${davHome}/contacts/contacts/
+
+        [general]
+        debug = no
+        default_action = list
+        editor = ${config.environment.variables.EDITOR}
+        merge_editor = ${pkgs.vim}/bin/vimdiff
+
+        [contact table]
+        display = first_name
+        group_by_addressbook = no
+        reverse = no
+        show_nicknames = no
+        show_uids = no
+        sort = last_name
+        localize_dates = yes
+        preferred_phone_number_type = pref, cell, home
+        preferred_email_address_type = pref, work, home
+
+        [vcard]
+        search_in_source_files = no
+        skip_unparsable = no
+      '';
+
+      "todoman/todoman.conf".text = ''
+        [main]
+        path = ${davHome}/calendar/*
+        date_format = %Y-%m-%d
+        time_format = %H:%M
+        default_due = 0
+        default_list = Personal
+        startable = True
+      '';
+
+      "khal/config".text = ''
+        [calendars]
+
+        [[kalender_local]]
+        path = ${davHome}/calendar/*
+        type = discover
+
+        [default]
+        highlight_event_days = True
+        timedelta = 5d
+
+        [locale]
+        timeformat = %H:%M
+        dateformat = %Y-%m-%d
+        longdateformat = %Y-%m-%d
+        datetimeformat = %Y-%m-%d %H:%M
+        longdatetimeformat = %Y-%m-%d %H:%M
+        local_timezone = ${config.time.timeZone}
+        default_timezone = ${config.time.timeZone}
+        weeknumbers = left
+      '';
+
+      "vdirsyncer/config".text = ''
+        [general]
+        status_path = "~/.local/share/vdirsyncer/status/"
+
+        [pair kontakte]
+        a = "kontakte_local"
+        b = "kontakte_cloud"
+        collections = ["contacts"]
+        conflict_resolution = "b wins"
+
+        [pair kalender]
+        a = "kalender_local"
+        b = "kalender_cloud"
+        collections = ["from a", "from b"]
+        conflict_resolution = "b wins"
+
+        [storage kontakte_local]
+        type = "filesystem"
+        path = "${davHome}/contacts/"
+        fileext = ".vcf"
+
+        [storage kalender_local]
+        type = "filesystem"
+        path = "${davHome}/calendar/"
+        fileext = ".ics"
+
+        [storage kontakte_cloud]
+        type = "carddav"
+        url = "${davEndpoint}/addressbooks/users/${username}/"
+        username = "${username}"
+        password = "${password}"
+
+        [storage kalender_cloud]
+        type = "caldav"
+        url = "${davEndpoint}/calendars/${username}/"
+        username = "${username}"
+        password = "${password}"
+      '';
+    };
+  };
+}

configs/kleiter.nix

@@ -1,13 +0,0 @@
-{ ... }:
-let ssid = "Kleiter Gast";
-in {
-  networking.wireless.networks.${ssid}.psk = "Kleiter-Gast";
-
-  # fix dns
-  systemd.network.networks.kleiter = {
-    dns = [ "8.8.8.8" "8.8.4.4" ];
-    networkConfig.DHCP = "yes";
-    matchConfig.Name = "wlp3s0";
-    matchConfig.SSID = ssid;
-  };
-}

configs/mail.nix

@@ -1,233 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  tagRules = [
-    {
-      query = "to:miaengiadina-pwa@noreply.github.com AND subject:\"PR run failed\"";
-      tags = [ "-new" "+deleted" ];
-    }
-    {
-      query = lib.concatStringsSep " OR " [
-        "from:noreply-local-guides@google.com"
-        "from:google-maps-noreply@google.com"
-        "subject:fd-noti"
-        "from:nebenan.de"
-        "to:miaengiadina-pwa@noreply.github.com"
-      ];
-      tags = [ "-new" ];
-    }
-    {
-      query = "tag:new";
-      tags = [ "-new" "+inbox" ];
-    }
-  ];
-
-  # turns out we have to escape $ because, if the password contains a $, it will get interpolated as a variable by the msmtp `passwordeval` which does: `bash -c "COMMAND; echo"`
-  pass_ = file: "echo ${lib.escape ["$"] (lib.escapeShellArg (lib.strings.fileContents file))}";
-
-  generateTaggingScript = filters:
-    let
-      template = { tags, query, message ? "tagging ${query} -> ${lib.concatStringsSep " " tags}", ... }: ''
-        echo '${message}'
-        ${pkgs.notmuch}/bin/notmuch tag ${lib.concatStringsSep " " tags} -- "${query}"
-      '';
-    in lib.concatStringsSep "\n" (map template filters);
-
-  enableDefaults = lib.recursiveUpdate {
-    mbsync = {
-      enable = true;
-      create = "both";
-      expunge = "both";
-    };
-    msmtp.enable = true;
-    notmuch.enable = true;
-  };
-
-  much-pkg = pkgs.haskellPackages.callCabal2nix "much" <niveum/submodules/much> {};
-  much = pkgs.haskell.lib.dontHaddock much-pkg;
-
-  mail-sync = pkgs.writers.writeDashBin "mail-sync" ''
-    ${pkgs.isync}/bin/mbsync --all
-    ${pkgs.notmuch}/bin/notmuch new
-  '';
-in {
-  environment.variables.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
-
-  systemd.services.mail-sync = {
-    enable = true;
-    wants = [ "network-online.target" ];
-    startAt = "*:0/15";
-    serviceConfig.User = "kfm";
-    serviceConfig.Type = "oneshot";
-    environment.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
-    script = ''
-      export PATH=${lib.makeBinPath [ pkgs.muchsync pkgs.notmuch mail-sync ]}
-      mail-sync
-      muchsync
-    '';
-  };
-
-  environment.systemPackages = [
-    pkgs.neomutt
-
-    pkgs.notmuch-addrlookup
-
-    mail-sync
-
-    pkgs.muchsync
-
-    (pkgs.writers.writeDashBin "mua" ''
-      if [ $# -eq 0 ]; then
-        ${much}/bin/much-kmein
-      else
-        ${much}/bin/much-kmein -q "$*"
-      fi
-    '')
-
-    (pkgs.writers.writeDashBin "mail-clean" ''
-      ${pkgs.notmuch}/bin/notmuch search --output files --format=text0 tag:deleted | ${pkgs.findutils}/bin/xargs -r0 rm
-      ${pkgs.notmuch}/bin/notmuch new
-    '')
-  ];
-
-
-  home-manager.users.me = {
-    services.muchsync.remotes =
-    let
-      muchsyncConfig = host: {
-        name = host;
-        value = {
-          frequency = "*:0/10";
-          remote.host = host;
-          remote.checkForModifiedFiles = false;
-          local.checkForModifiedFiles = false;
-          # don't run `notmuch new` locally nor remotely because muchsync is only regularly run after `mail-sync`
-          remote.importNew = false;
-          local.importNew = false;
-        };
-      };
-    in lib.listToAttrs (map muchsyncConfig [
-      "wilde"
-      "homeros"
-    ]);
-
-    programs.msmtp.enable = true;
-
-    programs.mbsync.enable = true;
-
-    programs.notmuch = {
-      enable = true;
-      new.tags = [ "new" ];
-      search.excludeTags = [ "deleted" "spam" ];
-      hooks.postNew = generateTaggingScript tagRules;
-      extraConfig.muchsync.and_tags = "inbox;unread";
-    };
-
-    accounts.email.maildirBasePath = "${config.users.users.me.home}/mail";
-
-    accounts.email.accounts = {
-      fysi = enableDefaults {
-        primary = false;
-        smtp = {
-          host = "smtp.fastmail.com";
-          port = 465;
-          tls.enable = true;
-        };
-        imap = {
-          host = "imap.fastmail.com";
-          port = 993;
-          tls.enable = true;
-        };
-        userName = "kieran@fysi.tech";
-        address = "kieran@fysi.tech";
-        realName = config.niveum.user.name;
-        passwordCommand = pass_ <secrets/mail/fastmail>;
-      };
-      cock = enableDefaults {
-        primary = false;
-        smtp = {
-          host = "mail.cock.li";
-          port = 587;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "mail.cock.li";
-          port = 993;
-          tls.enable = true;
-        };
-        userName = "2210@cock.li";
-        address = "2210@cock.li";
-        realName = "2210";
-        passwordCommand = pass_ <secrets/mail/cock>;
-      };
-      kieran-gmail = enableDefaults {
-        primary = false;
-        flavor = "gmail.com";
-        address = "kieran.meinhardt@gmail.com";
-        realName = config.niveum.user.name;
-        userName = "kieran.meinhardt";
-        passwordCommand = pass_ <secrets/mail/gmail/kieran.meinhardt>;
-        folders = {
-          drafts = "[Gmail]/Entw&APw-rfe";
-          sent = "[Gmail]/Gesendet";
-          trash = "[Gmail]/Papierkorb";
-        };
-      };
-      amroplay = enableDefaults {
-        primary = false;
-        flavor = "gmail.com";
-        address = "amroplay@gmail.com";
-        realName = config.niveum.user.name;
-        userName = "amroplay";
-        passwordCommand = pass_ <secrets/mail/gmail/amroplay>;
-        folders = {
-          drafts = "[Gmail]/Drafts";
-          sent = "[Gmail]/Sent Mail";
-          trash = "[Gmail]/Bin";
-        };
-      };
-      posteo = enableDefaults {
-        primary = true;
-        smtp = {
-          host = "posteo.de";
-          port = 587;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "posteo.de";
-          port = 993;
-          tls.enable = true;
-        };
-        address = "kieran.meinhardt@posteo.net";
-        realName = config.niveum.user.name;
-        userName = "kieran.meinhardt@posteo.net";
-        passwordCommand = pass_ <secrets/mail/posteo>;
-      };
-      hu-berlin = enableDefaults {
-        primary = false;
-        address = "meinhark@hu-berlin.de";
-        realName = config.niveum.user.name;
-        userName = "meinhark";
-        passwordCommand = pass_ <secrets/eduroam/password>;
-        smtp = {
-          host = "mailhost.cms.hu-berlin.de";
-          port = 25;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "mailbox.cms.hu-berlin.de";
-          port = 993;
-          tls.enable = true;
-        };
-      };
-    };
-  };
-}

configs/mail/accounts.nix

@@ -0,0 +1,145 @@
+{ lib, ... }:
+let
+  inherit (import <niveum/lib>) kieran;
+
+  enableDefaults = lib.recursiveUpdate {
+    mbsync = {
+      enable = true;
+      create = "both";
+      expunge = "both";
+    };
+    msmtp.enable = true;
+    notmuch.enable = true;
+  };
+
+  settings = {
+    fastmail = {
+      smtp = {
+        host = "smtp.fastmail.com";
+        port = 465;
+        tls.enable = true;
+      };
+      imap = {
+        host = "imap.fastmail.com";
+        port = 993;
+        tls.enable = true;
+      };
+    };
+    cock = {
+      smtp = {
+        host = "mail.cock.li";
+        port = 587;
+        tls = {
+          enable = true;
+          useStartTls = true;
+        };
+      };
+      imap = {
+        host = "mail.cock.li";
+        port = 993;
+        tls.enable = true;
+      };
+    };
+    posteo = {
+      smtp = {
+        host = "posteo.de";
+        port = 587;
+        tls = {
+          enable = true;
+          useStartTls = true;
+        };
+      };
+      imap = {
+        host = "posteo.de";
+        port = 993;
+        tls.enable = true;
+      };
+    };
+    hu-berlin = {
+      smtp = {
+        host = "mailhost.cms.hu-berlin.de";
+        port = 25;
+        tls = {
+          enable = true;
+          useStartTls = true;
+        };
+      };
+      imap = {
+        host = "mailbox.cms.hu-berlin.de";
+        port = 993;
+        tls.enable = true;
+      };
+    };
+  };
+
+  # turns out we have to escape $ because, if the password contains a $, it will get interpolated as a variable by the msmtp `passwordeval` which does: `bash -c "COMMAND; echo"`
+  pass_ = file: "echo ${lib.escape ["$"] (lib.escapeShellArg (lib.strings.fileContents file))}";
+in
+{
+  fysi = enableDefaults {
+    primary = false;
+    userName = "kieran@fysi.tech";
+    address = "kieran@fysi.tech";
+    realName = kieran.name;
+    passwordCommand = pass_ <secrets/mail/fastmail>;
+    inherit (settings.fastmail) imap smtp;
+  };
+  cock = enableDefaults {
+    primary = false;
+    userName = "2210@cock.li";
+    address = "2210@cock.li";
+    realName = "2210";
+    passwordCommand = pass_ <secrets/mail/cock>;
+    inherit (settings.cock) imap smtp;
+  };
+  kieran-gmail = enableDefaults {
+    primary = false;
+    flavor = "gmail.com";
+    address = "kieran.meinhardt@gmail.com";
+    realName = kieran.name;
+    userName = "kieran.meinhardt";
+    passwordCommand = pass_ <secrets/mail/gmail/kieran.meinhardt>;
+    folders = {
+      drafts = "[Gmail]/Entw&APw-rfe";
+      sent = "[Gmail]/Gesendet";
+      trash = "[Gmail]/Papierkorb";
+    };
+  };
+  amroplay = enableDefaults {
+    primary = false;
+    flavor = "gmail.com";
+    address = "amroplay@gmail.com";
+    realName = kieran.name;
+    userName = "amroplay";
+    passwordCommand = pass_ <secrets/mail/gmail/amroplay>;
+    folders = {
+      drafts = "[Gmail]/Drafts";
+      sent = "[Gmail]/Sent Mail";
+      trash = "[Gmail]/Bin";
+    };
+  };
+  posteo = enableDefaults {
+    primary = true;
+    address = "kieran.meinhardt@posteo.net";
+    realName = kieran.name;
+    userName = "kieran.meinhardt@posteo.net";
+    passwordCommand = pass_ <secrets/mail/posteo>;
+    inherit (settings.posteo) imap smtp;
+  };
+  hu-berlin = enableDefaults {
+    primary = false;
+    address = "meinhark@hu-berlin.de";
+    realName = kieran.name;
+    userName = "meinhark";
+    passwordCommand = pass_ <secrets/eduroam/password>;
+    inherit (settings.hu-berlin) imap smtp;
+  };
+  hu-berlin-work = enableDefaults {
+    primary = false;
+    address = "meinhaki@hu-berlin.de";
+    realName = kieran.name;
+    userName = "meinhaki";
+    passwordCommand = pass_ <secrets/mail/meinhaki>;
+    inherit (settings.hu-berlin) imap smtp;
+  };
+}

configs/mail/client.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (import <niveum/lib>) email-sshKey;
+  much =
+    let
+      nixpkgs-much = import (pkgs.fetchFromGitHub {
+        owner = "NixOS";
+        repo = "nixpkgs";
+        rev = "7c2a362b58a1c2ba72d24aa3869da3b1a91d39e1";
+        sha256 = "0gl4xndyahasa9dv5mi3x9w8s457wl2xh9lcldizcn1irjvkrzs4";
+      }) {
+        overlays = [
+          (import <stockholm/krebs/5pkgs/haskell>)
+        ];
+      };
+      much-pkg = pkgs.haskellPackages.callCabal2nix "much" <niveum/submodules/much> {};
+    in nixpkgs-much.haskell.lib.dontHaddock much-pkg;
+in {
+  environment.variables.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
+
+  users.users.me.openssh.authorizedKeys.keys = [ email-sshKey ];
+
+  environment.systemPackages = [
+    pkgs.notmuch-addrlookup
+
+    pkgs.muchsync
+
+    (pkgs.writers.writeDashBin "mua" ''
+      if [ $# -eq 0 ]; then
+        ${much}/bin/much-kmein
+      else
+        ${much}/bin/much-kmein -q "$*"
+      fi
+    '')
+
+    (pkgs.writers.writeDashBin "mail-clean" ''
+      ${pkgs.notmuch}/bin/notmuch search --output files --format=text0 tag:deleted | ${pkgs.findutils}/bin/xargs -r0 rm
+      ${pkgs.notmuch}/bin/notmuch new
+    '')
+  ];
+
+  home-manager.users.me = {
+    programs.notmuch = {
+      enable = true;
+      search.excludeTags = [ "deleted" "spam" ];
+    };
+
+    programs.msmtp.enable = true;
+
+    accounts.email.accounts = import ./accounts.nix { inherit lib; };
+  };
+}

configs/mail/fetcher.nix

@@ -0,0 +1,80 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (import <niveum/lib>) kieran sshPort;
+
+  tagRules = [
+    {
+      query = "to:miaengiadina-pwa@noreply.github.com AND subject:\"PR run failed\"";
+      tags = [ "-new" "+deleted" ];
+    }
+    {
+      query = lib.concatStringsSep " OR " [
+        "from:noreply-local-guides@google.com"
+        "from:google-maps-noreply@google.com"
+        "subject:fd-noti"
+        "from:nebenan.de"
+        "to:miaengiadina-pwa@noreply.github.com"
+      ];
+      tags = [ "-new" ];
+    }
+    {
+      query = "tag:new";
+      tags = [ "-new" "+inbox" ];
+    }
+  ];
+
+  generateTaggingScript = filters:
+    let
+      template = { tags, query, message ? "tagging ${query} -> ${lib.concatStringsSep " " tags}", ... }: ''
+        echo '${message}'
+        ${pkgs.notmuch}/bin/notmuch tag ${lib.concatStringsSep " " tags} -- "${query}"
+      '';
+    in lib.concatStringsSep "\n" (map template filters);
+in
+{
+  imports = [ <stockholm/krebs/3modules/secret.nix> ];
+
+  krebs.secret.files.email-ssh = {
+    path = "${config.users.users.email.home}/.ssh/id_ed25519";
+    owner.name = config.users.users.email.name;
+    source-path = toString <system-secrets> + "/email/ssh.key";
+  };
+
+  users.users.email = {
+    isNormalUser = true;
+    description = "fetching mails since 2021";
+  };
+
+  systemd.services.mail-sync =
+  let
+    hosts = [ "manakish.r" "kabsa.r" ];
+  in {
+    enable = true;
+    wants = [ "network-online.target" config.krebs.secret.files.email-ssh.service ];
+    startAt = "*:0/3";
+    serviceConfig.User = config.users.users.email.name;
+    serviceConfig.Type = "oneshot";
+    environment.NOTMUCH_CONFIG = config.home-manager.users.email.home.sessionVariables.NOTMUCH_CONFIG;
+    path = [ pkgs.notmuch pkgs.openssh ];
+    script = ''
+      ${pkgs.isync}/bin/mbsync --all || true
+
+      ${lib.concatMapStringsSep "\n" (host: ''
+        echo === syncing ${host}
+        ${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=4 -p ${toString sshPort}' kfm@${host} || :
+      '') hosts}
+    '';
+  };
+
+  home-manager.users.email = {
+    programs.mbsync.enable = true;
+
+    accounts.email.accounts = import ./accounts.nix { inherit lib; };
+
+    programs.notmuch = {
+      enable = true;
+      new.tags = [ "new" ];
+      hooks.postNew = generateTaggingScript tagRules;
+    };
+  };
+}

configs/matterbridge.nix

@@ -0,0 +1,56 @@
+{ pkgs, lib, ... }:
+{
+  nixpkgs.overlays = [
+    (self: super: {
+      matterbridge = (import (super.fetchFromGitHub {
+        owner = "NixOS";
+        repo = "nixpkgs";
+        rev = "e45d91ee65db293a172ec506759d1248e40c35f5";
+        sha256 = "03cjs5xcx09lw0djyrx2kfakw7gkg4iqmy9w25azai62im39l30k";
+      }) {}).matterbridge;
+    })
+  ];
+
+  services.matterbridge = {
+    enable = true;
+    configPath =
+    let bridgeBotToken = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
+    in toString ((pkgs.formats.toml {}).generate "config.toml" {
+      general = {
+        RemoteNickFormat = "[{NICK}] ";
+        Charset = "utf-8";
+      };
+      telegram.kmein.Token = bridgeBotToken;
+      irc =
+      let Nick = "ponte"; StripMarkdown = true;
+      in {
+        hackint = { Server = "irc.hackint.org:6697"; UseTLS = true; inherit Nick StripMarkdown; };
+      };
+      mumble.lassulus = {
+        Server = "lassul.us:64738";
+        Nick = "krebs_bridge";
+        SkipTLSVerify = true;
+      };
+      gateway = [
+        {
+          name = "krebs-bridge";
+          enable = true;
+          inout = [
+            {
+              account = "irc.hackint";
+              channel = "#krebs";
+            }
+            {
+              account = "telegram.kmein";
+              channel = "-330372458";
+            }
+            {
+              account = "mumble.lassulus";
+              channel = 6; # "nixos"
+            }
+          ];
+        }
+      ];
+    });
+  };
+}

configs/mime.nix

@@ -19,6 +19,7 @@
         "x-scheme-handler/mailto" = "brave-browser.desktop";
         "x-scheme-handler/unknown" = "brave-browser.desktop";
         "x-scheme-handler/webcal" = "brave-browser.desktop";
+        "inode/directory" = "pcmanfm.desktop";
       };
 
     };

configs/monitoring/loki.nix

@@ -0,0 +1,60 @@
+{
+  auth_enabled = false;
+  server = {
+    http_listen_port = 3100;
+    grpc_listen_port = 9096;
+  };
+  ingester = {
+    wal = {
+      enabled = true;
+      dir = "/tmp/wal";
+    };
+    lifecycler = {
+      address = "127.0.0.1";
+      ring = {
+        kvstore.store = "inmemory";
+        replication_factor = 1;
+      };
+      final_sleep = "0s";
+    };
+    chunk_idle_period = "1h";       # Any chunk not receiving new logs in this time will be flushed
+    max_chunk_age = "1h";           # All chunks will be flushed when they hit this age, default is 1h
+    chunk_target_size = 1048576;    # Loki will attempt to build chunks up to 1.5MB, flushing first if chunk_idle_period or max_chunk_age is reached first
+    chunk_retain_period = "30s";    # Must be greater than index read cache TTL if using an index cache (Default index read cache TTL is 5m)
+    max_transfer_retries = 0;       # Chunk transfers disabled
+  };
+  schema_config.configs = [
+    {
+      from = "2020-10-24";
+      store = "boltdb-shipper";
+      object_store = "filesystem";
+      schema = "v11";
+      index = {
+        prefix = "index_";
+        period = "24h";
+      };
+    }
+  ];
+  storage_config = {
+    boltdb_shipper = {
+      active_index_directory = "/tmp/loki/boltdb-shipper-active";
+      cache_location = "/tmp/loki/boltdb-shipper-cache";
+      cache_ttl = "24h";         # Can be increased for faster performance over longer query periods, uses more disk space
+      shared_store = "filesystem";
+    };
+    filesystem.directory = "/tmp/loki/chunks";
+  };
+  compactor = {
+    working_directory = "/tmp/loki/boltdb-shipper-compactor";
+    shared_store = "filesystem";
+  };
+  limits_config = {
+    reject_old_samples = true;
+    reject_old_samples_max_age = "168h";
+  };
+  chunk_store_config.max_look_back_period = "0s";
+  table_manager = {
+    retention_deletes_enabled = false;
+    retention_period = "0s";
+  };
+}

configs/monitoring/pull.nix

@@ -0,0 +1,172 @@
+{ lib, config, pkgs, ... }:
+let
+  lokiConfig = import ./loki.nix;
+in
+{
+  services.grafana = {
+    enable = true;
+    domain = "grafana.kmein.r";
+    port = 9444;
+    addr = "127.0.0.1";
+  };
+
+  services.nginx.virtualHosts.${config.services.grafana.domain} = {
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+      proxyWebsockets = true;
+    };
+  };
+
+  services.prometheus.rules = let diskFreeThreshold = 10; in [(builtins.toJSON {
+    groups = [{
+      name = "niveum";
+      rules = [
+        {
+          alert = "ServiceDown";
+          expr = ''node_systemd_unit_state{state="failed"} == 1'';
+          annotations = {
+            summary = "{{$labels.job}}: Service {{$labels.name}} failed to start.";
+          };
+        }
+        {
+          alert = "RootPartitionFull";
+          for = "10m";
+          expr = ''(node_filesystem_free_bytes{mountpoint="/"} * 100) / node_filesystem_size_bytes{mountpoint="/"} < ${toString diskFreeThreshold}'';
+          annotations = {
+            summary = "{{ $labels.job }}: Filesystem is running out of space soon.";
+            description = ''The root disk of {{ $labels.job }} has {{ $value | printf "%.2f" }}% free disk space (threshold at ${toString diskFreeThreshold}%).'';
+          };
+        }
+        {
+          alert = "RootPartitionFullWeek";
+          for = "1h";
+          expr = ''node_filesystem_free_bytes{mountpoint="/"} ''
+            + ''and predict_linear(node_filesystem_free_bytes{mountpoint="/"}[2d], 7*24*3600) <= 0'';
+          annotations = {
+            summary = "{{$labels.job}}: Filesystem is running out of space in 7 days.";
+          };
+        }
+        {
+          alert = "HighLoad";
+          expr = ''node_load15 / on(job) count(node_cpu_seconds_total{mode="system"}) by (job) >= 1.0'';
+          for = "10m";
+          annotations = {
+            summary = "{{$labels.job}}: Running on high load: {{$value}}";
+          };
+        }
+        {
+          alert = "HighRAM";
+          expr = "node_memory_MemFree_bytes + node_memory_Buffers_bytes + node_memory_Cached_bytes < node_memory_MemTotal_bytes * 0.1";
+          for = "1h";
+          annotations.summary = "{{$labels.job}}: Using lots of RAM.";
+        }
+        {
+          alert = "HostDown";
+          expr = ''up == 0'';
+          for = "5m";
+          annotations = {
+            summary = "Host {{ $labels.job }} down for 5 minutes.";
+          };
+        }
+        {
+          alert = "Reboot";
+          expr = "time() - node_boot_time_seconds < 300";
+          annotations.summary = "{{$labels.alias}}: Reboot";
+        }
+      ];
+    }];
+  })];
+
+  systemd.services.alertmanager-bot-telegram =
+  let
+    alertmanager-bot-telegram = pkgs.buildGoModule rec {
+      pname = "alertmanager-bot";
+      version = "2020-07-13";
+      src = pkgs.fetchFromGitHub {
+        owner = "metalmatze";
+        repo = "alertmanager-bot";
+        rev = "5efc0bbbf8023d4324e9da98562f064a714a7206";
+        sha256 = "09cciml1j8x76jpm2v5v6h2q6j1fkhsz1kswslmx8wl4wk40xgp4";
+      };
+      vendorSha256 = "1v0fgin8dn81b559zz4lqmrl7hikr46g4gb18sci4riql5qs1isj";
+      postInstall = ''
+        install -D ./default.tmpl $out/templates/default.tmpl
+      '';
+    };
+  in {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "ip-up.target" ];
+    environment.TELEGRAM_ADMIN = "18980945";
+    environment.TELEGRAM_TOKEN = lib.strings.fileContents <system-secrets/telegram/prometheus.token>;
+    serviceConfig = {
+      DynamicUser = true;
+      StateDirectory = "alertbot";
+      ExecStart = ''${alertmanager-bot-telegram}/bin/alertmanager-bot \
+        --alertmanager.url=http://localhost:9093 --log.level=info \
+        --store=bolt --bolt.path=/var/lib/alertbot/bot.db \
+        --listen.addr="0.0.0.0:16320" \
+        --template.paths=${pkgs.writeText "template.tmpl" ''
+          {{ define "telegram.default" }}
+          {{range .Alerts -}}
+          {{ if eq .Status "firing" }}
+          ⚠ <b>{{ index .Annotations "summary"}}</b>
+          {{ index .Annotations "description" }}
+
+          See on <a href="http://${config.services.grafana.domain}/d/alpUteInz/niveum">Grafana</a>.
+          {{ else -}}
+          😌 <del>{{ index .Annotations "summary"}}</del>
+          {{- end }}
+          {{end -}}
+          {{end}}
+        ''}'';
+    };
+  };
+
+  services.prometheus.alertmanager = {
+    enable = true;
+    listenAddress = "localhost";
+    configuration = {
+      route = {
+        group_wait = "30s";
+        repeat_interval = "4h";
+        receiver = "me";
+      };
+      receivers = [{
+        name = "me";
+        webhook_configs = [{
+          url = "http://localhost:16320";
+          send_resolved = true;
+        }];
+      }];
+    };
+  };
+
+  services.prometheus.alertmanagers = [{
+    scheme = "http";
+    path_prefix = "/";
+    static_configs = [ { targets = [ "localhost:9093" ]; } ];
+  }];
+
+  services.prometheus.scrapeConfigs = [
+    {
+      job_name = "makanek";
+      static_configs = [ { targets = [
+        "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
+        # "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}"
+      ]; } ];
+    }
+    {
+      job_name = "zaatar";
+      static_configs = [ { targets = [ "zaatar.r:${toString config.services.prometheus.exporters.node.port}" ]; } ];
+    }
+  ];
+
+  networking.firewall.allowedTCPPorts = [
+    lokiConfig.server.http_listen_port
+  ];
+
+  services.loki = {
+    enable = true;
+    configFile = (pkgs.formats.yaml {}).generate "loki.yaml" lokiConfig;
+  };
+}

configs/monitoring/push.nix

@@ -0,0 +1,75 @@
+{ config, pkgs, ... }:
+{
+  services.nginx.virtualHosts.default = {
+    locations."= /stub_status".extraConfig = "stub_status;";
+  };
+
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      nginx.enable = false;
+      node = {
+        enable = true;
+        enabledCollectors = [
+          "conntrack"
+          "diskstats"
+          "entropy"
+          "filefd"
+          "filesystem"
+          "loadavg"
+          "mdadm"
+          "meminfo"
+          "netdev"
+          "netstat"
+          "stat"
+          "time"
+          "vmstat"
+          "systemd"
+          "logind"
+          "interrupts"
+          "ksmd"
+        ];
+        port = 9002;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ config.services.prometheus.exporters.node.port ];
+
+  systemd.services.promtail = {
+    description = "Promtail service for Loki";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.grafana-loki}/bin/promtail --config.file ${(pkgs.formats.yaml {}).generate "promtail.yaml" {
+          server = {
+            http_listen_port = 28183;
+            grpc_listen_port = 0;
+          };
+          positions.filename = "/tmp/positions.yaml";
+          clients = [
+            { url = "http://${if config.networking.hostName == "makanek" then "127.0.0.1" else "makanek.r"}:3100/loki/api/v1/push"; }
+          ];
+          scrape_configs = [
+            {
+              job_name = "journal";
+              journal = {
+                max_age = "12h";
+                labels.job = "systemd-journal";
+                labels.host = config.networking.hostName;
+              };
+              relabel_configs = [
+                {
+                  source_labels = [ "__journal__systemd_unit" ];
+                  target_label = "unit";
+                }
+              ];
+            }
+          ];
+        }}
+      '';
+    };
+  };
+}

configs/moodle-dl/borsfaye.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, lib, ... }:
+let
+  moodle-dl-package = pkgs.moodle-dl.overrideAttrs (old: old // {
+    patches = [ <niveum/packages/moodle-dl/telegram-format.patch> ];
+  });
+in
+{
+  containers.moodle-dl-borsfaye = {
+    autoStart = true;
+    config = { lib, pkgs, ...}: {
+      imports = [ <niveum/modules/moodle-dl.nix> ];
+
+      services.moodle-dl = {
+        enable = true;
+        startAt = "hourly";
+        package = moodle-dl-package;
+        notifyOnly = true;
+        settings = {
+          telegram = {
+            token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
+            chat_id = "311425510";
+            send_error_msg = false;
+          };
+          token = lib.strings.fileContents <system-secrets/moodle-dl/faye.token>;
+          moodle_domain = "moodle.hu-berlin.de";
+          moodle_path = "/";
+        };
+      };
+    };
+  };
+}

configs/moodle-dl/meinhark.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, lib, ... }:
+let
+  moodle-dl-package = pkgs.moodle-dl.overrideAttrs (old: old // {
+    patches = [ <niveum/packages/moodle-dl/telegram-format.patch> ];
+  });
+in
+{
+  imports = [ <niveum/modules/moodle-dl.nix> ];
+
+  services.moodle-dl = {
+    enable = true;
+    startAt = "hourly";
+    package = moodle-dl-package;
+    settings = {
+      telegram = {
+        token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
+        chat_id = "18980945";
+        send_error_msg = false;
+      };
+      token = lib.strings.fileContents <system-secrets/moodle.token>;
+      moodle_domain = "moodle.hu-berlin.de";
+      moodle_path = "/";
+      download_course_ids = [
+        # WS 2020
+        99881 # Dialektologie
+        100183 # Onomastik
+        100353 # Sanskrit I
+        100692 # Sanskrit Tutorium
+        99832 # Germanisch
+        99823 # Gotisch
+        99813 # Altalbanisch
+        98681 # Geistliche Lyrik von Luther bis Lehnert
+        99667 # Antike Mythologie
+        # 52365 # FSR KlassPhil
+
+        # SS 2021
+        104850 # Metrik
+        103274 # Marc Aurel
+        102909 # Sanskrit II
+        104937 # Altirisch
+        104925 # Gradierung und Komparation
+        105264 # Was andere Sprachen anders machen
+        104991 # Warum klingt Orkisch böse
+        105074 # Litauisch
+        103685 # Griechische Sprache und Übersetzung I
+        105455 # Elegia greca
+        105335 # Homerische Epen
+      ];
+      download_submissions = true;
+      download_descriptions = true;
+      download_links_in_descriptions = false;
+      download_databases = false;
+      download_forums = false;
+      download_linked_files = false;
+      download_also_with_cookie = false;
+    };
+  };
+
+  fileSystems."/export/moodle" = {
+    device = config.services.moodle-dl.directory;
+    options = [ "bind" ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 2049 ];
+
+  services.nfs.server = {
+    enable = true;
+    exports = ''
+      /export        10.243.2.4(fsid=0)      10.243.2.85(fsid=0)
+      /export/moodle 10.243.2.4(insecure,rw) 10.243.2.85(insecure,rw)
+    '';
+  };
+}

configs/mpv.nix

@@ -1,14 +1,15 @@
-{ pkgs, ... }: let
+{ pkgs, lib, ... }: let
   swallow = command: "${pkgs.scripts.swallow}/bin/swallow ${command}";
+  nixpkgs-unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
 in {
-  environment.shellAliases.mpv = swallow "mpv";
+  environment.shellAliases.smpv = swallow "mpv";
 
   home-manager.users.me = {
     programs.mpv = {
       enable = true;
       config = {
-        force-window = "yes";
-        ytdl-format = "bestvideo[height<=?720][fps<=?30][vcodec!=?vp9]+bestaudio/best";
+        osc = "no";
+        ytdl-raw-options = lib.concatStringsSep "," [ ''sub-lang="de,en"'' "write-sub=" "write-auto-sub=" ];
       };
       bindings = {
         "Alt+RIGHT" = "add video-rotate 90";
@@ -20,6 +21,10 @@ in {
         "Alt+k" = "add video-pan-y 0.05";
         "Alt+j" = "add video-pan-y -0.05";
       };
+      scripts = [
+        pkgs.mpvScripts.thumbnail
+        nixpkgs-unstable.mpvScripts.youtube-quality
+      ];
     };
   };
 }

configs/neovim.nix

@@ -11,7 +11,6 @@
       vim-colors-paramount = pkgs.callPackage <niveum/packages/vimPlugins/vim-colors-paramount.nix> { };
       vim-256noir = pkgs.callPackage <niveum/packages/vimPlugins/vim-256noir.nix> { };
       icalendar-vim = pkgs.callPackage <niveum/packages/vimPlugins/icalendar-vim.nix> { };
-      todo-txt-vim = pkgs.callPackage <niveum/packages/vimPlugins/todo-txt-vim.nix> { };
       jq-vim = pkgs.callPackage <niveum/packages/vimPlugins/jq-vim.nix> { };
       vim-fsharp = pkgs.callPackage <niveum/packages/vimPlugins/vim-fsharp.nix> { };
       vim-reason-plus = pkgs.callPackage <niveum/packages/vimPlugins/vim-reason-plus.nix> { };
@@ -20,9 +19,10 @@
   };
 
   environment.systemPackages = [
+    (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
     (pkgs.neovim.override {
       configure = {
-        customRC = builtins.readFile <niveum/dot/init.vim>;
+        customRC = builtins.readFile <niveum/lib/vim/init.vim>;
         packages.nvim = with pkgs.vimPlugins; {
           start = [
             # cheat-sh-vim
@@ -60,10 +60,10 @@
             haskell-vim
             icalendar-vim
             idris-vim
+            nim-vim
             jq-vim
             purescript-vim
             rust-vim
-            todo-txt-vim
             typescript-vim
             vim-fsharp
             vim-javascript

configs/networkmanager.nix

@@ -0,0 +1,102 @@
+{ lib, pkgs, ... }:
+let
+  autowifi = pkgs.writers.writePython3Bin "autowifi" { flakeIgnore = [ "E501" ]; } <stockholm/lass/5pkgs/autowifi/autowifi.py>;
+  profile = name: custom: lib.recursiveUpdate {
+    connection.id = name;
+    connection.type = "wifi";
+    connection.interface-name = "wlp3s0";
+    connection.permissions = "";
+    wifi.mac-address-blacklist = "";
+    wifi.ssid = name;
+    wifi.mode = "infrastructure";
+    ipv4.dns-search = "";
+    ipv4.method = "auto";
+    ipv6.addr-gen-mode = "stable-privacy";
+    ipv6.dns-search = "";
+    ipv6.method = "auto";
+    proxy = {};
+  } custom;
+  eduroamProfile = {
+    connection.uuid = "eae9fee6-a7d2-4120-a609-440b457d6fcf";
+    wifi-security = {
+      group = "ccmp;tkip;";
+      key-mgmt = "wpa-eap";
+      pairwise = "ccmp;";
+      proto = "rsn;";
+    };
+    "802-1x" = {
+      altsubject-matches = "DNS:srv1-radius.cms.hu-berlin.de;DNS:srv2-radius.cms.hu-berlin.de;";
+      anonymous-identity = "anonymous@wlan.hu-berlin.de";
+      ca-cert = pkgs.fetchurl {
+        url = "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/t-telesec_globalroot_class_2.pem";
+        sha256 = "0if8aqd06sid7a0vw009zpa087wxcgdd2x6z2zs4pis5kvyqj2dk";
+      };
+      eap = "ttls;";
+      identity = lib.strings.fileContents <secrets/eduroam/identity>;
+      password = lib.strings.fileContents <secrets/eduroam/password>;
+      phase2-auth = "pap";
+    };
+  };
+in
+{
+  imports = [ <niveum/modules/networkmanager-declarative.nix> ];
+
+  networking.networkmanager = {
+    enable = true;
+    wifi.macAddress = "random";
+    ethernet.macAddress = "random";
+    unmanaged = [ "docker*" ];
+    profiles = lib.mapAttrs profile {
+      Aether = {
+        connection.uuid = "7138bb0f-1aeb-4905-890e-a6628427aa21";
+        wifi-security = {
+          psk = lib.strings.fileContents <secrets/wifi/Aether.psk>;
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      FactoryCommunityGuest = {
+        connection.uuid = "fb1f2e52-651e-48b5-a72c-1accddf31afb";
+        connection.timestamp = "1631885129";
+        wifi.seen-bssids = "54:EC:2F:19:30:DC;54:EC:2F:19:5C:9C;54:EC:2F:58:E4:3C;";
+        wifi-security = {
+          psk = "Factory4ever";
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      o2-WLAN66 = {
+        connection.uuid = "c563aec3-f344-4ffb-8d1c-60a6cdac8fe0";
+        wifi-security = {
+          psk = "PK3468KV488T934U";
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      "WIFI@DB".connection.uuid = "4eff4e94-8850-4e9f-a338-1787d0d90479";
+      eduroam = eduroamProfile;
+      eduroam_5GHz = eduroamProfile;
+    };
+  };
+
+  users.users.me.extraGroups = [ "networkmanager" ];
+
+  systemd.services.autowifi = {
+    enable = false;
+    description = "Automatic wifi connector";
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.networkmanager ];
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = "10s";
+      ExecStart = "${autowifi}/bin/autowifi";
+    };
+  };
+
+  networking.networkmanager.dispatcherScripts = [
+    { source = "${pkgs.nur.repos.makefu.prison-break}/bin/prison-break"; }
+  ];
+
+  environment.systemPackages = [ pkgs.speedtest-cli ];
+}

configs/newsboat.nix

@@ -2,8 +2,10 @@
 let
   ytdl-format = "'bestvideo[height<=?720][fps<=?30][vcodec!=?vp9]+bestaudio/best'";
 
+  youtube-download = "${pkgs.ts}/bin/ts ${pkgs.youtube-dl}/bin/youtube-dl -f ${ytdl-format} --add-metadata";
+
   newsboat-home =
-    "${config.users.users.me.home}/cloud/syncthing/common/newsboat";
+    "${config.users.users.me.home}/cloud/Seafile/Documents/newsboat";
   linkhandler-bin = "${pkgs.scripts.linkhandler}/bin/linkhandler";
 
   newsboat-config = pkgs.writeText "config" ''
@@ -22,7 +24,7 @@ let
     macro , open-in-browser
     macro c set browser "${pkgs.xsel}/bin/xsel -b <<<" ; open-in-browser ; set browser ${linkhandler-bin}
     macro v set browser "${pkgs.utillinux}/bin/setsid -f ${pkgs.mpv}/bin/mpv" ; open-in-browser ; set browser ${linkhandler-bin}
-    macro y set browser "${pkgs.ts}/bin/ts ${pkgs.youtube-dl}/bin/youtube-dl -f ${ytdl-format} --add-metadata" ; open-in-browser ; set browser ${linkhandler-bin}
+    macro y set browser "${youtube-download}" ; open-in-browser ; set browser ${linkhandler-bin}
 
     bind-key j down
     bind-key k up
@@ -69,5 +71,11 @@ in {
     '';
   };
 
-  environment.systemPackages = [ pkgs.newsboat ];
+  environment.systemPackages = [
+    pkgs.newsboat
+    (pkgs.writers.writeDashBin "mpv-watch-later" ''
+      ${pkgs.sqlite}/bin/sqlite3 ${newsboat-home}/cache.db "SELECT url FROM rss_item WHERE flags='e' AND deleted=0 ORDER BY pubDate DESC" \
+        | ${pkgs.findutils}/bin/xargs ${pkgs.mpv}/bin/mpv
+    '')
+  ];
 }

configs/nextcloud.nix

@@ -3,35 +3,22 @@ let
   inherit (import <niveum/lib>) localAddresses;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 80 ];
-
-  services.nginx = {
-    enable = true;
-
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-   # Only allow PFS-enabled ciphers with AES256
-   sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-  };
-
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud19;
+    package = pkgs.nextcloud21;
+
+    https = true;
 
     autoUpdateApps = {
       enable = true;
       startAt = "05:00:00";
     };
 
-    hostName = localAddresses.toum;
+    hostName = "cloud.xn--kiern-0qa.de";
 
-    nginx.enable = true;
-    # https = true;
     config = {
-      # overwriteProtocol = "https";
+      overwriteProtocol = "https";
+
       dbtype = "pgsql";
       dbuser = "nextcloud";
       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
@@ -39,7 +26,7 @@ in
       dbpass = lib.strings.fileContents <system-secrets/nextcloud/database>;
       adminpass = lib.strings.fileContents <system-secrets/nextcloud/admin>;
       adminuser = "admin";
-      extraTrustedDomains = [ "toum.r" ];
+      # extraTrustedDomains = [ "toum.r" ];
     };
   };
 
@@ -54,6 +41,12 @@ in
     ];
   };
 
+
+  services.nginx.virtualHosts."cloud.xn--kiern-0qa.de" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
   # Ensure that postgres is running before running the setup
   systemd.services."nextcloud-setup" = {
     requires = ["postgresql.service"];

configs/nix.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  # enable `nix flake`
+  nix = {
+    package = pkgs.nix;
+    # extraOptions = ''
+    #   experimental-features = nix-command
+    # '';
+  };
+}

configs/nixpkgs-unstable.nix

@@ -1,5 +0,0 @@
-{ config, ... }: {
-  nixpkgs.config.packageOverrides = pkgs: {
-    unstable = import <nixpkgs-unstable> { config = config.nixpkgs.config; };
-  };
-}

configs/openweathermap.nix

@@ -0,0 +1,19 @@
+{ pkgs, lib, ... }:
+let
+  openweathermap-repo = pkgs.fetchFromGitHub {
+    owner = "ip1981";
+    repo = "openweathermap";
+    rev = "9cfef7b14ac5af7109449b54b1cb352b4c76167a";
+    sha256 = "0sm43wicvw2fy7nq65s8vch6jjb5bszqr4ilnhibayamj4jcpw53";
+  };
+  openweathermap = pkgs.haskellPackages.callCabal2nix "openweathermap" openweathermap-repo {};
+  openweathermap-key = lib.strings.fileContents <secrets/openweathermap.key>;
+in {
+  nixpkgs.config.packageOverrides = pkgs: {
+    weather = pkgs.writers.writeDashBin "weather" ''
+      ${openweathermap}/bin/openweathermap --api-key ${openweathermap-key} "$@"
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.weather ];
+}

configs/packages/default.nix

@@ -1,4 +1,17 @@
-{ pkgs, lib, ... }: {
+{ pkgs, lib, ... }:
+let
+  hc = pkgs.callPackage <stockholm/tv/5pkgs/simple/hc.nix> {};
+  worldradio = pkgs.callPackage <niveum/packages/worldradio.nix> {};
+  nixpkgs-unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
+
+  recht = pkgs.callPackage (pkgs.fetchFromGitHub {
+    owner = "kmein";
+    repo = "recht";
+    rev = "0.6.2";
+    sha256 = "08gnrnz3lwh8h6fyga56yfy9qryzm89xbshm7wpxfyxf2pmp1qfx";
+  }) {};
+
+in {
   imports = [
     ./krebs.nix
     ./writing.nix
@@ -33,25 +46,21 @@
     # INTERNET
     aria2
     firefox
-    # tor-browser-bundle-bin
-    # qutebrowser
     tdesktop
-    skypeforlinux
     w3m
     wget
-    httpie
     whois
-    ddgr
     ix
-    # thunderbird
     nur.repos.kmein.python3Packages.instaloader
+    dnsutils
     # mtr # my traceroute
     # FILE MANAGERS
     ranger
-    gnome3.nautilus
+    pcmanfm
     # MEDIA
     ffmpeg
     imagemagick
+    exiftool
     scrot
     # ARCHIVE TOOLS
     unzip
@@ -66,20 +75,21 @@
     psmisc # for killall, pstree
     # SHELL
     bat # better cat
-    du-dust # better du
     fd # better find
     file # determine file type
     dos2unix
-    trash-cli
     ncdu # ncurses disk usage
     python3Packages.jsonschema # json validation
     jq # json toolkit
-    jo # json creation
+    pup # html toolkit
+    nixpkgs-unstable.htmlq
     xsv # csv toolkit
     xmlstarlet # xml toolkit
     manpages
     posix_man_pages
     # moreutils # for parallel, sponge, combine
+    tree
+    fuse_exfat # to mount windows drives
     parallel # for parallel, since moreutils shadows task spooler
     ripgrep # better grep
     rlwrap
@@ -97,19 +107,31 @@
     audacity
     calibre
     inkscape
-    zoom-us # video conferencing
+    nixpkgs-unstable.zoom-us # video conferencing
     pdfgrep # search in pdf
     pdftk # pdf toolkit
-    evince # for viewing pdf annotations
-    xournal # for annotating pdfs
+    poppler_utils # pdf toolkit
+    foxitreader # for viewing pdf annotations
+    xournalpp # for annotating pdfs
+    pdfpc # presenter console for pdf slides
+    hc # print files as qr codes
     youtubeDL
     bc # calculator
+    pari # gp -- better calculator
+    scripts.infschmv
+    scripts.new-mac # get a new mac address
+    scripts.scanned
     scripts.default-gateway
     scripts.showkeys-toggle
     scripts.favicon
     scripts.ipa # XSAMPA to IPA converter
+    scripts.playlist
+    scripts.mpv-tv
+    scripts.devanagari
     scripts.betacode # ancient greek betacode to unicode converter
+    scripts.meteo
     nur.repos.kmein.mahlzeit
+    recht
     # nur.repos.kmein.slide
     nur.repos.kmein.vimv
     scripts.swallow # window swallowing
@@ -121,20 +143,49 @@
     scripts.notetags
     scripts.booksplit
     scripts.dmenurandr
+    scripts.interdimensional-cable
     scripts.dmenubluetooth
     scripts.manual-sort
+    scripts.much-scripts
+    scripts.dns-sledgehammer
     ts
     scripts.vg
     scripts.fkill
     scripts.wttr
+    scripts.boetlingk
+    scripts.unicodmenu
+    scripts.trans
+    scripts.liddel-scott-jones
+    scripts.mpv-radio
     # kmein.slide
     scripts.tolino-screensaver
+    scripts.rfc
+    scripts.tag
+    scripts.menu-calc
     nix-prefetch-git
     scripts.nix-git
     nixfmt
     par
     qrencode
     wtf
+
+    (pkgs.writers.writeDashBin "worldradio" ''
+      shuf ${worldradio} | ${pkgs.findutils}/bin/xargs ${pkgs.mpv}/bin/mpv --no-video
+    '')
+
+    (pkgs.writers.writeDashBin "chats" ''
+      ${pkgs.openssh}/bin/ssh makanek "cd /var/lib/weechat/logs && grep --ignore-case --color=always --recursive $@" | ${pkgs.less}/bin/less --raw-control-chars
+    '')
+
+    (pkgs.writers.writeDashBin "ncmpcpp-zaatar" ''MPD_HOST=${(import <niveum/lib/local-network.nix>).zaatar} exec ${pkgs.ncmpcpp}/bin/ncmpcpp "$@"'')
+    (pkgs.writers.writeDashBin "mpc-zaatar" ''MPD_HOST=${(import <niveum/lib/local-network.nix>).zaatar} exec ${pkgs.mpc_cli}/bin/mpc "$@"'')
+
+    nixpkgs-unstable.spotify
+    nixpkgs-unstable.spotify-tui
+    playerctl
+
+    nix-index
+    scripts.nix-index-update
   ];
 
 }

configs/packages/haskell/default.nix

@@ -10,13 +10,14 @@
     '';
     # :def unpl \x -> return $ ":!${pkgs.haskellPackages.pointful}/bin/pointful \"" ++ x ++ "\""
       # :def pl \x -> return $ ":!${pkgs.haskellPackages.pointfree}/bin/pointfree -v \"" ++ x ++ "\""
-    ".stack/config.yaml".text = let inherit (config.niveum) user;
-    in builtins.toJSON {
+    ".stack/config.yaml".source =
+    let inherit (import <niveum/lib>) kieran;
+    in (pkgs.formats.yaml {}).generate "config.yaml" {
       templates.params = {
-        author-name = user.name;
-        author-email = user.email;
-        copyright = "Copyright: (c) 2019 ${user.name}";
-        github-username = user.github;
+        author-name = kieran.name;
+        author-email = kieran.email;
+        copyright = "Copyright: (c) 2020 ${kieran.name}";
+        github-username = kieran.github;
       };
     };
   };
@@ -32,8 +33,7 @@
       cabal2nix
       cabal-install
       hlint
-      haskellPackages.brittany
-      # haskellPackages.hfmt
+      haskellPackages.ormolu
       (haskellPackages.ghcWithHoogle (import ./packages.nix))
     ] ++ map haskell.lib.justStaticExecutables [
       haskellPackages.ghcid

configs/packages/haskell/packages.nix

@@ -87,7 +87,6 @@ with haskellPackages; [
   time
   transformers
   turtle
-  type-unary
   unix-time
   unordered-containers
   vector

configs/packages/krebs.nix

@@ -6,11 +6,9 @@ let
     acronym = pkgs.callPackage <stockholm/lass/5pkgs/acronym> { };
     urban = pkgs.callPackage <stockholm/lass/5pkgs/urban> { };
     mpv-poll = pkgs.callPackage <stockholm/lass/5pkgs/mpv-poll> { };
+    cyberlocker-tools = pkgs.callPackage <stockholm/krebs/5pkgs/simple/cyberlocker-tools> { };
     untilport = pkgs.callPackage <stockholm/krebs/5pkgs/simple/untilport> { };
     kpaste = pkgs.callPackage <stockholm/krebs/5pkgs/simple/kpaste> { };
-    krebspaste = pkgs.callPackage <stockholm/krebs/5pkgs/simple/krebspaste> { };
-    bepasty-client-cli =
-      pkgs.callPackage <stockholm/krebs/5pkgs/simple/bepasty-client-cli> { };
     irc-announce =
       pkgs.callPackage <stockholm/krebs/5pkgs/simple/irc-announce> { };
     git-preview =

configs/packages/python.nix

@@ -7,13 +7,10 @@
       py.pyls-black
       py.pyls-isort
       py.flake8
-      py.flask
       py.pygments
-      py.docopt
       py.schema
-      py.ansicolors
-      py.virtualenv
     ]))
+    pkgs.python3Packages.poetry
   ];
 
   home-manager.users.me.xdg.configFile."pycodestyle".text = ''

configs/packages/writing.nix

@@ -15,17 +15,11 @@ let
     })
     (zoteroStyle {
       name = "din-1505-2";
-      sha256 = if scardanelli then
-        "1pvy1b7qm13mnph7z365rrz1j082bl2y8ih73rhzd0zd6dz1jyjq"
-      else
-        "150kbnxl1r4g1s40khdavv5s6ah10ws135r9k883f6srk78sz6zi";
+      sha256 = "1pvy1b7qm13mnph7z365rrz1j082bl2y8ih73rhzd0zd6dz1jyjq";
     })
     (zoteroStyle {
       name = "apa";
-      sha256 = if scardanelli then
-        "0g8vhp7gnd315h5b60r3zqp49kaq3fkxqnz2v7j2a0zp6s3cisdk"
-      else
-        "1rg41mblmqifba1azb6481dwxhsbl606kf6ysqkqd786f9l9dcf8";
+      sha256 = "1878vxp0y0h05yzaghnd51n981623mxskw3lsdyzmffqhihvv111";
     })
   ];
 
@@ -34,7 +28,6 @@ let
       name = "dic/${name}";
       inherit path;
     }) dicts);
-  scardanelli = config.networking.hostName == "scardanelli";
 in {
   environment.variables.STARDICT_DATA_DIR = toString (makeStardictDataDir [
     {
@@ -67,14 +60,19 @@ in {
 
   environment.systemPackages = with pkgs; [
     texlive.combined.scheme-full
+    latexrun
     (aspellWithDicts (dict: [ dict.de dict.en dict.en-computers ]))
-    haskellPackages.pandoc-citeproc
-    # nur.repos.kmein.text2pdf
+    # haskellPackages.pandoc-citeproc
+    nur.repos.kmein.text2pdf
+    lowdown
+    glow # markdown to term
     libreoffice
-    unstable.pandoc
+    # gnumeric
+    dia
+    pandoc
     # proselint
     asciidoctor
     wordnet
-    sdcv # stardict cli
+    # sdcv # stardict cli
   ];
 }

configs/power-action.nix

@@ -0,0 +1,24 @@
+{ pkgs, config, ... }:
+let
+  suspend = pkgs.writers.writeDash "suspend" "${pkgs.systemd}/bin/systemctl suspend";
+in
+{
+  imports = [ <stockholm/krebs/3modules/power-action.nix> ];
+
+  krebs.power-action = {
+    enable = true;
+    plans.suspend = {
+      upperLimit = 7;
+      lowerLimit = 0;
+      charging = false;
+      action = pkgs.writeDash "suspend-wrapper" ''
+        /run/wrappers/bin/sudo ${suspend}
+      '';
+    };
+    user = config.users.users.me.name;
+  };
+
+  security.sudo.extraConfig = ''
+    ${config.krebs.power-action.user} ALL= (root) NOPASSWD: ${suspend}
+  '';
+}

configs/printing.nix

@@ -13,8 +13,6 @@ in {
     extraBackends = [ hp-driver ];
   };
 
-  users.users.me.extraGroups = [ "scanner" ];
-
   hardware.printers.ensurePrinters = [{
     name = "OfficeJet";
     location = "Zimmer";

configs/radio/default.nix

@@ -0,0 +1,218 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (import <niveum/lib>) tmpfilesConfig;
+
+  radioStore = "/var/lib/radio";
+  htgenPort = 8080;
+  stations = {
+    lyrikline = {
+      streamPort = 8001;
+      mpdPort = 6601;
+      description = ''
+        Weltklang. Welt als ewiges Gedicht, das seine Schallspuren durch Raum und Zeit jagt. Endlose Zufallswiedergabe von <a href="//lyrikline.org">lyrikline</a>. — Listen to the sound of voices and poems permeating linguistic and geographic barriers, 24 hours per day.
+      '';
+    };
+    lyrik = {
+      streamPort = 8002;
+      mpdPort = 6602;
+      description = ''
+        Deutsche Lyrik, die du noch nicht gut genug kennst. Tritt in einen Fluss aus Reim und Maß; keine zwei Mal ist er derselbe.
+      '';
+    };
+  };
+  mpd-add-with-tags = pkgs.writers.writeHaskell "mpd-add-with-tags" {
+    libraries = with pkgs.haskellPackages; [ optparse-generic libmpd ];
+  } ''
+    {-# LANGUAGE DeriveGeneric, OverloadedStrings #-}
+    import Control.Monad (void)
+    import Data.String
+    import Network.MPD
+    import Options.Generic
+
+    data Options = Options { url :: String, artist :: Maybe String, title :: Maybe String }
+      deriving (Generic)
+
+    instance ParseRecord Options
+
+    main :: IO ()
+    main = do
+      options <- getRecord "Add to MPD with tags"
+      void $ withMPD $ do
+        songId <- addId (fromString $ url options) Nothing
+        maybe (pure ()) (addTagId songId Artist . fromString) $ artist options
+        maybe (pure ()) (addTagId songId Title . fromString) $ title options
+  '';
+
+  mpcs = lib.mapAttrs (name: station: pkgs.writers.writeDashBin "mpc-${name}" ''
+    MPD_PORT=${toString station.mpdPort} ${pkgs.mpc_cli}/bin/mpc "$@"
+  '') stations;
+in
+{
+  imports = [ <stockholm/krebs/3modules/htgen.nix> ];
+  nixpkgs.overlays = [
+    (self: super: { htgen = super.callPackage <stockholm/krebs/5pkgs/simple/htgen> {}; })
+  ];
+
+  systemd.tmpfiles.rules = [
+    (tmpfilesConfig {
+      type = "d";
+      path = radioStore;
+      mode = "0755";
+      user = config.users.extraUsers.radio.name;
+      age = "1d";
+    })
+  ];
+
+  users.extraUsers.radio.isSystemUser = true;
+
+  krebs.htgen.radio = {
+    port = htgenPort;
+    user.name = "radio";
+    script = ''. ${pkgs.writers.writeDash "meinskript" ''
+      send200() {
+        printf 'HTTP/1.1 200 OK\r\n'
+        printf 'Content-Type: text/html; charset=UTF-8\r\n'
+        printf 'Connection: close\r\n'
+        printf '\r\n'
+      }
+
+      case "$Method $Request_URI" in
+        "GET /lyrik/status")
+          send200
+          video_id="$(
+            ${mpcs.lyrik}/bin/mpc-lyrik status -f %file% \
+              | head -n1 \
+              | grep -o 'id=[^&]*' \
+              | sed 's/^id=//g'
+          )"
+
+          ${pkgs.youtube-dl}/bin/youtube-dl -j "https://www.youtube.com/watch?v=$video_id" \
+            | ${pkgs.jq}/bin/jq -r '"% [\(.title)](\(.webpage_url))\n\n\(.description)"' \
+            | sed 's/$/  /g' \
+            | ${pkgs.pandoc}/bin/pandoc -s
+
+          exit
+        ;;
+        "GET /lyrikline/status")
+          send200
+
+          hash="$(
+            ${mpcs.lyrikline}/bin/mpc-lyrikline status -f '%file%' \
+              | head -n 1 \
+              | md5sum \
+              | cut -d' ' -f 1
+          )"
+          url="$(cat ${radioStore}/$hash)"
+
+          echo "<html><body style='margin:0'><iframe style='width:100%;height:100%;border:0' src="$url"></iframe></body></html>"
+          exit
+        ;;
+      esac
+    ''}'';
+  };
+
+  containers = lib.mapAttrs (name: station: {
+    autoStart = true;
+    config = {config, pkgs, ...}: {
+      services.mpd = {
+        enable = true;
+        network.port = station.mpdPort;
+        extraConfig = ''
+          log_level "default"
+
+          audio_output {
+            name "${name}"
+            type "httpd"
+            encoder "vorbis"
+            port "${toString station.streamPort}"
+            bitrate "128"
+            format "44100:16:2"
+            always_on "yes"
+            tags "yes"
+          }
+        '';
+      };
+    };
+  }) stations;
+
+  environment.systemPackages = lib.attrValues mpcs;
+
+  systemd.services.lyrikline = {
+    after = [ "container@lyrikline.service" ];
+    wantedBy = [ "container@lyrikline.service" ];
+    startAt = "*:00/5";
+    serviceConfig.User = config.users.extraUsers.radio.name;
+    preStart = "${mpcs.lyrikline}/bin/mpc-lyrikline crop || :";
+    script = ''
+      set -efu
+
+      lyrikline=https://www.lyrikline.org
+      for _ in $(seq 1 10); do
+        random_route="$(${pkgs.curl}/bin/curl -sSL "$lyrikline/index.php/tools/getrandompoem" --data-raw 'lang=de' --compressed | ${pkgs.jq}/bin/jq -r .link)"
+        poem_url="$lyrikline$random_route"
+
+        poem_file="$(
+          ${pkgs.curl}/bin/curl -sSL "$poem_url" \
+            | grep -o 'https://.*\.mp3' \
+            | head -n1
+        )"
+
+        hash="$(echo "$poem_file" | md5sum | cut -d' ' -f 1)"
+        echo "$poem_file ($hash) -> $poem_url"
+        echo "$poem_url" > "${radioStore}/$hash"
+
+        ${mpcs.lyrikline}/bin/mpc-lyrikline add "$poem_file"
+      done
+
+      ${mpcs.lyrikline}/bin/mpc-lyrikline play
+    '';
+  };
+
+  systemd.services.lyrik = {
+    after = [ "container@lyrik.service" ];
+    wantedBy = [ "container@lyrik.service" ];
+    preStart = "${mpcs.lyrik}/bin/mpc-lyrik crop || :";
+    restartIfChanged = true;
+    serviceConfig.User = config.users.extraUsers.radio.name;
+    script =
+      let
+        invidious = "https://invidious.silkky.cloud";
+        videoIds = import <niveum/lib/hot-rotation/lyrik.nix>;
+        streams = lib.concatMapStringsSep "\n" (id: "${invidious}/latest_version?id=${id}&itag=251") videoIds;
+        streamsFile = pkgs.writeText "hotrot" streams;
+      in ''
+        set -efu
+        ${mpcs.lyrik}/bin/mpc-lyrik add < ${toString streamsFile}
+
+        ${mpcs.lyrik}/bin/mpc-lyrik crossfade 5
+        ${mpcs.lyrik}/bin/mpc-lyrik random on
+        ${mpcs.lyrik}/bin/mpc-lyrik repeat on
+        ${mpcs.lyrik}/bin/mpc-lyrik play
+      '';
+  };
+
+
+  services.nginx.virtualHosts."radio.xn--kiern-0qa.de" = {
+    enableACME = true;
+    forceSSL = true;
+    locations = lib.mkMerge (
+      [
+        {
+          "/".extraConfig = ''
+            default_type "text/html";
+            root ${pkgs.linkFarm "station-list" [{
+              name = "index.html";
+              path = import ./station-list.nix { inherit pkgs lib stations; };
+            }]};
+            index index.html;
+          '';
+          # skip
+        }
+      ] ++ (lib.mapAttrsToList (name: station: {
+        "= /${name}/status".proxyPass = "http://127.0.0.1:${toString htgenPort}";
+        "= /${name}/listen.ogg".proxyPass = "http://127.0.0.1:${toString station.streamPort}";
+        "= /${name}.ogg".return = "301 http://radio.xn--kiern-0qa.de/${name}/listen.ogg"; # legacy
+      }) stations)
+    );
+  };
+}

configs/radio/station-list.nix

@@ -0,0 +1,43 @@
+{ pkgs, lib, stations }:
+let
+  theStations = lib.mapAttrsToList (name: value: value // {name = name;}) stations;
+in
+pkgs.writeText "index.html" ''
+  <!doctype html>
+  <html>
+    <head>
+      <title>radio.kierán</title>
+      <link
+        rel="stylesheet"
+        href="//cdn.rawgit.com/necolas/normalize.css/master/normalize.css"
+      />
+      <link
+        rel="stylesheet"
+        href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.9.2/css/bulma.min.css"
+      />
+      <meta name="viewport" content="width=device-width, initial-scale=1" />
+      <meta charset="utf-8" />
+    </head>
+    <body>
+      <main class="section">
+        <div class="subtitle is-3">Welcome to</div>
+        <h1 class="title is-1">radio.kierán</h1>
+
+        <div class="columns is-multiline">
+          ${lib.concatMapStringsSep "\n" (station: ''
+            <div class="column">
+              <div class="box">
+                <strong class="is-uppercase">${station.name}</strong>
+                (<a href="/${station.name}/status">status</a>, <a href="/${station.name}/listen.ogg">link</a>)
+
+                <p class="has-text-grey">${station.description}</p>
+                <hr/>
+                <audio style="width:100%" controls src="/${station.name}/listen.ogg"/>
+              </div>
+            </div>'') theStations
+          }
+        </div>
+      </main>
+    </body>
+  </html>
+''

configs/retiolum.nix

@@ -1,10 +1,7 @@
 { config, pkgs, ... }: {
-  imports = [ <niveum/modules/retiolum.nix> ];
+  imports = [
+    <niveum/modules/retiolum.nix>
+  ];
 
   networking.hosts = { "42:0:ca48:f98f:63d7:31ce:922b:245d" = [ "go" ]; };
-
-  environment.etc."tinc/retiolum/rsa_key.priv" = {
-    text = builtins.readFile <system-secrets/retiolum.key>;
-    mode = "400";
-  };
 }

configs/rofi.nix

@@ -1,12 +1,14 @@
 { config, ... }:
-with config.niveum; {
+let
+  inherit (import <niveum/lib>) colours;
+in{
   home-manager.users.me.programs.rofi = {
     enable = true;
     separator = "solid";
     scrollbar = false;
     borderWidth = 0;
     lines = 5;
-    font = "Monospace ${toString (fonts.size - 1)}";
+    font = "Monospace 10";
     colors = rec {
       window = rec {
         background = colours.foreground;

configs/save-space.nix

@@ -3,6 +3,7 @@
   documentation.enable = false;
   documentation.info.enable = false;
   documentation.man.enable = false;
+  documentation.man.generateCaches = false;
   fonts.fontconfig.enable = false;
   nix.gc.automatic = true;
   nix.optimise.automatic = true;

configs/seafile.nix

@@ -0,0 +1,20 @@
+{ pkgs, config, ... }:
+{
+  services.xserver.displayManager.sessionCommands = "${pkgs.seafile-client}/bin/seafile-applet &";
+
+  home-manager.users.me.xdg.configFile = {
+    "Seafile/Seafile Client.conf".source = (pkgs.formats.ini {}).generate "Seafile Client.conf" {
+      Behavior = {
+        hideDockIcon = false;
+        hideMainWindowWhenStarted = true;
+      };
+      Settings = {
+        computerName = config.networking.hostName;
+        lastShiburl = "https://box.hu-berlin.de";
+      };
+      UsedServerAddresses.main = "https://box.hu-berlin.de";
+    };
+  };
+
+  environment.systemPackages = [ pkgs.seafile-client ];
+}

configs/spacetime.nix

@@ -0,0 +1,7 @@
+{
+  time.timeZone = "Europe/Berlin";
+  location = {
+    latitude = 52.517;
+    longitude = 13.3872;
+  };
+}

configs/spotify.nix

@@ -1,42 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  inherit (lib.strings) fileContents;
-in {
-  environment.systemPackages = with pkgs; [ spotify spotify-tui playerctl ];
-
-  # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/audio/spotifyd.nix
-  systemd.user.services.spotifyd = let
-    spotifyd = pkgs.unstable.spotifyd.override {
-      withMpris = true;
-      withPulseAudio = true;
-      inherit (pkgs) libpulseaudio dbus;
-    };
-    spotifydConf = pkgs.writeText "spotifyd.conf" (lib.generators.toINI { } {
-      global = {
-        username = fileContents <secrets/spotify/username>;
-        password = fileContents <secrets/spotify/password>;
-        backend = "pulseaudio";
-        on_song_change_hook = toString (pkgs.writers.writeDash "songinfo" ''
-          PATH=$PATH:${
-            lib.makeBinPath [ pkgs.playerctl pkgs.gawk pkgs.libnotify ]
-          }
-          metadata=$(playerctl metadata --player spotifyd)
-          title=$(echo "$metadata" | awk '/^xesam:title\s/ { print substr($0, index($0, $3)) }')
-          artist=$(echo "$metadata" | awk '/^xesam:artist\s/ { print substr($0, index($0, $3)) }' | paste --serial --delimiters "/")
-          album=$(echo "$metadata" | awk '/^xesam:album\s/ { print substr($0, index($0, $3)) }')
-          notify-send --app-name=" Spotify" "$title" "$artist – $album"
-        '');
-      };
-    });
-  in {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" "sound.target" ];
-    description = "spotifyd, a Spotify playing daemon";
-    serviceConfig = {
-      ExecStart =
-        "${spotifyd}/bin/spotifyd --no-daemon --config-path ${spotifydConf}";
-      Restart = "always";
-      RestartSec = 12;
-    };
-  };
-}

configs/spotifyd.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, lib, ... }:
+{
+  imports = [ <niveum/modules/spotifyd.nix> ];
+  disabledModules = [ "services/audio/spotifyd.nix" ];
+
+  services.spotifyd = {
+    enable = true;
+    settings = {
+      global = {
+        username = lib.strings.fileContents <secrets/spotify/username>;
+        password = lib.strings.fileContents <secrets/spotify/password>;
+        backend = "pulseaudio";
+        bitrate = 320;
+        device_type = "s_t_b"; # set-top box
+        device_name = config.networking.hostName;
+      };
+    };
+  };
+
+  # ref https://github.com/NixOS/nixpkgs/issues/71362#issuecomment-753461502
+  hardware.pulseaudio.extraConfig = ''
+    unload-module module-native-protocol-unix
+    load-module module-native-protocol-unix auth-anonymous=1
+  '';
+
+  systemd.services.spotifyd.serviceConfig.Restart = "always";
+}

configs/ssh.nix

@@ -1,27 +1,12 @@
 { pkgs, config, lib, ... }:
 let
-  sshPort = 22022;
-  kmeinKeys = lib.strings.splitString "\n" (lib.strings.fileContents (pkgs.fetchurl {
-    url = "https://github.com/kmein.keys";
-    sha256 = "1b9gbpgihg7zc89ivsz0gs3najp0zg53rcknvzvkm0851fdzkryx";
-  }));
+  inherit (import <niveum/lib>) sshPort kieran;
 in {
-  services.xserver.displayManager.sessionCommands =
-    "${pkgs.openssh}/bin/ssh-add";
+  services.xserver.displayManager.sessionCommands = "${pkgs.openssh}/bin/ssh-add";
 
   programs.ssh.startAgent = true;
 
-  services.openssh = {
-    ports = [ sshPort ];
-    enable = true;
-    passwordAuthentication = false;
-    forwardX11 = true;
-  };
-
-  users.motd = "Welcome to ${config.networking.hostName}!";
-
-  users.users.root.openssh.authorizedKeys.keys = kmeinKeys;
-  users.users.me.openssh.authorizedKeys.keys = kmeinKeys;
+  users.users.me.openssh.authorizedKeys.keys = kieran.sshKeys pkgs;
 
   home-manager.users.me.programs.ssh = {
     enable = true;
@@ -30,25 +15,38 @@ in {
         hostname = "ssh.github.com";
         port = 443;
       };
-      scardanelli = {
-        hostname = "scardanelli.r";
-        user = "kfm";
+      zaatar = {
+        hostname = "zaatar.r";
+        user = "root";
         port = sshPort;
       };
-      homeros = {
-        hostname = "homeros.r";
+      makanek = {
+        hostname = "makanek.r";
+        user = "root";
+        port = sshPort;
+      };
+      manakish = {
+        hostname = "manakish.r";
         user = "kfm";
         port = sshPort;
       };
       toum = {
         hostname = "toum.r";
+        user = "root";
+        port = sshPort;
+      };
+      kabsa = {
+        hostname = "kabsa.r";
         user = "kfm";
         port = sshPort;
       };
-      wilde = {
-        hostname = "wilde.r";
-        user = "kfm";
-        port = sshPort;
+      "nextcloud.fysi.dev" = {
+        hostname = "116.203.82.203";
+        user = "root";
+      };
+      "lingua.miaengiadina.ch" = {
+        hostname = "135.181.85.233";
+        user = "root";
       };
     };
   };

configs/sshd.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (import <niveum/lib>) sshPort kieran;
+in
+{
+  users.motd = "Welcome to ${config.networking.hostName}!";
+
+  services.openssh = {
+    enable = true;
+    ports = [ sshPort ];
+    passwordAuthentication = false;
+    forwardX11 = true;
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = kieran.sshKeys pkgs;
+}

configs/telegram-bots/autorenkalender.nix

@@ -3,8 +3,8 @@ let
   autorenkalender-package = pkgs.fetchFromGitHub {
     owner = "kmein";
     repo = "autorenkalender";
-    rev = "1971f082ec6e14d392a0dc3ac62e0b1e4187409b";
-    sha256 = "0hipj616vcsa3f62s83jvlx8zx4bmbgl5h2n4w8ba5ngp40lkmb3";
+    rev = "cf49a7b057301332d980eb47042a626add93db66";
+    sha256 = "1pa7sjg33vdnjianrqldv445jdzzv3mn231ljk1j58hs0cd505gs";
   };
   autorenkalender =
     pkgs.python3Packages.callPackage autorenkalender-package { };

configs/telegram-bots/default.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+let
+  telebots = let
+    telebots-package = pkgs.fetchFromGitHub {
+      owner = "kmein";
+      repo = "telebots";
+      rev = "22931c9457e092c4e413555dbe61819d77844246";
+      sha256 = "0byp3w6li3fin7ry0ki4rmgkaajdil424y5pc1j7ci9mpws0s5ik";
+    };
+  in pkgs.callPackage telebots-package {};
+  reverseDirectory = "/run/telegram-reverse";
+  proverbDirectory = "/run/telegram-proverb";
+  inherit (import <niveum/lib>) tmpfilesConfig;
+in {
+  imports = [
+    ./literature-quote.nix
+    ./autorenkalender.nix
+    ./nachtischsatan.nix
+    ./tlg-wotd.nix
+    <niveum/modules/telegram-bot.nix>
+  ];
+
+  systemd.tmpfiles.rules = map (path: tmpfilesConfig {
+    type = "d";
+    mode = "0750";
+    age = "1h";
+    inherit path;
+  }) [ reverseDirectory proverbDirectory ];
+
+  systemd.services.telegram-reverse = {
+    wantedBy = [ "multi-user.target" ];
+    description = "Telegram reverse bot";
+    path = [ pkgs.ffmpeg ];
+    environment.TELEGRAM_BOT_TOKEN = lib.strings.fileContents <system-secrets/telegram/reverse.token>;
+    enable = true;
+    script = "${telebots}/bin/telegram-reverse";
+    serviceConfig.Restart = "always";
+    serviceConfig.WorkingDirectory = reverseDirectory;
+  };
+
+  systemd.services.telegram-betacode = {
+    wantedBy = [ "multi-user.target" ];
+    description = "Telegram beta code bot";
+    environment.TELEGRAM_BOT_TOKEN = lib.strings.fileContents <system-secrets/telegram/betacode.token>;
+    enable = true;
+    script = "${telebots}/bin/telegram-betacode";
+    serviceConfig.Restart = "always";
+  };
+
+  systemd.services.telegram-proverb = {
+    wantedBy = [ "multi-user.target" ];
+    description = "Telegram proverb bot";
+    environment.TELEGRAM_BOT_TOKEN = lib.strings.fileContents <system-secrets/telegram/proverb.token>;
+    enable = true;
+    script = "${telebots}/bin/telegram-proverb";
+    serviceConfig.Restart = "always";
+    serviceConfig.WorkingDirectory = proverbDirectory;
+  };
+}

configs/telegram-bots/nachtischsatan.nix

@@ -4,24 +4,20 @@ let
     pkgs.writers.writePython3 "nachtischsatan-bot" {
       libraries = [ pkgs.python3Packages.python-telegram-bot ];
     } ''
+      from telegram.ext import Updater, MessageHandler
+      from telegram.ext.filters import Filters
       import random
       import time
 
-      from telegram.ext import Updater, MessageHandler
-      from telegram.ext.filters import Filters
 
-
-      def flubber(bot, update):
+      def flubber(update, context):
           time.sleep(random.randrange(4000) / 1000)
           update.message.reply_text("*flubberflubber*")
 
 
-      updater = Updater(
-        '${token}'
-      )
+      updater = Updater('${token}')
 
       updater.dispatcher.add_handler(MessageHandler(Filters.all, flubber))
-
       updater.start_polling()
       updater.idle()
     '';

configs/telegram-bots/tlg-wotd.nix

@@ -0,0 +1,17 @@
+{ pkgs, lib, ... }:
+{
+  niveum.telegramBots.tlg-wotd = {
+    enable = true;
+    time = "9:30";
+    token = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
+    chatIds = [ "@tlgwotd" ];
+    command = toString (pkgs.writers.writeDash "tlg-wotd" ''
+      ${pkgs.curl}/bin/curl -sSL http://stephanus.tlg.uci.edu/Iris/Wotd \
+      | ${pkgs.recode}/bin/recode html..utf8 \
+      | ${pkgs.jq}/bin/jq -r '
+        "*\(.word)* '\'''\(.definition | rtrimstr(" "))'\'''\n\nFirst occurrence: \(.firstOccurrence)\nNumber of occurrences: \(.totalOccurrences)"
+      '
+    '');
+    parseMode = "Markdown";
+  };
+}

configs/themes/antares.nix

@@ -1,39 +0,0 @@
-{
-  niveum.colours = rec {
-    black = {
-      bright = "#151515";
-      dark = "#000000";
-    };
-    red = {
-      bright = "#de575c";
-      dark = "#de575c";
-    };
-    yellow = {
-      bright = "#ebe971";
-      dark = "#ebe971";
-    };
-    green = {
-      bright = "#00b853";
-      dark = "#00b853";
-    };
-    blue = {
-      bright = "#90d0f0";
-      dark = "#7fc6f0";
-    };
-    magenta = {
-      bright = "#cf9ffa";
-      dark = "#cf9ffa";
-    };
-    cyan = {
-      bright = "#4ae5e8";
-      dark = "#4ae5e8";
-    };
-    white = {
-      bright = "#ffffff";
-      dark = "#bbbbbb";
-    };
-    background = black.dark;
-    foreground = white.dark;
-    cursor = green.bright;
-  };
-}

configs/themes/apprentice.nix

@@ -1,39 +0,0 @@
-{
-  niveum.colours = {
-    black = {
-      bright = "#444444";
-      dark = "#1c1c1c";
-    };
-    red = {
-      bright = "#ff8700";
-      dark = "#af5f5f";
-    };
-    green = {
-      bright = "#87af87";
-      dark = "#5f875f";
-    };
-    yellow = {
-      bright = "#ffffaf";
-      dark = "#87875f";
-    };
-    blue = {
-      bright = "#8fafd7";
-      dark = "#5f87af";
-    };
-    magenta = {
-      bright = "#8787af";
-      dark = "#5f5f87";
-    };
-    cyan = {
-      bright = "#5fafaf";
-      dark = "#5f8787";
-    };
-    white = {
-      bright = "#999999";
-      dark = "#6c6c6c";
-    };
-    background = "#262626";
-    foreground = "#bcbcbc";
-    cursor = "#bcbcbc";
-  };
-}