fix zaatar build: move printer groups to configs/default.nix

printing.nix can't conditionally set users.users.me.extraGroups —
any mention of users.users.me in the module system creates the user
entry and triggers the isNormalUser/isSystemUser assertion on machines
without a 'me' user (like zaatar).

Move lp/scanner groups to configs/default.nix where users.users.me is
defined. On zaatar, root gets lp/scanner groups directly.

.bin/256color

@@ -1,38 +0,0 @@
-#! /bin/sh
-set -euf
-
-pl() {
-  for i in $(seq $1 $(expr $2 - 1)); do
-    printf '\e[38;5;%sm%03i\e[m ' $i $i
-  done
-  printf '\e[38;5;%sm%03i\e[m\n' $2 $2
-}
-
-p() {
-  printf '\e[38;5;%sm%03i\e[m ' $1 $1
-}
-pn() {
-  printf '\e[38;5;%sm%03i\e[m\n' $1 $1
-}
-
-p6x6() {
-  for i in $(seq 0 5); do
-    for j in $(seq 0 5); do
-      p $(expr $1 + $i + $j \* 6)
-    done
-    echo
-  done
-}
-
-pl 0 7
-pl 8 15
-
-p6x6 16
-p6x6 52
-p6x6 88
-p6x6 124
-p6x6 160
-p6x6 196
-
-pl 232 243
-pl 244 255

.bin/anki-poem.sh

@@ -1,29 +0,0 @@
-#!/bin/sh
-file="${1?please supply a poetry file}"
-[ -f "$file" ] || {
-  echo "'$file' is no file"
-  exit 1
-}
-
-poem="$(mktemp)"
-clean () {
-  rm "$poem"
-}
-trap clean EXIT
-sed '/^$/d' "$file" > "$poem"
-
-htmlize() {
-  awk 'ORS="<br/>"' \
-    | head -c -5          # remove final <br/> characters
-}
-
-for line_number in $(seq 1 "$(wc -l "$poem" | cut -d' ' -f1)"); do
-  if [ "$line_number" -gt 3 ] && [ "$line_number" -gt 1 ]; then
-    sed -n "$((line_number - 3)),$((line_number - 1))p" "$poem"
-  else
-    sed -n "1,$((line_number - 1))p" "$poem"
-  fi | htmlize
-  printf '\t'
-  sed -n "${line_number},+1p" "$poem" | htmlize
-  printf '\n'
-done

.bin/avesta.sed

@@ -1,54 +0,0 @@
-#!/usr/bin/env -S sed -f
-s/ā̊/𐬃/g
-s/t̰/𐬝/g
-s/ṣ̌/𐬴/g
-s/š́/𐬳/g
-s/ą̄/𐬅/g
-s/ŋᵛ/𐬤/g
-s/ə̄/𐬇/g
-s/ŋ́/𐬣/g
-s/x́/𐬒/g
-s/xᵛ/𐬓/g
-s/a/𐬀/g
-s/ā/𐬁/g
-s/å/𐬂/g
-s/ą/𐬄/g
-s/ə/𐬆/g
-s/e/𐬈/g
-s/ē/𐬉/g
-s/o/𐬊/g
-s/ō/𐬋/g
-s/i/𐬌/g
-s/ī/𐬍/g
-s/u/𐬎/g
-s/ū/𐬏/g
-s/k/𐬐/g
-s/x/𐬑/g
-s/g/𐬔/g
-s/ġ/𐬕/g
-s/γ/𐬖/g
-s/c/𐬗/g
-s/j/𐬘/g
-s/t/𐬙/g
-s/θ/𐬚/g
-s/d/𐬛/g
-s/δ/𐬜/g
-s/p/𐬞/g
-s/f/𐬟/g
-s/b/𐬠/g
-s/β/𐬡/g
-s/ŋ/𐬢/g
-s/n/𐬥/g
-s/ń/𐬦/g
-s/ṇ/𐬧/g
-s/m/𐬨/g
-s/m̨/𐬩/g
-s/ẏ/𐬫/g
-s/y/𐬪/g
-s/v/𐬬/g
-s/r/𐬭/g
-s/s/𐬯/g
-s/z/𐬰/g
-s/š/𐬱/g
-s/ž/𐬲/g
-s/h/𐬵/g

.bin/browser

@@ -1,24 +0,0 @@
-#!/bin/sh -e
-#
-# Usage: browser
-#        pipe html to a browser
-# e.g.
-#  $ echo '<h1>hi mom!</h1>' | browser
-#  $ ron -5 man/rip.5.ron | browser   
-
-if [ -t 0 ]; then
-  if [ -n "$1" ]; then
-    open $1
-  else
-    cat <<usage
-Usage: browser
-       pipe html to a browser
-$ echo '<h1>hi mom!</h1>' | browser
-$ ron -5 man/rip.5.ron | browser
-usage
-fi
-else
-  f="/tmp/browser.$RANDOM.html"
-  cat /dev/stdin > $f
-  xdg-open $f
-fi

.bin/bvg.sh

@@ -1,46 +0,0 @@
-#!/bin/sh
-interesting="U6 N6 140 M46 184 N84"
-
-curl -sSL 'https://www.bvg.de/disruption-reports/q' \
-  --data-raw '{"variables":{},"query":"{
-    allDisruptions {
-      disruptions {
-        meldungsId
-        linie
-        verkehrsmittel
-        __typename
-        ... on Traffic {
-          datum
-          gueltigVonDatum
-          gueltigVonZeit
-          gueltigBisDatum
-          gueltigBisZeit
-          richtungName
-          richtungHafasId
-          beginnAbschnittName
-          beginnAbschnittHafasId
-          endeAbschnittName
-          endeAbschnittHafasId
-          textIntUrsache
-          sev
-          textIntAuswirkung
-          umfahrung
-          textWAPSMSUrsache
-          textWAPSMSAuswirkung
-          prioritaet
-          __typename
-        }
-      }
-      __typename
-    }
-  }"}' \
-  | jq --arg interesting "$interesting" '
-    .data.allDisruptions.disruptions
-    | map(select(
-      (.linie as $linie
-      | $interesting
-      | split(" ")
-      | index($linie))
-      and (.["__typename"] == "Traffic")
-    ))
-  '

.bin/calendars.sh

@@ -1,19 +0,0 @@
-#!/bin/sh
-
-directory="$(mktemp -d)"
-trap clean EXIT
-clean() {
-  rm -rf "$directory"
-}
-
-year=$(date +%Y)
-output=/tmp/$year.pdf
-
-for month in $(seq 1 12); do
-  printf "\r%d" "$month" 1>&2
-  astrolog -zN Berlin -qm "$month" "$year" -X -K -XA -Xr -Xm -Xb -Xo "$(printf "%s/%02d.bmp" "$directory" "$month")" -Xw 1080 720 2>/dev/null
-done
-printf "\r"
-
-convert "$directory/*.bmp" "$output"
-echo "$output"

.bin/candyman

@@ -1,25 +0,0 @@
-#!/bin/sh
-set -efu
-
-usage() {
-  echo >&2 "$0 add-{reddit,telegram,youtube,twitch,twitter} NAME"
-  exit 1
-}
-
-candyman() {
-  curl -fsSv http://news.r/api -H content-type:application/json -d "$(jq -n "
-    {
-      command: \"PRIVMSG\",
-      params: [\"#all\", \"candyman: $1 $2\"]
-    }
-  ")"
-}
-
-[ $# -ge 2 ] || usage
-
-case "$1" in
-  add-reddit|add-telegram|add-youtube|add-twitter|add-twitch)
-    candyman "$@"
-  ;;
-  *) usage;;
-esac

.bin/chunk-pdf

@@ -1,23 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p pdftk gnugrep
-set -efu
-
-INPUT_FILE="${2:?Pass the PDF path as second argument.}"
-PAGES_PER_REPORT="${1:?Pass the chunk size as first argument.}"
-
-if [ ! -f "$INPUT_FILE" ]; then
-  echo >&2 "File $INPUT_FILE does not exist."
-  exit 1
-fi
-
-TOTAL_PAGES="$(pdftk "$INPUT_FILE" dump_data | grep NumberOfPages | cut -f2 -d' ')"
-
-RUNS=$((TOTAL_PAGES/PAGES_PER_REPORT))
-
-for run in $(seq 0 "$((RUNS-1))"); do
-  start_page=$((run*PAGES_PER_REPORT+1))
-  end_page=$(((run+1)*PAGES_PER_REPORT))
-  output_file="chunk_$((run+1)).pdf"
-  echo "splitting $INPUT_FILE from $start_page to $end_page into $output_file"
-  pdftk "$INPUT_FILE" cat "$start_page-$end_page" output "$output_file"
-done

.bin/countdown

@@ -1,13 +0,0 @@
-#!/usr/bin/env -S awk -f
-function z() {
-  getline < "/proc/uptime"
-  close("/proc/uptime")
-  return $0
-}
-BEGIN {
-  x = z()
-  while (1) {
-    y = z()
-    printf "%02d:%05.2f\r", (y - x) / 60, (y - x) % 60
-  }
-}

.bin/csv2json

@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-
-import csv
-import json
-import sys
-import argparse
-
-parser = argparse.ArgumentParser()
-parser.add_argument("--delimiter", "-d", default=",", help="CSV field separator")
-
-args = parser.parse_args()
-
-if __name__ == "__main__":
-    json.dump(list(csv.DictReader(sys.stdin, delimiter=args.delimiter)), sys.stdout)

.bin/dummy-alert

@@ -1,43 +0,0 @@
-#!/bin/bash
-
-name=$RANDOM
-url='http://localhost:9093/api/v1/alerts'
-
-echo "firing up alert $name"
-
-# change url o
-curl -XPOST $url -d "[{
-	\"status\": \"firing\",
-	\"labels\": {
-		\"alertname\": \"$name\",
-		\"service\": \"my-service\",
-		\"severity\":\"warning\",
-		\"instance\": \"$name.example.net\"
-	},
-	\"annotations\": {
-		\"summary\": \"High latency is high!\"
-	},
-	\"generatorURL\": \"http://prometheus.int.example.net/<generating_expression>\"
-}]"
-
-echo ""
-
-echo "press enter to resolve alert"
-read
-
-echo "sending resolve"
-curl -XPOST $url -d "[{
-	\"status\": \"resolved\",
-	\"labels\": {
-		\"alertname\": \"$name\",
-		\"service\": \"my-service\",
-		\"severity\":\"warning\",
-		\"instance\": \"$name.example.net\"
-	},
-	\"annotations\": {
-		\"summary\": \"High latency is high!\"
-	},
-	\"generatorURL\": \"http://prometheus.int.example.net/<generating_expression>\"
-}]"
-
-echo ""

.bin/elm-publish-private

@@ -1,7 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -p "(import <nixpkgs> { overlays = [ (import ~/work/fysiweb/engiadina-pwa/devops/pkgs) ]; }).elm-publish-private"
-#! nix-shell -i bash
-
-set -efux
-
-exec elm-publish-private "$@"

.bin/fix-sd.sh

@@ -1,21 +0,0 @@
-#!/bin/sh
-set -xfu
-
-drive="$1"
-mountpoint="/media/sd-card-$(date +%s)"
-backup_directory="$(pwd)"
-
-trap clean EXIT
-clean() {
-  umount "$mountpoint"
-  rmdir "$mountpoint"
-  fsck.exfat "$drive"
-}
-
-filenames="$(fsck.exfat "$drive" 2>&1 | sed -nE "s/.* file '(.*?)' is not allocated.*/\1/p")"
-mkdir "$mountpoint"
-mount "$drive" "$mountpoint"
-
-echo "$filenames" | while read -r filename; do
-  find "$mountpoint" -type f -name "$filename" -exec mv {} "$backup_directory" \;
-done

.bin/horoscope.sh

@@ -1,34 +0,0 @@
-#!/bin/sh
-set -efu
-
-# Berlin:  -d lodeg=13 -d lomin=22 -d losec=41 -d lodir=E -d ladeg=52 -d lamin=27 -d lasec=42 -d ladir=N -d usecoords=1 \
-# Kassel:  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
-
-
-[ $# -eq 1 ] || {
-  echo >&2 Usage: "$0" TIMESTAMP
-  exit 1
-}
-
-export TZ=UTC
-
-chart_path="$(mktemp /tmp/chart_XXX.pdf)"
-
-timestamp="$1"
-
-year="$(date -d "@$timestamp" +%Y)"
-month="$(date -d "@$timestamp" +%m)"
-day="$(date -d "@$timestamp" +%d)"
-hour="$(date -d "@$timestamp" +%H)"
-minute="$(date -d "@$timestamp" +%M)"
-
-curl -sSL 'https://edifyingfellowship.org/astro/' \
-  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
-  -d ybyr="$year" -d ybmo="$month" -d ybdy="$day" -d ybhr="$hour" -d ybmi="$minute" -d ybsc=0 -d ybtz="$TZ" \
-  -d currenttime=0 \
-  -d title="$timestamp" \
-  -d options[]=VancouverWheel -d options[]=Arrow -d options[]=XBold -d options[]=HouseLabels -d options[]=Placidus \
-  -d options[]=Sun -d options[]=Moon -d options[]=Mercury -d options[]=Venus -d options[]=Mars -d options[]=Jupiter -d options[]=Saturn -d options[]=Uranus -d options[]=Neptune -d options[]=Pluto -d options[]=Ascendant -d options[]=MC -d options[]=Lilith -d options[]=MeanNode -d options[]=TrueNode \
-  -d aspectpct=100 -d format=PDF -d Submit= -o "$chart_path"
-
-zathura "$chart_path"

.bin/json2csv

@@ -1,24 +0,0 @@
-#!/usr/bin/env python3
-import csv
-import json
-import sys
-
-if __name__ == "__main__":
-    json_list = json.load(sys.stdin)
-    if not isinstance(json_list, list):
-        print("JSON object is not a list.", file=sys.stderr)
-        sys.exit(1)
-    if len(json_list) == 0:
-        print("JSON list is empty.", file=sys.stderr)
-        sys.exit(1)
-    keys = set()
-    for element in json_list:
-        if isinstance(element, dict):
-            keys |= element.keys()
-        else:
-            print("Non-dict element:", element, file=sys.stderr)
-            sys.exit(1)
-    writer = csv.DictWriter(sys.stdout, fieldnames=list(keys))
-    writer.writeheader()
-    for element in json_list:
-        writer.writerow(element)

.bin/json2csv.jq

@@ -1,5 +0,0 @@
-#!/usr/bin/env -S jq -r -f
-(map(keys) | add | unique) as $cols
-| map(. as $row | $cols | map($row[.])) as $rows
-| $cols, $rows[]
-| @csv

.bin/libib.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-session_id=7b638c194d9bda74f80043045018cc9e
-
-declare -A libraries
-
-libraries["Literatur"]=344428
-libraries["Sprache"]=344160
-libraries["Miscellanea"]=344427
-libraries["Wissenschaft"]=344429
-libraries["Relicta"]=565920
-
-for library in ${!libraries[@]}
-do
-  curl -sSL 'https://www.libib.com/library/functions/csv-export.php' -H "Cookie: PHPSESSID=$session_id" -d export="${libraries[$library]}" > "$library.csv"
-done

.bin/lieferando.sh

@@ -1,81 +0,0 @@
-#!/bin/sh
-set -efu
-
-if echo "$1" | grep -Eq '[[:digit:]]{5}'; then
-  PLZ="$1"
-else
-  echo >&2 "Usage: $0 PLZ"
-  exit 1
-fi
-
-lieferando_dir=/tmp/lieferando
-mkdir -p "$lieferando_dir/$PLZ"
-
-fetch_restaurants() {
-  cache_path="$lieferando_dir/$PLZ.json"
-
-  if [ -r "$cache_path" ]; then
-    cat "$cache_path"
-  else
-    w3m -dump_source "http://www.lieferando.de/$PLZ" \
-      | gunzip \
-      | sed -n '/var restaurants/,/];$/p' \
-      | sed 's/var restaurants =//;$s/;$//' \
-      | prettier --parser=json \
-      | jq '
-        map({
-          name: .[30] | .name,
-          category: .[30] |.categories | split(", "),
-          url: "http://lieferando.de\(.[30] | .url)",
-          minutes: .[19],
-          minimum: .[10],
-          delivery: .[14]
-        })' \
-      | tee "$cache_path"
-  fi
-}
-
-fetch_menu() {
-  [ $# -eq 1 ] || exit 1
-
-  slug="$(echo "$1" | sed 's!.*/!!')"
-  cache_path="$lieferando_dir/$PLZ/$slug.json"
-
-  if [ -r "$cache_path" ]; then
-    cat "$cache_path"
-  else
-    w3m -dump_source "$1" \
-      | gunzip \
-      | sed -n '/var MenucardProducts/,/\];/p' \
-      | sed 's/var MenucardProducts =//;s/;$//' \
-      | jq -r '
-        unique_by(.productId)
-        | group_by(.categoryId)
-        | flatten
-      ' \
-      | tee "$cache_path"
-  fi
-}
-
-data="$(fetch_restaurants)"
-
-# echo "$data" | jq -c '.[]' | while read -r restaurant; do
-#   fetch_menu "$(echo "$restaurant" | jq -r .url)"
-# done
-
-selected_categories="$(echo "$data" | jq -r 'map(.category) | flatten | unique | .[]' | fzf -m)"
-
-selected_restaurant_url="$(echo "$selected_categories" | jq --argjson restaurants "$data" -sRr '
-  split("\n")[:-1] as $categories
-  | $restaurants[]
-  | select(.category - $categories != .category)
-  | "\(.name) [🚴\(.minutes)min 💰\(.minimum)€ + \(.delivery)€] (\(.url))"
-  ' \
-  | fzf \
-  | sed 's/.*(//;s/)$//'
-)"
-
-fetch_menu "$selected_restaurant_url" \
-  | jq -r '.[] | "\(.price)\t\(.name)"' \
-  | fzf -m \
-  | awk '{print $0; sum += $1} END {print "-----"; print sum}'

.bin/lit.awk

@@ -1,17 +0,0 @@
-BEGIN {
-  if (!comment) comment = "--";
-  if (!begin) begin = "\\begin{code}";
-  if (!end) end = "\\end{code}";
-}
-{
-  if ($0 == begin) {
-    code = 1;
-    print comment, $0;
-  } else if ($0 == end) {
-    code = 0;
-    print comment, $0;
-  } else {
-    if (code) print $0;
-    else print comment, $0;
-  }
-}

.bin/load.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-uptime | sed 's/.*load average: \(.*\), \(.*\), \(.*\)/\1 \2 \3/'

.bin/mail-current-part

@@ -1,3 +0,0 @@
-#! /bin/sh
-set -efu
-exec curl -fSs --unix-socket /tmp/much.api.sock http://localhost/current/part

.bin/mail-current-query-find-part-by-name

@@ -1,27 +0,0 @@
-#! /bin/sh
-# usage: mail-current-query-find-part-by-name NAME
-set -efu
-
-name=$1
-
-query=$(mail-current-query)
-result=$(notmuch show --entire-thread=false --format=json "$query")
-
-part_id=$(printf %s "$result" | jq --arg name "$name" '
-  [
-    recurse |
-    select(type == "object") |
-    { id, name: .filename } |
-    select(.id != null and .name != null)
-  ] |
-  map(select(.name == $name))[0].id
-')
-
-if test "$part_id" = null; then
-  printf 'error: could not find part with name %s\n' \
-    "$name" \
-    >&2
-  exit 1
-fi
-
-exec notmuch show --part="$part_id" "$query"

.bin/mail-current-query-find-part-by-type

@@ -1,39 +0,0 @@
-#! /bin/sh
-# usage: mail-current-query-find-part-by-type TYPE
-set -efu
-
-type=$1
-
-query=$(mail-current-query)
-result=$(notmuch show --entire-thread=false --format=json "$query")
-
-part_id=$(printf %s "$result" | jq --arg type "$type" '
-  #flatten|map(select(.!=null))[0].body[0] |
-  #
-  #if .["content-type"] == $type then
-  #  .id
-  #elif .["content-type"] | test("^multipart/") then
-  #  .content|map(select(.["content-type"]==$type))[0].id
-  #else
-  #  null
-  #end
-
-  [
-    recurse |
-    select(type == "object") |
-    { id, type: .["content-type"] } |
-    select(.id != null and .type != null)
-  ] |
-  map(select(.type == $type))[0].id
-')
-
-if test "$part_id" = null; then
-  printf 'error: could not find part with type %s\n' \
-    "$type" \
-    >&2
-  exit 1
-fi
-
-exec notmuch show --part="$part_id" "$query"
-
-

.bin/mp3player-write

@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-
-# Usage:
-# ./mp3_transfer.sh -s 1.3 /mnt/mp3player file1.m4a file2.m4a ...
-
-set -e
-
-# Default speed
-SPEED=1.0
-
-# Parse options
-while getopts ":s:" opt; do
-  case $opt in
-    s)
-      SPEED=$OPTARG
-      ;;
-    \?)
-      echo "Invalid option: -$OPTARG" >&2
-      exit 1
-      ;;
-    :)
-      echo "Option -$OPTARG requires a value." >&2
-      exit 1
-      ;;
-  esac
-done
-
-# Shift past the options
-shift $((OPTIND -1))
-
-# Check arguments
-if [ "$#" -lt 2 ]; then
-  echo "Usage: $0 [-s speed] MOUNT_POINT FILE1 [FILE2 ...]"
-  exit 1
-fi
-
-MOUNT_POINT=$1
-shift
-FILES=("$@")
-
-# Check mount point exists
-if [ ! -d "$MOUNT_POINT" ]; then
-  echo "Error: Mount point '$MOUNT_POINT' does not exist."
-  exit 1
-fi
-
-# Estimate required space
-TOTAL_SIZE=0
-for f in "${FILES[@]}"; do
-  if [ ! -f "$f" ]; then
-    echo "Warning: File '$f' does not exist, skipping."
-    continue
-  fi
-  # Get file size in bytes
-  FILE_SIZE=$(stat --printf="%s" "$f")
-  # Estimate mp3 output size: roughly 1/2 of original m4a (adjust if needed)
-  TOTAL_SIZE=$((TOTAL_SIZE + FILE_SIZE / 2))
-done
-
-# Get available space in bytes
-AVAILABLE=$(df --output=avail "$MOUNT_POINT" | tail -n 1)
-AVAILABLE=$((AVAILABLE * 1024))  # df reports in KB
-
-if [ "$TOTAL_SIZE" -gt "$AVAILABLE" ]; then
-  echo "Error: Not enough space on device. Required: $TOTAL_SIZE bytes, Available: $AVAILABLE bytes"
-  exit 1
-fi
-
-echo "Enough space available. Starting conversion..."
-
-sanitize_filename() {
-  local name="$1"
-  # Remove path, keep only base name
-  name=$(basename "$name")
-  # Remove any extension
-  name=${name%.*}
-  # Replace spaces and special chars with underscore
-  name=$(echo "$name" | tr ' ' '_' | tr -cd '[:alnum:]_-')
-  # Truncate to max 50 chars
-  echo "${name:0:50}"
-}
-
-# Convert and copy files
-for f in "${FILES[@]}"; do
-  if [ ! -f "$f" ]; then
-    continue
-  fi
-
-  # Determine the next prefix
-  existing_prefixes=$(ls "$MOUNT_POINT" | grep -E '^[0-9].*\.mp3$' | sed -E 's/^([0-9]).*/\1/' | sort -n | uniq)
-  for i in {0..9}; do
-    if ! echo "$existing_prefixes" | grep -q "^$i$"; then
-      PREFIX=$i
-      break
-    fi
-  done
-
-  echo "Using prefix: $PREFIX"
-
-  BASENAME=$(sanitize_filename "$f")
-  OUT_PATTERN="$MOUNT_POINT/${PREFIX}_%03d_${BASENAME}.mp3"
-
-  echo "Converting '$f' to '$OUT_PATTERN' at speed $SPEED..."
-
-  ffmpeg -nostdin -i "$f" \
-    -filter:a "atempo=$SPEED" \
-    -ar 22050 -ac 1 -c:a libmp3lame -b:a 32k \
-    -f segment -segment_time 300 \
-    "$OUT_PATTERN"
-
-  # Update prefix for next file
-  # Count how many segments were created
-  SEG_COUNT=$(ls "$MOUNT_POINT" | grep -E "^${PREFIX}[0-9]{2}_" | wc -l)
-  PREFIX=$((PREFIX + SEG_COUNT))
-done
-
-echo "All files processed successfully."

.bin/mud.sh

@@ -1 +0,0 @@
-ssh mud@hotdog.r -t "MUD_NICKNAME=$LOGNAME mud"

.bin/mushakkil.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-curl -sSL 'https://diac.alsharekh.org/Diac/DiacText' \
-  -H "Content-Type: application/json" \
-  --data-raw "$(jq --raw-input '{word: ., type: 1}')" \
-  --compressed \
-  | jq -r .diacWord

.bin/nix-haddock-index

@@ -1,93 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils gnugrep gnused graphviz
-#
-# usage: nix-haddock-index
-#
-# Run this script in an environment where either NIX_GHC is set, or the ghc
-# executable exists, to generate an HTML index file pointing to all Haddock
-# files accessible to the respective ghc version.
-#
-# Additionally, an SVG dependency graph of all packages is linked at the
-# bottom of the index file.
-#
-# Note: all files will be generated in /tmp, and won't be deleted automatically
-#
-
-set -efux
-
-if test -z "${NIX_GHC-}"; then
-  NIX_GHC=$(readlink -f "$(type -P ghc)")
-fi
-
-if ! echo $NIX_GHC | grep -q '^/nix/store/'; then
-  printf '%s: error: unsupported GHC executable path (not in Nix store): %q\n' \
-      "$0" \
-      "$NIX_GHC" \
-    >&2
-  exit -1
-fi
-
-NIX_GHC_PREFIX=$(dirname "$(dirname "$NIX_GHC")")
-NIX_GHC_DOCDIR=$NIX_GHC_PREFIX/share/doc/ghc/html
-
-main() {
-
-  hash=$(echo $NIX_GHC_PREFIX | sed -n 's|^/nix/store/\([a-z0-9]\+\).*|\1|p')
-  title="Haddock index for $NIX_GHC_PREFIX"
-
-  header=$(
-    printf 'Haddock index for <a href="%s">%s</a>\n' \
-        $NIX_GHC_PREFIX \
-        $NIX_GHC_PREFIX \
-  )
-
-  suffix=${hash:+-$hash}
-  index_file=/tmp/haddock$suffix-index.html
-  svg_file=/tmp/haddock$suffix.svg
-
-  #if ! test -e $index_file; then
-    eval "$(
-      echo 'gen_index() {'
-      echo '  html_head'
-      "$NIX_GHC_PREFIX"/bin/ghc-pkg dump | sed -n '
-        s/^---$/  reset/p
-        s/^\(name\|version\):\s*\([-A-Za-z0-9_.]\+\)$/  \1=\2/p
-        s/^haddock-html:\s*\([-A-Za-z0-9_./]\+\)$/  haddock_html \1/p
-      '
-      echo '  html_foot'
-      echo '}'
-    )"
-
-    gen_index > $index_file
-  #fi
-
-  #if ! test -e $svg_file; then
-    "$NIX_GHC_PREFIX"/bin/ghc-pkg dot | tred | dot -Tsvg | sed '
-      s/<svg width="[0-9]\+pt" height="[0-9]\+pt"/<svg width="3600px" height="100%"/
-    ' > $svg_file
-  #fi
-
-  echo $index_file
-}
-reset() {
-  unset name version
-}
-haddock_html() {
-  printf '<li>'
-  printf '<a href="%s/index.html">%s</a>' "$1" "$name-$version"
-  printf '</li>\n'
-}
-html_head() {
-  printf '<!doctype html>\n'
-  printf '<title>%s</title>\n' "$title"
-  printf '<link href="%s" rel="stylesheet" type="text/css">\n' \
-      "$NIX_GHC_DOCDIR/libraries/ocean.css"
-  printf '<h1>%s</h1>\n' "$header"
-  printf '<ul>\n'
-}
-html_foot() {
-  printf '</ul>\n'
-  printf '<a href="%s">graph</a>\n' "$svg_file"
-}
-
-main "$@"

.bin/notetags.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-# inspired by https://github.com/connermcd/bin/blob/1d38cb98812906d8b95dc6e51e1149e29261617d/notetags
-
-cd "$HOME/notes/" || exit
-
-[ -f tags ] && rm tags
-grep -r 'tags:' ./* | while read -r line; do
-  file=$(echo "$line" | cut -d: -f1)
-  unparsed_tags=$(echo "$line" | cut -d: -f3) #
-  tags=$(echo "$unparsed_tags" | sed -e 's/tags: *//g' -e 's/[][,]//g')
-  for tag in $tags; do
-    echo "$tag	$file	/^$unparsed_tags$/;" >> tags
-  done
-done

.bin/pdf-ocr.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p poppler_utils tesseract4
-set -eu
-
-pdf_path="$(realpath "$1")"
-
-[ -f "$pdf_path" ] || {
-  echo "Usage: $0 FILE.pdf" >&2
-  exit 1
-}
-
-
-tmpdir="$(mktemp -d)"
-trap 'rm -rf $tmpdir' EXIT
-
-cd "$tmpdir"
-
-pdftoppm -png "$pdf_path" pdf-ocr
-for png in pdf-ocr*.png; do
-  tesseract "$png" "$png.txt" 2>/dev/null
-done
-
-cat pdf-ocr-*.txt

.bin/playlist_entries.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-youtube-dl -ij "$*" | jq -sr '.[] | .webpage_url'

.bin/prospekte.sh

@@ -1,65 +0,0 @@
-#!/bin/sh
-lidl() {
-  echo LIDL
-  curl -sSL 'https://endpoints.lidl-flyer.com/v3/region-overview/lidl/de-DE/0.json' \
-    | jq -r '
-      .categories
-      | map(select(.name == "Filial-Angebote") | .subcategories | map(.flyers))
-      | flatten
-      | flatten
-      | .[]
-      | .pdfUrl
-    '
-}
-
-aldi_nord() {
-  echo ALDI nord
-  echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-aktuell/GetPDF.ashx'
-  echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-vorschau/GetPDF.ashx'
-}
-
-rewe_berlin() {(
-  store_id=662366923
-  publisher_id=1062
-
-  echo REWE
-  curl -sSL 'https://www.bonialserviceswidget.de/de/stores/'$store_id'/brochures?storeId='$store_id'&publisherId='$publisher_id | while read -r brochure_id; do
-    curl -sSL 'https://www.bonialserviceswidget.de/de/v5/brochureDetails/'"$brochure_id"'?publisherId='$publisher_id  | jq -r .pdfUrl
-  done
-)}
-
-kaufland() {(
-  region_code=8920
-  echo KAUFLAND
-  curl -sSL https://filiale.kaufland.de/prospekte.html | htmlq --attribute href '.flyer a' | grep -Eo 'DE_de_KDZ[^/]*' | sed "s/_3000_/_${region_code}_/" | while read -r flyer_id; do
-    curl -sSL "https://endpoints.leaflets.kaufland.com/v3/$flyer_id/flyer.json?regionCode=$region_code" | jq -r .flyer.pdfUrl
-  done
-)}
-
-netto_schwarz() {
-  echo 'NETTO (schwarz)'
-  curl -sSL 'https://squid-api.tjek.com/v2/catalogs?dealer_ids=90f2VL&order_by=created' \
-    | jq -r '.[] | .id' \
-    | while read -r flyer_id; do
-      curl -sSL "https://squid-api.tjek.com/v2/catalogs/$flyer_id/download" \
-        | jq -r .pdf_url
-    done
-}
-
-dir="$(mktemp -d)"
-trap clean EXIT
-
-clean() {
-  rm -rf "$dir"
-}
-
-prospekt_url="$( (
-  lidl
-  aldi_nord
-  rewe_berlin
-  kaufland
-  netto_schwarz
-) | fzf)"
-
-curl -sSL "$prospekt_url" -o "$dir/prospekt.pdf"
-zathura "$dir/prospekt.pdf"

.bin/proxies.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-curl -sSL https://www.netzwelt.de/proxy/index.html \
-  | pup ".tblc" \
-  | xml-to-json /dev/stdin \
-  | jq '
-    .div.table.tbody.tr
-    | map(
-      .td
-      | {
-        ip: .[0].a.value,
-        port: .[1],
-        country: .[2] | (if type == "string" then . else .a.value end),
-        security: .[3],
-        protocol: .[4]
-      }
-    )
-  '

.bin/readme

@@ -1,4 +0,0 @@
-#!/bin/sh
-curl -sSL "https://raw.githubusercontent.com/$*/master/README.md" \
-  | pandoc -f gfm -t man -s \
-  | man -l -

.bin/sample-pdf.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-filepath="$(shuf --head-count=1)"
-pages="$(pdfinfo "$filepath" | awk '/^Pages:/{print $2}')"
-random_page="$(shuf --input-range="1-$pages" --head-count=1)"
-zathura --page="$random_page" "$filepath"

.bin/screencap.sh

@@ -1,16 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i sh -p coreutils byzanz xorg.xwininfo gnused
-
-# shellcheck shell=sh
-# ref https://gist.github.com/aforemny/0994cb7f06ea30d56c8b9681ff5d2054
-
-set -eux
-
-eval "$(xwininfo | \
-  sed -n -e 's/^ \+Absolute upper-left X: \+\([0-9]\+\).*/x=\1/p' \
-         -e 's/^ \+Absolute upper-left Y: \+\([0-9]\+\).*/y=\1/p' \
-         -e 's/^ \+Width: \+\([0-9]\+\).*/w=\1/p' \
-         -e 's/^ \+Height: \+\([0-9]\+\).*/h=\1/p')"
-
-trap "pkill -f 'sleep 360d'" INT
-byzanz-record -e "sleep 360d" -c -x $x -y $y -w $w -h $h "$@"

.bin/space.py

@@ -1,49 +0,0 @@
-import ephem
-from datetime import datetime, date, timedelta
-
-now = datetime.now()
-limit = now + timedelta(days=365)
-
-
-def events_until(limit):
-    initial_date = ephem.Date(datetime.now())
-    events = {}
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_full_moon(now)
-        events[now] = "🌕"
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_new_moon(now)
-        events[now] = "🌑"
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_vernal_equinox(now)
-        events[now] = "spring equinox"
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_autumnal_equinox(now)
-        events[now] = "fall equinox"
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_winter_solstice(now)
-        events[now] = "winter solstice"
-
-    now = initial_date
-    while ephem.localtime(now) <= limit:
-        now = ephem.next_summer_solstice(now)
-        events[now] = "summer solstice"
-    return events
-
-
-events = events_until(limit)
-
-
-for date, event in sorted(events.items(), key=lambda x: x[0]):
-    if ephem.localtime(date) < limit:
-        print(ephem.localtime(date), event)

.bin/toposort.nix

@@ -1,81 +0,0 @@
-let
-  lib = import <nixpkgs/lib>;
-in
-rec {
-  inherit lib;
-
-  input = [
-    {
-      x = [
-        "pool"
-        "zfs"
-      ];
-      y = [
-        "mdadm"
-        "raid1"
-      ];
-    }
-    {
-      x = [
-        "pool"
-        "zfs"
-      ];
-      y = [
-        "disk"
-        "sda"
-      ];
-    }
-    {
-      x = [
-        "mdadm"
-        "raid1"
-      ];
-      y = [
-        "disk"
-        "sdb"
-      ];
-    }
-    {
-      x = [
-        "mdadm"
-        "raid1"
-      ];
-      y = [
-        "disk"
-        "sdc"
-      ];
-    }
-  ];
-
-  outNodes = node: graph: lib.unique (builtins.map (e: e.y) (builtins.filter (v: v.x == node) graph));
-
-  vertices = graph: lib.unique (builtins.map (x: x.y) graph ++ builtins.map (x: x.x) graph);
-
-  deleteVertex = node: graph: (builtins.filter (v: v.x != node && v.y != node) graph);
-
-  findSink =
-    graph:
-    lib.findFirst (v: outNodes v graph == [ ]) (lib.trace graph (builtins.abort "No sink found")) (
-      vertices graph
-    );
-
-  topSort =
-    graph:
-    if graph == [ ] then
-      [ ]
-    else if builtins.length graph == 1 then
-      let
-        only = builtins.head graph;
-      in
-      [
-        only.y
-        only.x
-      ]
-    else
-      let
-        sink = findSink graph;
-      in
-      [ sink ] ++ topSort (deleteVertex sink graph);
-
-  output = topSort input;
-}

.bin/ttrss-unread

@@ -1,18 +0,0 @@
-#/usr/bin/env -S deno run -A:q
-set -x
-session_cache="$HOME/.cache/tt-rss.session"
-ttrss_endpoint=https://feed.kmein.de/api/
-ttrss_user=k
-ttrss_password=$(pass shared/tt-rss/password)
-
-login() {
-  if [ -f "$session_cache" ]; then
-    session_id="$(cat "$session_cache")"
-  else
-    session_id="$(curl -d '{"op":"login","user":"'"$ttrss_user"'","password":"'"$ttrss_password"'"}' "$ttrss_endpoint" | jq -r .content.session_id)"
-    echo "$session_id" > "$session_cache"
-  fi
-}
-
-login
-curl -d '{"sid":"'"$session_id"'","op":"getUnread"}' "$ttrss_endpoint" | jq .content

.bin/tuesday-1800

@@ -1,16 +0,0 @@
-#!/bin/sh
-set -efux
-expected_max_results=1024 # the upper bound on the number of restaurants
-radius=250
-
-echo '[out:json];node(id:260050809)->.cbase;
-(
-  node(around.cbase:'$radius')[amenity=fast_food];
-  node(around.cbase:'$radius')[amenity=restaurant];
-);out;' \
-  | curl -sSL -d @- -X POST http://overpass-api.de/api/interpreter \
-  | jq --argjson random "$(shuf -i 0-$expected_max_results -n 1)" '
-    .elements
-    | length as $length
-    | .[$random % $length]
-  '

.bin/unicode

@@ -1,8 +0,0 @@
-import sys
-import unicodedata
-
-for index, character in enumerate(sys.stdin.read().strip()):
-  try:
-    print(index, character, hex(ord(character)), unicodedata.category(character), unicodedata.name(character))
-  except:
-    print(index, character, hex(ord(character)))

.bin/watson2fdf.sh

@@ -1,26 +0,0 @@
-project=Filli
-year=2022
-
-for month in Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec; do
-  from="$(date +%F -d "$month 1, $year")"
-  to="$(date +%F -d "$month 1, $year + 1 month")"
-  watson report --json --from "$from" --to "$to" --project "$project"
-done | jq --slurp '
-  def in_array($arr):
-      . as $value | any($arr[]; . == $value);
-
-  map(
-    ["engadin-app","fysiweb","val-muestair","mia-engiadina","ol"] as $official_projects
-    | (.timespan.from | .[0:7]) as $timespan
-    | .projects | .[0]
-    | .time as $total_time
-    | .tags
-    | select(. != null)
-    | map(select(.name | in_array($official_projects)))
-    | (map(.time)|add) as $official_time
-    | map({key:.name, value:.time}) | from_entries
-    | .other |= ($total_time - $official_time)
-    | map_values(. / (60*60) | ceil)
-    | .month |= $timespan
-  )
-'

AGENTS.md

@@ -0,0 +1,96 @@
+# niveum — Agent Notes
+
+## What This Is
+
+A NixOS flake managing ~9 machines (desktops, servers, family laptops) for one user (kmein/kfm).
+Levantine food-themed hostnames: fatteh, kabsa, kibbeh, makanek, manakish, tabula, tahina, zaatar, ful.
+
+## Repository Structure
+
+```
+flake.nix          # ~670 lines — inputs, overlay, nixosConfigurations, apps, packages output
+configs/           # ~50 NixOS config fragments imported by systems
+  default.nix      # 200+ line mega-module for desktop machines (user, shell, gnupg, i18n, etc.)
+  graphical/       # Hyprland + home-manager config (415 lines in home-manager.nix)
+  packages.nix     # ~250 lines of environment.systemPackages
+  bots/            # Telegram/Mastodon/Matrix bot configs
+  keyboard/        # XKB layouts (Coptic, Avestan, Gothic, etc.)
+configs/*.nix      # Individual concerns: bluetooth, sound, printing, ssh, fonts, etc.
+modules/           # Proper NixOS modules with options (retiolum, telegram-bot, passport, power-action, etc.)
+packages/          # ~107 package files (scripts, wrappers, small tools)
+systems/<name>/    # Per-machine: configuration.nix + hardware-configuration.nix + extras
+lib/               # default.nix (niveum helpers), machines.nix (IP/key inventory), panoptikon.nix
+secrets/           # agenix-encrypted .age files (empty dir in checkout, tracked via secrets.txt)
+```
+
+## Key Relationships
+
+- **niphas** (input): Provides shared "how I like things" config — nixosModules (shell, editor, git, desktop, nix, udiskie) and overlay (niphas-* packages). Used in `profiles.default` and `profiles.desktop`.
+- **configs/default.nix**: The "big desktop profile" — imported by fatteh, kabsa, manakish (the main desktop machines). NOT imported by servers or family laptops.
+- **profiles** (in flake.nix): `profiles.default`, `profiles.desktop`, `profiles.server` — lists of modules composed per machine.
+- **lib.niveum**: Custom lib injected via overlay (`pkgs.lib.niveum`) — used everywhere for machine addresses, SSH port, helper functions.
+
+## Coding Conventions
+
+- Packages use `writers.writeDashBin`, `writers.writeBashBin`, or `writers.writePython3Bin`
+- Dependencies are referenced via `lib.getExe pkg` (main executable) or `lib.getExe' pkg "name"` (specific binary)
+- For packages needing many commands via PATH, use `lib.makeBinPath` instead (see `packages/prospekte.nix`)
+- Overlay entries use `prev.callPackage packages/foo.nix { }` pattern
+- Packages are exported via `inherit (pkgs) ...` in the `packages` output
+
+## Known Bugs / Broken References
+
+All previously broken references have been fixed (see commits `36132b04`, `e67d6d7d`).
+
+Remaining issues:
+- `modules/retiolum.nix` uses `<retiolum/hosts>` and `<system-secrets/...>` NIX_PATH lookups — breaks flake purity but works with current `NIX_PATH` setup
+
+## Architectural Issues
+
+### 1. configs/default.nix is a grab-bag (200+ lines, ~15 inline anonymous modules)
+It's a list of `imports` mixing inline `{ ... }` blocks with file imports. Hard to find what's defined where.
+
+### 2. Retiolum secret boilerplate repeated 9 times
+Every system has a near-identical block:
+```nix
+age.secrets.retiolum-rsa = { file = ../../secrets/${hostname}-retiolum-privateKey-rsa.age; mode = "400"; owner = "tinc-retiolum"; ... };
+age.secrets.retiolum-ed25519 = { ... same ... };
+```
+Could be a function or module parameterized by hostname.
+
+### 3. Nginx + ACME boilerplate duplicated
+ful and makanek have identical nginx recommended settings + ACME config.
+
+### 4. niveum-* overlay aliases
+`niveum-terminal`, `niveum-browser`, `niveum-filemanager` are aliases to niphas equivalents. Could be removed by updating ~6 references in configs/ to use niphas-* names directly.
+
+### 5. The `pkgs.lib.niveum` pattern
+Custom lib injected via overlay into `pkgs.lib`. Unconventional — only available where overlay is applied. A `specialArgs` approach or standalone lib would be cleaner.
+
+### 6. Restic backup config scattered
+`services.restic.backups.niveum` is configured in configs/backup.nix, configs/applicative.nix, and extended in 5+ system files. Hard to see what a given machine backs up.
+
+### 7. configs/ vs modules/ distinction blurry
+`configs/` has both stateless config fragments (spacetime.nix = timezone) and stateful ones (backup.nix, cloud.nix). `modules/` has proper option-declaring modules. Some configs/ files import from modules/.
+
+## Machines Overview
+
+| Machine   | Role         | Profile          | Arch    | Notes                               |
+|-----------|--------------|------------------|---------|---------------------------------------|
+| fatteh    | Desktop      | default+desktop  | x86_64  | ThinkPad T480, CUDA, main daily       |
+| kabsa     | Desktop      | default+desktop  | x86_64  | ThinkPad X220, constrained (2 jobs)   |
+| manakish  | Desktop      | default+desktop  | x86_64  | ThinkPad X230                         |
+| kibbeh    | Desktop      | default+desktop  | x86_64  | Pantheon DE, travel laptop            |
+| ful       | Server       | default+server   | aarch64 | Oracle/Hetzner, nginx, web services   |
+| makanek   | Server       | default+server   | x86_64  | Hetzner, gitea, nextcloud, weechat    |
+| zaatar    | Server/Home  | default+server   | x86_64  | Home assistant, backup server         |
+| tabula    | Family laptop| default           | x86_64  | LXQt, user "xenos"                   |
+| tahina    | Family laptop| default           | x86_64  | Pantheon, user "xenos", German        |
+
+## Remaining Improvement Ideas
+
+1. **Extract retiolum secret boilerplate** into a function/module
+2. **Break up configs/default.nix** into proper named files
+3. **Extract nginx+ACME server profile**
+4. **Replace niveum-* aliases** with direct niphas-* references
+5. **Fix modules/retiolum.nix** NIX_PATH usage for flake purity

configs/bash.nix

@@ -1,10 +0,0 @@
-{ pkgs, ... }:
-{
-  programs.bash = {
-    promptInit = ''PS1="$(${pkgs.ncurses}/bin/tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(${pkgs.ncurses}/bin/tput sgr0) "'';
-    interactiveShellInit = ''
-      set -o vi
-    '';
-    completion.enable = true;
-  };
-}

configs/default.nix

@@ -16,9 +16,6 @@ in
       nixpkgs = {
         config = {
           allowUnfree = true;
-          packageOverrides = pkgs: {
-            dmenu = pkgs.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
-          };
           permittedInsecurePackages = [
           ];
         };
@@ -69,6 +66,8 @@ in
         extraGroups = [
           "pipewire"
           "audio"
+          "lp"
+          "scanner"
         ];
       };
 
@@ -153,7 +152,7 @@ in
         dconf.enable = true;
         dconf.settings = {
           # Change the default terminal for Nemo
-          "org/cinnamon/desktop/applications/terminal".exec = lib.getExe pkgs.niveum-terminal;
+          "org/cinnamon/desktop/applications/terminal".exec = lib.getExe pkgs.niphas-terminal;
         };
       };
     }

configs/direnv.nix

@@ -1,42 +0,0 @@
-{ pkgs, ... }:
-let
-  nixify = pkgs.writers.writeDashBin "nixify" ''
-    set -efuC
-
-    if [ ! -e ./.envrc ]; then
-      echo use_nix > .envrc
-      direnv allow
-    fi
-    if [ ! -e shell.nix ]; then
-      cat > shell.nix <<'EOF'
-    { pkgs ? import <nixpkgs> {} }:
-    pkgs.mkShell {
-      packages = [];
-    }
-    EOF
-      ''${EDITOR:-vim} shell.nix
-    fi
-  '';
-in
-{
-  environment.systemPackages = [
-    pkgs.direnv
-    nixify
-  ];
-
-  home-manager.users.me.programs.direnv = {
-    enable = true;
-    stdlib = builtins.readFile "${
-      pkgs.fetchFromGitHub {
-        owner = "Mic92";
-        repo = "dotfiles";
-        rev = "a0a9b7e358fa70a85cd468f8ca1fbb02ae0a91df";
-        sha256 = "1y9h5s1lf59sczsm0ksq2x1yhl98ba9lwk5yil3q53rg7n4574pg";
-      }
-    }/home/.direnvrc";
-  };
-
-  programs.zsh.interactiveShellInit = ''
-    eval "$(${pkgs.direnv}/bin/direnv hook zsh)"
-  '';
-}

configs/editor.nix

@@ -38,7 +38,6 @@
     pkgs.pyright
     pkgs.haskellPackages.haskell-language-server
     pkgs.texlab
-    pkgs.nil
     pkgs.gopls
     pkgs.nixfmt-rfc-style
     pkgs.rust-analyzer

configs/graphical/home-manager.nix

@@ -350,11 +350,11 @@ in
           ", XF86AudioPrev, exec, playerctl previous"
         ];
         bind = [
-          "${mod}, Return, exec, ${lib.getExe pkgs.niveum-terminal}"
+          "${mod}, Return, exec, ${lib.getExe pkgs.niphas-terminal}"
           "${mod} SHIFT, Q, killactive,"
           "${mod} SHIFT, R, exit,"
-          "${mod}, t, exec, ${lib.getExe pkgs.niveum-filemanager}"
+          "${mod}, t, exec, ${lib.getExe pkgs.niphas-file-browser}"
-          "${mod}, Y, exec, ${lib.getExe pkgs.niveum-browser}"
+          "${mod}, Y, exec, ${lib.getExe pkgs.niphas-web-browser}"
           "${mod}, Q, exec, ${lib.getExe pkgs.clipman} pick --tool=rofi"
           "${mod}, u, exec, ${lib.getExe pkgs.unicodmenu}"
           "${mod}, p, exec, ${lib.getExe pkgs.rofi-pass-wayland}"

configs/hledger.nix

@@ -4,7 +4,6 @@
 }:
 let
   ledgerDirectory = "/home/kfm/sync/src/ledger";
-  hora = pkgs.callPackage ../packages/hora.nix { timeLedger = "${ledgerDirectory}/time.timeclock"; };
 in
 {
   environment.systemPackages =
@@ -12,7 +11,6 @@ in
       git = "${pkgs.git}/bin/git -C ${ledgerDirectory}";
     in
     [
-      hora
       pkgs.hledger
       (pkgs.writers.writeDashBin "hledger-git" ''
         if [ "$1" = entry ]; then

configs/i3.nix

@@ -243,9 +243,9 @@ in
           "${modifier}+w" = "layout tabbed";
           "${modifier}+q" = "exec ${config.services.clipmenu.package}/bin/clipmenu";
 
-          "${modifier}+Return" = "exec ${lib.getExe pkgs.niveum-terminal}";
+          "${modifier}+Return" = "exec ${lib.getExe pkgs.niphas-terminal}";
-          "${modifier}+t" = "exec ${lib.getExe pkgs.niveum-filemanager}";
+          "${modifier}+t" = "exec ${lib.getExe pkgs.niphas-file-browser}";
-          "${modifier}+y" = "exec ${lib.getExe pkgs.niveum-browser}";
+          "${modifier}+y" = "exec ${lib.getExe pkgs.niphas-web-browser}";
 
           "${modifier}+d" =
             "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";

configs/packages.nix

@@ -70,23 +70,16 @@ in
       GPODDER_DOWNLOAD_DIR=${config.users.users.me.home}/mobile/audio/Text/podcasts exec ${pkgs.gpodder}/bin/gpodder "$@"
     '')
     # INTERNET
-    aria2
     telegram-desktop
-    whois
-    dnsutils
     # FILE MANAGERS
     lf
-    pcmanfm
     # MEDIA
     ffmpeg
     simplescreenrecorder
     imagemagick
     exiftool
-    nsxiv
     graphviz
     # SHELL
-    bat # better cat
-    dos2unix
     genpass # generate passwords
     (pkgs.writers.writeDashBin "genpassphrase" ''${pkgs.genpass}/bin/genpass "$@" --passphrase | ${pkgs.gnused}/bin/sed 's/ /-/g;s/\(^\|-\)\([a-z]\)/\1\U\2/g;s/$/-'$(${pkgs.coreutils}/bin/date +%Y)'/' '')
     gcc
@@ -94,16 +87,10 @@ in
     pup # html toolkit
     xan # csv toolkit
     magic-wormhole-rs # file transfer
-    man-pages
-    man-pages-posix
     exfat # to mount windows drives
     # HARDWARE TOOLS
     gnome-disk-utility
     arandr # xrandr for noobs
-    wdisplays
-    libnotify # for notify-send
-    wl-clipboard # clipboard CLI
-    dragon-drop # drag and drop
     portfolio # personal finance overview
     audacity
     calibre
@@ -254,10 +241,6 @@ in
     # proselint
     asciidoctor
     wordnet
-    tokei # count lines of code
-    gnumake
-    binutils # for strip, ld, ...
-    # nightly.rust
     shellcheck
 
     # photography

configs/printing.nix

@@ -26,7 +26,7 @@ in
     openFirewall = true;
   };
 
-  users.users.me.extraGroups = [ "lp" "scanner" ];
+  # users.users.me.extraGroups is set in configs/default.nix which defines the "me" user
 
   hardware.printers.ensurePrinters = [
     {

flake.lock

@@ -753,7 +753,6 @@
         "tinc-graph": "tinc-graph",
         "treefmt-nix": "treefmt-nix_4",
         "voidrice": "voidrice",
-        "wallpapers": "wallpapers",
         "wetter": "wetter",
         "wrappers": "wrappers_2"
       }
@@ -1130,22 +1129,6 @@
         "type": "github"
       }
     },
-    "wallpapers": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1589319718,
-        "narHash": "sha256-2NruGq3z37vY3uAH8S4sLqHvFAGi8gaDJAgEzMIvM/4=",
-        "owner": "kmein",
-        "repo": "wallpapers",
-        "rev": "7c553bc6bd78afa6dbf2824691466bbad0d8e6e9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "kmein",
-        "repo": "wallpapers",
-        "type": "github"
-      }
-    },
     "wetter": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -22,14 +22,12 @@
     tinc-graph.url = "github:kmein/tinc-graph";
     treefmt-nix.url = "github:numtide/treefmt-nix";
     voidrice.url = "github:Lukesmithxyz/voidrice";
-    wallpapers.url = "github:kmein/wallpapers";
     nix-topology.url = "github:oddlama/nix-topology";
     wetter.url = "github:4z3/wetter";
     wrappers.url = "github:lassulus/wrappers";
     llm-agents.url = "github:numtide/llm-agents.nix";
 
     voidrice.flake = false;
-    wallpapers.flake = false;
 
     naersk.url = "github:nix-community/naersk";
     fenix.url = "github:nix-community/fenix";
@@ -195,14 +193,25 @@
         system-dependent = import modules/system-dependent.nix;
         telegram-bot = import modules/telegram-bot.nix;
         go-webring = import modules/go-webring.nix;
-
-        zsh-kmein = import config/zsh.nix;
       };
 
       overlays.default = final: prev: {
-        niveum-terminal = prev.alacritty;
+
-        niveum-browser = prev.firefox;
+        # packaged from .bin/
-        niveum-filemanager = prev.pcmanfm;
+        two56color = prev.callPackage packages/256color.nix { };
+        avesta = prev.callPackage packages/avesta.nix { };
+        bvg = prev.callPackage packages/bvg.nix { };
+        charinfo = prev.callPackage packages/charinfo.nix { };
+        chunk-pdf = prev.callPackage packages/chunk-pdf.nix { };
+        csv2json = prev.callPackage packages/csv2json.nix { };
+        fix-sd = prev.callPackage packages/fix-sd.nix { };
+        json2csv = prev.callPackage packages/json2csv.nix { };
+        mp3player-write = prev.callPackage packages/mp3player-write.nix { };
+        mushakkil = prev.callPackage packages/mushakkil.nix { };
+        nix-haddock-index = prev.callPackage packages/nix-haddock-index.nix { };
+        pdf-ocr = prev.callPackage packages/pdf-ocr.nix { };
+        prospekte = prev.callPackage packages/prospekte.nix { };
+        readme = prev.callPackage packages/readme.nix { };
 
         ashell = nixpkgs-unstable.legacyPackages.${prev.system}.ashell;
 
@@ -344,7 +353,6 @@
         unicodmenu = prev.callPackage packages/unicodmenu.nix { };
         vg = prev.callPackage packages/vg.nix { };
         vim-kmein = prev.callPackage packages/vim-kmein { };
-        vimv = prev.callPackage packages/vimv.nix { };
         klem = prev.callPackage packages/klem.nix { };
         yt-dlp-master = prev.callPackage packages/yt-dlp-master.nix { };
 
@@ -551,14 +559,20 @@
             ];
           };
           inherit (pkgs)
+            two56color
+            avesta
             auc
             betacode
             booksplit
             brainmelter
             brassica
+            bvg
+            charinfo
             cheat-sh
+            chunk-pdf
             closest
             cro
+            csv2json
             cyberlocker-tools
             dawn-editor
             default-gateway
@@ -569,6 +583,7 @@
             emailmenu
             exodus
             fkill
+            fix-sd
             fzfmenu
             gfs-fonts
             bring-out-the-gimp
@@ -579,6 +594,7 @@
             image-convert-tolino
             ipa
             jsesh
+            json2csv
             kirciuoklis
             klem
             kpaste
@@ -587,24 +603,30 @@
             mansplain
             manual-sort
             morris
+            mp3player-write
             mpv-iptv
             mpv-radio
             mpv-tuner
             mpv-tv
+            mushakkil
             new-mac
             niveum-ssh
             nix-git
+            nix-haddock-index
             noise-waves
             notemenu
             obsidian-vim
             opustags
+            pdf-ocr
             picoclaw
             pls
             polyglot
+            prospekte
             q
             qrpaste
             radio-news
             random-zeno
+            readme
             rfc
             scanned
             stag
@@ -622,7 +644,6 @@
             vim-kmein
             vim-typewriter
             vim-email
-            vimv
             weechat-declarative
             wttr
             yt-dlp-master

modules/retiolum.nix

@@ -1,73 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib;
-let
-  netname = "retiolum";
-  cfg = config.networking.retiolum;
-in
-{
-  options = {
-    networking.retiolum.ipv4 = mkOption {
-      type = types.str;
-      description = ''
-        own ipv4 address
-      '';
-    };
-    networking.retiolum.ipv6 = mkOption {
-      type = types.str;
-      description = ''
-        own ipv6 address
-      '';
-    };
-    networking.retiolum.nodename = mkOption {
-      type = types.str;
-      default = config.networking.hostName;
-      description = ''
-        tinc network name
-      '';
-    };
-  };
-
-  config = {
-    services.tinc.networks.${netname} = {
-      name = cfg.nodename;
-      hosts = builtins.mapAttrs (name: _: builtins.readFile "${<retiolum/hosts>}/${name}") (
-        builtins.readDir <retiolum/hosts>
-      );
-      rsaPrivateKeyFile = toString <system-secrets/retiolum.key>;
-      ed25519PrivateKeyFile = toString <system-secrets/retiolum.ed25519>;
-      extraConfig = ''
-        LocalDiscovery = yes
-        AutoConnect = yes
-      '';
-    };
-
-    networking.extraHosts = builtins.readFile (toString <retiolum/etc.hosts>);
-
-    environment.systemPackages = [ config.services.tinc.networks.${netname}.package ];
-
-    networking.firewall = {
-      allowedTCPPorts = [ 655 ];
-      allowedUDPPorts = [ 655 ];
-    };
-    #services.netdata.portcheck.checks.tinc.port = 655;
-
-    systemd.network = {
-      enable = true;
-      networks = {
-        "${netname}".extraConfig = ''
-          [Match]
-          Name = tinc.${netname}
-
-          [Network]
-          Address=${cfg.ipv4}/12
-          Address=${cfg.ipv6}/16
-        '';
-      };
-    };
-  };
-}

packages/256color.nix

@@ -0,0 +1,37 @@
+{
+  writers,
+}:
+writers.writeDashBin "256color" ''
+  pl() {
+    for i in $(seq $1 $(expr $2 - 1)); do
+      printf '\e[38;5;%sm%03i\e[m ' $i $i
+    done
+    printf '\e[38;5;%sm%03i\e[m\n' $2 $2
+  }
+
+  p() {
+    printf '\e[38;5;%sm%03i\e[m ' $1 $1
+  }
+
+  p6x6() {
+    for i in $(seq 0 5); do
+      for j in $(seq 0 5); do
+        p $(expr $1 + $i + $j \* 6)
+      done
+      echo
+    done
+  }
+
+  pl 0 7
+  pl 8 15
+
+  p6x6 16
+  p6x6 52
+  p6x6 88
+  p6x6 124
+  p6x6 160
+  p6x6 196
+
+  pl 232 243
+  pl 244 255
+''

packages/avesta.nix

@@ -0,0 +1,66 @@
+# Transliterate Latin-script Avestan to Avestan Unicode script
+{
+  lib,
+  writers,
+  gnused,
+}:
+let
+  sedScript = builtins.toFile "avesta.sed" ''
+    s/ā̊/𐬃/g
+    s/t̰/𐬝/g
+    s/ṣ̌/𐬴/g
+    s/š́/𐬳/g
+    s/ą̄/𐬅/g
+    s/ŋᵛ/𐬤/g
+    s/ə̄/𐬇/g
+    s/ŋ́/𐬣/g
+    s/x́/𐬒/g
+    s/xᵛ/𐬓/g
+    s/a/𐬀/g
+    s/ā/𐬁/g
+    s/å/𐬂/g
+    s/ą/𐬄/g
+    s/ə/𐬆/g
+    s/e/𐬈/g
+    s/ē/𐬉/g
+    s/o/𐬊/g
+    s/ō/𐬋/g
+    s/i/𐬌/g
+    s/ī/𐬍/g
+    s/u/𐬎/g
+    s/ū/𐬏/g
+    s/k/𐬐/g
+    s/x/𐬑/g
+    s/g/𐬔/g
+    s/ġ/𐬕/g
+    s/γ/𐬖/g
+    s/c/𐬗/g
+    s/j/𐬘/g
+    s/t/𐬙/g
+    s/θ/𐬚/g
+    s/d/𐬛/g
+    s/δ/𐬜/g
+    s/p/𐬞/g
+    s/f/𐬟/g
+    s/b/𐬠/g
+    s/β/𐬡/g
+    s/ŋ/𐬢/g
+    s/n/𐬥/g
+    s/ń/𐬦/g
+    s/ṇ/𐬧/g
+    s/m/𐬨/g
+    s/m̨/𐬩/g
+    s/ẏ/𐬫/g
+    s/y/𐬪/g
+    s/v/𐬬/g
+    s/r/𐬭/g
+    s/s/𐬯/g
+    s/z/𐬰/g
+    s/š/𐬱/g
+    s/ž/𐬲/g
+    s/h/𐬵/g
+  '';
+in
+writers.writeDashBin "avesta" ''
+  exec ${lib.getExe gnused} -f ${sedScript} "$@"
+''

packages/bvg.nix

@@ -0,0 +1,52 @@
+# Berlin BVG transit disruption checker
+{
+  lib,
+  writers,
+  curl,
+  jq,
+}:
+writers.writeDashBin "bvg" ''
+  ${lib.getExe curl} -sSL 'https://www.bvg.de/disruption-reports/q' \
+    --data-raw '{"variables":{},"query":"{
+      allDisruptions {
+        disruptions {
+          meldungsId
+          linie
+          verkehrsmittel
+          __typename
+          ... on Traffic {
+            datum
+            gueltigVonDatum
+            gueltigVonZeit
+            gueltigBisDatum
+            gueltigBisZeit
+            richtungName
+            richtungHafasId
+            beginnAbschnittName
+            beginnAbschnittHafasId
+            endeAbschnittName
+            endeAbschnittHafasId
+            textIntUrsache
+            sev
+            textIntAuswirkung
+            umfahrung
+            textWAPSMSUrsache
+            textWAPSMSAuswirkung
+            prioritaet
+            __typename
+          }
+        }
+        __typename
+      }
+    }"}' \
+    | ${lib.getExe jq} --arg interesting "$interesting" '
+      .data.allDisruptions.disruptions
+      | map(select(
+        (.linie as $linie
+        | $interesting
+        | split(" ")
+        | index($linie))
+        and (.["__typename"] == "Traffic")
+      ))
+    '
+''

packages/charinfo.nix

@@ -0,0 +1,17 @@
+# Print Unicode character info for each character on stdin
+{
+  writers,
+  python3,
+}:
+writers.writePython3Bin "charinfo" {
+  flakeIgnore = [ "E501" "E722" ];
+} ''
+  import sys
+  import unicodedata
+
+  for index, character in enumerate(sys.stdin.read().strip()):
+      try:
+          print(index, character, hex(ord(character)), unicodedata.category(character), unicodedata.name(character))
+      except Exception:
+          print(index, character, hex(ord(character)))
+''

packages/chunk-pdf.nix

@@ -0,0 +1,31 @@
+# Split a PDF into chunks of N pages
+{
+  lib,
+  writers,
+  pdftk,
+  gnugrep,
+  coreutils,
+}:
+writers.writeDashBin "chunk-pdf" ''
+  set -efu
+
+  INPUT_FILE="''${2:?Pass the PDF path as second argument.}"
+  PAGES_PER_REPORT="''${1:?Pass the chunk size as first argument.}"
+
+  if [ ! -f "$INPUT_FILE" ]; then
+    echo >&2 "File $INPUT_FILE does not exist."
+    exit 1
+  fi
+
+  TOTAL_PAGES="$(${lib.getExe pdftk} "$INPUT_FILE" dump_data | ${lib.getExe gnugrep} NumberOfPages | ${lib.getExe' coreutils "cut"} -f2 -d' ')"
+
+  RUNS=$((TOTAL_PAGES/PAGES_PER_REPORT))
+
+  for run in $(${lib.getExe' coreutils "seq"} 0 "$((RUNS-1))"); do
+    start_page=$((run*PAGES_PER_REPORT+1))
+    end_page=$(((run+1)*PAGES_PER_REPORT))
+    output_file="chunk_$((run+1)).pdf"
+    echo "splitting $INPUT_FILE from $start_page to $end_page into $output_file"
+    ${lib.getExe pdftk} "$INPUT_FILE" cat "$start_page-$end_page" output "$output_file"
+  done
+''

packages/csv2json.nix

@@ -0,0 +1,21 @@
+# Convert CSV to JSON
+{
+  writers,
+  python3,
+}:
+writers.writePython3Bin "csv2json" {
+  flakeIgnore = [ "E501" ];
+} ''
+  import csv
+  import json
+  import sys
+  import argparse
+
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--delimiter", "-d", default=",", help="CSV field separator")
+
+  args = parser.parse_args()
+
+  if __name__ == "__main__":
+      json.dump(list(csv.DictReader(sys.stdin, delimiter=args.delimiter)), sys.stdout)
+''

packages/fix-sd.nix

@@ -0,0 +1,35 @@
+# Recover files from a corrupted exFAT SD card
+{
+  lib,
+  writers,
+  exfatprogs,
+  util-linux,
+  coreutils,
+  findutils,
+  gnused,
+}:
+writers.writeDashBin "fix-sd" ''
+  set -efu
+
+  drive="''${1:?Usage: fix-sd /dev/sdX [output-dir]}"
+  output_dir="''${2:-$(${lib.getExe' coreutils "mktemp"} -d "''${TMPDIR:-/tmp}/fix-sd-XXXXXX")}"
+  mountpoint="$(${lib.getExe' coreutils "mktemp"} -d "''${TMPDIR:-/tmp}/fix-sd-mount-XXXXXX")"
+
+  trap clean EXIT
+  clean() {
+    ${lib.getExe' util-linux "umount"} "$mountpoint" 2>/dev/null || true
+    ${lib.getExe' coreutils "rmdir"} "$mountpoint" 2>/dev/null || true
+  }
+
+  filenames="$(${lib.getExe' exfatprogs "fsck.exfat"} "$drive" 2>&1 | ${lib.getExe gnused} -nE "s/.* file '(.*?)' is not allocated.*/\1/p")"
+  ${lib.getExe' coreutils "mkdir"} -p "$mountpoint" "$output_dir"
+  ${lib.getExe' util-linux "mount"} "$drive" "$mountpoint"
+
+  echo "$filenames" | while read -r filename; do
+    [ -n "$filename" ] || continue
+    ${lib.getExe' findutils "find"} "$mountpoint" -type f -name "$filename" -exec ${lib.getExe' coreutils "cp"} {} "$output_dir" \;
+  done
+
+  echo "Recovered files saved to $output_dir"
+  ${lib.getExe' exfatprogs "fsck.exfat"} "$drive"
+''

packages/gpt.nix

@@ -1,15 +0,0 @@
-{
-  curl,
-  writers,
-  jq,
-  apiKeyCommand ? "pass api-keys/openai.com",
-  model ? "gpt-3.5-turbo",
-}:
-writers.writeDashBin "gpt" ''
-  json=$(jq --slurp --raw-input '{model:"${model}", messages: [{role: "user", content: .}]}')
-  ${curl}/bin/curl -sSL https://api.openai.com/v1/chat/completions \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $(${apiKeyCommand})" \
-    -d "$json" \
-    | ${jq}/bin/jq -r '.choices[] | .message.content'
-''

packages/hora.nix

@@ -1,81 +0,0 @@
-{
-  symlinkJoin,
-  hledger,
-  writers,
-  lib,
-  git,
-  coreutils,
-  gnugrep,
-  timeLedger,
-  ...
-}:
-let
-  date = "${coreutils}/bin/date +'%Y-%m-%d %H:%M:%S'";
-
-  hora = writers.writeDashBin "hora" "${hledger}/bin/hledger -f ${lib.escapeShellArg timeLedger} \"$@\"";
-  hora-edit = writers.writeDashBin "hora-edit" "$EDITOR ${lib.escapeShellArg timeLedger}";
-  hora-status = writers.writeDashBin "hora-status" "${coreutils}/bin/tac ${lib.escapeShellArg timeLedger} | ${gnugrep}/bin/grep -m 1 .";
-
-  hora-start = writers.writeDashBin "hora-start" ''
-    last_nonempty_line=$(${hora-status}/bin/hora-status)
-    (echo $last_nonempty_line | ${gnugrep}/bin/grep -q "^o") || {
-        echo "Last activity must be closed: $last_nonempty_line" >/dev/stderr
-        exit 1
-    }
-
-    account=$1
-    (${hora}/bin/hora accounts | ${gnugrep}/bin/grep -q "^$account\$") || {
-        echo "The account '$account' is not known. Please add manually."
-        exit 1
-    }
-
-    message=$2
-    date=$(${date})
-    echo "i $date $account  $message\n" >> "${timeLedger}"
-    echo "Started $account at $date" >/dev/stderr 
-  '';
-
-  hora-stop = writers.writeDashBin "hora-stop" ''
-    last_nonempty_line=$(${hora-status}/bin/hora-status)
-
-    (echo $last_nonempty_line | ${gnugrep}/bin/grep "^i") || {
-        echo "Last activity cannot be closed: $last_nonempty_line" >/dev/stderr
-        exit 1
-    }
-
-    last_activity=$(echo "$last_nonempty_line" | ${coreutils}/bin/cut -d' ' -f 4)
-    date=$(${date})
-
-    echo "o $date\n" >> ${timeLedger}
-    echo "Stopped $last_activity at $date" >/dev/stderr
-  '';
-
-  hora-year = writers.writeDashBin "hora-year" ''
-    ${hora}/bin/hora balance --tree --monthly --begin $(${coreutils}/bin/date +%Y) --depth 1
-  '';
-  hora-git = writers.writeDashBin "hora-git" ''
-    directory=$(${coreutils}/bin/dirname ${lib.escapeShellArg timeLedger})
-    if [ $# -gt 0 ]
-    then
-      ${git}/bin/git -C "$directory" --all --message=$(${date})
-    else
-      ${git}/bin/git -C "$directory" "$@"
-    fi
-  '';
-  hora-weekly = writers.writeDashBin "hora-weekly" ''
-    ${hora}/bin/hora register -p weekly --depth 1 --empty
-  '';
-in
-symlinkJoin {
-  name = "hora";
-  paths = [
-    hora
-    hora-edit
-    hora-start
-    hora-status
-    hora-stop
-    hora-year
-    hora-git
-    hora-weekly
-  ];
-}

packages/json2csv.nix

@@ -0,0 +1,32 @@
+# Convert JSON array of objects to CSV
+{
+  writers,
+  python3,
+}:
+writers.writePython3Bin "json2csv" {
+  flakeIgnore = [ "E501" ];
+} ''
+  import csv
+  import json
+  import sys
+
+  if __name__ == "__main__":
+      json_list = json.load(sys.stdin)
+      if not isinstance(json_list, list):
+          print("JSON object is not a list.", file=sys.stderr)
+          sys.exit(1)
+      if len(json_list) == 0:
+          print("JSON list is empty.", file=sys.stderr)
+          sys.exit(1)
+      keys = set()
+      for element in json_list:
+          if isinstance(element, dict):
+              keys |= element.keys()
+          else:
+              print("Non-dict element:", element, file=sys.stderr)
+              sys.exit(1)
+      writer = csv.DictWriter(sys.stdout, fieldnames=list(keys))
+      writer.writeheader()
+      for element in json_list:
+          writer.writerow(element)
+''

packages/k-lock.nix

@@ -1,30 +0,0 @@
-{
-  writers,
-  lib,
-  xlockmore,
-}:
-let
-  xlockModes = lib.concatStringsSep "\\n" [
-    # "braid"
-    "galaxy"
-    # "lightning"
-    # "matrix"
-    "pyro2"
-    "space"
-  ];
-in
-writers.writeDashBin "k-lock" ''
-  MODE=$(printf "${xlockModes}" | shuf -n 1)
-
-  ${xlockmore}/bin/xlock \
-    -saturation 0.4 \
-    -erasemode no_fade \
-    +description \
-    -showdate \
-    -username " " \
-    -password " " \
-    -info " " \
-    -validate "..." \
-    -invalid "Computer says no." \
-    -mode "$MODE"
-''

packages/mp3player-write.nix

@@ -0,0 +1,90 @@
+# Convert and transfer audio files to an MP3 player
+{
+  lib,
+  writers,
+  ffmpeg,
+  coreutils,
+  gnugrep,
+  gnused,
+}:
+writers.writeBashBin "mp3player-write" ''
+  set -e
+
+  SPEED=1.0
+
+  while getopts ":s:" opt; do
+    case $opt in
+      s) SPEED=$OPTARG ;;
+      \?) echo "Invalid option: -$OPTARG" >&2; exit 1 ;;
+      :) echo "Option -$OPTARG requires a value." >&2; exit 1 ;;
+    esac
+  done
+  shift $((OPTIND -1))
+
+  if [ "$#" -lt 2 ]; then
+    echo "Usage: mp3player-write [-s speed] MOUNT_POINT FILE1 [FILE2 ...]"
+    exit 1
+  fi
+
+  MOUNT_POINT=$1
+  shift
+  FILES=("$@")
+
+  if [ ! -d "$MOUNT_POINT" ]; then
+    echo "Error: Mount point '$MOUNT_POINT' does not exist."
+    exit 1
+  fi
+
+  TOTAL_SIZE=0
+  for f in "''${FILES[@]}"; do
+    if [ ! -f "$f" ]; then
+      echo "Warning: File '$f' does not exist, skipping."
+      continue
+    fi
+    FILE_SIZE=$(${lib.getExe' coreutils "stat"} --printf="%s" "$f")
+    TOTAL_SIZE=$((TOTAL_SIZE + FILE_SIZE / 2))
+  done
+
+  AVAILABLE=$(${lib.getExe' coreutils "df"} --output=avail "$MOUNT_POINT" | ${lib.getExe' coreutils "tail"} -n 1)
+  AVAILABLE=$((AVAILABLE * 1024))
+
+  if [ "$TOTAL_SIZE" -gt "$AVAILABLE" ]; then
+    echo "Error: Not enough space. Required: $TOTAL_SIZE bytes, Available: $AVAILABLE bytes"
+    exit 1
+  fi
+
+  echo "Enough space available. Starting conversion..."
+
+  sanitize_filename() {
+    local name
+    name=$(${lib.getExe' coreutils "basename"} "$1")
+    name=''${name%.*}
+    name=$(echo "$name" | ${lib.getExe' coreutils "tr"} ' ' '_' | ${lib.getExe' coreutils "tr"} -cd '[:alnum:]_-')
+    echo "''${name:0:50}"
+  }
+
+  for f in "''${FILES[@]}"; do
+    [ -f "$f" ] || continue
+
+    existing_prefixes=$(${lib.getExe' coreutils "ls"} "$MOUNT_POINT" | ${lib.getExe gnugrep} -E '^[0-9].*\.mp3$' | ${lib.getExe gnused} -E 's/^([0-9]).*/\1/' | ${lib.getExe' coreutils "sort"} -n | ${lib.getExe' coreutils "uniq"})
+    for i in {0..9}; do
+      if ! echo "$existing_prefixes" | ${lib.getExe gnugrep} -q "^$i$"; then
+        PREFIX=$i
+        break
+      fi
+    done
+
+    BASENAME=$(sanitize_filename "$f")
+    OUT_PATTERN="$MOUNT_POINT/''${PREFIX}_%03d_''${BASENAME}.mp3"
+
+    echo "Converting '$f' to '$OUT_PATTERN' at speed $SPEED..."
+
+    ${lib.getExe ffmpeg} -nostdin -i "$f" \
+      -filter:a "atempo=$SPEED" \
+      -ar 22050 -ac 1 -c:a libmp3lame -b:a 32k \
+      -f segment -segment_time 300 \
+      "$OUT_PATTERN"
+  done
+
+  echo "All files processed successfully."
+''

packages/mushakkil.nix

@@ -0,0 +1,14 @@
+# Add Arabic diacritics (tashkeel) to text via alsharekh.org
+{
+  lib,
+  writers,
+  curl,
+  jq,
+}:
+writers.writeDashBin "mushakkil" ''
+  ${lib.getExe curl} -sSL 'https://diac.alsharekh.org/Diac/DiacText' \
+    -H "Content-Type: application/json" \
+    --data-raw "$(${lib.getExe jq} --raw-input '{word: ., type: 1}')" \
+    --compressed \
+    | ${lib.getExe jq} -r .diacWord
+''

packages/nix-haddock-index.nix

@@ -0,0 +1,84 @@
+# Generate a Haddock index page for all packages visible to the current GHC
+{
+  lib,
+  writers,
+  coreutils,
+  gnugrep,
+  gnused,
+  graphviz,
+}:
+writers.writeBashBin "nix-haddock-index" ''
+  set -efux
+
+  if test -z "''${NIX_GHC-}"; then
+    NIX_GHC=$(${lib.getExe' coreutils "readlink"} -f "$(type -P ghc)")
+  fi
+
+  if ! echo $NIX_GHC | ${lib.getExe gnugrep} -q '^/nix/store/'; then
+    printf '%s: error: unsupported GHC executable path (not in Nix store): %q\n' \
+        "$0" \
+        "$NIX_GHC" \
+      >&2
+    exit 1
+  fi
+
+  NIX_GHC_PREFIX=$(${lib.getExe' coreutils "dirname"} "$(${lib.getExe' coreutils "dirname"} "$NIX_GHC")")
+  NIX_GHC_DOCDIR=$NIX_GHC_PREFIX/share/doc/ghc/html
+
+  main() {
+    hash=$(echo $NIX_GHC_PREFIX | ${lib.getExe gnused} -n 's|^/nix/store/\([a-z0-9]\+\).*|\1|p')
+    title="Haddock index for $NIX_GHC_PREFIX"
+
+    header=$(
+      printf 'Haddock index for <a href="%s">%s</a>\n' \
+          $NIX_GHC_PREFIX \
+          $NIX_GHC_PREFIX \
+    )
+
+    suffix=''${hash:+-$hash}
+    index_file=/tmp/haddock$suffix-index.html
+    svg_file=/tmp/haddock$suffix.svg
+
+    eval "$(
+      echo 'gen_index() {'
+      echo '  html_head'
+      "$NIX_GHC_PREFIX"/bin/ghc-pkg dump | ${lib.getExe gnused} -n '
+        s/^---$/  reset/p
+        s/^\(name\|version\):\s*\([-A-Za-z0-9_.]\+\)$/  \1=\2/p
+        s/^haddock-html:\s*\([-A-Za-z0-9_./]\+\)$/  haddock_html \1/p
+      '
+      echo '  html_foot'
+      echo '}'
+    )"
+
+    gen_index > $index_file
+
+    "$NIX_GHC_PREFIX"/bin/ghc-pkg dot | ${lib.getExe' graphviz "tred"} | ${lib.getExe' graphviz "dot"} -Tsvg | ${lib.getExe gnused} '
+      s/<svg width="[0-9]\+pt" height="[0-9]\+pt"/<svg width="3600px" height="100%"/
+    ' > $svg_file
+
+    echo $index_file
+  }
+  reset() {
+    unset name version
+  }
+  haddock_html() {
+    printf '<li>'
+    printf '<a href="%s/index.html">%s</a>' "$1" "$name-$version"
+    printf '</li>\n'
+  }
+  html_head() {
+    printf '<!doctype html>\n'
+    printf '<title>%s</title>\n' "$title"
+    printf '<link href="%s" rel="stylesheet" type="text/css">\n' \
+        "$NIX_GHC_DOCDIR/libraries/ocean.css"
+    printf '<h1>%s</h1>\n' "$header"
+    printf '<ul>\n'
+  }
+  html_foot() {
+    printf '</ul>\n'
+    printf '<a href="%s">graph</a>\n' "$svg_file"
+  }
+
+  main "$@"
+''

packages/pdf-ocr.nix

@@ -0,0 +1,30 @@
+# OCR a PDF file to text using tesseract
+{
+  lib,
+  writers,
+  poppler_utils,
+  tesseract,
+  coreutils,
+}:
+writers.writeDashBin "pdf-ocr" ''
+  set -efu
+
+  pdf_path="$(${lib.getExe' coreutils "realpath"} "$1")"
+
+  [ -f "$pdf_path" ] || {
+    echo "Usage: pdf-ocr FILE.pdf" >&2
+    exit 1
+  }
+
+  tmpdir="$(${lib.getExe' coreutils "mktemp"} -d)"
+  trap 'rm -rf $tmpdir' EXIT
+
+  cd "$tmpdir"
+
+  ${lib.getExe' poppler_utils "pdftoppm"} -png "$pdf_path" pdf-ocr
+  for png in pdf-ocr*.png; do
+    ${lib.getExe tesseract} "$png" "$png.txt" 2>/dev/null
+  done
+
+  cat pdf-ocr-*.txt
+''

packages/prospekte.nix

@@ -0,0 +1,77 @@
+# Browse and view German supermarket flyers (Lidl, Aldi, REWE, Kaufland, Netto)
+{
+  writers,
+  curl,
+  jq,
+  fzf,
+  zathura,
+  coreutils,
+  htmlq,
+  gnugrep,
+  gnused,
+  lib,
+}:
+writers.writeDashBin "prospekte" ''
+  export PATH=${lib.makeBinPath [ curl jq fzf zathura coreutils htmlq gnugrep gnused ]}:$PATH
+
+  lidl() {
+    echo LIDL
+    curl -sSL 'https://endpoints.lidl-flyer.com/v3/region-overview/lidl/de-DE/0.json' \
+      | jq -r '
+        .categories
+        | map(select(.name == "Filial-Angebote") | .subcategories | map(.flyers))
+        | flatten
+        | flatten
+        | .[]
+        | .pdfUrl
+      '
+  }
+
+  aldi_nord() {
+    echo ALDI nord
+    echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-aktuell/GetPDF.ashx'
+    echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-vorschau/GetPDF.ashx'
+  }
+
+  rewe_berlin() {
+    store_id=662366923
+    publisher_id=1062
+
+    echo REWE
+    curl -sSL "https://www.bonialserviceswidget.de/de/stores/$store_id/brochures?storeId=$store_id&publisherId=$publisher_id" | while read -r brochure_id; do
+      curl -sSL "https://www.bonialserviceswidget.de/de/v5/brochureDetails/$brochure_id?publisherId=$publisher_id" | jq -r .pdfUrl
+    done
+  }
+
+  kaufland() {
+    region_code=8920
+    echo KAUFLAND
+    curl -sSL https://filiale.kaufland.de/prospekte.html | htmlq --attribute href '.flyer a' | grep -Eo 'DE_de_KDZ[^/]*' | sed "s/_3000_/_''${region_code}_/" | while read -r flyer_id; do
+      curl -sSL "https://endpoints.leaflets.kaufland.com/v3/$flyer_id/flyer.json?regionCode=$region_code" | jq -r .flyer.pdfUrl
+    done
+  }
+
+  netto_schwarz() {
+    echo 'NETTO (schwarz)'
+    curl -sSL 'https://squid-api.tjek.com/v2/catalogs?dealer_ids=90f2VL&order_by=created' \
+      | jq -r '.[] | .id' \
+      | while read -r flyer_id; do
+        curl -sSL "https://squid-api.tjek.com/v2/catalogs/$flyer_id/download" \
+          | jq -r .pdf_url
+      done
+  }
+
+  dir="$(mktemp -d)"
+  trap 'rm -rf "$dir"' EXIT
+
+  prospekt_url="$( (
+    lidl
+    aldi_nord
+    rewe_berlin
+    kaufland
+    netto_schwarz
+  ) | fzf)"
+
+  curl -sSL "$prospekt_url" -o "$dir/prospekt.pdf"
+  zathura "$dir/prospekt.pdf"
+''

packages/readme.nix

@@ -0,0 +1,13 @@
+# Render a GitHub repo's README.md as a man page
+{
+  lib,
+  writers,
+  curl,
+  pandoc,
+  man,
+}:
+writers.writeDashBin "readme" ''
+  ${lib.getExe curl} -sSL "https://raw.githubusercontent.com/$*/master/README.md" \
+    | ${lib.getExe pandoc} -f gfm -t man -s \
+    | ${lib.getExe man} -l -
+''

packages/vimv.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  stdenv,
-  bash,
-  fetchFromGitHub,
-}:
-stdenv.mkDerivation {
-  name = "vimv";
-  src = fetchFromGitHub {
-    owner = "thameera";
-    repo = "vimv";
-    rev = "4152496c1946f68a13c648fb7e583ef23dac4eb8";
-    sha256 = "1fsrfx2gs6bqx7wk7pgcji2i2x4alqpsi66aif4kqvnpqfhcfzjd";
-  };
-  phases = [ "installPhase" ];
-  installPhase = ''
-    mkdir -p $out/bin
-    sed 's:#!/bin/bash:#!${bash}/bin/bash:' $src/vimv > $out/bin/vimv
-    chmod 755 $out/bin/vimv
-  '';
-  meta = with lib; {
-    homepage = "https://github.com/thameera/vimv";
-    description = "Batch-rename files using Vim";
-    license = licenses.mit;
-    platforms = platforms.all;
-  };
-}

secrets.txt

@@ -1,87 +0,0 @@
-secrets/alertmanager-token-reporters.age
-secrets/brevo-key.age
-secrets/cifs-credentials-zodiac.age
-secrets/copecart-ipn.age
-secrets/di-fm-key.age
-secrets/email-password-cock.age
-secrets/email-password-fysi.age
-secrets/email-password-ical-ephemeris.age
-secrets/email-password-letos.age
-secrets/email-password-meinhak99.age
-secrets/email-password-posteo.age
-secrets/fatteh-retiolum-privateKey-ed25519.age
-secrets/fatteh-retiolum-privateKey-rsa.age
-secrets/fatteh-syncthing-cert.age
-secrets/fatteh-syncthing-key.age
-secrets/fatteh-wireguard-aether-key.age
-secrets/fatteh-wireguard-aether-psk.age
-secrets/ful-retiolum-privateKey-ed25519.age
-secrets/ful-retiolum-privateKey-rsa.age
-secrets/ful-root.age
-secrets/fu-sftp-key.age
-secrets/gemini-api-key.age
-secrets/github-token-i3status-rust.age
-secrets/grafana-password-admin.age
-secrets/hetzner-storagebox-credentials.age
-secrets/home-assistant-token.age
-secrets/kabsa-retiolum-privateKey-ed25519.age
-secrets/kabsa-retiolum-privateKey-rsa.age
-secrets/kabsa-syncthing-cert.age
-secrets/kabsa-syncthing-key.age
-secrets/kabsa-wireguard-aether-key.age
-secrets/kabsa-wireguard-aether-psk.age
-secrets/kfm-password.age
-secrets/kibbeh-retiolum-privateKey-ed25519.age
-secrets/kibbeh-retiolum-privateKey-rsa.age
-secrets/kibbeh-syncthing-cert.age
-secrets/kibbeh-syncthing-key.age
-secrets/ledger-basicAuth.age
-secrets/makanek-retiolum-privateKey-ed25519.age
-secrets/makanek-retiolum-privateKey-rsa.age
-secrets/manakish-retiolum-privateKey-ed25519.age
-secrets/manakish-retiolum-privateKey-rsa.age
-secrets/manakish-syncthing-cert.age
-secrets/manakish-syncthing-key.age
-secrets/manakish-wireguard-aether-key.age
-secrets/manakish-wireguard-aether-psk.age
-secrets/mastodon-token-celan.age
-secrets/mastodon-token-hesychius.age
-secrets/mastodon-token-nietzsche.age
-secrets/mastodon-token-smyth.age
-secrets/mastodon-token-tlgwotd.age
-secrets/mastodon-token-transits.age
-secrets/matrix-token-lakai.age
-secrets/matrix-token-lakai-env.age
-secrets/maxmind-license-key.age
-secrets/mega-password.age
-secrets/miniflux-api-token.age
-secrets/miniflux-credentials.age
-secrets/nextcloud-password-admin.age
-secrets/nextcloud-password-database.age
-secrets/nextcloud-password-fysi.age
-secrets/nextcloud-password-kieran.age
-secrets/onlyoffice-jwt-key.age
-secrets/openweathermap-api-key.age
-secrets/restic.age
-secrets/secrets.nix
-secrets/spotify-password.age
-secrets/spotify-username.age
-secrets/stw-berlin-card-code.age
-secrets/tabula-retiolum-privateKey-ed25519.age
-secrets/tabula-retiolum-privateKey-rsa.age
-secrets/tahina-retiolum-privateKey-ed25519.age
-secrets/tahina-retiolum-privateKey-rsa.age
-secrets/telegram-token-betacode.age
-secrets/telegram-token-kmein.age
-secrets/telegram-token-menstruation.age
-secrets/telegram-token-nachtischsatan.age
-secrets/telegram-token-proverb.age
-secrets/telegram-token-reverse.age
-secrets/telegram-token-streaming-link.age
-secrets/weechat-sec.conf.age
-secrets/wifi.age
-secrets/zaatar-moodle-dl-basicAuth.age
-secrets/zaatar-moodle-dl-tokens.json.age
-secrets/zaatar-retiolum-privateKey-ed25519.age
-secrets/zaatar-retiolum-privateKey-rsa.age
-secrets/zaatar-ympd-basicAuth.age

systems/kibbeh/configuration.nix

@@ -8,17 +8,14 @@
   imports = [
     ./hardware-configuration.nix
     ../../configs/spacetime.nix
-    ../../configs/admin-essentials.nix
     ../../configs/keyboard
     ../../configs/sound.nix
     ../../configs/printing.nix
-    ../../configs/nix.nix
     ../../configs/fonts.nix
     ../../configs/mycelium.nix
     ../../configs/retiolum.nix
     ../../configs/sshd.nix
     ../../configs/sudo.nix
-    ../../configs/zsh.nix
   ];
 
   age.secrets = {

systems/tabula/configuration.nix

@@ -10,8 +10,6 @@
     ../../configs/spacetime.nix
     ../../configs/retiolum.nix
     ../../configs/sshd.nix
-    ../../configs/nix.nix
-    ../../configs/admin-essentials.nix
   ];
 
   age.secrets = {

systems/tahina/configuration.nix

@@ -10,8 +10,6 @@
     ../../configs/spacetime.nix
     ../../configs/sshd.nix
     ../../configs/retiolum.nix
-    ../../configs/nix.nix
-    ../../configs/admin-essentials.nix
   ];
 
   age.secrets = {

systems/zaatar/configuration.nix

@@ -11,7 +11,6 @@
     ./hardware-configuration.nix
     ./home-assistant.nix
     ../../configs/printing.nix
-    ../../configs/tmux.nix
     ../../configs/wpa_supplicant.nix
   ];
 
@@ -78,6 +77,8 @@
       pkgs.python3 # for sshuttle
     ];
 
+  users.users.root.extraGroups = [ "lp" "scanner" ];
+
   networking = {
     hostName = "zaatar";
     wireless.interfaces = [ "wlp2s0" ];