wip: flakes

This reverts commit 5ade0a7011.

.bin/256color

@@ -0,0 +1,38 @@
+#! /bin/sh
+set -euf
+
+pl() {
+  for i in $(seq $1 $(expr $2 - 1)); do
+    printf '\e[38;5;%sm%03i\e[m ' $i $i
+  done
+  printf '\e[38;5;%sm%03i\e[m\n' $2 $2
+}
+
+p() {
+  printf '\e[38;5;%sm%03i\e[m ' $1 $1
+}
+pn() {
+  printf '\e[38;5;%sm%03i\e[m\n' $1 $1
+}
+
+p6x6() {
+  for i in $(seq 0 5); do
+    for j in $(seq 0 5); do
+      p $(expr $1 + $i + $j \* 6)
+    done
+    echo
+  done
+}
+
+pl 0 7
+pl 8 15
+
+p6x6 16
+p6x6 52
+p6x6 88
+p6x6 124
+p6x6 160
+p6x6 196
+
+pl 232 243
+pl 244 255

.bin/browser

@@ -0,0 +1,24 @@
+#!/bin/sh -e
+#
+# Usage: browser
+#        pipe html to a browser
+# e.g.
+#  $ echo '<h1>hi mom!</h1>' | browser
+#  $ ron -5 man/rip.5.ron | browser   
+
+if [ -t 0 ]; then
+  if [ -n "$1" ]; then
+    open $1
+  else
+    cat <<usage
+Usage: browser
+       pipe html to a browser
+$ echo '<h1>hi mom!</h1>' | browser
+$ ron -5 man/rip.5.ron | browser
+usage
+fi
+else
+  f="/tmp/browser.$RANDOM.html"
+  cat /dev/stdin > $f
+  xdg-open $f
+fi

.bin/bvg.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+interesting="U6 N6 140 M46 184 N84"
+
+curl -sSL 'https://www.bvg.de/disruption-reports/q' \
+  --data-raw '{"variables":{},"query":"{
+    allDisruptions {
+      disruptions {
+        meldungsId
+        linie
+        verkehrsmittel
+        __typename
+        ... on Traffic {
+          datum
+          gueltigVonDatum
+          gueltigVonZeit
+          gueltigBisDatum
+          gueltigBisZeit
+          richtungName
+          richtungHafasId
+          beginnAbschnittName
+          beginnAbschnittHafasId
+          endeAbschnittName
+          endeAbschnittHafasId
+          textIntUrsache
+          sev
+          textIntAuswirkung
+          umfahrung
+          textWAPSMSUrsache
+          textWAPSMSAuswirkung
+          prioritaet
+          __typename
+        }
+      }
+      __typename
+    }
+  }"}' \
+  | jq --arg interesting "$interesting" '
+    .data.allDisruptions.disruptions
+    | map(select(
+      (.linie as $linie
+      | $interesting
+      | split(" ")
+      | index($linie))
+      and (.["__typename"] == "Traffic")
+    ))
+  '

.bin/candyman

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -efu
+
+usage() {
+  echo >&2 "$0 add-{reddit,telegram,youtube,twitch,twitter} NAME"
+  exit 1
+}
+
+candyman() {
+  curl -fsSv http://news.r/api -H content-type:application/json -d "$(jq -n "
+    {
+      command: \"PRIVMSG\",
+      params: [\"#all\", \"candyman: $1 $2\"]
+    }
+  ")"
+}
+
+[ $# -ge 2 ] || usage
+
+case "$1" in
+  add-reddit|add-telegram|add-youtube|add-twitter|add-twitch)
+    candyman "$@"
+  ;;
+  *) usage;;
+esac

.bin/countdown

@@ -0,0 +1,13 @@
+#!/usr/bin/env -S awk -f
+function z() {
+  getline < "/proc/uptime"
+  close("/proc/uptime")
+  return $0
+}
+BEGIN {
+  x = z()
+  while (1) {
+    y = z()
+    printf "%02d:%05.2f\r", (y - x) / 60, (y - x) % 60
+  }
+}

.bin/csv2json

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+
+import csv
+import json
+import sys
+import argparse
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--delimiter", "-d", default=",", help="CSV field separator")
+
+args = parser.parse_args()
+
+if __name__ == "__main__":
+    json.dump(list(csv.DictReader(sys.stdin, delimiter=args.delimiter)), sys.stdout)

.bin/elm-publish-private

@@ -0,0 +1,7 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -p "(import <nixpkgs> { overlays = [ (import ~/work/fysiweb/engiadina-pwa/devops/pkgs) ]; }).elm-publish-private"
+#! nix-shell -i bash
+
+set -efux
+
+exec elm-publish-private "$@"

.bin/horoscope.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -efu
+
+# Berlin:  -d lodeg=13 -d lomin=22 -d losec=41 -d lodir=E -d ladeg=52 -d lamin=27 -d lasec=42 -d ladir=N -d usecoords=1 \
+# Kassel:  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
+
+
+[ $# -eq 1 ] || {
+  echo >&2 Usage: "$0" TIMESTAMP
+  exit 1
+}
+
+export TZ=UTC
+
+chart_path="$(mktemp /tmp/chart_XXX.pdf)"
+
+timestamp="$1"
+
+year="$(date -d "@$timestamp" +%Y)"
+month="$(date -d "@$timestamp" +%m)"
+day="$(date -d "@$timestamp" +%d)"
+hour="$(date -d "@$timestamp" +%H)"
+minute="$(date -d "@$timestamp" +%M)"
+
+curl -sSL 'https://edifyingfellowship.org/astro/' \
+  -d lodeg=9 -d lomin=32 -d losec=5 -d lodir=E -d ladeg=51 -d lamin=18 -d lasec=17 -d ladir=N -d usecoords=1 \
+  -d ybyr="$year" -d ybmo="$month" -d ybdy="$day" -d ybhr="$hour" -d ybmi="$minute" -d ybsc=0 -d ybtz="$TZ" \
+  -d currenttime=0 \
+  -d title="$timestamp" \
+  -d options[]=VancouverWheel -d options[]=Arrow -d options[]=XBold -d options[]=HouseLabels -d options[]=Placidus \
+  -d options[]=Sun -d options[]=Moon -d options[]=Mercury -d options[]=Venus -d options[]=Mars -d options[]=Jupiter -d options[]=Saturn -d options[]=Uranus -d options[]=Neptune -d options[]=Pluto -d options[]=Ascendant -d options[]=MC -d options[]=Lilith -d options[]=MeanNode -d options[]=TrueNode \
+  -d aspectpct=100 -d format=PDF -d Submit= -o "$chart_path"
+
+zathura "$chart_path"

.bin/json2csv

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+import csv
+import json
+import sys
+
+if __name__ == "__main__":
+    json_list = json.load(sys.stdin)
+    if not isinstance(json_list, list):
+        print("JSON object is not a list.", file=sys.stderr)
+        sys.exit(1)
+    if len(json_list) == 0:
+        print("JSON list is empty.", file=sys.stderr)
+        sys.exit(1)
+    keys = set()
+    for element in json_list:
+        if isinstance(element, dict):
+            keys |= element.keys()
+        else:
+            print("Non-dict element:", element, file=sys.stderr)
+            sys.exit(1)
+    writer = csv.DictWriter(sys.stdout, fieldnames=list(keys))
+    writer.writeheader()
+    for element in json_list:
+        writer.writerow(element)

.bin/libib.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+session_id=7b638c194d9bda74f80043045018cc9e
+
+declare -A libraries
+
+libraries["Literatur"]=344428
+libraries["Sprache"]=344160
+libraries["Miscellanea"]=344427
+libraries["Wissenschaft"]=344429
+libraries["Relicta"]=565920
+
+for library in ${!libraries[@]}
+do
+  curl -sSL 'https://www.libib.com/library/functions/csv-export.php' -H "Cookie: PHPSESSID=$session_id" -d export="${libraries[$library]}" > "$library.csv"
+done

.bin/lieferando.sh

@@ -0,0 +1,81 @@
+#!/bin/sh
+set -efu
+
+if echo "$1" | grep -Eq '[[:digit:]]{5}'; then
+  PLZ="$1"
+else
+  echo >&2 "Usage: $0 PLZ"
+  exit 1
+fi
+
+lieferando_dir=/tmp/lieferando
+mkdir -p "$lieferando_dir/$PLZ"
+
+fetch_restaurants() {
+  cache_path="$lieferando_dir/$PLZ.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "http://www.lieferando.de/$PLZ" \
+      | gunzip \
+      | sed -n '/var restaurants/,/];$/p' \
+      | sed 's/var restaurants =//;$s/;$//' \
+      | prettier --parser=json \
+      | jq '
+        map({
+          name: .[30] | .name,
+          category: .[30] |.categories | split(", "),
+          url: "http://lieferando.de\(.[30] | .url)",
+          minutes: .[19],
+          minimum: .[10],
+          delivery: .[14]
+        })' \
+      | tee "$cache_path"
+  fi
+}
+
+fetch_menu() {
+  [ $# -eq 1 ] || exit 1
+
+  slug="$(echo "$1" | sed 's!.*/!!')"
+  cache_path="$lieferando_dir/$PLZ/$slug.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "$1" \
+      | gunzip \
+      | sed -n '/var MenucardProducts/,/\];/p' \
+      | sed 's/var MenucardProducts =//;s/;$//' \
+      | jq -r '
+        unique_by(.productId)
+        | group_by(.categoryId)
+        | flatten
+      ' \
+      | tee "$cache_path"
+  fi
+}
+
+data="$(fetch_restaurants)"
+
+# echo "$data" | jq -c '.[]' | while read -r restaurant; do
+#   fetch_menu "$(echo "$restaurant" | jq -r .url)"
+# done
+
+selected_categories="$(echo "$data" | jq -r 'map(.category) | flatten | unique | .[]' | fzf -m)"
+
+selected_restaurant_url="$(echo "$selected_categories" | jq --argjson restaurants "$data" -sRr '
+  split("\n")[:-1] as $categories
+  | $restaurants[]
+  | select(.category - $categories != .category)
+  | "\(.name) [🚴\(.minutes)min 💰\(.minimum)€ + \(.delivery)€] (\(.url))"
+  ' \
+  | fzf \
+  | sed 's/.*(//;s/)$//'
+)"
+
+fetch_menu "$selected_restaurant_url" \
+  | jq -r '.[] | "\(.price)\t\(.name)"' \
+  | fzf -m \
+  | awk '{print $0; sum += $1} END {print "-----"; print sum}'

.bin/lit.awk

@@ -0,0 +1,17 @@
+BEGIN {
+  if (!comment) comment = "--";
+  if (!begin) begin = "\\begin{code}";
+  if (!end) end = "\\end{code}";
+}
+{
+  if ($0 == begin) {
+    code = 1;
+    print comment, $0;
+  } else if ($0 == end) {
+    code = 0;
+    print comment, $0;
+  } else {
+    if (code) print $0;
+    else print comment, $0;
+  }
+}

.bin/mail-current-part

@@ -0,0 +1,3 @@
+#! /bin/sh
+set -efu
+exec curl -fSs --unix-socket /tmp/much.api.sock http://localhost/current/part

.bin/mail-current-query-find-part-by-name

@@ -0,0 +1,27 @@
+#! /bin/sh
+# usage: mail-current-query-find-part-by-name NAME
+set -efu
+
+name=$1
+
+query=$(mail-current-query)
+result=$(notmuch show --entire-thread=false --format=json "$query")
+
+part_id=$(printf %s "$result" | jq --arg name "$name" '
+  [
+    recurse |
+    select(type == "object") |
+    { id, name: .filename } |
+    select(.id != null and .name != null)
+  ] |
+  map(select(.name == $name))[0].id
+')
+
+if test "$part_id" = null; then
+  printf 'error: could not find part with name %s\n' \
+    "$name" \
+    >&2
+  exit 1
+fi
+
+exec notmuch show --part="$part_id" "$query"

.bin/mail-current-query-find-part-by-type

@@ -0,0 +1,39 @@
+#! /bin/sh
+# usage: mail-current-query-find-part-by-type TYPE
+set -efu
+
+type=$1
+
+query=$(mail-current-query)
+result=$(notmuch show --entire-thread=false --format=json "$query")
+
+part_id=$(printf %s "$result" | jq --arg type "$type" '
+  #flatten|map(select(.!=null))[0].body[0] |
+  #
+  #if .["content-type"] == $type then
+  #  .id
+  #elif .["content-type"] | test("^multipart/") then
+  #  .content|map(select(.["content-type"]==$type))[0].id
+  #else
+  #  null
+  #end
+
+  [
+    recurse |
+    select(type == "object") |
+    { id, type: .["content-type"] } |
+    select(.id != null and .type != null)
+  ] |
+  map(select(.type == $type))[0].id
+')
+
+if test "$part_id" = null; then
+  printf 'error: could not find part with type %s\n' \
+    "$type" \
+    >&2
+  exit 1
+fi
+
+exec notmuch show --part="$part_id" "$query"
+
+

.bin/pdf-ocr.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p poppler_utils tesseract4
+set -eu
+
+pdf_path="$(realpath "$1")"
+
+[ -f "$pdf_path" ] || {
+  echo "Usage: $0 FILE.pdf" >&2
+  exit 1
+}
+
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf $tmpdir' EXIT
+
+cd "$tmpdir"
+
+pdftoppm -png "$pdf_path" pdf-ocr
+for png in pdf-ocr*.png; do
+  tesseract "$png" "$png.txt" 2>/dev/null
+done
+
+cat pdf-ocr-*.txt

.bin/playlist_entries.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+youtube-dl -ij "$*" | jq -sr '.[] | .webpage_url'

.bin/proxies.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+curl -sSL https://www.netzwelt.de/proxy/index.html \
+  | pup ".tblc" \
+  | xml-to-json /dev/stdin \
+  | jq '
+    .div.table.tbody.tr
+    | map(
+      .td
+      | {
+        ip: .[0].a.value,
+        port: .[1],
+        country: .[2] | (if type == "string" then . else .a.value end),
+        security: .[3],
+        protocol: .[4]
+      }
+    )
+  '

.bin/readme

@@ -0,0 +1,4 @@
+#!/bin/sh
+curl -sSL "https://raw.githubusercontent.com/$*/master/README.md" \
+  | pandoc -f gfm -t man -s \
+  | man -l -

.bin/sample-pdf.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+filepath="$(shuf --head-count=1)"
+pages="$(pdfinfo "$filepath" | awk '/^Pages:/{print $2}')"
+random_page="$(shuf --input-range="1-$pages" --head-count=1)"
+zathura --page="$random_page" "$filepath"

.gitignore

@@ -3,3 +3,4 @@ result
 .envrc
 .history
 .todo
+node_modules

.gitmodules

@@ -1,3 +1,9 @@
-[submodule "submodules/much"]
+[submodule "submodules/menstruation-telegram"]
-	path = submodules/much
+	path = submodules/menstruation-telegram
-	url = git@github.com:kmein/much
+	url = https://github.com/kmein/menstruation-telegram
+[submodule "submodules/menstruation-backend"]
+	path = submodules/menstruation-backend
+	url = https://github.com/kmein/menstruation.rs
+[submodule "submodules/nur-packages"]
+	path = submodules/nur-packages
+	url = git@github.com:kmein/nur-packages.git

.versions/home-manager.json

@@ -1,9 +1,10 @@
 {
-  "url": "https://github.com/rycee/home-manager.git",
+  "url": "https://github.com/nix-community/home-manager.git",
-  "rev": "abaebf3b346c4bef500c5bd2fdebbed109261a0c",
+  "rev": "697cc8c68ed6a606296efbbe9614c32537078756",
-  "date": "2020-10-25T19:44:12+01:00",
+  "date": "2021-12-19T00:59:29+01:00",
-  "path": "/nix/store/48ki37j21zjc299b3qa6dizavw194hp8-home-manager",
+  "path": "/nix/store/fb46bv10azrag2jjlzhil6j11f4x8glw-home-manager",
-  "sha256": "1gcv2ni4nsicpmi4ain568msvgxch8cj04fxf6qgvhdklmh2y84k",
+  "sha256": "1c8gxm86zshr2zj9dvr02qs7y3m46gqavr6wyv01r09jfd99dxz9",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false

.versions/krops.json

@@ -1,9 +1,10 @@
 {
   "url": "https://cgit.krebsco.de/krops",
-  "rev": "55aa2c77ce8183f3d2b24f54efa33ab6a42e1e02",
+  "rev": "cccebf3ff7a53336b3f106cb96dddd5892d427ed",
-  "date": "2020-04-19T01:06:20+02:00",
+  "date": "2021-03-23T22:47:37+01:00",
-  "path": "/nix/store/08wg2yrcgkr6iwipjd6g0fbwb7gacqax-krops",
+  "path": "/nix/store/mz13xxnil35lwsf90hwnrm2agir7hb51-krops",
-  "sha256": "00rvx9h596ync8wgic6xc9srzajzm28wlp9q7mv4z0jsb27l5bj8",
+  "sha256": "07mg3iaqjf1w49vmwfchi7b1w55bh7rvsbgicp2m47gnj9alwdb6",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false

.versions/nix-writers.json

@@ -0,0 +1,11 @@
+{
+  "url": "https://cgit.krebsco.de/nix-writers",
+  "rev": "c528cf970e292790b414b4c1c8c8e9d7e73b2a71",
+  "date": "2019-04-02T20:05:33+02:00",
+  "path": "/nix/store/wm5zhsha1a2iy0d582nlfi7604ayd1vz-nix-writers",
+  "sha256": "0xdivaca1hgbxs79jw9sv4gk4f81vy8kcyaff56hh2dgq2awyvw4",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

.versions/nixpkgs-mozilla.json

@@ -0,0 +1,11 @@
+{
+  "url": "https://github.com/mozilla/nixpkgs-mozilla",
+  "rev": "7c1e8b1dd6ed0043fb4ee0b12b815256b0b9de6f",
+  "date": "2021-12-07T09:28:33-05:00",
+  "path": "/nix/store/pqwcw589i2y2w2116wn3ifl834adjsa0-nixpkgs-mozilla",
+  "sha256": "1a71nfw7d36vplf89fp65vgj3s66np1dc0hqnqgj5gbdnpm1bihl",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

.versions/nixpkgs-unstable.json

@@ -1,7 +1,11 @@
 {
   "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "0ead6f8cfd461c3a366c8bc9893037afd89f798d",
+  "rev": "f01adc7b35a8f80e82f3466e6d873b8b9c8f1b28",
-  "date": "2020-10-27T18:30:26+01:00",
+  "date": "2021-12-22T23:05:28+01:00",
-  "sha256": "170kziw7bxfm4mwi8q5c2vdpayml0mini4zyxagbvbivivdj5hla",
+  "path": "/nix/store/zhfrvg77dzpc3hq02v9zv20dfgqwpzk6-nixpkgs",
-  "fetchSubmodules": false
+  "sha256": "17iyf2iiizi7c1wr71day3wvgalbkkm2zgc9lpy7y42rl4frq9sf",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
 }

.versions/nixpkgs.json

@@ -1,9 +1,10 @@
 {
   "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "edb26126d98bc696f4f3e206583faa65d3d6e818",
+  "rev": "9ab7d12287ced0e1b4c03b61c781901f178d9d77",
-  "date": "2020-10-28T21:50:33+01:00",
+  "date": "2021-12-21T10:09:48+01:00",
-  "path": "/nix/store/06cjsyh3xc41h6dfiisa3y4wxb27dd9g-nixpkgs",
+  "path": "/nix/store/minmlh0avkwvvc3p7flhpbglp13kr585-nixpkgs",
-  "sha256": "1cl4ka4kk7kh3bl78g06dhiidazf65q8miyzaxi9930d6gwyzkci",
+  "sha256": "0bbd2pgcyavqn5wgq0xp8p67lha0kv9iqnh49i9w5fb5g29q7i30",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false

.versions/retiolum.json

@@ -1,9 +1,10 @@
 {
   "url": "https://github.com/krebs/retiolum",
-  "rev": "e85c778e67f640d2a6cbb36c873dd6ed24a74b97",
+  "rev": "b72b0a987767b587c79cba8499b5114d69fceeef",
-  "date": "2020-11-05T23:02:13+01:00",
+  "date": "2021-12-28T19:46:45+00:00",
-  "path": "/nix/store/s17y738p8fy7vlxfavvf7ip52ms15pm6-retiolum",
+  "path": "/nix/store/kyaqwf89v6id9mda92x4b0hf778j987x-retiolum",
-  "sha256": "16gjvms3abvfaw7plm0rdqlpd1p3677wry693narf7f08wj8in1v",
+  "sha256": "19hjzzlfk1m9ign33w4ppqgmg23v7c6k8l0fm7f33spq8982w7rb",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false

.versions/stockholm.json

@@ -1,9 +1,10 @@
 {
-  "url": "https://github.com/kmein/stockholm",
+  "url": "https://cgit.lassul.us/stockholm",
-  "rev": "f0325bef7954cb946674050847c6d52112cb658f",
+  "rev": "576c05cf3a0ceddefa29c2d0073108177c3cfa52",
-  "date": "2020-11-11T07:45:58+01:00",
+  "date": "2021-12-22T13:59:46+01:00",
-  "path": "/nix/store/lka6fhjfbwdx9bc7lk1bz4gizdv7nrbm-stockholm",
+  "path": "/nix/store/yx1j5pardgd9114f0cf3c4xjfq6r4yfv-stockholm",
-  "sha256": "0gbw6n5yq36ysc30afa5d2dbsl2d46f73ms6f0rprdbr4nhdw8l2",
+  "sha256": "18napi4k8i2iizrismlp9ha3ga6c3n2dvrhijy59kl1jxqrsaq9l",
+  "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "leaveDotGit": false

README.md

@@ -0,0 +1,10 @@
+# niveum
+
+> [nĭvĕus](https://logeion.uchicago.edu/niveus), a, um, adj. [nix], _of_ or _from snow, snowy, snow-_ (poet.)
+>
+> 1. Lit.: aggeribus niveis informis, Verg. G. 3, 354: aqua, _cooled with snow_, Mart. 12, 17, 6; cf. id. 14, 104 and 117: mons, _covered with snow_, Cat. 64, 240.—
+>
+> 2. Transf., _snow-white, snowy_ (mostly poet.): a similitudine sic: Corpore niveum candorem, aspectu igneum ardorem assequebatur, Auct. Her. 4, 33, 44: lacerti, Verg. A. 8, 387: lac, id. E. 2, 20: hanc si capite niveae agnae exorari judicas, Sen. Q. N. 2, 36: Briseis niveo colore, Hor. C. 2, 4, 3: vestis, Ov. M. 10, 432: candidior nivei folio, Galatea, ligustri, id. ib. 13, 789: dens, id. H. 18, 18: quā notam duxit niveus videri, Hor. C. 4, 2, 59: panis, Juv. 5, 70: flumen, _clear, pellucid_, Sen. Hippol. 504: undae, Mart. 7, 32, 11: tribuni, _clothed in white togas_, Calp. Ecl. 7, 29; so, Quirites, Juv. 10, 45.
+
+## Pressestimmen
+> das ist ja pure poesie —[xkey](https://github.com/riotbib)

configs/alacritty.nix

@@ -1,46 +1,45 @@
 { pkgs, lib, config, ... }:
-let
+{
-  inherit (import <niveum/lib>) colours;
-  colourNames =
-    [ "black" "red" "green" "yellow" "blue" "magenta" "cyan" "white" ];
-  colourPairs = lib.getAttrs colourNames colours;
-  alacrittyConfig = {
-    background_opacity = 0.9;
-    colors = {
-      primary = { inherit (colours) background foreground; };
-      normal = lib.mapAttrs (_: colour: colour.dark) colourPairs;
-      bright = lib.mapAttrs (_: colour: colour.bright) colourPairs;
-    };
-    font = {
-      normal.family = "Monospace";
-      size = 8;
-    };
-    key_bindings = [
-      {
-        key = "Add";
-        mods = "Control";
-        action = "IncreaseFontSize";
-      }
-      {
-        key = "Minus";
-        mods = "Control";
-        action = "DecreaseFontSize";
-      }
-      {
-        key = "Key0";
-        mods = "Control";
-        action = "ResetFontSize";
-      }
-    ];
-  };
-in {
   environment.variables.TERMINAL = "alacritty";
 
   environment.systemPackages = [
     pkgs.alacritty
   ];
 
-  home-manager.users.me.xdg.configFile = {
+  home-manager.users.me.xdg.configFile =
-    "alacritty/alacritty.yml".text = builtins.toJSON alacrittyConfig;
+  let
+    inherit (import <niveum/lib>) colours;
+    colourNames = [ "black" "red" "green" "yellow" "blue" "magenta" "cyan" "white" ];
+    colourPairs = lib.getAttrs colourNames colours;
+  in {
+    "alacritty/alacritty.yml".source = (pkgs.formats.yaml {}).generate "alacritty.yml" {
+      background_opacity = 0.9;
+      colors = {
+        primary = { inherit (colours) background foreground; };
+        normal = lib.mapAttrs (_: colour: colour.dark) colourPairs;
+        bright = lib.mapAttrs (_: colour: colour.bright) colourPairs;
+      };
+      font = {
+        normal.family = "Monospace";
+        size = 6;
+      };
+      key_bindings = [
+        {
+          key = "Plus";
+          mods = "Control";
+          action = "IncreaseFontSize";
+        }
+        {
+          key = "Minus";
+          mods = "Control";
+          action = "DecreaseFontSize";
+        }
+        {
+          key = "Key0";
+          mods = "Control";
+          action = "ResetFontSize";
+        }
+      ];
+    };
   };
 }

configs/battery.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  boot.extraModulePackages = with config.boot.kernelPackages; [
+    tp_smapi
+    acpi_call
+  ];
+  boot.kernelModules = [ "tp_smapi" "acpi_call" ];
+  environment.systemPackages = [ pkgs.tpacpi-bat ];
+
+  services.tlp = {
+    enable = true;
+    settings = {
+      START_CHARGE_THRESH_BAT0 = 80;
+      STOP_CHARGE_THRESH_BAT0 = 95;
+    };
+  };
+}

configs/beets.nix

@@ -0,0 +1,11 @@
+{ lib, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.beets ];
+  home-manager.users.me.xdg.configFile = {
+    "beets/config.yaml".source = (pkgs.formats.yaml {}).generate "config.yaml" {
+      directory = "~/cloud/syncthing/music";
+      library = "~/cloud/syncthing/common/music.db";
+      plugins = toString [ "fetchart" "lastgenre" ];
+    };
+  };
+}

configs/bluetooth.nix

@@ -1,7 +1,7 @@
 { pkgs, lib, ... }: {
   hardware.bluetooth = {
     enable = true;
-    config.General.Enable =
+    settings.General.Enable =
       lib.concatStringsSep "," [ "Source" "Sink" "Media" "Socket" ];
   };
 

configs/bvg.nix

@@ -0,0 +1,57 @@
+{ pkgs, lib, ... }:
+let
+  inherit (import <niveum/lib>) serveHtml;
+  stations = [
+    900068204 # A/M
+    900068302 # KAS
+    900068203 # B-P
+  ];
+  fahrplan = pkgs.writeText "fahrplan.html" ''
+    <!DOCTYPE html>
+    <title>Fahrplan</title>
+    <link
+      rel="icon"
+      type="image/x-icon"
+      href="https://mobil.bvg.de/Fahrinfo/img/ua_xhtml/logo.gif"
+    />
+    <style>
+      body {
+        margin: 0;
+        --bvg-yellow: #f0d722;
+      }
+      #fahrplan {
+        display: flex;
+        height: 100vh;
+        width: 100%;
+        flex-direction: row;
+      }
+      #fahrplan iframe {
+        flex-grow: 1;
+        border: none;
+      }
+      #fahrplan iframe + iframe {
+        border-left: 2px solid var(--bvg-yellow);
+      }
+    </style>
+    <body>
+      <div id="fahrplan">
+        ${lib.concatMapStrings (station: ''
+          <iframe scrolling="no" src="https://mobil.bvg.de/Fahrinfo/bin/stboard.bin/dox?ld=0.1&input=${toString station}&boardType=depRT&start=yes"></iframe>
+        '') stations}
+      </div>
+    </body>
+  '';
+in
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  services.nginx.virtualHosts."bvg.kmein.r" = {
+    locations."/".extraConfig = serveHtml fahrplan pkgs;
+  };
+}

configs/calcurse.nix

@@ -1,44 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  environment.systemPackages = [ pkgs.calcurse ];
-
-  systemd.services.caldav-sync = {
-    enable = true;
-    wants = [ "network-online.target" ];
-    startAt = "*:0/15";
-    serviceConfig.User = "kfm";
-    script = "${pkgs.calcurse}/bin/calcurse-caldav";
-  };
-
-  home-manager.users.me = {
-    home.file = {
-      ".calcurse/conf".text = ''
-        appearance.calendarview=monthly
-        appearance.layout=1
-        daemon.enable=no
-        daemon.log=no
-        format.inputdate=4
-        format.outputdate=%F
-        general.confirmquit=no
-        general.confirmdelete=yes
-        general.firstdayofweek=monday
-        appearance.theme=default on default
-      '';
-      ".calcurse/caldav/config".text = lib.generators.toINI {} {
-        General = {
-          Binary = "${pkgs.calcurse}/bin/calcurse";
-          Hostname = "posteo.de:8443";
-          Path = "/calendars/kieran.meinhardt/default/";
-          InsecureSSL = "No";
-          DryRun = "No";
-          Verbose = "Yes";
-        };
-        Auth = {
-          Username = "kieran.meinhardt@posteo.net";
-          Password = lib.strings.fileContents <secrets/mail/posteo>;
-        };
-      };
-    };
-  };
-
-}

configs/chromium.nix

@@ -2,10 +2,11 @@
   programs.chromium = {
     enable = true;
     extensions = [
-      "hdokiejnpimakedhajhdlcegeplioahd" # LastPass
+      "nngceckbapebfimnlniiiahkandclblb" # BitWarden
       # "ihlenndgcmojhcghmfjfneahoeklbjjh" # cVim
       # "fpnmgdkabkmnadcjpehmlllkndpkmiak" # Wayback Machine
       "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
+      "khncfooichmfjbepaaaebmommgaepoid" # Remove YouTube Recommended Videos
     ];
   };
 

configs/cloud.nix

@@ -1,14 +1,4 @@
 { config, lib, pkgs, ... }: {
-  imports = [
-    <niveum/modules/seafile.nix>
-    <niveum/modules/dropbox.nix>
-  ];
-
-  niveum = {
-    dropbox.enable = true;
-    seafile.enable = true;
-  };
-
   system.activationScripts.home-symlinks = ''
     ln -sfn ${config.users.users.me.home}/cloud/syncthing/common/mahlzeit ${config.users.users.me.home}/mahlzeit
     ln -sfn ${config.users.users.me.home}/cloud/Seafile/Wiki ${config.users.users.me.home}/notes
@@ -19,31 +9,46 @@
     services.nextcloud-client.enable = true;
   };
 
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "book" ''
+      set -efu
+      book="$({
+        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/syncthing/library -type f
+        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/Seafile/Books -type f
+      } | ${pkgs.fzf}/bin/fzf)"
+      ${pkgs.zathura}/bin/zathura "$book"
+    '')
+  ];
+
+  fileSystems."/media/moodle" = {
+    device = "zaatar.r:/moodle";
+    fsType = "nfs";
+    options = [
+      "x-systemd.idle-timeout=600"
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+
   services.syncthing = rec {
     enable = true;
     user = "kfm";
     openDefaultPorts = true;
     configDir = "/home/kfm/.config/syncthing";
     dataDir = "/home/kfm/.config/syncthing";
-    declarative = rec {
+    cert = toString <system-secrets/syncthing/cert.pem>;
-      cert = toString <system-secrets/syncthing/cert.pem>;
+    key = toString <system-secrets/syncthing/key.pem>;
-      key = toString <system-secrets/syncthing/key.pem>;
+    inherit ((import <niveum/lib>).syncthing) devices;
-      devices = {
+    folders =
-        wilde.id =
+      let cloud-dir = "${config.users.users.me.home}/cloud";
-          "R6DEBD7-G5RYDKN-VFA3HPO-WX4DNVI-373F7OQ-AW5MZTT-3L4BDVW-Y6ROEAF";
+      in {
-        heym.id =
+        "${cloud-dir}/syncthing/common".devices = [ "kabsa" "manakish" ];
-          "HLQSG3D-WSKLA6S-MEYQ3EU-GDBGABE-PY53RQ6-SWQAP2I-Z5MVBVX-MYPJXAM";
+        "${cloud-dir}/syncthing/library".devices = [ "kabsa" "manakish" "heym" ];
-        manakish.id =
+        "${cloud-dir}/syncthing/mundoiu".devices = [ "kabsa" "manakish" "heym" ];
-          "AJVBWR2-VFFAGZF-7ZF5JAX-T63GMOG-NZ446WK-MC5E6WK-6X6Q2HE-QQA2JQ3";
+        "${cloud-dir}/syncthing/music" = {
-      };
+          devices = [ "kabsa" "manakish" "heym" "zaatar" ];
-      folders =
+          id = "music";
-        let syncthing-dir = "${config.users.users.me.home}/cloud/syncthing";
-        in {
-          "${syncthing-dir}/common".devices = [ "wilde" "manakish" ];
-          "${syncthing-dir}/library".devices = lib.attrNames devices;
-          "${syncthing-dir}/mundoiu".devices = lib.attrNames devices;
-          "${syncthing-dir}/music".devices = lib.attrNames devices;
         };
-    };
+      };
   };
 }

configs/codimd.nix

@@ -1,25 +0,0 @@
-{
-  services.nginx.virtualHosts."pad.xn--kiern-0qa.de" = {
-    enableACME = true;
-    addSSL = true;
-    locations."/".extraConfig = ''
-      client_max_body_size 4G;
-      proxy_set_header Host $host;
-      proxy_pass http://localhost:3091;
-    '';
-  };
-
-  services.codimd = {
-    enable = true;
-    configuration = {
-      allowAnonymous = false;
-      allowGravatar = false;
-      db = {
-        dialect = "sqlite";
-        storage = "/var/lib/codimd/db.codimd.sqlite";
-        useCDN = false;
-      };
-      port = 3091;
-    };
-  };
-}

configs/copyq.nix

@@ -0,0 +1,37 @@
+{ config, pkgs, ... }:
+let
+  copyqConfig = pkgs.writers.writeDash "copyq-config" ''
+    ${pkgs.copyq}/bin/copyq config check_clipboard true
+    ${pkgs.copyq}/bin/copyq config check_selection false
+    ${pkgs.copyq}/bin/copyq config copy_clipboard true
+    ${pkgs.copyq}/bin/copyq config copy_selection false
+
+    ${pkgs.copyq}/bin/copyq config activate_closes true
+    ${pkgs.copyq}/bin/copyq config clipboard_notification_lines 0
+    ${pkgs.copyq}/bin/copyq config clipboard_tab \&clipboard
+    ${pkgs.copyq}/bin/copyq config disable_tray false
+    ${pkgs.copyq}/bin/copyq config hide_tabs false
+    ${pkgs.copyq}/bin/copyq config hide_toolbar false
+    ${pkgs.copyq}/bin/copyq config item_popup_interval true
+    ${pkgs.copyq}/bin/copyq config maxitems 1000
+    ${pkgs.copyq}/bin/copyq config move true
+    ${pkgs.copyq}/bin/copyq config text_wrap true
+  '';
+in {
+  environment.systemPackages = [ pkgs.copyq ];
+
+  systemd.user.services.copyq = {
+    wantedBy = [ "graphical-session.target" ];
+    environment = {
+      DISPLAY = ":${toString config.services.xserver.display}";
+    };
+    serviceConfig = {
+      SyslogIdentifier = "copyq";
+      ExecStart = "${pkgs.copyq}/bin/copyq";
+      ExecStartPost = copyqConfig;
+      Restart = "always";
+      RestartSec = "15s";
+      StartLimitBurst = 0;
+    };
+  };
+}

configs/default.nix

@@ -1,32 +1,23 @@
-{ pkgs, lib, config, options, ... }:
+{ inputs, pkgs, lib, config, options, ... }:
 let
   inherit (lib.strings) makeBinPath;
   inherit (import <niveum/lib>) localAddresses kieran;
 in {
   imports = [
-    <home-manager/nixos>
+    ../modules/system-dependent.nix
-    <niveum/modules/system-dependent.nix>
     {
       boot.supportedFilesystems = [ "ntfs" ];
     }
     {
       nix.nixPath = [
         "/var/src"
-        "nixpkgs-overlays=${toString ../overlays}"
       ];
     }
-    { services.dbus.packages = [ pkgs.gnome3.dconf ]; }
     {
       nixpkgs = {
         config = {
           allowUnfree = true;
           packageOverrides = pkgs: {
-            nur = import (builtins.fetchTarball
-              "https://github.com/nix-community/NUR/archive/aea85375c7a82297d977904de8dd7f41baf2d59a.tar.gz") {
-                inherit pkgs;
-              };
-            writeDashBin = pkgs.writers.writeDashBin;
-            writeDash = pkgs.writers.writeDash;
             gfs-fonts = pkgs.callPackage <niveum/packages/gfs-fonts.nix> {};
             iolanguage = pkgs.callPackage <niveum/packages/iolanguage.nix> { };
             ix = pkgs.callPackage <niveum/packages/ix.nix> { };
@@ -34,19 +25,14 @@ in {
         };
         overlays = [
           (self: super: {
-            scripts = import <niveum/packages/scripts> { pkgs = super; lib = super.lib; };
+            scripts = import <niveum/packages/scripts> { pkgs = super; inherit lib; };
           })
-          (import <niveum/overlays/toml.nix>)
-          (import <stockholm/krebs/5pkgs/haskell>)
-          (import <stockholm/submodules/nix-writers/pkgs>)
-          (import <stockholm/krebs/5pkgs/override>)
         ];
       };
     }
     {
       boot.cleanTmpDir = true;
       boot.loader.timeout = 1;
-      boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ];
     }
     {
       home-manager.users.me = {
@@ -70,19 +56,35 @@ in {
         hashedPassword =
           "$6$w9hXyGFl/.IZBXk$5OiWzS1G.5hImhh1YQmZiCXYNAJhi3X6Y3uSLupJNYYXPLMsQpx2fwF4Xr2uYzGMV8Foqh8TgUavx1APD9rcb/";
         isNormalUser = true;
+        uid = 1000;
       };
+
+      home-manager.users.me.xdg.enable = true;
+      home-manager.users.me.dconf.enable = false;
     }
     {
       sound.enable = true;
 
       hardware.pulseaudio = {
         enable = true;
-        package = pkgs.pulseaudioFull; # for bluetooth sound output
+        package = pkgs.pulseaudioFull;
+        extraModules = [ pkgs.pulseaudio-modules-bt ];
+        # copy server:/run/pulse/.config/pulse/cookie to client:~/.config/pulse/cookie to authenticate a client machine
+        zeroconf.discovery.enable = true;
+        extraConfig = ''
+          load-module ${toString [
+            "module-tunnel-sink-new"
+            "server=zaatar.r"
+            "sink_name=zaatar"
+            "channels=2"
+            "rate=44100"
+          ]}
+        '';
       };
 
       users.users.me.extraGroups = [ "audio" ];
 
-      environment.systemPackages = [ pkgs.pavucontrol pkgs.pamixer ];
+      environment.systemPackages = [ pkgs.pavucontrol pkgs.ncpamixer pkgs.pamixer pkgs.pulsemixer ];
     }
     {
       environment.interactiveShellInit =
@@ -103,29 +105,27 @@ in {
         cat = "${pkgs.bat}/bin/bat --style=plain";
         chromium-incognito =
           "chromium --user-data-dir=$(mktemp -d /tmp/chr.XXXXXX) --no-first-run --incognito";
-        cp = "cp -i";
+        cp = "cp --interactive";
-        dig = "dig +short";
         ip = "${pkgs.iproute}/bin/ip -c";
-        l = "${pkgs.exa}/bin/exa -s type -a";
+        l  = "ls --color=auto --time-style=long-iso --almost-all";
-        la = "${pkgs.exa}/bin/exa -s type -la";
+        ls = "ls --color=auto --time-style=long-iso";
-        ll = "${pkgs.exa}/bin/exa -s type -l";
+        ll = "ls --color=auto --time-style=long-iso -l";
-        ls = "${pkgs.exa}/bin/exa -s type";
+        la = "ls --color=auto --time-style=long-iso --almost-all -l";
-        mv = "mv -i";
+        mv = "mv --interactive";
         nixi = "nix repl '<nixpkgs>'";
         ns = "nix-shell --run zsh";
         o = "${pkgs.xdg_utils}/bin/xdg-open";
         pbcopy = "${pkgs.xclip}/bin/xclip -selection clipboard -in";
         pbpaste = "${pkgs.xclip}/bin/xclip -selection clipboard -out";
-        rm = "rm -i";
+        rm = "rm --interactive";
         s = "${pkgs.systemd}/bin/systemctl";
         take = "source ${take}";
         tmux = "${pkgs.tmux}/bin/tmux -2";
-        tree = "${pkgs.exa}/bin/exa --tree";
         sxiv = swallow "${pkgs.sxiv}/bin/sxiv";
         zathura = swallow "${pkgs.zathura}/bin/zathura";
         us = "${pkgs.systemd}/bin/systemctl --user";
         wcd = "source ${wcd}";
-        weechat = "${pkgs.openssh}/bin/ssh weechat@toum -t screen -x weechat-screen";
+        im = "${pkgs.openssh}/bin/ssh weechat@makanek -t tmux attach-session -t IM";
         where = "source ${where}";
         yt =
           "${pkgs.youtube-dl}/bin/youtube-dl --add-metadata -ic"; # Download video link
@@ -134,7 +134,6 @@ in {
       };
     }
     { i18n.defaultLocale = "en_GB.UTF-8"; }
-    { services.illum.enable = true; }
     {
       services.xserver = {
         enable = true;
@@ -155,21 +154,32 @@ in {
     }
     {
       security.wrappers = {
-        pmount.source = "${pkgs.pmount}/bin/pmount";
+        pmount = {
-        pumount.source = "${pkgs.pmount}/bin/pumount";
+          owner = "root";
+          group = "users";
+          source = "${pkgs.pmount}/bin/pmount";
+        };
+        pumount = {
+          owner = "root";
+          group = "users";
+          source = "${pkgs.pmount}/bin/pumount";
+        };
       };
     }
     { programs.command-not-found.enable = true; }
     {
       programs.gnupg.agent.enable = true;
 
-      environment.systemPackages = [ pkgs.gnupg pkgs.pass ];
+      environment.systemPackages = [
+        pkgs.gnupg
+        (pkgs.pass.withExtensions (e: [e.pass-otp]))
+      ];
     }
     {
       services.atd.enable = true;
     }
     {
-      services.mingetty = {
+      services.getty = {
         greetingLine = lib.mkForce "";
         helpLine = lib.mkForce "";
       };
@@ -182,15 +192,16 @@ in {
     }
     ./alacritty.nix
     ./bash.nix
+    ./beets.nix
     ./bluetooth.nix
     ./ccc.nix
-    ./kleiter.nix
+    # ./kleiter.nix
-    ./calcurse.nix
+    ./khal.nix
     ./chromium.nix
     ./cloud.nix
+    ./copyq.nix
     ./compton.nix
     ./direnv.nix
-    ./distrobump.nix
     ./docker.nix
     ./dunst.nix
     ./flix.nix
@@ -202,37 +213,38 @@ in {
     ./htop.nix
     ./hu-berlin.nix
     ./i3.nix
-    ./keybase.nix
     ./keyboard.nix
-    ./mail.nix
+    ./lb.nix
     ./mpv.nix
     ./mime.nix
     ./nano.nix
     ./neovim.nix
+    ./neomutt.nix
+    ./nix.nix
     ./newsboat.nix
     ./flameshot-once.nix
     ./packages
+    ./power-action.nix
     ./printing.nix
+    ./openweathermap.nix
     ./wallpaper.nix
     ./redshift.nix
     ./retiolum.nix
     ./rofi.nix
     ./spacetime.nix
+    ./seafile.nix
     ./ssh.nix
     ./sshd.nix
     ./sudo.nix
     ./sxiv.nix
     ./theming.nix
     ./tmux.nix
-    ./tor.nix
+    # ./tor.nix
-    ./todo-txt.nix
     ./traadfri.nix
     ./unclutter.nix
     ./version.nix
     ./vscode.nix
     ./watson.nix
-    ./wifi.nix
-    ./xautolock.nix
     ./zsh.nix
   ];
 }

configs/direnv.nix

@@ -11,8 +11,7 @@ let
       cat > shell.nix <<'EOF'
     { pkgs ? import <nixpkgs> {} }:
     pkgs.mkShell {
-      buildInputs = with pkgs; [];
+      buildInputs = [];
-      shellHook = "export HISTFILE=''${toString ./.history}";
     }
     EOF
       ''${EDITOR:-vim} shell.nix

configs/distrobump.nix

@@ -1,10 +0,0 @@
-{ lib, config, pkgs, ... }: {
-  imports = [
-    (import <stockholm/makefu/3modules/bump-distrowatch.nix> {
-      inherit lib config;
-      pkgs = pkgs // { writeDash = pkgs.writers.writeDash; };
-    })
-  ];
-
-  makefu.distrobump.enable = false;
-}

configs/docker.nix

@@ -1,5 +1,12 @@
-{ pkgs, ... }: {
+{ lib, pkgs, ... }: {
-  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+    enable = true;
+    # for ICE wifi, ref https://gist.github.com/sunsided/7840e89ff4e11b64a2d7503fafa0290c
+    extraOptions = lib.concatStringsSep " " [
+      "--bip=172.39.1.5/24"
+      "--fixed-cidr=172.39.1.0/25"
+    ];
+  };
   users.users.me.extraGroups = [ "docker" ];
   environment.systemPackages = [ pkgs.docker pkgs.docker_compose ];
 }

configs/dunst.nix

@@ -8,7 +8,7 @@ in {
     settings = {
       global = {
         transparency = 10;
-        font = "Monospace 7";
+        font = "Monospace 8";
         geometry = "200x5-30+20";
         frame_color = colours.foreground;
         follow = "mouse";

configs/flameshot-once.nix

@@ -1,12 +1,11 @@
 { lib, pkgs, ... }:
 let
   inherit (import <niveum/lib>) defaultApplications;
-  flameshot-once =
+  flameshot-once = pkgs.callPackage <stockholm/krebs/5pkgs/simple/flameshot-once> {};
-    pkgs.callPackage <stockholm/krebs/5pkgs/simple/flameshot-once> {};
 in {
   nixpkgs.overlays = [
     (self: super: {
-      xwaitforwindow =
+      write =
         super.callPackage <stockholm/krebs/5pkgs/simple/xwaitforwindow.nix> { };
     })
   ];
@@ -19,7 +18,7 @@ in {
         deleteUrl = "http://p.r/image/delete/%1";
         xdg-open.browser = (defaultApplications pkgs).browser;
       };
-      config.timeout = 200;
+      config.timeout = 1000;
     })
   ];
 }

configs/flix.nix

@@ -5,6 +5,7 @@ let
   indexFilename = "index";
   flixUser = "flix";
   flixGroup = "users";
+  inherit (import <niveum/lib>) tmpfilesConfig;
 in {
   fileSystems.${flixLocation} = {
     device = "prism.r:/export";
@@ -24,7 +25,13 @@ in {
   };
 
   systemd.tmpfiles.rules = [
-    "d '${cacheLocation}' 0750 ${flixUser} ${flixGroup} - -"
+    (tmpfilesConfig {
+      type = "d";
+      path = cacheLocation;
+      mode = "0750";
+      user = flixUser;
+      group = flixGroup;
+    })
   ];
 
   systemd.services.flix-index = {
@@ -44,11 +51,21 @@ in {
     isSystemUser = true;
     createHome = true;
     home = cacheLocation;
-    extraGroups = [ flixGroup ];
+    group = flixGroup;
   };
 
   environment.systemPackages = [
-    (pkgs.writeDashBin "flixmenu" ''
+    (pkgs.writers.writeDashBin "mpv-simpsons" ''
+      set -efu
+      cd "${flixLocation}/download"
+      [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
+
+      cat "${cacheLocation}/${indexFilename}" \
+        | ${pkgs.gnugrep}/bin/grep -i 'simpsons.*mkv' \
+        | shuf \
+        | ${pkgs.findutils}/bin/xargs -d '\n' ${pkgs.mpv}/bin/mpv
+    '')
+    (pkgs.writers.writeDashBin "flixmenu" ''
       set -efu
       cd "${flixLocation}/download"
 

configs/fonts.nix

@@ -1,8 +1,12 @@
 { pkgs, ... }: {
+  nixpkgs.config.joypixels.acceptLicense = true;
+
   fonts = {
     enableDefaultFonts = true;
-    enableFontDir = true;
+    fontDir.enable = true;
     fonts = with pkgs; [
+      alegreya
+      alegreya-sans
       corefonts
       eb-garamond
       fira
@@ -13,6 +17,8 @@
       libertine
       lmodern
       noto-fonts
+      noto-fonts-cjk
+      noto-fonts-emoji
       roboto
       roboto-mono
       roboto-slab
@@ -26,9 +32,9 @@
       joypixels
     ];
     fontconfig.defaultFonts = {
-      monospace = [ "JetBrains Mono" ];
+      monospace = [ "JetBrains Mono" "JoyPixels" ];
-      serif = [ "Source Serif Pro" ];
+      serif = [ "Roboto Slab" ];
-      sansSerif = [ "Source Sans Pro" ];
+      sansSerif = [ "Roboto" "Noto Sans" ];
       emoji = [ "JoyPixels" ];
     };
   };

configs/git.nix

@@ -76,6 +76,8 @@ in
       ignores = ignorePaths;
       extraConfig = {
         pull.ff = "only";
+        rebase.autoStash = true;
+        merge.autoStash = true;
         core.pager =
           "${pkgs.gitAndTools.diff-so-fancy}/bin/diff-so-fancy | ${pkgs.less}/bin/less --tabs=4 -RFX";
         color = {

configs/gitea.nix

@@ -2,10 +2,10 @@
   services.gitea = {
     enable = true;
     disableRegistration = true;
-    rootUrl = "https://code.xn--kiern-0qa.de";
+    rootUrl = "https://code.kmein.de";
-    appName = "code.kierán.de";
+    appName = "code.kmein.de";
   };
-  services.nginx.virtualHosts."code.xn--kiern-0qa.de" = {
+  services.nginx.virtualHosts."code.kmein.de" = {
     forceSSL = true;
     enableACME = true;
     locations."/".extraConfig = "proxy_pass http://localhost:3000;";

configs/hedgedoc.nix

@@ -0,0 +1,81 @@
+{ config, pkgs, ... }:
+let
+  backupLocation = "/var/lib/codimd-backup";
+  stateLocation = "/var/lib/codimd/state.sqlite";
+  nixpkgs-unstable = import <nixpkgs-unstable> {};
+  domain = "pad.kmein.de";
+in
+{
+  imports = [ <stockholm/krebs/3modules/permown.nix> ];
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "https://localhost:3091";
+      proxyWebsockets = true;
+    };
+  };
+
+  security.acme.certs.${domain}.group = "hedgecert";
+  users.groups.hedgecert.members = [ "codimd" "nginx" ];
+
+  security.dhparams = {
+    enable = true;
+    params.hedgedoc = {};
+  };
+
+  services.hedgedoc = {
+    enable = true;
+    configuration = {
+      allowOrigin = [ domain ];
+      allowAnonymous = true;
+      allowGravatar = false;
+      allowFreeURL = true;
+      db = {
+        dialect = "sqlite";
+        storage = stateLocation;
+      };
+      port = 3091;
+      domain = domain;
+      useSSL = true;
+      protocolUseSSL = true;
+      sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
+      sslCertPath = "/var/lib/acme/${domain}/cert.pem";
+      sslKeyPath = "/var/lib/acme/${domain}/key.pem";
+      dhParamPath = config.security.dhparams.params.hedgedoc.path;
+    };
+  };
+
+  krebs.permown.${backupLocation} = { owner = "codimd"; group = "codimd"; umask = "0002"; };
+
+  systemd.services.hedgedoc-backup = {
+    description = "Hedgedoc backup service";
+    script = ''
+      ${nixpkgs-unstable.sqlite}/bin/sqlite3 -json ${stateLocation} "select shortid, alias, ownerId, content from Notes" \
+      | ${pkgs.writers.writePython3 "hedgedoc-json-to-fs.py" {} ''
+        import json
+        import pathlib
+        import sys
+
+        for note in json.load(sys.stdin):
+            user_directory = pathlib.Path()
+            if note["ownerId"]:
+                user_directory = pathlib.Path(note["ownerId"])
+                user_directory.mkdir(exist_ok=True)
+            file_path = user_directory / (
+                (note["alias"] if note["alias"] else note["shortid"]) + ".md"
+            )
+            file_path.write_text(note["content"])
+            print(f"✔ {file_path}", file=sys.stderr)
+      ''}
+    '';
+    startAt = "hourly";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "codimd";
+      Group = "codimd";
+      WorkingDirectory = backupLocation;
+    };
+  };
+}

configs/hledger.nix

@@ -1,5 +1,5 @@
 { config, pkgs, ... }: {
-  imports = [ <niveum/modules/hledger.nix> ];
+  imports = [ ../modules/hledger.nix ];
 
   niveum.hledger = {
     enable = true;

configs/htop.nix

@@ -2,45 +2,28 @@
   home-manager.users.me = {
     programs.htop = {
       enable = true;
-      colorScheme = 0;
+      settings = {
-      accountGuestInCpuMeter = true;
+        color_scheme = 0;
-      cpuCountFromZero = false;
+        account_guest_in_cpu_meter = true;
-      delay = 15;
+        cpu_count_from_zero = false;
-      detailedCpuTime = false;
+        delay = 15;
-      headerMargin = true;
+        detailed_cpu_time = false;
-      hideKernelThreads = true;
+        header_margin = true;
-      hideThreads = false;
+        hide_kernel_threads = true;
-      hideUserlandThreads = false;
+        hide_threads = true;
-      highlightBaseName = true;
+        hide_userland_threads = true;
-      highlightMegabytes = true;
+        highlight_base_name = true;
-      highlightThreads = true;
+        highlight_megabytes = true;
-      shadowOtherUsers = true;
+        highlight_threads = true;
-      showProgramPath = false;
+        shadow_other_users = true;
-      showThreadNames = true;
+        show_program_path = false;
-      sortDescending = true;
+        show_thread_names = false;
-      sortKey = "PERCENT_CPU";
+        sort_descending = true;
-      treeView = true;
+        sort_key = "PERCENT_CPU";
-      updateProcessNames = false;
+        tree_view = true;
-      meters = {
+        update_process_names = false;
-        left = [
+        right_meters = [ "Uptime" "Tasks" "LoadAverage" "Battery" ];
-          {
+        left_meters = [ "LeftCPUs2" "RightCPUs2" "Memory" "Swap" ];
-            kind = "LeftCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "RightCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "Memory";
-            mode = 1;
-          }
-          {
-            kind = "Swap";
-            mode = 1;
-          }
-        ];
-        right = [ "Uptime" "Tasks" "LoadAverage" "Battery" ];
       };
     };
   };

configs/hu-berlin.nix

@@ -6,69 +6,74 @@ let
     identity = fileContents <secrets/eduroam/identity>;
     password = fileContents <secrets/eduroam/password>;
   };
-  eduroamAuth = ''
+  hu-berlin-cifs-options = [
-    key_mgmt=WPA-EAP
+    "uid=${toString config.users.users.me.uid}"
-    eap=TTLS
+    "gid=${toString config.users.groups.users.gid}"
-    proto=RSN
+    "sec=ntlmv2"
-    identity="${eduroam.identity}"
+    "workgroup=german"
-    anonymous_identity="anonymous@wlan.hu-berlin.de"
+    "username=meinhaki"
-    altsubject_match="DNS:srv1-radius.cms.hu-berlin.de;DNS:srv2-radius.cms.hu-berlin.de"
+    "password=${lib.strings.fileContents <secrets/mail/meinhaki>}"
-    password="${eduroam.password}"
+    "noauto"
-    ca_cert="${
+    "x-systemd.requires=openvpn-hu-berlin.service"
-      pkgs.fetchurl {
+    "x-systemd.automount"
-        url =
+    "x-systemd.device-timeout=1"
-          "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/t-telesec_globalroot_class_2.pem";
+    "x-systemd.idle-timeout=1min"
-        sha256 = "0if8aqd06sid7a0vw009zpa087wxcgdd2x6z2zs4pis5kvyqj2dk";
+  ];
-      }
-    }"
-    phase2="auth=PAP"
-  '';
 in {
-  networking.wireless.networks = {
+  fileSystems."/media/hu-berlin/germpro2" = {
-    eduroam_5GHz.auth = eduroamAuth;
+    device = "//hugerm31c.user.hu-berlin.de/germpro2/ling";
-    eduroam.auth = eduroamAuth;
+    fsType = "cifs";
+    options = hu-berlin-cifs-options;
   };
 
-  fileSystems."/mnt/moodle" = {
+  fileSystems."/media/hu-berlin/germhome" = {
-    device = "moodle@toum.r:/var/lib/moodle";
+    device = "//hugerm31c.user.hu-berlin.de/germhome/ling/meinhaki";
-    fsType = "fuse.sshfs";
+    fsType = "cifs";
-    options = [
+    options = hu-berlin-cifs-options;
-      "IdentityFile=/root/.ssh/id_rsa"
-      "Port=${toString sshPort}"
-      "_netdev"
-      "allow_other"
-      "default_permissions"
-      "gid=100"
-      "idmap=user"
-      # "noatime"
-      "noauto"
-      # "nodiratime"
-      "x-systemd.nofail"
-      "reconnect"
-      "ro"
-      "uid=1000"
-      "x-systemd.automount"
-      "x-systemd.device-timeout=1s"
-      "x-systemd.idle-timeout=1min"
-      "x-systemd.mount-timeout=1s"
-      "x-systemd.requires=tinc.retiolum.service"
-      "x-systemd.requires=wpa_supplicant.service"
-    ];
   };
 
 
+  home-manager.users.me.programs.ssh = {
+    matchBlocks = {
+      "alew.hu-berlin.de" = {
+        user = "centos";
+        hostname = "141.20.187.219";
+      };
+    };
+  };
+
   environment.systemPackages = [
-    pkgs.sshfsFuse
+    (pkgs.writers.writeDashBin "hu-ip" ''
+      ${pkgs.w3m}/bin/w3m -dump meineip.hu-berlin.de | head --lines=-4 | tail --lines=+3
+    '')
+    (pkgs.writers.writePython3Bin "hu-eduroam-install"
+      {
+        libraries = with pkgs.python3Packages; [ distro pyopenssl dbus-python ];
+        flakeIgnore = [ "E501" "E123" "W504" "E722" "F821" "E226" "E126" "E265" "W291" ];
+      }
+      (builtins.readFile (builtins.fetchurl {
+        url = "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/linux-installer/eduroam-linux-hub.py";
+        sha256 = "19x2kvwxx13265b2hj5fjf53g0liw6dw7xf9j9cav67cswmz60kf";
+      }))
+    )
+  ];
 
-    (pkgs.writers.writeDashBin "hu-vpn" ''
+  systemd.services.hu-vpn = {
-      ${pkgs.openfortivpn}/bin/openfortivpn -p "${eduroam.password}" -c ${pkgs.writeText "hu-berlin.config" ''
+    enable = true;
+    wants = [ "network-online.target" ];
+    conflicts = [ "openvpn-hu-berlin.service" ];
+    script = ''
+      ${pkgs.openfortivpn}/bin/openfortivpn -c ${pkgs.writeText "hu-berlin.config" ''
         host = forti-ssl.vpn.hu-berlin.de
         port = 443
-        trusted-cert = e5a7d56543002ffe1e8962caa5fd6d94053aa702381458247b670877a66f3c6f
+        trusted-cert = 42193a913d276d9eb86217612956e1e6464d6f07bed5393a4787c87adc4bd359
         username = ${eduroam.identity}
+        password = ${eduroam.password}
       ''}
-    '')
+    '';
-  ];
+  };
+
+  systemd.services.openvpn-hu-berlin.conflicts = [ "hu-vpn.service" ];
 
   services.openvpn.servers.hu-berlin = {
     autoStart = false;

configs/i3.nix

@@ -27,6 +27,12 @@ let
       "betacode" = pkgs.writers.writeDash "betacode" ''
         ${pkgs.scripts.betacode}/bin/betacode
       '';
+      "devanagari" = pkgs.writers.writeDash "devanagari" ''
+        ${pkgs.scripts.devanagari}/bin/devanagari
+      '';
+      "curl" = pkgs.writers.writeDash "curl" ''
+        ${pkgs.curl}/bin/curl -fSs "$(${pkgs.coreutils}/bin/cat)"
+      '';
     };
   };
 
@@ -37,29 +43,6 @@ let
     i3-msg move container to workspace $(($(i3-msg -t get_workspaces | tr , '\n' | grep '"num":' | cut -d : -f 2 | sort -rn | head -1) + 1))
   '';
 
-  # https://github.com/LukeSmithxyz/voidrice/blob/9fe6802122f6e0392c7fe20eefd30437771d7f8e/.local/bin/dmenuunicode
-  emoji-menu = let
-    emoji-file = pkgs.fetchurl {
-      url =
-        "https://raw.githubusercontent.com/LukeSmithxyz/voidrice/master/.local/share/larbs/emoji";
-      sha256 = "03fv69ah8msh2j6i3lm4sdkckqq8jwn1kj43j98dh0xjpzazsy46";
-    };
-  in with pkgs;
-  writers.writeDashBin "emoji-menu" ''
-    PATH=${lib.makeBinPath [ coreutils dmenu gnused libnotify xclip xdotool ]}
-    chosen=$(cut -d ';' -f1 ${emoji-file} | dmenu -i -l 10 | sed "s/ .*//")
-
-    [ "$chosen" != "" ] || exit
-
-    echo "$chosen" | tr -d '\n' | xclip -selection clipboard
-
-    if [ -n "$1" ]; then
-      xdotool key Shift+Insert
-    else
-      notify-send --app-name="emoji-menu" "'$chosen' copied to clipboard." &
-    fi
-  '';
-
 in {
   services.xserver = {
     displayManager.defaultSession = "none+i3";
@@ -69,10 +52,25 @@ in {
     };
   };
 
+  services.xserver = {
+    monitorSection = ''Option "DPMS" "false"'';
+    serverFlagsSection = ''
+      Option "BlankTime" "0"
+      Option "StandbyTime" "0"
+      Option "SuspendTime" "0"
+      Option "OffTime" "0"
+    '';
+    extraConfig = ''
+      Section "Extensions"
+        Option "DPMS" "Disable"
+      EndSection
+    '';
+  };
+
   home-manager.users.me.xsession.windowManager.i3 = {
     enable = true;
     config = rec {
-      fonts = [ "Monospace 10" ];
+      fonts = {names = ["Sans"]; size = 10.0;};
       modifier = "Mod4";
       window = {
         titlebar = false;
@@ -111,9 +109,9 @@ in {
         };
       in rec {
         focused = scheme // {
-          border = colours.foreground;
+          border = colours.cyan.bright;
-          indicator = colours.foreground;
+          indicator = colours.cyan.bright;
-          childBorder = colours.foreground;
+          childBorder = colours.cyan.bright;
         };
         unfocused = scheme // {
           border = colours.background;
@@ -134,7 +132,7 @@ in {
       };
       bars = [{
         workspaceButtons = false;
-        fonts = [ "Monospace 8" ];
+        fonts = {names = ["Sans"]; size = 8.0;};
         mode = "hide"; # "dock"
         position = "bottom";
         colors = rec {
@@ -148,7 +146,7 @@ in {
           };
         };
         statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs ${
-            pkgs.writeTOML (import <niveum/lib/i3status-rust.nix> {
+            (pkgs.formats.toml {}).generate "i3status-rust.toml" (import <niveum/lib/i3status-rust.nix> {
               inherit (config.niveum) batteryName wirelessInterface;
               inherit colours;
               inherit pkgs;
@@ -164,17 +162,15 @@ in {
         "l" = "resize grow width 10 px or 5 ppt";
       };
       keybindings = {
-        "${modifier}+Shift+h" = "move left";
+        "${modifier}+Shift+h" = "move left 25 px";
-        "${modifier}+Shift+j" = "move down";
+        "${modifier}+Shift+j" = "move down 25 px";
-        "${modifier}+Shift+k" = "move up";
+        "${modifier}+Shift+k" = "move up 25 px";
-        "${modifier}+Shift+l" = "move right";
+        "${modifier}+Shift+l" = "move right 25 px";
         "${modifier}+h" = "focus left";
         "${modifier}+j" = "focus down";
         "${modifier}+k" = "focus up";
         "${modifier}+l" = "focus right";
 
-        "${modifier}+Menu" = "exec ${klem}/bin/klem";
-
         "${modifier}+Shift+b" = "move window to workspace prev";
         "${modifier}+Shift+n" = "move window to workspace next";
         "${modifier}+Shift+x" = "exec --no-startup-id ${move-to-new-workspace}";
@@ -186,13 +182,16 @@ in {
         "${modifier}+Shift+q" = "kill";
         "${modifier}+Shift+r" = "restart";
 
-        "${modifier}+Shift+s" = "sticky toggle";
+        "${modifier}+z" = "sticky toggle";
         "${modifier}+Shift+z" = "floating toggle";
+
+        "${modifier}+s" = "scratchpad show";
+        "${modifier}+Shift+s" = "move scratchpad";
+
         "${modifier}+c" = "split h";
         "${modifier}+e" = "layout toggle split";
         "${modifier}+f" = "fullscreen toggle";
         "${modifier}+r" = "mode resize";
-        "${modifier}+s" = "layout stacking";
         "${modifier}+v" = "split v";
         "${modifier}+w" = "layout tabbed";
 
@@ -200,8 +199,9 @@ in {
         "${modifier}+Return" = "exec ${(defaultApplications pkgs).terminal}";
         "${modifier}+t" = "exec ${(defaultApplications pkgs).fileManager}";
         "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
+        "${modifier}+0" = "exec ${pkgs.scripts.menu-calc}/bin/=";
 
-        "${modifier}+Shift+w" = "exec ${pkgs.xautolock}/bin/xautolock -locknow";
+        "${modifier}+Shift+w" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
         "${modifier}+a" =
           "exec --no-startup-id ${pkgs.rofi}/bin/rofi -display-window — -show window";
         "${modifier}+d" = "exec --no-startup-id ${pkgs.dmenu}/bin/dmenu_run";
@@ -213,7 +213,11 @@ in {
               }
 
               cd ~/notes
-              note_file=$(find . -type f -printf "%T@ %p\n" | sort --reverse --numeric-sort | cut --delimiter=" " --fields=2 | dmenu -i)
+              note_file=$({
+                echo diary/$(date -I).md
+                echo diary/$(date -I -d yesterday).md
+                find . -type f -printf "%T@ %p\n" | sort --reverse --numeric-sort | cut --delimiter=" " --fields=2
+              } | dmenu -i)
               if test "$note_file"
               then
                 i3-sensible-terminal -e "$EDITOR" "$note_file"
@@ -221,31 +225,25 @@ in {
             ''
           }";
         "${modifier}+p" = "exec --no-startup-id ${pkgs.pass}/bin/passmenu -l 5";
-        "${modifier}+u" = "exec ${emoji-menu}/bin/emoji-menu";
+        "${modifier}+u" = "exec ${pkgs.scripts.unicodmenu}/bin/unicodmenu";
 
         "${modifier}+F7" = "exec ${pkgs.scripts.showkeys-toggle}/bin/showkeys-toggle";
         "${modifier}+F8" = "exec ${pkgs.xorg.xkill}/bin/xkill";
         "${modifier}+F9" = "exec ${pkgs.redshift}/bin/redshift -O 4000 -b 0.85";
         "${modifier}+F10" = "exec ${pkgs.redshift}/bin/redshift -x";
         "${modifier}+F11" = "exec ${pkgs.xcalib}/bin/xcalib -invert -alter";
-
+        "${modifier}+F12" = "exec ${klem}/bin/klem";
         "Print" = "exec flameshot-once";
-        "XF86AudioLowerVolume" =
+        "XF86AudioLowerVolume" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -d 5";
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -d 5";
         "XF86AudioMute" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -t";
-        "XF86AudioRaiseVolume" =
+        "XF86AudioRaiseVolume" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -i 5";
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -i 5";
+        "XF86Calculator" = "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
-        "XF86Calculator" =
+        "XF86AudioPause" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl pause";
-          "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
+        "XF86AudioPlay" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioPause" =
+        "XF86AudioNext" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl next";
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl pause";
+        "XF86AudioPrev" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86AudioPlay" =
+        "XF86AudioStop" = "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl stop";
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl play-pause";
+        "XF86ScreenSaver" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
-        "XF86AudioNext" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl next";
-        "XF86AudioPrev" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86ScreenSaver" = "exec ${pkgs.xautolock}/bin/xautolock -locknow";
 
         "XF86Display" = "exec ${pkgs.scripts.dmenurandr}/bin/dmenurandr";
 

configs/keybase.nix

@@ -1,8 +0,0 @@
-{ config, ... }: {
-  services.keybase.enable = true;
-
-  services.kbfs = {
-    enable = true;
-    mountPoint = "%h/cloud/keybase";
-  };
-}

configs/keyboard.nix

@@ -2,8 +2,8 @@
 let commaSep = builtins.concatStringsSep ",";
 in {
   services.xserver = {
-    layout = commaSep [ "de" "gr" ];
+    layout = commaSep [ "de" "gr" "ru" ];
-    xkbVariant = commaSep [ "T3" "polytonic" ];
+    xkbVariant = commaSep [ "T3" "polytonic" "phonetic" ];
     xkbOptions =
       commaSep [ "compose:caps" "terminate:ctrl_alt_bksp" "grp:ctrls_toggle" ];
     libinput.enable = true;

configs/khal.nix

@@ -0,0 +1,168 @@
+{ config, pkgs, lib, ... }:
+let
+  davHome = "~/.local/share/dav";
+  kmeinCloud = {
+    davEndpoint = "https://cloud.xn--kiern-0qa.de/remote.php/dav";
+    username = "kieran";
+    password = lib.fileContents <secrets/nextcloud/password>;
+  };
+  fysiCloud = {
+    davEndpoint = "https://nextcloud.fysi.dev/remote.php/dav";
+    username = "kmein";
+    password = lib.fileContents <secrets/nextcloud-fysi/password>;
+  };
+in
+{
+  environment.systemPackages = [ pkgs.khal pkgs.vdirsyncer pkgs.khard pkgs.todoman ];
+
+  systemd.user.services.vdirsyncer = {
+    enable = true;
+    wants = [ "network-online.target" ];
+    wantedBy = [ "default.target" ];
+    startAt = "*:00/10";
+    script = ''
+      ${pkgs.vdirsyncer}/bin/vdirsyncer sync
+      ${pkgs.khal}/bin/khal printcalendars # https://lostpackets.de/khal/configure.html#syncing
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      Restart = "on-failure";
+    };
+  };
+
+  home-manager.users.me = {
+    xdg.configFile = {
+      "khard/khard.conf".text = ''
+        [addressbooks]
+        [[contacts]]
+        path = ${davHome}/contacts/contacts/
+
+        [general]
+        debug = no
+        default_action = list
+        editor = ${config.environment.variables.EDITOR}
+        merge_editor = ${pkgs.vim}/bin/vimdiff
+
+        [contact table]
+        display = first_name
+        group_by_addressbook = no
+        reverse = no
+        show_nicknames = no
+        show_uids = no
+        sort = last_name
+        localize_dates = yes
+        preferred_phone_number_type = pref, cell, home
+        preferred_email_address_type = pref, work, home
+
+        [vcard]
+        search_in_source_files = no
+        skip_unparsable = no
+      '';
+
+      "todoman/config.py".text = ''
+        path = "${davHome}/calendar/*"
+        date_format = "%Y-%m-%d"
+        time_format = "%H:%M"
+        default_due = 0
+        default_list = "Personal"
+        startable = True
+      '';
+
+      "khal/config".text = ''
+        [calendars]
+
+        [[alew]]
+        path = ${davHome}/calendar/alew
+        color = "light gray"
+
+        [[personal]]
+        path = ${davHome}/calendar/personal
+        color = "light cyan"
+
+        [[uni]]
+        path = ${davHome}/calendar/uni-1
+        color = "yellow"
+
+        [[fysi]]
+        path = ${davHome}/calendar/fysi-1
+        color = "light magenta"
+
+        [[fysi_team]]
+        path = ${davHome}/calendar/personal_shared_by_fdf
+        color = "light red"
+
+        [[birthdays]]
+        path = ${davHome}/contacts/contacts
+        type = birthdays
+        color = "light green"
+
+        [default]
+        highlight_event_days = True
+        timedelta = 5d
+        print_new = path
+        default_calendar = personal
+
+        [locale]
+        timeformat = %H:%M
+        dateformat = %Y-%m-%d
+        longdateformat = %Y-%m-%d
+        datetimeformat = %Y-%m-%d %H:%M
+        longdatetimeformat = %Y-%m-%d %H:%M
+        local_timezone = ${config.time.timeZone}
+        default_timezone = ${config.time.timeZone}
+        weeknumbers = left
+      '';
+
+      "vdirsyncer/config".text = ''
+        [general]
+        status_path = "~/.local/share/vdirsyncer/status/"
+
+        [pair kontakte]
+        a = "kontakte_local"
+        b = "kontakte_cloud"
+        collections = ["contacts"]
+        conflict_resolution = "b wins"
+
+        [pair kalender]
+        a = "kalender_local"
+        b = "kalender_cloud"
+        collections = ["personal", "alew", "uni-1"]
+        conflict_resolution = "b wins"
+
+        [pair fysi]
+        a = "kalender_local"
+        b = "fysi_cloud"
+        collections = ["fysi-1", "personal_shared_by_fdf"]
+        conflict_resolution = "b wins"
+
+        [storage kontakte_local]
+        type = "filesystem"
+        path = "${davHome}/contacts/"
+        fileext = ".vcf"
+
+        [storage kalender_local]
+        type = "filesystem"
+        path = "${davHome}/calendar/"
+        fileext = ".ics"
+
+        [storage kontakte_cloud]
+        type = "carddav"
+        url = "${kmeinCloud.davEndpoint}/addressbooks/users/${kmeinCloud.username}/"
+        username = "${kmeinCloud.username}"
+        password = "${kmeinCloud.password}"
+
+        [storage kalender_cloud]
+        type = "caldav"
+        url = "${kmeinCloud.davEndpoint}/calendars/${kmeinCloud.username}/"
+        username = "${kmeinCloud.username}"
+        password = "${kmeinCloud.password}"
+
+        [storage fysi_cloud]
+        type = "caldav"
+        url = "${fysiCloud.davEndpoint}/calendars/${fysiCloud.username}/"
+        username = "${fysiCloud.username}"
+        password = "${fysiCloud.password}"
+      '';
+    };
+  };
+}

configs/kleiter.nix

@@ -1,13 +0,0 @@
-{ ... }:
-let ssid = "Kleiter Gast";
-in {
-  networking.wireless.networks.${ssid}.psk = "Kleiter-Gast";
-
-  # fix dns
-  systemd.network.networks.kleiter = {
-    dns = [ "8.8.8.8" "8.8.4.4" ];
-    networkConfig.DHCP = "yes";
-    matchConfig.Name = "wlp3s0";
-    matchConfig.SSID = ssid;
-  };
-}

configs/lb.nix

@@ -0,0 +1,27 @@
+{ lib, pkgs, ... }:
+let
+  nixpkgs-unstable = import <nixpkgs-unstable> {};
+in
+{
+  systemd.services.lb-subscription = {
+    enable = true;
+    wants = [ "network-online.target" ];
+    startAt = "weekly";
+    serviceConfig = {
+      user = "kfm";
+      WorkingDirectory = "/home/kfm/cloud/Seafile/Books/Germanistik/LB";
+    };
+    script = ''
+      first_year=2019
+      for year in $(${pkgs.coreutils}/bin/seq "$first_year" "$(date +%Y)"); do
+        ${pkgs.curl}/bin/curl -sSL "https://www.literarische-blaetter.de/jahrgang-$year/" \
+          | ${nixpkgs-unstable.htmlq}/bin/htmlq --attribute href 'ul.slides a' \
+          | while read -r month; do
+            ${pkgs.curl}/bin/curl -sSL "$month" \
+              | ${nixpkgs-unstable.htmlq}/bin/htmlq --attribute src iframe \
+              | ${pkgs.gnused}/bin/sed 's/.*?pdf=//;s/?wp-hosted.*//'
+          done
+      done | ${pkgs.findutils}/bin/xargs ${pkgs.wget}/bin/wget --no-clobber
+    '';
+  };
+}

configs/mail.nix

@@ -1,245 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran;
-
-  nixpkgs-much = import (pkgs.fetchFromGitHub {
-    owner = "NixOS";
-    repo = "nixpkgs";
-    rev = "7c2a362b58a1c2ba72d24aa3869da3b1a91d39e1";
-    sha256 = "0gl4xndyahasa9dv5mi3x9w8s457wl2xh9lcldizcn1irjvkrzs4";
-  }) {
-    overlays = [
-      (import <stockholm/krebs/5pkgs/haskell>)
-    ];
-  };
-  much-pkg = nixpkgs-much.haskellPackages.callCabal2nix "much" <niveum/submodules/much> {};
-  much = nixpkgs-much.haskell.lib.dontHaddock much-pkg;
-
-  tagRules = [
-    {
-      query = "to:miaengiadina-pwa@noreply.github.com AND subject:\"PR run failed\"";
-      tags = [ "-new" "+deleted" ];
-    }
-    {
-      query = lib.concatStringsSep " OR " [
-        "from:noreply-local-guides@google.com"
-        "from:google-maps-noreply@google.com"
-        "subject:fd-noti"
-        "from:nebenan.de"
-        "to:miaengiadina-pwa@noreply.github.com"
-      ];
-      tags = [ "-new" ];
-    }
-    {
-      query = "tag:new";
-      tags = [ "-new" "+inbox" ];
-    }
-  ];
-
-  # turns out we have to escape $ because, if the password contains a $, it will get interpolated as a variable by the msmtp `passwordeval` which does: `bash -c "COMMAND; echo"`
-  pass_ = file: "echo ${lib.escape ["$"] (lib.escapeShellArg (lib.strings.fileContents file))}";
-
-  generateTaggingScript = filters:
-    let
-      template = { tags, query, message ? "tagging ${query} -> ${lib.concatStringsSep " " tags}", ... }: ''
-        echo '${message}'
-        ${pkgs.notmuch}/bin/notmuch tag ${lib.concatStringsSep " " tags} -- "${query}"
-      '';
-    in lib.concatStringsSep "\n" (map template filters);
-
-  enableDefaults = lib.recursiveUpdate {
-    mbsync = {
-      enable = true;
-      create = "both";
-      expunge = "both";
-    };
-    msmtp.enable = true;
-    notmuch.enable = true;
-  };
-
-  mail-sync = pkgs.writers.writeDashBin "mail-sync" ''
-    ${pkgs.isync}/bin/mbsync --all
-    ${pkgs.notmuch}/bin/notmuch new
-  '';
-in {
-  environment.variables.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
-
-  systemd.services.mail-sync = {
-    enable = true;
-    wants = [ "network-online.target" ];
-    startAt = "*:0/15";
-    serviceConfig.User = "kfm";
-    serviceConfig.Type = "oneshot";
-    environment.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
-    script = ''
-      export PATH=${lib.makeBinPath [ pkgs.muchsync pkgs.notmuch mail-sync ]}
-      mail-sync
-      muchsync
-    '';
-  };
-
-  environment.systemPackages = [
-    pkgs.neomutt
-
-    pkgs.notmuch-addrlookup
-
-    mail-sync
-
-    pkgs.muchsync
-
-    (pkgs.writers.writeDashBin "mua" ''
-      if [ $# -eq 0 ]; then
-        ${much}/bin/much-kmein
-      else
-        ${much}/bin/much-kmein -q "$*"
-      fi
-    '')
-
-    (pkgs.writers.writeDashBin "mail-clean" ''
-      ${pkgs.notmuch}/bin/notmuch search --output files --format=text0 tag:deleted | ${pkgs.findutils}/bin/xargs -r0 rm
-      ${pkgs.notmuch}/bin/notmuch new
-    '')
-  ];
-
-
-  home-manager.users.me = {
-    services.muchsync.remotes =
-    let
-      muchsyncConfig = host: {
-        name = host;
-        value = {
-          frequency = "*:0/10";
-          remote.host = host;
-          remote.checkForModifiedFiles = false;
-          local.checkForModifiedFiles = false;
-          # don't run `notmuch new` locally nor remotely because muchsync is only regularly run after `mail-sync`
-          remote.importNew = false;
-          local.importNew = false;
-        };
-      };
-    in lib.listToAttrs (map muchsyncConfig [
-      "wilde"
-      "manakish"
-    ]);
-
-    programs.msmtp.enable = true;
-
-    programs.mbsync.enable = true;
-
-    programs.notmuch = {
-      enable = true;
-      new.tags = [ "new" ];
-      search.excludeTags = [ "deleted" "spam" ];
-      hooks.postNew = generateTaggingScript tagRules;
-      extraConfig.muchsync.and_tags = "inbox;unread";
-    };
-
-    accounts.email.maildirBasePath = "${config.users.users.me.home}/mail";
-
-    accounts.email.accounts = {
-      fysi = enableDefaults {
-        primary = false;
-        smtp = {
-          host = "smtp.fastmail.com";
-          port = 465;
-          tls.enable = true;
-        };
-        imap = {
-          host = "imap.fastmail.com";
-          port = 993;
-          tls.enable = true;
-        };
-        userName = "kieran@fysi.tech";
-        address = "kieran@fysi.tech";
-        realName = kieran.name;
-        passwordCommand = pass_ <secrets/mail/fastmail>;
-      };
-      cock = enableDefaults {
-        primary = false;
-        smtp = {
-          host = "mail.cock.li";
-          port = 587;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "mail.cock.li";
-          port = 993;
-          tls.enable = true;
-        };
-        userName = "2210@cock.li";
-        address = "2210@cock.li";
-        realName = "2210";
-        passwordCommand = pass_ <secrets/mail/cock>;
-      };
-      kieran-gmail = enableDefaults {
-        primary = false;
-        flavor = "gmail.com";
-        address = "kieran.meinhardt@gmail.com";
-        realName = kieran.name;
-        userName = "kieran.meinhardt";
-        passwordCommand = pass_ <secrets/mail/gmail/kieran.meinhardt>;
-        folders = {
-          drafts = "[Gmail]/Entw&APw-rfe";
-          sent = "[Gmail]/Gesendet";
-          trash = "[Gmail]/Papierkorb";
-        };
-      };
-      amroplay = enableDefaults {
-        primary = false;
-        flavor = "gmail.com";
-        address = "amroplay@gmail.com";
-        realName = kieran.name;
-        userName = "amroplay";
-        passwordCommand = pass_ <secrets/mail/gmail/amroplay>;
-        folders = {
-          drafts = "[Gmail]/Drafts";
-          sent = "[Gmail]/Sent Mail";
-          trash = "[Gmail]/Bin";
-        };
-      };
-      posteo = enableDefaults {
-        primary = true;
-        smtp = {
-          host = "posteo.de";
-          port = 587;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "posteo.de";
-          port = 993;
-          tls.enable = true;
-        };
-        address = "kieran.meinhardt@posteo.net";
-        realName = kieran.name;
-        userName = "kieran.meinhardt@posteo.net";
-        passwordCommand = pass_ <secrets/mail/posteo>;
-      };
-      hu-berlin = enableDefaults {
-        primary = false;
-        address = "meinhark@hu-berlin.de";
-        realName = kieran.name;
-        userName = "meinhark";
-        passwordCommand = pass_ <secrets/eduroam/password>;
-        smtp = {
-          host = "mailhost.cms.hu-berlin.de";
-          port = 25;
-          tls = {
-            enable = true;
-            useStartTls = true;
-          };
-        };
-        imap = {
-          host = "mailbox.cms.hu-berlin.de";
-          port = 993;
-          tls.enable = true;
-        };
-      };
-    };
-  };
-}

configs/matterbridge.nix

@@ -1,53 +1,56 @@
 { pkgs, lib, ... }:
-let
-  bridgeBotToken = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
-  config = {
-    general = {
-      RemoteNickFormat = "[{NOPINGNICK}] ";
-      Charset = "utf-8";
-    };
-    telegram.kmein.Token = bridgeBotToken;
-    irc.freenode = {
-      Server = "irc.freenode.net:6667";
-      Nick = "tg_bridge";
-    };
-    gateway = [
-      {
-        name = "krebs-bridge";
-        enable = true;
-        inout = [
-          {
-            account = "irc.freenode";
-            channel = "#krebs";
-          }
-          {
-            account = "telegram.kmein";
-            channel = "-330372458";
-          }
-        ];
-      }
-      {
-        name = "myengadin-bridge";
-        enable = true;
-        inout = [
-          {
-            account = "irc.freenode";
-            channel = "##myengadin";
-          }
-          {
-            account = "telegram.kmein";
-            channel = "-425759153";
-          }
-        ];
-      }
-    ];
-  };
-in
 {
-  nixpkgs.overlays = [ (import <niveum/overlays/toml.nix>) ];
+  nixpkgs.overlays = [
+    (self: super: {
+      matterbridge = (import (super.fetchFromGitHub {
+        owner = "NixOS";
+        repo = "nixpkgs";
+        rev = "e45d91ee65db293a172ec506759d1248e40c35f5";
+        sha256 = "03cjs5xcx09lw0djyrx2kfakw7gkg4iqmy9w25azai62im39l30k";
+      }) {}).matterbridge;
+    })
+  ];
 
   services.matterbridge = {
     enable = true;
-    configPath = toString (pkgs.writeTOML config);
+    configPath =
+    let bridgeBotToken = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
+    in toString ((pkgs.formats.toml {}).generate "config.toml" {
+      general = {
+        RemoteNickFormat = "[{NICK}] ";
+        Charset = "utf-8";
+      };
+      telegram.kmein.Token = bridgeBotToken;
+      irc =
+      let Nick = "ponte";
+      in {
+        hackint = { Server = "irc.hackint.org:6697"; UseTLS = true; inherit Nick; };
+      };
+      mumble.lassulus = {
+        Server = "lassul.us:64738";
+        Nick = "krebs_bridge";
+        SkipTLSVerify = true;
+      };
+      gateway = [
+        {
+          name = "krebs-bridge";
+          enable = true;
+          inout = [
+            {
+              account = "irc.hackint";
+              channel = "#krebs";
+            }
+            {
+              account = "telegram.kmein";
+              channel = "-330372458";
+            }
+            {
+              account = "mumble.lassulus";
+              channel = 6; # "nixos"
+            }
+          ];
+        }
+      ];
+    });
   };
 }

configs/menstruation.nix

@@ -0,0 +1,41 @@
+{ pkgs, lib, ... }:
+let
+  backend = pkgs.callPackage <niveum/submodules/menstruation-backend> {};
+  telegram = pkgs.callPackage <niveum/submodules/menstruation-telegram> {};
+  backendPort = 8000;
+in
+{
+  containers.menstruation.autoStart = true;
+  containers.menstruation.config = { config, pkgs, ... }: {
+    services.redis.enable = true;
+
+    systemd.services.menstruation-telegram = {
+      wants = [
+        "network-online.target"
+        "menstruation-backend.service"
+        "redis.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        MENSTRUATION_TOKEN = lib.strings.fileContents <system-secrets/telegram/menstruation.token>;
+        MENSTRUATION_ENDPOINT = "http://localhost:${toString backendPort}";
+        MENSTRUATION_MODERATORS = "18980945";
+      };
+      serviceConfig = {
+        Restart = "always";
+        DynamicUser = true;
+        ExecStart = "${telegram}/bin/menstruation-telegram";
+      };
+    };
+
+    systemd.services.menstruation-backend = {
+      wants = [ "network-online.target" ];
+      environment.ROCKET_PORT = toString backendPort;
+      serviceConfig = {
+        Restart = "always";
+        DynamicUser = true;
+        ExecStart = "${backend}/bin/menstruation_server";
+      };
+    };
+  };
+}

configs/mime.nix

@@ -19,6 +19,7 @@
         "x-scheme-handler/mailto" = "brave-browser.desktop";
         "x-scheme-handler/unknown" = "brave-browser.desktop";
         "x-scheme-handler/webcal" = "brave-browser.desktop";
+        "inode/directory" = "pcmanfm.desktop";
       };
 
     };

configs/monitoring/blackbox.nix

@@ -0,0 +1,17 @@
+# https://github.com/Fluepke/nix-files/blob/2be70b76a198afaa7763132fed645a3c19d5af6e/configuration/common/blackbox-exporter.yml
+# https://github.com/xHain-hackspace/xhain-nixfiles/blob/0d6e3b87a07317c2d54cccabf4f90da589319e2c/common/prometheus/blackbox-exporter.yml
+{
+  modules.http_2xx = {
+    http = {
+      fail_if_not_ssl = true;
+      ip_protocol_fallback = false;
+      method = "GET";
+      no_follow_redirects = false;
+      preferred_ip_protocol = "ip4";
+      valid_http_versions = [ "HTTP/1.1" "HTTP/2.0" ];
+      tls_config.insecure_skip_verify = true;
+    };
+    prober = "http";
+    timeout = "15s";
+  };
+}

configs/monitoring/loki.nix

@@ -0,0 +1,60 @@
+{
+  auth_enabled = false;
+  server = {
+    http_listen_port = 3100;
+    grpc_listen_port = 9096;
+  };
+  ingester = {
+    wal = {
+      enabled = true;
+      dir = "/tmp/wal";
+    };
+    lifecycler = {
+      address = "127.0.0.1";
+      ring = {
+        kvstore.store = "inmemory";
+        replication_factor = 1;
+      };
+      final_sleep = "0s";
+    };
+    chunk_idle_period = "1h";       # Any chunk not receiving new logs in this time will be flushed
+    max_chunk_age = "1h";           # All chunks will be flushed when they hit this age, default is 1h
+    chunk_target_size = 1048576;    # Loki will attempt to build chunks up to 1.5MB, flushing first if chunk_idle_period or max_chunk_age is reached first
+    chunk_retain_period = "30s";    # Must be greater than index read cache TTL if using an index cache (Default index read cache TTL is 5m)
+    max_transfer_retries = 0;       # Chunk transfers disabled
+  };
+  schema_config.configs = [
+    {
+      from = "2020-10-24";
+      store = "boltdb-shipper";
+      object_store = "filesystem";
+      schema = "v11";
+      index = {
+        prefix = "index_";
+        period = "24h";
+      };
+    }
+  ];
+  storage_config = {
+    boltdb_shipper = {
+      active_index_directory = "/tmp/loki/boltdb-shipper-active";
+      cache_location = "/tmp/loki/boltdb-shipper-cache";
+      cache_ttl = "24h";         # Can be increased for faster performance over longer query periods, uses more disk space
+      shared_store = "filesystem";
+    };
+    filesystem.directory = "/tmp/loki/chunks";
+  };
+  compactor = {
+    working_directory = "/tmp/loki/boltdb-shipper-compactor";
+    shared_store = "filesystem";
+  };
+  limits_config = {
+    reject_old_samples = true;
+    reject_old_samples_max_age = "168h";
+  };
+  chunk_store_config.max_look_back_period = "0s";
+  table_manager = {
+    retention_deletes_enabled = false;
+    retention_period = "0s";
+  };
+}

configs/monitoring/pull.nix

@@ -0,0 +1,229 @@
+{ lib, config, pkgs, ... }:
+let
+  lokiConfig = import ./loki.nix;
+  blackboxConfig = import ./blackbox.nix;
+in
+{
+  services.grafana = {
+    enable = true;
+    domain = "grafana.kmein.r";
+    port = 9444;
+    addr = "127.0.0.1";
+  };
+
+  services.nginx.virtualHosts.${config.services.grafana.domain} = {
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+      proxyWebsockets = true;
+    };
+  };
+
+  services.prometheus.rules = let diskFreeThreshold = 10; in [(builtins.toJSON {
+    groups = [{
+      name = "niveum";
+      rules = [
+        {
+          alert = "ServiceDown";
+          expr = ''node_systemd_unit_state{state="failed"} == 1'';
+          annotations = {
+            summary = "{{$labels.job}}: Service {{$labels.name}} failed to start.";
+          };
+        }
+        {
+          alert = "RootPartitionFull";
+          for = "10m";
+          expr = ''(node_filesystem_free_bytes{mountpoint="/"} * 100) / node_filesystem_size_bytes{mountpoint="/"} < ${toString diskFreeThreshold}'';
+          annotations = {
+            summary = "{{ $labels.job }}: Filesystem is running out of space soon.";
+            description = ''The root disk of {{ $labels.job }} has {{ $value | printf "%.2f" }}% free disk space (threshold at ${toString diskFreeThreshold}%).'';
+          };
+        }
+        {
+          alert = "RootPartitionFullWeek";
+          for = "1h";
+          expr = ''node_filesystem_free_bytes{mountpoint="/"} ''
+            + ''and predict_linear(node_filesystem_free_bytes{mountpoint="/"}[2d], 7*24*3600) <= 0'';
+          annotations = {
+            summary = "{{$labels.job}}: Filesystem is running out of space in 7 days.";
+          };
+        }
+        {
+          alert = "HighLoad";
+          expr = ''node_load15 / on(job) count(node_cpu_seconds_total{mode="system"}) by (job) >= 1.0'';
+          for = "10m";
+          annotations = {
+            summary = "{{$labels.job}}: Running on high load: {{$value}}";
+          };
+        }
+        {
+          alert = "HighRAM";
+          expr = "node_memory_MemFree_bytes + node_memory_Buffers_bytes + node_memory_Cached_bytes < node_memory_MemTotal_bytes * 0.1";
+          for = "1h";
+          annotations.summary = "{{$labels.job}}: Using lots of RAM.";
+        }
+        {
+          alert = "UptimeMonster";
+          expr = "time() - node_boot_time_seconds > 2592000";
+          annotations.summary = "{{$labels.job}}: up for more than 30 days.";
+        }
+        {
+          alert = "HostDown";
+          expr = ''up == 0'';
+          for = "5m";
+          annotations = {
+            summary = "Host {{ $labels.job }} down for 5 minutes.";
+          };
+        }
+        {
+          alert = "Reboot";
+          expr = "time() - node_boot_time_seconds < 300";
+          annotations.summary = "{{$labels.job}}: Reboot";
+        }
+        {
+          alert = "ProbeFailed";
+          expr = "probe_success == 0";
+          for = "5m";
+          annotations.summary = "{{$labels.instance}}: probe failed";
+        }
+        {
+          alert = "SlowProbe";
+          expr = "avg_over_time(probe_http_duration_seconds[1m]) > 1";
+          for = "5m";
+          annotations.summary = "{{$labels.instance}}: HTTP probe slow";
+        }
+        {
+          alert = "HttpStatusCode";
+          expr = "probe_http_status_code != 0 AND (probe_http_status_code <= 199 OR probe_http_status_code >= 400)";
+          for = "5m";
+          annotations.summary = "{{$labels.instance}}: status code {{$value}}";
+        }
+        {
+          alert = "SslExpirySoon";
+          expr = "probe_ssl_earliest_cert_expiry - time() < 86400 * 30";
+          for = "5m";
+          annotations.summary = "{{$labels.instance}}: SSL certificate expires in 30 days";
+        }
+        {
+          alert = "SslExpiry";
+          expr = "probe_ssl_earliest_cert_expiry - time()  <= 0";
+          for = "5m";
+          annotations.summary = "{{$labels.instance}}: SSL certificate has expired";
+        }
+      ];
+    }];
+  })];
+
+  systemd.services.alertmanager-bot-telegram =
+  let
+    alertmanager-bot-telegram = pkgs.buildGoModule rec {
+      pname = "alertmanager-bot";
+      version = "2020-07-13";
+      src = pkgs.fetchFromGitHub {
+        owner = "metalmatze";
+        repo = "alertmanager-bot";
+        rev = "5efc0bbbf8023d4324e9da98562f064a714a7206";
+        sha256 = "09cciml1j8x76jpm2v5v6h2q6j1fkhsz1kswslmx8wl4wk40xgp4";
+      };
+      vendorSha256 = "1v0fgin8dn81b559zz4lqmrl7hikr46g4gb18sci4riql5qs1isj";
+      postInstall = ''
+        install -D ./default.tmpl $out/templates/default.tmpl
+      '';
+    };
+  in {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "ip-up.target" ];
+    environment.TELEGRAM_ADMIN = "18980945";
+    environment.TELEGRAM_TOKEN = lib.strings.fileContents <system-secrets/telegram/prometheus.token>;
+    serviceConfig = {
+      DynamicUser = true;
+      StateDirectory = "alertbot";
+      ExecStart = ''${alertmanager-bot-telegram}/bin/alertmanager-bot \
+        --alertmanager.url=http://localhost:9093 --log.level=info \
+        --store=bolt --bolt.path=/var/lib/alertbot/bot.db \
+        --listen.addr="0.0.0.0:16320" \
+        --template.paths=${pkgs.writeText "template.tmpl" ''
+          {{ define "telegram.default" }}
+          {{range .Alerts -}}
+          {{ if eq .Status "firing" }}
+          ⚠ <b>{{ index .Annotations "summary"}}</b>
+          {{ index .Annotations "description" }}
+
+          See on Grafana: http://${config.services.grafana.domain}/d/alpUteInz/niveum
+          {{ else -}}
+          RESOLVED 😌 <del>{{ index .Annotations "summary"}}</del>
+          {{- end }}
+          {{end -}}
+          {{end}}
+        ''}'';
+    };
+  };
+
+  services.prometheus.alertmanager = {
+    enable = true;
+    listenAddress = "localhost";
+    configuration = {
+      route = {
+        group_wait = "30s";
+        repeat_interval = "4h";
+        receiver = "me";
+      };
+      receivers = [{
+        name = "me";
+        webhook_configs = [{
+          url = "http://localhost:16320";
+          send_resolved = true;
+        }];
+      }];
+    };
+  };
+
+  services.prometheus.alertmanagers = [{
+    scheme = "http";
+    path_prefix = "/";
+    static_configs = [ { targets = [ "localhost:9093" ]; } ];
+  }];
+
+  services.prometheus.scrapeConfigs = [
+    {
+      job_name = "makanek";
+      static_configs = [ { targets = [
+        "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
+      ]; } ];
+    }
+    {
+      scrape_interval = "5m";
+      job_name = "blackbox";
+      metrics_path = "/probe";
+      params.module = [ "http_2xx" ];
+      relabel_configs = [
+        { source_labels = ["__address__"]; target_label = "__param_target"; }
+        { source_labels = ["__param_target"]; target_label = "instance"; }
+        { replacement = "127.0.0.1:${toString config.services.prometheus.exporters.blackbox.port}"; target_label = "__address__"; }
+      ];
+      static_configs = [{
+        targets = [
+          "alew.hu-berlin.de"
+        ];
+      }];
+    }
+    {
+      job_name = "zaatar";
+      static_configs = [ { targets = [ "zaatar.r:${toString config.services.prometheus.exporters.node.port}" ]; } ];
+    }
+  ];
+
+
+  services.prometheus.exporters.blackbox = {
+    enable = true;
+    configFile = (pkgs.formats.yaml {}).generate "blackbox.yaml" blackboxConfig;
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    lokiConfig.server.http_listen_port
+  ];
+
+  services.loki = {
+    enable = true;
+    configFile = (pkgs.formats.yaml {}).generate "loki.yaml" lokiConfig;
+  };
+}

configs/monitoring/push.nix

@@ -0,0 +1,75 @@
+{ config, pkgs, ... }:
+{
+  services.nginx.virtualHosts.default = {
+    locations."= /stub_status".extraConfig = "stub_status;";
+  };
+
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      nginx.enable = false;
+      node = {
+        enable = true;
+        enabledCollectors = [
+          "conntrack"
+          "diskstats"
+          "entropy"
+          "filefd"
+          "filesystem"
+          "loadavg"
+          "mdadm"
+          "meminfo"
+          "netdev"
+          "netstat"
+          "stat"
+          "time"
+          "vmstat"
+          "systemd"
+          "logind"
+          "interrupts"
+          "ksmd"
+        ];
+        port = 9002;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ config.services.prometheus.exporters.node.port ];
+
+  systemd.services.promtail = {
+    description = "Promtail service for Loki";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.grafana-loki}/bin/promtail --config.file ${(pkgs.formats.yaml {}).generate "promtail.yaml" {
+          server = {
+            http_listen_port = 28183;
+            grpc_listen_port = 0;
+          };
+          positions.filename = "/tmp/positions.yaml";
+          clients = [
+            { url = "http://${if config.networking.hostName == "makanek" then "127.0.0.1" else "makanek.r"}:3100/loki/api/v1/push"; }
+          ];
+          scrape_configs = [
+            {
+              job_name = "journal";
+              journal = {
+                max_age = "12h";
+                labels.job = "systemd-journal";
+                labels.host = config.networking.hostName;
+              };
+              relabel_configs = [
+                {
+                  source_labels = [ "__journal__systemd_unit" ];
+                  target_label = "unit";
+                }
+              ];
+            }
+          ];
+        }}
+      '';
+    };
+  };
+}

configs/moodle-dl.nix

@@ -1,64 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran;
-
-  moodle-dl = pkgs.callPackage <niveum/packages/moodle-dl> {};
-
-  moodle-dl-config = {
-    telegram = {
-      token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
-      chat_id = "18980945";
-      send_error_msg = true;
-    };
-    token = lib.strings.fileContents <system-secrets/moodle.token>;
-    moodle_domain = "moodle.hu-berlin.de";
-    moodle_path = "/";
-    download_course_ids = [
-      99881 # Dialektologie
-      100183 # Onomastik
-      100353 # Sanskrit I
-      100692 # Sanskrit Tutorium
-      99832 # Germanisch
-      99823 # Gotisch
-      99813 # Altalbanisch
-      98681 # Geistliche Lyrik von Luther bis Lehnert
-      99667 # Antike Mythologie
-    ];
-    download_submissions = true;
-    download_descriptions = false;
-    download_links_in_descriptions = false;
-    download_databases = false;
-    download_forums = false;
-    download_linked_files = false;
-    download_also_with_cookie = false;
-  };
-
-  moodle-dl-json = pkgs.writeText "moodle-dl.json" (builtins.toJSON moodle-dl-config);
-in
-{
-  users.extraUsers.moodle = {
-    isNormalUser = false;
-    home = "/var/lib/moodle";
-    createHome = true;
-    openssh.authorizedKeys.keys = [
-      # for sshfs mount
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDtIFmbspaBHaSkLEx43V0uaVd7l9NUFiwt2VOP++KzLjvRMLkyF2hg2HjmogTjUvTyoDs7RHwEH/cHZlJ5JQkM1jRqQpnYwGfkZEwYvmXAl6LY9+vQMP36gNPfXmKX3y3LelO7oD2uhUs0guTtg0tHUyN5/UY5u+VinyD6djxDkHaCUn3S7CS/odBcs/4flXT654wsvzgYicnSKH9R4W+7C0YsckZ/NoIkA4jnuwtWZYWrUkxd4/290buX6pAc5+zVVZqyy0sI4i8s6pO9RL5W7xvYt+w+U0u0dMxm5ckiRmLVKfIbMN4YtDxsZbZDajlQ1nDbOsEsrSXWz4H4cSNot7J820x1qh5SSxL4GSQlcT+6xCFk9kKyflxoS3oLoPLttx3rmOMkZKJWxF/IKLW47orxV6wkG5mHxdeR3cf6jX4j3nkwFVyC9R+WG4w2Z4vKONVE7uWGYU3y4OpR1e6MGHVShkNKqEvC/Kjcc/6v7I7AKRAuPZB0WEw36tA65/8= root@wilde"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFPHt+FPQ6gq8Ev65YsBZrafdtpWGpCNnlVvy67S1BK root@manakish"
-    ];
-    useDefaultShell = true;
-  };
-
-  system.activationScripts.moodle-dl-config = "ln -sfn ${toString moodle-dl-json} ${config.users.extraUsers.moodle.home}/config.json";
-
-  systemd.services.moodle-dl = {
-    enable = true;
-    startAt = "hourly";
-    serviceConfig = {
-      Type = "oneshot";
-      User = config.users.extraUsers.moodle.name;
-      WorkingDirectory = config.users.extraUsers.moodle.home;
-    };
-    wants = [ "network-online.target" ];
-    script = "${moodle-dl}/bin/moodle-dl";
-  };
-}

configs/moodle-dl/borsfaye.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, lib, ... }:
+let
+  moodle-dl-package = pkgs.moodle-dl.overrideAttrs (old: old // {
+    patches = [ <niveum/packages/moodle-dl/telegram-format.patch> ];
+  });
+in
+{
+  containers.moodle-dl-borsfaye = {
+    autoStart = true;
+    config = { lib, pkgs, ...}: {
+      imports = [ <niveum/modules/moodle-dl.nix> ];
+
+      services.moodle-dl = {
+        enable = true;
+        startAt = "hourly";
+        package = moodle-dl-package;
+        notifyOnly = true;
+        settings = {
+          telegram = {
+            token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
+            chat_id = "311425510";
+            send_error_msg = false;
+          };
+          token = lib.strings.fileContents <system-secrets/moodle-dl/faye.token>;
+          moodle_domain = "moodle.hu-berlin.de";
+          moodle_path = "/";
+        };
+      };
+    };
+  };
+}

configs/moodle-dl/meinhark.nix

@@ -0,0 +1,107 @@
+{ config, pkgs, lib, ... }:
+let
+  moodle-dl-package = pkgs.moodle-dl.overrideAttrs (old: old // {
+    patches = [ <niveum/packages/moodle-dl/telegram-format.patch> ];
+  });
+in
+{
+  imports = [ <niveum/modules/moodle-dl.nix> ];
+
+  services.moodle-dl = {
+    enable = true;
+    startAt = "hourly";
+    package = moodle-dl-package;
+    settings = {
+      telegram = {
+        token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
+        chat_id = "18980945";
+        send_error_msg = false;
+      };
+      token = lib.strings.fileContents <system-secrets/moodle.token>;
+      moodle_domain = "moodle.hu-berlin.de";
+      moodle_path = "/";
+      download_course_ids = [
+        # WS 2020
+        99881 # Dialektologie
+        100183 # Onomastik
+        100353 # Sanskrit I
+        100692 # Sanskrit Tutorium
+        99832 # Germanisch
+        99823 # Gotisch
+        99813 # Altalbanisch
+        98681 # Geistliche Lyrik von Luther bis Lehnert
+        99667 # Antike Mythologie
+        # 52365 # FSR KlassPhil
+
+        # SS 2021
+        104850 # Metrik
+        103274 # Marc Aurel
+        102909 # Sanskrit II
+        104937 # Altirisch
+        104925 # Gradierung und Komparation
+        105264 # Was andere Sprachen anders machen
+        104991 # Warum klingt Orkisch böse
+        105074 # Litauisch
+        103685 # Griechische Sprache und Übersetzung I
+        105455 # Elegia greca
+        105335 # Homerische Epen
+
+        # WS 2021
+        108122 # Griechisch
+        107986 # Altostslavisch
+        107792 # Elegie in Rom
+        107369 # Tusculanae Disputationes
+        108586 # Griechische Religion
+        107988 # Balkanindogermanisch
+        108312 # Altnordisch
+        107281 # NLP
+        108736 # Grammatiktheorie
+        109438 # Warum klingt Orkisch böse
+        108025 # Poetik der Nordgermanen
+        107280 # Statistik
+        108350 # Attische Redner
+        107461 # Argonautika
+        108283 # Digital Classicist
+        109211 # Altlitauisch
+        109185 # Etymologie
+      ];
+      download_submissions = true;
+      download_descriptions = true;
+      download_links_in_descriptions = false;
+      download_databases = false;
+      download_forums = false;
+      download_linked_files = false;
+      download_also_with_cookie = false;
+    };
+  };
+
+  fileSystems."/export/moodle" = {
+    device = config.services.moodle-dl.directory;
+    options = [ "bind" ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 2049 ];
+
+  services.nginx.virtualHosts."moodle.kmein.r" =
+  let
+    identity = lib.strings.fileContents <secrets/eduroam/identity>;
+    password = lib.strings.fileContents <secrets/eduroam/password>;
+  in {
+    basicAuth."${identity}" = password;
+    locations."/" = {
+      root = config.services.moodle-dl.directory;
+      extraConfig = ''
+        autoindex on;
+        charset UTF-8;
+      '';
+    };
+  };
+
+  services.nfs.server = {
+    enable = true;
+    exports = let machines = with (import <niveum/lib>).retiolumAddresses; [kabsa manakish]; in ''
+      /export        ${lib.concatMapStringsSep " " (machine: "${machine.ipv4}(fsid=0)") machines}
+      /export/moodle ${lib.concatMapStringsSep " " (machine: "${machine.ipv4}(insecure,rw)") machines}
+    '';
+  };
+}

configs/mpd.nix

@@ -1,28 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  playlists = import <niveum/lib/playlists.nix>;
-  playlistFiles = lib.mapAttrs (name: {tracks, ...}: pkgs.writeText "${name}.m3u" (builtins.concatStringsSep "\n" (map ({url, ...}: url) tracks))) playlists;
-  linkPlaylist = name: file: ''
-    ln -sfn "${toString file}" "/var/lib/mpd/playlists/${name}.m3u"
-  '';
-  linkPlaylists = lib.concatStringsSep "\n" (lib.mapAttrsToList linkPlaylist playlistFiles);
-in
-{
-  system.activationScripts.mpd-playlists = ''
-    rm -rf /var/lib/mpd/playlists
-    install -d /var/lib/mpd/playlists
-    ${linkPlaylists}
-  '';
-
-  environment.systemPackages = [ pkgs.ncmpcpp pkgs.mpc_cli ];
-
-  services.mpd.enable = true;
-  services.ympd.enable = true;
-
-  # dont let anyone outside localhost or local network in
-  networking.firewall.extraCommands = let ympdPort = config.services.ympd.webPort; in ''
-    ${pkgs.iptables}/bin/iptables -A INPUT -p tcp --dport ${ympdPort} -s 192.168.0.0/16 -j ACCEPT
-    ${pkgs.iptables}/bin/iptables -A INPUT -p tcp --dport ${ympdPort} -s 127.0.0.0/8 -j ACCEPT
-    ${pkgs.iptables}/bin/iptables -A INPUT -p tcp --dport ${ympdPort} -j DROP
-  '';
-}

configs/mpv.nix

@@ -1,14 +1,15 @@
-{ pkgs, ... }: let
+{ pkgs, lib, ... }: let
   swallow = command: "${pkgs.scripts.swallow}/bin/swallow ${command}";
+  nixpkgs-unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
 in {
-  environment.shellAliases.mpv = swallow "mpv";
+  environment.shellAliases.smpv = swallow "mpv";
 
   home-manager.users.me = {
     programs.mpv = {
       enable = true;
       config = {
-        force-window = "yes";
+        ytdl-raw-options = lib.concatStringsSep "," [ ''sub-lang="de,en"'' "write-sub=" "write-auto-sub=" ];
-        ytdl-format = "bestvideo[height<=?720][fps<=?30][vcodec!=?vp9]+bestaudio/best";
+        screenshot-template = "%F-%wH%wM%wS-%#04n";
       };
       bindings = {
         "Alt+RIGHT" = "add video-rotate 90";
@@ -20,6 +21,9 @@ in {
         "Alt+k" = "add video-pan-y 0.05";
         "Alt+j" = "add video-pan-y -0.05";
       };
+      scripts = [
+        nixpkgs-unstable.mpvScripts.youtube-quality
+      ];
     };
   };
 }

configs/names.nix

@@ -0,0 +1,38 @@
+{ pkgs, lib, ... }:
+let
+  port = 5703;
+  geogen = (pkgs.fetchFromGitHub {
+    owner = "kmein";
+    repo = "scripts";
+    rev = "8945430f27a8c6fd632dd35382cb094abe3543ff";
+    sha256 = "1djyxkynypxsrmdf6idgjszqpcgqyq607rrsvl58p2bpymmwibzb";
+  }) + "/onomastics";
+  inherit (pkgs.callPackage geogen {}) dependencyEnv;
+in
+{
+  systemd.services.names = {
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    description = "Better clone of geogen.stoepel.net";
+    serviceConfig = {
+      DynamicUser = true;
+    };
+    script = ''
+      cd $(mktemp -d)
+      ln -s "${geogen}/wsgi.py" wsgi.py
+      ${dependencyEnv}/bin/gunicorn wsgi:app -b :${toString port}
+    '';
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  services.nginx.virtualHosts."names.kmein.r" = {
+    locations."/".proxyPass = "http://127.0.0.1:${toString port}";
+  };
+}

configs/neomutt.nix

@@ -0,0 +1,248 @@
+{ pkgs, lib, ... }:
+let
+  mainMailbox = "posteo";
+
+  accounts.uni = {
+    user = "meinhark";
+    password = lib.strings.fileContents <secrets/eduroam/password>;
+    address = "kieran.felix.meinhardt@hu-berlin.de";
+    imap = "mailbox.cms.hu-berlin.de";
+    smtp = "mailhost.cms.hu-berlin.de";
+    smtpSettings = smtp: "smtp://${smtp}";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts.uni-old = {
+    user = "meinhark";
+    password = lib.strings.fileContents <secrets/eduroam/password>;
+    address = "meinhark@informatik.hu-berlin.de";
+    imap = "mailbox.informatik.hu-berlin.de";
+    smtp = "mailhost.informatik.hu-berlin.de";
+    smtpSettings = smtp: "smtp://${smtp}";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts.work-uni = {
+    user = "meinhaki";
+    password = lib.strings.fileContents <secrets/mail/meinhaki>;
+    address = "kieran.meinhardt@hu-berlin.de";
+    imap = "mailbox.cms.hu-berlin.de";
+    smtp = "mailhost.cms.hu-berlin.de";
+    smtpSettings = smtp: "smtp://${smtp}";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts.work-fysi = rec {
+    user = "kieran@fysi.tech";
+    address = user;
+    password = lib.strings.fileContents <secrets/mail/fastmail>;
+    imap = "imap.fastmail.com";
+    smtp = "smtp.fastmail.com";
+    smtpSettings = smtp: "smtps://${smtp}:465";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts.cock = rec {
+    user = "2210@cock.li";
+    address = user;
+    password = lib.strings.fileContents <secrets/mail/cock>;
+    imap = "mail.cock.li";
+    smtp = imap;
+    smtpSettings = smtp: "smtp://${smtp}:587";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts."${mainMailbox}" = rec {
+    user = "kieran.meinhardt@posteo.net";
+    address = user;
+    password = lib.strings.fileContents <secrets/mail/posteo>;
+    imap = "posteo.de";
+    smtp = imap;
+    smtpSettings = smtp: "smtp://${smtp}";
+    folders = {
+      drafts = "Drafts";
+      sent = "Sent";
+      trash = "Trash";
+    };
+  };
+
+  accounts.google-amro = rec {
+    user = "amroplay@gmail.com";
+    address = user;
+    password = lib.strings.fileContents <secrets/mail/gmail/amroplay>;
+    imap = "imap.gmail.com";
+    smtp = "smtp.gmail.com";
+    smtpSettings = smtp: "smtps://${smtp}:465";
+    folders = {
+      drafts = "[Gmail]/Drafts";
+      sent = "[Gmail]/Sent Mail";
+      trash = "[Gmail]/Bin";
+    };
+  };
+
+  accounts.google-kieran = rec {
+    user = "kieran.meinhardt@gmail.com";
+    address = user;
+    password = lib.strings.fileContents <secrets/mail/gmail/kieran.meinhardt>;
+    imap = "imap.gmail.com";
+    smtp = "smtp.gmail.com";
+    smtpSettings = smtp: "smtps://${smtp}:465";
+    folders = {
+      drafts = "[Gmail]/Entwürfe";
+      sent = "[Gmail]/Gesendet";
+      trash = "[Gmail]/Papierkorb";
+    };
+  };
+in
+{
+  environment.systemPackages = [ pkgs.neomutt ];
+  environment.shellAliases.mua = "${pkgs.neomutt}/bin/neomutt -f ${mainMailbox}←";
+
+  home-manager.users.me.xdg.configFile."neomutt/neomuttrc".text = ''
+    set mailcap_path = ${pkgs.writeText "mailcap" ''
+      text/plain; $EDITOR %s ;
+      text/html; ${pkgs.lynx}/bin/lynx -assume_charset=%{charset} -display_charset=utf-8 -dump %s; nametemplate=%s.html; copiousoutput;
+      image/*; ${pkgs.sxiv}/bin/sxiv %s ;
+      video/*; ${pkgs.utillinux}/bin/setsid ${pkgs.mpv}/bin/mpv --quiet %s &; copiousoutput
+      audio/*; ${pkgs.mpv}/bin/mpv %s ;
+      application/pdf; ${pkgs.zathura}/bin/zathura %s ;
+      application/pgp-encrypted; ${pkgs.gnupg}/bin/gpg -d '%s'; copiousoutput;
+      application/pgp-keys; ${pkgs.gnupg}/bin/gpg --import '%s'; copiousoutput;
+    ''}:$mailcap_path
+
+    set sidebar_visible
+    set sidebar_format = "%D%?F? [%F]?%* %?N?%N/?%S"
+    set sidebar_width = 25                  # Plenty of space
+    set sidebar_divider_char = '│'          # Pretty line-drawing character
+    set mail_check_stats
+
+    set index_format="%2C %Z %D %-15.15L %s"
+    set date_format="%F %R"
+
+    set sort = 'reverse-date'
+    set sleep_time = 0		# Pause 0 seconds for informational messages
+    set markers = no		# Disables the `+` displayed at line wraps
+    set mark_old = no		# Unread mail stay unread until read
+    set wait_key = no		# mutt won't ask "press key to continue"
+    set fast_reply			# skip to compose when replying
+    set forward_format = "Fwd: %s"	# format of subject when forwarding
+    set reverse_name		# reply as whomever it was to
+    set include=ask-no			# don't include message in replies
+    auto_view text/html		# automatically show html (mailcap uses lynx)
+    auto_view application/pgp-encrypted
+    alternative_order text/plain text/enriched text/html
+
+    set abort_noattach abort_noattach_regex="\<(attach|attached|attachments?|anbei|Anhang|angehängt)\>"
+    set attach_save_dir=/tmp
+    set fast_reply
+
+    set narrow_tree # narrow threads for more depth
+
+    bind index,pager B sidebar-toggle-visible   # Use 'B' to switch the Sidebar on and off
+    bind index,pager \Ck sidebar-prev
+    bind index,pager \Cj sidebar-next
+    bind index,pager \Co sidebar-open
+    bind index,pager \Cp sidebar-prev-new
+    bind index,pager \Cn sidebar-next-new
+
+    macro index * <limit>~F\r
+    macro index + <limit>all\r
+
+    set query_command = "khard email --parsable %s"
+    bind editor <Tab> complete-query
+    bind editor ^T    complete
+
+    set mail_check = 90
+    set timeout = 15
+    # set imap_check_subscribed
+    set use_from
+
+
+    set header_cache="~/.cache/mutt" message_cachedir="~/.cache/mutt"
+
+    source ${pkgs.writeText "accounts.neomuttrc" ''
+      set realname = "Kierán Meinhardt"
+      account-hook . 'unset imap_user imap_pass smtp_user smtp_pass'
+      # set accordingly: postponed trash record
+      ${lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: let imapRoot = "imaps://${account.user}@${account.imap}"; in ''
+        account-hook ${account.user}@${account.imap} 'set imap_user="${account.user}" imap_pass="${account.password}"'
+        account-hook ${account.user}@${account.smtp} 'set smtp_user="${account.user}" smtp_pass="${account.password}"'
+        folder-hook  ${account.user}@${account.imap} 'set smtp_url="${account.smtpSettings "${account.user}@${account.smtp}"}" from="${account.address}" record="${imapRoot}/${account.folders.sent}" postponed="${imapRoot}/${account.folders.drafts}" trash="${imapRoot}/${account.folders.trash}"'
+        named-mailboxes "${name}←" "${imapRoot}" "${name}→" "${imapRoot}/${account.folders.sent}"
+      '') accounts)}
+    ''}
+
+    set spoolfile="${mainMailbox}"
+
+    source ${pkgs.writeText "colors.neomuttrc" ''
+      # Default index colors:
+      color index_number blue default
+      color index red default '.*'
+      color index_flags lightcyan default '.*'
+      color index_author yellow default '.*'
+      color index_subject lightblack default '.*'
+
+      # New mail is boldened:
+      color index_author lightyellow black "~N"
+      color index_subject lightwhite black "~N"
+
+      # Flagged mail is highlighted:
+      color index_flags lightmagenta default '~F'
+
+      # Other colors and aesthetic settings:
+      mono bold bold
+      mono underline underline
+      mono error bold
+      mono indicator reverse
+      # color sidebar_flagged red black
+      mono sidebar_new bold
+      color error red default
+      color message cyan default
+      color search brightmagenta default
+      color hdrdefault lightblack default
+      color quoted green default
+      color quoted1 blue default
+      color quoted2 cyan default
+      color quoted3 yellow default
+      color quoted4 red default
+      color quoted5 brightred default
+      color signature lightblack default
+      color tree color235 default
+
+      # Regex highlighting:
+      color header red default "^(Date)"
+      color header yellow default "^(From)"
+      color header white default "^(B?CC)"
+      color header brightwhite default "^(Subject)"
+      color body cyan default "[\-\.+_a-zA-Z0-9]+@[\-\.a-zA-Z0-9]+" # Email addresses
+      color body brightblue default "(https?|ftp)://[\-\.,/%~_:?&=\#a-zA-Z0-9]+" # URL
+      color body yellow default "^(\t| )*(-|\\*) \.*" # List items as yellow
+      color body red default "(BAD signature)|^gpg: BAD signature from.*"
+      color body brightgreen default "(Good signature)|^gpg: Good signature .*"
+      color body brightyellow default "^gpg: "
+      mono body bold "^gpg: Good signature"
+      mono body bold "^gpg: BAD signature from.*"
+      color body red default "([a-z][a-z0-9+-]*://(((([a-z0-9_.!~*'();:&=+$,-]|%[0-9a-f][0-9a-f])*@)?((([a-z0-9]([a-z0-9-]*[a-z0-9])?)\\.)*([a-z]([a-z0-9-]*[a-z0-9])?)\\.?|[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)(:[0-9]+)?)|([a-z0-9_.!~*'()$,;:@&=+-]|%[0-9a-f][0-9a-f])+)(/([a-z0-9_.!~*'():@&=+$,-]|%[0-9a-f][0-9a-f])*(;([a-z0-9_.!~*'():@&=+$,-]|%[0-9a-f][0-9a-f])*)*(/([a-z0-9_.!~*'():@&=+$,-]|%[0-9a-f][0-9a-f])*(;([a-z0-9_.!~*'():@&=+$,-]|%[0-9a-f][0-9a-f])*)*)*)?(\\?([a-z0-9_.!~*'();/?:@&=+$,-]|%[0-9a-f][0-9a-f])*)?(#([a-z0-9_.!~*'();/?:@&=+$,-]|%[0-9a-f][0-9a-f])*)?|(www|ftp)\\.(([a-z0-9]([a-z0-9-]*[a-z0-9])?)\\.)*([a-z]([a-z0-9-]*[a-z0-9])?)\\.?(:[0-9]+)?(/([-a-z0-9_.!~*'():@&=+$,]|%[0-9a-f][0-9a-f])*(;([-a-z0-9_.!~*'():@&=+$,]|%[0-9a-f][0-9a-f])*)*(/([-a-z0-9_.!~*'():@&=+$,]|%[0-9a-f][0-9a-f])*(;([-a-z0-9_.!~*'():@&=+$,]|%[0-9a-f][0-9a-f])*)*)*)?(\\?([-a-z0-9_.!~*'();/?:@&=+$,]|%[0-9a-f][0-9a-f])*)?(#([-a-z0-9_.!~*'();/?:@&=+$,]|%[0-9a-f][0-9a-f])*)?)[^].,:;!)? \t\r\n<>\"]"
+    ''}
+  '';
+}

configs/neovim.nix

@@ -11,7 +11,6 @@
       vim-colors-paramount = pkgs.callPackage <niveum/packages/vimPlugins/vim-colors-paramount.nix> { };
       vim-256noir = pkgs.callPackage <niveum/packages/vimPlugins/vim-256noir.nix> { };
       icalendar-vim = pkgs.callPackage <niveum/packages/vimPlugins/icalendar-vim.nix> { };
-      todo-txt-vim = pkgs.callPackage <niveum/packages/vimPlugins/todo-txt-vim.nix> { };
       jq-vim = pkgs.callPackage <niveum/packages/vimPlugins/jq-vim.nix> { };
       vim-fsharp = pkgs.callPackage <niveum/packages/vimPlugins/vim-fsharp.nix> { };
       vim-reason-plus = pkgs.callPackage <niveum/packages/vimPlugins/vim-reason-plus.nix> { };
@@ -20,23 +19,19 @@
   };
 
   environment.systemPackages = [
+    (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
     (pkgs.neovim.override {
       configure = {
         customRC = builtins.readFile <niveum/lib/vim/init.vim>;
         packages.nvim = with pkgs.vimPlugins; {
           start = [
-            # cheat-sh-vim
-            # deoplete-nvim
-            # vim-abolish
             ale
             fzf-vim
             fzfWrapper
-            goyo
             supertab
             undotree
             tabular
             vimwiki
-            vim-256noir
             vim-colors-paramount
             vim-commentary
             vim-css-color
@@ -44,13 +39,9 @@
             vim-fetch
             vim-fugitive
             vim-gitgutter
-            vim-pandoc
-            vim-pandoc-syntax # vim-pandoc-after
             vim-repeat
             vim-sensible
-            # vim-startify
             vim-surround
-            vim-mail
           ];
           opt = [
             csv
@@ -60,10 +51,10 @@
             haskell-vim
             icalendar-vim
             idris-vim
+            nim-vim
             jq-vim
             purescript-vim
             rust-vim
-            todo-txt-vim
             typescript-vim
             vim-fsharp
             vim-javascript
@@ -72,6 +63,9 @@
             vim-reason-plus
             vim-toml
             vimtex
+            vim-pandoc
+            vim-pandoc-syntax # vim-pandoc-after
+            vim-256noir
           ];
         };
       };

configs/networkmanager.nix

@@ -0,0 +1,100 @@
+{ lib, pkgs, ... }:
+let
+  autowifi = pkgs.writers.writePython3Bin "autowifi" { flakeIgnore = [ "E501" ]; } <stockholm/lass/5pkgs/autowifi/autowifi.py>;
+  profile = name: custom: lib.recursiveUpdate {
+    connection.id = name;
+    connection.type = "wifi";
+    connection.interface-name = "wlp3s0";
+    connection.permissions = "";
+    wifi.mac-address-blacklist = "";
+    wifi.ssid = name;
+    wifi.mode = "infrastructure";
+    ipv4.dns-search = "";
+    ipv4.method = "auto";
+    ipv6.addr-gen-mode = "stable-privacy";
+    ipv6.dns-search = "";
+    ipv6.method = "auto";
+    proxy = {};
+  } custom;
+  eduroamProfile = {
+    connection.uuid = "eae9fee6-a7d2-4120-a609-440b457d6fcf";
+    wifi-security = {
+      group = "ccmp;tkip;";
+      key-mgmt = "wpa-eap";
+      pairwise = "ccmp;";
+      proto = "rsn;";
+    };
+    "802-1x" = {
+      altsubject-matches = "DNS:srv1-radius.cms.hu-berlin.de;DNS:srv2-radius.cms.hu-berlin.de;";
+      anonymous-identity = "anonymous@wlan.hu-berlin.de";
+      ca-cert = pkgs.fetchurl {
+        url = "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/t-telesec_globalroot_class_2.pem";
+        sha256 = "0if8aqd06sid7a0vw009zpa087wxcgdd2x6z2zs4pis5kvyqj2dk";
+      };
+      eap = "ttls;";
+      identity = lib.strings.fileContents <secrets/eduroam/identity>;
+      password = lib.strings.fileContents <secrets/eduroam/password>;
+      phase2-auth = "pap";
+    };
+  };
+in
+{
+  imports = [ ../modules/networkmanager-declarative.nix ];
+
+  networking.networkmanager = {
+    enable = true;
+    wifi.macAddress = "random";
+    ethernet.macAddress = "random";
+    unmanaged = [ "docker*" ];
+    profiles = lib.mapAttrs profile {
+      Aether = {
+        connection.uuid = "7138bb0f-1aeb-4905-890e-a6628427aa21";
+        ipv6.addr-gen-mode = "stable";
+        wifi.cloned-mac-address = "stable";
+        wifi-security = {
+          psk = lib.strings.fileContents <secrets/wifi/Aether.psk>;
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      FactoryCommunityGuest = {
+        connection.uuid = "fb1f2e52-651e-48b5-a72c-1accddf31afb";
+        connection.timestamp = "1631885129";
+        wifi.seen-bssids = "54:EC:2F:19:30:DC;54:EC:2F:19:5C:9C;54:EC:2F:58:E4:3C;";
+        wifi-security = {
+          psk = "Factory4ever";
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      o2-WLAN66 = {
+        connection.uuid = "c563aec3-f344-4ffb-8d1c-60a6cdac8fe0";
+        wifi-security = {
+          psk = "PK3468KV488T934U";
+          auth-alg = "open";
+          key-mgmt = "wpa-psk";
+        };
+      };
+      "WIFI@DB".connection.uuid = "4eff4e94-8850-4e9f-a338-1787d0d90479";
+      eduroam = eduroamProfile;
+      eduroam_5GHz = eduroamProfile;
+    };
+  };
+
+  users.users.me.extraGroups = [ "networkmanager" ];
+
+  systemd.services.autowifi = {
+    enable = false;
+    description = "Automatic wifi connector";
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.networkmanager ];
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      RestartSec = "10s";
+      ExecStart = "${autowifi}/bin/autowifi";
+    };
+  };
+
+  environment.systemPackages = [ pkgs.speedtest-cli ];
+}

configs/newsboat.nix

@@ -2,8 +2,10 @@
 let
   ytdl-format = "'bestvideo[height<=?720][fps<=?30][vcodec!=?vp9]+bestaudio/best'";
 
+  youtube-download = "${pkgs.ts}/bin/ts ${pkgs.youtube-dl}/bin/youtube-dl -f ${ytdl-format} --add-metadata";
+
   newsboat-home =
-    "${config.users.users.me.home}/cloud/syncthing/common/newsboat";
+    "${config.users.users.me.home}/cloud/Seafile/Documents/newsboat";
   linkhandler-bin = "${pkgs.scripts.linkhandler}/bin/linkhandler";
 
   newsboat-config = pkgs.writeText "config" ''
@@ -22,7 +24,7 @@ let
     macro , open-in-browser
     macro c set browser "${pkgs.xsel}/bin/xsel -b <<<" ; open-in-browser ; set browser ${linkhandler-bin}
     macro v set browser "${pkgs.utillinux}/bin/setsid -f ${pkgs.mpv}/bin/mpv" ; open-in-browser ; set browser ${linkhandler-bin}
-    macro y set browser "${pkgs.ts}/bin/ts ${pkgs.youtube-dl}/bin/youtube-dl -f ${ytdl-format} --add-metadata" ; open-in-browser ; set browser ${linkhandler-bin}
+    macro y set browser "${youtube-download}" ; open-in-browser ; set browser ${linkhandler-bin}
 
     bind-key j down
     bind-key k up
@@ -69,5 +71,11 @@ in {
     '';
   };
 
-  environment.systemPackages = [ pkgs.newsboat ];
+  environment.systemPackages = [
+    pkgs.newsboat
+    (pkgs.writers.writeDashBin "mpv-watch-later" ''
+      ${pkgs.sqlite}/bin/sqlite3 ${newsboat-home}/cache.db "SELECT url FROM rss_item WHERE flags='e' AND deleted=0 ORDER BY pubDate DESC" \
+        | ${pkgs.findutils}/bin/xargs ${pkgs.mpv}/bin/mpv
+    '')
+  ];
 }

configs/nextcloud.nix

@@ -1,11 +1,12 @@
 { pkgs, lib, ... }:
 let
+  passwordFile = path: toString (pkgs.writeText "password" (lib.strings.fileContents path));
   inherit (import <niveum/lib>) localAddresses;
 in
 {
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud20;
+    package = pkgs.nextcloud22;
 
     https = true;
 
@@ -23,8 +24,8 @@ in
       dbuser = "nextcloud";
       dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
       dbname = "nextcloud";
-      dbpass = lib.strings.fileContents <system-secrets/nextcloud/database>;
+      dbpassFile = passwordFile <system-secrets/nextcloud/database>;
-      adminpass = lib.strings.fileContents <system-secrets/nextcloud/admin>;
+      adminpassFile = passwordFile <system-secrets/nextcloud/admin>;
       adminuser = "admin";
       # extraTrustedDomains = [ "toum.r" ];
     };
@@ -44,7 +45,7 @@ in
 
   services.nginx.virtualHosts."cloud.xn--kiern-0qa.de" = {
     enableACME = true;
-    addSSL = true;
+    forceSSL = true;
   };
 
   # Ensure that postgres is running before running the setup

configs/nix.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  # enable `nix flake`
+  nix = {
+    package = pkgs.nixFlakes;
+    extraOptions = "experimental-features = nix-command flakes";
+  };
+}

configs/openweathermap.nix

@@ -0,0 +1,19 @@
+{ pkgs, lib, ... }:
+let
+  openweathermap-repo = pkgs.fetchFromGitHub {
+    owner = "ip1981";
+    repo = "openweathermap";
+    rev = "9cfef7b14ac5af7109449b54b1cb352b4c76167a";
+    sha256 = "0sm43wicvw2fy7nq65s8vch6jjb5bszqr4ilnhibayamj4jcpw53";
+  };
+  openweathermap = pkgs.haskellPackages.callCabal2nix "openweathermap" openweathermap-repo {};
+  openweathermap-key = lib.strings.fileContents <secrets/openweathermap.key>;
+in {
+  nixpkgs.config.packageOverrides = pkgs: {
+    weather = pkgs.writers.writeDashBin "weather" ''
+      ${openweathermap}/bin/openweathermap --api-key ${openweathermap-key} "$@"
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.weather ];
+}

configs/packages/default.nix

@@ -1,6 +1,39 @@
-{ pkgs, lib, ... }: {
+{ pkgs, lib, ... }:
+let
+  hc = pkgs.callPackage <stockholm/tv/5pkgs/simple/hc.nix> {};
+  worldradio = pkgs.callPackage <niveum/packages/worldradio.nix> {};
+  menstruation = pkgs.callPackage <niveum/submodules/menstruation-backend> {};
+
+  nixpkgs-unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
+
+  astrolog = nixpkgs-unstable.astrolog.overrideAttrs (old: old // {
+    installPhase = ''
+      ${old.installPhase}
+      # set sensible defaults
+      sed -i '
+        /^-z /s/8:00W/1:00E/ # timezone
+        /^-zl /s/122W19:59 47N36:35/13E22:42 52N27:42/ # default location
+        /^-zj /s/"Current moment now"/Now/ # default name
+        /^-zj /s/"Seattle, WA, USA"/Berlin/ # default location
+        /^_k/s/_k/=k/ # use color
+        /^_Yd/s/_Yd/=Yd/ # sensible date format
+        /^_Yt/s/_Yt/=Yt/ # sensible time format
+        /^_Yv/s/_Yv/=Yv/ # sensible length format
+        /^:Xbw/s/:Xbw/:Xbn/ # set X11 bitmap format
+        /^:I /s/80/120/ # wider text output
+      ' $out/astrolog/astrolog.as
+    '';
+  });
+
+  recht = pkgs.callPackage (pkgs.fetchFromGitHub {
+    owner = "kmein";
+    repo = "recht";
+    rev = "0.6.2";
+    sha256 = "08gnrnz3lwh8h6fyga56yfy9qryzm89xbshm7wpxfyxf2pmp1qfx";
+  }) {};
+
+in {
   imports = [
-    ./krebs.nix
     ./writing.nix
     ./python.nix
     ./haskell
@@ -36,19 +69,17 @@
     tdesktop
     w3m
     wget
-    httpie
     whois
-    ddgr
     ix
-    nur.repos.kmein.python3Packages.instaloader
     dnsutils
     # mtr # my traceroute
     # FILE MANAGERS
     ranger
-    gnome3.nautilus
+    pcmanfm
     # MEDIA
     ffmpeg
     imagemagick
+    exiftool
     scrot
     # ARCHIVE TOOLS
     unzip
@@ -63,20 +94,21 @@
     psmisc # for killall, pstree
     # SHELL
     bat # better cat
-    du-dust # better du
     fd # better find
     file # determine file type
     dos2unix
-    trash-cli
     ncdu # ncurses disk usage
     python3Packages.jsonschema # json validation
     jq # json toolkit
-    jo # json creation
+    pup # html toolkit
+    nixpkgs-unstable.htmlq
     xsv # csv toolkit
     xmlstarlet # xml toolkit
     manpages
     posix_man_pages
     # moreutils # for parallel, sponge, combine
+    tree
+    fuse_exfat # to mount windows drives
     parallel # for parallel, since moreutils shadows task spooler
     ripgrep # better grep
     rlwrap
@@ -94,21 +126,37 @@
     audacity
     calibre
     inkscape
-    zoom-us # video conferencing
+    astrolog # astrolog
+    anki # flashcards
+    nixpkgs-unstable.zoom-us # video conferencing
     pdfgrep # search in pdf
     pdftk # pdf toolkit
-    evince # for viewing pdf annotations
+    poppler_utils # pdf toolkit
-    xournal # for annotating pdfs
+    foxitreader # for viewing pdf annotations
+    xournalpp # for annotating pdfs
+    pdfpc # presenter console for pdf slides
+    hc # print files as qr codes
     youtubeDL
     bc # calculator
+    pari # gp -- better calculator
+    scripts.auc
+    scripts.infschmv
+    scripts.qrpaste
+    scripts.new-mac # get a new mac address
+    scripts.scanned
     scripts.default-gateway
     scripts.showkeys-toggle
+    scripts.kirciuoklis
     scripts.favicon
     scripts.ipa # XSAMPA to IPA converter
+    scripts.playlist
+    scripts.mpv-tv
+    scripts.devanagari
     scripts.betacode # ancient greek betacode to unicode converter
-    nur.repos.kmein.mahlzeit
+    scripts.meteo
-    # nur.repos.kmein.slide
+    scripts.mahlzeit
-    nur.repos.kmein.vimv
+    recht
+    scripts.vimv
     scripts.swallow # window swallowing
     scripts.genius
     scripts.instaget
@@ -127,8 +175,18 @@
     scripts.vg
     scripts.fkill
     scripts.wttr
+    scripts.sanskrit-dictionary
+    scripts.unicodmenu
+    scripts.horoscope
+    scripts.closest
+    scripts.trans
+    scripts.liddel-scott-jones
+    scripts.mpv-radio
     # kmein.slide
     scripts.tolino-screensaver
+    scripts.rfc
+    scripts.tag
+    scripts.menu-calc
     nix-prefetch-git
     scripts.nix-git
     nixfmt
@@ -136,9 +194,34 @@
     qrencode
     wtf
 
-    spotify
+    menstruation
-    spotify-tui
+
+    (pkgs.writers.writeDashBin "worldradio" ''
+      shuf ${worldradio} | ${pkgs.findutils}/bin/xargs ${pkgs.mpv}/bin/mpv --no-video
+    '')
+
+    (pkgs.writers.writeDashBin "chats" ''
+      ${pkgs.openssh}/bin/ssh makanek "cd /var/lib/weechat/logs && grep --ignore-case --color=always --recursive $@" | ${pkgs.less}/bin/less --raw-control-chars
+    '')
+
+    (pkgs.writers.writeDashBin "ncmpcpp-zaatar" ''MPD_HOST=${(import <niveum/lib/local-network.nix>).zaatar} exec ${pkgs.ncmpcpp}/bin/ncmpcpp "$@"'')
+    (pkgs.writers.writeDashBin "mpc-zaatar" ''MPD_HOST=${(import <niveum/lib/local-network.nix>).zaatar} exec ${pkgs.mpc_cli}/bin/mpc "$@"'')
+
+    nixpkgs-unstable.spotify
+    ncspot
     playerctl
+
+    nix-index
+    scripts.nix-index-update
+
+    #krebs
+    dic
+    cyberlocker-tools
+    untilport
+    kpaste
+    irc-announce
+    git-preview
+    ircaids
   ];
 
 }

configs/packages/haskell/default.nix

@@ -10,8 +10,9 @@
     '';
     # :def unpl \x -> return $ ":!${pkgs.haskellPackages.pointful}/bin/pointful \"" ++ x ++ "\""
       # :def pl \x -> return $ ":!${pkgs.haskellPackages.pointfree}/bin/pointfree -v \"" ++ x ++ "\""
-    ".stack/config.yaml".text = let inherit (import <niveum/lib>) kieran;
+    ".stack/config.yaml".source =
-    in builtins.toJSON {
+    let inherit (import <niveum/lib>) kieran;
+    in (pkgs.formats.yaml {}).generate "config.yaml" {
       templates.params = {
         author-name = kieran.name;
         author-email = kieran.email;
@@ -32,8 +33,7 @@
       cabal2nix
       cabal-install
       hlint
-      haskellPackages.brittany
+      haskellPackages.ormolu
-      # haskellPackages.hfmt
       (haskellPackages.ghcWithHoogle (import ./packages.nix))
     ] ++ map haskell.lib.justStaticExecutables [
       haskellPackages.ghcid

configs/packages/haskell/packages.nix

@@ -36,6 +36,7 @@ with haskellPackages; [
   directory
   dlist
   either
+  edit-distance
   exceptions
   extra
   filepath
@@ -54,6 +55,7 @@ with haskellPackages; [
   megaparsec
   microlens
   monad-logger
+  monad-memo
   mono-traversable
   mtl
   network
@@ -87,7 +89,6 @@ with haskellPackages; [
   time
   transformers
   turtle
-  type-unary
   unix-time
   unordered-containers
   vector

configs/packages/krebs.nix

@@ -1,24 +0,0 @@
-{ lib, pkgs, ... }:
-let
-  krebs-packages = pkgs: {
-    dic = pkgs.callPackage <stockholm/krebs/5pkgs/simple/dic> { };
-    yt-next = pkgs.callPackage <stockholm/lass/5pkgs/yt-next> { };
-    acronym = pkgs.callPackage <stockholm/lass/5pkgs/acronym> { };
-    urban = pkgs.callPackage <stockholm/lass/5pkgs/urban> { };
-    mpv-poll = pkgs.callPackage <stockholm/lass/5pkgs/mpv-poll> { };
-    untilport = pkgs.callPackage <stockholm/krebs/5pkgs/simple/untilport> { };
-    kpaste = pkgs.callPackage <stockholm/krebs/5pkgs/simple/kpaste> { };
-    krebspaste = pkgs.callPackage <stockholm/krebs/5pkgs/simple/krebspaste> { };
-    bepasty-client-cli =
-      pkgs.callPackage <stockholm/krebs/5pkgs/simple/bepasty-client-cli> { };
-    irc-announce =
-      pkgs.callPackage <stockholm/krebs/5pkgs/simple/irc-announce> { };
-    git-preview =
-      pkgs.callPackage <stockholm/krebs/5pkgs/simple/git-preview> { };
-  };
-in {
-  nixpkgs.config.packageOverrides = krebs-packages;
-
-  environment.systemPackages =
-    map (name: pkgs.${name}) (lib.attrNames (krebs-packages pkgs));
-}

configs/packages/python.nix

@@ -2,18 +2,15 @@
   environment.systemPackages = [
     (pkgs.python3.withPackages (py: [
       py.black
-      py.python-language-server
+      # py.python-language-server
-      py.pyls-mypy
+      # py.pyls-mypy
-      py.pyls-black
+      # py.pyls-black
-      py.pyls-isort
+      # py.pyls-isort
       py.flake8
-      py.flask
       py.pygments
-      py.docopt
       py.schema
-      py.ansicolors
-      py.virtualenv
     ]))
+    pkgs.python3Packages.poetry
   ];
 
   home-manager.users.me.xdg.configFile."pycodestyle".text = ''

configs/packages/writing.nix

@@ -1,8 +1,6 @@
 { pkgs, lib, config, ... }:
 let
-  inherit (import <niveum/lib>) nixpkgs-unstable;
+  pandoc-doc = pkgs.callPackage <niveum/packages/man/pandoc.nix> {};
-
-  unstable = import nixpkgs-unstable {};
 
   zoteroStyle = { name, sha256 }: {
     name = "${name}.csl";
@@ -64,16 +62,20 @@ in {
 
   environment.systemPackages = with pkgs; [
     texlive.combined.scheme-full
+    latexrun
     (aspellWithDicts (dict: [ dict.de dict.en dict.en-computers ]))
-    haskellPackages.pandoc-citeproc
+    # haskellPackages.pandoc-citeproc
-    nur.repos.kmein.text2pdf
+    scripts.text2pdf
-    abiword
+    lowdown
-    gnumeric
+    glow # markdown to term
+    libreoffice
+    # gnumeric
     dia
-    unstable.pandoc
+    pandoc
+    pandoc-doc
     # proselint
     asciidoctor
     wordnet
-    sdcv # stardict cli
+    # sdcv # stardict cli
   ];
 }

configs/power-action.nix

@@ -0,0 +1,22 @@
+{ pkgs, config, ... }:
+let
+  suspend = pkgs.writers.writeDash "suspend" "${pkgs.systemd}/bin/systemctl suspend";
+in
+{
+  krebs.power-action = {
+    enable = true;
+    plans.suspend = {
+      upperLimit = 7;
+      lowerLimit = 0;
+      charging = false;
+      action = pkgs.writeDash "suspend-wrapper" ''
+        /run/wrappers/bin/sudo ${suspend}
+      '';
+    };
+    user = config.users.users.me.name;
+  };
+
+  security.sudo.extraConfig = ''
+    ${config.krebs.power-action.user} ALL= (root) NOPASSWD: ${suspend}
+  '';
+}

configs/printing.nix

@@ -13,8 +13,6 @@ in {
     extraBackends = [ hp-driver ];
   };
 
-  users.users.me.extraGroups = [ "scanner" ];
-
   hardware.printers.ensurePrinters = [{
     name = "OfficeJet";
     location = "Zimmer";

configs/radio/default.nix

@@ -0,0 +1,212 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (import <niveum/lib>) tmpfilesConfig serveHtml;
+
+  radioStore = "/var/lib/radio";
+  htgenPort = 8080;
+  stations = {
+    lyrikline = {
+      streamPort = 8001;
+      mpdPort = 6601;
+      description = ''
+        Weltklang. Welt als ewiges Gedicht, das seine Schallspuren durch Raum und Zeit jagt. Endlose Zufallswiedergabe von <a href="//lyrikline.org">lyrikline</a>. — Listen to the sound of voices and poems permeating linguistic and geographic barriers, 24 hours per day.
+      '';
+    };
+    lyrik = {
+      streamPort = 8002;
+      mpdPort = 6602;
+      description = ''
+        Deutsche Lyrik, die du noch nicht gut genug kennst. Tritt in einen Fluss aus Reim und Maß; keine zwei Mal ist er derselbe.
+      '';
+    };
+  };
+  mpd-add-with-tags = pkgs.writers.writeHaskell "mpd-add-with-tags" {
+    libraries = with pkgs.haskellPackages; [ optparse-generic libmpd ];
+  } ''
+    {-# LANGUAGE DeriveGeneric, OverloadedStrings #-}
+    import Control.Monad (void)
+    import Data.String
+    import Network.MPD
+    import Options.Generic
+
+    data Options = Options { url :: String, artist :: Maybe String, title :: Maybe String }
+      deriving (Generic)
+
+    instance ParseRecord Options
+
+    main :: IO ()
+    main = do
+      options <- getRecord "Add to MPD with tags"
+      void $ withMPD $ do
+        songId <- addId (fromString $ url options) Nothing
+        maybe (pure ()) (addTagId songId Artist . fromString) $ artist options
+        maybe (pure ()) (addTagId songId Title . fromString) $ title options
+  '';
+
+  mpcs = lib.mapAttrs (name: station: pkgs.writers.writeDashBin "mpc-${name}" ''
+    MPD_PORT=${toString station.mpdPort} ${pkgs.mpc_cli}/bin/mpc "$@"
+  '') stations;
+in
+{
+  imports = [ <stockholm/krebs/3modules/htgen.nix> ];
+  nixpkgs.overlays = [
+    (self: super: { htgen = super.callPackage <stockholm/krebs/5pkgs/simple/htgen> {}; })
+  ];
+
+  systemd.tmpfiles.rules = [
+    (tmpfilesConfig {
+      type = "d";
+      path = radioStore;
+      mode = "0755";
+      user = config.users.extraUsers.radio.name;
+      age = "1d";
+    })
+  ];
+
+  users.extraUsers.radio = {
+    isSystemUser = true;
+    group = "radio";
+  };
+  users.groups.radio = {};
+
+  krebs.htgen.radio = {
+    port = htgenPort;
+    user.name = "radio";
+    script = ''. ${pkgs.writers.writeDash "meinskript" ''
+      send200() {
+        printf 'HTTP/1.1 200 OK\r\n'
+        printf 'Content-Type: text/html; charset=UTF-8\r\n'
+        printf 'Connection: close\r\n'
+        printf '\r\n'
+      }
+
+      case "$Method $Request_URI" in
+        "GET /lyrik/status")
+          send200
+          video_id="$(
+            ${mpcs.lyrik}/bin/mpc-lyrik status -f %file% \
+              | head -n1 \
+              | grep -o 'id=[^&]*' \
+              | sed 's/^id=//g'
+          )"
+
+          ${pkgs.youtube-dl}/bin/youtube-dl -j "https://www.youtube.com/watch?v=$video_id" \
+            | ${pkgs.jq}/bin/jq -r '"% [\(.title)](\(.webpage_url))\n\n\(.description)"' \
+            | sed 's/$/  /g' \
+            | ${pkgs.pandoc}/bin/pandoc -s
+
+          exit
+        ;;
+        "GET /lyrikline/status")
+          send200
+
+          hash="$(
+            ${mpcs.lyrikline}/bin/mpc-lyrikline status -f '%file%' \
+              | head -n 1 \
+              | md5sum \
+              | cut -d' ' -f 1
+          )"
+          url="$(cat ${radioStore}/$hash)"
+
+          echo "<html><body style='margin:0'><iframe style='width:100%;height:100%;border:0' src="$url"></iframe></body></html>"
+          exit
+        ;;
+      esac
+    ''}'';
+  };
+
+  containers = lib.mapAttrs (name: station: {
+    autoStart = true;
+    config = {config, pkgs, ...}: {
+      services.mpd = {
+        enable = true;
+        network.port = station.mpdPort;
+        extraConfig = ''
+          log_level "default"
+
+          audio_output {
+            name "${name}"
+            type "httpd"
+            encoder "vorbis"
+            port "${toString station.streamPort}"
+            bitrate "128"
+            format "44100:16:2"
+            always_on "yes"
+            tags "yes"
+          }
+        '';
+      };
+    };
+  }) stations;
+
+  environment.systemPackages = lib.attrValues mpcs;
+
+  systemd.services.lyrikline = {
+    after = [ "container@lyrikline.service" ];
+    wantedBy = [ "container@lyrikline.service" ];
+    startAt = "*:00/5";
+    serviceConfig.User = config.users.extraUsers.radio.name;
+    preStart = "${mpcs.lyrikline}/bin/mpc-lyrikline crop || :";
+    script = ''
+      set -efu
+
+      lyrikline=https://www.lyrikline.org
+      for _ in $(seq 1 10); do
+        random_route="$(${pkgs.curl}/bin/curl -sSL "$lyrikline/index.php/tools/getrandompoem" --data-raw 'lang=de' --compressed | ${pkgs.jq}/bin/jq -r .link)"
+        poem_url="$lyrikline$random_route"
+
+        poem_file="$(
+          ${pkgs.curl}/bin/curl -sSL "$poem_url" \
+            | grep -o 'https://.*\.mp3' \
+            | head -n1
+        )"
+
+        hash="$(echo "$poem_file" | md5sum | cut -d' ' -f 1)"
+        echo "$poem_file ($hash) -> $poem_url"
+        echo "$poem_url" > "${radioStore}/$hash"
+
+        ${mpcs.lyrikline}/bin/mpc-lyrikline add "$poem_file"
+      done
+
+      ${mpcs.lyrikline}/bin/mpc-lyrikline play
+    '';
+  };
+
+  systemd.services.lyrik = {
+    after = [ "container@lyrik.service" ];
+    wantedBy = [ "container@lyrik.service" ];
+    preStart = "${mpcs.lyrik}/bin/mpc-lyrik crop || :";
+    restartIfChanged = true;
+    serviceConfig.User = config.users.extraUsers.radio.name;
+    script =
+      let
+        invidious = "https://invidious.silkky.cloud";
+        videoIds = import <niveum/lib/hot-rotation/lyrik.nix>;
+        streams = lib.concatMapStringsSep "\n" (id: "${invidious}/latest_version?id=${id}&itag=251") videoIds;
+        streamsFile = pkgs.writeText "hotrot" streams;
+      in ''
+        set -efu
+        ${mpcs.lyrik}/bin/mpc-lyrik add < ${toString streamsFile}
+
+        ${mpcs.lyrik}/bin/mpc-lyrik crossfade 5
+        ${mpcs.lyrik}/bin/mpc-lyrik random on
+        ${mpcs.lyrik}/bin/mpc-lyrik repeat on
+        ${mpcs.lyrik}/bin/mpc-lyrik play
+      '';
+  };
+
+
+  services.nginx.virtualHosts."radio.kmein.de" = {
+    enableACME = true;
+    forceSSL = true;
+    locations = lib.mkMerge (
+      [
+        { "/".extraConfig = serveHtml (import ./station-list.nix { inherit pkgs lib stations; }) pkgs; }
+      ] ++ (lib.mapAttrsToList (name: station: {
+        "= /${name}/status".proxyPass = "http://127.0.0.1:${toString htgenPort}";
+        "= /${name}/listen.ogg".proxyPass = "http://127.0.0.1:${toString station.streamPort}";
+        "= /${name}.ogg".return = "301 http://radio.xn--kiern-0qa.de/${name}/listen.ogg"; # legacy
+      }) stations)
+    );
+  };
+}

configs/radio/station-list.nix

@@ -0,0 +1,43 @@
+{ pkgs, lib, stations }:
+let
+  theStations = lib.mapAttrsToList (name: value: value // {name = name;}) stations;
+in
+pkgs.writeText "index.html" ''
+  <!doctype html>
+  <html>
+    <head>
+      <title>radio.kierán</title>
+      <link
+        rel="stylesheet"
+        href="//cdn.rawgit.com/necolas/normalize.css/master/normalize.css"
+      />
+      <link
+        rel="stylesheet"
+        href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.9.2/css/bulma.min.css"
+      />
+      <meta name="viewport" content="width=device-width, initial-scale=1" />
+      <meta charset="utf-8" />
+    </head>
+    <body>
+      <main class="section">
+        <div class="subtitle is-3">Welcome to</div>
+        <h1 class="title is-1">radio.kierán</h1>
+
+        <div class="columns is-multiline">
+          ${lib.concatMapStringsSep "\n" (station: ''
+            <div class="column">
+              <div class="box">
+                <strong class="is-uppercase">${station.name}</strong>
+                (<a href="/${station.name}/status">status</a>, <a href="/${station.name}/listen.ogg">link</a>)
+
+                <p class="has-text-grey">${station.description}</p>
+                <hr/>
+                <audio style="width:100%" controls src="/${station.name}/listen.ogg"/>
+              </div>
+            </div>'') theStations
+          }
+        </div>
+      </main>
+    </body>
+  </html>
+''

configs/retiolum-map.nix

@@ -0,0 +1,69 @@
+{ config, pkgs, lib, ... }:
+let
+  network = "retiolum";
+
+  stateDirectory = "retiolum-map";
+
+  geo-ip-database = "${lib.head config.services.geoipupdate.settings.EditionIDs}.mmdb";
+  geo-ip-database-path = "${config.services.geoipupdate.settings.DatabaseDirectory}/${geo-ip-database}";
+
+  tinc-graph-source = pkgs.fetchFromGitHub {
+    owner = "kmein";
+    repo = "tinc-graph";
+    rev = "1b9c69ffdbdab82d30a23e44f739feea63d94163";
+    sha256 = "0bk4x9l399f80lmz4asx7s5fcsgrfdb6xyymbq884621x4z3d2vp";
+  };
+  tinc-graph = pkgs.callPackage tinc-graph-source {};
+in
+{
+  systemd.services.retiolum-index = {
+    description = "Retiolum indexing service";
+    wants = [ "tinc.${network}.service" ];
+    script = ''
+      ${tinc-graph}/bin/tinc-graph --geoip-file ${geo-ip-database-path} --network ${network} \
+        | ${pkgs.coreutils}/bin/tee network.json \
+        | ${tinc-graph}/bin/tinc-statistics > statistics.json
+
+      cp ${tinc-graph}/static/map.html map.html
+      cp ${tinc-graph}/static/map.html index.html
+      cp ${tinc-graph}/static/graph.html graph.html
+    '';
+    startAt = "hourly";
+    path = [ pkgs.coreutils pkgs.jq pkgs.tinc_pre ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      StateDirectory = stateDirectory;
+      WorkingDirectory = "/var/lib/${stateDirectory}";
+    };
+  };
+
+  services.geoipupdate = {
+    enable = true;
+    settings = {
+      AccountID = 608777;
+      LicenseKey = toString <system-secrets/maxmind/license.key>;
+      EditionIDs = [ "GeoLite2-City" ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."graph.r".locations."/".root = "/var/lib/${stateDirectory}";
+  };
+
+  systemd.services.geoip-share = {
+    after = [ "geoipupdate.service" ];
+    script = let
+      cyberlocker-tools = pkgs.callPackage <stockholm/krebs/5pkgs/simple/cyberlocker-tools> {};
+    in "${cyberlocker-tools}/bin/cput ${geo-ip-database} < ${geo-ip-database-path}";
+    serviceConfig = {
+      Type = "oneshot";
+      DynamicUser = true;
+    };
+  };
+}

configs/retiolum.nix

@@ -1,10 +1,7 @@
 { config, pkgs, ... }: {
-  imports = [ <niveum/modules/retiolum.nix> ];
+  imports = [
+    ../modules/retiolum.nix
+  ];
 
   networking.hosts = { "42:0:ca48:f98f:63d7:31ce:922b:245d" = [ "go" ]; };
-
-  environment.etc."tinc/retiolum/rsa_key.priv" = {
-    text = builtins.readFile <system-secrets/retiolum.key>;
-    mode = "400";
-  };
 }

configs/rofi.nix

@@ -4,46 +4,6 @@ let
 in{
   home-manager.users.me.programs.rofi = {
     enable = true;
-    separator = "solid";
-    scrollbar = false;
-    borderWidth = 0;
-    lines = 5;
     font = "Monospace 10";
-    colors = rec {
-      window = rec {
-        background = colours.foreground;
-        border = background;
-        separator = colours.black.bright;
-      };
-      rows = {
-        normal = {
-          background = window.background;
-          backgroundAlt = window.background;
-          foreground = colours.background;
-          highlight = {
-            foreground = colours.cyan.dark;
-            inherit (window) background;
-          };
-        };
-        active = {
-          background = window.background;
-          backgroundAlt = window.background;
-          foreground = colours.yellow.dark;
-          highlight = {
-            foreground = colours.green.dark;
-            inherit (window) background;
-          };
-        };
-        urgent = {
-          background = window.background;
-          backgroundAlt = window.background;
-          foreground = colours.red.dark;
-          highlight = {
-            foreground = colours.magenta.dark;
-            inherit (window) background;
-          };
-        };
-      };
-    };
   };
 }

configs/seafile.nix

@@ -0,0 +1,20 @@
+{ pkgs, config, ... }:
+{
+  services.xserver.displayManager.sessionCommands = "${pkgs.seafile-client}/bin/seafile-applet &";
+
+  home-manager.users.me.xdg.configFile = {
+    "Seafile/Seafile Client.conf".source = (pkgs.formats.ini {}).generate "Seafile Client.conf" {
+      Behavior = {
+        hideDockIcon = false;
+        hideMainWindowWhenStarted = true;
+      };
+      Settings = {
+        computerName = config.networking.hostName;
+        lastShiburl = "https://box.hu-berlin.de";
+      };
+      UsedServerAddresses.main = "https://box.hu-berlin.de";
+    };
+  };
+
+  environment.systemPackages = [ pkgs.seafile-client ];
+}

configs/spotifyd.nix

@@ -1,12 +1,27 @@
-{ lib, ... }:
+{ config, pkgs, lib, ... }:
 {
+  imports = [ <niveum/modules/spotifyd.nix> ];
+  disabledModules = [ "services/audio/spotifyd.nix" ];
+
   services.spotifyd = {
     enable = true;
-    config = lib.generators.toINI { } {
+    settings = {
       global = {
         username = lib.strings.fileContents <secrets/spotify/username>;
         password = lib.strings.fileContents <secrets/spotify/password>;
+        backend = "pulseaudio";
+        bitrate = 320;
+        device_type = "s_t_b"; # set-top box
+        device_name = config.networking.hostName;
       };
     };
   };
+
+  # ref https://github.com/NixOS/nixpkgs/issues/71362#issuecomment-753461502
+  hardware.pulseaudio.extraConfig = ''
+    unload-module module-native-protocol-unix
+    load-module module-native-protocol-unix auth-anonymous=1
+  '';
+
+  systemd.services.spotifyd.serviceConfig.Restart = "always";
 }

configs/ssh.nix

@@ -35,11 +35,19 @@ in {
         user = "root";
         port = sshPort;
       };
-      wilde = {
+      kabsa = {
-        hostname = "wilde.r";
+        hostname = "kabsa.r";
         user = "kfm";
         port = sshPort;
       };
+      "nextcloud.fysi.dev" = {
+        hostname = "116.203.82.203";
+        user = "root";
+      };
+      "lingua.miaengiadina.ch" = {
+        hostname = "135.181.85.233";
+        user = "root";
+      };
     };
   };
 }

configs/tarot.nix

@@ -0,0 +1,61 @@
+{ config, pkgs, lib, ... }:
+let
+  tarotPort = 7407;
+  tarotFiles = pkgs.fetchzip {
+    url = "https://c.krebsco.de/tarot.zip";
+    sha256 = "0jl5vdwlj17pqp94yj02xgsb1gyvs9i08m83kac0jdnhfjl2f75a";
+    stripRoot = false;
+  };
+  tarotKey = builtins.fetchurl {
+    url = "http://c.krebsco.de/tarot.pdf";
+    sha256 = "1n2m53kjg2vj9dbr70b9jrsbqwdfrcb48l4wswn21549fi24g6dx";
+  };
+in
+{
+  krebs.htgen.tarot = {
+    port = tarotPort;
+    user.name = "radio";
+    script = ''. ${pkgs.writers.writeDash "tarot" ''
+      case "$Method $Request_URI" in
+        "GET /")
+          if item=$(${pkgs.findutils}/bin/find ${toString tarotFiles} -type f | ${pkgs.coreutils}/bin/shuf -n1); then
+            card=$(mktemp --tmpdir tarot.XXX)
+            trap 'rm $card' EXIT
+            reverse=$(${pkgs.coreutils}/bin/shuf -i0-1 -n1)
+            if [ "$reverse" -eq 1 ]; then
+              ${pkgs.imagemagick}/bin/convert -rotate 180 "$item" "$card"
+            else
+              ${pkgs.coreutils}/bin/cp "$item" "$card"
+            fi
+            printf 'HTTP/1.1 200 OK\r\n'
+            printf 'Content-Type: %s\r\n' "$(${pkgs.file}/bin/file -ib "$card")"
+            printf 'Server: %s\r\n' "$Server"
+            printf 'Connection: close\r\n'
+            printf 'Content-Length: %d\r\n' $(${pkgs.coreutils}/bin/wc -c < "$card")
+            printf '\r\n'
+            cat "$card"
+            exit
+          fi
+        ;;
+      esac
+    ''}'';
+  };
+
+  services.nginx.virtualHosts."tarot.kmein.de" = {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/".proxyPass = "http://127.0.0.1:${toString tarotPort}";
+      "/files/" = {
+        root = pkgs.linkFarm "tarot" [
+          { name = "files/key.pdf"; path = tarotKey; }
+          { name = "files/cards"; path = tarotFiles; }
+        ];
+        extraConfig = ''
+          autoindex on;
+          charset UTF-8;
+        '';
+      };
+    };
+  };
+}

configs/telegram-bots/astrology.nix

@@ -0,0 +1,53 @@
+{ pkgs, lib, ... }:
+let
+  nixpkgs-unstable = import <nixpkgs-unstable> {};
+  toSymbols = pkgs.writers.writeDash "to-symbols" ''
+    ${pkgs.gnused}/bin/sed '
+      s/\bTri\b/△/;
+      s/\bOpp\b/☍/;
+      s/\bSqu\b/□/;
+      s/\bSex\b/⚹/;
+      s/\bCon\b/☌/;
+      s/Sun/☉/g;
+      s/Moon/☽/g;
+      s/Mercury/☿/g;
+      s/Venus/♀/g;
+      s/Mars/♂/g;
+      s/Jupiter/♃/g;
+      s/Saturn/♄/g;
+      s/Uranus/♅/g;
+      s/Neptune/♆/g;
+      s/Pluto/♇/g;
+      s/North Node/☊/g;
+      s/\bLeo\b/♌/g;
+      s/\bCan\(cer\)\?\b/♋/g;
+      s/\bGem\(ini\)\?\b/♊/g;
+      s/\bVir\(go\)\?\b/♍/g;
+      s/\bLib\(ra\)\?\b/♎/g;
+      s/\bTau\(rus\)\?\b/♉/g;
+      s/\bAri\(es\)\?\b/♈/g;
+      s/\bSco\(rpio\)\?\b/♏/g;
+      s/\bPis\(ces\)\?\b/♓/g;
+      s/\bSag\(ittarius\)\?\b/♐/g;
+      s/\bAqu\(arius\)\?\b/♒/g;
+      s/\bCap\(ricorn\)\?\b/♑/g;
+      s/-->/⟶/g;
+      s/\s\+/ /g; # replace multiple spaces by one
+      s/^.*\([ 0-9]\{2\}:[0-9]\{2\}\) /\1 /; # remove date at beginning of line (but not everything up to v/c X:XX)
+      s/^\s*//
+    '
+  '';
+in {
+  niveum.telegramBots.transits = {
+    enable = true;
+    time = "4:00";
+    token = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
+    chatIds = [ "18980945" ];
+    command = toString (pkgs.writers.writeDash "common-transits" ''
+      {
+        ${nixpkgs-unstable.astrolog}/bin/astrolog -n -zN Berlin -Yt -Yd -d -R Uranus Neptune Pluto
+        ${nixpkgs-unstable.astrolog}/bin/astrolog -Yt -Yd -q 10 22 1999 6:32 -zN Kassel -td $(${pkgs.coreutils}/bin/date +'%m %d %Y') -R Uranus Neptune Pluto
+      } | ${toSymbols} | ${pkgs.coreutils}/bin/sort -n
+    '');
+  };
+}