feat(prometheus): scrape home assistant

This reverts commit b9d0258132.

.bin/256color

@@ -0,0 +1,38 @@
+#! /bin/sh
+set -euf
+
+pl() {
+  for i in $(seq $1 $(expr $2 - 1)); do
+    printf '\e[38;5;%sm%03i\e[m ' $i $i
+  done
+  printf '\e[38;5;%sm%03i\e[m\n' $2 $2
+}
+
+p() {
+  printf '\e[38;5;%sm%03i\e[m ' $1 $1
+}
+pn() {
+  printf '\e[38;5;%sm%03i\e[m\n' $1 $1
+}
+
+p6x6() {
+  for i in $(seq 0 5); do
+    for j in $(seq 0 5); do
+      p $(expr $1 + $i + $j \* 6)
+    done
+    echo
+  done
+}
+
+pl 0 7
+pl 8 15
+
+p6x6 16
+p6x6 52
+p6x6 88
+p6x6 124
+p6x6 160
+p6x6 196
+
+pl 232 243
+pl 244 255

.bin/anki-poem.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+file="${1?please supply a poetry file}"
+[ -f "$file" ] || {
+  echo "'$file' is no file"
+  exit 1
+}
+
+poem="$(mktemp)"
+clean () {
+  rm "$poem"
+}
+trap clean EXIT
+sed '/^$/d' "$file" > "$poem"
+
+htmlize() {
+  awk 'ORS="<br/>"' \
+    | head -c -5          # remove final <br/> characters
+}
+
+for line_number in $(seq 1 "$(wc -l "$poem" | cut -d' ' -f1)"); do
+  if [ "$line_number" -gt 3 ] && [ "$line_number" -gt 1 ]; then
+    sed -n "$((line_number - 3)),$((line_number - 1))p" "$poem"
+  else
+    sed -n "1,$((line_number - 1))p" "$poem"
+  fi | htmlize
+  printf '\t'
+  sed -n "${line_number},+1p" "$poem" | htmlize
+  printf '\n'
+done

.bin/avesta.sed

@@ -0,0 +1,54 @@
+#!/usr/bin/env -S sed -f
+s/ā̊/𐬃/g
+s/t̰/𐬝/g
+s/ṣ̌/𐬴/g
+s/š́/𐬳/g
+s/ą̄/𐬅/g
+s/ŋᵛ/𐬤/g
+s/ə̄/𐬇/g
+s/ŋ́/𐬣/g
+s/x́/𐬒/g
+s/xᵛ/𐬓/g
+s/a/𐬀/g
+s/ā/𐬁/g
+s/å/𐬂/g
+s/ą/𐬄/g
+s/ə/𐬆/g
+s/e/𐬈/g
+s/ē/𐬉/g
+s/o/𐬊/g
+s/ō/𐬋/g
+s/i/𐬌/g
+s/ī/𐬍/g
+s/u/𐬎/g
+s/ū/𐬏/g
+s/k/𐬐/g
+s/x/𐬑/g
+s/g/𐬔/g
+s/ġ/𐬕/g
+s/γ/𐬖/g
+s/c/𐬗/g
+s/j/𐬘/g
+s/t/𐬙/g
+s/θ/𐬚/g
+s/d/𐬛/g
+s/δ/𐬜/g
+s/p/𐬞/g
+s/f/𐬟/g
+s/b/𐬠/g
+s/β/𐬡/g
+s/ŋ/𐬢/g
+s/n/𐬥/g
+s/ń/𐬦/g
+s/ṇ/𐬧/g
+s/m/𐬨/g
+s/m̨/𐬩/g
+s/ẏ/𐬫/g
+s/y/𐬪/g
+s/v/𐬬/g
+s/r/𐬭/g
+s/s/𐬯/g
+s/z/𐬰/g
+s/š/𐬱/g
+s/ž/𐬲/g
+s/h/𐬵/g

.bin/bvg.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+interesting="U6 N6 140 M46 184 N84"
+
+curl -sSL 'https://www.bvg.de/disruption-reports/q' \
+  --data-raw '{"variables":{},"query":"{
+    allDisruptions {
+      disruptions {
+        meldungsId
+        linie
+        verkehrsmittel
+        __typename
+        ... on Traffic {
+          datum
+          gueltigVonDatum
+          gueltigVonZeit
+          gueltigBisDatum
+          gueltigBisZeit
+          richtungName
+          richtungHafasId
+          beginnAbschnittName
+          beginnAbschnittHafasId
+          endeAbschnittName
+          endeAbschnittHafasId
+          textIntUrsache
+          sev
+          textIntAuswirkung
+          umfahrung
+          textWAPSMSUrsache
+          textWAPSMSAuswirkung
+          prioritaet
+          __typename
+        }
+      }
+      __typename
+    }
+  }"}' \
+  | jq --arg interesting "$interesting" '
+    .data.allDisruptions.disruptions
+    | map(select(
+      (.linie as $linie
+      | $interesting
+      | split(" ")
+      | index($linie))
+      and (.["__typename"] == "Traffic")
+    ))
+  '

.bin/calendars.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+directory="$(mktemp -d)"
+trap clean EXIT
+clean() {
+  rm -rf "$directory"
+}
+
+year=$(date +%Y)
+output=/tmp/$year.pdf
+
+for month in $(seq 1 12); do
+  printf "\r%d" "$month" 1>&2
+  astrolog -zN Berlin -qm "$month" "$year" -X -K -XA -Xr -Xm -Xb -Xo "$(printf "%s/%02d.bmp" "$directory" "$month")" -Xw 1080 720 2>/dev/null
+done
+printf "\r"
+
+convert "$directory/*.bmp" "$output"
+echo "$output"

.bin/candyman

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -efu
+
+usage() {
+  echo >&2 "$0 add-{reddit,telegram,youtube,twitch,twitter} NAME"
+  exit 1
+}
+
+candyman() {
+  curl -fsSv http://news.r/api -H content-type:application/json -d "$(jq -n "
+    {
+      command: \"PRIVMSG\",
+      params: [\"#all\", \"candyman: $1 $2\"]
+    }
+  ")"
+}
+
+[ $# -ge 2 ] || usage
+
+case "$1" in
+  add-reddit|add-telegram|add-youtube|add-twitter|add-twitch)
+    candyman "$@"
+  ;;
+  *) usage;;
+esac

.bin/countdown

@@ -0,0 +1,13 @@
+#!/usr/bin/env -S awk -f
+function z() {
+  getline < "/proc/uptime"
+  close("/proc/uptime")
+  return $0
+}
+BEGIN {
+  x = z()
+  while (1) {
+    y = z()
+    printf "%02d:%05.2f\r", (y - x) / 60, (y - x) % 60
+  }
+}

.bin/csv2json

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+
+import csv
+import json
+import sys
+import argparse
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--delimiter", "-d", default=",", help="CSV field separator")
+
+args = parser.parse_args()
+
+if __name__ == "__main__":
+    json.dump(list(csv.DictReader(sys.stdin, delimiter=args.delimiter)), sys.stdout)

.bin/dummy-alert

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+name=$RANDOM
+url='http://localhost:9093/api/v1/alerts'
+
+echo "firing up alert $name"
+
+# change url o
+curl -XPOST $url -d "[{
+	\"status\": \"firing\",
+	\"labels\": {
+		\"alertname\": \"$name\",
+		\"service\": \"my-service\",
+		\"severity\":\"warning\",
+		\"instance\": \"$name.example.net\"
+	},
+	\"annotations\": {
+		\"summary\": \"High latency is high!\"
+	},
+	\"generatorURL\": \"http://prometheus.int.example.net/<generating_expression>\"
+}]"
+
+echo ""
+
+echo "press enter to resolve alert"
+read
+
+echo "sending resolve"
+curl -XPOST $url -d "[{
+	\"status\": \"resolved\",
+	\"labels\": {
+		\"alertname\": \"$name\",
+		\"service\": \"my-service\",
+		\"severity\":\"warning\",
+		\"instance\": \"$name.example.net\"
+	},
+	\"annotations\": {
+		\"summary\": \"High latency is high!\"
+	},
+	\"generatorURL\": \"http://prometheus.int.example.net/<generating_expression>\"
+}]"
+
+echo ""

.bin/elm-publish-private

@@ -0,0 +1,7 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -p "(import <nixpkgs> { overlays = [ (import ~/work/fysiweb/engiadina-pwa/devops/pkgs) ]; }).elm-publish-private"
+#! nix-shell -i bash
+
+set -efux
+
+exec elm-publish-private "$@"

.bin/json2csv

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+import csv
+import json
+import sys
+
+if __name__ == "__main__":
+    json_list = json.load(sys.stdin)
+    if not isinstance(json_list, list):
+        print("JSON object is not a list.", file=sys.stderr)
+        sys.exit(1)
+    if len(json_list) == 0:
+        print("JSON list is empty.", file=sys.stderr)
+        sys.exit(1)
+    keys = set()
+    for element in json_list:
+        if isinstance(element, dict):
+            keys |= element.keys()
+        else:
+            print("Non-dict element:", element, file=sys.stderr)
+            sys.exit(1)
+    writer = csv.DictWriter(sys.stdout, fieldnames=list(keys))
+    writer.writeheader()
+    for element in json_list:
+        writer.writerow(element)

.bin/json2csv.jq

@@ -0,0 +1,5 @@
+#!/usr/bin/env -S jq -r -f
+(map(keys) | add | unique) as $cols
+| map(. as $row | $cols | map($row[.])) as $rows
+| $cols, $rows[]
+| @csv

.bin/libib.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+session_id=7b638c194d9bda74f80043045018cc9e
+
+declare -A libraries
+
+libraries["Literatur"]=344428
+libraries["Sprache"]=344160
+libraries["Miscellanea"]=344427
+libraries["Wissenschaft"]=344429
+libraries["Relicta"]=565920
+
+for library in ${!libraries[@]}
+do
+  curl -sSL 'https://www.libib.com/library/functions/csv-export.php' -H "Cookie: PHPSESSID=$session_id" -d export="${libraries[$library]}" > "$library.csv"
+done

.bin/lieferando.sh

@@ -0,0 +1,81 @@
+#!/bin/sh
+set -efu
+
+if echo "$1" | grep -Eq '[[:digit:]]{5}'; then
+  PLZ="$1"
+else
+  echo >&2 "Usage: $0 PLZ"
+  exit 1
+fi
+
+lieferando_dir=/tmp/lieferando
+mkdir -p "$lieferando_dir/$PLZ"
+
+fetch_restaurants() {
+  cache_path="$lieferando_dir/$PLZ.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "http://www.lieferando.de/$PLZ" \
+      | gunzip \
+      | sed -n '/var restaurants/,/];$/p' \
+      | sed 's/var restaurants =//;$s/;$//' \
+      | prettier --parser=json \
+      | jq '
+        map({
+          name: .[30] | .name,
+          category: .[30] |.categories | split(", "),
+          url: "http://lieferando.de\(.[30] | .url)",
+          minutes: .[19],
+          minimum: .[10],
+          delivery: .[14]
+        })' \
+      | tee "$cache_path"
+  fi
+}
+
+fetch_menu() {
+  [ $# -eq 1 ] || exit 1
+
+  slug="$(echo "$1" | sed 's!.*/!!')"
+  cache_path="$lieferando_dir/$PLZ/$slug.json"
+
+  if [ -r "$cache_path" ]; then
+    cat "$cache_path"
+  else
+    w3m -dump_source "$1" \
+      | gunzip \
+      | sed -n '/var MenucardProducts/,/\];/p' \
+      | sed 's/var MenucardProducts =//;s/;$//' \
+      | jq -r '
+        unique_by(.productId)
+        | group_by(.categoryId)
+        | flatten
+      ' \
+      | tee "$cache_path"
+  fi
+}
+
+data="$(fetch_restaurants)"
+
+# echo "$data" | jq -c '.[]' | while read -r restaurant; do
+#   fetch_menu "$(echo "$restaurant" | jq -r .url)"
+# done
+
+selected_categories="$(echo "$data" | jq -r 'map(.category) | flatten | unique | .[]' | fzf -m)"
+
+selected_restaurant_url="$(echo "$selected_categories" | jq --argjson restaurants "$data" -sRr '
+  split("\n")[:-1] as $categories
+  | $restaurants[]
+  | select(.category - $categories != .category)
+  | "\(.name) [🚴\(.minutes)min 💰\(.minimum)€ + \(.delivery)€] (\(.url))"
+  ' \
+  | fzf \
+  | sed 's/.*(//;s/)$//'
+)"
+
+fetch_menu "$selected_restaurant_url" \
+  | jq -r '.[] | "\(.price)\t\(.name)"' \
+  | fzf -m \
+  | awk '{print $0; sum += $1} END {print "-----"; print sum}'

.bin/lit.awk

@@ -0,0 +1,17 @@
+BEGIN {
+  if (!comment) comment = "--";
+  if (!begin) begin = "\\begin{code}";
+  if (!end) end = "\\end{code}";
+}
+{
+  if ($0 == begin) {
+    code = 1;
+    print comment, $0;
+  } else if ($0 == end) {
+    code = 0;
+    print comment, $0;
+  } else {
+    if (code) print $0;
+    else print comment, $0;
+  }
+}

.bin/mail-current-query

@@ -1,3 +0,0 @@
-#! /bin/sh
-set -efu
-exec curl -fSs --unix-socket /tmp/much.api.sock http://localhost/current/query

.bin/mail-reply

@@ -1,47 +0,0 @@
-#! /bin/sh
-set -efu
-
-reply_to=$(mail-current-query)
-
-if ! test "$(notmuch search --output=messages "$reply_to" | wc -l)" = 1; then
-  echo "current query doesn't point to exactly one message. abort." >&2
-  exit 1
-fi
-
-# TODO update headers
-
-notmuch reply "$reply_to" |
-sed '
-  /^Non-text part: /d
-  /^Attachment: /d
-' |
-jq -Rrs '
-  # TODO dedup with mail-send
-  split("\n") |
-  index("") as $i |
-  .[:$i] as $head |
-  .[$i:] as $body |
-
-  {
-    "MIME-Version": "1.0",
-    "Content-Type": "text/plain; charset=UTF-8; format=flowed",
-    "Content-Transfer-Encoding": "8bit"
-  } as $extra_head |
-
-  ($extra_head | keys | join("|")) as $extra_head_regex |
-  ($extra_head | to_entries | map("\(.key): \(.value)")) as $extra_head_lines |
-
-  # TODO each of these could be followed by multiple lines starting with spaces
-  ($head | map(select(test("^(\($extra_head_regex)):";"i") | not))) as $head |
-
-  ($head + $extra_head_lines) as $head |
-
-  ($head + $body) | join("\n")
-'
-
-
-# TODO fix From:
-# TODO tune quote
-
-# TODO write draft
-# TODO send mail

.bin/mud.sh

@@ -0,0 +1 @@
+ssh mud@hotdog.r -t "MUD_NICKNAME=$LOGNAME mud"

.bin/mushakkil.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+curl -sSL 'https://diac.alsharekh.org/Diac/DiacText' \
+  -H "Content-Type: application/json" \
+  --data-raw "$(jq --raw-input '{word: ., type: 1}')" \
+  --compressed \
+  | jq -r .diacWord

.bin/pdf-ocr.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p poppler_utils tesseract4
+set -eu
+
+pdf_path="$(realpath "$1")"
+
+[ -f "$pdf_path" ] || {
+  echo "Usage: $0 FILE.pdf" >&2
+  exit 1
+}
+
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf $tmpdir' EXIT
+
+cd "$tmpdir"
+
+pdftoppm -png "$pdf_path" pdf-ocr
+for png in pdf-ocr*.png; do
+  tesseract "$png" "$png.txt" 2>/dev/null
+done
+
+cat pdf-ocr-*.txt

.bin/prospekte.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+lidl() {
+  echo LIDL
+  curl -sSL 'https://endpoints.lidl-flyer.com/v3/region-overview/lidl/de-DE/0.json' \
+    | jq -r '
+      .categories
+      | map(select(.name == "Filial-Angebote") | .subcategories | map(.flyers))
+      | flatten
+      | flatten
+      | .[]
+      | .pdfUrl
+    '
+}
+
+aldi_nord() {
+  echo ALDI nord
+  echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-aktuell/GetPDF.ashx'
+  echo 'https://magazine.aldi-nord.de/aldi-nord/aldi-vorschau/GetPDF.ashx'
+}
+
+rewe_berlin() {(
+  store_id=662366923
+  publisher_id=1062
+
+  echo REWE
+  curl -sSL 'https://www.bonialserviceswidget.de/de/stores/'$store_id'/brochures?storeId='$store_id'&publisherId='$publisher_id | while read -r brochure_id; do
+    curl -sSL 'https://www.bonialserviceswidget.de/de/v5/brochureDetails/'"$brochure_id"'?publisherId='$publisher_id  | jq -r .pdfUrl
+  done
+)}
+
+kaufland() {(
+  region_code=8920
+  echo KAUFLAND
+  curl -sSL https://filiale.kaufland.de/prospekte.html | htmlq --attribute href '.flyer a' | grep -Eo 'DE_de_KDZ[^/]*' | sed "s/_3000_/_${region_code}_/" | while read -r flyer_id; do
+    curl -sSL "https://endpoints.leaflets.kaufland.com/v3/$flyer_id/flyer.json?regionCode=$region_code" | jq -r .flyer.pdfUrl
+  done
+)}
+
+netto_schwarz() {
+  echo 'NETTO (schwarz)'
+  curl -sSL 'https://squid-api.tjek.com/v2/catalogs?dealer_ids=90f2VL&order_by=created' \
+    | jq -r '.[] | .id' \
+    | while read -r flyer_id; do
+      curl -sSL "https://squid-api.tjek.com/v2/catalogs/$flyer_id/download" \
+        | jq -r .pdf_url
+    done
+}
+
+dir="$(mktemp -d)"
+trap clean EXIT
+
+clean() {
+  rm -rf "$dir"
+}
+
+prospekt_url="$( (
+  lidl
+  aldi_nord
+  rewe_berlin
+  kaufland
+  netto_schwarz
+) | fzf)"
+
+curl -sSL "$prospekt_url" -o "$dir/prospekt.pdf"
+zathura "$dir/prospekt.pdf"

.bin/proxies.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+curl -sSL https://www.netzwelt.de/proxy/index.html \
+  | pup ".tblc" \
+  | xml-to-json /dev/stdin \
+  | jq '
+    .div.table.tbody.tr
+    | map(
+      .td
+      | {
+        ip: .[0].a.value,
+        port: .[1],
+        country: .[2] | (if type == "string" then . else .a.value end),
+        security: .[3],
+        protocol: .[4]
+      }
+    )
+  '

.bin/rfc.sh

@@ -1 +0,0 @@
-curl -sSL "https://tools.ietf.org/rfc/rfc$*.txt" | less

.bin/sample-pdf.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+filepath="$(shuf --head-count=1)"
+pages="$(pdfinfo "$filepath" | awk '/^Pages:/{print $2}')"
+random_page="$(shuf --input-range="1-$pages" --head-count=1)"
+zathura --page="$random_page" "$filepath"

.bin/screencap.sh

@@ -0,0 +1,16 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i sh -p coreutils byzanz xorg.xwininfo gnused
+
+# shellcheck shell=sh
+# ref https://gist.github.com/aforemny/0994cb7f06ea30d56c8b9681ff5d2054
+
+set -eux
+
+eval "$(xwininfo | \
+  sed -n -e 's/^ \+Absolute upper-left X: \+\([0-9]\+\).*/x=\1/p' \
+         -e 's/^ \+Absolute upper-left Y: \+\([0-9]\+\).*/y=\1/p' \
+         -e 's/^ \+Width: \+\([0-9]\+\).*/w=\1/p' \
+         -e 's/^ \+Height: \+\([0-9]\+\).*/h=\1/p')"
+
+trap "pkill -f 'sleep 360d'" INT
+byzanz-record -e "sleep 360d" -c -x $x -y $y -w $w -h $h "$@"

.bin/space.py

@@ -0,0 +1,49 @@
+import ephem
+from datetime import datetime, date, timedelta
+
+now = datetime.now()
+limit = now + timedelta(days=365)
+
+
+def events_until(limit):
+    initial_date = ephem.Date(datetime.now())
+    events = {}
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_full_moon(now)
+        events[now] = "🌕"
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_new_moon(now)
+        events[now] = "🌑"
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_vernal_equinox(now)
+        events[now] = "spring equinox"
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_autumnal_equinox(now)
+        events[now] = "fall equinox"
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_winter_solstice(now)
+        events[now] = "winter solstice"
+
+    now = initial_date
+    while ephem.localtime(now) <= limit:
+        now = ephem.next_summer_solstice(now)
+        events[now] = "summer solstice"
+    return events
+
+
+events = events_until(limit)
+
+
+for date, event in sorted(events.items(), key=lambda x: x[0]):
+    if ephem.localtime(date) < limit:
+        print(ephem.localtime(date), event)

.bin/toposort.nix

@@ -0,0 +1,50 @@
+let
+  lib = import <nixpkgs/lib>;
+in rec {
+  inherit lib;
+
+  input = [
+    {
+      x = ["pool" "zfs"];
+      y = ["mdadm" "raid1"];
+    }
+    {
+      x = ["pool" "zfs"];
+      y = ["disk" "sda"];
+    }
+    {
+      x = ["mdadm" "raid1"];
+      y = ["disk" "sdb"];
+    }
+    {
+      x = ["mdadm" "raid1"];
+      y = ["disk" "sdc"];
+    }
+  ];
+
+  outNodes = node: graph:
+    lib.unique
+    (builtins.map (e: e.y)
+      (builtins.filter (v: v.x == node) graph));
+
+  vertices = graph:
+    lib.unique
+    (builtins.map (x: x.y) graph ++ builtins.map (x: x.x) graph);
+
+  deleteVertex = node: graph: (builtins.filter (v: v.x != node && v.y != node) graph);
+
+  findSink = graph:
+    lib.findFirst
+    (v: outNodes v graph == [])
+    (lib.trace graph (builtins.abort "No sink found"))
+    (vertices graph);
+
+  topSort = graph:
+    if graph == []
+    then []
+    else if builtins.length graph == 1
+    then let only = builtins.head graph; in [only.y only.x]
+    else let sink = findSink graph; in [sink] ++ topSort (deleteVertex sink graph);
+
+  output = topSort input;
+}

.bin/ttrss-unread

@@ -0,0 +1,18 @@
+#/usr/bin/env -S deno run -A:q
+set -x
+session_cache="$HOME/.cache/tt-rss.session"
+ttrss_endpoint=https://feed.kmein.de/api/
+ttrss_user=k
+ttrss_password=$(pass shared/tt-rss/password)
+
+login() {
+  if [ -f "$session_cache" ]; then
+    session_id="$(cat "$session_cache")"
+  else
+    session_id="$(curl -d '{"op":"login","user":"'"$ttrss_user"'","password":"'"$ttrss_password"'"}' "$ttrss_endpoint" | jq -r .content.session_id)"
+    echo "$session_id" > "$session_cache"
+  fi
+}
+
+login
+curl -d '{"sid":"'"$session_id"'","op":"getUnread"}' "$ttrss_endpoint" | jq .content

.bin/tuesday-1800

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -efux
+expected_max_results=1024 # the upper bound on the number of restaurants
+radius=250
+
+echo '[out:json];node(id:260050809)->.cbase;
+(
+  node(around.cbase:'$radius')[amenity=fast_food];
+  node(around.cbase:'$radius')[amenity=restaurant];
+);out;' \
+  | curl -sSL -d @- -X POST http://overpass-api.de/api/interpreter \
+  | jq --argjson random "$(shuf -i 0-$expected_max_results -n 1)" '
+    .elements
+    | length as $length
+    | .[$random % $length]
+  '

.bin/unicode

@@ -0,0 +1,8 @@
+import sys
+import unicodedata
+
+for index, character in enumerate(sys.stdin.read().strip()):
+  try:
+    print(index, character, hex(ord(character)), unicodedata.category(character), unicodedata.name(character))
+  except:
+    print(index, character, hex(ord(character)))

.bin/watson2fdf.sh

@@ -0,0 +1,26 @@
+project=Filli
+year=2022
+
+for month in Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec; do
+  from="$(date +%F -d "$month 1, $year")"
+  to="$(date +%F -d "$month 1, $year + 1 month")"
+  watson report --json --from "$from" --to "$to" --project "$project"
+done | jq --slurp '
+  def in_array($arr):
+      . as $value | any($arr[]; . == $value);
+
+  map(
+    ["engadin-app","fysiweb","val-muestair","mia-engiadina","ol"] as $official_projects
+    | (.timespan.from | .[0:7]) as $timespan
+    | .projects | .[0]
+    | .time as $total_time
+    | .tags
+    | select(. != null)
+    | map(select(.name | in_array($official_projects)))
+    | (map(.time)|add) as $official_time
+    | map({key:.name, value:.time}) | from_entries
+    | .other |= ($total_time - $official_time)
+    | map_values(. / (60*60) | ceil)
+    | .month |= $timespan
+  )
+'

.github/workflows/flake.yml

@@ -0,0 +1,19 @@
+name: Update flake.lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Nix
+        uses: cachix/install-nix-action@v16
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@v3

.github/workflows/niveum.yml

@@ -0,0 +1,37 @@
+name: CI
+on:
+  push:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        system: [makanek,manakish,kabsa,zaatar,ful]
+    steps:
+    - uses: actions/checkout@v3
+    - name: Install QEMU (ARM)
+      run: sudo apt-get install -y qemu-user-static
+      if: ${{ matrix.system == 'ful' }}
+    - name: Install Nix (ARM)
+      uses: cachix/install-nix-action@v16
+      if: ${{ matrix.system == 'ful' }}
+      with:
+        extra_nix_config: |
+          system = aarch64-linux
+    - name: Install Nix (x86_64)
+      uses: cachix/install-nix-action@v16
+      if: ${{ matrix.system != 'ful' }}
+    - name: nixos-rebuild dry-build
+      run: |
+        # remove secrets: ref https://stackoverflow.com/questions/1260748/how-do-i-remove-a-submodule/36593218
+        git submodule deinit -f secrets
+        rm -rf .git/modules/secrets
+        git rm -f secrets
+
+        # recreate secrets
+        mkdir secrets
+        cat secrets.txt | while read -r path; do touch $path; done
+        git add secrets
+
+        nix run nixpkgs#nixos-rebuild -- dry-build  --flake $GITHUB_WORKSPACE#${{matrix.system}}

.gitignore

@@ -3,3 +3,4 @@ result
 .envrc
 .history
 .todo
+node_modules

.gitmodules

@@ -1,3 +1,3 @@
-[submodule "submodules/much"]
-	path = submodules/much
-	url = git@github.com:kmein/much
+[submodule "secrets"]
+	path = secrets
+	url = ssh://gitea@code.kmein.de:22022/kfm/niveum-secrets.git

.versions/home-manager.json

@@ -1,10 +0,0 @@
-{
-  "url": "https://github.com/nix-community/home-manager.git",
-  "rev": "209566c752c4428c7692c134731971193f06b37c",
-  "date": "2021-02-09T15:29:47-05:00",
-  "path": "/nix/store/fslcg7lcxr87ca3ccqd1jcahjlq3ak44-home-manager",
-  "sha256": "1canlfkm09ssbgm3hq0kb9d86bdh84jhidxv75g98zq5wgadk7jm",
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}

.versions/krops.json

@@ -1,10 +0,0 @@
-{
-  "url": "https://cgit.krebsco.de/krops",
-  "rev": "55aa2c77ce8183f3d2b24f54efa33ab6a42e1e02",
-  "date": "2020-04-19T01:06:20+02:00",
-  "path": "/nix/store/08wg2yrcgkr6iwipjd6g0fbwb7gacqax-krops",
-  "sha256": "00rvx9h596ync8wgic6xc9srzajzm28wlp9q7mv4z0jsb27l5bj8",
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}

.versions/nixpkgs-unstable.json

@@ -1,7 +0,0 @@
-{
-  "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "0ead6f8cfd461c3a366c8bc9893037afd89f798d",
-  "date": "2020-10-27T18:30:26+01:00",
-  "sha256": "170kziw7bxfm4mwi8q5c2vdpayml0mini4zyxagbvbivivdj5hla",
-  "fetchSubmodules": false
-}

.versions/nixpkgs.json

@@ -1,10 +0,0 @@
-{
-  "url": "https://github.com/NixOS/nixpkgs.git",
-  "rev": "42809feaa9f7474f5566a5c6e8e317e15e39160e",
-  "date": "2021-02-25T10:32:17-05:00",
-  "path": "/nix/store/yq68pnqwjhazj6rzzl82n7sgn8z3a53r-nixpkgs",
-  "sha256": "12cnyxx316pwhw069brqsx8v23b10akqlf0vhkilaimsksv7cwgm",
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}

.versions/retiolum.json

@@ -1,10 +0,0 @@
-{
-  "url": "https://github.com/krebs/retiolum",
-  "rev": "8d2ad60bd792c371bfa4df8f084c8bc68a340bd7",
-  "date": "2021-02-22T20:32:15+01:00",
-  "path": "/nix/store/niidhc1lqnazg6zczxs5cd8kkyqa29vd-retiolum",
-  "sha256": "0yh43la8s0dspvh632h5smjm006cy4p75xibx9kmj2di5ly3qqv9",
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}

.versions/stockholm.json

@@ -1,10 +0,0 @@
-{
-  "url": "https://github.com/kmein/stockholm",
-  "rev": "f0325bef7954cb946674050847c6d52112cb658f",
-  "date": "2020-11-11T07:45:58+01:00",
-  "path": "/nix/store/lka6fhjfbwdx9bc7lk1bz4gizdv7nrbm-stockholm",
-  "sha256": "0gbw6n5yq36ysc30afa5d2dbsl2d46f73ms6f0rprdbr4nhdw8l2",
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}

README.md

@@ -0,0 +1,10 @@
+# niveum
+
+> [nĭvĕus](https://logeion.uchicago.edu/niveus), a, um, adj. [nix], _of_ or _from snow, snowy, snow-_ (poet.)
+>
+> 1. Lit.: aggeribus niveis informis, Verg. G. 3, 354: aqua, _cooled with snow_, Mart. 12, 17, 6; cf. id. 14, 104 and 117: mons, _covered with snow_, Cat. 64, 240.—
+>
+> 2. Transf., _snow-white, snowy_ (mostly poet.): a similitudine sic: Corpore niveum candorem, aspectu igneum ardorem assequebatur, Auct. Her. 4, 33, 44: lacerti, Verg. A. 8, 387: lac, id. E. 2, 20: hanc si capite niveae agnae exorari judicas, Sen. Q. N. 2, 36: Briseis niveo colore, Hor. C. 2, 4, 3: vestis, Ov. M. 10, 432: candidior nivei folio, Galatea, ligustri, id. ib. 13, 789: dens, id. H. 18, 18: quā notam duxit niveus videri, Hor. C. 4, 2, 59: panis, Juv. 5, 70: flumen, _clear, pellucid_, Sen. Hippol. 504: undae, Mart. 7, 32, 11: tribuni, _clothed in white togas_, Calp. Ecl. 7, 29; so, Quirites, Juv. 10, 45.
+
+## Pressestimmen
+> das ist ja pure poesie —[xkey](https://github.com/riotbib)

configs/aerc.nix

@@ -0,0 +1,270 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ../lib/email.nix) defaults;
+in {
+  age.secrets = {
+    email-password-cock = {
+      file = ../secrets/email-password-cock.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    email-password-posteo = {
+      file = ../secrets/email-password-posteo.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  home-manager.users.me = {
+    services.mbsync = {
+      enable = true;
+      frequency = "daily";
+      preExec = "${pkgs.coreutils}/bin/mkdir -p ${config.home-manager.users.me.accounts.email.maildirBasePath}";
+      postExec = "${pkgs.notmuch}/bin/notmuch new";
+    };
+
+    programs.notmuch = {
+      enable = true;
+      extraConfig = {
+        database.path = config.home-manager.users.me.accounts.email.maildirBasePath;
+        new.tags = "";
+        user.name = defaults.realName;
+        user.primary_email = config.home-manager.users.me.accounts.email.accounts.posteo.address;
+      };
+    };
+
+    programs.mbsync = {
+      enable = true;
+      extraConfig = lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: ''
+          IMAPAccount ${name}
+          CertificateFile /etc/ssl/certs/ca-certificates.crt
+          Host ${account.imap.host}
+          PassCmd "${toString account.passwordCommand}"
+          User ${account.userName}
+          SSLType IMAPS
+          ${lib.optionalString (lib.isInt account.imap.port) "Port ${toString account.imap.port}"}
+
+          IMAPStore ${name}-remote
+          Account ${name}
+
+          MaildirStore ${name}-local
+          Path ${config.home-manager.users.me.accounts.email.maildirBasePath}/${name}/
+          SubFolders Verbatim
+
+          Channel ${name}
+          Create Near
+          Expunge None
+          Far :${name}-remote:
+          Near :${name}-local:
+          Patterns *
+          Remove None
+          SyncState *
+        '')
+        config.home-manager.users.me.accounts.email.accounts);
+    };
+
+    accounts.email.accounts = {
+      cock =
+        lib.recursiveUpdate defaults
+        rec {
+          address = "2210@cock.li";
+          userName = address;
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-cock.path}";
+          realName = "";
+          imap.host = "mail.cock.li";
+          smtp.host = imap.host;
+        };
+      posteo =
+        lib.recursiveUpdate defaults
+        rec {
+          address = "kieran.meinhardt@posteo.net";
+          aliases = ["kmein@posteo.de"];
+          userName = address;
+          imap.host = "posteo.de";
+          smtp.host = imap.host;
+          primary = true;
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-posteo.path}";
+          # himalaya = { enable = true; backend = "imap"; sender = "smtp"; };
+        };
+    };
+
+    # programs.himalaya.enable = true;
+
+    programs.aerc = {
+      enable = true;
+
+      extraBinds = {
+        # Binds are of the form <key sequence> = <command to run>
+        # To use '=' in a key sequence, substitute it with "Eq": "<Ctrl+Eq>"
+        # If you wish to bind #, you can wrap the key sequence in quotes: "#" = quit
+        global = {
+          "<C-p>" = ":prev-tab<Enter>";
+          "<C-n>" = ":next-tab <Enter>";
+          "<C-t>" = ":term<Enter>";
+          "?" = ":help keys<Enter>";
+        };
+        messages = {
+          q = ":quit<Enter>";
+          j = ":next <Enter>";
+          "<Down>" = ":next<Enter>";
+          "<C-d>" = ":next 50%<Enter>";
+          "<C-f>" = ":next 100%<Enter>";
+          "<PgDn>" = ":next 100%<Enter>";
+          k = ":prev <Enter>";
+          "<Up>" = ":prev<Enter>";
+          "<C-u>" = ":prev 50%<Enter>";
+          "<C-b>" = ":prev 100%<Enter>";
+          "<PgUp>" = ":prev 100%<Enter>";
+          g = ":select 0 <Enter>";
+          G = ":select -1<Enter>";
+          J = ":next-folder <Enter>";
+          K = ":prev-folder<Enter>";
+          H = ":collapse-folder<Enter>";
+          L = ":expand-folder<Enter>";
+          "<space>" = ":read -t<Enter>:next<Enter>";
+          v = ":mark -t<Enter>";
+          V = ":mark -v<Enter>";
+          F = ":flag -t<Enter>";
+          T = ":toggle-threads<Enter>";
+          "<Enter>" = ":view<Enter>";
+          d = ":prompt 'Delete? ' 'delete-message'<Enter>";
+          D = ":move Trash<Enter>";
+          A = ":archive flat<Enter>";
+          C = ":compose<Enter>";
+          rr = ":reply -a<Enter>";
+          rq = ":reply -aq<Enter>";
+          Rr = ":reply<Enter>";
+          Rq = ":reply -q<Enter>";
+          c = ":cf<space>";
+          "$" = ":term<space>";
+          "!" = ":term<space>";
+          "|" = ":pipe<space>";
+          "/" = ":search<space>";
+          "\\" = ":filter <space>";
+          n = ":next-result<Enter>";
+          N = ":prev-result<Enter>";
+          "<Esc>" = ":clear<Enter>";
+          "*" = ":filter -x Flagged<Enter>";
+        };
+        view = {
+          "/" = ":toggle-key-passthrough <Enter> /";
+          q = ":close<Enter>";
+          O = ":open<Enter>";
+          S = ":save<space>";
+          "|" = ":pipe<space>";
+          D = ":move Trash<Enter>";
+          A = ":archive flat<Enter>";
+          "<C-l>" = ":open-link <space>";
+          f = ":forward <Enter>";
+          rr = ":reply -a<Enter>";
+          rq = ":reply -aq<Enter>";
+          Rr = ":reply<Enter>";
+          Rq = ":reply -q<Enter>";
+          H = ":toggle-headers<Enter>";
+          "<C-k>" = ":prev-part<Enter>";
+          "<C-j>" = ":next-part<Enter>";
+          J = ":next <Enter>";
+          K = ":prev<Enter>";
+        };
+        "view::passthrough" = {
+          "$noinherit" = "true";
+          "$ex" = "<C-x>";
+          "<Esc>" = ":toggle-key-passthrough<Enter>";
+        };
+        compose = {
+          # Keybindings used when the embedded terminal is not selected in the compose
+          # view
+          "$noinherit" = "true";
+          "$ex" = "<C-x>";
+          "<C-k>" = ":prev-field<Enter>";
+          "<C-j>" = ":next-field<Enter>";
+          "<tab>" = ":next-field<Enter>";
+          "<C-p>" = ":prev-tab<Enter>";
+          "<C-n>" = ":next-tab<Enter>";
+        };
+
+        "compose::editor" = {
+          # Keybindings used when the embedded terminal is selected in the compose view
+          "$noinherit" = "true";
+          "$ex" = "<C-x>";
+          "<C-k>" = ":prev-field<Enter>";
+          "<C-j>" = ":next-field<Enter>";
+          "<C-p>" = ":prev-tab<Enter>";
+          "<C-n>" = ":next-tab<Enter>";
+        };
+
+        "compose::review" = {
+          # Keybindings used when reviewing a message to be sent
+          y = ":send <Enter>";
+          n = ":abort<Enter>";
+          p = ":postpone<Enter>";
+          q = ":choose -o d discard abort -o p postpone postpone<Enter>";
+          e = ":edit<Enter>";
+          a = ":attach<space>";
+          d = ":detach<space>";
+        };
+
+        terminal = {
+          "$noinherit" = "true";
+          "$ex" = "<C-x>";
+          "<C-p>" = ":prev-tab<Enter>";
+          "<C-n>" = ":next-tab<Enter>";
+        };
+      };
+
+      extraConfig = {
+        ui.sort = "-r date";
+        ui.timestamp-format = "2006-01-02 15:04";
+        ui.mouse-enabled = true;
+        ui.spinner = ". , .";
+        general.unsafe-accounts-conf = true;
+        general.pgp-provider = "gpg";
+        viewer = {pager = "${pkgs.less}/bin/less -R";};
+        compose = {
+          address-book-cmd = "khard email --remove-first-line --parsable '%s'";
+          no-attachment-warning = "(attach|attached|attachments?|anbei|Anhang|angehängt)";
+        };
+        filters = {
+          "text/plain" = "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
+          "text/calendar" = "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/calendar";
+          "text/html" = "${pkgs.aerc}/share/aerc/filters/html"; # Requires w3m, dante
+          # "text/html" =
+          #   "${pkgs.aerc}/share/aerc/filters/html | ${pkgs.aerc}/share/aerc/filters/colorize";
+          # "text/*" =
+          #   ''${pkgs.bat}/bin/bat -fP --theme=ansi --file-name="$AERC_FILENAME "'';
+          "message/delivery-status" = "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
+          "message/rfc822" = "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
+          "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
+        };
+        openers = let
+          as-pdf = pkgs.writers.writeDash "as-pdf" ''
+            d=$(mktemp -d)
+            trap clean EXIT
+            clean() {
+              rm -rf "$d"
+            }
+            ${pkgs.libreoffice}/bin/libreoffice --headless --convert-to pdf "$1" --outdir "$d"
+            ${pkgs.zathura}/bin/zathura "$d"/*.pdf
+          '';
+        in {
+          "image/*" = "${pkgs.nsxiv}/bin/nsxiv";
+          "application/pdf" = "${pkgs.zathura}/bin/zathura";
+          "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = toString as-pdf;
+          "application/vnd.oasis.opendocument.text" = toString as-pdf;
+          "video/*" = "${pkgs.mpv}/bin/mpv";
+          "audio/*" = "${pkgs.mpv}/bin/mpv";
+        };
+      };
+
+      templates = {
+        # new_message = "hello!";
+      };
+    };
+  };
+}

configs/alacritty.nix

@@ -1,46 +1,83 @@
-{ pkgs, lib, config, ... }:
-let
-  inherit (import <niveum/lib>) colours;
-  colourNames =
-    [ "black" "red" "green" "yellow" "blue" "magenta" "cyan" "white" ];
-  colourPairs = lib.getAttrs colourNames colours;
-  alacrittyConfig = {
-    background_opacity = 0.9;
-    colors = {
-      primary = { inherit (colours) background foreground; };
-      normal = lib.mapAttrs (_: colour: colour.dark) colourPairs;
-      bright = lib.mapAttrs (_: colour: colour.bright) colourPairs;
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  alacritty-cfg = theme:
+    (pkgs.formats.yaml {}).generate "alacritty.yml" {
+      bell = {
+        animation = "EaseOut";
+        duration = 100;
+        color = "#ffffff";
+      };
+      font = {
+        normal.family = "Monospace";
+        size = 6;
+      };
+      live_config_reload = true;
+      key_bindings = [
+        {
+          key = "Plus";
+          mods = "Control";
+          action = "IncreaseFontSize";
+        }
+        {
+          key = "Minus";
+          mods = "Control";
+          action = "DecreaseFontSize";
+        }
+        {
+          key = "Key0";
+          mods = "Control";
+          action = "ResetFontSize";
+        }
+      ];
+      colors = let
+        colourNames = ["black" "red" "green" "yellow" "blue" "magenta" "cyan" "white"];
+        colourPairs = lib.getAttrs colourNames theme;
+      in {
+        primary = {inherit (theme) background foreground;};
+        cursor = {inherit (theme) cursor;};
+        normal = lib.mapAttrs (_: colour: colour.dark) colourPairs;
+        bright = lib.mapAttrs (_: colour: colour.bright) colourPairs;
+      };
     };
-    font = {
-      normal.family = "Monospace";
-      size = 6;
-    };
-    key_bindings = [
-      {
-        key = "Add";
-        mods = "Control";
-        action = "IncreaseFontSize";
-      }
-      {
-        key = "Minus";
-        mods = "Control";
-        action = "DecreaseFontSize";
-      }
-      {
-        key = "Key0";
-        mods = "Control";
-        action = "ResetFontSize";
-      }
+  alacritty-pkg = pkgs.symlinkJoin {
+    name = "alacritty";
+    paths = [
+      (pkgs.writers.writeDashBin "alacritty" ''
+        ${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yml msg create-window "$@" ||
+        ${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yml "$@"
+      '')
+      pkgs.alacritty
     ];
   };
 in {
   environment.variables.TERMINAL = "alacritty";
 
-  environment.systemPackages = [
-    pkgs.alacritty
-  ];
-
-  home-manager.users.me.xdg.configFile = {
-    "alacritty/alacritty.yml".text = builtins.toJSON alacrittyConfig;
+  home-manager.users.me = {
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        key_bindings = [
+          {
+            key = "Plus";
+            mods = "Control";
+            action = "IncreaseFontSize";
+          }
+          {
+            key = "Minus";
+            mods = "Control";
+            action = "DecreaseFontSize";
+          }
+          {
+            key = "Key0";
+            mods = "Control";
+            action = "ResetFontSize";
+          }
+        ];
+      };
+    };
   };
 }

configs/android.nix

@@ -0,0 +1,5 @@
+{
+  programs.adb.enable = true;
+
+  users.users.me.extraGroups = ["adbusers"];
+}

configs/backup.nix

@@ -0,0 +1,55 @@
+{
+  pkgs,
+  config,
+  ...
+}: let
+  inherit (import ../lib) restic;
+in {
+  services.restic.backups.niveum = {
+    initialize = true;
+    inherit (restic) repository;
+    timerConfig = {
+      OnCalendar = "8:00";
+      RandomizedDelaySec = "1h";
+    };
+    passwordFile = config.age.secrets.restic.path;
+    extraBackupArgs = [
+      "--exclude=/home/kfm/projects/nixpkgs/.git"
+      "--exclude=node_modules"
+      "--exclude=.parcel-cache"
+    ];
+    paths = [
+      "/home/kfm/work"
+      "/home/kfm/projects"
+      "/home/kfm/Zotero"
+      "/home/kfm/notes"
+      "/home/kfm/Maildir"
+      "/home/kfm/cloud"
+      "/home/kfm/.gnupg"
+      "/home/kfm/.ssh"
+      "/mnt/sd-card/music"
+      "/mnt/sd-card/Books"
+    ];
+  };
+
+  systemd.services.restic-backups-niveum.serviceConfig = {
+    Restart = "on-failure";
+    RestartSec = "15s";
+    StartLimitIntervalSec = "1m"; # don't try more than 4 times
+    StartLimitBurst = 4;
+  };
+
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "restic-niveum" ''
+      ${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} "$@"
+    '')
+    (pkgs.writers.writeDashBin "restic-mount" ''
+      mountdir=$(mktemp -d)
+      trap clean EXIT
+      clean() {
+        rm -r "$mountdir"
+      }
+      ${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} mount "$mountdir"
+    '')
+  ];
+}

configs/bash.nix

@@ -1,7 +1,7 @@
-{
+{pkgs, ...}: {
   programs.bash = {
     promptInit = ''
-      PS1="$(tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(tput sgr0) "'';
+      PS1="$(${pkgs.ncurses}/bin/tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(${pkgs.ncurses}/bin/tput sgr0) "'';
     interactiveShellInit = ''
       set -o vi
     '';

configs/battery.nix

@@ -1,11 +1,14 @@
-{ config, pkgs, ... }:
 {
+  config,
+  pkgs,
+  ...
+}: {
   boot.extraModulePackages = with config.boot.kernelPackages; [
     tp_smapi
     acpi_call
   ];
-  boot.kernelModules = [ "tp_smapi" "acpi_call" ];
-  environment.systemPackages = [ pkgs.tpacpi-bat ];
+  boot.kernelModules = ["tp_smapi" "acpi_call"];
+  environment.systemPackages = [pkgs.tpacpi-bat pkgs.powertop];
 
   services.tlp = {
     enable = true;

configs/beets.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.beets];
+  home-manager.users.me.xdg.configFile = {
+    "beets/config.yaml".source = (pkgs.formats.yaml {}).generate "config.yaml" {
+      directory = "~/cloud/syncthing/music";
+      library = "~/cloud/syncthing/common/music.db";
+      plugins = toString ["fetchart" "lastgenre"];
+    };
+  };
+}

configs/bluetooth.nix

@@ -1,11 +1,17 @@
-{ pkgs, lib, ... }: {
+{
+  pkgs,
+  lib,
+  ...
+}: {
   hardware.bluetooth = {
     enable = true;
-    config.General.Enable =
-      lib.concatStringsSep "," [ "Source" "Sink" "Media" "Socket" ];
+    settings.General.Enable =
+      lib.concatStringsSep "," ["Source" "Sink" "Media" "Socket"];
   };
 
-  environment.systemPackages = [ pkgs.blueman ];
+  services.blueman.enable = true;
 
-  home-manager.users.me = { services.blueman-applet.enable = false; };
+  # environment.systemPackages = [pkgs.blueman];
+
+  home-manager.users.me = {services.blueman-applet.enable = true;};
 }

configs/calcurse.nix

@@ -1,44 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  environment.systemPackages = [ pkgs.calcurse ];
-
-  systemd.services.caldav-sync = {
-    enable = true;
-    wants = [ "network-online.target" ];
-    startAt = "*:0/15";
-    serviceConfig.User = "kfm";
-    script = "${pkgs.calcurse}/bin/calcurse-caldav";
-  };
-
-  home-manager.users.me = {
-    home.file = {
-      ".calcurse/conf".text = ''
-        appearance.calendarview=monthly
-        appearance.layout=1
-        daemon.enable=no
-        daemon.log=no
-        format.inputdate=4
-        format.outputdate=%F
-        general.confirmquit=no
-        general.confirmdelete=yes
-        general.firstdayofweek=monday
-        appearance.theme=default on default
-      '';
-      ".calcurse/caldav/config".text = lib.generators.toINI {} {
-        General = {
-          Binary = "${pkgs.calcurse}/bin/calcurse";
-          Hostname = "posteo.de:8443";
-          Path = "/calendars/kieran.meinhardt/default/";
-          InsecureSSL = "No";
-          DryRun = "No";
-          Verbose = "Yes";
-        };
-        Auth = {
-          Username = "kieran.meinhardt@posteo.net";
-          Password = lib.strings.fileContents <secrets/mail/posteo>;
-        };
-      };
-    };
-  };
-
-}

configs/ccc.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{pkgs, ...}:
 # https://paste.sr.ht/~erictapen/11716989e489b600f237041b6d657fdf0ee17b34
 let
   certificate = pkgs.stdenv.mkDerivation rec {
@@ -7,7 +7,7 @@ let
       1,/DST Root CA X3/d
       1,/-----END CERTIFICATE-----/p
     '';
-    nativeBuildInputs = with pkgs; [ cacert gnused ];
+    nativeBuildInputs = with pkgs; [cacert gnused];
     phases = "installPhase";
     installPhase = ''
       ${pkgs.gnused}/bin/sed -n -f $src ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt > $out

configs/chromium.nix

@@ -1,16 +1,97 @@
-{ pkgs, ... }: {
+{
+  pkgs,
+  config,
+  ...
+}: {
   programs.chromium = {
     enable = true;
     extensions = [
-      "hdokiejnpimakedhajhdlcegeplioahd" # LastPass
       # "ihlenndgcmojhcghmfjfneahoeklbjjh" # cVim
       # "fpnmgdkabkmnadcjpehmlllkndpkmiak" # Wayback Machine
       "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
-      "khncfooichmfjbepaaaebmommgaepoid" # Remove YouTube Recommended Videos
+      "pjjgklgkfeoeiebjogplpnibpfnffkng" # undistracted
+      "nhdogjmejiglipccpnnnanhbledajbpd" # vuejs devtools
+      "eimadpbcbfnmbkopoojfekhnkhdbieeh" # dark reader
     ];
   };
 
-  environment.systemPackages = [ pkgs.chromium pkgs.brave ];
+  home-manager.users.me = {
+    programs.firefox = {
+      enable = true;
+      package = pkgs.firefox.override {
+        cfg = {
+          enableTridactylNative = true;
+        };
+      };
+      profiles = let
+        defaultSettings = {
+          "beacon.enabled" = false;
+          "browser.bookmarks.showMobileBookmarks" = true;
+          "browser.newtab.preload" = false;
+          "browser.search.isUS" = false;
+          "browser.search.region" = "DE";
+          "browser.send_pings" = false;
+          "browser.shell.checkDefaultBrowser" = false;
+          "browser.startup.homepage" = "chrome://browser/content/blanktab.html";
+          "browser.uidensity" = 1;
+          "browser.urlbar.placeholderName" = "Search";
+          "datareporting.healthreport.service.enabled" = false;
+          "datareporting.healthreport.uploadEnabled" = false;
+          "datareporting.policy.dataSubmissionEnabled" = false;
+          "datareporting.sessions.current.clean" = true;
+          "distribution.searchplugins.defaultLocale" = "de-DE";
+          "general.smoothScroll" = true;
+          "identity.fxaccounts.account.device.name" = config.networking.hostName;
+          "network.cookie.cookieBehavior" = 1;
+          "privacy.donottrackheader.enabled" = true;
+          "privacy.trackingprotection.enabled" = true;
+          "privacy.trackingprotection.pbmode.enabled" = true;
+          "privacy.trackingprotection.socialtracking.enabled" = true;
+          "services.sync.declinedEngines" = "passwords";
+          "services.sync.engine.passwords" = false;
+          "signon.autofillForms" = false;
+          "signon.rememberSignons" = false;
+          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+          "toolkit.telemetry.archive.enabled" = false;
+          "toolkit.telemetry.bhrPing.enabled" = false;
+          "toolkit.telemetry.cachedClientID" = "";
+          "toolkit.telemetry.enabled" = false;
+          "toolkit.telemetry.firstShutdownPing.enabled" = false;
+          "toolkit.telemetry.hybridContent.enabled" = false;
+          "toolkit.telemetry.newProfilePing.enabled" = false;
+          "toolkit.telemetry.prompted" = 2;
+          "toolkit.telemetry.rejected" = true;
+          "toolkit.telemetry.server" = "";
+          "toolkit.telemetry.shutdownPingSender.enabled" = false;
+          "toolkit.telemetry.unified" = false;
+          "toolkit.telemetry.unifiedIsOptIn" = false;
+          "toolkit.telemetry.updatePing.enabled" = false;
+          "ui.prefersReducedMotion" = 1;
+        };
+      in {
+        default = {
+          id = 0;
+          isDefault = true;
+          settings = defaultSettings;
+          # extensions = with pkgs.nur.repos.rycee.firefox-addons; [
+          #   ublock-origin
+          #   darkreader
+          #   sponsorblock
+          #   consent-o-matic
+          #   i-dont-care-about-cookies
+          #   # auto-tab-discard TODO what is this
+          # ];
+          userChrome = ''
+            #TabsToolbar {
+              visibility: collapse !important;
+            }
+          '';
+        };
+      };
+    };
+  };
+
+  environment.systemPackages = [pkgs.brave];
 
   environment.variables.BROWSER = "brave";
 }

configs/clipboard.nix

@@ -0,0 +1,7 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.clipmenu.enable = true;
+}

configs/cloud.nix

@@ -1,22 +1,98 @@
-{ config, lib, pkgs, ... }: {
-  imports = [
-    <niveum/modules/seafile.nix>
-    <niveum/modules/dropbox.nix>
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (import ../lib) tmpfilesConfig;
+in {
+  systemd.tmpfiles.rules = map tmpfilesConfig [
+    {
+      type = "L+";
+      user = config.users.users.me.name;
+      group = "users";
+      mode = "0755";
+      argument = "${config.users.users.me.home}/cloud/nextcloud/Uni";
+      path = "${config.users.users.me.home}/uni";
+    }
   ];
 
-  niveum = {
-    dropbox.enable = true;
-    seafile.enable = true;
+  home-manager.users.me = {
+    services.gnome-keyring.enable = true;
+    services.nextcloud-client = {
+      enable = true;
+      startInBackground = true;
+    };
+    systemd.user.services.nextcloud-client = {
+      Unit = {
+        Wants = ["gnome-keyring.service"];
+        After = ["gnome-keyring.service"];
+      };
+    };
   };
 
-  system.activationScripts.home-symlinks = ''
-    ln -sfn ${config.users.users.me.home}/cloud/syncthing/common/mahlzeit ${config.users.users.me.home}/mahlzeit
-    ln -sfn ${config.users.users.me.home}/cloud/Seafile/Wiki ${config.users.users.me.home}/notes
-    ln -sfn ${config.users.users.me.home}/cloud/Seafile/Uni ${config.users.users.me.home}/uni
-  '';
+  systemd.user.services.nextcloud-syncer = {
+    enable = false;
+    wants = ["network-online.target"];
+    wantedBy = ["default.target"];
+    startAt = "*:00/10";
+    script = let
+      kieran = {
+        user = "kieran";
+        passwordFile = config.age.secrets.nextcloud-password-kieran.path;
+        endpoint = "https://cloud.kmein.de";
+        target = "${config.users.users.me.home}/notes";
+      };
+    in ''
+      mkdir -p ${lib.escapeShellArg kieran.target}
+      ${pkgs.nextcloud-client}/bin/nextcloudcmd --non-interactive --user ${kieran.user} --password "$(cat ${kieran.passwordFile})" --path /Notes ${lib.escapeShellArg kieran.target} ${kieran.endpoint}
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      Restart = "on-failure";
+    };
+  };
 
-  home-manager.users.me = {
-    services.nextcloud-client.enable = false;
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "book" ''
+      set -efu
+      book="$({
+        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/syncthing/library -type f
+        ${pkgs.findutils}/bin/find ${config.users.users.me.home}/cloud/nextcloud/Books -type f
+      } | ${pkgs.fzf}/bin/fzf)"
+      exec ${pkgs.zathura}/bin/zathura "$book"
+    '')
+    (let
+      kieran = {
+        user = "kieran.meinhardt@gmail.com";
+        passwordFile = config.age.secrets.mega-password.path;
+      };
+      megatools = command: ''${pkgs.megatools}/bin/megatools ${command} --username ${lib.escapeShellArg kieran.user} --password "$(cat ${kieran.passwordFile})"'';
+    in
+      pkgs.writers.writeDashBin "book-mega" ''
+        set -efu
+        selection="$(${megatools "ls"} | ${pkgs.fzf}/bin/fzf)"
+        test -n "$selection" || exit 1
+
+        tmpdir="$(mktemp -d)"
+        trap clean EXIT
+        clean() {
+          rm -rf "$tmpdir"
+        }
+
+        (
+          cd "$tmpdir"
+          ${megatools "get"} "$selection"
+          exec ${pkgs.zathura}/bin/zathura "$(basename "$selection")"
+        )
+      '')
+  ];
+
+  age.secrets.mega-password = {
+    file = ../secrets/mega-password.age;
+    owner = config.users.users.me.name;
+    group = config.users.users.me.group;
+    mode = "400";
   };
 
   services.syncthing = rec {
@@ -25,22 +101,24 @@
     openDefaultPorts = true;
     configDir = "/home/kfm/.config/syncthing";
     dataDir = "/home/kfm/.config/syncthing";
-    declarative = rec {
-      cert = toString <system-secrets/syncthing/cert.pem>;
-      key = toString <system-secrets/syncthing/key.pem>;
-      inherit ((import <niveum/lib>).syncthing) devices;
-      folders =
-        let cloud-dir = "${config.users.users.me.home}/cloud";
-        in {
-          "${cloud-dir}/syncthing/common".devices = [ "wilde" "manakish" ];
-          "${cloud-dir}/syncthing/library".devices = [ "wilde" "manakish" "heym" ];
-          "${cloud-dir}/syncthing/mundoiu".devices = [ "wilde" "manakish" "heym" ];
-          "${cloud-dir}/syncthing/music".devices = [ "wilde" "manakish" "heym" ];
-          "${cloud-dir}/moodle" = {
-            devices = [ "wilde" "toum" "manakish" ];
-            id = "moodle-dl";
-          };
-        };
+    cert = config.age.secrets.syncthing-cert.path;
+    key = config.age.secrets.syncthing-key.path;
+    inherit ((import ../lib).syncthing) devices;
+    folders = let
+      cloud-dir = "${config.users.users.me.home}/cloud";
+    in {
+      "${cloud-dir}/syncthing/zotero".devices = ["kabsa" "manakish"];
+      "${cloud-dir}/syncthing/common".devices = ["kabsa" "manakish"];
+      "${cloud-dir}/syncthing/library".devices = ["kabsa" "manakish" "heym"];
+      "${cloud-dir}/syncthing/mundoiu".devices = ["kabsa" "manakish" "heym"];
+      "${cloud-dir}/syncthing/obsidian" = {
+        devices = ["kabsa" "manakish" "heym"];
+        id = "3r1hu-3barr";
+      };
+      "${cloud-dir}/syncthing/music" = {
+        devices = ["kabsa" "manakish" "heym" "zaatar"];
+        id = "music";
+      };
     };
   };
 }

configs/compton.nix

@@ -1,8 +0,0 @@
-{
-  services.compton = {
-    enable = true;
-    shadow = true;
-    menuOpacity = 0.9;
-    shadowOpacity = 0.3;
-  };
-}

configs/default.nix

@@ -1,52 +1,53 @@
-{ pkgs, lib, config, options, ... }:
-let
+{
+  pkgs,
+  lib,
+  config,
+  niveumPackages,
+  inputs,
+  ...
+}: let
   inherit (lib.strings) makeBinPath;
-  inherit (import <niveum/lib>) localAddresses kieran;
+  inherit (import ../lib) localAddresses kieran;
+  defaultApplications = (import ../lib).defaultApplications {inherit pkgs;};
 in {
   imports = [
-    <home-manager/nixos>
-    <niveum/modules/system-dependent.nix>
+    inputs.self.nixosModules.system-dependent
+    inputs.self.nixosModules.power-action
     {
-      boot.supportedFilesystems = [ "ntfs" ];
+      boot.supportedFilesystems = ["ntfs"];
     }
-    {
-      nix.nixPath = [
-        "/var/src"
-        "nixpkgs-overlays=${toString ../overlays}"
-      ];
-    }
-    { services.dbus.packages = [ pkgs.gnome3.dconf ]; }
     {
       nixpkgs = {
         config = {
           allowUnfree = true;
           packageOverrides = pkgs: {
-            nur = import (builtins.fetchTarball
-              "https://github.com/nix-community/NUR/archive/222ea29ec4afb09c5565a7e5dda14bfd65a4a9f6.tar.gz") {
-                inherit pkgs;
-              };
-            writeDashBin = pkgs.writers.writeDashBin;
-            writeDash = pkgs.writers.writeDash;
-            gfs-fonts = pkgs.callPackage <niveum/packages/gfs-fonts.nix> {};
-            iolanguage = pkgs.callPackage <niveum/packages/iolanguage.nix> { };
-            ix = pkgs.callPackage <niveum/packages/ix.nix> { };
+            dmenu = pkgs.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
           };
+          permittedInsecurePackages = [
+            "qtwebkit-5.212.0-alpha4"
+          ];
         };
-        overlays = [
-          (self: super: {
-            scripts = import <niveum/packages/scripts> { pkgs = super; lib = super.lib; };
-          })
-          (import <niveum/overlays/toml.nix>)
-          (import <stockholm/krebs/5pkgs/haskell>)
-          (import <stockholm/submodules/nix-writers/pkgs>)
-          (import <stockholm/krebs/5pkgs/override>)
-        ];
       };
     }
     {
-      boot.cleanTmpDir = true;
+      boot.tmp.cleanOnBoot = true;
       boot.loader.timeout = 1;
-      boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ];
+    }
+    {
+      age.secrets = {
+        di-fm-key = {
+          file = ../secrets/di-fm-key.age;
+          owner = config.users.users.me.name;
+          group = config.users.users.me.group;
+          mode = "400";
+        };
+        restic = {
+          file = ../secrets/restic.age;
+          owner = config.users.users.me.name;
+          group = config.users.users.me.group;
+          mode = "400";
+        };
+      };
     }
     {
       home-manager.users.me = {
@@ -59,6 +60,19 @@ in {
         };
       };
     }
+    {
+      environment.systemPackages = [
+        pkgs.capitaine-cursors
+      ];
+
+      home-manager.users.me = {
+        home.pointerCursor = {
+          name = "capitaine-cursors-white";
+          package = pkgs.capitaine-cursors;
+          size = 12;
+        };
+      };
+    }
     {
       users.mutableUsers = false;
 
@@ -67,27 +81,19 @@ in {
       users.users.me = {
         name = "kfm";
         description = kieran.name;
-        hashedPassword =
-          "$6$w9hXyGFl/.IZBXk$5OiWzS1G.5hImhh1YQmZiCXYNAJhi3X6Y3uSLupJNYYXPLMsQpx2fwF4Xr2uYzGMV8Foqh8TgUavx1APD9rcb/";
+        passwordFile = config.age.secrets.kfm-password.path;
         isNormalUser = true;
         uid = 1000;
       };
-    }
-    {
-      sound.enable = true;
 
-      hardware.pulseaudio = {
-        enable = true;
-        package = pkgs.pulseaudioFull; # for bluetooth sound output
+      age.secrets = {
+        kfm-password.file = ../secrets/kfm-password.age;
       };
 
-      users.users.me.extraGroups = [ "audio" ];
-
-      environment.systemPackages = [ pkgs.pavucontrol pkgs.pamixer pkgs.pulsemixer ];
+      home-manager.users.me.xdg.enable = true;
     }
     {
-      environment.interactiveShellInit =
-        "export PATH=$PATH:$HOME/projects/niveum";
+      environment.interactiveShellInit = "export PATH=$PATH:$HOME/projects/niveum";
       environment.shellAliases = let
         wcd = pkgs.writers.writeDash "wcd" ''
           cd "$(readlink "$(${pkgs.which}/bin/which --skip-alias "$1")" | xargs dirname)/.."
@@ -98,42 +104,49 @@ in {
         take = pkgs.writers.writeDash "take" ''
           mkdir "$1" && cd "$1"
         '';
-        swallow = command: "${pkgs.scripts.swallow}/bin/swallow ${command}";
+        cdt = pkgs.writers.writeDash "cdt" ''
+          cd "$(mktemp -d)"
+          pwd
+        '';
+        swallow = command: "${niveumPackages.swallow}/bin/swallow ${command}";
       in {
-        "ß" = "${pkgs.utillinux}/bin/setsid";
-        cat = "${pkgs.bat}/bin/bat --style=plain";
-        chromium-incognito =
-          "chromium --user-data-dir=$(mktemp -d /tmp/chr.XXXXXX) --no-first-run --incognito";
+        "ß" = "${pkgs.util-linux}/bin/setsid";
+        cat = "${pkgs.bat}/bin/bat --theme=ansi --style=plain";
+        chromium-incognito = "chromium --user-data-dir=$(mktemp -d /tmp/chr.XXXXXX) --no-first-run --incognito";
         cp = "cp --interactive";
-        ip = "${pkgs.iproute}/bin/ip -c";
-        l  = "ls --color=auto --time-style=long-iso --almost-all";
+        ip = "${pkgs.iproute2}/bin/ip -c";
+        l = "ls --color=auto --time-style=long-iso --almost-all";
         ls = "ls --color=auto --time-style=long-iso";
         ll = "ls --color=auto --time-style=long-iso -l";
         la = "ls --color=auto --time-style=long-iso --almost-all -l";
         mv = "mv --interactive";
         nixi = "nix repl '<nixpkgs>'";
         ns = "nix-shell --run zsh";
-        o = "${pkgs.xdg_utils}/bin/xdg-open";
+        o = "${pkgs.xdg-utils}/bin/xdg-open";
         pbcopy = "${pkgs.xclip}/bin/xclip -selection clipboard -in";
         pbpaste = "${pkgs.xclip}/bin/xclip -selection clipboard -out";
         rm = "rm --interactive";
         s = "${pkgs.systemd}/bin/systemctl";
         take = "source ${take}";
+        cdt = "source ${cdt}";
+        vit = "$EDITOR $(mktemp)";
         tmux = "${pkgs.tmux}/bin/tmux -2";
-        sxiv = swallow "${pkgs.sxiv}/bin/sxiv";
+        sxiv = swallow "${pkgs.nsxiv}/bin/nsxiv";
         zathura = swallow "${pkgs.zathura}/bin/zathura";
         us = "${pkgs.systemd}/bin/systemctl --user";
         wcd = "source ${wcd}";
         im = "${pkgs.openssh}/bin/ssh weechat@makanek -t tmux attach-session -t IM";
         where = "source ${where}";
-        yt =
-          "${pkgs.youtube-dl}/bin/youtube-dl --add-metadata -ic"; # Download video link
-        yta =
-          "${pkgs.youtube-dl}/bin/youtube-dl --add-metadata -xic"; # Download with audio
+        yt = "${pkgs.yt-dlp}/bin/yt-dlp --add-metadata -ic"; # Download video link
+        yta = "${pkgs.yt-dlp}/bin/yt-dlp --add-metadata -xic"; # Download with audio
+      };
+    }
+    {
+      i18n = {
+        defaultLocale = "en_DK.UTF-8";
+        supportedLocales = ["all"];
       };
     }
-    { i18n.defaultLocale = "en_GB.UTF-8"; }
-    { services.illum.enable = true; }
     {
       services.xserver = {
         enable = true;
@@ -146,7 +159,7 @@ in {
             enable = true;
             greeters.gtk = {
               enable = true;
-              indicators = [ "~spacer" "~host" "~spacer" "~session" "~power" ];
+              indicators = ["~spacer" "~host" "~spacer" "~session" "~power"];
             };
           };
         };
@@ -154,88 +167,130 @@ in {
     }
     {
       security.wrappers = {
-        pmount.source = "${pkgs.pmount}/bin/pmount";
-        pumount.source = "${pkgs.pmount}/bin/pumount";
+        pmount = {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          source = "${pkgs.pmount}/bin/pmount";
+        };
+        pumount = {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          source = "${pkgs.pmount}/bin/pumount";
+        };
       };
     }
-    { programs.command-not-found.enable = true; }
+    {programs.command-not-found.enable = true;}
     {
-      programs.gnupg.agent.enable = true;
+      home-manager.users.me = {
+        services.gpg-agent = rec {
+          enable = true;
+          enableZshIntegration = true;
+          defaultCacheTtl = 2 * 60 * 60;
+          maxCacheTtl = 4 * defaultCacheTtl;
+        };
+      };
 
       environment.systemPackages = [
         pkgs.gnupg
-        (pkgs.pass.withExtensions (e: [e.pass-otp]))
+        (pkgs.pass.withExtensions (e: [e.pass-otp e.pass-import e.pass-genphrase]))
       ];
     }
     {
       services.atd.enable = true;
     }
     {
-      services.mingetty = {
+      services.getty = {
         greetingLine = lib.mkForce "";
         helpLine = lib.mkForce "";
       };
     }
     {
-      networking.hosts = lib.mapAttrs' (name: address: {
-        name = address;
-        value = [ "${name}.local" ];
-      }) localAddresses;
+      networking.hosts =
+        lib.mapAttrs' (name: address: {
+          name = address;
+          value = ["${name}.local"];
+        })
+        localAddresses;
     }
+    {
+      home-manager.users.me.home.stateVersion = "22.05";
+    }
+    {
+      systemd.user.services.udiskie = {
+        after = ["udisks2.service"];
+        wants = ["udisks2.service"];
+        wantedBy = ["graphical-session.target"];
+        serviceConfig = {
+          ExecStart = "${pkgs.udiskie}/bin/udiskie --verbose --no-config --notify";
+        };
+      };
+      services.udisks2.enable = true;
+      programs.dconf.enable = true;
+      home-manager.users.me = {
+        dconf.enable = true;
+        dconf.settings = {
+          # Change the default terminal for Nemo
+          "org/cinnamon/desktop/applications/terminal".exec = defaultApplications.terminal;
+        };
+      };
+    }
+    ./android.nix
+    ./stylix.nix
     ./alacritty.nix
+    ./backup.nix
     ./bash.nix
     ./bluetooth.nix
+    ./aerc.nix
     ./ccc.nix
-    ./kleiter.nix
-    ./calcurse.nix
+    ./khal.nix
     ./chromium.nix
+    ./clipboard.nix
     ./cloud.nix
-    ./compton.nix
     ./direnv.nix
-    ./distrobump.nix
     ./docker.nix
     ./dunst.nix
     ./flix.nix
     ./fonts.nix
     ./fzf.nix
-    ./gaslight.nix
     ./git.nix
     ./hledger.nix
     ./htop.nix
     ./hu-berlin.nix
+    ./fu-berlin.nix
+    ./fysi.nix
     ./i3.nix
-    ./keybase.nix
+    ./i3status-rust.nix
     ./keyboard.nix
-    ./mail/client.nix
+    ./lb.nix
     ./mpv.nix
     ./mime.nix
-    ./nano.nix
     ./neovim.nix
     ./nix.nix
     ./newsboat.nix
-    ./flameshot-once.nix
-    ./packages
+    ./flameshot.nix
+    ./packages.nix
+    ./picom.nix
+    ./stardict.nix
+    ./polkit.nix
     ./power-action.nix
     ./printing.nix
-    ./wallpaper.nix
     ./redshift.nix
     ./retiolum.nix
     ./rofi.nix
     ./spacetime.nix
     ./ssh.nix
     ./sshd.nix
+    ./sound.nix
     ./sudo.nix
-    ./sxiv.nix
-    ./theming.nix
     ./tmux.nix
-    ./tor.nix
-    ./todo-txt.nix
-    ./traadfri.nix
     ./unclutter.nix
-    ./version.nix
     ./vscode.nix
     ./watson.nix
-    ./wifi.nix
     ./zsh.nix
+    ./tor.nix
+    ./stw-berlin.nix
+    ./mastodon-bot.nix
   ];
 }

configs/direnv.nix

@@ -1,5 +1,4 @@
-{ pkgs, ... }:
-let
+{pkgs, ...}: let
   nixify = pkgs.writers.writeDashBin "nixify" ''
     set -efuC
 
@@ -11,26 +10,25 @@ let
       cat > shell.nix <<'EOF'
     { pkgs ? import <nixpkgs> {} }:
     pkgs.mkShell {
-      buildInputs = with pkgs; [];
-      shellHook = "export HISTFILE=''${toString ./.history}";
+      packages = [];
     }
     EOF
       ''${EDITOR:-vim} shell.nix
     fi
   '';
 in {
-  environment.systemPackages = [ pkgs.direnv nixify ];
+  environment.systemPackages = [pkgs.direnv nixify];
 
   home-manager.users.me.programs.direnv = {
     enable = true;
-    stdlib = builtins.readFile ("${
-        pkgs.fetchFromGitHub {
-          owner = "Mic92";
-          repo = "dotfiles";
-          rev = "a0a9b7e358fa70a85cd468f8ca1fbb02ae0a91df";
-          sha256 = "1y9h5s1lf59sczsm0ksq2x1yhl98ba9lwk5yil3q53rg7n4574pg";
-        }
-      }/home/.direnvrc");
+    stdlib = builtins.readFile "${
+      pkgs.fetchFromGitHub {
+        owner = "Mic92";
+        repo = "dotfiles";
+        rev = "a0a9b7e358fa70a85cd468f8ca1fbb02ae0a91df";
+        sha256 = "1y9h5s1lf59sczsm0ksq2x1yhl98ba9lwk5yil3q53rg7n4574pg";
+      }
+    }/home/.direnvrc";
   };
 
   programs.zsh.interactiveShellInit = ''

configs/distrobump.nix

@@ -1,8 +1,13 @@
-{ lib, config, pkgs, ... }: {
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
   imports = [
     (import <stockholm/makefu/3modules/bump-distrowatch.nix> {
       inherit lib config;
-      pkgs = pkgs // { writeDash = pkgs.writers.writeDash; };
+      pkgs = pkgs // {writeDash = pkgs.writers.writeDash;};
     })
   ];
 

configs/docker.nix

@@ -1,5 +1,16 @@
-{ pkgs, ... }: {
-  virtualisation.docker.enable = true;
-  users.users.me.extraGroups = [ "docker" ];
-  environment.systemPackages = [ pkgs.docker pkgs.docker_compose ];
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  virtualisation.docker = {
+    enable = true;
+    # for ICE wifi, ref https://gist.github.com/sunsided/7840e89ff4e11b64a2d7503fafa0290c
+    extraOptions = lib.concatStringsSep " " [
+      "--bip=172.39.1.5/24"
+      "--fixed-cidr=172.39.1.0/25"
+    ];
+  };
+  users.users.me.extraGroups = ["docker"];
+  environment.systemPackages = [pkgs.docker pkgs.docker-compose];
 }

configs/dunst.nix

@@ -1,6 +1,9 @@
-{ config, pkgs, ... }:
-let
-  inherit (import <niveum/lib>) defaultApplications colours theme;
+{
+  config,
+  pkgs,
+  ...
+}: let
+  inherit (import ../lib) defaultApplications theme;
 in {
   home-manager.users.me.services.dunst = {
     enable = true;
@@ -8,16 +11,13 @@ in {
     settings = {
       global = {
         transparency = 10;
-        font = "Monospace 8";
         geometry = "200x5-30+20";
-        frame_color = colours.foreground;
         follow = "mouse";
         indicate_hidden = true;
         notification_height = 0;
         separator_height = 2;
         padding = 8;
         horizontal_padding = 8;
-        separator_color = "auto";
         sort = true;
         markup = "full";
         format = "%a\\n<b>%s</b>\\n%b";
@@ -40,22 +40,13 @@ in {
         mouse_right_click = "close_current";
         mouse_middle_click = "close_all";
       };
-      urgency_low = rec {
-        frame_color = background;
-        background = colours.foreground;
-        foreground = colours.background;
+      urgency_low = {
         timeout = 5;
       };
-      urgency_normal = rec {
-        frame_color = background;
-        background = colours.foreground;
-        foreground = colours.background;
+      urgency_normal = {
         timeout = 10;
       };
-      urgency_critical = rec {
-        frame_color = background;
-        background = colours.red.dark;
-        foreground = colours.background;
+      urgency_critical = {
         timeout = 0;
       };
     };

configs/flameshot-once.nix

@@ -1,25 +0,0 @@
-{ lib, pkgs, ... }:
-let
-  inherit (import <niveum/lib>) defaultApplications;
-  flameshot-once =
-    pkgs.callPackage <stockholm/krebs/5pkgs/simple/flameshot-once> {};
-in {
-  nixpkgs.overlays = [
-    (self: super: {
-      xwaitforwindow =
-        super.callPackage <stockholm/krebs/5pkgs/simple/xwaitforwindow.nix> { };
-    })
-  ];
-
-  environment.systemPackages = [
-    (flameshot-once.override {
-      config.imgur = {
-        enable = true;
-        createUrl = "http://p.r/image";
-        deleteUrl = "http://p.r/image/delete/%1";
-        xdg-open.browser = (defaultApplications pkgs).browser;
-      };
-      config.timeout = 200;
-    })
-  ];
-}

configs/flameshot.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  home-manager.users.me = {
+    services.flameshot = {
+      enable = true;
+      settings.General = {
+        autoCloseIdleDaemon = true;
+        drawColor = "#ff0000";
+        drawThickness = 2;
+        checkForUpdates = false;
+        showDesktopNotification = true;
+        disabledTrayIcon = true;
+        showHelp = false;
+        squareMagnifier = true;
+        uploadWithoutConfirmation = true;
+        buttons = ''@Variant(\0\0\0\x7f\0\0\0\vQList<int>\0\0\0\0\x10\0\0\0\x2\0\0\0\x5\0\0\0\x13\0\0\0\xa\0\0\0\x1\0\0\0\xc\0\0\0\xd\0\0\0\x6\0\0\0\x8\0\0\0\0\0\0\0\xf\0\0\0\x4\0\0\0\xb\0\0\0\x3\0\0\0\x12\0\0\0\x9)'';
+      };
+    };
+  };
+}

configs/flix.nix

@@ -1,13 +1,19 @@
-{ config, pkgs, ... }:
-let
+{
+  config,
+  pkgs,
+  ...
+}: let
   flixLocation = "/media/flix";
+  flixLocationNew = "/media/flix-new";
   cacheLocation = "/var/cache/flix";
   indexFilename = "index";
+  indexFilenameNew = "index-new";
   flixUser = "flix";
   flixGroup = "users";
+  inherit (import ../lib) tmpfilesConfig;
 in {
   fileSystems.${flixLocation} = {
-    device = "prism.r:/export";
+    device = "prism.r:/export/download";
     fsType = "nfs";
     options = [
       "noauto"
@@ -17,20 +23,42 @@ in {
       "x-systemd.device-timeout=1"
       "x-systemd.idle-timeout=1min"
       "x-systemd.requires=tinc.retiolum.service"
-      "x-systemd.requires=wpa_supplicant.service"
       "user"
       "_netdev"
     ];
   };
 
+  fileSystems.${flixLocationNew} = {
+    device = "//yellow.r/public";
+    fsType = "cifs";
+    options = [
+      "guest"
+      "nofail"
+      "noauto"
+      "ro"
+      "x-systemd.automount"
+      "x-systemd.device-timeout=1"
+      "x-systemd.idle-timeout=1min"
+    ];
+  };
+
   systemd.tmpfiles.rules = [
-    "d '${cacheLocation}' 0750 ${flixUser} ${flixGroup} - -"
+    (tmpfilesConfig {
+      type = "d";
+      path = cacheLocation;
+      mode = "0750";
+      user = flixUser;
+      group = flixGroup;
+    })
   ];
 
   systemd.services.flix-index = {
     description = "Flix indexing service";
-    wants = [ "network-online.target" ];
-    script = "cp ${flixLocation}/download/index ./${indexFilename}";
+    wants = ["network-online.target"];
+    script = ''
+      cp ${flixLocation}/index ./${indexFilename}
+      cp ${flixLocationNew}/index ./${indexFilenameNew}
+    '';
     startAt = "hourly";
     serviceConfig = {
       Type = "oneshot";
@@ -44,11 +72,11 @@ in {
     isSystemUser = true;
     createHome = true;
     home = cacheLocation;
-    extraGroups = [ flixGroup ];
+    group = flixGroup;
   };
 
   environment.systemPackages = [
-    (pkgs.writeDashBin "mpv-simpsons" ''
+    (pkgs.writers.writeDashBin "mpv-simpsons" ''
       set -efu
       cd "${flixLocation}/download"
       [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
@@ -58,15 +86,13 @@ in {
         | shuf \
         | ${pkgs.findutils}/bin/xargs -d '\n' ${pkgs.mpv}/bin/mpv
     '')
-    (pkgs.writeDashBin "flixmenu" ''
+    (pkgs.writers.writeDashBin "flixmenu" ''
       set -efu
-      cd "${flixLocation}/download"
-
-      [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
-
-      ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" < ${cacheLocation}/${indexFilename} \
-        | ${pkgs.findutils}/bin/xargs -I '{}' ${pkgs.utillinux}/bin/setsid ${pkgs.xdg_utils}/bin/xdg-open '{}'
+      (
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocation}#' ${cacheLocation}/${indexFilename}
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocationNew}#' ${cacheLocation}/${indexFilenameNew}
+      ) | ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" \
+        | ${pkgs.findutils}/bin/xargs -I '{}' ${pkgs.util-linux}/bin/setsid ${pkgs.xdg-utils}/bin/xdg-open '{}'
     '')
   ];
-
 }

configs/fonts.nix

@@ -1,35 +1,128 @@
-{ pkgs, ... }: {
+{
+  pkgs,
+  niveumPackages,
+  ...
+}: let
+  zip-font = name: arguments: let
+    directory = pkgs.fetchzip arguments;
+  in
+    pkgs.runCommand name {} ''
+      mkdir -p $out/share/fonts/{truetype,opentype,woff}
+      ${pkgs.findutils}/bin/find ${directory} -name '*.ttf' -exec install '{}' $out/share/fonts/truetype \;
+      ${pkgs.findutils}/bin/find ${directory} -name '*.otf' -exec install '{}' $out/share/fonts/opentype \;
+      ${pkgs.findutils}/bin/find ${directory} -name '*.woff' -exec install '{}' $out/share/fonts/woff \;
+    '';
+  simple-ttf = name: arguments: let
+    file = pkgs.fetchurl arguments;
+  in
+    pkgs.runCommand name {} ''
+      mkdir -p $out/share/fonts/truetype
+      install ${file} $out/share/fonts/truetype
+    '';
+
+  egyptianHiero = zip-font "EgyptianHiero" {
+    url = "https://github.com/MKilani/Djehuty/archive/master.zip";
+    sha256 = "sha256-KbY4vedm757NWfDlgmNhslbZd+2Vs+o5PjtMMGDt61Y=";
+  };
+  antinoou = zip-font "Antinoou" {
+    url = "https://www.evertype.com/fonts/coptic/AntinoouFont.zip";
+    sha256 = "0jwihj08n4yrshcx07dnaml2x9yws6dgyjkvg19jqbz17drbp3sw";
+    stripRoot = false;
+  };
+  newGardiner = zip-font "NewGardiner" {
+    url = "https://mjn.host.cs.st-andrews.ac.uk/egyptian/fonts/NewGardiner.zip";
+    hash = "sha256-i7ZBN28no/884fYMA7ZJ47WpkwZXzY//TK0bDz21pE0=";
+    stripRoot = false;
+  };
+  junicode2 = zip-font "JunicodeTwo" {
+    url = "https://github.com/psb1558/Junicode-font/archive/48bf476db278c844c67542b04d1e0e4c71f139d2.zip";
+    sha256 = "1ryicc155vkvgv3315ddliigwa01afwyb4c4f6pnqcns03af001i";
+  };
+  newAthenaUnicode = zip-font "NewAthenaUnicode" {
+    url = "https://classicalstudies.org/sites/default/files/userfiles/files/NAU5_005.zip";
+    sha256 = "1g7qk9gl4nq2dz41bvck1nzilhin44j8691cxax3dlp77bbn9bxr";
+  };
+  jsesh = simple-ttf "JSesh" {
+    url = "http://files.qenherkhopeshef.org/jsesh/JSeshFont.ttf";
+    sha256 = "1203jrk2xzvgckcc5hx88kja1i3h8gm1wiyla5j6gspc0hbv56ry";
+  };
+  egyptianText = simple-ttf "EgyptianText-1.0beta" {
+    url = "http://c.krebsco.de/EgyptianText-v1.0-beta.ttf";
+    sha256 = "0cfjbk7xxnxhlp6v922psm5j1xzrv6wfk226ji2wz2yfrnkbcbsv";
+  };
+in {
   fonts = {
     enableDefaultFonts = true;
-    enableFontDir = true;
+    fontDir.enable = true;
     fonts = with pkgs; [
+      alegreya
+      alegreya-sans
+      amiri
+      annapurna-sil
+      antinoou
+      cantarell-fonts
+      cardo
+      charis-sil
+      doulos-sil
+      newAthenaUnicode
       corefonts
+      crimson
       eb-garamond
+      ipaexfont
+      jsesh
+      egyptianHiero
+      egyptianText
+      font-awesome_6
+      etBook
+      newGardiner
+      junicode2
+      ezra-sil
       fira
-      font-awesome-ttf
+      font-awesome
+      galatia-sil
+      gentium
+      niveumPackages.gfs-fonts
+      gyre-fonts
       ibm-plex
-      inconsolata
-      iosevka
-      libertine
+      jetbrains-mono
+      libertinus
+      libre-bodoni
       lmodern
-      noto-fonts
+      merriweather
+      ocr-a
       roboto
       roboto-mono
+      noto-fonts
+      noto-fonts-cjk
+      noto-fonts-emoji
       roboto-slab
+      scheherazade-new
       source-code-pro
-      source-serif-pro
       source-sans-pro
-      ubuntu_font_family
-      gfs-fonts
-      jetbrains-mono
-      twemoji-color-font
-      joypixels
-    ];
-    fontconfig.defaultFonts = {
-      monospace = [ "JetBrains Mono" ];
-      serif = [ "Source Serif Pro" ];
-      sansSerif = [ "Source Sans Pro" ];
-      emoji = [ "JoyPixels" ];
+      source-serif-pro
+      theano
+      niveumPackages.tocharian-font
+      vistafonts
+      vollkorn
+      zilla-slab
+    ]; # google-fonts league-of-moveable-type
+    fontconfig.defaultFonts = rec {
+      monospace = ["Noto Sans Mono"] ++ emoji;
+      serif = ["Noto Serif" "Noto Naskh Arabic" "Noto Serif Devanagari"];
+      sansSerif = ["Noto Sans Display" "Noto Naskh Arabic" "Noto Sans Devanagari" "Noto Sans CJK JP" "Noto Sans Coptic"];
+      emoji = ["Noto Color Emoji"];
     };
+    # xelatex fails with woff files
+    # ref https://tex.stackexchange.com/questions/392144/xelatex-and-fontspec-crash-trying-to-find-woff-file-for-some-fonts-but-not-other
+    fontconfig.localConf = ''
+      <fontconfig>
+      <!-- Reject WOFF fonts We don't register WOFF(2) fonts with fontconfig because of the W3C spec -->
+       <selectfont>
+        <rejectfont>
+         <glob>*.woff*</glob>
+        </rejectfont>
+       </selectfont>
+      </fontconfig>
+    '';
   };
 }

configs/fu-berlin.nix

@@ -0,0 +1,80 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  username = "meinhak99";
+  inherit (import ../lib/email.nix) defaults;
+  fu-defaults = rec {
+    imap.host = "mail.zedat.fu-berlin.de";
+    smtp.host = imap.host;
+    folders.drafts = "Entwürfe";
+    folders.sent = "Gesendet";
+    folders.trash = "Papierkorb";
+  };
+in {
+  home-manager.users.me = {
+    programs.ssh = {
+      matchBlocks = {
+        fu-berlin = {
+          user = username;
+          hostname = "login.zedat.fu-berlin.de";
+          setEnv.TERM = "xterm";
+        };
+      };
+    };
+    accounts.email.accounts = {
+      fu-student =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate fu-defaults
+          rec {
+            userName = "meinhak99";
+            address = "kieran.meinhardt@fu-berlin.de";
+            aliases = ["${userName}@fu-berlin.de"];
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhak99.path}";
+          });
+    };
+  };
+
+  systemd.user.services.fu-blackboard-calendar = {
+    enable = true;
+    # startAt = "*:00/10";
+    after = ["vdirsyncer.service"];
+    wantedBy = ["default.target"];
+    script = ''
+      ${pkgs.curl}/bin/curl $(cat ${config.age.secrets.blackboard-calendar-ics.path}) | ${pkgs.khal}/bin/khal import -
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      Restart = "on-failure";
+    };
+  };
+
+  age.secrets = {
+    email-password-meinhak99 = {
+      file = ../secrets/email-password-meinhak99.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    blackboard-calendar-ics = {
+      file = ../secrets/blackboard-calendar-ics.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  systemd.services.fu-vpn = {
+    enable = true;
+    wants = ["network-online.target"];
+    serviceConfig.LoadCredential = "password:${config.age.secrets.email-password-meinhak99.path}";
+    script = ''
+      if ${pkgs.wirelesstools}/bin/iwgetid | ${pkgs.gnugrep}/bin/grep --invert-match eduroam
+      then
+        cat "$CREDENTIALS_DIRECTORY/password" | ${pkgs.openconnect}/bin/openconnect vpn.fu-berlin.de --user ${username} --passwd-on-stdin
+      fi
+    '';
+  };
+}

configs/fysi.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (import ../lib/email.nix) defaults;
+  sshIdentity = name: "${config.users.users.me.home}/.ssh/${name}";
+in {
+  age.secrets = {
+    email-password-fysi = {
+      file = ../secrets/email-password-fysi.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  home-manager.users.me = {
+    accounts.email.accounts = {
+      fysi =
+        lib.recursiveUpdate defaults
+        rec {
+          address = "kieran@fysi.tech";
+          userName = address;
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fysi.path}";
+          flavor = "fastmail.com";
+        };
+    };
+
+    programs.ssh.matchBlocks = rec {
+      "nextcloud.fysi.dev" = {
+        hostname = "116.203.82.203";
+        user = "root";
+      };
+      "lingua.miaengiadina.ch" = {
+        hostname = "135.181.85.233";
+        user = "root";
+      };
+      "cms-dev.woc2023.app".identityFile = sshIdentity "fysiweb";
+      "cms-master.woc2023.app".identityFile = sshIdentity "fysiweb";
+      "fysi-dev1" = {
+        hostname = "94.130.229.139";
+        user = "root";
+        identityFile = sshIdentity "fysiweb";
+      };
+      ${fysi-dev1.hostname} = fysi-dev1;
+      "fysi-shared0" = {
+        hostname = "49.12.205.235";
+        user = "root";
+        identityFile = sshIdentity "fysiweb";
+      };
+    };
+  };
+}

configs/fzf.nix

@@ -1,32 +1,22 @@
-{ pkgs, lib, ... }: {
-  environment = {
-    systemPackages = [ pkgs.fzf ];
-    variables = {
-      FZF_DEFAULT_OPTS =
-        lib.escapeShellArgs [ "--height=40%" "--layout=reverse" ];
-      FZF_ALT_C_COMMAND = "${pkgs.fd}/bin/fd --type d";
-      FZF_ALT_C_OPTS = lib.escapeShellArgs [
-        "--preview='${pkgs.tree}/bin/tree -L 1 \"{}\"'"
+{pkgs, ...}: {
+  programs.fzf = {
+    fuzzyCompletion = true;
+    keybindings = true;
+  };
+
+  home-manager.users.me = {
+    programs.fzf = rec {
+      enable = true;
+      defaultCommand = "${pkgs.fd}/bin/fd --type f --strip-cwd-prefix --follow --no-ignore-vcs --exclude .git";
+      defaultOptions = ["--height=40%"];
+      changeDirWidgetCommand = "${pkgs.fd}/bin/fd --type d";
+      changeDirWidgetOptions = [
+        "--preview='${pkgs.tree}/bin/tree -L 1 {}'"
         "--bind=space:toggle-preview"
         "--preview-window=hidden"
       ];
-      FZF_CTRL_T_COMMAND = "${pkgs.fd}/bin/fd --type f";
-      FZF_CTRL_T_OPTS =
-        lib.escapeShellArgs [ "--preview='${pkgs.bat}/bin/bat \"{}\"'" ];
+      fileWidgetCommand = defaultCommand;
+      fileWidgetOptions = ["--preview='head -$LINES {}'"];
     };
   };
-
-  programs.zsh.interactiveShellInit = ''
-    if [[ $options[zle] = on ]]; then
-      . ${pkgs.fzf}/share/fzf/completion.zsh
-      . ${pkgs.fzf}/share/fzf/key-bindings.zsh
-    fi
-  '';
-
-  programs.bash.interactiveShellInit = ''
-    if [[ :$SHELLOPTS: =~ :(vi|emacs): ]]; then
-      . ${pkgs.fzf}/share/fzf/completion.bash
-      . ${pkgs.fzf}/share/fzf/key-bindings.bash
-    fi
-  '';
 }

configs/git.nix

@@ -1,20 +1,25 @@
-{ pkgs, config, lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran ignorePaths;
-in
 {
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  inherit (import ../lib) kieran ignorePaths;
+in {
   environment.systemPackages = [
     pkgs.mr
     pkgs.git
+    pkgs.git-crypt
     pkgs.gitAndTools.gitflow
-    pkgs.gitAndTools.hub
     pkgs.gitAndTools.gh
     pkgs.gitAndTools.git-extras
     pkgs.gitAndTools.git-trim
+    pkgs.gitAndTools.git-absorb
     pkgs.gitstats
     pkgs.patch
     pkgs.patchutils
-    pkgs.git-preview
+    inputs.self.packages.x86_64-linux.git-preview
   ];
 
   environment.shellAliases = {
@@ -23,37 +28,6 @@ in
   };
 
   home-manager.users.me = {
-    home.file.".mrconfig".text = let
-      prependPath = prefix:
-        lib.attrsets.mapAttrs'
-        (path: lib.attrsets.nameValuePair "${prefix}/${path}");
-      git = url: { checkout = "git clone ${url}"; };
-      github = owner: repo: git "git@github.com:${owner}/${repo}";
-      keybase = owner: repo: git "keybase://private/${owner}/${repo}";
-    in lib.generators.toINI { } ({
-      DEFAULT = { git_gc = ''git gc "$@"''; };
-    } // prependPath "projects" {
-      "menstruation.rs" = github "kmein" "menstruation.rs";
-      brockman = github "kmein" "brockman";
-      challenges = github "kmein" "challenges";
-      conlangs = github "kmein" "conlangs";
-      ledger = keybase "kmein" "ledger";
-      mahlzeit = github "kmein" "mahlzeit";
-      menstruation-telegram = github "kmein" "menstruation-telegram";
-      meteora = github "kmein" "meteora";
-      modernizr = github "kmein" "modernizr";
-      niveum = github "kmein" "niveum";
-      nixpkgs = github "NixOS" "nixpkgs";
-      poetry = github "kmein" "poetry";
-      quotes = github "kmein" "quotes";
-      sphinx = github "kmein" "sphinx";
-      stockholm = git "https://cgit.krebsco.de/stockholm";
-      telebots = github "kmein" "telebots";
-      traadfri = github "kmein" "traadfri";
-      wissen = github "kmein" "wissen";
-      zen = github "kmein" "zen";
-    });
-
     programs.git = {
       enable = true;
       package = pkgs.gitAndTools.gitFull;
@@ -70,33 +44,21 @@ in
         diffs = "diff --staged";
         last = "log -1 HEAD";
         logs = "log --pretty=oneline";
-        graph =
-          "log --graph --abbrev-commit --decorate --date=relative --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
+        graph = "log --graph --abbrev-commit --decorate --date=relative --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
       };
       ignores = ignorePaths;
       extraConfig = {
         pull.ff = "only";
         rebase.autoStash = true;
         merge.autoStash = true;
-        core.pager =
-          "${pkgs.gitAndTools.diff-so-fancy}/bin/diff-so-fancy | ${pkgs.less}/bin/less --tabs=4 -RFX";
-        color = {
-          ui = true;
-          diff = {
-            meta = "11";
-            frag = "magenta bold";
-            commit = "yellow bold";
-            old = "red bold";
-            new = "green bold";
-            whitespace = "red reverse";
-          };
-          diff-highlight = {
-            oldNormal = "red bold";
-            oldHighlight = "red bold 52";
-            newNormal = "green bold";
-            newHighlight = "green bold 22";
-          };
-        };
+        push.autoSetupRemote = true;
+
+        # # ref https://github.com/dandavison/delta
+        # core.pager = "${pkgs.delta}/bin/delta";
+        # interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+        # delta.navigate = true;
+        # merge.conflictStyle = "diff3";
+        # diff.colorMoved = "default";
       };
     };
   };

configs/gitea.nix

@@ -1,13 +0,0 @@
-{
-  services.gitea = {
-    enable = true;
-    disableRegistration = true;
-    rootUrl = "https://code.xn--kiern-0qa.de";
-    appName = "code.kierán.de";
-  };
-  services.nginx.virtualHosts."code.xn--kiern-0qa.de" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".extraConfig = "proxy_pass http://localhost:3000;";
-  };
-}

configs/hass/default.nix

@@ -1,61 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import ./lib.nix) triggers;
-  inherit (import <niveum/lib>) localAddresses;
-in
-{
-  imports = [
-    ./zigbee.nix
-    ./frontend.nix
-  ];
-
-  services.home-assistant = {
-    enable = true;
-    configWritable = true;
-    lovelaceConfigWritable = true;
-    openFirewall = true;
-    config = {
-      homeassistant = {
-        name = "Toum";
-        latitude = config.location.latitude;
-        longitude = config.location.longitude;
-        elevation = 90; # TODO find out how high I live
-        unit_system = "metric";
-        time_zone = config.time.timeZone;
-      };
-      config = {};
-      discovery = {};
-      system_health = {};
-      history = {};
-      # tradfri.host = localAddresses.tradfri; # dont use until python3Packages.pytradfri is packaged
-      sun = {};
-      mobile_app = {};
-      shopping_list = {};
-      sensor = [
-        {
-          platform = "dwd_weather_warnings";
-          region_name = "Berlin";
-        }
-      ];
-      mqtt = {
-        broker = "localhost";
-        port = 1883;
-        client_id = "home-assistant";
-        username = "albrecht";
-        password = lib.strings.fileContents <system-secrets/mosquitto>;
-        keepalive = 60;
-        protocol = "3.1";
-
-        discovery = true;
-        birth_message = {
-          topic = "/hass/status";
-          payload = "online";
-        };
-        will_message = {
-          topic = "/hass/status";
-          payload = "offline";
-        };
-      };
-    };
-  };
-}

configs/hass/frontend.nix

@@ -1,37 +0,0 @@
-let
-  inherit (import ./lib.nix) triggers;
-in
-{
-  services.home-assistant.config = {
-    frontend = {
-      themes = {
-        day_theme = import ./themes/clear.nix;
-        night_theme = import ./themes/clear-dark.nix;
-      };
-    };
-    automation = [
-      {
-        alias = "Night Theme";
-        hide_entity = true;
-        trigger = triggers.night;
-        action = [
-          {
-            service = "frontend.set_theme";
-            data.name = "night_theme";
-          }
-        ];
-      }
-      {
-        alias = "Day Theme";
-        hide_entity = true;
-        trigger = triggers.day;
-        action = [
-          {
-            service = "frontend.set_theme";
-            data.name = "day_theme";
-          }
-        ];
-      }
-    ];
-  };
-}

configs/hass/lib.nix

@@ -1,16 +0,0 @@
-{
-  triggers = {
-    night = {
-      platform = "numeric_state";
-      entity_id = "sun.sun";
-      value_template = "{{ state.attributes.elevation }}";
-      below = -4.0;
-    };
-    day = {
-      platform = "numeric_state";
-      entity_id = "sun.sun";
-      value_template = "{{ state.attributes.elevation }}";
-      above = 0;
-    };
-  };
-}

configs/hass/themes/clear-dark.nix

@@ -1,72 +0,0 @@
-rec {
-# Colors
- text-color = "#DADADB"; # Grey text
- text-medium-light-color = "#A0A2A8"; # Medium-light grey text
- text-medium-color = "#80828A"; # Medium grey text
- text-dark-color = "#6A6B74"; # Dark grey text
- accent-color = "#008bef"; # Blue
- accent-medium-color = "#2484C9"; # Decent blue
- background-color = "#3b4049"; # Dark grey background
- background-color-2 = "#484E59"; # Light grey background
- background-card-color = "#434952"; # Grey background
- border-color = "#383C46"; # Grey border
-
- # Header
- app-header-background-color = "#363941"; # Background color
-
- # Text
- primary-color = text-color;
- text-primary-color = text-color;
-
- # Left Menu
- paper-listbox-background-color = background-color; # Background
- sidebar-icon-color = text-medium-color; # icons
- sidebar-selected-icon-color = text-medium-light-color; # Selected row icon and background (15%)
- sidebar-selected-text-color = text-color; # Selected row label
-
- # UI
- paper-card-header-color = text-color; # Title in settings
- primary-background-color = background-color; # Background (also title background in left menu)
- mdc-theme-primary = accent-medium-color; # Action Buttons (save, restart etc.)
- card-background-color = background-card-color; # Entity Registry Background
-
- # Card
- paper-card-background-color = background-card-color; # Background
- dark-primary-color = text-color;
- primary-text-color = text-color;
- paper-listbox-color = text-color;
- light-primary-color = text-dark-color;
- secondary-text-color = text-medium-color;
- disabled-text-color = text-dark-color;
- paper-dialog-button-color = text-color;
- secondary-background-color = background-color-2; # Background more info title
-
- # Icons
- paper-item-icon-color = text-dark-color; # Off
- paper-item-icon-active-color = accent-color; # On
-
- # Switches
- switch-checked-button-color = text-medium-light-color; # Knob On
- switch-unchecked-button-color = text-medium-light-color; # Knob Off
- switch-checked-track-color = "#009FFF"; # Background On
- switch-unchecked-track-color = "#767682"; # Background Off
-
- # Slider
- paper-slider-active-color = accent-color; # Line On
- paper-slider-knob-color = text-medium-light-color; # Knob On
- paper-slider-container-color = text-dark-color; # Line Off
- paper-slider-knob-start-color = text-medium-light-color; # Knob Off
-
- # Badges
- label-badge-text-color = text-color;
- label-badge-background-color = "rgba(54, 57, 65, 0.6)";
-
- # Shadows
- ha-card-box-shadow = "inset 0px 0px 0px 1px var(--border-color)";
-
- # HACS
- hacs-badge-color = accent-color; # New Badge
- hacs-status-installed = text-color; # Installed Icon
- hacs-status-pending-restart = text-dark-color; # Restart Icon
- hacs-status-pending-update = accent-color;
-}

configs/hass/themes/clear.nix

@@ -1,52 +0,0 @@
-rec {
-  text-color = "#636B75"; # Grey text
-  text-medium-color = "#8c96a5"; # Medium grey text
-  text-light-color = "#BAC0C6"; # Light grey text
-  accent-color = "#00a1ff"; # Blue
-  background-color = "#F7F8F9"; # Light grey background
-  background-color-2 = "#F4F5F6"; # Light grey background
-  background-card-color = "rgba(255,255,255,1.0)"; # White background
-  border-color = "#E8E8E8"; # Light grey border
-
-  # Header
-  primary-color = text-color; # Background
-  text-primary-color = "#FFF"; # Text
-
-  # Left Menu
-  paper-listbox-background-color = background-color; # Background
-  # TODO = Text and Icons
-
-  # UI
-  paper-card-header-color = text-color; # Title in settings
-  primary-background-color = background-color; # Background color (also title background in left menu)
-
-  # Card
-  paper-card-background-color = background-card-color; # Background
-  dark-primary-color = text-color;
-  primary-text-color = text-color;
-  paper-listbox-color = text-color;
-  light-primary-color = text-light-color;
-  secondary-text-color = text-medium-color;
-  disabled-text-color = text-light-color;
-  paper-dialog-button-color = text-color;
-  secondary-background-color = background-color-2; # Background more info title
-
-  # Icons
-  paper-item-icon-color = text-light-color; # Off
-  paper-item-icon-active-color = accent-color; # On
-
-  # Switches
-  switch-checked-button-color = "#FFF"; # Knob On
-  switch-unchecked-button-color = "#FFF"; # Knob Off
-  switch-checked-track-color = "#0077FF"; # Background On
-  switch-unchecked-track-color = disabled-text-color; # Background Off
-
-  # Slider
-  paper-slider-active-color = accent-color; # Line On
-  paper-slider-container-color = "#e5e7ea"; # Line Off
-  paper-slider-knob-color = text-light-color; # Knob On
-  paper-slider-knob-start-color = text-light-color; # Knob Off
-
-  # Shadows
-  ha-card-box-shadow = "inset 0px 0px 0px 1px var(--border-color)";
-}

configs/hass/zigbee.nix

@@ -1,102 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) localAddresses;
-in
-{
-  services.zigbee2mqtt = {
-    enable = true;
-    config = {
-      permit_join = false;
-      homeassistant = true;
-      serial = {
-        port = "/dev/ttyACM0";
-        disable_led = true;
-      };
-      mqtt = {
-        discovery = true;
-        base_topic = "zigbee";
-        server = "mqtt://${localAddresses.toum}";
-        user = "albrecht";
-        password = lib.strings.fileContents <system-secrets/mosquitto>;
-      };
-    };
-  };
-
-  services.mosquitto = {
-    enable = true;
-    host = "0.0.0.0";
-    allowAnonymous = false;
-    checkPasswords = true;
-    users."albrecht" = {
-      password = lib.strings.fileContents <system-secrets/mosquitto>;
-      acl = [ "topic readwrite #" ];
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 1883 ];
-
-  environment.systemPackages = [ pkgs.mosquitto ];
-
-  services.home-assistant = {
-    config = {
-      switch = [
-        {
-          platform = "mqtt";
-          name = "zigbee2mqtt_join";
-          state_topic = "/zigbee2mqtt/bridge/config/permit_join";
-          command_topic = "/zigbee2mqtt/bridge/config/permit_join";
-          payload_on = "true";
-          payload_off = "false";
-        }
-      ];
-      timer.zigbee_permit_join = {
-        name = "Zigbee Time remaining";
-        duration = 120;
-      };
-      automation = [
-        # Automation to start timer when enable join is turned on
-        {
-          id = "zigbee_join_enabled";
-          alias = "";
-          hide_entity = "true";
-          trigger = {
-            platform = "state";
-            entity_id = "switch.zigbee2mqtt_join";
-            to = "on";
-          };
-          action = {
-            service = "timer.start";
-            entity_id = "timer.zigbee_permit_join";
-          };
-        }
-        # Automation to stop timer when switch turned off and turn off switch when timer finished
-        {
-          id = "zigbee_join_disabled";
-          hide_entity = "true";
-          trigger = [
-            {
-              platform = "event";
-              event_type = "timer.finished";
-              event_data.entity_id = "timer.zigbee_permit_join";
-            }
-            {
-              platform = "state";
-              entity_id = "switch.zigbee2mqtt_join";
-              to = "off";
-            }
-          ];
-          action = [
-            {
-              service = "timer.cancel";
-              data.entity_id = "timer.zigbee_permit_join";
-            }
-            {
-              service = "switch.turn_off";
-              entity_id = "switch.zigbee2mqtt_join";
-            }
-          ];
-        }
-      ];
-    };
-  };
-}

configs/hedgedoc.nix

@@ -1,25 +0,0 @@
-{
-  services.nginx.virtualHosts."pad.xn--kiern-0qa.de" = {
-    enableACME = true;
-    addSSL = true;
-    locations."/".extraConfig = ''
-      client_max_body_size 4G;
-      proxy_set_header Host $host;
-      proxy_pass http://localhost:3091;
-    '';
-  };
-
-  services.hedgedoc = {
-    enable = true;
-    configuration = {
-      allowAnonymous = false;
-      allowGravatar = false;
-      db = {
-        dialect = "sqlite";
-        storage = "/var/lib/codimd/db.codimd.sqlite";
-        useCDN = false;
-      };
-      port = 3091;
-    };
-  };
-}

configs/hledger.nix

@@ -1,14 +1,39 @@
-{ config, pkgs, ... }: {
-  imports = [ <niveum/modules/hledger.nix> ];
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = let
+    ledgerDirectory = "$HOME/projects/ledger";
+    timeLedger = "${ledgerDirectory}/time.timeclock";
+    git = "${pkgs.git}/bin/git -C ${ledgerDirectory}";
+  in [
+    pkgs.hledger
+    (pkgs.writers.writeDashBin "hora-edit" ''
+      $EDITOR + "${timeLedger}" && ${pkgs.git}/bin/git -C "$(${pkgs.coreutils}/bin/dirname ${timeLedger})" commit --all --message "$(${pkgs.coreutils}/bin/date -Im)"
+    '')
+    (pkgs.writers.writeDashBin "hora" ''
+      ${pkgs.hledger}/bin/hledger -f "${timeLedger}" "$@"
+    '')
+    (pkgs.writers.writeDashBin "hora-filli" ''
+      ${pkgs.hledger}/bin/hledger -f "${timeLedger}" register fillidefilla -O csv \
+        -b "$(date -d "$(date +%Y-%m)-01 last month" +%Y-%m-%d)" \
+        -e "$(date -d "$(date +%Y-%m)-01" +%Y-%m-%d)" \
+        | sed 's/(fillidefilla:\(.*\))/\1/g' \
+        | xsv select date,amount,total,account,description
+    '')
 
-  niveum.hledger = {
-    enable = true;
-    ledgerFile = "$HOME/projects/ledger/all.journal";
-    server = {
-      enable = false;
-      user = config.users.users.me;
-      package = pkgs.hledger-web;
-    };
-    package = pkgs.hledger;
-  };
+    (pkgs.writers.writeDashBin "hledger-git" ''
+      if [ "$1" = entry ]; then
+        ${pkgs.hledger}/bin/hledger balance -V > "${ledgerDirectory}/balance.txt"
+        ${git} add balance.txt
+        ${git} commit --all --message="$(date -Im)"
+      else
+        ${git} $*
+      fi
+    '')
+    (pkgs.writers.writeDashBin "hledger-edit" ''
+      $EDITOR ${ledgerDirectory}/current.journal
+    '')
+  ];
 }

configs/htop.nix

@@ -2,45 +2,28 @@
   home-manager.users.me = {
     programs.htop = {
       enable = true;
-      colorScheme = 0;
-      accountGuestInCpuMeter = true;
-      cpuCountFromZero = false;
-      delay = 15;
-      detailedCpuTime = false;
-      headerMargin = true;
-      hideKernelThreads = true;
-      hideThreads = true;
-      hideUserlandThreads = true;
-      highlightBaseName = true;
-      highlightMegabytes = true;
-      highlightThreads = true;
-      shadowOtherUsers = true;
-      showProgramPath = false;
-      showThreadNames = false;
-      sortDescending = true;
-      sortKey = "PERCENT_CPU";
-      treeView = true;
-      updateProcessNames = false;
-      meters = {
-        left = [
-          {
-            kind = "LeftCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "RightCPUs2";
-            mode = 1;
-          }
-          {
-            kind = "Memory";
-            mode = 1;
-          }
-          {
-            kind = "Swap";
-            mode = 1;
-          }
-        ];
-        right = [ "Uptime" "Tasks" "LoadAverage" "Battery" ];
+      settings = {
+        color_scheme = 0;
+        account_guest_in_cpu_meter = true;
+        cpu_count_from_zero = false;
+        delay = 15;
+        detailed_cpu_time = false;
+        header_margin = true;
+        hide_kernel_threads = true;
+        hide_threads = true;
+        hide_userland_threads = true;
+        highlight_base_name = true;
+        highlight_megabytes = true;
+        highlight_threads = true;
+        shadow_other_users = true;
+        show_program_path = false;
+        show_thread_names = false;
+        sort_descending = true;
+        sort_key = "PERCENT_CPU";
+        tree_view = false;
+        update_process_names = false;
+        right_meters = ["Uptime" "Tasks" "LoadAverage" "Battery"];
+        left_meters = ["LeftCPUs2" "RightCPUs2" "Memory" "Swap"];
       };
     };
   };

configs/hu-berlin.nix

@@ -1,47 +1,29 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (lib.strings) fileContents;
-  inherit (import <niveum/lib>) sshPort;
-  eduroam = {
-    identity = fileContents <secrets/eduroam/identity>;
-    password = fileContents <secrets/eduroam/password>;
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (import ../lib/email.nix) defaults;
+  hu-defaults = {
+    imap.host = "mailbox.cms.hu-berlin.de";
+    imap.port = 993;
+    smtp.host = "mailhost.cms.hu-berlin.de";
+    smtp.port = 25;
+    smtp.tls.useStartTls = true;
   };
-  eduroamAuth = ''
-    key_mgmt=WPA-EAP
-    eap=TTLS
-    proto=RSN
-    identity="${eduroam.identity}"
-    anonymous_identity="anonymous@wlan.hu-berlin.de"
-    altsubject_match="DNS:srv1-radius.cms.hu-berlin.de;DNS:srv2-radius.cms.hu-berlin.de"
-    password="${eduroam.password}"
-    ca_cert="${
-      pkgs.fetchurl {
-        url =
-          "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/t-telesec_globalroot_class_2.pem";
-        sha256 = "0if8aqd06sid7a0vw009zpa087wxcgdd2x6z2zs4pis5kvyqj2dk";
-      }
-    }"
-    phase2="auth=PAP"
-  '';
   hu-berlin-cifs-options = [
     "uid=${toString config.users.users.me.uid}"
     "gid=${toString config.users.groups.users.gid}"
     "sec=ntlmv2"
     "workgroup=german"
-    "username=meinhaki"
-    "password=${lib.strings.fileContents <secrets/mail/meinhaki>}"
+    "credentials=${config.age.secrets.cifs-credentials-hu-berlin.path}"
     "noauto"
-    "x-systemd.requires=hu-vpn.service"
     "x-systemd.automount"
     "x-systemd.device-timeout=1"
     "x-systemd.idle-timeout=1min"
   ];
 in {
-  networking.wireless.networks = {
-    eduroam_5GHz.auth = eduroamAuth;
-    eduroam.auth = eduroamAuth;
-  };
-
   fileSystems."/media/hu-berlin/germpro2" = {
     device = "//hugerm31c.user.hu-berlin.de/germpro2/ling";
     fsType = "cifs";
@@ -54,39 +36,165 @@ in {
     options = hu-berlin-cifs-options;
   };
 
+  age.secrets = {
+    cifs-credentials-hu-berlin.file = ../secrets/cifs-credentials-hu-berlin.age;
+    email-password-meinhark = {
+      file = ../secrets/email-password-meinhark.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    email-password-meinhaki = {
+      file = ../secrets/email-password-meinhaki.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    email-password-dslalewa = {
+      file = ../secrets/email-password-dslalewa.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    email-password-fsklassp = {
+      file = ../secrets/email-password-fsklassp.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  home-manager.users.me = {
+    programs.ssh = {
+      matchBlocks = {
+        "gruenau6.informatik.hu-berlin.de" = {
+          hostname = "gruenau6.informatik.hu-berlin.de";
+          user = "meinhark";
+          setEnv.TERM = "xterm";
+        };
+        "alew.hu-berlin.de" = {
+          user = "centos";
+          hostname = "141.20.187.219";
+        };
+      };
+    };
+
+    accounts.email.accounts = rec {
+      hu-student =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate hu-defaults
+          rec {
+            userName = "meinhark";
+            address = "kieran.felix.meinhardt@hu-berlin.de";
+            aliases = ["${userName}@hu-berlin.de"];
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
+          });
+      hu-student-cs =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate hu-defaults
+          rec {
+            userName = "meinhark";
+            address = "kieran.felix.meinhardt@informatik.hu-berlin.de";
+            aliases = ["${userName}@informatik.hu-berlin.de"];
+            imap.host = "mailbox.informatik.hu-berlin.de";
+            smtp.host = "mailhost.informatik.hu-berlin.de";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
+          });
+      hu-employee =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate hu-defaults
+          rec {
+            userName = "meinhaki";
+            address = "kieran.meinhardt@hu-berlin.de";
+            aliases = ["${userName}@hu-berlin.de"];
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhaki.path}";
+            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
+            signature = {
+              showSignature = "append";
+              text = ''
+                ${defaults.realName}
+                Studentische Hilfskraft / Administrator ALEW
+                Humboldt-Universität zu Berlin
+
+                Telefon: +49 (0)30 2093 9634
+                Raum 3.212, Dorotheenstraße 24, 10117 Berlin-Mitte
+                https://alew.hu-berlin.de
+              '';
+            };
+          });
+      hu-admin =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate hu-defaults
+          rec {
+            userName = "dslalewa";
+            address = "admin.alew.vglsprwi@hu-berlin.de";
+            aliases = ["${userName}@hu-berlin.de"];
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-dslalewa.path}";
+            inherit (hu-employee) signature;
+            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
+          });
+      hu-fsi =
+        lib.recursiveUpdate defaults
+        (lib.recursiveUpdate hu-defaults
+          rec {
+            userName = "fsklassp";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fsklassp.path}";
+            address = "${userName}@hu-berlin.de";
+            realName = "FSI Klassische Philologie";
+            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
+            signature = {
+              showSignature = "append";
+              text = ''
+                Fachschafts-Initiative
+
+                Humboldt-Universität zu Berlin
+                Sprach- und literaturwissenschaftliche Fakultät
+                Institut für klassische Philologie
+                Unter den Linden 6
+                10099 Berlin
+              '';
+            };
+          });
+    };
+  };
+
   environment.systemPackages = [
     (pkgs.writers.writeDashBin "hu-ip" ''
       ${pkgs.w3m}/bin/w3m -dump meineip.hu-berlin.de | head --lines=-4 | tail --lines=+3
     '')
+    (
+      pkgs.writers.writePython3Bin "hu-eduroam-install"
+      {
+        libraries = with pkgs.python3Packages; [distro pyopenssl dbus-python];
+        flakeIgnore = ["E501" "E123" "W504" "E722" "F821" "E226" "E126" "E265" "W291"];
+      }
+      (builtins.readFile (builtins.fetchurl {
+        url = "https://www.cms.hu-berlin.de/de/dl/netze/wlan/config/eduroam/linux-installer/eduroam-linux-hub.py";
+        sha256 = "19x2kvwxx13265b2hj5fjf53g0liw6dw7xf9j9cav67cswmz60kf";
+      }))
+    )
   ];
 
+  # ref https://github.com/NixOS/nixpkgs/issues/231038#issuecomment-1591888919
+  environment.etc."ppp/options".text = "ipcp-accept-remote";
+
   systemd.services.hu-vpn = {
     enable = true;
-    wants = [ "network-online.target" ];
-    conflicts = [ "openvpn-hu-berlin.service" ];
+    wants = ["network-online.target"];
+    serviceConfig.LoadCredential = "password:${config.age.secrets.email-password-meinhark.path}";
     script = ''
-      ${pkgs.openfortivpn}/bin/openfortivpn -c ${pkgs.writeText "hu-berlin.config" ''
-        host = forti-ssl.vpn.hu-berlin.de
-        port = 443
-        trusted-cert = 42193a913d276d9eb86217612956e1e6464d6f07bed5393a4787c87adc4bd359
-        username = ${eduroam.identity}
-        password = ${eduroam.password}
-      ''}
+      if ${pkgs.wirelesstools}/bin/iwgetid | ${pkgs.gnugrep}/bin/grep --invert-match eduroam
+      then
+        ${pkgs.openfortivpn}/bin/openfortivpn \
+          --password="$(cat "$CREDENTIALS_DIRECTORY/password")" \
+          --config=${
+        pkgs.writeText "hu-berlin.config" ''
+          host = forti-ssl.vpn.hu-berlin.de
+          port = 443
+          username = meinhark
+        ''
+      }
+      fi
     '';
   };
-
-  systemd.services.openvpn-hu-berlin.conflicts = [ "hu-vpn.service" ];
-
-  services.openvpn.servers.hu-berlin = {
-    autoStart = false;
-    authUserPass = {
-      username = eduroam.identity;
-      password = eduroam.password;
-    };
-    config = fileContents (pkgs.fetchurl {
-      url =
-        "https://www.cms.hu-berlin.de/de/dl/netze/vpn/openvpn/hu-berlin.ovpn";
-      sha256 = "15b55aibik5460svjq2gwxrcyh6ay4k8savd6cd5lncgndmd8p8h";
-    });
-  };
 }

configs/i3.nix

@@ -1,14 +1,28 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) defaultApplications colours;
-  klem = import <niveum/packages/scripts/klem.nix> {
-    inherit pkgs lib;
+{
+  config,
+  pkgs,
+  lib,
+  niveumPackages,
+  ...
+}: let
+  inherit (import ../lib) defaultApplications;
+  klem = niveumPackages.klem.override {
+    config.dmenu = "${pkgs.dmenu}/bin/dmenu -i -p klem";
     config.scripts = {
       "p.r" = pkgs.writers.writeDash "p.r" ''
         ${pkgs.curl}/bin/curl -fSs http://p.r --data-binary @- \
           | ${pkgs.coreutils}/bin/tail --lines=1 \
           | ${pkgs.gnused}/bin/sed 's/\\<r\\>/krebsco.de/'
       '';
+      # "envs.sh host" = pkgs.writers.writeDash "envs-host" ''
+      #   ${pkgs.curl}/bin/curl -F "file=$(${pkgs.coreutils}/bin/cat)" https://envs.sh
+      # '';
+      "envs.sh mirror" = pkgs.writers.writeDash "envs-mirror" ''
+        ${pkgs.curl}/bin/curl -F "url=$(${pkgs.coreutils}/bin/cat)" https://envs.sh
+      '';
+      "envs.sh shorten" = pkgs.writers.writeDash "envs-shorten" ''
+        ${pkgs.curl}/bin/curl -F "shorten=$(${pkgs.coreutils}/bin/cat)" https://envs.sh
+      '';
       "ix.io" = pkgs.writers.writeDash "ix.io" ''
         ${pkgs.curl}/bin/curl -fSs -F 'f:1=<-' ix.io
       '';
@@ -22,13 +36,22 @@ let
         ${pkgs.coreutils}/bin/tr '[A-Za-z]' '[N-ZA-Mn-za-m]'
       '';
       "ipa" = pkgs.writers.writeDash "ipa" ''
-        ${pkgs.scripts.ipa}/bin/ipa
+        ${niveumPackages.ipa}/bin/ipa
       '';
       "betacode" = pkgs.writers.writeDash "betacode" ''
-        ${pkgs.scripts.betacode}/bin/betacode
+        ${niveumPackages.betacode}/bin/betacode
       '';
-      "devanagari" = pkgs.writers.writeDash "devanagari" ''
-        ${pkgs.scripts.devanagari}/bin/devanagari
+      "curl" = pkgs.writers.writeDash "curl" ''
+        ${pkgs.curl}/bin/curl -fSs "$(${pkgs.coreutils}/bin/cat)"
+      '';
+      ocr = pkgs.writers.writeDash "ocr" ''
+        ${pkgs.tesseract4}/bin/tesseract -l eng+deu - stdout
+      '';
+      emojai = pkgs.writers.writeDash "emojai" ''
+        ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
+      '';
+      gpt = pkgs.writers.writeDash "gpt" ''
+        ${niveumPackages.gpt}/bin/gpt
       '';
     };
   };
@@ -39,51 +62,24 @@ let
   move-to-new-workspace = pkgs.writers.writeDash "new-workspace" ''
     i3-msg move container to workspace $(($(i3-msg -t get_workspaces | tr , '\n' | grep '"num":' | cut -d : -f 2 | sort -rn | head -1) + 1))
   '';
-
-  # https://github.com/LukeSmithxyz/voidrice/blob/9fe6802122f6e0392c7fe20eefd30437771d7f8e/.local/bin/dmenuunicode
-  emoji-menu = let
-    emoji-file = pkgs.fetchurl {
-      url =
-        "https://raw.githubusercontent.com/LukeSmithxyz/voidrice/master/.local/share/larbs/emoji";
-      sha256 = "03fv69ah8msh2j6i3lm4sdkckqq8jwn1kj43j98dh0xjpzazsy46";
-    };
-    kaomoji-file = pkgs.writeText "kaomoji.txt" ''
-      ¯\(°_o)/¯ dunno lol shrug dlol
-      ¯\_(ツ)_/¯ dunno lol shrug dlol
-      ( ͡° ͜ʖ ͡°) lenny
-      ¯\_( ͡° ͜ʖ ͡°)_/¯ lenny shrug dlol
-      ( ﾟдﾟ) aaah sad noo
-      ヽ(^o^)丿 hi yay hello
-      (^o^: ups hehe
-      (^∇^) yay
-      ┗(｀皿´)┛ angry argh
-      ヾ(^_^) byebye!! bye
-      <(^.^<) <(^.^)> (>^.^)> (7^.^)7 (>^.^<) dance
-      (-.-)Zzz... sleep
-      (∩╹□╹∩) oh noes woot
-      (╯°□°）╯ ┻━┻ table flip
-      (」゜ロ゜)」 why woot
-      (_゜_゜_) gloom I see you
-      ༼ ༎ຶ ෴ ༎ຶ༽ sad
-      (\/) (°,,,,°) (\/) krebs
-    '';
-  in with pkgs;
-  writers.writeDashBin "emoji-menu" ''
-    PATH=${lib.makeBinPath [ coreutils dmenu gnused libnotify xclip xdotool ]}
-    chosen=$(cat ${emoji-file} ${kaomoji-file} | cut -d ';' -f1 | dmenu -i -l 10 | sed "s/ .*//")
-
-    [ "$chosen" != "" ] || exit
-
-    echo "$chosen" | tr -d '\n' | xclip -selection clipboard
-
-    if [ -n "$1" ]; then
-      xdotool key Shift+Insert
-    else
-      notify-send --app-name="emoji-menu" "'$chosen' copied to clipboard." &
-    fi
-  '';
-
 in {
+  age.secrets = {
+    github-token-i3status-rust = {
+      file = ../secrets/github-token-i3status-rust.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    openweathermap-api-key = {
+      file = ../secrets/openweathermap-api-key.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  programs.slock.enable = true;
+
   services.xserver = {
     displayManager.defaultSession = "none+i3";
     windowManager.i3 = {
@@ -107,26 +103,34 @@ in {
     '';
   };
 
-  home-manager.users.me.xsession.windowManager.i3 = {
+  home-manager.users.me.xsession.windowManager.i3 = let
+    modifier = "Mod4";
+  in {
     enable = true;
+    extraConfig = ''
+      bindsym --release ${modifier}+Shift+w exec /run/wrappers/bin/slock
+    '';
     config = rec {
-      fonts = [ "Monospace 10" ];
-      modifier = "Mod4";
+      inherit modifier;
       window = {
         titlebar = false;
-        border = 1;
+        border = 2;
         hideEdgeBorders = "smart";
         commands = [
           {
-            criteria = { class = "floating"; };
+            criteria = {class = "floating";};
             command = "floating enable";
           }
           {
-            criteria = { class = "fzfmenu"; };
+            criteria = {class = "fzfmenu";};
             command = "floating enable";
           }
           {
-            criteria = { class = "mpv"; };
+            criteria = {class = ".*";};
+            command = "border pixel 2";
+          }
+          {
+            criteria = {class = "mpv";};
             command = lib.strings.concatStringsSep ", " [
               "floating enable"
               "sticky enable"
@@ -142,57 +146,31 @@ in {
         titlebar = false;
         border = 1;
       };
+      bars = [
+        (config.home-manager.users.me.lib.stylix.i3.bar
+          // rec {
+            workspaceButtons = false;
+            mode = "dock"; # "hide";
+            position = "bottom";
+            statusCommand = toString (pkgs.writers.writeDash "i3status-rust" ''
+              export I3RS_GITHUB_TOKEN="$(cat ${config.age.secrets.github-token-i3status-rust.path})"
+              export OPENWEATHERMAP_API_KEY="$(cat ${config.age.secrets.openweathermap-api-key.path})"
+              ${config.home-manager.users.me.programs.i3status-rust.package}/bin/i3status-rs ${config.home-manager.users.me.home.homeDirectory}/.config/i3status-rust/config-${position}.toml
+            '');
+            fonts = {
+              names = ["${config.stylix.fonts.sansSerif.name}" "FontAwesome 6 Free"];
+              size = config.stylix.fonts.sizes.desktop * 0.8;
+            };
+          })
+      ];
       colors = let
-        scheme = {
-          background = colours.background;
-          text = colours.foreground;
-        };
-      in rec {
-        focused = scheme // {
-          border = colours.foreground;
-          indicator = colours.foreground;
-          childBorder = colours.foreground;
-        };
-        unfocused = scheme // {
-          border = colours.background;
-          indicator = colours.background;
-          childBorder = colours.background;
-        };
-        focusedInactive = unfocused;
-        urgent = scheme // {
-          border = colours.red.bright;
-          indicator = colours.red.bright;
-          childBorder = colours.red.bright;
-        };
-        placeholder = scheme // {
-          border = colours.green.bright;
-          indicator = colours.green.bright;
-          childBorder = colours.green.bright;
+        background = config.lib.stylix.colors.withHashtag.base00;
+      in {
+        unfocused = {
+          border = lib.mkForce background;
+          childBorder = lib.mkForce background;
         };
       };
-      bars = [{
-        workspaceButtons = false;
-        fonts = [ "Monospace 8" ];
-        mode = "hide"; # "dock"
-        position = "bottom";
-        colors = rec {
-          background = colours.background;
-          separator = background;
-          statusline = colours.foreground;
-          bindingMode = {
-            background = colours.red.bright;
-            border = colours.background;
-            text = colours.foreground;
-          };
-        };
-        statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs ${
-            pkgs.writeTOML (import <niveum/lib/i3status-rust.nix> {
-              inherit (config.niveum) batteryName wirelessInterface;
-              inherit colours;
-              inherit pkgs;
-            })
-          }";
-      }];
       modes.resize = {
         "Escape" = ''mode "default"'';
         "Return" = ''mode "default"'';
@@ -213,78 +191,66 @@ in {
 
         "${modifier}+Shift+b" = "move window to workspace prev";
         "${modifier}+Shift+n" = "move window to workspace next";
-        "${modifier}+Shift+x" = "exec --no-startup-id ${move-to-new-workspace}";
+        "${modifier}+Shift+x" = "exec ${move-to-new-workspace}";
         "${modifier}+b" = "workspace prev";
         "${modifier}+n" = "workspace next";
-        "${modifier}+x" = "exec --no-startup-id ${new-workspace}";
+        "${modifier}+x" = "exec ${new-workspace}";
 
         "${modifier}+Shift+c" = "reload";
         "${modifier}+Shift+q" = "kill";
         "${modifier}+Shift+r" = "restart";
 
-        "${modifier}+Shift+s" = "sticky toggle";
+        "${modifier}+z" = "sticky toggle";
         "${modifier}+Shift+z" = "floating toggle";
+
+        "${modifier}+s" = "scratchpad show";
+        "${modifier}+Shift+s" = "move scratchpad";
+
         "${modifier}+c" = "split h";
         "${modifier}+e" = "layout toggle split";
         "${modifier}+f" = "fullscreen toggle";
         "${modifier}+r" = "mode resize";
-        "${modifier}+s" = "layout stacking";
         "${modifier}+v" = "split v";
         "${modifier}+w" = "layout tabbed";
+        "${modifier}+q" = "exec ${config.services.clipmenu.package}/bin/clipmenu";
 
-        # "${modifier}+Shift+y" = "exec ${pkgs.qutebrowser}/bin/qutebrowser";
         "${modifier}+Return" = "exec ${(defaultApplications pkgs).terminal}";
         "${modifier}+t" = "exec ${(defaultApplications pkgs).fileManager}";
         "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
+        "${modifier}+0" = "exec ${niveumPackages.menu-calc}/bin/=";
 
-        "${modifier}+Shift+w" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
-        "${modifier}+a" =
-          "exec --no-startup-id ${pkgs.rofi}/bin/rofi -display-window — -show window";
-        "${modifier}+d" = "exec --no-startup-id ${pkgs.dmenu}/bin/dmenu_run";
-        "${modifier}+Shift+d" = "exec ${
-            pkgs.writers.writeDash "notemenu" ''
-              set -efu
-              PATH=$PATH:${
-                lib.makeBinPath [ pkgs.dmenu pkgs.findutils pkgs.coreutils ]
-              }
+        "${modifier}+d" = "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
+        "${modifier}+Shift+d" = "exec ${niveumPackages.notemenu}/bin/notemenu";
+        "${modifier}+p" = "exec rofi-pass";
+        "${modifier}+Shift+p" = "exec rofi-pass --insert";
+        "${modifier}+u" = "exec ${niveumPackages.unicodmenu}/bin/unicodmenu";
 
-              cd ~/notes
-              note_file=$(find . -type f -printf "%T@ %p\n" | sort --reverse --numeric-sort | cut --delimiter=" " --fields=2 | dmenu -i)
-              if test "$note_file"
-              then
-                i3-sensible-terminal -e "$EDITOR" "$note_file"
-              fi
-            ''
-          }";
-        "${modifier}+p" = "exec --no-startup-id ${pkgs.pass}/bin/passmenu -l 5";
-        "${modifier}+u" = "exec ${emoji-menu}/bin/emoji-menu";
-
-        "${modifier}+F7" = "exec ${pkgs.scripts.showkeys-toggle}/bin/showkeys-toggle";
-        "${modifier}+F8" = "exec ${pkgs.xorg.xkill}/bin/xkill";
+        "${modifier}+F6" = "exec ${pkgs.xorg.xkill}/bin/xkill";
+        "${modifier}+F7" = "exec ${pkgs.writers.writeDash "showkeys-toggle" ''
+          if ${pkgs.procps}/bin/pgrep screenkey; then
+            exec ${pkgs.procps}/bin/pkill screenkey
+          else
+            exec ${pkgs.screenkey}/bin/screenkey
+          fi
+        ''}";
+        "${modifier}+F8" = "exec switch-theme toggle";
         "${modifier}+F9" = "exec ${pkgs.redshift}/bin/redshift -O 4000 -b 0.85";
         "${modifier}+F10" = "exec ${pkgs.redshift}/bin/redshift -x";
         "${modifier}+F11" = "exec ${pkgs.xcalib}/bin/xcalib -invert -alter";
         "${modifier}+F12" = "exec ${klem}/bin/klem";
+        "Print" = "exec flameshot gui";
+        "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
+        "XF86AudioMute" = "exec ${pkgs.pamixer}/bin/pamixer -t";
+        "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
+        "XF86Calculator" = "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
+        "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
+        "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
+        "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
+        "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
+        "XF86AudioStop" = "exec ${pkgs.playerctl}/bin/playerctl stop";
+        "XF86ScreenSaver" = "exec ${niveumPackages.k-lock}/bin/k-lock";
 
-        "Print" = "exec flameshot-once";
-        "XF86AudioLowerVolume" =
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -d 5";
-        "XF86AudioMute" = "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -t";
-        "XF86AudioRaiseVolume" =
-          "exec --no-startup-id ${pkgs.pamixer}/bin/pamixer -i 5";
-        "XF86Calculator" =
-          "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
-        "XF86AudioPause" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl pause";
-        "XF86AudioPlay" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioNext" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl next";
-        "XF86AudioPrev" =
-          "exec --no-startup-id ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86ScreenSaver" = "exec ${pkgs.scripts.k-lock}/bin/k-lock";
-
-        "XF86Display" = "exec ${pkgs.scripts.dmenurandr}/bin/dmenurandr";
+        "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenu-randr";
 
         # key names detected with xorg.xev:
         # XF86WakeUp (fn twice)

configs/i3status-rust.nix

@@ -0,0 +1,175 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  home-manager.users.me = {
+    programs.i3status-rust = {
+      enable = true;
+      bars.bottom = {
+        icons = "awesome6";
+        settings = {
+          theme.overrides = let
+            colours = config.lib.stylix.colors.withHashtag;
+          in {
+            idle_bg = colours.base00;
+            idle_fg = colours.base05;
+            good_bg = colours.base00;
+            good_fg = colours.base0B;
+            warning_bg = colours.base00;
+            warning_fg = colours.base0A;
+            critical_bg = colours.base00;
+            critical_fg = colours.base09;
+            info_bg = colours.base00;
+            info_fg = colours.base04;
+            separator_bg = colours.base00;
+            separator = " ";
+          };
+        };
+        blocks = [
+          {
+            block = "weather";
+            autolocate = true;
+            format = "$icon $location: $temp";
+            service = {
+              name = "openweathermap";
+              city_id = "2950159";
+              units = "metric";
+            };
+          }
+          {
+            block = "custom";
+            interval = 60 * 5;
+            command = let
+              spacetime = import ../configs/spacetime.nix;
+            in
+              pkgs.writers.writePython3 "sun.py" {
+                libraries = [pkgs.python3Packages.astral];
+                flakeIgnore = ["E121" "E501"];
+              }
+              ''
+                import astral
+                import astral.moon
+                import astral.sun
+
+                current_phase = astral.moon.phase()
+
+                city = astral.LocationInfo("Berlin", "Germany", "${spacetime.time.timeZone}", ${toString spacetime.location.latitude}, ${toString spacetime.location.longitude})
+                sun = astral.sun.sun(city.observer, date=astral.today(), tzinfo=city.timezone)
+
+                print("↑{} ↓{} {}{}".format(sun["sunrise"].strftime("%R"), sun["sunset"].strftime("%R"), "☽" if current_phase < 14 else "☾", round(current_phase, 1)))
+              '';
+          }
+          {
+            block = "github";
+            info = ["total"];
+            warning = ["mention" "review_requested" "team_mention" "manual" "invitation" "assign" "subscribed"];
+          }
+          {
+            block = "custom";
+            interval = 10;
+            command = pkgs.writers.writeDash "todo" ''
+              ${pkgs.todoman}/bin/todo --porcelain | ${pkgs.jq}/bin/jq -r '
+                map(select(.due != null))
+                | (map(select(.due < now)) | length) as $overdue
+                | (map(select(.due >= now and .due < now + (60 * 60 * 24))) | length) as $dueToday
+                | {
+                  icon: "tasks",
+                  text: (($overdue + $dueToday) as $sum | if $sum > 0 then $sum | tostring else "" end),
+                  state: (
+                    if $overdue > 0 then
+                      "Critical"
+                    elif $dueToday > 0 then
+                      "Warning"
+                    else
+                      "Idle"
+                    end
+                  )
+                }
+              '
+            '';
+            json = true;
+            hide_when_empty = true;
+          }
+          {
+            block = "custom";
+            interval = 60;
+            command = pkgs.writers.writeDash "weechat" ''
+              ssh -o ConnectTimeout=1 makanek cat /var/lib/weechat/hotlist.txt | sed 's/,/\n/g' | wc -l | jq '{
+                text: (if . > 0 then . | tostring else "" end),
+                state: (if . > 0 then "Info" else "Idle" end),
+                icon: "bell"
+              }'
+            '';
+            json = true;
+            hide_when_empty = true;
+          }
+          {
+            block = "net";
+            format = " $icon HU";
+            missing_format = "";
+            device = "ppp0";
+          }
+          {
+            block = "net";
+            format = " $icon FU";
+            missing_format = "";
+            device = "tun0";
+          }
+          {
+            block = "net";
+            device = config.niveum.wirelessInterface;
+            format = "$icon $ssid $signal_strength";
+          }
+          {
+            block = "battery";
+            device = config.niveum.batteryName;
+          }
+          {
+            block = "sound";
+          }
+          {
+            block = "disk_space";
+            format = "$icon $available";
+          }
+          {
+            block = "memory";
+            format = "$icon $mem_used.eng(prefix:G)";
+          }
+          {block = "load";}
+          {
+            block = "custom";
+            interval = 10;
+            json = true;
+            command = pkgs.writers.writeDash "time" ''
+              ${pkgs.jq}/bin/jq -n \
+                --arg now "$(${pkgs.coreutils}/bin/date +'%Y-%m-%d (%W %a) %H:%M')" \
+                --argjson nextEvent "$(
+                  ${pkgs.khal}/bin/khal list --format "{start}" --day-format "" $(${pkgs.coreutils}/bin/date +'%Y-%m-%d %H:%M') 2>/dev/null \
+                  | ${pkgs.gnugrep}/bin/grep -E '[0-9]{2}:[0-9]{2}' \
+                  | ${pkgs.coreutils}/bin/head -1 \
+                  | ${pkgs.coreutils}/bin/date --date="$(cat)" +%s
+                )" \
+                '{
+                  text: $now,
+                  icon: "time",
+                  state: (
+                    ($nextEvent - now) as $deltaT
+                    | if $deltaT < (5 * 60) then
+                      "Critical"
+                    elif $deltaT < (15 * 60) then
+                      "Warning"
+                    elif $deltaT < (60 * 60) then
+                      "Info"
+                    else
+                      "Idle"
+                    end
+                  )
+                }'
+            '';
+          }
+        ];
+      };
+    };
+  };
+}

configs/kdeconnect.nix

@@ -1,13 +1,17 @@
 {
   networking.firewall = {
-    allowedTCPPortRanges = [{
-      from = 1714;
-      to = 1764;
-    }];
-    allowedUDPPortRanges = [{
-      from = 1714;
-      to = 1764;
-    }];
+    allowedTCPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
   };
 
   home-manager.users.me = {

configs/keybase.nix

@@ -1,8 +0,0 @@
-{ config, ... }: {
-  services.keybase.enable = true;
-
-  services.kbfs = {
-    enable = true;
-    mountPoint = "%h/cloud/keybase";
-  };
-}

configs/keyboard.nix

@@ -1,17 +1,83 @@
-{ pkgs, lib, ... }:
-let commaSep = builtins.concatStringsSep ",";
+{
+  pkgs,
+  lib,
+  ...
+}: let
+  commaSep = builtins.concatStringsSep ",";
+  xkbOptions = ["compose:caps" "terminate:ctrl_alt_bksp" "grp:ctrls_toggle"];
+  languages = {
+    de = "T3";
+    gr = "polytonic";
+    ru = "phonetic";
+    ara = "buckwalter";
+    cop = "";
+    ave = "";
+    got = "";
+    "in" = "san-kagapa";
+    il = "phonetic";
+  };
+  defaultLanguage = "de";
 in {
+  # man 7 xkeyboard-config
   services.xserver = {
-    layout = commaSep [ "de" "gr" ];
-    xkbVariant = commaSep [ "T3" "polytonic" ];
-    xkbOptions =
-      commaSep [ "compose:caps" "terminate:ctrl_alt_bksp" "grp:ctrls_toggle" ];
+    layout = "de";
+    # T3: https://upload.wikimedia.org/wikipedia/commons/a/a9/German-Keyboard-Layout-T3-Version1-large.png
+    # buckwalter: http://www.qamus.org/transliteration.htm
+    xkbVariant = "T3";
+    xkbOptions = commaSep xkbOptions;
     libinput.enable = true;
+    xkbDir = pkgs.symlinkJoin {
+      name = "x-keyboard-directory";
+      paths = [
+        "${pkgs.xkeyboard_config}/etc/X11/xkb"
+        (pkgs.linkFarm "custom-x-keyboards" [
+          {
+            name = "symbols/cop";
+            path = pkgs.fetchurl {
+              url = "http://www.moheb.de/download/cop";
+              sha256 = "1l0h6aq536hyinrh0i0ia355y229bjrlibii0sya5bmqh46vycia";
+            };
+          }
+          {
+            name = "symbols/got";
+            path = pkgs.fetchurl {
+              url = "https://c.krebsco.de/got";
+              sha256 = "1i0jxghxi3rldlijw6gm2xawrv7f0pmm7a5cqbzzgjrg7ldk46gd";
+            };
+          }
+          {
+            name = "symbols/ave";
+            path = pkgs.fetchurl {
+              url = "https://blog.simos.info/wp-content/uploads/2010/06/avestan.txt";
+              sha256 = "192zmmm3gxyhim39dsax7r87gsay2w5v2xkhwmvsfipjb60hwp5g";
+            };
+          }
+        ])
+      ];
+    };
   };
 
   console.keyMap = "de";
 
+  environment.systemPackages =
+    lib.mapAttrsToList
+    (language: variant:
+      pkgs.writers.writeDashBin "kb-${language}" ''
+        ${pkgs.xorg.setxkbmap}/bin/setxkbmap ${defaultLanguage},${language} ${languages.${defaultLanguage}},${variant} ${toString (map (option: "-option ${option}") xkbOptions)}
+      '')
+    languages;
+
   # improve held key rate
-  services.xserver.displayManager.sessionCommands =
-    "${pkgs.xorg.xset}/bin/xset r rate 300 50";
+  services.xserver.displayManager.sessionCommands = "${pkgs.xorg.xset}/bin/xset r rate 300 50";
+
+  systemd.user.services.gxkb = {
+    wantedBy = ["graphical-session.target"];
+    serviceConfig = {
+      SyslogIdentifier = "gxkb";
+      ExecStart = "${pkgs.gxkb}/bin/gxkb";
+      Restart = "always";
+      RestartSec = "15s";
+      StartLimitBurst = 0;
+    };
+  };
 }

configs/khal.nix

@@ -0,0 +1,216 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  davHome = "~/.local/share/dav";
+  kmeinCloud = {
+    davEndpoint = "https://cloud.kmein.de/remote.php/dav";
+    username = "kieran";
+    passwordFile = config.age.secrets.nextcloud-password-kieran.path;
+  };
+  fysiCloud = {
+    davEndpoint = "https://nextcloud.fysi.dev/remote.php/dav";
+    username = "kmein";
+    passwordFile = config.age.secrets.nextcloud-password-fysi.path;
+  };
+in {
+  age.secrets = {
+    nextcloud-password-kieran = {
+      file = ../secrets/nextcloud-password-kieran.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+    nextcloud-password-fysi = {
+      file = ../secrets/nextcloud-password-fysi.age;
+      owner = config.users.users.me.name;
+      group = config.users.users.me.group;
+      mode = "400";
+    };
+  };
+
+  environment.systemPackages = [
+    pkgs.khal
+    pkgs.vdirsyncer
+    pkgs.khard
+    pkgs.todoman
+    (pkgs.writers.writeDashBin "todo-procrastinate" ''
+      [ $# -eq 1 ] || {
+        echo "Usage: $0 TODO_ID" >&2
+        exit 1
+      }
+      todo_id=$1
+      new_timestamp=$(${pkgs.todoman}/bin/todo --porcelain show "$todo_id" | ${pkgs.jq}/bin/jq '.due + 24 * 60 * 60')
+      new_date=$(${pkgs.coreutils}/bin/date +"%Y-%m-%d %H:%M" -d "@$new_timestamp")
+      ${pkgs.todoman}/bin/todo edit "$todo_id" --due "$new_date"
+    '')
+  ];
+
+  systemd.user.services.vdirsyncer = {
+    enable = true;
+    wants = ["network-online.target"];
+    wantedBy = ["default.target"];
+    startAt = "*:00/10";
+    script = ''
+      ${pkgs.vdirsyncer}/bin/vdirsyncer sync && ${pkgs.khal}/bin/khal printcalendars # https://lostpackets.de/khal/configure.html#syncing
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      Restart = "on-failure";
+    };
+  };
+
+  home-manager.users.me = {
+    xdg.configFile = {
+      "khard/khard.conf".text = ''
+        [addressbooks]
+        [[contacts]]
+        path = ${davHome}/contacts/contacts/
+
+        [general]
+        debug = no
+        default_action = list
+        editor = ${config.environment.variables.EDITOR}
+        merge_editor = ${pkgs.vim}/bin/vimdiff
+
+        [contact table]
+        display = first_name
+        group_by_addressbook = no
+        reverse = no
+        show_nicknames = no
+        show_uids = no
+        sort = last_name
+        localize_dates = yes
+        preferred_phone_number_type = pref, cell, home
+        preferred_email_address_type = pref, work, home
+
+        [vcard]
+        search_in_source_files = no
+        skip_unparsable = no
+      '';
+
+      "todoman/config.py".text = ''
+        path = "${davHome}/calendar/*"
+        date_format = "%Y-%m-%d"
+        time_format = "%H:%M"
+        default_due = 0
+        default_list = "Personal"
+        startable = True
+      '';
+
+      "khal/config".text = ''
+        [calendars]
+
+        [[alew]]
+        path = ${davHome}/calendar/alew
+        color = "light gray"
+
+        [[personal]]
+        path = ${davHome}/calendar/personal
+        color = "light cyan"
+
+        [[krebs]]
+        path = ${davHome}/calendar/krebs
+        color = "light red"
+
+        [[uni]]
+        path = ${davHome}/calendar/uni-1
+        color = "yellow"
+
+        [[fysi]]
+        path = ${davHome}/calendar/fysi-1
+        color = "light magenta"
+
+        [[fysi_team]]
+        path = ${davHome}/calendar/personal_shared_by_fdf
+        color = "light red"
+
+        [[birthdays]]
+        path = ${davHome}/contacts/contacts
+        type = birthdays
+        color = "light green"
+
+        [default]
+        highlight_event_days = True
+        timedelta = 5d
+        print_new = path
+        default_calendar = personal
+
+        [locale]
+        timeformat = %H:%M
+        dateformat = %Y-%m-%d
+        longdateformat = %Y-%m-%d
+        datetimeformat = %Y-%m-%d %H:%M
+        longdatetimeformat = %Y-%m-%d %H:%M
+        local_timezone = ${config.time.timeZone}
+        default_timezone = ${config.time.timeZone}
+        weeknumbers = left
+      '';
+
+      "vdirsyncer/config".text = ''
+        [general]
+        status_path = "~/.local/share/vdirsyncer/status/"
+
+        [pair kontakte]
+        a = "kontakte_local"
+        b = "kontakte_cloud"
+        collections = ["contacts"]
+        conflict_resolution = "b wins"
+
+        [pair kalender]
+        a = "kalender_local"
+        b = "kalender_cloud"
+        collections = ["personal", "alew", "uni-1"]
+        conflict_resolution = "b wins"
+
+        [pair krebs]
+        a = "kalender_local"
+        b = "krebs_cloud"
+        collections = ["3edef929-d509-7944-2440-000a54f2d054"]
+        conflict_resolution = "b wins"
+
+        [pair fysi]
+        a = "kalender_local"
+        b = "fysi_cloud"
+        collections = ["fysi-1", "personal_shared_by_fdf"]
+        conflict_resolution = "b wins"
+
+        [storage kontakte_local]
+        type = "filesystem"
+        path = "${davHome}/contacts/"
+        fileext = ".vcf"
+
+        [storage kalender_local]
+        type = "filesystem"
+        path = "${davHome}/calendar/"
+        fileext = ".ics"
+
+        [storage kontakte_cloud]
+        type = "carddav"
+        url = "${kmeinCloud.davEndpoint}/addressbooks/users/${kmeinCloud.username}/"
+        username = "${kmeinCloud.username}"
+        password.fetch = ["command", "cat", "${kmeinCloud.passwordFile}"]
+
+        [storage kalender_cloud]
+        type = "caldav"
+        url = "${kmeinCloud.davEndpoint}/calendars/${kmeinCloud.username}/"
+        username = "${kmeinCloud.username}"
+        password.fetch = ["command", "cat", "${kmeinCloud.passwordFile}"]
+
+        [storage krebs_cloud]
+        type = "caldav"
+        url = "http://calendar.r/krebs/"
+        username = "krebs"
+        password = "krebs"
+
+        [storage fysi_cloud]
+        type = "caldav"
+        url = "${fysiCloud.davEndpoint}/calendars/${fysiCloud.username}/"
+        username = "${fysiCloud.username}"
+        password.fetch = ["command", "cat", "${fysiCloud.passwordFile}"]
+      '';
+    };
+  };
+}

configs/kleiter.nix

@@ -1,13 +0,0 @@
-{ ... }:
-let ssid = "Kleiter Gast";
-in {
-  networking.wireless.networks.${ssid}.psk = "Kleiter-Gast";
-
-  # fix dns
-  systemd.network.networks.kleiter = {
-    dns = [ "8.8.8.8" "8.8.4.4" ];
-    networkConfig.DHCP = "yes";
-    matchConfig.Name = "wlp3s0";
-    matchConfig.SSID = ssid;
-  };
-}

configs/lb.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  systemd.services.lb-subscription = {
+    enable = true;
+    wants = ["network-online.target"];
+    startAt = "weekly";
+    serviceConfig = {
+      user = "kfm";
+      WorkingDirectory = "/home/kfm/cloud/nextcloud/Books/Germanistik/LB";
+    };
+    script = ''
+      first_year=2019
+      for year in $(${pkgs.coreutils}/bin/seq "$first_year" "$(date +%Y)"); do
+        ${pkgs.curl}/bin/curl -sSL "https://www.literarische-blaetter.de/jahrgang-$year/" \
+          | ${pkgs.htmlq}/bin/htmlq --attribute href 'ul.slides a' \
+          | while read -r month; do
+            ${pkgs.curl}/bin/curl -sSL "$month" \
+              | ${pkgs.htmlq}/bin/htmlq --attribute src iframe \
+              | ${pkgs.gnused}/bin/sed 's/.*?pdf=//;s/?wp-hosted.*//'
+          done
+      done | ${pkgs.findutils}/bin/xargs ${pkgs.wget}/bin/wget --no-clobber
+    '';
+  };
+}

configs/mail/accounts.nix

@@ -1,145 +0,0 @@
-{ lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran;
-
-  enableDefaults = lib.recursiveUpdate {
-    mbsync = {
-      enable = true;
-      create = "both";
-      expunge = "both";
-    };
-    msmtp.enable = true;
-    notmuch.enable = true;
-  };
-
-  settings = {
-    fastmail = {
-      smtp = {
-        host = "smtp.fastmail.com";
-        port = 465;
-        tls.enable = true;
-      };
-      imap = {
-        host = "imap.fastmail.com";
-        port = 993;
-        tls.enable = true;
-      };
-    };
-    cock = {
-      smtp = {
-        host = "mail.cock.li";
-        port = 587;
-        tls = {
-          enable = true;
-          useStartTls = true;
-        };
-      };
-      imap = {
-        host = "mail.cock.li";
-        port = 993;
-        tls.enable = true;
-      };
-    };
-    posteo = {
-      smtp = {
-        host = "posteo.de";
-        port = 587;
-        tls = {
-          enable = true;
-          useStartTls = true;
-        };
-      };
-      imap = {
-        host = "posteo.de";
-        port = 993;
-        tls.enable = true;
-      };
-    };
-    hu-berlin = {
-      smtp = {
-        host = "mailhost.cms.hu-berlin.de";
-        port = 25;
-        tls = {
-          enable = true;
-          useStartTls = true;
-        };
-      };
-      imap = {
-        host = "mailbox.cms.hu-berlin.de";
-        port = 993;
-        tls.enable = true;
-      };
-    };
-  };
-
-  # turns out we have to escape $ because, if the password contains a $, it will get interpolated as a variable by the msmtp `passwordeval` which does: `bash -c "COMMAND; echo"`
-  pass_ = file: "echo ${lib.escape ["$"] (lib.escapeShellArg (lib.strings.fileContents file))}";
-in
-{
-  fysi = enableDefaults {
-    primary = false;
-    userName = "kieran@fysi.tech";
-    address = "kieran@fysi.tech";
-    realName = kieran.name;
-    passwordCommand = pass_ <secrets/mail/fastmail>;
-    inherit (settings.fastmail) imap smtp;
-  };
-  cock = enableDefaults {
-    primary = false;
-    userName = "2210@cock.li";
-    address = "2210@cock.li";
-    realName = "2210";
-    passwordCommand = pass_ <secrets/mail/cock>;
-    inherit (settings.cock) imap smtp;
-  };
-  kieran-gmail = enableDefaults {
-    primary = false;
-    flavor = "gmail.com";
-    address = "kieran.meinhardt@gmail.com";
-    realName = kieran.name;
-    userName = "kieran.meinhardt";
-    passwordCommand = pass_ <secrets/mail/gmail/kieran.meinhardt>;
-    folders = {
-      drafts = "[Gmail]/Entw&APw-rfe";
-      sent = "[Gmail]/Gesendet";
-      trash = "[Gmail]/Papierkorb";
-    };
-  };
-  amroplay = enableDefaults {
-    primary = false;
-    flavor = "gmail.com";
-    address = "amroplay@gmail.com";
-    realName = kieran.name;
-    userName = "amroplay";
-    passwordCommand = pass_ <secrets/mail/gmail/amroplay>;
-    folders = {
-      drafts = "[Gmail]/Drafts";
-      sent = "[Gmail]/Sent Mail";
-      trash = "[Gmail]/Bin";
-    };
-  };
-  posteo = enableDefaults {
-    primary = true;
-    address = "kieran.meinhardt@posteo.net";
-    realName = kieran.name;
-    userName = "kieran.meinhardt@posteo.net";
-    passwordCommand = pass_ <secrets/mail/posteo>;
-    inherit (settings.posteo) imap smtp;
-  };
-  hu-berlin = enableDefaults {
-    primary = false;
-    address = "meinhark@hu-berlin.de";
-    realName = kieran.name;
-    userName = "meinhark";
-    passwordCommand = pass_ <secrets/eduroam/password>;
-    inherit (settings.hu-berlin) imap smtp;
-  };
-  hu-berlin-work = enableDefaults {
-    primary = false;
-    address = "meinhaki@hu-berlin.de";
-    realName = kieran.name;
-    userName = "meinhaki";
-    passwordCommand = pass_ <secrets/mail/meinhaki>;
-    inherit (settings.hu-berlin) imap smtp;
-  };
-}

configs/mail/client.nix

@@ -1,52 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) email-sshKey;
-  much =
-    let
-      nixpkgs-much = import (pkgs.fetchFromGitHub {
-        owner = "NixOS";
-        repo = "nixpkgs";
-        rev = "7c2a362b58a1c2ba72d24aa3869da3b1a91d39e1";
-        sha256 = "0gl4xndyahasa9dv5mi3x9w8s457wl2xh9lcldizcn1irjvkrzs4";
-      }) {
-        overlays = [
-          (import <stockholm/krebs/5pkgs/haskell>)
-        ];
-      };
-      much-pkg = nixpkgs-much.haskellPackages.callCabal2nix "much" <niveum/submodules/much> {};
-    in nixpkgs-much.haskell.lib.dontHaddock much-pkg;
-in {
-  environment.variables.NOTMUCH_CONFIG = config.home-manager.users.me.home.sessionVariables.NOTMUCH_CONFIG;
-
-  users.users.me.openssh.authorizedKeys.keys = [ email-sshKey ];
-
-  environment.systemPackages = [
-    pkgs.notmuch-addrlookup
-
-    pkgs.muchsync
-
-    (pkgs.writers.writeDashBin "mua" ''
-      if [ $# -eq 0 ]; then
-        ${much}/bin/much-kmein
-      else
-        ${much}/bin/much-kmein -q "$*"
-      fi
-    '')
-
-    (pkgs.writers.writeDashBin "mail-clean" ''
-      ${pkgs.notmuch}/bin/notmuch search --output files --format=text0 tag:deleted | ${pkgs.findutils}/bin/xargs -r0 rm
-      ${pkgs.notmuch}/bin/notmuch new
-    '')
-  ];
-
-  home-manager.users.me = {
-    programs.notmuch = {
-      enable = true;
-      search.excludeTags = [ "deleted" "spam" ];
-    };
-
-    programs.msmtp.enable = true;
-
-    accounts.email.accounts = import ./accounts.nix { inherit lib; };
-  };
-}

configs/mail/fetcher.nix

@@ -1,80 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran sshPort;
-
-  tagRules = [
-    {
-      query = "to:miaengiadina-pwa@noreply.github.com AND subject:\"PR run failed\"";
-      tags = [ "-new" "+deleted" ];
-    }
-    {
-      query = lib.concatStringsSep " OR " [
-        "from:noreply-local-guides@google.com"
-        "from:google-maps-noreply@google.com"
-        "subject:fd-noti"
-        "from:nebenan.de"
-        "to:miaengiadina-pwa@noreply.github.com"
-      ];
-      tags = [ "-new" ];
-    }
-    {
-      query = "tag:new";
-      tags = [ "-new" "+inbox" ];
-    }
-  ];
-
-  generateTaggingScript = filters:
-    let
-      template = { tags, query, message ? "tagging ${query} -> ${lib.concatStringsSep " " tags}", ... }: ''
-        echo '${message}'
-        ${pkgs.notmuch}/bin/notmuch tag ${lib.concatStringsSep " " tags} -- "${query}"
-      '';
-    in lib.concatStringsSep "\n" (map template filters);
-in
-{
-  imports = [ <stockholm/krebs/3modules/secret.nix> ];
-
-  krebs.secret.files.email-ssh = {
-    path = "${config.users.users.email.home}/.ssh/id_ed25519";
-    owner.name = config.users.users.email.name;
-    source-path = toString <system-secrets> + "/email/ssh.key";
-  };
-
-  users.users.email = {
-    isNormalUser = true;
-    description = "fetching mails since 2021";
-  };
-
-  systemd.services.mail-sync =
-  let
-    hosts = [ "manakish.r" "wilde.r" ];
-  in {
-    enable = true;
-    wants = [ "network-online.target" config.krebs.secret.files.email-ssh.service ];
-    startAt = "*:0/3";
-    serviceConfig.User = config.users.users.email.name;
-    serviceConfig.Type = "oneshot";
-    environment.NOTMUCH_CONFIG = config.home-manager.users.email.home.sessionVariables.NOTMUCH_CONFIG;
-    path = [ pkgs.notmuch pkgs.openssh ];
-    script = ''
-      ${pkgs.isync}/bin/mbsync --all
-
-      ${lib.concatMapStringsSep "\n" (host: ''
-        echo === syncing ${host}
-        ${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=4 -p ${toString sshPort}' kfm@${host} || :
-      '') hosts}
-    '';
-  };
-
-  home-manager.users.email = {
-    programs.mbsync.enable = true;
-
-    accounts.email.accounts = import ./accounts.nix { inherit lib; };
-
-    programs.notmuch = {
-      enable = true;
-      new.tags = [ "new" ];
-      hooks.postNew = generateTaggingScript tagRules;
-    };
-  };
-}

configs/mastodon-bot.nix

@@ -0,0 +1,19 @@
+{pkgs, ...}: {
+  systemd.services.imaginary-illuminations = {
+    enable = false;
+    wants = ["network-online.target"];
+    serviceConfig = {
+      User = "kfm";
+      Group = "users";
+      WorkingDirectory = "/home/kfm/cloud/Seafile/Documents/Media/imaginary-illuminations";
+      Restart = "on-failure";
+      RestartSec = "15s";
+    };
+    startAt = "7:00";
+    script = ''
+      ${pkgs.deno}/bin/deno run -A post.ts
+    '';
+  };
+
+  systemd.timers.imaginary-illuminations.timerConfig.RandomizedDelaySec = "14h";
+}

configs/matterbridge.nix

@@ -1,58 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  bridgeBotToken = lib.strings.fileContents <system-secrets/telegram/kmein.token>;
-  config = {
-    general = {
-      RemoteNickFormat = "[{NICK}] ";
-      Charset = "utf-8";
-    };
-    telegram.kmein.Token = bridgeBotToken;
-    irc.freenode = {
-      Server = "irc.freenode.net:6667";
-      Nick = "ponte";
-    };
-    mumble.lassulus = {
-      Server = "lassul.us:64738";
-      Nick = "krebs_bridge";
-      SkipTLSVerify = true;
-    };
-    gateway = [
-      {
-        name = "krebs-bridge";
-        enable = true;
-        inout = [
-          {
-            account = "irc.freenode";
-            channel = "#krebs";
-          }
-          {
-            account = "telegram.kmein";
-            channel = "-330372458";
-          }
-          {
-            account = "mumble.lassulus";
-            channel = 6; # "nixos"
-          }
-        ];
-      }
-    ];
-  };
-in
-{
-  nixpkgs.overlays = [
-    (import <niveum/overlays/toml.nix>)
-    (self: super: {
-      matterbridge = (import (super.fetchFromGitHub {
-        owner = "NixOS";
-        repo = "nixpkgs";
-        rev = "e45d91ee65db293a172ec506759d1248e40c35f5";
-        sha256 = "03cjs5xcx09lw0djyrx2kfakw7gkg4iqmy9w25azai62im39l30k";
-      }) {}).matterbridge;
-    })
-  ];
-
-  services.matterbridge = {
-    enable = true;
-    configPath = toString (pkgs.writeTOML config);
-  };
-}

configs/mime.nix

@@ -7,21 +7,20 @@
         "application/pdf" = "org.pwmt.zathura.desktop";
         "application/vnd.oasis.opendocument.text" = "writer.desktop";
         "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = "writer.desktop";
-        "image/jpeg" = "sxiv.desktop";
-        "image/png" = "sxiv.desktop";
+        "image/jpeg" = "nsxiv.desktop";
+        "image/png" = "nsxiv.desktop";
         "image/vnd.djvu+multipage" = "org.pwmt.zathura.desktop";
-        "text/html" = "brave-browser.desktop";
+        "text/html" = "firefox.desktop";
         "text/markdown" = "nvim.desktop";
         "text/plain" = "nvim.desktop";
-        "x-scheme-handler/about" = "brave-browser.desktop";
-        "x-scheme-handler/http" = "brave-browser.desktop";
-        "x-scheme-handler/https" = "brave-browser.desktop";
-        "x-scheme-handler/mailto" = "brave-browser.desktop";
-        "x-scheme-handler/unknown" = "brave-browser.desktop";
-        "x-scheme-handler/webcal" = "brave-browser.desktop";
+        "x-scheme-handler/about" = "firefox.desktop";
+        "x-scheme-handler/http" = "firefox.desktop";
+        "x-scheme-handler/https" = "firefox.desktop";
+        "x-scheme-handler/mailto" = "firefox.desktop";
+        "x-scheme-handler/unknown" = "firefox.desktop";
+        "x-scheme-handler/webcal" = "firefox.desktop";
         "inode/directory" = "pcmanfm.desktop";
       };
-
     };
   };
 }

configs/monitoring.nix

@@ -0,0 +1,85 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.nginx.virtualHosts.default = {
+    locations."= /stub_status".extraConfig = "stub_status;";
+  };
+
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      nginx.enable = false;
+      node = {
+        enable = true;
+        openFirewall = true;
+        enabledCollectors = [
+          "conntrack"
+          "diskstats"
+          "entropy"
+          "filefd"
+          "filesystem"
+          "loadavg"
+          "mdadm"
+          "meminfo"
+          "netdev"
+          "netstat"
+          "stat"
+          "time"
+          "vmstat"
+          "systemd"
+          "logind"
+          "interrupts"
+          "ksmd"
+        ];
+        port = 9002;
+      };
+    };
+  };
+
+  systemd.services.promtail = {
+    description = "Promtail service for Loki";
+    wantedBy = ["multi-user.target"];
+
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.grafana-loki}/bin/promtail --config.file ${
+          (pkgs.formats.yaml {}).generate "promtail.yaml" {
+            server = {
+              http_listen_port = 28183;
+              grpc_listen_port = 0;
+            };
+            positions.filename = "/tmp/positions.yaml";
+            clients = [
+              {
+                url = "http://${
+                  if config.networking.hostName == "makanek"
+                  then "127.0.0.1"
+                  else "makanek.r"
+                }:3100/loki/api/v1/push";
+              }
+            ];
+            scrape_configs = [
+              {
+                job_name = "journal";
+                journal = {
+                  max_age = "12h";
+                  labels.job = "systemd-journal";
+                  labels.host = config.networking.hostName;
+                };
+                relabel_configs = [
+                  {
+                    source_labels = ["__journal__systemd_unit"];
+                    target_label = "unit";
+                  }
+                ];
+              }
+            ];
+          }
+        }
+      '';
+    };
+  };
+}

configs/moodle-dl.nix

@@ -1,86 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  inherit (import <niveum/lib>) kieran;
-
-  moodle-dl = pkgs.callPackage <niveum/packages/moodle-dl> {};
-
-  moodle-dl-config = {
-    telegram = {
-      token = lib.strings.fileContents <system-secrets/telegram/moodle-dl.token>;
-      chat_id = "18980945";
-      send_error_msg = true;
-    };
-    token = lib.strings.fileContents <system-secrets/moodle.token>;
-    moodle_domain = "moodle.hu-berlin.de";
-    moodle_path = "/";
-    download_course_ids = [
-      99881 # Dialektologie
-      100183 # Onomastik
-      100353 # Sanskrit I
-      100692 # Sanskrit Tutorium
-      99832 # Germanisch
-      99823 # Gotisch
-      99813 # Altalbanisch
-      98681 # Geistliche Lyrik von Luther bis Lehnert
-      99667 # Antike Mythologie
-      # 52365 # FSR KlassPhil
-    ];
-    download_submissions = true;
-    download_descriptions = true;
-    download_links_in_descriptions = false;
-    download_databases = false;
-    download_forums = false;
-    download_linked_files = false;
-    download_also_with_cookie = false;
-  };
-
-  moodle-dl-json = pkgs.writeText "moodle-dl.json" (builtins.toJSON moodle-dl-config);
-
-  moodle-dl-directory = "/var/lib/moodle";
-in
-{
-  users.extraUsers.moodle = {
-    isNormalUser = false;
-    home = moodle-dl-directory;
-    createHome = true;
-    openssh.authorizedKeys.keys = [
-      # for sshfs mount
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDtIFmbspaBHaSkLEx43V0uaVd7l9NUFiwt2VOP++KzLjvRMLkyF2hg2HjmogTjUvTyoDs7RHwEH/cHZlJ5JQkM1jRqQpnYwGfkZEwYvmXAl6LY9+vQMP36gNPfXmKX3y3LelO7oD2uhUs0guTtg0tHUyN5/UY5u+VinyD6djxDkHaCUn3S7CS/odBcs/4flXT654wsvzgYicnSKH9R4W+7C0YsckZ/NoIkA4jnuwtWZYWrUkxd4/290buX6pAc5+zVVZqyy0sI4i8s6pO9RL5W7xvYt+w+U0u0dMxm5ckiRmLVKfIbMN4YtDxsZbZDajlQ1nDbOsEsrSXWz4H4cSNot7J820x1qh5SSxL4GSQlcT+6xCFk9kKyflxoS3oLoPLttx3rmOMkZKJWxF/IKLW47orxV6wkG5mHxdeR3cf6jX4j3nkwFVyC9R+WG4w2Z4vKONVE7uWGYU3y4OpR1e6MGHVShkNKqEvC/Kjcc/6v7I7AKRAuPZB0WEw36tA65/8= root@wilde"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFPHt+FPQ6gq8Ev65YsBZrafdtpWGpCNnlVvy67S1BK root@manakish"
-    ];
-    useDefaultShell = true;
-  };
-
-  system.activationScripts.moodle-dl-config = "ln -sfn ${toString moodle-dl-json} ${config.users.extraUsers.moodle.home}/config.json";
-
-  services.syncthing = {
-    enable = true;
-    user = "moodle"; # config.users.extraUsers.moodle.name;
-    openDefaultPorts = true;
-    configDir = "${moodle-dl-directory}/.config/syncthing";
-    dataDir = "${moodle-dl-directory}/.config/syncthing";
-    declarative = rec {
-      cert = toString <system-secrets/syncthing/cert.pem>;
-      key = toString <system-secrets/syncthing/key.pem>;
-      devices = {
-        inherit ((import <niveum/lib>).syncthing.devices) wilde manakish toum;
-      };
-      folders.${moodle-dl-directory} = {
-        devices = [ "toum" "wilde" "manakish" ];
-        id = "moodle-dl";
-      };
-    };
-  };
-
-  systemd.services.moodle-dl = {
-    enable = true;
-    startAt = "hourly";
-    serviceConfig = {
-      Type = "oneshot";
-      User = config.users.extraUsers.moodle.name;
-      WorkingDirectory = config.users.extraUsers.moodle.home;
-    };
-    wants = [ "network-online.target" ];
-    script = "${moodle-dl}/bin/moodle-dl";
-  };
-}

configs/mpd-fm.nix

@@ -1,83 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  streams = import <niveum/lib/streams.nix> {
-    di-fm-key = lib.strings.fileContents <secrets/di.fm/key>;
-  };
-  multi-room-audio-port = 8000;
-in
-{
-  imports = [
-    <niveum/modules/mpd-fm.nix>
-  ];
-
-  services.mpd = {
-    enable = true;
-    extraConfig = ''
-      log_level "default"
-      auto_update "yes"
-
-      audio_output {
-        type "alsa"
-        name "zaatar single room audio system"
-      }
-
-      audio_output {
-        type "httpd"
-        name "zaatar multi room audio system"
-        encoder "vorbis" # optional
-        port "${toString multi-room-audio-port}"
-        quality "5.0" # do not define if bitrate is defined
-        # bitrate "128" # do not define if quality is defined
-        format "44100:16:2"
-        always_on "yes" # prevent MPD from disconnecting all listeners when playback is stopped.
-        tags "yes" # httpd supports sending tags to listening streams.
-      }
-    '';
-  };
-
-  environment.systemPackages = [ pkgs.mpc_cli ];
-
-  services.mpd-fm = {
-    enable = true;
-    # stationsFile = "/etc/mpd-fm/stations.json";
-    stations = lib.lists.imap0 (id: {desc ? "", logo ? "https://picsum.photos/seed/${builtins.hashString "md5" stream}/300", stream, station}: { inherit id desc logo stream station; }) streams;
-    webPort = 8080;
-  };
-
-  systemd.services.mpd-fm-stations =
-  let
-    stations = lib.lists.imap0 (id: {desc ? "", logo ? "https://picsum.photos/seed/${builtins.hashString "md5" stream}/300", stream, station}: { inherit id desc logo stream station; }) streams;
-    stationsJson = pkgs.writeText "stations.json" (builtins.toJSON stations);
-  in {
-    wantedBy = [ "mpd-fm.service" ];
-    startAt = "hourly";
-    script = ''
-      mkdir -p /etc/mpd-fm
-      antenne_asb_url=$(
-        ${pkgs.curl}/bin/curl -sS 'https://www.caster.fm/widgets/em_player.php?jsinit=true&uid=529295&t=blue&c=' \
-          | grep streamUrl \
-          | sed ${lib.escapeShellArg "s/^.*'\\([^']*\\)'.*/\\1/"}
-      )
-      ${pkgs.jq}/bin/jq "map(if .station == \"Antenne ASB\" then .stream |= \"$antenne_asb_url\" else . end)" < ${stationsJson} > /etc/mpd-fm/stations.json
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  services.nginx = {
-    enable = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    virtualHosts.default = {
-      basicAuth.dj = lib.strings.fileContents <system-secrets/mpd-web.key>;
-      locations."= /listen.ogg" = {
-        proxyPass = "http://127.0.0.1:${toString multi-room-audio-port}";
-      };
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString config.services.mpd-fm.webPort}";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}