wip: add specus VPN

chore: update
feat(stardict): add turkish
2026-03-29 16:51:07 +02:00 · 2023-04-14 08:43:23 +02:00 · 2023-04-14 08:42:59 +02:00 · 2023-04-14 08:42:22 +02:00 · 2023-04-01 17:46:56 +02:00 · 2023-04-01 17:46:48 +02:00
49 changed files with 1608 additions and 495 deletions
--- a/configs/aerc.nix
+++ b/configs/aerc.nix
@@ -63,6 +63,53 @@ in {
  };

  home-manager.users.me = {
+    services.mbsync = {
+      enable = true;
+      frequency = "daily";
+      preExec = "${pkgs.coreutils}/bin/mkdir -p ${config.home-manager.users.me.accounts.email.maildirBasePath}";
+      postExec = "${pkgs.notmuch}/bin/notmuch new";
+    };
+
+    programs.notmuch = {
+      enable = true;
+      extraConfig = {
+        database.path = config.home-manager.users.me.accounts.email.maildirBasePath;
+        new.tags = "";
+        user.name = defaults.realName;
+        user.primary_email = config.home-manager.users.me.accounts.email.accounts.posteo.address;
+      };
+    };
+
+    programs.mbsync = {
+      enable = true;
+      extraConfig = lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: ''
+          IMAPAccount ${name}
+          CertificateFile /etc/ssl/certs/ca-certificates.crt
+          Host ${account.imap.host}
+          PassCmd "${toString account.passwordCommand}"
+          User ${account.userName}
+          SSLType IMAPS
+          ${lib.optionalString (lib.isInt account.imap.port) "Port ${toString account.imap.port}"}
+
+          IMAPStore ${name}-remote
+          Account ${name}
+
+          MaildirStore ${name}-local
+          Path ${config.home-manager.users.me.accounts.email.maildirBasePath}/${name}/
+          SubFolders Verbatim
+
+          Channel ${name}
+          Create Near
+          Expunge None
+          Far :${name}-remote:
+          Near :${name}-local:
+          Patterns *
+          Remove None
+          SyncState *
+        '')
+        config.home-manager.users.me.accounts.email.accounts);
+    };
+
    accounts.email.accounts = rec {
      hu-student =
        lib.recursiveUpdate defaults
@@ -71,7 +118,7 @@ in {
            userName = "meinhark";
            address = "kieran.felix.meinhardt@hu-berlin.de";
            aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
          });
      hu-student-cs =
        lib.recursiveUpdate defaults
@@ -82,7 +129,7 @@ in {
            aliases = ["${userName}@informatik.hu-berlin.de"];
            imap.host = "mailbox.informatik.hu-berlin.de";
            smtp.host = "mailhost.informatik.hu-berlin.de";
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
          });
      hu-employee =
        lib.recursiveUpdate defaults
@@ -91,7 +138,7 @@ in {
            userName = "meinhaki";
            address = "kieran.meinhardt@hu-berlin.de";
            aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhaki.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhaki.path}";
            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
            signature = {
              showSignature = "append";
@@ -113,7 +160,7 @@ in {
            userName = "dslalewa";
            address = "admin.alew.vglsprwi@hu-berlin.de";
            aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-dslalewa.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-dslalewa.path}";
            inherit (hu-employee) signature;
            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
          });
@@ -122,7 +169,7 @@ in {
        (lib.recursiveUpdate hu-defaults
          rec {
            userName = "fsklassp";
-            passwordCommand = "cat ${config.age.secrets.email-password-fsklassp.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fsklassp.path}";
            address = "${userName}@hu-berlin.de";
            realName = "FSI Klassische Philologie";
            aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
@@ -144,7 +191,7 @@ in {
        rec {
          address = "kieran@fysi.tech";
          userName = address;
-          passwordCommand = "cat ${config.age.secrets.email-password-fysi.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fysi.path}";
          flavor = "fastmail.com";
        };
      cock =
@@ -152,7 +199,7 @@ in {
        rec {
          address = "2210@cock.li";
          userName = address;
-          passwordCommand = "cat ${config.age.secrets.email-password-cock.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-cock.path}";
          realName = "";
          imap.host = "mail.cock.li";
          smtp.host = imap.host;
@@ -166,7 +213,7 @@ in {
          imap.host = "posteo.de";
          smtp.host = imap.host;
          primary = true;
-          passwordCommand = "cat ${config.age.secrets.email-password-posteo.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-posteo.path}";
          # himalaya = { enable = true; backend = "imap"; sender = "smtp"; };
        };
    };
--- a/configs/alacritty.nix
+++ b/configs/alacritty.nix
@@ -62,7 +62,7 @@ in {
  ];

  environment.etc = {
-    "themes/dark/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-dark.nix);
-    "themes/light/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-light.nix);
+    "themes/dark/alacritty.yml".source = alacritty-cfg (import ../lib/colours/owickstrom-dark.nix);
+    "themes/light/alacritty.yml".source = alacritty-cfg (import ../lib/colours/owickstrom-light.nix);
  };
 }
--- a/configs/backup.nix
+++ b/configs/backup.nix
@@ -21,6 +21,7 @@ in {
      "/home/kfm/work"
      "/home/kfm/projects"
      "/home/kfm/notes"
+      "/home/kfm/Maildir"
      "/home/kfm/cloud"
      "/home/kfm/.gnupg"
      "/home/kfm/.ssh"
--- a/configs/default.nix
+++ b/configs/default.nix
@@ -13,10 +13,7 @@ in {
  imports = [
    inputs.self.nixosModules.system-dependent
    inputs.self.nixosModules.traadfri
-    inputs.stockholm.nixosModules.power-action
-    {
-      nixpkgs.config.overlays = [inputs.nix-writers];
-    }
+    inputs.self.nixosModules.power-action
    {
      boot.supportedFilesystems = ["ntfs"];
    }
--- a/configs/flix.nix
+++ b/configs/flix.nix
@@ -4,14 +4,16 @@
  ...
 }: let
  flixLocation = "/media/flix";
+  flixLocationNew = "/media/flix-new";
  cacheLocation = "/var/cache/flix";
  indexFilename = "index";
+  indexFilenameNew = "index-new";
  flixUser = "flix";
  flixGroup = "users";
  inherit (import ../lib) tmpfilesConfig;
 in {
  fileSystems.${flixLocation} = {
-    device = "prism.r:/export";
+    device = "prism.r:/export/download";
    fsType = "nfs";
    options = [
      "noauto"
@@ -26,6 +28,20 @@ in {
    ];
  };

+  fileSystems.${flixLocationNew} = {
+    device = "//yellow.r/public";
+    fsType = "cifs";
+    options = [
+      "guest"
+      "nofail"
+      "noauto"
+      "ro"
+      "x-systemd.automount"
+      "x-systemd.device-timeout=1"
+      "x-systemd.idle-timeout=1min"
+    ];
+  };
+
  systemd.tmpfiles.rules = [
    (tmpfilesConfig {
      type = "d";
@@ -39,7 +55,10 @@ in {
  systemd.services.flix-index = {
    description = "Flix indexing service";
    wants = ["network-online.target"];
-    script = "cp ${flixLocation}/download/index ./${indexFilename}";
+    script = ''
+      cp ${flixLocation}/index ./${indexFilename}
+      cp ${flixLocationNew}/index ./${indexFilenameNew}
+    '';
    startAt = "hourly";
    serviceConfig = {
      Type = "oneshot";
@@ -69,11 +88,10 @@ in {
    '')
    (pkgs.writers.writeDashBin "flixmenu" ''
      set -efu
-      cd "${flixLocation}/download"
-
-      [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
-
-      ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" < ${cacheLocation}/${indexFilename} \
+      (
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocation}#' ${cacheLocation}/${indexFilename}
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocationNew}#' ${cacheLocation}/${indexFilenameNew}
+      ) | ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" \
        | ${pkgs.findutils}/bin/xargs -I '{}' ${pkgs.util-linux}/bin/setsid ${pkgs.xdg-utils}/bin/xdg-open '{}'
    '')
  ];
--- a/configs/hu-berlin.nix
+++ b/configs/hu-berlin.nix
@@ -17,7 +17,7 @@
    "workgroup=german"
    "credentials=${config.age.secrets.cifs-credentials-hu-berlin.path}"
    "noauto"
-    "x-systemd.requires=hu-vpn.service"
+    # "x-systemd.requires=hu-vpn.service"
    "x-systemd.automount"
    "x-systemd.device-timeout=1"
    "x-systemd.idle-timeout=1min"
@@ -68,9 +68,11 @@ in {
    wants = ["network-online.target"];
    serviceConfig.LoadCredential = "password:${config.age.secrets.email-password-meinhark.path}";
    script = ''
-      ${pkgs.openfortivpn}/bin/openfortivpn \
-        --password="$(cat "$CREDENTIALS_DIRECTORY/password")" \
-        --config=${
+      if ${pkgs.wirelesstools}/bin/iwgetid | ${pkgs.gnugrep}/bin/grep --invert-match eduroam
+      then
+        ${pkgs.openfortivpn}/bin/openfortivpn \
+          --password="$(cat "$CREDENTIALS_DIRECTORY/password")" \
+          --config=${
        pkgs.writeText "hu-berlin.config" ''
          host = forti-ssl.vpn.hu-berlin.de
          port = 443
@@ -78,6 +80,7 @@ in {
          trusted-cert = 9e5dea8e077970d245900839f437ef7fb9551559501c7defd70af70ea568573d
        ''
      }
+      fi
    '';
  };
 }
--- a/configs/i3.nix
+++ b/configs/i3.nix
@@ -47,6 +47,9 @@
      ocr = pkgs.writers.writeDash "ocr" ''
        ${pkgs.tesseract4}/bin/tesseract -l eng+deu - stdout
      '';
+      emojai = pkgs.writers.writeDash "emojai" ''
+        ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
+      '';
    };
  };

@@ -72,6 +75,8 @@ in {
    };
  };

+  programs.slock.enable = true;
+
  services.xserver = {
    displayManager.defaultSession = "none+i3";
    windowManager.i3 = {
@@ -94,14 +99,19 @@ in {
    '';
  };

-  home-manager.users.me.xsession.windowManager.i3 = {
+  home-manager.users.me.xsession.windowManager.i3 = let
+    modifier = "Mod4";
+  in {
    enable = true;
+    extraConfig = ''
+      bindsym --release ${modifier}+Shift+w exec /run/wrappers/bin/slock
+    '';
    config = rec {
      fonts = {
        names = ["Sans"];
        size = 10.0;
      };
-      modifier = "Mod4";
+      inherit modifier;
      window = {
        titlebar = false;
        border = 1;
@@ -256,7 +266,6 @@ in {
        "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
        "${modifier}+0" = "exec ${niveumPackages.menu-calc}/bin/=";

-        "${modifier}+Shift+w" = "exec ${niveumPackages.k-lock}/bin/k-lock";
        "${modifier}+d" = "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
        "${modifier}+Shift+d" = "exec ${
          pkgs.writers.writeDash "notemenu" ''
@@ -306,7 +315,7 @@ in {
        "XF86AudioStop" = "exec ${pkgs.playerctl}/bin/playerctl stop";
        "XF86ScreenSaver" = "exec ${niveumPackages.k-lock}/bin/k-lock";

-        "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenurandr";
+        "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenu-randr";

        # key names detected with xorg.xev:
        # XF86WakeUp (fn twice)
--- a/configs/neovim.nix
+++ b/configs/neovim.nix
@@ -12,7 +12,11 @@
    (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
    (pkgs.neovim.override {
      configure = {
-        customRC = builtins.readFile ../lib/vim/init.vim;
+        customRC = ''
+          source ${../lib/vim/init.vim}
+
+          luafile ${../lib/vim/init.lua}
+        '';
        packages.nvim = with pkgs.vimPlugins; {
          start = [
            ale
@@ -23,6 +27,7 @@
            tabular
            # vimwiki
            niveumPackages.vimPlugins-vim-colors-paramount
+            nvim-lspconfig
            vim-commentary
            vim-css-color
            vim-eunuch
--- a/configs/packages.nix
+++ b/configs/packages.nix
@@ -134,7 +134,7 @@ in {
    okular # the word is nucular
    xournalpp # for annotating pdfs
    pdfpc # presenter console for pdf slides
-    inputs.stockholm.packages.x86_64-linux.hc # print files as qr codes
+    niveumPackages.hc # print files as qr codes
    yt-dlp
    espeak
    bc # calculator
@@ -191,6 +191,7 @@ in {
    qrencode

    inputs.menstruation-backend.defaultPackage.x86_64-linux
+    inputs.agenix.packages.x86_64-linux.default
    inputs.recht.defaultPackage.x86_64-linux

    (pkgs.writers.writeDashBin "worldradio" ''
@@ -214,10 +215,10 @@ in {
    niveumPackages.nix-index-update

    #krebs
-    inputs.stockholm.packages.x86_64-linux.dic
-    inputs.stockholm.packages.x86_64-linux.cyberlocker-tools
-    inputs.stockholm.packages.x86_64-linux.untilport
-    inputs.stockholm.packages.x86_64-linux.kpaste
+    niveumPackages.dic
+    niveumPackages.cyberlocker-tools
+    niveumPackages.untilport
+    niveumPackages.kpaste
    config.nur.repos.mic92.ircsink

    (python3.withPackages (py: [
@@ -232,6 +233,13 @@ in {
    ]))
    # python3Packages.poetry

+    # language servers
+    pyright
+    haskell-language-server
+    texlab
+    nil
+    rust-analyzer
+
    html-tidy
    nodePackages.csslint
    nodePackages.jsonlint
--- a/configs/picom.nix
+++ b/configs/picom.nix
@@ -8,5 +8,18 @@
    shadow = true;
    menuOpacity = 0.9;
    shadowOpacity = 0.3;
+    fadeExclude = [
+      "class_g = 'slock'" # don't want a transparent lock screen!
+      "name *?= 'slock'"
+      "focused = 1"
+    ];
+    opacityRules = [
+      # opacity-rule overrides both inactive and active opacity
+
+      # video in browser tabs
+      # substring /regex match of title bar text
+      "99:name *?= 'Youtube'"
+      "99:WM_CLASS@:s *= 'mpv$'"
+    ];
  };
 }
--- a/configs/power-action.nix
+++ b/configs/power-action.nix
@@ -5,7 +5,7 @@
 }: let
  suspend = pkgs.writers.writeDash "suspend" "${pkgs.systemd}/bin/systemctl suspend";
 in {
-  krebs.power-action = {
+  services.power-action = {
    enable = true;
    plans.suspend = {
      upperLimit = 7;
@@ -19,6 +19,6 @@ in {
  };

  security.sudo.extraConfig = ''
-    ${config.krebs.power-action.user} ALL= (root) NOPASSWD: ${suspend}
+    ${config.services.power-action.user} ALL= (root) NOPASSWD: ${suspend}
  '';
 }
--- a/configs/ssh.nix
+++ b/configs/ssh.nix
@@ -7,24 +7,37 @@
  inherit (import ../lib) sshPort kieran;
  externalNetwork = import ../lib/external-network.nix;
  sshIdentity = name: "${config.users.users.me.home}/.ssh/${name}";
-  ssh-passphrase = lib.strings.fileContents <system-secrets/ssh/passphrase>;
 in {
-  /*
-     TODO how do I do this?
-  services.xserver.displayManager.sessionCommands = toString (pkgs.writeScript "ssh-add" ''
-    #!${pkgs.expect}/bin/expect -f
-    spawn ${pkgs.openssh}/bin/ssh-add
-    expect "Enter passphrase for *:"
-    send "${ssh-passphrase}\n";
-    expect "Identity added: *"
-    interact
-  '');
-  */
-
-  programs.ssh.startAgent = true;
-
  users.users.me.openssh.authorizedKeys.keys = kieran.sshKeys pkgs;

+  home-manager.users.me = {
+    services.gpg-agent = rec {
+      enable = true;
+      enableSshSupport = true;
+      defaultCacheTtlSsh = 2 * 60 * 60;
+      maxCacheTtlSsh = 4 * defaultCacheTtlSsh;
+      sshKeys = [
+        "568047C91DE03A23883E340F15A9C24D313E847C"
+        "BB3EE102DB8CD45540A78A6B18B511B67061F6B4" # kfm@manakish ed25519
+        "3F8986755818B5762A096BE212777EAAC441DD9D" # fysiweb rsa
+        "0E4ABD229432486CC432639BB0986B2CDE365105" # agenix ed25519
+        "A1E8D32CBFCDBD2DE798E2298D795CCFD785AE06" # kfm@kabsa ed25519
+      ];
+    };
+  };
+
+  environment.extraInit = ''
+    if [[ -z "$SSH_AUTH_SOCK" ]]; then
+      export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)"
+    fi
+  '';
+
+  environment.interactiveShellInit = ''
+    GPG_TTY="$(tty)"
+    export GPG_TTY
+    ${pkgs.gnupg}/bin/gpg-connect-agent updatestartuptty /bye > /dev/null
+  '';
+
  home-manager.users.me.programs.ssh = {
    enable = true;
    matchBlocks = rec {
--- a/configs/stardict.nix
+++ b/configs/stardict.nix
@@ -158,6 +158,16 @@
        sha256 = "03f9wdmkgpjifpms7dyh10ma29wf3ka1j3zlp1av0cybhdldk2a8";
      };
    };
+    turkish = {
+      BabylonTurkishEnglish = pkgs.fetchzip {
+        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_Turkish_English-2.4.2.tar.bz2";
+        sha256 = "17rv46r95nkikg7aszqmfrbgdhz9ny52w423m8n01g3p93shdb4i";
+      };
+      BabylonEnglishTurkish = pkgs.fetchzip {
+        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_English_Turkish-2.4.2.tar.bz2";
+        sha256 = "063dl02s8ii8snsxgma8wi49xwr6afk6ysq0v986fygx5511353f";
+      };
+    };
  };

  makeStardictDataDir = dicts: pkgs.linkFarm "dictionaries" (lib.mapAttrsToList (name: path: {inherit name path;}) dicts);
@@ -292,7 +302,8 @@ in {
    // dictionaries.sanskrit
    // dictionaries.oed
    // dictionaries.russian
-    // dictionaries.englishGerman));
+    // dictionaries.englishGerman
+    // dictionaries.turkish));

  environment.systemPackages = [
    # pkgs.goldendict
@@ -302,6 +313,7 @@ in {
    (makeStardict "sd-russian" dictionaries.russian)
    (makeStardict "sd" dictionaries.englishGerman)
    (makeStardict "jbo" dictionaries.lojban)
+    (makeStardict "sd-turkish" dictionaries.turkish)
  ];
 }
 /*
--- a/configs/tor.nix
+++ b/configs/tor.nix
@@ -1,4 +1,5 @@
 {pkgs, ...}: {
  services.tor.enable = true;
-  environment.systemPackages = [pkgs.tor];
+  services.tor.client.enable = true;
+  environment.systemPackages = [pkgs.tor pkgs.torsocks];
 }
--- a/configs/zsh.nix
+++ b/configs/zsh.nix
@@ -77,7 +77,11 @@

      precmd () {
        vcs_info
-        RPROMPT="$vcs_info_msg_0_"
+        if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ] || [ -n "$SSH_CONNECTION" ]; then
+          RPROMPT="$(hostname)"
+        else
+          RPROMPT="$vcs_info_msg_0_"
+        fi
        if [[ -n $IN_NIX_SHELL ]]; then
          PROMPT='%B%~%b %(?.%F{${promptColours.success}}.%F{${promptColours.failure}})λ%f '
        else
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1677247280,
-        "narHash": "sha256-sa+8MtoAOSLsWP9vf0qiJUyMovIEYgDzHE8TkoK04Hk=",
+        "lastModified": 1680281360,
+        "narHash": "sha256-XdLTgAzjJNDhAG2V+++0bHpSzfvArvr2pW6omiFfEJk=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "833f87c8ff574a29aea3e091045cbaed3cf86bc1",
+        "rev": "e64961977f60388dd0b49572bb0fc453b871f896",
        "type": "github"
      },
      "original": {
@@ -60,42 +60,15 @@
      }
    },
    "flake-utils": {
-      "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
-        "type": "github"
+      "inputs": {
+        "systems": "systems"
      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_10": {
      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_11": {
-      "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
        "type": "github"
      },
      "original": {
@@ -196,11 +169,11 @@
    },
    "flake-utils_8": {
      "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
        "type": "github"
      },
      "original": {
@@ -232,11 +205,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1677284824,
-        "narHash": "sha256-I3gDxmGjyXdtOR5S8sIeCO8pT+5OR69f/g5EVoQUdsY=",
+        "lastModified": 1681092193,
+        "narHash": "sha256-JerCqqOqbT2tBnXQW4EqwFl0hHnuZp21rIQ6lu/N4rI=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "29280978234b73423f4eb708cbb999295f76b42a",
+        "rev": "f9edbedaf015013eb35f8caacbe0c9666bbc16af",
        "type": "github"
      },
      "original": {
@@ -320,25 +293,6 @@
        "type": "github"
      }
    },
-    "nix-writers": {
-      "inputs": {
-        "flake-utils": "flake-utils_8",
-        "nixpkgs": "nixpkgs_7"
-      },
-      "locked": {
-        "lastModified": 1677612737,
-        "narHash": "sha256-UaCKZ4PbMZU6UZH7XNFcjRtd5jheswl66rjZDBfQgp8=",
-        "ref": "refs/heads/master",
-        "rev": "66a1f6833464bbb121b6d94247ad769f277351f8",
-        "revCount": 39,
-        "type": "git",
-        "url": "https://cgit.krebsco.de/nix-writers"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://cgit.krebsco.de/nix-writers"
-      }
-    },
    "nixinate": {
      "inputs": {
        "nixpkgs": [
@@ -375,22 +329,6 @@
        "type": "github"
      }
    },
-    "nixpkgs_10": {
-      "locked": {
-        "lastModified": 1669418739,
-        "narHash": "sha256-T86oFvcUIRwHWBWUt7WjaP4BP/3lDGbv5AppQSI1FkI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
-        "type": "github"
-      }
-    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1665296151,
@@ -425,11 +363,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1677179781,
-        "narHash": "sha256-+peLp16ruWLuTFHo0ZUbLlS1/meS/+RsWQQ9bUAzOh8=",
+        "lastModified": 1681269223,
+        "narHash": "sha256-i6OeI2f7qGvmLfD07l1Az5iBL+bFeP0RHixisWtpUGo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "50c23cd4ff6c8344e0b4d438b027b3afabfe58dd",
+        "rev": "87edbd74246ccdfa64503f334ed86fa04010bab9",
        "type": "github"
      },
      "original": {
@@ -471,21 +409,6 @@
      }
    },
    "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1677608380,
-        "narHash": "sha256-k82O23qBAK+43X0KSBjsMYXG2x4kWWXeAmpPTc2KRGY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4aba90e89f6d4ac6138939961f62842bd94ec929",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_8": {
      "locked": {
        "lastModified": 1659446231,
        "narHash": "sha256-hekabNdTdgR/iLsgce5TGWmfIDZ86qjPhxDg/8TlzhE=",
@@ -501,7 +424,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_9": {
+    "nixpkgs_8": {
      "locked": {
        "lastModified": 1665296151,
        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
@@ -517,13 +440,29 @@
        "type": "github"
      }
    },
+    "nixpkgs_9": {
+      "locked": {
+        "lastModified": 1669418739,
+        "narHash": "sha256-T86oFvcUIRwHWBWUt7WjaP4BP/3lDGbv5AppQSI1FkI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "695b3515251873e0a7e2021add4bba643c56cde3",
+        "type": "github"
+      }
+    },
    "nur": {
      "locked": {
-        "lastModified": 1677308535,
-        "narHash": "sha256-66BgZxZ+MnxouwGRd0K9ue1G70r8jyR6l2neuMMiYjs=",
+        "lastModified": 1681454031,
+        "narHash": "sha256-JOamj7vKkFRp5mJ7FKt5dPfCmWj33sZLnBGDt15c/sc=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "ab8cd578fc38e3e797eaa98cd392b2f625a0f265",
+        "rev": "8a35714f0be00235e2a1c8b759e6dc3888763d8b",
        "type": "github"
      },
      "original": {
@@ -554,11 +493,11 @@
    },
    "retiolum": {
      "locked": {
-        "lastModified": 1676473689,
-        "narHash": "sha256-TGQbsiIojBj4DvGhhkI3i2dq9NmU2Vkt+i7Rw2U/BEg=",
+        "lastModified": 1681246809,
+        "narHash": "sha256-3RUAwk0ApPjq2Ms8KiAh+gG6EJKWurIur612w2m3Zu8=",
        "ref": "refs/heads/master",
-        "rev": "30152917194d6e54ce68e45b499323356db3ae7c",
-        "revCount": 283,
+        "rev": "c8ddb36f3d85be762aeb1893a79da36014f55658",
+        "revCount": 296,
        "type": "git",
        "url": "https://git.thalheim.io/Mic92/retiolum"
      },
@@ -580,7 +519,6 @@
        "recht": "recht",
        "retiolum": "retiolum",
        "scripts": "scripts",
-        "stockholm": "stockholm",
        "telebots": "telebots",
        "tinc-graph": "tinc-graph",
        "traadfri": "traadfri",
@@ -646,8 +584,8 @@
    },
    "rust-overlay_4": {
      "inputs": {
-        "flake-utils": "flake-utils_10",
-        "nixpkgs": "nixpkgs_9"
+        "flake-utils": "flake-utils_8",
+        "nixpkgs": "nixpkgs_8"
      },
      "locked": {
        "lastModified": 1677119371,
@@ -691,32 +629,25 @@
        "type": "github"
      }
    },
-    "stockholm": {
-      "inputs": {
-        "flake-utils": "flake-utils_7",
-        "nix-writers": "nix-writers",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "systems": {
      "locked": {
-        "lastModified": 1677616153,
-        "narHash": "sha256-PNXb97q62yK61alFlOeohpro8WLxt2ay1jYUTrFMgPA=",
-        "owner": "kmein",
-        "repo": "stockholm",
-        "rev": "831a6668339e3be59a449645624fd61e55bd45ff",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
-        "owner": "kmein",
-        "repo": "stockholm",
+        "owner": "nix-systems",
+        "repo": "default",
        "type": "github"
      }
    },
    "telebots": {
      "inputs": {
-        "flake-utils": "flake-utils_9",
-        "nixpkgs": "nixpkgs_8"
+        "flake-utils": "flake-utils_7",
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
        "lastModified": 1677156381,
@@ -758,8 +689,8 @@
    },
    "traadfri": {
      "inputs": {
-        "flake-utils": "flake-utils_11",
-        "nixpkgs": "nixpkgs_10"
+        "flake-utils": "flake-utils_9",
+        "nixpkgs": "nixpkgs_9"
      },
      "locked": {
        "lastModified": 1677165914,
@@ -793,11 +724,11 @@
    "voidrice": {
      "flake": false,
      "locked": {
-        "lastModified": 1677155625,
-        "narHash": "sha256-fxkeRwTfdzfHTRmwvUpbbL/bcCtDot/b7sUXfyq3+Vo=",
+        "lastModified": 1681301489,
+        "narHash": "sha256-5Zz33Q3E4A9nsEmxPQikYeX7Rvu3hM+PlXx/0SIqG34=",
        "owner": "Lukesmithxyz",
        "repo": "voidrice",
-        "rev": "2062e8110cc6b4479417ff5c5f966aebe337a6da",
+        "rev": "d4ff2ebaf3e88efe20cae0d1e592fddfc433c96e",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -17,14 +17,12 @@
    tinc-graph.url = "github:kmein/tinc-graph";
    traadfri.url = "github:kmein/traadfri";
    voidrice.url = "github:Lukesmithxyz/voidrice";
-    stockholm.url = "github:kmein/stockholm";

    agenix.inputs.nixpkgs.follows = "nixpkgs";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
    menstruation-backend.inputs.flake-utils.follows = "flake-utils";
    menstruation-backend.inputs.nixpkgs.follows = "nixpkgs";
    nixinate.inputs.nixpkgs.follows = "nixpkgs";
-    stockholm.inputs.nixpkgs.follows = "nixpkgs";
    tinc-graph.inputs.flake-utils.follows = "flake-utils";
    tinc-graph.inputs.nixpkgs.follows = "nixpkgs";
    voidrice.flake = false;
@@ -39,27 +37,34 @@
    agenix,
    retiolum,
    flake-utils,
-    stockholm,
    ...
-  }: let
-  in
+  }:
    {
      apps = nixinate.nixinate.x86_64-linux self;

      nixosModules = {
+        htgen = import modules/htgen.nix;
        moodle-dl = import modules/moodle-dl.nix;
        networkmanager-declarative = import modules/networkmanager-declarative.nix;
        passport = import modules/passport.nix;
+        panoptikon = import modules/panoptikon.nix;
+        power-action = import modules/power-action.nix;
+        specus = import modules/specus.nix;
        system-dependent = import modules/system-dependent.nix;
        telegram-bot = import modules/telegram-bot.nix;
        traadfri = import modules/traadfri.nix;
      };

+      lib = {
+        panoptikon = import lib/panoptikon.nix;
+      };
+
      nixosConfigurations = {
        ful = nixpkgs.lib.nixosSystem rec {
          system = "aarch64-linux";
          specialArgs = {
            niveumPackages = inputs.self.packages.${system};
+            niveumLib = inputs.self.lib;
            inherit inputs;
          };
          modules = [
@@ -74,7 +79,11 @@
            }
            systems/ful/configuration.nix
            agenix.nixosModules.default
+            inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
+            inputs.self.nixosModules.panoptikon
            retiolum.nixosModules.retiolum
+            nur.nixosModules.nur
          ];
        };
        zaatar = nixpkgs.lib.nixosSystem rec {
@@ -118,8 +127,9 @@
            }
            systems/makanek/configuration.nix
            inputs.self.nixosModules.telegram-bot
-            inputs.stockholm.nixosModules.htgen
+            inputs.self.nixosModules.htgen
            inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
            agenix.nixosModules.default
            retiolum.nixosModules.retiolum
            nur.nixosModules.nur
@@ -183,6 +193,7 @@
            systems/kabsa/configuration.nix
            agenix.nixosModules.default
            retiolum.nixosModules.retiolum
+            inputs.self.nixosModules.specus
            home-manager.nixosModules.home-manager
            nur.nixosModules.nur
          ];
@@ -192,7 +203,13 @@
    // flake-utils.lib.eachSystem [flake-utils.lib.system.x86_64-linux flake-utils.lib.system.aarch64-linux] (system: let
      pkgs = import nixpkgs {
        inherit system;
-        overlays = [nur.overlay];
+        overlays = [
+          nur.overlay
+          (self: super: {
+            mpv = super.mpv.override {scripts = [inputs.self.packages.${system}.mpv-visualizer];};
+            dmenu = super.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
+          })
+        ];
      };
      wrapScript = {
        packages ? [],
@@ -201,11 +218,12 @@
      }:
        pkgs.writers.writeDashBin name ''PATH=$PATH:${nixpkgs.lib.makeBinPath (packages ++ [pkgs.findutils pkgs.coreutils pkgs.gnused pkgs.gnugrep])} ${script} "$@"'';
    in {
-      packages = {
+      packages = rec {
        auc = pkgs.callPackage packages/auc.nix {};
        betacode = pkgs.callPackage packages/betacode.nix {};
        cheat-sh = pkgs.callPackage packages/cheat-sh.nix {};
        closest = pkgs.callPackage packages/closest {};
+        cyberlocker-tools = pkgs.callPackage packages/cyberlocker-tools.nix {};
        default-gateway = pkgs.callPackage packages/default-gateway.nix {};
        depp = pkgs.callPackage packages/depp.nix {};
        devanagari = pkgs.callPackage packages/devanagari {};
@@ -220,7 +238,9 @@
        genius = pkgs.callPackage packages/genius.nix {};
        gfs-fonts = pkgs.callPackage packages/gfs-fonts.nix {};
        git-preview = pkgs.callPackage packages/git-preview.nix {};
+        hc = pkgs.callPackage packages/hc.nix {};
        heuretes = pkgs.callPackage packages/heuretes.nix {};
+        htgen = pkgs.callPackage packages/htgen.nix {};
        image-convert-favicon = pkgs.callPackage packages/image-convert-favicon.nix {};
        image-convert-tolino = pkgs.callPackage packages/image-convert-tolino.nix {};
        infschmv = pkgs.callPackage packages/infschmv.nix {};
@@ -231,6 +251,7 @@
        k-lock = pkgs.callPackage packages/k-lock.nix {};
        kirciuoklis = pkgs.callPackage packages/kirciuoklis.nix {};
        klem = pkgs.callPackage packages/klem.nix {};
+        kpaste = pkgs.callPackage packages/kpaste.nix {};
        literature-quote = pkgs.callPackage packages/literature-quote.nix {};
        mahlzeit = pkgs.haskellPackages.callPackage packages/mahlzeit.nix {};
        man-pandoc = pkgs.callPackage packages/man/pandoc.nix {};
@@ -257,6 +278,7 @@
        trans = pkgs.callPackage packages/trans.nix {};
        ttspaste = pkgs.callPackage packages/ttspaste.nix {};
        unicodmenu = pkgs.callPackage packages/unicodmenu.nix {};
+        untilport = pkgs.callPackage packages/untilport.nix {};
        vg = pkgs.callPackage packages/vg.nix {};
        vimPlugins-cheat-sh-vim = pkgs.callPackage packages/vimPlugins/cheat-sh.nix {};
        vimPlugins-icalendar-vim = pkgs.callPackage packages/vimPlugins/icalendar-vim.nix {};
@@ -268,9 +290,13 @@
        vimPlugins-vim-mail = pkgs.callPackage packages/vimPlugins/vim-mail.nix {};
        vimPlugins-vim-reason-plus = pkgs.callPackage packages/vimPlugins/vim-reason-plus.nix {};
        vimv = pkgs.callPackage packages/vimv.nix {};
+        weechat-declarative = pkgs.callPackage packages/weechat-declarative.nix {};
        weechatScripts-hotlist2extern = pkgs.callPackage packages/weechatScripts/hotlist2extern.nix {};
        wttr = pkgs.callPackage packages/wttr.nix {};

+        itl = pkgs.callPackage packages/itl.nix {};
+        itools = pkgs.callPackage packages/itools.nix {itl = itl;};
+
        booksplit = wrapScript {
          script = inputs.voidrice.outPath + "/.local/bin/booksplit";
          name = "booksplit";
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -40,7 +40,7 @@ rec {

  sshPort = 22022;

-  colours = import ./colours/papercolor-dark.nix;
+  colours = import ./colours/owickstrom-dark.nix;

  theme = pkgs: {
    gtk = {
@@ -72,7 +72,7 @@ rec {
    sshKeys = pkgs:
      pkgs.lib.strings.splitString "\n" (pkgs.lib.strings.fileContents (pkgs.fetchurl {
        url = "https://github.com/kmein.keys";
-        sha256 = "09c6ny0rmpid1m0pc1wsmb3wyy9g721lf4kv55i4lrp42b3i2d5b";
+        hash = "sha256-TvvPwplrH9cw7NE4GKqbE5ga+oBHM+TkjxYQ3b1fpLI=";
      }));
  };

--- a/lib/i3status-rust.nix
+++ b/lib/i3status-rust.nix
@@ -21,8 +21,6 @@ in {
      info_fg = colours.cyan.bright;
      warning_fg = colours.yellow.bright;
      warning_bg = colours.background;
-      alternating_tint_bg = colours.background;
-      alternating_tint_fg = colours.foreground;
      critical_bg = colours.background;
      good_bg = colours.background;
      idle_bg = colours.background;
--- a/lib/panoptikon.nix
+++ b/lib/panoptikon.nix
@@ -0,0 +1,45 @@
+{
+  pkgs,
+  lib,
+  niveumPackages,
+  config,
+  ...
+}: {
+  # watcher scripts
+  url = address:
+    pkgs.writers.writeDash "watch-url" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
+        | ${pkgs.python3Packages.html2text}/bin/html2text --decode-errors=ignore
+    '';
+  urlSelector = selector: address:
+    pkgs.writers.writeDash "watch-url-selector" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
+        | ${pkgs.htmlq}/bin/htmlq ${lib.escapeShellArg selector} \
+        | ${pkgs.python3Packages.html2text}/bin/html2text
+    '';
+  urlJSON = {jqScript ? "."}: address:
+    pkgs.writers.writeDash "watch-url-json" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} | ${pkgs.jq}/bin/jq -f ${pkgs.writeText "script.jq" jqScript}
+    '';
+
+  # reporter scripts
+  kpaste-irc = {
+    target,
+    retiolumLink ? false,
+    server ? "irc.r",
+    messagePrefix ? "change detected: ",
+    nick ? ''"$PANOPTIKON_WATCHER"-watcher'',
+  }:
+    pkgs.writers.writeDash "kpaste-irc-reporter" ''
+      ${niveumPackages.kpaste}/bin/kpaste \
+        | ${pkgs.gnused}/bin/sed -n "${
+        if retiolumLink
+        then "2"
+        else "3"
+      }s/^/${messagePrefix}/p" \
+        | ${config.nur.repos.mic92.ircsink}/bin/ircsink \
+          --nick ${nick} \
+          --server ${server} \
+          --target ${target}
+    '';
+}
--- a/lib/streams.nix
+++ b/lib/streams.nix
@@ -956,6 +956,11 @@ in
      stream = soma-fm "scanner";
      tags = [tags.soma tags.text];
    }
+    {
+      station = "Al Jazeera Arabic";
+      stream = "https://live-hls-audio-web-aja.getaj.net/VOICE-AJA/01.m3u8";
+      tags = [tags.text tags.arabic];
+    }
    {
      desc = "Celebrating NASA and Space Explorers everywhere.";
      logo = "http://soma.fm/img/missioncontrol120.jpg";
@@ -1842,71 +1847,127 @@ in
      stream = dr "p8jazz";
      tags = [tags.jazz tags.danish];
    }
+    {
+      station = "CNN morse code slow";
+      stream = "http://cw.dimebank.com:8080/CNNslow";
+      tags = [tags.text];
+    }
+    {
+      station = "CNN morse code fast";
+      stream = "http://cw.dimebank.com:8080/CNNfast";
+      tags = [tags.text];
+    }
+    {
+      station = "XXX orchestral";
+      stream = "http://orion.shoutca.st:8978/stream";
+      tags = [tags.classical];
+    }
+    {
+      station = "XXX greek";
+      stream = "http://radio.hostchefs.net:8046/stream?1520818130148";
+      tags = [tags.greek];
+    }
+    {
+      station = "XXX turkish or greek";
+      stream = "https://onairmediagroup.live24.gr/kralfm100xanthi";
+      tags = [tags.greek tags.turkish];
+    }
+    {
+      station = "Hard Rock Hell Radio";
+      tags = [tags.rock];
+      stream = "http://andromeda.shoutca.st:9254/stream";
+    }
+    {
+      station = "Divyavani";
+      tags = [tags.trad tags.indian];
+      stream = "https://divyavani.radioca.st/stream";
+    }
+    {
+      station = "XXX sanskrit radio";
+      tags = [tags.text tags.indian];
+      stream = "https://stream-23.zeno.fm/m08mkwsyw8quv?zs=0w7MJFPdRfavhR_zPt0M2g";
+    }
+    {
+      station = "Radio Mariam Arabic";
+      stream = "http://www.dreamsiteradiocp4.com:8014/stream";
+      tags = [tags.text tags.arabic];
+    }
+    {
+      station = "Kamchatka Live Rock";
+      stream = "https://radio.kamchatkalive.ru:8103/rock";
+      tags = [tags.rock];
+    }
+    {
+      station = "Kamchatka Live Chillout";
+      stream = "https://radio.kamchatkalive.ru:8103/chillout";
+      tags = [tags.chill];
+    }
+    {
+      station = "Kamchatka Live Dance";
+      stream = "https://radio.kamchatkalive.ru:8103/dance";
+      tags = [tags.party];
+    }
+    {
+      tags = [tags.arabic tags.text];
+      stream = "http://n02.radiojar.com/sxfbks1vfy8uv.mp3";
+      station = "Bahrain Radio 102.3 FM (Arabic Stories)";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      stream = "http://s2.voscast.com:12312/;";
+      station = "Bahrain Quran Radio";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      stream = "http://162.244.81.30:8224/;";
+      station = "Quran Radio Lebanon";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      station = "Coptic for God";
+      stream = "http://66.70.249.70:5832/stream";
+    }
+    {
+      stream = "http://stream-025.zeno.fm/5y95pu36sm0uv?";
+      station = "Hayat FM";
+      tags = [tags.arabic tags.text tags.holy];
+    }
+    {
+      stream = "http://uk2.internet-radio.com:8151/stream";
+      station = "The Quran Radio";
+      tags = [tags.arabic tags.text tags.holy];
+    }
  ]
+  ++ map (name: {
+    stream = "https://${name}.stream.publicradio.org/${name}.aac";
+    station = "${name} | Your Classical";
+    tags = [tags.classical];
+  }) ["ycradio" "guitar" "cms" "relax" "lullabies" "choral" "favorites" "chambermusic" "concertband" "holiday"]
 /*
      (caster-fm "TODO" "noasrv" 10182) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u
      (caster-fm "TODO" "shaincast" 20866) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u

-CNN news in morse code
-http://cw.dimebank.com:8080/CNNslow
-http://cw.dimebank.com:8080/CNNfast
-
-Orchestral
-http://orion.shoutca.st:8978/stream

 LoFi / Chill
 http://ice55.securenetsystems.net/DASH76

-News background music
-https://c13014-l-hls.u.core.cdn.streamfarm.net/1000153copo/hk2.m3u8
-
-?
-http://94.23.221.158:9163/stream
-
-Greek radio
-http://radio.hostchefs.net:8046/stream?1520818130148

 : http://audiokrishna.com/stations/japa2.mp3
-http://185.105.4.53:2339//;stream.mp3
-http://cast5.servcast.net:1390/;stream.mp3
-
-Hard rock
-http://andromeda.shoutca.st:9254/stream

 Rock alternative
 http://icy.unitedradio.it/VirginRockAlternative.mp3

-American nautical weather news
-http://ca.radioboss.fm:8149/stream

 Christian radio in all languages
 https://jesuscomingfm.com/#
 tamazight http://live.jesuscomingfm.com:8462/;

-supposedly good Greek radio
-https://onairmediagroup.live24.gr/kralfm100xanthi

 Somali Radio
 http://n0b.radiojar.com/1pu7hhf8kfhvv

-Sanskrit
-https://stream-23.zeno.fm/m08mkwsyw8quv?zs=0w7MJFPdRfavhR_zPt0M2g
-https://divyavani.radioca.st/stream

 Chillout from kassel
 https://server4.streamserver24.com:2199/tunein/ejanowsk.pls
-
-Radio Mariam Arabic (Rome)
-http://www.dreamsiteradiocp4.com:8014/stream
-
-https://radio.kamchatkalive.ru:8103/rock
-https://radio.kamchatkalive.ru:8103/chillout
-https://radio.kamchatkalive.ru:8103/dance
-
-Fuṣḥā Stories (Bahrain Radio 102.3 FM)
-http://n02.radiojar.com/sxfbks1vfy8uv.mp3
-
-Bahrain Quran Radio
-http://s2.voscast.com:12312/;
 */

--- a/lib/vim/init.lua
+++ b/lib/vim/init.lua
@@ -0,0 +1,86 @@
+local opts = { noremap=true, silent=true }
+vim.keymap.set('n', '<space>e', vim.diagnostic.open_float, opts)
+vim.keymap.set('n', '[d', vim.diagnostic.goto_prev, opts)
+vim.keymap.set('n', ']d', vim.diagnostic.goto_next, opts)
+vim.keymap.set('n', '<space>q', vim.diagnostic.setloclist, opts)
+
+-- Use an on_attach function to only map the following keys
+-- after the language server attaches to the current buffer
+local on_attach = function(client, bufnr)
+  -- Enable completion triggered by <c-x><c-o>
+  vim.api.nvim_buf_set_option(bufnr, 'omnifunc', 'v:lua.vim.lsp.omnifunc')
+
+  -- Mappings.
+  -- See `:help vim.lsp.*` for documentation on any of the below functions
+  local bufopts = { noremap=true, silent=true, buffer=bufnr }
+  vim.keymap.set('n', 'gD', vim.lsp.buf.declaration, bufopts)
+  vim.keymap.set('n', 'gd', vim.lsp.buf.definition, bufopts)
+  vim.keymap.set('n', 'K', vim.lsp.buf.hover, bufopts)
+  vim.keymap.set('n', 'gi', vim.lsp.buf.implementation, bufopts)
+  vim.keymap.set('n', '<C-k>', vim.lsp.buf.signature_help, bufopts)
+  vim.keymap.set('n', '<space>wa', vim.lsp.buf.add_workspace_folder, bufopts)
+  vim.keymap.set('n', '<space>wr', vim.lsp.buf.remove_workspace_folder, bufopts)
+  vim.keymap.set('n', '<space>wl', function()
+    print(vim.inspect(vim.lsp.buf.list_workspace_folders()))
+  end, bufopts)
+  vim.keymap.set('n', '<space>D', vim.lsp.buf.type_definition, bufopts)
+  vim.keymap.set('n', '<space>rn', vim.lsp.buf.rename, bufopts)
+  vim.keymap.set('n', '<space>ca', vim.lsp.buf.code_action, bufopts)
+  vim.keymap.set('n', 'gr', vim.lsp.buf.references, bufopts)
+  vim.keymap.set('n', '<space>f', function() vim.lsp.buf.format { async = true } end, bufopts)
+end
+
+local lsp_flags = {
+  -- This is the default in Nvim 0.7+
+  debounce_text_changes = 150,
+}
+
+language_servers = {
+  pyright = {}, -- pyright
+  -- tsserver = {}, -- typescript-language-server
+  -- elmls = {}, -- elm-language-server
+  -- denols = {}, -- deno built in
+  -- bashls = {}, -- bash-language-server
+  hls = {}, -- haskell-language-server
+  -- html = {}, -- vscode-langservers-extracted
+  -- jsonls = {}, -- vscode-langservers-extracted
+  nil_ls = {}, -- github:oxalica/nil
+  -- rnix = {}, -- rnix-lsp
+  -- jqls = {}, -- jq-lsp
+  rust_analyzer = { ["rust-analyzer"] = {} },
+  -- eslint?
+  -- volar? vls?
+  texlab = {
+    texlab = {
+      auxDirectory = ".",
+      bibtexFormatter = "texlab",
+      build = {
+        args = { "-pdf", "-interaction=nonstopmode", "-synctex=1", "%f" },
+        executable = "latexmk",
+        forwardSearchAfter = false,
+        onSave = false
+      },
+      chktex = {
+        onEdit = false,
+        onOpenAndSave = false
+      },
+      diagnosticsDelay = 300,
+      formatterLineLength = 80,
+      forwardSearch = {
+        args = {}
+      },
+      latexFormatter = "latexindent",
+      latexindent = {
+        modifyLineBreaks = false
+      }
+    }
+  }
+}
+
+for server, settings in pairs(language_servers) do
+  require('lspconfig')[server].setup{
+    on_attach = on_attach,
+    flags = lsp_flags,
+    settings = settings,
+  }
+end
--- a/modules/htgen.nix
+++ b/modules/htgen.nix
@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  htgen = pkgs.callPackage ../packages/htgen.nix {};
+in {
+  options.services.htgen = lib.mkOption {
+    default = {};
+    type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
+      options = {
+        enable = lib.mkEnableOption "htgen-${config._module.args.name}";
+        port = lib.mkOption {
+          type = lib.types.int;
+        };
+        script = lib.mkOption {
+          type = lib.types.str;
+        };
+      };
+    }));
+  };
+  config = {
+    systemd.services =
+      lib.mapAttrs' (
+        name: cfg:
+          lib.nameValuePair "htgen-${name}" {
+            wantedBy = ["multi-user.target"];
+            after = ["network.target"];
+            environment = {
+              HOME = "/var/lib/htgen-${name}";
+              HTGEN_PORT = toString cfg.port;
+              HTGEN_SCRIPT = cfg.script;
+            };
+            serviceConfig = {
+              SyslogIdentifier = "htgen-${name}";
+              DynamicUser = true;
+              StateDirectory = "htgen-${name}";
+              PrivateTmp = true;
+              Restart = "always";
+              ExecStart = "${htgen}/bin/htgen --serve";
+            };
+          }
+      )
+      config.services.htgen;
+  };
+}
--- a/modules/panoptikon.nix
+++ b/modules/panoptikon.nix
@@ -0,0 +1,130 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  options.services.panoptikon = {
+    enable = lib.mkEnableOption "Generic command output / website watcher";
+    watchers = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (watcher: {
+        options = {
+          script = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              A script whose stdout is to be watched.
+            '';
+            example = ''
+              pkgs.writers.writeDash "github-meta" '''
+                ''${pkgs.curl}/bin/curl -sSL https://api.github.com/meta | ''${pkgs.jq}/bin/jq
+              '''
+            '';
+          };
+          frequency = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              How often to run the script. See systemd.time(7) for more information about the format.
+            '';
+            example = "*:0/3";
+            default = "daily";
+          };
+          reporters = lib.mkOption {
+            type = lib.types.listOf lib.types.path;
+            description = ''
+              A list of scripts that take the diff (if any) via stdin and report it (e.g. to IRC, Telegram or Prometheus). The name of the watcher will be in the $PANOPTIKON_WATCHER environment variable.
+            '';
+            example = ''
+              [
+                (pkgs.writers.writeDash "telegram-reporter" '''
+                  ''${pkgs.curl}/bin/curl -X POST https://api.telegram.org/bot''${TOKEN}/sendMessage \
+                    -d chat_id=123456 \
+                    -d text="$(cat)"
+                ''')
+                (pkgs.writers.writeDash "notify" '''
+                  ''${pkgs.libnotify}/bin/notify-send "$PANOPTIKON_WATCHER has changed."
+                ''')
+              ]
+            '';
+          };
+        };
+        config = {};
+      }));
+    };
+  };
+
+  config = let
+    cfg = config.services.panoptikon;
+  in
+    lib.mkIf cfg.enable {
+      users.extraUsers.panoptikon = {
+        isSystemUser = true;
+        createHome = true;
+        home = "/var/lib/panoptikon";
+        group = "panoptikon";
+      };
+
+      users.extraGroups.panoptikon = {};
+
+      systemd.timers = lib.attrsets.mapAttrs' (watcherName: _:
+        lib.nameValuePair "panoptikon-${watcherName}" {
+          timerConfig.RandomizedDelaySec = toString (60 * 60);
+        })
+      cfg.watchers;
+
+      systemd.services =
+        {
+          setup-panoptikon = {
+            enable = true;
+            wantedBy = ["multi-user.target"];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "panoptikon";
+              Group = "panoptikon";
+              WorkingDirectory = "/var/lib/panoptikon";
+              Restart = "on-failure";
+            };
+            script = ''
+              ${pkgs.git}/bin/git init --quiet
+              ${pkgs.git}/bin/git config user.email "panoptikon@${config.networking.hostName}"
+              ${pkgs.git}/bin/git config user.name Panoptikon
+            '';
+          };
+        }
+        // lib.attrsets.mapAttrs' (watcherName: watcherOptions:
+          lib.nameValuePair "panoptikon-${watcherName}" {
+            enable = true;
+            after = ["setup-panoptikon.service"];
+            startAt = watcherOptions.frequency;
+            serviceConfig = {
+              Type = "oneshot";
+              User = "panoptikon";
+              Group = "panoptikon";
+              WorkingDirectory = "/var/lib/panoptikon";
+              RestartSec = "60";
+              Restart = "on-failure";
+            };
+            unitConfig = {
+              StartLimitIntervalSec = "300";
+              StartLimitBurst = "5";
+            };
+            environment.PANOPTIKON_WATCHER = watcherName;
+            wants = ["network-online.target"];
+            script = ''
+              set -efu
+
+              ${watcherOptions.script} > ${watcherName}
+              ${pkgs.git}/bin/git add ${watcherName}
+              ${pkgs.git}/bin/git commit --message "${watcherName} / $(${pkgs.coreutils}/bin/date -Is)" || :
+
+              if [ -n "$(${pkgs.git}/bin/git diff HEAD^ -- ${watcherName})" ]; then
+                ${lib.strings.concatMapStringsSep "\n" (reporter: ''
+                  ${pkgs.git}/bin/git diff HEAD^ -- ${watcherName} | ${reporter}
+                '')
+                watcherOptions.reporters}
+                :
+              fi
+            '';
+          })
+        cfg.watchers;
+    };
+}
--- a/modules/power-action.nix
+++ b/modules/power-action.nix
@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.services.power-action;
+
+  out = {
+    options.services.power-action = api;
+    config = lib.mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "power-action";
+    battery = mkOption {
+      type = types.str;
+      default = "BAT0";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "power-action";
+    };
+    startAt = mkOption {
+      type = types.str;
+      default = "*:0/1";
+    };
+    plans = mkOption {
+      type = with types;
+        attrsOf (submodule {
+          options = {
+            charging = mkOption {
+              type = nullOr bool;
+              default = null;
+              description = ''
+                check for charging status.
+                null = don't care
+                true = only if system is charging or unknown
+                false = only if system is discharging
+              '';
+            };
+            upperLimit = mkOption {
+              type = int;
+            };
+            lowerLimit = mkOption {
+              type = int;
+            };
+            action = mkOption {
+              type = path;
+            };
+          };
+        });
+    };
+  };
+
+  imp = {
+    systemd.services.power-action = {
+      serviceConfig = rec {
+        ExecStart = startScript;
+        User = cfg.user;
+      };
+      startAt = cfg.startAt;
+    };
+  };
+
+  startScript = pkgs.writers.writeDash "power-action" ''
+    set -euf
+
+    power="$(${powerlvl})"
+    state="$(${state})"
+    ${concatStringsSep "\n" (mapAttrsToList writeRule cfg.plans)}
+  '';
+  charging_check = plan:
+    if (plan.charging == null)
+    then ""
+    else if plan.charging
+    then ''&& [ "$state" = "true" ]''
+    else ''&& ! [ "$state" = "true" ]'';
+
+  writeRule = _: plan: "if [ $power -ge ${toString plan.lowerLimit} ] && [ $power -le ${toString plan.upperLimit} ] ${charging_check plan}; then ${plan.action}; fi";
+
+  powerlvl = pkgs.writers.writeDash "powerlvl" ''
+    cat /sys/class/power_supply/${cfg.battery}/capacity
+  '';
+
+  state = pkgs.writers.writeDash "state" ''
+    if [ "$(cat /sys/class/power_supply/${cfg.battery}/status)" = "Discharging" ]
+      then echo "false"
+      else echo "true"
+    fi
+  '';
+in
+  out
--- a/modules/retiolum.nix
+++ b/modules/retiolum.nix
@@ -0,0 +1,72 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib; let
+  netname = "retiolum";
+  cfg = config.networking.retiolum;
+in {
+  options = {
+    networking.retiolum.ipv4 = mkOption {
+      type = types.str;
+      description = ''
+        own ipv4 address
+      '';
+    };
+    networking.retiolum.ipv6 = mkOption {
+      type = types.str;
+      description = ''
+        own ipv6 address
+      '';
+    };
+    networking.retiolum.nodename = mkOption {
+      type = types.str;
+      default = config.networking.hostName;
+      description = ''
+        tinc network name
+      '';
+    };
+  };
+
+  config = {
+    services.tinc.networks.${netname} = {
+      name = cfg.nodename;
+      hosts =
+        builtins.mapAttrs
+        (name: _: builtins.readFile "${<retiolum/hosts>}/${name}")
+        (builtins.readDir <retiolum/hosts>);
+      rsaPrivateKeyFile = toString <system-secrets/retiolum.key>;
+      ed25519PrivateKeyFile = toString <system-secrets/retiolum.ed25519>;
+      extraConfig = ''
+        LocalDiscovery = yes
+        AutoConnect = yes
+      '';
+    };
+
+    networking.extraHosts = builtins.readFile (toString <retiolum/etc.hosts>);
+
+    environment.systemPackages = [config.services.tinc.networks.${netname}.package];
+
+    networking.firewall = {
+      allowedTCPPorts = [655];
+      allowedUDPPorts = [655];
+    };
+    #services.netdata.portcheck.checks.tinc.port = 655;
+
+    systemd.network = {
+      enable = true;
+      networks = {
+        "${netname}".extraConfig = ''
+          [Match]
+          Name = tinc.${netname}
+
+          [Network]
+          Address=${cfg.ipv4}/12
+          Address=${cfg.ipv6}/16
+        '';
+      };
+    };
+  };
+}
--- a/modules/specus.nix
+++ b/modules/specus.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  specusMachines = {
+    servers = {
+      makanek = {
+        ipv4 = "10.100.0.1";
+        publicKey = "KhcScd4fBpdhQzK8Vc+1mEHQMQBpbKBUPB4oZ7skeSk=";
+      };
+      ful = {
+        ipv4 = "10.100.0.2";
+        publicKey = "0Y7+zoXkWJGVOWWnMjvYjtwP+WpggAlmkRbgMw0z8Dk=";
+      };
+    };
+    clients = {
+      kabsa = {
+        ipv4 = "10.100.0.101";
+        publicKey = "nRkzoRi9crKHF7263U37lt4GGL7/8637NBSKjifI9hY=";
+      };
+    };
+  };
+in {
+  options.services.specus = {
+    server = {
+      enable = lib.mkEnableOption "Specus private VPN (server)";
+    };
+    client = {
+      enable = lib.mkEnableOption "Specus private VPN (client)";
+    };
+    privateKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Private key file of the server/client machine";
+    };
+  };
+
+  config = let
+    cfg = config.services.specus;
+    specusPort = 22;
+  in
+    {
+      assertions = [
+        {
+          assertion =
+            !(cfg.server.enable && cfg.client.enable);
+          message = "specus: systems cannot be client and server at the same time";
+        }
+      ];
+    }
+    // lib.mkIf cfg.server.enable {
+      networking.nat = {
+        enable = true;
+        externalInterface = "eth0"; # TODO
+        internalInterfaces = ["specus"];
+      };
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces.specus = {
+        ips = ["${specusMachines.servers.${config.networking.hostName}.ipv4}/24"];
+        # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        listenPort = specusPort;
+        privateKeyFile = cfg.privateKeyFile;
+        peers =
+          lib.mapAttrsToList (clientName: clientConfig: {
+            publicKey = clientConfig.publicKey;
+            allowedIPs = ["${clientConfig.ipv4}/32"];
+          })
+          specusMachines.clients;
+      };
+    }
+    // lib.mkIf cfg.client.enable {
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces = lib.attrsets.mapAttrs' (serverName: serverConfig:
+        lib.nameValuePair "specus-${serverName}" {
+          ips = ["${specusMachines.clients.${config.networking.hostName}.ipv4}/24"];
+          listenPort = specusPort;
+          privateKeyFile = cfg.privateKeyFile;
+          peers = [
+            {
+              allowedIPs = ["0.0.0.0/0"];
+              endpoint = "${(import ../lib/external-network.nix).${serverName}}:${toString specusPort}";
+              persistentKeepalive = 25;
+              publicKey = serverConfig.publicKey;
+            }
+          ];
+        })
+      specusMachines.servers;
+    };
+}
--- a/packages/cyberlocker-tools.nix
+++ b/packages/cyberlocker-tools.nix
@@ -0,0 +1,23 @@
+{pkgs}:
+pkgs.symlinkJoin {
+  name = "cyberlocker-tools";
+  paths = [
+    (pkgs.writers.writeDashBin "cput" ''
+      set -efu
+      path=''${1:-$(hostname)}
+      path=$(echo "/$path" | sed -E 's:/+:/:')
+      url=http://c.r$path
+
+      ${pkgs.curl}/bin/curl -fSs --data-binary @- "$url"
+      echo "$url"
+    '')
+    (pkgs.writers.writeDashBin "cdel" ''
+      set -efu
+      path=$1
+      path=$(echo "/$path" | sed -E 's:/+:/:')
+      url=http://c.r$path
+
+      ${pkgs.curl}/bin/curl -f -X DELETE "$url"
+    '')
+  ];
+}
--- a/packages/dic.nix
+++ b/packages/dic.nix
@@ -0,0 +1,43 @@
+{
+  fetchgit,
+  lib,
+  stdenv,
+  coreutils,
+  curl,
+  gnugrep,
+  gnused,
+  util-linux,
+}:
+stdenv.mkDerivation {
+  name = "dic";
+
+  src = fetchgit {
+    url = https://cgit.ni.krebsco.de/dic;
+    rev = "refs/tags/v1.1.1";
+    sha256 = "1gbj967a5hj53fdkkxijqgwnl9hb8kskz0cmpjq7v65ffz3v6vag";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = let
+    path = lib.makeBinPath [
+      coreutils
+      curl
+      gnused
+      gnugrep
+      util-linux
+    ];
+  in ''
+    mkdir -p $out/bin
+
+    sed \
+      's,^main() {$,&\n  PATH=${path}; export PATH,' \
+      < ./dic \
+      > $out/bin/dic
+
+    chmod +x $out/bin/dic
+  '';
+}
--- a/packages/hc.nix
+++ b/packages/hc.nix
@@ -0,0 +1,49 @@
+{
+  fetchgit,
+  lib,
+  makeWrapper,
+  stdenv,
+  coreutils,
+  findutils,
+  gawk,
+  gnugrep,
+  qrencode,
+  texlive,
+  utillinux,
+  zbar,
+}:
+stdenv.mkDerivation rec {
+  name = "hc-${meta.version}";
+
+  src = fetchgit {
+    url = "https://cgit.krebsco.de/hc";
+    rev = "refs/tags/v${meta.version}";
+    sha256 = "09349gja22p0j3xs082kp0fnaaada14bafszn4r3q7rg1id2slfb";
+  };
+
+  nativeBuildInputs = [makeWrapper];
+
+  buildPhase = null;
+
+  installPhase = ''
+    mkdir -p $out/bin
+
+    cp $src/bin/hc $out/bin/hc
+
+    wrapProgram $out/bin/hc \
+      --prefix PATH : ${lib.makeBinPath [
+      coreutils
+      findutils
+      gawk
+      gnugrep
+      qrencode
+      texlive.combined.scheme-full
+      utillinux
+      zbar
+    ]}
+  '';
+
+  meta = {
+    version = "1.0.0";
+  };
+}
--- a/packages/htgen.nix
+++ b/packages/htgen.nix
@@ -0,0 +1,31 @@
+{
+  fetchgit,
+  lib,
+  pkgs,
+  stdenv,
+}:
+stdenv.mkDerivation rec {
+  pname = "htgen";
+  version = "1.3.1";
+
+  src = fetchgit {
+    url = "http://cgit.krebsco.de/htgen";
+    rev = "refs/tags/${version}";
+    sha256 = "0ml8kp89bwkrwy6iqclzyhxgv2qn9dcpwaafbmsr4mgcl70zx22r";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    {
+      echo '#! ${pkgs.dash}/bin/dash'
+      echo 'export PATH=${lib.makeBinPath [
+      pkgs.coreutils
+      pkgs.jq
+      pkgs.ucspi-tcp
+    ]}''${PATH+":$PATH"}'
+      sed 's:^Server=htgen$:&/${version}:' htgen
+    } > $out/bin/htgen
+    chmod +x $out/bin/htgen
+    cp -r examples $out
+  '';
+}
--- a/packages/itl.nix
+++ b/packages/itl.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, cmake, lib }:
+stdenv.mkDerivation rec {
+  pname = "itl";
+  version = "0.8.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "ITL";
+    rev = "v${version}";
+    sha256 = "sha256-GTicTbZmFbPhzInFob3cfvtTxOpUZuqsQz1w9CoWu9w=";
+  };
+  nativeBuildInputs = [cmake];
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "Islamic Tools and Libraries";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}
--- a/packages/itools.nix
+++ b/packages/itools.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, itl, lib, autoreconfHook }:
+stdenv.mkDerivation rec {
+  pname = "itools";
+  version = "1.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "itools";
+    rev = version;
+    sha256 = "sha256-g9bsjupC4Sb5ywAgUNbjYLbHZ/i994lbNSnX2JyaP3g=";
+  };
+  preAutoreconf = "autoupdate";
+  nativeBuildInputs = [autoreconfHook];
+  buildInputs = [itl];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "The itools package is a set of user friendly applications utilizing Arabeyes' ITL library. ";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}
--- a/packages/klem.nix
+++ b/packages/klem.nix
@@ -40,6 +40,8 @@
  '';
 in
  pkgs.writers.writeDashBin "klem" ''
+    set -efu
+
    ${pkgs.xclip}/bin/xclip -selection ${cfg.selection} -out \
      | case $(echo "${
      lib.concatStringsSep "\n" (lib.attrNames cfg.scripts)
@@ -49,4 +51,6 @@ in
      esac \
      | tr -d '\r\n' \
      | ${pkgs.xclip}/bin/xclip -selection ${cfg.selection} -in
+
+    ${pkgs.libnotify}/bin/notify-send --app-name="klem" "Result copied to clipboard."
  ''
--- a/packages/kpaste.nix
+++ b/packages/kpaste.nix
@@ -0,0 +1,9 @@
+{
+  curl,
+  gnused,
+  writers,
+}:
+writers.writeDashBin "kpaste" ''
+  ${curl}/bin/curl -sS http://p.r --data-binary @"''${1:--}" |
+  ${gnused}/bin/sed '$ {p;s|http://p.r|https://p.krebsco.de|}'
+''
--- a/packages/timer.nix
+++ b/packages/timer.nix
@@ -9,6 +9,9 @@ writers.writeDashBin "timer" ''
    echo "Usage: $0 TIME MESSAGE" 1>&2
    exit 1
  }
+  time=$(echo "$1" | ${bc}/bin/bc)
  echo "sleeping $time seconds, then saying: $2"
-  ${coreutils}/bin/sleep "$time" && ${espeak}/bin/espeak -v german-mbrola-6 "$2"
+  ${coreutils}/bin/sleep "$time" && {
+    echo "$2" | ${espeak}/bin/espeak -v german-mbrola-6
+  }
 ''
--- a/packages/untilport.nix
+++ b/packages/untilport.nix
@@ -0,0 +1,17 @@
+{pkgs, ...}:
+pkgs.writers.writeDashBin "untilport" ''
+  set -euf
+
+  usage() {
+    echo 'untiport $target $port'
+    echo 'Sleeps until the destinated port is reachable.'
+    echo 'ex: untilport google.de 80 && echo "google is now reachable"'
+  }
+
+
+  if [ $# -ne 2 ]; then
+    usage
+  else
+    until ${pkgs.libressl.nc}/bin/nc -z "$@"; do sleep 1; done
+  fi
+''
--- a/packages/urlwatch-insecure.patch
+++ b/packages/urlwatch-insecure.patch
@@ -1,12 +0,0 @@
-diff --git a/lib/urlwatch/storage.py b/lib/urlwatch/storage.py
-index 3f6160f..03979f0 100644
--- a/lib/urlwatch/storage.py
-+++ b/lib/urlwatch/storage.py
-@@ -292,7 +292,6 @@ class UrlsBaseFileStorage(BaseTextualFileStorage, metaclass=ABCMeta):
-         shelljob_errors = self.shelljob_security_checks()
-         if shelljob_errors and any(is_shell_job(job) for job in jobs):
-             print(('Removing shell jobs, because %s' % (' and '.join(shelljob_errors),)))
-            jobs = [job for job in jobs if not is_shell_job(job)]
- 
-         return jobs
- 
--- a/packages/weechat-declarative.nix
+++ b/packages/weechat-declarative.nix
@@ -0,0 +1,177 @@
+{
+  pkgs,
+  lib,
+  ...
+} @ args: let
+  # config cannot be declared in the input attribute set because that would
+  # cause callPackage to inject the wrong config.  Instead, get it from ...
+  # via args.
+  config = args.config or {};
+
+  lib =
+    args.lib
+    // rec {
+      attrPaths = let
+        recurse = path: value:
+          if builtins.isAttrs value
+          then lib.mapAttrsToList (name: recurse (path ++ [name])) value
+          else [(lib.nameValuePair path value)];
+      in
+        attrs: lib.flatten (recurse [] attrs);
+
+      attrPathsSep = sep: attrs: lib.listToAttrs (map (x: x // {name = lib.concatStringsSep sep x.name;}) (attrPaths attrs));
+
+      toWeechatValue = x:
+        {
+          bool = builtins.toJSON x;
+          string = x;
+          list = lib.concatMapStringsSep "," toWeechatValue x;
+          int = toString x;
+        }
+        .${builtins.typeOf x};
+
+      setCommand = name: value: "/set ${name} \"${toWeechatValue value}\"";
+
+      filterAddreplace = name: filter: "/filter addreplace ${name} ${filter.buffer} ${toWeechatValue filter.tags} ${filter.regex}";
+    };
+
+  cfg = eval.config;
+
+  eval = lib.evalModules {
+    modules = lib.singleton {
+      _file = toString ./default.nix;
+      imports = lib.singleton config;
+      options = {
+        scripts = lib.mkOption {
+          type = lib.types.listOf lib.types.package;
+          default = [];
+          description = ''
+            some stuff from pkgs.weechatScripts
+          '';
+        };
+        settings = lib.mkOption {
+          type = (pkgs.formats.json {}).type;
+          description = ''
+            your weechat config in nix-style syntax.
+            secrets can be defined with \''${my.secret.value}
+          '';
+          default = {};
+          example = {
+            irc.server_default.nicks = "rick_\\\${sec.data.foo}";
+            irc.server_default.msg_part = "ciao kakao";
+            irc.server_default.msg_quit = "tschö mit \\\${sec.data.foo}";
+            irc.look.color_nicks_in_nicklist = true;
+            matrix.server.nibbana = {
+              address = "nibbana.jp";
+            };
+            irc.server.hackint = {
+              address = "irc.hackint.org/6697";
+              ssl = true;
+              autoconnect = true;
+              autojoin = ["#krebs"];
+            };
+            weechat.bar.buflist.hidden = true;
+            irc.server.hackint.command = lib.concatStringsSep "\\;" [
+              "/msg nickserv IDENTIFY \\\${sec.data.hackint_password}"
+              "/msg nickserv SET CLOAK ON"
+            ];
+            filters.playlist_topic = {
+              buffer = "irc.*.#the_playlist";
+              tags = ["irc_topic"];
+              regex = "*";
+            };
+            relay = {
+              port.weechat = 9000;
+              network.password = "hunter2";
+            };
+            alias.cmd.mod = "quote omode $channel +o $nick";
+            secure.test.passphrase_command = "echo lol1234123124";
+          };
+        };
+        extraCommands = lib.mkOption {
+          type = lib.types.lines;
+          default = "";
+        };
+        files = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          default = {};
+          example = lib.literalExpression ''
+            {
+              "sec.conf" = toString (pkgs.writeText "sec.conf" '''
+                [crypt]
+                cipher = aes256
+                hash_algo = sha256
+                passphrase_command = ""
+                salt = on
+
+                [data]
+                __passphrase__ = off
+                foo = "bar"
+              ''');
+            }
+          '';
+        };
+      };
+    };
+  };
+
+  setFile = pkgs.writeText "weechat.set" (
+    lib.optionalString (cfg.settings != {})
+    (lib.concatStringsSep "\n" (
+      lib.optionals
+      (cfg.settings.irc or {} != {})
+      (lib.mapAttrsToList
+        (name: server: "/server add ${name} ${lib.toWeechatValue server.addresses}")
+        cfg.settings.irc.server)
+      ++ lib.optionals
+      (cfg.settings.matrix or {} != {})
+      (lib.mapAttrsToList
+        (name: server: "/matrix server add ${name} ${server.address}")
+        cfg.settings.matrix.server)
+      ++ lib.mapAttrsToList lib.setCommand (lib.attrPathsSep "." cfg.settings)
+      ++ lib.optionals
+      (cfg.settings.filters or {} != {})
+      (lib.mapAttrsToList lib.filterAddreplace cfg.settings.filters)
+      ++ lib.singleton cfg.extraCommands
+    ))
+  );
+
+  weechat = pkgs.weechat.override {
+    configure = _: {
+      init = "/exec -oc cat ${setFile}";
+
+      scripts = cfg.scripts;
+    };
+  };
+
+  wrapper = pkgs.writers.writeDashBin "weechat" ''
+    CONFDIR=''${XDG_CONFIG_HOME:-$HOME/.config}/weechat
+    ${pkgs.coreutils}/bin/mkdir -p "$CONFDIR"
+    ${
+      lib.concatStringsSep "\n"
+      (
+        lib.mapAttrsToList
+        (name: target:
+          /*
+          sh
+          */
+          ''
+            ${pkgs.coreutils}/bin/cp ${lib.escapeShellArg target} "$CONFDIR"/${lib.escapeShellArg name}
+            ${pkgs.coreutils}/bin/chmod -w "$CONFDIR"/${lib.escapeShellArg name}
+          '')
+        cfg.files
+      )
+    }
+    exec ${weechat}/bin/weechat "$@"
+  '';
+in
+  pkgs.symlinkJoin {
+    name = "weechat-configured";
+    paths = [
+      wrapper
+      pkgs.weechat
+    ];
+    postBuild = ''
+      ln -s ${setFile} $out/weechat.set
+    '';
+  }
--- a/2
+++ b/2
--- a/systems/ful/configuration.nix
+++ b/systems/ful/configuration.nix
@@ -9,7 +9,10 @@ in {
  imports = [
    ./hardware-configuration.nix
    ./matomo.nix
+    ./radio.nix
+    ./panoptikon.nix
    ../../configs/monitoring.nix
+    ../../configs/tor.nix
    ../../configs/save-space.nix
    ../../configs/spacetime.nix
    ../../configs/retiolum.nix
@@ -17,6 +20,20 @@ in {
    ../../configs/nix.nix
  ];

+  niveum.passport = {
+    enable = true;
+    introductionHTML = ''
+    '';
+    virtualHost = "ful.r";
+
+    services = [
+      {
+        title = "restic backup";
+        description = "This machine backups its state via restic backup.";
+      }
+    ];
+  };
+
  age.secrets = {
    retiolum-rsa = {
      file = ../../secrets/ful-retiolum-privateKey-rsa.age;
@@ -32,6 +49,12 @@ in {
    };
    root.file = ../../secrets/ful-root.age;
    restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/ful-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
  };

  services.restic.backups.niveum = {
--- a/systems/ful/panoptikon.nix
+++ b/systems/ful/panoptikon.nix
@@ -0,0 +1,108 @@
+{
+  config,
+  pkgs,
+  lib,
+  niveumLib,
+  niveumPackages,
+  ...
+}: let
+  panoptikon = niveumLib.panoptikon {inherit pkgs lib niveumPackages config;};
+
+  irc-xxx = panoptikon.kpaste-irc {
+    target = lib.escapeShellArg "#xxx";
+    retiolumLink = true;
+  };
+
+  irc-kmein = panoptikon.kpaste-irc {
+    messagePrefix = "$PANOPTIKON_WATCHER: ";
+    target = "kmein";
+    nick = "panoptikon-kmein";
+    retiolumLink = false;
+  };
+in {
+  services.panoptikon = {
+    enable = true;
+    watchers = {
+      "github-meta" = {
+        script = panoptikon.urlJSON {} "https://api.github.com/meta";
+        reporters = [irc-xxx];
+      };
+      lammla = {
+        script = panoptikon.url "http://lammla.info/index.php?reihe=30";
+        reporters = [irc-kmein];
+      };
+      kratylos = {
+        script = panoptikon.url "https://kratylos.reichert-online.org/current_issue/KRATYLOS";
+        reporters = [irc-kmein];
+      };
+      zeno-free = {
+        script = panoptikon.urlSelector ".zenoCOMain" "http://www.zeno.org/Lesesaal/M/E-Books";
+        reporters = [irc-kmein];
+      };
+      carolinawelslau = {
+        script = panoptikon.urlSelector "#main" "https://carolinawelslau.de/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann-archive = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/archive/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann-projects = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/projects/";
+        reporters = [irc-kmein];
+      };
+      tatort = {
+        script = panoptikon.urlSelector ".linklist" "https://www.daserste.de/unterhaltung/krimi/tatort/sendung/index.html";
+        reporters = [irc-kmein];
+      };
+      warpgrid-idiomarium = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/idiomarium/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-futurism = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/futurism/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-imagiary = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/imagiary/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-alchemy = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/alchemy/";
+        reporters = [irc-kmein];
+      };
+      indogermanische-forschungen = {
+        script = panoptikon.urlSelector "#latestIssue" "https://www.degruyter.com/journal/key/INDO/html";
+        reporters = [irc-kmein];
+      };
+      ig-neuigkeiten = {
+        script = panoptikon.urlSelector "[itemprop=articleBody]" "https://www.indogermanistik.org/aktuelles/neuigkeiten.html";
+        reporters = [irc-kmein];
+      };
+      ig-tagungen = {
+        script = panoptikon.urlSelector "[itemprop=articleBody]" "https://www.indogermanistik.org/tagungen/tagungen-der-ig.html";
+        reporters = [irc-kmein];
+      };
+      fxght-or-flxght = {
+        script = panoptikon.urlJSON {
+          jqScript = ''
+            .answers | map(
+              select(.type == "answer")
+              | {
+                 question: .tell,
+                 answer: .answer,
+                 date: .createdAt,
+                 media: .media | map(.url)
+              }
+            )
+          '';
+        } "https://api.tellonym.me/profiles/name/fxght.or.flxght?limit=20";
+        reporters = [irc-kmein];
+      };
+    };
+  };
+}
--- a/systems/makanek/radio.nix
+++ b/systems/makanek/radio.nix
@@ -2,11 +2,38 @@
  lib,
  pkgs,
  config,
+  niveumPackages,
  ...
 }: let
  inherit (import ../../lib) tmpfilesConfig;
  liquidsoapDirectory = "/var/cache/liquidsoap";
  icecastPassword = "hackme";
+  refresh-qasaid = pkgs.writers.writeDashBin "refresh-qasaid" ''
+    (
+      for i in $(seq 1 22)
+      do
+        ${pkgs.curl}/bin/curl -sSL "https://www.hindawi.org/poems/$i/"
+      done
+    ) | ${pkgs.htmlq}/bin/htmlq '.poems li' \
+      | ${pkgs.fq}/bin/fq -d html  '
+        .html.body.li
+        | map(.a
+          | {
+            id: .[0].["@href"] | sub("/poems/"; "") | sub("/$"; "") | tonumber,
+            poem: .[0].["#text"],
+            author: .[1].["#text"]
+          })
+      ' | ${niveumPackages.cyberlocker-tools}/bin/cput qasaid.json
+  '';
+  qasida-poem = pkgs.writers.writeDash "qasida.sh" ''
+    set -efu
+    ${pkgs.jq}/bin/jq -c '.[]' < ${pkgs.fetchurl {
+      url = "https://c.krebsco.de/qasaid.json";
+      sha256 = "0vh1jzdrvjrdyq7dzya9k9g3jyli9jr0zfsqb2m1phm39psy4g2b";
+    }} \
+      | shuf -n1 \
+      | ${pkgs.jq}/bin/jq -r '"annotate:title=\"\(.poem) | https://www.hindawi.org/poems/\(.id)/\",artist=\"\(.author)\":https://downloads.hindawi.org/poems/\(.id)/\(.id).m4a"'
+  '';
  lyrikline-poem = pkgs.writers.writeDash "lyrikline.sh" ''
    set -efu

@@ -72,11 +99,11 @@
 in {
  # https://github.com/savonet/liquidsoap/issues/1043#issuecomment-593354427
  services.liquidsoap.streams.radio = pkgs.writeText "lyrikline.liq" ''
-    set("protocol.external.curl","${pkgs.curl}/bin/curl")
+    set("protocol.external.curl","${pkgs.torsocks}/bin/torsocks ${pkgs.curl}/bin/curl")

    def random_url(script) =
      mksafe(audio_to_stereo(request.dynamic.list(
-        fun () -> list.map(request.create, get_process_lines(script))
+        fun () -> list.map(request.create, process.read.lines(script))
      )))
    end

@@ -92,6 +119,7 @@ in {
    end

    make_streams("lyrikline", random_url("${lyrikline-poem}"), description="lyrikline. listen to the poet (unofficial)", genre="poetry")
+    make_streams("qasida", random_url("${qasida-poem}"), description="Qasa'id. Classical arabic poetry", genre="poetry")
    make_streams("lyrik", random_url("${stavenhagen-poem}"), description="Fritz Stavenhagen – Lyrik für alle | www.deutschelyrik.de", genre="poetry")
    make_streams("wikipedia", random_url("${wikipedia-article}"), description="Zufällige Artikel von Wikipedia", genre="useless knowledge")
  '';
--- a/systems/kabsa/configuration.nix
+++ b/systems/kabsa/configuration.nix
@@ -40,10 +40,16 @@ in {
    restic.file = ../../secrets/restic.age;
    syncthing-cert.file = ../../secrets/kabsa-syncthing-cert.age;
    syncthing-key.file = ../../secrets/kabsa-syncthing-key.age;
+    specus.file = ../../secrets/kabsa-specus-privateKey.age;
  };

  environment.systemPackages = [pkgs.minecraft pkgs.zeroad];

+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    client.enable = false;
+  };
+
  networking = {
    hostName = "kabsa";
    wireless.interfaces = ["wlp3s0"];
--- a/systems/makanek/configuration.nix
+++ b/systems/makanek/configuration.nix
@@ -16,14 +16,13 @@ in {
    ./names.nix
    ./nextcloud.nix
    ./radio-news.nix
-    ./radio.nix
    ./retiolum-map.nix
    ./tarot.nix
    ./tt-rss.nix
-    ./urlwatch.nix
    ./weechat.nix
    ../../configs/monitoring.nix
    ../../configs/nix.nix
+    ../../configs/tor.nix
    ../../configs/save-space.nix
    ../../configs/retiolum.nix
    ../../configs/spacetime.nix
@@ -96,6 +95,12 @@ in {
      group = "tinc.retiolum";
    };
    restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/makanek-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
  };

  system.stateVersion = "20.03";
--- a/systems/makanek/tarot.nix
+++ b/systems/makanek/tarot.nix
@@ -15,32 +15,32 @@
    sha256 = "1n2m53kjg2vj9dbr70b9jrsbqwdfrcb48l4wswn21549fi24g6dx";
  };
 in {
-  krebs.htgen.tarot = {
+  services.htgen.tarot = {
    port = tarotPort;
-    scriptFile = pkgs.writers.writeDash "tarot" ''
-      case "$Method $Request_URI" in
-        "GET /")
-          if item=$(${pkgs.findutils}/bin/find ${toString tarotFiles} -type f | ${pkgs.coreutils}/bin/shuf -n1); then
-            card=$(mktemp --tmpdir tarot.XXX)
-            trap 'rm $card' EXIT
-            reverse=$(${pkgs.coreutils}/bin/shuf -i0-1 -n1)
-            if [ "$reverse" -eq 1 ]; then
-              ${pkgs.imagemagick}/bin/convert -rotate 180 "$item" "$card"
-            else
-              ${pkgs.coreutils}/bin/cp "$item" "$card"
+    script = ''. ${pkgs.writers.writeDash "tarot" ''
+        case "$Method $Request_URI" in
+          "GET /")
+            if item=$(${pkgs.findutils}/bin/find ${toString tarotFiles} -type f | ${pkgs.coreutils}/bin/shuf -n1); then
+              card=$(mktemp --tmpdir tarot.XXX)
+              trap 'rm $card' EXIT
+              reverse=$(${pkgs.coreutils}/bin/shuf -i0-1 -n1)
+              if [ "$reverse" -eq 1 ]; then
+                ${pkgs.imagemagick}/bin/convert -rotate 180 "$item" "$card"
+              else
+                ${pkgs.coreutils}/bin/cp "$item" "$card"
+              fi
+              printf 'HTTP/1.1 200 OK\r\n'
+              printf 'Content-Type: %s\r\n' "$(${pkgs.file}/bin/file -ib "$card")"
+              printf 'Server: %s\r\n' "$Server"
+              printf 'Connection: close\r\n'
+              printf 'Content-Length: %d\r\n' $(${pkgs.coreutils}/bin/wc -c < "$card")
+              printf '\r\n'
+              cat "$card"
+              exit
            fi
-            printf 'HTTP/1.1 200 OK\r\n'
-            printf 'Content-Type: %s\r\n' "$(${pkgs.file}/bin/file -ib "$card")"
-            printf 'Server: %s\r\n' "$Server"
-            printf 'Connection: close\r\n'
-            printf 'Content-Length: %d\r\n' $(${pkgs.coreutils}/bin/wc -c < "$card")
-            printf '\r\n'
-            cat "$card"
-            exit
-          fi
-        ;;
-      esac
-    '';
+          ;;
+        esac
+      ''}'';
  };

  niveum.passport.services = [
--- a/systems/makanek/urlwatch.nix
+++ b/systems/makanek/urlwatch.nix
@@ -1,204 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  inherit (import ../../lib) kieran;
-
-  urlwatchDir = "/var/lib/urlwatch";
-
-  urlsFile = pkgs.writeText "urls" (builtins.concatStringsSep "\n---\n" (map builtins.toJSON urls));
-
-  tokensFile = config.age.secrets.urlwatch-tokens.path;
-
-  urls = [
-    {
-      name = "Corona-Verordnung";
-      url = "https://www.berlin.de/corona/massnahmen/verordnung/";
-      filter = [{css = "[role=main]";} "html2text" "strip"];
-    }
-    {
-      name = "HU Semester";
-      url = "https://agnes.hu-berlin.de/lupo/rds?state=change&type=6&moduleParameter=semesterSelect&nextdir=change&next=SearchSelect.vm&subdir=applications&targettype=7&targetstate=change&getglobal=semester";
-      filter = [{css = "fieldset";} "html2text" "strip"];
-    }
-    {
-      name = "Lammla 2021";
-      url = "http://lammla.info/index.php?reihe=30";
-      filter = ["html2text" "strip"];
-    }
-    {
-      name = "Kratylos";
-      url = "https://kratylos.reichert-online.org/current_issue/KRATYLOS";
-      filter = [{element-by-id = "content";} "html2text" "strip"];
-    }
-    {
-      name = "Zeno Free E-Books";
-      url = "http://www.zeno.org/Lesesaal/M/E-Books";
-      filter = [{element-by-class = "zenoCOMain";} "html2text" "strip"];
-    }
-    {
-      name = "Carolina Welslau";
-      url = "https://carolinawelslau.de/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann";
-      url = "https://lisalittmann.de/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Tatort: Fälle";
-      url = "https://www.daserste.de/unterhaltung/krimi/tatort/sendung/index.html";
-      filter = [{element-by-class = "linklist";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann: Projects";
-      url = "https://lisalittmann.de/projects/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann: Archive";
-      url = "https://lisalittmann.de/archive/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Idiomarium";
-      url = "https://warpgrid.de/idiomarium/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Futurism";
-      url = "https://warpgrid.de/futurism/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Imagiary";
-      url = "https://warpgrid.de/imagiary/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Cook";
-      url = "https://warpgrid.de/alchemy/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "Indogermanische Forschungen";
-      url = "https://www.degruyter.com/journal/key/INDO/html";
-      filter = [{element-by-id = "latestIssue";} "html2text" "strip"];
-    }
-    {
-      name = "IG Neuigkeiten";
-      url = "https://www.indogermanistik.org/aktuelles/neuigkeiten.html";
-      filter = [{css = "[itemprop=articleBody]";} "html2text" "strip"];
-    }
-    {
-      name = "IG Tagungen";
-      url = "https://www.indogermanistik.org/tagungen/tagungen-der-ig.html";
-      filter = [{css = "[itemprop=articleBody]";} "html2text" "strip"];
-    }
-    {
-      name = "Christian-Metz-Blamage";
-      url = "https://www.deutschlandfunk.de/meine-nacht-schlaeft-nicht-pflanze-mich-nicht-in-dein-herz.700.de.html?dram:article_id=486475";
-      filter = [{element-by-class = "dlf-articledetail";} "html2text" "strip"];
-    }
-    {
-      name = "Ist der Congress schon abgesagt?";
-      url = "https://ist-der-congress-schon-abgesagt.de/";
-    }
-    {
-      name = "fxght.or.flxght";
-      url = "https://api.tellonym.me/profiles/name/fxght.or.flxght?limit=20";
-      headers.tellonym-client = "web:0.52.0";
-      filter = [
-        {
-          shellpipe = ''
-            ${pkgs.jq}/bin/jq '.answers | map({
-              question: .tell,
-              answer: .answer,
-              date: .createdAt,
-              media: .media | map(.url)
-            })'
-          '';
-        }
-      ];
-    }
-  ];
-
-  configFile = (pkgs.formats.json {}).generate "urlwatch.json" {
-    display = {
-      error = true;
-      new = true;
-      unchanged = false;
-    };
-    report = {
-      email = {
-        enabled = true;
-        from = "2210@cock.li";
-        html = false;
-        method = "smtp";
-        smtp = {
-          host = "mail.cock.li";
-          port = 587;
-          starttls = true;
-          auth = true;
-        };
-        subject = "{count} changes: {jobs}";
-        to = kieran.email;
-      };
-      telegram = {
-        enabled = true;
-        chat_id = "-1001504043752";
-      };
-      html.diff = "unified";
-      stdout = {
-        color = true;
-        enabled = true;
-      };
-      text.footer = false;
-    };
-  };
-  urlwatch = pkgs.urlwatch.overrideAttrs (attrs: {
-    patches = [../../packages/urlwatch-insecure.patch];
-  });
-in {
-  users.extraUsers.urlwatch = {
-    home = urlwatchDir;
-    createHome = true;
-    isSystemUser = true;
-    group = "urlwatch";
-  };
-
-  age.secrets.urlwatch-tokens.file = ../../secrets/urlwatch-tokens.json.age;
-
-  users.groups.urlwatch = {};
-
-  systemd.services.urlwatch = {
-    enable = true;
-    startAt = "12:00";
-    script = ''
-      ${urlwatch}/bin/urlwatch \
-        --config=<(
-          ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${toString configFile} ${toString tokensFile}
-        ) \
-        --urls=${lib.escapeShellArg urlsFile}
-    '';
-    serviceConfig = {
-      User = config.users.extraUsers.urlwatch.name;
-      Group = config.users.groups.urlwatch.name;
-      WorkingDirectory = config.users.extraUsers.urlwatch.home;
-      PermissionsStartOnly = "true";
-      PrivateTmp = "true";
-      SyslogIdentifier = "urlwatch";
-      Type = "oneshot";
-    };
-  };
-
-  niveum.passport.services = [
-    {
-      description = "keeps me up-to-date on sites that have no RSS feed (shame be upon them!).";
-      title = "urlwatch";
-    }
-  ];
-}
--- a/systems/makanek/weechat.nix
+++ b/systems/makanek/weechat.nix
@@ -1,11 +1,12 @@
 {
  lib,
  pkgs,
-  inputs,
+  config,
  ...
 }: let
  inherit (import ../../lib) kieran;
  weechatHome = "/var/lib/weechat";
+  weechat-declarative = pkgs.callPackage ../../packages/weechat-declarative.nix {};
 in {
  systemd.services.weechat = let
    tmux = pkgs.writers.writeDash "tmux" ''
@@ -26,12 +27,12 @@ in {
        ''
      } "$@"
    '';
-    weechat = inputs.stockholm.packages.x86_64-linux.weechat-declarative.override {
+    weechat = weechat-declarative.override {
      config = {
        scripts = [
          pkgs.weechatScripts.weechat-autosort
          pkgs.weechatScripts.colorize_nicks
-          pkgs.weechatScripts.weechat-matrix
+          # pkgs.weechatScripts.weechat-matrix
          (pkgs.callPackage ../../packages/weechatScripts/hotlist2extern.nix {})
        ];
        settings = let
@@ -118,6 +119,7 @@ in {
            use_title = "off";
            delimiter = ",";
          };
+          matrix.look.server_buffer = "merge_without_core";
          matrix.server.nibbana = {
            address = "nibbana.jp";
            username = nick;
@@ -164,9 +166,9 @@ in {
        };
        extraCommands = ''
          /save
-          /matrix connect nibbana
          /connect -all
        '';
+        # /matrix connect nibbana
      };
    };
  in {
@@ -176,7 +178,7 @@ in {
    restartIfChanged = true;
    path = [pkgs.alacritty.terminfo];
    environment.WEECHAT_HOME = weechatHome;
-    preStart = "${pkgs.coreutils}/bin/rm $WEECHAT_HOME/*.conf";
+    # preStart = "${pkgs.coreutils}/bin/rm $WEECHAT_HOME/*.conf";
    script = "${tmux} -2 new-session -d -s IM ${weechat}/bin/weechat";
    preStop = "${tmux} kill-session -t IM";
    serviceConfig = {
--- a/systems/manakish/hdmi.nix
+++ b/systems/manakish/hdmi.nix
@@ -1,12 +1,52 @@
-{pkgs, ...}: {
-  services.xserver.displayManager.sessionCommands = let
-    intern = "LVDS-1";
-    extern = "HDMI-3";
-    pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
-    pulseaudioProfile = "output:hdmi-stereo-extra2+input:analog-stereo";
-  in
-    toString (pkgs.writers.writeDash "hdmi-on" ''
-      ${pkgs.xorg.xrandr}/bin/xrandr --output ${intern} --primary --auto --output ${extern} --above ${intern} --auto
-      ${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} ${pulseaudioProfile}
-    '');
+{pkgs, ...}: let
+  pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
+  fingerprint = {
+    HDMI-1 = "00ffffffffffff004c2d320d48435030181a0103803c22782a5295a556549d250e5054bb8c00b30081c0810081809500a9c001010101023a801871382d40582c450056502100001e000000fd0032481e5111000a202020202020000000fc00433237463339300a2020202020000000ff00485451483630323132390a202001e402031af14690041f131203230907078301000066030c00100080011d00bc52d01e20b828554056502100001e8c0ad090204031200c4055005650210000188c0ad08a20e02d10103e9600565021000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061";
+    LVDS-1 = "00ffffffffffff0006af6c100000000000140104901c10780220e5925554922825505400000001010101010101010101010101010101121b56585000193030203600159c100000180000000f0000000000000000000000000020000000fe0041554f0a202020202020202020000000fe004231323558573031205630200a00ec";
+  };
+in {
+  home-manager.users.me = {
+    programs.autorandr = {
+      enable = true;
+      hooks.postswitch.wallpaper = "systemctl --user restart wallpaper";
+      profiles = {
+        single = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} alsa_output.pci-0000_00_1b.0.analog-stereo";
+          fingerprint = {inherit (fingerprint) LVDS-1;};
+          config = {
+            HDMI-1.enable = false;
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              primary = true;
+              rate = "60.10";
+            };
+          };
+        };
+        desk = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} output:hdmi-stereo+input:analog-stereo";
+          fingerprint = {inherit (fingerprint) HDMI-1 LVDS-1;};
+          config = {
+            HDMI-1 = {
+              enable = true;
+              crtc = 1;
+              mode = "1920x1080";
+              position = "0x0";
+              primary = true;
+              rate = "60.00";
+            };
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              rate = "60.10";
+            };
+          };
+        };
+      };
+    };
+  };
 }
Author	SHA1	Message	Date
Kierán Meinhardt	2d25c1fc7b	wip: add specus VPN	2023-04-14 08:43:23 +02:00
Kierán Meinhardt	9456adc0b5	chore: update	2023-04-14 08:42:59 +02:00
Kierán Meinhardt	d6372b8d8e	feat(stardict): add turkish	2023-04-14 08:42:22 +02:00
Kierán Meinhardt	5da8218a8f	feat(streams): add more	2023-04-01 17:46:56 +02:00
Kierán Meinhardt	17cbff9917	feat(radio): add qasida arabic poetry radio	2023-04-01 17:46:48 +02:00
Kierán Meinhardt	d72c234adb	fix(weechat): disable matrix for now	2023-03-31 11:00:01 +02:00
Kierán Meinhardt	ffc5f9b596	fix(panoptikon): add watcher name to commit message, random delay 1h, ignore html errors, #xxx notification	2023-03-31 10:59:52 +02:00
Kierán Meinhardt	c20a9e3098	feat(flake): override mpv and dmenu for own packages	2023-03-30 19:16:54 +02:00
Kierán Meinhardt	7759cfb35f	feat(panoptikon): add library to flake outputs and use	2023-03-30 19:16:54 +02:00
Kierán Meinhardt	b7a5c3c333	chore: update	2023-03-28 22:28:51 +02:00
Kierán Meinhardt	672257fc04	fix: hu-vpn conflicts with hu-eduroam	2023-03-28 11:03:20 +02:00
Kierán Meinhardt	fada909105	feat(panoptikon): setup in different service	2023-03-27 09:27:44 +02:00
Kierán Meinhardt	96d44a52f0	feat: install agenix package	2023-03-27 09:27:30 +02:00
Kierán Meinhardt	22f957ee1f	fix(weechat): do not delete secrets on startup	2023-03-26 20:22:44 +02:00
Kierán Meinhardt	13e674389d	feat: independence from stockholm	2023-03-26 19:24:38 +02:00
Kierán Meinhardt	f805550ff8	fix(panoptikon)	2023-03-26 19:14:57 +02:00
Kierán Meinhardt	a8db4ab8a8	fix(panoptikon): tellonym has ads now	2023-03-26 00:41:59 +01:00
Kierán Meinhardt	83efbcd61c	feat(panoptikon): start more gentle	2023-03-26 00:26:57 +01:00
Kierán Meinhardt	246b4e1cec	chore: update secrets	2023-03-24 19:04:21 +01:00
Kierán Meinhardt	29985fffc2	feat: replace urlwatch by panoptikon	2023-03-24 19:02:27 +01:00
Kierán Meinhardt	85036b55a5	feat(i3): fix slock	2023-03-24 17:04:34 +01:00
Kierán Meinhardt	15c7e5a35a	feat: panoptikon urlwatcher	2023-03-24 17:00:51 +01:00
Kierán Meinhardt	c829a3ecac	chore: update	2023-03-24 00:12:31 +01:00
Kierán Meinhardt	ee2b929838	feat: slock	2023-03-24 00:12:23 +01:00
Kierán Meinhardt	36f5bc6dc0	fix(flix): flixmenu	2023-03-22 18:47:50 +01:00
Kierán Meinhardt	54793196bc	feat(radio): curl via tor	2023-03-22 07:48:13 +01:00
Kierán Meinhardt	bbe6a9efec	feat: update kmein ssh keys	2023-03-22 07:47:43 +01:00
Kierán Meinhardt	eb5cedabf8	fix(picom): do not make lockscreen transparent	2023-03-21 19:14:32 +01:00
Kierán Meinhardt	a294bf009d	feat: use slock instead of k-lock	2023-03-21 19:13:48 +01:00
Kierán Meinhardt	eb45fe28f6	fix(i3status-rust): no alternating tint; cool colours	2023-03-20 16:00:09 +01:00
Kierán Meinhardt	5e8b1f37c6	feat(radio): move to ful to evade block, remove tor	2023-03-20 13:14:02 +01:00
Kierán Meinhardt	7e86718b0f	feat(radio): torify lyrikline	2023-03-20 12:25:43 +01:00
Kierán Meinhardt	97ae9ec0bf	feat(klem): add emojai script	2023-03-20 12:24:06 +01:00
Kierán Meinhardt	a342aa687c	feat(ssh): add kabsa key to agent	2023-03-20 12:23:49 +01:00
Kierán Meinhardt	0a92d58d00	feat(klem): notify on success	2023-03-20 12:23:36 +01:00
Kierán Meinhardt	0955b68054	feat(weechat): fix matrix server in sidebar	2023-03-20 12:23:25 +01:00
Kierán Meinhardt	87ab995b82	feat(ssh): use gpg agent for agent	2023-03-12 18:26:58 +01:00
Kierán Meinhardt	743a0f3239	chore: update secrets	2023-03-12 18:26:45 +01:00
Kierán Meinhardt	fdaa98886e	feat(manakish): add autorandr for dock switch	2023-03-12 18:26:07 +01:00
Kierán Meinhardt	e07b053f6e	fix(weechat): do not set passwords	2023-03-12 18:24:56 +01:00
Kierán Meinhardt	ef08f4decd	fix(streams): talk -> text	2023-03-11 08:27:20 +01:00
Kierán Meinhardt	e6fb052ab8	chore: update	2023-03-11 06:36:29 +01:00
Kierán Meinhardt	11f1be099e	feat: gpg ssh key	2023-03-11 06:36:22 +01:00
Kierán Meinhardt	dc267fc464	feat(manakish): sound via dock	2023-03-11 06:35:52 +01:00
Kierán Meinhardt	24b552b966	feat(streams): add al jazeera	2023-03-10 20:33:11 +01:00
Kierán Meinhardt	bc27b8bc64	fix(i3): correctly call dmenu-randr	2023-03-08 17:40:04 +01:00
Kierán Meinhardt	58ceef04d6	feat(notmuch, mbsync): add fully qualified paths to dependent programs	2023-03-07 13:04:07 +01:00
Kierán Meinhardt	bf62f74bc1	fix(notmuch): set name and email so it stops complaining	2023-03-06 22:30:09 +01:00
Kierán Meinhardt	cbeffcdadd	feat: install language servers	2023-03-06 22:07:57 +01:00
Kierán Meinhardt	8f4019443d	feat(neovim): hello lsp	2023-03-06 22:01:58 +01:00
Kierán Meinhardt	eba8788547	fix(email): backup correctly if mbsync is enabled for a homemanager account, aerc wants to use the maildir, which is stupid	2023-03-06 22:01:34 +01:00
Kierán Meinhardt	3ebf717112	feat: backup email	2023-03-06 14:50:30 +01:00
Kierán Meinhardt	4e6c8e13af	feat(zsh): show hostname if in ssh	2023-03-06 11:44:38 +01:00
Kierán Meinhardt	18ec46c773	feat(flix): update	2023-03-06 11:44:24 +01:00