wip: package itools

if mbsync is enabled for a homemanager account, aerc wants to use the
  maildir, which is stupid

configs/aerc.nix

@@ -63,6 +63,53 @@ in {
   };
 
   home-manager.users.me = {
+    services.mbsync = {
+      enable = true;
+      frequency = "daily";
+      preExec = "${pkgs.coreutils}/bin/mkdir -p ${config.home-manager.users.me.accounts.email.maildirBasePath}";
+      postExec = "${pkgs.notmuch}/bin/notmuch new";
+    };
+
+    programs.notmuch = {
+      enable = true;
+      extraConfig = {
+        database.path = config.home-manager.users.me.accounts.email.maildirBasePath;
+        new.tags = "";
+        user.name = defaults.realName;
+        user.primary_email = config.home-manager.users.me.accounts.email.accounts.posteo.address;
+      };
+    };
+
+    programs.mbsync = {
+      enable = true;
+      extraConfig = lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: ''
+          IMAPAccount ${name}
+          CertificateFile /etc/ssl/certs/ca-certificates.crt
+          Host ${account.imap.host}
+          PassCmd "${toString account.passwordCommand}"
+          User ${account.userName}
+          SSLType IMAPS
+          ${lib.optionalString (lib.isInt account.imap.port) "Port ${toString account.imap.port}"}
+
+          IMAPStore ${name}-remote
+          Account ${name}
+
+          MaildirStore ${name}-local
+          Path ${config.home-manager.users.me.accounts.email.maildirBasePath}/${name}/
+          SubFolders Verbatim
+
+          Channel ${name}
+          Create Near
+          Expunge None
+          Far :${name}-remote:
+          Near :${name}-local:
+          Patterns *
+          Remove None
+          SyncState *
+        '')
+        config.home-manager.users.me.accounts.email.accounts);
+    };
+
     accounts.email.accounts = rec {
       hu-student =
         lib.recursiveUpdate defaults
@@ -71,7 +118,7 @@ in {
             userName = "meinhark";
             address = "kieran.felix.meinhardt@hu-berlin.de";
             aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
           });
       hu-student-cs =
         lib.recursiveUpdate defaults
@@ -82,7 +129,7 @@ in {
             aliases = ["${userName}@informatik.hu-berlin.de"];
             imap.host = "mailbox.informatik.hu-berlin.de";
             smtp.host = "mailhost.informatik.hu-berlin.de";
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhark.path}";
           });
       hu-employee =
         lib.recursiveUpdate defaults
@@ -91,7 +138,7 @@ in {
             userName = "meinhaki";
             address = "kieran.meinhardt@hu-berlin.de";
             aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-meinhaki.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhaki.path}";
             aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
             signature = {
               showSignature = "append";
@@ -113,7 +160,7 @@ in {
             userName = "dslalewa";
             address = "admin.alew.vglsprwi@hu-berlin.de";
             aliases = ["${userName}@hu-berlin.de"];
-            passwordCommand = "cat ${config.age.secrets.email-password-dslalewa.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-dslalewa.path}";
             inherit (hu-employee) signature;
             aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
           });
@@ -122,7 +169,7 @@ in {
         (lib.recursiveUpdate hu-defaults
           rec {
             userName = "fsklassp";
-            passwordCommand = "cat ${config.age.secrets.email-password-fsklassp.path}";
+            passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fsklassp.path}";
             address = "${userName}@hu-berlin.de";
             realName = "FSI Klassische Philologie";
             aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
@@ -144,7 +191,7 @@ in {
         rec {
           address = "kieran@fysi.tech";
           userName = address;
-          passwordCommand = "cat ${config.age.secrets.email-password-fysi.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fysi.path}";
           flavor = "fastmail.com";
         };
       cock =
@@ -152,7 +199,7 @@ in {
         rec {
           address = "2210@cock.li";
           userName = address;
-          passwordCommand = "cat ${config.age.secrets.email-password-cock.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-cock.path}";
           realName = "";
           imap.host = "mail.cock.li";
           smtp.host = imap.host;
@@ -166,7 +213,7 @@ in {
           imap.host = "posteo.de";
           smtp.host = imap.host;
           primary = true;
-          passwordCommand = "cat ${config.age.secrets.email-password-posteo.path}";
+          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-posteo.path}";
           # himalaya = { enable = true; backend = "imap"; sender = "smtp"; };
         };
     };

configs/alacritty.nix

@@ -62,7 +62,7 @@ in {
   ];
 
   environment.etc = {
-    "themes/dark/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-dark.nix);
-    "themes/light/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-light.nix);
+    "themes/dark/alacritty.yml".source = alacritty-cfg (import ../lib/colours/owickstrom-dark.nix);
+    "themes/light/alacritty.yml".source = alacritty-cfg (import ../lib/colours/owickstrom-light.nix);
   };
 }

configs/backup.nix

@@ -21,6 +21,7 @@ in {
       "/home/kfm/work"
       "/home/kfm/projects"
       "/home/kfm/notes"
+      "/home/kfm/Maildir"
       "/home/kfm/cloud"
       "/home/kfm/.gnupg"
       "/home/kfm/.ssh"

configs/flix.nix

@@ -4,14 +4,16 @@
   ...
 }: let
   flixLocation = "/media/flix";
+  flixLocationNew = "/media/flix-new";
   cacheLocation = "/var/cache/flix";
   indexFilename = "index";
+  indexFilenameNew = "index-new";
   flixUser = "flix";
   flixGroup = "users";
   inherit (import ../lib) tmpfilesConfig;
 in {
   fileSystems.${flixLocation} = {
-    device = "prism.r:/export";
+    device = "prism.r:/export/download";
     fsType = "nfs";
     options = [
       "noauto"
@@ -26,6 +28,20 @@ in {
     ];
   };
 
+  fileSystems.${flixLocationNew} = {
+    device = "//yellow.r/public";
+    fsType = "cifs";
+    options = [
+      "guest"
+      "nofail"
+      "noauto"
+      "ro"
+      "x-systemd.automount"
+      "x-systemd.device-timeout=1"
+      "x-systemd.idle-timeout=1min"
+    ];
+  };
+
   systemd.tmpfiles.rules = [
     (tmpfilesConfig {
       type = "d";
@@ -39,7 +55,10 @@ in {
   systemd.services.flix-index = {
     description = "Flix indexing service";
     wants = ["network-online.target"];
-    script = "cp ${flixLocation}/download/index ./${indexFilename}";
+    script = ''
+      cp ${flixLocation}/index ./${indexFilename}
+      cp ${flixLocationNew}/index ./${indexFilenameNew}
+    '';
     startAt = "hourly";
     serviceConfig = {
       Type = "oneshot";
@@ -69,11 +88,10 @@ in {
     '')
     (pkgs.writers.writeDashBin "flixmenu" ''
       set -efu
-      cd "${flixLocation}/download"
-
-      [ -f "${cacheLocation}/${indexFilename}" ] || exit 1
-
-      ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" < ${cacheLocation}/${indexFilename} \
+      (
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocation}#' ${cacheLocation}/${indexFilename}
+        ${pkgs.gnused}/bin/sed 's#^\.#${flixLocationNew}#' ${cacheLocation}/${indexFilenameNew}
+      ) | ${pkgs.dmenu}/bin/dmenu -i -p flix -l 5 "$@" \
         | ${pkgs.findutils}/bin/xargs -I '{}' ${pkgs.util-linux}/bin/setsid ${pkgs.xdg-utils}/bin/xdg-open '{}'
     '')
   ];

configs/hu-berlin.nix

@@ -17,7 +17,7 @@
     "workgroup=german"
     "credentials=${config.age.secrets.cifs-credentials-hu-berlin.path}"
     "noauto"
-    "x-systemd.requires=hu-vpn.service"
+    # "x-systemd.requires=hu-vpn.service"
     "x-systemd.automount"
     "x-systemd.device-timeout=1"
     "x-systemd.idle-timeout=1min"
@@ -68,9 +68,11 @@ in {
     wants = ["network-online.target"];
     serviceConfig.LoadCredential = "password:${config.age.secrets.email-password-meinhark.path}";
     script = ''
-      ${pkgs.openfortivpn}/bin/openfortivpn \
-        --password="$(cat "$CREDENTIALS_DIRECTORY/password")" \
-        --config=${
+      if ${pkgs.wirelesstools}/bin/iwgetid | ${pkgs.gnugrep}/bin/grep --invert-match eduroam
+      then
+        ${pkgs.openfortivpn}/bin/openfortivpn \
+          --password="$(cat "$CREDENTIALS_DIRECTORY/password")" \
+          --config=${
         pkgs.writeText "hu-berlin.config" ''
           host = forti-ssl.vpn.hu-berlin.de
           port = 443
@@ -78,6 +80,7 @@ in {
           trusted-cert = 9e5dea8e077970d245900839f437ef7fb9551559501c7defd70af70ea568573d
         ''
       }
+      fi
     '';
   };
 }

configs/i3.nix

@@ -47,6 +47,9 @@
       ocr = pkgs.writers.writeDash "ocr" ''
         ${pkgs.tesseract4}/bin/tesseract -l eng+deu - stdout
       '';
+      emojai = pkgs.writers.writeDash "emojai" ''
+        ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
+      '';
     };
   };
 
@@ -72,6 +75,8 @@ in {
     };
   };
 
+  programs.slock.enable = true;
+
   services.xserver = {
     displayManager.defaultSession = "none+i3";
     windowManager.i3 = {
@@ -94,14 +99,19 @@ in {
     '';
   };
 
-  home-manager.users.me.xsession.windowManager.i3 = {
+  home-manager.users.me.xsession.windowManager.i3 = let
+    modifier = "Mod4";
+  in {
     enable = true;
+    extraConfig = ''
+      bindsym --release ${modifier}+Shift+w exec /run/wrappers/bin/slock
+    '';
     config = rec {
       fonts = {
         names = ["Sans"];
         size = 10.0;
       };
-      modifier = "Mod4";
+      inherit modifier;
       window = {
         titlebar = false;
         border = 1;
@@ -256,7 +266,6 @@ in {
         "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
         "${modifier}+0" = "exec ${niveumPackages.menu-calc}/bin/=";
 
-        "${modifier}+Shift+w" = "exec ${niveumPackages.k-lock}/bin/k-lock";
         "${modifier}+d" = "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
         "${modifier}+Shift+d" = "exec ${
           pkgs.writers.writeDash "notemenu" ''
@@ -306,7 +315,7 @@ in {
         "XF86AudioStop" = "exec ${pkgs.playerctl}/bin/playerctl stop";
         "XF86ScreenSaver" = "exec ${niveumPackages.k-lock}/bin/k-lock";
 
-        "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenurandr";
+        "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenu-randr";
 
         # key names detected with xorg.xev:
         # XF86WakeUp (fn twice)

configs/khal.nix

@@ -182,19 +182,19 @@ in {
         type = "carddav"
         url = "${kmeinCloud.davEndpoint}/addressbooks/users/${kmeinCloud.username}/"
         username = "${kmeinCloud.username}"
-        password.fetch = ["cat", "${kmeinCloud.passwordFile}"]
+        password.fetch = ["command", "cat", "${kmeinCloud.passwordFile}"]
 
         [storage kalender_cloud]
         type = "caldav"
         url = "${kmeinCloud.davEndpoint}/calendars/${kmeinCloud.username}/"
         username = "${kmeinCloud.username}"
-        password.fetch = ["cat", "${kmeinCloud.passwordFile}"]
+        password.fetch = ["command", "cat", "${kmeinCloud.passwordFile}"]
 
         [storage fysi_cloud]
         type = "caldav"
         url = "${fysiCloud.davEndpoint}/calendars/${fysiCloud.username}/"
         username = "${fysiCloud.username}"
-        password.fetch = ["cat", "${fysiCloud.passwordFile}"]
+        password.fetch = ["command", "cat", "${fysiCloud.passwordFile}"]
       '';
     };
   };

configs/neovim.nix

@@ -12,7 +12,11 @@
     (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
     (pkgs.neovim.override {
       configure = {
-        customRC = builtins.readFile ../lib/vim/init.vim;
+        customRC = ''
+          source ${../lib/vim/init.vim}
+
+          luafile ${../lib/vim/init.lua}
+        '';
         packages.nvim = with pkgs.vimPlugins; {
           start = [
             ale
@@ -23,6 +27,7 @@
             tabular
             # vimwiki
             niveumPackages.vimPlugins-vim-colors-paramount
+            nvim-lspconfig
             vim-commentary
             vim-css-color
             vim-eunuch

configs/packages.nix

@@ -191,6 +191,7 @@ in {
     qrencode
 
     inputs.menstruation-backend.defaultPackage.x86_64-linux
+    inputs.agenix.packages.x86_64-linux.default
     inputs.recht.defaultPackage.x86_64-linux
 
     (pkgs.writers.writeDashBin "worldradio" ''
@@ -232,6 +233,13 @@ in {
     ]))
     # python3Packages.poetry
 
+    # language servers
+    pyright
+    haskell-language-server
+    texlab
+    nil
+    rust-analyzer
+
     html-tidy
     nodePackages.csslint
     nodePackages.jsonlint

configs/picom.nix

@@ -8,5 +8,18 @@
     shadow = true;
     menuOpacity = 0.9;
     shadowOpacity = 0.3;
+    fadeExclude = [
+      "class_g = 'slock'" # don't want a transparent lock screen!
+      "name *?= 'slock'"
+      "focused = 1"
+    ];
+    opacityRules = [
+      # opacity-rule overrides both inactive and active opacity
+
+      # video in browser tabs
+      # substring /regex match of title bar text
+      "99:name *?= 'Youtube'"
+      "99:WM_CLASS@:s *= 'mpv$'"
+    ];
   };
 }

configs/ssh.nix

@@ -7,24 +7,37 @@
   inherit (import ../lib) sshPort kieran;
   externalNetwork = import ../lib/external-network.nix;
   sshIdentity = name: "${config.users.users.me.home}/.ssh/${name}";
-  ssh-passphrase = lib.strings.fileContents <system-secrets/ssh/passphrase>;
 in {
-  /*
-     TODO how do I do this?
-  services.xserver.displayManager.sessionCommands = toString (pkgs.writeScript "ssh-add" ''
-    #!${pkgs.expect}/bin/expect -f
-    spawn ${pkgs.openssh}/bin/ssh-add
-    expect "Enter passphrase for *:"
-    send "${ssh-passphrase}\n";
-    expect "Identity added: *"
-    interact
-  '');
-  */
-
-  programs.ssh.startAgent = true;
-
   users.users.me.openssh.authorizedKeys.keys = kieran.sshKeys pkgs;
 
+  home-manager.users.me = {
+    services.gpg-agent = rec {
+      enable = true;
+      enableSshSupport = true;
+      defaultCacheTtlSsh = 2 * 60 * 60;
+      maxCacheTtlSsh = 4 * defaultCacheTtlSsh;
+      sshKeys = [
+        "568047C91DE03A23883E340F15A9C24D313E847C"
+        "BB3EE102DB8CD45540A78A6B18B511B67061F6B4" # kfm@manakish ed25519
+        "3F8986755818B5762A096BE212777EAAC441DD9D" # fysiweb rsa
+        "0E4ABD229432486CC432639BB0986B2CDE365105" # agenix ed25519
+        "A1E8D32CBFCDBD2DE798E2298D795CCFD785AE06" # kfm@kabsa ed25519
+      ];
+    };
+  };
+
+  environment.extraInit = ''
+    if [[ -z "$SSH_AUTH_SOCK" ]]; then
+      export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)"
+    fi
+  '';
+
+  environment.interactiveShellInit = ''
+    GPG_TTY="$(tty)"
+    export GPG_TTY
+    ${pkgs.gnupg}/bin/gpg-connect-agent updatestartuptty /bye > /dev/null
+  '';
+
   home-manager.users.me.programs.ssh = {
     enable = true;
     matchBlocks = rec {

configs/stardict.nix

@@ -158,6 +158,16 @@
         sha256 = "03f9wdmkgpjifpms7dyh10ma29wf3ka1j3zlp1av0cybhdldk2a8";
       };
     };
+    turkish = {
+      BabylonTurkishEnglish = pkgs.fetchzip {
+        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_Turkish_English-2.4.2.tar.bz2";
+        sha256 = "17rv46r95nkikg7aszqmfrbgdhz9ny52w423m8n01g3p93shdb4i";
+      };
+      BabylonEnglishTurkish = pkgs.fetchzip {
+        url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_English_Turkish-2.4.2.tar.bz2";
+        sha256 = "063dl02s8ii8snsxgma8wi49xwr6afk6ysq0v986fygx5511353f";
+      };
+    };
   };
 
   makeStardictDataDir = dicts: pkgs.linkFarm "dictionaries" (lib.mapAttrsToList (name: path: {inherit name path;}) dicts);
@@ -292,7 +302,8 @@ in {
     // dictionaries.sanskrit
     // dictionaries.oed
     // dictionaries.russian
-    // dictionaries.englishGerman));
+    // dictionaries.englishGerman
+    // dictionaries.turkish));
 
   environment.systemPackages = [
     # pkgs.goldendict
@@ -302,6 +313,7 @@ in {
     (makeStardict "sd-russian" dictionaries.russian)
     (makeStardict "sd" dictionaries.englishGerman)
     (makeStardict "jbo" dictionaries.lojban)
+    (makeStardict "sd-turkish" dictionaries.turkish)
   ];
 }
 /*

configs/tor.nix

@@ -1,4 +1,5 @@
 {pkgs, ...}: {
   services.tor.enable = true;
-  environment.systemPackages = [pkgs.tor];
+  services.tor.client.enable = true;
+  environment.systemPackages = [pkgs.tor pkgs.torsocks];
 }

configs/zsh.nix

@@ -77,7 +77,11 @@
 
       precmd () {
         vcs_info
-        RPROMPT="$vcs_info_msg_0_"
+        if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ] || [ -n "$SSH_CONNECTION" ]; then
+          RPROMPT="$(hostname)"
+        else
+          RPROMPT="$vcs_info_msg_0_"
+        fi
         if [[ -n $IN_NIX_SHELL ]]; then
           PROMPT='%B%~%b %(?.%F{${promptColours.success}}.%F{${promptColours.failure}})λ%f '
         else

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1677247280,
-        "narHash": "sha256-sa+8MtoAOSLsWP9vf0qiJUyMovIEYgDzHE8TkoK04Hk=",
+        "lastModified": 1680281360,
+        "narHash": "sha256-XdLTgAzjJNDhAG2V+++0bHpSzfvArvr2pW6omiFfEJk=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "833f87c8ff574a29aea3e091045cbaed3cf86bc1",
+        "rev": "e64961977f60388dd0b49572bb0fc453b871f896",
         "type": "github"
       },
       "original": {
@@ -60,12 +60,15 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
         "type": "github"
       },
       "original": {
@@ -202,11 +205,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1677284824,
-        "narHash": "sha256-I3gDxmGjyXdtOR5S8sIeCO8pT+5OR69f/g5EVoQUdsY=",
+        "lastModified": 1681092193,
+        "narHash": "sha256-JerCqqOqbT2tBnXQW4EqwFl0hHnuZp21rIQ6lu/N4rI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "29280978234b73423f4eb708cbb999295f76b42a",
+        "rev": "f9edbedaf015013eb35f8caacbe0c9666bbc16af",
         "type": "github"
       },
       "original": {
@@ -360,11 +363,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1677179781,
-        "narHash": "sha256-+peLp16ruWLuTFHo0ZUbLlS1/meS/+RsWQQ9bUAzOh8=",
+        "lastModified": 1681269223,
+        "narHash": "sha256-i6OeI2f7qGvmLfD07l1Az5iBL+bFeP0RHixisWtpUGo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50c23cd4ff6c8344e0b4d438b027b3afabfe58dd",
+        "rev": "87edbd74246ccdfa64503f334ed86fa04010bab9",
         "type": "github"
       },
       "original": {
@@ -455,11 +458,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1677308535,
-        "narHash": "sha256-66BgZxZ+MnxouwGRd0K9ue1G70r8jyR6l2neuMMiYjs=",
+        "lastModified": 1681454031,
+        "narHash": "sha256-JOamj7vKkFRp5mJ7FKt5dPfCmWj33sZLnBGDt15c/sc=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "ab8cd578fc38e3e797eaa98cd392b2f625a0f265",
+        "rev": "8a35714f0be00235e2a1c8b759e6dc3888763d8b",
         "type": "github"
       },
       "original": {
@@ -490,11 +493,11 @@
     },
     "retiolum": {
       "locked": {
-        "lastModified": 1676473689,
-        "narHash": "sha256-TGQbsiIojBj4DvGhhkI3i2dq9NmU2Vkt+i7Rw2U/BEg=",
+        "lastModified": 1681246809,
+        "narHash": "sha256-3RUAwk0ApPjq2Ms8KiAh+gG6EJKWurIur612w2m3Zu8=",
         "ref": "refs/heads/master",
-        "rev": "30152917194d6e54ce68e45b499323356db3ae7c",
-        "revCount": 283,
+        "rev": "c8ddb36f3d85be762aeb1893a79da36014f55658",
+        "revCount": 296,
         "type": "git",
         "url": "https://git.thalheim.io/Mic92/retiolum"
       },
@@ -626,6 +629,21 @@
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "telebots": {
       "inputs": {
         "flake-utils": "flake-utils_7",
@@ -706,11 +724,11 @@
     "voidrice": {
       "flake": false,
       "locked": {
-        "lastModified": 1677155625,
-        "narHash": "sha256-fxkeRwTfdzfHTRmwvUpbbL/bcCtDot/b7sUXfyq3+Vo=",
+        "lastModified": 1681301489,
+        "narHash": "sha256-5Zz33Q3E4A9nsEmxPQikYeX7Rvu3hM+PlXx/0SIqG34=",
         "owner": "Lukesmithxyz",
         "repo": "voidrice",
-        "rev": "2062e8110cc6b4479417ff5c5f966aebe337a6da",
+        "rev": "d4ff2ebaf3e88efe20cae0d1e592fddfc433c96e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -38,8 +38,7 @@
     retiolum,
     flake-utils,
     ...
-  }: let
-  in
+  }:
     {
       apps = nixinate.nixinate.x86_64-linux self;
 
@@ -48,17 +47,23 @@
         moodle-dl = import modules/moodle-dl.nix;
         networkmanager-declarative = import modules/networkmanager-declarative.nix;
         passport = import modules/passport.nix;
+        panoptikon = import modules/panoptikon.nix;
         power-action = import modules/power-action.nix;
         system-dependent = import modules/system-dependent.nix;
         telegram-bot = import modules/telegram-bot.nix;
         traadfri = import modules/traadfri.nix;
       };
 
+      lib = {
+        panoptikon = import lib/panoptikon.nix;
+      };
+
       nixosConfigurations = {
         ful = nixpkgs.lib.nixosSystem rec {
           system = "aarch64-linux";
           specialArgs = {
             niveumPackages = inputs.self.packages.${system};
+            niveumLib = inputs.self.lib;
             inherit inputs;
           };
           modules = [
@@ -73,7 +78,10 @@
             }
             systems/ful/configuration.nix
             agenix.nixosModules.default
+            inputs.self.nixosModules.passport
+            inputs.self.nixosModules.panoptikon
             retiolum.nixosModules.retiolum
+            nur.nixosModules.nur
           ];
         };
         zaatar = nixpkgs.lib.nixosSystem rec {
@@ -191,7 +199,13 @@
     // flake-utils.lib.eachSystem [flake-utils.lib.system.x86_64-linux flake-utils.lib.system.aarch64-linux] (system: let
       pkgs = import nixpkgs {
         inherit system;
-        overlays = [nur.overlay];
+        overlays = [
+          nur.overlay
+          (self: super: {
+            mpv = super.mpv.override {scripts = [inputs.self.packages.${system}.mpv-visualizer];};
+            dmenu = super.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
+          })
+        ];
       };
       wrapScript = {
         packages ? [],
@@ -200,7 +214,7 @@
       }:
         pkgs.writers.writeDashBin name ''PATH=$PATH:${nixpkgs.lib.makeBinPath (packages ++ [pkgs.findutils pkgs.coreutils pkgs.gnused pkgs.gnugrep])} ${script} "$@"'';
     in {
-      packages = {
+      packages = rec {
         auc = pkgs.callPackage packages/auc.nix {};
         betacode = pkgs.callPackage packages/betacode.nix {};
         cheat-sh = pkgs.callPackage packages/cheat-sh.nix {};
@@ -276,6 +290,9 @@
         weechatScripts-hotlist2extern = pkgs.callPackage packages/weechatScripts/hotlist2extern.nix {};
         wttr = pkgs.callPackage packages/wttr.nix {};
 
+        itl = pkgs.callPackage packages/itl.nix {};
+        itools = pkgs.callPackage packages/itools.nix {itl = itl;};
+
         booksplit = wrapScript {
           script = inputs.voidrice.outPath + "/.local/bin/booksplit";
           name = "booksplit";

lib/default.nix

@@ -40,7 +40,7 @@ rec {
 
   sshPort = 22022;
 
-  colours = import ./colours/papercolor-dark.nix;
+  colours = import ./colours/owickstrom-dark.nix;
 
   theme = pkgs: {
     gtk = {
@@ -72,7 +72,7 @@ rec {
     sshKeys = pkgs:
       pkgs.lib.strings.splitString "\n" (pkgs.lib.strings.fileContents (pkgs.fetchurl {
         url = "https://github.com/kmein.keys";
-        sha256 = "09c6ny0rmpid1m0pc1wsmb3wyy9g721lf4kv55i4lrp42b3i2d5b";
+        hash = "sha256-TvvPwplrH9cw7NE4GKqbE5ga+oBHM+TkjxYQ3b1fpLI=";
       }));
   };
 

lib/i3status-rust.nix

@@ -21,8 +21,6 @@ in {
       info_fg = colours.cyan.bright;
       warning_fg = colours.yellow.bright;
       warning_bg = colours.background;
-      alternating_tint_bg = colours.background;
-      alternating_tint_fg = colours.foreground;
       critical_bg = colours.background;
       good_bg = colours.background;
       idle_bg = colours.background;

lib/panoptikon.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  lib,
+  niveumPackages,
+  config,
+  ...
+}: {
+  # watcher scripts
+  url = address:
+    pkgs.writers.writeDash "watch-url" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
+        | ${pkgs.python3Packages.html2text}/bin/html2text --decode-errors=ignore
+    '';
+  urlSelector = selector: address:
+    pkgs.writers.writeDash "watch-url-selector" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
+        | ${pkgs.htmlq}/bin/htmlq ${lib.escapeShellArg selector} \
+        | ${pkgs.python3Packages.html2text}/bin/html2text
+    '';
+  urlJSON = {jqScript ? "."}: address:
+    pkgs.writers.writeDash "watch-url-json" ''
+      ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} | ${pkgs.jq}/bin/jq -f ${pkgs.writeText "script.jq" jqScript}
+    '';
+
+  # reporter scripts
+  kpaste-irc = {
+    target,
+    retiolumLink ? false,
+    server ? "irc.r",
+    messagePrefix ? "change detected: ",
+    nick ? ''"$PANOPTIKON_WATCHER"-watcher'',
+  }:
+    pkgs.writers.writeDash "kpaste-irc-reporter" ''
+      ${niveumPackages.kpaste}/bin/kpaste \
+        | ${pkgs.gnused}/bin/sed -n "${
+        if retiolumLink
+        then "2"
+        else "3"
+      }s/^/${messagePrefix}/p" \
+        | ${config.nur.repos.mic92.ircsink}/bin/ircsink \
+          --nick ${nick} \
+          --server ${server} \
+          --target ${target}
+    '';
+}

lib/streams.nix

@@ -956,6 +956,11 @@ in
       stream = soma-fm "scanner";
       tags = [tags.soma tags.text];
     }
+    {
+      station = "Al Jazeera Arabic";
+      stream = "https://live-hls-audio-web-aja.getaj.net/VOICE-AJA/01.m3u8";
+      tags = [tags.text tags.arabic];
+    }
     {
       desc = "Celebrating NASA and Space Explorers everywhere.";
       logo = "http://soma.fm/img/missioncontrol120.jpg";
@@ -1842,71 +1847,127 @@ in
       stream = dr "p8jazz";
       tags = [tags.jazz tags.danish];
     }
+    {
+      station = "CNN morse code slow";
+      stream = "http://cw.dimebank.com:8080/CNNslow";
+      tags = [tags.text];
+    }
+    {
+      station = "CNN morse code fast";
+      stream = "http://cw.dimebank.com:8080/CNNfast";
+      tags = [tags.text];
+    }
+    {
+      station = "XXX orchestral";
+      stream = "http://orion.shoutca.st:8978/stream";
+      tags = [tags.classical];
+    }
+    {
+      station = "XXX greek";
+      stream = "http://radio.hostchefs.net:8046/stream?1520818130148";
+      tags = [tags.greek];
+    }
+    {
+      station = "XXX turkish or greek";
+      stream = "https://onairmediagroup.live24.gr/kralfm100xanthi";
+      tags = [tags.greek tags.turkish];
+    }
+    {
+      station = "Hard Rock Hell Radio";
+      tags = [tags.rock];
+      stream = "http://andromeda.shoutca.st:9254/stream";
+    }
+    {
+      station = "Divyavani";
+      tags = [tags.trad tags.indian];
+      stream = "https://divyavani.radioca.st/stream";
+    }
+    {
+      station = "XXX sanskrit radio";
+      tags = [tags.text tags.indian];
+      stream = "https://stream-23.zeno.fm/m08mkwsyw8quv?zs=0w7MJFPdRfavhR_zPt0M2g";
+    }
+    {
+      station = "Radio Mariam Arabic";
+      stream = "http://www.dreamsiteradiocp4.com:8014/stream";
+      tags = [tags.text tags.arabic];
+    }
+    {
+      station = "Kamchatka Live Rock";
+      stream = "https://radio.kamchatkalive.ru:8103/rock";
+      tags = [tags.rock];
+    }
+    {
+      station = "Kamchatka Live Chillout";
+      stream = "https://radio.kamchatkalive.ru:8103/chillout";
+      tags = [tags.chill];
+    }
+    {
+      station = "Kamchatka Live Dance";
+      stream = "https://radio.kamchatkalive.ru:8103/dance";
+      tags = [tags.party];
+    }
+    {
+      tags = [tags.arabic tags.text];
+      stream = "http://n02.radiojar.com/sxfbks1vfy8uv.mp3";
+      station = "Bahrain Radio 102.3 FM (Arabic Stories)";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      stream = "http://s2.voscast.com:12312/;";
+      station = "Bahrain Quran Radio";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      stream = "http://162.244.81.30:8224/;";
+      station = "Quran Radio Lebanon";
+    }
+    {
+      tags = [tags.arabic tags.text tags.holy];
+      station = "Coptic for God";
+      stream = "http://66.70.249.70:5832/stream";
+    }
+    {
+      stream = "http://stream-025.zeno.fm/5y95pu36sm0uv?";
+      station = "Hayat FM";
+      tags = [tags.arabic tags.text tags.holy];
+    }
+    {
+      stream = "http://uk2.internet-radio.com:8151/stream";
+      station = "The Quran Radio";
+      tags = [tags.arabic tags.text tags.holy];
+    }
   ]
+  ++ map (name: {
+    stream = "https://${name}.stream.publicradio.org/${name}.aac";
+    station = "${name} | Your Classical";
+    tags = [tags.classical];
+  }) ["ycradio" "guitar" "cms" "relax" "lullabies" "choral" "favorites" "chambermusic" "concertband" "holiday"]
 /*
       (caster-fm "TODO" "noasrv" 10182) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u
       (caster-fm "TODO" "shaincast" 20866) # https://github.com/cccruzr/albumsyoumusthear/blob/7e00baf575e4d357cd275d54d1aeb717321141a8/HLS/IBERO_90_1.m3u
 
-CNN news in morse code
-http://cw.dimebank.com:8080/CNNslow
-http://cw.dimebank.com:8080/CNNfast
-
-Orchestral
-http://orion.shoutca.st:8978/stream
 
 LoFi / Chill
 http://ice55.securenetsystems.net/DASH76
 
-News background music
-https://c13014-l-hls.u.core.cdn.streamfarm.net/1000153copo/hk2.m3u8
-
-?
-http://94.23.221.158:9163/stream
-
-Greek radio
-http://radio.hostchefs.net:8046/stream?1520818130148
 
 : http://audiokrishna.com/stations/japa2.mp3
-http://185.105.4.53:2339//;stream.mp3
-http://cast5.servcast.net:1390/;stream.mp3
-
-Hard rock
-http://andromeda.shoutca.st:9254/stream
 
 Rock alternative
 http://icy.unitedradio.it/VirginRockAlternative.mp3
 
-American nautical weather news
-http://ca.radioboss.fm:8149/stream
 
 Christian radio in all languages
 https://jesuscomingfm.com/#
 tamazight http://live.jesuscomingfm.com:8462/;
 
-supposedly good Greek radio
-https://onairmediagroup.live24.gr/kralfm100xanthi
 
 Somali Radio
 http://n0b.radiojar.com/1pu7hhf8kfhvv
 
-Sanskrit
-https://stream-23.zeno.fm/m08mkwsyw8quv?zs=0w7MJFPdRfavhR_zPt0M2g
-https://divyavani.radioca.st/stream
 
 Chillout from kassel
 https://server4.streamserver24.com:2199/tunein/ejanowsk.pls
-
-Radio Mariam Arabic (Rome)
-http://www.dreamsiteradiocp4.com:8014/stream
-
-https://radio.kamchatkalive.ru:8103/rock
-https://radio.kamchatkalive.ru:8103/chillout
-https://radio.kamchatkalive.ru:8103/dance
-
-Fuṣḥā Stories (Bahrain Radio 102.3 FM)
-http://n02.radiojar.com/sxfbks1vfy8uv.mp3
-
-Bahrain Quran Radio
-http://s2.voscast.com:12312/;
 */
 

lib/vim/init.lua

@@ -0,0 +1,86 @@
+local opts = { noremap=true, silent=true }
+vim.keymap.set('n', '<space>e', vim.diagnostic.open_float, opts)
+vim.keymap.set('n', '[d', vim.diagnostic.goto_prev, opts)
+vim.keymap.set('n', ']d', vim.diagnostic.goto_next, opts)
+vim.keymap.set('n', '<space>q', vim.diagnostic.setloclist, opts)
+
+-- Use an on_attach function to only map the following keys
+-- after the language server attaches to the current buffer
+local on_attach = function(client, bufnr)
+  -- Enable completion triggered by <c-x><c-o>
+  vim.api.nvim_buf_set_option(bufnr, 'omnifunc', 'v:lua.vim.lsp.omnifunc')
+
+  -- Mappings.
+  -- See `:help vim.lsp.*` for documentation on any of the below functions
+  local bufopts = { noremap=true, silent=true, buffer=bufnr }
+  vim.keymap.set('n', 'gD', vim.lsp.buf.declaration, bufopts)
+  vim.keymap.set('n', 'gd', vim.lsp.buf.definition, bufopts)
+  vim.keymap.set('n', 'K', vim.lsp.buf.hover, bufopts)
+  vim.keymap.set('n', 'gi', vim.lsp.buf.implementation, bufopts)
+  vim.keymap.set('n', '<C-k>', vim.lsp.buf.signature_help, bufopts)
+  vim.keymap.set('n', '<space>wa', vim.lsp.buf.add_workspace_folder, bufopts)
+  vim.keymap.set('n', '<space>wr', vim.lsp.buf.remove_workspace_folder, bufopts)
+  vim.keymap.set('n', '<space>wl', function()
+    print(vim.inspect(vim.lsp.buf.list_workspace_folders()))
+  end, bufopts)
+  vim.keymap.set('n', '<space>D', vim.lsp.buf.type_definition, bufopts)
+  vim.keymap.set('n', '<space>rn', vim.lsp.buf.rename, bufopts)
+  vim.keymap.set('n', '<space>ca', vim.lsp.buf.code_action, bufopts)
+  vim.keymap.set('n', 'gr', vim.lsp.buf.references, bufopts)
+  vim.keymap.set('n', '<space>f', function() vim.lsp.buf.format { async = true } end, bufopts)
+end
+
+local lsp_flags = {
+  -- This is the default in Nvim 0.7+
+  debounce_text_changes = 150,
+}
+
+language_servers = {
+  pyright = {}, -- pyright
+  -- tsserver = {}, -- typescript-language-server
+  -- elmls = {}, -- elm-language-server
+  -- denols = {}, -- deno built in
+  -- bashls = {}, -- bash-language-server
+  hls = {}, -- haskell-language-server
+  -- html = {}, -- vscode-langservers-extracted
+  -- jsonls = {}, -- vscode-langservers-extracted
+  nil_ls = {}, -- github:oxalica/nil
+  -- rnix = {}, -- rnix-lsp
+  -- jqls = {}, -- jq-lsp
+  rust_analyzer = { ["rust-analyzer"] = {} },
+  -- eslint?
+  -- volar? vls?
+  texlab = {
+    texlab = {
+      auxDirectory = ".",
+      bibtexFormatter = "texlab",
+      build = {
+        args = { "-pdf", "-interaction=nonstopmode", "-synctex=1", "%f" },
+        executable = "latexmk",
+        forwardSearchAfter = false,
+        onSave = false
+      },
+      chktex = {
+        onEdit = false,
+        onOpenAndSave = false
+      },
+      diagnosticsDelay = 300,
+      formatterLineLength = 80,
+      forwardSearch = {
+        args = {}
+      },
+      latexFormatter = "latexindent",
+      latexindent = {
+        modifyLineBreaks = false
+      }
+    }
+  }
+}
+
+for server, settings in pairs(language_servers) do
+  require('lspconfig')[server].setup{
+    on_attach = on_attach,
+    flags = lsp_flags,
+    settings = settings,
+  }
+end

modules/panoptikon.nix

@@ -0,0 +1,130 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  options.services.panoptikon = {
+    enable = lib.mkEnableOption "Generic command output / website watcher";
+    watchers = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (watcher: {
+        options = {
+          script = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              A script whose stdout is to be watched.
+            '';
+            example = ''
+              pkgs.writers.writeDash "github-meta" '''
+                ''${pkgs.curl}/bin/curl -sSL https://api.github.com/meta | ''${pkgs.jq}/bin/jq
+              '''
+            '';
+          };
+          frequency = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              How often to run the script. See systemd.time(7) for more information about the format.
+            '';
+            example = "*:0/3";
+            default = "daily";
+          };
+          reporters = lib.mkOption {
+            type = lib.types.listOf lib.types.path;
+            description = ''
+              A list of scripts that take the diff (if any) via stdin and report it (e.g. to IRC, Telegram or Prometheus). The name of the watcher will be in the $PANOPTIKON_WATCHER environment variable.
+            '';
+            example = ''
+              [
+                (pkgs.writers.writeDash "telegram-reporter" '''
+                  ''${pkgs.curl}/bin/curl -X POST https://api.telegram.org/bot''${TOKEN}/sendMessage \
+                    -d chat_id=123456 \
+                    -d text="$(cat)"
+                ''')
+                (pkgs.writers.writeDash "notify" '''
+                  ''${pkgs.libnotify}/bin/notify-send "$PANOPTIKON_WATCHER has changed."
+                ''')
+              ]
+            '';
+          };
+        };
+        config = {};
+      }));
+    };
+  };
+
+  config = let
+    cfg = config.services.panoptikon;
+  in
+    lib.mkIf cfg.enable {
+      users.extraUsers.panoptikon = {
+        isSystemUser = true;
+        createHome = true;
+        home = "/var/lib/panoptikon";
+        group = "panoptikon";
+      };
+
+      users.extraGroups.panoptikon = {};
+
+      systemd.timers = lib.attrsets.mapAttrs' (watcherName: _:
+        lib.nameValuePair "panoptikon-${watcherName}" {
+          timerConfig.RandomizedDelaySec = toString (60 * 60);
+        })
+      cfg.watchers;
+
+      systemd.services =
+        {
+          setup-panoptikon = {
+            enable = true;
+            wantedBy = ["multi-user.target"];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "panoptikon";
+              Group = "panoptikon";
+              WorkingDirectory = "/var/lib/panoptikon";
+              Restart = "on-failure";
+            };
+            script = ''
+              ${pkgs.git}/bin/git init --quiet
+              ${pkgs.git}/bin/git config user.email "panoptikon@${config.networking.hostName}"
+              ${pkgs.git}/bin/git config user.name Panoptikon
+            '';
+          };
+        }
+        // lib.attrsets.mapAttrs' (watcherName: watcherOptions:
+          lib.nameValuePair "panoptikon-${watcherName}" {
+            enable = true;
+            after = ["setup-panoptikon.service"];
+            startAt = watcherOptions.frequency;
+            serviceConfig = {
+              Type = "oneshot";
+              User = "panoptikon";
+              Group = "panoptikon";
+              WorkingDirectory = "/var/lib/panoptikon";
+              RestartSec = "60";
+              Restart = "on-failure";
+            };
+            unitConfig = {
+              StartLimitIntervalSec = "300";
+              StartLimitBurst = "5";
+            };
+            environment.PANOPTIKON_WATCHER = watcherName;
+            wants = ["network-online.target"];
+            script = ''
+              set -efu
+
+              ${watcherOptions.script} > ${watcherName}
+              ${pkgs.git}/bin/git add ${watcherName}
+              ${pkgs.git}/bin/git commit --message "${watcherName} / $(${pkgs.coreutils}/bin/date -Is)" || :
+
+              if [ -n "$(${pkgs.git}/bin/git diff HEAD^ -- ${watcherName})" ]; then
+                ${lib.strings.concatMapStringsSep "\n" (reporter: ''
+                  ${pkgs.git}/bin/git diff HEAD^ -- ${watcherName} | ${reporter}
+                '')
+                watcherOptions.reporters}
+                :
+              fi
+            '';
+          })
+        cfg.watchers;
+    };
+}

packages/itl.nix

@@ -0,0 +1,28 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  lib,
+}:
+stdenv.mkDerivation rec {
+  pname = "itl";
+  version = "0.8.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "ITL";
+    rev = "v${version}";
+    sha256 = "sha256-GTicTbZmFbPhzInFob3cfvtTxOpUZuqsQz1w9CoWu9w=";
+  };
+  nativeBuildInputs = [cmake];
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "Islamic Tools and Libraries";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}

packages/itools.nix

@@ -0,0 +1,32 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  itl,
+  lib,
+  # autoreconfHook,
+  automake,
+}:
+stdenv.mkDerivation rec {
+  pname = "itools";
+  version = "1.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "itools";
+    rev = version;
+    sha256 = "sha256-g9bsjupC4Sb5ywAgUNbjYLbHZ/i994lbNSnX2JyaP3g=";
+  };
+  # nativeBuildInputs = [autoreconfHook];
+  buildPhase = ''
+    touch ChangeLog
+    ./configure
+    make
+  '';
+  buildInputs = [itl];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "The itools package is a set of user friendly applications utilizing Arabeyes' ITL library. ";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}

packages/klem.nix

@@ -40,6 +40,8 @@
   '';
 in
   pkgs.writers.writeDashBin "klem" ''
+    set -efu
+
     ${pkgs.xclip}/bin/xclip -selection ${cfg.selection} -out \
       | case $(echo "${
       lib.concatStringsSep "\n" (lib.attrNames cfg.scripts)
@@ -49,4 +51,6 @@ in
       esac \
       | tr -d '\r\n' \
       | ${pkgs.xclip}/bin/xclip -selection ${cfg.selection} -in
+
+    ${pkgs.libnotify}/bin/notify-send --app-name="klem" "Result copied to clipboard."
   ''

packages/ttspaste.nix

@@ -1,9 +1,11 @@
 {
   writers,
   xclip,
-  curl,
-  mpv,
+  espeak,
 }:
 writers.writeDashBin "ttspaste" ''
-  ${xclip}/bin/xclip -selection clipboard -out | ${curl}/bin/curl -G http://tts.r/api/tts --data-urlencode 'text@-' | ${mpv}/bin/mpv -
+  ${xclip}/bin/xclip -selection clipboard -out | ${espeak}/bin/espeak
 ''
+# curl, mpv,
+# ${curl}/bin/curl -G http://tts.r/api/tts --data-urlencode 'text@-' | ${mpv}/bin/mpv -
+

packages/urlwatch-insecure.patch

@@ -1,12 +0,0 @@
-diff --git a/lib/urlwatch/storage.py b/lib/urlwatch/storage.py
-index 3f6160f..03979f0 100644
---- a/lib/urlwatch/storage.py
-+++ b/lib/urlwatch/storage.py
-@@ -292,7 +292,6 @@ class UrlsBaseFileStorage(BaseTextualFileStorage, metaclass=ABCMeta):
-         shelljob_errors = self.shelljob_security_checks()
-         if shelljob_errors and any(is_shell_job(job) for job in jobs):
-             print(('Removing shell jobs, because %s' % (' and '.join(shelljob_errors),)))
--            jobs = [job for job in jobs if not is_shell_job(job)]
- 
-         return jobs
- 

packages/weechat-declarative.nix

@@ -157,7 +157,7 @@
           */
           ''
             ${pkgs.coreutils}/bin/cp ${lib.escapeShellArg target} "$CONFDIR"/${lib.escapeShellArg name}
-            ${pkgs.coreutils}/bin/chmod +w "$CONFDIR"/${lib.escapeShellArg name}
+            ${pkgs.coreutils}/bin/chmod -w "$CONFDIR"/${lib.escapeShellArg name}
           '')
         cfg.files
       )

systems/ful/configuration.nix

@@ -9,7 +9,10 @@ in {
   imports = [
     ./hardware-configuration.nix
     ./matomo.nix
+    ./radio.nix
+    ./panoptikon.nix
     ../../configs/monitoring.nix
+    ../../configs/tor.nix
     ../../configs/save-space.nix
     ../../configs/spacetime.nix
     ../../configs/retiolum.nix
@@ -17,9 +20,33 @@ in {
     ../../configs/nix.nix
   ];
 
+  niveum.passport = {
+    enable = true;
+    introductionHTML = ''
+    '';
+    virtualHost = "ful.r";
+
+    services = [
+      {
+        title = "restic backup";
+        description = "This machine backups its state via restic backup.";
+      }
+    ];
+  };
+
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/ful-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/ful-retiolum-privateKey-rsa.age;
+    retiolum-rsa = {
+      file = ../../secrets/ful-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/ful-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
     root.file = ../../secrets/ful-root.age;
     restic.file = ../../secrets/restic.age;
   };

systems/ful/panoptikon.nix

@@ -0,0 +1,108 @@
+{
+  config,
+  pkgs,
+  lib,
+  niveumLib,
+  niveumPackages,
+  ...
+}: let
+  panoptikon = niveumLib.panoptikon {inherit pkgs lib niveumPackages config;};
+
+  irc-xxx = panoptikon.kpaste-irc {
+    target = lib.escapeShellArg "#xxx";
+    retiolumLink = true;
+  };
+
+  irc-kmein = panoptikon.kpaste-irc {
+    messagePrefix = "$PANOPTIKON_WATCHER: ";
+    target = "kmein";
+    nick = "panoptikon-kmein";
+    retiolumLink = false;
+  };
+in {
+  services.panoptikon = {
+    enable = true;
+    watchers = {
+      "github-meta" = {
+        script = panoptikon.urlJSON {} "https://api.github.com/meta";
+        reporters = [irc-xxx];
+      };
+      lammla = {
+        script = panoptikon.url "http://lammla.info/index.php?reihe=30";
+        reporters = [irc-kmein];
+      };
+      kratylos = {
+        script = panoptikon.url "https://kratylos.reichert-online.org/current_issue/KRATYLOS";
+        reporters = [irc-kmein];
+      };
+      zeno-free = {
+        script = panoptikon.urlSelector ".zenoCOMain" "http://www.zeno.org/Lesesaal/M/E-Books";
+        reporters = [irc-kmein];
+      };
+      carolinawelslau = {
+        script = panoptikon.urlSelector "#main" "https://carolinawelslau.de/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann-archive = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/archive/";
+        reporters = [irc-kmein];
+      };
+      lisalittmann-projects = {
+        script = panoptikon.urlSelector "#site-content" "https://lisalittmann.de/projects/";
+        reporters = [irc-kmein];
+      };
+      tatort = {
+        script = panoptikon.urlSelector ".linklist" "https://www.daserste.de/unterhaltung/krimi/tatort/sendung/index.html";
+        reporters = [irc-kmein];
+      };
+      warpgrid-idiomarium = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/idiomarium/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-futurism = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/futurism/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-imagiary = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/imagiary/";
+        reporters = [irc-kmein];
+      };
+      warpgrid-alchemy = {
+        script = panoptikon.urlSelector "#site-content" "https://warpgrid.de/alchemy/";
+        reporters = [irc-kmein];
+      };
+      indogermanische-forschungen = {
+        script = panoptikon.urlSelector "#latestIssue" "https://www.degruyter.com/journal/key/INDO/html";
+        reporters = [irc-kmein];
+      };
+      ig-neuigkeiten = {
+        script = panoptikon.urlSelector "[itemprop=articleBody]" "https://www.indogermanistik.org/aktuelles/neuigkeiten.html";
+        reporters = [irc-kmein];
+      };
+      ig-tagungen = {
+        script = panoptikon.urlSelector "[itemprop=articleBody]" "https://www.indogermanistik.org/tagungen/tagungen-der-ig.html";
+        reporters = [irc-kmein];
+      };
+      fxght-or-flxght = {
+        script = panoptikon.urlJSON {
+          jqScript = ''
+            .answers | map(
+              select(.type == "answer")
+              | {
+                 question: .tell,
+                 answer: .answer,
+                 date: .createdAt,
+                 media: .media | map(.url)
+              }
+            )
+          '';
+        } "https://api.tellonym.me/profiles/name/fxght.or.flxght?limit=20";
+        reporters = [irc-kmein];
+      };
+    };
+  };
+}

systems/ful/radio.nix

@@ -2,11 +2,38 @@
   lib,
   pkgs,
   config,
+  niveumPackages,
   ...
 }: let
   inherit (import ../../lib) tmpfilesConfig;
   liquidsoapDirectory = "/var/cache/liquidsoap";
   icecastPassword = "hackme";
+  refresh-qasaid = pkgs.writers.writeDashBin "refresh-qasaid" ''
+    (
+      for i in $(seq 1 22)
+      do
+        ${pkgs.curl}/bin/curl -sSL "https://www.hindawi.org/poems/$i/"
+      done
+    ) | ${pkgs.htmlq}/bin/htmlq '.poems li' \
+      | ${pkgs.fq}/bin/fq -d html  '
+        .html.body.li
+        | map(.a
+          | {
+            id: .[0].["@href"] | sub("/poems/"; "") | sub("/$"; "") | tonumber,
+            poem: .[0].["#text"],
+            author: .[1].["#text"]
+          })
+      ' | ${niveumPackages.cyberlocker-tools}/bin/cput qasaid.json
+  '';
+  qasida-poem = pkgs.writers.writeDash "qasida.sh" ''
+    set -efu
+    ${pkgs.jq}/bin/jq -c '.[]' < ${pkgs.fetchurl {
+      url = "https://c.krebsco.de/qasaid.json";
+      sha256 = "0vh1jzdrvjrdyq7dzya9k9g3jyli9jr0zfsqb2m1phm39psy4g2b";
+    }} \
+      | shuf -n1 \
+      | ${pkgs.jq}/bin/jq -r '"annotate:title=\"\(.poem) | https://www.hindawi.org/poems/\(.id)/\",artist=\"\(.author)\":https://downloads.hindawi.org/poems/\(.id)/\(.id).m4a"'
+  '';
   lyrikline-poem = pkgs.writers.writeDash "lyrikline.sh" ''
     set -efu
 
@@ -72,11 +99,11 @@
 in {
   # https://github.com/savonet/liquidsoap/issues/1043#issuecomment-593354427
   services.liquidsoap.streams.radio = pkgs.writeText "lyrikline.liq" ''
-    set("protocol.external.curl","${pkgs.curl}/bin/curl")
+    set("protocol.external.curl","${pkgs.torsocks}/bin/torsocks ${pkgs.curl}/bin/curl")
 
     def random_url(script) =
       mksafe(audio_to_stereo(request.dynamic.list(
-        fun () -> list.map(request.create, get_process_lines(script))
+        fun () -> list.map(request.create, process.read.lines(script))
       )))
     end
 
@@ -92,6 +119,7 @@ in {
     end
 
     make_streams("lyrikline", random_url("${lyrikline-poem}"), description="lyrikline. listen to the poet (unofficial)", genre="poetry")
+    make_streams("qasida", random_url("${qasida-poem}"), description="Qasa'id. Classical arabic poetry", genre="poetry")
     make_streams("lyrik", random_url("${stavenhagen-poem}"), description="Fritz Stavenhagen – Lyrik für alle | www.deutschelyrik.de", genre="poetry")
     make_streams("wikipedia", random_url("${wikipedia-article}"), description="Zufällige Artikel von Wikipedia", genre="useless knowledge")
   '';

systems/kabsa/configuration.nix

@@ -25,8 +25,18 @@ in {
   };
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/kabsa-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/kabsa-retiolum-privateKey-ed25519.age;
+    retiolum-rsa = {
+      file = ../../secrets/kabsa-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/kabsa-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
     restic.file = ../../secrets/restic.age;
     syncthing-cert.file = ../../secrets/kabsa-syncthing-cert.age;
     syncthing-key.file = ../../secrets/kabsa-syncthing-key.age;

systems/makanek/configuration.nix

@@ -16,14 +16,13 @@ in {
     ./names.nix
     ./nextcloud.nix
     ./radio-news.nix
-    ./radio.nix
     ./retiolum-map.nix
     ./tarot.nix
     ./tt-rss.nix
-    ./urlwatch.nix
     ./weechat.nix
     ../../configs/monitoring.nix
     ../../configs/nix.nix
+    ../../configs/tor.nix
     ../../configs/save-space.nix
     ../../configs/retiolum.nix
     ../../configs/spacetime.nix
@@ -83,8 +82,18 @@ in {
   };
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/makanek-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/makanek-retiolum-privateKey-ed25519.age;
+    retiolum-rsa = {
+      file = ../../secrets/makanek-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/makanek-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
     restic.file = ../../secrets/restic.age;
   };
 

systems/makanek/urlwatch.nix

@@ -1,204 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  inherit (import ../../lib) kieran;
-
-  urlwatchDir = "/var/lib/urlwatch";
-
-  urlsFile = pkgs.writeText "urls" (builtins.concatStringsSep "\n---\n" (map builtins.toJSON urls));
-
-  tokensFile = config.age.secrets.urlwatch-tokens.path;
-
-  urls = [
-    {
-      name = "Corona-Verordnung";
-      url = "https://www.berlin.de/corona/massnahmen/verordnung/";
-      filter = [{css = "[role=main]";} "html2text" "strip"];
-    }
-    {
-      name = "HU Semester";
-      url = "https://agnes.hu-berlin.de/lupo/rds?state=change&type=6&moduleParameter=semesterSelect&nextdir=change&next=SearchSelect.vm&subdir=applications&targettype=7&targetstate=change&getglobal=semester";
-      filter = [{css = "fieldset";} "html2text" "strip"];
-    }
-    {
-      name = "Lammla 2021";
-      url = "http://lammla.info/index.php?reihe=30";
-      filter = ["html2text" "strip"];
-    }
-    {
-      name = "Kratylos";
-      url = "https://kratylos.reichert-online.org/current_issue/KRATYLOS";
-      filter = [{element-by-id = "content";} "html2text" "strip"];
-    }
-    {
-      name = "Zeno Free E-Books";
-      url = "http://www.zeno.org/Lesesaal/M/E-Books";
-      filter = [{element-by-class = "zenoCOMain";} "html2text" "strip"];
-    }
-    {
-      name = "Carolina Welslau";
-      url = "https://carolinawelslau.de/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann";
-      url = "https://lisalittmann.de/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Tatort: Fälle";
-      url = "https://www.daserste.de/unterhaltung/krimi/tatort/sendung/index.html";
-      filter = [{element-by-class = "linklist";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann: Projects";
-      url = "https://lisalittmann.de/projects/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "Lisa Littmann: Archive";
-      url = "https://lisalittmann.de/archive/";
-      filter = [{element-by-id = "main";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Idiomarium";
-      url = "https://warpgrid.de/idiomarium/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Futurism";
-      url = "https://warpgrid.de/futurism/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Imagiary";
-      url = "https://warpgrid.de/imagiary/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "WarpGrid: Cook";
-      url = "https://warpgrid.de/alchemy/";
-      filter = [{element-by-id = "site-content";} "html2text" "strip"];
-    }
-    {
-      name = "Indogermanische Forschungen";
-      url = "https://www.degruyter.com/journal/key/INDO/html";
-      filter = [{element-by-id = "latestIssue";} "html2text" "strip"];
-    }
-    {
-      name = "IG Neuigkeiten";
-      url = "https://www.indogermanistik.org/aktuelles/neuigkeiten.html";
-      filter = [{css = "[itemprop=articleBody]";} "html2text" "strip"];
-    }
-    {
-      name = "IG Tagungen";
-      url = "https://www.indogermanistik.org/tagungen/tagungen-der-ig.html";
-      filter = [{css = "[itemprop=articleBody]";} "html2text" "strip"];
-    }
-    {
-      name = "Christian-Metz-Blamage";
-      url = "https://www.deutschlandfunk.de/meine-nacht-schlaeft-nicht-pflanze-mich-nicht-in-dein-herz.700.de.html?dram:article_id=486475";
-      filter = [{element-by-class = "dlf-articledetail";} "html2text" "strip"];
-    }
-    {
-      name = "Ist der Congress schon abgesagt?";
-      url = "https://ist-der-congress-schon-abgesagt.de/";
-    }
-    {
-      name = "fxght.or.flxght";
-      url = "https://api.tellonym.me/profiles/name/fxght.or.flxght?limit=20";
-      headers.tellonym-client = "web:0.52.0";
-      filter = [
-        {
-          shellpipe = ''
-            ${pkgs.jq}/bin/jq '.answers | map({
-              question: .tell,
-              answer: .answer,
-              date: .createdAt,
-              media: .media | map(.url)
-            })'
-          '';
-        }
-      ];
-    }
-  ];
-
-  configFile = (pkgs.formats.json {}).generate "urlwatch.json" {
-    display = {
-      error = true;
-      new = true;
-      unchanged = false;
-    };
-    report = {
-      email = {
-        enabled = true;
-        from = "2210@cock.li";
-        html = false;
-        method = "smtp";
-        smtp = {
-          host = "mail.cock.li";
-          port = 587;
-          starttls = true;
-          auth = true;
-        };
-        subject = "{count} changes: {jobs}";
-        to = kieran.email;
-      };
-      telegram = {
-        enabled = true;
-        chat_id = "-1001504043752";
-      };
-      html.diff = "unified";
-      stdout = {
-        color = true;
-        enabled = true;
-      };
-      text.footer = false;
-    };
-  };
-  urlwatch = pkgs.urlwatch.overrideAttrs (attrs: {
-    patches = [../../packages/urlwatch-insecure.patch];
-  });
-in {
-  users.extraUsers.urlwatch = {
-    home = urlwatchDir;
-    createHome = true;
-    isSystemUser = true;
-    group = "urlwatch";
-  };
-
-  age.secrets.urlwatch-tokens.file = ../../secrets/urlwatch-tokens.json.age;
-
-  users.groups.urlwatch = {};
-
-  systemd.services.urlwatch = {
-    enable = true;
-    startAt = "12:00";
-    script = ''
-      ${urlwatch}/bin/urlwatch \
-        --config=<(
-          ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${toString configFile} ${toString tokensFile}
-        ) \
-        --urls=${lib.escapeShellArg urlsFile}
-    '';
-    serviceConfig = {
-      User = config.users.extraUsers.urlwatch.name;
-      Group = config.users.groups.urlwatch.name;
-      WorkingDirectory = config.users.extraUsers.urlwatch.home;
-      PermissionsStartOnly = "true";
-      PrivateTmp = "true";
-      SyslogIdentifier = "urlwatch";
-      Type = "oneshot";
-    };
-  };
-
-  niveum.passport.services = [
-    {
-      description = "keeps me up-to-date on sites that have no RSS feed (shame be upon them!).";
-      title = "urlwatch";
-    }
-  ];
-}

systems/makanek/weechat.nix

@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  config,
   ...
 }: let
   inherit (import ../../lib) kieran;
@@ -31,7 +32,7 @@ in {
         scripts = [
           pkgs.weechatScripts.weechat-autosort
           pkgs.weechatScripts.colorize_nicks
-          pkgs.weechatScripts.weechat-matrix
+          # pkgs.weechatScripts.weechat-matrix
           (pkgs.callPackage ../../packages/weechatScripts/hotlist2extern.nix {})
         ];
         settings = let
@@ -118,6 +119,7 @@ in {
             use_title = "off";
             delimiter = ",";
           };
+          matrix.look.server_buffer = "merge_without_core";
           matrix.server.nibbana = {
             address = "nibbana.jp";
             username = nick;
@@ -164,9 +166,9 @@ in {
         };
         extraCommands = ''
           /save
-          /matrix connect nibbana
           /connect -all
         '';
+        # /matrix connect nibbana
       };
     };
   in {
@@ -176,7 +178,7 @@ in {
     restartIfChanged = true;
     path = [pkgs.alacritty.terminfo];
     environment.WEECHAT_HOME = weechatHome;
-    preStart = "${pkgs.coreutils}/bin/rm $WEECHAT_HOME/*.conf";
+    # preStart = "${pkgs.coreutils}/bin/rm $WEECHAT_HOME/*.conf";
     script = "${tmux} -2 new-session -d -s IM ${weechat}/bin/weechat";
     preStop = "${tmux} kill-session -t IM";
     serviceConfig = {

systems/manakish/configuration.nix

@@ -15,8 +15,18 @@ in {
   ];
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/manakish-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/manakish-retiolum-privateKey-ed25519.age;
+    retiolum-rsa = {
+      file = ../../secrets/manakish-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/manakish-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
     syncthing-cert.file = ../../secrets/manakish-syncthing-cert.age;
     syncthing-key.file = ../../secrets/manakish-syncthing-key.age;
   };

systems/manakish/hdmi.nix

@@ -1,12 +1,52 @@
-{pkgs, ...}: {
-  services.xserver.displayManager.sessionCommands = let
-    intern = "LVDS-1";
-    extern = "HDMI-3";
-    pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
-    pulseaudioProfile = "output:hdmi-stereo-extra2+input:analog-stereo";
-  in
-    toString (pkgs.writers.writeDash "hdmi-on" ''
-      ${pkgs.xorg.xrandr}/bin/xrandr --output ${intern} --primary --auto --output ${extern} --above ${intern} --auto
-      ${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} ${pulseaudioProfile}
-    '');
+{pkgs, ...}: let
+  pulseaudioCard = "alsa_card.pci-0000_00_1b.0";
+  fingerprint = {
+    HDMI-1 = "00ffffffffffff004c2d320d48435030181a0103803c22782a5295a556549d250e5054bb8c00b30081c0810081809500a9c001010101023a801871382d40582c450056502100001e000000fd0032481e5111000a202020202020000000fc00433237463339300a2020202020000000ff00485451483630323132390a202001e402031af14690041f131203230907078301000066030c00100080011d00bc52d01e20b828554056502100001e8c0ad090204031200c4055005650210000188c0ad08a20e02d10103e9600565021000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061";
+    LVDS-1 = "00ffffffffffff0006af6c100000000000140104901c10780220e5925554922825505400000001010101010101010101010101010101121b56585000193030203600159c100000180000000f0000000000000000000000000020000000fe0041554f0a202020202020202020000000fe004231323558573031205630200a00ec";
+  };
+in {
+  home-manager.users.me = {
+    programs.autorandr = {
+      enable = true;
+      hooks.postswitch.wallpaper = "systemctl --user restart wallpaper";
+      profiles = {
+        single = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} alsa_output.pci-0000_00_1b.0.analog-stereo";
+          fingerprint = {inherit (fingerprint) LVDS-1;};
+          config = {
+            HDMI-1.enable = false;
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              primary = true;
+              rate = "60.10";
+            };
+          };
+        };
+        desk = {
+          hooks.postswitch = "${pkgs.pulseaudio}/bin/pactl set-card-profile ${pulseaudioCard} output:hdmi-stereo+input:analog-stereo";
+          fingerprint = {inherit (fingerprint) HDMI-1 LVDS-1;};
+          config = {
+            HDMI-1 = {
+              enable = true;
+              crtc = 1;
+              mode = "1920x1080";
+              position = "0x0";
+              primary = true;
+              rate = "60.00";
+            };
+            LVDS-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "1366x768";
+              position = "277x1080";
+              rate = "60.10";
+            };
+          };
+        };
+      };
+    };
+  };
 }

systems/tabula/configuration.nix

@@ -14,8 +14,18 @@ in {
   ];
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/tabula-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/tabula-retiolum-privateKey-rsa.age;
+    retiolum-rsa = {
+      file = ../../secrets/tabula-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/tabula-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
   };
 
   services.xserver = {

systems/tahina/configuration.nix

@@ -14,8 +14,18 @@ in {
   ];
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/tahina-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/tahina-retiolum-privateKey-rsa.age;
+    retiolum-rsa = {
+      file = ../../secrets/tahina-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/tahina-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
   };
 
   console.keyMap = "de";

systems/zaatar/configuration.nix

@@ -30,8 +30,18 @@ in {
   ];
 
   age.secrets = {
-    retiolum-rsa.file = ../../secrets/zaatar-retiolum-privateKey-rsa.age;
-    retiolum-ed25519.file = ../../secrets/zaatar-retiolum-privateKey-rsa.age;
+    retiolum-rsa = {
+      file = ../../secrets/zaatar-retiolum-privateKey-rsa.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
+    retiolum-ed25519 = {
+      file = ../../secrets/zaatar-retiolum-privateKey-ed25519.age;
+      mode = "400";
+      owner = "tinc.retiolum";
+      group = "tinc.retiolum";
+    };
     restic.file = ../../secrets/restic.age;
   };