regreet: deduplicate libinput code

.bin/mp3player-write

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+
+# Usage:
+# ./mp3_transfer.sh -s 1.3 /mnt/mp3player file1.m4a file2.m4a ...
+
+set -e
+
+# Default speed
+SPEED=1.0
+
+# Parse options
+while getopts ":s:" opt; do
+  case $opt in
+    s)
+      SPEED=$OPTARG
+      ;;
+    \?)
+      echo "Invalid option: -$OPTARG" >&2
+      exit 1
+      ;;
+    :)
+      echo "Option -$OPTARG requires a value." >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Shift past the options
+shift $((OPTIND -1))
+
+# Check arguments
+if [ "$#" -lt 2 ]; then
+  echo "Usage: $0 [-s speed] MOUNT_POINT FILE1 [FILE2 ...]"
+  exit 1
+fi
+
+MOUNT_POINT=$1
+shift
+FILES=("$@")
+
+# Check mount point exists
+if [ ! -d "$MOUNT_POINT" ]; then
+  echo "Error: Mount point '$MOUNT_POINT' does not exist."
+  exit 1
+fi
+
+# Estimate required space
+TOTAL_SIZE=0
+for f in "${FILES[@]}"; do
+  if [ ! -f "$f" ]; then
+    echo "Warning: File '$f' does not exist, skipping."
+    continue
+  fi
+  # Get file size in bytes
+  FILE_SIZE=$(stat --printf="%s" "$f")
+  # Estimate mp3 output size: roughly 1/2 of original m4a (adjust if needed)
+  TOTAL_SIZE=$((TOTAL_SIZE + FILE_SIZE / 2))
+done
+
+# Get available space in bytes
+AVAILABLE=$(df --output=avail "$MOUNT_POINT" | tail -n 1)
+AVAILABLE=$((AVAILABLE * 1024))  # df reports in KB
+
+if [ "$TOTAL_SIZE" -gt "$AVAILABLE" ]; then
+  echo "Error: Not enough space on device. Required: $TOTAL_SIZE bytes, Available: $AVAILABLE bytes"
+  exit 1
+fi
+
+echo "Enough space available. Starting conversion..."
+
+sanitize_filename() {
+  local name="$1"
+  # Remove path, keep only base name
+  name=$(basename "$name" .m4a)
+  # Replace spaces and special chars with underscore
+  name=$(echo "$name" | tr ' ' '_' | tr -cd '[:alnum:]_-')
+  # Truncate to max 50 chars
+  echo "${name:0:50}"
+}
+
+# Convert and copy files
+for f in "${FILES[@]}"; do
+  if [ ! -f "$f" ]; then
+    continue
+  fi
+
+  # Determine the next prefix
+  existing_prefixes=$(ls "$MOUNT_POINT" | grep -E '^[0-9].*\.mp3$' | sed -E 's/^([0-9]).*/\1/' | sort -n | uniq)
+  for i in {0..9}; do
+    if ! echo "$existing_prefixes" | grep -q "^$i$"; then
+      PREFIX=$i
+      break
+    fi
+  done
+
+  echo "Using prefix: $PREFIX"
+
+  BASENAME=$(sanitize_filename "$f")
+  OUT_PATTERN="$MOUNT_POINT/${PREFIX}%02d_${BASENAME}.mp3"
+
+  echo "Converting '$f' to '$OUT_PATTERN' at speed $SPEED..."
+
+  ffmpeg -i "$f" \
+    -filter:a "atempo=$SPEED" -ar 44100 -ac 2 -c:a libmp3lame -b:a 128k \
+    -f segment -segment_time 300 \
+    "$OUT_PATTERN"
+
+  # Update prefix for next file
+  # Count how many segments were created
+  SEG_COUNT=$(ls "$MOUNT_POINT" | grep -E "^${PREFIX}[0-9]{2}_" | wc -l)
+  PREFIX=$((PREFIX + SEG_COUNT))
+done
+
+echo "All files processed successfully."

.bin/toposort.nix

@@ -1,50 +1,81 @@
 let
   lib = import <nixpkgs/lib>;
-in rec {
+in
+rec {
   inherit lib;
 
   input = [
     {
-      x = ["pool" "zfs"];
-      y = ["mdadm" "raid1"];
+      x = [
+        "pool"
+        "zfs"
+      ];
+      y = [
+        "mdadm"
+        "raid1"
+      ];
     }
     {
-      x = ["pool" "zfs"];
-      y = ["disk" "sda"];
+      x = [
+        "pool"
+        "zfs"
+      ];
+      y = [
+        "disk"
+        "sda"
+      ];
     }
     {
-      x = ["mdadm" "raid1"];
-      y = ["disk" "sdb"];
+      x = [
+        "mdadm"
+        "raid1"
+      ];
+      y = [
+        "disk"
+        "sdb"
+      ];
     }
     {
-      x = ["mdadm" "raid1"];
-      y = ["disk" "sdc"];
+      x = [
+        "mdadm"
+        "raid1"
+      ];
+      y = [
+        "disk"
+        "sdc"
+      ];
     }
   ];
 
-  outNodes = node: graph:
-    lib.unique
-    (builtins.map (e: e.y)
-      (builtins.filter (v: v.x == node) graph));
+  outNodes = node: graph: lib.unique (builtins.map (e: e.y) (builtins.filter (v: v.x == node) graph));
 
-  vertices = graph:
-    lib.unique
-    (builtins.map (x: x.y) graph ++ builtins.map (x: x.x) graph);
+  vertices = graph: lib.unique (builtins.map (x: x.y) graph ++ builtins.map (x: x.x) graph);
 
   deleteVertex = node: graph: (builtins.filter (v: v.x != node && v.y != node) graph);
 
-  findSink = graph:
-    lib.findFirst
-    (v: outNodes v graph == [])
-    (lib.trace graph (builtins.abort "No sink found"))
-    (vertices graph);
+  findSink =
+    graph:
+    lib.findFirst (v: outNodes v graph == [ ]) (lib.trace graph (builtins.abort "No sink found")) (
+      vertices graph
+    );
 
-  topSort = graph:
-    if graph == []
-    then []
-    else if builtins.length graph == 1
-    then let only = builtins.head graph; in [only.y only.x]
-    else let sink = findSink graph; in [sink] ++ topSort (deleteVertex sink graph);
+  topSort =
+    graph:
+    if graph == [ ] then
+      [ ]
+    else if builtins.length graph == 1 then
+      let
+        only = builtins.head graph;
+      in
+      [
+        only.y
+        only.x
+      ]
+    else
+      let
+        sink = findSink graph;
+      in
+      [ sink ] ++ topSort (deleteVertex sink graph);
 
   output = topSort input;
 }

.github/workflows/flake.yml

@@ -2,7 +2,7 @@ name: Update flake.lock
 on:
   workflow_dispatch: # allows manual triggering
   schedule:
-    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+    - cron: "0 0 * * 0" # runs weekly on Sunday at 00:00
 
 jobs:
   lockfile:

README.md

@@ -5,10 +5,14 @@
 > [nĭvĕus](https://logeion.uchicago.edu/niveus), a, um, adj. [nix], _of_ or _from snow, snowy, snow-_ (poet.)
 >
 > 1. Lit.: aggeribus niveis informis, Verg. G. 3, 354: aqua, _cooled with snow_, Mart. 12, 17, 6; cf. id. 14, 104 and 117: mons, _covered with snow_, Cat. 64, 240.—
->
 > 2. Transf., _snow-white, snowy_ (mostly poet.): a similitudine sic: Corpore niveum candorem, aspectu igneum ardorem assequebatur, Auct. Her. 4, 33, 44: lacerti, Verg. A. 8, 387: lac, id. E. 2, 20: hanc si capite niveae agnae exorari judicas, Sen. Q. N. 2, 36: Briseis niveo colore, Hor. C. 2, 4, 3: vestis, Ov. M. 10, 432: candidior nivei folio, Galatea, ligustri, id. ib. 13, 789: dens, id. H. 18, 18: quā notam duxit niveus videri, Hor. C. 4, 2, 59: panis, Juv. 5, 70: flumen, _clear, pellucid_, Sen. Hippol. 504: undae, Mart. 7, 32, 11: tribuni, _clothed in white togas_, Calp. Ecl. 7, 29; so, Quirites, Juv. 10, 45.
 
 ## Pressestimmen
+
 > das ist ja pure poesie —[riotbib](https://github.com/riotbib/)
 
 > Deine Configs sind wunderschön <3 —[flxai](https://github.com/flxai/)
+
+## To do
+
+🦗

configs/admin-essentials.nix

@@ -1,13 +1,13 @@
 {
   pkgs,
-  niveumPackages,
   lib,
   ...
-}: let
+}:
+let
   darwin = lib.strings.hasSuffix "-darwin" pkgs.stdenv.hostPlatform.system;
-in {
-  environment.systemPackages =
-    [
+in
+{
+  environment.systemPackages = [
     pkgs.htop
     pkgs.w3m
     pkgs.wget
@@ -37,12 +37,12 @@ in {
     pkgs.bc # calculator
     pkgs.pari # gp -- better calculator
     pkgs.ts
-      niveumPackages.vimv
-      niveumPackages.vg
-      niveumPackages.fkill
-      niveumPackages.cyberlocker-tools
-      niveumPackages.untilport
-      niveumPackages.kpaste
+    pkgs.vimv
+    pkgs.vg
+    pkgs.fkill
+    pkgs.cyberlocker-tools
+    pkgs.untilport
+    pkgs.kpaste
     # HARDWARE
     pkgs.pciutils # for lspci
   ]
@@ -53,7 +53,6 @@ in {
     pkgs.psmisc # for killall, pstree
   ];
 
-
   security.wrappers = {
     pmount = {
       setuid = true;
@@ -69,12 +68,20 @@ in {
     };
   };
 
-  environment.shellAliases = let
+  environment.interactiveShellInit = ''
+    # Use XDG_RUNTIME_DIR for temporary files if available
+    if [ -d "$XDG_RUNTIME_DIR" ]; then
+      export TMPDIR="$XDG_RUNTIME_DIR"
+    fi
+  '';
+
+  environment.shellAliases =
+    let
       take = pkgs.writers.writeDash "take" ''
         mkdir "$1" && cd "$1"
       '';
       cdt = pkgs.writers.writeDash "cdt" ''
-      cd "$(mktemp -d)"
+        cd $(mktemp -p "$XDG_RUNTIME_DIR" -d "cdt-XXXXXX")
         pwd
       '';
       wcd = pkgs.writers.writeDash "wcd" ''
@@ -85,7 +92,7 @@ in {
       '';
     in
     {
-      nixi = "nix repl '<nixpkgs>'";
+      nixi = "nix repl nixpkgs";
       take = "source ${take}";
       wcd = "source ${wcd}";
       where = "source ${where}";
@@ -104,9 +111,10 @@ in {
       la = "${pkgs.coreutils}/bin/ls --color=auto --time-style=long-iso --almost-all -l";
     }
     // (
-      if darwin
-      then {}
-      else {
+      if darwin then
+        { }
+      else
+        {
           "ß" = "${pkgs.util-linux}/bin/setsid";
           ip = "${pkgs.iproute2}/bin/ip -c";
           # systemd

configs/aerc.nix

@@ -2,11 +2,9 @@
   pkgs,
   config,
   lib,
-  niveumPackages,
   ...
-}: let
-  inherit (import ../lib/email.nix) defaults thunderbirdProfile;
-in {
+}:
+{
   age.secrets = {
     email-password-ical-ephemeris = {
       file = ../secrets/email-password-ical-ephemeris.age;
@@ -43,14 +41,15 @@ in {
       extraConfig = {
         database.path = config.home-manager.users.me.accounts.email.maildirBasePath;
         new.tags = "";
-        user.name = defaults.realName;
+        user.name = pkgs.lib.niveum.email.defaults.realName;
         user.primary_email = config.home-manager.users.me.accounts.email.accounts.posteo.address;
       };
     };
 
     programs.mbsync = {
       enable = true;
-      extraConfig = lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: ''
+      extraConfig = lib.concatStringsSep "\n\n" (
+        lib.mapAttrsToList (name: account: ''
           IMAPAccount ${name}
           CertificateFile /etc/ssl/certs/ca-certificates.crt
           Host ${account.imap.host}
@@ -74,30 +73,35 @@ in {
           Patterns *
           Remove None
           SyncState *
-        '')
-        config.home-manager.users.me.accounts.email.accounts);
+        '') config.home-manager.users.me.accounts.email.accounts
+      );
     };
 
     accounts.email.accounts = {
       cock =
-        lib.recursiveUpdate defaults
-        rec {
+        let
+          mailhost = "mail.cock.li";
           address = "2210@cock.li";
+        in
+        lib.recursiveUpdate pkgs.lib.niveum.email.defaults {
+          address = address;
           userName = address;
           passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-cock.path}";
           realName = "2210";
-          imap.host = "mail.cock.li";
+          imap.host = mailhost;
           imap.port = 993;
-          smtp.host = imap.host;
+          smtp.host = mailhost;
           smtp.port = 25;
           smtp.tls.useStartTls = true;
         };
       ical-ephemeris =
-        lib.recursiveUpdate defaults
-        rec {
-          userName = "ical.ephemeris@web.de";
+        let
+          address = "ical.ephemeris@web.de";
+        in
+        lib.recursiveUpdate pkgs.lib.niveum.email.defaults {
+          userName = address;
           realName = "Kieran from iCal Ephemeris";
-          address = userName;
+          address = address;
           passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-ical-ephemeris.path}";
           imap.host = "imap.web.de";
           imap.port = 993;
@@ -106,22 +110,24 @@ in {
           smtp.tls.useStartTls = true;
         };
       posteo =
-        lib.recursiveUpdate defaults
-        rec {
+        let
+          mailhost = "posteo.de";
           address = "kieran.meinhardt@posteo.net";
+        in
+        lib.recursiveUpdate pkgs.lib.niveum.email.defaults {
+          address = address;
           aliases = [ "kmein@posteo.de" ];
           userName = address;
-          imap.host = "posteo.de";
+          imap.host = mailhost;
           imap.port = 993;
           imap.tls.enable = true;
-          smtp.host = imap.host;
+          smtp.host = mailhost;
           smtp.port = 465;
           smtp.tls.enable = true;
           primary = true;
           passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-posteo.path}";
           himalaya = {
             enable = true;
-            settings.backend = "imap";
           };
           aerc.extraAccounts.pgp-key-id = "9EDE82CC72A343A95266D0F444857074A3ACC8B7";
         };
@@ -133,7 +139,7 @@ in {
       enable = true;
       settings = {
       };
-      profiles.${thunderbirdProfile} = {
+      profiles.${pkgs.lib.niveum.email.thunderbirdProfile} = {
         isDefault = true;
         settings = {
           "mail.default_send_format" = 1;
@@ -141,10 +147,8 @@ in {
           "msgcompose.text_color" = config.lib.stylix.colors.withHashtag.base00;
           "msgcompose.background_color" = config.lib.stylix.colors.withHashtag.base05;
         };
-        userChrome = ''
-        '';
-        userContent = ''
-        '';
+        userChrome = '''';
+        userContent = '''';
         withExternalGnupg = false;
       };
     };
@@ -206,7 +210,7 @@ in {
           "*" = ":filter -x Flagged<Enter>";
         };
         view = {
-          tr = ":pipe ${niveumPackages.trans}/bin/trans -show-original n -b -no-autocorrect<Enter>"; # https://man.sr.ht/~rjarry/aerc/integrations/translator.md
+          tr = ":pipe ${pkgs.trans}/bin/trans -show-original n -b -no-autocorrect<Enter>"; # https://man.sr.ht/~rjarry/aerc/integrations/translator.md
           "/" = ":toggle-key-passthrough <Enter> /";
           q = ":close<Enter>";
           O = ":open<Enter>";
@@ -279,7 +283,9 @@ in {
         ui.spinner = ". , .";
         general.unsafe-accounts-conf = true;
         general.pgp-provider = "gpg";
-        viewer = {pager = "${pkgs.less}/bin/less -R";};
+        viewer = {
+          pager = "${pkgs.less}/bin/less -R";
+        };
         compose = {
           # address-book-cmd = "khard email --remove-first-line --parsable '%s'";
           no-attachment-warning = "(attach|attached|attachments?|anbei|Anhang|angehängt|beigefügt)";
@@ -296,9 +302,10 @@ in {
           "message/rfc822" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
           "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
         };
-        openers = let
+        openers =
+          let
             as-pdf = pkgs.writers.writeDash "as-pdf" ''
-            d=$(mktemp -d)
+              d=$(mktemp -p "$XDG_RUNTIME_DIR" -d)
               trap clean EXIT
               clean() {
                 rm -rf "$d"
@@ -306,7 +313,8 @@ in {
               ${pkgs.libreoffice}/bin/libreoffice --headless --convert-to pdf "$1" --outdir "$d"
               ${pkgs.zathura}/bin/zathura "$d"/*.pdf
             '';
-        in {
+          in
+          {
             "image/*" = "${pkgs.nsxiv}/bin/nsxiv";
             "application/pdf" = "${pkgs.zathura}/bin/zathura";
             "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = toString as-pdf;

configs/alacritty.nix

@@ -2,8 +2,10 @@
   pkgs,
   lib,
   ...
-}: let
-in {
+}:
+let
+in
+{
   environment.variables.TERMINAL = "alacritty";
 
   home-manager.users.me = {

configs/applicative.nix

@@ -0,0 +1,124 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  users.users.applicative = {
+    name = "applicative";
+    description = "<*>";
+    hashedPasswordFile = config.age.secrets.kfm-password.path;
+    isNormalUser = true;
+    extraGroups = [
+      "pipewire"
+      "audio"
+    ];
+  };
+
+  # to run nspawn in nix sandbox
+  nix.settings = {
+    auto-allocate-uids = true;
+    system-features = [ "uid-range" ];
+    experimental-features = [
+      "auto-allocate-uids"
+      "cgroups"
+    ];
+    extra-sandbox-paths = [ "/dev/net" ]; # needed for tests of VPNs
+  };
+
+  services.restic.backups.niveum = {
+    extraBackupArgs = [
+      "--exclude=${config.users.users.applicative.home}/src/nixpkgs/.git"
+    ];
+    paths = [
+      config.users.users.applicative.home
+    ];
+  };
+
+  security.sudo.extraRules = [
+    {
+      # still required for systemd-nspawn
+      users = [ config.users.users.applicative.name ];
+      commands = [ "ALL" ];
+    }
+  ];
+
+  home-manager.users.applicative =
+    let
+      mainGitConfig = (import ./git.nix {
+        inherit pkgs lib config;
+      }).home-manager.users.me.programs.git;
+      mainAlacrittyConfig = (import ./alacritty.nix {
+        inherit pkgs lib config;
+      }).home-manager.users.me.programs.alacritty;
+    in
+    lib.recursiveUpdate
+      (import ./graphical/home-manager.nix {
+        inherit lib pkgs config;
+      })
+      {
+        xdg.enable = true;
+        home.stateVersion = "25.11";
+
+        programs.git = {
+          enable = true;
+          settings = {
+            inherit (mainGitConfig.settings) alias;
+          };
+        };
+
+        programs.alacritty = mainAlacrittyConfig;
+
+        services.hyprpaper =
+          let
+            # asgWallpaper = pkgs.fetchurl {
+            #   url = "http://c.krebsco.de/asg-wallpaper.png";
+            #   hash = "sha256-XLp8XcUgFgDKW5Qae0//0Xw9lhribcevQTVSQvClEB4=";
+            # };
+
+            backgroundColor = config.lib.stylix.colors.withHashtag.base06;
+            foregroundColor = config.lib.stylix.colors.withHashtag.base01;
+            width = 1920;
+            height = 1080;
+
+            svgUrl = "https://applicative.systems/_astro/logo-full.D8zRvqBZ.svg";
+            logoSvg = pkgs.fetchurl {
+              url = svgUrl;
+              hash = "sha256-qXDIEZsAPn4eUJ3kb5U6L3PMUCtWGYqhqyIaBt7FntE=";
+            };
+
+            asgWallpaper =
+              pkgs.runCommand "applicative-wallpaper.png"
+                {
+                  nativeBuildInputs = [ pkgs.imagemagick ];
+                }
+                ''
+                  # 1. We use -background to set the canvas color
+                  # 2. We use -fuzz and -opaque to replace the logo's internal colors
+                  # 3. We use -gravity and -extent to center it on a wallpaper-sized canvas
+
+                  convert \
+                    -background none \
+                    -density 300 \
+                    "${logoSvg}" \
+                    -fuzz 100% -fill "${foregroundColor}" -opaque black \
+                    -resize 800x800 \
+                    -gravity center \
+                    -background "${backgroundColor}" \
+                    -extent ${toString width}x${toString height} \
+                    $out
+                '';
+          in
+          {
+            enable = true;
+            settings = {
+              ipc = false;
+              splash = true;
+              preload = [ "${asgWallpaper}" ];
+              wallpaper = [ ",${asgWallpaper}" ];
+            };
+          };
+
+      };
+}

configs/backup.nix

@@ -1,13 +1,13 @@
 {
   pkgs,
   config,
+  lib,
   ...
-}: let
-  inherit (import ../lib) restic;
-in {
+}:
+{
   services.restic.backups.niveum = {
     initialize = true;
-    inherit (restic) repository;
+    repository = pkgs.lib.niveum.restic.repository;
     timerConfig = {
       OnCalendar = "8:00";
       RandomizedDelaySec = "1h";
@@ -38,15 +38,15 @@ in {
 
   environment.systemPackages = [
     (pkgs.writers.writeDashBin "restic-niveum" ''
-      ${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} "$@"
+      ${pkgs.restic}/bin/restic -r ${pkgs.lib.niveum.restic.repository} -p ${config.age.secrets.restic.path} "$@"
     '')
     (pkgs.writers.writeDashBin "restic-mount" ''
-      mountdir=$(mktemp -d)
+      mountdir=$(mktemp -p "$XDG_RUNTIME_DIR" -d "restic-mount-XXXXXXX")
       trap clean EXIT
       clean() {
         rm -r "$mountdir"
       }
-      ${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} mount "$mountdir"
+      ${pkgs.restic}/bin/restic -r ${pkgs.lib.niveum.restic.repository} -p ${config.age.secrets.restic.path} mount "$mountdir"
     '')
   ];
 }

configs/bash.nix

@@ -1,7 +1,7 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.bash = {
-    promptInit = ''
-      PS1="$(${pkgs.ncurses}/bin/tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(${pkgs.ncurses}/bin/tput sgr0) "'';
+    promptInit = ''PS1="$(${pkgs.ncurses}/bin/tput bold)\w \$([[ \$? == 0 ]] && echo \"\[\033[1;32m\]\" || echo \"\[\033[1;31m\]\")\$$(${pkgs.ncurses}/bin/tput sgr0) "'';
     interactiveShellInit = ''
       set -o vi
     '';

configs/bluetooth.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   hardware.bluetooth = {
     enable = true;
     settings.general = {

configs/bots/autorenkalender.nix

@@ -1,10 +1,9 @@
 {
   config,
-  inputs,
+  pkgs,
   ...
-}: let
-  autorenkalender = inputs.autorenkalender.packages.x86_64-linux.default;
-in {
+}:
+{
   niveum.bots.autorenkalender = {
     enable = true;
     time = "07:00";
@@ -14,7 +13,7 @@ in {
       chatIds = [ "@autorenkalender" ];
       parseMode = "Markdown";
     };
-    command = "${autorenkalender}/bin/autorenkalender";
+    command = "${pkgs.autorenkalender}/bin/autorenkalender";
   };
 
   niveum.passport.services = [

configs/bots/celan.nix

@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   niveum.bots.celan = {
     enable = true;
     time = "08:00";
@@ -17,7 +18,8 @@
       tokenFile = config.age.secrets.mastodon-token-celan.path;
       language = "de";
     };
-    command = toString (pkgs.writers.writePython3 "random-celan.py" { libraries = [pkgs.python3Packages.lxml]; } ''
+    command = toString (
+      pkgs.writers.writePython3 "random-celan.py" { libraries = [ pkgs.python3Packages.lxml ]; } ''
         from lxml import etree
         import random
 
@@ -26,10 +28,12 @@
             return "".join("".join(t.itertext()) for t in elements).strip()
 
 
-      tree = etree.parse('${pkgs.fetchurl {
+        tree = etree.parse('${
+          pkgs.fetchurl {
             url = "http://c.krebsco.de/celan.tei.xml";
             hash = "sha256-HgNmJYfhuwyfm+FcNtnnYWpJpIIU1ElHLeLiIFjF9mE=";
-      }}')
+          }
+        }')
         root = tree.getroot()
 
         tei = {"tei": "http://www.tei-c.org/ns/1.0"}
@@ -60,7 +64,8 @@
             current_element = current_element.getparent()
 
         print("\n\n#PaulCelan #Celan #Lyrik #poetry")
-    '');
+      ''
+    );
   };
 
   age.secrets = {

configs/bots/default.nix

@@ -1,15 +1,13 @@
 {
   config,
   pkgs,
-  lib,
-  inputs,
   ...
-}: let
-  telebots = inputs.telebots.defaultPackage.x86_64-linux;
+}:
+let
   reverseDirectory = "/run/telegram-reverse";
   proverbDirectory = "/run/telegram-proverb";
-  inherit (import ../../lib) tmpfilesConfig;
-in {
+in
+{
   imports = [
     ./logotheca.nix
     ./transits.nix
@@ -26,13 +24,21 @@ in {
     telegram-token-kmein.file = ../../secrets/telegram-token-kmein.age;
   };
 
-  systemd.tmpfiles.rules = map (path:
-    tmpfilesConfig {
+  systemd.tmpfiles.rules =
+    map
+      (
+        path:
+        pkgs.lib.niveum.tmpfilesConfig {
           type = "d";
           mode = "0750";
           age = "1h";
           inherit path;
-    }) [reverseDirectory proverbDirectory];
+        }
+      )
+      [
+        reverseDirectory
+        proverbDirectory
+      ];
 
   niveum.passport.services = [
     {
@@ -65,7 +71,7 @@ in {
     path = [ pkgs.ffmpeg ];
     enable = true;
     script = ''
-      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${telebots}/bin/telegram-reverse
+      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${pkgs.telebots}/bin/telegram-reverse
     '';
     serviceConfig.Restart = "always";
     serviceConfig.WorkingDirectory = reverseDirectory;
@@ -77,7 +83,7 @@ in {
     description = "Telegram bot converting YouTube Music <-> Spotify";
     enable = true;
     script = ''
-      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${telebots}/bin/telegram-streaming-link
+      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${pkgs.telebots}/bin/telegram-streaming-link
     '';
     serviceConfig.Restart = "always";
     serviceConfig.LoadCredential = "token:${config.age.secrets.telegram-token-streaming-link.path}";
@@ -88,7 +94,7 @@ in {
     description = "Telegram beta code bot";
     enable = true;
     script = ''
-      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${telebots}/bin/telegram-betacode
+      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${pkgs.telebots}/bin/telegram-betacode
     '';
     serviceConfig.Restart = "always";
     serviceConfig.LoadCredential = "token:${config.age.secrets.telegram-token-betacode.path}";
@@ -99,7 +105,7 @@ in {
     description = "Telegram proverb bot";
     enable = true;
     script = ''
-      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${telebots}/bin/telegram-proverb
+      TELEGRAM_BOT_TOKEN="$(cat "$CREDENTIALS_DIRECTORY/token")" ${pkgs.telebots}/bin/telegram-proverb
     '';
     serviceConfig.Restart = "always";
     serviceConfig.WorkingDirectory = proverbDirectory;

configs/bots/hesychius.nix

@@ -1,12 +1,9 @@
 {
   pkgs,
   config,
-  inputs,
-  lib,
   ...
-}: let
-  hesychius = inputs.scripts.outPath + "/hesychius/hesychius.txt";
-in {
+}:
+{
   niveum.bots.hesychius = {
     enable = true;
     time = "08:00";
@@ -20,7 +17,7 @@ in {
       tokenFile = config.age.secrets.telegram-token-kmein.path;
       chatIds = [ "@HesychiosAlexandreus" ];
     };
-    command = "${pkgs.coreutils}/bin/shuf -n1 ${hesychius}";
+    command = "${pkgs.coreutils}/bin/shuf -n1 ${pkgs.hesychius}";
   };
 
   systemd.timers.bot-hesychius.timerConfig.RandomizedDelaySec = "10h";

configs/bots/logotheca.nix

@@ -1,10 +1,9 @@
 {
   pkgs,
   config,
-  lib,
-  niveumPackages,
   ...
-}: {
+}:
+{
   niveum.bots.logotheca = {
     enable = true;
     time = "08/6:00";
@@ -22,7 +21,7 @@
         "!zlwCuPiCNMSxDviFzA:4d2.org"
       ];
     };
-    command = "${niveumPackages.literature-quote}/bin/literature-quote";
+    command = "${pkgs.literature-quote}/bin/literature-quote";
   };
 
   age.secrets = {

configs/bots/nachtischsatan.nix

@@ -3,11 +3,15 @@
   config,
   lib,
   ...
-}: let
-  nachtischsatan-bot = {tokenFile}:
-    pkgs.writers.writePython3 "nachtischsatan-bot" {
+}:
+let
+  nachtischsatan-bot =
+    { tokenFile }:
+    pkgs.writers.writePython3 "nachtischsatan-bot"
+      {
         libraries = [ pkgs.python3Packages.python-telegram-bot ];
-    } ''
+      }
+      ''
         from telegram.ext import Application, ContextTypes, MessageHandler, filters
         from telegram import Update
         import random
@@ -25,7 +29,8 @@
             application.add_handler(MessageHandler(filters.ALL, flubber))
             application.run_polling()
       '';
-in {
+in
+{
   systemd.services.telegram-nachtischsatan = {
     wantedBy = [ "multi-user.target" ];
     description = "*flubberflubber*";

configs/bots/nietzsche.nix

@@ -1,9 +1,9 @@
 {
   config,
   pkgs,
-  niveumPackages,
   ...
-}: {
+}:
+{
   niveum.bots.nietzsche = {
     enable = true;
     time = "08:00";
@@ -12,15 +12,17 @@
       tokenFile = config.age.secrets.mastodon-token-nietzsche.path;
       language = "de";
     };
-    command = toString (pkgs.writers.writeBash "random-nietzsche" ''
+    command = toString (
+      pkgs.writers.writeBash "random-nietzsche" ''
         set -efu
         random_number=$(( ($RANDOM % 10) + 1 ))
         if [ "$random_number" -eq 1 ]; then
-        ${niveumPackages.random-zeno}/bin/random-zeno "/Literatur/M/Nietzsche,+Friedrich"
+          ${pkgs.random-zeno}/bin/random-zeno "/Literatur/M/Nietzsche,+Friedrich"
         else
-        ${niveumPackages.random-zeno}/bin/random-zeno "/Philosophie/M/Nietzsche,+Friedrich"
+          ${pkgs.random-zeno}/bin/random-zeno "/Philosophie/M/Nietzsche,+Friedrich"
         fi
-    '');
+      ''
+    );
   };
 
   systemd.timers.bot-nietzsche.timerConfig.RandomizedDelaySec = "10h";

configs/bots/smyth.nix

@@ -3,7 +3,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   niveum.bots.smyth = {
     enable = true;
     time = "08:00";
@@ -17,7 +18,8 @@
       tokenFile = config.age.secrets.telegram-token-kmein.path;
       chatIds = [ "@HerbertWeirSmyth" ];
     };
-    command = toString (pkgs.writers.writeDash "random-smyth" ''
+    command = toString (
+      pkgs.writers.writeDash "random-smyth" ''
         set -efu
 
         good_curl() {
@@ -50,7 +52,8 @@
           | ${pkgs.pandoc}/bin/pandoc -f html -t plain --wrap=none
 
         printf '\n%s\n\n#AncientGreek' "$url"
-    '');
+      ''
+    );
   };
 
   systemd.timers.bot-smyth.timerConfig.RandomizedDelaySec = "10h";

configs/bots/tlg-wotd.nix

@@ -1,20 +1,28 @@
 {
   pkgs,
-  lib,
   config,
-  niveumPackages,
-  unstablePackages,
   ...
-}: let
+}:
+let
   mastodonEndpoint = "https://social.krebsco.de";
-in {
+in
+{
   systemd.services.bot-tlg-wotd = {
     # TODO reenable
     # once https://github.com/NixOS/nixpkgs/pull/462893 is in stable NixOS
     enable = true;
     wants = [ "network-online.target" ];
     startAt = "9:30";
-    path = [ pkgs.jq pkgs.curl pkgs.recode pkgs.deno pkgs.imagemagick pkgs.gawk pkgs.gnugrep pkgs.coreutils ];
+    path = [
+      pkgs.jq
+      pkgs.curl
+      pkgs.recode
+      pkgs.deno
+      pkgs.imagemagick
+      pkgs.gawk
+      pkgs.gnugrep
+      pkgs.coreutils
+    ];
     environment = {
       NPM_CONFIG_CACHE = "/tmp";
       CLTK_DATA = "/tmp";
@@ -45,9 +53,12 @@ in {
 
         #ancientgreek #classics #wotd #wordoftheday
 
-      transliteration=$(${pkgs.writers.writePython3 "translit.py" {
+        transliteration=$(${
+          pkgs.writers.writePython3 "translit.py"
+            {
               libraries = py: [ py.cltk ];
-      } ''
+            }
+            ''
               import sys
               from cltk.phonology.grc.transcription import Transcriber
 
@@ -56,7 +67,8 @@ in {
               ipa = probert.transcribe(text)
 
               print(ipa)
-      ''} "$compact_word")
+            ''
+        } "$compact_word")
 
 
         photo_path=/tmp/output.png

configs/bots/transits.nix

@@ -3,7 +3,8 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   toSymbols = pkgs.writers.writeDash "to-symbols" ''
     ${pkgs.gnused}/bin/sed '
       s/\bTri\b/△/;
@@ -40,7 +41,8 @@
       s/^\s*//
     '
   '';
-in {
+in
+{
   niveum.bots.transits = {
     enable = true;
     time = "*:0/1";
@@ -53,7 +55,8 @@ in {
       tokenFile = config.age.secrets.telegram-token-kmein.path;
       chatIds = [ "-1001796440545" ];
     };
-    command = toString (pkgs.writers.writeDash "common-transits" ''
+    command = toString (
+      pkgs.writers.writeDash "common-transits" ''
         set -efu
 
         now=$(${pkgs.coreutils}/bin/date +%_H:%M | ${pkgs.gnused}/bin/sed 's/^\s*//')
@@ -63,7 +66,8 @@ in {
           # ./astrolog -Yt -Yd -q 10 22 1999 6:32 -zN Kassel -td $date -R Uranus Neptune Pluto "North Node"
           ./astrolog -qd $date -zN Berlin -Yt -Yd -d -R Uranus Neptune Pluto "North Node" -A 2
         ) | ${toSymbols} | ${pkgs.coreutils}/bin/sort -n | ${pkgs.gnugrep}/bin/grep "^$now" || :
-    '');
+      ''
+    );
   };
 
   age.secrets = {

configs/browser.nix

@@ -1,11 +1,11 @@
 {
   config,
   pkgs,
-  niveumPackages,
   ...
-}: {
+}:
+{
   environment.systemPackages = [
-    niveumPackages.cro
+    pkgs.cro
     pkgs.tor-browser
     pkgs.firefox
     pkgs.brave
@@ -14,7 +14,8 @@
   home-manager.users.me = {
     programs.firefox = {
       enable = true;
-      profiles = let
+      profiles =
+        let
           defaultSettings = {
             "beacon.enabled" = false;
             "browser.bookmarks.showMobileBookmarks" = true;
@@ -59,7 +60,8 @@
             "toolkit.telemetry.updatePing.enabled" = false;
             "ui.prefersReducedMotion" = 1;
           };
-      in {
+        in
+        {
           default = {
             id = 0;
             isDefault = true;

configs/ccc.nix

@@ -1,28 +1,38 @@
 { pkgs, ... }:
-# https://paste.sr.ht/~erictapen/11716989e489b600f237041b6d657fdf0ee17b34
-let
-  certificate = pkgs.stdenv.mkDerivation rec {
-    name = "dst-root-ca-x3.pem";
-    src = builtins.toFile "${name}.sed" ''
-      1,/DST Root CA X3/d
-      1,/-----END CERTIFICATE-----/p
-    '';
-    nativeBuildInputs = with pkgs; [cacert gnused];
-    phases = "installPhase";
-    installPhase = ''
-      ${pkgs.gnused}/bin/sed -n -f $src ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt > $out
-    '';
+{
+  networking.networkmanager.ensureProfiles.profiles = {
+    "39C3" = {
+      connection = {
+        id = "39C3";
+        type = "wifi";
+      };
+      wifi = {
+        mode = "infrastructure";
+        ssid = "39C3";
+      };
+      wifi-security = {
+        auth-alg = "open";
+        key-mgmt = "wpa-eap";
+      };
+      "802-1x" = {
+        anonymous-identity = "39C3";
+        eap = "ttls;";
+        identity = "39C3";
+        password = "39C3";
+        phase2-auth = "pap";
+        altsubject-matches = "DNS:radius.c3noc.net";
+        ca-cert = "${builtins.fetchurl {
+          url = "https://letsencrypt.org/certs/isrgrootx1.pem";
+          sha256 = "sha256:1la36n2f31j9s03v847ig6ny9lr875q3g7smnq33dcsmf2i5gd92";
+        }}";
+      };
+      ipv4 = {
+        method = "auto";
+      };
+      ipv6 = {
+        addr-gen-mode = "default";
+        method = "auto";
+      };
     };
-in {
-  networking.wireless.networks."36C3" = {
-    auth = ''
-      key_mgmt=WPA-EAP
-      eap=TTLS
-      identity="kmein"
-      password=" "
-      ca_cert="${certificate}"
-      altsubject_match="DNS:radius.c3noc.net"
-      phase2="auth=PAP"
-    '';
   };
 }

configs/clipboard.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   services.clipmenu.enable = true;
 }

configs/cloud.nix

@@ -3,9 +3,8 @@
   lib,
   pkgs,
   ...
-}: let
-  inherit (import ../lib) tmpfilesConfig;
-in {
+}:
+{
   systemd.user.services.systemd-tmpfiles-clean = {
     enable = true;
     wantedBy = [ "default.target" ];
@@ -16,7 +15,8 @@ in {
     };
   };
 
-  systemd.user.tmpfiles.users.me.rules = map tmpfilesConfig [
+  systemd.user.tmpfiles.users.me.rules =
+    map pkgs.lib.niveum.tmpfilesConfig [
       {
         type = "d";
         mode = "0755";
@@ -29,14 +29,26 @@ in {
         age = "7d";
         path = "${config.users.users.me.home}/cloud/nextcloud/tmp";
       }
-  ] ++ map (path: tmpfilesConfig {
+    ]
+    ++
+      map
+        (
+          path:
+          pkgs.lib.niveum.tmpfilesConfig {
             type = "L+";
             user = config.users.users.me.name;
             group = config.users.users.me.group;
             mode = "0755";
             argument = "${config.users.users.me.home}/sync/${path}";
             path = "${config.users.users.me.home}/${path}";
-  }) [".ssh" ".gnupg" ".pki" ".local/share/aerc"];
+          }
+        )
+        [
+          ".ssh"
+          ".gnupg"
+          ".pki"
+          ".local/share/aerc"
+        ];
 
   services.gnome.gnome-keyring.enable = true;
   security.pam.services.lightdm.enableGnomeKeyring = true;
@@ -53,14 +65,16 @@ in {
     wants = [ "network-online.target" ];
     wantedBy = [ "default.target" ];
     startAt = "*:00/10";
-    script = let
+    script =
+      let
         kieran = {
           user = "kieran";
           passwordFile = config.age.secrets.nextcloud-password-kieran.path;
           endpoint = "https://cloud.kmein.de";
           target = "${config.users.users.me.home}/notes";
         };
-    in ''
+      in
+      ''
         mkdir -p ${lib.escapeShellArg kieran.target}
         ${pkgs.nextcloud-client}/bin/nextcloudcmd --non-interactive --user ${kieran.user} --password "$(cat ${kieran.passwordFile})" --path /Notes ${lib.escapeShellArg kieran.target} ${kieran.endpoint}
       '';
@@ -79,19 +93,22 @@ in {
       } | ${pkgs.fzf}/bin/fzf)"
       exec ${pkgs.zathura}/bin/zathura "$book"
     '')
-    (let
+    (
+      let
         kieran = {
           user = "kieran.meinhardt@gmail.com";
           passwordFile = config.age.secrets.mega-password.path;
         };
-      megatools = command: ''${pkgs.megatools}/bin/megatools ${command} --username ${lib.escapeShellArg kieran.user} --password "$(cat ${kieran.passwordFile})"'';
+        megatools =
+          command:
+          ''${pkgs.megatools}/bin/megatools ${command} --username ${lib.escapeShellArg kieran.user} --password "$(cat ${kieran.passwordFile})"'';
       in
       pkgs.writers.writeDashBin "book-mega" ''
         set -efu
         selection="$(${megatools "ls"} | ${pkgs.fzf}/bin/fzf)"
         test -n "$selection" || exit 1
 
-        tmpdir="$(mktemp -d)"
+        tmpdir="$(mktemp -p "$XDG_RUNTIME_DIR" -d)"
         trap clean EXIT
         clean() {
           rm -rf "$tmpdir"
@@ -102,7 +119,8 @@ in {
           ${megatools "get"} "$selection"
           exec ${pkgs.zathura}/bin/zathura "$(basename "$selection")"
         )
-      '')
+      ''
+    )
   ];
 
   age.secrets.mega-password = {
@@ -121,16 +139,25 @@ in {
     cert = config.age.secrets.syncthing-cert.path;
     key = config.age.secrets.syncthing-key.path;
     settings = {
-      inherit ((import ../lib).syncthing) devices;
+      devices = pkgs.lib.niveum.syncthingIds;
       folders = {
         "${config.users.users.me.home}/sync" = {
-          devices = ["kabsa" "manakish" "fatteh"];
+          devices = [
+            "kabsa"
+            "manakish"
+            "fatteh"
+          ];
           label = "sync";
           versioning.type = "trashcan";
           versioning.params.cleanoutDays = 100;
         };
         "${config.users.users.me.home}/mobile" = {
-          devices = ["kabsa" "manakish" "fatteh" "kibbeh"];
+          devices = [
+            "kabsa"
+            "manakish"
+            "fatteh"
+            "kibbeh"
+          ];
           id = "mobile";
           label = "mobile";
           versioning.type = "trashcan";

configs/default.nix

@@ -2,19 +2,13 @@
   pkgs,
   lib,
   config,
-  niveumPackages,
-  inputs,
   ...
 }:
 let
   inherit (lib.strings) makeBinPath;
-  inherit (import ../lib) localAddresses kieran remoteDir;
-  defaultApplications = (import ../lib).defaultApplications { inherit pkgs; };
 in
 {
   imports = [
-    inputs.self.nixosModules.system-dependent
-    inputs.self.nixosModules.power-action
     {
       boot.supportedFilesystems = [ "ntfs" ];
     }
@@ -68,7 +62,7 @@ in
 
       users.users.me = {
         name = "kfm";
-        description = kieran.name;
+        description = pkgs.lib.niveum.kieran.name;
         hashedPasswordFile = config.age.secrets.kfm-password.path;
         isNormalUser = true;
         uid = 1000;
@@ -90,13 +84,13 @@ in
       environment.interactiveShellInit = "export PATH=$PATH";
       environment.shellAliases =
         let
-          swallow = command: "${niveumPackages.swallow}/bin/swallow ${command}";
+          swallow = command: "${pkgs.swallow}/bin/swallow ${command}";
         in
         {
           o = "${pkgs.xdg-utils}/bin/xdg-open";
           ns = "nix-shell --run zsh";
-          pbcopy = "${pkgs.xclip}/bin/xclip -selection clipboard -in";
-          pbpaste = "${pkgs.xclip}/bin/xclip -selection clipboard -out";
+          pbcopy = "${pkgs.wl-clipboard}/bin/wl-copy";
+          pbpaste = "${pkgs.wl-clipboard}/bin/wl-paste";
           tmux = "${pkgs.tmux}/bin/tmux -2";
           sxiv = swallow "${pkgs.nsxiv}/bin/nsxiv";
           zathura = swallow "${pkgs.zathura}/bin/zathura";
@@ -111,19 +105,22 @@ in
         supportedLocales = [ "all" ];
       };
     }
+    {
+      services.power-profiles-daemon.enable = true;
+    }
     {
       services.displayManager = {
         autoLogin = {
-          enable = true;
+          enable = false;
           user = config.users.users.me.name;
         };
       };
       services.xserver = {
-        enable = true;
+        enable = false;
         displayManager.lightdm = {
-          enable = true;
+          enable = false;
           greeters.gtk = {
-            enable = true;
+            enable = false;
             indicators = [
               "~spacer"
               "~host"
@@ -140,9 +137,13 @@ in
         agent = {
           enable = true;
           pinentryPackage = pkgs.pinentry-qt;
-          settings = rec {
-            default-cache-ttl = 2 * 60 * 60;
-            max-cache-ttl = 4 * default-cache-ttl;
+          settings =
+            let
+              defaultCacheTtl = 2 * 60 * 60;
+            in
+            {
+              default-cache-ttl = defaultCacheTtl;
+              max-cache-ttl = 4 * defaultCacheTtl;
             };
         };
       };
@@ -161,7 +162,7 @@ in
     }
     {
       services.getty = {
-        greetingLine = lib.mkForce "";
+        greetingLine = lib.mkForce "As-salamu alaykum wa rahmatullahi wa barakatuh!";
         helpLine = lib.mkForce "";
       };
     }
@@ -169,7 +170,7 @@ in
       networking.hosts = lib.mapAttrs' (name: address: {
         name = address;
         value = [ "${name}.local" ];
-      }) localAddresses;
+      }) pkgs.lib.niveum.localAddresses;
     }
     {
       home-manager.users.me.home.stateVersion = "22.05";
@@ -190,103 +191,76 @@ in
         dconf.enable = true;
         dconf.settings = {
           # Change the default terminal for Nemo
-          "org/cinnamon/desktop/applications/terminal".exec = defaultApplications.terminal;
+          "org/cinnamon/desktop/applications/terminal".exec = lib.getExe pkgs.niveum-terminal;
         };
       };
     }
     ./android.nix
-    ./admin-essentials.nix
     ./stylix.nix
     ./alacritty.nix
     ./backup.nix
     ./bash.nix
     ./bluetooth.nix
     ./aerc.nix
-    ./ccc.nix
     ./khal.nix
     ./browser.nix
     ./clipboard.nix
     ./cloud.nix
     ./direnv.nix
-    ./docker.nix
-    ./dunst.nix
     ./fonts.nix
     ./fzf.nix
     ./git.nix
     ./hledger.nix
     ./htop.nix
     ./uni.nix
-    ./i3.nix
+    # ./i3.nix
+    ./graphical
     ./i3status-rust.nix
-    ./keyboard.nix
-    ./mycelium.nix
+    ./keyboard
     ./kdeconnect.nix
-    { home-manager.users.me.home.file.".XCompose".source = ../lib/keyboards/XCompose; }
     { services.upower.enable = true; }
     ./lb.nix
     ./mpv.nix
     ./mime.nix
     ./neovim.nix
-    ./nix.nix
     ./newsboat.nix
     ./flameshot.nix
     ./packages.nix
     ./virtualization.nix
-    ./picom.nix
     ./stardict.nix
     ./polkit.nix
     ./printing.nix
     ./redshift.nix
-    ./retiolum.nix
     ./rofi.nix
-    ./spacetime.nix
     ./ssh.nix
-    ./sshd.nix
     ./sound.nix
     ./sudo.nix
     ./tmux.nix
     ./unclutter.nix
     ./vscode.nix
-    ./watson.nix
     ./wallpaper.nix
     ./zsh.nix
+    ./applicative.nix
     {
       home-manager.users.me.home.file.".zshrc".text = ''
         # nothing to see here
       '';
     }
-    ./tor.nix
-    ./mastodon-bot.nix
-    {
-      fileSystems."${remoteDir}/fritz" = {
-        device = "//192.168.178.1/FRITZ.NAS/Backup";
-        fsType = "cifs";
-        options = [
-          "username=ftpuser"
-          "password=ftppassword"
-          "noauto"
-          "nounix"
-          "rw"
-          # "noserverino" # ref https://askubuntu.com/a/1265165
-          "uid=${toString config.users.users.me.uid}"
-          "gid=${toString config.users.groups.users.gid}"
-          "x-systemd.automount"
-          "x-systemd.device-timeout=1"
-          "x-systemd.idle-timeout=1min"
-        ];
-      };
-    }
     {
       home-manager.users.me = {
-        xdg.userDirs = rec {
+        xdg.userDirs =
+          let
+            pictures = "${config.users.users.me.home}/cloud/nextcloud/Bilder";
+          in
+          {
             enable = true;
             documents = "${config.users.users.me.home}/cloud/nextcloud/Documents";
             desktop = "/tmp";
             download = "${config.users.users.me.home}/sync/Downloads";
             music = "${config.users.users.me.home}/mobile/audio";
-          pictures = "${config.users.users.me.home}/cloud/nextcloud/Bilder";
             publicShare = "${config.users.users.me.home}/cloud/nextcloud/tmp";
             videos = pictures;
+            pictures = pictures;
           };
       };
     }

configs/direnv.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
+let
   nixify = pkgs.writers.writeDashBin "nixify" ''
     set -efuC
 
@@ -16,8 +17,12 @@
       ''${EDITOR:-vim} shell.nix
     fi
   '';
-in {
-  environment.systemPackages = [pkgs.direnv nixify];
+in
+{
+  environment.systemPackages = [
+    pkgs.direnv
+    nixify
+  ];
 
   home-manager.users.me.programs.direnv = {
     enable = true;

configs/distrobump.nix

@@ -1,15 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
-  imports = [
-    (import <stockholm/makefu/3modules/bump-distrowatch.nix> {
-      inherit lib config;
-      pkgs = pkgs // {writeDash = pkgs.writers.writeDash;};
-    })
-  ];
-
-  makefu.distrobump.enable = false;
-}

configs/docker.nix

@@ -1,16 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}: {
-  virtualisation.docker = {
-    enable = true;
-    # for ICE wifi, ref https://gist.github.com/sunsided/7840e89ff4e11b64a2d7503fafa0290c
-    extraOptions = lib.concatStringsSep " " [
-      "--bip=172.39.1.5/24"
-      "--fixed-cidr=172.39.1.0/25"
-    ];
-  };
-  users.users.me.extraGroups = ["docker"];
-  environment.systemPackages = [pkgs.docker pkgs.docker-compose];
-}

configs/dunst.nix

@@ -1,65 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  inherit (import ../lib) defaultApplications theme;
-  sgr = code: string: ''\u001b[${code}m${string}\u001b[0m'';
-in {
-  environment.systemPackages = [
-    (pkgs.writers.writeDashBin "notifications" ''
-      ${pkgs.dunst}/bin/dunstctl history \
-        | ${pkgs.jq}/bin/jq -r '
-          .data[]
-          | map("${sgr "90" ''\(.appname.data)''} ${sgr "1" ''\(.summary.data)''} ${sgr "31" ''\(.body.data | gsub("\n"; " | "))''}")
-          | join("\n")'
-    '')
-  ];
-
-  home-manager.users.me.services.dunst = {
-    enable = true;
-    iconTheme = (theme pkgs).icon;
-    settings = {
-      global = {
-        transparency = 10;
-        geometry = "200x5-30+20";
-        follow = "mouse";
-        indicate_hidden = true;
-        notification_height = 0;
-        separator_height = 2;
-        padding = 8;
-        horizontal_padding = 8;
-        sort = true;
-        markup = "full";
-        format = "%a\\n<b>%s</b>\\n%b";
-        alignment = "left";
-        show_age_threshold = 60;
-        bounce_freq = 0;
-        word_wrap = true;
-        ellipsize = "middle";
-        ignore_newline = false;
-        stack_duplicates = true;
-        hide_duplicate_count = false;
-        max_icon_size = 32;
-        sticky_history = true;
-        history_length = 20;
-        dmenu = "${pkgs.rofi}/bin/rofi -display-run dunst -show run";
-        browser = (defaultApplications pkgs).browser;
-        verbosity = "mesg";
-        corner_radius = 0;
-        mouse_left_click = "do_action";
-        mouse_right_click = "close_current";
-        mouse_middle_click = "close_all";
-      };
-      urgency_low = {
-        timeout = 5;
-      };
-      urgency_normal = {
-        timeout = 10;
-      };
-      urgency_critical = {
-        timeout = 0;
-      };
-    };
-  };
-}

configs/flameshot.nix

@@ -2,7 +2,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   home-manager.users.me = {
     services.flameshot = {
       enable = true;

configs/fonts.nix

@@ -1,9 +1,11 @@
 {
   pkgs,
-  niveumPackages,
   ...
-}: let
-  zip-font = name: arguments: let
+}:
+let
+  zip-font =
+    name: arguments:
+    let
       directory = pkgs.fetchzip arguments;
     in
     pkgs.runCommand name { } ''
@@ -12,7 +14,9 @@
       ${pkgs.findutils}/bin/find ${directory} -name '*.otf' -exec install '{}' $out/share/fonts/opentype \;
       ${pkgs.findutils}/bin/find ${directory} -name '*.woff' -exec install '{}' $out/share/fonts/woff \;
     '';
-  simple-ttf = name: arguments: let
+  simple-ttf =
+    name: arguments:
+    let
       file = pkgs.fetchurl arguments;
     in
     pkgs.runCommand name { } ''
@@ -58,7 +62,8 @@
     url = "https://github.com/microsoft/font-tools/raw/1092cb23520967830001a0807eb21d6a44dda522/EgyptianOpenType/font/eot.ttf";
     sha256 = "1n294vhcx90270pnsw1dbk6izd61fjvbnjrh4hcf98ff3s540x0c";
   };
-in {
+in
+{
   fonts = {
     enableDefaultPackages = true;
     fontDir.enable = true;
@@ -93,7 +98,6 @@ in {
       font-awesome
       galatia-sil
       gentium
-      # niveumPackages.gfs-fonts
       gyre-fonts
       ibm-plex
       jetbrains-mono
@@ -114,16 +118,32 @@ in {
       source-sans-pro
       source-serif-pro
       theano
-      niveumPackages.tocharian-font
+      tocharian-font
       vista-fonts
       vollkorn
       zilla-slab
     ]; # google-fonts league-of-moveable-type
-    fontconfig.defaultFonts = rec {
-      monospace = ["Noto Sans Mono"] ++ emoji;
-      serif = ["Noto Serif" "Noto Naskh Arabic" "Noto Serif Devanagari"];
-      sansSerif = ["Noto Sans Display" "Noto Naskh Arabic" "Noto Sans Hebrew" "Noto Sans Devanagari" "Noto Sans CJK JP" "Noto Sans Coptic" "Noto Sans Syriac Western"];
+    fontconfig.defaultFonts =
+      let
         emoji = [ "Noto Color Emoji" ];
+      in
+      {
+        monospace = [ "Noto Sans Mono" ] ++ emoji;
+        serif = [
+          "Noto Serif"
+          "Noto Naskh Arabic"
+          "Noto Serif Devanagari"
+        ];
+        sansSerif = [
+          "Noto Sans Display"
+          "Noto Naskh Arabic"
+          "Noto Sans Hebrew"
+          "Noto Sans Devanagari"
+          "Noto Sans CJK JP"
+          "Noto Sans Coptic"
+          "Noto Sans Syriac Western"
+        ];
+        inherit emoji;
       };
     # xelatex fails with woff files
     # ref https://tex.stackexchange.com/questions/392144/xelatex-and-fontspec-crash-trying-to-find-woff-file-for-some-fonts-but-not-other

configs/fysi.nix

@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit (import ../lib/email.nix) defaults;
-  sshIdentity = name: "${config.users.users.me.home}/.ssh/${name}";
-in {
-  age.secrets = {
-    email-password-fysi = {
-      file = ../secrets/email-password-fysi.age;
-      owner = config.users.users.me.name;
-      group = config.users.users.me.group;
-      mode = "400";
-    };
-  };
-
-  home-manager.users.me = {
-    accounts.email.accounts = {
-      fysi =
-        lib.recursiveUpdate defaults
-        rec {
-          address = "kieran@fysi.tech";
-          userName = address;
-          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fysi.path}";
-          flavor = "fastmail.com";
-        };
-    };
-
-    programs.ssh.matchBlocks = rec {
-      "nextcloud.fysi.dev" = {
-        hostname = "116.203.82.203";
-        user = "root";
-      };
-      "lingua.miaengiadina.ch" = {
-        hostname = "135.181.85.233";
-        user = "root";
-      };
-      "cms-dev.woc2023.app".identityFile = sshIdentity "fysiweb";
-      "cms-master.woc2023.app".identityFile = sshIdentity "fysiweb";
-      "fysi-dev1" = {
-        hostname = "94.130.229.139";
-        user = "root";
-        identityFile = sshIdentity "fysiweb";
-      };
-      ${fysi-dev1.hostname} = fysi-dev1;
-      "fysi-shared0" = {
-        hostname = "49.12.205.235";
-        user = "root";
-        identityFile = sshIdentity "fysiweb";
-      };
-    };
-  };
-}

configs/fzf.nix

@@ -1,13 +1,18 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.fzf = {
     fuzzyCompletion = true;
     keybindings = true;
   };
 
   home-manager.users.me = {
-    programs.fzf = rec {
-      enable = true;
+    programs.fzf =
+      let
         defaultCommand = "${pkgs.fd}/bin/fd --type f --strip-cwd-prefix --follow --no-ignore-vcs --exclude .git";
+      in
+      {
+        enable = true;
+        defaultCommand = defaultCommand;
         defaultOptions = [ "--height=40%" ];
         changeDirWidgetCommand = "${pkgs.fd}/bin/fd --type d";
         changeDirWidgetOptions = [

configs/gaming.nix

@@ -4,6 +4,16 @@
     pkgs.zeroad
     pkgs.mari0
     pkgs.luanti # fka minetest
+    # pkgs.openarena
+    # pkgs.teeworlds
+    pkgs.nethack
+    # pkgs.freeciv
+    # pkgs.lincity-ng
+    # pkgs.superTuxKart
+
+    pkgs.morris
+    pkgs.gnome-chess
+    pkgs.gnuchess
   ];
   networking.firewall = {
     # for 0ad multiplayer

configs/git.nix

@@ -1,10 +1,9 @@
 {
   pkgs,
-  inputs,
+  lib,
   ...
-}: let
-  inherit (import ../lib) kieran ignorePaths;
-in {
+}:
+{
   environment.systemPackages = [
     pkgs.mr
     pkgs.gitFull
@@ -37,13 +36,14 @@ in {
         st = "status -s";
         unstage = "reset HEAD --";
         diffs = "diff --staged";
+        pushf = "push --force-with-lease";
         last = "log -1 HEAD";
         logs = "log --pretty=oneline";
         graph = "log --graph --abbrev-commit --decorate --date=relative --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
       };
-      ignores = ignorePaths;
-      settings.user.name = kieran.name;
-      settings.user.email = kieran.email;
+      ignores = pkgs.lib.niveum.ignorePaths;
+      settings.user.name = pkgs.lib.niveum.kieran.name;
+      settings.user.email = pkgs.lib.niveum.kieran.email;
       settings.pull.ff = "only";
       settings.rebase.autoStash = true;
       settings.merge.autoStash = true;

configs/graphical/default.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  stylixColors = config.lib.stylix.colors;
+in
+{
+  programs.hyprland = {
+    enable = true;
+    withUWSM = true;
+    xwayland.enable = true;
+    package = pkgs.hyprland;
+    portalPackage = pkgs.xdg-desktop-portal-hyprland;
+  };
+
+  programs.ydotool.enable = true;
+
+  xdg.portal = {
+    enable = true;
+    extraPortals = [
+      pkgs.xdg-desktop-portal-hyprland
+      pkgs.xdg-desktop-portal-gtk
+    ];
+    config.common.default = "*";
+  };
+
+  services.dbus = {
+    implementation = "broker";
+    # needed for GNOME services outside of GNOME (?)
+    packages = [ pkgs.gcr ];
+  };
+
+  environment.systemPackages = [
+    pkgs.xdg-desktop-portal
+    pkgs.xdg-desktop-portal-hyprland
+  ];
+
+  programs.regreet =
+    let
+      wallpaper =
+        pkgs.runCommand "textured-monochrome-wallpaper.png"
+          {
+            buildInputs = [ pkgs.imagemagick ];
+          }
+          ''
+            magick -size 2560x1440 plasma:fractal \
+              -colorspace Gray \
+              -normalize \
+              -fill ${lib.escapeShellArg config.lib.stylix.colors.withHashtag.base00} -colorize 100% \
+              -attenuate 0.15 +noise Gaussian \
+              $out
+          '';
+    in
+    {
+      enable = true;
+      settings = {
+        background = {
+          path = wallpaper;
+          fit = "Fill";
+        };
+        appearance.greeting_msg = "स्वागतम्";
+        widget.clock.format = "%F %H:%M";
+      };
+      font = {
+        inherit (config.stylix.fonts.sansSerif) name;
+        size = config.stylix.fonts.sizes.applications;
+      };
+      iconTheme = {
+        inherit (config.home-manager.users.me.gtk.iconTheme) package name;
+      };
+    };
+
+  home-manager.users.me = import ./home-manager.nix {
+    inherit lib pkgs config;
+  };
+}

configs/graphical/home-manager.nix

@@ -0,0 +1,390 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  klem = pkgs.klem.override {
+    options.dmenu = "${pkgs.dmenu}/bin/dmenu -i -p klem";
+    options.scripts = {
+      "p.r paste" = pkgs.writers.writeDash "p.r" ''
+        ${pkgs.curl}/bin/curl -fSs http://p.r --data-binary @- \
+          | ${pkgs.coreutils}/bin/tail --lines=1 \
+          | ${pkgs.gnused}/bin/sed 's/\\<r\\>/krebsco.de/'
+      '';
+      "envs.sh paste" = pkgs.writers.writeDash "envs-host" ''
+        ${pkgs.curl}/bin/curl -F "file=@-" https://envs.sh
+      '';
+      # this segfaults
+      # "envs.sh mirror" = pkgs.writers.writeDash "envs-mirror" ''
+      #   ${pkgs.curl}/bin/curl -F "url=$(${pkgs.coreutils}/bin/cat)" https://envs.sh
+      # '';
+      "envs.sh shorten" = pkgs.writers.writeDash "envs-shorten" ''
+        ${pkgs.curl}/bin/curl -F "shorten=$(${pkgs.coreutils}/bin/cat)" https://envs.sh
+      '';
+      "go.r shorten" = pkgs.writers.writeDash "go.r" ''
+        ${pkgs.curl}/bin/curl -fSs http://go.r -F "uri=$(${pkgs.coreutils}/bin/cat)"
+      '';
+      "4d2.org paste" = pkgs.writers.writeDash "4d2-paste" ''
+        ${pkgs.curl}/bin/curl -F "file=@-" https://depot.4d2.org/
+      '';
+      "0x0.st shorten" = pkgs.writers.writeDash "0x0.st" ''
+        ${pkgs.curl}/bin/curl -fSs https://0x0.st -F "shorten=$(${pkgs.coreutils}/bin/cat)"
+      '';
+      "rot13" = pkgs.writers.writeDash "rot13" ''
+        ${pkgs.coreutils}/bin/tr '[A-Za-z]' '[N-ZA-Mn-za-m]'
+      '';
+      "ipa" = pkgs.writers.writeDash "ipa" ''
+        ${pkgs.ipa}/bin/ipa
+      '';
+      "betacode" = pkgs.writers.writeDash "betacode" ''
+        ${pkgs.betacode}/bin/betacode
+      '';
+      "curl" = pkgs.writers.writeDash "curl" ''
+        ${pkgs.curl}/bin/curl -fSs "$(${pkgs.coreutils}/bin/cat)"
+      '';
+      ocr = pkgs.writers.writeDash "ocr" ''
+        ${pkgs.tesseract4}/bin/tesseract -l eng+deu - stdout
+      '';
+      emojai = pkgs.writers.writeDash "emojai" ''
+        ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
+      '';
+    };
+  };
+in
+{
+  services.mako.enable = true;
+
+  services.hyprsunset.enable = true;
+
+  programs.ashell = {
+    enable = true;
+    settings = {
+      # position = "bottom";
+      modules = {
+        left = [
+          "Workspaces"
+          [
+            "WindowTitle"
+          ]
+          [
+            "MediaPlayer"
+          ]
+        ];
+        center = [ "Clock" ];
+        right = [
+          "KeyboardLayout"
+          [
+            "Tray"
+            "SystemInfo"
+            "Settings"
+          ]
+        ];
+      };
+      workspaces = {
+        workspace_names =
+          let
+            arabic = [
+              "١"
+              "٢"
+              "٣"
+              "٤"
+              "٥"
+              "٦"
+              "٧"
+              "٨"
+              "٩"
+              "١٠"
+            ];
+            hindi = [
+              "१"
+              "२"
+              "३"
+              "४"
+              "५"
+              "६"
+              "७"
+              "८"
+              "९"
+              "१०"
+            ];
+            hebrew = [
+              "א"
+              "ב"
+              "ג"
+              "ד"
+              "ה"
+              "ו"
+              "ז"
+              "ח"
+              "ט"
+              "י"
+            ];
+          in
+          hindi;
+        visibility_mode = "MonitorSpecific";
+        enable_workspace_filling = false;
+        disable_special_workspaces = true;
+      };
+      keyboard_layout.labels = {
+        "de" = "🇩🇪";
+      };
+      window_title = {
+        mode = "Title";
+        truncate_title_after_length = 75;
+      };
+      media_player = {
+        max_title_length = 40;
+      };
+      system_info.indicators = [
+        "Cpu"
+        "Memory"
+        { Disk = "/"; }
+      ];
+      clock.format = "%Y-%m-%d (%W %a) %H:%M";
+      settings.indicators = [
+        "IdleInhibitor"
+        "PowerProfile"
+        "Audio"
+        "Bluetooth"
+        "Network"
+        "Vpn"
+        "Battery"
+      ];
+      appearance = {
+        font_name = config.stylix.fonts.sansSerif.name;
+        backdrop = 0.3;
+        scale_factor = 0.85;
+        # style = "Solid";
+      };
+    };
+  };
+
+  services.hyprpaper = {
+    enable = true;
+    settings = {
+      ipc = "on";
+      splash = false;
+      preload = [ "${config.users.users.me.home}/.cache/wallpaper/wallpaper" ];
+    };
+  };
+
+  services.hypridle = {
+    enable = true;
+    settings = {
+      general = {
+        after_sleep_cmd = "hyprctl dispatch dpms on";
+        ignore_dbus_inhibit = false;
+        lock_cmd = "hyprlock";
+      };
+      listener = [
+        {
+          timeout = 900;
+          on-timeout = "hyprlock";
+        }
+        {
+          timeout = 1200;
+          on-timeout = "hyprctl dispatch dpms off";
+          on-resume = "hyprctl dispatch dpms on";
+        }
+      ];
+    };
+  };
+
+  programs.hyprlock = {
+    enable = true;
+    settings = {
+      animations.enabled = false;
+      general = {
+        hide_cursor = true;
+        ignore_empty_input = true;
+      };
+    };
+  };
+
+  gtk = {
+    enable = true;
+    iconTheme = {
+      name = "Adwaita";
+      package = pkgs.adwaita-icon-theme;
+    };
+  };
+
+  wayland.windowManager.hyprland =
+    let
+      mod = "SUPER";
+    in
+    {
+      enable = true;
+      systemd.enable = false;
+      systemd.variables = [ "--all" ];
+      settings = {
+        env = [
+          "XCURSOR_SIZE,${toString config.stylix.cursor.size}" # TODO
+          "HYPRCURSOR_SIZE,${toString config.stylix.cursor.size}" # TODO
+          "HYPRCURSOR_THEME,${config.stylix.cursor.name}"
+          "QT_QPA_PLATFORM=wayland"
+          "GDK_BACKEND=wayland"
+          "NIXOS_OZONE_WL=1"
+          "HYPRSHOT_DIR=${config.home-manager.users.me.xdg.userDirs.download}/screenshots"
+        ];
+        permission = [
+          "${lib.getExe pkgs.hyprshot}, screencopy, allow"
+          "${pkgs.xdg-desktop-portal-hyprland}/libexec/.xdg-desktop-portal-hyprland-wrapped, screencopy, allow"
+        ];
+        monitor = [
+          ",preferred,auto,1" # TODO https://wiki.hypr.land/Configuring/Monitors/
+          "desc:Samsung Electric Company C27F390 HTQH602129, 1920x1080, 0x-1080, 1"
+        ];
+        exec-once = [
+          (lib.getExe pkgs.ashell)
+          "hyprctl dispatch exec \"[workspace special:उपलविशेषः silent] obsidian\""
+          "${lib.getExe' pkgs.wl-clipboard "wl-paste"} -t text --watch ${lib.getExe pkgs.clipman} store"
+          # (lib.getExe pkgs.hyprsunset)
+          # (lib.getExe pkgs.hyprpaper)
+        ];
+
+        device = [
+          {
+            name = "elan-touchscreen";
+            enabled = false;
+          }
+        ];
+
+        general = {
+          gaps_in = 2;
+          gaps_out = 2;
+          border_size = 1;
+          resize_on_border = true;
+          allow_tearing = false;
+          layout = "dwindle";
+        };
+
+        decoration = {
+          rounding = 2;
+          rounding_power = 2;
+          active_opacity = 1.0;
+          inactive_opacity = 1.0;
+          shadow = {
+            enabled = false;
+            range = 4;
+            render_power = 3;
+          };
+          blur = {
+            enabled = false;
+            size = 3;
+            passes = 1;
+            vibrancy = 0.17;
+          };
+        };
+
+        animations = {
+          enabled = false;
+        };
+
+        dwindle = {
+          pseudotile = true;
+          preserve_split = true;
+        };
+
+        master.new_status = "master";
+
+        gesture = [
+          "3, horizontal, workspace"
+        ];
+
+        input = {
+          kb_layout = "de";
+          kb_variant = "T3";
+          kb_options = "compose:caps,grp:ctrls_toggle";
+          follow_mouse = 1;
+          sensitivity = 0;
+          touchpad.natural_scroll = false;
+        };
+
+        bindm = [
+          "${mod}, mouse:272, movewindow"
+          "${mod}, mouse:273, resizewindow"
+        ];
+        bindel = [
+          ",XF86AudioRaiseVolume, exec, wpctl set-volume -l 1 @DEFAULT_AUDIO_SINK@ 5%+"
+          ",XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
+          ",XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
+          ",XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"
+          ",XF86MonBrightnessUp, exec, brightnessctl -e4 -n2 set 5%+"
+          ",XF86MonBrightnessDown, exec, brightnessctl -e4 -n2 set 5%-"
+          ", Print, exec, ${lib.getExe pkgs.hyprshot} -m region --clipboard-only"
+          "${mod}, Print, exec, ${lib.getExe pkgs.hyprshot} -m region"
+        ];
+        bindl = [
+          ", XF86AudioNext, exec, playerctl next"
+          ", XF86AudioPause, exec, playerctl play-pause"
+          ", XF86AudioPlay, exec, playerctl play-pause"
+          ", XF86AudioPrev, exec, playerctl previous"
+        ];
+        bind = [
+          "${mod}, Return, exec, ${lib.getExe pkgs.niveum-terminal}"
+          "${mod} SHIFT, Q, killactive,"
+          "${mod} SHIFT, R, exit,"
+          "${mod}, t, exec, ${lib.getExe pkgs.niveum-filemanager}"
+          "${mod}, Y, exec, ${lib.getExe pkgs.niveum-browser}"
+          "${mod}, Q, exec, ${lib.getExe pkgs.clipman} pick --tool=rofi"
+          "${mod}, u, exec, ${lib.getExe pkgs.unicodmenu}"
+          "${mod}, p, exec, ${lib.getExe pkgs.rofi-pass-wayland}"
+          "${mod} Shift, Z, togglefloating,"
+          "${mod}, D, exec, ${lib.getExe pkgs.rofi} -show run"
+          "${mod}, v, togglesplit," # dwindle
+          "${mod} SHIFT, V, pseudo," # dwindle
+          "${mod}, F, fullscreen"
+          "${mod}, h, movefocus, l"
+          "${mod}, l, movefocus, r"
+          "${mod}, k, movefocus, u"
+          "${mod}, j, movefocus, d"
+          "${mod}, F9, exec, hyprctl hyprsunset temperature -1000"
+          "${mod}, F10, exec, hyprctl hyprsunset temperature +1000" # reset color temperature
+
+          "${mod}, F12, exec, ${klem}/bin/klem"
+          "${mod} SHIFT, W, exec, hyprlock"
+          "${mod} SHIFT, H, movewindow, l"
+          "${mod} SHIFT, L, movewindow, r"
+          "${mod} SHIFT, K, movewindow, u"
+          "${mod} SHIFT, J, movewindow, d"
+          "${mod}, S, togglespecialworkspace, magic"
+          "${mod} SHIFT, S, movetoworkspace, special:magic"
+          "${mod}, O, togglespecialworkspace, उपलविशेषः"
+          "${mod} SHIFT, O, movetoworkspace, special:उपलविशेषः"
+        ]
+        ++ lib.concatMap (
+          i:
+          let
+            key = lib.mod i 10;
+          in
+          [
+            "${mod}, ${toString key}, workspace, ${toString i}"
+            "${mod} SHIFT, ${toString key}, movetoworkspace, ${toString i}"
+          ]
+        ) (lib.range 1 10);
+
+        windowrule = [
+          "suppressevent maximize, class:.*" # ignore maximize requests from apps
+          "nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0" # fix some dragging issues with wayyland
+
+          "float,title:^(Picture-in-Picture)$"
+          "pin,title:^(Picture-in-Picture)$"
+          "size 640 360,title:^(Picture-in-Picture)$"
+          "move 100%-640 100%-360,title:^(Picture-in-Picture)$"
+        ];
+      };
+      extraConfig = ''
+        bind = ${mod}, R, submap, resize
+        submap = resize
+        binde = , l, resizeactive, 50 0
+        binde = , h, resizeactive, -50 0
+        binde = , k, resizeactive, 0 -50
+        binde = , j, resizeactive, 0 50
+        bind = , escape, submap, reset
+        submap = reset
+      '';
+    };
+}

configs/hledger.nix

@@ -1,13 +1,17 @@
 {
   pkgs,
   ...
-}: let
+}:
+let
   ledgerDirectory = "/home/kfm/sync/src/ledger";
   hora = pkgs.callPackage ../packages/hora.nix { timeLedger = "${ledgerDirectory}/time.timeclock"; };
-in {
-  environment.systemPackages = let
+in
+{
+  environment.systemPackages =
+    let
       git = "${pkgs.git}/bin/git -C ${ledgerDirectory}";
-  in [
+    in
+    [
       hora
       pkgs.hledger
       (pkgs.writers.writeDashBin "hledger-git" ''

configs/htop.nix

@@ -22,8 +22,18 @@
         sort_key = "PERCENT_CPU";
         tree_view = false;
         update_process_names = false;
-        right_meters = ["Uptime" "Tasks" "LoadAverage" "Battery"];
-        left_meters = ["LeftCPUs2" "RightCPUs2" "Memory" "Swap"];
+        right_meters = [
+          "Uptime"
+          "Tasks"
+          "LoadAverage"
+          "Battery"
+        ];
+        left_meters = [
+          "LeftCPUs2"
+          "RightCPUs2"
+          "Memory"
+          "Swap"
+        ];
       };
     };
   };

configs/i3.nix

@@ -2,18 +2,12 @@
   config,
   pkgs,
   lib,
-  niveumPackages,
   ...
-}: let
-  dashboard = pkgs.writers.writeDashBin "dashboard" ''
-    ${pkgs.alacritty}/bin/alacritty --option font.size=4 --class dashboard --command ${pkgs.writers.writeDash "dashboard-inner" ''
-      exec ${pkgs.procps}/bin/watch -c -n 10 ${niveumPackages.q}/bin/q
-    ''}
-  '';
-  inherit (import ../lib) defaultApplications;
-  klem = niveumPackages.klem.override {
-    config.dmenu = "${pkgs.dmenu}/bin/dmenu -i -p klem";
-    config.scripts = {
+}:
+let
+  klem = pkgs.klem.override {
+    options.dmenu = "${pkgs.dmenu}/bin/dmenu -i -p klem";
+    options.scripts = {
       "p.r paste" = pkgs.writers.writeDash "p.r" ''
         ${pkgs.curl}/bin/curl -fSs http://p.r --data-binary @- \
           | ${pkgs.coreutils}/bin/tail --lines=1 \
@@ -42,10 +36,10 @@
         ${pkgs.coreutils}/bin/tr '[A-Za-z]' '[N-ZA-Mn-za-m]'
       '';
       "ipa" = pkgs.writers.writeDash "ipa" ''
-        ${niveumPackages.ipa}/bin/ipa
+        ${pkgs.ipa}/bin/ipa
       '';
       "betacode" = pkgs.writers.writeDash "betacode" ''
-        ${niveumPackages.betacode}/bin/betacode
+        ${pkgs.betacode}/bin/betacode
       '';
       "curl" = pkgs.writers.writeDash "curl" ''
         ${pkgs.curl}/bin/curl -fSs "$(${pkgs.coreutils}/bin/cat)"
@@ -56,15 +50,10 @@
       emojai = pkgs.writers.writeDash "emojai" ''
         ${pkgs.curl}/bin/curl https://www.emojai.app/api/generate -X POST -H 'Content-Type: application/json' --data-raw "$(${pkgs.jq}/bin/jq -sR '{emoji:.}')" | ${pkgs.jq}/bin/jq -r .result
       '';
-      "gpt-3.5" = pkgs.writers.writeDash "gpt" ''
-        ${niveumPackages.gpt35}/bin/gpt
-      '';
-      gpt-4 = pkgs.writers.writeDash "gpt" ''
-        ${niveumPackages.gpt4}/bin/gpt
-      '';
     };
   };
-in {
+in
+{
   age.secrets = {
     github-token-i3status-rust = {
       file = ../secrets/github-token-i3status-rust.age;
@@ -86,9 +75,14 @@ in {
     };
   };
 
-  programs.slock.enable = true;
-
-  environment.systemPackages = [dashboard];
+  environment.systemPackages = [
+    pkgs.xsecurelock
+  ];
+  environment.sessionVariables = {
+    XSECURELOCK_NO_COMPOSITE = "1";
+    XSECURELOCK_BACKGROUND_COLOR = "navy";
+    XSECURELOCK_PASSWORD_PROMPT = "time_hex";
+  };
 
   services.displayManager.defaultSession = "none+i3";
   services.xserver = {
@@ -113,8 +107,8 @@ in {
     '';
   };
 
-
-  home-manager.users.me = let
+  home-manager.users.me =
+    let
       modifier = "Mod4";
       infoWorkspace = "ℹ";
       messageWorkspace = "✉";
@@ -131,19 +125,27 @@ in {
         titlebar = false;
         border = 1;
       };
-    bars = [
-      (config.home-manager.users.me.stylix.targets.i3.exportedBarConfig
-        // rec {
+      bars =
+        let
+          position = "bottom";
+        in
+        [
+          (lib.recursiveUpdate config.home-manager.users.me.stylix.targets.i3.exportedBarConfig {
             workspaceButtons = true;
             mode = "hide"; # "dock";
-          position = "bottom";
-          statusCommand = toString (pkgs.writers.writeDash "i3status-rust" ''
+            inherit position;
+            statusCommand = toString (
+              pkgs.writers.writeDash "i3status-rust" ''
                 export I3RS_GITHUB_TOKEN="$(cat ${config.age.secrets.github-token-i3status-rust.path})"
                 export OPENWEATHERMAP_API_KEY="$(cat ${config.age.secrets.openweathermap-api-key.path})"
                 exec ${config.home-manager.users.me.programs.i3status-rust.package}/bin/i3status-rs ${config.home-manager.users.me.home.homeDirectory}/.config/i3status-rust/config-${position}.toml
-          '');
+              ''
+            );
             fonts = {
-            names = ["${config.stylix.fonts.sansSerif.name}" "FontAwesome 6 Free"];
+              names = [
+                "${config.stylix.fonts.sansSerif.name}"
+                "FontAwesome 6 Free"
+              ];
               size = config.stylix.fonts.sizes.desktop * 0.8;
             };
           })
@@ -154,19 +156,27 @@ in {
         hideEdgeBorders = "smart";
         commands = [
           {
-          criteria = {class = "floating";};
+            criteria = {
+              class = "floating";
+            };
             command = "floating enable";
           }
           {
-          criteria = {class = "fzfmenu";};
+            criteria = {
+              class = "fzfmenu";
+            };
             command = "floating enable";
           }
           {
-          criteria = {class = ".*";};
+            criteria = {
+              class = ".*";
+            };
             command = "border pixel 2";
           }
           {
-          criteria = {class = "mpv";};
+            criteria = {
+              class = "mpv";
+            };
             command = lib.strings.concatStringsSep ", " [
               "floating enable"
               "sticky enable"
@@ -177,17 +187,25 @@ in {
           }
         ];
       };
-    colors = let
+      colors =
+        let
           background = config.lib.stylix.colors.withHashtag.base00;
-    in {
+        in
+        {
           unfocused = {
             border = lib.mkForce background;
             childBorder = lib.mkForce background;
           };
         };
       keybindings =
-      lib.listToAttrs (map (x: lib.nameValuePair "${modifier}+Shift+${toString x}" "move container to workspace ${toString x}") (lib.range 1 9))
-      // lib.listToAttrs (map (x: lib.nameValuePair "${modifier}+${toString x}" "workspace ${toString x}") (lib.range 1 9))
+        lib.listToAttrs (
+          map (
+            x: lib.nameValuePair "${modifier}+Shift+${toString x}" "move container to workspace ${toString x}"
+          ) (lib.range 1 9)
+        )
+        // lib.listToAttrs (
+          map (x: lib.nameValuePair "${modifier}+${toString x}" "workspace ${toString x}") (lib.range 1 9)
+        )
         // {
           "${modifier}+i" = "workspace ${infoWorkspace}";
           "${modifier}+m" = "workspace ${messageWorkspace}";
@@ -225,16 +243,18 @@ in {
           "${modifier}+w" = "layout tabbed";
           "${modifier}+q" = "exec ${config.services.clipmenu.package}/bin/clipmenu";
 
-        "${modifier}+Return" = "exec ${(defaultApplications pkgs).terminal}";
-        "${modifier}+t" = "exec ${(defaultApplications pkgs).fileManager}";
-        "${modifier}+y" = "exec ${(defaultApplications pkgs).browser}";
+          "${modifier}+Return" = "exec ${lib.getExe pkgs.niveum-terminal}";
+          "${modifier}+t" = "exec ${lib.getExe pkgs.niveum-filemanager}";
+          "${modifier}+y" = "exec ${lib.getExe pkgs.niveum-browser}";
 
-        "${modifier}+d" = "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
-        "${modifier}+Shift+d" = "exec ${niveumPackages.notemenu}/bin/notemenu";
+          "${modifier}+d" =
+            "exec ${pkgs.writers.writeDash "run" ''exec rofi -modi run,ssh,window -show run''}";
+          "${modifier}+Shift+d" = "exec ${lib.getExe pkgs.notemenu}";
           "${modifier}+p" = "exec rofi-pass";
           "${modifier}+Shift+p" = "exec rofi-pass --insert";
-        "${modifier}+u" = "exec ${niveumPackages.unicodmenu}/bin/unicodmenu";
-        "${modifier}+Shift+u" = "exec ${pkgs.writers.writeDash "last-unicode" ''${pkgs.xdotool}/bin/xdotool type --delay 1000 "$(${pkgs.gawk}/bin/awk 'END{print $1}' ~/.cache/unicodmenu)"''}";
+          "${modifier}+u" = "exec ${lib.getExe pkgs.unicodmenu}";
+          "${modifier}+Shift+u" =
+            "exec ${pkgs.writers.writeDash "last-unicode" ''${pkgs.xdotool}/bin/xdotool type --delay 1000 "$(${pkgs.gawk}/bin/awk 'END{print $1}' ~/.cache/unicodmenu)"''}";
 
           "${modifier}+F7" = "exec ${pkgs.writers.writeDash "showkeys-toggle" ''
             if ${pkgs.procps}/bin/pgrep screenkey; then
@@ -244,16 +264,15 @@ in {
             fi
           ''}";
           "${modifier}+F12" = "exec ${klem}/bin/klem";
-        "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
-        "XF86AudioMute" = "exec ${pkgs.pamixer}/bin/pamixer -t";
+          "XF86AudioLowerVolume" = "exec ${lib.getExe pkgs.pamixer} -d 5";
+          "XF86AudioMute" = "exec ${lib.getExe pkgs.pamixer} -t";
           "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
-        "XF86Calculator" = "exec ${pkgs.st}/bin/st -c floating -e ${pkgs.bc}/bin/bc";
-        "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
-        "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86AudioStop" = "exec ${pkgs.playerctl}/bin/playerctl stop";
-        "XF86ScreenSaver" = "exec ${niveumPackages.k-lock}/bin/k-lock";
+          "XF86Calculator" = "exec ${lib.getExe pkgs.st} -c floating -e ${pkgs.bc}/bin/bc";
+          "XF86AudioPause" = "exec ${lib.getExe pkgs.playerctl} play-pause";
+          "XF86AudioPlay" = "exec ${lib.getExe pkgs.playerctl} play-pause";
+          "XF86AudioNext" = "exec ${lib.getExe pkgs.playerctl} next";
+          "XF86AudioPrev" = "exec ${lib.getExe pkgs.playerctl} previous";
+          "XF86AudioStop" = "exec ${lib.getExe pkgs.playerctl} stop";
 
           # key names detected with xorg.xev:
           # XF86WakeUp (fn twice)
@@ -269,36 +288,41 @@ in {
           # XF86Back
           # XF86Launch1 (thinkvantage)
         };
-  in {
+    in
+    {
       stylix.targets.i3.enable = true;
 
       xsession.windowManager.i3 = {
         enable = true;
         extraConfig = ''
-        bindsym --release ${modifier}+Shift+w exec /run/wrappers/bin/slock
+          bindsym --release ${modifier}+Shift+w exec xsecurelock
 
-        exec "${pkgs.obsidian}/bin/obsidian"
+          exec "${lib.getExe pkgs.obsidian}"
           for_window [class="obsidian"] , move scratchpad
 
           assign [class="message"] ${messageWorkspace}
-        exec "${pkgs.writers.writeDash "irc" "exec ${pkgs.alacritty}/bin/alacritty --class message -e ssh weechat@makanek -t tmux attach-session -t IM"}"
-        exec "${pkgs.writers.writeDash "email" "exec ${pkgs.alacritty}/bin/alacritty --class message -e aerc"}"
+          exec "${pkgs.writers.writeDash "irc" "exec ${lib.getExe pkgs.alacritty} --class message -e ssh weechat@makanek -t tmux attach-session -t IM"}"
+          exec "${pkgs.writers.writeDash "email" "exec ${lib.getExe pkgs.alacritty} --class message -e aerc"}"
 
-        assign [class="dashboard"] ${infoWorkspace}
-        exec ${dashboard}/bin/dashboard
+          exec --no-startup-id ${pkgs.xss-lock}/bin/xss-lock -- xsecurelock
         '';
         config = {
-          inherit modifier gaps modes bars floating window colors;
+          inherit
+            modifier
+            gaps
+            modes
+            bars
+            floating
+            window
+            colors
+            ;
           keybindings = keybindings // {
-            "${modifier}+ß" = "exec ${niveumPackages.menu-calc}/bin/=";
-            "${modifier}+F6" = "exec ${pkgs.xorg.xkill}/bin/xkill";
             "${modifier}+F9" = "exec ${pkgs.redshift}/bin/redshift -O 4000 -b 0.85";
             "${modifier}+F10" = "exec ${pkgs.redshift}/bin/redshift -x";
-            "${modifier}+F11" = "exec ${pkgs.xcalib}/bin/xcalib -invert -alter";
             "Print" = "exec flameshot gui";
             # "${modifier}+Shift+x" = "exec ${move-to-new-workspace}";
             # "${modifier}+x" = "exec ${new-workspace}";
-            "XF86Display" = "exec ${niveumPackages.dmenu-randr}/bin/dmenu-randr";
+            "XF86Display" = "exec ${lib.getExe pkgs.dmenu-randr}";
           };
         };
       };

configs/i3status-rust.nix

@@ -2,7 +2,8 @@
   pkgs,
   config,
   ...
-}: {
+}:
+{
   age.secrets = {
     miniflux-api-token = {
       file = ../secrets/miniflux-api-token.age;
@@ -18,9 +19,11 @@
       bars.bottom = {
         icons = "awesome6";
         settings = {
-          theme.overrides = let
+          theme.overrides =
+            let
               colours = config.lib.stylix.colors.withHashtag;
-          in {
+            in
+            {
               idle_bg = colours.base00;
               idle_fg = colours.base05;
               good_bg = colours.base00;

configs/keyboard/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   lib,
   ...
@@ -27,10 +28,10 @@ let
     arabic = {
       code = "ara";
       variant = "buckwalter";
-    }; # ../lib/keyboards/arabic;
-    coptic = ../lib/keyboards/coptic;
-    avestan = ../lib/keyboards/avestan;
-    gothic = ../lib/keyboards/gothic;
+    };
+    coptic = ./coptic;
+    avestan = ./avestan;
+    gothic = ./gothic;
     farsi = {
       code = "ir";
       variant = "qwerty";
@@ -63,39 +64,41 @@ in
 
   # man 7 xkeyboard-config
   services.xserver = {
-    exportConfiguration = true; # link /usr/share/X11 properly
+    exportConfiguration = lib.mkForce true; # link /usr/share/X11 properly
     xkb.layout = defaultLanguage.code;
     # T3: https://upload.wikimedia.org/wikipedia/commons/a/a9/German-Keyboard-Layout-T3-Version1-large.png
     # buckwalter: http://www.qamus.org/transliteration.htm
     xkb.variant = defaultLanguage.variant;
     xkb.options = commaSep xkbOptions;
-    xkb.dir = pkgs.symlinkJoin {
-      name = "x-keyboard-directory";
-      paths = [
-        "${pkgs.xkeyboard_config}/etc/X11/xkb"
-        (pkgs.linkFarm "custom-x-keyboards" (
-          lib.mapAttrsToList (name: value: {
-            name = "symbols/${name}";
-            path = value;
-          }) (lib.filterAttrs (_: value: !(value ? "code")) languages)
-          ++ [
-            {
-              name = "symbols/ir";
-              path = ../lib/keyboards/farsi;
-            }
-          ]
-        ))
-      ];
+    xkb.extraLayouts = {
+      coptic = {
+        languages = [ "cop" ];
+        description = "Coptic is the latest stage of the Egyptian language and was used by Egyptian Christians. The Coptic script is based on the Greek alphabet with some letters borrowed from Demotic Egyptian.";
+        symbolsFile = ./coptic;
+      };
+      avestan = {
+        languages = [ "ave" ];
+        description = "Avestan is an ancient Iranian language known primarily from its use in the sacred texts of Zoroastrianism, the Avesta. It is an Indo-Iranian language that was spoken in ancient Persia.";
+        symbolsFile = ./avestan;
+      };
+      gothic = {
+        languages = [ "got" ];
+        description = "Gothic is an extinct East Germanic language that was spoken by the Goths. It is known primarily from the Codex Argenteus, a 6th-century manuscript containing a translation of the Bible into Gothic.";
+        symbolsFile = ./gothic;
+      };
+      farsi = {
+        languages = [ "fas" ];
+        description = "Farsi, also known as Persian, is an Indo-Iranian language spoken primarily in Iran, Afghanistan (where it is known as Dari), and Tajikistan (where it is called Tajik). It has a rich literary tradition and is written in a modified Arabic script.";
+        symbolsFile = ./farsi;
+      };
     };
   };
 
   environment.etc."x11-locale".source = toString pkgs.xorg.libX11 + "share/X11/locale";
 
   home-manager.users.me = {
-    home.file =
-      lib.mapAttrs' (name: path: lib.nameValuePair ".xkb/symbols/${name}" { source = path; })
-        (lib.filterAttrs (_: value: !(value ? "code")) languages) // {
-          ".xkb/symbols/ir".source = ../lib/keyboards/farsi;
+    home.file = {
+      ".XCompose".source = ./XCompose;
     };
   };
 
@@ -108,17 +111,21 @@ in
       variant = if settings ? "variant" then settings.variant else "";
     in
     pkgs.writers.writeDashBin "kb-${language}" ''
-      if [ -z $SWAYSOCK ]; then
-        ${pkgs.xorg.setxkbmap}/bin/setxkbmap ${defaultLanguage.code},${code} ${defaultLanguage.variant},${variant} ${
-          toString (map (option: "-option ${option}") xkbOptions)
-        }
-      else
+      if [ -n "$SWAYSOCK" ]; then
         swaymsg -s $SWAYSOCK 'input * xkb_layout "${defaultLanguage.code},${code}"'
         swaymsg -s $SWAYSOCK 'input * xkb_variant "${defaultLanguage.variant},${variant}"'
         swaymsg -s $SWAYSOCK 'input * xkb_options "${lib.concatStringsSep "," xkbOptions}"'
+      elif [ -n "$HYPRLAND_INSTANCE_SIGNATURE" ]; then
+        hyprctl keyword input:kb_variant "" # otherwise we end up with an invalid combination for a short while
+        hyprctl keyword input:kb_layout "${defaultLanguage.code},${code}"
+        hyprctl keyword input:kb_variant "${defaultLanguage.variant},${variant}"
+      elif [ -n "$DISPLAY" ]; then
+        ${pkgs.xorg.setxkbmap}/bin/setxkbmap ${defaultLanguage.code},${code} ${defaultLanguage.variant},${variant} ${
+          toString (map (option: "-option ${option}") xkbOptions)
+        }
       fi
     ''
-  ) languages;
+  ) (languages // config.services.xserver.xkb.extraLayouts);
 
   # improve held key rate
   services.xserver.displayManager.sessionCommands = "${pkgs.xorg.xset}/bin/xset r rate 300 50";

configs/khal.nix

@@ -3,19 +3,16 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   davHome = "~/.local/share/dav";
   kmeinCloud = {
     davEndpoint = "https://cloud.kmein.de/remote.php/dav";
     username = "kieran";
     passwordFile = config.age.secrets.nextcloud-password-kieran.path;
   };
-  fysiCloud = {
-    davEndpoint = "https://nextcloud.fysi.dev/remote.php/dav";
-    username = "kmein";
-    passwordFile = config.age.secrets.nextcloud-password-fysi.path;
-  };
-in {
+in
+{
   age.secrets = {
     nextcloud-password-kieran = {
       file = ../secrets/nextcloud-password-kieran.age;
@@ -23,12 +20,6 @@ in {
       group = config.users.users.me.group;
       mode = "400";
     };
-    nextcloud-password-fysi = {
-      file = ../secrets/nextcloud-password-fysi.age;
-      owner = config.users.users.me.name;
-      group = config.users.users.me.group;
-      mode = "400";
-    };
   };
 
   environment.systemPackages = [

configs/lb.nix

@@ -2,7 +2,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   systemd.services.lb-subscription = {
     enable = true;
     wants = [ "network-online.target" ];

configs/mastodon-bot.nix

@@ -1,19 +0,0 @@
-{pkgs, ...}: {
-  systemd.services.imaginary-illuminations = {
-    enable = false;
-    wants = ["network-online.target"];
-    serviceConfig = {
-      User = "kfm";
-      Group = "users";
-      WorkingDirectory = "/home/kfm/cloud/Seafile/Documents/Media/imaginary-illuminations";
-      Restart = "on-failure";
-      RestartSec = "15s";
-    };
-    startAt = "7:00";
-    script = ''
-      ${pkgs.deno}/bin/deno run -A post.ts
-    '';
-  };
-
-  systemd.timers.imaginary-illuminations.timerConfig.RandomizedDelaySec = "14h";
-}

configs/monitoring.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   services.nginx.virtualHosts.default = {
     locations."= /stub_status".extraConfig = "stub_status;";
   };
@@ -55,9 +56,7 @@
             clients = [
               {
                 url = "http://${
-                  if config.networking.hostName == "makanek"
-                  then "127.0.0.1"
-                  else "makanek.r"
+                  if config.networking.hostName == "makanek" then "127.0.0.1" else "makanek.r"
                 }:3100/loki/api/v1/push";
               }
             ];

configs/mpv.nix

@@ -2,11 +2,12 @@
   pkgs,
   lib,
   config,
-  niveumPackages,
   ...
-}: let
-  swallow = command: "${niveumPackages.swallow}/bin/swallow ${command}";
-in {
+}:
+let
+  swallow = command: "${pkgs.swallow}/bin/swallow ${command}";
+in
+{
   environment.shellAliases.smpv = swallow "mpv";
 
   nixpkgs.overlays = [
@@ -20,7 +21,11 @@ in {
       enable = true;
       config = {
         ytdl-format = "bestvideo[height<=?720][fps<=?30][vcodec!=?vp9]+bestaudio/best";
-        ytdl-raw-options = lib.concatStringsSep "," [''sub-lang="de,en"'' "write-sub=" "write-auto-sub="];
+        ytdl-raw-options = lib.concatStringsSep "," [
+          ''sub-lang="de,en"''
+          "write-sub="
+          "write-auto-sub="
+        ];
         screenshot-template = "%F-%wH%wM%wS-%#04n";
         script-opts = "ytdl_hook-ytdl_path=${pkgs.yt-dlp}/bin/yt-dlp";
         ao = "pulse"; # no pipewire for me :(
@@ -36,8 +41,8 @@ in {
         "Alt+j" = "add video-pan-y -0.05";
       };
       scripts = [
-        pkgs.mpvScripts.quality-menu
-        pkgs.mpvScripts.visualizer
+        # pkgs.mpvScripts.quality-menu
+        # pkgs.mpvScripts.visualizer
       ];
     };
   };

configs/mycelium.nix

@@ -1,7 +1,4 @@
-{ lib, ... }:
-let
-  myceliumAddresses = import ../lib/mycelium-network.nix;
-in
+{ lib, pkgs, ... }:
 {
   services.mycelium = {
     enable = true;
@@ -11,5 +8,5 @@ in
   networking.hosts = lib.mapAttrs' (name: address: {
     name = address;
     value = [ "${name}.m" ];
-  }) myceliumAddresses;
+  }) pkgs.lib.niveum.myceliumAddresses;
 }

configs/neovim.nix

@@ -1,10 +1,19 @@
 {
   pkgs,
-  niveumPackages,
+  lib,
   config,
   ...
-}: {
-  environment.variables.EDITOR = pkgs.lib.mkForce "nvim";
+}:
+let
+  vim-kmein = (
+    pkgs.vim-kmein.override {
+      # stylixColors = config.lib.stylix.colors;
+      colorscheme = "base16-gruvbox-dark-medium";
+    }
+  );
+in
+{
+  environment.variables.EDITOR = lib.getExe vim-kmein;
   environment.shellAliases.vi = "nvim";
   environment.shellAliases.vim = "nvim";
   environment.shellAliases.view = "nvim -R";
@@ -35,11 +44,8 @@
   };
 
   environment.systemPackages = [
-    (pkgs.writers.writeDashBin "vim" ''neovim "$@"'')
-    (niveumPackages.vim.override {
-      # stylixColors = config.lib.stylix.colors;
-      colorscheme = "base16-gruvbox-dark-medium";
-    })
+    pkgs.vim-typewriter
+    vim-kmein
 
     # language servers
     pkgs.pyright

configs/networkmanager.nix

@@ -1,7 +1,8 @@
 {
   pkgs,
   ...
-}: {
+}:
+{
   programs.nm-applet.enable = true;
 
   networking.networkmanager = {

configs/newsboat.nix

@@ -2,7 +2,8 @@
   pkgs,
   config,
   ...
-}: {
+}:
+{
   environment.systemPackages = [
     (pkgs.writers.writeDashBin "miniflux-watch-later" ''
       miniflux_api_token=$(cat ${config.age.secrets.miniflux-api-token.path})

configs/nix.nix

@@ -1,14 +1,13 @@
 {
   pkgs,
-  inputs,
   ...
-}: {
+}:
+{
   nixpkgs = {
     config.allowUnfree = true;
   };
   nix = {
     package = pkgs.nixVersions.stable;
-    extraOptions = "experimental-features = nix-command flakes";
-    nixPath = ["nixpkgs=${inputs.nixpkgs}"];
+    settings.experimental-features = [ "nix-command" "flakes" ];
   };
 }

configs/openweathermap.nix

@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   openweathermap-repo = pkgs.fetchFromGitHub {
     owner = "ip1981";
     repo = "openweathermap";
@@ -11,7 +12,8 @@
   };
   openweathermap = pkgs.haskellPackages.callCabal2nix "openweathermap" openweathermap-repo { };
   openweathermap-key = lib.strings.fileContents <secrets/openweathermap.key>;
-in {
+in
+{
   nixpkgs.config.packageOverrides = pkgs: {
     weather = pkgs.writers.writeDashBin "weather" ''
       ${openweathermap}/bin/openweathermap --api-key ${openweathermap-key} "$@"

configs/packages.nix

@@ -1,19 +1,17 @@
 {
   config,
   pkgs,
-  lib,
-  inputs,
-  niveumPackages,
   ...
-}: let
+}:
+let
   worldradio = pkgs.callPackage ../packages/worldradio.nix { };
 
-  externalNetwork = import ../lib/external-network.nix;
-
-  zoteroStyle = {
+  zoteroStyle =
+    {
       name,
       sha256,
-  }: {
+    }:
+    {
       name = "${name}.csl";
       path = pkgs.fetchurl {
         url = "https://www.zotero.org/styles/${name}";
@@ -35,7 +33,8 @@
     })
   ];
 
-  astrolog = pkgs.astrolog.overrideAttrs (old:
+  astrolog = pkgs.astrolog.overrideAttrs (
+    old:
     old
     // {
       installPhase = ''
@@ -54,8 +53,10 @@
           /^:I /s/80/120/ # wider text output
         ' $out/astrolog/astrolog.as
       '';
-    });
-in {
+    }
+  );
+in
+{
   home-manager.users.me.home.file = {
     ".csl".source = cslDirectory;
     ".local/share/pandoc/csl".source = cslDirectory; # as of pandoc 2.11, it includes citeproc
@@ -87,7 +88,7 @@ in {
     bat # better cat
     dos2unix
     genpass # generate passwords
-    (pkgs.writers.writeDashBin "genpassphrase" ''${pkgs.genpass}/bin/genpass --passphrase | ${pkgs.gnused}/bin/sed 's/ /-/g;s/\(^\|-\)\([a-z]\)/\1\U\2/g;s/$/-'$(${pkgs.coreutils}/bin/date +%Y)'/' '')
+    (pkgs.writers.writeDashBin "genpassphrase" ''${pkgs.genpass}/bin/genpass "$@" --passphrase | ${pkgs.gnused}/bin/sed 's/ /-/g;s/\(^\|-\)\([a-z]\)/\1\U\2/g;s/$/-'$(${pkgs.coreutils}/bin/date +%Y)'/' '')
     gcc
     python3Packages.jsonschema # json validation
     pup # html toolkit
@@ -101,15 +102,14 @@ in {
     arandr # xrandr for noobs
     wdisplays
     libnotify # for notify-send
-    xclip # clipboard CLI
+    wl-clipboard # clipboard CLI
     dragon-drop # drag and drop
-    xorg.xkill # kill by clicking
     portfolio # personal finance overview
     audacity
     calibre
     electrum
     inkscape
-    niveumPackages.gimp
+    gimp
     gthumb
     astrolog
     obsidian
@@ -120,7 +120,7 @@ in {
     zoom-us # video conferencing
     (pkgs.writers.writeDashBin "im" ''
       weechat_password=$(${pkgs.pass}/bin/pass weechat)
-      exec ${weechat}/bin/weechat -t -r '/mouse enable; /remote add makanek http://${externalNetwork.makanek}:8002 -password='"$weechat_password"'; /remote connect makanek'
+      exec ${weechat}/bin/weechat -t -r '/mouse enable; /remote add makanek http://${pkgs.lib.niveum.machines.makanek.externalIp}:8002 -password='"$weechat_password"'; /remote connect makanek'
     '')
     alejandra # nix formatter
     pdfgrep # search in pdf
@@ -130,80 +130,78 @@ in {
     kdePackages.okular # the word is nucular
     xournalpp # for annotating pdfs
     pdfpc # presenter console for pdf slides
-    niveumPackages.hc # print files as qr codes
+    hc # print files as qr codes
     yt-dlp
     espeak
     rink # unit converter
-    niveumPackages.auc
-    niveumPackages.noise-waves
-    niveumPackages.stag
-    niveumPackages.cheat-sh
-    niveumPackages.polyglot
-    niveumPackages.qrpaste
-    niveumPackages.ttspaste
-    niveumPackages.new-mac # get a new mac address
-    niveumPackages.scanned
-    niveumPackages.default-gateway
-    niveumPackages.kirciuoklis
-    niveumPackages.image-convert-favicon
-    niveumPackages.heuretes
-    niveumPackages.ipa # XSAMPA to IPA converter
-    niveumPackages.pls
-    niveumPackages.mpv-tv
-    niveumPackages.mpv-iptv
-    niveumPackages.devanagari
-    niveumPackages.betacode # ancient greek betacode to unicode converter
-    pkgs.jq-lsp
-    niveumPackages.swallow # window swallowing
-    niveumPackages.literature-quote
-    niveumPackages.booksplit
-    niveumPackages.dmenu-randr
-    niveumPackages.manual-sort
-    niveumPackages.wttr
-    niveumPackages.unicodmenu
-    niveumPackages.emailmenu
-    niveumPackages.closest
-    niveumPackages.trans
-    (niveumPackages.mpv-radio.override {
+    auc
+    noise-waves
+    stag
+    cheat-sh
+    polyglot
+    qrpaste
+    ttspaste
+    new-mac # get a new mac address
+    scanned
+    default-gateway
+    kirciuoklis
+    image-convert-favicon
+    heuretes
+    ipa # XSAMPA to IPA converter
+    pls
+    mpv-tv
+    mpv-iptv
+    devanagari
+    betacode # ancient greek betacode to unicode converter
+    jq-lsp
+    swallow # window swallowing
+    literature-quote
+    booksplit
+    dmenu-randr
+    manual-sort
+    wttr
+    unicodmenu
+    emailmenu
+    closest
+    trans
+    (mpv-radio.override {
       di-fm-key-file = config.age.secrets.di-fm-key.path;
     })
-    (niveumPackages.mpv-radio.override {
+    (mpv-radio.override {
       di-fm-key-file = config.age.secrets.di-fm-key.path;
       executableName = "cro-radio";
-      mpvCommand = "${niveumPackages.cro}/bin/cro";
+      mpvCommand = "${cro}/bin/cro";
     })
-    (niveumPackages.mpv-tuner.override {
+    (mpv-tuner.override {
       di-fm-key-file = config.age.secrets.di-fm-key.path;
     })
     # kmein.slide
     termdown
-    niveumPackages.image-convert-tolino
-    niveumPackages.rfc
-    niveumPackages.tag
-    niveumPackages.timer
-    niveumPackages.menu-calc
+    image-convert-tolino
+    rfc
+    tag
+    timer
     nix-prefetch-git
-    niveumPackages.nix-git
+    nix-git
     nixfmt-rfc-style
+    comma
     par
     qrencode
 
-    # inputs.menstruation-backend.defaultPackage.x86_64-linux
-    inputs.agenix.packages.x86_64-linux.default
-    inputs.recht.defaultPackage.x86_64-linux
+    pkgs.agenix
+    pkgs.alarm
 
     (pkgs.writers.writeDashBin "worldradio" ''
       shuf ${worldradio} | ${pkgs.findutils}/bin/xargs ${pkgs.mpv}/bin/mpv --no-video
     '')
 
     (pkgs.writers.writeDashBin "chats" ''
-      ${pkgs.openssh}/bin/ssh makanek "cd /var/lib/weechat/logs && grep --ignore-case --color=always --recursive $@" | ${pkgs.less}/bin/less --raw-control-chars
+      ${pkgs.openssh}/bin/ssh -p ${toString pkgs.lib.niveum.machines.makanek.sshPort} ${pkgs.lib.niveum.machines.makanek.externalIp} "cd /var/lib/weechat/logs && grep --ignore-case --color=always --recursive $@" | ${pkgs.less}/bin/less --raw-control-chars
     '')
 
-    inputs.scripts.packages.x86_64-linux.alarm
+    niveum-ssh
 
     spotify
-    ncspot
     playerctl
 
     #krebs
@@ -217,6 +215,7 @@ in {
 
     (python3.withPackages (py: [
       py.black
+      py.ruff
       # py.python-language-server
       # py.pyls-mypy
       # py.pyls-black
@@ -237,17 +236,21 @@ in {
     go
     texlive.combined.scheme-full
     latexrun
-    (aspellWithDicts (dict: [dict.de dict.en dict.en-computers]))
+    (aspellWithDicts (dict: [
+      dict.de
+      dict.en
+      dict.en-computers
+    ]))
     # haskellPackages.pandoc-citeproc
-    niveumPackages.text2pdf
+    text2pdf
     lowdown
     glow # markdown to term
-    libreoffice
+    libreoffice-qt6-fresh
     # gnumeric
     dia
     pandoc
     librsvg # pandoc depends on this to include SVG in documents
-    # niveumPackages.man-pandoc
+    # man-pandoc
     typst
     # proselint
     asciidoctor

configs/picom.nix

@@ -1,25 +0,0 @@
-{
-  services.picom = {
-    enable = true;
-    # activeOpacity = 1;
-    fade = true;
-    fadeDelta = 1;
-    # inactiveOpacity = 0.9;
-    # shadow = true;
-    # menuOpacity = 0.9;
-    # shadowOpacity = 0.3;
-    fadeExclude = [
-      "class_g = 'slock'" # don't want a transparent lock screen!
-      "name *?= 'slock'"
-      "focused = 1"
-    ];
-    opacityRules = [
-      # opacity-rule overrides both inactive and active opacity
-
-      # video in browser tabs
-      # substring /regex match of title bar text
-      "99:name *?= 'Youtube'"
-      "99:WM_CLASS@:s *= 'mpv$'"
-    ];
-  };
-}

configs/polkit.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   user = config.users.users.me.name;
-in {
+in
+{
   security.polkit.extraConfig = ''
     polkit.addRule(function(action, subject) {
       if (subject.user == "${user}" && action.id == "org.freedesktop.systemd1.manage-units") {

configs/power-action.nix

@@ -2,9 +2,11 @@
   pkgs,
   config,
   ...
-}: let
+}:
+let
   suspend = pkgs.writers.writeDash "suspend" "${pkgs.systemd}/bin/systemctl suspend";
-in {
+in
+{
   services.power-action = {
     enable = true;
     plans.suspend = {

configs/printing.nix

@@ -1,7 +1,8 @@
-{pkgs, ...}: let
-  inherit (import ../lib) localAddresses;
+{ pkgs, lib, ... }:
+let
   hp-driver = pkgs.hplip;
-in {
+in
+{
   services.printing = {
     enable = true;
     drivers = [ hp-driver ];
@@ -18,7 +19,7 @@ in {
     {
       name = "OfficeJet";
       location = "Zimmer";
-      deviceUri = "https://${localAddresses.officejet}";
+      deviceUri = "https://${pkgs.lib.niveum.localAddresses.officejet}";
       model = "drv:///hp/hpcups.drv/hp-officejet_4650_series.ppd";
       ppdOptions = {
         Duplex = "DuplexNoTumble"; # DuplexNoTumble DuplexTumble None
@@ -34,4 +35,3 @@ in {
   HP/hp-officejet_4650_series.ppd.gz
   drv:///hp/hpcups.drv/hp-officejet_4650_series.ppd
 */
-

configs/redshift.nix

@@ -1 +1 @@
-{services.redshift.enable = false;}
+{ services.redshift.enable = true; }

configs/retiolum.nix

@@ -2,8 +2,11 @@
   config,
   pkgs,
   ...
-}: {
-  networking.hosts = {"42:0:ca48:f98f:63d7:31ce:922b:245d" = ["go"];};
+}:
+{
+  networking.hosts = {
+    "42:0:ca48:f98f:63d7:31ce:922b:245d" = [ "go" ];
+  };
 
   services.tinc.networks.retiolum = {
     rsaPrivateKeyFile = config.age.secrets.retiolum-rsa.path;

configs/rofi.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   home-manager.users.me.programs.rofi = {
     enable = true;
     pass = {

configs/sound.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.pipewire = {
     enable = true;
     alsa = {

configs/ssh.nix

@@ -1,8 +1,6 @@
-{pkgs, ...}: let
-  inherit (import ../lib) sshPort kieran;
-  externalNetwork = import ../lib/external-network.nix;
-in {
-  users.users.me.openssh.authorizedKeys.keys = kieran.sshKeys;
+{ pkgs, lib, ... }:
+{
+  users.users.me.openssh.authorizedKeys.keys = pkgs.lib.niveum.kieran.sshKeys;
   programs.ssh.startAgent = true;
   services.gnome.gcr-ssh-agent.enable = false;
 
@@ -12,33 +10,8 @@ in {
       eval $(${pkgs.gnome3.gnome-keyring}/bin/gnome-keyring-daemon --daemonize --components=ssh,secrets)
       export SSH_AUTH_SOCK
     '';
-    # services.gpg-agent = rec {
-    #   enable = false;
-    #   enableSshSupport = true;
-    #   defaultCacheTtlSsh = 2 * 60 * 60;
-    #   maxCacheTtlSsh = 4 * defaultCacheTtlSsh;
-    #   sshKeys = [
-    #     "568047C91DE03A23883E340F15A9C24D313E847C"
-    #     "BB3EE102DB8CD45540A78A6B18B511B67061F6B4" # kfm@manakish ed25519
-    #     "3F8986755818B5762A096BE212777EAAC441DD9D" # fysiweb rsa
-    #     "0E4ABD229432486CC432639BB0986B2CDE365105" # agenix ed25519
-    #     "A1E8D32CBFCDBD2DE798E2298D795CCFD785AE06" # kfm@kabsa ed25519
-    #   ];
-    # };
   };
 
-  # environment.extraInit = ''
-  # if [[ -z "$SSH_AUTH_SOCK" ]]; then
-  #   export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)"
-  # fi
-  # '';
-
-  # environment.interactiveShellInit = ''
-  # GPG_TTY="$(tty)"
-  # export GPG_TTY
-  # ${pkgs.gnupg}/bin/gpg-connect-agent updatestartuptty /bye > /dev/null
-  # '';
-
   home-manager.users.me.programs.ssh = {
     enable = true;
     enableDefaultConfig = false;
@@ -50,43 +23,44 @@ in {
       zaatar = {
         hostname = "zaatar.r";
         user = "root";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       makanek = {
-        hostname = externalNetwork.makanek;
+        hostname = pkgs.lib.niveum.externalNetwork.makanek;
         user = "root";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       ful = {
-        hostname = externalNetwork.ful;
+        hostname = pkgs.lib.niveum.externalNetwork.ful;
         user = "root";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       tahina = {
         hostname = "tahina.r";
         user = "root";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       tabula = {
         hostname = "tabula.r";
         user = "root";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       manakish = {
         hostname = "manakish.r";
         user = "kfm";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       kabsa = {
         hostname = "kabsa.r";
         user = "kfm";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
       fatteh = {
         hostname = "fatteh.r";
         user = "kfm";
-        port = sshPort;
+        port = pkgs.lib.niveum.sshPort;
       };
+      "*.onion".proxyCommand = "nc -xlocalhost:9050 %h %p";
     };
   };
 }

configs/sshd.nix

@@ -1,23 +1,21 @@
 {
   config,
-  lib,
   pkgs,
   ...
-}: let
-  inherit (import ../lib) sshPort kieran;
-in {
+}:
+{
   users.motd = "Welcome to ${config.networking.hostName}!";
 
   services.openssh = {
     enable = true;
-    ports = [sshPort];
+    ports = [ pkgs.lib.niveum.machines.${config.networking.hostName}.sshPort ];
     settings = {
       PasswordAuthentication = false;
       X11Forwarding = true;
     };
   };
 
-  users.users.root.openssh.authorizedKeys.keys = kieran.sshKeys ++ [
+  users.users.root.openssh.authorizedKeys.keys = pkgs.lib.niveum.kieran.sshKeys ++ [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoiRIn1dBUtpApcUyGbZKN+m5KBSgKIDQjdnQ8vU0xU kfm@kibbeh" # travel laptop
   ];
 }

configs/stardict.nix

@@ -1,9 +1,9 @@
 {
   pkgs,
   lib,
-  inputs,
   ...
-}: let
+}:
+let
   locker = x: "https://c.krebsco.de/${x}";
   dictionaries = {
     lojban = {
@@ -105,9 +105,11 @@
         sha256 = "0cx086zvb86bmz7i8vnsch4cj4fb0cp165g4hig4982zakj6f2jd";
       };
     };
-    sanskrit = let
+    sanskrit =
+      let
         repo = "https://github.com/indic-dict/stardict-sanskrit/raw/4ebd2d3db5820f7cbe3a649c3d5aa8f83d19b29f";
-    in {
+      in
+      {
         BoehtlingkRoth = pkgs.fetchzip {
           url = "${repo}/sa-head/german-entries/tars/Bohtlingk-and-Roth-Grosses-Petersburger-Worterbuch__2021-10-05_14-23-18Z__19MB.tar.gz";
           sha256 = "13414a8rgd7hd5ffar6nl68nk3ys60wjkgb7m11hp0ahaasmf6ly";
@@ -150,7 +152,6 @@
       };
     };
     coptic = {
-      dictionary = inputs.coptic-dictionary.packages.x86_64-linux.coptic-stardict;
       Crum = pkgs.fetchzip {
         url = locker "stardict-Coptic-English_all_dialects-2.4.2.tar.bz2";
         sha256 = "1fi281mb9yzv40wjsdapi8fzpa7x2yscz582lv2qnss9g8zzzzr9";
@@ -178,9 +179,11 @@
     };
   };
 
-  makeStardictDataDir = dicts: pkgs.linkFarm "dictionaries" (lib.mapAttrsToList (name: path: {inherit name path;}) dicts);
+  makeStardictDataDir =
+    dicts: pkgs.linkFarm "dictionaries" (lib.mapAttrsToList (name: path: { inherit name path; }) dicts);
 
-  makeStardict = name: dicts:
+  makeStardict =
+    name: dicts:
     pkgs.writers.writeDashBin name ''
       set -efu
       export SDCV_PAGER=${toString sdcvPager}
@@ -188,7 +191,13 @@
     '';
 
   sdcvPager = pkgs.writers.writeDash "sdcvPager" ''
-    export PATH=${lib.makeBinPath [pkgs.gnused pkgs.ncurses pkgs.less]}
+    export PATH=${
+      lib.makeBinPath [
+        pkgs.gnused
+        pkgs.ncurses
+        pkgs.less
+      ]
+    }
     sed "
       s!<sup>1</sup>!¹!gI
       s!<sup>2</sup>!²!gI
@@ -291,7 +300,8 @@
       s!</\?p[^>]*>!!gI
     " | less -FR
   '';
-in {
+in
+{
   # environment.etc.stardict.source = toString (makeStardictDataDir ({
   #     Crum = pkgs.fetchzip {
   #       url = "http://download.huzheng.org/misc/stardict-Coptic-English_all_dialects-2.4.2.tar.bz2";
@@ -385,4 +395,3 @@ MacDonell = pkgs.fetchzip {
     stripRoot = false;
   };
 */
-

configs/stylix.nix

@@ -2,21 +2,11 @@
   pkgs,
   config,
   lib,
-  inputs,
   ...
-}: let
-  generatedWallpaper = pkgs.runCommand "wallpaper.png" {} ''
-    ${inputs.wallpaper-generator.packages.x86_64-linux.wp-gen}/bin/wallpaper-generator lines \
-      --output $out \
-      ${lib.concatMapStringsSep " "
-      (n: "--base0${lib.toHexString n}=${config.lib.stylix.colors.withHashtag."base0${lib.toHexString n}"}")
-      (lib.range 0 15)}
-  '';
-in {
+}:
+{
   # https://danth.github.io/stylix/tricks.html
-  # stylix.image = inputs.wallpapers.outPath + "/meteora/rodrigo-soares-250630.jpg";
   stylix.enable = true;
-  stylix.image = generatedWallpaper;
 
   stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-dark-medium.yaml";
 
@@ -53,6 +43,7 @@ in {
   # dracula # https://draculatheme.com/
   # }.yaml";
 
+
   stylix.fonts = {
     serif = {
       package = pkgs.noto-fonts;
@@ -75,7 +66,7 @@ in {
     };
 
     sizes = {
-      terminal = 6;
+      terminal = 8;
       applications = 10;
     };
   };

configs/tlp.nix

@@ -2,16 +2,23 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.extraModulePackages = with config.boot.kernelPackages; [
     tp_smapi
     acpi_call
   ];
-  boot.kernelModules = ["tp_smapi" "acpi_call"];
-  environment.systemPackages = [pkgs.tpacpi-bat pkgs.powertop];
+  boot.kernelModules = [
+    "tp_smapi"
+    "acpi_call"
+  ];
+  environment.systemPackages = [
+    pkgs.tpacpi-bat
+    pkgs.powertop
+  ];
 
   services.tlp = {
-    enable = true;
+    enable = false;
     settings = {
       START_CHARGE_THRESH_BAT0 = 80;
       STOP_CHARGE_THRESH_BAT0 = 95;

configs/tmux.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = [
     pkgs.tmuxp
     pkgs.reptyr # move programs over to a tmux session

configs/tor.nix

@@ -1,5 +1,30 @@
-{pkgs, ...}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  sshPort = pkgs.lib.niveum.machines.${config.networking.hostName}.sshPort;
+in
+{
   services.tor.enable = true;
   services.tor.client.enable = true;
-  environment.systemPackages = [pkgs.tor pkgs.torsocks];
+  environment.systemPackages = [
+    pkgs.tor
+    pkgs.torsocks
+  ];
+
+  services.tor.relay.onionServices = {
+    "ssh" = {
+      version = 3;
+      map = [
+        {
+          port = sshPort;
+          target.port = sshPort;
+          target.addr = "127.0.0.1";
+        }
+      ];
+    };
+  };
 }

configs/uni.nix

@@ -3,22 +3,26 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   username = "meinhak99";
-  inherit (import ../lib/email.nix) defaults pronouns;
-  inherit (import ../lib) remoteDir;
-  fu-defaults = rec {
-    imap.host = "mail.zedat.fu-berlin.de";
+  fu-defaults =
+    let
+      mailhost = "mail.zedat.fu-berlin.de";
+    in
+    {
+      imap.host = mailhost;
       imap.port = 993;
       imap.tls.enable = true;
-    smtp.host = imap.host;
+      smtp.host = mailhost;
       smtp.port = 465;
       smtp.tls.enable = true;
       folders.drafts = "Entwürfe";
       folders.sent = "Gesendet";
       folders.trash = "Papierkorb";
     };
-in {
+in
+{
   home-manager.users.me = {
     programs.ssh = {
       matchBlocks = {
@@ -30,9 +34,7 @@ in {
       };
     };
     accounts.email.accounts = {
-      letos =
-        lib.recursiveUpdate defaults
-        {
+      letos = lib.recursiveUpdate pkgs.lib.niveum.email.defaults {
         userName = "slfletos";
         address = "letos.sprachlit@hu-berlin.de";
         passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-letos.path}";
@@ -42,19 +44,22 @@ in {
         smtp.port = 25;
         smtp.tls.useStartTls = true;
       };
-      fu =
-        lib.recursiveUpdate defaults
-        (lib.recursiveUpdate fu-defaults
-          rec {
+      fu = lib.recursiveUpdate pkgs.lib.niveum.email.defaults (
+        lib.recursiveUpdate fu-defaults (
+          let
             userName = "meinhak99";
+          in
+          {
+            userName = userName;
             address = "kieran.meinhardt@fu-berlin.de";
             aliases = [ "${userName}@fu-berlin.de" ];
             passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhak99.path}";
             himalaya = {
               enable = true;
-              settings.backend = "imap";
             };
-          });
+          }
+        )
+      );
     };
   };
 
@@ -84,7 +89,8 @@ in {
   system.fsPackages = [ pkgs.sshfs ];
 
   # https://www.zedat.fu-berlin.de/tip4u_157.pdf
-  fileSystems = let
+  fileSystems =
+    let
       fu-berlin-cifs-options = [
         "uid=${toString config.users.users.me.uid}"
         "gid=${toString config.users.groups.users.gid}"
@@ -100,7 +106,7 @@ in {
       firstCharacter = lib.strings.substring 0 1;
 
       home-directory-mount = user: {
-      "${remoteDir}/fu/${user}/home" = {
+        "${pkgs.lib.niveum.remoteDir}/fu/${user}/home" = {
           device = "${user}@login.zedat.fu-berlin.de:/home/${firstCharacter user}/${user}";
           fsType = "sshfs";
           options = [
@@ -113,30 +119,27 @@ in {
           ];
         };
       };
-  in home-directory-mount "meinhak99";
+    in
+    home-directory-mount "meinhak99";
 
   environment.systemPackages = [
     (pkgs.writers.writeDashBin "hu-vpn-split" ''
       ${pkgs.openfortivpn}/bin/openfortivpn \
         --password="$(cat "${config.age.secrets.email-password-letos.path}")" \
-        --config=${
-        pkgs.writeText "hu-berlin-split.config" ''
+        --config=${pkgs.writeText "hu-berlin-split.config" ''
           host = forti-ssl.vpn.hu-berlin.de
           port = 443
           username = slfletos@split_tunnel
-        ''
-      }
+        ''}
     '')
     (pkgs.writers.writeDashBin "hu-vpn-full" ''
       ${pkgs.openfortivpn}/bin/openfortivpn \
         --password="$(cat "${config.age.secrets.email-password-letos.path}")" \
-        --config=${
-        pkgs.writeText "hu-berlin-full.config" ''
+        --config=${pkgs.writeText "hu-berlin-full.config" ''
           host = forti-ssl.vpn.hu-berlin.de
           port = 443
           username = slfletos@tunnel_all
-        ''
-      }
+        ''}
     '')
     (pkgs.writers.writeDashBin "fu-vpn" ''
       if ${pkgs.wirelesstools}/bin/iwgetid | ${pkgs.gnugrep}/bin/grep --invert-match eduroam

configs/vscode.nix

@@ -1 +1,4 @@
-{pkgs, ...}: {environment.systemPackages = [pkgs.vscode];}
+{ pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.vscode ];
+}

configs/wallpaper.nix

@@ -2,26 +2,36 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   # url = "http://wallpaper.r/realwallpaper-krebs-stars-berlin.png";
   url = "http://wallpaper.r/realwallpaper-krebs.png";
   stateDir = "~/.cache/wallpaper";
-in {
+in
+{
   systemd.user.services.wallpaper = {
     wantedBy = [ "graphical-session.target" ];
     after = [ "network.target" ];
+    path = [
+      pkgs.curl
+      pkgs.hyprland
+    ];
     script = ''
       set -euf
 
       mkdir -p ${stateDir}
       chmod o+rx ${stateDir}
       cd ${stateDir}
-      (${pkgs.curl}/bin/curl -s -o wallpaper.tmp -z wallpaper.tmp ${lib.escapeShellArg url} && cp wallpaper.tmp wallpaper) || :
-      ${pkgs.feh}/bin/feh --no-fehbg --bg-scale wallpaper
+      (${pkgs.curl}/bin/curl -s -o wallpaper.tmp -z wallpaper.tmp ${lib.escapeShellArg url} && cp wallpaper.tmp wallpaper.png) || :
+      hyprctl hyprpaper preload ${stateDir}/wallpaper.png
+      hyprctl hyprpaper wallpaper ",${stateDir}/wallpaper.png"
+      sleep 5
+      hyprctl hyprpaper unload unused
+      true
     '';
     startAt = "*:00,10,20,30,40,50";
     serviceConfig = {
-      Restart = "always";
+      Restart = "on-failure";
       RestartSec = "15s";
       StartLimitBurst = 0;
     };

configs/watson.nix

@@ -1,9 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  environment.systemPackages = [pkgs.watson];
-
-  environment.variables.WATSON_DIR = "${config.users.users.me.home}/cloud/Seafile/Documents/watson";
-}

configs/zsh.nix

@@ -2,32 +2,32 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   promptColours.success = "cyan";
   promptColours.failure = "red";
-in {
-  environment.systemPackages = [pkgs.atuin];
-  environment.variables.ATUIN_CONFIG_DIR = toString (pkgs.writeTextDir "/config.toml" ''
-    auto_sync = true
-    update_check = false
-    sync_address = "http://zaatar.r:8888"
-    sync_frequency = 0
-    style = "compact"
-  '');
-
-  programs.zsh = let
+in
+{
+  programs.zsh =
+    let
       zsh-completions = pkgs.fetchFromGitHub {
         owner = "zsh-users";
         repo = "zsh-completions";
         rev = "cf565254e26bb7ce03f51889e9a29953b955b1fb";
         sha256 = "1yf4rz99acdsiy0y1v3bm65xvs2m0sl92ysz0rnnrlbd5amn283l";
       };
-  in {
+    in
+    {
       enable = true;
       enableCompletion = true;
       autosuggestions.enable = true;
       syntaxHighlighting.enable = true;
-    syntaxHighlighting.highlighters = ["main" "brackets" "pattern" "line"];
+      syntaxHighlighting.highlighters = [
+        "main"
+        "brackets"
+        "pattern"
+        "line"
+      ];
       interactiveShellInit = ''
         setopt INTERACTIVE_COMMENTS CORRECT
         setopt MULTIOS
@@ -67,13 +67,6 @@ in {
         zstyle ':vcs_info:*' formats "%c%u%F{cyan}%b%f"
         zstyle ':vcs_info:*' actionformats "(%a) %c%u%F{cyan}%b%f"
 
-      # atuin distributed shell history
-      export ATUIN_NOBIND="true" # disable all keybdinings of atuin
-      eval "$(atuin init zsh)"
-      bindkey '^r' _atuin_search_widget # bind ctrl+r to atuin
-      # use zsh only session history
-      fc -p
-
         precmd () {
           vcs_info
           if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ] || [ -n "$SSH_CONNECTION" ]; then

flake.nix

@@ -6,71 +6,118 @@
 
     agenix.url = "github:ryantm/agenix";
     autorenkalender.url = "github:kmein/autorenkalender";
-    coptic-dictionary.url = "github:kmein/coptic-dictionary";
     home-manager.url = "github:nix-community/home-manager/release-25.11";
     menstruation-backend.url = "github:kmein/menstruation.rs";
     menstruation-telegram.url = "github:kmein/menstruation-telegram";
     nix-index-database.url = "github:nix-community/nix-index-database";
-    nixinate.url = "github:matthewcroughan/nixinate";
     nixpkgs-old.url = "github:NixOS/nixpkgs/50fc86b75d2744e1ab3837ef74b53f103a9b55a0";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
     nur.url = "github:nix-community/NUR";
-    recht.url = "github:kmein/recht";
     retiolum.url = "github:krebs/retiolum";
     scripts.url = "github:kmein/scripts";
     stockholm.url = "github:krebs/stockholm";
     stylix.url = "github:danth/stylix/release-25.11";
     telebots.url = "github:kmein/telebots";
     tinc-graph.url = "github:kmein/tinc-graph";
+    treefmt-nix.url = "github:numtide/treefmt-nix";
     voidrice.url = "github:Lukesmithxyz/voidrice";
-    wallpaper-generator.url = "github:pinpox/wallpaper-generator/v1.1";
     wallpapers.url = "github:kmein/wallpapers";
+    nix-topology.url = "github:oddlama/nix-topology";
+
+    voidrice.flake = false;
+    wallpapers.flake = false;
+
+    naersk.url = "github:nix-community/naersk";
+    fenix.url = "github:nix-community/fenix";
+    naersk.inputs.fenix.follows = "fenix";
+    menstruation-backend.inputs.fenix.follows = "fenix";
+    tinc-graph.inputs.fenix.follows = "fenix";
+    scripts.inputs.fenix.follows = "fenix";
+    tinc-graph.inputs.naersk.follows = "naersk";
+    scripts.inputs.naersk.follows = "naersk";
+
+    menstruation-telegram.inputs.menstruation-backend.follows = "menstruation-backend";
+
+    menstruation-telegram.inputs.nixpkgs.follows = "nixpkgs-old";
+    telebots.inputs.nixpkgs.follows = "nixpkgs-old";
 
     agenix.inputs.home-manager.follows = "home-manager";
+
     agenix.inputs.nixpkgs.follows = "nixpkgs";
     autorenkalender.inputs.nixpkgs.follows = "nixpkgs";
-    coptic-dictionary.inputs.nixpkgs.follows = "nixpkgs";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    menstruation-telegram.inputs.menstruation-backend.follows = "menstruation-backend";
-    menstruation-telegram.inputs.nixpkgs.follows = "nixpkgs-old";
+    naersk.inputs.nixpkgs.follows = "nixpkgs";
+    fenix.inputs.nixpkgs.follows = "nixpkgs";
+    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
+    nur.inputs.nixpkgs.follows = "nixpkgs";
+    nix-topology.inputs.nixpkgs.follows = "nixpkgs";
+    stockholm.inputs.nixpkgs.follows = "nixpkgs";
+    menstruation-backend.inputs.nixpkgs.follows = "nixpkgs";
     nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-    recht.inputs.nixpkgs.follows = "nixpkgs";
     scripts.inputs.nixpkgs.follows = "nixpkgs";
     stylix.inputs.nixpkgs.follows = "nixpkgs";
     tinc-graph.inputs.nixpkgs.follows = "nixpkgs";
-    voidrice.flake = false;
-    wallpapers.flake = false;
   };
 
   outputs =
-    inputs@{
+    {
       self,
       nixpkgs,
-      nixpkgs-unstable,
       nur,
       home-manager,
       agenix,
       retiolum,
-      nixinate,
-      flake-utils,
+      menstruation-backend,
+      menstruation-telegram,
+      scripts,
+      tinc-graph,
+      nix-topology,
+      nixos-hardware,
+      treefmt-nix,
+      autorenkalender,
+      telebots,
+      stockholm,
       nix-index-database,
       stylix,
+      voidrice,
       ...
     }:
     let
       lib = nixpkgs.lib;
       eachSupportedSystem = lib.genAttrs lib.systems.flakeExposed;
+      treefmtEval = eachSupportedSystem (
+        system:
+        treefmt-nix.lib.evalModule nixpkgs.legacyPackages.${system} (
+          { pkgs, ... }:
+          {
+            projectRootFile = "flake.nix";
+            programs.nixfmt.enable = true;
+            programs.ormolu.enable = true;
+            programs.black.enable = true;
+            programs.prettier.enable = true;
+            programs.stylua.enable = true;
+          }
+        )
+      );
     in
     {
-      apps = {
-        x86_64-linux =
+
+      apps =
         let
-            pkgs = nixpkgs.legacyPackages.x86_64-linux;
+          localSystem = "x86_64-linux";
+        in
+        {
+          ${localSystem} =
+            let
+              pkgs = import nixpkgs {
+                system = localSystem;
+                overlays = [ self.overlays.default ];
+              };
               lib = nixpkgs.lib;
             in
-          nixinate.nixinate.x86_64-linux self
-          // {
+            lib.mergeAttrsList [
+              {
                 mock-secrets = {
                   type = "app";
                   program = toString (
@@ -80,50 +127,50 @@
                   );
                 };
               }
-          # the following error prevents remote building of ful: https://github.com/NixOS/nixpkgs/issues/177873
-          // builtins.listToAttrs (
+              (builtins.listToAttrs (
                 map (
                   hostname:
                   let
-                targets = {
-                  ful = "root@ful";
-                  zaatar = "root@zaatar";
-                  makanek = "root@makanek";
-                  manakish = "root@manakish";
-                  tahina = "root@tahina";
-                  tabula = "root@tabula";
-                  kabsa = "root@kabsa";
-                  fatteh = "root@fatteh";
-                  kibbeh = "root@kibbeh";
-                };
-              in
-              lib.attrsets.nameValuePair "deploy-${hostname}" {
-                type = "app";
-                program = toString (
-                  pkgs.writers.writeDash "deploy-${hostname}" ''
-                    exec ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \
+                    machines = import lib/machines.nix;
+                    deployScript = pkgs.writers.writeBash "deploy-${hostname}" ''
+                      reachable=$(${pkgs.try-connect.${hostname}}/bin/try-connect)
+
+                      if [ -z "$reachable" ]; then
+                        exit 1
+                      fi
+
+                      target="root@$reachable"
+                      echo "Deploying to ${hostname} via $target"
+
+                      # Set SSH options based on address type
+                      if [[ "$reachable" == *.onion ]]; then
+                        # why? ControlPath=none
+                        # SSH is trying to create a control socket with a path that includes
+                        # the full .onion hostname, and Unix domain sockets have a path length
+                        # limit (typically 108 characters). The .onion address is too long.
+                        export NIX_SSHOPTS="-p ${
+                          toString machines.${hostname}.sshPort
+                        } -o ProxyCommand='${pkgs.netcat}/bin/nc -x localhost:9050 %h %p' -o ControlPath=none"
+                      else
+                        export NIX_SSHOPTS="-p ${toString machines.${hostname}.sshPort}"
+                      fi
+
+                      ${pkgs.nixos-rebuild-ng}/bin/nixos-rebuild-ng switch \
                         --max-jobs 2 \
                         --log-format internal-json \
                         --flake .#${hostname} \
-                      --target-host ${targets.${hostname}} 2>&1 \
-                      | ${pkgs.nix-output-monitor}/bin/nom --json
-                  ''
-                );
+                        --target-host "$target" \
+                        ${lib.optionalString (localSystem != machines.${hostname}.system) "--build-host $target"} \
+                        |& ${pkgs.nix-output-monitor}/bin/nom --json
+                    '';
+                  in
+                  lib.attrsets.nameValuePair "deploy-${hostname}" {
+                    type = "app";
+                    program = toString deployScript;
                   }
                 ) (builtins.attrNames self.nixosConfigurations)
-          )
-          // {
-            deploy-ful = {
-              type = "app";
-              program = toString (
-                pkgs.writers.writeDash "deploy-ful" ''
-                  exec ${pkgs.nix}/bin/nix run .#nixinate.ful \
-                    --log-format internal-json 2>&1 \
-                    | ${pkgs.nix-output-monitor}/bin/nom --json
-                ''
-              );
-            };
-          };
+              ))
+            ];
         };
 
       # TODO overlay for packages
@@ -131,7 +178,6 @@
 
       nixosModules = {
         moodle-dl = import modules/moodle-dl.nix;
-        networkmanager-declarative = import modules/networkmanager-declarative.nix;
         passport = import modules/passport.nix;
         panoptikon = import modules/panoptikon.nix;
         power-action = import modules/power-action.nix;
@@ -140,263 +186,396 @@
         go-webring = import modules/go-webring.nix;
       };
 
-      lib = {
-        panoptikon = import lib/panoptikon.nix;
-      };
+      overlays.default = final: prev: {
+        niveum-terminal = prev.alacritty;
+        niveum-browser = prev.firefox;
+        niveum-filemanager = prev.pcmanfm;
 
-      nixosConfigurations = let
-        niveumSpecialArgs = system: {
-          unstablePackages = import nixpkgs-unstable {
-            inherit system;
-            config.allowUnfreePredicate = pkg:
-              builtins.elem (nixpkgs-unstable.lib.getName pkg) [
-                "obsidian"
-                "zoom"
+        # wrapped from upstream
+        wrapScript =
+          {
+            packages ? [ ],
+            name,
+            script,
+          }:
+          prev.writers.writeDashBin name ''PATH=$PATH:${
+            nixpkgs.lib.makeBinPath (
+              packages
+              ++ [
+                final.findutils
+                final.coreutils
+                final.gnused
+                final.gnugrep
+              ]
+            )
+          } ${script} "$@"'';
+        tag = final.wrapScript {
+          script = voidrice.outPath + "/.local/bin/tag";
+          name = "tag";
+          packages = [ final.ffmpeg ];
+        };
+        booksplit = final.wrapScript {
+          script = voidrice.outPath + "/.local/bin/booksplit";
+          name = "booksplit";
+          packages = [
+            final.ffmpeg
+            final.glibc.bin
           ];
         };
-
-          niveumPackages = inputs.self.packages.${system};
-          niveumLib = inputs.self.lib;
-          inherit inputs;
+        auc = prev.callPackage packages/auc.nix { };
+        cheat-sh = prev.callPackage packages/cheat-sh.nix { };
+        brassica = prev.callPackage packages/brassica.nix { }; # TODO upstream
+        dawn-editor = prev.callPackage packages/dawn.nix {};
+        text2pdf = prev.callPackage packages/text2pdf.nix { }; # TODO upstream
+        wttr = prev.callPackage packages/wttr.nix { }; # TODO upstream
+        jsesh = prev.callPackage packages/jsesh.nix { }; # TODO upstream
+        opustags = prev.callPackage packages/opustags.nix { }; # TODO upstream
+        trans = prev.callPackage packages/trans.nix { }; # TODO upstream
+        go-webring = prev.callPackage packages/go-webring.nix { }; # TODO upstream
+        stag = prev.callPackage packages/stag.nix { }; # TODO upstream
+        mpv = prev.mpv.override {
+          scripts = [
+            # final.mpvScripts.visualizer
+            final.mpvScripts.mpris
+          ];
         };
-      in {
-        ful = nixpkgs.lib.nixosSystem rec {
-          system = "aarch64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/ful/configuration.nix
-            agenix.nixosModules.default
-            inputs.self.nixosModules.passport
-            inputs.self.nixosModules.panoptikon
-            inputs.self.nixosModules.go-webring
-            inputs.stockholm.nixosModules.reaktor2
-            retiolum.nixosModules.retiolum
-            nur.modules.nixos.default
-            { nixpkgs.overlays = [ inputs.stockholm.overlays.default ]; }
+        morris = prev.callPackage packages/morris.nix { };
+        cro = prev.callPackage packages/cro.nix { };
+        dmenu = prev.writers.writeDashBin "dmenu" ''exec ${final.rofi}/bin/rofi -dmenu "$@"'';
+        weechatScripts = prev.weechatScripts // {
+          hotlist2extern = prev.callPackage packages/weechatScripts/hotlist2extern.nix { }; # TODO upstream
+        };
+        vimPlugins = prev.vimPlugins // {
+          cheat-sh = prev.callPackage packages/vimPlugins/cheat-sh.nix { };
+          icalendar-vim = prev.callPackage packages/vimPlugins/icalendar-vim.nix { }; # TODO upstream
+          jq-vim = prev.callPackage packages/vimPlugins/jq-vim.nix { }; # TODO upstream
+          typst-vim = prev.callPackage packages/vimPlugins/typst-vim.nix { }; # TODO upstream
+          mdwa-nvim = prev.callPackage packages/vimPlugins/mdwa-nvim.nix { }; # TODO upstream
+          vim-ernest = prev.callPackage packages/vimPlugins/vim-ernest.nix { }; # TODO upstream
+          vim-256noir = prev.callPackage packages/vimPlugins/vim-256noir.nix { }; # TODO upstream
+          vim-colors-paramount = prev.callPackage packages/vimPlugins/vim-colors-paramount.nix { }; # TODO upstream
+          vim-fetch = prev.callPackage packages/vimPlugins/vim-fetch.nix { }; # TODO upstream
+          vim-fsharp = prev.callPackage packages/vimPlugins/vim-fsharp.nix { }; # TODO upstream
+          vim-mail = prev.callPackage packages/vimPlugins/vim-mail.nix { }; # TODO upstream
+          vim-reason-plus = prev.callPackage packages/vimPlugins/vim-reason-plus.nix { }; # TODO upstream
+        };
+
+        # packaged from inputs
+        agenix = agenix.packages.${prev.stdenv.hostPlatform.system}.default;
+        pun-sort-api = scripts.packages.${prev.stdenv.hostPlatform.system}.pun-sort-api;
+        alarm = scripts.packages.${prev.stdenv.hostPlatform.system}.alarm;
+        menstruation-telegram =
+          menstruation-telegram.packages.${prev.stdenv.hostPlatform.system}.menstruation-telegram;
+        menstruation-backend =
+          menstruation-backend.packages.${prev.stdenv.hostPlatform.system}.menstruation-backend;
+        telebots = telebots.packages.${prev.stdenv.hostPlatform.system}.telebots;
+        hesychius = scripts.packages.${prev.stdenv.hostPlatform.system}.hesychius;
+        autorenkalender = autorenkalender.packages.${prev.stdenv.hostPlatform.system}.default;
+        onomap = scripts.packages.${prev.stdenv.hostPlatform.system}.onomap;
+        tinc-graph = tinc-graph.packages.${prev.stdenv.hostPlatform.system}.tinc-graph;
+
+        # krebs
+        brainmelter = prev.callPackage packages/brainmelter.nix { };
+        cyberlocker-tools = prev.callPackage packages/cyberlocker-tools.nix { };
+        hc = prev.callPackage packages/hc.nix { };
+        pls = prev.callPackage packages/pls.nix { };
+        radio-news = prev.callPackage packages/radio-news { };
+        untilport = prev.callPackage packages/untilport.nix { };
+        weechat-declarative = prev.callPackage packages/weechat-declarative.nix { };
+
+        # my packages
+        betacode = prev.callPackage packages/betacode.nix { };
+        bring-out-the-gimp = prev.callPackage packages/gimp.nix { };
+        closest = prev.callPackage packages/closest { };
+        default-gateway = prev.callPackage packages/default-gateway.nix { };
+        depp = prev.callPackage packages/depp.nix { };
+        devanagari = prev.callPackage packages/devanagari { };
+        radioStreams = prev.callPackage packages/streams { };
+        devour = prev.callPackage packages/devour.nix { };
+        dmenu-randr = prev.callPackage packages/dmenu-randr.nix { };
+        emailmenu = prev.callPackage packages/emailmenu.nix { };
+        fkill = prev.callPackage packages/fkill.nix { };
+        fzfmenu = prev.callPackage packages/fzfmenu.nix { };
+        gfs-fonts = prev.callPackage packages/gfs-fonts.nix { };
+        heuretes = prev.callPackage packages/heuretes.nix { };
+        image-convert-favicon = prev.callPackage packages/image-convert-favicon.nix { };
+        image-convert-tolino = prev.callPackage packages/image-convert-tolino.nix { };
+        ipa = prev.writers.writePython3Bin "ipa" { flakeIgnore = [ "E501" ]; } packages/ipa.py;
+        kirciuoklis = prev.callPackage packages/kirciuoklis.nix { };
+        kpaste = prev.callPackage packages/kpaste.nix { };
+        literature-quote = prev.callPackage packages/literature-quote.nix { };
+        man-pdf = prev.callPackage packages/man-pdf.nix { };
+        mansplain = prev.callPackage packages/mansplain.nix { };
+        manual-sort = prev.callPackage packages/manual-sort.nix { };
+        mpv-iptv = prev.callPackage packages/mpv-iptv.nix { };
+        mpv-radio = prev.callPackage packages/mpv-radio.nix { di-fm-key-file = "/dev/null"; };
+        mpv-tuner = prev.callPackage packages/mpv-tuner.nix { di-fm-key-file = "/dev/null"; };
+        mpv-tv = prev.callPackage packages/mpv-tv.nix { };
+        new-mac = prev.callPackage packages/new-mac.nix { };
+        nix-git = prev.callPackage packages/nix-git.nix { };
+        noise-waves = prev.callPackage packages/noise-waves.nix { };
+        notemenu = prev.callPackage packages/notemenu.nix { };
+        obsidian-vim = prev.callPackage packages/obsidian-vim.nix { };
+        vim-typewriter = prev.callPackage packages/vim-typewriter.nix { };
+        vim-email = prev.callPackage packages/vim-email.nix { };
+        polyglot = prev.callPackage packages/polyglot.nix { };
+        q = prev.callPackage packages/q.nix { };
+        qrpaste = prev.callPackage packages/qrpaste.nix { };
+        random-zeno = prev.callPackage packages/random-zeno.nix { };
+        scanned = prev.callPackage packages/scanned.nix { };
+        stardict-tools = prev.callPackage packages/stardict-tools.nix { };
+        swallow = prev.callPackage packages/swallow.nix { };
+        tocharian-font = prev.callPackage packages/tocharian-font.nix { };
+        ttspaste = prev.callPackage packages/ttspaste.nix { };
+        niveum-ssh = prev.callPackage packages/niveum-ssh.nix { };
+        try-connect = prev.callPackage packages/try-connect.nix { };
+        unicodmenu = prev.callPackage packages/unicodmenu.nix { };
+        vg = prev.callPackage packages/vg.nix { };
+        vim-kmein = prev.callPackage packages/vim-kmein { };
+        vimv = prev.callPackage packages/vimv.nix { };
+        klem = prev.callPackage packages/klem.nix { };
+
+        lib = lib // {
+          niveum = import lib/default.nix {
+            inherit lib;
+            pkgs = final;
+          };
+          panoptikon = import lib/panoptikon.nix {
+            inherit lib;
+            pkgs = final;
+          };
+        };
+      };
+
+      nixosConfigurations =
+        let
+          profiles.default = [
+            { nix.nixPath = [ "nixpkgs=${nixpkgs}" ]; }
+            { nixpkgs.overlays = [ self.overlays.default ]; }
             {
-              _module.args.nixinate = {
-                host = "ful";
-                sshUser = "root";
-                buildOn = "remote";
-                substituteOnTarget = true;
-                hermetic = false;
+              system.autoUpgrade = {
+                enable = true;
+                flake = self.outPath;
+                flags = [
+                  "--print-build-logs"
+                ];
+                dates = "02:00";
+                randomizedDelaySec = "45min";
               };
             }
+            agenix.nixosModules.default
+            retiolum.nixosModules.retiolum
+            nix-topology.nixosModules.default
+            configs/mycelium.nix
+            configs/tor.nix
+            configs/retiolum.nix
+            configs/spacetime.nix
+            configs/nix.nix
+            configs/sshd.nix
+            configs/admin-essentials.nix
+          ];
+          profiles.desktop = [
+            home-manager.nixosModules.home-manager
+            nix-index-database.nixosModules.default
+            nur.modules.nixos.default
+            stylix.nixosModules.stylix
+            self.nixosModules.system-dependent
+            self.nixosModules.power-action
+          ];
+          profiles.server = [
+            configs/save-space.nix
+            configs/monitoring.nix
+            self.nixosModules.passport
+          ];
+        in
+        {
+          ful = nixpkgs.lib.nixosSystem {
+            system = "aarch64-linux";
+            modules =
+              profiles.default
+              ++ profiles.server
+              ++ [
+                systems/ful/configuration.nix
+                self.nixosModules.panoptikon
+                self.nixosModules.go-webring
+                stockholm.nixosModules.reaktor2
+                nur.modules.nixos.default
+                { nixpkgs.overlays = [ stockholm.overlays.default ]; }
               ];
           };
-        zaatar = nixpkgs.lib.nixosSystem rec {
+          zaatar = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.server
+              ++ [
                 systems/zaatar/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
               ];
           };
-        kibbeh = nixpkgs.lib.nixosSystem rec {
+          kibbeh = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.desktop
+              ++ [
                 systems/kibbeh/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
               ];
           };
-        makanek = nixpkgs.lib.nixosSystem rec {
+          makanek = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          # for using inputs in other config files
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.server
+              ++ [
                 systems/makanek/configuration.nix
-            inputs.self.nixosModules.telegram-bot
-            inputs.self.nixosModules.passport
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
+                self.nixosModules.telegram-bot
                 nur.modules.nixos.default
               ];
           };
-        tahina = nixpkgs.lib.nixosSystem rec {
+          tahina = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules = profiles.default ++ [
               systems/tahina/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
             ];
           };
-        tabula = nixpkgs.lib.nixosSystem rec {
+          tabula = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules = profiles.default ++ [
               systems/tabula/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
             ];
           };
-        manakish = nixpkgs.lib.nixosSystem rec {
+          manakish = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.desktop
+              ++ [
                 systems/manakish/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nix-index-database.nixosModules.default
-            nur.modules.nixos.default
-            stylix.nixosModules.stylix
+                nixos-hardware.nixosModules.lenovo-thinkpad-x230
               ];
           };
-        kabsa = nixpkgs.lib.nixosSystem rec {
+          kabsa = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.desktop
+              ++ [
                 systems/kabsa/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nur.modules.nixos.default
-            nix-index-database.nixosModules.default
-            stylix.nixosModules.stylix
+                nixos-hardware.nixosModules.lenovo-thinkpad-x220
               ];
           };
-        fatteh = nixpkgs.lib.nixosSystem rec {
+          fatteh = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
+            modules =
+              profiles.default
+              ++ profiles.desktop
+              ++ [
                 systems/fatteh/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nur.modules.nixos.default
-            nix-index-database.nixosModules.default
-            stylix.nixosModules.stylix
+                nixos-hardware.nixosModules.lenovo-thinkpad-t480
               ];
           };
         };
 
-      packages = eachSupportedSystem (system: let
+      formatter = eachSupportedSystem (system: treefmtEval.${system}.config.build.wrapper);
+      checks = eachSupportedSystem (system: {
+        formatting = treefmtEval.${system}.config.build.check self;
+      });
+
+      packages = eachSupportedSystem (
+        system:
+        let
           pkgs = import nixpkgs {
             inherit system;
             config.allowUnfree = true;
             overlays = [
               nur.overlays.default
-            (self: super: {
-              mpv = super.mpv.override {scripts = [super.mpvScripts.visualizer super.mpvScripts.mpris];};
-              dmenu = super.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
-            })
+              self.overlays.default
+              nix-topology.overlays.default
             ];
           };
-        wrapScript = {
-          packages ? [],
-          name,
-          script,
-        }:
-          pkgs.writers.writeDashBin name ''PATH=$PATH:${nixpkgs.lib.makeBinPath (packages ++ [pkgs.findutils pkgs.coreutils pkgs.gnused pkgs.gnugrep])} ${script} "$@"'';
-      in {
-        # linguistics and ancient world
-        auc = pkgs.callPackage packages/auc.nix {};
-        betacode = pkgs.callPackage packages/betacode.nix {};
-        brassica = pkgs.callPackage packages/brassica.nix {}; # TODO upstream
-        devanagari = pkgs.callPackage packages/devanagari {};
-        stardict-tools = pkgs.callPackage packages/stardict-tools.nix {};
-        heuretes = pkgs.callPackage packages/heuretes.nix {};
-        ipa = pkgs.writers.writePython3Bin "ipa" {flakeIgnore = ["E501"];} (builtins.readFile packages/ipa.py);
-        jsesh = pkgs.callPackage packages/jsesh.nix {}; # TODO upstream
-        kirciuoklis = pkgs.callPackage packages/kirciuoklis.nix {};
-        polyglot = pkgs.callPackage packages/polyglot.nix {};
-        tocharian-font = pkgs.callPackage packages/tocharian-font.nix {};
-        gfs-fonts = pkgs.callPackage packages/gfs-fonts.nix {};
-        closest = pkgs.callPackage packages/closest {};
-
-        # lit
-        random-zeno = pkgs.callPackage packages/random-zeno.nix {};
-        literature-quote = pkgs.callPackage packages/literature-quote.nix {};
-
-        # krebs
-        brainmelter = pkgs.callPackage packages/brainmelter.nix {};
-        cyberlocker-tools = pkgs.callPackage packages/cyberlocker-tools.nix {};
-        hc = pkgs.callPackage packages/hc.nix {};
-        kpaste = pkgs.callPackage packages/kpaste.nix {};
-        pls = pkgs.callPackage packages/pls.nix {};
-        untilport = pkgs.callPackage packages/untilport.nix {};
-        radio-news = pkgs.callPackage packages/radio-news.nix {};
-
-        # window manager
-        swallow = pkgs.callPackage packages/swallow.nix {};
-        devour = pkgs.callPackage packages/devour.nix {};
-
-        cheat-sh = pkgs.callPackage packages/cheat-sh.nix {};
-        vimPlugins-cheat-sh-vim = pkgs.callPackage packages/vimPlugins/cheat-sh.nix {}; # TODO upstream
-        cro = pkgs.callPackage packages/cro.nix {};
-        default-gateway = pkgs.callPackage packages/default-gateway.nix {};
-        depp = pkgs.callPackage packages/depp.nix {};
-        dashboard = pkgs.callPackage packages/dashboard {};
-        fkill = pkgs.callPackage packages/fkill.nix {};
-        fzfmenu = pkgs.callPackage packages/fzfmenu.nix {};
-        gpt35 = pkgs.callPackage packages/gpt.nix {model = "gpt-3.5-turbo";};
-        gpt4 = pkgs.callPackage packages/gpt.nix {model = "gpt-4";};
-        image-convert-favicon = pkgs.callPackage packages/image-convert-favicon.nix {};
-        image-convert-tolino = pkgs.callPackage packages/image-convert-tolino.nix {};
-        k-lock = pkgs.callPackage packages/k-lock.nix {};
-        klem = pkgs.callPackage packages/klem.nix {};
-        man-pandoc = pkgs.callPackage packages/man/pandoc.nix {}; # TODO upstream
-        man-pdf = pkgs.callPackage packages/man-pdf.nix {};
-        mansplain = pkgs.callPackage packages/mansplain.nix {};
-        manual-sort = pkgs.callPackage packages/manual-sort.nix {};
-        menu-calc = pkgs.callPackage packages/menu-calc.nix {};
-        noise-waves = pkgs.callPackage packages/noise-waves.nix {};
-        mpv-radio = pkgs.callPackage packages/mpv-radio.nix {di-fm-key-file = "/dev/null";};
-        mpv-tuner = pkgs.callPackage packages/mpv-tuner.nix {di-fm-key-file = "/dev/null";};
-        mpv-tv = pkgs.callPackage packages/mpv-tv.nix {};
-        mpv-iptv = pkgs.callPackage packages/mpv-iptv.nix {};
-        new-mac = pkgs.callPackage packages/new-mac.nix {};
-        nix-git = pkgs.callPackage packages/nix-git.nix {};
-        notemenu = pkgs.callPackage packages/notemenu.nix {niveumPackages = self.packages.${system};};
-        opustags = pkgs.callPackage packages/opustags.nix {}; # TODO upstream
-        q = pkgs.callPackage packages/q.nix {};
-        qrpaste = pkgs.callPackage packages/qrpaste.nix {};
-        go-webring = pkgs.callPackage packages/go-webring.nix {}; # TODO upstream
-        rfc = pkgs.callPackage packages/rfc.nix {};
-        gimp = pkgs.callPackage packages/gimp.nix {};
-        scanned = pkgs.callPackage packages/scanned.nix {};
-        text2pdf = pkgs.callPackage packages/text2pdf.nix {}; # TODO upstream
-        timer = pkgs.callPackage packages/timer.nix {};
-        trans = pkgs.callPackage packages/trans.nix {}; # TODO upstream
-        ttspaste = pkgs.callPackage packages/ttspaste.nix {};
-        unicodmenu = pkgs.callPackage packages/unicodmenu.nix {};
-        emailmenu = pkgs.callPackage packages/emailmenu.nix {};
-        stag = pkgs.callPackage packages/stag.nix {}; # TODO upstream
-        vg = pkgs.callPackage packages/vg.nix {};
-        vim = pkgs.callPackage packages/vim.nix {niveumPackages = self.packages.${system};};
-        obsidian-vim = pkgs.callPackage packages/obsidian-vim.nix {};
-        vimPlugins-icalendar-vim = pkgs.callPackage packages/vimPlugins/icalendar-vim.nix {}; # TODO upstream
-        vimPlugins-jq-vim = pkgs.callPackage packages/vimPlugins/jq-vim.nix {}; # TODO upstream
-        vimPlugins-typst-vim = pkgs.callPackage packages/vimPlugins/typst-vim.nix {}; # TODO upstream
-        vimPlugins-mdwa-nvim = pkgs.callPackage packages/vimPlugins/mdwa-nvim.nix {}; # TODO upstream
-        vimPlugins-vim-ernest = pkgs.callPackage packages/vimPlugins/vim-ernest.nix {}; # TODO upstream
-        vimPlugins-vim-256noir = pkgs.callPackage packages/vimPlugins/vim-256noir.nix {}; # TODO upstream
-        vimPlugins-vim-colors-paramount = pkgs.callPackage packages/vimPlugins/vim-colors-paramount.nix {}; # TODO upstream
-        vimPlugins-vim-fetch = pkgs.callPackage packages/vimPlugins/vim-fetch.nix {}; # TODO upstream
-        vimPlugins-vim-fsharp = pkgs.callPackage packages/vimPlugins/vim-fsharp.nix {}; # TODO upstream
-        vimPlugins-vim-mail = pkgs.callPackage packages/vimPlugins/vim-mail.nix {}; # TODO upstream
-        vimPlugins-vim-reason-plus = pkgs.callPackage packages/vimPlugins/vim-reason-plus.nix {}; # TODO upstream
-        vimv = pkgs.callPackage packages/vimv.nix {};
-        weechat-declarative = pkgs.callPackage packages/weechat-declarative.nix {}; # TODO upstream
-        weechatScripts-hotlist2extern = pkgs.callPackage packages/weechatScripts/hotlist2extern.nix {}; # TODO upstream
-        dmenu-randr = pkgs.callPackage packages/dmenu-randr.nix {};
-        wttr = pkgs.callPackage packages/wttr.nix {}; # TODO upstream
-
-        booksplit = wrapScript {
-          script = inputs.voidrice.outPath + "/.local/bin/booksplit";
-          name = "booksplit";
-          packages = [pkgs.ffmpeg pkgs.glibc.bin];
+        in
+        {
+          topology = import nix-topology {
+            inherit pkgs;
+            modules = [
+              { nixosConfigurations = self.nixosConfigurations; }
+            ];
           };
-        tag = wrapScript {
-          script = inputs.voidrice.outPath + "/.local/bin/tag";
-          name = "tag";
-          packages = [pkgs.ffmpeg];
-        };
-      });
+          inherit (pkgs)
+            auc
+            betacode
+            booksplit
+            brainmelter
+            brassica
+            cheat-sh
+            closest
+            cro
+            cyberlocker-tools
+            dawn-editor
+            default-gateway
+            depp
+            devanagari
+            devour
+            dmenu-randr
+            emailmenu
+            fkill
+            fzfmenu
+            gfs-fonts
+            bring-out-the-gimp
+            go-webring
+            hc
+            heuretes
+            image-convert-favicon
+            image-convert-tolino
+            ipa
+            jsesh
+            kirciuoklis
+            klem
+            kpaste
+            literature-quote
+            man-pdf
+            mansplain
+            manual-sort
+            morris
+            mpv-iptv
+            mpv-radio
+            mpv-tuner
+            mpv-tv
+            new-mac
+            niveum-ssh
+            nix-git
+            noise-waves
+            notemenu
+            obsidian-vim
+            opustags
+            pls
+            polyglot
+            q
+            qrpaste
+            radio-news
+            random-zeno
+            rfc
+            scanned
+            stag
+            stardict-tools
+            swallow
+            text2pdf
+            timer
+            tocharian-font
+            trans
+            try-connect
+            ttspaste
+            unicodmenu
+            untilport
+            vg
+            vim-kmein
+            vim-typewriter
+            vim-email
+            vimv
+            weechat-declarative
+            wttr
+            ;
+        }
+      );
     };
 }

lib/default-applications.nix

@@ -1,5 +0,0 @@
-pkgs: rec {
-  terminal = "alacritty";
-  browser = "${pkgs.firefox}/bin/firefox";
-  fileManager = "${pkgs.pcmanfm}/bin/pcmanfm";
-}

lib/default.nix

@@ -1,5 +1,10 @@
+{ lib, pkgs }:
+let
+  machines = import ./machines.nix;
+in
+{
+  tmpfilesConfig =
     {
-  tmpfilesConfig = {
       type,
       path,
       mode ? "-",
@@ -7,22 +12,29 @@
       group ? "-",
       age ? "-",
       argument ? "-",
-  }: "${type} '${path}' ${mode} ${user} ${group} ${age} ${argument}";
+    }:
+    "${type} '${path}' ${mode} ${user} ${group} ${age} ${argument}";
 
-  restic = rec {
-    port = 3571;
+  restic =
+    let
       host = "zaatar.r";
+      port = 3571;
+    in
+    {
+      inherit host port;
       repository = "rest:http://${host}:${toString port}/";
     };
 
   remoteDir = "/home/kfm/remote";
 
-  firewall = lib: {
-    accept = {
+  firewall = {
+    accept =
+      {
         source,
         protocol,
         dport,
-    }: "nixos-fw -s ${lib.escapeShellArg source} -p ${lib.escapeShellArg protocol} --dport ${lib.escapeShellArg (toString dport)} -j nixos-fw-accept";
+      }:
+      "nixos-fw -s ${lib.escapeShellArg source} -p ${lib.escapeShellArg protocol} --dport ${lib.escapeShellArg (toString dport)} -j nixos-fw-accept";
     addRules = lib.concatMapStringsSep "\n" (rule: "iptables -A ${rule}");
     removeRules = lib.concatMapStringsSep "\n" (rule: "iptables -D ${rule} || true");
   };
@@ -42,45 +54,64 @@
 
   sshPort = 22022;
 
-  theme = pkgs: {
-    gtk = {
-      name = "Adwaita-dark";
-      package = pkgs.gnome-themes-extra;
+  retiolumAddresses = lib.mapAttrs (_: v: { inherit (v.retiolum) ipv4 ipv6; }) (
+    lib.filterAttrs (_: v: v ? "retiolum") machines
+  );
+  externalNetwork = lib.mapAttrs (_: v: v.externalIp) (
+    lib.filterAttrs (_: v: v ? "externalIp") machines
+  );
+  localAddresses = lib.mapAttrs (_: v: v.internalIp) (
+    lib.filterAttrs (_: v: v ? "internalIp") machines
+  );
+  myceliumAddresses = lib.mapAttrs (_: v: v.mycelium.ipv6) (
+    lib.filterAttrs (_: v: v ? "mycelium") machines
+  );
+  torAddresses = lib.mapAttrs (_: v: v.torAddress) (
+    lib.filterAttrs (_: v: v ? "torAddress") machines
+  );
+  syncthingIds = lib.mapAttrs (_: v: { id = v.syncthingId; }) (
+    lib.filterAttrs (_: v: v ? "syncthingId") machines
+  );
+
+  email =
+    let
+      thunderbirdProfile = "donnervogel";
+    in
+    {
+      inherit thunderbirdProfile;
+      defaults = {
+        thunderbird = {
+          enable = true;
+          profiles = [ thunderbirdProfile ];
         };
-    icon = {
-      name = "Adwaita";
-      package = pkgs.adwaita-icon-theme;
-    };
-    cursor = {
-      name = "capitaine-cursors-white";
-      package = pkgs.capitaine-cursors;
+        aerc.enable = true;
+        realName = "Kierán Meinhardt";
+        folders.inbox = "INBOX";
       };
     };
 
-  defaultApplications = import ./default-applications.nix;
-
-  retiolumAddresses = import ./retiolum-network.nix;
-
-  localAddresses = import ./local-network.nix;
-
-  email-sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINKz33wHtPuIfgXEb0+hybxFGV9ZuPsDTLUZo/+hlcdA";
+  machines = machines;
 
   kieran = {
     github = "kmein";
     email = "kmein@posteo.de";
     name = "Kierán Meinhardt";
-    sshKeys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyTnGhFq0Q+vghNhrqNrAyY+CsN7nNz8bPfiwIwNpjk" # kabsa
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOiQEc8rTr7C7xVLYV7tQ99BDDBLrJsy5hslxtCEatkB" # manakish
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIByreBjBEMJKjgpKLd5XZHIUUwIhNafVqN6OUOQpJa3y" # fatteh
+    pronouns = builtins.concatStringsSep "/" [
+      "er"
+      "he"
+      "is"
+      "οὗτος"
+      "هو"
+      "ⲛ̄ⲧⲟϥ"
+      "он"
+      "han"
+      "सः"
+    ];
+    sshKeys = [
+      machines.fatteh.sshKey
+      machines.manakish.sshKey
+      machines.kabsa.sshKey
     ];
-  };
-
-  syncthing.devices = {
-    kabsa.id = "R6DEBD7-G5RYDKN-VFA3HPO-WX4DNVI-373F7OQ-AW5MZTT-3L4BDVW-Y6ROEAF";
-    kibbeh.id = "HLQSG3D-WSKLA6S-MEYQ3EU-GDBGABE-PY53RQ6-SWQAP2I-Z5MVBVX-MYPJXAM";
-    manakish.id = "AJVBWR2-VFFAGZF-7ZF5JAX-T63GMOG-NZ446WK-MC5E6WK-6X6Q2HE-QQA2JQ3";
-    fatteh.id = "GSOGYT3-2GBHZXT-MNCTDIY-3BJIR4V-OHVOOMJ-ICVLKXR-U4C7RFB-HJOK3AC";
   };
 
   ignorePaths = [

lib/email.nix

@@ -1,23 +0,0 @@
-rec {
-  thunderbirdProfile = "donnervogel";
-  pronouns = builtins.concatStringsSep "/" [
-    "er"
-    "he"
-    "is"
-    "οὗτος"
-    "هو"
-    "ⲛ̄ⲧⲟϥ"
-    "он"
-    "han"
-    "सः"
-  ];
-  defaults = {
-    thunderbird = {
-      enable = true;
-      profiles = [thunderbirdProfile];
-    };
-    aerc.enable = true;
-    realName = "Kierán Meinhardt";
-    folders.inbox = "INBOX";
-  };
-}

lib/external-network.nix

@@ -1,4 +0,0 @@
-{
-  ful = "130.61.217.114";
-  makanek = "88.99.83.173";
-}

lib/goldendict-config.nix

@@ -1,182 +0,0 @@
-{
-  pkgs,
-  path,
-}: ''
-  <config>
-   <paths>
-    <path recursive="1">${path}</path>
-   </paths>
-   <sounddirs/>
-   <dictionaryOrder name="" id="0">
-    <mutedDictionaries/>
-   </dictionaryOrder>
-   <inactiveDictionaries name="" id="0">
-    <mutedDictionaries/>
-   </inactiveDictionaries>
-   <groups nextId="1"/>
-   <hunspell dictionariesPath=""/>
-   <transliteration>
-    <enableRussianTransliteration>0</enableRussianTransliteration>
-    <enableGermanTransliteration>0</enableGermanTransliteration>
-    <enableGreekTransliteration>0</enableGreekTransliteration>
-    <enableBelarusianTransliteration>0</enableBelarusianTransliteration>
-    <chinese>
-     <enable>0</enable>
-     <enableSCToTWConversion>1</enableSCToTWConversion>
-     <enableSCToHKConversion>1</enableSCToHKConversion>
-     <enableTCToSCConversion>1</enableTCToSCConversion>
-    </chinese>
-    <romaji>
-     <enable>0</enable>
-     <enableHepburn>1</enableHepburn>
-     <enableNihonShiki>0</enableNihonShiki>
-     <enableKunreiShiki>0</enableKunreiShiki>
-     <enableHiragana>1</enableHiragana>
-     <enableKatakana>1</enableKatakana>
-    </romaji>
-   </transliteration>
-   <forvo>
-    <enable>0</enable>
-    <apiKey></apiKey>
-    <languageCodes></languageCodes>
-   </forvo>
-   <mediawikis>
-    <mediawiki enabled="0" name="English Wikipedia" icon="" id="ae6f89aac7151829681b85f035d54e48" url="https://en.wikipedia.org/w"/>
-    <mediawiki enabled="0" name="English Wiktionary" icon="" id="affcf9678e7bfe701c9b071f97eccba3" url="https://en.wiktionary.org/w"/>
-    <mediawiki enabled="0" name="German Wikipedia" icon="" id="a8a66331a1242ca2aeb0b4aed361c41d" url="https://de.wikipedia.org/w"/>
-    <mediawiki enabled="0" name="German Wiktionary" icon="" id="21c64bca5ec10ba17ff19f3066bc962a" url="https://de.wiktionary.org/w"/>
-   </mediawikis>
-   <websites>
-    <website enabled="0" name="Google En-En (Oxford)" icon="" id="b88cb2898e634c6638df618528284c2d" url="https://www.google.com/search?q=define:%GDWORD%&amp;hl=en" inside_iframe="1"/>
-    <website enabled="0" name="Urban Dictionary" icon="" id="f376365a0de651fd7505e7e5e683aa45" url="https://www.urbandictionary.com/define.php?term=%GDWORD%" inside_iframe="1"/>
-    <website enabled="0" name="Multitran (En)" icon="" id="324ca0306187df7511b26d3847f4b07c" url="https://multitran.ru/c/m.exe?CL=1&amp;l1=1&amp;s=%GD1251%" inside_iframe="1"/>
-    <website enabled="0" name="Lingvo (En-Ru)" icon="" id="924db471b105299c82892067c0f10787" url="http://lingvopro.abbyyonline.com/en/Search/en-ru/%GDWORD%" inside_iframe="1"/>
-    <website enabled="0" name="Michaelis (Pt-En)" icon="" id="087a6d65615fb047f4c80eef0a9465db" url="http://michaelis.uol.com.br/moderno/ingles/index.php?lingua=portugues-ingles&amp;palavra=%GDISO1%" inside_iframe="1"/>
-   </websites>
-   <dictservers/>
-   <programs>
-    <program enabled="0" name="Espeak" icon="" id="2cf8b3a60f27e1ac812de0b57c148340" commandLine="${pkgs.espeak}/bin/espeak %GDWORD%" type="0"/>
-    <program enabled="0" name="Manpages" icon="" id="4f898f7582596cea518c6b0bfdceb8b3" commandLine="${pkgs.man_db}/bin/man -a --html=/bin/cat %GDWORD%" type="2"/>
-   </programs>
-   <voiceEngines/>
-   <mutedDictionaries/>
-   <popupMutedDictionaries>
-    <mutedDictionary>ae6f89aac7151829681b85f035d54e48</mutedDictionary>
-   </popupMutedDictionaries>
-   <preferences>
-    <interfaceLanguage></interfaceLanguage>
-    <helpLanguage></helpLanguage>
-    <displayStyle>modern</displayStyle>
-    <newTabsOpenAfterCurrentOne>0</newTabsOpenAfterCurrentOne>
-    <newTabsOpenInBackground>1</newTabsOpenInBackground>
-    <hideSingleTab>0</hideSingleTab>
-    <mruTabOrder>0</mruTabOrder>
-    <hideMenubar>0</hideMenubar>
-    <enableTrayIcon>1</enableTrayIcon>
-    <startToTray>1</startToTray>
-    <closeToTray>1</closeToTray>
-    <autoStart>0</autoStart>
-    <doubleClickTranslates>1</doubleClickTranslates>
-    <selectWordBySingleClick>0</selectWordBySingleClick>
-    <escKeyHidesMainWindow>0</escKeyHidesMainWindow>
-    <zoomFactor>1</zoomFactor>
-    <helpZoomFactor>1</helpZoomFactor>
-    <wordsZoomLevel>0</wordsZoomLevel>
-    <enableMainWindowHotkey>1</enableMainWindowHotkey>
-    <mainWindowHotkey>Ctrl+F11, Ctrl+F11</mainWindowHotkey>
-    <enableClipboardHotkey>1</enableClipboardHotkey>
-    <clipboardHotkey>Ctrl+C, Ctrl+C</clipboardHotkey>
-    <enableScanPopup>1</enableScanPopup>
-    <startWithScanPopupOn>0</startWithScanPopupOn>
-    <enableScanPopupModifiers>0</enableScanPopupModifiers>
-    <scanPopupModifiers>0</scanPopupModifiers>
-    <scanPopupAltMode>0</scanPopupAltMode>
-    <scanPopupAltModeSecs>3</scanPopupAltModeSecs>
-    <ignoreOwnClipboardChanges>0</ignoreOwnClipboardChanges>
-    <scanToMainWindow>0</scanToMainWindow>
-    <ignoreDiacritics>0</ignoreDiacritics>
-    <showScanFlag>0</showScanFlag>
-    <scanPopupUseUIAutomation>1</scanPopupUseUIAutomation>
-    <scanPopupUseIAccessibleEx>1</scanPopupUseIAccessibleEx>
-    <scanPopupUseGDMessage>1</scanPopupUseGDMessage>
-    <scanPopupUnpinnedWindowFlags>0</scanPopupUnpinnedWindowFlags>
-    <scanPopupUnpinnedBypassWMHint>0</scanPopupUnpinnedBypassWMHint>
-    <pronounceOnLoadMain>0</pronounceOnLoadMain>
-    <pronounceOnLoadPopup>0</pronounceOnLoadPopup>
-    <useInternalPlayer>1</useInternalPlayer>
-    <internalPlayerBackend>FFmpeg+libao</internalPlayerBackend>
-    <audioPlaybackProgram>mplayer</audioPlaybackProgram>
-    <alwaysOnTop>1</alwaysOnTop>
-    <searchInDock>1</searchInDock>
-    <historyStoreInterval>0</historyStoreInterval>
-    <favoritesStoreInterval>0</favoritesStoreInterval>
-    <confirmFavoritesDeletion>1</confirmFavoritesDeletion>
-    <proxyserver enabled="0" useSystemProxy="0">
-     <type>0</type>
-     <host></host>
-     <port>3128</port>
-     <user></user>
-     <password></password>
-     <systemProxyUser></systemProxyUser>
-     <systemProxyPassword></systemProxyPassword>
-    </proxyserver>
-    <disallowContentFromOtherSites>0</disallowContentFromOtherSites>
-    <enableWebPlugins>0</enableWebPlugins>
-    <hideGoldenDictHeader>0</hideGoldenDictHeader>
-    <maxNetworkCacheSize>50</maxNetworkCacheSize>
-    <clearNetworkCacheOnExit>1</clearNetworkCacheOnExit>
-    <maxStringsInHistory>500</maxStringsInHistory>
-    <storeHistory>1</storeHistory>
-    <alwaysExpandOptionalParts>0</alwaysExpandOptionalParts>
-    <addonStyle></addonStyle>
-    <collapseBigArticles>0</collapseBigArticles>
-    <articleSizeLimit>2000</articleSizeLimit>
-    <limitInputPhraseLength>0</limitInputPhraseLength>
-    <inputPhraseLengthLimit>1000</inputPhraseLengthLimit>
-    <maxDictionaryRefsInContextMenu>20</maxDictionaryRefsInContextMenu>
-    <trackClipboardChanges>0</trackClipboardChanges>
-    <synonymSearchEnabled>1</synonymSearchEnabled>
-    <fullTextSearch>
-     <searchMode>0</searchMode>
-     <matchCase>0</matchCase>
-     <maxArticlesPerDictionary>100</maxArticlesPerDictionary>
-     <maxDistanceBetweenWords>2</maxDistanceBetweenWords>
-     <useMaxArticlesPerDictionary>0</useMaxArticlesPerDictionary>
-     <useMaxDistanceBetweenWords>1</useMaxDistanceBetweenWords>
-     <dialogGeometry></dialogGeometry>
-     <disabledTypes></disabledTypes>
-     <enabled>1</enabled>
-     <ignoreWordsOrder>0</ignoreWordsOrder>
-     <ignoreDiacritics>0</ignoreDiacritics>
-     <maxDictionarySize>0</maxDictionarySize>
-    </fullTextSearch>
-   </preferences>
-   <lastMainGroupId>0</lastMainGroupId>
-   <lastPopupGroupId>0</lastPopupGroupId>
-   <popupWindowState>AAAA/wAAAAH9AAAAAAAAAg0AAAGTAAAABAAAAAQAAAAIAAAACPwAAAABAAAAAQAAAAEAAAAaAGQAaQBjAHQAaQBvAG4AYQByAHkAQgBhAHIDAAAAAP////8AAAAAAAAAAA==</popupWindowState>
-   <popupWindowGeometry>AdnQywADAAAAAAC6AAABEgAAAuYAAAKkAAAAugAAARIAAALmAAACpAAAAAAAAAAABVYAAAC6AAABEgAAAuYAAAKk</popupWindowGeometry>
-   <pinPopupWindow>0</pinPopupWindow>
-   <popupWindowAlwaysOnTop>0</popupWindowAlwaysOnTop>
-   <mainWindowState>AAAA/wAAAAH9AAAAAgAAAAAAAADMAAAC0PwCAAAAAfsAAAAUAHMAZQBhAHIAYwBoAFAAYQBuAGUBAAAAFAAAAtAAAAB9AP///wAAAAEAAADMAAAC0PwCAAAAA/sAAAASAGQAaQBjAHQAcwBQAGEAbgBlAQAAABQAAAFvAAAAYQD////7AAAAGgBmAGEAdgBvAHIAaQB0AGUAcwBQAGEAbgBlAAAAABQAAALQAAAAYQD////7AAAAFgBoAGkAcwB0AG8AcgB5AFAAYQBuAGUBAAABhAAAAWAAAABhAP///wAAA7QAAALQAAAABAAAAAQAAAAIAAAACPwAAAABAAAAAgAAAAIAAAAUAG4AYQB2AFQAbwBvAGwAYgBhAHIAAAAAAP////8AAAAAAAAAAAAAABoAZABpAGMAdABpAG8AbgBhAHIAeQBCAGEAcgAAAAAA/////wAAAAAAAAAA</mainWindowState>
-   <mainWindowGeometry>AdnQywADAAAAAAAEAAAAGAAABVEAAAL7AAAABAAAABgAAAVRAAAC+wAAAAAAAAAABVYAAAAEAAAAGAAABVEAAAL7</mainWindowGeometry>
-   <helpWindowGeometry>AdnQywADAAAAAAF3AAAAgwAAA9AAAAJGAAABeAAAAIQAAAPPAAACRQAAAAAAAAAABVYAAAF4AAAAhAAAA88AAAJF</helpWindowGeometry>
-   <helpSplitterState>AAAA/wAAAAEAAAACAAABBAAABAAB/////wEAAAABAA==</helpSplitterState>
-   <dictInfoGeometry>AdnQywADAAAAAAF1AAAAmgAAA84AAAIrAAABdgAAAJsAAAPNAAACKgAAAAAAAAAABVYAAAF2AAAAmwAAA80AAAIq</dictInfoGeometry>
-   <inspectorGeometry></inspectorGeometry>
-   <timeForNewReleaseCheck></timeForNewReleaseCheck>
-   <skippedRelease></skippedRelease>
-   <showingDictBarNames>1</showingDictBarNames>
-   <usingSmallIconsInToolbars>1</usingSmallIconsInToolbars>
-   <editDictionaryCommandLine></editDictionaryCommandLine>
-   <maxPictureWidth>0</maxPictureWidth>
-   <maxHeadwordSize>256</maxHeadwordSize>
-   <maxHeadwordsToExpand>0</maxHeadwordsToExpand>
-   <headwordsDialog>
-    <searchMode>0</searchMode>
-    <matchCase>0</matchCase>
-    <autoApply>0</autoApply>
-    <headwordsExportPath></headwordsExportPath>
-    <headwordsDialogGeometry></headwordsDialogGeometry>
-   </headwordsDialog>
-  </config>
-''

lib/home.nix

@@ -1,2 +0,0 @@
-# https://github.com/hercules-ci/gitignore.nix/pull/58/files
-path: ~/. + path

lib/keyboards/arabic

@@ -1,23 +0,0 @@
-// Arabic keyboard using Buckwalter transliteration
-// http://www.qamus.org/transliteration.htm
-// Martin Vidner
-// stolen from https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/blob/2505a3ec2605ea7303bc6de68acf96578f0fd424/symbols/ara#L179
-
-// TODO 06CC ARABIC LETTER FARSI YEH
-
-default partial alphanumeric_keys
-xkb_symbols "buckwalter" {
-  include "ara(buckwalter)"
-  name[Group1] = "Arabic (Buckwalter + Persian)";
-
-  key <AE09> {[ 0x1000669, parenleft ] };
-  key <AE10> {[ 0x1000660, parenright ] };
-  key <AD10> {[ Arabic_tehmarbuta, 0x100067E ] }; // پ
-  key <AD11> {[ 0x100200C, 0x1000671 ] }; // alif wasla, ZWNJ
-  key <AD12> {[ 0x10006C0, Arabic_hamzaonyeh ] }; // ۀ
-  key <AC05> {[ Arabic_ghain, 0x10006AF ] }; // گ
-  key <AC07> {[ Arabic_jeem, 0x1000686 ] }; // چ
-  key <AB03> {[ 0x10006A9, 0x1000698 ] }; // ک ژ
-  key <AB04> {[ Arabic_theh, 0x10006A4 ] }; // ڤ
-  key <AB09> {[ period, Arabic_hamzaonalef ] };
-};

lib/local-network.nix

@@ -1,4 +0,0 @@
-{
-  officejet = "192.168.0.251";
-  router = "192.168.0.1";
-}

lib/machines.nix

@@ -0,0 +1,102 @@
+let
+  sshPort = 22022;
+in
+{
+  kabsa = {
+    sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyTnGhFq0Q+vghNhrqNrAyY+CsN7nNz8bPfiwIwNpjk";
+    internalIp = "192.168.0.209";
+    syncthingId = "R6DEBD7-G5RYDKN-VFA3HPO-WX4DNVI-373F7OQ-AW5MZTT-3L4BDVW-Y6ROEAF";
+    retiolum = {
+      ipv4 = "10.243.2.4";
+      ipv6 = "42:0:3c46:861f:a118:8e9a:82c9:3d";
+    };
+    mycelium.ipv6 = "432:e30:d5d8:9311:e34b:6587:96ee:3fcb";
+    torAddress = "uwhxlsrkumxfjygdpoa556xs33jafcyq7gcifbdgscsoimbo5wbbksyd.onion";
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  manakish = {
+    sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOiQEc8rTr7C7xVLYV7tQ99BDDBLrJsy5hslxtCEatkB";
+    internalIp = "192.168.0.237";
+    syncthingId = "AJVBWR2-VFFAGZF-7ZF5JAX-T63GMOG-NZ446WK-MC5E6WK-6X6Q2HE-QQA2JQ3";
+    retiolum = {
+      ipv4 = "10.243.2.85";
+      ipv6 = "42:0:3c46:ac99:ae36:cb8:c551:ba27";
+    };
+    mycelium.ipv6 = "512:d3bd:3cd9:fcc8:ae34:81fa:385f:8c21";
+    torAddress = "wyc6ci4obq5huqhtop2omdkqipbq2tf7bz3wqxmsnfkwwrxvaesdepad.onion";
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  fatteh = {
+    sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIByreBjBEMJKjgpKLd5XZHIUUwIhNafVqN6OUOQpJa3y";
+    internalIp = "192.168.0.59";
+    syncthingId = "GSOGYT3-2GBHZXT-MNCTDIY-3BJIR4V-OHVOOMJ-ICVLKXR-U4C7RFB-HJOK3AC";
+    retiolum = {
+      ipv6 = "42:0:3c46:aa73:82b0:14d7:7bf8:bf2";
+      ipv4 = "10.243.2.77";
+    };
+    torAddress = "uoe7poyeliuaudf4x5nrwvs3t55ldcdpfqfyeqsadbs77ttjx7upquyd.onion";
+    mycelium.ipv6 = "463:a0d4:daa3:aa8d:a9b1:744a:46a5:7a80";
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  kibbeh = {
+    syncthingId = "HLQSG3D-WSKLA6S-MEYQ3EU-GDBGABE-PY53RQ6-SWQAP2I-Z5MVBVX-MYPJXAM";
+  };
+  ful = {
+    externalIp = "130.61.217.114";
+    retiolum = {
+      ipv4 = "10.243.2.107";
+      ipv6 = "42:0:3c46:2c8b:a564:1213:9fb4:1bc4";
+    };
+    mycelium.ipv6 = "5bf:d60e:bebf:5163:f495:8787:880c:6d41";
+    torAddress = "ll3k2akcpwuo562hlbr452yvzhi6kmpjzcnjgw6z4nege2yftspgjjad.onion";
+    inherit sshPort;
+    system = "aarch64-linux";
+  };
+  zaatar = {
+    internalIp = "192.168.0.47";
+    retiolum = {
+      ipv4 = "10.243.2.34";
+      ipv6 = "42:0:3c46:156e:10b6:3bd6:6e82:b2cd";
+    };
+    mycelium.ipv6 = "5c5:49e0:7793:f017:59e1:1715:9e0e:3fc8";
+    torAddress = "hurgxlejplh7lj2hyaj4gk2fuearibst6axdxl2ekfohiivyiab3gkad.onion";
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  makanek = {
+    externalIp = "88.99.83.173";
+    retiolum = {
+      ipv4 = "10.243.2.84";
+      ipv6 = "42:0:3c46:f7a9:1f0a:1b2b:822a:6050";
+    };
+    mycelium.ipv6 = "43f:ad4f:fa67:d9f7:8a56:713c:7418:164b";
+    torAddress = "gnaoacvkhovpllpiwi4a4mbnx4awpdcufwtsj365tiweybdeec7thuyd.onion";
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  officejet = {
+    internalIp = "192.168.0.251";
+  };
+  router = {
+    internalIp = "192.168.0.1";
+  };
+  tabula = {
+    retiolum = {
+      ipv4 = "10.243.2.78";
+      ipv6 = "";
+    };
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+  tahina = {
+    retiolum = {
+      ipv4 = "10.243.2.74";
+      ipv6 = "42:0:3c46:2923:1c90:872:edd6:306";
+    };
+    inherit sshPort;
+    system = "x86_64-linux";
+  };
+}

lib/mycelium-network.nix

@@ -1,8 +0,0 @@
-{
-  zaatar = "5c5:49e0:7793:f017:59e1:1715:9e0e:3fc8";
-  fatteh = "463:a0d4:daa3:aa8d:a9b1:744a:46a5:7a80";
-  ful = "5bf:d60e:bebf:5163:f495:8787:880c:6d41";
-  kabsa = "432:e30:d5d8:9311:e34b:6587:96ee:3fcb";
-  makanek = "43f:ad4f:fa67:d9f7:8a56:713c:7418:164b";
-  manakish = "512:d3bd:3cd9:fcc8:ae34:81fa:385f:8c21";
-}

lib/panoptikon.nix

@@ -1,28 +1,35 @@
 {
   pkgs,
   lib,
-  niveumPackages,
   ...
-}: {
+}:
+{
   # watcher scripts
-  url = address:
+  url =
+    address:
     pkgs.writers.writeDash "watch-url" ''
       ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
         | ${pkgs.python3Packages.html2text}/bin/html2text --decode-errors=ignore
     '';
-  urlSelector = selector: address:
+  urlSelector =
+    selector: address:
     pkgs.writers.writeDash "watch-url-selector" ''
       ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} \
         | ${pkgs.htmlq}/bin/htmlq ${lib.escapeShellArg selector} \
         | ${pkgs.python3Packages.html2text}/bin/html2text
     '';
-  urlJSON = {jqScript ? "."}: address:
+  urlJSON =
+    {
+      jqScript ? ".",
+    }:
+    address:
     pkgs.writers.writeDash "watch-url-json" ''
       ${pkgs.curl}/bin/curl -sSL ${lib.escapeShellArg address} | ${pkgs.jq}/bin/jq -f ${pkgs.writeText "script.jq" jqScript}
     '';
 
   # reporter scripts
-  kpaste-irc = {
+  kpaste-irc =
+    {
       target,
       retiolumLink ? false,
       server ? "irc.r",
@@ -30,12 +37,8 @@
       nick ? ''"$PANOPTIKON_WATCHER"-watcher'',
     }:
     pkgs.writers.writeDash "kpaste-irc-reporter" ''
-      KPASTE_CONTENT_TYPE=text/plain ${niveumPackages.kpaste}/bin/kpaste \
-        | ${pkgs.gnused}/bin/sed -n "${
-        if retiolumLink
-        then "2"
-        else "3"
-      }s/^/${messagePrefix}/p" \
+      KPASTE_CONTENT_TYPE=text/plain ${pkgs.kpaste}/bin/kpaste \
+        | ${pkgs.gnused}/bin/sed -n "${if retiolumLink then "2" else "3"}s/^/${messagePrefix}/p" \
         | ${pkgs.nur.repos.mic92.ircsink}/bin/ircsink \
           --nick ${nick} \
           --server ${server} \

lib/retiolum-network.nix

@@ -1,39 +0,0 @@
-{
-  kabsa = {
-    ipv4 = "10.243.2.4";
-    ipv6 = "42:0:3c46:861f:a118:8e9a:82c9:3d";
-  };
-
-  ful = {
-    ipv4 = "10.243.2.107";
-    ipv6 = "42:0:3c46:2c8b:a564:1213:9fb4:1bc4";
-  };
-
-  zaatar = {
-    ipv4 = "10.243.2.34";
-    ipv6 = "42:0:3c46:156e:10b6:3bd6:6e82:b2cd";
-  };
-
-  makanek = {
-    ipv4 = "10.243.2.84";
-    ipv6 = "42:0:3c46:f7a9:1f0a:1b2b:822a:6050";
-  };
-
-  fatteh = {
-    ipv6 = "42:0:3c46:aa73:82b0:14d7:7bf8:bf2";
-    ipv4 = "10.243.2.77";
-  };
-
-  manakish = {
-    ipv4 = "10.243.2.85";
-    ipv6 = "42:0:3c46:ac99:ae36:cb8:c551:ba27";
-  };
-  tabula = {
-    ipv4 = "10.243.2.78";
-    ipv6 = "";
-  };
-  tahina = {
-    ipv4 = "10.243.2.74";
-    ipv6 = "42:0:3c46:2923:1c90:872:edd6:306";
-  };
-}

modules/go-webring.nix

@@ -84,7 +84,11 @@ in
         Type = "simple";
         ExecStart = ''
           ${lib.getExe cfg.package} \
-            ${lib.optionalString (cfg.contactInstructions != null) ("--contact " + lib.escapeShellArg cfg.contactInstructions)} \
+            ${
+              lib.optionalString (cfg.contactInstructions != null) (
+                "--contact " + lib.escapeShellArg cfg.contactInstructions
+              )
+            } \
             --host ${cfg.host} \
             --index ${pkgs.writeText "index.html" cfg.homePageTemplate} \
             --listen ${cfg.listenAddress} \

modules/moodle-dl.nix

@@ -4,12 +4,14 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.services.moodle-dl;
   json = pkgs.formats.json { };
   moodle-dl-json = json.generate "moodle-dl.json" cfg.settings;
   stateDirectoryDefault = "/var/lib/moodle-dl";
-in {
+in
+{
   options = {
     services.moodle-dl = {
       enable = mkEnableOption "moodle-dl, a Moodle downloader";

modules/networkmanager-declarative.nix

@@ -1,69 +0,0 @@
-# https://github.com/jmackie/nixos-networkmanager-profiles/
-{
-  lib,
-  config,
-  ...
-}:
-with lib; let
-  nm = config.networking.networkmanager;
-
-  mkProfile = profileAttrs:
-    if !(isAttrs profileAttrs)
-    then throw "error 1"
-    else {
-      enable = true;
-      mode = "0400"; # readonly (user)
-      text =
-        (foldlAttrs (accum: {
-            name,
-            value,
-          }: ''
-            ${accum}
-
-            [${name}] ${mkProfileEntry value}'')
-          "# Generated by nixos-networkmanager-profiles"
-          profileAttrs)
-        + "\n";
-    };
-
-  mkProfileEntry = entryAttrs:
-    if !(isAttrs entryAttrs)
-    then throw "error 2"
-    else
-      foldlAttrs (accum: {
-        name,
-        value,
-      }: ''
-        ${accum}
-        ${name}=${toString value}'') ""
-      entryAttrs;
-
-  foldlAttrs = op: nul: attrs:
-    foldl (accum: {
-      fst,
-      snd,
-    }:
-      op accum (nameValuePair fst snd))
-    nul
-    (lists.zipLists (attrNames attrs) (attrValues attrs));
-
-  attrLength = attrs: length (attrValues attrs);
-in {
-  options.networking.networkmanager.profiles = mkOption {
-    type = types.attrs;
-    default = {};
-  };
-
-  config = mkIf (attrLength nm.profiles > 0) {
-    environment.etc = foldlAttrs (accum: {
-      name,
-      value,
-    }:
-      accum
-      // {
-        "NetworkManager/system-connections/${name}.nmconnection" =
-          mkProfile value;
-      }) {}
-    nm.profiles;
-  };
-}

modules/panoptikon.nix

@@ -3,11 +3,13 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   options.services.panoptikon = {
     enable = lib.mkEnableOption "Generic command output / website watcher";
     watchers = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule (watcher: {
+      type = lib.types.attrsOf (
+        lib.types.submodule (watcher: {
           options = {
             script = lib.mkOption {
               type = lib.types.path;
@@ -55,11 +57,13 @@
             };
           };
           config = { };
-      }));
+        })
+      );
     };
   };
 
-  config = let
+  config =
+    let
       cfg = config.services.panoptikon;
     in
     lib.mkIf cfg.enable {
@@ -72,14 +76,15 @@
 
       users.extraGroups.panoptikon = { };
 
-      systemd.timers = lib.attrsets.mapAttrs' (watcherName: _:
+      systemd.timers = lib.attrsets.mapAttrs' (
+        watcherName: _:
         lib.nameValuePair "panoptikon-${watcherName}" {
           timerConfig.RandomizedDelaySec = toString (60 * 60);
-        })
-      cfg.watchers;
+        }
+      ) cfg.watchers;
 
-      systemd.services =
-        lib.attrsets.mapAttrs' (watcherName: watcherOptions:
+      systemd.services = lib.attrsets.mapAttrs' (
+        watcherName: watcherOptions:
         lib.nameValuePair "panoptikon-${watcherName}" {
           enable = true;
           startAt = watcherOptions.frequency;
@@ -101,14 +106,18 @@
           script = ''
             set -fux
             ${watcherOptions.script} > ${lib.escapeShellArg watcherName}
-              diff_output=$(${pkgs.diffutils}/bin/diff --new-file ${lib.escapeShellArg (watcherName + ".old")} ${lib.escapeShellArg watcherName} || :)
+            diff_output=$(${pkgs.diffutils}/bin/diff --new-file ${
+              lib.escapeShellArg (watcherName + ".old")
+            } ${lib.escapeShellArg watcherName} || :)
             if [ -n "$diff_output" ]
             then
-                ${lib.strings.concatMapStringsSep "\n" (reporter: ''echo "$diff_output" | ${reporter} || :'') watcherOptions.reporters}
+              ${lib.strings.concatMapStringsSep "\n" (
+                reporter: ''echo "$diff_output" | ${reporter} || :''
+              ) watcherOptions.reporters}
             fi
             mv ${lib.escapeShellArg watcherName} ${lib.escapeShellArg (watcherName + ".old")}
           '';
-          })
-        cfg.watchers;
+        }
+      ) cfg.watchers;
     };
 }

modules/passport.nix

@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.niveum.passport;
   sortOn = a: lib.sort (as1: as2: lib.lessThan (lib.getAttr a as1) (lib.getAttr a as2));
   css = ''
@@ -52,7 +53,8 @@
     }
   '';
 in
-  with lib; {
+with lib;
+{
   options.niveum.passport = {
     enable = mkEnableOption "server passport";
 
@@ -63,7 +65,8 @@ in
     };
 
     services = mkOption {
-        type = types.listOf (types.submodule {
+      type = types.listOf (
+        types.submodule {
           options = {
             title = mkOption { type = types.str; };
             link = mkOption {
@@ -75,7 +78,8 @@ in
               default = "";
             };
           };
-        });
+        }
+      );
       default = [ ];
     };
   };