feat: init quickshell

.editorconfig

@@ -1,13 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-end_of_line = lf
-charset = utf-8
-insert_final_newline = true
-
-[*.{nix,lua,yaml,css}]
-indent_size = 2
-
-[Makefile]
-indent_size = 4

.envrc

@@ -1 +0,0 @@
-export IMPURE_ROOT=$(pwd)

.lazy.lua

@@ -1,40 +0,0 @@
-vim.lsp.config("nixd", {
-  settings = {
-    nixd = {
-      options = {
-        nixos = {
-          expr = '(builtins.getFlake ("git+file://" + toString ./.)).nixosConfigurations.'
-            .. vim.uv.os_gethostname()
-            .. ".options",
-        },
-      },
-      diagnostic = {
-        suppress = {
-          "sema-primop-overridden",
-        },
-      },
-    },
-  },
-})
-
-return {
-  {
-    "folke/lazydev.nvim",
-    ft = "lua",
-    opts = {
-      library = {
-        { path = "${3rd}/luv/library", words = { "vim%.uv" } },
-      },
-    },
-  },
-  {
-    "hrsh7th/nvim-cmp",
-    opts = function(_, opts)
-      opts.sources = opts.sources or {}
-      table.insert(opts.sources, {
-        name = "lazydev",
-        group_index = 0,
-      })
-    end,
-  },
-}

.sops.yaml

@@ -1,11 +1,13 @@
 keys:
-  - &imxyy-nix ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO
+  - &imxyy-nix age1jf5pg2x6ta8amj40xdy0stvcvrdlkwc2nrwtmkpymu0qclk0eg5qmm9kns
-  - &imxyy-nix-server ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB28jpN+h5euh3NtdN+A+EtqgIatC22e4i1TPTioKire
+  - &imxyy-nix-server age1hpgg6psejh4y6jcdd34wxuml75fnweqpe0kh8376yqsctsfn9qxs037kk6
-  - &imxyy-nix-x16 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMb5G/ieEYBOng66YeyttBQLThyM6W//z2POsNyq4Rw/
+  - &imxyy-nix-x16 age1r0fv0tagxupfacv0aaxk5ss7sqvswv6kq8tk3x46ndqrj6f5afvqegahxq
+  - &imxyy-cloudwin age1tp7th3rrv3x0l6jl76n0hjqjp223w2y586pkgr0hcjwdm254jd5shkj6a8
 creation_rules:
-  - path_regex: secrets/.*\..*
+  - path_regex: secrets/.*\.(yaml|toml|json|env|dae|txt|conf)$
     key_groups:
       - age:
         - *imxyy-nix
         - *imxyy-nix-server
         - *imxyy-nix-x16
+        - *imxyy-cloudwin

Justfile

@@ -1,51 +0,0 @@
-set export
-
-IMPURE_ROOT := `pwd`
-
-all: fmt switch
-
-@switch:
-	echo "Rebuilding NixOS..."
-	nh os switch . --impure
-
-@switch-offline:
-	echo "Rebuilding NixOS without net..."
-	nh os switch . --impure --no-net
-
-alias offline := switch-offline
-
-@boot:
-	echo "Rebuilding NixOS..."
-	nh os boot . --impure
-
-@test:
-	echo "Rebuilding NixOS..."
-	nh os test . --impure
-
-@vm:
-	echo "Building NixOS VM..."
-	nh os build-vm . --impure
-
-@update:
-	echo "Updating flakes..."
-	nix flake update
-
-@repl:
-	nixos-rebuild repl --flake .
-
-@cleandry:
-	echo "Listing all generations older than 15 days..."
-	sudo nix profile wipe-history --profile /nix/var/nix/profiles/system --dry-run --older-than 15d
-	nix profile wipe-history --profile ~/.local/state/nix/profiles/home-manager --dry-run --older-than 15d
-
-@clean:
-	echo "Removing all generations older than 15 days..."
-	sudo nix profile wipe-history --profile /nix/var/nix/profiles/system --older-than 15d
-	nix profile wipe-history --profile ~/.local/state/nix/profiles/home-manager --older-than 15d
-
-@gc:
-	nix store gc --debug
-
-@fmt:
-	echo "Formatting files..."
-	nix fmt

Makefile

@@ -0,0 +1,49 @@
+all: fmt switch
+
+switch:
+	@echo "Rebuilding NixOS..."
+	@nh os switch .
+
+boot:
+	@echo "Rebuilding NixOS..."
+	@nh os boot .
+
+test:
+	@echo "Rebuilding NixOS..."
+	@nh os test .
+
+vm:
+	@echo "Building NixOS VM..."
+	@nh os build-vm .
+
+update:
+	@echo "Updating flakes..."
+	@nix flake update
+
+history:
+	@nix profile history --profile /nix/var/nix/profiles/system
+
+replpkgs:
+	@nix repl -f flake:nixpkgs
+
+repl:
+	@nh os repl .
+
+cleandry:
+	@echo "Listing all generations older than 15 days..."
+	@sudo nix profile wipe-history --profile /nix/var/nix/profiles/system --dry-run --older-than 15d
+	@nix profile wipe-history --profile ~/.local/state/nix/profiles/home-manager --dry-run --older-than 15d
+
+clean:
+	@echo "Removing all generations older than 15 days..."
+	@sudo nix profile wipe-history --profile /nix/var/nix/profiles/system --older-than 15d
+	@nix profile wipe-history --profile ~/.local/state/nix/profiles/home-manager --older-than 15d
+
+gc:
+	@nix store gc --debug
+
+fmt:
+	@echo "Formatting nix files..."
+	@nix fmt
+
+.PHONY: os home news update history repl clean gc fmt

README.md

@@ -10,7 +10,7 @@ Currently, this repository contains the nix code that builds:
 2. NixOS home server
 3. NixOS WSL
 
-See [./hosts](./hosts) for details of each host.
+See [./config/hosts](./config/hosts) for details of each host.
 
 ## Why NixOS & Flakes?
 
@@ -22,25 +22,30 @@ forever. If someone else shares their configuration, anyone else can just use it
 As for Flakes, refer to
 [Introduction to Flakes - NixOS & Nix Flakes Book](https://nixos-and-flakes.thiscute.world/nixos-with-flakes/introduction-to-flakes)
 
-This configuration uses [flake-parts](https://flake.parts/) for better flake organization and modularity,
+## Components
-enabling declarative host definitions and cleaner separation of concerns.
+
+|                               | NixOS(Wayland)                                          |
+| ----------------------------- | :------------------------------------------------------ |
+| **Window Manager**            | Niri                                                    |
+| **Terminal Emulator**         | Alacritty & Kitty & Foot & Ghostty                      |
+| **Bar**                       | Waybar                                                  |
+| **Application Launcher**      | wofi                                                    |
+| **Notification Daemon**       | SwayNotificationCenter                                  |
+| **Input method framework**    | Fcitx5                                                  |
+| **Shell**                     | Zsh                                                     |
+| **Netease Cloudmusic Player** | go-musicfox                                             |
+| **Media Player**              | mpv                                                     |
+| **Text Editor**               | Neovim                                                  |
+| **Fonts**                     | Noto Sans CJK & Jetbrains Mono & Nerd Font              |
+| **Filesystem**                | btrfs subvolumes, clean '/' every boot for impermanence |
+
+And more...
 
 ## Folder Structure
 
 - `modules/` - custom NixOS modules
-  - `modules/core/` - core system modules (nix, persistence, time, user, xdg)
+- `config/base.nix` - generic configs
-  - `modules/cli/` - command-line tools and utilities
+- `config/hosts/<name>/` - hosts-specific configs
-  - `modules/coding/` - development environments and editors
-  - `modules/desktop/` - desktop applications and window managers
-  - `modules/virt/` - virtualization configurations
-- `profiles/` - system configuration profiles
-  - `profiles/base.nix` - base configuration for all hosts
-  - `profiles/desktop.nix` - desktop environment configuration
-  - `profiles/server.nix` - server-specific configuration
-  - `profiles/wsl.nix` - WSL-specific configuration
-- `hosts/<name>/` - host-specific configs
-- `flake/` - flake-parts modules
-  - `flake/hosts.nix` - declarative host definitions
 - `lib/` - custom nix library
 - `pkgs/` - custom packages
 - `overlays/` - nixpkgs overlays

config/base.nix

@@ -0,0 +1,38 @@
+{ config, hostname, ... }:
+{
+  # I prefer this to the default issue text
+  # ported from ArchLinux IIRC
+  environment.etc.issue.text = "\\e{lightcyan}\\S\\e{reset} Login (\\l)\n\n";
+  networking.hostName = hostname;
+  # don't change this unless you know what you are doing!
+  # for further information, see wiki.nixos.org
+  system.stateVersion = "24.11";
+  # disable this since we already have machine-id persisted
+  systemd.services."systemd-machine-id-commit".enable = !config.my.persist.enable;
+
+  my = {
+    home = {
+      # nicely reload system units when changing configs
+      systemd.user.startServices = "sd-switch";
+      home.stateVersion = "24.11";
+    };
+
+    xdg.enable = true;
+    persist = {
+      nixosDirs = [
+        "/root"
+        "/var"
+        "/etc/ssh"
+      ];
+      nixosFiles = [
+        "/etc/machine-id"
+      ];
+      homeDirs = [
+        {
+          directory = ".ssh";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+}

config/hosts/imxyy-nix-server/ai.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  services.open-webui = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 8089;
+    package = pkgs.stable.open-webui;
+  };
+  services.caddy.virtualHosts."ai.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8089 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+}

config/hosts/imxyy-nix-server/build.nix

@@ -1,15 +1,13 @@
 {
-  lib,
   config,
+  lib,
   pkgs,
-  secrets,
+  sopsRoot,
-  hosts,
   ...
 }:
 {
   sops.secrets.et-imxyy-nix-server-nixremote = {
-    sopsFile = secrets.et-imxyy-nix-server-nixremote;
+    sopsFile = sopsRoot + /et-imxyy-nix-server-nixremote.toml;
-    restartUnits = [ "easytier-nixremote.service" ];
     format = "binary";
   };
   environment.systemPackages = [ pkgs.easytier ];
@@ -17,8 +15,10 @@
     enable = true;
     script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-server-nixremote.path}";
     serviceConfig = {
-      Restart = "always";
+      Restart = lib.mkOverride 500 "always";
-      RestartSec = 30;
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
       User = "root";
     };
     wantedBy = [ "multi-user.target" ];
@@ -32,7 +32,12 @@
     isSystemUser = true;
     description = "nix remote build user";
     group = "nixremote";
-    openssh.authorizedKeys.keys = (lib.mapAttrsToList (host: key: "${key} ${host}") hosts) ++ [
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWOy0QmAyxENg/O5m3cus8U3c9jCLioivwcWsh5/a82 imxyy-hisense-pad"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8pivvE8PMtsOxmccfNhH/4KehDKhBfUfJbQZxo/SZT imxyy-ace5"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKALTBn/QSGcSPgMg0ViSazFcaA0+nEF05EJpjbsI6dE imxyy_soope_@imxyy-cloudwin"
+
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIENauvvhVMLsUwH9cPYsvnOg7VCL3a4yEiKm8I524TE efl@efl-nix"
     ];
   };

config/hosts/imxyy-nix-server/code.nix

@@ -0,0 +1,38 @@
+{ config, ... }:
+{
+  services.postgresql.ensureUsers = [
+    {
+      name = "coder";
+      ensureDBOwnership = true;
+    }
+  ];
+  services.postgresql.ensureDatabases = [ "coder" ];
+  virtualisation.oci-containers = {
+    containers = {
+      coder = {
+        image = "ghcr.io/coder/coder:latest";
+        environment = {
+          CODER_ACCESS_URL = "https://coder.imxyy.top";
+          CODER_HTTP_ADDRESS = "0.0.0.0:8086";
+          CODER_PG_CONNECTION_URL = "postgresql://coder:coderdatabase@127.0.0.1/coder?sslmode=disable";
+        };
+        extraOptions = [
+          "--network=host"
+          "--group-add=${toString config.users.groups.podman.gid}"
+        ];
+        volumes = [
+          "/var/lib/coder:/home/coder/.config"
+          "/var/run/docker.sock:/var/run/docker.sock"
+        ];
+        ports = [ "8086:8086" ];
+      };
+    };
+  };
+  services.caddy.virtualHosts."coder.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8086 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+}

config/hosts/imxyy-nix-server/default.nix

@@ -0,0 +1,27 @@
+{
+  imports = [
+    ./nixos.nix
+    ./hardware.nix
+    ./home.nix
+    ./virt.nix
+    ./docker.nix
+    ./minecraft.nix
+    ./samba.nix
+    ./net.nix
+    ./caddy.nix
+    ./nextcloud.nix
+    ./mail.nix
+    ./gitea.nix
+    ./vault.nix
+    ./homepage.nix
+    ./code.nix
+    ./yesplaymusic.nix
+    ./ai.nix
+    ./grafana.nix
+    ./note.nix
+    ./matrix.nix
+    ./minio.nix
+    ./build.nix
+    ./immich.nix
+  ];
+}

config/hosts/imxyy-nix-server/docker.nix

@@ -5,10 +5,5 @@
     enable = true;
     dockerCompat = true;
     dockerSocket.enable = true;
-    defaultNetwork.settings.dns_enabled = true;
-  };
-  # avoid collision with dnsmasq
-  virtualisation.containers = {
-    containersConf.settings.network.dns_bind_port = 5353;
   };
 }

config/hosts/imxyy-nix-server/grafana.nix

@@ -1,3 +1,4 @@
+{ pkgs, ... }:
 {
   services.grafana = {
     enable = true;
@@ -11,6 +12,7 @@
   };
   services.prometheus = {
     enable = true;
+    package = pkgs.stable.prometheus;
     port = 8091;
     exporters = {
       node = {

config/hosts/imxyy-nix-server/hardware.nix

@@ -18,18 +18,15 @@ in
   ];
   boot.initrd.kernelModules = [ "amdgpu" ];
   boot.kernelModules = [ "kvm-amd" ];
-  boot.kernelPackages = lib.mkForce pkgs.linuxPackages_xanmod_stable;
+  boot.kernelPackages = lib.mkForce pkgs.linuxPackages_cachyos;
-  services.scx = {
+  services.scx.enable = true;
-    enable = true;
-    scheduler = "scx_rusty";
-  };
   boot.extraModulePackages = [ ];
   boot.tmp.useTmpfs = true;
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs = {
-    package = pkgs.zfs_unstable;
     extraPools = [ "data" ];
     forceImportRoot = false;
+    package = pkgs.zfs_cachyos;
   };
   services.zfs.autoScrub.enable = true;
   services.btrfs.autoScrub.enable = true;

config/hosts/imxyy-nix-server/home.nix

@@ -1,14 +1,11 @@
-{ lib, ... }:
+{ ... }:
 {
   my = {
     cli.all.enable = true;
-    cli.media.all.enable = lib.mkForce false;
     coding.editor.neovim.enable = true;
     coding.misc.enable = true;
     coding.langs.lua.enable = true;
     coding.langs.rust.enable = true;
-    coding.langs.js.enable = true;
-    fonts.enable = lib.mkForce false;
     persist = {
       enable = true;
       homeDirs = [

config/hosts/imxyy-nix-server/homepage.nix

@@ -0,0 +1,18 @@
+{
+  virtualisation.oci-containers = {
+    containers = {
+      sun-panel = {
+        image = "hslr/sun-panel:latest";
+        volumes = [
+          "/var/lib/sun-panel:/app/conf"
+        ];
+        ports = [ "8085:3002" ];
+      };
+    };
+  };
+  services.caddy.virtualHosts."home.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8085
+    '';
+  };
+}

config/hosts/imxyy-nix-server/immich.nix

@@ -1,9 +1,5 @@
 { ... }:
 {
-  users.users.immich = {
-    home = "/mnt/nas/immich";
-    createHome = true;
-  };
   services.immich = {
     enable = true;
     host = "127.0.0.1";

config/hosts/imxyy-nix-server/matrix.nix

@@ -0,0 +1,46 @@
+{
+  services.matrix-synapse = {
+    enable = true;
+    settings = {
+      server_name = "matrix.imxyy.top";
+      public_baseurl = "https://matrix.imxyy.top";
+      listeners = [
+        {
+          port = 8094;
+          bind_addresses = [ "127.0.0.1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [
+            {
+              names = [
+                "client"
+                "federation"
+              ];
+              compress = true;
+            }
+          ];
+        }
+      ];
+      turn_uris = [ "turns:vkvm.imxyy.top:5349" ];
+      turn_shared_secret = "ac779a48c03bb451839569d295a29aa6ab8c264277bec2df9c9c7f5e22936288";
+      turn_user_lifetime = "1h";
+      database_type = "psycopg2";
+      database_args.database = "matrix-synapse";
+    };
+    extraConfigFiles = [
+      "/var/lib/matrix-synapse/secret"
+    ];
+  };
+  services.caddy.virtualHosts."matrix.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8094
+      handle_path /_matrix {
+        reverse_proxy :8094
+      }
+      handle_path /_synapse/client {
+        reverse_proxy :8094
+      }
+    '';
+  };
+}

config/hosts/imxyy-nix-server/minecraft.nix

@@ -8,10 +8,9 @@
       WorkingDirectory = "/opt/minecraft/fabric1.20.6";
       ExecStart = "${lib.getExe' pkgs.openjdk21 "java"} -Xms1G -Xmx5G -jar fabric-server-mc.1.20.6-loader.0.15.11-launcher.1.0.1.jar";
       Restart = "always";
-      RestartSec = 120;
+      RestartSec = "10s";
     };
   };
-
   my.persist = {
     nixosDirs = [
       "/opt/minecraft"

config/hosts/imxyy-nix-server/minio.nix

@@ -1,8 +1,7 @@
-{ config, secrets, ... }:
+{ config, sopsRoot, ... }:
 {
   sops.secrets.minio-env = {
-    sopsFile = secrets.minio;
+    sopsFile = sopsRoot + /minio.env;
-    restartUnits = [ "minio.service" ];
     format = "dotenv";
   };
   services.minio = {
@@ -17,4 +16,11 @@
     ];
     rootCredentialsFile = config.sops.secrets.minio-env.path;
   };
+  services.caddy.virtualHosts."minio.imxyy.top" = {
+    extraConfig = ''
+      handle_path /* {
+          reverse_proxy :9000
+      }
+    '';
+  };
 }

config/hosts/imxyy-nix-server/net.nix

@@ -0,0 +1,592 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  sopsRoot,
+  ...
+}:
+{
+  boot.kernelParams = [
+    "biosdevname=0"
+    "net.ifnames=0"
+  ];
+  networking = {
+    useDHCP = lib.mkForce false;
+    dhcpcd = {
+      wait = "background";
+      IPv6rs = true;
+      extraConfig = ''
+        interface mac0
+          noipv4
+      '';
+    };
+    interfaces = {
+      eth0.wakeOnLan.enable = true;
+      eth1.wakeOnLan.enable = true;
+      mac0 = {
+        useDHCP = true;
+        ipv4.addresses = [
+          {
+            address = "192.168.3.2";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+    macvlans."mac0" = {
+      interface = "eth0";
+      mode = "bridge";
+    };
+    defaultGateway = {
+      address = "192.168.3.1";
+      interface = "mac0";
+    };
+    nameservers = [
+      "192.168.3.2"
+    ];
+
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      flushRuleset = true;
+      ruleset = ''
+        table inet firewall {
+          set LANv4 {
+            type ipv4_addr
+            flags interval
+
+            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
+          }
+          set LANv6 {
+            type ipv6_addr
+            flags interval
+
+            elements = { fd00::/8, fe80::/10 }
+          }
+          set tcp_ports {
+            type inet_service
+            flags interval
+
+            elements = {
+              http,
+              https,
+              2222,
+              25565
+            }
+          }
+
+          chain prerouting {
+            type filter hook prerouting priority mangle; policy accept;
+
+            ip daddr @LANv4 accept
+            ip6 daddr @LANv6 accept
+          }
+
+          chain output {
+            type filter hook output priority 100; policy accept;
+
+            ip daddr @LANv4 accept
+            ip6 daddr @LANv6 accept
+          }
+
+          chain input {
+            type filter hook input priority 0; policy drop;
+            iif lo accept
+            ct state invalid drop
+            ct state established,related accept
+
+            ip protocol { icmp, igmp } accept
+
+            ip saddr @LANv4 accept
+            ip6 saddr @LANv6 accept
+
+            tcp dport 2222 ct state new limit rate 15/minute counter accept
+
+            tcp dport @tcp_ports counter accept
+          }
+
+          chain forward {
+            type filter hook forward priority 0; policy accept;
+          }
+
+          chain nat {
+            type nat hook postrouting priority 0; policy accept;
+            ip saddr 192.168.3.0/24 masquerade
+          }
+        }
+      '';
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      # PermitRootLogin = "yes";
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = true;
+    };
+  };
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWOy0QmAyxENg/O5m3cus8U3c9jCLioivwcWsh5/a82 imxyy-hisense-pad"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8pivvE8PMtsOxmccfNhH/4KehDKhBfUfJbQZxo/SZT imxyy-ace5"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKALTBn/QSGcSPgMg0ViSazFcaA0+nEF05EJpjbsI6dE imxyy_soope_@imxyy-cloudwin"
+  ];
+  users.users.${username}.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWOy0QmAyxENg/O5m3cus8U3c9jCLioivwcWsh5/a82 imxyy-hisense-pad"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8pivvE8PMtsOxmccfNhH/4KehDKhBfUfJbQZxo/SZT imxyy-ace5"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKALTBn/QSGcSPgMg0ViSazFcaA0+nEF05EJpjbsI6dE imxyy_soope_@imxyy-cloudwin"
+  ];
+
+  sops.secrets.dae-imxyy-nix-server = {
+    sopsFile = sopsRoot + /dae-imxyy-nix-server.dae;
+    format = "binary";
+  };
+  services.dae = {
+    enable = true;
+    configFile = config.sops.secrets.dae-imxyy-nix-server.path;
+  };
+  systemd.services.dae.after = [ "sops-nix.service" ];
+  sops.secrets.mihomo = {
+    sopsFile = sopsRoot + /mihomo.yaml;
+    format = "yaml";
+    key = "";
+  };
+  systemd.services.mihomo.after = [ "sops-nix.service" ];
+  services.mihomo = {
+    enable = true;
+    configFile = config.sops.secrets.mihomo.path;
+    webui = pkgs.metacubexd;
+  };
+
+  sops.secrets.frp-env = {
+    sopsFile = sopsRoot + /frp.env;
+    format = "dotenv";
+  };
+  systemd.services.frp.serviceConfig.EnvironmentFile = [
+    config.sops.secrets.frp-env.path
+  ];
+  services.frp = {
+    enable = true;
+    role = "client";
+    settings = {
+      serverAddr = "hk.vkvm.imxyy.top";
+      serverPort = 7000;
+      auth.token = "{{ .Envs.FRP_AUTH_TOKEN }}";
+      proxies = [
+        {
+          name = "nextcloud-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "nextcloud.imxyy.top" ];
+        }
+        {
+          name = "nextcloud-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "nextcloud.imxyy.top" ];
+        }
+
+        {
+          name = "oidc-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "oidc.imxyy.top" ];
+        }
+        {
+          name = "oidc-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "oidc.imxyy.top" ];
+        }
+        {
+          name = "headscale-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "headscale.imxyy.top" ];
+        }
+        {
+          name = "headscale-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "headscale.imxyy.top" ];
+        }
+
+        {
+          name = "mail-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "mail.imxyy.top" ];
+        }
+        {
+          name = "mail-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "mail.imxyy.top" ];
+        }
+
+        {
+          name = "gitea-ssh";
+          type = "tcp";
+          localIP = "127.0.0.1";
+          localPort = 2222;
+          remotePort = 2222;
+        }
+        {
+          name = "gitea-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "git.imxyy.top" ];
+        }
+        {
+          name = "gitea-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "git.imxyy.top" ];
+        }
+
+        {
+          name = "vault-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "vault.imxyy.top" ];
+        }
+        {
+          name = "vault-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "vault.imxyy.top" ];
+        }
+
+        {
+          name = "home-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "home.imxyy.top" ];
+        }
+        {
+          name = "home-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "home.imxyy.top" ];
+        }
+
+        {
+          name = "coder-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "coder.imxyy.top" ];
+        }
+        {
+          name = "coder-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "coder.imxyy.top" ];
+        }
+
+        {
+          name = "music-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "music.imxyy.top" ];
+        }
+        {
+          name = "music-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "music.imxyy.top" ];
+        }
+
+        {
+          name = "ai-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "ai.imxyy.top" ];
+        }
+        {
+          name = "ai-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "ai.imxyy.top" ];
+        }
+
+        {
+          name = "grafana-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "grafana.imxyy.top" ];
+        }
+        {
+          name = "grafana-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "grafana.imxyy.top" ];
+        }
+
+        {
+          name = "note-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "note.imxyy.top" ];
+        }
+        {
+          name = "note-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "note.imxyy.top" ];
+        }
+
+        {
+          name = "siyuan-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "sy.imxyy.top" ];
+        }
+        {
+          name = "siyuan-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "sy.imxyy.top" ];
+        }
+
+        {
+          name = "matrix-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "matrix.imxyy.top" ];
+        }
+        {
+          name = "matrix-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "matrix.imxyy.top" ];
+        }
+
+        {
+          name = "immich-http";
+          type = "http";
+          localIP = "127.0.0.1";
+          localPort = 80;
+          customDomains = [ "immich.imxyy.top" ];
+        }
+        {
+          name = "immich-https";
+          type = "https";
+          localIP = "127.0.0.1";
+          localPort = 443;
+          customDomains = [ "immich.imxyy.top" ];
+        }
+
+        {
+          name = "minecraft";
+          type = "tcp";
+          localIP = "127.0.0.1";
+          localPort = 25565;
+          remotePort = 25565;
+        }
+      ];
+    };
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+    extraSetFlags = [ "--accept-dns=false" ];
+  };
+  services.headscale = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 8080;
+    settings = {
+      logtail.enabled = false;
+      server_url = "https://headscale.imxyy.top";
+      dns.magic_dns = false;
+      dns.override_local_dns = false;
+      ip_prefixes = "100.64.0.0/10";
+
+      oidc = {
+        only_start_if_oidc_is_available = true;
+        issuer = "https://oidc.imxyy.top";
+        client_id = "https://headscale.imxyy.top";
+        allowed_domains = [
+          "imxyy.top"
+          "*.imxyy.top"
+        ];
+        client_secret = "";
+        expiry = 0;
+        extra_params.domain_hint = "imxyy.top";
+      };
+    };
+  };
+  systemd.services."headscale" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
+    };
+    after = [
+      "podman-obligator.service"
+    ];
+    requires = [
+      "podman-obligator.service"
+    ];
+  };
+
+  sops.secrets.et-imxyy-nix-server = {
+    sopsFile = sopsRoot + /et-imxyy-nix-server.toml;
+    format = "binary";
+  };
+  environment.systemPackages = [ pkgs.easytier ];
+  systemd.services."easytier" = {
+    enable = true;
+    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-server.path}";
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
+      User = "root";
+    };
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "network.target"
+      "sops-nix.service"
+    ];
+  };
+
+  virtualisation.oci-containers = {
+    containers = {
+      obligator = {
+        image = "anderspitman/obligator:latest";
+        volumes = [
+          "/var/lib/obligator:/data"
+          "/var/lib/obligator:/api"
+        ];
+        ports = [ "8081:1616" ];
+        cmd = [
+          "-storage-dir"
+          "/data"
+          "-api-socket-dir"
+          "/api"
+          "-root-uri"
+          "https://oidc.imxyy.top"
+          "-port"
+          "1616"
+        ];
+      };
+    };
+  };
+  services.caddy.virtualHosts."headscale.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8080 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+  services.caddy.virtualHosts."oidc.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8081 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+
+  systemd.services.ddns-go =
+    let
+      ddns-go = pkgs.buildGoModule rec {
+        pname = "ddns-go";
+        version = "6.6.7";
+        src = pkgs.fetchFromGitHub {
+          owner = "jeessy2";
+          repo = "ddns-go";
+          rev = "v${version}";
+          hash = "sha256-Ejoe6e9GFhHxQ9oIBDgDRQW9Xx1XZK+qSAXiRXLdn+c=";
+        };
+        meta.mainProgram = "ddns-go";
+        vendorHash = "sha256-XZii7gV3DmTunYyGYzt5xXhv/VpTPIoYKbW4LnmlAgs=";
+        doCheck = false;
+      };
+    in
+    {
+      description = "Go Dynamic DNS";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${lib.getExe ddns-go} -l :9876 -f 10 -cacheTimes 180 -c /var/lib/ddns-go/config.yaml";
+        Restart = "always";
+        RestartSec = 120;
+      };
+      path = [
+        pkgs.bash
+      ];
+    };
+
+  services.dnsmasq =
+    let
+      subDomains = [
+        "home"
+        "nextcloud"
+        "mail"
+        "git"
+        "vault"
+        "coder"
+        "headscale"
+        "grafana"
+        "matrix"
+        "note"
+        "oidc"
+        "mc"
+        "music"
+        "ai"
+        "sy"
+        "minio"
+      ];
+    in
+    {
+      enable = true;
+      resolveLocalQueries = false;
+      settings = {
+        server = [
+          "120.53.53.53"
+          "223.5.5.5"
+        ];
+        address = map (sub: "/${sub}.imxyy.top/192.168.3.2") subDomains ++ [
+          "/imxyy-nix-server/192.168.3.2"
+          "/imxyy-cloudwin/192.168.3.4"
+          "/printer.home/192.168.3.53"
+        ];
+        cache-size = 0;
+      };
+    };
+}

config/hosts/imxyy-nix-server/nextcloud.nix

@@ -17,9 +17,9 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud31;
     extraApps = {
-      inherit (pkgs.nextcloud32.packages.apps)
+      inherit (pkgs.nextcloud31.packages.apps)
         bookmarks
         previewgenerator
         spreed
@@ -31,26 +31,20 @@ in
     hostName = nextcloud;
     home = "/mnt/nas/nextcloud";
     https = true;
+    nginx.recommendedHttpHeaders = true;
     caching.redis = true;
     configureRedis = true;
     database.createLocally = true;
-    notify_push.enable = true;
     config = {
       dbtype = "pgsql";
       adminpassFile = toString (pkgs.writeText "nextcloud-pass" "admin12345!");
       adminuser = "admin";
     };
-    settings = {
+    settings.trusted_domains = [
-      trusted_domains = [
       hostname
       "192.168.3.2"
       "10.0.0.1"
     ];
-      trusted_proxies = [
-        "127.0.0.1"
-        "192.168.3.0/24"
-      ];
-    };
     phpExtraExtensions =
       all: with all; [
         pdlib
@@ -59,7 +53,7 @@ in
     phpOptions = {
       "opcache.enable" = 1;
       "opcache.enable_cli" = 1;
-      "opcache.interned_strings_buffer" = 23;
+      "opcache.interned_strings_buffer" = 8;
       "opcache.max_accelerated_files" = 10000;
       "opcache.memory_consumption" = 128;
       "opcache.save_comments" = 1;
@@ -100,12 +94,9 @@ in
   */
   services.caddy.virtualHosts."nextcloud.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy http://127.0.0.1:8084 {
+      reverse_proxy :8084 {
-        trusted_proxies 192.168.3.0/24
+        header_up X-Real-IP {remote_host}
       }
-
-      redir /.well-known/carddav /remote.php/dav/ 301
-      redir /.well-known/caldav /remote.php/dav/ 301
     '';
   };
 

config/hosts/imxyy-nix-server/nixos.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  config,
+  username,
+  sopsRoot,
+  ...
+}:
+{
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+    grub.enable = false;
+    timeout = 0;
+  };
+
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+
+  systemd.services.nix-daemon = {
+    environment.TMPDIR = "/var/cache/nix";
+    serviceConfig.CacheDirectory = "nix";
+  };
+  environment.variables.NIX_REMOTE = "daemon";
+
+  sops.secrets.imxyy-nix-server-hashed-password = {
+    sopsFile = sopsRoot + /imxyy-nix-server-hashed-password.txt;
+    format = "binary";
+    neededForUsers = true;
+  };
+  users.users.${username}.hashedPasswordFile =
+    lib.mkForce config.sops.secrets.imxyy-nix-server-hashed-password.path;
+  users.users.root.hashedPasswordFile = lib.mkForce config.sops.secrets.imxyy-nix-server-hashed-password.path;
+}

config/hosts/imxyy-nix-server/note.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  sopsRoot,
+  ...
+}:
+{
+  sops.secrets = {
+    flatnote-env = {
+      sopsFile = sopsRoot + /flatnote.env;
+      format = "dotenv";
+    };
+    siyuan-env = {
+      sopsFile = sopsRoot + /siyuan.env;
+      format = "dotenv";
+    };
+  };
+  virtualisation.oci-containers = {
+    containers = {
+      flatnotes = {
+        image = "dullage/flatnotes:latest";
+        volumes = [
+          "/mnt/nas/flatnotes/data:/data"
+        ];
+        environmentFiles = [
+          "${config.sops.secrets.flatnote-env.path}"
+        ];
+        ports = [ "8093:8080" ];
+      };
+      siyuan = {
+        image = "apkdv/siyuan-unlock:v3.1.30";
+        volumes = [
+          "/mnt/nas/siyuan/workspace:/workspace"
+          "/mnt/nas/siyuan:/home/siyuan"
+        ];
+        cmd = [
+          "--workspace=/workspace"
+        ];
+        environment = {
+          PUID = "0";
+          PGID = "0";
+        };
+        environmentFiles = [
+          "${config.sops.secrets.siyuan-env.path}"
+        ];
+        ports = [ "8095:6806" ];
+      };
+    };
+  };
+  services.caddy.virtualHosts = {
+    "note.imxyy.top" = {
+      extraConfig = ''
+        reverse_proxy :8093
+      '';
+    };
+    "sy.imxyy.top" = {
+      extraConfig = ''
+        reverse_proxy :8095
+      '';
+    };
+  };
+}

config/hosts/imxyy-nix-server/samba.nix

@@ -9,7 +9,7 @@
       };
       share = {
         path = "/mnt/nas/share";
-        browsable = "yes";
+        browseable = "yes";
         "read only" = "no";
         "guest ok" = "no";
         "create mask" = "0664";

config/hosts/imxyy-nix-server/vault.nix

@@ -1,8 +1,7 @@
-{ config, secrets, ... }:
+{ config, sopsRoot, ... }:
 {
   sops.secrets.vaultwarden-env = {
-    sopsFile = secrets.vaultwarden;
+    sopsFile = sopsRoot + /vaultwarden.env;
-    restartUnits = [ "vaultwarden.service" ];
     format = "dotenv";
   };
   services.postgresql.ensureUsers = [

config/hosts/imxyy-nix-server/virt.nix

@@ -13,7 +13,7 @@ let
 in
 {
   boot = {
-    initrd.kernelModules = lib.mkBefore [
+    initrd.kernelModules = [
       "vfio_pci"
       "vfio"
       "vfio_iommu_type1"

config/hosts/imxyy-nix-server/yesplaymusic.nix

@@ -0,0 +1,23 @@
+{
+  virtualisation.oci-containers.containers."YesPlayMusic" = {
+    image = "git.imxyy.top/imxyy1soope1/yesplaymusic:latest";
+    environment = {
+      "NODE_TLS_REJECT_UNAUTHORIZED" = "0";
+    };
+    volumes = [
+      "/etc/localtime:/etc/localtime:ro"
+    ];
+    ports = [
+      "8088:80/tcp"
+    ];
+    log-driver = "journald";
+  };
+
+  services.caddy.virtualHosts."music.imxyy.top" = {
+    extraConfig = ''
+      reverse_proxy :8088 {
+        header_up X-Real-IP {remote_host}
+      }
+    '';
+  };
+}

config/hosts/imxyy-nix-wsl/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./nixos.nix
+    ./home.nix
+  ];
+}

config/hosts/imxyy-nix-wsl/home.nix

@@ -0,0 +1,14 @@
+{ lib, username, ... }:
+{
+  my.home.programs.zsh.shellAliases = {
+    localproxy_on = "export http_proxy=http://192.168.128.1:7890 https_proxy=http://192.168.128.1:7890 all_proxy=socks://192.168.128.1:7890";
+  };
+  my = {
+    sops.sshKeyPath = "/home/${username}/.ssh/id_ed25519";
+    coding.all.enable = true;
+    coding.editor.vscode.enable = lib.mkForce false;
+    cli.misc.enable = true;
+    xdg.enable = true;
+    cli.media.all.enable = true;
+  };
+}

config/hosts/imxyy-nix-x16/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./nixos.nix
+    ./hardware.nix
+    ./home.nix
+    ./net.nix
+  ];
+}

config/hosts/imxyy-nix-x16/hardware.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  username,
   ...
 }:
 let
@@ -21,7 +22,7 @@ in
       verbose = false;
     };
 
-    kernelPackages = lib.mkForce pkgs.linuxPackages_xanmod_latest;
+    kernelPackages = lib.mkForce pkgs.linuxPackages_cachyos;
     kernelModules = [ "kvm-amd" ];
 
     tmp.useTmpfs = true;
@@ -29,10 +30,7 @@ in
       "fs.file-max" = 9223372036854775807;
     };
   };
-  services.scx = {
+  services.scx.enable = true;
-    enable = true;
-    scheduler = "scx_rusty";
-  };
 
   fileSystems."/" = {
     device = btrfs;

config/hosts/imxyy-nix-x16/home.nix

@@ -1,53 +1,43 @@
 {
   config,
+  lib,
   pkgs,
   username,
   ...
 }:
 {
-  my.hm = {
+  my.home = {
     home.packages = with pkgs; [
       localsend
 
+      rclone
+
       wpsoffice-cn
       wps-office-fonts
       ttf-wps-fonts
-      papers
+      evince
 
       anki
 
       ayugram-desktop
+      telegram-desktop
       signal-desktop
-      element-desktop
+      discord
-      fractal
       qq
       wechat
 
       gnome-clocks
+
+      wineWowPackages.waylandFull
+
+      pavucontrol
+      pamixer
     ];
     programs.zsh = {
       sessionVariables = {
         PATH = "/home/${username}/bin:$PATH";
       };
     };
-    programs.fish.interactiveShellInit = ''
-      set -gp PATH $HOME/bin
-    '';
-
-    programs.niri.settings = {
-      environment.STEAM_FORCE_DESKTOPUI_SCALING = "1.25";
-      outputs = {
-        eDP-1 = {
-          enable = true;
-          mode = {
-            width = 1920;
-            height = 1200;
-            refresh = 60.002;
-          };
-          scale = 1.25;
-        };
-      };
-    };
   };
 
   my = {
@@ -55,7 +45,8 @@
     cli.all.enable = true;
     coding.all.enable = true;
     desktop.all.enable = true;
-    virt.moonlight.enable = true;
+
+    desktop.browser.librewolf.enable = lib.mkForce false;
 
     i18n.fcitx5.enable = true;
 
@@ -63,14 +54,14 @@
       enable = true;
       defaultApplications =
         let
-          browser = [ config.my.desktop.browser.default.desktop ];
+          browser = [ "zen-beta.desktop" ];
           editor = [ "codium.desktop" ];
           imageviewer = [ "org.gnome.Shotwell-Viewer.desktop" ];
         in
         {
-          "inode/directory" = [ "org.gnome.Nautilus.desktop" ];
+          "inode/directory" = [ "nemo.desktop" ];
 
-          "application/pdf" = [ "org.gnome.Papers.desktop" ];
+          "application/pdf" = [ "org.gnome.Evince.desktop" ];
 
           "text/*" = editor;
           "application/json" = editor;
@@ -101,6 +92,15 @@
           "image/png" = imageviewer;
           "image/webp" = imageviewer;
         };
+      extraBookmarks =
+        let
+          homedir = config.my.home.home.homeDirectory;
+        in
+        [
+          "file://${homedir}/NAS NAS"
+          "file://${homedir}/NAS/imxyy_soope_ NAS imxyy_soope_"
+          "file://${homedir}/NAS/imxyy_soope_/OS NAS OS"
+        ];
     };
     persist = {
       enable = true;
@@ -118,26 +118,23 @@
         ".local/state"
         ".local/share/Anki2"
         ".local/share/shotwell"
+        ".local/share/cheat.sh"
         ".local/share/Kingsoft"
 
         ".local/share/AyuGramDesktop"
-        ".local/share/fractal"
+        ".local/share/TelegramDesktop"
         ".config/Signal"
-        ".config/Element"
+        ".config/discord"
         ".config/QQ"
         ".xwechat"
 
         ".config/Kingsoft"
         ".config/dconf"
+        ".config/gh"
+        ".config/pulse"
         ".config/pip"
+        ".config/libreoffice"
         ".config/sunshine"
-
-        ".gemini"
-        ".claude"
-        ".claude-code-router"
-      ];
-      homeFiles = [
-        ".claude.json"
       ];
     };
   };

config/hosts/imxyy-nix-x16/net.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  sopsRoot,
+  ...
+}:
+{
+  boot.kernelParams = [
+    "biosdevname=0"
+    "net.ifnames=0"
+  ];
+  networking.networkmanager.enable = true;
+
+  sops.secrets.dae-imxyy-nix-x16 = {
+    sopsFile = sopsRoot + /dae-imxyy-nix-x16.dae;
+    format = "binary";
+  };
+  services.dae = {
+    enable = true;
+    configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
+  };
+  systemd.services.dae.after = [ "sops-nix.service" ];
+  sops.secrets.mihomo = {
+    sopsFile = sopsRoot + /mihomo.yaml;
+    format = "yaml";
+    key = "";
+  };
+  systemd.services.mihomo.after = [ "sops-nix.service" ];
+  services.mihomo = {
+    enable = true;
+    configFile = config.sops.secrets.mihomo.path;
+    webui = pkgs.metacubexd;
+  };
+
+  sops.secrets.et-imxyy-nix-x16 = {
+    sopsFile = sopsRoot + /et-imxyy-nix-x16.toml;
+    format = "binary";
+  };
+  environment.systemPackages = with pkgs; [
+    easytier
+  ];
+  systemd.services."easytier" = {
+    enable = true;
+    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-x16.path}";
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
+      User = "root";
+    };
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "network.target"
+      "sops-nix.service"
+    ];
+  };
+}

config/hosts/imxyy-nix-x16/nixos.nix

@@ -0,0 +1,175 @@
+{
+  lib,
+  pkgs,
+  config,
+  username,
+  sopsRoot,
+  ...
+}:
+{
+  security.pam.loginLimits = [
+    {
+      domain = "*";
+      type = "soft";
+      item = "nofile";
+      value = "524288";
+    }
+  ];
+
+  boot.kernelParams = [
+    "usbcore.autosuspend=-1" # Avoid usb autosuspend (for usb bluetooth adapter)
+  ];
+
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+    grub.enable = false;
+    timeout = 0;
+  };
+
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+
+  systemd.services.nix-daemon = {
+    environment.TMPDIR = "/var/cache/nix";
+    serviceConfig.CacheDirectory = "nix";
+  };
+  environment.variables.NIX_REMOTE = "daemon";
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = false;
+    alsa.support32Bit = false;
+    pulse.enable = false;
+    audio.enable = false;
+  };
+  services.pulseaudio = {
+    enable = true;
+    support32Bit = true;
+    package = pkgs.pulseaudioFull;
+    extraConfig = ''
+      load-module module-switch-on-connect
+      unload-module module-suspend-on-idle
+    '';
+  };
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        Enable = "Source,Sink,Media,Socket";
+        Disable = "HeadSet";
+        MultiProfile = "multiple";
+      };
+    };
+  };
+  users.extraUsers.${username}.extraGroups = [ "audio" ];
+
+  fonts = {
+    enableDefaultPackages = false;
+    fontDir.enable = true;
+
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-emoji
+
+      jetbrains-mono
+
+      nerd-fonts.symbols-only
+    ];
+
+    fontconfig.defaultFonts = {
+      serif = [
+        "Noto Serif CJK SC"
+        "Noto Serif"
+        "Symbols Nerd Font"
+      ];
+      sansSerif = [
+        "Noto Sans CJK SC"
+        "Noto Sans"
+        "Symbols Nerd Font"
+      ];
+      monospace = [
+        "JetBrains Mono"
+        "Noto Sans Mono CJK SC"
+        "Symbols Nerd Font Mono"
+      ];
+      emoji = [ "Noto Color Emoji" ];
+    };
+  };
+
+  services.printing.enable = true;
+
+  services.keyd = {
+    enable = true;
+    keyboards.default.settings = {
+      main = {
+        capslock = "overload(control, esc)";
+        home = "end";
+      };
+      shift = {
+        home = "home";
+      };
+      control = {
+        delete = "print";
+      };
+    };
+  };
+
+  services.gvfs.enable = true;
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      # Forbid root login through SSH.
+      PermitRootLogin = null;
+      PasswordAuthentication = true;
+    };
+  };
+
+  environment.systemPackages = [
+    pkgs.rclone
+  ];
+
+  sops.secrets.imxyy-nix-rclone = {
+    sopsFile = sopsRoot + /imxyy-nix-rclone.conf;
+    format = "binary";
+  };
+  fileSystems = {
+    "/home/${username}/Nextcloud" = {
+      device = "Nextcloud:";
+      fsType = "rclone";
+      options = [
+        "nodev"
+        "nofail"
+        "allow_other"
+        "args2env"
+        "config=${config.sops.secrets.imxyy-nix-rclone.path}"
+        "uid=1000"
+        "gid=100"
+        "rw"
+        "no-check-certificate"
+        "vfs-cache-mode=full"
+      ];
+    };
+    "/home/${username}/NAS" = {
+      device = "//10.0.0.1/share";
+      fsType = "cifs";
+      options = [
+        "username=nas"
+        "password=nasshare"
+        "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"
+        "nodev"
+        "nofail"
+        "uid=1000"
+        "gid=100"
+        "vers=3"
+        "rw"
+      ];
+    };
+  };
+
+  my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
+}

config/hosts/imxyy-nix/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./nixos.nix
+    ./hardware.nix
+    ./home.nix
+    ./virt.nix
+    ./net.nix
+  ];
+}

config/hosts/imxyy-nix/hardware.nix

@@ -23,7 +23,7 @@ in
       verbose = false;
     };
 
-    kernelPackages = lib.mkForce pkgs.linuxPackages_xanmod_latest;
+    kernelPackages = lib.mkForce pkgs.linuxPackages_cachyos;
     kernelModules = [ "kvm-amd" ];
 
     tmp.useTmpfs = true;
@@ -36,10 +36,7 @@ in
       "resume_offset=6444127"
     ];
   };
-  services.scx = {
+  services.scx.enable = true;
-    enable = true;
-    scheduler = "scx_rusty";
-  };
 
   fileSystems."/" = {
     device = btrfs;

config/hosts/imxyy-nix/home.nix

@@ -1,57 +1,59 @@
 {
   config,
+  lib,
   pkgs,
   username,
   ...
 }:
 {
-  my.hm = {
+  my.home = {
     home.packages = with pkgs; [
       localsend
 
+      rclone
+
       wpsoffice-cn
       wps-office-fonts
       ttf-wps-fonts
-      papers
+      evince
 
       anki
 
       ayugram-desktop
+      telegram-desktop
       signal-desktop
-      element-desktop
+      discord
-      fractal
       qq
       wechat
 
       gnome-clocks
+
+      wineWowPackages.waylandFull
+
+      pavucontrol
+      pamixer
     ];
     programs.zsh = {
       shellAliases = {
-        cageterm = "cage -m DP-1 -s -- alacritty -o font.size=20";
+        cageterm = "cage -m DP-2 -s -- alacritty -o font.size=20";
-        cagefoot = "cage -m DP-1 -s -- foot --font=monospace:size=20";
+        cagefoot = "cage -m DP-2 -s -- foot --font=monospace:size=20";
-        cagekitty = "cage -m DP-1 -s -- kitty -o font_size=20";
+        cagekitty = "cage -m DP-2 -s -- kitty -o font_size=20";
       };
       sessionVariables = {
         no_proxy = "192.168.3.0/24";
         PATH = "/home/${username}/bin:$PATH";
       };
-    };
+      profileExtra = ''
-    programs.fish = {
+        if [ `tty` = "/dev/tty6" ]; then
-      shellAliases = {
+          clear
-        cageterm = "cage -m DP-1 -s -- alacritty -o font.size=20";
+        fi
-        cagefoot = "cage -m DP-1 -s -- foot --font=monospace:size=20";
-        cagekitty = "cage -m DP-1 -s -- kitty -o font_size=20";
-      };
-      interactiveShellInit = ''
-        set -g no_proxy "192.168.3.0/24"
-        set -gp PATH $HOME/bin
       '';
     };
 
     programs.niri.settings = {
       environment.STEAM_FORCE_DESKTOPUI_SCALING = "1.25";
       outputs = {
-        DP-1 = {
+        DP-2 = {
           enable = true;
           mode = {
             width = 2560;
@@ -64,7 +66,7 @@
             y = 0;
           };
         };
-        DP-2 = {
+        DP-3 = {
           enable = true;
           mode = {
             width = 2560;
@@ -89,20 +91,22 @@
     coding.all.enable = true;
     desktop.all.enable = true;
 
+    desktop.browser.librewolf.enable = lib.mkForce false;
+
     i18n.fcitx5.enable = true;
 
     xdg = {
       enable = true;
       defaultApplications =
         let
-          browser = [ config.my.desktop.browser.default.desktop ];
+          browser = [ "zen-beta.desktop" ];
           editor = [ "codium.desktop" ];
           imageviewer = [ "org.gnome.Shotwell-Viewer.desktop" ];
         in
         {
-          "inode/directory" = [ "org.gnome.Nautilus.desktop" ];
+          "inode/directory" = [ "nemo.desktop" ];
 
-          "application/pdf" = [ "org.gnome.Papers.desktop" ];
+          "application/pdf" = [ "org.gnome.Evince.desktop" ];
 
           "text/*" = editor;
           "application/json" = editor;
@@ -133,6 +137,16 @@
           "image/png" = imageviewer;
           "image/webp" = imageviewer;
         };
+      extraBookmarks =
+        let
+          homedir = config.my.home.home.homeDirectory;
+        in
+        [
+          "file://${homedir}/Documents/%E7%8F%AD%E7%BA%A7%E4%BA%8B%E5%8A%A1 班级事务"
+          "file://${homedir}/NAS NAS"
+          "file://${homedir}/NAS/imxyy_soope_ NAS imxyy_soope_"
+          "file://${homedir}/NAS/imxyy_soope_/OS NAS OS"
+        ];
     };
     persist = {
       enable = true;
@@ -148,26 +162,23 @@
         ".local/state"
         ".local/share/Anki2"
         ".local/share/shotwell"
+        ".local/share/cheat.sh"
         ".local/share/Kingsoft"
 
         ".local/share/AyuGramDesktop"
-        ".local/share/fractal"
+        ".local/share/TelegramDesktop"
         ".config/Signal"
-        ".config/Element"
+        ".config/discord"
         ".config/QQ"
         ".xwechat"
 
         ".config/Kingsoft"
         ".config/dconf"
+        ".config/gh"
+        ".config/pulse"
         ".config/pip"
+        ".config/libreoffice"
         ".config/sunshine"
-
-        ".gemini"
-        ".claude"
-        ".claude-code-router"
-      ];
-      homeFiles = [
-        ".claude.json"
       ];
     };
   };

config/hosts/imxyy-nix/net.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   pkgs,
-  secrets,
+  sopsRoot,
+  username,
   ...
 }:
 {
@@ -69,7 +70,6 @@
           chain input {
             type filter hook input priority 0; policy drop;
             iif lo accept
-            iifname waydroid0 accept
             ct state invalid drop
             ct state established,related accept
 
@@ -79,9 +79,6 @@
 
           chain forward {
             type filter hook forward priority 0; policy drop;
-
-            iifname waydroid0 accept
-            oifname waydroid0 accept
           }
         }
       '';
@@ -89,8 +86,7 @@
   };
 
   sops.secrets.dae-imxyy-nix = {
-    sopsFile = secrets.dae-imxyy-nix;
+    sopsFile = sopsRoot + /dae-imxyy-nix.dae;
-    restartUnits = [ "dae.service" ];
     format = "binary";
   };
   services.dae = {
@@ -99,8 +95,7 @@
   };
   systemd.services.dae.after = [ "sops-nix.service" ];
   sops.secrets.mihomo = {
-    sopsFile = secrets.mihomo;
+    sopsFile = sopsRoot + /mihomo.yaml;
-    restartUnits = [ "mihomo.service" ];
     format = "yaml";
     key = "";
   };
@@ -112,8 +107,7 @@
   };
 
   sops.secrets.et-imxyy-nix = {
-    sopsFile = secrets.et-imxyy-nix;
+    sopsFile = sopsRoot + /et-imxyy-nix.toml;
-    restartUnits = [ "easytier.service" ];
     format = "binary";
   };
   environment.systemPackages = [ pkgs.easytier ];
@@ -121,8 +115,10 @@
     enable = true;
     script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix.path}";
     serviceConfig = {
-      Restart = "always";
+      Restart = lib.mkOverride 500 "always";
-      RestartSec = 30;
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
       User = "root";
     };
     wantedBy = [ "multi-user.target" ];

config/hosts/imxyy-nix/nixos.nix

@@ -0,0 +1,264 @@
+{
+  lib,
+  pkgs,
+  config,
+  username,
+  sopsRoot,
+  ...
+}:
+let
+  btreset = pkgs.writeScriptBin "btreset" ''
+    #!${lib.getExe pkgs.python3}
+
+    import subprocess
+    import os
+    import sys
+
+    SYM = "BT"
+
+    def action(line: str) -> bool:
+        if line.find(SYM) == -1:
+            return False
+        temp = line.split(" ")
+        bus = temp[1]
+        device = temp[3][:-1]
+        subprocess.run(["${lib.getExe usbreset}", f"/dev/bus/usb/{bus}/{device}"])
+        return True
+
+    if __name__ == "__main__":
+        if os.path.exists("/tmp/.btreseted") and len(sys.argv) == 1 and "-f" not in sys.argv[1:]:
+            exit(0)
+        res_byte = subprocess.check_output("/run/current-system/sw/bin/lsusb")
+        res = res_byte.decode()
+        lst = res.split("\n")
+
+        if any(tuple(map(action, lst))):
+            with open("/tmp/.btreseted", "w"):
+                ...
+  '';
+  usbreset = pkgs.writeCBin "usbreset" ''
+    #include <stdio.h>
+    #include <unistd.h>
+    #include <fcntl.h>
+    #include <sys/ioctl.h>
+
+    #include <linux/usbdevice_fs.h>
+
+    int main(int argc, char **argv)
+    {
+        const char *filename;
+        int fd;
+        int rc;
+
+        if (argc != 2) {
+            fprintf(stderr, "Usage: usbreset device-filename\n");
+            return 1;
+        }
+        filename = argv[1];
+
+        fd = open(filename, O_WRONLY);
+        if (fd < 0) {
+            perror("Error opening output file");
+            return 1;
+        }
+
+        printf("Resetting USB device %s\n", filename);
+        rc = ioctl(fd, USBDEVFS_RESET, 0);
+        if (rc < 0) {
+            perror("Error in ioctl");
+            return 1;
+        }
+        printf("Reset successful\n");
+
+        close(fd);
+        return 0;
+    }
+  '';
+in
+{
+  security.pam.loginLimits = [
+    {
+      domain = "*";
+      type = "soft";
+      item = "nofile";
+      value = "524288";
+    }
+  ];
+
+  systemd.services.btreset = {
+    script = lib.getExe btreset;
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.Type = "oneshot";
+  };
+  boot.kernelParams = [
+    "usbcore.autosuspend=-1" # Avoid usb autosuspend (for usb bluetooth adapter)
+    "fsck.mode=skip"
+  ];
+
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+    grub.enable = false;
+    timeout = 0;
+  };
+
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+
+  systemd.services.nix-daemon = {
+    environment.TMPDIR = "/var/cache/nix";
+    serviceConfig.CacheDirectory = "nix";
+  };
+  environment.variables.NIX_REMOTE = "daemon";
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = false;
+    alsa.support32Bit = false;
+    pulse.enable = false;
+    audio.enable = false;
+  };
+  services.pulseaudio = {
+    enable = true;
+    support32Bit = true;
+    package = pkgs.pulseaudioFull;
+    extraConfig = ''
+      load-module module-switch-on-connect
+      unload-module module-suspend-on-idle
+    '';
+  };
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        Enable = "Source,Sink,Media,Socket";
+        Disable = "HeadSet";
+        MultiProfile = "multiple";
+      };
+    };
+  };
+  users.extraUsers.${username}.extraGroups = [ "audio" ];
+
+  fonts = {
+    enableDefaultPackages = false;
+    fontDir.enable = true;
+
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-emoji
+
+      jetbrains-mono
+
+      nerd-fonts.symbols-only
+    ];
+
+    fontconfig.defaultFonts = {
+      serif = [
+        "Noto Serif CJK SC"
+        "Noto Serif"
+        "Symbols Nerd Font"
+      ];
+      sansSerif = [
+        "Noto Sans CJK SC"
+        "Noto Sans"
+        "Symbols Nerd Font"
+      ];
+      monospace = [
+        "JetBrains Mono"
+        "Noto Sans Mono CJK SC"
+        "Symbols Nerd Font Mono"
+      ];
+      emoji = [ "Noto Color Emoji" ];
+    };
+  };
+
+  services.printing.enable = true;
+
+  services.keyd = {
+    enable = true;
+    keyboards.default.settings = {
+      main = {
+        capslock = "overload(control, esc)";
+        home = "end";
+      };
+      shift = {
+        home = "home";
+      };
+      control = {
+        delete = "print";
+      };
+    };
+  };
+
+  services.gvfs.enable = true;
+
+  programs.wireshark.enable = true;
+  programs.wireshark.package = pkgs.wireshark;
+  users.users.${username}.extraGroups = [ "wireshark" ];
+
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true;
+    applications.apps = [
+      {
+        name = "Desktop";
+        image-path = "desktop.png";
+      }
+    ];
+  };
+  services.openssh = {
+    enable = true;
+    settings = {
+      # Forbid root login through SSH.
+      PermitRootLogin = null;
+      PasswordAuthentication = true;
+    };
+  };
+
+  environment.systemPackages = [
+    pkgs.rclone
+    btreset
+  ];
+
+  sops.secrets.imxyy-nix-rclone = {
+    sopsFile = sopsRoot + /imxyy-nix-rclone.conf;
+    format = "binary";
+  };
+  fileSystems = {
+    "/home/${username}/Nextcloud" = {
+      device = "Nextcloud:";
+      fsType = "rclone";
+      options = [
+        "nodev"
+        "nofail"
+        "allow_other"
+        "args2env"
+        "config=${config.sops.secrets.imxyy-nix-rclone.path}"
+        "uid=1000"
+        "gid=100"
+        "rw"
+        "no-check-certificate"
+        "vfs-cache-mode=full"
+      ];
+    };
+    "/home/${username}/NAS" = {
+      device = "//192.168.3.2/share";
+      fsType = "cifs";
+      options = [
+        "username=nas"
+        "password=nasshare"
+        "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"
+        "nodev"
+        "nofail"
+        "uid=1000"
+        "gid=100"
+        "vers=3"
+        "rw"
+      ];
+    };
+  };
+}

flake.nix

@@ -3,141 +3,213 @@
 
   inputs = {
     # Nixpkgs
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/release-25.11";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/release-25.05";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
     # nixpkgs.follows = "nixpkgs-stable";
     nixpkgs.follows = "nixpkgs-unstable";
     # nixpkgs.follows = "nixpkgs-master";
 
+    # Nyxpkgs
+    chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
+
+    # SOPS
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+
     # Home manager
-    home-manager = {
+    home-manager.url = "github:nix-community/home-manager/master";
-      url = "github:nix-community/home-manager/master";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
+
-    };
+    # Impermanence
+    impermanence.url = "github:nix-community/impermanence";
+
+    # NUR
+    nur.url = "github:nix-community/NUR";
+
+    # Niri
+    niri.url = "github:sodiboo/niri-flake";
+    niri.inputs.nixpkgs.follows = "nixpkgs";
+    niri.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
+
+    quickshell.url = "git+https://git.outfoxxed.me/outfoxxed/quickshell";
+    quickshell.inputs.nixpkgs.follows = "nixpkgs";
+
+    darkly.url = "github:Bali10050/Darkly";
+    darkly.inputs.nixpkgs.follows = "nixpkgs";
+
+    stylix.url = "github:danth/stylix";
+    stylix.inputs.nixpkgs.follows = "nixpkgs";
+
+    # go-musicfox
+    go-musicfox.url = "github:imxyy1soope1/go-musicfox/master";
+    go-musicfox.inputs.nixpkgs.follows = "nixpkgs";
 
     # NixOS-WSL
-    nixos-wsl = {
+    nixos-wsl.url = "github:nix-community/NixOS-WSL";
-      url = "github:nix-community/NixOS-WSL";
+    nixos-wsl.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
 
-    # Flake organization tools
+    fenix.url = "github:nix-community/fenix";
-    # keep-sorted start block=yes
+    fenix.inputs.nixpkgs.follows = "nixpkgs";
-    flake-parts = {
-      url = "github:hercules-ci/flake-parts";
-      inputs.nixpkgs-lib.follows = "nixpkgs";
-    };
-    haumea = {
-      url = "github:nix-community/haumea/v0.2.2";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    infuse = {
-      url = "git+https://codeberg.org/amjoseph/infuse.nix";
-      flake = false;
-    };
-    # keep-sorted end
 
-    # Useful modules
-    # keep-sorted start block=yes
-    catppuccin = {
-      url = "github:catppuccin/nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    impermanence.url = "github:nix-community/impermanence";
-    # TODO: sops-nix: remove pr patch once merged
-    # https://github.com/Mic92/sops-nix/pull/779
-    sops-nix = {
-      url = "github:Mic92/sops-nix/pull/779/merge";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    stylix = {
-      url = "github:danth/stylix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    # keep-sorted end
-
-    # Useful software
-    # keep-sorted start block=yes
-    angrr = {
-      url = "github:linyinfeng/angrr";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    darkly = {
-      url = "github:Bali10050/Darkly";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    fenix = {
-      url = "github:nix-community/fenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    go-musicfox = {
-      url = "github:imxyy1soope1/go-musicfox";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    niri.url = "github:sodiboo/niri-flake";
-    noctalia = {
-      url = "github:noctalia-dev/noctalia-shell/v3.8.2";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    zen.inputs.nixpkgs.follows = "nixpkgs";
     zen.url = "github:0xc000022070/zen-browser-flake";
-    # keep-sorted end
+    zen.inputs.nixpkgs.follows = "nixpkgs";
 
-    # Misc
+    infuse.url = "git+https://codeberg.org/amjoseph/infuse.nix";
-    treefmt = {
+    infuse.flake = false;
-      url = "github:numtide/treefmt-nix";
+
-      inputs.nixpkgs.follows = "nixpkgs";
+    haumea.url = "github:nix-community/haumea/v0.2.2";
-    };
+    haumea.inputs.nixpkgs.follows = "nixpkgs";
-    plant = {
-      url = "git+ssh://git@git.imxyy.top:2222/imxyy1soope1/HF-plant.git?rev=08dc0b3889797eb3618c7475c3c367ec0e5fdf40";
-      flake = false;
-    };
-    my-templates.url = "git+https://git.imxyy.top/imxyy1soope1/flake-templates";
   };
 
   outputs =
     {
-      flake-parts,
+      self,
+      nixpkgs,
       ...
     }@inputs:
-    flake-parts.lib.mkFlake
+    let
-      {
+      inherit (self) outputs;
-        inherit inputs;
+      vars = import ./vars.nix;
-        specialArgs.lib = import ./lib {
+      forAllSystems = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed;
-          inherit (inputs.nixpkgs) lib;
+      forAllHosts =
-          inherit inputs;
+        mkSystem:
-        };
+        nixpkgs.lib.attrsets.mergeAttrsList (
+          builtins.map (hostname: {
+            ${hostname} = mkSystem hostname;
+          }) (builtins.attrNames (builtins.readDir ./config/hosts))
+        );
+
+      lib = (import ./lib/stdlib-extended.nix nixpkgs.lib).extend (
+        final: prev: {
+          inherit (inputs.home-manager.lib) hm;
+          inherit infuse;
+          haumea = inputs.haumea.lib;
         }
+      );
+      infuse = (import inputs.infuse { inherit (nixpkgs) lib; }).v1.infuse;
+    in
     {
-        systems = [ "x86_64-linux" ];
+      packages = forAllSystems (
+        system:
+        lib.haumea.load {
+          src = ./pkgs;
+          loader = [
+            {
+              matches = str: builtins.match ".*\\.nix" str != null;
+              loader = _: path: nixpkgs.legacyPackages.${system}.callPackage path { };
+            }
+          ];
+          transformer = lib.haumea.transformers.liftDefault;
+        }
+      );
 
-        imports = [
+      # workaround for "treefmt warning"
-          ./flake/hosts.nix
+      formatter = forAllSystems (
-          ./flake/pkgs.nix
+        system:
-          ./treefmt.nix
+        let
-          ./overlays
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        pkgs.writeShellApplication {
+          name = "nixfmt-wrapper";
+
+          runtimeInputs = with pkgs; [
+            fd
+            nixfmt-rfc-style
           ];
 
-        nixosHosts = {
+          text = ''
-          imxyy-nix = {
+            fd "$@" -t f -e nix -x nixfmt '{}'
-            profiles = [ "desktop" ];
+          '';
+        }
+      );
+
+      overlays = import ./overlays {
+        inherit inputs lib;
       };
 
-          imxyy-nix-server = {
+      nixosConfigurations = forAllHosts (
-            profiles = [ "server" ];
+        hostname:
+        let
+          overlays = builtins.attrValues self.overlays ++ [
+            inputs.go-musicfox.overlays.default
+            inputs.niri.overlays.niri
+            inputs.fenix.overlays.default
+            (final: prev: {
+              darkly-qt5 = inputs.darkly.packages.${final.system}.darkly-qt5;
+              darkly-qt6 = inputs.darkly.packages.${final.system}.darkly-qt6;
+            })
+            (final: prev: {
+              quickshell = inputs.quickshell.packages.${final.system}.default.override {
+                withJemalloc = true;
+                withQtSvg = true;
+                withWayland = true;
+                withPipewire = true;
+                withPam = false;
+                withX11 = false;
+                withHyprland = false;
               };
-
+            })
-          imxyy-nix-wsl = {
+            (final: prev: {
-            profiles = [ "wsl" ];
+              inherit lib;
-            modules = [
+            })
-              inputs.nixos-wsl.nixosModules.default
           ];
-          };
+          home = {
-
+            home-manager = {
-          imxyy-nix-x16 = {
+              sharedModules = [
-            profiles = [ "desktop" ];
+                inputs.sops-nix.homeManagerModules.sops
+                inputs.impermanence.nixosModules.home-manager.impermanence
+                inputs.stylix.homeModules.stylix
+                inputs.zen.homeModules.beta
+                # workaround for annoying stylix
+                (
+                  { lib, ... }:
+                  {
+                    nixpkgs.overlays = lib.mkForce null;
+                  }
+                )
+              ];
+              useGlobalPkgs = true;
             };
           };
+          pkgsConf.nixpkgs = {
+            inherit overlays;
+            config.allowUnfree = true;
+            flake.setNixPath = false;
+          };
+        in
+        lib.nixosSystem {
+          specialArgs = {
+            inherit
+              inputs
+              outputs
+              hostname
+              ;
+            sopsRoot = ./secrets;
+            flake = ./.;
+          } // vars;
+          modules =
+            (lib.umport {
+              paths = [ ./modules ];
+              exclude = [
+                ./modules/virt/types
+                ./modules/desktop/wm/niri/waybar
+              ];
+              recursive = true;
+            })
+            ++ [
+              (lib.mkAliasOptionModule [ "my" "home" ] [ "home-manager" "users" vars.username ])
+              ./config/base.nix
+              ./config/hosts/${hostname}
+              inputs.chaotic.nixosModules.default
+              inputs.sops-nix.nixosModules.sops
+              inputs.impermanence.nixosModules.impermanence
+              inputs.home-manager.nixosModules.default
+              inputs.niri.nixosModules.niri
+              home
+              pkgsConf
+            ];
+        }
+      );
     };
 }

flake/hosts.nix

@@ -1,139 +0,0 @@
-{
-  self,
-  lib,
-  inputs,
-  withSystem,
-  config,
-  pkgsParams,
-  ...
-}:
-let
-  vars = import ../vars.nix;
-  pkgsModule = {
-    nixpkgs = pkgsParams;
-  };
-  hmModule = {
-    home-manager = {
-      sharedModules = [
-        inputs.sops-nix.homeManagerModules.sops
-        inputs.stylix.homeModules.stylix
-        inputs.noctalia.homeModules.default
-        inputs.zen.homeModules.beta
-        {
-          stylix.overlays.enable = lib.mkForce false;
-        }
-      ];
-      useGlobalPkgs = true;
-    };
-  };
-in
-{
-  options.nixosHosts = lib.mkOption {
-    type = lib.types.attrsOf (
-      lib.types.submodule (
-        { name, ... }:
-        {
-          options = {
-            system = lib.mkOption {
-              type = lib.types.str;
-              default = "x86_64-linux";
-              description = "System architecture";
-            };
-
-            profiles = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              default = [ ];
-              description = "List of profile names (e.g., 'desktop', 'server', 'wsl')";
-            };
-
-            modules = lib.mkOption {
-              type = lib.types.listOf lib.types.deferredModule;
-              default = (
-                lib.umport {
-                  paths = [ ../hosts/${name} ];
-                  extraExcludePredicate = path: lib.hasInfix "/_" (toString path);
-                  recursive = true;
-                }
-              );
-              description = "Additional NixOS modules specific to this host";
-            };
-
-            extraSpecialArgs = lib.mkOption {
-              type = lib.types.attrs;
-              default = { };
-              description = "Extra special arguments to pass to modules";
-            };
-          };
-        }
-      )
-    );
-    default = { };
-    description = "Declarative host definitions";
-  };
-
-  config = {
-    # Generate nixosConfigurations from declarative host definitions
-    flake.nixosConfigurations = lib.mapAttrs (
-      hostname: hostConfig:
-      withSystem hostConfig.system (
-        { ... }:
-        lib.nixosSystem {
-          inherit (hostConfig) system;
-
-          specialArgs = {
-            inherit
-              inputs
-              self
-              hostname
-              ;
-            assets =
-              with lib.haumea;
-              load {
-                src = ../assets;
-                loader = [ (matchers.always loaders.path) ];
-              };
-            secrets =
-              with lib.haumea;
-              load {
-                src = ../secrets;
-                loader = [ (matchers.always loaders.path) ];
-              };
-          }
-          // vars
-          // hostConfig.extraSpecialArgs;
-
-          modules =
-            # Automatically import all feature modules
-            (lib.umport {
-              paths = [ ../modules ];
-              extraExcludePredicate = path: lib.hasInfix "/_" (toString path);
-              recursive = true;
-            })
-            ++ [
-              # Base profile (always included)
-              ../profiles/base.nix
-            ]
-            # Add requested profiles
-            ++ (map (profile: ../profiles/${profile}.nix) hostConfig.profiles)
-            # Add host-specific modules
-            ++ hostConfig.modules
-            ++ [
-              (lib.mkAliasOptionModule [ "my" "hm" ] [ "home-manager" "users" vars.username ])
-
-              # Upstream modules
-              inputs.sops-nix.nixosModules.sops
-              inputs.impermanence.nixosModules.impermanence
-              inputs.home-manager.nixosModules.default
-              inputs.niri.nixosModules.niri
-              inputs.catppuccin.nixosModules.catppuccin
-              inputs.angrr.nixosModules.angrr
-
-              # pkgs and home-manager configuration
-              pkgsModule
-              hmModule
-            ];
-        }
-      )
-    ) config.nixosHosts;
-  };
-}

flake/pkgs.nix

@@ -1,55 +0,0 @@
-{
-  inputs,
-  lib,
-  config,
-  pkgsParams,
-  ...
-}:
-{
-  _module.args = {
-    pkgsParams = {
-      overlays = builtins.attrValues config.flake.overlays ++ [
-        inputs.go-musicfox.overlays.default
-        inputs.niri.overlays.niri
-        inputs.fenix.overlays.default
-        inputs.angrr.overlays.default
-        (final: prev: {
-          darkly-qt5 = inputs.darkly.packages.${final.stdenv.hostPlatform.system}.darkly-qt5;
-          darkly-qt6 = inputs.darkly.packages.${final.stdenv.hostPlatform.system}.darkly-qt6;
-
-          noctalia-shell = inputs.noctalia.packages.${final.stdenv.hostPlatform.system}.default;
-        })
-      ];
-      config.allowUnfree = true;
-      flake.setNixPath = false;
-    };
-  };
-
-  perSystem =
-    {
-      system,
-      pkgs,
-      ...
-    }:
-    {
-      _module.args.pkgs = import inputs.nixpkgs (pkgsParams // { inherit system; });
-      legacyPackages = pkgs;
-      packages = lib.genAttrs (builtins.attrNames (config.flake.overlays.additions pkgs pkgs)) (
-        pkg: pkgs.${pkg}
-      );
-    };
-
-  flake.overlays.additions =
-    final: prev:
-    with lib.haumea;
-    load {
-      src = ../pkgs;
-      loader = [
-        {
-          matches = str: builtins.match ".*\\.nix" str != null;
-          loader = _: path: final.callPackage path { };
-        }
-      ];
-      transformer = transformers.liftDefault;
-    };
-}

hosts/imxyy-nix-server/code.nix

@@ -1,15 +0,0 @@
-{
-  services.coder = {
-    enable = true;
-    accessUrl = "https://coder.imxyy.top";
-    listenAddress = "127.0.0.1:8086";
-  };
-  users.users.coder.extraGroups = [ "podman" ];
-  services.caddy.virtualHosts."coder.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8086 {
-        header_up X-Real-IP {remote_host}
-      }
-    '';
-  };
-}

hosts/imxyy-nix-server/efl.nix

@@ -1,55 +0,0 @@
-{ config, secrets, ... }:
-{
-  sops.secrets.efl-tuwunel-env = {
-    sopsFile = secrets.efl-tuwunel;
-    restartUnits = [ "podman-tuwunel.service" ];
-    format = "dotenv";
-  };
-  virtualisation.oci-containers.containers = {
-    tuwunel = {
-      image = "jevolk/tuwunel:latest";
-      volumes = [
-        "tuwunel_db:/var/lib/tuwunel"
-      ];
-      ports = [ "6167:6167" ];
-      networks = [ "podman" ];
-      environment = {
-        TUWUNEL_SERVER_NAME = "mtx.eflx.top";
-        TUWUNEL_PORT = "6167";
-        TUWUNEL_ADDRESS = "0.0.0.0";
-        TUWUNEL_WELL_KNOWN__SERVER = "mtx.eflx.top:443";
-        TUWUNEL_WELL_KNOWN__CLIENT = "https://mtx.eflx.top";
-      };
-      environmentFiles = [
-        config.sops.secrets.efl-tuwunel-env.path
-      ];
-    };
-    mautrix-telegram = {
-      image = "dock.mau.dev/mautrix/telegram:latest";
-      ports = [ "8099:8099" ];
-      networks = [ "podman" ];
-      extraOptions = [ "--ip=10.88.0.254" ];
-      volumes = [ "/var/lib/efl-mautrix-telegram:/data" ];
-    };
-
-    send = {
-      image = "lanol/filecodebox:latest";
-      ports = [ "12345:12345" ];
-      volumes = [ "/var/lib/send:/app/data:rw" ];
-    };
-  };
-  services.caddy.virtualHosts."mtx.eflx.top" = {
-    extraConfig = ''
-      reverse_proxy :6167 {
-        header_up X-Real-IP {remote_host}
-      }
-    '';
-  };
-  services.caddy.virtualHosts."send.eflx.top" = {
-    extraConfig = ''
-      reverse_proxy :12345 {
-        header_up X-Real-IP {remote_host}
-      }
-    '';
-  };
-}

hosts/imxyy-nix-server/homepage.nix

@@ -1,14 +0,0 @@
-{
-  virtualisation.oci-containers.containers.sun-panel = {
-    image = "hslr/sun-panel:latest";
-    volumes = [
-      "/var/lib/sun-panel:/app/conf"
-    ];
-    ports = [ "8085:3002" ];
-  };
-  services.caddy.virtualHosts."home.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8085
-    '';
-  };
-}

hosts/imxyy-nix-server/matrix.nix

@@ -1,107 +0,0 @@
-{
-  config,
-  secrets,
-  ...
-}:
-{
-  nixpkgs.config.permittedInsecurePackages = [
-    "olm-3.2.16"
-  ];
-  sops.secrets.tuwunel-reg-token = {
-    sopsFile = secrets.tuwunel-reg-token;
-    restartUnits = [ "tuwunel.service" ];
-    format = "binary";
-    owner = config.services.matrix-tuwunel.user;
-    group = config.services.matrix-tuwunel.group;
-  };
-  sops.secrets.tuwunel-turn-secret = {
-    sopsFile = secrets.tuwunel-turn-secret;
-    restartUnits = [ "tuwunel.service" ];
-    format = "binary";
-    owner = config.services.matrix-tuwunel.user;
-    group = config.services.matrix-tuwunel.group;
-  };
-  services.matrix-tuwunel = {
-    enable = true;
-    settings.global = {
-      address = [ "127.0.0.1" ];
-      port = [ 8094 ];
-      server_name = "imxyy.top";
-      well_known = {
-        server = "matrix.imxyy.top:443";
-        client = "https://matrix.imxyy.top";
-      };
-
-      allow_registration = true;
-      registration_token_file = config.sops.secrets.tuwunel-reg-token.path;
-
-      suppress_push_when_active = true;
-
-      turn_uris = [
-        "turn:hk.vkvm.imxyy.top?transport=udp"
-        "turn:hk.vkvm.imxyy.top?transport=tcp"
-      ];
-      turn_secret_file = config.sops.secrets.tuwunel-turn-secret.path;
-
-      new_user_displayname_suffix = "";
-    };
-  };
-  services.caddy.virtualHosts."imxyy.top" = {
-    extraConfig = ''
-      handle /.well-known/matrix/server {
-        header Content-Type application/json
-        header "Access-Control-Allow-Origin" "*"
-
-        respond `{"m.server": "matrix.imxyy.top:443"}` 200
-      }
-      handle /.well-known/matrix/client {
-        header Content-Type application/json
-        header "Access-Control-Allow-Origin" "*"
-
-        respond `{"m.homeserver": {"base_url": "https://matrix.imxyy.top/"}}` 200
-      }
-    '';
-  };
-  services.caddy.virtualHosts."matrix.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8094
-    '';
-  };
-
-  sops.secrets.mautrix-telegram = {
-    sopsFile = secrets.mautrix-telegram;
-    restartUnits = [ "mautrix-telegram.service" ];
-    format = "dotenv";
-    owner = "mautrix-telegram";
-    group = "mautrix-telegram";
-  };
-  services.mautrix-telegram = {
-    enable = true;
-    environmentFile = config.sops.secrets.mautrix-telegram.path;
-    settings = {
-      homeserver = {
-        address = "http://127.0.0.1:8094";
-        domain = "imxyy.top";
-      };
-      appservice = {
-        address = "http://127.0.0.1:8098";
-        hostname = "127.0.0.1";
-        port = "8098";
-        bot_username = "telegrambot";
-      };
-      bridge = {
-        username_template = "telegram_{userid}";
-        alias_template = "telegram_{groupname}";
-        displayname_template = "{displayname} (Telegram)";
-        permissions = {
-          "@imxyy_soope_:imxyy.top" = "admin";
-        };
-      };
-      telegram = {
-        # borrowed from https://github.com/telegramdesktop/tdesktop/blob/9bdc19e2fd4d497c8f403891848383a88faadc25/snap/snapcraft.yaml#L134-L135
-        api_id = "611335";
-        api_hash = "d524b414d21f4d37f08684c1df41ac9c";
-      };
-    };
-  };
-}

hosts/imxyy-nix-server/net.nix

@@ -1,527 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  hosts,
-  secrets,
-  ...
-}:
-{
-  boot.kernelParams = [
-    "biosdevname=0"
-    "net.ifnames=0"
-  ];
-  networking = {
-    useDHCP = lib.mkForce false;
-    dhcpcd = {
-      wait = "background";
-      IPv6rs = true;
-      extraConfig = ''
-        interface mac0
-          noipv4
-      '';
-    };
-    interfaces = {
-      eth0.wakeOnLan.enable = true;
-      eth1.wakeOnLan.enable = true;
-      mac0 = {
-        useDHCP = true;
-        ipv4.addresses = [
-          {
-            address = "192.168.3.2";
-            prefixLength = 24;
-          }
-        ];
-      };
-    };
-    macvlans."mac0" = {
-      interface = "eth0";
-      mode = "bridge";
-    };
-    defaultGateway = {
-      address = "192.168.3.1";
-      interface = "mac0";
-    };
-    nameservers = [
-      "192.168.3.2"
-    ];
-
-    firewall.enable = false;
-    nftables = {
-      enable = true;
-      flushRuleset = true;
-      ruleset = ''
-        table inet firewall {
-          set LANv4 {
-            type ipv4_addr
-            flags interval
-
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          }
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-          set tcp_ports {
-            type inet_service
-            flags interval
-
-            elements = {
-              http,
-              https,
-              2222,
-              25565
-            }
-          }
-
-          chain prerouting {
-            type filter hook prerouting priority mangle; policy accept;
-
-            ip daddr @LANv4 accept
-            ip6 daddr @LANv6 accept
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-
-            ip daddr @LANv4 accept
-            ip6 daddr @LANv6 accept
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip protocol { icmp, igmp } accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-
-            tcp dport 2222 ct state new limit rate 15/minute counter accept
-
-            tcp dport @tcp_ports counter accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy accept;
-          }
-
-          chain nat {
-            type nat hook postrouting priority 0; policy accept;
-            ip saddr 192.168.3.0/24 masquerade
-          }
-        }
-      '';
-    };
-  };
-
-  services.openssh = {
-    enable = true;
-    settings = {
-      # PermitRootLogin = "yes";
-      PermitRootLogin = "prohibit-password";
-      PasswordAuthentication = true;
-    };
-  };
-  users.users.root.openssh.authorizedKeys.keys = lib.mapAttrsToList (
-    host: key: "${key} ${host}"
-  ) hosts;
-  users.users.${username}.openssh.authorizedKeys.keys = lib.mapAttrsToList (
-    host: key: "${key} ${host}"
-  ) hosts;
-
-  sops.secrets.dae-imxyy-nix-server = {
-    sopsFile = secrets.dae-imxyy-nix-server;
-    restartUnits = [ "dae.service" ];
-    format = "binary";
-  };
-  services.dae = {
-    enable = true;
-    configFile = config.sops.secrets.dae-imxyy-nix-server.path;
-  };
-  systemd.services.dae = {
-    after = [ "sops-nix.service" ];
-    serviceConfig.MemoryMax = "1G";
-  };
-  sops.secrets.mihomo = {
-    sopsFile = secrets.mihomo;
-    restartUnits = [ "mihomo.service" ];
-    format = "yaml";
-    key = "";
-  };
-  systemd.services.mihomo.after = [ "sops-nix.service" ];
-  services.mihomo = {
-    enable = true;
-    configFile = config.sops.secrets.mihomo.path;
-    webui = pkgs.metacubexd;
-  };
-
-  sops.secrets.frp-env = {
-    sopsFile = secrets.frp;
-    restartUnits = [ "frp.service" ];
-    format = "dotenv";
-  };
-  systemd.services.frp.serviceConfig.EnvironmentFile = [
-    config.sops.secrets.frp-env.path
-  ];
-  services.frp = {
-    instances."" = {
-      enable = true;
-      role = "client";
-      settings = {
-        serverAddr = "{{ .Envs.FRP_SERVER_ADDR }}";
-        serverPort = 7000;
-        auth.token = "{{ .Envs.FRP_AUTH_TOKEN }}";
-        proxies = [
-          {
-            name = "nextcloud-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "nextcloud.imxyy.top" ];
-          }
-          {
-            name = "nextcloud-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "nextcloud.imxyy.top" ];
-          }
-
-          {
-            name = "oidc-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "oidc.imxyy.top" ];
-          }
-          {
-            name = "oidc-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "oidc.imxyy.top" ];
-          }
-
-          {
-            name = "mail-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "mail.imxyy.top" ];
-          }
-          {
-            name = "mail-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "mail.imxyy.top" ];
-          }
-
-          {
-            name = "gitea-ssh";
-            type = "tcp";
-            localIP = "127.0.0.1";
-            localPort = 2222;
-            remotePort = 2222;
-          }
-          {
-            name = "gitea-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "git.imxyy.top" ];
-          }
-          {
-            name = "gitea-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "git.imxyy.top" ];
-          }
-
-          {
-            name = "vault-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "vault.imxyy.top" ];
-          }
-          {
-            name = "vault-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "vault.imxyy.top" ];
-          }
-
-          {
-            name = "home-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "home.imxyy.top" ];
-          }
-          {
-            name = "home-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "home.imxyy.top" ];
-          }
-
-          {
-            name = "coder-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "coder.imxyy.top" ];
-          }
-          {
-            name = "coder-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "coder.imxyy.top" ];
-          }
-
-          {
-            name = "grafana-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "grafana.imxyy.top" ];
-          }
-          {
-            name = "grafana-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "grafana.imxyy.top" ];
-          }
-
-          {
-            name = "siyuan-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "sy.imxyy.top" ];
-          }
-          {
-            name = "siyuan-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "sy.imxyy.top" ];
-          }
-
-          {
-            name = "matrix-root-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "imxyy.top" ];
-          }
-          {
-            name = "matrix-root-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "imxyy.top" ];
-          }
-          {
-            name = "matrix-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "matrix.imxyy.top" ];
-          }
-          {
-            name = "matrix-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "matrix.imxyy.top" ];
-          }
-
-          {
-            name = "immich-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "immich.imxyy.top" ];
-          }
-          {
-            name = "immich-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "immich.imxyy.top" ];
-          }
-
-          {
-            name = "memo-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "memo.imxyy.top" ];
-          }
-          {
-            name = "memo-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "memo.imxyy.top" ];
-          }
-
-          {
-            name = "efl-matrix-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "mtx.eflx.top" ];
-          }
-          {
-            name = "efl-matrix-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "mtx.eflx.top" ];
-          }
-          {
-            name = "efl-send-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "send.eflx.top" ];
-          }
-          {
-            name = "efl-send-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "send.eflx.top" ];
-          }
-        ];
-      };
-    };
-  };
-
-  sops.secrets.et-imxyy-nix-server = {
-    sopsFile = secrets.et-imxyy-nix-server;
-    restartUnits = [ "easytier.service" ];
-    format = "binary";
-  };
-  environment.systemPackages = [ pkgs.easytier ];
-  systemd.services."easytier" = {
-    enable = true;
-    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-server.path}";
-    serviceConfig = {
-      Restart = "always";
-      RestartSec = 30;
-      User = "root";
-    };
-    wantedBy = [ "multi-user.target" ];
-    after = [
-      "network.target"
-      "sops-nix.service"
-    ];
-  };
-
-  virtualisation.oci-containers.containers.obligator = {
-    image = "anderspitman/obligator:latest";
-    volumes = [
-      "/var/lib/obligator:/data"
-      "/var/lib/obligator:/api"
-    ];
-    ports = [ "8081:1616" ];
-    cmd = [
-      "-storage-dir"
-      "/data"
-      "-api-socket-dir"
-      "/api"
-      "-root-uri"
-      "https://oidc.imxyy.top"
-      "-port"
-      "1616"
-    ];
-  };
-  services.caddy.virtualHosts."oidc.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8081 {
-        header_up X-Real-IP {remote_host}
-      }
-    '';
-  };
-
-  systemd.services.ddns-go =
-    let
-      version = "6.6.7";
-      ddns-go = pkgs.buildGoModule {
-        inherit version;
-        pname = "ddns-go";
-        src = pkgs.fetchFromGitHub {
-          owner = "jeessy2";
-          repo = "ddns-go";
-          rev = "v${version}";
-          hash = "sha256-Ejoe6e9GFhHxQ9oIBDgDRQW9Xx1XZK+qSAXiRXLdn+c=";
-        };
-        meta.mainProgram = "ddns-go";
-        vendorHash = "sha256-XZii7gV3DmTunYyGYzt5xXhv/VpTPIoYKbW4LnmlAgs=";
-        doCheck = false;
-      };
-    in
-    {
-      description = "Go Dynamic DNS";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${lib.getExe ddns-go} -l :9876 -f 10 -cacheTimes 180 -c /var/lib/ddns-go/config.yaml";
-        Restart = "always";
-        RestartSec = 120;
-      };
-      path = [
-        pkgs.bash
-      ];
-    };
-
-  services.dnsmasq =
-    let
-      subDomains = [
-        "home"
-        "nextcloud"
-        "mail"
-        "git"
-        "vault"
-        "coder"
-        "grafana"
-        "matrix"
-        "note"
-        "oidc"
-        "mc"
-        "music"
-        "sy"
-        "immich"
-      ];
-    in
-    {
-      enable = true;
-      resolveLocalQueries = false;
-      settings = {
-        no-resolv = true;
-        server = [ "192.168.3.1" ];
-        address = map (sub: "/${sub}.imxyy.top/192.168.3.2") subDomains ++ [
-          "/imxyy-nix-server/192.168.3.2"
-          "/imxyy-cloudwin/192.168.3.4"
-          "/printer.home/192.168.3.53"
-        ];
-        cache-size = 0;
-        log-queries = "extra";
-      };
-    };
-}

hosts/imxyy-nix-server/nixos.nix

@@ -1,17 +0,0 @@
-{
-  lib,
-  config,
-  username,
-  secrets,
-  ...
-}:
-{
-  sops.secrets.imxyy-nix-server-hashed-password = {
-    sopsFile = secrets.imxyy-nix-server-hashed-password;
-    format = "binary";
-    neededForUsers = true;
-  };
-  users.users.${username}.hashedPasswordFile =
-    lib.mkForce config.sops.secrets.imxyy-nix-server-hashed-password.path;
-  users.users.root.hashedPasswordFile = lib.mkForce config.sops.secrets.imxyy-nix-server-hashed-password.path;
-}

hosts/imxyy-nix-server/note.nix

@@ -1,51 +0,0 @@
-{
-  config,
-  secrets,
-  ...
-}:
-{
-  sops.secrets.siyuan-env = {
-    sopsFile = secrets.siyuan;
-    restartUnits = [ "siyuan.service" ];
-    format = "dotenv";
-  };
-  virtualisation.oci-containers.containers = {
-    siyuan = {
-      image = "apkdv/siyuan-unlock:v3.1.30";
-      volumes = [
-        "/mnt/nas/siyuan/workspace:/workspace"
-        "/mnt/nas/siyuan:/home/siyuan"
-      ];
-      cmd = [
-        "--workspace=/workspace"
-      ];
-      environment = {
-        PUID = "0";
-        PGID = "0";
-      };
-      environmentFiles = [
-        "${config.sops.secrets.siyuan-env.path}"
-      ];
-      ports = [ "8095:6806" ];
-    };
-    memos = {
-      image = "neosmemo/memos:stable";
-      volumes = [
-        "/mnt/nas/memos:/var/opt/memos"
-      ];
-      ports = [ "8097:5230" ];
-    };
-  };
-  services.caddy.virtualHosts = {
-    "sy.imxyy.top" = {
-      extraConfig = ''
-        reverse_proxy :8095
-      '';
-    };
-    "memo.imxyy.top" = {
-      extraConfig = ''
-        reverse_proxy :8097
-      '';
-    };
-  };
-}

hosts/imxyy-nix-server/plant.nix

@@ -1,74 +0,0 @@
-{
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  app = pkgs.buildNpmPackage (finalAttrs: {
-    pname = "HF-plant";
-    version = "unstable-2025-09-21";
-
-    src = inputs.plant;
-
-    buildPhase = ''
-      runHook preBuild
-
-      npm run build
-      npm run build:proxy
-
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-
-      mkdir $out
-      mv dist $out
-      cp .env proxy-server-bundled.js $out
-
-      runHook postInstall
-    '';
-
-    npmDepsHash = "sha256-ret4BtjrEt8L1nlvJmFiejAKmbz89Z7NSiKs+qlB51w=";
-  });
-in
-{
-  systemd.services.HF-plant-proxy = {
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${lib.getExe pkgs.bash} -c 'source ${app}/.env; export FEISHU_APP_ID FEISHU_APP_SECRET AMAP_JSCODE; ${lib.getExe pkgs.nodejs} ${app}/proxy-server-bundled.js'";
-      Restart = "always";
-      RestartSec = 120;
-    };
-  };
-  services.caddy.virtualHosts."plant.imxyy.top" = {
-    extraConfig = ''
-      handle /api/* {
-        reverse_proxy localhost:3001
-      }
-
-      handle /* {
-        root * ${app}/dist
-        try_files {path} /index.html
-        file_server
-      }
-    '';
-  };
-  services.frp.instances."".settings.proxies = [
-    {
-      name = "plant-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "plant.imxyy.top" ];
-    }
-    {
-      name = "plant-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "plant.imxyy.top" ];
-    }
-  ];
-}

hosts/imxyy-nix-server/rss.nix

@@ -1,55 +0,0 @@
-{ config, secrets, ... }:
-let
-  redisUrl = config.services.redis.servers.rsshub.unixSocket;
-in
-{
-  sops.secrets.rsshub-env = {
-    sopsFile = secrets.rsshub;
-    restartUnits = [ "podman-rsshub.service" ];
-    format = "dotenv";
-  };
-  users.users.rsshub = {
-    home = "/var/empty";
-    group = "rsshub";
-    isSystemUser = true;
-  };
-  users.groups.rsshub.members = [ "rsshub" ];
-  services.redis.servers.rsshub = {
-    enable = true;
-    user = "rsshub";
-  };
-  virtualisation.oci-containers.containers.rsshub = {
-    image = "diygod/rsshub";
-    volumes = [
-      "${redisUrl}:${redisUrl}"
-    ];
-    ports = [ "8100:1200" ];
-    networks = [ "podman" ];
-    environment = {
-      CACHE_TYPE = "redis";
-      REDIS_URL = "${redisUrl}";
-    };
-    environmentFiles = [ config.sops.secrets.rsshub-env.path ];
-  };
-  services.caddy.virtualHosts."rss.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8100
-    '';
-  };
-  services.frp.instances."".settings.proxies = [
-    {
-      name = "rsshub-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "rss.imxyy.top" ];
-    }
-    {
-      name = "rsshub-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "rss.imxyy.top" ];
-    }
-  ];
-}

hosts/imxyy-nix-server/sshwifty.nix

@@ -1,49 +0,0 @@
-{ config, secrets, ... }:
-{
-  sops.secrets.sshwifty = {
-    sopsFile = secrets.sshwifty;
-    format = "binary";
-  };
-  services.sshwifty = {
-    enable = true;
-    sharedKeyFile = config.sops.secrets.sshwifty.path;
-    settings = {
-      Servers = [
-        {
-          ListenInterface = "0.0.0.0";
-          ListenPort = 8101;
-          InitialTimeout = 10;
-          ReadTimeout = 120;
-          WriteTimeout = 120;
-          HeartbeatTimeout = 10;
-          ReadDelay = 10;
-          WriteDelay = 10;
-          TLSCertificateFile = "";
-          TLSCertificateKeyFile = "";
-          ServerMessage = "";
-        }
-      ];
-    };
-  };
-  services.caddy.virtualHosts."ssh.imxyy.top" = {
-    extraConfig = ''
-      reverse_proxy :8101
-    '';
-  };
-  services.frp.instances."".settings.proxies = [
-    {
-      name = "sshwifty-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "ssh.imxyy.top" ];
-    }
-    {
-      name = "sshwifty-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "ssh.imxyy.top" ];
-    }
-  ];
-}

hosts/imxyy-nix-wsl/home.nix

@@ -1,19 +0,0 @@
-{ lib, username, ... }:
-{
-  my.hm = {
-    programs.zsh.shellAliases = {
-      localproxy_on = "export http_proxy=http://192.168.128.1:7890 https_proxy=http://192.168.128.1:7890 all_proxy=socks://192.168.128.1:7890";
-    };
-    programs.fish.shellAliases = {
-      localproxy_on = "export http_proxy=http://192.168.128.1:7890 https_proxy=http://192.168.128.1:7890 all_proxy=socks://192.168.128.1:7890";
-    };
-  };
-  my = {
-    sops.sshKeyFile = "/home/${username}/.ssh/id_ed25519";
-    coding.all.enable = true;
-    coding.editor.vscode.enable = lib.mkForce false;
-    cli.misc.enable = true;
-    xdg.enable = true;
-    cli.media.all.enable = true;
-  };
-}

hosts/imxyy-nix-x16/net.nix

@@ -1,101 +0,0 @@
-{
-  config,
-  pkgs,
-  secrets,
-  ...
-}:
-{
-  boot.kernelParams = [
-    "biosdevname=0"
-    "net.ifnames=0"
-  ];
-  my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
-  networking = {
-    networkmanager.enable = true;
-    firewall.enable = false;
-    nftables = {
-      enable = true;
-      flushRuleset = true;
-      ruleset = ''
-        table inet firewall {
-          set LANv4 {
-            type ipv4_addr
-            flags interval
-
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          }
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy drop;
-          }
-        }
-      '';
-    };
-  };
-
-  sops.secrets.dae-imxyy-nix-x16 = {
-    sopsFile = secrets.dae-imxyy-nix-x16;
-    restartUnits = [ "dae.service" ];
-    format = "binary";
-  };
-  services.dae = {
-    enable = true;
-    configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
-  };
-  systemd.services.dae.after = [ "sops-nix.service" ];
-  sops.secrets.mihomo = {
-    sopsFile = secrets.mihomo;
-    restartUnits = [ "mihomo.service" ];
-    format = "yaml";
-    key = "";
-  };
-  systemd.services.mihomo.after = [ "sops-nix.service" ];
-  services.mihomo = {
-    enable = true;
-    configFile = config.sops.secrets.mihomo.path;
-    webui = pkgs.metacubexd;
-  };
-
-  sops.secrets.et-imxyy-nix-x16 = {
-    sopsFile = secrets.et-imxyy-nix-x16;
-    restartUnits = [ "easytier.service" ];
-    format = "binary";
-  };
-  environment.systemPackages = with pkgs; [
-    easytier
-  ];
-  systemd.services."easytier" = {
-    enable = true;
-    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-x16.path}";
-    serviceConfig = {
-      Restart = "always";
-      RestartSec = 30;
-      User = "root";
-    };
-    wantedBy = [ "multi-user.target" ];
-    after = [
-      "network.target"
-      "sops-nix.service"
-    ];
-  };
-}

hosts/imxyy-nix-x16/nixos.nix

@@ -1,67 +0,0 @@
-{
-  pkgs,
-  config,
-  username,
-  secrets,
-  ...
-}:
-{
-  boot.kernelParams = [
-    "usbcore.autosuspend=-1" # Avoid usb autosuspend (for usb bluetooth adapter)
-  ];
-
-  services.upower.enable = true;
-  services.power-profiles-daemon.enable = true;
-
-  services.keyd = {
-    enable = true;
-    keyboards.default.settings = {
-      main = {
-        capslock = "overload(control, esc)";
-        home = "end";
-      };
-      shift = {
-        home = "home";
-      };
-      control = {
-        delete = "print";
-      };
-    };
-  };
-
-  services.openssh = {
-    enable = true;
-    settings = {
-      # Forbid root login through SSH.
-      PermitRootLogin = null;
-      PasswordAuthentication = true;
-    };
-  };
-
-  environment.systemPackages = [
-    pkgs.rclone
-  ];
-
-  sops.secrets.imxyy-nix-rclone = {
-    sopsFile = secrets.imxyy-nix-rclone;
-    format = "binary";
-  };
-  fileSystems = {
-    "/home/${username}/Nextcloud" = {
-      device = "Nextcloud:";
-      fsType = "rclone";
-      options = [
-        "nodev"
-        "nofail"
-        "allow_other"
-        "args2env"
-        "config=${config.sops.secrets.imxyy-nix-rclone.path}"
-        "uid=1000"
-        "gid=100"
-        "rw"
-        "no-check-certificate"
-        "vfs-cache-mode=full"
-      ];
-    };
-  };
-}

hosts/imxyy-nix/nixos.nix

@@ -1,130 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  username,
-  secrets,
-  ...
-}:
-let
-  btreset = pkgs.writeShellScriptBin "btreset" ''
-    LOCKFILE="/tmp/.btreseted"
-    SYM="BT"
-
-    if [ -f "$LOCKFILE" ] && [ "$1" != "-f" ]; then
-      exit 0
-    fi
-
-    ${lib.getExe' pkgs.usbutils "lsusb"} | grep "$SYM" | while read -r line; do
-      bus=$(echo "$line" | awk '{print $2}')
-      dev=$(echo "$line" | awk '{print $4}' | tr -d ':')
-      ${lib.getExe' pkgs.usbutils "usbreset"} "$bus/$dev"
-
-      touch "$LOCKFILE"
-    done
-  '';
-in
-{
-  systemd.services.btreset = {
-    script = lib.getExe btreset;
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig.Type = "oneshot";
-  };
-
-  boot.kernelParams = [
-    "usbcore.autosuspend=-1" # Avoid usb autosuspend (for usb bluetooth adapter)
-    "fsck.mode=skip"
-  ];
-
-  services.keyd = {
-    enable = true;
-    keyboards = {
-      default.settings = {
-        main = {
-          capslock = "overload(control, esc)";
-          home = "end";
-        };
-        shift = {
-          home = "home";
-        };
-        control = {
-          delete = "print";
-        };
-      };
-      kone-pro-owl-eye = {
-        ids = [ "1e7d:2dcd" ];
-        settings.main.mouse2 = "rightmouse";
-      };
-    };
-  };
-
-  programs.wireshark.enable = true;
-  programs.wireshark.package = pkgs.wireshark;
-  users.users.${username}.extraGroups = [ "wireshark" ];
-
-  virtualisation.waydroid.enable = true;
-  my.persist.homeDirs = [ ".local/share/waydroid" ];
-
-  services.sunshine = {
-    enable = true;
-    autoStart = true;
-    capSysAdmin = true;
-    applications.apps = [
-      {
-        name = "Desktop";
-        image-path = "desktop.png";
-      }
-    ];
-  };
-  services.openssh = {
-    enable = true;
-    settings = {
-      # Forbid root login through SSH.
-      PermitRootLogin = null;
-      PasswordAuthentication = true;
-    };
-  };
-
-  environment.systemPackages = [
-    pkgs.rclone
-    btreset
-  ];
-
-  sops.secrets.imxyy-nix-rclone = {
-    sopsFile = secrets.imxyy-nix-rclone;
-    format = "binary";
-  };
-  fileSystems = {
-    "/home/${username}/Nextcloud" = {
-      device = "Nextcloud:";
-      fsType = "rclone";
-      options = [
-        "nodev"
-        "nofail"
-        "allow_other"
-        "args2env"
-        "config=${config.sops.secrets.imxyy-nix-rclone.path}"
-        "uid=1000"
-        "gid=100"
-        "rw"
-        "no-check-certificate"
-        "vfs-cache-mode=full"
-      ];
-    };
-    "/home/${username}/NAS" = {
-      device = "//192.168.3.2/share";
-      fsType = "cifs";
-      options = [
-        "username=nas"
-        "password=nasshare"
-        "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"
-        "nodev"
-        "nofail"
-        "uid=1000"
-        "gid=100"
-        "vers=3"
-        "rw"
-      ];
-    };
-  };
-}

hosts/imxyy-nix/podman.nix

@@ -1,36 +0,0 @@
-{
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-{
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-  };
-  users.users.${username}.extraGroups = [ "podman" ];
-  environment.systemPackages = [ pkgs.distrobox ];
-  my.hm.programs.distrobox = {
-    enable = true;
-    settings = {
-      container_image_default = "docker.io/archlinux:latest";
-    };
-    containers = {
-      archlinux = {
-        image = "archlinux:latest";
-        additional_packages = "nvim";
-      };
-    };
-  };
-  my.hm.programs.zsh.initContent = lib.mkBefore ''
-    if [ -n "''${CONTAINER_ID+1}" ]; then
-      export ZSH_DISABLE_COMPFIX=true
-    fi
-  '';
-  my.persist.homeDirs = [
-    ".config/containers"
-    ".local/share/containers"
-  ];
-}

lib/default.nix

@@ -1,9 +1,102 @@
-{ lib, inputs }:
+{ lib }:
-lib.extend (
+
-  self: super: {
+{
-    inherit (inputs.home-manager.lib) hm;
+  makeSwitch =
-    umport = import ./umport.nix { lib = self; };
+    {
-    haumea = inputs.haumea.lib;
+      default ? false,
-    infuse = (import inputs.infuse { inherit lib; }).v1.infuse;
+      config,
+      optionPath,
+      optionName,
+      config',
+    }:
+    let
+      cfg = lib.getAttrFromPath optionPath config.my;
+    in
+    {
+      options.my = lib.setAttrByPath (optionPath) {
+        enable = (lib.mkEnableOption optionName) // {
+          inherit default;
+        };
+      };
+
+      config = lib.mkIf cfg.enable config';
+    };
+
+  makeHomePackageConfig =
+    {
+      config,
+      pkgs,
+      packageName,
+      packagePath,
+      optionPath,
+      extraConfig ? { },
+    }:
+    lib.my.makeSwitch {
+      inherit config optionPath;
+      optionName = packageName;
+      config' = lib.mkMerge [
+        {
+          my.home.home.packages = [ (lib.getAttrFromPath packagePath pkgs) ];
         }
-)
+        extraConfig
+      ];
+    };
+
+  makeHomeProgramConfig =
+    {
+      config,
+      programName,
+      optionPath,
+      extraConfig ? { },
+    }:
+    lib.my.makeSwitch {
+      inherit config optionPath;
+      optionName = programName;
+
+      config' = lib.mkMerge [
+        {
+          my.home.programs = lib.setAttrByPath [ programName "enable" ] true;
+        }
+        extraConfig
+      ];
+    };
+
+  makeNixosPackageConfig =
+    {
+      config,
+      pkgs,
+      packageName,
+      packagePath,
+      optionPath,
+      extraConfig ? { },
+    }:
+    lib.my.makeSwitch {
+      inherit config optionPath;
+      optionName = packageName;
+      config' = lib.mkMerge [
+        {
+          environment.systemPackages = [ (lib.getAttrFromPath packagePath pkgs) ];
+        }
+        extraConfig
+      ];
+    };
+
+  makeNixosProgramConfig =
+    {
+      config,
+      programName,
+      optionPath,
+      extraConfig ? { },
+    }:
+    lib.my.makeSwitch {
+      inherit config optionPath;
+      optionName = programName;
+
+      config' = lib.mkMerge [
+        {
+          programs = lib.setAttrByPath [ programName "enable" ] true;
+        }
+        extraConfig
+      ];
+    };
+}

lib/stdlib-extended.nix

@@ -0,0 +1,14 @@
+# Just a convenience function that returns the given Nixpkgs standard
+# library extended with the imxyy library.
+
+stdlib:
+
+let
+  mkMyLib = import ./.;
+in
+stdlib.extend (
+  self: super: {
+    my = mkMyLib { lib = self; };
+    umport = import ./umport.nix { lib = self; };
+  }
+)

lib/umport.nix

@@ -13,7 +13,6 @@ let
       paths ? [ ],
       include ? [ ],
       exclude ? [ ],
-      extraExcludePredicate ? _: true,
       recursive ? true,
     }:
     with lib;
@@ -23,22 +22,26 @@ let
       excludedDirs = filter (path: pathIsDirectory path) exclude;
       isExcluded =
         path:
-        (elem path excludedFiles)
+        if elem path excludedFiles then
-        || ((filter (excludedDir: lib.path.hasPrefix excludedDir path) excludedDirs) != [ ])
+          true
-        || extraExcludePredicate path;
+        else
+          (filter (excludedDir: lib.path.hasPrefix excludedDir path) excludedDirs) != [ ];
     in
     unique (
-      (filter (file: pathIsRegularFile file && hasSuffix ".nix" (toString file) && !isExcluded file) (
+      (filter
+        (file: pathIsRegularFile file && hasSuffix ".nix" (builtins.toString file) && !isExcluded file)
+        (
           concatMap (
-          path:
+            _path:
             if recursive then
-            toList path
+              toList _path
             else
               mapAttrsToList (
-              name: type: path + (if type == "directory" then "/${name}/default.nix" else "/${name}")
+                name: type: _path + (if type == "directory" then "/${name}/default.nix" else "/${name}")
-            ) (builtins.readDir path)
+              ) (builtins.readDir _path)
           ) (unique (if path == null then paths else [ path ] ++ paths))
-      ))
+        )
+      )
       ++ (if recursive then concatMap (path: toList path) (unique include) else unique include)
     );
 in

modules/audio.nix

@@ -1,29 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  username,
-  ...
-}:
-let
-  cfg = config.my.audio;
-in
-{
-  options.my.audio = {
-    enable = lib.mkEnableOption "default audio settings";
-  };
-
-  config = lib.mkIf cfg.enable {
-    security.rtkit.enable = true;
-    services.pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      audio.enable = true;
-    };
-    users.extraUsers.${username}.extraGroups = [ "audio" ];
-    my.persist.homeDirs = [ ".local/state/wireplumber" ];
-    my.hm.home.packages = [ pkgs.pwvucontrol ];
-  };
-}

modules/bluetooth.nix

@@ -1,23 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.bluetooth;
-in
-{
-  options.my.bluetooth = {
-    enable = lib.mkEnableOption "default bluetooth settings";
-  };
-
-  config = lib.mkIf cfg.enable {
-    hardware.bluetooth = {
-      enable = true;
-      powerOnBoot = true;
-      settings = {
-        General = {
-          Enable = "Source,Sink,Media,Socket";
-          Disable = "HeadSet";
-          MultiProfile = "multiple";
-        };
-      };
-    };
-  };
-}

modules/cli/all.nix

@@ -1,13 +1,12 @@
 { config, lib, ... }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.all;
+  inherit config;
-in
+  optionName = "all command line tools";
-{
+  optionPath = [
-  options.my.cli.all = {
+    "cli"
-    enable = lib.mkEnableOption "all command line tools";
+    "all"
-  };
+  ];
-
+  config' = {
-  config = lib.mkIf cfg.enable {
     my.cli = {
       media.all.enable = true;
       misc.enable = true;

modules/cli/media/all.nix

@@ -1,15 +1,17 @@
 { config, lib, ... }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.media.all;
+  inherit config;
-in
+  optionName = "all command line media tools";
-{
+  optionPath = [
-  options.my.cli.media.all = {
+    "cli"
-    enable = lib.mkEnableOption "all command line media tools";
+    "media"
-  };
+    "all"
-
+  ];
-  config = lib.mkIf cfg.enable {
+  config' = {
     my.cli.media = {
+      cava.enable = true;
       go-musicfox.enable = true;
+      mpd.enable = true;
       ffmpeg.enable = true;
     };
   };

modules/cli/media/cava/config/config

@@ -0,0 +1,167 @@
+## Configuration file for CAVA. Default values are commented out. Use either ';' or '#' for commenting.
+
+
+[general]
+
+# Smoothing mode. Can be 'normal', 'scientific' or 'waves'.
+mode = normal
+
+# Accepts only non-negative values.
+framerate = 60
+
+# 'autosens' will attempt to decrease sensitivity if the bars peak. 1 = on, 0 = off
+# 'overshoot' allows bars to overshoot (in % of terminal height) without initiating autosens.
+; autosens = 1
+; overshoot = 20
+
+# Manual sensitivity in %. Autosens must be turned off for this to take effect.
+# 200 means double height. Accepts only non-negative values.
+; sensitivity = 100
+
+# The number of bars (0-200). 0 sets it to auto (fill up console).
+# Bars' width and space between bars in number of characters.
+bars = 0
+bar_width = 5
+bar_spacing = 1
+
+# Lower and higher cutoff frequencies for lowest and highest bars
+# the bandwidth of the visualizer.
+# Note: there is a minimum total bandwidth of 43Mhz x number of bars.
+# Cava will automatically increase the higher cutoff if a too low band is specified.
+; lower_cutoff_freq = 50
+; higher_cutoff_freq = 10000
+
+
+
+[input]
+
+# Audio capturing method. Possible methods are: 'pulse', 'alsa' or 'fifo'.
+# Defaults to 'pulse', 'alsa' or 'fifo', in that order, dependent on what support cava was built with.
+#
+# All input methods uses the same config variable 'source'
+# to define where it should get the audio.
+#
+# For pulseaudio 'source' will be the source. Default: 'auto', which uses the monitor source of the default sink
+# (all pulseaudio sinks(outputs) have 'monitor' sources(inputs) associated with them).
+#
+# For alsa 'source' will be the capture device.
+# For fifo 'source' will be the path to fifo-file.
+method = pulse
+source = auto
+
+; method = alsa
+; source = hw:Loopback,1
+
+; method = fifo
+; source = /tmp/mpd.fifo
+
+
+
+[output]
+
+# Ouput method. Can be 'ncurses', 'noncurses' or 'raw'.
+# 'noncurses' is for systems that does not suport ncurses.
+# 'raw' is a 16 bit data stream of the bar heights that can be used to send to other applications.
+# 'raw' defaults to 200 bars, which can be adjusted in the 'bars' option above.
+method = ncurses
+
+# Visual styles. Can be 'stereo' or 'mono'.
+# 'stereo' mirrors both channels with low frequencies in center.
+# 'mono' averages both channels and outputs left to right lowest to highest frequencies.
+style = mono
+
+# Raw output target. A fifo will be created if target does not exist.
+; raw_target = /dev/stdout
+
+# Raw data format. Can be 'binary' or 'ascii'.
+; data_format = binary
+
+# Binary bit format, can be '8bit' (0-255) or '16bit' (0-65530).
+; bit_format = 16bit
+
+# Ascii max value. In 'ascii' mode range will run from 0 to value specified here
+; ascii_max_range = 1000
+
+# Ascii delimiters. In ascii format each bar and frame is separated by a delimiters.
+# Use decimal value in ascii table (i.e. 59 = ';' and 10 = '\n' (line feed)).
+; bar_delimiter = 59
+; frame_delimiter = 10
+
+
+
+# [color]
+
+# # Colors can be one of seven predefined: black, blue, cyan, green, magenta, red, white, yellow.
+# # Or defined by hex code '#xxxxxx' (hex code must be within ''). User defined colors requires a
+# # terminal that can change color definitions such as Gnome-terminal or rxvt.
+# ; background = black
+# ; foreground = cyan
+
+# # Gradient mode, only hex defined colors are supported, background must also be defined in hex
+# # or remain commented out. 1 = on, 0 = off. Warning: for certain terminal emulators cava will
+# # not able to restore color definitions on exit, simply restart your terminal to restore colors.
+# gradient = 1
+# gradient_color_1 = '#0099ff'
+# gradient_color_2 = '#ff3399'
+
+
+
+[smoothing]
+
+# Multiplier for the integral smoothing calculations. Takes values from 0-0.99.
+# Higher values means smoother, but less precise. Set to 0 to disable.
+; integral = 0.7
+
+# Disables or enables the so-called "Monstercat smoothing". Set to 0 to disable.
+; monstercat = 1
+; waves = 1
+
+# Set gravity multiplier for "drop off". Higher values means bars will drop faster.
+# Accepts only non-negative values. 0.5 means half gravity, 2 means double. Set to 0 to disable "drop off".
+; gravity = 2
+
+
+# In bar height, bars that would have been lower that this will not be drawn.
+; ignore = 0
+
+
+[eq]
+
+# This one is tricky. You can have as much keys as you want.
+# Remember to uncomment more then one key! More keys = more precision.
+# Look at readme.md on github for further explanations and examples.
+#; 1 = 1 # bass
+#; 2 = 1
+#; 3 = 1 # midtone
+#; 4 = 1
+#; 5 = 1 # treble
+1=1
+2=1
+3=2
+4=1
+5=1
+
+[color]
+
+#background = '#191724'
+gradient = 1
+gradient_count = 6
+gradient_color_1 = '#31748f'
+gradient_color_2 = '#9ccfd8'
+gradient_color_3 = '#c4a7e7'
+gradient_color_4 = '#ebbcba'
+gradient_color_5 = '#f6c177'
+gradient_color_6 = '#eb6f92'
+
+[color]
+
+gradient = 1
+
+gradient_color_1 = '#94e2d5'
+gradient_color_2 = '#89dceb'
+gradient_color_3 = '#74c7ec'
+gradient_color_4 = '#89b4fa'
+gradient_color_5 = '#cba6f7'
+gradient_color_6 = '#f5c2e7'
+gradient_color_7 = '#eba0ac'
+gradient_color_8 = '#f38ba8'

modules/cli/media/cava/config/config-applet

@@ -0,0 +1,167 @@
+## Configuration file for CAVA. Default values are commented out. Use either ';' or '#' for commenting.
+
+
+[general]
+
+# Smoothing mode. Can be 'normal', 'scientific' or 'waves'.
+mode = normal
+
+# Accepts only non-negative values.
+framerate = 60
+
+# 'autosens' will attempt to decrease sensitivity if the bars peak. 1 = on, 0 = off
+# 'overshoot' allows bars to overshoot (in % of terminal height) without initiating autosens.
+; autosens = 1
+; overshoot = 20
+
+# Manual sensitivity in %. Autosens must be turned off for this to take effect.
+# 200 means double height. Accepts only non-negative values.
+; sensitivity = 100
+
+# The number of bars (0-200). 0 sets it to auto (fill up console).
+# Bars' width and space between bars in number of characters.
+bars = 0
+bar_width = 2
+bar_spacing = 1
+
+# Lower and higher cutoff frequencies for lowest and highest bars
+# the bandwidth of the visualizer.
+# Note: there is a minimum total bandwidth of 43Mhz x number of bars.
+# Cava will automatically increase the higher cutoff if a too low band is specified.
+; lower_cutoff_freq = 50
+; higher_cutoff_freq = 10000
+
+
+
+[input]
+
+# Audio capturing method. Possible methods are: 'pulse', 'alsa' or 'fifo'.
+# Defaults to 'pulse', 'alsa' or 'fifo', in that order, dependent on what support cava was built with.
+#
+# All input methods uses the same config variable 'source'
+# to define where it should get the audio.
+#
+# For pulseaudio 'source' will be the source. Default: 'auto', which uses the monitor source of the default sink
+# (all pulseaudio sinks(outputs) have 'monitor' sources(inputs) associated with them).
+#
+# For alsa 'source' will be the capture device.
+# For fifo 'source' will be the path to fifo-file.
+method = pulse
+source = auto
+
+; method = alsa
+; source = hw:Loopback,1
+
+; method = fifo
+; source = /tmp/mpd.fifo
+
+
+
+[output]
+
+# Ouput method. Can be 'ncurses', 'noncurses' or 'raw'.
+# 'noncurses' is for systems that does not suport ncurses.
+# 'raw' is a 16 bit data stream of the bar heights that can be used to send to other applications.
+# 'raw' defaults to 200 bars, which can be adjusted in the 'bars' option above.
+method = ncurses
+
+# Visual styles. Can be 'stereo' or 'mono'.
+# 'stereo' mirrors both channels with low frequencies in center.
+# 'mono' averages both channels and outputs left to right lowest to highest frequencies.
+style = mono
+
+# Raw output target. A fifo will be created if target does not exist.
+; raw_target = /dev/stdout
+
+# Raw data format. Can be 'binary' or 'ascii'.
+; data_format = binary
+
+# Binary bit format, can be '8bit' (0-255) or '16bit' (0-65530).
+; bit_format = 16bit
+
+# Ascii max value. In 'ascii' mode range will run from 0 to value specified here
+; ascii_max_range = 1000
+
+# Ascii delimiters. In ascii format each bar and frame is separated by a delimiters.
+# Use decimal value in ascii table (i.e. 59 = ';' and 10 = '\n' (line feed)).
+; bar_delimiter = 59
+; frame_delimiter = 10
+
+
+
+# [color]
+
+# # Colors can be one of seven predefined: black, blue, cyan, green, magenta, red, white, yellow.
+# # Or defined by hex code '#xxxxxx' (hex code must be within ''). User defined colors requires a
+# # terminal that can change color definitions such as Gnome-terminal or rxvt.
+# ; background = black
+# ; foreground = cyan
+
+# # Gradient mode, only hex defined colors are supported, background must also be defined in hex
+# # or remain commented out. 1 = on, 0 = off. Warning: for certain terminal emulators cava will
+# # not able to restore color definitions on exit, simply restart your terminal to restore colors.
+# gradient = 1
+# gradient_color_1 = '#0099ff'
+# gradient_color_2 = '#ff3399'
+
+
+
+[smoothing]
+
+# Multiplier for the integral smoothing calculations. Takes values from 0-0.99.
+# Higher values means smoother, but less precise. Set to 0 to disable.
+; integral = 0.7
+
+# Disables or enables the so-called "Monstercat smoothing". Set to 0 to disable.
+; monstercat = 1
+; waves = 1
+
+# Set gravity multiplier for "drop off". Higher values means bars will drop faster.
+# Accepts only non-negative values. 0.5 means half gravity, 2 means double. Set to 0 to disable "drop off".
+; gravity = 1
+
+
+# In bar height, bars that would have been lower that this will not be drawn.
+; ignore = 0
+
+
+[eq]
+
+# This one is tricky. You can have as much keys as you want.
+# Remember to uncomment more then one key! More keys = more precision.
+# Look at readme.md on github for further explanations and examples.
+#; 1 = 1 # bass
+#; 2 = 1
+#; 3 = 1 # midtone
+#; 4 = 1
+#; 5 = 1 # treble
+1=1
+2=1
+3=2
+4=1
+5=1
+
+[color]
+
+#background = '#191724'
+gradient = 1
+gradient_count = 6
+gradient_color_1 = '#31748f'
+gradient_color_2 = '#9ccfd8'
+gradient_color_3 = '#c4a7e7'
+gradient_color_4 = '#ebbcba'
+gradient_color_5 = '#f6c177'
+gradient_color_6 = '#eb6f92'
+
+[color]
+
+gradient = 1
+
+gradient_color_1 = '#94e2d5'
+gradient_color_2 = '#89dceb'
+gradient_color_3 = '#74c7ec'
+gradient_color_4 = '#89b4fa'
+gradient_color_5 = '#cba6f7'
+gradient_color_6 = '#f5c2e7'
+gradient_color_7 = '#eba0ac'
+gradient_color_8 = '#f38ba8'

modules/cli/media/cava/config/shaders/bar_spectrum.frag

@@ -0,0 +1,79 @@
+#version 330
+
+in vec2 fragCoord;
+out vec4 fragColor;
+
+// bar values. defaults to left channels first (low to high), then right (high to low).
+uniform float bars[512];
+
+uniform int bars_count;    // number of bars (left + right) (configurable)
+uniform int bar_width;    // bar width (configurable), not used here
+uniform int bar_spacing;    // space bewteen bars (configurable)
+
+uniform vec3 u_resolution; // window resolution
+
+//colors, configurable in cava config file (r,g,b) (0.0 - 1.0)
+uniform vec3 bg_color; // background color
+uniform vec3 fg_color; // foreground color
+
+uniform int gradient_count;
+uniform vec3 gradient_colors[8]; // gradient colors
+
+vec3 normalize_C(float y,vec3 col_1, vec3 col_2, float y_min, float y_max)
+{
+    //create color based on fraction of this color and next color
+    float yr = (y - y_min) / (y_max - y_min);
+    return col_1 * (1.0 - yr) + col_2 * yr;
+}
+
+void main()
+{
+    // find which bar to use based on where we are on the x axis
+    float x = u_resolution.x * fragCoord.x;
+    int bar = int(bars_count * fragCoord.x);
+
+    //calculate a bar size
+    float bar_size = u_resolution.x / bars_count;
+
+    //the y coordinate and bar values are the same
+    float y =  bars[bar];
+
+    // make sure there is a thin line at bottom
+    if (y * u_resolution.y < 1.0)
+    {
+      y = 1.0 / u_resolution.y;
+    }
+
+    //draw the bar up to current height
+    if (y > fragCoord.y)
+    {
+        //make some space between bars basen on settings
+        if (x > (bar + 1) * (bar_size) - bar_spacing)
+        {
+            fragColor = vec4(bg_color,1.0);
+        }
+        else
+        {
+            if (gradient_count == 0)
+            {
+                fragColor = vec4(fg_color,1.0);
+            }
+            else
+            {
+                //find which color in the configured gradient we are at
+                int color = int((gradient_count - 1) * fragCoord.y);
+
+                //find where on y this and next color is supposed to be
+                float y_min = color / (gradient_count - 1.0);
+                float y_max = (color + 1.0) / (gradient_count - 1.0);
+
+                //make color
+                fragColor = vec4(normalize_C(fragCoord.y, gradient_colors[color], gradient_colors[color + 1], y_min, y_max), 1.0);
+            }
+        }
+    }
+    else
+    {
+        fragColor = vec4(bg_color,1.0);
+    }
+}

modules/cli/media/cava/config/shaders/normalized_bars.frag

@@ -0,0 +1,38 @@
+#version 330
+
+in vec2 fragCoord;
+out vec4 fragColor;
+
+// bar values. defaults to left channels first (low to high), then right (high to low).
+uniform float bars[512];
+
+uniform int bars_count;    // number of bars (left + right) (configurable)
+
+uniform vec3 u_resolution; // window resolution, not used here
+
+//colors, configurable in cava config file
+uniform vec3 bg_color; // background color(r,g,b) (0.0 - 1.0), not used here
+uniform vec3 fg_color; // foreground color, not used here
+
+float normalize_C(float x, float x_min, float x_max, float r_min, float r_max )
+{
+	float xr;
+	xr = (r_max-r_min) * (x - x_min) / (x_max - x_min) + r_min;
+	return xr;
+}
+
+void main()
+{
+    // find which bar to use based on where we are on the x axis
+    int bar = int(bars_count * fragCoord.x);
+
+    // create a normal along the y axis based on the bar height
+    float x = normalize_C(fragCoord.y, 1.0, 0.0, 0.0, bars[bar]);
+
+    // set color
+    fragColor.r=fg_color.x*x;
+    fragColor.g=fg_color.y*x;
+    fragColor.b=fg_color.z*x;
+    fragColor.a=1.0;
+
+}

modules/cli/media/cava/config/shaders/northern_lights.frag

@@ -0,0 +1,34 @@
+#version 330
+
+in vec2 fragCoord;
+out vec4 fragColor;
+
+// bar values. defaults to left channels first (low to high), then right (high to low).
+uniform float bars[512];
+
+uniform int bars_count;    // number of bars (left + right) (configurable)
+
+uniform vec3 u_resolution; // window resolution, not used here
+
+//colors, configurable in cava config file
+uniform vec3 bg_color; // background color(r,g,b) (0.0 - 1.0), not used here
+uniform vec3 fg_color; // foreground color, not used here
+
+void main()
+{
+    // find which bar to use based on where we are on the x axis
+    int bar = int(bars_count * fragCoord.x);
+
+    float bar_y = 1.0 - abs((fragCoord.y - 0.5)) * 2.0;
+    float y = (bars[bar]) * bar_y;
+
+    float bar_x = (fragCoord.x - float(bar) / float(bars_count)) * bars_count;
+    float bar_r = 1.0 - abs((bar_x - 0.5)) * 2;
+
+    bar_r = bar_r * bar_r * 2;
+
+    // set color
+    fragColor.r = fg_color.x * y * bar_r;
+    fragColor.g = fg_color.y * y * bar_r;
+    fragColor.b = fg_color.z * y * bar_r;
+}

modules/cli/media/cava/config/shaders/pass_through.vert

@@ -0,0 +1,14 @@
+#version 330
+
+
+// Input vertex data, different for all executions of this shader.
+layout(location = 0) in vec3 vertexPosition_modelspace;
+
+// Output data ; will be interpolated for each fragment.
+out vec2 fragCoord;
+
+void main()
+{
+    gl_Position =  vec4(vertexPosition_modelspace,1);
+    fragCoord  = (vertexPosition_modelspace.xy+vec2(1,1))/2.0;
+}

modules/cli/media/cava/default.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+lib.my.makeHomePackageConfig {
+  inherit config pkgs;
+  packageName = "cava";
+  packagePath = [ "cava" ];
+  optionPath = [
+    "cli"
+    "media"
+    "cava"
+  ];
+  extraConfig = {
+    my.home.xdg.configFile."cava" = {
+      source = ./config;
+      recursive = true;
+    };
+  };
+}

modules/cli/media/ffmpeg.nix

@@ -4,15 +4,13 @@
   pkgs,
   ...
 }:
-let
+lib.my.makeHomePackageConfig {
-  cfg = config.my.cli.media.ffmpeg;
+  inherit config pkgs;
-in
+  packageName = "ffmpeg";
-{
+  packagePath = [ "ffmpeg" ];
-  options.my.cli.media.ffmpeg = {
+  optionPath = [
-    enable = lib.mkEnableOption "ffmpeg";
+    "cli"
-  };
+    "media"
-
+    "ffmpeg"
-  config = lib.mkIf cfg.enable {
+  ];
-    my.hm.home.packages = [ pkgs.ffmpeg ];
-  };
 }

modules/cli/media/go-musicfox.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  secrets,
-  ...
-}:
-let
-  cfg = config.my.cli.media.go-musicfox;
-in
-{
-  options.my.cli.media.go-musicfox = {
-    enable = lib.mkEnableOption "go-musicfox";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my = {
-      hm = {
-        home.packages = with pkgs; [
-          playerctl
-          go-musicfox
-        ];
-        sops.secrets.go-musicfox = {
-          sopsFile = secrets.go-musicfox;
-          format = "binary";
-          path = "${config.my.hm.xdg.configHome}/go-musicfox/config.toml";
-        };
-      };
-
-      desktop.media.mpv.enable = lib.mkForce true;
-
-      persist.homeDirs = [
-        ".local/share/go-musicfox/db"
-      ];
-      persist.homeFiles = [
-        ".local/share/go-musicfox/cookie"
-      ];
-    };
-  };
-}

modules/cli/media/go-musicfox/default.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+lib.my.makeSwitch {
+  inherit config;
+  optionName = "go-musicfox";
+  optionPath = [
+    "cli"
+    "media"
+    "go-musicfox"
+  ];
+  config' = {
+    my = {
+      home = {
+        home.packages = with pkgs; [
+          playerctl
+          go-musicfox
+        ];
+        xdg.configFile."go-musicfox/go-musicfox.ini".source = ./go-musicfox.ini;
+      };
+
+      cli.media.mpd.enable = true;
+
+      persist.homeDirs = [
+        ".config/go-musicfox/db"
+      ];
+      persist.homeFiles = [
+        ".config/go-musicfox/cookie"
+      ];
+    };
+  };
+}

modules/cli/media/go-musicfox/go-musicfox.ini

@@ -0,0 +1,97 @@
+# 启动页配置
+[startup]
+# 是否显示启动页
+show=false
+# 启动页进度条是否有回弹效果
+progressOutBounce=true
+# 启动页时长
+loadingSeconds=2
+# 启动页欢迎语
+welcome=musicfox
+# 启动时自动签到
+signin=false
+
+# 进度条配置
+[progress]
+# 进度条已加载字符
+fullChar=#
+# 进度条未加载字符
+emptyChar=
+
+# 主页面配置
+[main]
+# 是否显示标题
+showTitle=true
+# 加载中提示
+loadingText=[加载中...]
+# 歌曲音质，可选项：standard, exhigh, lossless, hires, jyeffect(高清环绕声), sky(沉浸环绕声), jymaster(超清母带) 进行音质判断
+songLevel=hires
+# 主题颜色
+# 随机
+# primaryColor=random
+# 经典网易云音乐红
+#primaryColor="#ea403f"
+primaryColor="#6186D9"
+# 是否显示歌词
+showLyric=true
+# 歌词偏移 ms
+lyricOffset=0
+# 显示歌词翻译
+showLyricTrans=true
+# 是否显示通知信息
+showNotify=false
+# 开启pprof, --pprof时会开启
+pprofPort=9876
+# altScreen显示模式
+altScreen=true
+# 双列显示，开启务必使用等宽字体
+doubleColumn=true
+# 下载目录，默认为$HOME/.go-musicfox/download
+downloadDir=/home/imxyy/Music/go-musicfox
+# 缓存目录，默认为${MUSICFOX_ROOT}/cache
+cacheDir=/home/imxyy/Music/go-musicfox/.cache
+# 缓存大小（以MB为单位），0为不使用缓存，-1为不限制，默认为0
+cacheLimit=-1
+# 是否显示歌单下所有歌曲，默认不开启，仅获取歌单前1000首，开启后可能会占用更多内存（大量歌曲数据）和带宽（会同时发送多个请求获取歌单下歌曲数据）
+showAllSongsOfPlaylist=false
+# 动态显示menu行数
+dynamicMenuRows=true
+enableMouseEvent = false
+
+[autoplay]
+# 是否开启自动播放，默认不开启
+autoPlay=true
+# 自动播放歌单，dailyReco,like,no（保持上次退出时的设置，无视offset）,name:歌单名，默认dailyReco
+autoPlayList="no"
+# 播放偏移，0为第一首，-1为最后一首，默认为0
+offset=0
+# 播放模式，listLoop, order, singleLoop, random, intelligent（心动）, last（上次退出时的模式）,default，默认为last
+playMode=singleLoop
+
+[player]
+# 播放引擎 beep / mpd(需要安装配置mpd) / osx(Mac才可用)
+# 不填Mac默认使用osx，其他系统默认使用beep（推荐的配置）
+engine=mpd
+# beep使用的mp3解码器，可选：go-mp3, minimp3 (minimp3更少的CPU占用，但是稳定性不如go-mp3)
+#beepMp3Decoder=go-mp3
+
+# mpd配置
+mpdBin=mpd
+# !!!注意!!! 一定要在配置文件中设置pid_file，否则在退出时不会kill掉mpd进程
+mpdConfigFile=/home/imxyy/.config/mpd/mpd.conf
+mpdNetwork=tcp
+mpdAddr=127.0.0.1:6600
+
+[unm]
+# UNM开关
+switch=true
+# UNM源: kuwo,kugou,migu,qq
+sources=kuwo,kugou
+# UNM搜索其他平台限制 0-3
+searchLimit=0
+# 解除会员限制
+enableLocalVip=true
+# 解除音质限制
+unlockSoundEffects=true
+# QQ音乐cookie文件
+qqCookieFile=

modules/cli/media/mpd/default.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+lib.my.makeSwitch {
+  inherit config;
+  optionName = "mpd";
+  optionPath = [
+    "cli"
+    "media"
+    "mpd"
+  ];
+  config' = {
+    my.home = {
+      home.packages = with pkgs.stable; [
+        mpd
+        mpc-cli
+      ];
+      services.mpris-proxy.enable = true;
+      xdg.configFile."mpd/mpd.conf".source = ./mpd.conf;
+    };
+    my.persist.homeFiles = [
+      ".config/mpd/mpd.db"
+    ];
+  };
+}

modules/cli/media/mpd/mpd.conf

@@ -0,0 +1,30 @@
+bind_to_address   "127.0.0.1"
+port              "6600"
+music_directory   "/home/imxyy/Music/go-musicfox/.cache"
+pid_file          "/home/imxyy/.config/mpd/mpd.pid"
+db_file           "/home/imxyy/.config/mpd/mpd.db"
+
+input {
+    plugin      "file"
+    enabled     "yes"
+}
+
+input {
+    plugin      "curl"
+    enabled     "yes"
+}
+
+decoder {
+    plugin      "ffmpeg"
+    enabled     "yes"
+}
+
+audio_output {
+    type        "pipewire"
+    name        "pipewire"
+}
+
+audio_output {
+    type        "pulse"
+    name        "pulseaudio"
+}

modules/cli/misc.nix

@@ -2,24 +2,24 @@
   config,
   lib,
   pkgs,
+  username,
+  userfullname,
+  useremail,
   ...
 }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.misc;
+  inherit config;
-in
-{
-  options.my.cli.misc = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
   default = true;
-      description = "Enable misc command line tools";
+  optionName = "misc command line tools";
-    };
+  optionPath = [
-  };
+    "cli"
-
+    "misc"
-  config = lib.mkIf cfg.enable {
+  ];
+  config' = {
     environment.systemPackages = with pkgs; [
       vim
       wget
+      git
 
       file
       gnused
@@ -46,33 +46,21 @@ in
 
     programs.dconf.enable = true;
 
-    my.persist.homeDirs = [
+    my.home = {
-      ".local/share/zoxide"
-      ".config/television/cable"
-    ];
-    my.hm = {
       home.packages = with pkgs; [
-        # keep-sorted start
-        aria2
-        bat
-        comma
-        fastfetch
-        fd
-        fzf
-        keep-sorted
         lsd
+        fd
         neofetch
+        fzf
+        bat
         ripgrep
+
+        aria2
         socat
-        typos
-        # keep-sorted end
       ];
       programs.tmux = {
         enable = true;
-        extraConfig = ''
+        extraConfig = "set-option -g mouse on";
-          set-option -g mouse on
-          set-option -a terminal-features ",xterm-256color:RGB,focus,clipboard,usstyle"
-        '';
         plugins = [
           (pkgs.tmuxPlugins.mkTmuxPlugin {
             pluginName = "tokyo-night-tmux";
@@ -92,125 +80,6 @@ in
         enableAutoUpdates = true;
         settings.updates.auto_update = true;
       };
-      programs.television = {
-        enable = true;
-        enableZshIntegration = true;
-        enableFishIntegration = true;
-      };
-      programs.zoxide = {
-        enable = true;
-        enableZshIntegration = true;
-        enableFishIntegration = true;
-      };
-      xdg.configFile."fastfetch/config.jsonc".text = ''
-        {
-          "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
-          "display": {
-            "separator": "  "
-          },
-          "modules": [
-            // Title
-            {
-              "type": "title",
-              "format": "{user-name-colored}{#}@{host-name-colored}"
-            },
-            {
-              "type": "custom",
-              "format": "---------------"
-            },
-            // System Information
-            {
-              "type": "custom",
-              "format": "{#}System Information"
-            },
-            {
-              "type": "os",
-              "key": "{#keys}󰍹 OS"
-            },
-            {
-              "type": "kernel",
-              "key": "{#keys}󰒋 Kernel"
-            },
-            {
-              "type": "uptime",
-              "key": "{#keys}󰅐 Uptime"
-            },
-            {
-              "type": "packages",
-              "key": "{#keys}󰏖 Packages",
-              "format": "{all}"
-            },
-            {
-              "type": "custom",
-              "format": ""
-            },
-            // Desktop Environment
-            {
-              "type": "custom",
-              "format": "{#}Desktop Environment"
-            },
-            {
-              "type": "de",
-              "key": "{#keys}󰧨 DE"
-            },
-            {
-              "type": "wm",
-              "key": "{#keys}󱂬 WM"
-            },
-            {
-              "type": "wmtheme",
-              "key": "{#keys}󰉼 Theme"
-            },
-            {
-              "type": "display",
-              "key": "{#keys}󰹑 Resolution"
-            },
-            {
-              "type": "shell",
-              "key": "{#keys}󰞷 Shell"
-            },
-            {
-              "type": "terminalfont",
-              "key": "{#keys}󰛖 Font"
-            },
-            {
-              "type": "custom",
-              "format": ""
-            },
-            // Hardware Information
-            {
-              "type": "custom",
-              "format": "{#}Hardware Information"
-            },
-            {
-              "type": "cpu",
-              "key": "{#keys}󰻠 CPU"
-            },
-            {
-              "type": "gpu",
-              "key": "{#keys}󰢮 GPU"
-            },
-            {
-              "type": "memory",
-              "key": "{#keys}󰍛 Memory"
-            },
-            {
-              "type": "disk",
-              "key": "{#keys}󰋊 Disk (/)",
-              "folders": "/"
-            },
-            {
-              "type": "custom",
-              "format": ""
-            },
-            // Colors
-            {
-              "type": "colors",
-              "symbol": "circle"
-            },
-          ]
-        }
-      '';
     };
   };
 }

modules/cli/monitor/all.nix

@@ -1,13 +1,13 @@
 { config, lib, ... }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.monitor.all;
+  inherit config;
-in
+  optionName = "all command line monitor tools";
-{
+  optionPath = [
-  options.my.cli.monitor.all = {
+    "cli"
-    enable = lib.mkEnableOption "all command line monitor tools";
+    "monitor"
-  };
+    "all"
-
+  ];
-  config = lib.mkIf cfg.enable {
+  config' = {
     my.cli.monitor = {
       btop.enable = true;
     };

modules/cli/monitor/btop/config/themes/nord.theme

@@ -18,7 +18,7 @@ theme[main_fg]="#D8DEE9"
 # Title color for boxes
 theme[title]="#8FBCBB"
 
-# Highlight color for keyboard shortcuts
+# Higlight color for keyboard shortcuts
 theme[hi_fg]="#5E81AC"
 
 # Background color of selected item in processes box

modules/cli/monitor/btop/default.nix

@@ -4,17 +4,17 @@
   pkgs,
   ...
 }:
-let
+lib.my.makeHomePackageConfig {
-  cfg = config.my.cli.monitor.btop;
+  inherit config pkgs;
-in
+  packageName = "btop";
-{
+  packagePath = [ "btop" ];
-  options.my.cli.monitor.btop = {
+  optionPath = [
-    enable = lib.mkEnableOption "btop";
+    "cli"
-  };
+    "monitor"
-
+    "btop"
-  config = lib.mkIf cfg.enable {
+  ];
-    my.hm.home.packages = [ pkgs.btop ];
+  extraConfig = {
-    my.hm.xdg.configFile."btop" = {
+    my.home.xdg.configFile."btop" = {
       source = ./config;
       recursive = true;
     };

modules/cli/shell/all.nix

@@ -1,17 +1,15 @@
 { config, lib, ... }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.shell.all;
+  inherit config;
-in
+  optionName = "all shells";
-{
+  optionPath = [
-  options.my.cli.shell.all = {
+    "cli"
-    enable = lib.mkEnableOption "all shells";
+    "shell"
-  };
+    "all"
-
+  ];
-  config = lib.mkIf cfg.enable {
+  config' = {
     my.cli.shell = {
       zsh.enable = true;
-      fish.enable = true;
-      starship.enable = true;
     };
   };
 }

modules/cli/shell/defaultShell.nix

@@ -1,34 +0,0 @@
-{
-  lib,
-  config,
-  username,
-  ...
-}:
-let
-  cfg = config.my.cli.shell;
-in
-{
-  options.my.cli.shell.default = lib.mkOption {
-    type = lib.types.enum [
-      "fish"
-      "zsh"
-    ];
-    default = "fish";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf (cfg.default == "fish") {
-      my.cli.shell.fish.enable = true;
-      users.users.${username} = {
-        shell = config.my.hm.programs.fish.package;
-        # do not need `programs.fish.enable = true` since fish is managed by home-manager
-        ignoreShellProgramCheck = true;
-      };
-    })
-
-    (lib.mkIf (cfg.default == "zsh") {
-      my.cli.shell.zsh.enable = true;
-      users.users.${username}.shell = config.my.hm.programs.zsh.package;
-    })
-  ];
-}

modules/cli/shell/fish.nix

@@ -1,108 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.my.cli.shell.fish;
-in
-{
-  options.my.cli.shell.fish = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Enable default fish settings";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.persist = {
-      homeDirs = [
-        ".local/share/fish"
-      ];
-    };
-    my.hm = {
-      xdg.configFile."fish/themes/tokyonight_storm.theme".source = builtins.fetchurl {
-        url = "https://raw.githubusercontent.com/folke/tokyonight.nvim/refs/tags/v4.14.1/extras/fish_themes/tokyonight_storm.theme";
-        sha256 = "02n1w5x65683c8mlwg1rav06iqm3xk90zq45qmygpm7pzyn8dqh1";
-      };
-      programs.starship.enableFishIntegration = false;
-      programs.fish = {
-        enable = true;
-        plugins = [
-          {
-            name = "extract";
-            src = pkgs.fetchFromGitHub {
-              owner = "hexclover";
-              repo = "fish-extract-ng";
-              tag = "v0.1";
-              hash = "sha256-yef5NX4HdZ3ab/2AzNrvvhi0CbeTvXYKZmyH76gIpyk=";
-            };
-          }
-        ];
-        shellAliases = {
-          la = "lsd -lah";
-          ls = "lsd";
-          svim = "doasedit";
-          nf = "fastfetch";
-        };
-        interactiveShellInit = lib.mkBefore ''
-          fish_vi_key_bindings
-          fish_config theme choose tokyonight_storm
-          ${lib.optionalString config.my.cli.shell.starship.enable "source ${./starship.fish}"}
-        '';
-        functions = {
-          fish_greeting = "";
-          yank_to_clipboard = {
-            description = "Insert latest killring entry into the system clipboard";
-            body = ''printf "%s" "$fish_killring[1]" | fish_clipboard_copy'';
-          };
-          fish_user_key_bindings = ''
-            # make vi mode yanks copy to clipboard
-            bind yy kill-whole-line yank_to_clipboard yank
-            bind Y kill-whole-line yank_to_clipboard yank
-            bind y,\$ kill-line yank_to_clipboard yank
-            bind y,\^ backward-kill-line yank_to_clipboard yank
-            bind y,0 backward-kill-line yank_to_clipboard yank
-            bind y,w kill-word yank_to_clipboard yank
-            bind y,W kill-bigword yank_to_clipboard yank
-            bind y,i,w forward-single-char forward-single-char backward-word kill-word yank_to_clipboard yank
-            bind y,i,W forward-single-char forward-single-char backward-bigword kill-bigword yank_to_clipboard yank
-            bind y,a,w forward-single-char forward-single-char backward-word kill-word yank_to_clipboard yank
-            bind y,a,W forward-single-char forward-single-char backward-bigword kill-bigword yank_to_clipboard yank
-            bind y,e kill-word yank_to_clipboard yank
-            bind y,E kill-bigword yank_to_clipboard yank
-            bind y,b backward-kill-word yank_to_clipboard yank
-            bind y,B backward-kill-bigword yank_to_clipboard yank
-            bind y,g,e backward-kill-word yank_to_clipboard yank
-            bind y,g,E backward-kill-bigword yank_to_clipboard yank
-            bind y,f begin-selection forward-jump kill-selection yank_to_clipboard yank end-selection
-            bind y,t begin-selection forward-jump-till kill-selection yank_to_clipboard yank end-selection
-            bind y,F begin-selection backward-jump kill-selection yank_to_clipboard yank end-selection
-            bind y,T begin-selection backward-jump-till kill-selection yank_to_clipboard yank end-selection
-            bind y,h backward-char begin-selection kill-selection yank_to_clipboard yank end-selection
-            bind y,l begin-selection kill-selection yank_to_clipboard yank end-selection
-            bind y,i,b jump-till-matching-bracket and jump-till-matching-bracket and begin-selection jump-till-matching-bracket kill-selection yank_to_clipboard yank end-selection
-            bind y,a,b jump-to-matching-bracket and jump-to-matching-bracket and begin-selection jump-to-matching-bracket kill-selection yank_to_clipboard yank end-selection
-            bind y,i backward-jump-till and repeat-jump-reverse and begin-selection repeat-jump kill-selection yank_to_clipboard yank end-selection
-            bind y,a backward-jump and repeat-jump-reverse and begin-selection repeat-jump kill-selection yank_to_clipboard yank end-selection
-            bind -M visual -m default y kill-selection yank_to_clipboard yank end-selection repaint-mode
-
-            # use system clipboard for vi mode pastes
-            bind -s p 'set -g fish_cursor_end_mode exclusive' forward-char 'set -g fish_cursor_end_mode inclusive' fish_clipboard_paste
-            bind -s P fish_clipboard_paste
-          '';
-
-          nix-closure-size = {
-            body = ''
-              nix path-info --recursive --size --closure-size \
-                            --human-readable $(readlink -f $(which $program))
-            '';
-            argumentNames = [ "program" ];
-          };
-        };
-      };
-    };
-  };
-}

modules/cli/shell/starship.fish

@@ -1,143 +0,0 @@
-# This file is modified from:
-# https://github.com/tyler-stefani/starship/blob/main/conf.d/starship.fish
-# The MIT License can be found here:
-# https://github.com/tyler-stefani/starship/blob/main/LICENSE
-
-status is-interactive
-or exit 0
-
-# set temp file and signal for async prompts
-if test -n "$XDG_RUNTIME_DIR"
-    set -g starship_temp_dir "$XDG_RUNTIME_DIR"/fish-async-prompt
-else
-    set -g starship_temp_dir /tmp/fish-async-prompt
-end
-mkdir -p "$starship_temp_dir"
-set -g starship_temp_file "$starship_temp_dir"/"$fish_pid"_last_prompt
-set -g starship_async_signal SIGUSR1
-
-function fish_prompt
-    if test "$TRANSIENT" = "1"
-        starship_transient_prompt_func
-    else if test -e $starship_temp_file
-        cat $starship_temp_file 
-    else
-        starship_transient_prompt_func
-    end
-end
-
-function starship_transient_prompt_func
-    # Clear from cursor to end of screen as `commandline -f repaint` does not do this
-    # See https://github.com/fish-shell/fish-shell/issues/8418
-    printf \e\[0J
-    starship module character
-end
-
-
-function fish_right_prompt
-    switch "$fish_key_bindings"
-        case fish_hybrid_key_bindings fish_vi_key_bindings
-            set STARSHIP_KEYMAP "$fish_bind_mode"
-        case '*'
-            set STARSHIP_KEYMAP insert
-    end
-    set STARSHIP_CMD_PIPESTATUS $pipestatus
-    set STARSHIP_CMD_STATUS $status
-    # Account for changes in variable name between v2.7 and v3.0
-    set STARSHIP_DURATION "$CMD_DURATION$cmd_duration"
-    set STARSHIP_JOBS (count (jobs -p))
-    if test "$TRANSIENT" = "1"
-        if type -q starship_transient_rprompt_func
-            starship_transient_rprompt_func
-        else
-            printf ""
-        end
-    else
-        starship prompt --right --terminal-width="$COLUMNS" --status=$STARSHIP_CMD_STATUS --pipestatus="$STARSHIP_CMD_PIPESTATUS" --keymap=$STARSHIP_KEYMAP --cmd-duration=$STARSHIP_DURATION --jobs=$STARSHIP_JOBS
-    end
-end
-
-# Disable virtualenv prompt, it breaks starship
-set -g VIRTUAL_ENV_DISABLE_PROMPT 1
-
-# Remove default mode prompt
-builtin functions -e fish_mode_prompt
-
-set -gx STARSHIP_SHELL fish
-
-# Transience related functions
-function reset-transient --on-event fish_postexec
-    set -g TRANSIENT 0
-end
-
-function transient_execute
-    if commandline --is-valid
-        set -g TRANSIENT 1
-        commandline -f repaint
-    else
-        set -g TRANSIENT 0
-    end
-    commandline -f execute
-end
-
-function transient_cancel
-    if string length -q -- (commandline)
-        set -g TRANSIENT 1
-        commandline -f repaint
-    end
-    commandline -f cancel-commandline
-end
-
-# --user is the default, but listed anyway to make it explicit.
-function enable_transience --description 'enable transient prompt keybindings'
-    bind --user \r transient_execute
-    bind --user -M insert \r transient_execute
-    bind --user \cc transient_cancel
-end
-
-# Erase the transient prompt related key bindings.
-# --user is the default, but listed anyway to make it explicit.
-# Erasing a user binding will revert to the preset.
-function disable_transience --description 'remove transient prompt keybindings'
-    bind --user -e \r
-    bind --user -M insert -e \r
-    bind --user -e \cc
-end
-
-# Set up the session key that will be used to store logs
-# We don't use `random [min] [max]` because it is unavailable in older versions of fish shell
-set -gx STARSHIP_SESSION_KEY (string sub -s1 -l16 (random)(random)(random)(random)(random)0000000000000000)
-
-# async related functions
-function write_prompt_to_temp --on-event fish_prompt
-    switch "$fish_key_bindings"
-        case fish_hybrid_key_bindings fish_vi_key_bindings
-            set STARSHIP_KEYMAP "$fish_bind_mode"
-        case '*'
-            set STARSHIP_KEYMAP insert
-    end
-    set STARSHIP_CMD_PIPESTATUS $pipestatus
-    set STARSHIP_CMD_STATUS $status
-    # Account for changes in variable name between v2.7 and v3.0
-    set STARSHIP_DURATION "$CMD_DURATION$cmd_duration"
-    set STARSHIP_JOBS (count (jobs -p))
-
-    # MODIFIED: '"$STARSHIP_CMD_PIPESTATUS"' -> '$STARSHIP_CMD_PIPESTATUS'
-    fish -c 'starship prompt \
-	    --terminal-width='"$COLUMNS"' \
-	    --status='$STARSHIP_CMD_STATUS' \
-	    --pipestatus='$STARSHIP_CMD_PIPESTATUS' \
-	    --keymap='$STARSHIP_KEYMAP' \
-	    --cmd-duration='$STARSHIP_DURATION' \
-	    --jobs='$STARSHIP_JOBS' > '$starship_temp_file' \
-	    && kill -s '"$starship_async_signal"' '"$fish_pid"'' &
-    disown
-end
-
-function repaint_prompt_on_signal --on-signal "$starship_async_signal"
-    commandline -f repaint
-end
-
-function remove_temp_prompt_on_exit --on-event fish_exit
-    rm -f $starship_temp_file
-end

modules/cli/shell/starship.nix

@@ -1,21 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.cli.shell.starship;
-in
-{
-  options.my.cli.shell.starship = {
-    enable = lib.mkEnableOption "starship prompt";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.hm = {
-      programs.starship = {
-        enable = true;
-        settings = lib.recursiveUpdate (with builtins; fromTOML (readFile ./starship-preset.toml)) {
-          add_newline = false;
-          nix_shell.disabled = true;
-        };
-      };
-    };
-  };
-}

modules/cli/shell/zsh.nix

@@ -4,41 +4,104 @@
   pkgs,
   ...
 }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.shell.zsh;
+  inherit config;
-in
-{
-  options.my.cli.shell.zsh = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
   default = true;
-      description = "Enable default zsh settings";
+  optionName = "default zsh settings";
+  optionPath = [
+    "cli"
+    "shell"
+    "zsh"
+  ];
+  config' = {
+    my.persist.homeDirs = [ ".local/share/zoxide" ];
+    my.home =
+      let
+        stateHome = config.my.home.xdg.stateHome;
+        zsh-syntax-highlighting = pkgs.fetchFromGitHub {
+          owner = "zsh-users";
+          repo = "zsh-syntax-highlighting";
+          rev = "0.8.0";
+          hash = "sha256-iJdWopZwHpSyYl5/FQXEW7gl/SrKaYDEtTH9cGP7iPo=";
         };
+        fzf-tab = pkgs.fetchFromGitHub {
+          owner = "Aloxaf";
+          repo = "fzf-tab";
+          rev = "v1.2.0";
+          hash = "sha256-q26XVS/LcyZPRqDNwKKA9exgBByE0muyuNb0Bbar2lY=";
         };
-
+      in
-  config = lib.mkIf cfg.enable {
+      {
-    my.hm = {
         home.packages = with pkgs; [
           fzf
+          zoxide
         ];
+        programs.starship = {
+          enable = true;
+          settings = lib.recursiveUpdate (with builtins; fromTOML (readFile ./starship-preset.toml)) {
+            add_newline = false;
+            custom = {
+              jj = {
+                ignore_timeout = true;
+                description = "The current jj status";
+                when = "jj root";
+                symbol = " ";
+                command = ''
+                  jj log --revisions @ --no-graph --ignore-working-copy --color always --limit 1 --template '
+                    separate(" ",
+                      change_id.shortest(4),
+                      bookmarks,
+                      "|",
+                      concat(
+                        if(conflict, "💥"),
+                        if(divergent, "🚧"),
+                        if(hidden, "👻"),
+                        if(immutable, "🔒"),
+                      ),
+                      raw_escape_sequence("\x1b[1;32m") ++ if(empty, "(empty)"),
+                      raw_escape_sequence("\x1b[1;32m") ++ coalesce(
+                        truncate_end(29, description.first_line(), "…"),
+                        "(no description set)",
+                      ) ++ raw_escape_sequence("\x1b[0m"),
+                    )
+                  '
+                '';
+              };
+              git_branch = {
+                when = true;
+                command = "jj root >/dev/null 2>&1 || starship module git_branch";
+                description = "Only show git_branch if we're not in a jj repo";
+              };
+              git_status = {
+                when = true;
+                command = "jj root >/dev/null 2>&1 || starship module git_status";
+                description = "Only show git_status if we're not in a jj repo";
+              };
+            };
+            git_state.disabled = true;
+            git_commit.disabled = true;
+            git_metrics.disabled = true;
+            git_branch.disabled = true;
+            git_status.disabled = true;
+            nix_shell.disabled = true;
+          };
+        };
         programs.zsh = {
           enable = true;
-        dotDir = "${config.my.hm.xdg.configHome}/zsh";
+          dotDir = ".config/zsh";
           history = {
-          path = "${config.my.hm.xdg.stateHome}/zsh_history";
+            path = "${stateHome}/zsh_history";
             ignorePatterns = [
               "la"
             ];
           };
-        autosuggestion.enable = true;
+          initContent = lib.mkAfter ''
-        syntaxHighlighting.enable = true;
+            source ${fzf-tab}/fzf-tab.plugin.zsh
-        plugins = [
+
-          {
+            eval "$(zoxide init zsh)"
-            name = "fzf-tab";
+            source ${zsh-syntax-highlighting}/zsh-syntax-highlighting.plugin.zsh
-            src = pkgs.zsh-fzf-tab;
+            source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh
-            file = "share/fzf-tab/fzf-tab.plugin.zsh";
+          '';
-          }
-        ];
           oh-my-zsh = {
             enable = true;
             theme = "gentoo";
@@ -47,13 +110,16 @@ in
               "git-extras"
               "extract"
               "sudo"
+              "dotenv"
             ];
           };
           shellAliases = {
             x = "extract";
             ls = "lsd";
-          svim = "doasedit";
+            svim = "sudoedit";
-          nf = "fastfetch";
+            nf = "neofetch";
+            tmux = "tmux -T RGB,focus,overline,mouse,clipboard,usstyle";
+            pastart = "pasuspender true";
           };
         };
       };

modules/cli/vcs/all.nix

@@ -1,13 +1,13 @@
 { config, lib, ... }:
-let
+lib.my.makeSwitch {
-  cfg = config.my.cli.vcs.all;
+  inherit config;
-in
+  optionName = "all command line tools";
-{
+  optionPath = [
-  options.my.cli.vcs.all = {
+    "cli"
-    enable = lib.mkEnableOption "all command line tools";
+    "vcs"
-  };
+    "all"
-
+  ];
-  config = lib.mkIf cfg.enable {
+  config' = {
     my.cli.vcs = {
       git.enable = true;
       jj.enable = true;

modules/cli/vcs/git.nix

@@ -4,43 +4,35 @@
   pkgs,
   username,
   userfullname,
-  emails,
+  useremail,
-  hosts,
   ...
 }:
-let
+lib.my.makeHomeProgramConfig {
-  cfg = config.my.cli.vcs.git;
+  inherit config;
-in
+  programName = "git";
-{
+  optionPath = [
-  options.my.cli.vcs.git = {
+    "cli"
-    enable = lib.mkEnableOption "git";
+    "vcs"
-  };
+    "git"
-
+  ];
-  config = lib.mkIf cfg.enable {
+  extraConfig = {
-    my.hm = {
+    my.home = {
       programs.git = {
-        enable = true;
+        userName = "${userfullname}";
-        settings = {
+        userEmail = "${useremail}";
-          gpg.ssh.allowedSignersFile =
-            hosts
-            |> lib.mapAttrsToList (
-              host: key: map (email: "${email} ${key} ${host}") (builtins.attrValues emails)
-            )
-            |> lib.flatten
-            |> lib.concatStringsSep "\n"
-            |> pkgs.writeText "allowed-signers"
-            |> toString;
-          push.autoSetupRemote = true;
-          user = {
-            name = userfullname;
-            email = emails.default;
-          };
-        };
         signing = {
           format = "ssh";
           signByDefault = true;
           key = "/home/${username}/.ssh/id_ed25519";
         };
+        extraConfig = {
+          push.autoSetupRemote = true;
+          gpg.ssh.allowedSignersFile =
+            (pkgs.writeText "allowed_signers" ''
+              imxyy1soope1@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix
+              imxyy@imxyy.top ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix
+            '').outPath;
+        };
       };
       programs.lazygit = {
         enable = true;