暂存

This reverts commit d75e195136.

.gitattributes

@@ -0,0 +1,5 @@
+*.png filter=lfs diff=lfs merge=lfs -text
+*.icm filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text
+*.webp filter=lfs diff=lfs merge=lfs -text
+*.efi filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -1,3 +1,7 @@
 result
-result-man
+result-*
 outputs
+.direnv
+build
+.vscode
+.cache

.sops.yaml

@@ -1,43 +1,63 @@
 keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
   - &chn age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
   - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
+  - &vps4 age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
   - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
   - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
-  - &yoga age1qrea4twxdhd7fnvlq5v45528c90qy6hp2wa55kghsxzgut6n6fxs7w6u42
+  - &surface age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
   - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
-  - &xmupc1 age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
+  - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
+  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
+  - &pcvm age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
 creation_rules:
-  - path_regex: secrets/pc/.*$
+  - path_regex: devices/pc/.*$
     key_groups:
     - age:
       - *chn
       - *pc
-  - path_regex: secrets/vps6/.*$
+  - path_regex: devices/vps4/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *vps4
+  - path_regex: devices/vps6/.*$
     key_groups:
     - age:
       - *chn
       - *vps6
-  - path_regex: secrets/vps7/.*$
+  - path_regex: devices/vps7/.*$
     key_groups:
     - age:
       - *chn
       - *vps7
-  - path_regex: secrets/nas/.*$
+  - path_regex: devices/nas/.*$
     key_groups:
     - age:
       - *chn
       - *nas
-  - path_regex: secrets/xmupc1/.*$
+  - path_regex: devices/surface/.*$
     key_groups:
     - age:
       - *chn
-  - path_regex: secrets/yoga/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *yoga
-  - path_regex: secrets/xmupc1/.*$
+      - *surface
+  - path_regex: devices/xmupc1/.*$
     key_groups:
     - age:
       - *chn
       - *xmupc1
+  - path_regex: devices/xmupc2/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *xmupc2
+  - path_regex: devices/pi3b/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *pi3b
+  - path_regex: devices/pcvm/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *pcvm

blog/.gitignore

@@ -0,0 +1,4 @@
+/themes
+/public
+/.hugo_build.lock
+/resources/_gen

blog/archetypes/default.md

@@ -0,0 +1,5 @@
++++
+title = '{{ replace .File.ContentBaseName "-" " " | title }}'
+date = {{ .Date }}
+draft = true
++++

blog/content/_index.md

@@ -0,0 +1,6 @@
+---
+title: Introduction
+type: docs
+---
+
+这里是主页

blog/content/docs/example/_index.md

@@ -0,0 +1,7 @@
+---
+weight: 1
+bookFlatSection: true
+title: "Example Site"
+---
+
+{{< callout emoji="​:building_construction:" >}} 施工中 {{< /callout >}}

blog/content/posts/_index.md

@@ -0,0 +1,5 @@
+---
+title: Blog
+---
+
+我得在这里写点什么

blog/content/posts/aaa.md

@@ -0,0 +1,172 @@
+---
+title = 'Aaa'
+date = 2024-08-25T13:20:46+08:00
+draft = true
+---
+
+大家好，我是陈浩南，是 xmurp 的作者。
+前两天“页文选”的 up 主联系到我，说想让我聊聊相关事情的看法。
+那我就想，我干脆也在 b 站做个视频，那就有这个东西了。
+这个是我在 b 站的第一个投稿，废话比较多，没有专业麦克风，如果有什么口胡的话大家也可以提提意见。
+视频各个章节的传送链接会放到评论区，大家可以直接跳到自己感兴趣的地方。
+
+# xmurp 是什么？
+
+它是几年前我写的一个装在**路由器**上的插件，
+  那这个插件是用来让这个路由器在校园网里，也就是在学校宿舍里，也能正常使用。
+当时我们学校的网络你买了他的带宽带的套餐之后，只许你**一台**电脑插着网线上网，
+  不管你是接路由器，还是电脑开个热点，
+  只要手机或者平板通过这个宽带连上网，他们后台都会检测到，然后就会把你的网给断了，一次断二十分钟，
+  等二十分钟恢复之后，如果它发现还是有手机或者平板通过这个宽带上网，就会再给你断网二十分钟，如此循环，
+  直到你放弃折腾，老老实实就用一台电脑上网为止。
+然后我这个插件就是解决这个问题的，路由器装这个插件之后，它会把手机或者平板的一些数据特征给抹掉，
+  那它在后台检测不到你的手机，就不会给你断网了。
+所以当时给插件起名叫 xmu 路由器补丁，简称 xmurp。
+然后我把这个源代码共享出去之后，才发现这个问题是很多学校都有的，我那个插件在很多学校都能用，然后，然后就流行起来了，是这么回事。
+
+这个事情大概是2018年到2019年的时候发生的，现在都已经过去很多年了。
+前两天（8月20日左右，字幕备注）有个叫“页文选”的 up 主找到我，
+  说想让我评价一下这个事情，就是校园网里不许装路由器的事情，以及大家去想办法绕过这个限制的事情，
+  然后把我的评价做到她的视频结尾里。
+但是她也没有提出什么**非常具体**的问题，我这个人聊起天来又容易跑题跑到不知道哪里去，很容易就扯一大堆其它的东西。
+正好关于这个话题我也有一些想聊的事情，也想试试在 b 站发个视频看会怎么样，就干脆决定自己做一个视频了。
+
+# 做这个插件的背景？
+
+其实我刚上大学的时候，当时宿舍是海韵1，那栋楼是可以正常用路由器的。
+大二也就是 2017 年刚放暑假的时候我搬到了另外一栋宿舍（海韵16）。
+这栋楼有网络限制，但限制的措施还不是我之前提到的那种情况。
+当时联网是需要用一个叫“深澜”的软件去联网的，这个软件只能运行在 Windows 上，就没法接路由器了。
+尤其我主要用的 linux，那就约等于不许我上网了，那这个事情我肯定得解决。
+后来乘着暑假我在网上找资料，发现有人提到那个软件其实就是个套壳 PPPoE，PPPoE 的账号怎么搞出来也有办法。
+一旦知道这点就好办了，路由器也就安排上，顺便在qq空间发了个帖子。
+暑假结束之后同学们返校之后发现判死刑的路由器又能用了，我总结的拨号的方法就被传播开了。
+开心地上了一年网之后，一年之后的暑假，路由器又突然不能用了，这次是我之前提到的那种情况。
+然后我就很生气，就是我什么都没干就突然把我网断了，完全就是无缘无故被欺负的感觉。
+经常欺负我的人都知道，我平时都很好说话的，沾我一点小便宜也都无所谓，
+  但一旦过了一个度，我就会很生气，就一定会报复，做事情也会非常激进，当时就是这种情况。
+然后我就闷头搞了两周，其中第一周就各种尝试确定它是怎么检测的，第二周就是写代码，内核怎么编程，netfilter hook 怎么用，之类的。
+两周之后就肝出来了。但是比较可惜的是内核模块使用门槛还是有点高，在现实世界反而没怎么传开了。
+反而是在网上传开了，然后发现其它学校的情况也差不多。
+
+# 是否会继续维护插件？
+
+大概率不会。因为我自己后来搬到别的宿舍了，那些宿舍都是可以正常用路由器的，所以我也就没太有动力继续维护这个插件了。
+而且后来这个检测似乎放松了很多，据我观察，很多同学直接接路由器，网络也基本可用。现在流量也便宜，身边人的需求也少了。
+也许会作为一个兴趣项目哪天把它捡起来再写写，但是大概率不会，毕竟我感兴趣的也不止这一件事情。
+如果还有很多其他人需要的话，也可能会继续维护。但也只是可能。毕竟使用门槛还是有点高，要会自己刷机自己编译才行，这能难倒 99% 的人了。
+
+有其他人开发的项目，可以搜索到，用户态的程序。也有人开发内核态的软件，也挺好的。
+
+# 如何看待校园网禁止共享
+
+我觉得这个问题可能大家都会比较期待我从宏观上回答，去评价全中国的这种现象。
+这个问题我很难从宏观上来回答。我又不是这个行业的人，我也并不比大家知道更多的内幕。
+所以这个事情我只能从我个人亲身经历的角度来回答。
+如果你问我，想到这个事情，情绪上是怎样的，那我一定是想骂人的。这方面我觉得我和大多数看到这里的人是一样的。
+抛开情绪的话，我有两个事情想要讨论。
+
+第一个事情是，这个事情到底是谁干的？
+我个人觉得这个事情不是学校干的，也不是运营商干的。
+因为学校没有动力去赚那两个破钱的，培养一个本科生一年要花的钱、相关的财政补贴，应该都比这些多得多。
+而且学校一般也比较注重自己的名声，出这种事情学生第一反应肯定是怨学校。
+中国移动电信这些运营商倒是有动力赚这个钱，但我们这里运营商是存在竞争的，故意恶化自己的服务就是给对手送钱。
+我当时因为移动和电信资费一样而电信提供公网IP而换了电信，如果哪家运营商这样作死那就别想再赚钱了。
+实际上我在厦大住过几栋不同的宿舍楼，只有一栋楼是会有限制的。
+这栋楼的网络还有两个特点，一个是在这栋楼里，下载论文是没有付费墙的，就像是在学校的内网一样；另外一个是只有它是需要用深澜客户端登陆的。
+如果你去搜索深澜，它属于深信服，一个做to B的主要做网络安全和审计的公司。
+如果你稍微搜索一下，会发现很多公司和学校的网络安全都是他家做的，包括厦大的vpn easyconnect也是他家做的。
+搜索“深澜认证计费软件解决方案 百度文库”，里面就有关于限制代理的内容。
+所以我觉得应该是这栋楼的网络因为什么原因想划到校园网内部，需要做一些网络安全上的事情，这个事情就交给深信服去做了。
+  这中间有决策者一刀切，然后就成这样了。至于决策者是谁，那就不知道了，但直接干这个事情的公司应该是深信服。
+限制用户的直接目的也不是赚钱，而是行政决策上的不周全，这是我的观点。
+
+第二个事情是，如果技术一直升级下去，检测代理的技术进步反检测的技术也进步，那最后会是谁赢呢？
+我个人的观点是，我们会赢。
+因为上网这个事情是有正当性的，至少单个设备的正常上网是有正当性的。
+反代理检测是这样的，我们要做的事情比较简单，只要把特征抹除得足够干净，让它的误报率降不下来就行。
+深信服要考虑的就多了，误报率不能太高，设备成本不能太高，其实他们要考虑的很多，他们的技术升级的难度是比较大的。
+我们就灵活多了，都不需要科班出身的人，物理系的本科生努力两个星期也就绕过去了。
+总之就是，哪怕仅仅是从技术上来说，检测的技术难度也比反检测要大很多，再加上行政成本，只要你想，肯定是能绕过去的。
+
+# 你的博客呢？
+
+有人可能看到过我的一篇文章，和 xmurp 配套的，发在我自己博客上。
+但是我自己博客迁移过好多次，你可能现在也找不到了（我自己没丢）。
+实际上最近几年都没有认真写过东西，感觉这几年有点太浮躁了，没有沉下心来写东西。但我内心其实是有写作的欲望的。
+最近我应该会把博客恢复起来。包括这个稿子也会整理一下放到上面。
+
+# 对这个 up 主的视频怎么看？
+
+我有点担心她的视频发出去后会让一些人失望。
+因为我看预告的视频下面的评论区，一些朋友期待看这个视频学到一些技术。
+我提前看过她的视频的文字大纲，按照我的理解，她的视频主要目的并不是技术教学，
+  主要目的有两个方面，一方面是尝试一些视频特效，另一方面是记录一下自己探索的过程。
+如果你之前完全没有接触过这些东西，它可以解答“有什么”的问题，让你眼熟一些名词，知道有这么回事。
+但是它没法解答“为什么”和“怎么做”，也就是没法带你理解技术细节，也没法教明白怎么操作。
+换句话说，看视频只要半个小时，你可能会觉得“原来如此，なるほど”，
+  但是你要想真的去做的话，大概率会遇到比看上去多很多的细碎但是又相当硌脚的一些困难。
+实际上如果真的教这些技术细节的话，她的视频也不会只有半个小时了。
+比如b站上有详细的教你怎么编译openwrt，只是编译这**一个**事情就要讲半个小时，
+  没有linux操作经验的话，从装虚拟机到编译出来要花费的时间绝对不止半个小时，如果他三四个小时能做出来我都觉得是神速。
+总之大家还是要有一个心理预期。虽然你们的条件比我当年好了很多，（不需要一个人闷声干一星期），
+  但这个事情还是没有那么容易。
+
+# 为什么要做这个视频？
+
+xmurp 是我本科的时候做的**最**骄傲的一个事情，虽然它不是我专业的，虽然它的代码质量在我现在看来就是依托答辩，
+  但它确实是我内心最认可的作品。
+当时能做出这个事情来，其实有一个我觉得很重要的原因我在之前都没有提到，那就是我当时是放暑假，我**一个人**在宿舍生活。
+我不知道别的i人是什么感觉，反正我是个很内向的人，但对我来说，和别人相处是一个非常耗费精力的事情。
+一方面我得考虑我干什么会不会打扰到别人，另外一方面我也需要考虑别人如何理解我表达或者正在做的事情，等等。
+但是当我一个人的时候，我就可以完全不用考虑这些事情。
+一旦没有什么干扰，精力自然而然就会聚焦到一件事情上，这个时候一旦决定做什么事情，力量就会非常大。
+为什么提这件事情呢，是因为我这个暑假又搬宿舍了，这次是单人间。
+逐渐习惯之后，那种长时间专注、充满掌控力的感觉就又回来了。
+
+就在这个时候呢，这个 up 主呢就来联系我了。
+可是我当时不知道他是个up主，我也没注意到我其实还看过她的视频，
+  她上来也不做自我介绍，直接丢给我一个我根本看不明白的word文档，关键是同样的内容我在邮件的垃圾箱里也看到过，就把我整蒙了。
+后来又看了好几遍才终于看明白，她是想让我聊聊我对这个事情的看法。
+这种直率又缺少经验的感觉就很像我以前做事的感觉，我其实就是在她这个年龄，用和她差不多的方式，做了一个 xmurp 出来。
+我内心就挺感动的，她是一个遇到问题就直接朝着问题撞过去的开拓者，虽然她很缺乏和人沟通的经验，
+  她的视频最后做得好不好我没法预知，但她做的事情是独一份的，你在b站上找不到类似的。
+“勇敢牛牛不怕困难”，我不知道为什么会想到这句话。
+我自己在过去几年其实过得挺消沉的，原因的话也很复杂，不只是和别人住在一起导致的，概括来说的话就是和身边的世界妥协得太多了，
+  一些该割舍的情感一直犹豫着没有割舍（不是指恋爱），心里想要的东西一直不敢去追求。
+或者说，就是出格的事情干得太少了，少得自己都忘了自己是一个主动的**人**，那种感觉。
+我不好说这个到底是怎么回事吧，就蛮神奇的，触动了我一根已经很久没有被触动的神经。
+
+我稿子写到这里是8月25号晚上11点了，接下来我非常清楚我要做什么事情，我整理一下，今天晚上或者明天把稿子录个音，
+  然后简单做个视频，这个事情就算结束，等到时间发布就行。
+之后的工作，我要先做什么，再做什么，我要争取什么结果，我都非常非常清楚。
+我很久没有这种感觉了，我觉得我应该要感谢这个 up 主，谢谢xx。
+
+# 为什么公开反检测的技术，不会导致反检测技术无效化？
+
+反检测很简单，只要把它要找的那一点点特征藏起来就行了，但检测的时候要考虑的就多了。
+那他们得考虑设备成本不能太高，误报率不能太高，技术人员的工资也得给人家发，不能影响用户正常上网，还得行政上合规，这些东西很麻烦的。
+
+# 对比一下校园内有线宽带和蜂窝网络的区别？
+
+各取所需嘛，现在流量费用也很便宜了，很多人单纯手机流量就够了，根本不需要折腾这些。
+如果确实需要宽带，又有兴趣折腾，那就搞呗，谁要是说你不应该搞的话那是他没素质。
+
+# 对反检测路由器商业化的看法？
+
+我其实觉得商业化本身是很好的，相当于给不愿意折腾的人节省了很多时间。
+至于商家不尊重开源协议，那这个确实该骂。openwrt是gpl协议发布的，gpl的意思是说，你可以卖钱，但同时必须开源，不然就是违法。现在国内司法实践有这种判例，但是很少，这块还是缺少发展的。
+以次充好、价格虚高，我觉得得看他有没有虚假宣传。如果没有虚假宣传的话只是不值那个价格，那就是市场的问题，应该交给市场调节。要是有虚假宣传，比如宣传八核实际卖四核，那就是违法。但实际上市场上假货还很多，你去淘宝上搜石墨烯，99%都是假的，什么石墨烯电热毯石墨烯散热器都是扯淡。
+
+# 代理检测原本是用于企业的安全技术，为什么会用于宿舍的网络？
+
+学校里的网络也和企业一样，需要保证安全。至于为什么宿舍的网络也要被划分到校园网里处理，我觉得这是个行政决策上的错误。据我体验厦大大部分宿舍楼都是没有划分到校园网里的，就和小区里的网络一样，爱怎么用怎么用，我住过五栋，只有一栋是划分在校园网里管理的，当年搞得很麻烦。实际上我住的那栋后来也基本上放开了，我看其它同学接普通路由器也能用。
+
+# 代理检测厂商的技术改进方向？
+
+这个你应该问深信服的人（我不知道这个算不算他们的商业机密），但我觉得这个事情已经基本上到头了，检测ua或者个别应用的特殊软件包这个已经是极限了。不是说不可能继续升级，但是考虑到成本（经济成本，合规成本）的话，我觉得已经到头了。
+实际上我已经不在这个圈里很久了，我写xmurp是五年前了，五年过去了我看技术也没什么改进。
+
+# 反检测的改进方向？
+
+以前是“见招拆招”，他们检测什么我们改什么。现在已经把所有的招都拆过一遍了，再改进的话就是让软件更易用，让使用成本更低。比如说能不能做到一键编译openwrt软件包，再一键安装上去，我觉得其实是可以的。说到这里我就要安利一个我自己正在用的一个东西，叫nix，它就是一个一键可复现地构建一个软件，甚至可复现地构建并且帮你配置好整个linux系统，这个就叫NixOS。我觉得这个东西非常好，我有空可以试试能不能搓一个一键构建和安装xmurp的网页，这个我其实挺有兴趣的。当然我不懂前端，所以搓出来的网页很可能会比较丑。

blog/content/posts/helloworld.md

@@ -0,0 +1,49 @@
+---
+title: Helloworld
+date: 2024-08-24T20:13:59+08:00
+draft: false
+summary: 为什么不问问神奇海螺呢？
+math: true
+---
+
+# 一级标题
+
+## 二级标题
+
+### 三级标题
+
+hello world!
+
+* 无序列表1
+* 无序列表2
+* 无序列表3
+
+1. 有序列表1
+2. 有序列表2
+3. 有序列表3
+
+> 这是一个引用
+> 写了两行
+
+如果段与段之间
+没有空行
+会怎样？
+
+```c++
+#include <iostream>
+using namespace std;
+int main() {
+    cout << "Hello, World!" << endl;
+    return 0;
+}
+```
+
+这是一个行内代码`printf("Hello, World!\n");`，和行内公式 $E=mc^2$。
+
+$$
+\int_{-\infty}^{+\infty} e^{-x^2} \dd x = \sqrt{\pi}
+$$
+
+**这是粗体文本**，*这是斜体文本*。
+
+[这是一个链接](https://www.example.com)

blog/default.nix

@@ -0,0 +1,13 @@
+{ stdenv, hextra, hugo }: stdenv.mkDerivation
+{
+  name = "blog";
+  src = ./.;
+  nativeBuildInputs = [ hugo ];
+  configurePhase =
+  ''
+    mkdir themes
+    ln -s ${hextra} themes/hextra
+  '';
+  buildPhase = "hugo";
+  installPhase = "cp -r public $out";
+}

blog/hugo.yaml

@@ -0,0 +1,144 @@
+baseURL: https://blog.chn.moe/
+theme: hextra
+
+enableRobotsTXT: true
+enableGitInfo: false
+enableEmoji: true
+hasCJKLanguage: true
+
+# services:
+#   googleAnalytics:
+#     ID: G-MEASUREMENT_ID
+
+outputs:
+  home: [ html ]
+  page: [ html ]
+  section: [ html, rss ]
+
+defaultContentLanguage: zh-cn
+languages:
+  zh-cn:
+    languageName: 简体中文
+    languageCode: zh-CN
+    weight: 1
+    title: My New Hugo Site
+  en:
+    languageName: English
+    weight: 2
+    title: My New Hugo Site
+    contentDir: content/en
+
+# Needed for mermaid/katex shortcodes
+markup:
+  goldmark:
+    renderer:
+      unsafe: true
+  highlight:
+    noClasses: false
+
+enableInlineShortcodes: true
+
+menu:
+  main:
+    - identifier: documentation
+      name: Documentation
+      pageRef: /docs
+      weight: 1
+    - identifier: blog
+      name: Blog
+      pageRef: /blog
+      weight: 2
+    - identifier: about
+      name: About
+      pageRef: /about
+      weight: 3
+    - name: Search
+      weight: 4
+      params:
+        type: search
+    - name: GitHub
+      weight: 5
+      url: "https://github.com/imfing/hextra"
+      params:
+        icon: github
+  sidebar:
+    - identifier: more
+      name: More
+      params:
+        type: separator
+      weight: 1
+    - identifier: about
+      name: "About"
+      pageRef: "/about"
+      weight: 2
+    - identifier: hugoDocs
+      name: "Hugo Docs ↗"
+      url: "https://gohugo.io/documentation/"
+      weight: 3
+
+params:
+  description: Modern, responsive, batteries-included Hugo theme for creating beautiful static websites.
+  navbar:
+    displayTitle: true
+    displayLogo: true
+    logo:
+      path: images/logo.svg
+      dark: images/logo-dark.svg
+      # width: 40
+      # height: 20
+      # link: /
+    width: wide
+  page:
+    # full (100%), wide (90rem), normal (1280px)
+    width: normal
+  theme:
+    # light | dark | system
+    default: system
+    displayToggle: true
+  footer:
+    enable: true
+    displayCopyright: true
+    displayPoweredBy: true
+    width: normal
+  displayUpdatedDate: true
+  dateFormat: "January 2, 2006"
+  search:
+    enable: true
+    type: flexsearch
+    flexsearch:
+      # index page by: content | summary | heading | title
+      index: content
+      # full | forward | reverse | strict
+      # https://github.com/nextapps-de/flexsearch/#tokenizer-prefix-search
+      tokenize: forward
+  editURL:
+    enable: true
+    base: "https://github.com/imfing/hextra/edit/main/exampleSite/content"
+  blog:
+    list:
+      displayTags: true
+      # date | lastmod | publishDate | title | weight
+      sortBy: date
+      sortOrder: desc # or "asc"
+  highlight:
+    copy:
+      enable: true
+      # hover | always
+      display: hover
+  comments:
+    # TODO: enable cusdis
+    enable: false
+    type: giscus
+    # https://giscus.app/
+    giscus:
+      repo: imfing/hextra
+      repoId: R_kgDOJ9fJag
+      category: General
+      categoryId: DIC_kwDOJ9fJas4CY7gW
+      # mapping: pathname
+      # strict: 0
+      # reactionsEnabled: 1
+      # emitMetadata: 0
+      # inputPosition: top
+      # lang: en
+  math: true

devices/jykang.xmuhpc/.bash_logout

@@ -0,0 +1,3 @@
+if [ -z "${CHN_DEBUG-}" ]; then
+  hpcstat logout
+fi

devices/jykang.xmuhpc/.bash_profile

@@ -0,0 +1,3 @@
+if [ -f ~/.bashrc ]; then
+	. ~/.bashrc
+fi

devices/jykang.xmuhpc/.bashrc

@@ -0,0 +1,42 @@
+# This is really FOLLISH but it works
+if [ -z "${BASHRC_SOURCED-}" ]; then
+	if [[ $TERM == chn_unset_ls_colors* ]]; then
+		export TERM=${TERM#*:}
+		export CHN_LS_USE_COLOR=1
+	fi
+	if [[ $TERM == chn_cd* ]]; then
+		export TERM=${TERM#*:}
+		cd ~/${TERM%%:*}
+		export TERM=${TERM#*:}
+	fi
+	if [[ $TERM == hpcstat_subaccount* ]]; then
+		export TERM=${TERM#*:}
+		export HPCSTAT_SUBACCOUNT=${TERM%%:*}
+		export TERM=${TERM#*:}
+	fi
+	if [[ $TERM == chn_debug* ]]; then
+		export TERM=${TERM#*:}
+		export CHN_DEBUG=1
+	fi
+
+	export HPCSTAT_DATADIR=$HOME/linwei/chn/software/hpcstat/var/lib/hpcstat
+	export HPCSTAT_SHAREDIR=$HOME/linwei/chn/software/hpcstat/share/hpcstat
+	export HPCSTAT_SSH_BINDIR=$HOME/linwei/chn/software/hpcstat/bin
+	export HPCSTAT_DUC_BINDIR=$HOME/linwei/chn/software/hpcstat/bin
+	export HPCSTAT_BSUB=/opt/ibm/lsfsuite/lsf/10.1/linux2.6-glibc2.3-x86_64/bin/bsub
+	${HPCSTAT_SSH_BINDIR}/hpcstat login
+	if [ "$?" -ne 0 ]; then
+		exit 1
+	fi
+fi
+
+if [ -f /etc/bashrc ]; then
+	. /etc/bashrc
+fi
+
+if [ -z "${BASHRC_SOURCED-}" ]; then
+	export PATH=$HPCSTAT_SSH_BINDIR:$PATH:$HOME/bin:$HOME/linwei/chn/software/scripts
+	export BASHRC_SOURCED=1
+fi
+
+[ -n "$CHN_LS_USE_COLOR" ] && alias ls="ls --color=auto"

devices/jykang.xmuhpc/.ssh/authorized_keys

@@ -0,0 +1,15 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXlhoouWG+arWJz02vBP/lxpG2tUjx8jhGBnDeNyMu0OtGcnHMAWcb3YDP0A2XJIVFBCCZMM2REwnSNbHRSCl1mTdRbelfjA+7Jqn1wnrDXkAOG3S8WYXryPGpvavu6lgW7p+dIhGiTLWwRbFH+epFTn1hZ3A1UofVIWTOPdoOnx6k7DpQtIVMWiIXLg0jIkOZiTMr3jKfzLMBAqQ1xbCV2tVwbEY02yxxyxIznbpSPReyn1RDLWyqqLRd/oqGPzzhEXNGNAZWnSoItkYq9Bxh2AvMBihiTir3FEVPDgDLtS5LUpM93PV1yTr6JyCPAod9UAxpfBYzHKse0KCQFoZH chn@chn-PC
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDWAfyfDFctbzJTiuK9IPw3yFLqt7vqd/T0/HoZfH/bzLZ8GVeod2oz6kjm3ns0IG94HO5vGMEmQfbK1ZKT2TqA7ve+3wG9seiwfh8xh7Xhl2AnaF0pjHEXnw+w8mTzxCv9qRhsgfHuuBVhH6PguHvk66GKjvNaxTJhlKAyNogOI3jLnw7ODFScldHbJlMYl1pBHV/G/Zeuq0qnA/pkeiFdvlsZUVGD0cCfuoHm8FCfEzv6pfkhVJUH0v5rof8GiT9eg7ntG49Gei1lkH5NosbY8f6fEKNSoOc0dm5g2FaI3D7LJixwQ6rMiJwmPb6A4oHmcJQKokU8uhROQorYLgV7RtrnHu2cHMRW6SiAUvpmvaPPcxn8CbfuSOGDhYRKxNJNtWRK08Urtq9tYD+Fpze4QoZXxN35uvsi3lMA55PK0AsTm/aVGslzHUUzgWtDxcI2pLAm9rFpCRPCY+UC1Xp5vjZoqZXwhJ81qZ7VXWTM2voxCrKAlu+Zg2FaQD5szOU= gb@xmupc1
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJ/jzUQ6QuAjnAryvpWk7TReS6pnHxhEXY9RonojKkurhfYSQO/IlxDMDq23TFXcgu8iZG4cS6MADgx/KNZD/MjuN9YNCIEGvMwzWvB0oM25BC6Vf3iKDmhH06rZKH6/g5GN+HWoCN4yE/+MhIpegFO3+YMpveXwEESlyoIjPvcW+RwmlNJevrHd83ETYDQ4AybWyJo6en5tz2ngr22HaK4MtxgrqnIN/KorY+nrzTNa7VBC7BaZc1tA5FLwUeCXtuzp2ibfrxoGUAiDig4FW09ijCk3Y77y7aNVI2nw5y28nCV5rgVMh5fejtNVqIqku7p+8qgjxvY6veATG0lYgZgw2ldnDGDNbEGxcCnKKmCgZMxok8zTRsniZ91KuHkcl2L7xUo7kdQYzBRwZyQ53eW+yPoqUya4yn272rscBEUMyZzmegfr1SXMqw/8zn+MZdr1KXEvrbfjX+2QL52GY3bfYUf3KFje+Sp88k688bRH0vrxj9BCOS7ovbyfe9BEU= xll@xmupc1
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCtnVhZQsJfbs2w9hFZkx4qDhIs++7no+6r5TifP3Dq7epJYd2QYx4dI66XxTNhKxZjN6a4Xn5nFlYLtQJXOvzBLC8IBf1W5GCH0k/jqzzskS0/Ix/70HzcBwJk8ihWDkyON5Ki1BRCx34RNxth1BIxWyc5QT+lou+D92x8iAu/uOvmcAL3Ua0OlZwxw03hLp/PpS4ZnUqFjc2JVtarY7eQu/i3RwOZUaK6nT2EL8RObzk4xnieqsU5PWwA3voVjetqZaDQ+P7dimQXz/FaucroKxCNyTiy1oG4fdQpm2UDrH6ZfPvdQLYrtet6FQabXOxhV7MuR3jYtxZjs1kDVZIseIZ6IwjetaUoMxvIouRfYjOSIEo9Ek9o0+Yhku4r0uWmPDrymWugU1raMmlRxSUwdlzW+C7mQwtGbs/MG4MN4GWkM6id5DKlY2vYKUfrTzmhY1swCtzKq20fjvyX8qhJdcytgVlOrBZnPje6Qd55sI0RjdgJrBsxT2SYquez7U8= yjq@xmupc1
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDn1pfGen7kjPTHsbb8AgrUJWOeFPHK5S4M97Lcj3tvdcjZi2SXN6PwHQfh8/xGhZbTLPz/40S9O9/Dn30xkUTfnONirKt790jp7VEbOtPnjQPOd/KRNWlS3VV0BELuq5p633Mi13rP6JZtdKmU2uSkvvaUBfCppy3JaWv/B7HLJ48f8IzkdiT1px3dN1eQ4SFoHOiVG0ci5TGG6wfMdoAAnM9R1aXI4gDxnYjLYujpaNZ4hBOta/6ZK/PV0JufoXdIAZjubgk1Hv04XHXLR2Z0UhRM6x7UrZIOdM/LlnKmcVk408ZKEj/9m1xRyDsNoZ24CF++cmnwfBHrp9I5nvDI7xOTdZlOhzkiiPM3f4i6s2Qjdv4vpZ6AeE3Qt1LVQyAr67b4UMjHuYqSi2KgyCO6My2Ov2eRoS74EKcb8ejJv3O+XInmYUgDgTgDFT3CgQgK2DG45HiV6nOkaE/6iKx2JSOiYZTFc7TRcePfXF9JQD7dXFde6qm3EbIVyJIpCJ8= zem@xmupc1
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCW2fx1Sim7X2i/e/RBPEl1q/XbV7wa9pmZfnRINHIv24MCUgtNZ5GHEEW7dvzrQBeRj3I7CAyK8fbuhv/l8HuDtjxJJ1fmcBp9UG5vfpb/UTxayJxHBRrwokp2JL7HKVviI6d8FcNa/T0CMoUNYXnel6dE3B78k9Q0dDxlOGS1MzgsP3Pn66lm0ww9FRAVHe+KkhFmwyQ1VHUxHgK4QjCIt7+9+PJE7fK0aVWBsR309pui7Pbm6mgd4d6mwiBeVvxsNGnI4DsO1hz4N2GapuQy19PDiG7A4H41Z5RYQnv/3XTy4TBXOFQm77v6pyGkCmG6BGnRdvMB6C0hWPJvudbsA/BNp4ApL7/CrwTdLp1z6ToAOLvKrUQAM+hcbJimnFVMXqz7iSYg99XTnzue7ncecp19XiaDJbM47bGXcT4nTO5XaiMYi2xGAHIrij5GIuFF5ymKYSp5ejb1VucMdKlaaAmS10+wdUcuT7tzX/IuVr5aqg2dsxT5aJCRhZ1k2V0= xly@xmuhpc
+
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmJoiGO5YD3lbbIOJ99Al2xxm6QS9q+dTCTtlALjYI5f9ICGZJT8PEGlV9BBNCRQdgb3i2LBzQi90Tq1oG6/PcTV3Mto2TawLz5+2+ym29eIq1QIhVTLmZskK815FpawWqxY6+xpGU3vP1WjrFBbhGtl+CCaN+P2TWNkrR8FjG2144hdAlFfEEqfQC+TXbsyJCYoExuxGDJo8ae0JGbz9w1A1UbjnHwKnoxvirTFEbw9IHJIcTdUwuQKOrwydboCOqeaHt74+BnnCOZhpYqMDacrknHITN4GfFFzbs6FsE8NAwFk6yvkNXXzoe60iveNXtCIYuWjG517LQgHAC5BdaPgqzYNg+eqSul72e+jjRs+KDioNqvprw+TcBBO1lXZ2VQFyWyAdV2Foyaz3Wk5qYlOpX/9JLEp6H3cU0XCFR25FdXmjQ4oXN1QEe+2akV8MQ9cWhFhDcbY8Q1EiMWpBVC1xbt4FwE8VCTByZOZsQ0wPVe/vkjANOo+brS3tsR18= 00@xmuhpc
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxcIWDQxVyIRqCGR4uWtrh4tLc025+q6du2GVsox8IzmBFkjNY8Au5GIMP5BKRstxFdg3f/wam8krckUN9rv5+OHB9U8HGz77Xs0FktqRVNMaDPdptePZQJ9A9eW3kkFDfQnORJtiVcEWfUBS3pi0QFOHylnG27YyC/Vjx9tjvtJWKsQEVTFJbFHPdi+G7lHTpqIGx+/a2JN9O6uVujXXYvjSVXsd+CWB9VMZMvYCIz2Ecb6RqR3brj4FhRRl8zyCj+J4ACYFdGWL98fTab2uPHbpVeKrefFFA43JOD/4zwBx/uw7MAQAq0GunTV3FpBfIAQHWgftf2fSlbz20oPjCwdYn9ZuGJOBUroryex7AKZmnSYM3biLHcctQfZtxqVPEU3W/62MUsI/kZb9RcF24JRksMoS2XWTiv2HFf5ijQGLXXOjqiTlGncwiKf65DwkDBsSxzgbXk5Uo86viq6UITFXPx/RytU+SUiN4Wb7wcBTjt/+tyQd1uqc7+3DCDXk= 01@xmuhpc
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDkT/P4MnzxBh8sRi0oQ88duNpY/ejFtptGqUQJVobj23vbu7ju6x/yuXqnHFOLi/IOZgNl5oBhRlJekRL+FWMIwpPBA6MnbVNkHXvwu5kLXVTt0O9dhJfDiPPbYcNjOhw4o8aZMc0oEyz8xZgkPoIehHQda+K5vRhFnYCRgn2X92VY/dW1QqPJKEfN47Tsp00w8wyKixEvuJe8OBEoKDpiZYzbXJKuoKhCdMp0uMHMCojYuYP9rGZO6bHl7Q6cYotGx1jH2pe30Ujtm3Xbm44H1mhXr1K/lhcHfojSge8POqii+eaXSCzqRlXaWyvrL9JLaaRD7GfWDaRWSKDfN8Ha4mnUvRtObRMSLOnr2QOTLJw9QPnlDDxCd1q7yluKraccYnTQQP5JuBwkRqjuJTatd9b18Z14HffmXZNR7asT1sJXK1rWKeLTrZwqxpkuwLAnbr60PVwfMHZeZ6FVPXGZ4wQb22lFHvaZZCEJf+9QDXpDn5L59FlaBYO2Xwojj3s= 02@xmuhpc
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDOF3LfnQiI8wpsXGn87bt7rbUZcgsdaOSOswk4Vf4dBautEdQZc0q+UDB2TlR2K8L7SPyywpl5z67euN5QRJLEwg8flTybiJp3EKDctYEM22sa36ONcSIJ/iHSdCkwtPXkBYreh9e+MAHfTroIKK5zM/P1QIN3NrknIXpWjLDF73ejrxE+EXRK6jbuWfo+5dnLnDoUFt1e+pYLZos5KRRB94Qt5I79D/cAg3hG+Zl2FCCOpn1hIdLo/kWJTKUPe61oUaIxriV6nCXp/pU1BHlM43hGowiHa4bVZIs8Eo4r7OI9thhSuS2BKSifibBKIicZtntSlS/I3xa5am28YLmrOiEXRsjPom7trO8qIhPfYOc/yFDg1gcpLxyNroCPooPBzPxUqrTT96Q4fDDTaqfyuVxQFxbYoFAqQs8/lw6WcGJ4fGC5JPsPiwoSdQy/B7gCfQcFjPXp1NH8Sx+xMLCmxRqdKSyeiEwoyB0tZ6ngaI73HFhCPX1/rLx3xv0zd/8= 03@xmuhpc
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC96jp6qFrWt4651Arg+Ua6AU3CjftZuounKLlZ8s268Lo9Cba+nmoOGRNzefqr+f6/7KmFKd9+jqS3ZnKFQbzRFVzzHHIT7tSlgxFRw+yb553/vgm7z6d0HGd3B7XjpIpR7DrM/unnXtiT/WuX+UIKKQ1S4kHp4fTJxZuwzYgNWDsT7O/5H7nBoRVuUSG/achCzTq5V5WfNjvrGZypCmcCw5MTH3Iab4qQ7fhRK46e/OpgSMmsY1ZuEynIwVtimW4G10MUWZdawN4LHBNsCDBmBu0H1DYBb9AUW5IuifAyFPPlTOPtuzpEganaMwotcXiAwhfPQg1c0TfbB4ZJPow612dzxcflHAJyFy2LXbiG0rF48h0GpW5gY92QkeMQcbybKOS5yVlXynNNg0nL1bx+reu7Fy4jurc0facTaqzpSiyXsBLSOva+DZrxl2MBDLEdykkQMNIY69GeeC2XIN4tbfGDYU8VVtwnXJUkmeHAge5ypI1kkPhYRDxPDspym9M= 04@xmuhpc
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9FmT0i2j9JsnyeVrEZP8gaWHnc5NnhJgb1sP8MP/pjx/GMEkms2LQvZYNw8MQvGA6HH/O2acy5NIdD69QkRlALXZlWpUQco8JDuJe7+2xkTMGPOAqB5YLMHRpFGHUmDMuSFGSg2YyLXaWXoWmib5xAvTL95xAcdNgp5xqWvO2N55edDeVOY5cTmIE2vC0nm5JSjMEMcIuqL8yJ3AweN4JkD8CVVy3po8f+krKsaYB+f21MqqSnCQ/cpKlWHuMN9k85hP/FB1E7gBXW/MuZ1uOm4IzjBhj8tYVN0UY7Mo2/9PhFqoBKGr6vs7Nx1mXBJ/A1lIKvW+ROvQ9ADpOfww6kPuHbX16gQ55JG7zneWeiP5pVaI4YZ4O1vAvARw/SaSFhRdpymPs5r+wdIDV9gGoqORrYqoPBz7Q02V71W+EV7WFAgxiJozO0vZwD9JJ2zivyIJfcVtIOMIvEhfsha7Hviut4JIOyoaEHjIZYsmvYHEeEBA4pTUHIUZlZj/St7U= 05@xmuhpc
+
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJRWge2+B1Et03n/B4ALBcAnjvtWPPmcFAoIlLP8oFkB hpcstat

devices/jykang.xmuhpc/.vaspkit

@@ -0,0 +1,165 @@
+# cp how_to_set_environment_variables ~/.vaspkit and modify the ~/.vaspkit file based on the settings in your supercomputer!
+# All environment variables are case sensitive.
+VASP5                         =     .TRUE.                         # .TRUE. or .FALSE.; Set .FALSE. if you are using vasp.4.x
+LDA_PATH                      =     /data/gpfs01/jykang/linwei/chn/software/vaspkit-1.4.1/POTCAR/PAW_LDA
+PBE_PATH                      =     /data/gpfs01/jykang/linwei/chn/software/vaspkit-1.4.1/POTCAR/PAW_PBE
+GGA_PATH                      =     /data/gpfs01/jykang/linwei/chn/software/vaspkit-1.4.1/POTCAR/PAW_PW91
+VASPKIT_UTILITIES_PATH        =     /data/gpfs01/jykang/linwei/chn/software/vaspkit-1.4.1/utilities
+PYTHON_BIN                    =     /data/gpfs01/jykang/linwei/chn/software/scripts/chn_python3.sh
+POTCAR_TYPE                   =      PBE                           #  PBE, PW91 or LDA; Set PBE if you want to make PBE-POTCAR file
+GW_POTCAR                     =     .FALSE.                        # .TRUE. or .FALSE.; For example, H_GW, O_GW will be chose when POTCAR_GW set to .TRUE.
+RECOMMENDED_POTCAR            =     .TRUE.                         # .TRUE. or .FALSE.; The recommended PAW potential will be chose when RECOMMENDED_POTCAR set to .TRUE.
+SET_FERMI_ENERGY_ZERO         =     .TRUE.                         # .TRUE. or .FALSE.; The Fermi Energy will be set to zero eV when SET_FERMI_ENERGY_ZERO set to .TRUE.
+SET_MINI_INCAR                =     .FALSE.                        # .TRUE. or .FALSE.; A simplified INCAR will be written when MINI_INCAR set to .TRUE.
+USER_DEFINED_INCAR            =     .FALSE.                        # .TRUE. or .FALSE.; whether to use embedded INCAR templates or user defined INCAR templates
+WRITE_SELECTIVE_DYNAMICS      =     .FALSE.                        # .TRUE. or .FALSE.; the selective dymanics set will be forced to write when SET_SELECTIVE_DYNAMICS_MODE set to .TRUE.
+GET_DOS_FROM_HYBRID_BAND      =     .FASLE.                        # .TRUE. or .FALSE.; whether to calculate DOS using optimized tetrahedron method in the hybrid band strucutre calculations
+ADVANCED_USER                 =     .TRUE.                         # .TRUE. or .FALSE.; Please fill in your settings in the block 'USER_DEFINED' if you want vaspkit to integrate your own scripts in the 'UTILITIES' file.
+SET_INCAR_WRITE_MODE          =      OVERRIDE                      #  OVERRIDE, APPEND, BACK-UP-OLD,BACK-UP-NEW;  "Customize INCAR File"  whether to override existing or appending existing INCAR/backup existing INCAR to INCAR.old && write into INCAR/write into INCAR.new
+APPLY_SCISSOR_CORRECTION      =     .FALSE.                        # .TRUE. or .FALSE.; whether to rigidly shift of the conduction band with respect to the valence band of nonmagnetic semiconductors to matches with that of the experimental, HSE or GW value (default: .FALSE)
+APPLY_PHS_CORRECTION          =     .FALSE.                        # .TRUE. or .FALSE.; whether to make PHS correction during linear optical calculations. More details are given in Comput. Mater. Sci. 172 (2020) 109315 
+NORMALIZE_ORBITAL_WEIGHTS     =     .FALSE.                        # .TRUE. or .FALSE.; whether to normalize orbital-projected weights in each state (default: .FALSE.)
+REORIENTATE_LATTICE_VECTORS   =     .FALSE.                        # .TRUE. or .FALSE.; reorientate lattice vectors when build supercell or heterojunction or not (default: .FALSE.) 
+GET_IRREDUCIBLE_KPOINTS       =     .TRUE.                         # .TRUE. or .FALSE.; Control whether to generate k-points in the symmetry-irreducible wedge of the Brillouin Zone (default: .TRUE.)
+FACTOR_ENCUT2NPWS             =      0.262465831d0                 # Adjust the final decimal place (or one beyond that) of this parameter if you encounter an error message saying that “Error: the calculated NPWS is not equal to the read NPWS”. 
+SYMMETRY_TOLERANCE            =      1E-5                          # Tolerance in Cartesian coordinates to find crystal symmetry, compatibility with SYMPREC (default: 1E-5)
+LATTICE_TOLERANCE             =      0.2                           # Float lattice tolerance for the lattice vectors (default: 0.2 angstrom) 
+ANGLE_TOLERANCE               =      0.2                           # Float angle tolerance for the lattice vectors in degrees (default: 0.2 degree) 
+EMIN                          =     -20.0                          # Minimum energy for evaluation of DOS (default: -20.0 eV)
+EMAX                          =      20.0                          # Maximum energy for evaluation of DOS (default:  20.0 eV)
+SIGMA                         =      0.2                           # The width of the smearing to calculate DOS from eigenvalue (default: 0.2 eV)
+NEDOS                         =      2001                          # Number of grid points in DOS (default: 2001)
+GAMMA_CENTERED                =     .TRUE.                         # .TRUE. or .FALSE. (default: .TRUE.).
+VACUUM_THICKNESS              =      15.0                          # The thickness of vacuum to build slab or 2D materials (default: 10 angstrom)
+CENTER_SLAB                   =     .TRUE.                         # Center the slab in the z direction; (default: .TRUE.)
+                                 
+# New added in Version 1.3.0       
+MAX_ATOM_NUMBER               =      10000                         # The maximum number of atoms to screen heterostructures (default: 10000)
+MIN_ATOM_NUMBER               =      1                             # The minimum number of atoms to screen heterostructures (default: 1)
+MIN_LATTICE_ANGLE             =      0.0                           # The minimum lattice angle to screen heterostructures (default: 0.0)
+MAX_LATTICE_ANGLE             =      180.0                         # The maximum lattice angle to screen heterostructures (default: 180.0)
+GET_INTERPOLATED_DATA         =     .FALSE.                        # .TRUE. or .FALSE.; Whether to interpolate the grid data of charge/spin density, potential, band structure, etc. (default: .FALSE.)
+INTERPOLATION_SPACING         =      0.04                          # Determines the number of interpolation grids, in unit of A in real-space or 1/A in reciprocal space (default: 0.04)
+INTERPOLATION_METHOD          =     'cubic'                        # 'linear', 'cubic' (3rd order-spline interpolation), quartic (4th order-spline interpolation), or FFT available only for 2D and 3D grids (default method: 'cubic')
+AUTO_SUBMIT_JOB               =     .FALSE.                        # .TRUE. or .FALSE. (default: .FASLE.). Whether to auto-submit vaspkit or vasp job or not.   
+SUBMIT_JOB_COMMAND            =     'qsub job.sh'                  # The command line to submit job
+AUTO_PLOT                     =     .TRUE.                        # TRUE. or .FALSE. (default: .FASLE.). Whether to auto-plot data graphs in the post-processing.
+
+# New added in Version 1.4.1
+REDUCE_FERMISURFACE_FILE      =     .FALSE.                        # TRUE. or .FALSE. (default: .FASLE.). Whether to write only the bands which cross the Fermi energy.
+WEIGHT_THRESHOLD              =      0.00                          # Threshold value of spectra weight in the band structure unfolding.
+
+# New added in Version 1.5.0
+CENTER_DEFECT_POSITION        =     .TRUE.                         # Move the position of defect to the center of the supercell; (default value: .TRUE.)                              
+VACUUM_THICKNES               =     10                             # Vacuum thickness (default value: 10 Angstrom).                     
+UNWRAP_TRAJECTORIES           =     .TRUE.                         # Unwrap MD trajectories or not; (default value: .TRUE.)  
+
+#USER_DEFINED                 
+#Synopsis:The first parameter is the command-id,starting with 'u'; the second is the interpreter, like 'python/bash/perl'(Please left it blank if you are using an executive binary); the third is the name of a script or an executive binary; the fourth one is a switch, if any extra argv is needed, please set if .TRUE. ; the last on is the description, MUST use '_' as delimiter.
+#           id      interpreter      script          argv       description
+#Example1  'u1        python      get_entropy.py    .TRUE.      get_entropy'
+#Example2  'u2                      hello.exe       .FALSE.     ls         '
+                              
+u1        python      get_entropy.py    .TRUE.      get_entropy_for_adsorbate
+u2        python      bader2pqr.py      .FALSE.     bader2pqr
+#END_USER_DEFINED             
+                              
+#+------------------------------------------------------------------------------------------------------------------+
+#| Customize VASP job script                                                                                        |
+#| Must copy the block from #BEGIN_CUSTOMIZE_JOB_SCRIPT to #END_CUSTOMIZE_JOB_SCRIPT                                |             
+#+------------------------------------------------------------------------------------------------------------------+
+#BEGIN_CUSTOMIZE_JOB_SCRIPT   
+#PBS -N name                  
+#PBS -o out                   
+#PBS -e err                   
+#PBS -l nodes=2:ppn=4         
+#PBS -r y                     
+cd $PBS_O_WORKDIR             
+mpirun -np 8 vasp_std > vasp-out
+#END_CUSTOMIZE_JOB_SCRIPT     
+#+------------------------------------------------------------------------------------------------------------------+
+                              
+#BEGIN_CUSTOMIZE_PLOT         
+#+------------------------------------------------------------------------------------------------------------------+
+#| WARNNING! The character-type values of plot variables are case sensitive and must be enclosed in single quotes.  |
+#+------------------------------------------------------------------------------------------------------------------+
+# https://matplotlib.org/3.3.3/tutorials/introductory/customizing.html
+# https://matplotlib.org/tutorials/text/text_props.html
+# https://github.com/rougier/matplotlib-cheatsheet                             
+# Advanced Features of VASPKIT Pro version
+figure_format                 =     'pdf'                          # string type (default: 'jpg'). Options: 'png', 'pdf', 'eps', 'jpg', etc.
+figure_height                 =      4.0                           # float type (default: 4.0). The height of the figure.
+figure_width                  =      5.0                           # float type (default: 5.0). The width of the figure.
+dpi                           =      400                           # integer type (default: 400). The resolution of the figure in dots-per-inch.
+set_tight_layout              =     .FALSE.                        # .TRUE. or .FALSE (default: .FALSE.). Automatically adjust the padding between and around subplots. 
+                                                                
+# Global settings             =                                    
+figure_style                  =     'default'                      # string type (default: 'default'). Options: 'default', 'classic', 'grayscale', 'seaborn', 'bmh', 'seaborn-notebook', etc.
+font_family                   =     'arial'                        # string type (default: 'arial'). Options: 'fantasy','arial','sans-serif', 'monospace', 'cursive', 'serif', etc.
+global_fontsize               =      12.0                          # float type (default: 15.0).
+label_fontsize                =      12.0                          # float type (default: 15.0).
+number_format                 =      '%.3f'                        # string type (default: 15.0).
+                                                                 
+# Legend-related settings     =                                    
+show_legend                   =     .TRUE.                         # .TRUE. or .FALSE (default: .TRUE.).
+legend_location               =     'best'                         # string type (default: 'best'). Options: 'best', 'upper right', 'upper left', 'lower left', 'lower right', 'right', 'center left', 'center right', 'lower center', 'upper center', 'center', etc.
+legend_fontsize               =      12.0                          # float type (default: 14.0).
+                              =                                    
+# Line-related settings       =                                    
+line_colors                   =     ['b', 'g', 'r', 'm']           # string type (default: 'blue'). Options: 'red', 'green', 'cyan', '#4c005c', etc.
+line_styles                   =     ['-', '-', '-', '-']           # string type (default: '-'). Options: '-' or solid, '--' or 'dashed', '-.' or 'dashdot', etc.
+line_widths                   =     [1.5, 1.5, 1.5]                # float type (default: 1.5).
+line_alpha                    =     [1.0, 1.0, 1.0]                # float type (default: 1.0). 0.0< alpha <=1.0, adjust the transparency of each line (by default, alpha=1.0)
+fill_areas                    =     .FALSE.                        # .TRUE. or .FALSE (default: .FLASE.). Fill the area between two horizontal curves.
+
+# Marker-related settings     =     
+#marker_colors                =     ['blue', 'cyan', 'red', 'magenta', 'orange', 'lawngreen', 'deeppink', 'brown', 'dodgerblue']
+marker_symbols                =     ['o','o','o']                  # string type (default: 'o'). Options: 'o': Circle, 'x': Cross, '+': Plus sign, 'D': Filled diamond, 's': Square, '^': Triangle, etc.
+marker_colors                 =     ['#0db14b', '#4c005c', '#d93b2b','#0075dc', '#740aff', '#993f00', '#4c005c', '#426600']
+marker_sizes                  =     [60, 60.0, 60.0]               # float type (default: 10.0).
+marker_scale                  =     1.0                            # float type (default: 1.0). marker_sizes = marker_sizes * marker_scale        
+marker_alpha                  =     [0.8, 0.7, 0.6, 0.5, 0.4]      # float type (default: 1.0). 0.0< alpha <=1.0), adjust the transparency of markers (by default, alpha=1.0)
+                                   
+# Tick-related settings       =     
+#x_label                      =     'Wave vector'                  # string type (No default value).
+#y_label                      =     'Energy (eV)'                  # string type (No default value).
+#z_label                      =     'k$_x$ ($\\mathrm{\\AA}$)'     # string type (No default value).
+#x_limits                     =     [-8.0, 8.0]                    # float type [xmin, xmax] (No default value).
+#y_limits                     =     [-8.0, 8.0]                    # float type [ymin, ymax] (No default value).
+#z_limits                     =     [-8.0, 8.0]                    # float type [zmin, zmax] (No default value).
+#x_major_locator              =      2.0                           # float type (No default value).
+#y_major_locator              =      2.0                           # float type (No default value).
+#z_major_locator              =      2.0                           # float type (No default value).
+#x_minor_locator              =      1.0                           # float type (No default value).
+#y_minor_locator              =      1.0                           # float type (No default value).
+#z_minor_locator              =      1.0                           # float type (No default value).
+                                                                   
+# contour-related settings                                         
+colormap                      =     'RdBu'                         # string typ (default: 'jet'). Options: 'jet', 'hsv', 'viridis', 'gray', etc.
+contour_levels                =      5                             # integer type (default: 5).
+contour_limits                =     [0.0, 0.5]                     # float type (No default value).
+display_colorbar              =     .FLASE.                        # .TRUE. or .FALSE (default: .FLASE.).
+display_level_value           =     .FLASE.                        # .TRUE. or .FALSE (default: .FLASE.).
+display_contour               =     .FLASE.                        # .TRUE. or .FALSE (default: .FLASE.).  
+colorbar_shrink               =      0.5                           # float type (default: 0.4).
+colorbar_orientation          =     'vertical'                     # 'horizontal' or 'vertical' (default: 'horizontal')
+                                                                   
+# 3D-plot related settings                                         
+elevation                     =     12.0                           # float type (default: 12).
+azimuth                       =     24.0                           # float type (default: 23).
+display_coordinate_axes       =    .TRUE.                          # .TRUE. or .FALSE (default: .TRUE.).
+display_brillouin_zone        =    .TRUE.                          # .TRUE. or .FALSE (default: .TRUE.).
+axis_length                   =    [1.0, 1.0, 1.0]                 # Determine the length of each axis
+box_linewidth                 =     1.0                            # Specify the transparency level for the lines of the box or Brillouin zone  
+box_linealpha                 =     1.0                            # Evaluate the line width of the box or Brillouin zone
+                                                                   
+# XKCD sketch-style related settings                               
+xkcd_style                    =    .FALSE.                         # .TRUE. or .FALSE (default: .FLASE.). Turn on xkcd sketch-style drawing mode or not. 
+xkcd_scale                    =     1                              # float type (default: 1.0). The amplitude of the wiggle perpendicular to the source line (default: 1).  
+xkcd_length                   =     100                            # float type (default: 100.0). The length of the wiggle along the line (default: 100). 
+xkcd_randomness               =     2                              # float type (default: 2.0). The scale factor by which the length is shrunken or expanded (default: 2).
+
+# band structure related settings
+disconnecte_band_paths        =   .TRUE.                           # .TRUE. or .FALSE (default: .TRUE.). Turn on disconnected band paths drawing mode or not.
+
+#END_CUSTOMIZE_PLOT

devices/jykang.xmuhpc/linwei/chn/software/hpcstat/bin/bsub

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+hpcstat submitjob "$@"

devices/nas/default.nix

@@ -0,0 +1,68 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/627D-1FAA" = "/boot";
+            btrfs =
+            {
+              "/dev/mapper/nix"."/nix" = "/nix";
+              "/dev/mapper/root3" =
+              {
+                "/nix/rootfs" = "/nix/rootfs";
+                "/nix/persistent" = "/nix/persistent";
+                "/nix/nodatacow" = "/nix/nodatacow";
+                "/nix/rootfs/current" = "/";
+                "/nix/backup" = "/nix/backup";
+              };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices =
+            {
+              "/dev/disk/by-uuid/a47f06e1-dc90-40a4-89ea-7c74226a5449".mapper = "root3";
+              "/dev/disk/by-uuid/b3408fb5-68de-405b-9587-5e6fbd459ea2".mapper = "root4";
+              "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
+            };
+            delayedMount = [ "/" "/nix" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs.waitDevices = [ "/dev/mapper/root4" ];
+        };
+        initrd.sshd.enable = true;
+        nixpkgs.march = "silvermont";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        networking = { hostname = "nas"; networkd = {}; };
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        xray.client = { enable = true; dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1"; };
+        smartd.enable = true;
+        beesd.instances =
+        {
+          root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
+          nix = { device = "/nix"; hashTableSizeMB = 128; };
+        };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+          wireguardIp = "192.168.83.4";
+        };
+      };
+    };
+  };
+}

devices/nas/secrets.yaml

@@ -0,0 +1,35 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:97aX07G5FPumdWcDxnYOs6fRgljXWuwyNXGg1d7zdbUUfNnb,iv:+wAC/DZXsg+evYFA4DMfLw5Ut3ExQl1RgZ/2AsNQDpo=,tag:ebD77muITHof+FQMydWobg==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:OrYgBRU1VPpkpDzYMFHINfPSHsXEKABdZOcgiAiBJKcreBoaSVHUvg==,iv:XIeZPJhzmUi5ZHKBCYN5UA9HWH1K+26SvcIWVrHAYDA=,tag:3F93syLBZjcHwnRRkUEjlw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:VPlB4wSbWqSYw3rYRwfAMa39xrPcPZfz7sV2Cq3rmOhifnUPwggxnA+51do=,iv:utnyrB6Yfe5O94Oq4HDVFm/lQ9ZBoyvUT68r2G2PdwA=,tag:snm01vA+z2yKK8d2i5i2ig==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3aWJSUVUwMnYwN01vSEJO
+            cHV3Ylkzb1Z6Z1E3a2NwZXdIVlpacHJDNWhBCkZXZWx5M21HKy94WkhuaDhkVEFL
+            M01MdUlza0VmK1hKTExmeFdUWDllbTAKLS0tIE8wR1F6ZVZPNVYwU1Y3ZFJaUkhT
+            a3B1UzdQSjlzTmxReVhWMzhTaVdTRDgKG76K16V6NAMaeyfne4LL/zwa5+lfPz/y
+            1SX1JOaWNpXqfOIGflZUF88lxCLR8ttEFea391x2vhoKPZKCvIDGHw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4eXhkb1B3WXhGTTBLTDk2
+            ZmhTUDltWGk4ZU1PUk8vYkVaUkx0MDFEWUZNCjl2R25JR3Z0U3NKWWwzbjVsMXVq
+            NXMxOThGaFVHQ1ZacU4yUXVBVXNBNUkKLS0tIFkyUjhzMzlMVkM2WFZ1VUw5Zlcy
+            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
+            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-07-24T05:14:57Z"
+    mac: ENC[AES256_GCM,data:9xKBuoVeotcZfiqsKg+iXxOc5BV9kGVvR5f9Anu6DauBceYIBxgeVCDU3dRUPz67MkOK/n2w9+gLchQxUyK8G4ECRTESL+GKpZslNVThb2j6vswLXNBHqsQCoQBlYOiKw5ZM1gpdYJPni8qpsdGvTwc5JkW+FH6v1BdZWaUhc3U=,iv:SyLiMXsQhS+8FFlSMXiD9ETD+mIsz6mePXnJzBODK5g=,tag:YpiU58lJ5Nb78EMyEmJdbw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

devices/pc/default.nix

@@ -0,0 +1,193 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/7A60-4232" = "/boot";
+            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          decrypt.auto =
+          {
+            "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root1"; ssd = true; };
+            "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
+              { mapper = "swap"; ssd = true; before = [ "root1" ]; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
+        };
+        grub.windowsEntries."7AF0-D2F2" = "Windows";
+        nix =
+        {
+          marches =
+          [
+            "znver2" "znver3" "znver4"
+            # FXSR SAHF XSAVE
+            "sandybridge"
+            # FXSR PREFETCHW RDRND SAHF
+            "silvermont"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+            "broadwell"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+            "skylake"
+            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+            "alderlake"
+          ];
+          remote.master = { enable = true; hosts = [ "xmupc1" "xmupc2" ]; };
+          githubToken.enable = true;
+        };
+        nixpkgs =
+          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
+        kernel =
+        {
+          variant = "xanmod-latest";
+          patches = [ "hibernate-progress" "amdgpu" ];
+          modules.modprobeConfig =
+            [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
+        };
+        networking.hostname = "pc";
+        sysctl.laptop-mode = 5;
+        gui.enable = true;
+      };
+      hardware =
+      {
+        cpus = [ "amd" ];
+        gpu =
+        {
+          type = "amd+nvidia";
+          nvidia = { prime.busId = { amd = "5:0:0"; nvidia = "1:0:0"; }; dynamicBoost = true; driver = "latest"; };
+        };
+        legion = {};
+      };
+      virtualization =
+      {
+        waydroid.enable = true;
+        docker.enable = true;
+        kvmHost = { enable = true; gui = true; };
+        nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
+      };
+      services =
+      {
+        snapper.enable = true;
+        samba =
+        {
+          enable = true;
+          private = true;
+          hostsAllowed = "192.168. 127.";
+          shares =
+          {
+            media.path = "/run/media/chn";
+            home.path = "/home/chn";
+            mnt.path = "/mnt";
+            share.path = "/home/chn/share";
+          };
+        };
+        sshd = {};
+        xray.client =
+        {
+          enable = true;
+          dnsmasq.hosts = builtins.listToAttrs
+          (
+            (builtins.map
+              (name: { inherit name; value = "74.211.99.69"; })
+              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
+            ++ (builtins.map
+              (name: { inherit name; value = "0.0.0.0"; })
+              [
+                "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
+                "dispatchcnglobal.yuanshen.com"
+              ])
+          );
+        };
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        acme.cert."debug.mirism.one" = {};
+        frpClient =
+        {
+          enable = true;
+          serverName = "frp.chn.moe";
+          user = "pc";
+          stcpVisitor."yy.vnc".localPort = 6187;
+        };
+        nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
+        smartd.enable = true;
+        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
+          wireguardIp = "192.168.83.3";
+        };
+        gamemode = { enable = true; drmDevice = 1; };
+        slurm =
+        {
+          enable = true;
+          cpu = { cores = 16; threads = 2; mpiThreads = 2; openmpThreads = 4; };
+          memoryMB = 90112;
+          gpus."4060" = 1;
+        };
+        ollama = {};
+      };
+      bugs = [ "xmunet" "backlight" "amdpstate" ];
+    };
+    boot =
+    {
+      kernelParams = [ "acpi_osi=!" ''acpi_osi="Windows 2015"'' ];
+      loader.grub =
+      {
+        extraFiles =
+        {
+          "DisplayEngine.efi" = ./bios/DisplayEngine.efi;
+          "SetupBrowser.efi" = ./bios/SetupBrowser.efi;
+          "UiApp.efi" = ./bios/UiApp.efi;
+          "EFI/Boot/Bootx64.efi" = ./bios/Bootx64.efi;
+        };
+        extraEntries = 
+        ''
+          menuentry 'Advanced UEFI Firmware Settings' {
+            insmod fat
+            insmod chain
+            chainloader @bootRoot@/EFI/Boot/Bootx64.efi
+          }
+        '';
+      };
+    };
+    # 禁止鼠标等在睡眠时唤醒
+    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
+    networking.extraHosts = "74.211.99.69 mirism.one beta.mirism.one ng01.mirism.one";
+    services.colord.enable = true;
+    environment.persistence."/nix/archive" =
+    {
+      hideMounts = true;
+      users.chn.directories = builtins.map
+        (dir: { directory = "repo/${dir}"; user = "chn"; group = "chn"; mode = "0755"; })
+        [ "BPD-paper" "kurumi-asmr" "BPD-paper-old" "SiC-20240705" ];
+    };
+    specialisation =
+    {
+      nvidia.configuration =
+      {
+        nixos =
+        {
+          hardware.gpu.type = inputs.lib.mkForce "nvidia";
+          services.gamemode.drmDevice = inputs.lib.mkForce 0;
+        };
+        system.nixos.tags = [ "nvidia" ];
+      };
+      zen.configuration =
+      {
+        nixos.system.kernel = { variant = inputs.lib.mkForce "zen"; patches = inputs.lib.mkForce []; };
+        system.nixos.tags = [ "zen" ];
+      };
+    };
+  };
+}

devices/pc/secrets/default.yaml

@@ -1,7 +1,7 @@
 xray-client:
     uuid: ENC[AES256_GCM,data:XU7/GZ8cJmDwNsrQfoFHrquZT5QkjvTPZfnghX3BLyvPLlrX,iv:e/BQkZ5ydWD4P/qT9OUloB8/cXImfkG3YZnuIeNLoTc=,tag:EW3ZBzGnyIrUfcMeJqm4aA==,type:str]
 acme:
-    cloudflare.ini: ENC[AES256_GCM,data:hPNpTclYvRbcbFO6aR9PNyHt3kDUmjeUgg4NPsr+c/yxKPundoiziNYBRfF7/axlw8Hu32jf/cDlcWaEmqCBQJY=,iv:bdGCD/a6AnGQhiFNyZ+fD1f/rILsEcPXC2qRDsAO4n8=,tag:MLZak9uSqsg/0Ldx2Wgb6A==,type:str]
+    token: ENC[AES256_GCM,data:e+ZPOwOobbShxm5zZqmIeM4cmP4JQT8kDQ0goKsSwpIKmJAzi8WutQ==,iv:ZKOzKa98yWTM2LkC4+rzA6rTW4afm3oAG4nc/2vk7Bg=,tag:Qctw1sk1SC/a6Xv5Fju8EA==,type:str]
 frp:
     token: ENC[AES256_GCM,data:0mE8/cWqHKNquCIiqgbjcNhipKk7KEfbZ+qRYbu+iZr7AH9QjfYZQiMJNp4Aa3JWwBLYAnpf,iv:ID4cc8Tn0H9b1CimXlPamMlhlAkafhRApDHo/CCQ4BE=,tag:BUuU/BCj16R7FlKlpubawA==,type:str]
     stcp:
@@ -14,12 +14,14 @@ postgresql:
     misskey_misskey: ENC[AES256_GCM,data:MSDbQffk/WjZ6EYiwVuUMdhdv9VE59ZM7t4XldOKRO0=,iv:J/x9t4Pk5zi7Av9fbzxgAbbtbEUZttSx/JGRmmgmvE4=,tag:CwFR9K++T7YqYR932z3IAg==,type:str]
 redis:
     misskey-misskey: ENC[AES256_GCM,data:vcvQ/hs/F3BZd1sfvWwfEeB8vVoqdnprxobcmL6xsmg=,iv:S32yrjrjj56HbxTlfFGjOb+sO2M9KKEDEazCrpQWj6Q=,tag:iwnvqwQEdd6jicx9jJBdbg==,type:str]
-meilisearch:
-    misskey-misskey: ENC[AES256_GCM,data:/wYR3Bz4LRk/Ks0vizlZS3Ebf5qVfnlBBqZEm/ZIBFdDuhddgu71cqCjTHIKQ6CYh3CoUyguKIIFWku/kOCHKA==,iv:dllKvZwxvZC4pVyEMOB9WNiVBsVxzo5kwbdYKCzzyrY=,tag:MvzqalVvBkyJoLbirN0V8Q==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:kNm9hwMa/EhDeOCeZw1jEnroolTkeEeAxpSEDko6tHSDHwHbhfjr01ZzHKE=,iv:q2qCi99XgZJvRuF1dm16sK6BFIoa9QUN8p4LSiZq28o=,tag:ApOKdA91LBiWHv6TuXMkpA==,type:str]
 wireguard:
     privateKey: ENC[AES256_GCM,data:oIpiXJvEoyryS4eEutoe85Af0L5a5iNuOsCWCat9KEhr2ecY/vRimk/1fbA=,iv:dm2hTSNX7Q38yASon5o1jxEJZbWPXUWYydXYMBHF/sE=,tag:yrANhwIF/wHQGHGA1bfPgw==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:fGvNMmqk7Cee28VJ1QoBVrBbgIUbj/F1W0SRjdP8N4K/M8Wx4AVm1kAr0IAhPWyDLXlIjM1NUvuEV5BpYDBdjg==,iv:rFTMJ4x2kgENQUA8ftSaLjdOc25i5mWR3UYbdq54vjs=,tag:6feD0eCSv7bcHWBveLNJwg==,type:str]
+nix:
+    remote: ENC[AES256_GCM,data:uosYkxTCB0wiY+Uufk//OcBZFN3EzbZoQGZ95M9eZMjQ5AobAZqosi4laE+EMcZL1CqYqlWXaSoEUOB8biUaZPseo+1AX1TlmUgZ7QpkfOX0VKZu01C6C+lVyqVqMFq6z1BFyX/oeITMIfnd4a/2KwJCHLAZ4hMkJ5p+aJwByKGa3N/2m41HH/1S3z7pYQWj7YJxunTPPG6WNSiRncQki11rvmddwnXmsBF89+jW1Phge8U295haC57T5oIGPxR645IeTK4ZUlL8eVuZ+BhsnwbkYcaxvjSwe+DOIVPupR8GW+gis7KxwE89kqvnQhinamexcPUz4lGHlqO/Xn6jrJx6T/wXF+19epAzeHapYte3dTWNsdPwPLPJihT16YT5fwrLnH3zq8kexWz1crmnCGUoaBs4S2tHWHLgv2lTv0IHLx5F6ijpDBj/Avg9YILIURzdeea+rBxdycHasUDTVlJtYKRH5J+WbAKWI+oJ5qmXjIRUYL+O9xIUfOGO+1b3xs8MYxRWuvDV2P88N8vN,iv:yQQp5wjbSVn1oia5yL7d6GF9Vo704G0iOQRGMbzQHzg=,tag:bpBag5y5n+7ojOa8QOcDvA==,type:str]
+github:
+    token: ENC[AES256_GCM,data:59z1zSofzUyv2Qfn8oS7dZplzJDtOD/zxhPm07MLbVLHt8mE57IGcw==,iv:nZ4JmIE1h496RN6BChvqo7XWHjur76jP4HMgqGBbMJQ=,tag:pUSGsofG7hvkvJxCRwkg1Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -44,8 +46,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-07T08:55:33Z"
-    mac: ENC[AES256_GCM,data:3WDgwrlyzb0QfhCpGEKSguLZpRE68APpUclQaP4/2O5pX8E/HZ9tXVQNNVeOqozHWIe8sM5/kvY4vXEiXc1t2qrJk4JdPNI7fMIWf7QAYQWcFDNbSquUNp1VSmNp3Aka3xSS1wyVWnQOs6JY9rdbmeOcLQq0jE2sNDvivtBeJJQ=,iv:xt94toLZ91J9Twigu4FiyeYIg27u9oPkzduCUaLIgts=,tag:chf+LnNJMrnMf191BorOvg==,type:str]
+    lastmodified: "2024-05-24T03:34:07Z"
+    mac: ENC[AES256_GCM,data:+nJ/wuO5G6pEsCiBNEHOYrbiYyGXXIHu3ZUgEVwqLQ10W94EOGLUto61IGtkapk4xmaHYAVmUlq76g2hRGrndLVlUthGnEc5QoQKZoUmrxK7ux1R2ubv0s1k+l2HpRerr/I8X+hHyV0fdxT6ivkpq6OsEzHDnxgewDvYNZGQS4k=,iv:TuzO1Yo0MPms5RrG8+GbwSCOILp9BF7Jsv5JvcAPwFw=,tag:fUNc+ccQDE/jcMLuQ4thCQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

devices/pc/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:ftogJ/2oPME8sVbyNAuI3t3GEzUmdCadyjf2g/bjGNx3AoV0jU0SDxnBLDFfoR1rEtV00zfgCMPDGsEXavg+QVvoICpvvhckXMOLXe37H3Ff0wDVJtL4BBIK3oVh/SiYaRm/+uR0x6HW37KX50RRvKvpQoRdMVNnvtKbMjmQVIA=,iv:MOHfTIavoU643K10jSR3HruzoofOqqVspYgiaLc294o=,tag:zjDTPKwAOh/nqkquvAQpbw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TTB1bHFXcDhoMk1QVzJ0\nUUplcGVBVUhoOEt0Rnc2ZStDUUpjZmV0eGpvCjFQSGl4TjlMT2R5RExNZWxwOUtz\nSWhhSUtFN0JISzJhclpCMFZDQ09jK28KLS0tIGJydDNoY3hBbEhBYUNYZGZCaWpQ\nQnVDalJCcWpIRTdVaWkzeGVNSGpDRWsKWXoMC8NApfenn191aRwdAjD0iM5+C3R6\nXKpHxfhc1Gf6paxBhketFU+AwWsKiBDKh0gntV49F+YSriPa7uI3FA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzclYwVjdOZnQ1Y2dlUi9n\naXQya21QVHZ0KzMxTkVuTEJuazB4WklqdFdvCmpMd0h6OXUvZSttOFpmeUdsSlNs\nQkhQaVJqVFdidFNMejljV2h3WUFTaFUKLS0tIGNBemY5R1N3T00zMEthZjBsWXZh\nVXRtNG5UV3I3WG5LYUphNUNyUDI5WXcKVQpMe3zYgzHOtQQvo8Vvz94lYR6TBFuV\nD7ztr4rD/Vdk3hkSGZQvdzGjNDdGpac38LUN9vtFQbzMofykcn/etw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-24T05:48:31Z",
+		"mac": "ENC[AES256_GCM,data:kCLcS6xeMijD8Bxa0MBUbFH2pdXX6BdGL1SztHHPet8loMkiCfgEiyp9l/QjszWa3G6zx3K+0wXXtRXmrNAxThnIgMZQVGCy4Ucw7fp8Pral/5eaJNlZGb56JQPF9ZDHb9YQPDPImaEAKYUtzayyaZAGJGlCmIIhVVhXTx7iiig=,iv:MXRDA/6YnVUbLdYAIrMvrdb2iPsi4Bmr06SPCU8CCVc=,tag:9hT7Xo0tRnHTgAaivKj4QQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}

devices/pcarm/default.nix

@@ -0,0 +1,28 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            # TODO: reparition
+            vfat."/dev/disk/by-uuid/CE84-E0D8" = "/boot";
+            btrfs."/dev/disk/by-uuid/61f51d93-d3e5-4028-a903-332fafbfd365" =
+              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
+          };
+          rollingRootfs = {};
+        };
+        networking = { hostname = "pcarm"; networkd = {}; };
+        nixpkgs.arch = "aarch64";
+        kernel.variant = "nixos";
+        sops.enable = false;
+      };
+      services.sshd = {};
+    };
+  };
+}

devices/pcvm/default.nix

@@ -0,0 +1,28 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            # TODO: reparition
+            vfat."/dev/disk/by-uuid/AE90-1DD1" = "/boot";
+            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          decrypt.auto."/dev/disk/by-uuid/a9e4a508-3f0b-492e-b932-e2019be28615" = { mapper = "root"; ssd = true; };
+          rollingRootfs = {};
+        };
+        kernel.variant = "xanmod-latest";
+        networking.hostname = "pcvm";
+        initrd.sshd.enable = true;
+      };
+      hardware.cpus = [ "amd" ];
+      services.sshd = {};
+    };
+  };
+}

devices/pcvm/secrets.yaml

@@ -0,0 +1,39 @@
+hello: ENC[AES256_GCM,data:7xCy5PqPVdUNIdzqaGQLsPA88mAfRt6T57LjFDwOaTlhdejLPrBdyN4=,iv:dM0QWDpylPjnbtdNrjV8LHISNi/U718+xooFm0qTcbI=,tag:d5HbLG7yF3QRz7nP+4aeiA==,type:str]
+example_key: ENC[AES256_GCM,data:K5SD4k9jL5r4ZSUwNQ==,iv:mJrZshT0PKmT7OJE/ZBUWzq1Gc6xXymFbypxwQtQJq8=,tag:I4+AyMh+AVpmWa1fdIJpyA==,type:str]
+#ENC[AES256_GCM,data:vHj6+kNand8d1AzgXTaOMQ==,iv:j6b3SDqzVgY8U/puEm9UcpJYGK84gF/YIXzRbG0radQ=,tag:yzfXKHReJ0++3fhk2ztbBA==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:vRjjfVSy8g5mBZVM/oU=,iv:C+HE4Q157eNhEmcDJSMJINfMgztf6XfELCjotg8q3XU=,tag:JSQDItdYbCCs65tmbeR6tg==,type:str]
+    - ENC[AES256_GCM,data:xzfN6WiT8r8YcWtS+H4=,iv:btlOvqrn0pITT3rCTIjgS2b5TrfNKym0yPEnE7bJDqg=,tag:Wf40b8zBhrv452OKodkU+w==,type:str]
+example_number: ENC[AES256_GCM,data:akqZ12u1wl4Zww==,iv:hS3NBWI7o6dZLtsIsoVHYdtyqpUmbQrpMHPhRRzEd18=,tag:1voFm4LuupWJMGP3xd0k4A==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:wWEU8w==,iv:rf8uwo+sP9YFyPmoxROVVmrx+q6Yr0PIOWznM96w9XY=,tag:nVJdD1Z7U8zVRBxs8gLvQQ==,type:bool]
+    - ENC[AES256_GCM,data:gVe51tg=,iv:eOJ2TOWStHpckNyYx2UdLcipshFpjcWtEids5c+Q8bs=,tag:0iSjlC/TgNfl7ZtXmttgaQ==,type:bool]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTGliaUlvOVlxejZhSDZi
+            YU96S0VPOE5Ldk56WlJjTzBSRm9oYnBoQ0NBCnhJWmg3KzUrT1VyemRiSWtQeklS
+            UFFFTjdod0g1d1EvYWJoOElJSjIrWTgKLS0tIDlaQnJOMTZRUms4am1mQjV5MzFJ
+            QlhKL1ltY2lGZGU0clhIRTRsSW5BOTgK4gKbhvF1bV/YdKOxzqrecHPDAKPOd81V
+            YnWgLpP6h+zycx80iqwsfqiQJdPyDrfhB43ksn2oxsX0qXtLI9j9TQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRU1IRXZkbFQ4elgydTlv
+            VlRVKzJIWDVCZk5xaTd0Y2JXS2l0Mi85Zm1jCnNkS0NETm5SaG9WUE9Mb3RtbE5B
+            YTRmWHNXTk9hZHNBT0FxT1RNNnFMNEkKLS0tIGRWNWpLcDVtOEdGZHFPT3paeVo2
+            QWsreTlaVW5Bd2lZb3JZeTdjcG9WQlEKy3p4QnjPrJtfaueLKBzMz7VZ9QfrTer1
+            lEP8mInFprR65LtpoKabsTWQwkzURzB/OdbKSYG2o6Rlqy9L3d5eBw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-07-02T23:46:35Z"
+    mac: ENC[AES256_GCM,data:OncqYSgPSoge5Nw6eh0A4cm0KXSQhmSpGIu5WSv38LdMto5fNLIK2VRIwaXfq9nyf10bxNN7xSADj2GPhMiwlHM8nIQXtxdlWsZfEOc/qOWM8nz+9DPKtKGD6RZcDLDRhNTDxzPXGWIuY1tDKQpUlt/iDlymSskcqSrdTfBqCGk=,iv:NesxRr6FXXApE8aafnAV3x6hwCoAxoEly/QkcyAQ8Pw=,tag:3o37dr4vKLqEENIdj8RHXw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

devices/pi3b/default.nix

@@ -0,0 +1,42 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            # TODO: reparition
+            vfat."/dev/disk/by-uuid/ABC6-6B3E" = "/boot";
+            btrfs."/dev/disk/by-uuid/c459c6c0-23a6-4ef2-945a-0bfafa9a45b6" =
+              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        networking = { hostname = "pi3b"; networkd = {}; };
+        nixpkgs.arch = "aarch64";
+        kernel.variant = "nixos";
+      };
+      services =
+      {
+        # snapper.enable = true;
+        sshd = {};
+        xray.client.enable = true;
+        fail2ban = {};
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "X5SwWQk3JDT8BDxd04PYXTJi5E20mZKP6PplQ+GDnhI=";
+          wireguardIp = "192.168.83.8";
+        };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 32; };
+      };
+    };
+  };
+}

devices/pi3b/secrets.yaml

@@ -0,0 +1,33 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:82Xg9VkmkLrKKcZfojA7dHqqMZh45n+eL4T5qZ1z/xy9k0q5,iv:/2j9flBDwjY6JW2mHYo1S2VE+ruu6gxrw8BzSyoiPcc=,tag:iq8wzfIRyq1T18k3vStVGw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:8whySpY/4WPWx2+t7IOgn+qjKCsv+BgRtaAFLrP8L0fV3TJdLob5vwDplHk=,iv:kXTDwOyJNzbjPtlzQqNsXtuk3EXFdF9CAsYkvImbyDE=,tag:tsK9nCMmwEb0c08rJ3Iwyg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TzU0U2Facm5yWkYrREgw
+            a1Fxc1MxaHYwRWUzUHpsbDBHYVoxb1NKVDAwCjNuUFlabzJ0aWtGMFBQb05nSlRP
+            akwrWDI0QnZBYkFmSUpWZFFnYmQ2aDQKLS0tIGlIQ3lTREN4WXgxV3pNdjdaakF6
+            ZnppV1ZRZzZ5Smt2NGsyRndjTFdnV00KaWVPGLWPnqINH6AHKS/84kuYy/v1v4Tb
+            QdehcMiq5ZF5XLqOX5sMDLu8h96FIklqOSTZNFkzr+s9VYv/UO58rg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTEZERkRSZUdSN2dySnlI
+            aDFjdXFCWnlJZlpYQmR1WEE2RzdCaVp1WFEwCjd1N1ZpMUExZ0ZBWmFwSHg3RUs4
+            RkRYTjRMWmE5cTA4Z2JJUGgyN05HSmMKLS0tIFpKZmd2Q2k2bnNYK1V2ZnNQNUxH
+            aDU3Vm95ZkpvSTJDMjJEOFY1ZjhrQlUKLdMYiOj6tlzwLpwZsTQVSQ8hHart0ba3
+            NS7+SprzJRb0hQXrvyU6s9zho8dPOw8wiGbscmMXSVS/Kar3eQigmg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-28T13:31:33Z"
+    mac: ENC[AES256_GCM,data:fuppF9gFh3O6ZqJRTcVxNqVlz2y5f4xR39JIeInKblh4hNhrdnQg7oh8repoZeXHVRewGeGyxSqzUg+Twy8J+q+d6TSmiDVViD/SHse5rPns2Egt671geF7JmGEB/yKSCbECjGCp0QFgYYEg/vUOaV3v1a0s7LLTE/t2haPIaYc=,iv:f4T7JGxKB3WmEtETuSH7ApKRJ8ptPwZPfspyqc8+vmM=,tag:GF5br+e/p6qHsNCTjfIBCA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

devices/surface/default.nix

@@ -0,0 +1,69 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules [ inputs.topInputs.nixos-hardware.nixosModules.microsoft-surface-pro-intel ];
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/4596-D670" = "/boot";
+            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          decrypt.auto =
+          {
+            "/dev/disk/by-uuid/eda0042b-ffd5-47d1-b828-4cf99d744c9f" = { mapper = "root1"; ssd = true; };
+            "/dev/disk/by-uuid/41d83848-f3dd-4b2f-946f-de1d2ae1cbd4" = { mapper = "swap"; ssd = true; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
+        };
+        nixpkgs.march = "skylake";
+        nix = { substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ]; githubToken.enable = true; };
+        kernel = { variant = "xanmod-lts"; patches = [ "surface" "hibernate-progress" ]; };
+        networking.hostname = "surface";
+        gui.enable = true;
+        initrd.unl0kr = {};
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
+      virtualization = { docker.enable = true; waydroid.enable = true; };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        xray.client =
+        {
+          enable = true;
+          dnsmasq.hosts = builtins.listToAttrs (builtins.map
+            (name: { inherit name; value = "0.0.0.0"; })
+            [
+              "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
+              "dispatchcnglobal.yuanshen.com"
+            ]);
+        };
+        firewall.trustedInterfaces = [ "virbr0" ];
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "j7qEeODVMH31afKUQAmKRGLuqg8Bxd0dIPbo17LHqAo=";
+          wireguardIp = "192.168.83.5";
+        };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
+      };
+      bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
+      packages.vasp = null;
+    };
+    powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';
+    services.iptsd.config =
+    {
+      Touch = { DisableOnPalm = true; DisableOnStylus = true; Overshoot = 0.5; };
+      Contacts = { Neutral = "Average"; NeutralValue = 10; };
+    };
+  };
+}

devices/surface/secrets.yaml

@@ -0,0 +1,35 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:WEBAH3PQM5ahNpH/kvTtcjcJ2GllmmRlBR2oclG6AimGenSg,iv:TMp0WTOe9fuELSZoVGenl5XSZUFoiYUBEMWMn4NFv1g=,tag:GJTE0EELcZkrnGAKLYer1g==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:P/tyZHaEAahZUBF22dJEZb6mACm/wmUunPDG0vS7SNW3sWbzxRSut0haR/g=,iv:8VMv5iotmDrYDLiszcOvJHkD8l6uE+SboPSILr6KuzU=,tag:U/FIBhvghwDTvFtUWEqr4g==,type:str]
+github:
+    token: ENC[AES256_GCM,data:SyqrpFfy+y7syReWs0Bi23651ew41Us8aqjImBTzkDanOtWQgIYC6g==,iv:H3Y/TuP3VvZv6MlRAdLOY0CiNUeoqGZRNg0s58ZSkQ8=,tag:rSf4E8Whvue/LZ+VlSqDDQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzV1pvWkVGSFg5TVAvRlhu
+            TnFnMEszcDRWWHlQanAyRkRpQWdqQkdhTzFvCjBqUG4xNFBiRnlSeTNQSmdkVkdD
+            UlVCQjRFVExuZHdrSnViajZGZ3c2dWsKLS0tIHlQYU5VeGpEQzllMmxLSnJZZzZx
+            N1R3Mkhxa0dOVlJiU0V2OEZVVzZVMFkKae3c1axl22uxh9wMygAHs6q1WA5ImOS8
+            uzKSthWSqtC7DMqgUFaaSjBYM2TN3l402syx71xVFyyAmCcGZbbJcg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSHJVRGIwQUFpVER5SWxq
+            YjJOT0lXN3dFOFpjMFlWV3JCbmZFN0hnNEJBClpQUEczK2RWTGlVTmJRbVZaUC8y
+            bEFrL1RjTTNlYVNnRVRBZlRjaTlnUEEKLS0tIE5GM01pTGFFcWVVSWEvUHE3Z08r
+            a2xybTRFUFZZN20zajZJTVNwVEpGcEEKglmFMk7z1q5IlZ+lZf9M0HtknmvcYt/P
+            2/z5e8wLN1Hy0Zsbv0yIL/NmqwxAOGJOdzz7ElJszk/Y4kUr9aRasg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-05-24T03:36:38Z"
+    mac: ENC[AES256_GCM,data:Dv6WO5K0GFVm4Rt+GjXeE1vwqlPkP+kmRCGU41rbSR3YBcL8mkpBRQQXJiMU99cQQMK/rCGy+k91fhGnG5xFT/FdEZF8qUjRHPZ5MdWCjPOuY/LrXWnSnwwJa2neQLFH/ToUkNaGHCk/FngnZ/e0U43Rnwt3iHRDBG3io8oDY0M=,iv:Jf5EtkTuf/MFDq6UiOo8/31ev5zBiaP9WnlgsUgK5Y4=,tag:r6ql+UbXbG5A1vtbsGXnJQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

devices/vps4/default.nix

@@ -0,0 +1,45 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/403fe853-8648-4c16-b2b5-3dfa88aee351"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
+        nixpkgs.march = "znver2";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        initrd.sshd.enable = true;
+        networking = { hostname = "vps4"; networkd = {}; };
+        kernel.variant = "xanmod-latest";
+      };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        fail2ban = {};
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
+        xray.server = { serverName = "xserver.vps4.chn.moe"; userNumber = 4; };
+      };
+    };
+  };
+}

devices/vps4/secrets.yaml

@@ -0,0 +1,51 @@
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:d7cv,iv:RHzGIDLuuKejCTQ5YlNNITkCS3VoprsqH/kHckdpAv0=,tag:3cYw7uyUmXALo3v7SiqLJA==,type:comment]
+        user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
+        #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
+        user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
+        #ENC[AES256_GCM,data:3KN/1hzeR2I=,iv:iaqJJD6iURTUlIL8e8P7fsAzJYo+y3NGZXgWmPX+4ao=,tag:e8g/JgVrMrWJamUMpiv2pQ==,type:comment]
+        user2: ENC[AES256_GCM,data:58PnLCwDayOYinsPCYPeMvuKiF7b4tZtbmEJFWEl+2Nu6HL2,iv:hSv3jCtkLm4rrm/4+ot10CBhobGwtnK5db5wR1S/XrU=,tag:SQbynYp8pDSqj4tAK6JBMQ==,type:str]
+        #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
+        user3: ENC[AES256_GCM,data:WCVr0ylGm2SHtOGulb8TD/cI2xJXrbvY1d6+STXGxf0d0izb,iv:vhNshb38AVpwKCFRwUVruCQ0SxhHrOmwQ+IoQZeUj1k=,tag:OfdIjRrTAuVZBOEXTtnrQQ==,type:str]
+    private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:JBeN7SVxKGOe6er0eS7/v8YrXdv0nCK/KZc8Ygq0G7FIGu4hO662kg==,iv:rf59MgUCYlAA5h18wtdWoUyb2VPB13OPuJjz1VsI2dU=,tag:ViPrwduD8aWf8i8vmBG78A==,type:str]
+nginx:
+    detectAuth:
+        chn: ENC[AES256_GCM,data:lQHDpv8/Yl5/nycHoeTnCw==,iv:ernNxRpcTOSAllDpqRFVFg3qEw/slEEPPXDFq1AhNL0=,tag:2AVALUf9cDyOgCqI9wwgQQ==,type:str]
+        led: ENC[AES256_GCM,data:zyCiiH21,iv:iEYyNClDsCpWE2oNjt2NqQZ88xOOlMr0yycjKTPdmlw=,tag:kQfbshXfTBA5PtUAgpgCcA==,type:str]
+        chat: ENC[AES256_GCM,data:pXu0WPWmvUzvl2expDpQPqWwi1A4abg72npsaYXDXRcg6aVU0Ec+tgM2+uz2hT9rh3mNoBxadYXDc/zeOL1UCg==,iv:iln5UGGBK2s5pGS03PtolWTkx6KrnYBAWCFnI0V2Bag=,tag:EahTDoPIBkgWnp4MOoTCmw==,type:str]
+    maxmind-license: ENC[AES256_GCM,data:8OioibcXQ9IZ0OQhJ/zHSBQjfdHzkoqwUx5zR8Zq0atNw6SSf7vKrg==,iv:z6WTI2yeqP0h7EqKG114nRQpFVJlNzZspgS6gIFtpt4=,tag:a0dBt9pXJnncBiSKt9dsAQ==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:Si6yTh48HpA8OkkkvgHwtJYFhF8tW3oaQbldjwBc09QJxp9AoKgASMnZtbDZYA==,iv:GrNyZXjaZMviSjy/LGHHrYTr5PFvDkCXmT3MU4+SLpc=,tag:YifB1tKFLqsgXB/YLqYK4w==,type:str]
+    chat: ENC[AES256_GCM,data:ydPky0W4ZWqn,iv:uWQrZDz2GCxiKRaijM89Npt0fQeSNHbQzDefkZCkUAE=,tag:OJQwV/889Vp2/4wjbN41JA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNamN1TytweDd3blJsR2ZH
+            ZmlocFZjT3ZaUjlVbG1vVSt4a2s2SjJIaGtRCjRneDV6cHYwdGJOY1BDVS9DeDVC
+            cDdNbUdtSGRHNU1yZFpPc1MzRS92ME0KLS0tIFpmamNmTFYrRGRqbTFVSzBhUlNa
+            VllXdzZ3bEc3UFY0YjZRKzBUcGgyVkUKqI1ojiLbF87alAkEwyrm8wuW2fLbmj8d
+            YBIpoDCZ7AwR5uHWQAtl7BWJV1zab+rA3zvaf2BsrVA1A+RWOtYT/Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWitsSnRVSzJDZG9ZSE5I
+            bmt2NEFDanR3aFJyYVNnU1NlUldRb2RUVXhNClQrTkgzR1dPNWp3endZTUl5SmRs
+            dEtkSWk4aWJEc2hhbWlXZkxpNGhacFUKLS0tIGZNSG43R0NKYmdFMzdXbmJjSExJ
+            Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
+            1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-25T03:19:55Z"
+    mac: ENC[AES256_GCM,data:v6yb7ZYcnPw/8SqEJnSWzmlE17PenjnBH2X8HZp+kIDXzNFyNvD19FcbCBZjwyjBLvN1ZF4M9FS7Y4+CvvMrN/4JcFufcY/V1NrOd8IZisfAT5N3WuopPee4IN9WEyPVOsbFnesZo6/wJKuqlV1UR8UZxCd3/wHXob9Lkz45cBw=,iv:XKIUiRfP0lj8V/Z1HbvhBankdcAjQqM8Way6TWjJJMY=,tag:PLYsVj6BmR132oWsxEKnfg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/vps6/default.nix

@@ -0,0 +1,90 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/24577c0e-d56b-45ba-8b36-95a848228600"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
+        nixpkgs.march = "sandybridge";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        initrd.sshd.enable = true;
+        networking = { hostname = "vps6"; networkd = {}; };
+        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
+      };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 20; };
+        frpServer = { enable = true; serverName = "frp.chn.moe"; };
+        nginx =
+        {
+          streamProxy.map =
+          {
+            "anchor.fm" = { upstream = "anchor.fm:443"; proxyProtocol = false; };
+            "podcasters.spotify.com" = { upstream = "podcasters.spotify.com:443"; proxyProtocol = false; };
+            "xlog.chn.moe" = { upstream = "cname.xlog.app:443"; proxyProtocol = false; };
+          }
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.pc.chn.moe"; })
+            [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
+            [
+              "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
+              "send" "kkmeeting" "api" "git" "grafana" "vikunja" "write" "blog"
+            ]));
+          applications =
+          {
+            element.instances."element.chn.moe" = {};
+            synapse-admin.instances."synapse-admin.chn.moe" = {};
+            catalog.enable = true;
+            main.enable = true;
+            nekomia.enable = true;
+          };
+        };
+        coturn = {};
+        httpua = {};
+        mirism.enable = true;
+        fail2ban = {};
+        wireguard =
+        {
+          enable = true;
+          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" ];
+          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+          wireguardIp = "192.168.83.1";
+          listenIp = "74.211.99.69";
+          lighthouse = true;
+        };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
+      };
+      user.users = [ "chn" "zqq" ];
+    };
+    specialisation.generic.configuration =
+    {
+      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
+      system.nixos.tags = [ "generic" ];
+    };
+  };
+}

devices/vps6/secrets.yaml

@@ -0,0 +1,94 @@
+acme:
+    token: ENC[AES256_GCM,data:lJc2A1Q5vxWQsSchA5pvXSYW+DjBCkdSbWVD7+Py+lG/6nGUmEAHVw==,iv:ZcysHsiLQzD/7vMn1wTCE5lw7/IgkH3oLem5xCjnf7Q=,tag:7EC+S79HRCG/Q+bqVcGVDw==,type:str]
+frp:
+    token: ENC[AES256_GCM,data:T8b1ku4HNCNSJ+33QgIt1GILFA4wTu3Qd0rDqHPVgdqsGo0R90k0u8z+dElSO7q9PapTqUbZ,iv:hwnMu6JxfYLgw4TyhujX5dI2IAytgZh+Bexhgta6ATQ=,tag:lqgwvXlS/jGPxasmk5Vh3w==,type:str]
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:DXEC,iv:SZ1AhmK6fWQ/HGDk97kDUcRN84zQMp99eiz4SpRhig8=,tag:Fkdf28ZvB8XKCxSYdjuuHw==,type:comment]
+        user0: ENC[AES256_GCM,data:rJ00sfe/oJSry6Ixn4Bn+p41syqsOrdWv6fRGVCwPvn/unMY,iv:htTvFMvhIRkORA/gIU8J7CgA+tOncYQWh7sUh+F6XDs=,tag:VrSJBD7ti9WtSLHoWjMClw==,type:str]
+        #ENC[AES256_GCM,data:OVgDU+zqcQ==,iv:8KuEqBuL5Ca6pUOFFA+vySJx/h3BhGAAC0CgnxiW46o=,tag:TY1MajSSy2RjKVI2SSAAFw==,type:comment]
+        user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
+        #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
+        user2: ENC[AES256_GCM,data:e7ITe2ZouKr8dXT7SYATyzbzHaVeu6AKt1OcQKk3U0nsQgoa,iv:UbOOuojy6OAFEH8lGhKe5Hs+2K6FX5MZ8Br9AB007gs=,tag:5XeB4YngzTcHZvCpXe/ZXA==,type:str]
+        #ENC[AES256_GCM,data:93BxR0AEdQ==,iv:rf69GWpuxYt7fu1Fyv55pynuQDhi+TA5CwZK3cc3yBo=,tag:/hLy6atNMxLw6G3/qgMM4g==,type:comment]
+        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
+        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
+        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
+        #ENC[AES256_GCM,data:PTYBkBHs16U=,iv:qr3u7OveM1CmTBIf9gZK4fTRuLCpcZCwf8jmnd1L3Co=,tag:w3O41NG7yCwCVqPGh/6SXA==,type:comment]
+        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
+        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
+        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
+        #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
+        user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
+        #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
+        user8: ENC[AES256_GCM,data:H1gPtqF8vryD0rVH7HYzpMuZ3lufOBYczKwaTr4PidQtTyQK,iv:wh7NwFc/1ogNrnTTpm5L9dBqDVkvWiIsJZelR2mtR4Q=,tag:oEFdMFZJ9UYhsSVdefJ4rg==,type:str]
+        #ENC[AES256_GCM,data:aYWIiLxs1UvupQ==,iv:AisokHuAzD5B6fEF6ak8WfAe151CM3a8MsaWC4uJPnw=,tag:cdk5S4n9ulyWrqsD+jcqYg==,type:comment]
+        user9: ENC[AES256_GCM,data:HVK9KvGfOcwn1joc3VrkjBjE6hrxQPOBD5RTtQUgBPepToh6,iv:VK9aQ64L/GajpledBxC8PNB1BdNYEqwcdL3GKttgxvs=,tag:O/piztCYBARtAFxTMNXGaA==,type:str]
+        #ENC[AES256_GCM,data:b839t/OihMOmz0gIcTo43r2MIw==,iv:8kaAFG7DhFOoitcvbFaAvE1NUSLFrFhy1KiMrqs4r/c=,tag:G4vSADa52ZfN5y5ytoFJoQ==,type:comment]
+        user10: ENC[AES256_GCM,data:xjVkr/wy7OxRuNZKfQagfNxdVxTEyQP1ZhnR6jHy2gjBQ0RD,iv:G6iOBCHOqlvfEENY/ega/TUm81wgT2OOdZKZ6bPfg9o=,tag:p8AMa3bGsIl0hWQ09lSzgA==,type:str]
+        #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
+        user11: ENC[AES256_GCM,data:BIZ2zRgGv5/9AexiZZvu+m4A62YUWtAkjWWMu89GteqpWMBq,iv:13IJcDf18LjoxJk7uoKnuFZT6Ihxrxsy7DBaAaiFqus=,tag:RN7wj+uPneCkqNlMRyYrXw==,type:str]
+        #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
+        user12: ENC[AES256_GCM,data:FAF9lXOzXW9CrZgnQ1a2+E8snZj2+JHqP5Gny92k09o/Wzga,iv:/qZuAtFmUQE7A9lMzJUoCvGx+3Sv9Ioh2ahch3puaC4=,tag:urwbLwGkSX3e85NCjyPhhg==,type:str]
+        #ENC[AES256_GCM,data:HueqiREBet2bxQ==,iv:WCjTAGg2gXgBSvY3zc/YyB/1X0XjvphPduVXLsjOwH8=,tag:wC+On6lyyYQ1Dt/BHDvONw==,type:comment]
+        user13: ENC[AES256_GCM,data:ExbnvWDIBqga5+k2mpoT8AKBOXAvUNMjBTPXUKrmtWzz4l+L,iv:UI7CvSx2FHYGf6BEHS4e3iwHZZWkl2Zt5xg2WdKbLvY=,tag:ad0c7YW2Bxo+Dn+BoSZ0Ng==,type:str]
+        #ENC[AES256_GCM,data:R8lN5T0=,iv:FXLf8Vtjg+PkwNhxXWDViMKqwn7tFMaPhio9zhnudZw=,tag:34gxRH+P9lmkUxlOPKcYMg==,type:comment]
+        user14: ENC[AES256_GCM,data:dgNPPlJD5JOFPbKhlvlRHBLmUNKeDm/JAiawUVpBE7H07Box,iv:w+t9BkqYvlxVKr+x0MwtBz0/YSR/7z1OnZLIoPdW4gc=,tag:CR3GLbaO0jSQgA2HuwzRqg==,type:str]
+        #ENC[AES256_GCM,data:X80nhW5a/JQ1IQ==,iv:2UTsNLLDr4uBAEcPyvmep1fqH43JLUiHc/zqQWChfDk=,tag:DJEArs1nVnlcJgqM2uy17A==,type:comment]
+        user15: ENC[AES256_GCM,data:6AskiMLLl0HV6tm2rYpV46XW0jePQy+wme2oi3M7He7WsgVM,iv:lGfnFn69Vnjv5J3rp5sRazD5/B+8Nk8MNG7HIyf4HKA=,tag:Vbg82tdn3noOfhKVVx0Phg==,type:str]
+        #ENC[AES256_GCM,data:4jJkbMD9Psxrag==,iv:arRtRaNrqnYcT7vE3wqgl/y8/65ORaxqTdGw55AKDP8=,tag:pRpta6mXfy0XCyzMA4+cEQ==,type:comment]
+        user16: ENC[AES256_GCM,data:fo6KJXlPDn7+FmxjEJQo9d79rDYemLFx6LanYZcJpKJR7Gxq,iv:yEUKPNZ9idrSqyVO9fhksP/7bjPMT/LzNK2VSq503/c=,tag:M87D44SIo9JzDB3ZyKu7fA==,type:str]
+        #ENC[AES256_GCM,data:/Kec+CdtnT11EA==,iv:DnmbWfgriaE6XAnMqq2UXhHhN+Rd/3YRodKVUCJo6p4=,tag:NimqZpbslKxwzoljaZqEdw==,type:comment]
+        user17: ENC[AES256_GCM,data:gQInIcNFxJuCSsMDGq4yTp5JdMMmJRy1tY3PGLoLuuIXWV0a,iv:ya4n9Z7T9/bxeHqi5QqwJprEzDMsT6X0BuEXRS67wWk=,tag:RcjQfAHv8uc3PgN5c4bySA==,type:str]
+        #ENC[AES256_GCM,data:h7E4P6BiGjktYg==,iv:DhkK3NNppBqo3sXt9U7kbgfaBPYcSEX2hu6VOAesDiE=,tag:XoVbZklwCmU1EBhv0ujcSw==,type:comment]
+        user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
+        #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
+        user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
+    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
+nginx:
+    #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
+    #ENC[AES256_GCM,data:rVTLpe3uIQ5LArPnEY8N8kjtHq8kZddbqR+nyUaia72Y7PWEfHzy6wgx3Q==,iv:AZEufH3zfVL0XbUh3CQZGYcx6zIMFV4tF+jHf73IplU=,tag:B/UbtQh5dGrctNih2uoO8w==,type:comment]
+    #ENC[AES256_GCM,data:InzwjKl3R4SJSXTz5u1Pt0kf2HYEtKfSkJO0cbPhhXADNp2/Tn0nwQJFy9EzpMvK9mw8+l5LadbY0tIwmTVvV5yxUQo78HcgXWInfp/zJ+GG1L/RQOHck74lEA==,iv:UBMRYPd0loOQBs3mNyndiKPu72aRA8HbOKWDfUWPQg8=,tag:t/ONqdwpWcbo/2vy5TOjlA==,type:comment]
+    #ENC[AES256_GCM,data:HTinhnsAbVujUOuLIVT/CkvdtTN9Nk7wZKZ5SyrPC+vZ/cB9E10FffMYLQ==,iv:Clby9A7MIUSknNFkzKuWEDL0yUW/ctd6KShCIEYrDZA=,tag:CJKORoXrspDjRmaSHUnlqw==,type:comment]
+    #ENC[AES256_GCM,data:cwAb68VgebTwCCeAFUbOG0CUAuggfRnLNv9NWldJN+E9NY4WKxs12Nz7yX/vtelcqqJ2TOUL78uAR88Nzavv7VtCTZRivWjRG6GvAUyRdv8lAZo=,iv:PScTSTCuVnsoZlvyTVL+ZgqqEm4m2/fUqWzPwE+PvuY=,tag:1jeRsHqgMheXbcnhRicsnw==,type:comment]
+    #ENC[AES256_GCM,data:V5XRrTvyeezkcJqw1/BhhZz5K/egpl+PtNwjAGELjWRp7IqDfRsInxBKEg==,iv:LdOTkL22HvaNbiUi6hG8o0ownfZ22OKFGxCuGPqG8xU=,tag:/06I/mLzBlgS489iuwFTuw==,type:comment]
+    #ENC[AES256_GCM,data:i9PXzaO1od7HimP/6vxYfh30SxFbdXRDcnXujH3VrvngFcWaVcXgigncp3cboi6RoERSZ6yakxviVyEBIS4v0qRfombj2UtJg8N3Kg==,iv:aohIMhAYfZhlGDrcEvi+Qc16nF8ZgrPUGhWj/7nl8Fs=,tag:o70qsk/2cAbZgbVBwfl3Ew==,type:comment]
+    maxmind-license: ENC[AES256_GCM,data:sESU6uK9EYLido9/0sXO2Zw1SjuKmxPh4r3giJcaG7068gn1kByjsA==,iv:htnFgnLrH35zSvmlRAdoRDLFIpKroKO5dW9TNK9soUc=,tag:6pJuc54SrKP5n0kJJ7fGyA==,type:str]
+send:
+    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
+coturn:
+    auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:LskBPmXZk3hRZ2bChXZjmRzzGd2A2GKrUZMknCDXTpTzOdP/RDibRvgI75HLWg==,iv:9lJKuGLD5HuQinWvvAvwWFAvEJofUGkJsxKNpqZrGmI=,tag:pTmTOlsYIY6Uqd69AtrnBA==,type:str]
+    chat: ENC[AES256_GCM,data:0ehCIvd7sBFc,iv:OwdiIoPrt/e1YgsCrYcqqMYhsJuEtKW2pSKNVxahMV4=,tag:ig2CfQxwzv2ppIutU6371w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1QXc4NzREZHlhMDV2WXlM
+            a2I4d1pjWm9Xd2gzUDUwZ1ZSTkFGR1ZQNDJzCmJwcWFxRWNNVGxTNno2b1NxNktO
+            aHhINXBjdmE3alFGYk9kUHZ1UzdJUk0KLS0tIFdKMDlvb1Z2Qi8xRjl0MXpKMDMz
+            cVVNdDRDNmtHZlJEcVRXR1FLVkZrMWcKn2iTHH7/52fJNXcbDFbzOxNAaiQRA0nO
+            we74EeNzcaaQwuEmBQPKxd/g7/kjhnHzTkoX3OneXMd/gBZMn2knXw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBycEw1bXA4QUZkUzJ0Z3pM
+            Z0xHam5SLzRGV21XYUtxTFh1VnhQUk1NbzAwCkU1Z3VTR1FtZ05GOWNDOENlZTgz
+            SitzYXo2Q2VEaGtLTGE2UGRoUDkxN28KLS0tIHhRS2Y1cnQreC9Fc2FLdGR1ZXdJ
+            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
+            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-06-30T10:43:57Z"
+    mac: ENC[AES256_GCM,data:Mg/DZghIkaWM5KEjk5zg3S0L5qPa8/rkc2ooSjA1ewzbDhTKls2tzv7fQqLx2WQtcJiKkoVx22UkiL0AzBwJdCr3473vx93ajTVK9HNu3jqXmuzSiv2iVS21EX9tyBNiL6uWlVAtlVfMMs69PEUF+EJIYY5TkVVPaQjzEebwo5w=,iv:tFON7RVSnNNHo5U4dRuMGDhH5iPGShW9uoda+apiIjI=,tag:3nG/u7vaChFBHoDsLLb23w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

devices/vps7/default.nix

@@ -0,0 +1,80 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/e36287f7-7321-45fa-ba1e-d126717a65f0"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
+        nixpkgs.march = "znver2";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        initrd.sshd.enable = true;
+        networking = { hostname = "vps7"; networkd = {}; };
+      };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        rsshub.enable = true;
+        wallabag.enable = true;
+        misskey.instances =
+          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
+        synapse.instances =
+        {
+          synapse.matrixHostname = "synapse.chn.moe";
+          matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
+        };
+        vaultwarden.enable = true;
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 1024; loadAverage = 4; };
+        photoprism.enable = true;
+        nextcloud = {};
+        freshrss.enable = true;
+        send.enable = true;
+        huginn.enable = true;
+        fz-new-order = {};
+        nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; blog = {}; };
+        httpapi.enable = true;
+        gitea = { enable = true; ssh = {}; };
+        grafana.enable = true;
+        fail2ban = {};
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
+          wireguardIp = "192.168.83.2";
+          listenIp = "95.111.228.40";
+        };
+        vikunja.enable = true;
+        chatgpt = {};
+        xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
+        writefreely = {};
+      };
+    };
+    specialisation.generic.configuration =
+    {
+      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
+      system.nixos.tags = [ "generic" ];
+    };
+  };
+}

devices/vps7/secrets.yaml

@@ -1,9 +1,10 @@
 acme:
-    cloudflare.ini: ENC[AES256_GCM,data:PJ3JhdSPCyxzdcRI4UFdESWgyAjIYGyuVaU9l0R3s8mJidtgavvSSMy0hC0G/2fauLB/Eqc3L3NppXFjlKVywVE=,iv:lZVlOf7P/Vs/+u/5YPKFXmdeYV9NP9kcVWd00w1OjB4=,tag:LfWZTvPQH4QPrNrYfZ/Z6Q==,type:str]
+    token: ENC[AES256_GCM,data:D5D9Voteggfoc7Hj/xdhGEHmFIkG2H0Y0t2AfSY7hjRlsQhUoAzCRg==,iv:JLUjY/6DJrNsG0YZ0WD/Dmjgjsbx26VANAQvZnyj6l4=,tag:WBQv8AvPW5+XK8FAzppnNw==,type:str]
 nginx:
     detectAuth:
         chn: ENC[AES256_GCM,data:Gk0TTbnFcsvIgoDcen6B8w==,iv:kvyvygw9zDwaiTQ2vPFTHQex0EWDFg8M8U22AConQFM=,tag:ewAZ/nXxmTOhDAjW/A2OnA==,type:str]
         led: ENC[AES256_GCM,data:Owax7cyp,iv:NCEKyicVCYZNgxJzlO90heUmwPjfXbZEcyXX09XQKI4=,tag:WMTCVMVCD9sJgAhRUsqvYg==,type:str]
+        chat: ENC[AES256_GCM,data:1HJiO1zU5SX4G56oWxv5zqGyUqnBWByrtSnQ01wvmZ7PmRkrV+DV6StMg5DtJR9HhkWYnbXlbnBHzP+poPUMag==,iv:sfwI62nwGSnsdj1RyADWgXvp5AY+9RQdtSooxbKFWTs=,tag:pN/LF0mo7RXWoIPPzzs8qw==,type:str]
     maxmind-license: ENC[AES256_GCM,data:9aW4QR3K6S+eTqzIjVlNEwkG0wZ4u5jgRfe7CMwRlJlK4AmcS6c45Q==,iv:cPTN1K4Aag5sohGbCQUZHYTvcwAL7AhF+rrY3OvXGPs=,tag:d9GGUMHnfzRz9Cf2U+dBfw==,type:str]
 redis:
     rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
@@ -27,8 +28,7 @@ postgresql:
     grafana: ENC[AES256_GCM,data:ZLtDIZ3oKasE4r1WNllNe/rkXxqRS+QAJI7EGPKhiFF1BtAxD46UpGQnUag3yg0gP/8+3COQs6camVSxcKFL1A==,iv:wMj3keVjNpVwNMwlt4E3ds1EYjLNIZ/S3RydhOlmYWU=,tag:ZRn7NWaUPbf2rHYLoLYw+w==,type:str]
     akkoma: ENC[AES256_GCM,data:6piRt7BbMBLVGdot+VyoJN3/S8DoPNTYHFh/1coHSLNmiA6kU/6sca4Bts1Up/Vu164oTsFAr1JsKx6tzNzAPg==,iv:qplA1GXHwzVrmjm7eagCk3PFa7DRdwaf+p7N1HLb6mw=,tag:W6WedSK3R1IgZVo/0Hr9vA==,type:str]
     synapse_matrix: ENC[AES256_GCM,data:5j+TYJ3vYUqu6CdRDYAT558DsTWbX4Rh+HuukPog5HGXlhneL3RnxVeGBR9CV1rlCP1NY99Nm8roBG+BcyPYHQ==,iv:CboB6lzqxAE/8ZlzaTU3bxw94N6OAhrq8pZ0AfxQiUc=,tag:z6cM3ufgbMn5n5PzgqdRjw==,type:str]
-meilisearch:
-    misskey-misskey: ENC[AES256_GCM,data:4s+qqd6mmstioC0XmG/vA6ED9mzu1vRJVPFFalRiqnnsFy0dYEU87H+y12eOp/KDSLdTNvpp6Z6jCNvxnpDXzQ==,iv:x6L9OPu/dwVsD9pYb4dqavw9NesMbo7LB+rwz6veAR4=,tag:/BBqV2sHIgPas7XsZydh2g==,type:str]
+    vikunja: ENC[AES256_GCM,data:syb4NYBxL3DdmZmcC+em0klmm6bkkIL/DH/gnzShYRiaezRFskT+yay9govn++SpbuvkoCJq/GYAFxNL+hcVtw==,iv:TQUgdzYQ0gqsAmux9v3BAQFNzHnCTZ+X/OC0b9Bfya8=,tag:b1AsiAW5XzA3DzGdf8J03g==,type:str]
 rsshub:
     pixiv-refreshtoken: ENC[AES256_GCM,data:EeSOTSAAh+1Dc8+a/AaPJ0aBK5DTa3pdS6DrIMQmRw/n0SRu2QoynIF76w==,iv:dnZxi8jM1I4w3C2duYielpP/8wOAdHDjcqDIrowM0dM=,tag:8irGvLEbRJHV9TB8Jibs9g==,type:str]
     youtube-key: ENC[AES256_GCM,data:OEm/ynOUPUq7ZEVzL2jgs9d+utkLTIdNq0MHE0JDujb9ndAwyJJI,iv:RRae6Cg6GdDnXAQOdtBYmcA7ZNuu70VpIg2MEezBn5k=,tag:gX4ZG345cT3Jh3ovUxtLGw==,type:str]
@@ -53,14 +53,14 @@ synapse:
         form: ENC[AES256_GCM,data:7HF7HMUH1BTJgXXP6cpUiVj0jCwGW57bx9wKTJu7PnRsNuAam/+nKX7Zfg7WD+gSBlA=,iv:SYeUsuFVgAA6U6STCtKT5c5E8Kglh3x7hy6+Op4n0W8=,tag:eICmHTwwn0KcgNhdDGnusA==,type:str]
         signing-key: ENC[AES256_GCM,data:hzxxDbGp1L09O7+ueUSa5lJOY/QvF2zvHdpueEHjaPQEToQt9mr2loeTQHC7ObTegfLb9UHrI1jn4A==,iv:KngfahwYZZmDQ5LeOUPWptTMGAC8TZm1G0FWcrwCwsw=,tag:U9pW6/boBIpiswn67Ezrfw==,type:str]
         sliding-sync: ENC[AES256_GCM,data:BeA6g98IWDP6hnLFI77QqG6esDwB6j3OPzAv3eJxWoTajAsByHSgSYP1vHN5Iok6IgvSSmkf0/HiOJy1Ca8IIA==,iv:ca+t/rYwc/fAVUcz0JTmrRQCOcbDNscbnE8BpHkx/OE=,tag:eEfhUChUt4kRnO82XqRY4g==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:9o6EkfTWOU0KwnJsgHML4E7VOfzo3LHnlOkV8ubhi6aayXImC3lAaoPrqUI=,iv:KHprijN7z+4FIIW+D5klDM9a9VzMJ5xawPc7jJtbHmk=,tag:0DAmxoz8D5f38ndPbkNW+g==,type:str]
 vaultwarden:
-    admin_token: ENC[AES256_GCM,data:muavuOY88Lm4rSEoCp4IIPp7Z+sqf36VwpnPgf+K6IwwFkUgYM1GO80ogReYWqqUM6ij1Yzl5D9ncUbq+aGTKQ==,iv:jA4MRJlz71CMmPnWjb2tGbbIoMkEsESUowhXDckKKMI=,tag:l0HaJmnU29YeFUxjOgN3Kg==,type:str]
+    #ENC[AES256_GCM,data:yFDD8GHjZWHN/Yh53DseevKAhDVwrHX60e8sGZnF4BUsUuPA/4S2PRzj7CtlpFzUH3kb0i+HkLKRvbchg93U3as=,iv:JGG7daEKs0oMKTNVi9GS7PrXn/8rFtVkHknACsEQR+g=,tag:RSN6fojLsI4dcuPu2eTiWA==,type:comment]
+    admin_token: ENC[AES256_GCM,data:OpjREmxJSRj+aGVoP8KKRE7ClNqRtaV8va4WLVmpl1AO6D0q/GapJvhORHQb5s5ZjIAgvWTz1w+fh050Q9sPwRsNUke3FIcyeNy7k0PHgnnVIdxnU1Vn9KMz/SovjQ0/qEQ7tArvW/EXtKfwnP9lsz9m94VBvA==,iv:9AvDqMa2PeQOSrP2th3YBgA2RxPl3oKZTyUzi/yjRTM=,tag:HYFTQDgWvBsHQk8IZxWkfw==,type:str]
 mariadb:
     photoprism: ENC[AES256_GCM,data:TF1SZVFnvzyE+7vrHYYUS4Juqhbiw9QcJx7p3Xj88xyBFcTqS1YjzAKs/9GQ1PuzdBrt6hXm/XtJILHiuktnSg==,iv:sd9sQEuIePL6LzUYbFtmdecJ57sMrkF0coalBf8KFqQ=,tag:P/knaKYTJ+aXu4l6IixISA==,type:str]
     freshrss: ENC[AES256_GCM,data:ydqCbj3UbsLC1e++p5ixb5Kpmk2BsYd0urcfw8T51Is5N1/gQ7P0zgR33AOteAxw2oj85WQZhxu3eAN7BCXV5A==,iv:1oiMo1wwFNXiTZLsf4UPZSJfKFIWLI3h947TC06CVy4=,tag:Otq1oeKBnWXhqNilfsywPQ==,type:str]
     huginn: ENC[AES256_GCM,data:1Tdg1WDwGgFSXdChgif8knWS24BIFYnmaiSjJXxs5uj/v/5fJ1alb4K4XHW/kFRjQbuAOFfJiJ9ogJ1KAyk17A==,iv:qLMaQpVaKrjP7g2lWzhaNLghxwiV4YJmyYY1hrpu5I8=,tag:566JCENvOxgwD7tM3aQBiw==,type:str]
+    writefreely: ENC[AES256_GCM,data:+5jsON4SpeWKWZWlbn233XuQ/6HDzaS3XxUxDbUqAp8S/XGmn/QuFK2f375QJEiyZsnrIYkbN/CiOjdTw+nNzg==,iv:8mKqWegyxrT6908P5G0olVZzpP+BwpE7SYODEry7F3A=,tag:HeYoT0RFJGzX6DWcBQy7Jg==,type:str]
 photoprism:
     adminPassword: ENC[AES256_GCM,data:gB81joOfS8h05BNy2YmD/N0cpLPa/vAduDcQBeHiY/WkcnvqSXnXsOfnvbP74KQfoP4W35oFkfyGVPUBSB83tg==,iv:AkN2NoqMXVHQA9fHTTR7xbEapEqy/D61mHn7O23hyYk=,tag:WV+siDA3VnRkOYnP4Z9Qhw==,type:str]
 nextcloud:
@@ -70,21 +70,18 @@ freshrss:
 huginn:
     invitationCode: ENC[AES256_GCM,data:+m2AabRzUiCFy3MAKTB8d1IE05WHTcmZ,iv:ccdIPHl9N+bvPR/QCwZUwZOfWTeW6gWhhBjOpL85JRg=,tag:Ir2085K04XUGkAuoCG+7VQ==,type:str]
 fz-new-order:
-    manager: ENC[AES256_GCM,data:qZc5U3SZQPWzcKVjN2+A2qWNae4GItcjvEQFgkThvIQ=,iv:fJpiUlViiUg1ea/zGhgedQG7TeTbeb9dPviYoiUBLqI=,tag:6T7rgJflsjgK++28SgsLtg==,type:str]
     token: ENC[AES256_GCM,data:qhwWRflJbW1QMOhiPfbTIrEdQJyVtfZ1QycCgstdKD1Nh40=,iv:GvZ8MJig64l34jkvuJbMMjyNaPT5yz0/pFCc6KEPTvA=,tag:cMXo/6F9thl8k2iAhT507Q==,type:str]
     uids:
-        #ENC[AES256_GCM,data:WJszzA==,iv:KvyEnUu69+L5ZxNbRmjtP2R+8lHKgdlMN0WuvDbYgE4=,tag:LP2FJ2HXWZJmTdvXpHflVQ==,type:comment]
-        user0: ENC[AES256_GCM,data:Qw18Ht6qXo3n7DD9NgNB+3IRbCmKuvJQiK5UBsg/FC8=,iv:TeeTcR0tnRrniySqKrsKfOfr2JO7+kqS3iETdCFX5ZA=,tag:rRo2yNku9JWxmILWBS/Wyw==,type:str]
         #ENC[AES256_GCM,data:O3DOE3jFCg==,iv:9shUoHCLXsJPKHELlyWdreouEcyOqhsfVI2KaqwC4CU=,tag:tYKVv+/DuesSijZwWGdrig==,type:comment]
-        user1: ENC[AES256_GCM,data:vY4qTPNqdFp2H348jAgvwKktywdVVvQK/lR2NgRE4Ho=,iv:DrweeSEJ5ETomIkRtkcVboiQindzBoxvxjlSmrQIfI8=,tag:sMz1ITHkDclBc4OY91dMGg==,type:str]
+        user0: ENC[AES256_GCM,data:2sieulGmi7mCYrJH24djrrmHArrFbOHZ9wUuKvY4f2k=,iv:lb5ODFOeQQ+D9HZnMw48n/DGRB7L51U4frBVcPx1mvk=,tag:MwZua6u+G478uGOwtGu4fQ==,type:str]
         #ENC[AES256_GCM,data:yeA9zF8Tug==,iv:VZuWLZnt1RBmkBWudKVvgJkYfqxIj/umEHVCfR6IG3k=,tag:1kj7HyjVT59n05VYJ1uP+w==,type:comment]
-        user2: ENC[AES256_GCM,data:7hlq1FEauGcKkStREDbxA3tOA5NmFo9AbXiOPUt+kZ4=,iv:urOP3ENSviWRKDIWGc1P5PkEtkoBSCSYlgGqJQznp8s=,tag:NNKCW5bFPY7t/PC7dsSJwg==,type:str]
+        user1: ENC[AES256_GCM,data:Aw0ydspmf+PXKU27Pdzn4q/nY4sxXCADL1WGB7vm3eo=,iv:uTmVvGlW1HfdvoNbupSw3GyShsWTGVCoNrvVJ5BPUy0=,tag:k9KIoCWM6bSprwR8dmN+Hg==,type:str]
         #ENC[AES256_GCM,data:4G7DyLVVgQ==,iv:Ht/exln1QtL2BxjCaOTIXHRPDiSFYP4zIa7VaeMCuhE=,tag:btVLXf+WS/YgzRFbVFoAfQ==,type:comment]
-        user3: ENC[AES256_GCM,data:nBTbmp9OP14ayVBz1UGC5g76txfUwxL2NPQCKGxsQyw=,iv:2B8ISdT+8WpfeiU9peKoMlpwcRoGZVh11VyAnS9IKP4=,tag:uBMxqrPlb6TaftnAMqodKw==,type:str]
+        user2: ENC[AES256_GCM,data:P5gmhaQ+VOWVOjTrsx34zUS8dsqIkzCwOImIE8TIfUc=,iv:IoJIUcNJmaBTyr0Ut6R7BN/UqyK8p4HtiwbXUl171pE=,tag:k99PGSL1cEALTmFVWH1uSg==,type:str]
         #ENC[AES256_GCM,data:TGrZBuCRgQ==,iv:9IOJ3Bkw9udS/y93TTtZ9o79aDq3Bb+DMEogJG77iqA=,tag:S/XcPX1f89IyfZnMoR9s/A==,type:comment]
-        user4: ENC[AES256_GCM,data:LVendDEBlPUCkXPfgbYf2X0EgJsAdLKjAudXeAgy2Is=,iv:bR0emkQa6OHUP1ucgAvJU0eEop0gp+3rwDB5XJhh4+s=,tag:YZsW9Yyr+ey9AbTO3ucWDg==,type:str]
+        user3: ENC[AES256_GCM,data:cAzf2X20rtQYyz1rLK6b4jo8utuUOdUHVYfCWdfPTDY=,iv:L5cg7aNdfnLTH2dKl4bWCqaujJ9tIvBJrJIoDIaBLwk=,tag:9Al6Wig4lz1my6hgozSsIA==,type:str]
         #ENC[AES256_GCM,data:b4iJ73sUoQ==,iv:A2hmi7lCR15E5jVR8E71GQuHgF4TdjDuQadXOtBon6k=,tag:eopTJdjN16u7PtpZdhKymQ==,type:comment]
-        user5: ENC[AES256_GCM,data:wG4awLnfB4B0qLWG6Aj+OslLMnViPjIzicfB4ZzkZPA=,iv:b9C1IDmZTMV0RYXqkM/Y3khZeSQEOISrQyPjhQe3WKM=,tag:cRMtLNU6TCwTQG4UVhvTng==,type:str]
+        user4: ENC[AES256_GCM,data:nUJ0lPuFOUVGCtq0IRSh5dAkAna7hoow1YOtFEgSoZc=,iv:D8phoZxdbQ2/Zaeq8498eRb0a7SZD5WnVdKv+u2pBak=,tag:Obu01n34JjyAVnF0f3uKzg==,type:str]
     config0:
         username: ENC[AES256_GCM,data:p8+q8u1A,iv:9s52kS5yLB4vQuGVXNtA4amZqT3eHTTybsbsQZRiFnk=,tag:7SA4SEzMHpP9H/rwoE+UJQ==,type:str]
         password: ENC[AES256_GCM,data:58+gFodT,iv:ohZlT1BwnzCYv84xHgFsLRkiPMpE8lB8QVHwr0QtDWc=,tag:XF047RnXs6IbKsTnsm0D6g==,type:str]
@@ -93,8 +90,6 @@ fz-new-order:
         username: ENC[AES256_GCM,data:xWP1cesh,iv:11KFZ/J9PScz/oW2+H5BWgw0+ETkCXlcYOMuPpgjEs0=,tag:HswEVzm6ElRjIDsZyEfZcA==,type:str]
         password: ENC[AES256_GCM,data:Da/E7ZeZ,iv:gIoheXeTErV3+CtZSEDsX7pGzRahHWlKYQ6QZ6W2eu8=,tag:0oQzQ5DJiS2hqMQfU6JRWw==,type:str]
         comment: ENC[AES256_GCM,data:etfZKwbh,iv:XqqF3D0PpCPd2Q/CCu/PAH4SrvXAOu+lIXvSht/KfKk=,tag:7jyG33foxneRK2wvI/5uBg==,type:str]
-httpapi:
-    token: ENC[AES256_GCM,data:fuGJ+5sKr3yob7JbyqtwGBAxnDzxTvoC5XPWHNawOjqC7Ydz6HujpYudG2CUMxt+rA==,iv:Yhg5NqRRp+PYsxNKFUiUydAL1hmz2pr/T0f5GDKV18w=,tag:SZoy0gTzpeq39mEFBTUDLA==,type:str]
 gitlab:
     secret: ENC[AES256_GCM,data:hBax7ClSuttBacykKw42pvrvowZW8OeTry/0rkmy5BHyLM7HllNYCOw+tupIOdhVEfgJPWQeBeGuyFHt7lPRWQ==,iv:zOM+eMW04Z9QkTchkAXWYHg2eWTQmGEs/dHtUnvNVd8=,tag:RzLyecuASl9CcmQSuabN6w==,type:str]
     otp: ENC[AES256_GCM,data:Hgq5Tyq+BUTsexVsjFWf07fY0znPL50+qIm+fhuVljlauXBZouQjJKMhqTs9zhLECOktYUtp0wrNa++nO1Ys9A==,iv:Am51j8QjDtldtsZL8uCu0I3pr/SQ6R8KUQinznZjClg=,tag:hbtrlG0MGNL3VcbQUG/irQ==,type:str]
@@ -105,6 +100,26 @@ grafana:
     chn: ENC[AES256_GCM,data:0bbjggWS1MdcUIQiQyPlBTULm+faKDpJbmZmV6vSw8k=,iv:am65WQzUE+AvQrQV+NSF5u6RCWn7EetyPsdy4Cuvyyw=,tag:lxNUM1cIYVSXVgwEnS1Hdw==,type:str]
 wireguard:
     privateKey: ENC[AES256_GCM,data:TS+toaJRgAvC78XVwTciXe2IG8++vaqXVCi/u/8Aej6qq1B9Cb6f20cp5K0=,iv:T/NkLvcYiWzIDG3jWtuhe/sH2GT4z5f0xdUGbSL901I=,tag:qN7YokFBj3Kbbx4ijHTRnw==,type:str]
+vikunja:
+    jwtsecret: ENC[AES256_GCM,data:p6e22qPJzTGB21oWhSr8AA4bfrele9ZOHVtZ8BHgX21IhoKdm58coGtSX1CGXR7J6+1/74RdLY9K88nGrM1F1w==,iv:DGUO8rhf7Lg9dTqSmzlR/Jd2K4oUjO8w9E5bihwsykI=,tag:SpX6UI0QIju/tC1fIL9CCg==,type:str]
+chatgpt:
+    key: ENC[AES256_GCM,data:bkLxKUqkjwpUeqeAZCaAgKiOse8QtZ0zOn9TQNA84+B3rxNiTFPisI8=,iv:Zd5dO5Sdt4HCvNZgS2K0FjJAzti6oE22vahYQl99TrI=,tag:E3o+X84tRsIEGU9Jfb85JQ==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:Mr6KrAzYoDXA+dPT3oXqK2wm9ahTjZ5GVE/iRPsmcM+S2MABT+8ramyHz9oIFw==,iv:nIZ8rpSxz2GwMbDQFfG3xauMQjiriZ1oxFMrEQeH7sQ=,tag:y5U1T1vV/mmdE/CeaeTR8g==,type:str]
+    chat: ENC[AES256_GCM,data:8w/0EI64a1dC,iv:dHu9JHcUY7QPd9YBKXnrRXQB2K6jpnLrSFs+1IJmkio=,tag:3ucN3uNnBxxRF+cbLsa1nQ==,type:str]
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:aAZS,iv:Z+iJG7yC6HJeNdKCCpsZSc9Ny7kAt6GYfXUtZozMb4A=,tag:iMfwjqqmLvu5a8YpF7a0zQ==,type:comment]
+        user0: ENC[AES256_GCM,data:Q8MFrN/3SRgzSlwTx2GmpP/gvG1vpYiVgjsESzUoomsJaigP,iv:oLsf7AX3FE0tFOkJAbqrZVrCa6UxKjp450Sl1rs2Vs0=,tag:5w+AX0p4Or1GAQsEU3NxOQ==,type:str]
+        #ENC[AES256_GCM,data:j3zVwqHmag==,iv:8+ol60wNlbV2RzMBe47VxIrZuec8aXDUNcQvHcxKuiA=,tag:1AgCMfZf9vzWiWDS6hkw2Q==,type:comment]
+        user1: ENC[AES256_GCM,data:ucCiL7uoSafFUP9IiwKOjJqgwNxNLmuHxYXsLYl0fBgbCT3F,iv:RbNPwvSWibODQqySRc+YW65nUvRwaeXT0eDh02sfrwM=,tag:iE7GGrkBxljBT9HdPzDOfA==,type:str]
+        #ENC[AES256_GCM,data:x7dwVDe22M8=,iv:+fT7VUxZGd8SgS0PnEBqHLPLDuywu4s01iWB6TA/BKQ=,tag:CxfP7xSd4L9RBulSfViHaQ==,type:comment]
+        user2: ENC[AES256_GCM,data:e6PbRg30dzOJSXNmU6TML4AaFsSWEvZwN7MHAEX6fEW2p3hW,iv:Y+YYAO6hY9e/T8LSCr34M7riGmSzFIocmWwAwWjnZQs=,tag:LTkdGcRyrx7HqvbSYSsv4A==,type:str]
+        #ENC[AES256_GCM,data:j83rYg==,iv:3oEdAoVz7aMcezcy2chTO0LQTtKpTrJJoQZx3PC03BU=,tag:ABteEIyr2Y6MbGQhmrQySQ==,type:comment]
+        user3: ENC[AES256_GCM,data:Uk0Ax9FVzmmYs+ggWy7z6FEkuj2tppGlvnQdoW6PDI1VA9oI,iv:wSxigXleRUalQR1/TzKfdUVrdyEUuq+Wg42gSv1QMAI=,tag:qn6nBWv6MlGhMarCfI13BA==,type:str]
+    private-key: ENC[AES256_GCM,data:TarrinCFzWkB5zCc7i7f3B3tFfxrF+cGnrg4bw9CAGKWBazSJHCviY8Imw==,iv:azHdrc6AlgS9RPwGVsYRb8bBeC/askCdut1rnv9TA3I=,tag:AT2lLraKVgbp9GmlLJiI+w==,type:str]
+writefreely:
+    chn: ENC[AES256_GCM,data:YvhPa69sVdiljm9Ix6yQh6YCEpFvC9iw5Yx72MBcGr7+swdbvWDAfMmGFY066mAPvhpwZX/IEivKvrS0t/OSnw==,iv:7s2yEb30YaCAtNeevbur0HL28nXHVIqmCx6Bngh+HWk=,tag:yx0JK8RNQMVcYLBSxNj+uw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -129,8 +144,8 @@ sops:
             SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
             HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-20T06:27:19Z"
-    mac: ENC[AES256_GCM,data:i7AN+Sd4C61GSzT409mYd6D2tQzDyONIUsto52b1mV8hIJ4Q/U9VT5wumRjm4dGUWqrq9oFdD0/iUL1CmEdasBN7VFwNEpSYl6yhzU7zX3Re3N/0mffeW0Fx/38LdvywusJAHC9yWvsNMblKDnYxGm/UI2W/7QRMDyr8jnU6La0=,iv:Ua+K1m27GkkrUn+wcylkwrdWnq1yzFG1NMVzYAiW/6k=,tag:Gqqk5zOU3Ax2Al5CvXEV7g==,type:str]
+    lastmodified: "2024-08-20T15:48:48Z"
+    mac: ENC[AES256_GCM,data:buEby7ZmmEFARmRp3r7JwYdMck87u4c3TGkeF2pkc5ORnqIgwSH1XVSjlbK8vTBWz2FKXeQh9wkX3BMaam9dU873/yPBe54BnbZNggZ7jDDEpSTeddfTsM8mrka0xDO3CUHbwCsqYWFm4NLAbCfRPKhrjvSJVyEC85K3eO45Z6M=,iv:/7cOdSi6oiaaFRkSnR+1/XXapjlQdMgom31xrpIGXHk=,tag:XW4WX93bw45zPweblW4Dtg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0

devices/wlin.xmuhpc/.bash_profile

@@ -0,0 +1,12 @@
+# .bash_profile
+
+# Get the aliases and functions
+if [ -f ~/.bashrc ]; then
+	. ~/.bashrc
+fi
+
+# User specific environment and startup programs
+
+PATH=$PATH:$HOME/bin
+
+export PATH

devices/wlin.xmuhpc/.bashrc

@@ -0,0 +1,43 @@
+# .bashrc
+
+# Source global definitions
+if [ -f /etc/bashrc ]; then
+	. /etc/bashrc
+fi
+
+export PATH=$PATH:/data/gpfs01/wlin/bin
+
+# User specific aliases and functions
+export PATH=/data/gpfs01/wlin/bin/vaspkit.1.4.1/bin:${PATH}
+#export PATH=~/bin:/data/gpfs01/wlin/opt/mpich_ifort/bin:$PATH
+#export LD_LIBRARY_PATH=/data/gpfs01/wlin/opt/mpich_ifort/lib:$LD_LIBRARY_PATH
+#export PATH=~/bin:/data/gpfs01/wlin/opt/mpich/bin:$PATH
+#export LD_LIBRARY_PATH=/data/gpfs01/wlin/opt/mpich/lib:$LD_LIBRARY_PATH
+export P4_RSHCOMMAND=ssh
+ shopt -s cdspell
+ export HISTCONTROL=ignoredups
+#shopt -s histappend
+ PROMPT_COMMAND='history -a'
+ export C3_RSH="ssh -x"
+export OMP_NUM_THREADS=1
+export MKL_NUM_THREADS=1
+alias grep='grep --color'
+USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'` 
+ 
+export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  `whoami`@${USER_IP}: "
+export HISTFILESIZE=1000000
+export PROMPT_COMMAND="history -a; history -r;  $PROMPT_COMMAND"
+shopt -s histappend
+# Auto add env parameter $PROMPT_COMMAND when use non-Linux tty login by ssh.
+if [ "$SSH_CONNECTION" != '' -a "$TERM" != 'linux' ]; then
+declare -a HOSTIP
+HOSTIP=`echo $SSH_CONNECTION |awk '{print $3}'`
+export PROMPT_COMMAND='echo -ne "\033]0;${USER}@$HOSTIP:[${HOSTNAME%%.*}]:${PWD/#$HOME/~} \007"'
+fi
+ulimit -s unlimited
+export PYTHONPATH=/data/gpfs01/wlin/bin/VaspBandUnfolding-master:${PYTHONPATH}
+
+# vsts, see https://theory.cm.utexas.edu/vtsttools/scripts.html
+export PATH=$PATH:/data/gpfs01/wlin/yjj/vtstscripts-1022
+export PERL5LIB=/data/gpfs01/wlin/yjj/vtstscripts-1022
+

devices/xmupc1/README.md

@@ -0,0 +1,297 @@
+# 硬件
+
+* CPU：16 核 32 线程。
+* 内存：96 G。
+* 显卡：
+  * 4090：24 G 显存。
+  * 3090：24 G 显存。
+  * 2080Ti: 12 G 显存。
+* 硬盘：2 T。
+
+# 队列系统（SLURM）
+
+## 基本概念
+
+SLURM 是一个用来对任务排队的系统，轮到某个任务时，再调用其它程序来执行这个任务。
+
+## 常用命令
+
+我做了一个 TUI 界面，用起来比较简单，大多情况下可以满足需求。命令为：
+
+```bash
+sbatch-tui
+```
+
+或
+
+```bash
+sbatch
+```
+
+如果需要在提交任务时指定更详细的细节，或者要编写脚本批量提交任务，则在 `sbatch` 后面加上参数，这时是直接调用来自 SLURM 的 `sbatch` 命令。
+常用的参数见下文。更详细的内容见 SLURM 的官方文档。
+
+提交一个 VASP GPU 任务的例子：
+
+```bash
+sbatch --gpus=1 --ntasks-per-gpu=1 --job-name="my great job" vasp-nvidia
+```
+
+* `--gpus` 指定使用GPU 的情况：
+  * 要占用任意一个 GPU（排到这个任务时哪个空闲就使用哪个），写 `--gpus=1`。要占用任意两个就写 `--gpus=2`，以此类推。
+    但一般来说，**单个任务不要占用超过一个 GPU**，多个显卡的速度会比单个更慢。
+  * 要指定具体使用哪个 GPU 时，写 `--gpus=4090:1`。2080 Ti 需要写为 `2080_ti`，P5000 需要写为 `p5000`。
+  * 当需要使用多个不同类型的显卡（例如，指定使用一个 3090 和一个 4090）时，写 `--gres=gpu:3090:1,gpu:4090:1`。
+* `--ntasks-per-gpu=1` 对于 VASP 来说一定要写。
+* `--job-name=xxx` 指定任务的名字。可以简写为 `-J`。也可以不指定。
+* 默认情况下，一个 task 会搭配分配一个 CPU 核（一个线程），一般已经够用。如果一定要修改，用 `--cpus-per-task`。
+* `vasp-nvidia` 指调用 std 版本，要使用 gam 或 ncl 版本时，写为例如 `vasp-nvidia-gam`。
+
+提交一个 VASP CPU 任务的例子：
+
+```bash
+sbatch --ntasks=4 --cpus-per-task=4 --hint=nomultithread --job-name="my great job" vasp-intel
+```
+
+* `--ntasks=4 --cpus-per-task=4` 指定使用占用多少核。
+  * CPU 的调度是个非常复杂的问题，而且 slurm 和 Intel MPI 之间的兼容性也不算好，因此**推荐照抄下面的设置**。
+    也可以自己测试一下怎样分配更好，但不要随意地设置。不同的设置会成倍地影响性能。
+    * 对于 xmupc1：`--ntasks=3 --cpus-per-task=4`。
+    * 对于 xmupc2：`--ntasks=4 --cpus-per-task=10`。
+* `--hint=nomultithread` 记得写。
+* `--job-name=xxx` 指定任务的名字。可以简写为 `-J`。也可以不指定。
+* `vasp-intel` 指调用 std 版本，要使用 gam 或 ncl 版本时，写为例如 `vasp-intel-gam`。
+
+要把其它程序提交到队列里，也是类似的写法。请自行举一反三。
+
+要列出已经提交（包括已经完成、取消、失败）的任务：
+
+```bash
+squeue -t all -l
+```
+
+取消一个任务：
+
+```bash
+# 按任务的 id 取消
+scancel 114514
+# 按任务的名字取消
+scancel -n my_great_job
+# 取消一个用户的所有任务
+scancel -u chn
+```
+
+要将自己已经提交的一个任务优先级提到最高（相应降低其它任务的优先级，使得总体来说不影响别人的任务）：
+
+```bash
+scontrol top 114514
+```
+
+要显示一个任务的详细信息（不包括服务器重启之前算过的任务）：
+
+```bash
+scontrol show job 114514
+```
+
+要显示一个任务的详细信息（包括服务器重启之前算过的任务）：
+
+```bash
+sacct --units M --format=ALL -j 114514 | bat -S
+```
+
+## `sbatch` 的更多参数
+
+```bash
+# 提交一个新任务，但是礼让后面的任务（推迟到指定时间再开始排队）
+--begin=16:00 --begin=now+1hour
+# 指定工作目录
+--chdir=/path/to/your/workdir
+# 指定备注
+--comment="my great job"
+# 指定任务的 ddl，算不完就杀掉
+--deadline=now+1hour
+# 标准错误输出写到别的文件里
+--error=error.log
+# 将一些环境变量传递给任务（=ALL是默认行为）
+--export=ALL,MY_ENV_VAR=my_value
+# 不传递现在的环境变量
+--export=NONE
+# 打开一个文件作为标准输入
+--input=
+# 发生一些事件（任务完成等）时发邮件
+--mail-type=NONE,BEGIN,END,FAIL,REQUEUE,ALL --mail-user=chn@chn.moe
+# 要求分配内存（不会真的限制内存使用，只是在分配资源时会考虑）
+--mem=20G --mem-per-cpu --mem-per-gpu
+# 输出文件是否覆盖
+--open-mode={append|truncate}
+# 指定输出文件
+-o, --output=<filename_pattern>
+# 不排队，直接跑（超额分配）
+-s, --oversubscribe
+# 包裹一个二进制程序
+--wrap=
+```
+
+# 支持的连接协议
+
+## SSH
+
+ssh 就是 putty winscp 之类的工具使用的那个协议。
+
+* 地址：xmupc1.chn.moe
+* 端口：6007
+* 用户名：自己名字的拼音首字母
+* 可以用密码登陆，也可以用证书登陆。
+
+从一台服务器登陆到其它服务器，只需要使用 `ssh`` 命令：
+
+```bash
+ssh jykang
+ssh xmupc1
+ssh xmupc2
+ssh user@host
+```
+
+直接从另外一台服务器下载文件，可以使用 `rsync` 命令：
+
+```bash
+rsync -avzP jykang:/path/to/remote/directory_or_file /path/to/local/directory
+```
+
+将另外一个服务器的某个目录挂载到这个服务器，可以使用 `sshfs` 命令：
+
+```bash
+sshfs jykang:/path/to/remote/directory /path/to/local/directory
+```
+
+用完之后记得卸载（不卸载也不会有什么后果，只是怕之后忘记了以为这是本地的目录，以及如果网络不稳定的话，运行在这里的软件可能会卡住）：
+
+```bash
+umount /path/to/local/directory
+```
+
+如果不喜欢敲命令来挂载/卸载远程目录，也可以 RDP 登陆后用 dolphin。
+
+## RDP
+
+就是 windows 那个远程桌面。
+
+* 地址：xmupc1.chn.moe
+* 用户名：自己名字的拼音首字母
+* 密码和 ssh 一样（使用同样的验证机制）。
+
+RDP 暂时没有硬件加速（主要是毛玻璃之类的特效会有点卡）。
+
+记得在连接时，点击“显示选项”，将“体验”中的连接速度改为“LAN（10 Mbps 或更高）”，不然会很卡。
+
+## samba
+
+samba 就是 windows 共享文件夹的那个协议。
+
+* 地址：xmupc1.chn.moe
+* 用户名：自己名字的拼音首字母
+* 初始密码和 ssh 一样，你可以自己修改密码（使用 `smbpasswd` 命令）。samba 的密码和 ssh/rdp 的密码是分开的，它们使用不同的验证机制。
+
+在 windows 上，可以直接在资源管理器中输入 `\\xmupc1.chn.moe` 访问。
+也可以将它作为一个网络驱动器添加（地址同样是 `\\xmupc1.chn.moe`）。
+
+# 计算软件
+
+## VASP
+
+VASP 有很多很多个版本，具体来说：
+
+* VASP 可以用不同的编译器编译。目前安装的有：nvidia、intel。nvidia 使用 GPU 计算，intel 能用 CPU 计算。其它版本性能不佳，没有安装。
+* VASP 的 std/gam/ncl 版本有一点区别，一般用 std，只有一个 gamma 点的时候用 gam 会快一点，系统中存在方向不平行的磁矩时必须用 ncl。
+* 无论哪个版本，都集成了下面这些补丁：
+  * HDF5：用于生成 hdf5 格式的输出文件。
+  * wannier90：我也不知道干啥的，随手加上的。
+  * OPTCELL：如果存在一个 `OPTCELL` 文件，VASP 会据此决定弛豫时仅优化哪几个晶胞参数。
+  * MPI shared memory：用来减小内存占用。
+  * VTST tools：用来计算 neb。
+
+如何提交 VASP 到队列系统已经在上面介绍过了。下面的例子是，如果要直接运行一个任务的写法：
+
+```bash
+vasp-nvidia-env mpirun -np 1 -x CUDA_DEVICE_ORDER=PCI_BUS_ID -x CUDA_VISIBLE_DEVICES=0 -x OMP_NUM_THREADS=4 vasp-std
+vasp-intel-env mpirun -n 2 -genv OMP_NUM_THREADS=4 vasp-std
+```
+
+其中 `CUDA_VISIBLE_DEVICES` 用于指定用哪几个显卡计算（多个显卡用逗号分隔）。
+要查看显卡的编号，可以用 `CUDA_DEVICE_ORDER=PCI_BUS_ID vasp-nvidia-env nvaccelinfo` 命令。
+
+这里 `vasp-xxx-env` 命令的作用是，进入一个安装了对应版本的 VASP 的环境，实际上和 VASP 关系不大；
+  后面的 `mpirun xxx` 才是真的调用 VASP。
+所以实际上你也可以在这个环境里做别的事情，例如执行上面的 `nvaccelinfo` 命令。
+
+要使用 VTST tools 里带的脚本，需要在命令前加上 `vtstscripts` 。例如：
+
+```bash
+vtstscripts dist.pl POSCAR.init POSCAR.final
+```
+
+## mumax
+
+问龚斌，我没用过。
+
+## lammps
+
+除了我应该没人用，就不写了。
+
+## quantum espresso
+
+我也只用过一次。大规模用到了再说吧。
+
+# 其它软件
+
+我自己电脑上有的软件，服务器都有装，用于科研的比如 VESTA 什么的。可以自己去菜单里翻一翻。
+
+## 操作系统
+
+操作系统是 NixOS，是一个相对来说比较小众的系统。
+它是一个所谓“函数式”的系统。
+也就说，理想情况下，系统的状态（包括装了什么软件、每个软件和服务的设置等等）是由一组配置文件唯一决定的（这组配置文件放在 `/etc/nixos` 中）。
+要修改系统的状态（新增软件、修改设置等等），只需要修改这组配置文件，然后要求系统应用这组配置文件就可以了，
+  系统会自动计算出应该怎么做（增加、删除、修改哪些文件，重启哪些服务等等）。
+这样设计有许多好处，例如可以方便地回滚到之前任意一个时刻的状态（方便在调试时试错）；
+  一份配置文件可以描述多台机器的系统，在一台上调试好后在其它机器上直接部署；
+  以及适合抄或者引用别人写好的配置文件。
+
+以上都是对于管理员来说的好处。对于用户来说的好处不是太多，但是也有一些。
+举个例子，如果用户需要使用一个没有安装的软件（例如 `phonopy`，当然实际上这个已经装了），只需要在要执行的命令前加一个逗号：
+
+```bash
+, phonopy --dim 2 2 2
+```
+
+系统就会帮你下载所有的依赖，并在一个隔离的环境中运行这个命令（不会影响这之后系统的状态）。
+
+还有一个命令可能也有用，叫 `try`。
+它会在当前的文件系统上添加一个 overlay，之后执行的命令对文件的修改只会发生在这个 overlay 上；
+  命令执行完成后，它会告诉你哪些文件发生了改变，然后可以选择实际应用这些改变还是丢弃这些改变。
+例如：
+
+```bash
+try phonopy --dim 2 2 2
+```
+
+这个命令和 NixOS 无关，只是突然想起来了。
+
+## 文件系统
+
+文件系统是 BtrFS。它的好处有：
+
+* 同样的内容只占用一份空间；以及内容会被压缩存储（在读取时自动解压）。这样大致可以节省一半左右的空间。
+  例如现在 xll 目录里放了 213 G 文件，但只占用了 137 G 空间。
+* 每小时自动备份，放置在 `/nix/persistent/.snapshots` 中，大致上会保留最近一周的备份。如果你误删了什么文件，可以去里面找回。
+
+## ZSH
+
+所谓 “shell” 就是将敲击的一行行命令转换成操作系统能理解的系统调用（C 语言的函数）的那个东西，也就是负责解释敲进去的命令的意思的那个程序。
+
+大多情况下默认的 shell 是 bash，但我装的服务器上用 zsh。
+zsh 几乎完全兼容 bash 的语法，除此以外有一些顺手的功能：
+* 如果忘记了曾经输入过的一个命令，输入其中的几个连续的字母或者单词（不一定是开头的几个字母），然后按 `↑` 键，就会自动在历史命令中依次搜索。
+  例如我输入 `install` 按几下 `↑` 键，就可以找到 `sudo nixos-rebuild boot --flake . --install-bootloader --option substituters https://nix-store.chn.moe` 这个东西。
+* 如果从头开始输入一个曾经输入过的命令，会用浅灰色提示这个命令。要直接补全全部命令，按 `→` 键。要补全一个单词，按 `Ctrl` + `→` 键。
+* 常用的命令，以及常用命令的常用选项，按几下 `tab` 键，会自动补全或者弹出提示。

devices/xmupc1/default.nix

@@ -0,0 +1,97 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            # TODO: reparition
+            vfat."/dev/disk/by-uuid/467C-02E3" = "/boot";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/2f9060bc-09b5-4348-ad0f-3a43a91d158b"."/nix" = "/nix";
+              "/dev/disk/by-uuid/a04a1fb0-e4ed-4c91-9846-2f9e716f6e12" =
+              {
+                "/nix/rootfs" = "/nix/rootfs";
+                "/nix/persistent" = "/nix/persistent";
+                "/nix/nodatacow" = "/nix/nodatacow";
+                "/nix/rootfs/current" = "/";
+              };
+            };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        nixpkgs =
+        {
+          march = "znver3";
+          cuda =
+          {
+            enable = true;
+            capabilities =
+            [
+              # p5000 p400
+              "6.1"
+              # 2080 Ti
+              "7.5"
+              # 3090
+              "8.6"
+              # 4090
+              "8.9"
+            ];
+            forwardCompat = false;
+          };
+        };
+        gui = { enable = true; preferred = false; autoStart = true; };
+        networking.hostname = "xmupc1";
+        nix.remote.slave.enable = true;
+      };
+      hardware = { cpus = [ "amd" ]; gpu.type = "nvidia"; };
+      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      services =
+      {
+        snapper.enable = true;
+        sshd = { passwordAuthentication = true; groupBanner = true; };
+        xray.client.enable = true;
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        smartd.enable = true;
+        beesd.instances =
+        {
+          root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
+          nix = { device = "/nix"; hashTableSizeMB = 512; };
+        };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
+          wireguardIp = "192.168.83.6";
+        };
+        slurm =
+        {
+          enable = true;
+          cpu = { cores = 16; threads = 2; mpiThreads = 3; openmpThreads = 4; };
+          memoryMB = 94208;
+          gpus = { "2080_ti" = 1; "3090" = 1; "4090" = 1; };
+        };
+        xrdp = { enable = true; hostname = [ "xmupc1.chn.moe" ]; };
+        samba =
+        {
+          enable = true;
+          hostsAllowed = "";
+          shares = { home.path = "/home"; root.path = "/"; };
+        };
+        groupshare = {};
+        hpcstat = {};
+      };
+      bugs = [ "xmunet" "amdpstate" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "zqq" ];
+    };
+    services.hardware.bolt.enable = true;
+  };
+}

devices/xmupc1/secrets/default.yaml

@@ -0,0 +1,55 @@
+acme:
+    token: ENC[AES256_GCM,data:KKMdZgzciiM+n0Hdsb8vivjmCw6SiqJMbEAmvFwFQgvS9zpCNSyh+g==,iv:GbNJrVLmFudVzgoLdf+j8JsEPRvrQhBu3+2585grReQ=,tag:3tNL+2hoz2R9aOz0TUTjVQ==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:/7R7w+fiMw54Cmd7y/wT/s8RMqFMf3Fc0Mph0ZhURmCzowkmLEhtmw==,iv:i+Z+2NbssI864Edwf73SQfaeFuWoqr+U8eQ/8R23FOk=,tag:8ITlkS97vlsmHM1HDk6/3A==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:4PM/d263HgBseIgRplgo5ahJ8u8HuPznXt2hW5O+VawS6WjP,iv:98Ymj4eiCGQPMcaHBI9zJAaRagm82mF0LY2c9bzA+/s=,tag:8imXq/hxAxS5XKy0uWIBPw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:Azaqung7llErB7/IdnOnEkwjQ39yQHKcO7VgvMDCDTExM7nS0zx+yMYX4ls=,iv:FX8oLHMBVEnKkYOg8q2A9vFmtRZDws5T87+lEl7+2G8=,tag:DdOQUbNKB6JK7Tp6McQ0Og==,type:str]
+users:
+    #ENC[AES256_GCM,data:1RG/IM/UrLCk,iv:LY2QCBN0gYwuhVwS/WIrjt4MEHhjPPQG+cjTZJhU6Zc=,tag:AEL+smmitSqW+D70K74LbQ==,type:comment]
+    xll: ENC[AES256_GCM,data:YauaeGHDVAnMXp9hSz4r4jNsioF79Q+WplfsYGpl4g5FxoakhfjRlnfzrLmMO3mWEIBOmDqeShbDEulyV5O47CIBGaMUUHe+Gg==,iv:RNwRfghJBb0PO4A/T5d5J1U0NsXdygXlWq/FfF8MO4U=,tag:BOh666TYGbCCHcgB/uBhTw==,type:str]
+    #ENC[AES256_GCM,data:zxOQcoOzJNBK,iv:YJQB8lV+nhwm5XYMpDIyt0IDHBlHTiHO8cpgXkXe/dQ=,tag:re5ekGkYRewPdxv83mtLUQ==,type:comment]
+    zem: ENC[AES256_GCM,data:bIxVN4T3Gh3aSa1gylkPmW3/uT5xQAlruC+L3zk0Tc3KvwBCQA5DpxXU8ZxjeK0P0xGi02U7gFWgm+yxp6otdCsUEmWed4EHHw==,iv:vpKpY0nRUwuI5mCcYTOD3zN/E21wHl4ZbRDUPoFmdhQ=,tag:m5WTzCgOTC7oqU4yfV9gkQ==,type:str]
+    #ENC[AES256_GCM,data:ZnMFN0WzjKDd,iv:t1YHrNoHOohYsdBOqoV6OtfS5ig6CTS8jW5mKy0oSQA=,tag:WkgrH1ZXcbHruxJY/hVsmg==,type:comment]
+    yjq: ENC[AES256_GCM,data:ua0DINHutjt2Pk+SfHRQRV99mT3Cnw6rRKO8VRIAlP0dY6QhK9wkNdyRYWYRBKVrWgyFQMGNFYAxIpymjF/X7mBOVI2sOHLgkw==,iv:PUZ6S0KICuqoSA2sDLxdL4gtAOQnQXOUY+5f3qDZgpc=,tag:f39P34vAUOrV23BsKkRarA==,type:str]
+    #ENC[AES256_GCM,data:6qNjSdjck4Vz,iv:c/GNqCNgRgwgL+2f6Vumtjb/ub9WCBSy8R02NRCDqk8=,tag:b/tucJsHTjSfcK0vgHtE8A==,type:comment]
+    gb: ENC[AES256_GCM,data:3eAKBiJoC1owCHTFd3Xq8vI8VK980evePc92xCXJJ21M9D1MdbwN8ySZ3Ovjk7VfQmEo8oRv1Ll1sftyrXYoeTHmJsNDxCpR6A==,iv:Ju/ERNuGrgO5kYlbvmkbLJkgiW3Elou34AsJTFITCUg=,tag:POVlxYh9kZ1BMSbt97IVOQ==,type:str]
+    #ENC[AES256_GCM,data:oniighfvCNGWUwdhqg==,iv:RVUuZBqCd111QJ7MpgYBuP4fDCzm4NZAtbua9kXkrJM=,tag:21zF8E/3lBTDr54I9NKPVg==,type:comment]
+    zqq: ENC[AES256_GCM,data:Vjbbs8xIlH3+of7+kLGFVp4bIizU8D5R1qRbCqP5FhzTadXA8KD9/uiYxtrV3oxYGwZ/RlLvriHMClob4ihyDF4U2t8Dc4eVqA==,iv:FjCftpfKPZYThiNOyNkhx9uNyWIsjC5sK5WWcaEBtiY=,tag:MTL490c2SeFGx3EhxEdvkA==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:qQMD8SKNmxb3PdScXNqppF9zkX7dV5i7rvljvZuhiI5zLnu77qYCHBW6ymh0mrY14N9NjxmQZhZWX/H8TvBlcg==,iv:J5N3LjCYW3QmuEkMBpl7qvPFW1Z9ZoPLkj45jKcIW9U=,tag:Tl+ld07+lVkmzt7f/f2MqQ==,type:str]
+hpcstat:
+    key: ENC[AES256_GCM,data:POK329h/joF7WdSBwSE1EkYH/pZ9X+wiTKcVWLZjmh7gM9d7HONbN/PqsYNFTHJVR0GgysqpLEcPN2OFGs/SSeH86o04cAdjAVznKZgt1Q34QGYy6b+io15P3lbmK0kTKmeGt5qEhGkBh6BVBoSyqbKAknvUqJ17ZkL17kyRaKffm3Zais7keEJCFdyRF6oSz2kl2CvEmKNWPWDdO9EpgqgYlm9mwu95/k9Hx5eyUjiFpxc3fdFTESGbe0ZYAqKQ0eLFfLLorQp0pAzxCbbxIzZEgyxjzkICXKa1n7Zz6h1ON2Rsqq0Q4hEYJdWGLtvOH/VLVxvNWjW4Er6i3lWGhZRiDDrxLErQGONI+X7QqbneFCnMCZGln3pAfNtOr+KX58ij/egyzmb7bKZrARqnm+X+/I/L0+VS1PfDdLP53GaX7mfKYpcH6z7O2F/zjpuXQTV8njs64YlvgyYXsCaghEUBzehsruwRsBEkTIb4R2AlqItpbesMnNNUJ4Cr/B7Bw6O+gHeJ+oK4ZPBYbgso,iv:B2eWjydl8m8nbcPw2fZfxCnj57utWM9ABj2eJ1pRKWQ=,tag:5W9ZwVSJvm1KvZnf/E5Tug==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:Mu7guAFUu+UoHvo/h1blcI6Kg3mvng6zNc/HKXuCdf73ujziK0mXwPcf7t7d/w==,iv:BkA4d0OJ4lTD7csZJQHcDnYe7SYcFbwRVYOQAWOQ2lQ=,tag:GuJ4z5pe2znTY3xNT2WF+w==,type:str]
+    chat: ENC[AES256_GCM,data:OC8ElUPmfsVL,iv:WgZMJP2ugZbqZyihdNtL1xMH8u9VpLNzO8DGpDL4w4k=,tag:u4cKABikuMUbCIm5zCnk6A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RWIreCtMeTZ0UE9Zd2di
+            VE9tR0x6SUNyWjlPV1BqMU5Tb0RTSXNGN2hNCkxuVjFFb0xJZTBMekxqdE96RlRh
+            czF0dHQxdVhsNE5tVWg0Q2RmYktsWDgKLS0tIFY3dHRlbFpsWUsyTzA3RVR1Qyts
+            UUJHMU13cm1lOXhRYzhSWlFyTFltYWcKDUxABRGskWWpHEFL44gHYzAqaQ3AmBDt
+            LcL/4IiEs3TwOpuY+WTVx8JKZBOsxcSlNahiDuCnoTbL4gZTPnd0pA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwbHd4ZHhsTk5leDlreC9E
+            TVAzRXVuS0Judk5zTGVWRVhWSUhpMFdscEg0ClVFYzZYZG9hNjJKTlRVZ1I3eXVq
+            M2Y5by85dE1QM25yQ3g3bFVSL2tsVlkKLS0tIHVYbGxrT0hOQkZ5SHBsQ3UyaVly
+            ZDNHUjE2QVlCV3p0NHdKYW5IMHVBZzQKkZtfyvfroOntg3yRjMw4jQHiQj8eaB2h
+            IeIHfW4y01mmVT2ofbtB0xYpjcl4gtUlQ8X3tn5iJ9P8gcVo0G598A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-21T09:56:03Z"
+    mac: ENC[AES256_GCM,data:9+AR9Y6ik+BH1Spk62LSTU1NFQ8ID0YROF+yf8ss2RqhfP6/5+lsrNjGC7gnEEMYF8UWVtChUuljIK3Q4MtT64JhDWgp8tenbpkJnRFGylzEe37MYajdDY7nrPP7iPUPNvS1ndo6vp/yuEigBXVhCtpjMObj7zIdGnLbtz0sczA=,iv:gNb8gVp9adnlZsMM2afOlFe46Vy15ELmC9vGaaeaInY=,tag:rltLL3WSZytjEemgjCy6Ng==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/xmupc1/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:tuEymMXW0f7Rui5wrz/xozphTEq6ffkYIfNIoURFNHwH2Cg+aKHz2ox0gk02BJARhPMDrxCYlChkcrEI0ma/T0eBe9sWz3tA8AOwU1lHSZ06d/JWzW7IUIyTac2mnjt3/jY/qpnR4A8wtHwD0j4zkzXgUgFwq7k/fs24acEE4Jo=,iv:iDTS0xswLrwkOYmfomE5hluVONgJYia/RjINDy7T3R0=,tag:oIYNpFCuT2D+X1QEJJiHew==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aFRRa0NsOUp5MEg3UHcx\nc3g1VFZEQS9Tci9QSnNFYnIrT3hUdVU5cWxjCnU5UXVEdTFXczJzcHVvSjF2WHdB\nYmpyQVVaUFozKzJIZThBbXUxb2k2YzAKLS0tIHE1QXVrOXo1Y3VXMzJJYitWU3Qv\neDF1cndrSi94clh1cS9NczN0UW9pOXcKtrnIj3WovMYdcg5nWnnyRhJhTGLrlwxW\nxQ6bmNrfbZedmCNdjY2lPXmudMXJ8YlWe/HGCe94x3iFlaSwCIGUsA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocFl1SHJEemRySlBnMmNn\nVW9RS1NNdlo4M3l2WGlQaHJmbDBHcjMwaVVnCnY5WExPOXZJVEdYSlJ6UTRBMGJj\ncmlYaUNVV1hnWTNkaWVuV2VuaXN2eU0KLS0tIDBTYnd2NmVYTUJKaHZWRWo3ZlUx\nTEtPZWc2RE1XNG9WTXFOTllWVUVWeUkK+9aLz1rygGAQjpG+oMNUtrDkQaDfg+2q\nnl/CtZZrFD6NXGw6Di0X5t9fQu295NTJ/0qjXnfMigG8gDtxkE+/7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-26T06:04:53Z",
+		"mac": "ENC[AES256_GCM,data:y0RkPyUwwff95BFL951TxS/x5ORzMsxFJVjopSw+8iVtswD8MT1nmsbwyth4C9OnJ/IAtnZk/CjAt72a68AZpPI+2W/JqJq20ohFoquDNhTlsoyLWdO3Vjrd+Wo3hp0+iKQ3e/uYrF1sTqQO9a3OIxu2sVLM0gEDmIe2nJpLJQo=,iv:EjXTQvVdjzfClNfQ3rPxAFVWVqr7sSOz4ap+nshPEAk=,tag:DcIlf9W7NNqQ+gf8f46MwQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}

devices/xmupc1/tunnel.md

@@ -0,0 +1,39 @@
+# 使用 SSH 隧道连接
+
+在学校外且不使用厦大 VPN 时，无法直接连接到学校的服务器，可以通过下面的方法连接到：
+  首先连接到 vps6.chn.moe。这个服务器在校外（洛杉矶），因此可以直接连接到。
+  同时，它通过别的方式与学校的服务器保持着连接，利用这个保持着的连接，跳回到学校的服务器。
+
+这个跳转的过程不需要手动操作，只需要将软件设置好即可。
+
+## PuTTY
+
+1. 首先设置一个名为 `vps6` 的会话。
+   1. 在 Session 页，填入 `vps6.chn.moe` 作为 Host Name。
+   2. 在 Connection -> SSH -> Auth -> Credentials 页，在 “Private key file for authentication“ 选择密钥文件。
+   3. 在 Connection -> Data 页，在 “Auto-login username” 填写用户名。
+   4. 回到 Session 页，在 “Saved Sessions” 填入 `vps6` 并点击 “Save” 保存配置。
+2. 再设置一个名为 `wireguard.xmupc1` 的会话。
+   1. 在 Session 页，填入 `wireguard.xmupc1.chn.moe` 作为 Host Name。
+   2. 在 Connection -> SSH -> Auth -> Credentials 页和 Connection -> Data 页，需要修改的设置与在 `vps6` 会话中相同。
+   3. 在 Connection -> Proxy 页，设置 Proxy type 为 `SSH to proxy and use port forwarding`，Proxy hostname 为 `vps6`。
+   4. 回到 Session 页，在 “Saved Sessions” 填入 `wireguard.xmupc1` 并点击 “Save” 保存配置。
+
+之后双击双击 `wireguard.xmupc1` 会话即可连接到学校的服务器。
+
+## WinSCP
+
+1. 在登陆界面，点击 “新建站点”。
+   1. 设置 “文件协议” 为 `SCP`，“主机名” 为 `wireguard.xmupc1.chn.moe`，并输入用户名。
+   2. 然后点击右下角 “高级” 继续修改设置。
+   3. 在 连接 -> 隧道 页，勾选 “通过 SSH 隧道进行连接”，主机名填写 `vps6.chn.moe`，选择密钥文件，并填写用户名。
+   4. 在 SSH -> 验证 页，选择密钥文件。
+   5. 点击 “确定”，再点击 “保存”。
+
+## OpenSSH
+
+下面是一个命令的示例：
+
+```bash
+ssh -J username@vps6.chn.moe username@wireguard.xmupc1.chn.moe
+```

devices/xmupc2/README.md

@@ -0,0 +1,31 @@
+# 硬件
+
+* CPU：44 核 88 线程。
+* 内存：256 G。
+* 显卡：
+  * 4090：24 G 显存。
+  * P5000：16 G 显存。
+* 硬盘：18 T。
+
+# 支持的连接协议
+
+## SSH
+
+* 地址：xmupc2.chn.moe
+* 端口：6394
+* 用户名：自己名字的拼音首字母
+* 可以用密码登陆，也可以用证书登陆。
+
+## RDP
+
+* 地址：xmupc2.chn.moe
+* 用户名：自己名字的拼音首字母
+* 密码和 ssh 一样（使用同样的验证机制）。
+
+## samba
+
+* 地址：xmupc2.chn.moe
+* 用户名：自己名字的拼音首字母
+* 初始密码和 ssh 一样。
+
+其它内容请阅读 [xmupc1](../xmupc1) 的说明，两台机器的软件大致是一样的。

devices/xmupc2/default.nix

@@ -0,0 +1,79 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/23CA-F4C4" = "/boot";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/d187e03c-a2b6-455b-931a-8d35b529edac" =
+                { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
+            };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        nixpkgs =
+        {
+          march = "skylake";
+          cuda =
+          {
+            enable = true;
+            capabilities =
+            [
+              # p5000 p400
+              "6.1"
+              # 2080 Ti
+              "7.5"
+              # 3090
+              "8.6"
+              # 4090
+              "8.9"
+            ];
+            forwardCompat = false;
+          };
+        };
+        gui = { enable = true; preferred = false; autoStart = true; };
+        networking.hostname = "xmupc2";
+        nix.remote.slave.enable = true;
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "nvidia"; };
+      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      services =
+      {
+        snapper.enable = true;
+        sshd = { passwordAuthentication = true; groupBanner = true; };
+        xray.client.enable = true;
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        smartd.enable = true;
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
+          wireguardIp = "192.168.83.7";
+        };
+        slurm =
+        {
+          enable = true;
+          cpu = { sockets = 2; cores = 22; threads = 2; mpiThreads = 4; openmpThreads = 10; };
+          memoryMB = 253952;
+          gpus = { "4090" = 1; "p5000" = 1; };
+        };
+        xrdp = { enable = true; hostname = [ "xmupc2.chn.moe" ]; };
+        samba = { enable = true; hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
+        groupshare = {};
+      };
+      bugs = [ "xmunet" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "zqq" ];
+    };
+  };
+}

devices/xmupc2/secrets/default.yaml

@@ -0,0 +1,50 @@
+acme:
+    token: ENC[AES256_GCM,data:Wb7Gons3HCMK5WGIZpG4XrrqZ5G6bymjuKMW6IUjLiK0CIXFz/ARNg==,iv:zc4BgHcc+O7SHQbJkff11fBwgsd+TFtvSEGJ/qrzVo4=,tag:K+Nu9kenTtTnin4+hDCdWA==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:FPVSD8otQMNpbESNEHXCfQjB/zi3OVwZoyLijUtnHQlQzec7KVSiGw==,iv:DkkwCqvRmcFHQIXseh2fycCxZboJMYhHPu67GddenY4=,tag:iHEC8r5GcuB1QcZ5Uf8Skw==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:j2R0UtfS/es2A+Ic+Kq6FZJSqXlA/Q8tGkuAIX0ZdTsV4hGk,iv:Ovpr49isIJRdUyM3jxgiT+9Sc+qTF6ZnkKUwxIq6KUs=,tag:2VRSkiPNWaOmCqLJti8Bzw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:0Vw9NVs/Kxc52zUlmeAPFeOG8msdL0YopjhzFKRWhv6+kfb+SFObOP8EJ2M=,iv:KgIZIawbnN+1sIcMjNECkdtujPbg7yQktKVc25SXavI=,tag:b79oZP+GZKmM3OVFshvFhg==,type:str]
+users:
+    #ENC[AES256_GCM,data:FP1Mr1TmRI4L,iv:3K4LMbOQPvF1ORWNyaXDoC5MXn3yColR4eKs9sm9y5s=,tag:f3guTegVXw1A6aqolKQnqA==,type:comment]
+    xll: ENC[AES256_GCM,data:CAEd+usnLKoQZ+0PLEiJfbZpz2pyn+I/edC2KbNXBXZPAgT7IDENMnSQyxme899KqRVL4nLrtHs82aA8+kl/dE+QYSTCFVVuHg==,iv:Hs8rb0Iu5Xw74p9/cL2gWfPLh61VaLzIltKUSjRFZjc=,tag:/u5vI0oTMQbNoCEzhcWqOw==,type:str]
+    #ENC[AES256_GCM,data:UIns0CnC/QmJ,iv:Gn4XDPcdTyDLXAgGq7qwayrN206Gx7JsJ3V9G+4bTyA=,tag:FITVs8Tgkiq1XoS8joXM1Q==,type:comment]
+    zem: ENC[AES256_GCM,data:znpGuS8LVxaztnwQlIwu3hykWRBUtQvOsniLaOasXDbw9lHGX8lwwYJuCE+0I14HmiZK/RrrouIwfAfcjZQzPyjJ/SRoOG1Vyg==,iv:YXHX43y99/w9102vhsvFLVOUtJmuRnLVLu+ywfn9URY=,tag:AzsmkXOyX7y/D+ndteuMmA==,type:str]
+    #ENC[AES256_GCM,data:6vMItERptBsX,iv:G0sDjEfLciheMxTZbeLIbWKlimPD1ANIk/VVdhQifXA=,tag:oR9FEdVx6W+0uDeKfb37iw==,type:comment]
+    yjq: ENC[AES256_GCM,data:sGPQ0xALULREnhzl9g/V91M5osMglsSps6R4gYn5OZc/4xVC1phF3qajVN3YMOr7kKgkHbF2Rjm6/2vuK0k1iYZnFswUAmFlmw==,iv:5vG1hn7SlX6HCpas2BgxBSwWqLby8OCxcH3EKNvceIc=,tag:TVwFBAuosKnEOZecq1phXw==,type:str]
+    #ENC[AES256_GCM,data:ALHxkRABA+ll,iv:r1IDiHLFcTdLID3q16zrLTavAwQfddC7bXMKcFZFveI=,tag:4Pd0/Q1BmH4gJjaM4hbqqQ==,type:comment]
+    gb: ENC[AES256_GCM,data:z4CrtdmdLJJ0qZzr7qvihnluJQgjtciX56KdEmtemiRu0llEJk9qz6a23aJ7m40Sfc38elF1/LsvjOuBOC87+BVkKDCj76phag==,iv:WrFVxkr3snmqDXZx5kAYCLp7ixEIzxoT7El3rV7Ovqg=,tag:iExf2Y/HObHQrKMTRvqn7A==,type:str]
+    #ENC[AES256_GCM,data:UoNCXbGIHDNsmyCJxw==,iv:uTNvqg4xm7E+yn8vFaaihbEGEhLTZ2FNFNCYzdgiDlU=,tag:4bRSZbx6FFzA6MiBYVu0qw==,type:comment]
+    zqq: ENC[AES256_GCM,data:sfgufV++PfTrdeUBXZhmF1JoSpD8Nj+m0QKFrUMJG/pHb0AUagJEWEJwPsI+m91tZE0qxM271ks+WKqLElmyD4Ftw7ywWzTE0Q==,iv:R05QFUF+fvIHidWpHIR/D/e+UeciS5ehnx1kx+saCgM=,tag:3Awnd+pUQRxjjQ58SUX7Mg==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:9wLQ1zF/kDaiw0s3UaRpiHgmngU7u6hwyqpddSjev0+Z0v58Q2oiJtK8vn+2VlSxx5ACfqEFbzp0PZYAxd575w==,iv:q9JTkgDymOwkbZ/PaxRAAQrtO96QmGgZcQuLTFCMoS4=,tag:dwOHlOTgZqT/1jQ+oGf7UQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Rmc2Ull1WFB4Smh3c0Zl
+            emlTNGJKZkpIK2JFeUNVeUcrR2FzRXRQZHlvCkhzMHpzYmZRZ0M0cXdRVi8wZmp6
+            ZDRZQ2FkOWt6M0lrdjBHa3VTWXBDKzgKLS0tIGtJbTRRelg1VVk2QStwdzlFM1g4
+            M1JOd1g3cVdjUFRhZ0FxcWphZXZJbkkKFXDtJVoi+qIrXp6cznevuZ+peBiRRITP
+            rrplqLiYsNIGKmKYtRIUu8WXDZ2q2CJ8Z+pka3W3H/U+m957hBDWyw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSHdka3FPQUYrcXQzcTFo
+            a000TUllT0MvUzk5ZzVFbXZheG9ZVTM2S253CkE5VW9tQktvL2pMWFoxcnFjTGpr
+            Z0p1RjZWRGpSZ01TdTZRcEJXM2NOUkUKLS0tIC9rNmNzWitMdEd5dXQvdWlELzhM
+            M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
+            LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-21T09:56:44Z"
+    mac: ENC[AES256_GCM,data:COodLhpL5EA5g15lgimsuxs1vmqJrLDVgtjw+0FLKTq6E1pcQ+zJl+dD0b9u5fYy9BBf56TI8TLJahVPR0eGxbDFlHmx8M9GStlTqaOE3jRsDT8GsihdlvLokyVt8jEfAnaWESTIgfehVL2TrLlsMnIsoVHrzdlEhX5ATXA3QOg=,iv:U/EwFmYWOcxi7ItkR/+MT8gTu7UobH5pxS00qrH/yyU=,tag:RVMcx4X0IS9yvpHrF0owpg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/xmupc2/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:Um00c+kry3QrHEZVdlUws+gGGvtPKh8WzkpT6CHL7uwHRUWc+5E0bvlwXFJTkmPdGOOV2Jx9fGvSKpQb1/MPJhMhpCAw5n69QIRjVVURZcvVVFrl+eNO2sf/h2GTFvKRAtlcNAh7cvjkpiB3r+S7mRYSI914B7w8GLTdRFvtqYo=,iv:gk7S1SiA0iBAfpXLhhPJuexolP6w1XAd8M2H+sqqmoM=,tag:O8Eoa4LjEo14H/+1W5rcgQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWYmNFOFlnbm1FdXdGWUNr\nOGN3THhDUyt4SDVzcHY5dEYrSWsrQm1UOFJvCmhXaWFlcC8wazROaXZzcm9tUnFM\nQlphZ0x6c0RhbzY0aGVFbXdOa1BHbG8KLS0tIHF2YUNTVnZ3Z25FSnFlTEdmdXhE\nb3Z2UEp1c2UrOUp3NEdNcE5HSFptbzAKWGSTwv6xUNs/f+p0Bhpzg8zZ7EVK8kMm\no13fru2Cnqrw8Cj0zfx+7LODpBVzo03fLYKqZ6kbPZGa12ihk+fD4g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRVMrenM2Q1ZheFVPc2Rz\nYVd6UGoxbkpSQlZsNFN1dmIzSkl6SERwaTBRCjlHV3MvTEpxbDY4OHZjeUd5NmRF\nRmc1NzVCMTA0bDhwajNlMWZKTlNKK2cKLS0tIHRZZ0cxY2dwV21iRDlmeE5UZkM4\nK1dKV24yY3FKV2J3U2VzZWt2QnBSTHcKn8mq+1RnJG/nBbH2mAFpSFSTHDWvMqJj\nsziW9lK0cH6bPxhcpDO4oG8K08bdGHUVGtx2Zk81CDqzfamlMzzG2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-03-09T07:59:38Z",
+		"mac": "ENC[AES256_GCM,data:zNh6Cioh4+r0+nx04yLqeQShozxl7bLLKSmwodnmHtVQVlOTjj5sDLMEAAmrj1Ym2KrBPJOgdm34Sl6AbsmiBLxzDcBKe6J68Y/LHIeaPkToRKpmoy9I9a177w0KzFXgNaU2ieH71egD+nf8JmGG61hDjpiJRpx1Lwxb16Bn+Xs=,iv:QxiUYymiGuH0EBwEhyg5gDzkSKvGhq0+0wERNEJ71UM=,tag:N1Nn9X9vrghwwJWC3kituA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}

flake.nix

@@ -3,10 +3,12 @@
 
   inputs =
   {
-    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-23.11";
-    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
-    nixpkgs-2305.url = "github:CHN-beta/nixpkgs/nixos-23.05";
-    home-manager = { url = "github:nix-community/home-manager/release-23.11"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-unstable";
+    "nixpkgs-23.11".url = "github:CHN-beta/nixpkgs/nixos-23.11";
+    "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    "nixpkgs-22.11".url = "github:NixOS/nixpkgs/nixos-22.11";
+    "nixpkgs-22.05".url = "github:NixOS/nixpkgs/nixos-22.05";
+    home-manager = { url = "github:nix-community/home-manager"; inputs.nixpkgs.follows = "nixpkgs"; };
     sops-nix =
     {
       url = "github:Mic92/sops-nix";
@@ -14,654 +16,192 @@
     };
     aagl = { url = "github:ezKEa/aagl-gtk-on-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
     nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nur.url = "github:nix-community/NUR";
-    nixos-cn = { url = "github:nixos-cn/flakes"; inputs.nixpkgs.follows = "nixpkgs"; };
     nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
     nix-vscode-extensions = { url = "github:nix-community/nix-vscode-extensions"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-alien =
-    {
-      url = "github:thiagokokada/nix-alien";
-      inputs = { nixpkgs.follows = "nixpkgs"; nix-index-database.follows = "nix-index-database"; };
-    };
     impermanence.url = "github:nix-community/impermanence";
-    qchem = { url = "github:Nix-QChem/NixOS-QChem"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nixd = { url = "github:nix-community/nixd"; inputs.nixpkgs.follows = "nixpkgs"; };
-    napalm = { url = "github:nix-community/napalm"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nixpak = { url = "github:nixpak/nixpak"; inputs.nixpkgs.follows = "nixpkgs"; };
-    deploy-rs = { url = "github:serokell/deploy-rs"; inputs.nixpkgs.follows = "nixpkgs"; };
-    pnpm2nix-nzbr = { url = "github:CHN-beta/pnpm2nix-nzbr"; inputs.nixpkgs.follows = "nixpkgs"; };
-    lmix = { url = "github:CHN-beta/lmix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    dguibert-nur-packages = { url = "github:CHN-beta/dguibert-nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    qchem = { url = "github:Nix-QChem/NixOS-QChem/master"; inputs.nixpkgs.follows = "nixpkgs"; };
     plasma-manager =
     {
       url = "github:pjones/plasma-manager";
       inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
     };
-    nix-doom-emacs = { url = "github:nix-community/nix-doom-emacs"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nixos-hardware.url = "github:CHN-beta/nixos-hardware";
+    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-fast-build = { url = "github:/Mic92/nix-fast-build"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-flatpak.url = "github:gmodena/nix-flatpak";
+    chaotic =
+    {
+      url = "github:chaotic-cx/nyx";
+      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
+    };
+    gricad = { url = "github:Gricad/nur-packages"; flake = false; };
+    catppuccin.url = "github:catppuccin/nix";
+    bscpkgs = { url = "git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
+
+    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
+    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
+    zpp-bits = { url = "github:eyalz800/zpp_bits"; flake = false; };
+    concurrencpp = { url = "github:David-Haim/concurrencpp"; flake = false; };
+    cppcoro = { url = "github:Garcia6l20/cppcoro"; flake = false; };
+    date = { url = "github:HowardHinnant/date"; flake = false; };
+    eigen = { url = "gitlab:libeigen/eigen"; flake = false; };
+    matplotplusplus = { url = "github:alandefreitas/matplotplusplus"; flake = false; };
+    nameof = { url = "github:Neargye/nameof"; flake = false; };
+    nodesoup = { url = "github:olvb/nodesoup"; flake = false; };
+    tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
+    v-sim = { url = "gitlab:l_sim/v_sim"; flake = false; };
+    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
+    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
+    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
+    linux-surface = { url = "github:linux-surface/linux-surface"; flake = false; };
+    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
+    lmod = { url = "github:TACC/Lmod"; flake = false; };
+    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
+    kylin-virtual-keyboard = { url = "git+https://gitee.com/openkylin/kylin-virtual-keyboard.git"; flake = false; };
+    cjktty = { url = "github:CHN-beta/cjktty-patches"; flake = false; };
+    zxorm = { url = "github:CHN-beta/zxorm"; flake = false; };
+    openxlsx = { url = "github:troldal/OpenXLSX?rev=f85f7f1bd632094b5d78d4d1f575955fc3801886"; flake = false; };
+    sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
+    sockpp = { url = "github:fpagliughi/sockpp"; flake = false; };
+    git-lfs-transfer = { url = "github:charmbracelet/git-lfs-transfer"; flake = false; };
+    nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
+    hextra = { url = "github:imfing/hextra"; flake = false; };
+
+    # does not support lfs yet
+    # nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git"; flake = false; };
   };
 
   outputs = inputs:
     let
-      localLib = import ./local/lib inputs.nixpkgs.lib;
+      localLib = import ./lib.nix inputs.nixpkgs.lib;
+      devices = builtins.filter (dir: (builtins.readDir ./devices/${dir})."default.nix" or null == "regular" )
+        (builtins.attrNames (builtins.readDir ./devices));
     in
     {
-      packages.x86_64-linux =
+      packages.x86_64-linux = rec
       {
+        pkgs = (import inputs.nixpkgs
+        {
+          system = "x86_64-linux";
+          config.allowUnfree = true;
+          overlays = [ inputs.self.overlays.default ];
+        });
         default = inputs.nixpkgs.legacyPackages.x86_64-linux.writeText "systems"
           (builtins.concatStringsSep "\n" (builtins.map
             (system: builtins.toString inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel)
-            [ "pc" "vps6" "vps7" "nas" "yoga" ]));
+            devices));
+        hpcstat =
+          let
+            openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
+              (prev: { doCheck = false; patches = prev.patches ++ [ ./packages/hpcstat/openssh.patch ];});
+            duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
+          in pkgs.pkgsStatic.localPackages.hpcstat.override
+            { inherit openssh duc; standalone = true; version = inputs.self.rev or "dirty"; };
+        ufo =
+          let
+            range-v3 = pkgs.pkgsStatic.range-v3.overrideAttrs (prev:
+            {
+              cmakeFlags = prev.cmakeFlags or []
+                ++ [ "-DRANGE_V3_DOCS=OFF" "-DRANGE_V3_TESTS=OFF" "-DRANGE_V3_EXAMPLES=OFF" ];
+              doCheck = false;
+            });
+            tbb = pkgs.pkgsStatic.tbb_2021_11.overrideAttrs (prev: { cmakeFlags = prev.cmakeFlags or [] ++
+              [ "-DTBB_TEST=OFF" ]; });
+            biu = pkgs.pkgsStatic.localPackages.biu.override { inherit range-v3; };
+            matplotplusplus = pkgs.pkgsStatic.localPackages.matplotplusplus.override { libtiff = null; };
+          in pkgs.pkgsStatic.localPackages.ufo.override { inherit biu tbb matplotplusplus; };
+        chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
+        blog = pkgs.callPackage ./blog { inherit (inputs) hextra; };
       }
-      // (
-        builtins.listToAttrs (builtins.map
+      // (builtins.listToAttrs (builtins.map
+        (system:
+        {
+          name = system;
+          value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
+        })
+        devices)
+      );
+      nixosConfigurations =
+      (
+        (builtins.listToAttrs (builtins.map
           (system:
           {
             name = system;
-            value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
-          })
-          [ "pc" "vps6" "vps7" "nas" "yoga" "xmupc1" ])
-      );
-      # ssh-keygen -t rsa -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_rsa_key
-      # ssh-keygen -t ed25519 -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_ed25519_key
-      # systemd-machine-id-setup --root=/mnt/nix/persistent
-      nixosConfigurations =
-        let
-          system =
-          {
-            pc =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.auto =
-                  {
-                    "/dev/disk/by-uuid/55fdd19f-0f1d-4c37-bd4e-6df44fc31f26" = { mapper = "root"; ssd = true; };
-                    "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
-                      { mapper = "swap"; ssd = true; before = [ "root" ]; };
-                  };
-                  swap = [ "/dev/mapper/swap" ];
-                  resume = "/dev/mapper/swap";
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub =
-                {
-                  windowsEntries = { "7317-1DB6" = "Windows"; "7321-FA9C" = "Windows for malware"; };
-                  installDevice = "efi";
-                };
-                nix =
-                {
-                  marches =
-                  [
-                    "alderlake"
-                    # CX16
-                    "sandybridge"
-                    # CX16 SAHF FXSR
-                    "silvermont"
-                    # RDSEED MWAITX SHA CLZERO CX16 SSE4A ABM CLFLUSHOPT WBNOINVD
-                    "znver2" "znver3"
-                    # CX16 SAHF FXSR HLE RDSEED
-                    "broadwell"
-                    "znver4"
-                  ];
-                  keepOutputs = true;
-                };
-                nixpkgs =
-                  { march = "alderlake"; cuda = { enable = true; capabilities = [ "8.6" ]; forwardCompat = false; }; };
-                kernel.patches = [ "cjktty" "lantian" ];
-                impermanence.enable = true;
-                networking.hostname = "pc";
-                sysctl.laptop-mode = 5;
-              };
-              hardware =
-              {
-                cpus = [ "intel" ];
-                gpus = [ "intel" "nvidia" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                prime = { enable = true; mode = "offload"; busId = { intel = "PCI:0:2:0"; nvidia = "PCI:1:0:0"; }; };
-                gamemode.drmDevice = 1;
-              };
-              packages.packageSet = "workstation";
-              virtualization =
-              {
-                waydroid.enable = true;
-                docker.enable = true;
-                kvmHost = { enable = true; gui = true; autoSuspend = [ "win10" "hardconnect" ]; };
-                # kvmGuest.enable = true;
-                nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
-              };
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  private = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares =
-                  {
-                    media.path = "/run/media/chn";
-                    home.path = "/home/chn";
-                    mnt.path = "/mnt";
-                    share.path = "/home/chn/share";
-                  };
-                };
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns =
-                  {
-                    extraInterfaces = [ "docker0" ];
-                    hosts =
-                    {
-                      "mirism.one" = "74.211.99.69";
-                      "beta.mirism.one" = "74.211.99.69";
-                      "ng01.mirism.one" = "74.211.99.69";
-                      "debug.mirism.one" = "127.0.0.1";
-                      "initrd.vps6.chn.moe" = "74.211.99.69";
-                      "nix-store.chn.moe" = "127.0.0.1";
-                      "initrd.nas.chn.moe" = "192.168.1.185";
-                    };
-                  };
-                };
-                firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
-                acme = { enable = true; cert."debug.mirism.one" = {}; };
-                frpClient =
-                {
-                  enable = true;
-                  serverName = "frp.chn.moe";
-                  user = "pc";
-                  stcpVisitor."yy.vnc".localPort = 6187;
-                };
-                nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
-                smartd.enable = true;
-                misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
-                beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 2048; }; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
-                  wireguardIp = "192.168.83.3";
-                };
-              };
-              bugs =
-              [
-                "suspend-hibernate-no-platform" "hibernate-iwlwifi" "suspend-lid-no-wakeup" "xmunet"
-                "suspend-hibernate-waydroid" "power"
-              ];
-            };
-            vps6 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/24577c0e-d56b-45ba-8b36-95a848228600"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
-                    delayedMount = [ "/" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
-                nixpkgs.march = "sandybridge";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                initrd.sshd.enable = true;
-                impermanence.enable = true;
-                networking.hostname = "vps6";
-              };
-              packages.packageSet = "server";
-              services =
-              {
-                snapper.enable = true;
-                sshd.enable = true;
-                xrayServer = { enable = true; serverName = "vps6.xserver.chn.moe"; };
-                frpServer = { enable = true; serverName = "frp.chn.moe"; };
-                nginx =
-                {
-                  streamProxy.map =
-                  {
-                    "anchor.fm" = { upstream = "anchor.fm:443"; proxyProtocol = false; };
-                    "podcasters.spotify.com" = { upstream = "podcasters.spotify.com:443"; proxyProtocol = false; };
-                    "xlog.chn.moe" = { upstream = "cname.xlog.app:443"; proxyProtocol = false; };
-                  }
-                  // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.pc.chn.moe"; })
-                    [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
-                  // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
-                    [
-                      "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
-                      "send" "kkmeeting" "api" "git" "grafana"
-                    ]));
-                  applications =
-                  {
-                    element.instances."element.chn.moe" = {};
-                    synapse-admin.instances."synapse-admin.chn.moe" = {};
-                    catalog.enable = true;
-                    blog.enable = true;
-                    main.enable = true;
-                  };
-                };
-                coturn.enable = true;
-                httpua.enable = true;
-                mirism.enable = true;
-                fail2ban.enable = true;
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "pc" "nas" "vps7" ];
-                  publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
-                  wireguardIp = "192.168.83.1";
-                  externalIp = "74.211.99.69";
-                  lighthouse = true;
-                };
-              };
-            };
-            vps7 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/e36287f7-7321-45fa-ba1e-d126717a65f0"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
-                    delayedMount = [ "/" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
-                nixpkgs.march = "broadwell";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                initrd.sshd.enable = true;
-                impermanence.enable = true;
-                networking.hostname = "vps7";
-                gui.preferred = false;
-              };
-              packages.packageSet = "desktop";
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                sshd.enable = true;
-                rsshub.enable = true;
-                wallabag.enable = true;
-                misskey.instances =
-                {
-                  misskey.hostname = "xn--s8w913fdga.chn.moe";
-                  misskey-old = { port = 9727; redis.port = 3546; meilisearch.enable = false; };
-                };
-                synapse.instances =
-                {
-                  synapse.matrixHostname = "synapse.chn.moe";
-                  matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
-                };
-                xrdp = { enable = true; hostname = [ "vps7.chn.moe" ]; };
-                vaultwarden.enable = true;
-                beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 1024; }; };
-                photoprism.enable = true;
-                nextcloud.enable = true;
-                freshrss.enable = true;
-                send.enable = true;
-                huginn.enable = true;
-                fz-new-order.enable = true;
-                nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; };
-                httpapi.enable = true;
-                mastodon.enable = true;
-                gitea.enable = true;
-                grafana.enable = true;
-                fail2ban.enable = true;
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
-                  wireguardIp = "192.168.83.2";
-                  externalIp = "95.111.228.40";
-                };
-              };
-            };
-            nas =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/13BC-F0C9" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/0e184f3b-af6c-4f5d-926a-2559f2dc3063"."/boot" = "/boot";
-                      "/dev/mapper/nix"."/nix" = "/nix";
-                      "/dev/mapper/root1" =
-                      {
-                        "/nix/rootfs" = "/nix/rootfs";
-                        "/nix/persistent" = "/nix/persistent";
-                        "/nix/nodatacow" = "/nix/nodatacow";
-                        "/nix/rootfs/current" = "/";
-                        "/nix/backup" = "/nix/backup";
-                      };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices =
-                    {
-                      "/dev/disk/by-uuid/5cf1d19d-b4a5-4e67-8e10-f63f0d5bb649".mapper = "root1";
-                      "/dev/disk/by-uuid/aa684baf-fd8a-459c-99ba-11eb7636cb0d".mapper = "root2";
-                      "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
-                    };
-                    delayedMount = [ "/" "/nix" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root1"; path = "/nix/rootfs"; };
-                };
-                initrd.sshd.enable = true;
-                grub.installDevice = "efi";
-                nixpkgs.march = "silvermont";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "nas";
-                gui.preferred = false;
-              };
-              hardware = { cpus = [ "intel" ]; gpus = [ "intel" ]; };
-              packages.packageSet = "desktop";
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares = { home.path = "/home"; root.path = "/"; };
-                };
-                sshd = { enable = true; passwordAuthentication = true; };
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                xrdp = { enable = true; hostname = [ "nas.chn.moe" "office.chn.moe" ]; };
-                groupshare.enable = true;
-                smartd.enable = true;
-                beesd =
-                {
-                  enable = true;
-                  instances =
-                  {
-                    root = { device = "/"; hashTableSizeMB = 2048; };
-                    nix = { device = "/nix"; hashTableSizeMB = 128; };
-                  };
-                };
-                frpClient =
-                {
-                  enable = true;
-                  serverName = "frp.chn.moe";
-                  user = "nas";
-                  stcp.hpc = { localIp = "hpc.xmu.edu.cn"; localPort = 22; };
-                };
-                nginx = { enable = true; applications.webdav.instances."local.webdav.chn.moe" = {}; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
-                  wireguardIp = "192.168.83.4";
-                };
-              };
-              users.users = [ "chn" "xll" "zem" "yjq" "yxy" ];
-            };
-            yoga =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/86B8-CF80" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/e252f81d-b4b3-479f-8664-380a9b73cf83"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.auto."/dev/disk/by-uuid/8186d34e-005c-4461-94c7-1003a5bd86c0" =
-                    { mapper = "root"; ssd = true; };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                nixpkgs.march = "silvermont";
-                grub.installDevice = "efi";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "yoga";
-              };
-              hardware =
-              {
-                cpus = [ "intel" ];
-                gpus = [ "intel" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                halo-keyboard.enable = true;
-              };
-              packages.packageSet = "desktop-fat";
-              virtualization.docker.enable = true;
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                firewall.trustedInterfaces = [ "virbr0" ];
-              };
-              bugs = [ "xmunet" ];
-            };
-            xmupc1 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  swap = [ "/dev/mapper/swap" ];
-                  resume = "/dev/mapper/swap";
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "efi";
-                nixpkgs =
-                {
-                  march = "znver3";
-                  cuda =
-                  {
-                    enable = true;
-                    capabilities =
-                    [
-                      # 2080 Ti
-                      "7.5"
-                      # 3090
-                      "8.6"
-                      # 4090
-                      "8.9"
-                    ];
-                    forwardCompat = false;
-                  };
-                };
-                gui.preferred = false;
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "xmupc1";
-              };
-              hardware =
-              {
-                cpus = [ "amd" ];
-                gpus = [ "nvidia" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                gamemode.drmDevice = 1;
-              };
-              packages.packageSet = "workstation";
-              virtualization = { docker.enable = true; kvmHost = { enable = true; gui = true; }; };
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  private = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares =
-                  {
-                    media.path = "/run/media/chn";
-                    home.path = "/home/chn";
-                    mnt.path = "/mnt";
-                    share.path = "/home/chn/share";
-                  };
-                };
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
-                acme = { enable = true; cert."debug.mirism.one" = {}; };
-                smartd.enable = true;
-                beesd = { enable = true; instances.root = { device = "/nix/persistent"; hashTableSizeMB = 2048; }; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
-                  wireguardIp = "192.168.83.5";
-                };
-              };
-              bugs = [ "xmunet" "firefox" ];
-            };
-          };
-        in builtins.listToAttrs (builtins.map
-          (system:
-          {
-            name = system.name;
             value = inputs.nixpkgs.lib.nixosSystem
             {
               system = "x86_64-linux";
               specialArgs = { topInputs = inputs; inherit localLib; };
               modules = localLib.mkModules
               [
-                (inputs: { config.nixpkgs.overlays = [(final: prev:
-                  { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); })]; })
+                (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
+                  # replace pkgs with final to avoid infinite recursion
+                  { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
                 ./modules
-                { config.nixos = system.value; }
+                ./devices/${system}
               ];
             };
           })
-          (localLib.attrsToList system));
-      # sudo HTTPS_PROXY=socks5://127.0.0.1:10884 nixos-install --flake .#bootstrap --option substituters http://127.0.0.1:5000 --option require-sigs false --option system-features gccarch-silvermont
-      # nix-serve -p 5000
-      # nix copy --substitute-on-destination --to ssh://server /run/current-system
-      # nix copy --to ssh://nixos@192.168.122.56 ./result
-      # sudo nixos-install --flake .#bootstrap
-      #    --option substituters http://192.168.122.1:5000 --option require-sigs false
-      # sudo chattr -i var/empty
-      # nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
-      # sudo nixos-rebuild switch --flake .#vps6 --log-format internal-json -v |& nom --json
-      # boot.shell_on_fail systemd.setenv=SYSTEMD_SULOGIN_FORCE=1
-      # sudo usbipd
-      # ssh -R 3240:127.0.0.1:3240 root@192.168.122.57
-      # modprobe vhci-hcd
-      # sudo usbip bind -b 3-6
-      # usbip attach -r 127.0.0.1 -b 3-6
-      # systemd-cryptenroll --fido2-device=auto /dev/vda2
-      # systemd-cryptsetup attach root /dev/vda2
-      deploy =
-      {
-        sshUser = "root";
-        user = "root";
-        fastConnection = true;
-        autoRollback = false;
-        magicRollback = false;
-        nodes = builtins.listToAttrs (builtins.map
-          (node:
+          devices))
+        // {
+          pi3b = inputs.nixpkgs.lib.nixosSystem
           {
-            name = node;
-            value =
-            {
-              hostname = node;
-              profiles.system.path = inputs.self.nixosConfigurations.${node}.pkgs.deploy-rs.lib.activate.nixos
-                inputs.self.nixosConfigurations.${node};
-            };
-          })
-          [ "vps6" "vps7" "nas" "yoga" ]);
-      };
-      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks inputs.self.deploy) inputs.deploy-rs.lib;
+            system = "aarch64-linux";
+            specialArgs = { topInputs = inputs; inherit localLib; };
+            modules = localLib.mkModules
+            [
+              (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
+                # replace pkgs with final to avoid infinite recursion
+                { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
+              ./modules
+              ./devices/pi3b
+            ];
+          };
+        }
+      );
       overlays.default = final: prev:
-        { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); };
+        { localPackages = (import ./packages { inherit (inputs) lib; pkgs = final; topInputs = inputs; }); };
+      config = { archive = false; branch = "production"; };
+      devShells.x86_64-linux = let inherit (inputs.self.packages.x86_64-linux) pkgs; in
+      {
+        biu = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+        {
+          inputsFrom = [ pkgs.localPackages.biu ];
+          packages = [ pkgs.clang-tools_18 ];
+          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+        };
+        hpcstat = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+        {
+          inputsFrom = [ (inputs.self.packages.x86_64-linux.hpcstat.override { version = null; }) ];
+          packages = [ pkgs.clang-tools_18 ];
+          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+        };
+        sbatch-tui = pkgs.mkShell
+        {
+          inputsFrom = [ pkgs.localPackages.sbatch-tui ];
+          packages = [ pkgs.clang-tools_18 ];
+          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+        };
+        ufo = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+        {
+          inputsFrom = [ (inputs.self.packages.x86_64-linux.ufo.override { version = null; }) ];
+          packages = [ pkgs.clang-tools_18 ];
+          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+        };
+        chn-bsub = pkgs.mkShell
+        {
+          inputsFrom = [ pkgs.localPackages.chn-bsub ];
+          packages = [ pkgs.clang-tools_18 ];
+          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+        };
+        winjob =
+          let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
+          in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+          {
+            inputsFrom = [ winjob ];
+            packages = [ clang-tools_18 ];
+            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+          };
+      };
     };
 }

lib.nix

@@ -1,6 +1,6 @@
-lib:
+lib: rec
 {
-  attrsToList = Attrs: builtins.map ( name: { inherit name; value = Attrs.${name}; } ) ( builtins.attrNames Attrs );
+  attrsToList = attrs: builtins.map (name: { inherit name; value = attrs.${name}; }) (builtins.attrNames attrs);
   mkConditional = condition: trueResult: falseResult: let inherit (lib) mkMerge mkIf; in
     mkMerge [ ( mkIf condition trueResult ) ( mkIf (!condition) falseResult ) ];
 
@@ -12,9 +12,9 @@ lib:
   mkModules = moduleList:
     (builtins.map
       (
-        let handle = module:
-          if ( builtins.typeOf module ) == "path" then (handle (import module))
-          else if ( builtins.typeOf module ) == "lambda" then ({ pkgs, utils, ... }@inputs: (module inputs))
+        let handle = module: let type = builtins.typeOf module; in
+          if type == "path" || type == "string" then (handle (import module))
+          else if type == "lambda" then ({ pkgs, utils, ... }@inputs: (module inputs))
           else module;
         in handle
       )
@@ -37,4 +37,21 @@ lib:
   findIndex = e: list:
     let findIndex_ = i: list: if (builtins.elemAt list i) == e then i else findIndex_ (i + 1) list;
     in findIndex_ 0 list;
+
+  # return a list of path, including:
+  # - all .nix file in the directory except for default.nix
+  # - all directories containing a default.nix
+  findModules = path:
+    mkModules (builtins.filter (path: path != null) (builtins.map
+      (subPath:
+        if subPath.value == "regular" && subPath.name != "default.nix"
+          then if lib.strings.hasSuffix ".nix" subPath.name
+            then "${path}/${subPath.name}"
+            else null
+          else if subPath.value == "directory"
+            then if (builtins.readDir "${path}/${subPath.name}")."default.nix" or null == "regular"
+              then "${path}/${subPath.name}"
+            else null
+          else null)
+      (attrsToList (builtins.readDir path))));
 }

local/pkgs/biu/default.nix

@@ -1,17 +0,0 @@
-{
-  stdenv, fetchFromGitHub, cmake, pkg-config, ninja,
-  fmt, boost, magic-enum, libbacktrace, concurrencpp, tgbot-cpp, nameof, eigen, range-v3
-}: stdenv.mkDerivation rec
-{
-  name = "libbiu";
-  src = fetchFromGitHub
-  {
-    owner = "CHN-beta";
-    repo = "biu";
-    rev = "8ed2e52968f98d3a6ddbd01e86e57604ba3a7f54";
-    sha256 = "OqQ+QkjjIbpve/xn/DJA7ONw/bBg5zGNr+VJjc3o+K8=";
-  };
-  nativeBuildInputs = [ cmake pkg-config ninja ];
-  buildInputs = [ fmt boost magic-enum libbacktrace concurrencpp tgbot-cpp nameof eigen range-v3 ];
-  propagatedBuildInputs = buildInputs;
-}

local/pkgs/chromiumos-touch-keyboard/default.nix

@@ -1,18 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, cmake }: stdenv.mkDerivation rec
-{
-  pname = "chromiumos-touch-keyboard";
-  version = "1.4.1";
-  src = fetchFromGitHub
-  {
-    owner = "CHN-beta";
-    repo = "chromiumos_touch_keyboard";
-    rev = "32b72240ccac751a1b983152f65aa5b19503ffcf";
-    sha256 = "eFesDSBS2VzTOVfepgXYGynWvkrCSdCV9C/gcG/Ocbg=";
-  };
-  cmakeFlags = [ "-DCMAKE_CXX_FLAGS=-Wno-error=stringop-truncation" ];
-  nativeBuildInputs = [ cmake ];
-  postInstall =
-  ''
-    cp $out/etc/touch_keyboard/layouts/YB1-X9x-pc105.csv $out/etc/touch_keyboard/layout.csv
-  '';
-}

local/pkgs/citation-style-language/default.nix

@@ -1,30 +0,0 @@
-{ stdenvNoCC, texlive, fetchFromGitHub }: stdenvNoCC.mkDerivation (finalAttrs: rec
-{
-  pname = "citation-style-language";
-  version = "0.4.5";
-  passthru = {
-    pkgs = [ finalAttrs.finalPackage ];
-    tlDeps = with texlive; [ latex ];
-    tlType = "run";
-  };
-
-  src = fetchFromGitHub
-  {
-    owner = "zepinglee";
-    repo = "citeproc-lua";
-    rev = "v${version}";
-    sha256 = "XH+GH+t/10hr4bfaod8F9JPxmBnAQlDmpSvQNDQsslM=";
-    fetchSubmodules = true;
-  };
-
-  nativeBuildInputs = [ texlive.combined.scheme-full ];
-  dontConfigure = true;
-  dontBuild = true;
-  installPhase =
-  ''
-    runHook preInstall
-    export TEXMFHOME=$out
-    l3build install
-    runHook postInstall
-  '';
-})

local/pkgs/concurrencpp/default.nix

@@ -1,13 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation rec
-{
-  pname = "concurrencpp";
-  version = "0.1.7";
-  src = fetchFromGitHub
-  {
-    owner = "David-Haim";
-    repo = "concurrencpp";
-    rev = "v.${version}";
-    sha256 = "4qT29YVjKEWcMrI5R5Ps8aD4grAAgz5VOxANjpp1oTo=";
-  };
-  nativeBuildInputs = [ cmake ];
-}

local/pkgs/cppcoro/default.nix

@@ -1,13 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation
-{
-  name = "cppcoro";
-  src = fetchFromGitHub
-  {
-    owner = "Garcia6l20";
-    repo = "cppcoro";
-    rev = "e1d53e620b0eee828915ada179cd7ca8e66ca855";
-    sha256 = "luBkf1x5kqXaVbQM01yWRmA5QvrQNZkFVCjRctJdnXc=";
-  };
-  nativeBuildInputs = [ cmake ];
-  patches = [ ./cppcoro-include-utility.patch ];
-}

local/pkgs/date/default.nix

@@ -1,18 +0,0 @@
-{ stdenv, fetchFromGitHub }: stdenv.mkDerivation
-{
-  name = "date";
-  src = fetchFromGitHub
-  {
-    owner = "HowardHinnant";
-    repo = "date";
-    rev = "cc4685a21e4a4fdae707ad1233c61bbaff241f93";
-    sha256 = "KilhBEeLMvHtS76Gu0UhzE8lhS1+sCwQ1UL4pswKXTs=";
-  };
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r $src/{include,src} $out
-  '';
-}

local/pkgs/default.nix

@@ -1,48 +0,0 @@
-{ lib, pkgs }: with pkgs; rec
-{
-  typora = callPackage ./typora {};
-  vesta = callPackage ./vesta {};
-  oneapi = callPackage ./oneapi {};
-  rsshub = callPackage ./rsshub {};
-  misskey = callPackage ./misskey { nodejs = nodejs_21; };
-  mk-meili-mgn = callPackage ./mk-meili-mgn {};
-  # vasp = callPackage ./vasp
-  # {
-  #   stdenv = pkgs.lmix-pkgs.intel21Stdenv;
-  #   intel-mpi = pkgs.lmix-pkgs.intel-oneapi-mpi_2021_9_0;
-  #   ifort = pkgs.lmix-pkgs.intel-oneapi-ifort_2021_9_0;
-  # };
-  vasp = callPackage ./vasp
-  {
-    openmp = llvmPackages.openmp;
-    openmpi = pkgs.openmpi.override { cudaSupport = false; };
-  };
-  vaspkit = callPackage ./vaspkit { attrsToList = (import ../lib lib).attrsToList; };
-  v_sim = callPackage ./v_sim {};
-  concurrencpp = callPackage ./concurrencpp { stdenv = gcc13Stdenv; };
-  eigengdb = python3Packages.callPackage ./eigengdb {};
-  nodesoup = callPackage ./nodesoup {};
-  matplotplusplus = callPackage ./matplotplusplus { inherit nodesoup glad; };
-  zpp-bits = callPackage ./zpp-bits {};
-  eigen = callPackage ./eigen {};
-  nameof = callPackage ./nameof {};
-  pslist = callPackage ./pslist {};
-  glad = callPackage ./glad {};
-  chromiumos-touch-keyboard = callPackage ./chromiumos-touch-keyboard {};
-  yoga-support = callPackage ./yoga-support {};
-  tgbot-cpp = callPackage ./tgbot-cpp {};
-  biu = callPackage ./biu { inherit concurrencpp tgbot-cpp nameof; stdenv = gcc13Stdenv; };
-  citation-style-language = callPackage ./citation-style-language {};
-  mirism = callPackage ./mirism
-  {
-    inherit cppcoro nameof tgbot-cpp date;
-    nghttp2 = nghttp2-2305.override { enableAsioLib = true; };
-  };
-  cppcoro = callPackage ./cppcoro {};
-  date = callPackage ./date {};
-  esbonio = python3Packages.callPackage ./esbonio {};
-  pix2tex = python3Packages.callPackage ./pix2tex {};
-  pyreadline3 = python3Packages.callPackage ./pyreadline3 {};
-  torchdata = python3Packages.callPackage ./torchdata {};
-  torchtext = python3Packages.callPackage ./torchtext { inherit torchdata; };
-}

local/pkgs/eigen/default.nix

@@ -1,12 +0,0 @@
-{ lib, stdenv, fetchFromGitLab, cmake }: stdenv.mkDerivation rec
-{
-  name = "eigen";
-  src = fetchFromGitLab
-  {
-    owner = "libeigen";
-    repo = name;
-    rev = "6d829e766ff1b1ab867d93631163cbc63ed5798f";
-    sha256 = "BXUnizcRPrOyiPpoyYJ4VVOjlG49aj80mgzPKmEYPKU=";
-  };
-  nativeBuildInputs = [ cmake ];
-}

local/pkgs/hpcstat/doc/setup.md

@@ -0,0 +1 @@
+Moved to [../../../../packages/hpcstat/doc/setup.md](../../../../packages/hpcstat/doc/setup.md)

local/pkgs/matplotplusplus/default.nix

@@ -1,25 +0,0 @@
-{
-  stdenv, fetchFromGitHub, cmake, pkg-config, substituteAll,
-  gnuplot, libjpeg, libtiff, zlib, libpng, lapack, blas, fftw, opencv, nodesoup, cimg, glfw, libGL, python3, glad
-}: stdenv.mkDerivation
-{
-  pname = "matplotplusplus";
-  version = "1.2.0";
-  src = fetchFromGitHub
-  {
-    owner = "alandefreitas";
-    repo = "matplotplusplus";
-    rev = "a40344efa9dc5ea0c312e6e9ef4eb7238d98dc12";
-    sha256 = "6/dH/Rl2aAb8b+Ji5LwzkC+GWPOCBnYCrjy0qk8u/+I=";
-  };
-  cmakeFlags =
-  [
-    "-DBUILD_SHARED_LIBS=ON" "-DMATPLOTPP_BUILD_SHARED_LIBS=ON" "-DMATPLOTPP_BUILD_EXAMPLES=OFF"
-    "-DMATPLOTPP_WITH_SYSTEM_NODESOUP=ON" "-DMATPLOTPP_WITH_SYSTEM_CIMG=ON"
-    "-DMATPLOTPP_BUILD_EXPERIMENTAL_OPENGL_BACKEND=ON" "-DGLAD_REPRODUCIBLE=ON"
-  ];
-  buildInputs = [ gnuplot libjpeg libtiff zlib libpng lapack blas fftw opencv nodesoup cimg glfw libGL glad ];
-  nativeBuildInputs = [ cmake pkg-config python3 ];
-  propagatedBuildInputs = [ libGL glad glfw ];
-  propagatedNativeBuildInputs = [ python3 ];
-}

local/pkgs/misskey/default.nix

@@ -1,76 +0,0 @@
-{
-  lib, stdenv, mkPnpmPackage, fetchFromGitHub, fetchurl, nodejs, writeShellScript, buildFHSEnv,
-  bash, cypress, vips, pkg-config
-}:
-let
-  pname = "misskey";
-  version = "2023.12.2";
-  src = fetchFromGitHub
-  {
-    owner = "CHN-beta";
-    repo = "misskey";
-    rev = "cd1d0ab06eb6b7e06afdfae9a12b2d2829564229";
-    hash = "sha256-sKEZ1ZpyA/02CNwiOMIOS5f/csx6ELDwCVJYc+oMChM=";
-    fetchSubmodules = true;
-  };
-  originalPnpmPackage = mkPnpmPackage
-  {
-    inherit pname version src nodejs;
-    copyPnpmStore = true;
-  };
-  startScript = writeShellScript "misskey"
-  ''
-    export PATH=${lib.makeBinPath [ bash nodejs nodejs.pkgs.pnpm nodejs.pkgs.gulp cypress ]}:$PATH
-    export CYPRESS_RUN_BINARY="${cypress}/bin/Cypress"
-    export NODE_ENV=production
-    pnpm run migrateandstart
-  '';
-in
-  stdenv.mkDerivation rec
-  {
-    inherit version src pname;
-    buildInputs =
-    [
-      bash nodejs nodejs.pkgs.typescript nodejs.pkgs.pnpm nodejs.pkgs.gulp cypress vips pkg-config
-    ];
-    nativeBuildInputs = buildInputs;
-    CYPRESS_RUN_BINARY = "${cypress}/bin/Cypress";
-    NODE_ENV = "production";
-    configurePhase =
-    ''
-      export HOME=$NIX_BUILD_TOP # Some packages need a writable HOME
-      export npm_config_nodedir=${nodejs}
-
-      runHook preConfigure
-
-      store=$(pnpm store path)
-      mkdir -p $(dirname $store)
-
-      cp -f ${originalPnpmPackage.passthru.patchedLockfileYaml} pnpm-lock.yaml
-      cp -RL ${originalPnpmPackage.passthru.pnpmStore} $store
-      chmod -R +w $store
-      pnpm install --frozen-lockfile --offline
-
-      runHook postConfigure
-    '';
-    buildPhase =
-    ''
-      runHook preBuild
-      pnpm run build
-      runHook postBuild
-    '';
-    installPhase =
-    ''
-      runHook preInstall
-      mkdir -p $out
-      mv * .* $out
-      mkdir -p $out/bin
-      cp ${startScript} $out/bin/misskey
-      mkdir -p $out/files
-      runHook postInstall
-    '';
-    passthru =
-    {
-      inherit originalPnpmPackage startScript;
-    };
-  }

local/pkgs/nameof/default.nix

@@ -1,20 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }: stdenv.mkDerivation rec
-{
-  pname = "nameof";
-  version = "0.10.3";
-  src = fetchFromGitHub
-  {
-    owner = "Neargye";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "eHG0Y/BQGbwTrBHjq9SeSiIXaVqWp7PxIq7vCIECYPk=";
-  };
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r $src/include $out
-    runHook postInstall
-  '';
-}

local/pkgs/nodesoup/default.nix

@@ -1,13 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, cairo, pcre2, xorg }: stdenv.mkDerivation rec
-{
-  name = "nodesoup";
-  src = fetchFromGitHub
-  {
-    owner = "olvb";
-    repo = "nodesoup";
-    rev = "3158ad082bb0cd1abee75418b12b35522dbca74f";
-    sha256 = "tFLq6QC3U3uvcuWsdRy2wnwcmAfH2MkI2oMcAiUBHSo=";
-  };
-  buildInputs = [ cairo pcre2.dev xorg.libXdmcp.dev ];
-  nativeBuildInputs = [ cmake pkg-config ];
-}

local/pkgs/rsshub/default.nix

@@ -1,57 +0,0 @@
-{
-  lib, stdenv, mkPnpmPackage, fetchFromGitHub, nodejs, writeShellScript,
-  chromium, bash
-}:
-let
-  name = "rsshub";
-  src = fetchFromGitHub
-  {
-    owner = "DIYgod";
-    repo = "RSSHub";
-    rev = "38a5b0c193bf77d71c4eea33db6e76bc8b565d0b";
-    hash = "sha256-gJsT9W2fFiy2IG89E5th49DpBHsPMfsdONyzAKDG48c=";
-  };
-  originalPnpmPackage = mkPnpmPackage { inherit name src nodejs; };
-  nodeModules = originalPnpmPackage.nodeModules.overrideAttrs { PUPPETEER_SKIP_DOWNLOAD = true; };
-  rsshub-unwrapped = stdenv.mkDerivation
-  {
-    inherit src;
-    name = "${name}-unwrapped";
-    configurePhase = 
-    ''
-      export HOME=$NIX_BUILD_TOP # Some packages need a writable HOME
-      export npm_config_nodedir=${nodejs}
-
-      runHook preConfigure
-
-      ln -s ${nodeModules}/. node_modules
-
-      runHook postConfigure
-    '';
-    installPhase =
-    ''
-      runHook preInstall
-      mkdir -p $out
-      mv * .* $out
-      runHook postInstall
-    '';
-  };
-  startScript = writeShellScript "rsshub"
-  ''
-    cd ${rsshub-unwrapped}
-    export PATH=${lib.makeBinPath [ bash nodejs nodejs.pkgs.pnpm chromium ]}:$PATH
-    export CHROMIUM_EXECUTABLE_PATH=chromium
-    pnpm start
-  '';
-in stdenv.mkDerivation
-{
-  inherit name;
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    runHook preInstall
-    mkdir -p $out/bin
-    cp ${startScript} $out/bin/rsshub
-    runHook postInstall
-  '';
-}

local/pkgs/tgbot-cpp/default.nix

@@ -1,15 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, boost, openssl, zlib, curl }: stdenv.mkDerivation rec
-{
-  pname = "tgbot-cpp";
-  version = "1.7.2";
-  src = fetchFromGitHub
-  {
-    owner = "reo7sp";
-    repo = "tgbot-cpp";
-    rev = "v${version}";
-    sha256 = "TKirSxEUqFB1WtzNEfU4EJK3p7V5xcFIvA2+QVX7TlA=";
-  };
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ boost openssl zlib curl.dev ];
-  propagatedBuildInputs = buildInputs;
-}

local/pkgs/typora/default.nix

@@ -1,42 +0,0 @@
-{ lib, stdenv, steam-run, fetchurl, writeShellScript }:
-let
-  typora-dist = stdenv.mkDerivation rec
-  {
-    pname = "typora-dist";
-    version = "1.7.6";
-    src = fetchurl
-    {
-      url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
-      sha256 = "19xgv83zk3mhniswwrb341sr9j4sb9pqy47jamrmkc3w8famxpd3";
-    };
-
-    dontFixup = true;
-
-    unpackPhase =
-    ''
-      ar x ${src}
-      tar xf data.tar.xz
-    '';
-    installPhase =
-    ''
-      mkdir -p $out
-      mv usr/share $out
-    '';
-  };
-in stdenv.mkDerivation rec
-{
-  pname = "typora";
-  inherit (typora-dist) version;
-  BuildInputs = [ typora-dist steam-run ];
-  startScript = writeShellScript "typora" "${steam-run}/bin/steam-run ${typora-dist}/share/typora/Typora $@";
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    mkdir -p $out/bin $out/share/applications
-    ln -s ${startScript} $out/bin/typora
-    cp ${typora-dist}/share/applications/typora.desktop $out/share/applications
-    sed -i "s|Exec=.*|Exec=${startScript} %U|g" $out/share/applications/typora.desktop
-    sed -i "s|Icon=.*|Icon=${typora-dist}/share/icons/hicolor/256x256/apps/typora.png|g" \
-      $out/share/applications/typora.desktop
-  '';
-}

local/pkgs/vasp/default.nix

@@ -1,77 +0,0 @@
-# {
-#   stdenv, requireFile, config, rsync, intel-mpi, ifort,
-#   mkl
-# }:
-# stdenv.mkDerivation rec
-# {
-#   pname = "vasp";
-#   version = "6.4.0";
-#   # nix-store --query --hash $(nix store add-path ./vasp-6.4.0)
-#   src = requireFile
-#   {
-#     name = "${pname}-${version}";
-#     sha256 = "189i1l5q33ynmps93p2mwqf5fx7p4l50sls1krqlv8ls14s3m71f";
-#     hashMode = "recursive";
-#     message = "Source file not found.";
-#   };
-#   VASP_TARGET_CPU = if config ? oneapiArch then "-x${config.oneapiArch}" else "";
-#   MKLROOT = mkl;
-#   makeFlags = "DEPS=1";
-#   enableParallelBuilding = true;
-#   buildInputs = [ mkl intel-mpi ifort ];
-#   nativeBuildInputs = [ rsync ];
-#   configurePhase =
-#   ''
-#     cp arch/makefile.include.intel makefile.include
-#     echo "CPP_OPTIONS += -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj" >> makefile.include
-#     echo "OBJECTS_LIB += getshmem.o" >> makefile.include
-#     mkdir -p bin
-#   '';
-#   installPhase =
-#   ''
-#     mkdir -p $out/bin
-#     for i in std gam ncl; do
-#       cp bin/vasp_$i $out/bin/vasp-cpu-${version}-$i
-#     done
-#   '';
-#   doStrip = false;
-#   doFixup = false;
-# }
-{
-  stdenvNoCC, requireFile, rsync, blas, scalapack, openmpi, openmp, gfortran, gcc, fftwMpi
-}:
-stdenvNoCC.mkDerivation rec
-{
-  pname = "vasp";
-  version = "6.4.0";
-  # nix-store --query --hash $(nix store add-path ./vasp-6.4.0)
-  src = requireFile
-  {
-    name = "${pname}-${version}";
-    sha256 = "189i1l5q33ynmps93p2mwqf5fx7p4l50sls1krqlv8ls14s3m71f";
-    hashMode = "recursive";
-    message = "Source file not found.";
-  };
-  # VASP_TARGET_CPU = if config ? oneapiArch then "-x${config.oneapiArch}" else "";
-  # MKLROOT = mkl;
-  makeFlags = "DEPS=1";
-  enableParallelBuilding = true;
-  buildInputs = [ blas scalapack openmpi openmp gfortran gfortran.cc gcc fftwMpi.dev fftwMpi ];
-  nativeBuildInputs = [ rsync ];
-  FFTW_ROOT = fftwMpi.dev;
-  configurePhase =
-  ''
-    cp ${./makefile.include/${version}-gnu} makefile.include
-    chmod +w makefile.include
-    echo "CPP_OPTIONS += -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj" >> makefile.include
-    echo "OBJECTS_LIB += getshmem.o" >> makefile.include
-    mkdir -p bin
-  '';
-  installPhase =
-  ''
-    mkdir -p $out/bin
-    for i in std gam ncl; do
-      cp bin/vasp_$i $out/bin/vasp-gnu-${version}-$i
-    done
-  '';
-}

local/pkgs/zpp-bits/default.nix

@@ -1,18 +0,0 @@
-{ stdenv, fetchFromGitHub }: stdenv.mkDerivation rec
-{
-  pname = "zpp-bits";
-  version = "4.4.19";
-  src = fetchFromGitHub
-  {
-    owner = "eyalz800";
-    repo = "zpp_bits";
-    rev = "v${version}";
-    sha256 = "ejIwrvCFALuBQbQhTfzjBb11oMR/akKnboB60GWbjlQ=";
-  };
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    mkdir -p $out/include
-    cp $src/zpp_bits.h $out/include
-  '';
-}

modules/bugs/default.nix

@@ -11,47 +11,6 @@ inputs:
         SuspendState=freeze
         HibernateMode=shutdown
       '';
-      # reload iwlwifi after resume from hibernate
-      hibernate-iwlwifi =
-      {
-        systemd.services.reload-iwlwifi-after-hibernate =
-        {
-          description = "reload iwlwifi after resume from hibernate";
-          after = [ "systemd-hibernate.service" ];
-          serviceConfig.Type = "oneshot";
-          script = let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in
-          ''
-            ${modprobe} -r iwlwifi
-            ${modprobe} iwlwifi
-            echo 0 > /sys/devices/system/cpu/intel_pstate/no_turbo
-          '';
-          wantedBy = [ "systemd-hibernate.service" ];
-        };
-        nixos.system.kernel.modules.modprobeConfig =
-          [ "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
-      };
-      # disable wakeup on lid open
-      suspend-lid-no-wakeup.systemd.services.lid-no-wakeup =
-      {
-        description = "lid no wake up";
-        serviceConfig.Type = "oneshot";
-        script =
-          let
-            cat = "${inputs.pkgs.coreutils}/bin/cat";
-            grep = "${inputs.pkgs.gnugrep}/bin/grep";
-          in
-          ''
-            if ${cat} /proc/acpi/wakeup | ${grep} LID0 | ${grep} -q enabled
-            then
-              echo LID0 > /proc/acpi/wakeup
-            fi
-            if ${cat} /proc/acpi/wakeup | ${grep} XHCI | ${grep} -q enabled
-            then
-              echo XHCI > /proc/acpi/wakeup
-            fi
-          '';
-        wantedBy = [ "multi-user.target" ];
-      };
       # xmunet use old encryption
       xmunet.nixpkgs.config.packageOverrides = pkgs: { wpa_supplicant = pkgs.wpa_supplicant.overrideAttrs
         (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
@@ -77,8 +36,10 @@ inputs:
             script = "${systemctl} start waydroid-container";
           };
         };
-      firefox.programs.firefox.enable = inputs.lib.mkForce false;
-      power.boot.kernelParams = [ "cpufreq.default_governor=powersave" ];
+      backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
+      amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
+      hibernate-mt7921e.powerManagement.resumeCommands =
+        let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in "${modprobe} -r -w 3000 mt7921e && ${modprobe} mt7921e";
     };
   in
     {

modules/default.nix

@@ -10,9 +10,12 @@ inputs:
       topInputs.sops-nix.nixosModules.sops
       topInputs.aagl.nixosModules.default
       topInputs.nix-index-database.nixosModules.nix-index
-      topInputs.nur.nixosModules.nur
       topInputs.nur-xddxdd.nixosModules.setupOverlay
       topInputs.impermanence.nixosModules.impermanence
+      topInputs.nix-flatpak.nixosModules.nix-flatpak
+      topInputs.chaotic.nixosModules.default
+      { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
+      topInputs.catppuccin.nixosModules.catppuccin
       (inputs:
       {
         config =
@@ -20,31 +23,24 @@ inputs:
           nixpkgs.overlays =
           [
             topInputs.qchem.overlays.default
-            topInputs.nixd.overlays.default
-            topInputs.nix-alien.overlays.default
-            topInputs.napalm.overlays.default
-            topInputs.pnpm2nix-nzbr.overlays.default
-            topInputs.lmix.overlays.default
             topInputs.aagl.overlays.default
-            (import "${topInputs.dguibert-nur-packages}/overlays/nvhpc-overlay")
+            topInputs.bscpkgs.overlays.default
             (final: prev:
             {
               nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
               nur-xddxdd = topInputs.nur-xddxdd.overlays.default final prev;
-              deploy-rs =
-                { inherit (prev) deploy-rs; inherit ((topInputs.deploy-rs.overlay final prev).deploy-rs) lib; };
-              # needed by mirism
-              nghttp2-2305 =
-                inputs.pkgs.callPackage "${inputs.topInputs.nixpkgs-2305}/pkgs/development/libraries/nghttp2" {};
+              nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
+              firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
+              inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
             })
           ];
           home-manager.sharedModules =
           [
             topInputs.plasma-manager.homeManagerModules.plasma-manager
-            topInputs.nix-doom-emacs.hmModule
+            topInputs.catppuccin.homeManagerModules.catppuccin
           ];
         };
       })
-      ./hardware ./packages ./system ./virtualization ./services ./bugs ./users
+      ./hardware ./packages ./system ./virtualization ./services ./bugs ./user
     ];
   }

modules/hardware/cpus.nix

@@ -0,0 +1,26 @@
+inputs:
+{
+  options.nixos.hardware.cpus = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
+  config = let inherit (inputs.config.nixos.hardware) cpus; in inputs.lib.mkIf (cpus != [])
+  {
+    hardware.cpu = builtins.listToAttrs
+      (builtins.map (name: { inherit name; value = { updateMicrocode = true; }; }) cpus);
+    boot =
+    {
+      initrd.availableKernelModules =
+        let modules =
+        {
+          intel =
+          [
+            "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp"
+          ];
+          amd = [];
+        };
+        in builtins.concatLists (builtins.map (cpu: modules.${cpu}) cpus);
+    };
+    environment.systemPackages =
+      let packages = with inputs.pkgs; { intel = []; amd = [ zenmonitor ]; };
+      in builtins.concatLists (builtins.map (cpu: packages.${cpu}) cpus);
+  };
+}

modules/hardware/default.nix

@@ -1,220 +1,46 @@
 inputs:
 {
-  options.nixos.hardware = let inherit (inputs.lib) mkOption types; in
-  {
-    bluetooth.enable = mkOption { type = types.bool; default = false; };
-    joystick.enable = mkOption { type = types.bool; default = false; };
-    printer.enable = mkOption { type = types.bool; default = false; };
-    sound.enable = mkOption { type = types.bool; default = false; };
-    cpus = mkOption { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
-    gpus = mkOption { type = types.listOf (types.enum [ "intel" "nvidia" "amd" ]); default = []; };
-    prime =
-    {
-      enable = mkOption { type = types.bool; default = false; };
-      mode = mkOption { type = types.enum [ "offload" "sync" ]; default = "offload"; };
-      busId = mkOption { type = types.attrsOf types.str; default = {}; };
-    };
-    gamemode.drmDevice = mkOption { type = types.int; default = 0; };
-    halo-keyboard.enable = mkOption { type = types.bool; default = false; };
-  };
-  config =
+  imports = inputs.localLib.findModules ./.;
+  options.nixos.hardware =
     let
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (inputs.config.nixos) hardware;
-      inherit (builtins) listToAttrs map concatLists;
-      inherit (inputs.localLib) attrsToList;
-    in mkMerge
-    [
-      # bluetooth
-      (mkIf hardware.bluetooth.enable { hardware.bluetooth.enable = true; })
-      # joystick
-      (mkIf hardware.joystick.enable { hardware = { xone.enable = true; xpadneo.enable = true; }; })
-      # printer
-      (
-        mkIf hardware.printer.enable
+      inherit (inputs.lib) mkOption types;
+      default = if inputs.config.nixos.system.gui.enable then {} else null;
+    in
+    {
+      bluetooth = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
+      joystick = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
+      printer = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
+      sound = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
+    };
+  config = let inherit (inputs.config.nixos) hardware; in inputs.lib.mkMerge
+  [
+    # bluetooth
+    (inputs.lib.mkIf (hardware.bluetooth != null) { hardware.bluetooth.enable = true; })
+    # joystick
+    (inputs.lib.mkIf (hardware.joystick != null) { hardware = { xone.enable = true; xpadneo.enable = true; }; })
+    # printer
+    (
+      inputs.lib.mkIf (hardware.printer != null)
+      {
+        services =
         {
-          services =
+          printing =
           {
-            printing = { enable = true; drivers = [ inputs.pkgs.cnijfilter2 ]; };
-            avahi = { enable = true; nssmdns = true; openFirewall = true; };
+            enable = true;
+            drivers = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") [ inputs.pkgs.cnijfilter2 ];
           };
-        }
-      )
-      # sound
-      (
-        mkIf hardware.sound.enable
-        {
-          hardware.pulseaudio.enable = false;
-          services.pipewire = { enable = true; alsa = { enable = true; support32Bit = true; }; pulse.enable = true; };
-          sound.enable = true;
-          security.rtkit.enable = true;
-          environment.etc."wireplumber/main.lua.d/50-alsa-config.lua".text =
-            let
-              content = builtins.readFile
-                (inputs.pkgs.wireplumber + "/share/wireplumber/main.lua.d/50-alsa-config.lua");
-              matched = builtins.match
-                ".*\n([[:space:]]*)(--\\[\"session\\.suspend-timeout-seconds\"][^\n]*)[\n].*" content;
-              spaces = builtins.elemAt matched 0;
-              comment = builtins.elemAt matched 1;
-              config = ''["session.suspend-timeout-seconds"] = 0'';
-            in
-              builtins.replaceStrings [(spaces + comment)] [(spaces + config)] content;
-        }
-      )
-      # cpus
-      (
-        mkIf (hardware.cpus != [])
-        {
-          hardware.cpu = listToAttrs
-            (map (name: { inherit name; value = { updateMicrocode = true; }; }) hardware.cpus);
-          boot.initrd.availableKernelModules =
-            let
-              modules =
-              {
-                intel =
-                [
-                  "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp"
-                ];
-                amd = [];
-              };
-            in
-              concatLists (map (cpu: modules.${cpu}) hardware.cpus);
-        }
-      )
-      # gpus
-      (
-        mkIf (hardware.gpus != [])
-        {
-          boot.initrd.availableKernelModules =
-            let
-              modules =
-              {
-                intel = [ "i915" ];
-                nvidia = [ "nvidia" "nvidia_drm" "nvidia_modeset" "nvidia_uvm" ];
-                amd = [ "amdgpu" ];
-              };
-            in
-              concatLists (map (gpu: modules.${gpu}) hardware.gpus);
-          hardware =
-          {
-            opengl =
-            {
-              enable = true;
-              driSupport = true;
-              extraPackages =
-                with inputs.pkgs;
-                let
-                  packages =
-                  {
-                    intel = [ intel-compute-runtime intel-media-driver libvdpau-va-gl ]; # intel-vaapi-driver
-                    nvidia = [ vaapiVdpau ];
-                    amd = [];
-                  };
-                in
-                  concatLists (map (gpu: packages.${gpu}) hardware.gpus);
-              driSupport32Bit = true;
-            };
-            nvidia.nvidiaSettings = builtins.elem "nvidia" hardware.gpus;
-          };
-        }
-      )
-      (mkIf (builtins.elem "intel" hardware.gpus) { services.xserver.deviceSection = ''Driver "modesetting"''; })
-      # prime
-      (
-        mkIf hardware.prime.enable
-        {
-          hardware.nvidia = mkMerge
-          [
-            (
-              mkIf (hardware.prime.mode == "offload")
-              {
-                prime.offload = { enable = true; enableOffloadCmd = true; };
-                powerManagement = { finegrained = true; enable = true; };
-              }
-            )
-            (
-              mkIf (hardware.prime.mode == "sync")
-              {
-                prime = { sync.enable = true; };
-                # prime.forceFullCompositionPipeline = true;
-              }
-            )
-            {
-              prime = listToAttrs
-                (map (gpu: { inherit (gpu) value; name = "${gpu.name}BusId"; }) (attrsToList hardware.prime.busId));
-            }
-            
-          ];
-        }
-      )
-      { programs.gamemode.settings.gpu.gpu_device = "${toString hardware.gamemode.drmDevice}"; }
-      # halo-keyboard
-      (mkIf hardware.halo-keyboard.enable
-      (
-        let
-          keyboard = inputs.pkgs.localPackages.chromiumos-touch-keyboard;
-          support = inputs.pkgs.localPackages.yoga-support;
-        in
-        {
-          services.udev.packages = [ keyboard support ];
-          systemd.services =
-          {
-            touch-keyboard-handler.serviceConfig =
-            {
-              Type = "simple";
-              WorkingDirectory = "/etc/touch_keyboard";
-              ExecStart = "${keyboard}/bin/touch_keyboard_handler";
-            };
-            yogabook-modes-handler.serviceConfig =
-            {
-              Type = "simple";
-              ExecStart = "${support}/bin/yogabook-modes-handler";
-              StandardOutput = "journal";
-            };
-            monitor-sensor =
-            {
-              wantedBy = [ "default.target" ];
-              serviceConfig =
-              {
-                Type = "simple";
-                ExecStart = "${inputs.pkgs.iio-sensor-proxy}/bin/monitor-sensor --hinge";
-              };
-            };
-          };
-          environment.etc."touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
-          boot.initrd =
-          {
-            services.udev.packages = [ keyboard support ];
-            systemd =
-            {
-              extraBin =
-              {
-                touch_keyboard_handler = "${keyboard}/bin/touch_keyboard_handler";
-                yogabook-modes-handler = "${support}/bin/yogabook-modes-handler";
-              };
-              services =
-              {
-                touch-keyboard-handler =
-                {
-                  serviceConfig =
-                  {
-                    Type = "simple";
-                    WorkingDirectory = "/etc/touch_keyboard";
-                    ExecStart = "${keyboard}/bin/touch_keyboard_handler";
-                  };
-                };
-                yogabook-modes-handler.serviceConfig =
-                {
-                  Type = "simple";
-                  ExecStart = "${support}/bin/yogabook-modes-handler";
-                  StandardOutput = "journal";
-                };
-              };
-
-            };
-            extraFiles."/etc/touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
-          };
-        }
-      ))
-    ];
+          avahi = { enable = true; nssmdns4 = true; openFirewall = true; };
+        };
+      }
+    )
+    # sound
+    (
+      inputs.lib.mkIf (hardware.sound != null)
+      {
+        hardware.pulseaudio.enable = false;
+        services.pipewire = { enable = true; alsa = { enable = true; support32Bit = true; }; pulse.enable = true; };
+        security.rtkit.enable = true;
+      }
+    )
+  ];
 }

modules/hardware/gpu.nix

@@ -0,0 +1,110 @@
+inputs:
+{
+  options.nixos.hardware.gpu = let inherit (inputs.lib) mkOption types; in
+  {
+    type = mkOption
+    {
+      type = types.nullOr (types.enum
+      [
+        # single gpu
+        "intel" "nvidia" "amd"
+        # hibrid gpu: use nvidia prime offload mode
+        "intel+nvidia" "amd+nvidia"
+      ]);
+      default = null;
+    };
+    nvidia =
+    {
+      dynamicBoost = mkOption { type = types.bool; default = false; };
+      prime =
+      {
+        mode = mkOption { type = types.enum [ "offload" "sync" ]; default = "offload"; };
+        busId = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
+      };
+      driver = mkOption { type = types.enum [ "production" "latest" "beta" ]; default = "production"; };
+    };
+  };
+  config = let inherit (inputs.config.nixos.hardware) gpu; in inputs.lib.mkIf (gpu.type != null) (inputs.lib.mkMerge
+  [
+    # generic settings
+    (
+      let gpus = inputs.lib.strings.splitString "+" gpu.type; in
+      {
+        boot.initrd.availableKernelModules =
+          let modules =
+          {
+            intel = [ "i915" ];
+            nvidia = []; # early loading breaks resume from hibernation
+            amd = [];
+          };
+          in builtins.concatLists (builtins.map (gpu: modules.${gpu}) gpus);
+        hardware =
+        {
+          graphics =
+          {
+            enable = true;
+            extraPackages =
+              let packages = with inputs.pkgs;
+              {
+                intel = [ intel-vaapi-driver libvdpau-va-gl intel-media-driver ];
+                nvidia = [ vaapiVdpau ];
+                amd = [];
+              };
+              in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
+          };
+          nvidia = inputs.lib.mkIf (builtins.elem "nvidia" gpus)
+          {
+            modesetting.enable = true;
+            powerManagement.enable = true;
+            dynamicBoost.enable = inputs.lib.mkIf gpu.nvidia.dynamicBoost true;
+            nvidiaSettings = true;
+            package = inputs.config.boot.kernelPackages.nvidiaPackages.${gpu.nvidia.driver};
+            open = true; # TODO: remove when 560 is stable
+            prime.allowExternalGpu = true;
+          };
+        };
+        boot.blacklistedKernelModules = [ "nouveau" ];
+        environment.variables =
+          if builtins.elem "nvidia" gpus then { VDPAU_DRIVER = "nvidia"; }
+          else if builtins.elem "intel" gpus then { VDPAU_DRIVER = "va_gl"; }
+          else {};
+        services.xserver.videoDrivers =
+          let driver = { intel = "modesetting"; amd = "amdgpu"; nvidia = "nvidia"; };
+          in builtins.map (gpu: driver.${gpu}) gpus;
+        nixos.packages.packages._packages =
+          let packages = with inputs.pkgs;
+          {
+            intel = [ intel-gpu-tools ];
+            nvidia = [ nvtopPackages.full ];
+            amd = [];
+          };
+          in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
+      }
+    )
+    # nvidia prime offload
+    (
+      inputs.lib.mkIf (inputs.lib.strings.hasSuffix "+nvidia" gpu.type) { hardware.nvidia =
+      {
+        prime =
+        {
+          offload = inputs.lib.mkIf (gpu.nvidia.prime.mode == "offload") { enable = true; enableOffloadCmd = true; };
+          sync = inputs.lib.mkIf (gpu.nvidia.prime.mode == "sync") { enable = true; };
+        }
+        // builtins.listToAttrs (builtins.map
+          (gpu: { name = "${if gpu.name == "amd" then "amdgpu" else gpu.name}BusId"; value = "PCI:${gpu.value}"; })
+          (inputs.localLib.attrsToList gpu.nvidia.prime.busId));
+        powerManagement.finegrained = inputs.lib.mkIf (gpu.nvidia.prime.mode == "offload") true;
+      };}
+    )
+    # amdgpu
+    (
+      inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
+      {
+        opencl.enable = true;
+        legacySupport.enable = true;
+        initrd.enable = true;
+        amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
+      };}
+    )
+  ]);
+}

modules/hardware/legion.nix

@@ -0,0 +1,10 @@
+inputs:
+{
+  options.nixos.hardware.legion = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.hardware) legion; in inputs.lib.mkIf (legion != null)
+  {
+    environment.systemPackages = [ inputs.pkgs.lenovo-legion ];
+    boot.extraModulePackages = [ inputs.config.boot.kernelPackages.lenovo-legion-module ];
+  };
+}

modules/packages/chromium.nix

@@ -0,0 +1,12 @@
+inputs:
+{
+  options.nixos.packages.chromium = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) chromium; in inputs.lib.mkIf (chromium != null)
+  {
+    programs.chromium = { enable = true; extraOpts.PasswordManagerEnabled = false; };
+  };
+}

modules/packages/default.nix

@@ -1,72 +1,44 @@
 inputs:
 {
-  imports = inputs.localLib.mkModules
-  [
-    ./server
-    ./desktop
-    ./desktop-fat
-    ./workstation
-  ];
-  options.nixos.packages =
-    let
-      inherit (inputs.lib) mkOption types;
-      packageSets =
-      [
-        # no gui, only used for specific purpose
-        "server"
-        # gui, for daily use, but not install large programs such as matlab
-        "desktop"
-        "desktop-fat"
-        # nearly everything
-        "workstation"
-      ];
-    in
-    {
-      packageSet = mkOption { type = types.enum packageSets; default = "server"; };
-      extraPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      excludePackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      extraPythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      excludePythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      extraPrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      excludePrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      _packageSets = mkOption
-      {
-        type = types.listOf types.nonEmptyStr;
-        readOnly = true;
-        default = builtins.genList (i: builtins.elemAt packageSets i)
-          ((inputs.localLib.findIndex inputs.config.nixos.packages.packageSet packageSets) + 1);
-      };
-      _packages = mkOption { type = types.listOf types.unspecified; default = []; };
-      _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-      _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    };
+  imports = inputs.localLib.findModules ./.;
+  options.nixos.packages.packages = let inherit (inputs.lib) mkOption types; in
+  {
+    extraPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    excludePackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    extraPythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    excludePythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    extraPrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    excludePrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _packages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+  };
   config =
-    let
-      inherit (builtins) concatLists map;
-    in
-    {
-      environment.systemPackages = let inherit (inputs.lib.lists) subtractLists; in with inputs.config.nixos.packages;
-        (subtractLists excludePackages (_packages ++ extraPackages))
-        ++ [
-          (inputs.pkgs.python3.withPackages (pythonPackages:
-            subtractLists
-              (concatLists (map (packageFunction: packageFunction pythonPackages) excludePythonPackages))
-              (concatLists (map (packageFunction: packageFunction pythonPackages)
-                (_pythonPackages ++ extraPythonPackages)))))
-          (inputs.pkgs.callPackage ({ stdenv }: stdenv.mkDerivation
-          {
-            name = "prebuild-packages";
-            propagateBuildInputs = subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages);
-            phases = [ "installPhase" ];
-            installPhase =
-            ''
-              runHook preInstall
-              mkdir -p $out
-              runHook postInstall
-            '';
-          }) {})
-        ];
-    };
+  {
+    environment.systemPackages = with inputs.config.nixos.packages.packages;
+      (inputs.lib.lists.subtractLists excludePackages (_packages ++ extraPackages))
+      ++ [
+        (inputs.pkgs.python3.withPackages (pythonPackages:
+          inputs.lib.lists.subtractLists
+            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+              excludePythonPackages))
+            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+              (_pythonPackages ++ extraPythonPackages)))))
+        (inputs.pkgs.callPackage ({ stdenv }: stdenv.mkDerivation
+        {
+          name = "prebuild-packages";
+          propagateBuildInputs = inputs.lib.lists.subtractLists excludePrebuildPackages
+            (_prebuildPackages ++ extraPrebuildPackages);
+          phases = [ "installPhase" ];
+          installPhase =
+          ''
+            runHook preInstall
+            mkdir -p $out
+            runHook postInstall
+          '';
+        }) {})
+      ];
+  };
 }
 
     # programs.firejail =

modules/packages/desktop-fat/chromium.nix

@@ -1,39 +0,0 @@
-inputs:
-{
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
-    {
-      nixos.users.sharedModules =
-      [{
-        config.programs.chromium =
-        {
-          enable = true;
-          extensions =
-          [
-            { id = "mpkodccbngfoacfalldjimigbofkhgjn"; } # Aria2 Explorer
-            { id = "nngceckbapebfimnlniiiahkandclblb"; } # Bitwarden
-            { id = "kbfnbcaeplbcioakkpcpgfkobkghlhen"; } # Grammarly
-            { id = "ihnfpdchjnmlehnoeffgcbakfmdjcckn"; } # Pixiv Fanbox Downloader
-            { id = "cimiefiiaegbelhefglklhhakcgmhkai"; } # Plasma Integration
-            { id = "dkndmhgdcmjdmkdonmbgjpijejdcilfh"; } # Powerful Pixiv Downloader
-            { id = "padekgcemlokbadohgkifijomclgjgif"; } # Proxy SwitchyOmega
-            { id = "kefjpfngnndepjbopdmoebkipbgkggaa"; } # RSSHub Radar
-            { id = "abpdnfjocnmdomablahdcfnoggeeiedb"; } # Save All Resources
-            { id = "nbokbjkabcmbfdlbddjidfmibcpneigj"; } # SmoothScroll
-            { id = "onepmapfbjohnegdmfhndpefjkppbjkm"; } # SuperCopy 超级复制
-            { id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; } # uBlock Origin
-            { id = "gppongmhjkpfnbhagpmjfkannfbllamg"; } # Wappalyzer
-            { id = "hkbdddpiemdeibjoknnofflfgbgnebcm"; } # YouTube™ 双字幕
-            { id = "ekhagklcjbdpajgpjgmbionohlpdbjgc"; } # Zotero Connector
-            { id = "ikhdkkncnoglghljlkmcimlnlhkeamad"; } # 划词翻译
-            { id = "dhdgffkkebhmkfjojejmpbldmpobfkfo"; } # 篡改猴
-            { id = "hipekcciheckooncpjeljhnekcoolahp"; } # Tabliss
-            { id = "nkbihfbeogaeaoehlefnkodbefgpgknn"; } # MetaMask
-            { id = "bpoadfkcbjbfhfodiogcnhhhpibjhbnh"; } # 沉浸式翻译
-          ];
-        };
-      }];
-    };
-}

modules/packages/desktop-fat/default.nix

@@ -1,48 +0,0 @@
-inputs:
-{
-  imports = inputs.localLib.mkModules
-  [
-    ./chromium.nix
-    ./steam.nix
-  ];
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
-    {
-      nixos =
-      {
-        packages = with inputs.pkgs;
-        {
-          _packages =
-          [
-            # system management
-            etcher btrfs-assistant snapper-gui libsForQt5.qtstyleplugin-kvantum
-            # password and key management
-            yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden
-            # download
-            qbittorrent nur-xddxdd.baidupcs-go wgetpaste
-            # development
-            scrcpy weston cage openbox krita
-            # media
-            spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc
-            # editor
-            localPackages.typora
-            # themes
-            orchis-theme plasma-overdose-kde-theme materia-kde-theme graphite-kde-theme arc-kde-theme materia-theme
-            # news
-            fluent-reader
-            # nix tools
-            deploy-rs.deploy-rs nixpkgs-fmt
-            # instant messager
-            element-desktop telegram-desktop discord fluffychat
-            # browser
-            google-chrome
-            # office
-            crow-translate zotero pandoc ydict
-          ] ++ (with inputs.lib; filter isDerivation (attrValues plasma5Packages.kdeGear));
-        };
-      };
-      programs.kdeconnect.enable = true;
-    };
-}

modules/packages/desktop-fat/steam.nix

@@ -1,23 +0,0 @@
-inputs:
-{
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
-    {
-      programs.steam =
-      {
-        enable = true;
-        package = inputs.pkgs.steam.override (prev:
-        {
-          steam = prev.steam.overrideAttrs (prev:
-          {
-            postInstall = prev.postInstall +
-            ''
-              sed -i 's#Comment\[zh_CN\]=.*$#Comment\[zh_CN\]=思题慕®学习平台#' $out/share/applications/steam.desktop
-            '';
-          });
-        });
-      };
-    };
-}

modules/packages/desktop/default.nix

@@ -1,55 +1,141 @@
 inputs:
 {
-  imports = inputs.localLib.mkModules [ ./vscode.nix ];
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "desktop" inputs.config.nixos.packages._packageSets)
+  options.nixos.packages.desktop = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) desktop; in inputs.lib.mkIf (desktop != null)
+  {
+    nixos =
     {
-      nixos =
+      packages.packages =
       {
-        packages._packages = with inputs.pkgs;
+        _packages = with inputs.pkgs;
         [
           # system management
-          gparted wl-clipboard-x11 kio-fuse
-          wayland-utils clinfo glxinfo vulkan-tools dracut
+          # TODO: module should add yubikey-touch-detector into path
+          gparted wayland-utils clinfo glxinfo vulkan-tools dracut yubikey-touch-detector btrfs-assistant snapper-gui
+          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x inputs.pkgs."pkgs-23.11".etcher wl-mirror
+          (
+            writeShellScriptBin "xclip"
+            ''
+              #!${bash}/bin/bash
+              if [ "$XDG_SESSION_TYPE" = "x11" ]; then
+                exec ${xclip}/bin/xclip -sel clip "$@"
+              else
+                exec ${wl-clipboard-x11}/bin/xclip "$@"
+              fi
+            ''
+          )
+          # color management
+          argyllcms xcalib
           # networking
           remmina putty mtr-gui
           # media
-          mpv nomacs
+          mpv nomacs spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc obs-studio
+          waifu2x-converter-cpp inkscape blender whalebird paraview
           # themes
-          tela-circle-icon-theme
-          firefoxpwa
-        ];
-        users.sharedModules =
-        [{
-          config.home.file.".config/baloofilerc".text =
-          ''
-            [Basic Settings]
-            Indexing-Enabled=false
-          '';
-        }];
+          catppuccin catppuccin-sddm catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
+          (catppuccin-kde.override { flavour = [ "latte" ]; }) (catppuccin-kvantum.override { variant = "latte"; })
+          localPackages.slate localPackages.blurred-wallpaper tela-circle-icon-theme
+          # terminal
+          warp-terminal
+          # development
+          adb-sync scrcpy weston cage openbox krita jetbrains.clion android-studio dbeaver-bin cling fprettify
+          aircrack-ng
+          # desktop sharing
+          rustdesk-flutter
+          # password and key management
+          yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden electrum
+          jabref
+          john crunch hashcat
+          # download
+          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
+          # editor
+          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+          # news
+          fluent-reader rssguard newsflash newsboat
+          # nix tools
+          nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
+          nix-template nil pnpm-lock-export bundix
+          # instant messager
+          element-desktop telegram-desktop discord fluffychat zoom-us signal-desktop slack nur-linyinfeng.wemeet
+          cinny-desktop nheko # qq nur-xddxdd.wechat-uos
+          # browser
+          google-chrome tor-browser microsoft-edge
+          # office
+          crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
+          davinci-resolve
+          texliveFull
+          # math, physics and chemistry
+          octaveFull root ovito localPackages.vesta localPackages.vaspkit localPackages.v-sim
+          (mathematica.overrideAttrs (prev: { postInstall = prev.postInstall or "" + "ln -s ${src} $out/src"; }))
+          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; }) jmol mpi
+          # virtualization
+          # TODO: broken on python 3.12: playonlinux
+          wineWowPackages.stagingFull virt-viewer bottles genymotion
+          # media
+          nur-xddxdd.svp
+        ]
+          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
+            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
+          # TODO: fix it
+          # ++ inputs.lib.optional (inputs.config.nixos.system.nixpkgs.march != null) localPackages.mumax;
+        _pythonPackages = [(pythonPackages: with pythonPackages;
+        [
+          phonopy scipy scikit-learn jupyterlab autograd # localPackages.pix2tex
+          # TODO: broken on python 3.12: tensorflow keras
+        ])];
       };
-      programs =
-      {
-        adb.enable = true;
-        wireshark = { enable = true; package = inputs.pkgs.wireshark; };
-        firefox =
+      user.sharedModules =
+      [{
+        config.programs =
         {
-          enable = true;
-          languagePacks = [ "zh-CN" "en-US" ];
-          nativeMessagingHosts.packages = [ inputs.pkgs.firefoxpwa ];
+          plasma = 
+          {
+            enable = true;
+            configFile =
+            {
+              plasma-localerc = { Formats.LANG.value = "en_US.UTF-8"; Translations.LANGUAGE.value = "zh_CN"; };
+              baloofilerc."Basic Settings".Indexing-Enabled.value = false;
+            };
+            powerdevil =
+              let config =
+              {
+                autoSuspend.action = "nothing";
+                dimDisplay.enable = false;
+                powerButtonAction = "turnOffScreen";
+                turnOffDisplay.idleTimeout = "never";
+                whenLaptopLidClosed = "turnOffScreen";
+              };
+              in { AC = config; battery = config; lowBattery = config; };
+          };
+          obs-studio =
+          {
+            enable = true;
+            plugins = with inputs.pkgs.obs-studio-plugins; [ wlrobs obs-vaapi obs-nvfbc droidcam-obs obs-vkcapture ];
+          };
         };
-        vim.package = inputs.pkgs.vim-full;
-      };
-      nixpkgs.config.packageOverrides = pkgs: 
-      {
-        telegram-desktop = pkgs.telegram-desktop.overrideAttrs (attrs:
-        {
-          patches = (if (attrs ? patches) then attrs.patches else []) ++ [ ./telegram.patch ];
-        });
-      };
-      services.pcscd.enable = true;
+      }];
     };
+    programs =
+    {
+      adb.enable = true;
+      wireshark = { enable = true; package = inputs.pkgs.wireshark; };
+      yubikey-touch-detector.enable = true;
+      kdeconnect.enable = true;
+      anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
+      honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
+      sleepy-launcher = { enable = true; package = inputs.pkgs.sleepy-launcher; };
+    };
+    nixpkgs.overlays = [(final: prev:
+    {
+      telegram-desktop = prev.telegram-desktop.overrideAttrs (attrs:
+      {
+        patches = (if (attrs ? patches) then attrs.patches else []) ++ [ ./telegram.patch ];
+      });
+    })];
+    services.pcscd.enable = true;
+  };
 }
-

modules/packages/desktop/telegram.patch

@@ -1,8 +1,7 @@
-diff --git a/Telegram/SourceFiles/data/data_sponsored_messages.cpp b/Telegram/SourceFiles/data/data_sponsored_messages.cpp
-index fa21af4..211f3bf 100644
---- a/Telegram/SourceFiles/data/data_sponsored_messages.cpp
-+++ b/Telegram/SourceFiles/data/data_sponsored_messages.cpp
-@@ -175,7 +175,7 @@ void SponsoredMessages::inject(
+diff --color -ur a/Telegram/SourceFiles/data/components/sponsored_messages.cpp b/Telegram/SourceFiles/data/components/sponsored_messages.cpp
+--- a/Telegram/SourceFiles/data/components/sponsored_messages.cpp	1970-01-01 08:00:01.000000000 +0800
++++ b/Telegram/SourceFiles/data/components/sponsored_messages.cpp	2024-05-21 20:41:12.849951324 +0800
+@@ -193,7 +193,7 @@
  }
  
  bool SponsoredMessages::canHaveFor(not_null<History*> history) const {

modules/packages/firefox.nix

@@ -0,0 +1,18 @@
+inputs:
+{
+  options.nixos.packages.firefox = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) firefox; in inputs.lib.mkIf (firefox != null)
+  {
+    # still enable global firefox, to install language packs
+    programs.firefox =
+    {
+      enable = true;
+      languagePacks = [ "zh-CN" "en-US" ];
+      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator ];
+    };
+  };
+}

modules/packages/flatpak.nix

@@ -0,0 +1,12 @@
+inputs:
+{
+  options.nixos.packages.flatpak = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) flatpak; in inputs.lib.mkIf (flatpak != null)
+  {
+    services.flatpak = { enable = true; uninstallUnmanaged = true; };
+  };
+}

modules/packages/git.nix

@@ -0,0 +1,22 @@
+inputs:
+{
+  options.nixos.packages.git = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) git; in inputs.lib.mkIf (git != null)
+  {
+    programs.git =
+    {
+      enable = true;
+      package = inputs.pkgs.gitFull;
+      lfs.enable = true;
+      config =
+      {
+        init.defaultBranch = "main";
+        core.quotepath = false;
+        lfs.ssh.automultiplex = false; # 避免 lfs 一直要求触摸 yubikey
+        receive.denyCurrentBranch = "warn"; # 允许 push 到非 bare 的仓库
+      };
+    };
+    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.git-lfs-transfer ]; # make pure ssh lfs work
+  };
+}

modules/packages/gpg.nix

@@ -0,0 +1,9 @@
+inputs:
+{
+  options.nixos.packages.gpg = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) gpg; in inputs.lib.mkIf (gpg != null)
+  {
+    programs.gnupg.agent.enable = true;
+  };
+}

modules/packages/server.nix

@@ -0,0 +1,68 @@
+inputs:
+{
+  options.nixos.packages.server = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) server; in inputs.lib.mkIf (server != null)
+  {
+    nixos.packages.packages =
+    {
+      _packages = with inputs.pkgs;
+      [
+        # basic tools
+        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij ipfetch localPackages.pslist
+        fastfetch reptyr nushell duc ncdu progress libva-utils ksh neofetch
+        # lsxx
+        pciutils usbutils lshw util-linux lsof dmidecode lm_sensors
+        # top
+        iotop iftop htop btop powertop s-tui
+        # editor
+        nano bat
+        # downloader
+        wget aria2 curl yt-dlp ffsend
+        # file manager
+        tree eza trash-cli lsd broot file xdg-ninja mlocate
+        # compress
+        pigz upx unzip zip lzip p7zip
+        # file system management
+        sshfs e2fsprogs duperemove compsize exfatprogs
+        # disk management
+        smartmontools hdparm
+        # encryption and authentication
+        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
+        # networking
+        ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
+        # nix tools
+        nix-output-monitor nix-tree ssh-to-age (callPackage "${inputs.topInputs.nix-fast-build}" {}) nix-inspect
+        # development
+        gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
+        # stupid things
+        toilet lolcat
+        # office
+        todo-txt-cli pdfgrep ffmpeg-full
+      ]
+        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ])
+        ++ (inputs.lib.optional (inputs.config.nixos.system.nixpkgs.arch == "x86_64") rar);
+      _pythonPackages = [(pythonPackages: with pythonPackages;
+      [
+        openai python-telegram-bot fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus
+      ])];
+    };
+    programs =
+    {
+      nix-index-database.comma.enable = true;
+      nix-index.enable = true;
+      command-not-found.enable = false;
+      autojump.enable = true;
+      direnv = { enable = true; nix-direnv.enable = true; };
+      mosh.enable = true;
+      yazi.enable = true;
+    };
+    services =
+    {
+      udev.packages = with inputs.pkgs; [ yubikey-personalization libfido2 ];
+      fwupd.enable = true;
+    };
+    home-manager = { useGlobalPkgs = true; useUserPackages = true; };
+  };
+}

modules/packages/server/default.nix

@@ -1,134 +0,0 @@
-inputs:
-{
-  imports = inputs.localLib.mkModules
-  [
-    ./ssh
-    ./zsh
-    ./gpg.nix
-  ];
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (builtins) concatLists map listToAttrs;
-      inherit (inputs.localLib) attrsToList;
-    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
-    {
-      nixos =
-      {
-        packages = with inputs.pkgs;
-        {
-          _packages = 
-          [
-            # shell
-            ksh
-            # basic tools
-            beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij neofetch ipfetch localPackages.pslist
-            fastfetch reptyr
-            # lsxx
-            pciutils usbutils lshw util-linux lsof
-            # top
-            iotop iftop htop btop powertop s-tui
-            # editor
-            nano bat
-            # downloader
-            wget aria2 curl yt-dlp
-            # file manager
-            tree eza trash-cli lsd broot file xdg-ninja mlocate
-            # compress
-            pigz rar upx unzip zip lzip p7zip
-            # file system management
-            sshfs e2fsprogs adb-sync duperemove compsize exfatprogs
-            # disk management
-            smartmontools hdparm
-            # encryption and authentication
-            apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
-            # networking
-            ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
-            # nix tools
-            nix-output-monitor nix-tree ssh-to-age
-            # office
-            todo-txt-cli
-            # development
-            gdb try inputs.topInputs.plasma-manager.packages.x86_64-linux.rc2nix hexo-cli
-          ] ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
-        };
-        users.sharedModules = [(home-inputs:
-        {
-          config.programs =
-          {
-            direnv = { enable = true; nix-direnv.enable = true; };
-            git =
-            {
-              enable = true;
-              lfs.enable = true;
-              extraConfig =
-              {
-                core.editor = if inputs.config.nixos.system.gui.preferred then "code --wait" else "vim";
-                advice.detachedHead = false;
-                merge.conflictstyle = "diff3";
-                diff.colorMoved = "default";
-              };
-              package = inputs.pkgs.gitFull;
-              delta =
-              {
-                enable = true;
-                options =
-                {
-                  side-by-side = true;
-                  navigate = true;
-                  syntax-theme = "GitHub";
-                  light = true;
-                  zero-style = "syntax white";
-                  line-numbers-zero-style = "#ffffff";
-                };
-              };
-            };
-            vim =
-            {
-              enable = true;
-              defaultEditor = true;
-              packageConfigurable = inputs.config.programs.vim.package;
-              settings =
-              {
-                number = true;
-                expandtab = false;
-                shiftwidth = 2;
-                tabstop = 2;
-              };
-              extraConfig =
-              ''
-                set clipboard=unnamedplus
-                colorscheme evening
-              '';
-            };
-          };
-        })];
-      };
-      programs =
-      {
-        nix-index-database.comma.enable = true;
-        nix-index.enable = true;
-        command-not-found.enable = false;
-        autojump.enable = true;
-        git =
-        {
-          enable = true;
-          package = inputs.pkgs.gitFull;
-          lfs.enable = true;
-          config =
-          {
-            init.defaultBranch = "main";
-            core = { quotepath = false; editor = "vim"; };
-          };
-        };
-        yazi.enable = true;
-        mosh.enable = true;
-      };
-      services =
-      {
-        fwupd.enable = true;
-        udev.packages = with inputs.pkgs; [ yubikey-personalization libfido2 ];
-      };
-      home-manager = { useGlobalPkgs = true; useUserPackages = true; };
-    };
-}

modules/packages/server/gpg.nix

@@ -1,10 +0,0 @@
-inputs:
-{
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
-    {
-      programs.gnupg.agent = { enable = true; pinentryFlavor = "tty"; };
-    };
-}

modules/packages/server/ssh/default.nix

@@ -1,169 +0,0 @@
-inputs:
-{
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (builtins) concatLists map listToAttrs;
-      inherit (inputs.localLib) attrsToList;
-    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
-    {
-      services.openssh.knownHosts =
-        let
-          servers =
-          {
-            vps6 =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
-              hostnames = [ "vps6.chn.moe" "wireguard.vps6.chn.moe" "74.211.99.69" "192.168.83.1" ];
-            };
-            "initrd.vps6" =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4DKB/zzUYco5ap6k9+UxeO04LL12eGvkmQstnYxgnS";
-              hostnames = [ "initrd.vps6.chn.moe" "74.211.99.69" ];
-            };
-            vps7 =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5XkdilejDAlg5hZZD0oq69k8fQpe9hIJylTo/aLRgY";
-              hostnames = [ "vps7.chn.moe" "wireguard.vps7.chn.moe" "ssh.git.chn.moe" "95.111.228.40" "192.168.83.2" ];
-            };
-            "initrd.vps7" =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZyQpdQmEZw3nLERFmk2tS1gpSvXwW0Eish9UfhrRxC";
-              hostnames = [ "initrd.vps7.chn.moe" "95.111.228.40" ];
-            };
-            nas =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIktNbEcDMKlibXg54u7QOLt0755qB/P4vfjwca8xY6V";
-              hostnames = [ "wireguard.nas.chn.moe" "[office.chn.moe]:5440" "192.168.1.185" "192.168.83.4" ];
-            };
-            "initrd.nas" =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
-              hostnames = [ "initrd.nas.chn.moe" "[office.chn.moe]:5440" "192.168.1.185" ];
-            };
-            pc =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
-              hostnames = [ "wireguard.pc.chn.moe" "192.168.83.3" ];
-            };
-            hpc =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVpsQW3kZt5alHC6mZhay3ZEe2fRGziG4YJWCv2nn/O";
-              hostnames = [ "hpc.xmu.edu.cn" ];
-            };
-            github =
-            {
-              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
-              hostnames = [ "github.com" ];
-            };
-          };
-        in listToAttrs (concatLists (map
-          (server:
-          (
-            if builtins.pathExists ./ssh/${server.name}_rsa.pub then
-            [{
-              name = "${server.name}-rsa";
-              value =
-              {
-                publicKey = builtins.readFile ./ssh/${server.name}_rsa.pub;
-                hostNames = server.value.hostnames;
-              };
-            }]
-            else []
-          )
-          ++ (
-            if builtins.pathExists ./ssh/${server.name}_ecdsa.pub then
-            [{
-              name = "${server.name}-ecdsa";
-              value =
-              {
-                publicKey = builtins.readFile ./ssh/${server.name}_ecdsa.pub;
-                hostNames = server.value.hostnames;
-              };
-            }]
-            else []
-          )
-          ++ (
-            if server.value ? ed25519 then
-            [{
-              name = "${server.name}-ed25519";
-              value =
-              {
-                publicKey = server.value.ed25519;
-                hostNames = server.value.hostnames;
-              };
-            }]
-            else []
-          ))
-          (attrsToList servers)));
-      programs.ssh =
-      {
-        startAgent = true;
-        enableAskPassword = true;
-        askPassword = "${inputs.pkgs.systemd}/bin/systemd-ask-password";
-        extraConfig = "AddKeysToAgent yes";
-      };
-      environment.sessionVariables.SSH_ASKPASS_REQUIRE = "prefer";
-      nixos.users.sharedModules =
-      [(hmInputs: {
-        config.programs.ssh =
-        {
-          enable = true;
-          controlMaster = "auto";
-          controlPersist = "1m";
-          compression = true;
-          matchBlocks = builtins.listToAttrs
-          (
-            (builtins.map
-              (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-              [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "wireguard.nas" ])
-            ++ (builtins.map
-              (host:
-              {
-                name = host;
-                value =
-                {
-                  host = host;
-                  hostname = "hpc.xmu.edu.cn";
-                  user = host;
-                  extraOptions =
-                  {
-                    PubkeyAcceptedAlgorithms = "+ssh-rsa";
-                    HostkeyAlgorithms = "+ssh-rsa";
-                    SetEnv =
-                      let
-                        usernameMap =
-                        {
-                          chn = "linwei/chn";
-                        };
-                        cdString =
-                          if host == "jykang" && (usernameMap ? ${hmInputs.config.home.username}) then
-                            ":chn_cd:${usernameMap.${hmInputs.config.home.username}}"
-                          else "";
-                      in "TERM=chn_unset_ls_colors${cdString}:xterm-256color";
-                    # in .bash_profile:
-                    # if [[ $TERM == chn_unset_ls_colors* ]]; then
-                    #   export TERM=${TERM#*:}
-                    #   export CHN_LS_USE_COLOR=1
-                    # fi
-                    # if [[ $TERM == chn_cd* ]]; then
-                    #   export TERM=${TERM#*:}
-                    #   cd ~/${TERM%%:*}
-                    #   export TERM=${TERM#*:}
-                    # fi
-                    # in .bashrc
-                    # [ -n "$CHN_LS_USE_COLOR" ] && alias ls="ls --color=auto"
-                  };
-                };
-              })
-              [ "wlin" "jykang" "hwang" ])
-          )
-          // {
-            xmupc1 = { host = "xmupc1"; hostname = "office.chn.moe"; port = 6007; };
-            nas = { host = "nas"; hostname = "office.chn.moe"; port = 5440; };
-            gitea = { host = "gitea"; hostname = "ssh.git.chn.moe"; };
-          };
-        };
-      })];
-    };
-}

modules/packages/server/ssh/github_ecdsa.pub

@@ -1 +0,0 @@
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

modules/packages/server/ssh/github_rsa.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=