modules.system.nixpkgs: fix native kernel patch

flake.lib.buildNixpkgsConfig: fix binaryen
devices.steamdeck: init
2026-01-12 12:39:24 +08:00 · 2025-08-07 23:15:32 +08:00 · 2025-08-07 20:42:34 +08:00 · 2025-08-07 20:29:40 +08:00
107 changed files with 1500 additions and 2133 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,14 +4,17 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &vps4 age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
+  - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
  - &srv1-node2 age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
  - &srv2-node0 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &srv2-node1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
+  - &srv3 age1n4lhfwv7g0vhx54exmwx9yv2z04m3h2lunzpa5zdzgtcvjjuf5nqc36g8a
  - &test age1vgqvdqqe3mn0gvh0hydvu9c5f9yn5vek08cagyvwjhyta6utpvuq00g9c2
  - &test-pc age17a8y4yr2ckuek67rt786ujuf7705gvj3vv6ezktxxmgayea9zcyqet7hgc
  - &test-pc-vm age1wmcayhf9eyx9e9yp97850mqas9ns455crce8hfmvnupgcxd6sews5r0cln
+  - &steamdeck age1x7gda43xxsggveu8q2pajttlmgwsjhmksv7hzv3r270gyrpk8a5sza87gz
 creation_rules:
  - path_regex: devices/pc/.*$
    key_groups: [{ age: [ *chn, *pc ] }]
@@ -21,6 +24,8 @@ creation_rules:
    key_groups: [{ age: [ *chn, *vps6 ] }]
  - path_regex: devices/nas/.*$
    key_groups: [{ age: [ *chn, *nas ] }]
+  - path_regex: devices/one/.*$
+    key_groups: [{ age: [ *chn, *one ] }]
  - path_regex: devices/srv1/secrets/.*$
    key_groups: [{ age: [ *chn, *srv1-node0, *srv1-node1, *srv1-node2 ] }]
  - path_regex: devices/srv1/node0/.*$
@@ -35,16 +40,20 @@ creation_rules:
    key_groups: [{ age: [ *chn, *srv2-node0 ] }]
  - path_regex: devices/srv2/node1/.*$
    key_groups: [{ age: [ *chn, *srv2-node1 ] }]
+  - path_regex: devices/srv3/.*$
+    key_groups: [{ age: [ *chn, *srv3 ] }]
  - path_regex: devices/test/.*$
    key_groups: [{ age: [ *chn, *test ] }]
  - path_regex: devices/test-pc/.*$
    key_groups: [{ age: [ *chn, *test-pc ] }]
  - path_regex: devices/test-pc-vm/.*$
    key_groups: [{ age: [ *chn, *test-pc-vm ] }]
+  - path_regex: devices/steamdeck/.*$
+    key_groups: [{ age: [ *chn, *steamdeck ] }]
  - path_regex: devices/cross/secrets/default.yaml$
    key_groups:
-    - age: [ *chn, *pc, *vps4, *vps6, *nas, *srv1-node0, *srv1-node1, *srv1-node2, *srv2-node0, *srv2-node1,
-      *test, *test-pc, *test-pc-vm]
+    - age: [ *chn, *pc, *vps4, *vps6, *nas, *one, *srv1-node0, *srv1-node1, *srv1-node2, *srv2-node0, *srv2-node1,
+      *srv3, *test, *test-pc, *test-pc-vm, *steamdeck ]
  - path_regex: devices/cross/secrets/chn.yaml$
    key_groups:
-    - age: [ *chn, *pc, *nas ]
+    - age: [ *chn, *pc, *one, *nas ]
--- a/devices/cross/luks-manual/default.nix
+++ b/devices/cross/luks-manual/default.nix
@@ -3,16 +3,17 @@ let devices =
 {
  nas =
  {
-    "/dev/disk/by-partlabel/nas-root1".mapper = "root1";
-    "/dev/disk/by-partlabel/nas-root2".mapper = "root2";
-    "/dev/disk/by-partlabel/nas-root3" = { mapper = "root3"; ssd = true; };
-    "/dev/disk/by-partlabel/nas-root4" = { mapper = "root4"; ssd = true; };
+    "/dev/disk/by-partlabel/nas-root3".mapper = "root3";
+    "/dev/disk/by-partlabel/nas-root4".mapper = "root4";
    "/dev/disk/by-partlabel/nas-swap" = { mapper = "swap"; ssd = true; };
-    "/dev/disk/by-partlabel/nas-ssd1" = { mapper = "ssd1"; ssd = true; };
-    "/dev/disk/by-partlabel/nas-ssd2" = { mapper = "ssd2"; ssd = true; };
  };
  vps4."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
  vps6."/dev/disk/by-uuid/961d75f0-b4ad-4591-a225-37b385131060" = { mapper = "root"; ssd = true; };
+  srv3 =
+  {
+    "/dev/disk/by-partlabel/srv3-root1" = { mapper = "root1"; ssd = true; };
+    "/dev/disk/by-partlabel/srv3-swap" = { mapper = "swap"; ssd = true; };
+  };
 };
 in
 {
--- a/devices/cross/secrets/default.yaml
+++ b/devices/cross/secrets/default.yaml
@@ -21,6 +21,13 @@ users:
    GROUPIII-3: ENC[AES256_GCM,data:c+HRdDZPugIVI2vmuOlorhjZzxS11c6CJiZ3ZEwFFHfIoIUmGsXoRPGraJ0BjI3W+XZbI6qk211yufTgXLVj7nOVi0PW/9mteg==,iv:H8DlkTjkL/f6Oa2LG3dHRsJuWkEqokUJ/mjMyDnEAc4=,tag:0QmUyfAbYnn7vs4AdwQtYw==,type:str]
    #ENC[AES256_GCM,data:F347rPlEQZyz,iv:VlbVlc/tFmmoe8lVDza7ZJgHavZ/1NM9mK3KZNVrpbk=,tag:iRdvv0ajtgrJgMe87vBFfA==,type:comment]
    zzn: ENC[AES256_GCM,data:P76cGOGJK3B7Z3nxZ9BlvvyegJ+4JX25kax7/Bj/0VKsH1cGEfyvNbPH8qYUZqm+zUvqEoFNZKWM4+IQKO7Zo9IXCJhGItL1Nw==,iv:e9lnHecgzSrHJkxumRpKGHzGlYbM5Yov4F4Dd4fIqrc=,tag:G7Cr7d1KZfldzYNRL1eSpA==,type:str]
+    aleksana: ENC[AES256_GCM,data:xRqQLPpcv0Ymz7wV0jDDz1i6eKIZKEXvqofO58VSHEC9aVSTLV7aXLw2kQ8PrAPo4FAkne2F6MYQGRwZFIHOjxfhw+ncXVDHxg==,iv:OSbT/f2LRUFY3DEyCCbWkPzwsrsNdVz6ah5ITRt+Kjc=,tag:00z36RTe76p1uxFCchGcpg==,type:str]
+    #ENC[AES256_GCM,data:xAGWajpTpg2keMthwQ==,iv:sQreB2mExZlWgVsig7885zf4LI6RFSitYUnD4ngvhfQ=,tag:viEY1wUVlDCqKm5ucQWzsA==,type:comment]
+    alikia: ENC[AES256_GCM,data:N4lyS8XZSxP3su+Frz00BPU+II+N6nosu4yOLPSG7zxefcJoG7i5bG3bzb1OQLc/x4fTuD2Wd6mEy6q66cizBkGn3xQHZIaW2w==,iv:FO64ACjOS6+UzWKP5WdcFOGZTzslfetX/VAxyUPZ3ds=,tag:6Kf0MCRUj9cbxyk4TsH8iA==,type:str]
+    #ENC[AES256_GCM,data:1br5bc3q0jBn4WrJzQ==,iv:YmIFhDd9Wl4dcKJLBC6A3v7oUXhBin6ZOuJknSiaYfw=,tag:8gtEBug4vHQkxN/9tLjqSw==,type:comment]
+    pen: ENC[AES256_GCM,data:XOKXV0YSFbHC3I3xO8fpWvYerNfVFg2afs+CUp2MZB+yt9KR5bTJdVOfUGldLbWH5CR4v5FxTrTujv24wJ710Rfyugxh9aFJ/w==,iv:tHLoO+XpdUk8S56QUiJQOpVO9C5epam9PMubMN+8fHw=,tag:H0srWRigNUedQMIAfJlfjg==,type:str]
+    #ENC[AES256_GCM,data:K6O0TIYYGZmM8iOwsQ==,iv:xtT8Psnoy51V9gsRo335+VT56FXTcMQ3d4/tnuWouew=,tag:k8irtZ33G3UFK++rzcmyiw==,type:comment]
+    reonokiy: ENC[AES256_GCM,data:fPKdOPAKbXUvK5Jj08T0iSD23mhhkTXCexgB5q3v5JS4c6V4S+W14WOkS4UHrMQls/rHslw0NyMzS5G27A+5vN+EN+xJZfuRGg==,iv:tSdNOgs61tyt7/hUKt8bfKvpq9qOQU14ligdxBs/ATs=,tag:6IoS/p2StKtFREIpxsWkdg==,type:str]
    #ENC[AES256_GCM,data:cZznknXjlWF6eoEaTA==,iv:tdw/54W2evO1o5sq1syz3k0DZrm/rjflxqJpB9LZgvg=,tag:d60Ctc5YeSmhZJUURUmeSg==,type:comment]
    zqq: ENC[AES256_GCM,data:iFtM0pxIvXPHBnLEfHdmYGVWXuroDLgUaAKF+DmuBdq1NY+pr33oXNJzckFZfWgpIOuCm4cNg5j5R6nsG+zk2VWdi2vuITT4jA==,iv:qfBC/D1gJYXOZ0Fy2DkAb+ImDgXZWU6R/Z50hbVDR98=,tag:eCr6lbSieWDCNaTYzoQ0qQ==,type:str]
    zgq: ENC[AES256_GCM,data:cHYFToQ5ulEcb741Gg3X4lKj8ZJy1zcLHpkVQjQXt5hRAQtPsiPlegi2a1nUIAUb6sI//4ffcytlXpdK2sXewFe3ZiIXy3UVjQ==,iv:fKaPxpfh5ssOwAbmEsAPaQ45KrNtkHZb96IzWc6pD9s=,tag:Vt91B77SjxYaZ/HvWVBufA==,type:str]
@@ -169,7 +176,7 @@ sops:
            UnR5Y24rSTk3WUV1VUgvQUFCVUxPZUEKv/lTy02gZYn4jF1uGtm+LhJd0m59Xe99
            +unmqUDh0ZqAhJU8o0jrBiWs1lXOHU7CkIom7tGEMHGUxHkS+Z/6GQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-06T01:03:09Z"
-    mac: ENC[AES256_GCM,data:9pJpUNzMogdijzFpjkCw4wEuOGn8B6Q/sKqzA6Pq73fp42t59BbdtK6ClTWqDRUG5MMmLVXYqdlrjPeHeRtXuQ0USNNFY6jC/p35/gB/+Gh+qqLY48YtBPjsV7aYkF8bVhC8EeDZPXvw6Hz5r+e1crVxcbOjk1uFXFVdoDGgsuQ=,iv:0QKuxk9WvCgLMJCNkX0/S/YonY/bmTvvN27DKcZGzv4=,tag:S9S/J57/GHjmVLJhtLDqDw==,type:str]
+    lastmodified: "2025-07-13T00:27:59Z"
+    mac: ENC[AES256_GCM,data:iBBMsGOD7nDpXDPDlB/ml06y4WVe0uq7dptn5VZSppoxGA7BmRfWq9OKueXykmgfueqC3N45KVeRh3/b+FrsIRuTl1iyKnT3pd/naGTguQBfFewhrbqNc6UaDadpEVSgYiS76A5JwEoemePPHVUboDOSe0ru3uzNk1nDh/85jRg=,iv:8/GpDArKPYPG2O41p97oQZHkmIgIVdB7OWLvMrDXlaI=,tag:sq3B5Zo7XoA151WmgtvMMw==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/devices/cross/ssh.nix
+++ b/devices/cross/ssh.nix
@@ -17,8 +17,8 @@ let
    {
      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIIktNbEcDMKlibXg54u7QOLt0755qB/P4vfjwca8xY6V";
      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
-      extraAccess = [ "ssh.git" ];
    };
+    one.publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIC5i2Z/vK0D5DBRg3WBzS2ejM0U+w3ZPDJRJySdPcJ5d";
    pc.publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
    srv1-node0 =
      { publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIDm6M1D7dBVhjjZtXYuzMj2P1fXNWN3O9wmwNssxEeDs"; extraAccess = [ "srv1" ]; };
@@ -40,6 +40,13 @@ let
      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAINTvfywkKRwMrVp73HfHTfjhac2Tn9qX/lRjLr09ycHp";
      proxyJump = "srv2";
    };
+    srv3 =
+    {
+      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIIg2wuwWqIOWNx1kVmreF6xTrGaW7rIaXsEPfCMe+5P9";
+      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIPW7XPhNsIV0ZllaueVMHIRND97cHb6hE9O21oLaEdCX";
+      # 默认仅包括wireguard访问的域名和直接访问的域名，这里写额外的域名
+      extraAccess = [ "ssh.git" ];
+    };
  };
 in
 {
--- a/devices/cross/wireguard.nix
+++ b/devices/cross/wireguard.nix
@@ -6,208 +6,240 @@ let
    vps6 = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
    pc = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
    nas = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+    one = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
    srv1-node0 = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
    srv1-node1 = "wyNONnJF2WHykaHsQIV4gNntOaCsdTfi7ysXDsR2Bww=";
    srv1-node2 = "zWvkVyJwtQhwmxM2fHwNDnK+iwYm1O0RHrwCQ/VXdEo=";
    srv2-node0 = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
    srv2-node1 = "wc+DkY/WlGkLeI8cMcoRHcCcITNqX26P1v5JlkQwWSc=";
+    srv3 = "a1pUi12SN6fIFiHA9W0N1ycuSz1fWUSpZnjz20OPaBk=";
  };
  dns = inputs.topInputs.self.config.dns.wireguard;
-  inherit (inputs.topInputs.self.config.dns."chn.moe") getAddress;
-  listenPort =
+  networks = # 对于每个网络，只需要设置每个设备的 listenPort，以及每个设备的每个 peer 的 publicKey endpoint allowedIPs
  {
-    wg0 = builtins.listToAttrs (builtins.map
-      (name: inputs.lib.nameValuePair name 51820)
-      (builtins.attrNames publicKey));
-    wg1 = builtins.listToAttrs (builtins.map
-      (name: inputs.lib.nameValuePair name (51820 + dns.peer.${name}))
-      (builtins.attrNames publicKey));
-  };
-  subnet = # 设备之间可以直接连接的子网。若一个设备可以主动接受连接，则设置它接受连接的 ip；否则设置为 null
-  {
-    wg0 =
-    [
-      # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
-      (builtins.listToAttrs
-      (
-        (builtins.map (n: inputs.lib.nameValuePair n (getAddress n)) [ "vps4" "vps6" ])
-          ++ (builtins.map
-            (n: { name = n; value = null; })
-            (inputs.lib.subtractLists [ "vps4" "vps6" ] (builtins.attrNames publicKey)))
-      ))
-    ];
-    wg1 =
-    [
-      # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
-      (builtins.listToAttrs
-      (
-        (builtins.map (n: inputs.lib.nameValuePair n (getAddress n)) [ "vps4" "vps6" ])
-          ++ (builtins.map (n: inputs.lib.nameValuePair n null) [ "pc" "nas" "srv1-node0" "srv2-node0" ])
-      ))
-      # 校内网络
-      (builtins.listToAttrs
-      (
-        (builtins.map (n: inputs.lib.nameValuePair n (getAddress n)) [ "srv1-node0" "srv2-node0" ])
-          ++ (builtins.map (n: inputs.lib.nameValuePair n null) [ "pc" "nas" ])
-      ))
-      # 办公室或者宿舍局域网
-      (builtins.listToAttrs (builtins.map (n: inputs.lib.nameValuePair n (getAddress n)) [ "pc" "nas" ]))
-      # 集群内部网络
-      (builtins.listToAttrs (builtins.map
-        (n: inputs.lib.nameValuePair "srv1-node${builtins.toString n}" "192.168.178.${builtins.toString (n + 1)}")
-        (builtins.genList (n: n) 3)))
-      (builtins.listToAttrs (builtins.map
-        (n: inputs.lib.nameValuePair "srv2-node${builtins.toString n}" "192.168.178.${builtins.toString (n + 1)}")
-        (builtins.genList (n: n) 2)))
-    ];
-  };
-  # 给定起止点，返回最短路径的第一跳的目的地
-  # 如果两个设备不能连接，返回 null;
-  # 如果可以直接、主动连接，返回 { address = xx; port = xx; }；如果可以直接连接但是被动连接，返回 { address = null; }；
-  # 如果需要中转，返回 { jump = 下一跳; }
-  connection =
-    let
-      # 将给定子网翻译成一列边，返回 [{ dev1 = null or ip; dev2 = null or ip; }]
-      # 边中至少有一个端点是可以接受连接的
-      netToEdges = subnet:
-        let devWithAddress = builtins.filter (n: subnet.${n} != null) (builtins.attrNames subnet);
-        in inputs.lib.unique (builtins.concatLists (builtins.map
-          (dev1: builtins.map
-            (dev2: { "${dev1}" = subnet."${dev1}"; "${dev2}" = subnet."${dev2}"; })
-            (inputs.lib.remove dev1 (builtins.attrNames subnet)))
-          devWithAddress));
-      # 在一个图中加入一个边
-      # current 的结构是：from.to = null or { address = xxx or null; length = l; jump = ""; }
-      addEdge = current: newEdge: builtins.mapAttrs
-        (nameFrom: valueFrom: builtins.mapAttrs
-          (nameTo: valueTo:
-            # 不处理自己到自己的路
-            if nameFrom == nameTo then null
-            # 如果要加入的边包含起点
-            else if newEdge ? "${nameFrom}" then
-              # 如果要加入的边包含终点，那么这两个点可以直连
-              if newEdge ? "${nameTo}"
-                then { address = newEdge.${nameTo}; length = 1; }
-                else let edgePoint2 = builtins.head (inputs.lib.remove nameFrom (builtins.attrNames newEdge)); in
-                  # 如果边的另外一个点到终点可以连接
-                  if current.${edgePoint2}.${nameTo} != null then
-                    # 如果之前不能连接，则使用新的连接
-                    if current.${nameFrom}.${nameTo} == null then
-                      { jump = edgePoint2; length = 1 + current.${edgePoint2}.${nameTo}.length; }
-                    # 如果之前可以连接，且新连接更短，同样更新连接
-                    else if current.${nameFrom}.${nameTo}.length > 1 + current.${edgePoint2}.${nameTo}.length then
-                      { jump = edgePoint2; length = 1 + current.${edgePoint2}.${nameTo}.length; }
-                    # 否则，不更新连接
-                    else current.${nameFrom}.${nameTo}
-                  # 否则，不更新连接
-                  else current.${nameFrom}.${nameTo}
-            # 如果要加入的边包不包含起点但包含终点
-            else if newEdge ? "${nameTo}" then
-              let edgePoint2 = builtins.head (inputs.lib.remove nameTo (builtins.attrNames newEdge)); in
-              # 如果起点与另外一个点可以相连
-              if current.${nameFrom}.${edgePoint2} != null then
-                # 如果之前不能连接，则使用新的连接
-                if current.${nameFrom}.${nameTo} == null then
-                {
-                  jump = current.${nameFrom}.${edgePoint2}.jump or edgePoint2;
-                  length = current.${nameFrom}.${edgePoint2}.length + 1;
-                }
-                # 如果之前可以连接，且新连接更短，同样更新连接
-                else if current.${nameFrom}.${nameTo}.length > current.${nameFrom}.${edgePoint2}.length + 1 then
-                {
-                  jump = current.${nameFrom}.${edgePoint2}.jump or edgePoint2;
-                  length = current.${nameFrom}.${edgePoint2}.length + 1;
-                }
-                # 否则，不更新连接
-                else current.${nameFrom}.${nameTo}
-              # 如果起点与另外一个点不可以相连，则不改变连接
-              else current.${nameFrom}.${nameTo}
-            # 如果要加入的边不包含起点和终点
-            else
-              let
-                edgePoints = builtins.attrNames newEdge;
-                p1 = builtins.elemAt edgePoints 0;
-                p2 = builtins.elemAt edgePoints 1;
-              in
-                # 如果起点与边的第一个点可以连接、终点与边的第二个点可以连接
-                if current.${nameFrom}.${p1} != null && current.${p2}.${nameTo} != null then
-                  # 如果之前不能连接，则新连接必然是唯一的连接，使用新连接
-                  if current.${nameFrom}.${nameTo} == null then
-                  {
-                    jump = current.${nameFrom}.${p1}.jump or p1;
-                    length = current.${nameFrom}.${p1}.length + 1 + current.${p2}.${nameTo}.length;
-                  }
-                  # 如果之前可以连接，那么反过来一定也能连接，选取三种连接中最短的
-                  else builtins.head (inputs.lib.sort
-                    (a: b: if a == null then false else if b == null then true else a.length < b.length)
-                    [
-                      # 原先的连接
-                      current.${nameFrom}.${nameTo}
-                      # 正着连接
-                      {
-                        jump = current.${nameFrom}.${p1}.jump or p1;
-                        length = current.${nameFrom}.${p1}.length + 1 + current.${p2}.${nameTo}.length;
-                      }
-                      # 反着连接
-                      {
-                        jump = current.${nameFrom}.${p2}.jump or p2;
-                        length = current.${nameFrom}.${p2}.length + 1 + current.${p1}.${nameTo}.length;
-                      }
-                    ])
-                # 如果正着不能连接、反过来可以连接，那么反过来连接一定是唯一的通路，使用反向的连接
-                else if current.${nameFrom}.${p2} != null && current.${p1}.${nameTo} != null then
-                {
-                  jump = current.${nameFrom}.${p2}.jump or p2;
-                  length = current.${nameFrom}.${p2}.length + 1 + current.${p1}.${nameTo}.length;
-                }
-                # 如果正着连接、反向连接都不行，那么就不更新连接
-                else current.${nameFrom}.${nameTo})
-          valueFrom)
-        current;
-      # 初始时，所有点之间都不连接
-      init = builtins.listToAttrs (builtins.map
-        (dev1:
-        {
-          name = dev1;
-          value = builtins.listToAttrs (builtins.map
-            (dev2: { name = dev2; value = null; })
-            (builtins.attrNames publicKey));
-        })
-        (builtins.attrNames publicKey));
-    in builtins.mapAttrs (_: v: builtins.foldl' addEdge init (builtins.concatLists (builtins.map netToEdges v))) subnet;
-  networks = builtins.mapAttrs
-    (n: v: builtins.listToAttrs (builtins.map
-      (deviceName: inputs.lib.nameValuePair deviceName
+    # 星形网络，所有流量通过 vps6 中转
+    wg0 = let vps6ListenIp = "144.34.225.59"; in
+    {
+      devices =
      {
-        ip = "192.168.${builtins.toString dns.net.${n}}.${builtins.toString dns.peer.${deviceName}}";
-        listenPort = listenPort.${n}.${deviceName};
-        peer = builtins.listToAttrs (builtins.concatLists (builtins.map
-          (peerName:
-            # 如果不能直连，就不用加 peer
-            inputs.lib.optionals (v.${deviceName}.${peerName} ? address)
-            [{
+        vps6 =
+        {
+          listenPort = 51820;
+          peer = builtins.listToAttrs (builtins.map
+            (peerName:
+            {
              name = peerName;
              value =
              {
                publicKey = publicKey.${peerName};
-                allowedIPs =
-                  [ "192.168.${builtins.toString dns.net.${n}}.${builtins.toString dns.peer.${peerName}}" ]
-                  ++ builtins.map
-                    (destination:
-                      "192.168.${builtins.toString dns.net.${n}}.${builtins.toString dns.peer.${destination}}")
-                    (builtins.filter
-                      (destination: v.${deviceName}.${destination}.jump or null == peerName)
-                      (builtins.attrNames publicKey));
-              }
-                // inputs.lib.optionalAttrs (v.${deviceName}.${peerName}.address != null)
-                {
-                  endpoint = "${v.${deviceName}.${peerName}.address}:"
-                    + builtins.toString (listenPort.${n}.${peerName});
-                };
-            }])
-          (inputs.lib.remove deviceName (builtins.attrNames publicKey))));
-      })
-      (builtins.attrNames publicKey))
-    )
-    connection;
-in { config.nixos.services.wireguard = builtins.mapAttrs (_: v: v.${inputs.config.nixos.model.hostname}) networks; }
+                allowedIPs = [ "192.168.${builtins.toString dns.net.wg0}.${builtins.toString dns.peer.${peerName}}" ];
+              };
+            })
+            (inputs.lib.remove "vps6" (builtins.attrNames publicKey)));
+        };
+      }
+      // (builtins.listToAttrs (builtins.map
+        (deviceName:
+        {
+          name = deviceName;
+          value.peer.vps6 =
+          {
+            publicKey = publicKey.vps6;
+            endpoint = "${vps6ListenIp}:51820";
+            allowedIPs = [ "192.168.${builtins.toString dns.net.wg0}.0/24" ];
+          };
+        })
+        (inputs.lib.remove "vps6" (builtins.attrNames publicKey))));
+    };
+    # 两两互连
+    wg1 =
+      let
+        inherit (inputs.topInputs.self.config.dns."chn.moe") getAddress;
+        # 设备之间可以直接连接的子网
+        # 若一个设备可以主动接受连接，则设置它接受连接的 ip；否则设置为 null
+        subnet =
+        [
+          # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
+          (builtins.listToAttrs
+          (
+            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps4" "vps6" "srv3" ])
+              ++ (builtins.map (n: { name = n; value = null; }) [ "pc" "nas" "one" "srv1-node0" "srv2-node0" ])
+          ))
+          # 校内网络
+          (builtins.listToAttrs
+          (
+            (builtins.map (n: { name = n; value = getAddress n; }) [ "srv1-node0" "srv2-node0" ])
+              ++ (builtins.map (n: { name = n; value = null; }) [ "pc" "nas" "one" ])
+          ))
+          # 办公室或者宿舍局域网
+          (builtins.listToAttrs (builtins.map (n: { name = n; value = getAddress n; }) [ "pc" "nas" "one" ]))
+          # 集群内部网络
+          (builtins.listToAttrs (builtins.map
+            (n: { name = "srv1-node${builtins.toString n}"; value = "192.168.178.${builtins.toString (n + 1)}"; })
+            (builtins.genList (n: n) 3)))
+          (builtins.listToAttrs (builtins.map
+            (n: { name = "srv2-node${builtins.toString n}"; value = "192.168.178.${builtins.toString (n + 1)}"; })
+            (builtins.genList (n: n) 2)))
+        ];
+        # 给定起止点，返回最短路径的第一跳的目的地
+        # 如果两个设备不能连接，返回 null; 
+        # 如果可以直接、主动连接，返回 { ip = 地址; }；如果可以直接连接但是被动连接，返回 { ip = null; }；
+        # 如果需要中转，返回 { jump = 下一跳; }
+        connection =
+          let
+            # 将给定子网翻译成一列边，返回 [{ dev1 = null or ip; dev2 = null or ip; }]
+            netToEdges = subnet:
+              let devWithAddress = builtins.filter (n: subnet.${n} != null) (builtins.attrNames subnet);
+              in inputs.lib.unique (builtins.concatLists (builtins.map
+                (dev1: builtins.map
+                  (dev2: { "${dev1}" = subnet."${dev1}"; "${dev2}" = subnet."${dev2}"; })
+                  (inputs.lib.remove dev1 (builtins.attrNames subnet)))
+                devWithAddress));
+            # 在一个图中加入一个边，current 的结构是：from.to = null or { ip = "" or null; length = l; jump = ""; }
+            addEdge = current: newEdge: builtins.mapAttrs
+              (nameFrom: valueFrom: builtins.mapAttrs
+                (nameTo: valueTo:
+                  # 忽略自己到自己的路
+                  if nameFrom == nameTo then null
+                  # 如果要加入的边包含起点
+                  else if newEdge ? "${nameFrom}" then
+                    # 如果要加入的边包含终点，那么这两个点可以直连
+                    if newEdge ? "${nameTo}" then { ip = newEdge.${nameTo}; length = 1; }
+                    else let edgePoint2 = builtins.head (inputs.lib.remove nameFrom (builtins.attrNames newEdge)); in
+                      # 如果边的另外一个点到终点可以连接
+                      if current.${edgePoint2}.${nameTo} != null then
+                        # 如果之前不能连接，则使用新的连接
+                        if current.${nameFrom}.${nameTo} == null then
+                          { jump = edgePoint2; length = 1 + current.${edgePoint2}.${nameTo}.length; }
+                        # 如果之前可以连接，且新连接更短，同样更新连接
+                        else if current.${nameFrom}.${nameTo}.length > 1 + current.${edgePoint2}.${nameTo}.length then
+                          { jump = edgePoint2; length = 1 + current.${edgePoint2}.${nameTo}.length; }
+                        # 否则，不更新连接
+                        else current.${nameFrom}.${nameTo}
+                      # 否则，不更新连接
+                      else current.${nameFrom}.${nameTo}
+                  # 如果要加入的边包不包含起点但包含终点
+                  else if newEdge ? "${nameTo}" then
+                    let edgePoint2 = builtins.head (inputs.lib.remove nameTo (builtins.attrNames newEdge)); in
+                    # 如果起点与另外一个点可以相连
+                    if current.${nameFrom}.${edgePoint2} != null then
+                      # 如果之前不能连接，则使用新的连接
+                      if current.${nameFrom}.${nameTo} == null then
+                      {
+                        jump = current.${nameFrom}.${edgePoint2}.jump or edgePoint2;
+                        length = current.${nameFrom}.${edgePoint2}.length + 1;
+                      }
+                      # 如果之前可以连接，且新连接更短，同样更新连接
+                      else if current.${nameFrom}.${nameTo}.length > current.${nameFrom}.${edgePoint2}.length + 1 then
+                      {
+                        jump = current.${nameFrom}.${edgePoint2}.jump or edgePoint2;
+                        length = current.${nameFrom}.${edgePoint2}.length + 1;
+                      }
+                      # 否则，不更新连接
+                      else current.${nameFrom}.${nameTo}
+                    # 如果起点与另外一个点不可以相连，则不改变连接
+                    else current.${nameFrom}.${nameTo}
+                  # 如果要加入的边不包含起点和终点
+                  else
+                    let
+                      edgePoints = builtins.attrNames newEdge;
+                      p1 = builtins.elemAt edgePoints 0;
+                      p2 = builtins.elemAt edgePoints 1;
+                    in
+                      # 如果起点与边的第一个点可以连接、终点与边的第二个点可以连接
+                      if current.${nameFrom}.${p1} != null && current.${p2}.${nameTo} != null then
+                        # 如果之前不能连接，则新连接必然是唯一的连接，使用新连接
+                        if current.${nameFrom}.${nameTo} == null then
+                        {
+                          jump = current.${nameFrom}.${p1}.jump or p1;
+                          length = current.${nameFrom}.${p1}.length + 1 + current.${p2}.${nameTo}.length;
+                        }
+                        # 如果之前可以连接，那么反过来一定也能连接，选取三种连接中最短的
+                        else builtins.head (inputs.lib.sort
+                          (a: b: if a == null then false else if b == null then true else a.length < b.length)
+                          [
+                            # 原先的连接
+                            current.${nameFrom}.${nameTo}
+                            # 正着连接
+                            {
+                              jump = current.${nameFrom}.${p1}.jump or p1;
+                              length = current.${nameFrom}.${p1}.length + 1 + current.${p2}.${nameTo}.length;
+                            }
+                            # 反着连接
+                            {
+                              jump = current.${nameFrom}.${p2}.jump or p2;
+                              length = current.${nameFrom}.${p2}.length + 1 + current.${p1}.${nameTo}.length;
+                            }
+                          ])
+                      # 如果正着不能连接、反过来可以连接，那么反过来连接一定是唯一的通路，使用反向的连接
+                      else if current.${nameFrom}.${p2} != null && current.${p1}.${nameTo} != null then
+                      {
+                        jump = current.${nameFrom}.${p2}.jump or p2;
+                        length = current.${nameFrom}.${p2}.length + 1 + current.${p1}.${nameTo}.length;
+                      }
+                      # 如果正着连接、反向连接都不行，那么就不更新连接
+                      else current.${nameFrom}.${nameTo})
+                valueFrom)
+              current;
+            # 初始时，所有点之间都不连接
+            init = builtins.listToAttrs (builtins.map
+              (dev1:
+              {
+                name = dev1;
+                value = builtins.listToAttrs (builtins.map
+                  (dev2: { name = dev2; value = null; })
+                  (builtins.attrNames publicKey));
+              })
+              (builtins.attrNames publicKey));
+          in builtins.foldl' addEdge init (builtins.concatLists (builtins.map netToEdges subnet));
+      in
+      {
+        devices = builtins.listToAttrs (builtins.map
+          (deviceName:
+          {
+            name = deviceName;
+            value =
+            {
+              listenPort = 51820 + dns.peer.${deviceName};
+              peer = builtins.listToAttrs (builtins.concatLists (builtins.map
+                (peerName:
+                  # 如果不能直连，就不用加 peer
+                  inputs.lib.optionals (connection.${deviceName}.${peerName} ? ip)
+                  [{
+                    name = peerName;
+                    value =
+                    {
+                      publicKey = publicKey.${peerName};
+                      allowedIPs =
+                        [ "192.168.${builtins.toString dns.net.wg1}.${builtins.toString dns.peer.${peerName}}" ]
+                        ++ builtins.map
+                          (destination:
+                            "192.168.${builtins.toString dns.net.wg1}.${builtins.toString dns.peer.${destination}}")
+                          (builtins.filter
+                            (destination: connection.${deviceName}.${destination}.jump or null == peerName)
+                            (builtins.attrNames publicKey));
+                    }
+                      // inputs.lib.optionalAttrs (connection.${deviceName}.${peerName}.ip != null)
+                      {
+                        endpoint = "${connection.${deviceName}.${peerName}.ip}:"
+                          + builtins.toString (51820 + dns.peer.${peerName});
+                      };
+                  }])
+                (inputs.lib.remove deviceName (builtins.attrNames publicKey))));
+            };
+          })
+          (builtins.attrNames publicKey));
+      };
+  };
+in
+{
+  config.nixos.services.wireguard = inputs.lib.mkMerge (builtins.map
+    (network:
+      let inherit (inputs.config.nixos.model) hostname;
+      in inputs.lib.optionalAttrs (network.value.devices ? ${hostname}) { ${network.name} =
+        network.value.devices.${hostname}
+        // {
+          ip = "192.168.${builtins.toString dns.net.${network.name}}.${builtins.toString dns.peer.${hostname}}";
+        };})
+    (inputs.localLib.attrsToList networks));
+}
--- a/devices/jykang.xmuhpc/default.nix
+++ b/devices/jykang.xmuhpc/default.nix
@@ -2,23 +2,15 @@
 # sudo nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log' -qR ./result | grep -Fxv -f <(ssh jykang find .nix/store -maxdepth 1 -exec realpath '{}' '\;') | sudo xargs nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log' --export | xz -T0 | pv > jykang.nar.xz
 # cat data.nar | nix-store --import
 { inputs, localLib }:
-let
-  pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
-  {
-    inputs = { inherit (inputs.nixpkgs) lib; topInputs = inputs; };
-    nixpkgs = { march = "haswell"; cuda = null; nixRoot = "/data/gpfs01/jykang/.nix"; nixos = false; };
-  });
-  python-lyj =
-    let python = pkgs.pkgs-2411.python310.withPackages (_: [ pkgs.localPackages.pybinding ]);
-    in pkgs.runCommand "python-lyj" { }
-    ''
-      mkdir -p $out/bin
-      ln -s ${python}/bin/python3 $out/bin/python-lyj
-    '';
+let pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
+{
+  inputs = { inherit (inputs.nixpkgs) lib; topInputs = inputs; };
+  nixpkgs = { march = "haswell"; cuda = null; nixRoot = "/data/gpfs01/jykang/.nix"; nixos = false; };
+});
 in pkgs.symlinkJoin
 {
  name = "jykang";
-  paths = with pkgs; [ gnuplot localPackages.vaspkit pv python-lyj ];
+  paths = with pkgs; [ hello iotop gnuplot localPackages.vaspkit pv btop ];
  postBuild = "echo ${inputs.self.rev or "dirty"} > $out/.version";
  passthru = { inherit pkgs; };
 }
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -11,26 +11,15 @@ inputs:
        {
          mount =
          {
-            vfat."/dev/disk/by-partlabel/nas-boot" = "/boot";
-            btrfs =
-            {
-              "/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-              "/dev/mapper/ssd1"."/nix/ssd" = "/nix/ssd";
-            };
+            vfat."/dev/disk/by-uuid/627D-1FAA" = "/boot";
+            btrfs."/dev/mapper/root3" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
          };
          swap = [ "/dev/mapper/swap" ];
-          # TODO: snapshot should take place just before switching root
-          rollingRootfs.waitDevices =
-            [ "/dev/mapper/root2" "/dev/mapper/root3" "/dev/mapper/root4" "/dev/mapper/ssd1" "/dev/mapper/ssd2" ];
+          rollingRootfs.waitDevices = [ "/dev/mapper/root4" ];
        };
        initrd.sshd = {};
-        nixpkgs.march = "alderlake";
-        network =
-        {
-          bridge.nixvirt.interfaces = [ "enp3s0" ];
-          static.nixvirt = { ip = "192.168.1.2"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; }; 
-        };
-        kernel.patches = [ "btrfs" ];
+        nixpkgs.march = "silvermont";
+        network = {};
      };
      hardware.gpu.type = "intel";
      services =
@@ -38,43 +27,13 @@ inputs:
        sshd = {};
        xray =
        {
-          client =
-          {
-            xray.serverName = "xserver2.vps4.chn.moe";
-            dnsmasq = { extraInterfaces = [ "enp3s0" ]; hosts."git.chn.moe" = "127.0.0.1"; };
-          };
+          client.dnsmasq = { extraInterfaces = [ "enp3s0" ]; hosts."git.nas.chn.moe" = "127.0.0.1"; };
          xmuServer = {};
          server.serverName = "xservernas.chn.moe";
        };
        beesd."/" = { hashTableSizeMB = 10 * 128; threads = 4; };
-        nix-serve.hostname = "nix-store.nas.chn.moe";
-        postgresql.mountFrom = "ssd";
-        mariadb.mountFrom = "ssd";
-        rsshub = {};
-        misskey.instances =
-          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
-        synapse.instances =
-        {
-          synapse.matrixHostname = "synapse.chn.moe";
-          matrix = { port = 8009; redisPort = 6380; };
-        };
-        vaultwarden = {};
-        photoprism = {};
-        nextcloud = {};
-        freshrss = {};
-        send = {};
-        huginn = {};
-        httpapi = {};
-        gitea = {};
-        grafana = {};
-        podman = {};
-        peertube = {};
-        nginx.applications.webdav.instances."webdav.chn.moe" = {};
-        # open-webui.ollamaHost = "192.168.83.3";
-        nixvirt = {};
+        nfs."/" = [(inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc")];
      };
    };
-    systemd.tmpfiles.rules =
-      [ "w /sys/class/powercap/intel-rapl/intel-rapl:0/constraint_0_power_limit_uw - - - - 10000000" ];
  };
 }
--- a/devices/nas/secrets.yaml
+++ b/devices/nas/secrets.yaml
@@ -7,81 +7,6 @@ xray-server:
        #ENC[AES256_GCM,data:gToh4rgMOQ==,iv:A14sSC7ExbSZNOzzz6mOmWalSz9K6ROoSYgCqdF7j4U=,tag:1Jr2FfVQ9L2w+bWHh/NekQ==,type:comment]
        user4: ENC[AES256_GCM,data:/ZrgvlpwDlKhcHqkBRsdqqJsNUxtb3ZnC36mc8qlJ+HP4mY3,iv:R5QzXY0mC72TDB0OcF4fJt3bc5L1Z96Q+n9kNbZP7m4=,tag:tjWSEcsG0udvQZZJ/RMTJw==,type:str]
    private-key: ENC[AES256_GCM,data:34FOslwr3AZNDg4YrS95S20agGXwGJRNGnpogMR7utbt1ELUxfQkiAU1qw==,iv:4fiJCi6TJM+NIlfI1qFX/eCNhcVaCWGsLA7iMjQpATw=,tag:eLz8HlQMprQNryk5saqyVQ==,type:str]
-store:
-    signingKey: ENC[AES256_GCM,data:zr02XBgQ4H5jRnjpLtp9rjcysXP9qI7McOiBwaWhdylu5GevKmxlCd4h3pEUO74k+gJT88BzJ+S59P+6DS76Y5nlKqextGMzGjdq5XPkdDkSkKZBai2kkqBSyko=,iv:hyhroaDazMLFeLMGruiFeokZ2Tz3xKj+xCsiEUJ5faQ=,tag:w3805eqo6Y1pw65mjoRgOg==,type:str]
-nginx:
-    detectAuth:
-        chn: ENC[AES256_GCM,data:5kGvlFB332xf+PQCDmJ+EA==,iv:/BQI83lMdzmycQCe0k6Y8bwqV4Ma9vqgvgPWWqVAr1g=,tag:61AhVVNUx8+b55DkIjVifQ==,type:str]
-        led: ENC[AES256_GCM,data:XFlK2jjo,iv:rTCHmoFU4S++eBywCa7NXsAmSqcSgCFXxnW0RyFA2a0=,tag:aK5IejgS060FrxQfmdxohw==,type:str]
-redis:
-    rsshub: ENC[AES256_GCM,data:r2O88tXccKZw68Jg5tvUcpwf6y8Vs1kcZ7XbAReJ7aGyGH4MH3jTO72Hs7vh7185IUygXri0M2C6Ko2CY3gaLg==,iv:ZYbSqlcnga+JnC5Dxt2cTHiGTlkndSAB550ilSO+P1U=,tag:PgrW6H276sSvYe3NA6o/vA==,type:str]
-    misskey-misskey: ENC[AES256_GCM,data:Up0Q/4MjyCdXyL1EVoXbmW0J3QJCx1PlhClXSc2WpBNwpSfgmoJceLoXRbIs009JVjhn5tt7LO6EmwKiNc6yTA==,iv:myWj8+exXtg+t7Fs+ZPOLJXWtKEu0PyhTw68i7rnuTQ=,tag:WMpj06Swj3pMbSXgM0bNuQ==,type:str]
-    misskey-misskey-old: ENC[AES256_GCM,data:yLVCQaElMWBdVnKa9hBNEnSxfOx/582SoCDpQM9QjEgWzYOmPIVoRsTAs10Gsw3PezJW54S+AUrNg1mV0f8Nwg==,iv:xYXQt2CsZyymdKMIoqKLzLeTMNff7RwGzBGDfBOoxlM=,tag:L3V+AZZyOJow/Sf1RzD38A==,type:str]
-    nextcloud: ENC[AES256_GCM,data:/wv5hG7cmHz8S3d411cGxFY87MNmo/6V/vXJsWqYr4afoVLMlqUgpf6ZkSPcj2PKBmB/X+RR1s/Mus9RIJKpzw==,iv:WMdKp63LsMyOGheurm6bM4qUUNVe3/WmkvCQ8PWxqoo=,tag:PHjeJ052LtCqerED4bgACQ==,type:str]
-    send: ENC[AES256_GCM,data:5y0GGNdmVzl1Ro4bv8rab9dgmIOgNQBPPF02HfpOn/ctbSBzi9c96TJeIbDJVS2tN4P2+hSgP/XOR+hoM9prxw==,iv:4xf0b1/1f9vyVlQtIGmX5Ea/xNPyjXmA5/vazf5sOZA=,tag:b2211wLiDTvPKqRA3IpzOA==,type:str]
-    synapse-synapse: ENC[AES256_GCM,data:3lSmLz+sO9fwomeb/NCTlSRwpbegH6g1vp0qKg4G/hnWsKCu2mK6TDhQbLCSDQEagw4oBDN68yEBQ0C0tvmd3w==,iv:9rrv3XvB4ELcZhdi2KNxnYFw+XH96U4SM0X9ZSGp0KA=,tag:Qn8FdMMOaDeB9Wb11F44xA==,type:str]
-    synapse-matrix: ENC[AES256_GCM,data:NqDKomSPI6UcRDAjqVapBlmXXFHdHYS0w3jvJ4oQCvoeqYvNalkD009A6E6Br3w0/FGEKJQeTBI2MkYLlHAWcg==,iv:o8TDqzRDQCi4+Kv82BSTRyB4Y7mKhxM3c49hEbQuQmw=,tag:6RCKWwxC5Fw5N1QD/5UktQ==,type:str]
-    peertube: ENC[AES256_GCM,data:zzRRyCbXsqVVxDvS8kpBbOyozqi24d6G9K++/ToLQyt3TumefTssNehljNsb0oqsmZBLgLhND0T4WDhMf9//Ng==,iv:yDM/LREKnBW8noRzHPIdqg0TvmWAfxmVOplZkY8MSro=,tag:19uoxbEdGPOIzcQqm31H5Q==,type:str]
-postgresql:
-    misskey_misskey: ENC[AES256_GCM,data:mcJM5hgd6Y6MjphFuH20QHU1zxPVnrd5CG3rwX3CekxpM4NzElhkD0pcWM0eTxbNQCM4V+lmjAvaQzBS8T9Mzg==,iv:eC2/GyNcZK31jxLYfRRw4l0aNhz1kcsjE/w4Y/P6ydQ=,tag:hNC2Fj327+O8/4/5/riTYw==,type:str]
-    misskey_misskey_old: ENC[AES256_GCM,data:z4C8J2dAu6OhtRzkHGLb1u3pUGeRuTF1EHzjduO45zF9cpMufIs52u8vhzwmrEXm7bJP2lomyFtQRWNPqtPkVw==,iv:QA56d2wcAseFuhI+lgR5Op0TbKrzs+1Cd5v8/0i8/gE=,tag:Df63HfuHZhDn/0SL2/6fdA==,type:str]
-    synapse_synapse: ENC[AES256_GCM,data:4Em7JbATF0Rs8pLjrVT9ZIxPaqecqxCGUtQPie69XWZIVuB/4AsmhPe4WmyJ2jPPmHBdzPHHLwQbd3ryusMzsg==,iv:49JsSMnsZzROuH5mXxMVEbkFOp0uf8gsps02vAH1Ovo=,tag:63LjUCFcnhqUsWqn/hDijQ==,type:str]
-    vaultwarden: ENC[AES256_GCM,data:qP5i100QGGHbYLbmgI29eU1vjx3S9zAAJ6SuahykqehFcowJMG/x9L4VCfw8nMmvoDZDUDvOKsE/8XH6tJ8c8g==,iv:f+yahEvIwdchADrtQsX0EllR6jGzqLA5zwnnAaUjnck=,tag:Iy5JbgktJSoUPszcinb9vQ==,type:str]
-    nextcloud: ENC[AES256_GCM,data:XBsqWgTwAMMQ+aZVf91w343yqL7a1xEswc8CeC0NWsM/ZwabQfYeToVDKlQEGnItuyBRZfhSzH+EUsF7pXDB9Q==,iv:OEoqECAOuyJ0wjsaof8GFYaftEv8z7vH64RWlGHU9XI=,tag:nFoMasHkPawFxiLvclsP6w==,type:str]
-    gitea: ENC[AES256_GCM,data:7afp3qF0jU+aGOktymlk4iDaK2EuYjLD0QcMQA2Nkxf+ac4PQFb1g4rsaPcxuNLn5ZFueq6QXCVUTPNdEeCJNA==,iv:OjNWbhRoi5fvVY8dtkoHWIPO1frXsmI8cuBxKgDHPmo=,tag:1s3+L08McDetU2BTMXWP+g==,type:str]
-    grafana: ENC[AES256_GCM,data:jsKB0+FFRGDfCG/alFwQF1fvI+TOFAUN6gc3zraMkCsRzn6SBzPsyuOiDthTCyS2dx0+arwmn93TzX1fm/vKuQ==,iv:Vl7IsQRuP8TBTDfwJSU/QrHTSowukXtGPG38fu3QcnA=,tag:L5G8sN6ZcOWyoeQgvTYGrg==,type:str]
-    synapse_matrix: ENC[AES256_GCM,data:uyV13dMgUzPLGmSGN3Hoi6u1tY9rMU186VUSl7HspZXFqhs+OmRGL86cf91o/owvz15WijIw4wuAP++T8MY4LA==,iv:TG7Fi3ETAvmrOxv8ZahnrOR7Z90Vf5YgHcOtPkzueJI=,tag:uH10mk1m0q3a0fGcDbH9HQ==,type:str]
-    peertube: ENC[AES256_GCM,data:J/qNYYuOhENTVFU+6Iz9P8Cy1FcHlD6xpPADDzdYDZuce9DEsnFq28d+tTJ7Z71IvOKvNySly7ru/R+Tu7rqpQ==,iv:sV34o2Zf7yLUovdVND7wh+rcoGglz4llc3xfSEllHNM=,tag:c9wzEAlWMINTN8TEZhDIRw==,type:str]
-rsshub:
-    pixiv-refreshtoken: ENC[AES256_GCM,data:PVWacd0SAg2n76ExpQy5Hdg2WK2IdokhnZ0PoY7rNz7pLkBjlrMjbtCenQ==,iv:wPCVw0VVL4b/9TLvGd3fU+dDr/gIlSyUOO5pKF3CuzM=,tag:HgUrPEOCZK9DYsyowi55Ag==,type:str]
-    youtube-key: ENC[AES256_GCM,data:XOPAZPIE8Hd3vKWAR8tlaXQp/FGeH2pIBmwym8h7TXUf+MGTGQko,iv:mv1csjmeKi/ZQIiuhzPIr3DPyygjWevhFGSK+URaQiA=,tag:yh4Zr9MpINU8O0eeH9+z3A==,type:str]
-    youtube-client-id: ENC[AES256_GCM,data:HEJQeFtoyXaSQqprbpGY7qvYYsq1u23CMM5kGvgGsoP1xvEMcwRa3Lza8OhL/lk0MtKH0krojDyUMzWPZtohG9U3ad/t18YQPg==,iv:vT4V3VZU4lJx2djtjIOow/xuER2LQ4reQUOgCPeW+9Y=,tag:MFvBv/3hs2H6BQWGU9eeFg==,type:str]
-    youtube-client-secret: ENC[AES256_GCM,data:7++nVoYfFxv304u9fxmk5W+38tP6Z+mMS/nh7adolhyfDXI=,iv:WlYBfwCz7//qM02ljM1prc/YnBwLOb60ATcUlnBK9ik=,tag:erwi1hRaSaUQ2cLp+S9QOw==,type:str]
-    youtube-refresh-token: ENC[AES256_GCM,data:o9KEBZ18h+taPc3WoQ4EsbR/WbFn3wRhgdvLAz7dmM05Cktf9pgZ8iI1idWQZCJ0ehYL5VyizNhHrmkocXsHzCJ6i79J3uBl5vggWZ4v6/5cUBtNZXq5DYYG/EVN2RXjOdrkzYZnQA==,iv:CQzgvwhofMljnhNXYh+t6BkPJ3OO4GRPOSFZOVXe7TY=,tag:/1i73kP+RrkP76Tho27wkA==,type:str]
-    twitter-auth-token: ENC[AES256_GCM,data:2OM7aZZYuE1A3aQMsDia5yy2cGVmaT7L3QljZ3J8IixA9zaJdFwu6w==,iv:vcc80V5PMqZk7lcvoyfl+XtoIhZ7g951OSRnXPywtao=,tag:EVL2NIiDTS5EHU8MxIZjpA==,type:str]
-    bilibili-cookie: ENC[AES256_GCM,data:PoylF8gAs3dpRSdV6ClpaV9J6jRqRIsAYPlv1NiWy43hHmvEQac1tVrQfm0WHsxV3SfEaphyVH18bgwAcWnkWHbMTzKTWtzsJ74WrihRgksPiuttUm0JkTTr16g0jUtF8kSJiajQfDKmL0pEY9k3mnGnLltjIfntnqbH6dM11FRFy0Ixg0USUPiPz+uFMpJ7x6RHp+ypfhvMYsi5uuCiloCYMV4cUcr65gGym7a72S74vPdPQRzuGoz9fsJn/aPGPlhZR9L2k98TzQjp2jz5lbbGLEH6O1AH/aW9QlDuooF1ki9SvanQ,iv:nO6Adc002Twmw4Qov+EkhVu2TBN0NUEgaCoWOaTu7hE=,tag:cHG00fvDaTR7kAYIMPsICw==,type:str]
-    zhihu-cookies: ENC[AES256_GCM,data:88obR6OzMhO07UM4Mqr928ik/LY8wjjuYRVJdFFJNwiq+q05DfKprrX0oh5barTBqWduZ/PZZzOswh8OgzyeVpRZwBLIz63AJSv+Zui6wV/KODITZs/iDC+UiEnGkh0kf93p3g/TUvxWDGwe7beydGiDXUZrvaQ2nKB7NBGAoohdsx3cXb+TPruj0U8G1GaqRscSjqoYJFhj30EJBH7Jqb687/Zms0oetgXi6KZ8Mw==,iv:tYjHMC7FVxQJ4mhst6pttxivCoSxVyv8qUPmXXDoqzs=,tag:c3UHpyGKvD48qi0rBlfyjA==,type:str]
-mail:
-    bot: ENC[AES256_GCM,data:redeWqYAJlHVivVtywOD+Q==,iv:mDZ+4K4aj+05/KRij0oH+v7/JiBxs7y/x08Nz7U1sSQ=,tag:2FRwDxmN/mIuBjE39jl/Ng==,type:str]
-synapse:
-    synapse:
-        coturn: ENC[AES256_GCM,data:IAgJ3Lni1s/AGQxz2Tt0EpFoIwRZ7Y9TtDHsm7fyCcfDLNvwhNorTod5MSgiqFtHhWLzXf/iqh3/cWitIeuxAg==,iv:QUGCkeFMO+CA3tAXbM8h4KALFic6XbnW5pCxtPtJyb8=,tag:dq6qECRfcyUvJX5EwCPDvQ==,type:str]
-        registration: ENC[AES256_GCM,data:HV4DXfW6h1Z/OaW73jXJ4oXs/FOJf4EXWrWlXsnqbOJyzhCszBOiGFAw/i+wx9sSB+k=,iv:8VIXG3Xqug8dYaw2Log9IrGpxqAXwXFk4MJ4JuzQsBY=,tag:3Ra69sIFOxtX4Wzehvz+lQ==,type:str]
-        macaroon: ENC[AES256_GCM,data:ilCgbQjqIALJd+rz0XmEo6TLqO44NCBBG2vKv8QITLntZ80bgedKACXZogfMVCv7pTI=,iv:LQG1/agu05i7kFL2vWFnSCttivD7yyDijhWFfq50Xq4=,tag:2VfNhZA5OogXI/RaWohDag==,type:str]
-        form: ENC[AES256_GCM,data:0NdGdzjSF1/Xo7jz+Y3sGK/szDlhgg6kWLCoBiqDmBSARZX8SnW9W5zlPKM4Xa0sG+o=,iv:XVxnFBK2f2tvhIshzQLqLeUMcO28MyLrrF5QZMUeUr8=,tag:5frMH5KQt1hL1u2ltDpApw==,type:str]
-        signing-key: ENC[AES256_GCM,data:JPjrh78ySJwmfL7l5C2OT6pelzMfqaWRQK7MoMv3lQ3VXcWKrVsJZlfRQaTJbaEgK+qSiHh0T99LGA==,iv:DFefjxW8U9YK3kCQUPyxOHsh+ZhUYEj5DfOlKVZePxA=,tag:u7oyKnuVDqkyvzwvsyfV/A==,type:str]
-    matrix:
-        coturn: ENC[AES256_GCM,data:ecDAOVKq9+tJklCJK3ktiWQ6Ky+O5fjr9zS3b3PjwJUyCpIADvVhWBTmFeaVy2ApfuWbugGw8d5wCscpOOy/aw==,iv:p9l9X0UBK2mDpkR9+OX/j+ETYxMdzZhjowzOvA6Uk/Q=,tag:5IC3IsfXg4JmJ+m9F4ehPA==,type:str]
-        registration: ENC[AES256_GCM,data:YnDk7rqVPi3uyzNSBvWLQPb2ZaayNzgubs4Hf0i/CN0hW4ha49AZtkcNka/hVtwTGMI=,iv:Zs7SpAecN8r2Sg7Ih190SUlbH5SLu19BDCUPX9ywYzw=,tag:RLZ6jIgOeFCDwzAu0008yA==,type:str]
-        macaroon: ENC[AES256_GCM,data:YmEJKAZ6dyjBVyvK3Xi68TZtJHUuljAQMhlR6I8vNUOxuP766XYkU/z/YaH3R2rVv9Y=,iv:1/C8Fm2CIpo6Y+YnE80EtWvHfG6cQu/mYd10XjagJdg=,tag:QmtfqZ/3as+4gdF/b2OuxA==,type:str]
-        form: ENC[AES256_GCM,data:rGLJQUMVpOBTCQEqQtiUk3SWitLL1tijBFqVDbohrUspUhTXgRmCQ/0eodhku3RiwcA=,iv:GSxZtwo4/FDRn/dA+L/NQFWcj45KEUSaV2sUL09vqe0=,tag:4dvt57c3Q73B6O/9/UsbNQ==,type:str]
-        signing-key: ENC[AES256_GCM,data:mUY9Fn7TcBPs4HhSpRkj1weFezAzr5ld1xYE8kZcjRNU05MCGLTbPa+av6pYr0HoAaSyzBXmKBBZMQ==,iv:wX092d4eAJ2jLce6Y1EfewxGZsLnwOSce5RJoikCiRg=,tag:Uegzv54CvAI8d0NTz3UesQ==,type:str]
-vaultwarden:
-    #ENC[AES256_GCM,data:wbKsGwBKrJYagX1AvY0o5FHXxOhrfjZ/+crasAh52uOFYGd0P8A7NnyF6JvNgH749dAT9H47DXRKBAclVVSqWPc=,iv:TZgJ7pwyGBpf7S4g7CL2dync2sGNzQ9369atAvLwFJ8=,tag:sxtkPHOmrjUb13zeWPBdng==,type:comment]
-    admin_token: ENC[AES256_GCM,data:TrgqQwXBoCdsLeWQYkur4zS+Z4nCoDDoePnN5vm+AIcgYXVwjxcf/0AwXQIxVNEypYysPpoHKOigwhkf5kLazAMiBZ0goAflJT/S4nOLo90s+9kDCADXWnCeHNhBUg8fUulNPBbpqdfFKCJgJCD2WTI+V5yFLQ==,iv:maKU6pcxis7Cyrx9x26cUTBzA6ZKcKJWSP23w+MDehw=,tag:GYpPHp2slC6V8aKA1FHFAg==,type:str]
-mariadb:
-    photoprism: ENC[AES256_GCM,data:h7TQh5ScGM30e42VSEg6AynwRUPHMRHddJcJotQtDbkFVgmfjHmAHTY22U5jWqjq4KXPN5ItRETLOMw9k9yOgg==,iv:jFTPaXortmiU+8m/NBTYjAXRXHCpD+UE5oeveH7/znk=,tag:3OOUUyHLQJROh5rZcX8bAg==,type:str]
-    freshrss: ENC[AES256_GCM,data:Qjg5GIX13ccZi/DuqtWK0qzr2GK0GzzUdEZWXDhUhGxFWzgosADxDCc8wfOchItaJFefnVrpPxdAPvT+4TEH0g==,iv:oGii3o6sJYVc11kdQMh0Pa3GUbWqttFgjvSVEbTycZc=,tag:8GWWwuJjQBwDFl9pJvg90g==,type:str]
-    huginn: ENC[AES256_GCM,data:/hFQdG/RGrX75qd0+WgwhnwR7p/CEVx1vPksRSudxmc1m4VO/AVzgMCWAz4310ctTEnn4GZinvD6QGFta5IOSA==,iv:mrPDZA6Bnw+SPVDDe64tivvvQtHWvCsPJbEnPqm12g4=,tag:ihXbIJwwtQ0RfaNfcaop4Q==,type:str]
-photoprism:
-    adminPassword: ENC[AES256_GCM,data:QXrDNGSKdRZxc4mfwIhR5cmmmJysGV3cThSFlng3mEviaq0p+BvOa5Thtgw0CxQXdpgjrkui+837NJ/FxPUYvg==,iv:EkutxeDDWfSOVD9p1Ari/rkgf7EwTutDymZQ1uNm6FA=,tag:r3gXuefnIQ+5pPtGZajnZg==,type:str]
-nextcloud:
-    admin: ENC[AES256_GCM,data:DJK+u19VP9cFvq4/P0+f7erXxZkRWI4NRrX9HdHO96xy9wZMtB+hEDN3zLQnkTTtmd2ZLs9+c9BsUNXZperGDQ==,iv:zX8Nxt5+O/mGVt5l1j8IojBkgxg5oDae6KWTXYz0hRE=,tag:MRyMx0OXYTCmtaySP/umNw==,type:str]
-freshrss:
-    chn: ENC[AES256_GCM,data:wwHntnMeiGZ5v8CE7CGV,iv:snIdYdFpvv5HvcR5qucD2pZXXef3dhSU+2wK5SPrDjw=,tag:2RnujKKkQSoxvSNZPLS9Pg==,type:str]
-huginn:
-    invitationCode: ENC[AES256_GCM,data:E8rEdAfUQX9oJEnvxVF5PmYFMd9PN8+K,iv:gZtUf+AkICLHD4h2beHbEfyoL4bcoOv0sivDFDB3vVY=,tag:4tlsPuED6jCXNE0iOayXsg==,type:str]
-grafana:
-    secret: ENC[AES256_GCM,data:O2L0+R9QvOMJLKa941nxn+FeuZ5nOAm1iDlKW2vvk5Dyod0XLdGL1seWuYzpx+NL16qmC1u8jydDcBfUT+PAeA==,iv:Pqsr+POPAr8djdVMK5U4PiS1zUnZXLH3q588D/jOMys=,tag:QziP0kKT5oyI/RHaYHr2mw==,type:str]
-    chn: ENC[AES256_GCM,data:xMwWBYChRIxw5KDjgCYBJWkbRRo5FUtyhZ0+SVRIgjQ=,iv:EIjECQHx3/2t+oMC16B1Xfwa8guiST2pdIKM1hNcuFA=,tag:BP8ElnMevqF6urDgBP/UAg==,type:str]
-peertube:
-    secrets: ENC[AES256_GCM,data:9pm5hD8FdbmFIRZZX5+C0NyXn8qdt0OIlecu79xjVrWd8C6H7C01Uriw5M1qifTIJLDMvJC36Trci0/eniDsEA==,iv:iZ/KiwgFm5TyZBZxo8n9k3Lr3o3Vk+c4zFn9efPtJYw=,tag:HGgoRL1C3Nm/KTHGfq2Ejg==,type:str]
-    password: ENC[AES256_GCM,data:PNrcz2PnGF6WGa7vL5PBWiM03xsA2B2imPiwHpU0IMPN/CMh77eMVtwmoxtl6QkGl1UKb12975NJsfJwJPg9gg==,iv:vjFl6SFNqZhTHmmxRckYAj8nZ1IbFtTfTAxYkdSf/lI=,tag:K2PpVnu+919MddGl5qJn+w==,type:str]
-open-webui:
-    openai: ENC[AES256_GCM,data:E8/Szd4ZFat/R4UW6F4qVEvKmq55sT7mpY6hK274JDCYJgjfQdtJ3gY=,iv:Ryxy19pQsY9pFfz/E4SbBfxYx0N5BXqZtR/Kv9E+0uM=,tag:GEd5+N/ziOncF1UhrwgngQ==,type:str]
-    webui: ENC[AES256_GCM,data:6rpvA80i+HXkDQgYCDIHbXwDfxHq/5tXQRK4piI=,iv:vVIBHf/9LnY1z4zVZGB0ZRBRwLpdXKvNhsYWySxhsiY=,tag:JmbDJKlZ2dH13+drXyXXPg==,type:str]
-nixvirt:
-    yumieko: ENC[AES256_GCM,data:tO+67mdCFH8=,iv:vl+PLSBfMDk7rGmpjuZ8TnEC1B8tni2pphC7cTmxQU0=,tag:RVW5UaUD0g0HDpoGp2/mAA==,type:str]
 sops:
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
@@ -102,7 +27,7 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-07T00:23:06Z"
-    mac: ENC[AES256_GCM,data:Vmcv7Hof4ZR8uXOwbk8zeKSfVldCxJQ696m3mCe6ar5FKpGja0f2XbW8a7tpuYqfwNa5Z7OCovku40PZ/TSmq91hQlZ+zbXe66nPx3/ybbQUSu1rvujprv36kvp1BQwK5A2clLEX7Vo7fGsTq1jX1AFrNM7zTJABrET/7yqVdTE=,iv:IkODPE4AMMLpBNbgwbOpYLWpG7IkRPKVBiLfxKASmPs=,tag:9xfwdCvaWvVey24dLmkFSQ==,type:str]
+    lastmodified: "2025-08-06T04:33:54Z"
+    mac: ENC[AES256_GCM,data:DMLcRc1hDS0x5Gt0WA/6kfEi7KKogeKHBfuW9gndj7fPqCyyYFzW9Mn8mZ3UhWB68c25GtKyLdo9T5yFivS90JB74kEWrQn/Nfdy0wW18BOloiRwLdSipoADwYwpJtr+JGNs9R6AqIAoDcbVJrr4q6kZh/Cjue6TJiyBdI4uirU=,iv:YOn7XzKAKtzucq6h0yAgj+Ee6L3srscnvieCOmZjBeo=,tag:lnAfv2pWVf5czeTgL4donQ==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -0,0 +1,35 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      model = { type = "desktop"; private = true; };
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-partlabel/one-boot" = "/boot";
+            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          luks.auto."/dev/disk/by-partlabel/one-root" = { mapper = "root"; ssd = true; };
+          swap = [ "/nix/swap/swap" ];
+          resume = { device = "/dev/mapper/root"; offset = 4728064; };
+        };
+        nixpkgs.march = "tigerlake";
+      };
+      hardware.gpu.type = "intel";
+      services =
+      {
+        xray.client = {};
+        beesd."/".hashTableSizeMB = 64;
+        sshd = {};
+        waydroid = {};
+      };
+      bugs = [ "xmunet" ];
+    };
+    specialisation.niri.configuration.nixos.system.gui.implementation = "niri";
+  };
+}
--- a/devices/one/secrets.yaml
+++ b/devices/one/secrets.yaml
@@ -0,0 +1,32 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:GmfSlDQjO4aBq3u50jnFjOR9VxamYHzokUrO9IpIGuBx0j8e,iv:++O2wBUCnHDPowRgtxPQJQePXP2Cda74WXQvlKHbHNw=,tag:XDWhiXwT718RgrBw7L5yzw==,type:str]
+wireguard: ENC[AES256_GCM,data:OuduClOu9y9adCcV1+U/NLp/t1yWPkuyptproTJv4beImptrLOVGbhb5fb8=,iv:qa1jpzAlUEhPBznZw6j4CYquTCpmNZ+uNbyHjH2qGy4=,tag:+5I2CRuyCAMSy74xVtdJGA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOUJWMm5xT040cEoxQit5
+            ZnhhQWVyWjlnejhzQlEvVVg3ZGVJb05iL1hjCnF5bzFTUTZFYkNQR0k5U0xmOW1t
+            TXhsRHFIeVBBSXc1UURON2M4MDlTMEUKLS0tIGdSbTdZdmdjY0dmNjkrRjd0VkhK
+            eWV6SDJqT1B2MEp1MURkV0E4S3Z0Zm8KX9lEjG4u2QRe1zH+13rbedCWl1B7vvl8
+            2iMHj1qQ4JkCeq83llEH5IuDXKYnKKXSi8l3nU/l6Aw6yx/KHDFK/g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2K3VKTVJqMTl2cWxUZHhM
+            OVg5ZjN0VGNpVXQ5M1FKZHloZ0ZnWTZ2ZWowCjJIYTlhRU8wd1JienlUTHIwWXYw
+            eFY1d2MxeStBd013VmszbTUzTkF6U2cKLS0tIDdDNXp4OTdQRjN0MGdIOS9oSldU
+            ZW5PT3VYZWhDMkZUeHViZE41eUhna2sKc8J8mJ8ge9KMb5p6Xi/vRIIXZMEj6Ih+
+            LjLKsgDfMbqNqKaQXSvC3tbvI/dDoiStyCsf4rkTY9QOkyEI80MtXg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-10T10:44:01Z"
+    mac: ENC[AES256_GCM,data:Sso6g9UEH7faygbcrypsnB/4h8cIwveLdVI+YgDDfTHMC5nxXj+xtfFHhzao1pkyvF0avUVjsMVXLRcB48eDcbZdXwBvoNKg0mpL7VAeOnDuwElI6GGpRVTaOsZC9LT9d1kuGkmavMljCvmaA3sPLZsvW3Hqjdicj+suMoQJ/nE=,iv:DYf0m9PfJ1qx3gI/6T6ByxJWHrdVGgiNMCVhcBOrgBw=,tag:Ddw2HFuCmk6PFnxF4G13hQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -11,28 +11,53 @@ inputs:
        {
          mount =
          {
-            vfat."/dev/disk/by-partlabel/pc-boot" = "/boot";
-            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            vfat."/dev/disk/by-uuid/7A60-4232" = "/boot";
+            btrfs."/dev/mapper/root1" =
+            {
+              "/nix" = "/nix";
+              "/nix/rootfs/current" = "/";
+              "/nix/remote/jykang.xmuhpc" = "/data/gpfs01/jykang/.nix";
+              "/nix/remote/xmuhk" = "/public/home/xmuhk/.nix";
+            };
+            nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.nas"}:/" =
+              { mountPoint = "/nix/remote/nas"; hard = false; };
          };
-          luks.auto."/dev/disk/by-partlabel/pc-root1" = { mapper = "root1"; ssd = true; };
+          luks.auto =
+          {
+            "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root1"; ssd = true; };
+            "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
+              { mapper = "swap"; ssd = true; before = [ "root1" ]; };
+          };
+          swap = [ "/dev/mapper/swap" ];
        };
        grub.windowsEntries."08D3-10DE" = "Windows";
-        nix.marches =
-        [
-          "znver2" "znver3" "znver5"
-          # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
-          "broadwell"
-          # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-          "skylake" "cascadelake"
-          # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT PCONFIG PREFETCHW PTWRITE RDRND
-          # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
-          "alderlake"
-        ];
-        nixpkgs.march = "znver4";
+        nix =
+        {
+          marches =
+          [
+            "znver2" "znver3" "znver4"
+            # FXSR SAHF XSAVE
+            "sandybridge"
+            # FXSR PREFETCHW RDRND SAHF
+            "silvermont"
+            # SAHF FXSR XSAVE RDRND LZCNT HLE
+            "haswell"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+            "broadwell"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+            "skylake" "cascadelake"
+            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
+            "tigerlake"
+            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+            "alderlake"
+          ];
+          remote.master.host.srv2-node0 = [ "skylake" ];
+        };
+        nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
        sysctl.laptop-mode = 5;
-        kernel.variant = "xanmod-latest";
      };
-      hardware.gpu.type = "amd";
+      hardware = { gpu = { type = "nvidia"; nvidia.dynamicBoost = true; }; legion = {}; };
      services =
      {
        samba =
@@ -47,15 +72,16 @@ inputs:
          };
        };
        sshd = {};
-        xray.client.dnsmasq =
+        xray = 
        {
-          hosts = builtins.listToAttrs
+          client.dnsmasq.hosts = builtins.listToAttrs
          (
            (builtins.map
              (name: { inherit name; value = "144.34.225.59"; })
              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
-          );
-          extraInterfaces = [ "wlo1" ];
+          )
+          // { "4006024680.com" = "192.168.199.1"; };
+          xmuClient = {};
        };
        nix-serve = {};
        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
@@ -69,23 +95,58 @@ inputs:
            name = "pc"; address = "127.0.0.1";
            cpu = { sockets = 2; cores = 8; threads = 2; };
            memoryGB = 80;
+            gpus."4060" = 1;
          };
          partitions.localhost = [ "pc" ];
-          tui.cpuQueues = [{ mpiThreads = 4; openmpThreads = 4; memoryGB = 56; }];
+          tui =
+          {
+            cpuQueues = [{ mpiThreads = 4; openmpThreads = 4; memoryGB = 56; }];
+            gpuQueues = [{ name = "localhost"; gpuIds = [ "4060" ]; }];
+          };
        };
        ollama = {};
        podman = {};
        ananicy = {};
        keyd = {};
+        lumericalLicenseManager = { macAddress = "74:5d:22:c7:d2:97"; autoStart = false; };
+        searx = {};
        kvm.aarch64 = true;
-        peerBanHelper = {};
-        mariadb.mountFrom = "nodatacow";
-        lumericalLicenseManager.macAddress = "10:5f:ad:10:3e:ca";
+        nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
+        nfs."/" = [ "192.168.84.0/24" ];
      };
-      bugs = [ "xmunet" "amdpstate" "iwlwifi" ];
-      packages = { mathematica = {}; vasp = {}; lumerical = {}; };
-      user.users = [ "chn" "xly" ];
+      bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
+      packages = { mathematica = {}; vasp = {}; android-studio = {}; lumerical = {}; };
    };
+    boot.loader.grub =
+    {
+      extraFiles =
+      {
+        "DisplayEngine.efi" = ./bios/DisplayEngine.efi;
+        "SetupBrowser.efi" = ./bios/SetupBrowser.efi;
+        "UiApp.efi" = ./bios/UiApp.efi;
+        "EFI/Boot/Bootx64.efi" = ./bios/Bootx64.efi;
+        "nixos.iso" = inputs.topInputs.self.src.iso.nixos;
+      };
+      extraEntries = 
+      ''
+        menuentry 'Advanced UEFI Firmware Settings' {
+          insmod fat
+          insmod chain
+          chainloader @bootRoot@/EFI/Boot/Bootx64.efi
+        }
+        menuentry 'Live ISO' {
+          set iso_path=@bootRoot@/nixos.iso
+          export iso_path
+          search --set=root --file "$iso_path"
+          loopback loop "$iso_path"
+          root=(loop)
+          configfile /boot/grub/loopback.cfg
+          loopback --delete loop
+        }
+      '';
+    };
+    # 禁止鼠标等在睡眠时唤醒
+    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
    # 允许kvm读取物理硬盘
    users.users.qemu-libvirtd.extraGroups = [ "disk" ];
    services.colord.enable = true;
--- a/devices/r2s/default.nix
+++ b/devices/r2s/default.nix
@@ -1,30 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      model.arch = "aarch64";
-      system =
-      {
-        fileSystems =
-        {
-          mount.btrfs."/dev/disk/by-partlabel/r2s-root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          swap = [ "/nix/swap/swap" ];
-        };
-        network = {};
-        # uboot 起始位置 0x8000 字节，这个地方还在分区表内部；除此以外还需要预留一些空间，预留32M足够。
-        uboot.buildArgs =
-        {
-          defconfig = "nanopi-r2s-rk3328_defconfig";
-          filesToInstall = [ "u-boot-rockchip.bin" ];
-          env.BL31 = "${inputs.pkgs.armTrustedFirmwareRK3328}/bl31.elf";
-        };
-      };
-      services =
-      {
-        sshd = {};
-      };
-    };
-  };
-}
--- a/devices/srv1/default.nix
+++ b/devices/srv1/default.nix
@@ -59,9 +59,8 @@ inputs:
            { name = "n1"; mpiThreads = 8; openmpThreads = 4; }
          ];
        };
-        mariadb.mountFrom = "nodatacow";
      };
-      packages.vasp = {};
+      packages = { vasp = {}; lumerical = {}; };
      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" "zgq" ];
    };
  };
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -27,12 +27,8 @@ inputs:
        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
      };
-      packages =
-      {
-        desktop = {};
-        packages._prebuildPackages =
-          [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
-      };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
    };
  };
 }
--- a/devices/srv2/default.nix
+++ b/devices/srv2/default.nix
@@ -12,6 +12,8 @@ inputs:
          vfat."/dev/disk/by-partlabel/${clusterName}-${nodeName}-boot" = "/boot";
          btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root1" =
            { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc"}:/" =
+            { mountPoint = "/nix/remote/pc"; hard = false; };
        };
        nixpkgs.cuda.capabilities =
        [
@@ -19,8 +21,6 @@ inputs:
          "6.1"
          # 2080 Ti
          "7.5"
-          # A30
-          "8.0"
          # 3090
          "8.6"
          # 4090
@@ -74,13 +74,12 @@ inputs:
            ];
          };
        };
-        mariadb.mountFrom = "nodatacow";
      };
-      packages = { vasp = {}; desktop = {}; lumerical = {}; };
+      packages.vasp = {};
      user.users =
      [
        # 组内
-        "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "qmx" "xly"
+        "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "qmx"
        # 组外
        "yxf" # 小芳同志
        "hss" # 还没见到本人
--- a/devices/srv2/node0/default.nix
+++ b/devices/srv2/node0/default.nix
@@ -7,7 +7,7 @@ inputs:
      model.cluster.nodeType = "master";
      system =
      {
-        nixpkgs.march = "icelake-server";
+        nixpkgs.march = "skylake";
        network =
        {
          static.eno2 = { ip = "192.168.178.1"; mask = 24; };
@@ -15,19 +15,11 @@ inputs:
          trust = [ "eno2" ];
        };
        nix.remote.slave = {};
-        fileSystems =
-        {
-          swap = [ "/dev/disk/by-partlabel/srv2-node0-swap" ];
-          mount.btrfs."/dev/disk/by-partlabel/srv2-node0-root1" =
-          {
-            "/nix/remote/jykang.xmuhpc" = "/data/gpfs01/jykang/.nix";
-            "/nix/remote/xmuhk" = "/public/home/xmuhk/.nix";
-          };
-        };
+        fileSystems.swap = [ "/dev/disk/by-partlabel/srv2-node0-swap" ];
      };
      services =
      {
-        xray.client.dnsmasq = { extraInterfaces = [ "eno1" "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; };
+        xray.client = { dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; }; };
        beesd."/" = { hashTableSizeMB = 16 * 128; loadAverage = 8; };
        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
@@ -36,7 +28,6 @@ inputs:
        ollama = {};
        sshd = { groupBanner = true; motd = true; };
        speedtest = {};
-        lumericalLicenseManager.macAddress = "70:20:84:09:a3:52";
      };
    };
  };
--- a/devices/srv2/node1/default.nix
+++ b/devices/srv2/node1/default.nix
@@ -15,11 +15,7 @@ inputs:
        };
        fileSystems.swap = [ "/nix/swap/swap" ];
      };
-      services =
-      {
-        beesd."/".hashTableSizeMB = 64;
-        lumericalLicenseManager.macAddress = "04:42:1a:26:0c:07";
-      };
+      services.beesd."/".hashTableSizeMB = 64;
    };
    services.hardware.bolt.enable = true;
  };
--- a/devices/srv2/node2/default.nix
+++ b/devices/srv2/node2/default.nix
@@ -1,43 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      model.cluster.nodeType = "master";
-      system =
-      {
-        nixpkgs.march = "skylake";
-        network =
-        {
-          static.eno2 = { ip = "192.168.178.1"; mask = 24; };
-          masquerade = [ "eno2" ];
-          trust = [ "eno2" ];
-        };
-        nix.remote.slave = {};
-        fileSystems =
-        {
-          swap = [ "/dev/disk/by-partlabel/srv2-node2-swap" ];
-          mount.btrfs."/dev/disk/by-partlabel/srv2-node2-root1" =
-          {
-            "/nix/remote/jykang.xmuhpc" = "/data/gpfs01/jykang/.nix";
-            "/nix/remote/xmuhk" = "/public/home/xmuhk/.nix";
-          };
-        };
-      };
-      services =
-      {
-        xray.client.dnsmasq = { extraInterfaces = [ "eno1" "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; };
-        beesd."/" = { hashTableSizeMB = 16 * 128; loadAverage = 8; };
-        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
-        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
-        groupshare = {};
-        hpcstat = {};
-        ollama = {};
-        sshd = { groupBanner = true; motd = true; };
-        speedtest = {};
-        lumericalLicenseManager.macAddress = "70:20:84:09:a3:52";
-      };
-    };
-  };
-}
--- a/devices/srv2/node2/secrets.yaml
+++ b/devices/srv2/node2/secrets.yaml
@@ -1,34 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:j2R0UtfS/es2A+Ic+Kq6FZJSqXlA/Q8tGkuAIX0ZdTsV4hGk,iv:Ovpr49isIJRdUyM3jxgiT+9Sc+qTF6ZnkKUwxIq6KUs=,tag:2VRSkiPNWaOmCqLJti8Bzw==,type:str]
-wireguard: ENC[AES256_GCM,data:TEi3LAZA0BaPxeXA1yFMD6fQPRKSndVyAzNycCD/5CYXmNVyO7zv4o23ahg=,iv:tEKFPyuqmpsWf0vDoSaw4Ai6S5DzacZFA4otNgnknxY=,tag:qZJzr/Yyoex2hDfVtT6nYA==,type:str]
-mariadb:
-    slurm: ENC[AES256_GCM,data:9wLQ1zF/kDaiw0s3UaRpiHgmngU7u6hwyqpddSjev0+Z0v58Q2oiJtK8vn+2VlSxx5ACfqEFbzp0PZYAxd575w==,iv:q9JTkgDymOwkbZ/PaxRAAQrtO96QmGgZcQuLTFCMoS4=,tag:dwOHlOTgZqT/1jQ+oGf7UQ==,type:str]
-hpcstat:
-    key: ENC[AES256_GCM,data:+Z7MRDkLLdUqDwMrkafFKkBjeCkw+zgRoAoiVEwrr+LY0uMeW8nNYoaYrfz6Ig8CMCDgX3n/DMb0ibUeN32j3HShQIStbtUxRPGpQMyH+ealbvgskGriTFpST4VPyQxNACkUpq/e+sh2CmLbKkSxhamkjKOXwsfqrBlgVbEkp7u7HkWGuAaYL1oPGt0Q94fWXwH0UVhRYZYQ2iFA/S6SEZY8gxaTIGDKUdWU9+fOHzPQ5WfhxtKYU4p4ydyfYsAt6ffqnPSx/SI72GsUCOJ4981JX8TuvnEzx3gQLVFYheK6NibTWCy6eODbvguieVOTHSvCPTrHmoP12lHVWU2kKzLwv70Jl7sXyzKHYROG0D+/z/4DKlNeotKM/IA0q2cST08/lwSKN7WDDmrt+O6xXhvwby28ZYKEsSvvrfV+VIKzHPl84ZKbUEX5xv/GHc3THfznUvKKz5PzDiqrkjCkEt5PRMsVW9A6MU1+QEUr+sXLLtcUd2CCL87c8CpwNHJx1us6vJ4ji1gu0PGoT+60,iv:yU6j9W2Hs2D34uHMJqqPFbNy2pNEZY2kzXoNdhPMSmA=,tag:TNvEfMVrhu7HrNxY8qe5mg==,type:str]
-wireless:
-    #ENC[AES256_GCM,data:n9OPSJsB7yNk,iv:xQzKJxqPB7uT83m/B4UoOje6NQbPLhuHR7Hp93oNz8A=,tag:gtsTx6ALnS/7fIDd7VimOg==,type:comment]
-    409的5G: ENC[AES256_GCM,data:K9wm3zedoil7jHgTcb+VmbdbkG2dgrMdr3BmDRUHDVADqLANMvnUMSecggYTO4HaiI9q6uv2/BSkluanD5K4Dw==,iv:7dGET3ULKlnaDMVmkuXDek+hQPLZ2VUbPqvEOX+5jlQ=,tag:MBGmQ0NNNqX+T9EsBiWCaw==,type:str]
-sops:
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Rmc2Ull1WFB4Smh3c0Zl
-            emlTNGJKZkpIK2JFeUNVeUcrR2FzRXRQZHlvCkhzMHpzYmZRZ0M0cXdRVi8wZmp6
-            ZDRZQ2FkOWt6M0lrdjBHa3VTWXBDKzgKLS0tIGtJbTRRelg1VVk2QStwdzlFM1g4
-            M1JOd1g3cVdjUFRhZ0FxcWphZXZJbkkKFXDtJVoi+qIrXp6cznevuZ+peBiRRITP
-            rrplqLiYsNIGKmKYtRIUu8WXDZ2q2CJ8Z+pka3W3H/U+m957hBDWyw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSHdka3FPQUYrcXQzcTFo
-            a000TUllT0MvUzk5ZzVFbXZheG9ZVTM2S253CkE5VW9tQktvL2pMWFoxcnFjTGpr
-            Z0p1RjZWRGpSZ01TdTZRcEJXM2NOUkUKLS0tIC9rNmNzWitMdEd5dXQvdWlELzhM
-            M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
-            LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-12T04:13:47Z"
-    mac: ENC[AES256_GCM,data:W+e5d1scvV24AdVdl7Pisp9HxsXQ/tPjN2NV/Bd0RXZNBRB7LNQrSfk1GadboBnihW0ctAQOFk66PZsxwE2czfFL2/yzFxm9Cf11Mc822ZL3BwjnQBK4uR9LJrbjL7x1lFUk9v0AIPhjrir8F6dcX8mq6++hHNN0wjGaH3J9E0Y=,iv:RK7e4Dxog+Qsgk6gxK0f8PN8oF9bjWIrTyYK67Cdras=,tag:QSKsETYXbhnvhhjavP4UiA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2
--- a/devices/srv3/README.md
+++ b/devices/srv3/README.md
@@ -0,0 +1,101 @@
+# 定价与配置
+
+售卖两类 kvm 虚拟机。它们都按照需求的内存和硬盘定价。
+
+## 普通虚拟机
+
+* 硬盘每 10 GB 0.056 美元每月；内存每 128 MB 0.044 美元每月。每 1G 内存附带 1 核心 CPU，内存不够 1G 的给 1 核心 CPU。
+  * 例如，4C4G/100G 的配置，每月 2 美元。
+  * 这个价格相当于母鸡价格的 70% 。
+* 适合绝大多数轻度负载。不适合的情况包括：
+  * 硬盘需要禁用 CoW 以获得尽可能高的 IOPS，例如较大的、繁忙的数据库（例如大型 mastodon/misskey 实例）。
+  * 希望内存中的数据一直驻留在内存中（而不是被交换到 swap 中）。
+* **可能会超售**，但我凭良心保证，当你需要时，仍然可以占满内存和硬盘；长期占满硬盘和内存不算滥用。
+  * 前期肯定不会超售（笑死，根本没有那么多用户）。
+  * 永远不会滥售；但后期可能会视情况调整价格。如果涨价，会延迟三个月生效。如果降价则立即生效。
+  * 万一出现卖超太多了、不够用的情况，我会自掏腰包增加母鸡配置。
+* 实现细节：
+  * 硬盘会使用 raw 格式，放置在启用 CoW 的 btrfs 子卷中；不预先分配，用到时再分配。
+  * 内存会允许交换到 swap 中，并开启 KSM。
+* 限购：
+  * 每台内存不能超过 8 GB，硬盘不能超过 200 GB。有更大的需求请买下一个配置。
+  * 每个用户只能购买一台。
+  * 这个限购措施是为了防止有人和我抬杠，花 70% 的价格把整个母鸡买下来。并不是营销手段。合理需求的情况都可以谈。
+* 宿主机会自动创建快照，需要时可以回滚到几个小时或几天前的状态。
+
+## 独立虚拟机（资源独立分配）
+
+* 按照母鸡价格的 1 倍定价。也就是：硬盘每 100 GB 0.8 美元每月；每 5G 内存/2 CPU 2.5 美元每月。
+* 实现细节：
+  * 硬盘会使用 raw 格式，放置在禁用 CoW 的 btrfs 子卷中；预先分配所有容量。
+  * 内存会锁定在物理内存中。
+  * CPU 会隔离/锁定在物理 CPU 上。
+* 宿主机不会创建硬盘的快照。
+* 两类资源可以混合购买。比如可以硬盘按照独立虚拟机的价格购买，内存/CPU 按照普通虚拟机的价格购买。
+
+## 其它细节
+
+* 无论哪个方案，硬盘/内存长时间占满都不算滥用。对于第一个方案，CPU 是共享的，请不要长时间占满。
+* 暂不限制带宽，合理使用即可。
+* 默认共享 IPv4，支持端口转发（详见下文说明）。独立的 IPv4 每个每月 2 美元。
+  独立的 IPv6 免费，但暂不支持（技术上没有准备好，如果有人有需要我就去准备）。
+* 只卖朋友和朋友的朋友（总之得有人保证别拿去做坏事）。
+  若此定价对您来说仍然难以接受，可以联系我，打五折或者免费。
+* 此价格 2025 年 9 月 17 日前有效。之后大概率也不会调整，但保留调整的权利。
+* 预计收入无法覆盖成本。如果某个月的收入高于成本，承诺会将多出的部分捐出去。
+* 非 kvm 虚拟机的服务（例如，只跑一个 podman 容器，只跑某一个服务）定价私聊，大致上是上方价格再加上我的工作成本（事少的免费，事多的就要实收了）。
+* 配置随时可以调整。所以按照自己这个月够用的来就行，不需要为未来留余量。但每次调整都需要重启虚拟机。
+* 母鸡价格 40 美元每月，配置在下方列出。
+  * 机房: LAX3 （IP：srv3.chn.moe）
+  * CPU: Intel® Xeon E5-2650L v3 (12 Cores 24 Threads)
+  * Memory: 64GB ECC DDR4
+  * Storage: 1TB NVMe (可加，8 美元/TB，另有 NFS 3 美元/TB)
+  * Network: 1Gbps, 1x IPv4 (可加，2 美元/IPv4), 8TB/month
+
+# 操作
+
+我不提供网页端的控制面板（因为懒得搞，要是有人想替我搞的话那就提供）。
+
+在确认购买后，我会给你一个 VNC 端口和密码。虚拟机会首先启动到 netboot.xyz，你需要登陆 VNC 选择自己喜欢的发行版并安装。
+安装好系统之后，VNC 连接仍然可以使用，你可以使用它来重装系统等。如果你担心安全性，也可以告知我，将它关闭。
+
+此外，我还可以提供一个宿主机的账户（SSH 连接），用于强制重启虚拟机等（会做好权限的分隔的）。若有需要请告知我。
+
+# 共享 IP
+
+支持多种转发策略。
+
+* TCP/UDP 端口转发，就是最普通的转发。
+  这个方法只有一个坏处，就是多个虚拟机不能共享同一个公网 IP 的同一个端口。
+  这导致用户在访问时往往需要明确端口号而不能使用默认端口（因为默认端口已经被占用了），
+    例如需要使用 https://srv3.chn.moe:4321 而不是 https://srv3.chn.moe。
+  建议不面向普通用户的服务使用这个方法（例如，ssh，coturn，等）。
+* 利用 Nginx，根据一些信息分流再转发给虚拟机。这可以做到多个虚拟机共享同一个端口，但也有缺陷。具体来说，它有很多种方法：
+  * 依据 SNI 分流，并透明代理到虚拟机。
+    这个办法的缺点是，只支持 TLS 连接（例如 https），同时服务端看到的用户侧端口会变化（通常情况下不影响什么）。
+    只要这两个缺点不是问题，就建议用这个方法。
+  * 依据 SNI 分流，并使用代理协议（proxy protocol）转发给虚拟机。
+    相比于上一个方法，这个方法可以正确传递用户侧端口号，但需要虚拟机的服务端支持 proxy protocol。
+  * Nginx 依据 http 的 host 头分流，再发给虚拟机。
+    这个方法的缺点有很多，例如我需要修改你的域名的 DNS（用来申请证书），母鸡到虚拟机的连接不加密，只支持 http/https，等。
+    这个方法唯一的好处是，如果你不会配置 nginx，可以在宿主机上配置好，虚拟机只要跑后端的服务就行了。
+* 别转发了，直接在宿主机上处理。例如 80 到 443 的跳转。以及如果你想要 host 一个小的、不常改动的静态网站，等。
+
+# 杂项
+
+**如何调整虚拟机启动顺序（重启到 iso 而不是硬盘）？**
+
+先重启虚拟机，然后马上连接 VNC，可以看到“Tiano Core”的提示。这个提示只会停留 15 秒，所以重启虚拟机后要迅速连接 VNC。
+在这个界面按 ESC 就可以进入虚拟机的 BIOS，在这里可以修改虚拟机的一些设置（就像实体机的 BIOS 那样）。
+如果只是想临时从 ISO 启动，可以在这里选择“Boot Manager”，然后选择带 “CDROM” 那一项就可以了。
+
+**如何调整硬盘大小？**
+
+* 扩容：你需要在扩容**后**将分区和文件系统调整大（占用虚拟磁盘在末尾新增的空间）。
+* 缩容：你需要在缩容**前**将分区和文件系统调整小（在虚拟磁盘的末尾预留出要缩容的空间）。
+
+这些事情都最好你自己来做。我可以尝试帮忙，但不保证数据安全。
+
+**如何强制重启虚拟机/关机后如何开机？**
+
+登陆宿主机后，使用 `vm` 命令，不加任何参数，即可看到提示，按提示操作。
--- a/devices/srv3/default.nix
+++ b/devices/srv3/default.nix
@@ -0,0 +1,125 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      model.type = "server";
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-partlabel/srv3-boot" = "/boot";
+            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+        };
+        nixpkgs.march = "haswell";
+        initrd.sshd = {};
+        network =
+        {
+          bridge.nixvirt.interfaces = [ "eno1" ];
+          static.nixvirt =
+          {
+            ip = "23.135.236.216";
+            mask = 24;
+            gateway = "23.135.236.1";
+            dns = "8.8.8.8";
+          };
+        };
+      };
+      services =
+      {
+        beesd."/" = { hashTableSizeMB = 128; threads = 4;};
+        sshd = {};
+        nixvirt.instance =
+        {
+          pen =
+          {
+            memory.sizeMB = 512;
+            cpu.count = 1;
+            network =
+            {
+              address = 3;
+              portForward =
+              {
+                tcp =
+                [
+                  { host = 5690; guest = 22; }
+                  { host = 5691; guest = 80; }
+                  { host = 5692; guest = 443; }
+                  { host = 22000; guest = 22000; }
+                ];
+                udp = [{ host = 22000; guest = 22000; }];
+                web = { httpsProxy = [ "natsume.nohost.me" ]; httpProxy = [ "natsume.nohost.me" ]; };
+              };
+            };
+          };
+          test =
+          {
+            owner = "chn";
+            memory.sizeMB = 4096;
+            cpu.count = 4;
+            network =
+            {
+              address = 4;
+              vnc.openFirewall = false;
+              portForward =
+              {
+                tcp = [{ host = 5693; guest = 22; }];
+                web = { httpsProxy = [ "example.chn.moe" ]; httpProxy = [ "example.chn.moe" ]; };
+              };
+            };
+          };
+          reonokiy =
+          {
+            memory.sizeMB = 4 * 1024;
+            cpu.count = 4;
+            network = { address = 5; portForward.tcp = [{ host = 5694; guest = 22; }]; };
+          };
+          yumieko =
+          {
+            memory.sizeMB = 8 * 1024;
+            cpu.count = 8;
+            network =
+            {
+              address = 6;
+              portForward =
+              {
+                tcp = [{ host = 5695; guest = 22; }];
+                web = { httpsProxy = [ "littlewing.yumieko.com" ]; httpProxy = [ "littlewing.yumieko.com" ]; };
+              };
+            };
+            storage.iso = "${inputs.topInputs.self.src.guix}";
+          };
+        };
+        rsshub = {};
+        misskey.instances =
+          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
+        synapse.instances =
+        {
+          synapse.matrixHostname = "synapse.chn.moe";
+          matrix = { port = 8009; redisPort = 6380; };
+        };
+        vaultwarden = {};
+        photoprism = {};
+        nextcloud = {};
+        freshrss = {};
+        send = {};
+        huginn = {};
+        httpapi = {};
+        gitea = {};
+        grafana = {};
+        fail2ban = {};
+        xray = { server = {}; xmuPersist = {}; };
+        podman = {};
+        peertube = {};
+        nginx.applications.webdav.instances."webdav.chn.moe" = {};
+        open-webui.ollamaHost = "192.168.83.3";
+      };
+      user.users = [ "chn" "aleksana" "alikia" "pen" "reonokiy" "yumieko" ];
+    };
+  };
+}
--- a/devices/srv3/secrets.yaml
+++ b/devices/srv3/secrets.yaml
@@ -0,0 +1,112 @@
+wireguard: ENC[AES256_GCM,data:Coe4iIEnJVDb4a9KUVTRkXl4kng5Zo6x1Iyr0ErgR2b9bN287mvO6jPUPSc=,iv:fiNUUKobJjitcoxBemIah5Cl5+dSz2Q7sbiOT8bDrRM=,tag:rHfNeRGTxnyVYAu8P/2ewA==,type:str]
+nixvirt:
+    pen: ENC[AES256_GCM,data:okvzUul3UXk=,iv:hcBhsUMP8jdhhKuKdHD1lZi8ixNAC729HfMQ79UzyNk=,tag:SRRav39ScHn0O/sf86CIOw==,type:str]
+    test: ENC[AES256_GCM,data:MYlMmzgbW9c=,iv:q1qPAwFTh0fj2IHBIlnrOMbTU2BnwIYzOFUHVqWCY/Q=,tag:Mb2bJJemg/LxpKI5whNvQw==,type:str]
+    reonokiy: ENC[AES256_GCM,data:J/ZM0Vavmnk=,iv:ZT1cMF/JWLWmXyBx331XkBQerOhLJeOd0a53jcSC4S4=,tag:/WCwzOg5LlAS5ZaiI5DSIw==,type:str]
+    yumieko: ENC[AES256_GCM,data:Nugm6tP4jxg=,iv:HweUreniPs3eDs1ucu/G/P/JZ4jfSaOAiLD2o5WeOUo=,tag:eoc1cVG7CD5WFoawDUUpnw==,type:str]
+nginx:
+    detectAuth:
+        chn: ENC[AES256_GCM,data:cek6iIlJXgU191uzq44rTw==,iv:r7aMj5UzH1sbKkxvS8oyw6kpIcpRygD4ype8qkmnNa0=,tag:x2jWZnnFCO0sHj/OS2BQbA==,type:str]
+        led: ENC[AES256_GCM,data:JiCmbknE,iv:Z2RFOWIPUk2jaR6qd4PgRb7LwwHSKNapPQq996Mx+yI=,tag:mq6Vtwjw31DKig3Dl4xU+w==,type:str]
+redis:
+    rsshub: ENC[AES256_GCM,data:+wEclSJGMLBMt7Ss2fMlUgq5kRyNiOheQnRvVtbW47eG2mFODBaw04Qftb80aaSE6YpCTNslBGdIjcpIC7FTUA==,iv:6Caod/1AnUxEEC7ZwVrtDZ1kP6Qu50R+9I3eda/p0pk=,tag:/EYXZ6yl3QupVrzIHQMdbA==,type:str]
+    misskey-misskey: ENC[AES256_GCM,data:nCrH0B3A5B6yMAgTd5TA56PKqJUxwtHeS6BvuUseyKAVbqH581TGsO80mNQ0AJRjviw5o3ftTay79nJnmGld6Q==,iv:fhGcgbpNBo9yUpFDWtuzMos2iPhMdWyc88S0fZDxGao=,tag:QIZ72z5VBqd5pFgaEvMTZg==,type:str]
+    misskey-misskey-old: ENC[AES256_GCM,data:WS+SVmxYs3cNc/+sJQLNYDO0ZkZvmqzW9hCGdDae/N06KGicgiGOKV8LDe1UviGGGzXzB5VG0YvAprEGhUURcQ==,iv:6Ur9FL2+RzU4tfK2V4TaaCpempS1JSSMHz6ebg3mp7c=,tag:qCNqJ3SauPdpxo3f4NVg2g==,type:str]
+    nextcloud: ENC[AES256_GCM,data:pwxtefU7CjTxyogcpPpvQxvdnYIpggaBHZ+/PaT9lhVfvFcNtBBZ1eeOGbUXMZc7BnkFAUDVTVjr5KV75CeX6Q==,iv:65K3PsNfesaAJ7rSRI66o5UEM3SW5KdUnGc4h9WMkUE=,tag:e2nx9vTlkGekvhm8lYsMkg==,type:str]
+    send: ENC[AES256_GCM,data:QCfqbGYuBrlwfuHiSsZIZ1OBVnSO9QjhlPWGVRysKbQK+As/RGbJ5QYtPOyKfRg2L1d5Irfu1aGRoVrzpA8O1Q==,iv:MWzJP+JBwf131X030MnzNKMJ3d4Fq/GtbHpuan4N53Y=,tag:z29HS/FQXTvgN1e1HZFJkg==,type:str]
+    synapse-synapse: ENC[AES256_GCM,data:C6eXXK6SvMmvIa8dVjttorYBScC1SfILqXPMYDCpewVyJCUFzQK3NB8KUz9TMov4P5n+Lm5YItjrUgnhNJA5jQ==,iv:ziJ5JK/+M9d+R6/O/4hQy5DPBw/4XSZVQvIcy55aHRY=,tag:nv0rre2/kyhKu4C5JSE5dg==,type:str]
+    synapse-matrix: ENC[AES256_GCM,data:E72t568kxMjz+x+nC0kIJJFfgt6njlW8Wx6RuqnI736vW7IaA7scNVQ03lXpqZlKS1M7wUhb1QRPowJxNjSK7A==,iv:5qGHIWb7XXrnbjPQVWt+EcX/yDEV4Ny+TIo5OaRHwOk=,tag:O+SQBmZ7xpToSJYmcSCRWA==,type:str]
+    peertube: ENC[AES256_GCM,data:lxf5JtlGfDsYY2kzqaas8zPmS3u7Xch6onLVe2yoQZL6Eeb94V8yncqezGFcsGv1k3Xfr4ncoEraupO3RtKYSw==,iv:VM3SAORs2Ol/WKYCffLlHNPAzA37Kp2fgToM1faS7Ew=,tag:gwI80Kn00QOU+9vRsUKchQ==,type:str]
+postgresql:
+    misskey_misskey: ENC[AES256_GCM,data:BUHwrGGcniD/7+hSHkXegopgG1bRGSt+OXJxKdMOEyeawAkG96af+njJ+WgcZ6KAzQdWtqJATdiTOxpznkvKfA==,iv:9hF/jcGyWFNPzzqVyaVXEabeaGDE92bpVYq1oxvQGOY=,tag:nZObCyAfuMr+B+rlUhCMMA==,type:str]
+    misskey_misskey_old: ENC[AES256_GCM,data:saLuu3wFcqRW2yNF9aZZ4zc6njm6pqqcUUqRTbijXELvZwMy+G+OMKuvgsh71NLDJiNDZdOBAOdUUXlC+okBFQ==,iv:kcHjlpndXENhASkenLN8fNLJjHmcuLN+i7+a+fLjxyU=,tag:Sbr74hl4GsCts2Diw8veRw==,type:str]
+    synapse_synapse: ENC[AES256_GCM,data:NfXD6BHV9za79NW1kLvJjdOLeHjtcrzx9O9W65jgHYneEmUNKO1nuBgs3PrI8tkBPkmn55UdC+4v2WFjHWXrkQ==,iv:YdF0liKfIBT3CHCr1ufguu9qqYpfXfjOhJY5BO79orE=,tag:OWyN3Zh6uvm10LmCBipJ4w==,type:str]
+    vaultwarden: ENC[AES256_GCM,data:4thZ0nGnbprVntYH2wG2PAgAJcAYuexQPOJBSpC1ivQgNbmn89L5pSANx5fvYewa834mlqSWHWeSqIw/81tDqg==,iv:d6gARu6yGzALNZrgpvaxWqM1cdkalA17GZ4EVWHqYUc=,tag:guYaW+Ds1TylCLw/naD2mA==,type:str]
+    nextcloud: ENC[AES256_GCM,data:jeJSAF+oeEXL2BqKbzngnSVvpxE5yuzRq2LLu6EyKT76xHP/whP7QuRxns23dsJnUr55qaRUzDunvoFco8MCZw==,iv:0lxolTDXskNvrVEAC4dV/mIgCMi3B0xH+xVT40Brii0=,tag:YvUtW172rmKK6pY/+4WhXQ==,type:str]
+    gitea: ENC[AES256_GCM,data:D+WDCVPTAcOg/gpxlcaNHFVHBC8uKOs5VZKQYuF0qNZQn0H0dWQS89K3DsgjBKck7ugiZOyXKUHISBVrfBn+VQ==,iv:qkahWBx8q1g6wlzXKM5Bl1PqxwkprCZzzCq1vGWaj7E=,tag:hWX9jF2qx60QrOForU7LLw==,type:str]
+    grafana: ENC[AES256_GCM,data:Hm92Qnz5QVWwk6P61vrnnxDFLtdVx2vOMKwy3sRSv+KDnNSYvRNyLQUkyuf7Nh0S167XgAxDPTZQb9k6AjO36g==,iv:oXmfVDr63NGv4rRBb12V9l9dNXxQK7Se/2fbK40d2a0=,tag:DNeeRwEShxUhowkIfr1feg==,type:str]
+    synapse_matrix: ENC[AES256_GCM,data:HdhB5WAxBa+BaFBVoIo6RwhOxhN5WrTLR11kah9H1sBS5GDPldDw0H274faWFwE/UwXO2ggBEAYvACXr/rXkvQ==,iv:NxOsZqxsP9BSgdlW43AuQGw0VjSGx77wygjdDcINf8s=,tag:CtbG4zcXG2QFFP4dGgOxzg==,type:str]
+    peertube: ENC[AES256_GCM,data:6P8muSWzJ+A71nZZKlCXRCRwr1HWu7yrSw5bkeHg5As917frrbOMmDCpf21H0q+eagx/ZrRIWod2JXc2YGKCfg==,iv:G/zZeYbDCHffACCvhJlKlJ1cUCkw0+raq5G1ubqIRAg=,tag:HeQA3ueNo/t+8JR9jVUUPQ==,type:str]
+rsshub:
+    pixiv-refreshtoken: ENC[AES256_GCM,data:3nQdmn5RAaeqeI7S/0gPUGOzt7rkizpk3Ouz+pXwbqKBpikXKm4amvwg1Q==,iv:sze0u8un0xyumqHj0YeKcBD9xKZRW77rQdQn7auIf8I=,tag:bWqg+/pBaQJ2J3hjx05hlw==,type:str]
+    youtube-key: ENC[AES256_GCM,data:NZPG5iYrkOof+L3SKp9SqXmXOt37hvqCxTTibkzXv5TBPcCjPhCe,iv:Re6966w0oRtvHDCt9eYvswDMLNKcM+stIAA+P1qpWbg=,tag:0jNqPlGoXr0bHGMgHUZXCA==,type:str]
+    youtube-client-id: ENC[AES256_GCM,data:7BOIrxA5FIUo/31p3yqrLJKJhV9IUB25//w343eBoAnr3uD6J9zeLO3nIQv99vItioqFA1RmygCeer9pG7j/FI/MmmT8nGzPcw==,iv:mzKY2XghoXhKTTkO6EiG+ZJFsM39TX6UXJbzh0UA7vc=,tag:w7oiCvURV8yFxxoFR2P/jw==,type:str]
+    youtube-client-secret: ENC[AES256_GCM,data:JCyNb9biROLSx0RHkr0FqZ26nhU/LRBEnzfx91mmq+Ux0/A=,iv:fEMmanWtWaKBVUJVIeMSu+XV3v8xeccDY3DTJr4LOsk=,tag:bT+XedAZu94h053/1zr7Ow==,type:str]
+    youtube-refresh-token: ENC[AES256_GCM,data:TXNvLTfF4K5RT4D0anzXds/fcdPy3FXddGt5xxLIaxbKIqCAtsQyLEhA+SfQXaBk6T/yKIhtd/H/BLu1jOkiZsFL/8i5GSRSIXyagFrCfh/7tEqhCB0u52Hz5Xy4pkZiqd/AXx84Og==,iv:s+q2ffpJP/rcKu/Pw4KosM5/7boFPArJxgbqL0f1ZkI=,tag:chUtPpJbYuhjv09lRdXHMw==,type:str]
+    twitter-auth-token: ENC[AES256_GCM,data:scLoap0kDJW8Q9+h9S/JKYafyCUgx75RV7akHY/BYEmFhRNRq5Z2Lg==,iv:GhP3nyaK18PDcoHc18zhuuPAPnfEWgUagBrZNDY3toQ=,tag:qsE2rIgrmlxBW8D3i10KUw==,type:str]
+    bilibili-cookie: ENC[AES256_GCM,data:fdAX5CpbJZv3fxRdA5SpFwNUZ0jYgYuv8SyKfbJzm5toQ8S5TrQ9WnQk6Jwweqmg3VDRD5l6l/irGsRlLdjt3p7fyAJy0wtzY0jD1xGw8XhdKWevMTysg1YQcMijkJSI0oHpofis975M6EDjcURPWwlR6GqW6POOpMep97siOxiNyBi32TbZHqvIWa1YfyuMcngYMEsShpzWAZCCvLYXoBINXebG1JPHU2xua7EHMO+VH7UFNVCyBYmOw4iXBJ4YFaXqxjQTBza4GDDZ/RVBvO5Egdjovjpj1DR/hOEG4xJHpg6xTsFw,iv:WQTVuovkZjzuu5w743GkMcWqu2p7dmPr9sKHemkbxG4=,tag:eszbpreVfC4LtxnRte241Q==,type:str]
+    zhihu-cookies: ENC[AES256_GCM,data:ssemzXs7ub4z7pw4hWGSfzBfKH/xzv8bhtqC1dDbZJCnwZ4D4/U9ES9QDrPeKT5AjbdLV/WBvJqWKcwTQjGnRhMrgK2MU2/8Et61mur5WE5GPQjwhWV5JaTMhSxKS3pZtpyvIgy+0iwOj8QQS6mbujHnpb/y0fhszlmUQPBL4eIxm269/FyjBLeRivrJvSmMpLQxxwh2/GTojMPH2F3bclsdMHgZhvYGdJ65hSWn2Q==,iv:PffeWFhC+dYkLSDQKuIHRRDjqE7By/ZIuZIhkjCGDig=,tag:p4iJwqLfqkiKOi/KnoyfQA==,type:str]
+mail:
+    bot: ENC[AES256_GCM,data:XngvO9b98ccRoW9WgfX/Pg==,iv:SE8SK49zhYhDxl6f2UonCzTPcKg23CzbI5V/fOh5zOA=,tag:IXGwnSU+Vx0BQxjgvyBnCQ==,type:str]
+synapse:
+    synapse:
+        coturn: ENC[AES256_GCM,data:TQqNzjJV8iM46JZQOKqkydkSrDFH2El4EE1ZCjUPpZ6EM7UHfjjxP536sm7c7adxIZzrj2TlzKufhlGFYfZ8xQ==,iv:OVguyW8sQzfczVHMaMTg6+J0wzTzeTb2zZkXnMEZ4Jk=,tag:dYLMU2bHyg/IR1oyujsoRQ==,type:str]
+        registration: ENC[AES256_GCM,data:MXlRld2ugF3qDVPbrd3TGiwdFhJEcxKDsvmEV4P9Qap/zp1WcMzfo+wAeXtq18MV7Fw=,iv:ztN6q+1ql9b4NMiyuDEmWbnpWeOPmbEftymMDQ3C53M=,tag:+BI9t1jSNNcfrIU6AaDOXw==,type:str]
+        macaroon: ENC[AES256_GCM,data:hVkFqtfaOL64qNGjIfmSORm0D8lOvA/H3Mrm11Glrgy11ACjh+zI1CSglQC0SmaKSP0=,iv:ydNz3kXOelPxSFKshjH9+iYw4OItm6QoNGuks8kSDow=,tag:TCHyMXc+gT+fxVyd7HexMQ==,type:str]
+        form: ENC[AES256_GCM,data:lykxrVPMWz1sBk5GoMRHfHhsVxcT7txvLJ9GM48Jyff5HXh1z4IWuZzOu8HkrELkJrA=,iv:QGV8vqor+wByS9z37sF/iPfrNaL/0jU/yUGiphEl4Fw=,tag:Mg/Oz5hI+oDnp58aQF6Rew==,type:str]
+        signing-key: ENC[AES256_GCM,data:Ov+ly2t3abRunse65ccPpQgqKzDrF8B2wMaCJt3Bxa+QDu6WwD8DD4E+pcQK5/HaTdsQte8Z/3f2Kw==,iv:SSMjSTrhgHt6iz+oyHe0sHm3Eb82ks5z8DR1Puc1raE=,tag:9X+T4n/6Vl4tUbVM0LJySA==,type:str]
+    matrix:
+        coturn: ENC[AES256_GCM,data:BmnF4oyUdbESzOwlqQ5SXYgeUnWgyFE0pdBox33JmaMcOvRPtckD9p38UeMTxp8Pccarmx6f83rdHsifeoiWaw==,iv:1bb3Tn67HTHVNR9ohH1HtqS8wh6t7qtTEl5MNbwn7h8=,tag:xlxMZtqew4pTc9ztY74cHg==,type:str]
+        registration: ENC[AES256_GCM,data:LB5tWjoAsftqszYZGOXtqLFXa0HyU1b6lVUrBup5SJJdB2ZOnPsNtcgEkZLtMUlQ//M=,iv:jvLEwPv4iKuKfOPV08sPb9Z2XMnN+074DCQX+ARDPf4=,tag:4QxCLcOSQ30dU2Z+0OzGYg==,type:str]
+        macaroon: ENC[AES256_GCM,data:JSlovYowIe0C2jEFsIJci6+M1GYgbINdp0XkY58oOk1/ztyMnABSXcgZ73pEpLeUCvY=,iv:r2d5COTXL3gz9pb4GxuFQjM5DHsmwAfDy/eqlZyZJoM=,tag:yRn/OBcy1IqMvJQYD9sA6Q==,type:str]
+        form: ENC[AES256_GCM,data:sN24Yj5miXmUsvEmeSDOxFJxAetQdEJw+kEPNq+iMXyEexqEgoYBseH6kbFZwZAVrBo=,iv:ZtRkme3U1ofUBzT2J9SeRov1+rN5CrSi/ExKX7S5DNY=,tag:gGj8l5JXlzX+2sdHsLfQAg==,type:str]
+        signing-key: ENC[AES256_GCM,data:nmP8lwTAYGHc0LYcEj2AJE1XwSJBfA/NK+K6/0KGsufxwS1VhCXUWX9s3oEUPwuteTGZesaDVep1Qg==,iv:NcJEhlz6WgorViN2oiUG7kLy8N5kUzr5cD7Z4PRGdTg=,tag:WiWhIKaE5UQwEXunUokaNQ==,type:str]
+vaultwarden:
+    #ENC[AES256_GCM,data:rD0YOnSNf23ZjJhRWWia3+Zbpl6/cynCKlQQFhzaWIclHBk7YU3Z4E9J+YuWzlO8BM0bbp+zMxFGEFvbMrSHEHQ=,iv:PzQOCpSrjFb/aYn70oKrpb3jDy8rtZKPkLQ8qv0GMyE=,tag:wRfa4oHzAKD3BNYghIjZKA==,type:comment]
+    admin_token: ENC[AES256_GCM,data:oEIaHRqRIVQh+lSv+4p6G26bIKCtAQiw3t/C24C465THrwVa05D2Sax1IZ1JaHKgOmLzo8vxteBmJarARyC4kAnw2vb5bDPT1KCO/6u99mXhQyF3NY3FjmDwWHqTHHZT29dwAmtdFRz7rJQowLVqhBVQzNePdQ==,iv:QVAZ9JwwebqD7zxS8+Ai3K5V60bQbe+ewDc+JBXDMuM=,tag:vUYNlVf7ccooiBIXQWQC0g==,type:str]
+mariadb:
+    photoprism: ENC[AES256_GCM,data:JWeUPE1mb79IzyIsJime2yaBH+/yno2vbXAXO5E6Tx+al7bUlEH5JzYqz8+g8Jkiz3HhRNI4tcGUcVE7kkLgfA==,iv:ZJlIUGbEL/mGLWzjNEwgvzuzZZZrTy5D7e0eZ5+Ouvg=,tag:WY7/sUd2p2viKKDKsj1TLg==,type:str]
+    freshrss: ENC[AES256_GCM,data:/qt890Ly7zvuZB4Zn5xHLflc3L6Ex9JDa1BAinbG7OOkPGpnC83g8ivaQA3xL/CU1FRsm9V1OW4Bv2eN7VDhrQ==,iv:xQG5j3e4C7HWGct6gAET9uVUhGFv0BYVMLdL/1sj664=,tag:YaqjUNk7ybjfitrRpreQwQ==,type:str]
+    huginn: ENC[AES256_GCM,data:vbXI6k3IvTDgQNtKNX9VVJmanO6l+mLoOTq6djEuKfSQAO5UKMq9Xec2rsAibq4reKh503C4too3n2GU1Wo+FA==,iv:rSHmytVa2QWiZ1HH+8AOTOgimYcmPwo4fXgSSq7o+fQ=,tag:5DkdG0TarAs3cSsgPfFNJw==,type:str]
+photoprism:
+    adminPassword: ENC[AES256_GCM,data:X9af31Z4xGu8XJjMfsf3+whEdx96KHMyfJKO+5Q4q1nlnZD+cLjO8Lza2soO1fFndXcowRYsReUAzmXjH8Ffvg==,iv:LmH+JDA3YwydSNr8KbePPDga5ukGFol/BGrHNOZUxPg=,tag:T2HbUNcHnYD5c3GR5rnRmA==,type:str]
+nextcloud:
+    admin: ENC[AES256_GCM,data:mhTb6UPo3fIGlKPpER+Lcr2Jyv1nMk5jbQtxoN4txGJAFaJIhK+iAiZDZXBtOiysYqatcC2orJdgt9je8BAVWQ==,iv:G/uDlOGUt/F1GgxpIMGvVuFjcagVnHBudSGXZi3rrXY=,tag:hdE3Pf3G/xrnKaUkYO1WsA==,type:str]
+freshrss:
+    chn: ENC[AES256_GCM,data:Z4UmsXv1KiVfZMIQOEHH,iv:pF5lQLggkxm9y7taDVcp366JKp8U+8akNEdPA+Nf9Uo=,tag:0TajgUI/VgM3FxG1j6c/jA==,type:str]
+huginn:
+    invitationCode: ENC[AES256_GCM,data:JDN913i+zf6+obWxrNAbgx1NJGPyewRm,iv:lqnjbSk46J0ZJN6ccbbiCiOK92W8fj2mWRwQHKqy2dc=,tag:UYZesryRlfAMo7xhKQ7zgw==,type:str]
+grafana:
+    secret: ENC[AES256_GCM,data:1Wfq8QmhzKBObdktheFPySzXYlOJzHWbYYQXgn3beLOwSlW9f7bUn+wIrRoj1e8WlFJkAU2xywzjzzy/UwpSYA==,iv:/0YoHTs54O+cT6VVt1U5CYXr2qEdY2kijOlnMZMW4d0=,tag:SD/IELlcgfS7p9NBEa6D/g==,type:str]
+    chn: ENC[AES256_GCM,data:8R92k7RH1491u6lfQdM0U3SG8TPi3vWhZyj810XSjnA=,iv:8v6ijLHgoTPT6MGoP/lWB+UEZCCgOpvfskWCJJ63Udo=,tag:k9SHzJ9d54Rny3n8EbksOw==,type:str]
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:RIih,iv:1KQsPDpbG1A0NFT72tO6sSuQ84vfW07DST+/XzpNZvY=,tag:D3AHUPlCJGyVBbDalTHobQ==,type:comment]
+        user0: ENC[AES256_GCM,data:n6gIZGYdT6wEfKgizFvIE802AkpR8BpSPSZrQ5WP/aZWzLUL,iv:AxnwFOzmIRm3nTLpi8/4lkv+TjO4y4RZQtHO0GriD8o=,tag:nllDCaLZd6JNS2JqwvgVyg==,type:str]
+        #ENC[AES256_GCM,data:uhAauqQ1oQ==,iv:0Sr6YjarjkLmBq5H1ELb3SYBzrTVhqIE6qPxc9HYeKY=,tag:NvGGSY99Y7d3OTnpOr2p2g==,type:comment]
+        user1: ENC[AES256_GCM,data:EcEySx/n52rN5REPEWNjCuWywokvOetadbljqPpDPADTeeSk,iv:7r3CdvHJT1iZvx1Xn53It1ZxIkdLVIeQ+Q03zISm94k=,tag:8cIGZUlIhVgRc2FeU931kQ==,type:str]
+        #ENC[AES256_GCM,data:KuuPQQ==,iv:LGGqLFV4CnUMLWaNbHj6bRseetvdMdSOefV1FeYlJSA=,tag:wXlqKM2BuoMRZAwYbv5eOg==,type:comment]
+        user5: ENC[AES256_GCM,data:T5p0POx9Cnqdlp0blEYvAnRNIDOCNVdpOBR4rVQ1/07/rOCX,iv:EZx6ToeORzHoG+aEPi9oiTcwp4bOIAJpPUvemhYM96Q=,tag:aSS+RY5rEzr62mbE+JDanw==,type:str]
+    private-key: ENC[AES256_GCM,data:xz7xFt/g++E79bIl6AeBWATHDB+gHBIoXo5vdWTeyrAT1RtllgYie9k3Fg==,iv:x7fdmSINQA+F7a08jpuvCAg7vIZpsYaoX+EnitJMUCk=,tag:GAb/RRdAOlteIQPxeIMAXQ==,type:str]
+peertube:
+    secrets: ENC[AES256_GCM,data:OR3OA8qJsq1gAYiv1rShNa8eODzIxPOpVbqbnseSCMUNx4+FeOgReTLl7cXHPxbBkrJbsfEq5XYm1QtRtxotdw==,iv:6vz0ezsFuCNsBduNhm4VQ+it6oEJF/eMxktVFhdXgug=,tag:hmW7BwF9C53SAHhu2HBLYg==,type:str]
+    password: ENC[AES256_GCM,data:OaoqvUzWZz4LvVwZMbOSeq0mZyTqWT/E1Dt/N0XwEGwn9LLtarG/LrzV24BMS503N7NIxePVBK0jJCdbO7sI3Q==,iv:aaInNy3UmdF+aOu+Lzo7F0FvEVRbsn2XDwmYLNtYaFE=,tag:l/ONyeZJtZjS6IqwQgMs7A==,type:str]
+open-webui:
+    openai: ENC[AES256_GCM,data:5B1wPAOx3GsLDoYBKHWFzoyXFmn93fdcq6UC2rCt/P5zYLA4VNzfsp0=,iv:Y2gTLCmwB5wY4dhN73HRvTqSMVXbAEd+RjRbgUEuTeE=,tag:vcfNhXpG0C3twFBsm7PHwA==,type:str]
+    webui: ENC[AES256_GCM,data:Lg32DZ5GC+AYzWc4WloNMQlnpsqW67s5/kXzYwE=,iv:ECncgdYoLkX9GUOX26MXFSO8JOZahUDjTdKV87IRNJ8=,tag:J/5tTR3MI0iGIVDrlacYEg==,type:str]
+xray-xmu-client:
+    cookie: ENC[AES256_GCM,data:z1KI3CUfPqyiI/B/qgrNhg==,iv:QEjUlMkkF/fdwwEIGiJJ5UxFGw869qAnpApmWaRn3GY=,tag:EbdJsYEslwJbARxDoEWrDA==,type:str]
+sops:
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaURzWlFQNUpObmtvaUd2
+            bVc2UXRHajFPeXR5eTNqQnBhaWVOTXRDSEhVCjJVREN5MzF2MXhMSGIvNlM0endj
+            ZGVhTUFrTXVXRTlvYThaRVZBWmwxd2sKLS0tIDNTME1EaHFKY2J2SWxrRWFpaVJ4
+            Sm5xUlU2TXpyMUJQWVpoRUdlTnVjOFkKZErjPuX3nNFc3jFPBX462qs9hwguyxUD
+            POxmT4DMCPAaEz+lNB+Qa03P3TYFJ3LfqTsO7QXO2f9113wFqF2lFg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1n4lhfwv7g0vhx54exmwx9yv2z04m3h2lunzpa5zdzgtcvjjuf5nqc36g8a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxd2RzNEttTzk5cXVhc2RK
+            R3hxM1N4TmkyNGp0Z2ZwODZBL0RuMW1qNjFjCkI0N2FMUkd0eENPK0w4MWVJY2d4
+            NWlvUFdQbUh3SFIycDczZlg0ZEJMalkKLS0tIGs4dHlocTRseXRWYVFxMkdrV2x2
+            d0h3aDh5QXFZYWJFdmNVYnJxQ3pBeVUKTl0XVvtwJcz+RpSylgDPl/R8msInxvWX
+            eQGmrDHibeE1V+KSDiuNzC4MVRIrOnh1beHrhnVQ86HwPVgJqs2FoQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-01T05:55:35Z"
+    mac: ENC[AES256_GCM,data:MEgCbEJ/bwx3EVWVYQjb1RbNx8OlJkqelHPbMG5DzSRgcBcllptTFCanLIPZrg4FihkHx3b41Q5xsCXbras1njh4R1FeyLVVGZH7pYjZaPF2MRaD8nYeCHKlItWUVvHQTf5bRrTOOQoo4Kmn2by/xdMWwZlZwt0aBoGnEYBxGf0=,iv:lrPlg8cM5qPgQPpIUHF6WBVglTe9YQtI28hfJSgJ1vU=,tag:tjucRsf+tt9F03Mhjf+jeg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2
--- a/devices/steamdeck/default.nix
+++ b/devices/steamdeck/default.nix
@@ -0,0 +1,34 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      model.type = "desktop";
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-partlabel/steamdeck-boot" = "/boot";
+            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          luks.auto."/dev/disk/by-partlabel/steamdeck-root" = { mapper = "root"; ssd = true; };
+          swap = [ "/nix/swap/swap" ];
+          resume = { device = "/dev/mapper/root"; offset = 4728064; };
+        };
+        nixpkgs.march = "znver2";
+        kernel.variant = "steamos";
+      };
+      hardware = { gpu.type = "amd"; steamdeck = {}; };
+      services =
+      {
+        xray.client = {};
+        beesd."/".hashTableSizeMB = 64;
+        sshd = {};
+      };
+      bugs = [ "xmunet" ];
+    };
+  };
+}
--- a/devices/steamdeck/secrets.yaml
+++ b/devices/steamdeck/secrets.yaml
@@ -0,0 +1,26 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:x024tCccHGScH485GeeJEsnNTmzGklHO3KXXDl7FvVzYveQq,iv:oTzWSgH4XqA8PaeHEXB684DWA7TwFJ1ClxTJbnR0zdI=,tag:Xg32v1Lb0OgRk/dcr6snNg==,type:str]
+sops:
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRWxFSmFpZ3NOM1hnbVNw
+            czlOREhxNGQvU1I1SGd1QXowck9uY2czTURFCnkyY1MrUUg3ZW1odTFGODQ4NzBy
+            dXd0dzNjYlZVUUpXRXMveEdxRytQUVEKLS0tIGZIeUIwRngwUjBaQy8zQnRhbURS
+            U1M1S0pndTFWOVN0Mng2Qk92SG1SV0kKnrJCXqjW9ZnvFIz7EYYWWgWrByap8pVo
+            3AIe2q//nXm4it+B0ZzIvv8LrkqP1kJr/I6v2GqvB6URi8rL/nGxqg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1x7gda43xxsggveu8q2pajttlmgwsjhmksv7hzv3r270gyrpk8a5sza87gz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUGkzZTZ1TWFIVHZmaExC
+            Vk1xUlBKdUhaaW8rTGdoanQxZ2xkbU0rcjJvCi83K2RhcmkvYUVRSDV2QWxmK2VW
+            akorYVNCRTJhSW5Wa0NUZExMTndja1UKLS0tIGZZZXpsOFBIWHRRVUN2bjFzKzVD
+            a3lMTWNmL2UyTkVwL0d0RFg0L2tBU1EKXwsf8TZEEUKm6716gNFpOQ6JWF948Lgy
+            7ID8/Ug1v6/r+ta4FkZ5KHMqlxGRcBD56d5YvT1VsbjYzare4CgW6Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-07T07:28:26Z"
+    mac: ENC[AES256_GCM,data:0g3+g1xG9aw5EgXmC+LCsCl4jAGLF/vKd86gqFVMqaAL/Ukhb2JjTH3Wh3bdyg8e+c5ugohD4dkg2audy2nilgPXeNyHyb/lQmzUM/O+O7EIcowqPM3xPqnEBmTGjI6VDp44w5r40IQfVTWHha8CgTdYbARQ3RO4QxWnOh8V1zA=,iv:AThu70oSpIRRgGOpLIuqcmGHDcHSyujudX/2HeiZ5PQ=,tag:CVL5pmIc0kONcMndf+8nKw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -27,13 +27,7 @@ inputs:
      {
        sshd = {};
        fail2ban = {};
-        xray.server.serverName = "xserver2.vps4.chn.moe";
-        nginx.streamProxy.map = builtins.listToAttrs (builtins.map
-          (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.nas.chn.moe"; })
-          [
-            "xn--s8w913fdga" "matrix" "send" "git" "grafana" "peertube" "rsshub" "misskey" "synapse" "vaultwarden"
-            "photoprism" "nextcloud" "freshrss" "huginn" "api" "webdav" "chat"
-          ]);
+        xray.server = {};
      };
    };
  };
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -38,7 +38,10 @@ inputs:
          }
          // (builtins.listToAttrs (builtins.map
            (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.pc.chn.moe"; })
-            [ "xn--qbtm095lrg0bfka60z" ]));
+            [ "xn--qbtm095lrg0bfka60z" ]))
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.srv3.chn.moe"; })
+            [ "xn--s8w913fdga" "misskey" "synapse" "matrix" "send" "api" "git" "grafana" "peertube" ]));
          applications =
          {
            element.instances."element.chn.moe" = {};
@@ -56,33 +59,29 @@ inputs:
        mirism = {};
        fail2ban = {};
        beesd."/" = {};
-        # bind = {};
+        bind = {};
      };
    };
    networking.nftables.tables.forward =
    {
      family = "inet";
-      content =
-        let
-          srv2 = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg0.srv2-node0";
-        in
-        ''
-          chain prerouting {
-            type nat hook prerouting priority dstnat; policy accept;
-            tcp dport 7011 fib daddr type local counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-          }
-          chain output {
-            type nat hook output priority dstnat; policy accept;
-            # 需要忽略透明代理发出的流量（gid 不是 nginx）
-            meta skgid != ${builtins.toString inputs.config.users.groups.nginx.gid} \
-              tcp dport 7011 fib daddr type local \
-              counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-          }
-          chain postrouting {
-            type nat hook postrouting priority srcnat; policy accept;
-            oifname wg0 meta mark & 4 == 4 counter masquerade
-          }
-        '';
+      content = let srv2 = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg0.srv2-node0"; in
+      ''
+        chain prerouting {
+          type nat hook prerouting priority dstnat; policy accept;
+          tcp dport 7011 fib daddr type local counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
+        }
+        chain output {
+          type nat hook output priority dstnat; policy accept;
+          # 需要忽略透明代理发出的流量（gid 不是 nginx）
+          meta skgid != ${builtins.toString inputs.config.users.groups.nginx.gid} tcp dport 7011 fib daddr type local \
+            counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
+        }
+        chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname wg0 meta mark & 4 == 4 counter masquerade
+        }
+      '';
    };
  };
 }
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -12,6 +12,8 @@ xray-server:
        user4: ENC[AES256_GCM,data:/kBaGAqbewLav+WCJPHm1py3pvb7bA/YO2DeBP2FTCZv44wA,iv:iwxV6KHu00oITH/58kBFmf43lkgTU3BHJ/kb9FPnRSE=,tag:ns+6Dvhf/D15bZc0fd6zLA==,type:str]
        #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
+        #ENC[AES256_GCM,data:k2kFgIsD8jrmxg==,iv:qfYqA6zFSMBlUS8og70oYSbBLhUGp2ugGPNnLLSWwGY=,tag:DJPHm63XLD0wqle3Qwhc0Q==,type:comment]
+        user6: ENC[AES256_GCM,data:mmfwa1Z4yd+gLm2vNTp6hnYaBBoVzWhm+04DTuS6Rl50mg+A,iv:4KQGW1zorwRH8sBpN4UR60jV9Sk63JsoIf/Ma1HvpDI=,tag:TXfadko9ar+z4bnx6uesHA==,type:str]
        #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
        user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
        #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
@@ -66,7 +68,7 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-01T05:54:47Z"
-    mac: ENC[AES256_GCM,data:OtHwr58A1UOfYxQR88ay76fWmAyWPl5YtNbAiv0LXPLZPRtLGBJKuTjMaHr17AMepFZ+u5IPV2r8z1AUDj0opLXlv3Ik/DJ2PCcQTOBH+/lnSgzJKWfdCip9/wFR6N3dT0PKKLuBiURB9ZCYmtnq6E5+Guadc6ATYDSEpwbENZQ=,iv:kXsYMGjAtUlv1UqFU8Xv0zagohnpHkzSI72mq5HKY7k=,tag:KR+1A8l2VvbzDZV/00hbJg==,type:str]
+    lastmodified: "2025-08-07T07:28:06Z"
+    mac: ENC[AES256_GCM,data:omiQq5zptATaWWKj/4szKRlssEbgD9fQERNWY//nogrYHO4wgC0xjngjlztt9Rs72pavZ23O+WtlSjQ88kPyUy6WhywjJBE7zmMwj27hlFWPJJ94omBKvV0mhRFJ4hQ2cc2RkQAH5ADRVPMMYaGCY3ZW3S3ZmPYedIhNXFT6wDU=,iv:FlLkIBYGQp7bP5YLyw21taedk8Btcz89Qw6YOcu4VN4=,tag:YVQYiuXoGrXKAOjrpZ6o4g==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/doc/branch.md
+++ b/doc/branch.md
@@ -1,2 +0,0 @@
-* archive: archive
-* one-fprint: test fingerpint on one
--- a/doc/todo.md
+++ b/doc/todo.md
@@ -1,10 +1,14 @@
+* 测试 huggin rsshub
 * 打包 intel 编译器
 * 切换到 niri，清理 plasma
 * 调整其它用户的 zsh 配置
 * 调整 motd
 * 找到 wg1 不能稳定工作的原因；确定 persistentKeepalive 发包的协议、是否会被正确 NAT。
+* 备份系统
+* 备份数据
 * 清理 mariadb，移动到 persistent
 * 清理多余文件
 * 移动日志到 persistent
+* 更新 srv1
+* 告知将代理改到 xserver2
 * 准备单独一个的 archive
-* 测试透明代理代理其它机器的情况
--- a/flake.lock
+++ b/flake.lock
@@ -25,12 +25,12 @@
    "blog": {
      "flake": false,
      "locked": {
-        "lastModified": 1759333393,
+        "lastModified": 1748787595,
        "lfs": true,
-        "narHash": "sha256-0ruJ4kw82hQZDLp5oIBG2Kq+SBeOUoTSMJzFofOz4Sg=",
+        "narHash": "sha256-FFkwHb9DEdBjBaaH6JuhlmpP7ReSEWTy79P3i/eH708=",
        "ref": "refs/heads/public",
-        "rev": "e6d2bc75a815a8ea73eea24091af10b4eb595b95",
-        "revCount": 37,
+        "rev": "d9020a59f07f7ced60c854f324df8879b249e8b6",
+        "revCount": 32,
        "type": "git",
        "url": "https://git.chn.moe/chn/blog-public.git"
      },
@@ -100,32 +100,6 @@
        "type": "github"
      }
    },
-    "chaotic": {
-      "inputs": {
-        "flake-schemas": "flake-schemas",
-        "home-manager": [
-          "home-manager"
-        ],
-        "jovian": "jovian",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1757979374,
-        "narHash": "sha256-1ppp2L9mZsCe8H1GzV9Ni4PnXnYz1GDQPYurbPU/pZI=",
-        "owner": "chaotic-cx",
-        "repo": "nyx",
-        "rev": "ed13c5539660d20490d07e3898977c2f39317920",
-        "type": "github"
-      },
-      "original": {
-        "owner": "chaotic-cx",
-        "repo": "nyx",
-        "type": "github"
-      }
-    },
    "concurrencpp": {
      "flake": false,
      "locked": {
@@ -349,23 +323,9 @@
        "type": "github"
      }
    },
-    "flake-schemas": {
-      "locked": {
-        "lastModified": 1721999734,
-        "narHash": "sha256-G5CxYeJVm4lcEtaO87LKzOsVnWeTcHGKbKxNamNWgOw=",
-        "rev": "0a5c42297d870156d9c57d8f99e476b738dcd982",
-        "revCount": 75,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.1.5/0190ef2f-61e0-794b-ba14-e82f225e55e6/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%3D0.1.5.tar.gz"
-      }
-    },
    "flake-utils": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -383,7 +343,7 @@
    },
    "flake-utils_2": {
      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -400,6 +360,24 @@
      }
    },
    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
      "inputs": {
        "systems": "systems_4"
      },
@@ -495,20 +473,19 @@
      "inputs": {
        "nix-github-actions": "nix-github-actions",
        "nixpkgs": [
-          "chaotic",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1757230583,
-        "narHash": "sha256-4uqu7sFPOaVTCogsxaGMgbzZ2vK40GVGMfUmrvK3/LY=",
-        "owner": "Jovian-Experiments",
+        "lastModified": 1754569749,
+        "narHash": "sha256-MxTJFjO+KgmTWSDAsXLt4Al8tIl5F0grF6IKee+bDdA=",
+        "owner": "CHN-beta",
        "repo": "Jovian-NixOS",
-        "rev": "fc3960e6c32c9d4f95fff2ef84444284d24d3bea",
+        "rev": "e889cad7f0198266f634161b8d88ac1ff42844ab",
        "type": "github"
      },
      "original": {
-        "owner": "Jovian-Experiments",
+        "owner": "CHN-beta",
        "repo": "Jovian-NixOS",
        "type": "github"
      }
@@ -701,7 +678,6 @@
    "nix-github-actions": {
      "inputs": {
        "nixpkgs": [
-          "chaotic",
          "jovian",
          "nixpkgs"
        ]
@@ -762,24 +738,25 @@
        "type": "github"
      }
    },
-    "nix4vscode": {
+    "nix-vscode-extensions": {
      "inputs": {
+        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "systems": "systems"
+        ]
      },
      "locked": {
-        "lastModified": 1757210216,
-        "narHash": "sha256-wPFyyAJ9dw3a0W3rUUvMs53YHI1f37/4icFLYRbdBtE=",
+        "lastModified": 1747382874,
+        "narHash": "sha256-VCFqktsjKsz5eJOCdX2mM3Uytbb7Et6MHshEpCpuWFk=",
        "owner": "nix-community",
-        "repo": "nix4vscode",
-        "rev": "a916585d834e4e4bf092adad85e7f90c84ed7ddb",
+        "repo": "nix-vscode-extensions",
+        "rev": "4a7f92bdabb365936a8e8958948536cc2ceac7ba",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "repo": "nix4vscode",
+        "ref": "4a7f92bdabb365936a8e8958948536cc2ceac7ba",
+        "repo": "nix-vscode-extensions",
        "type": "github"
      }
    },
@@ -802,12 +779,12 @@
    "nixos-wallpaper": {
      "flake": false,
      "locked": {
-        "lastModified": 1757571059,
+        "lastModified": 1749300029,
        "lfs": true,
-        "narHash": "sha256-1Uc16Z/ji8j1xzCzLn497coFxSc53JopVW0TFHPL6+o=",
+        "narHash": "sha256-m5rQGDo9sogrNFtHNdf4CiUe4odqOVStj03ikUQX7NE=",
        "ref": "refs/heads/main",
-        "rev": "d14321b09e94a4e071575246c296bffdf89978b5",
-        "revCount": 11,
+        "rev": "8da808801224ac49758e4df095922be0c84650c8",
+        "revCount": 8,
        "type": "git",
        "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
      },
@@ -851,11 +828,11 @@
    },
    "nixpkgs-2311": {
      "locked": {
-        "lastModified": 1760234929,
-        "narHash": "sha256-4W0o4O8ANykPCOQD2Jb6pdGerDSLNzIVNF7AoVNMZvM=",
+        "lastModified": 1735377590,
+        "narHash": "sha256-U9W9H/HYoaKa5wzSL2IBmnFDhxlesuKAcKi/hl5xPvE=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "66170f3c82eecdee7dcd29a7e72ed87965bde4fc",
+        "rev": "0c3e74a65634ae3f43be7d0f6c3b5156ac54747b",
        "type": "github"
      },
      "original": {
@@ -930,11 +907,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1757823305,
-        "narHash": "sha256-goy+ZVzBAe/cN/Udsiqg7RdNA19jyJqO8x6KXnZ8Mfs=",
+        "lastModified": 1752553852,
+        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "db545f2ed84e23a80610792162a7a8adc888dcae",
+        "rev": "72d2707fa09a82bae26845eadb136ce94fd96a3e",
        "type": "github"
      },
      "original": {
@@ -946,11 +923,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1758027585,
-        "narHash": "sha256-+so5XM1uC1cMlS7hp85a9W4FXsqxkTAaK6BfDH8s7kM=",
+        "lastModified": 1753842094,
+        "narHash": "sha256-1IAtQ0itZjT07XyUNfHJ4r8nO4+036T6scVUFs1NEko=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "eeeecadbdeeea84b71422bbda9ce3e80e8cbd56c",
+        "rev": "2ebe9e65f6f1223450f58bf0197fcbce3fb9bf0f",
        "type": "github"
      },
      "original": {
@@ -1001,7 +978,7 @@
        "devshell": "devshell",
        "flake-compat": "flake-compat_2",
        "flake-parts": "flake-parts",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixos-stable": "nixos-stable",
        "nixpkgs": [
          "nixpkgs"
@@ -1082,7 +1059,7 @@
    "nvfetcher_2": {
      "inputs": {
        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nur-xddxdd",
          "nixpkgs"
@@ -1213,24 +1190,6 @@
        "type": "github"
      }
    },
-    "pybinding": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1598796477,
-        "narHash": "sha256-4DtGtQ40TEaM6qSydwsj9gD3JqpaCFpcvWJISwn69Zk=",
-        "ref": "refs/heads/master",
-        "rev": "ec1128aaa84a1b43a74fb970479ce4544bd63179",
-        "revCount": 774,
-        "submodules": true,
-        "type": "git",
-        "url": "https://github.com/dean0x7d/pybinding"
-      },
-      "original": {
-        "submodules": true,
-        "type": "git",
-        "url": "https://github.com/dean0x7d/pybinding"
-      }
-    },
    "root": {
      "inputs": {
        "aagl": "aagl",
@@ -1238,7 +1197,6 @@
        "bscpkgs": "bscpkgs",
        "buildproxy": "buildproxy",
        "catppuccin": "catppuccin",
-        "chaotic": "chaotic",
        "concurrencpp": "concurrencpp",
        "cppcoro": "cppcoro",
        "date": "date",
@@ -1246,6 +1204,7 @@
        "hextra": "hextra",
        "home-manager": "home-manager",
        "impermanence": "impermanence",
+        "jovian": "jovian",
        "lepton": "lepton",
        "mac-style": "mac-style",
        "matplotplusplus": "matplotplusplus",
@@ -1256,7 +1215,7 @@
        "niri": "niri",
        "nix-flatpak": "nix-flatpak",
        "nix-index-database": "nix-index-database",
-        "nix4vscode": "nix4vscode",
+        "nix-vscode-extensions": "nix-vscode-extensions",
        "nixos-wallpaper": "nixos-wallpaper",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-2305": "nixpkgs-2305",
@@ -1272,7 +1231,6 @@
        "plasma-manager": "plasma-manager",
        "pocketfft": "pocketfft",
        "py4vasp": "py4vasp",
-        "pybinding": "pybinding",
        "rsshub": "rsshub",
        "rycee": "rycee",
        "sops-nix": "sops-nix",
@@ -1304,27 +1262,6 @@
        "type": "github"
      }
    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "chaotic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1757930296,
-        "narHash": "sha256-Z9u5VszKs8rfEvg2AsFucWEjl7wMtAln9l1b78cfBh4=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "09442765a05c2ca617c20ed68d9613da92a2d96b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
    "rycee": {
      "flake": false,
      "locked": {
@@ -1428,7 +1365,6 @@
      }
    },
    "systems": {
-      "flake": false,
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1600,7 +1536,7 @@
    "winapps": {
      "inputs": {
        "flake-compat": "flake-compat_5",
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_4",
        "nixpkgs": [
          "nixpkgs"
        ]
--- a/flake.nix
+++ b/flake.nix
@@ -12,6 +12,11 @@
    sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
    nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-vscode-extensions =
+    {
+      url = "github:nix-community/nix-vscode-extensions?ref=4a7f92bdabb365936a8e8958948536cc2ceac7ba";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    impermanence.url = "github:CHN-beta/impermanence";
    plasma-manager =
    {
@@ -20,11 +25,6 @@
    };
    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-flatpak.url = "github:gmodena/nix-flatpak";
-    chaotic =
-    {
-      url = "github:chaotic-cx/nyx";
-      inputs = { nixpkgs.follows = "nixpkgs-unstable"; home-manager.follows = "home-manager"; };
-    };
    catppuccin = { url = "github:catppuccin/nix"; inputs.nixpkgs.follows = "nixpkgs"; };
    bscpkgs = { url = "github:CHN-beta/bscpkgs"; inputs.nixpkgs.follows = "nixpkgs"; };
    aagl = { url = "github:ezKEa/aagl-gtk-on-nix/release-25.05"; inputs.nixpkgs.follows = "nixpkgs"; };
@@ -32,7 +32,7 @@
    nixvirt = { url = "github:CHN-beta/NixVirt"; inputs.nixpkgs.follows = "nixpkgs"; };
    buildproxy = { url = "github:polygon/nix-buildproxy"; inputs.nixpkgs.follows = "nixpkgs"; };
    niri.url = "github:sodiboo/niri-flake";
-    nix4vscode = { url = "github:nix-community/nix4vscode"; inputs.nixpkgs.follows = "nixpkgs"; };
+    jovian = { url = "github:CHN-beta/Jovian-NixOS"; inputs.nixpkgs.follows = "nixpkgs"; };

    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -64,7 +64,6 @@
    phono3py = { url = "github:phonopy/phono3py"; flake = false; };
    sticker = { url = "git+https://git.chn.moe/chn/sticker.git?lfs=1"; flake = false; };
    speedtest = { url = "github:librespeed/speedtest"; flake = false; };
-    pybinding = { url = "git+https://github.com/dean0x7d/pybinding?submodules=1"; flake = false; };
  };

  outputs = inputs: let localLib = import ./flake/lib inputs.nixpkgs.lib; in
--- a/flake/dev.nix
+++ b/flake/dev.nix
@@ -48,11 +48,4 @@
    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
    hardeningDisable = [ "all" ];
  };
-  xinli = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
-  {
-    inputsFrom = [ pkgs.localPackages.xinli ];
-    packages = [ pkgs.clang-tools_18 ];
-    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-    hardeningDisable = [ "all" ];
-  };
 }
--- a/flake/dns/config/chn.moe.nix
+++ b/flake/dns/config/chn.moe.nix
@@ -2,40 +2,39 @@ localLib:
 let
  cname =
  {
+    autoroute = [ "api" "git" "grafana" "matrix" "peertube" "send" "synapse" "vikunja" "铜锣湾" ];
    nas = [ "initrd.nas" ];
    office = [ "srv2-node0" "xserverxmu" ];
-    vps4 =
-    [
-      "initrd.vps4" "xserver2.vps4"
-      # to nas
-      "git" "grafana" "matrix" "peertube" "send" "vikunja" "铜锣湾" "xservernas" "chat" "freshrss" "huginn" "nextcloud"
-      "photoprism" "rsshub" "vaultwarden" "webdav" "synapse" "misskey" "api"
-    ];
+    vps4 = [ "initrd.vps4" "xserver2.vps4" ];
    vps6 =
    [
-      "blog" "catalog" "coturn" "element" "initrd.vps6" "sticker" "synapse-admin" "tgapi" "ua" "xserver2"
-      "xserver2.vps6"
-      # to pc
-      "铜锣湾实验室"
+      "blog" "catalog" "coturn" "element" "initrd.vps6" "misskey" "sticker" "synapse-admin" "tgapi"
+      "ua" "xserver2" "xserver2.vps6" "铜锣湾实验室" "xservernas"
    ];
    "xlog.autoroute" = [ "xlog" ];
    "wg0.srv1-node0" = [ "wg0.srv1" ];
    "wg0.srv2-node0" = [ "wg0.srv2" ];
+    srv3 =
+    [
+      "chat" "freshrss" "huginn" "initrd.srv3" "nextcloud" "photoprism" "rsshub" "ssh.git" "vaultwarden" "webdav"
+      "xserver2.srv3" "example"
+    ];
    srv1-node0 = [ "srv1" ];
    srv2-node0 = [ "srv2" ];
    "wg1.pc" = [ "nix-store" ];
    "wg1.nas" = [ "nix-store.nas" ];
-    "wg0.nas" = [ "ssh.git" ];
  };
  a =
  {
    nas = "192.168.1.2";
    pc = "192.168.1.3";
-    office = "210.34.16.21";
+    one = "192.168.1.4";
+    office = "210.34.16.20";
    srv1-node0 = "59.77.36.250";
    vps4 = "104.234.37.61";
    vps6 = "144.34.225.59";
    search = "127.0.0.1";
+    srv3 = "23.135.236.216";
    srv1-node1 = "192.168.178.2";
    srv1-node2 = "192.168.178.3";
    srv2-node1 = "192.168.178.2";
--- a/flake/dns/config/wireguard.nix
+++ b/flake/dns/config/wireguard.nix
@@ -6,10 +6,12 @@
    vps6 = 1;
    pc = 3;
    nas = 4;
+    one = 5;
    srv1-node0 = 9;
    srv1-node1 = 6;
    srv1-node2 = 8;
    srv2-node0 = 7;
    srv2-node1 = 10;
+    srv3 = 11;
  };
 }
--- a/flake/lib/buildNixpkgsConfig/default.nix
+++ b/flake/lib/buildNixpkgsConfig/default.nix
@@ -1,12 +1,12 @@
-# inputs = { lib, topInputs, ...}; nixpkgs = { march, cuda, nixRoot, nixos, arch };
+# inputs = { lib, topInputs, ...}; nixpkgs = { march, cuda, nixRoot, nixos };
 { inputs, nixpkgs }:
 let
  platformConfig =
-    if nixpkgs.march == null then { system = "${nixpkgs.arch or "x86_64"}-linux"; }
+    if nixpkgs.march == null then { system = "x86_64-linux"; }
    else
    {
      ${if nixpkgs.nixos then "hostPlatform" else "localSystem"} =
-        { system = "${nixpkgs.arch or "x86_64"}-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; };
+        { system = "x86_64-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; };
    };
  cudaConfig = inputs.lib.optionalAttrs (nixpkgs.cuda != null)
  (
@@ -39,10 +39,11 @@ in platformConfig //
  [
    inputs.topInputs.aagl.overlays.default
    inputs.topInputs.nur-xddxdd.overlays.inSubTree
+    inputs.topInputs.nix-vscode-extensions.overlays.default
    inputs.topInputs.buildproxy.overlays.default
-    inputs.topInputs.nix4vscode.overlays.default
    (final: prev:
    {
+      inherit (inputs.topInputs.nix-vscode-extensions.overlays.default final prev) nix-vscode-extensions;
      nur-linyinfeng = (inputs.topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
      firefox-addons = (import "${inputs.topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
    })
@@ -74,55 +75,23 @@ in platformConfig //
      }
      // (
        let
-          marchFilter = version:
-            # old version of nixpkgs does not recognize znver5, use znver4 instead
-            inputs.lib.optionalAttrs (inputs.lib.versionOlder version "25.05") { znver5 = "znver4"; };
          source =
          {
            pkgs-2305 = "nixpkgs-2305";
            pkgs-2311 = "nixpkgs-2311";
-            pkgs-2411 =
-            {
-              source = "nixpkgs-2411";
-              overlays =
-              [
-                inputs.topInputs.bscpkgs.overlays.default
-                (final: prev: inputs.lib.optionalAttrs (nixpkgs.march != null)
-                {
-                  pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
-                  {
-                    sphinx = prev.sphinx.overridePythonAttrs (prev:
-                      { disabledTests = prev.disabledTests or [] ++ [ "test_xml_warnings" ]; });
-                  })];
-                })
-              ];
-            };
+            pkgs-2411 = { source = "nixpkgs-2411"; overlay = inputs.topInputs.bscpkgs.overlays.default; };
            pkgs-unstable =
            {
              source = "nixpkgs-unstable";
-              overlays =
-              [
-                inputs.topInputs.self.overlays.default
-                (_: _:
-                {
-                  genericPackages = import inputs.topInputs.nixpkgs-unstable
-                    { inherit system; config = { allowUnfree = true; inherit allowInsecurePredicate; }; };
-                })
-              ];
+              overlay = inputs.topInputs.self.overlays.default;
            };
          };
-          packages = name:
-            let flakeSource = inputs.topInputs.${source.${name}.source or source.${name}};
-            in import flakeSource
-            {
-              localSystem =
-                if nixpkgs.march == null then { system = "${nixpkgs.arch or "x86_64"}-linux"; }
-                else
-                  let march = (marchFilter flakeSource.lib.version).${nixpkgs.march} or nixpkgs.march;
-                  in { system = "${nixpkgs.arch or "x86_64"}-linux"; gcc = { arch = march; tune = march; }; };
-              inherit config;
-              overlays = source.${name}.overlays or [(_: _: {})];
-            };
+          packages = name: import inputs.topInputs.${source.${name}.source or source.${name}}
+          {
+            localSystem = platformConfig.hostPlatform or platformConfig.localSystem or platformConfig;
+            inherit config;
+            overlays = [(source.${name}.overlay or (_: _: {}))];
+          };
        in builtins.listToAttrs (builtins.map
          (name: { inherit name; value = packages name; }) (builtins.attrNames source))
      )
@@ -149,6 +118,8 @@ in platformConfig //
        openvswitch = prev.openvswitch.overrideAttrs (prev: { doCheck = false; });
        rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
        valkey = prev.valkey.overrideAttrs { doCheck = false; };
+        binaryen = prev.binaryen.overrideAttrs
+          { cmakeFlags = (prev.cmakeFlags or []) ++ [ "-DCMAKE_CXX_FLAGS=-Wno-maybe-uninitialized" ]; };
        # -march=xxx cause embree build failed
        # https://github.com/embree/embree/issues/115
        embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
@@ -176,6 +147,5 @@ in platformConfig //
      })
      // (inputs.lib.optionalAttrs (nixpkgs.march == "silvermont")
        { c-blosc = prev.c-blosc.overrideAttrs { doCheck = false; }; })
-      // (inputs.lib.optionalAttrs (nixpkgs.arch or null == "aarch64") { nix = final.nixVersions.nix_2_29; })
  )];
 }
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -1,7 +1,7 @@
 { inputs, localLib }:
 let
-  singles = [ "nas" "pc" "vps4" "vps6" "r2s" ];
-  cluster = { srv1 = 3; srv2 = 3; };
+  singles = [ "nas" "pc" "vps4" "vps6" "one" "srv3" "steamdeck" ];
+  cluster = { srv1 = 3; srv2 = 2; };
  deviceModules = builtins.listToAttrs
  (
    (builtins.map
@@ -25,9 +25,9 @@ let
      (localLib.attrsToList cluster)))
  );
 in builtins.mapAttrs
-  (n: v: inputs.nixpkgs.lib.nixosSystem
+  (_: v: inputs.nixpkgs.lib.nixosSystem
  {
-    system = null;
+    system = "x86_64-linux";
    specialArgs = { topInputs = inputs; inherit localLib; };
    modules = localLib.mkModules v;
  })
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -29,7 +29,7 @@
    netboot = pkgs.fetchurl
    {
      url = "https://boot.netboot.xyz/ipxe/netboot.xyz.iso";
-      sha256 = "6GeOcugqElGPoPXeaWVpjcV5bCFxNLShGgN/sjsVzuI=";
+      sha256 = "01hlslbi2i3jkzjwn24drhd2lriaqiwr9hb83r0nib9y1jvr3k5p";
    };
  };
  vasp =
@@ -128,7 +128,7 @@
  mirism-old = pkgs.requireFile
  {
    name = "mirism";
-    sha256 = "1zhhzwi325g21kqdip7zzw1i9b354h1wpzd4zhzb1ql9kjdh87q3";
+    sha256 = "0f50pvdafhlmrlbf341mkp9q50v4ld5pbx92d2w1633f18zghbzf";
    hashMode = "recursive";
    message = "Source file not found.";
  };
@@ -204,16 +204,4 @@
    name = "guix.iso";
    sha256 = "0xqabnay8wwqc1a96db8ix1a6bhvgm84s5is1q67rr432q7gqgd4";
  };
-  peerBanHelper =
-  {
-    image = "ghostchu/peerbanhelper:v8.0.12";
-    imageFile = pkgs.dockerTools.pullImage
-    {
-      imageName = "ghostchu/peerbanhelper";
-      imageDigest = "sha256:fce7047795fe1e6d730ea2583b390ccc336e79eb2d8dae8114f4f63f00208879";
-      hash = "sha256-7Z2ewDpGFXyvCze9HZ7KwFwn9o9R6Y4pjJDcr5Wmy1g=";
-      finalImageName = "ghostchu/peerbanhelper";
-      finalImageTag = "v8.0.12";
-    };
-  };
 }
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -7,13 +7,20 @@ inputs: let inherit (inputs) topInputs; in
    topInputs.nix-index-database.nixosModules.nix-index
    topInputs.impermanence.nixosModules.impermanence
    topInputs.nix-flatpak.nixosModules.nix-flatpak
-    topInputs.chaotic.nixosModules.default
-    { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
    topInputs.catppuccin.nixosModules.catppuccin
    topInputs.aagl.nixosModules.default
    topInputs.nixvirt.nixosModules.default
    topInputs.niri.nixosModules.niri
    { config.niri-flake.cache.enable = false; }
+    topInputs.jovian.nixosModules.default
+    {
+      config.jovian =
+      {
+        steamos.useSteamOSConfig = inputs.lib.mkDefault false;
+        devices.steamdeck.enableKernelPatches = inputs.lib.mkDefault false;
+        overlay.enable = inputs.lib.mkDefault false;
+      };
+    }
    # TODO: Remove after next release
    "${topInputs.nixpkgs-unstable}/nixos/modules/services/hardware/lact.nix"
    (inputs:
--- a/modules/hardware/cpu.nix
+++ b/modules/hardware/cpu.nix
@@ -2,11 +2,11 @@ inputs:
 {
  options.nixos.hardware.cpu = let inherit (inputs.lib) mkOption types; in mkOption
  {
-    type = types.nullOr (types.enum [ "intel" "amd" ]);
+    type = types.enum [ "intel" "amd" ];
    default = let inherit (inputs.config.nixos.system.nixpkgs) march; in
      if march == null then null
-      else if inputs.lib.hasInfix "znver" march then "amd"
-      else if (inputs.lib.hasInfix "lake" march)
+      else if inputs.lib.hasPrefix "znver" march then "amd"
+      else if (inputs.lib.hasSuffix "lake" march)
        || (builtins.elem march [ "sandybridge" "silvermont" "haswell" "broadwell" ])
        then "intel"
      else null;
--- a/modules/hardware/steamdeck.nix
+++ b/modules/hardware/steamdeck.nix
@@ -0,0 +1,22 @@
+inputs:
+{
+  options.nixos.hardware.steamdeck = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.hardware) steamdeck; in inputs.lib.mkIf (steamdeck != null)
+  {
+    jovian =
+    {
+      steam = { enable = true; autoStart = true; user = "chn"; desktopSession = "plasma"; };
+      steamos.useSteamOSConfig = true;
+      decky-loader = { enable = true; package = inputs.pkgs.decky-loader-prerelease; };
+      devices.steamdeck.enable = true;
+      overlay.enable = true;
+    };
+    boot.initrd.kernelModules =
+    [
+      "hid_generic" "hid_multitouch" "i2c_designware_core" "i2c_designware_platform" "i2c_hid_acpi" "evdev"
+      "i2c_hid_api"
+    ];
+    nixos.packages.packages._packages = [ inputs.pkgs.steamdeck-firmware ];
+  };
+}
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -3,7 +3,6 @@ inputs:
  options.nixos.model = let inherit (inputs.lib) mkOption types; in
  {
    hostname = mkOption { type = types.nonEmptyStr; };
-    arch = mkOption { type = types.nonEmptyStr; default = "x86_64"; };
    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
    private = mkOption { type = types.bool; default = false; };
    cluster = mkOption
--- a/modules/packages/android-studio.nix
+++ b/modules/packages/android-studio.nix
@@ -0,0 +1,9 @@
+inputs:
+{
+  options.nixos.packages.android-studio = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.packages) android-studio; in inputs.lib.mkIf (android-studio != null)
+  {
+    nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ];
+  };
+}
--- a/modules/packages/chromium.nix
+++ b/modules/packages/chromium.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.chromium = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) chromium; in inputs.lib.mkIf (chromium != null)
  {
--- a/modules/packages/default.nix
+++ b/modules/packages/default.nix
@@ -1,63 +1,25 @@
 inputs:
 {
  imports = inputs.localLib.findModules ./.;
-  options.nixos.packages =
-    let
-      inherit (inputs.lib) mkOption types;
-      simpleSubmodule = mkOption { type = types.nullOr (types.submodule {}); default = null; };
-    in
-    {
-      packages =
-      {
-        _packages = mkOption { type = types.listOf types.unspecified; default = []; };
-        _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-        _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-        _pythonEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-        _vscodeEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-      };
-    }
-    // (builtins.listToAttrs (builtins.map (n: inputs.lib.nameValuePair n simpleSubmodule)
-      [ "vasp" "mathematica" "lumerical" "flatpak" "android-studio" ]));
-  config = inputs.lib.mkMerge
-  [
-    {
-      environment.systemPackages = with inputs.config.nixos.packages.packages;
-        _packages
-        ++ [
-          (
-            (inputs.pkgs.python3.withPackages (pythonPackages:
-              builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages) _pythonPackages)))
-            .override (prev: { makeWrapperArgs = prev.makeWrapperArgs or [] ++ _pythonEnvFlags; }))
-          (inputs.pkgs.writeTextDir "share/prebuild-packages"
-            (builtins.concatStringsSep "\n" (builtins.map builtins.toString _prebuildPackages)))
-        ];
-    }
-    (inputs.lib.mkIf (inputs.config.nixos.packages.vasp != null)
-    {
-      nixos.packages.packages = with inputs.pkgs;
-      {
-        _packages =
-        [
-          localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90
-          (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.vasp.nvidia else emptyDirectory)
-          localPackages.atomkit (inputs.lib.mkAfter localPackages.atat)
-        ];
-        _pythonPackages = [(_: [ localPackages.py4vasp ])];
-      };
-    })
-    (inputs.lib.mkIf (inputs.config.nixos.packages.mathematica != null)
-      { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; })
-    (inputs.lib.mkIf (inputs.config.nixos.packages.lumerical != null)
-    {
-      nixos =
-      {
-        packages.packages._packages = [ inputs.pkgs.localPackages.lumerical.lumerical.cmd ];
-        services.lumericalLicenseManager = {};
-      };
-    })
-    (inputs.lib.mkIf (inputs.config.nixos.packages.flatpak != null)
-      { services.flatpak = { enable = true; uninstallUnmanaged = true; }; })
-    (inputs.lib.mkIf (inputs.config.nixos.packages.android-studio != null)
-      { nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ]; })
-  ];
+  options.nixos.packages.packages = let inherit (inputs.lib) mkOption types; in
+  {
+    _packages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _pythonEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+    _vscodeEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+  };
+  config =
+  {
+    environment.systemPackages = with inputs.config.nixos.packages.packages;
+      _packages
+      ++ [
+        (
+          (inputs.pkgs.python3.withPackages (pythonPackages:
+            builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages) _pythonPackages)))
+          .override (prev: { makeWrapperArgs = prev.makeWrapperArgs or [] ++ _pythonEnvFlags; }))
+        (inputs.pkgs.writeTextDir "share/prebuild-packages"
+          (builtins.concatStringsSep "\n" (builtins.map builtins.toString _prebuildPackages)))
+      ];
+  };
 }
--- a/modules/packages/desktop.nix
+++ b/modules/packages/desktop.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.desktop = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) desktop; in inputs.lib.mkIf (desktop != null)
  {
@@ -72,14 +72,22 @@ inputs:
            wannier90 = wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; };
          })
          pkgs-2311.hdfview numbat qalculate-qt
+          (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.mumax else emptyDirectory)
+          (if inputs.config.nixos.system.nixpkgs.cuda != null
+            then (lammps.override { stdenv = cudaPackages.backendStdenv; }).overrideAttrs (prev:
+            {
+              cmakeFlags = prev.cmakeFlags ++
+                [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
+              nativeBuildInputs = prev.nativeBuildInputs ++ [ cudaPackages.cudatoolkit ];
+              buildInputs = prev.buildInputs ++ [ mpi ];
+            })
+            else lammps-mpi)
          # virtualization
          virt-viewer bottles wineWowPackages.stagingFull genymotion playonlinux
          # media
          nur-xddxdd.svp
          # for kdenlive auto subtitle
          openai-whisper
-          # daily management
-          activitywatch
        ]
          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
@@ -148,6 +156,9 @@ inputs:
        nvidiaSupport = if inputs.config.nixos.hardware.gpu.type == null then false
          else inputs.lib.hasSuffix "nvidia" inputs.config.nixos.hardware.gpu.type;
      };
+      anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
+      honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
+      sleepy-launcher = { enable = true; package = inputs.pkgs.sleepy-launcher; };
      alvr = { enable = true; openFirewall = true; };
      localsend.enable = true;
    };
--- a/modules/packages/extra.nix
+++ b/modules/packages/extra.nix
@@ -1,14 +0,0 @@
-inputs:
-{
-  options.nixos.packages.extra = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.packages) extra; in inputs.lib.mkIf (extra != null)
-  {
-    programs =
-    {
-      anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
-      honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
-      sleepy-launcher = { enable = true; package = inputs.pkgs.sleepy-launcher; };
-    };
-  };
-}
--- a/modules/packages/flatpak.nix
+++ b/modules/packages/flatpak.nix
@@ -0,0 +1,12 @@
+inputs:
+{
+  options.nixos.packages.flatpak = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) flatpak; in inputs.lib.mkIf (flatpak != null)
+  {
+    services.flatpak = { enable = true; uninstallUnmanaged = true; };
+  };
+}
--- a/modules/packages/lumerical.nix
+++ b/modules/packages/lumerical.nix
@@ -0,0 +1,13 @@
+inputs:
+{
+  options.nixos.packages.lumerical = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.packages) lumerical; in inputs.lib.mkIf (lumerical != null)
+  {
+    nixos =
+    {
+      packages.packages._packages = [ inputs.pkgs.localPackages.lumerical.lumerical.cmd ];
+      services.lumericalLicenseManager = {};
+    };
+  };
+}
--- a/modules/packages/mathematica.nix
+++ b/modules/packages/mathematica.nix
@@ -0,0 +1,7 @@
+inputs:
+{
+  options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
+    { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; };
+}
--- a/modules/packages/minimal.nix
+++ b/modules/packages/minimal.nix
@@ -22,13 +22,11 @@ inputs:
        # file manager
        tree eza trash-cli lsd broot file xdg-ninja mlocate
        # compress
-        pigz upx unzip zip lzip p7zip
-        (if inputs.pkgs.stdenv.hostPlatform.linuxArch == "x86_64" then rar else emptyDirectory)
+        pigz upx unzip zip lzip p7zip rar
        # file system management
        sshfs e2fsprogs compsize exfatprogs
        # disk management
-        smartmontools hdparm gptfdisk
-        (if inputs.pkgs.stdenv.hostPlatform.linuxArch == "x86_64" then megacli else emptyDirectory)
+        smartmontools hdparm gptfdisk megacli
        # encryption and authentication
        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool libfido2
        # networking
@@ -37,25 +35,12 @@ inputs:
        # nix tools
        nix-output-monitor nix-tree ssh-to-age nix-inspect
        # development
-        gdb try rr hexo-cli gh hugo
-        # build failed on aarch64
-        (if inputs.pkgs.stdenv.hostPlatform.linuxArch == "x86_64" then nix-init else emptyDirectory)
+        gdb try rr hexo-cli gh nix-init hugo
        (octodns.withProviders (_: with octodns-providers; [ cloudflare ]))
        # stupid things
        toilet lolcat localPackages.stickerpicker graph-easy
        # office
        pdfgrep ffmpeg-full hdf5
-        # scientific computing
-        (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.mumax else emptyDirectory)
-        (if inputs.config.nixos.system.nixpkgs.cuda != null
-          then (lammps.override { stdenv = cudaPackages.backendStdenv; }).overrideAttrs (prev:
-          {
-            cmakeFlags = prev.cmakeFlags ++
-              [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
-            nativeBuildInputs = prev.nativeBuildInputs ++ [ cudaPackages.cudatoolkit ];
-            buildInputs = prev.buildInputs ++ [ mpi ];
-          })
-          else lammps-mpi)
      ]
        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ])
        ++ (inputs.lib.optionals (inputs.config.nixos.system.gui.implementation == "kde")
--- a/modules/packages/steam.nix
+++ b/modules/packages/steam.nix
@@ -10,7 +10,7 @@ inputs:
    programs.steam =
    {
      enable = true;
-      package = inputs.pkgs.steam.override (prev:
+      package = inputs.lib.mkIf (inputs.config.nixos.hardware.steamdeck == null) (inputs.pkgs.steam.override (prev:
      {
        steam-unwrapped = prev.steam-unwrapped.overrideAttrs (prev:
        {
@@ -19,7 +19,7 @@ inputs:
            sed -i 's#Comment\[zh_CN\]=.*$#Comment\[zh_CN\]=思题慕®学习平台#' $out/share/applications/steam.desktop
          '';
        });
-      });
+      }));
      extraPackages = [ inputs.pkgs.openssl_1_1 ];
      extraCompatPackages = [ inputs.pkgs.proton-ge-bin ];
      remotePlay.openFirewall = true;
@@ -27,5 +27,11 @@ inputs:
      localNetworkGameTransfers.openFirewall = true;
      dedicatedServer.openFirewall = true;
    };
+    # not easy to override steamdeck's steam package env, just write env vars to global
+    environment.sessionVariables = inputs.lib.mkIf (inputs.config.nixos.hardware.steamdeck != null)
+    {
+      STEAM_EXTRA_COMPAT_TOOLS_PATHS =
+        inputs.lib.makeSearchPathOutput "steamcompattool" "" inputs.config.programs.steam.extraCompatPackages;
+    };
  };
 }
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -0,0 +1,18 @@
+inputs:
+{
+  options.nixos.packages.vasp = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
+  {
+    nixos.packages.packages = with inputs.pkgs;
+    {
+      _packages =
+      [
+        localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90
+        (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.vasp.nvidia else emptyDirectory)
+        localPackages.atomkit (inputs.lib.mkAfter localPackages.atat)
+      ];
+      _pythonPackages = [(_: [ localPackages.py4vasp ])];
+    };
+  };
+}
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -3,336 +3,84 @@ inputs:
  options.nixos.packages.vscode = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) vscode; in inputs.lib.mkIf (vscode != null)
  {
-    nixos.user.sharedModules =
-    [(hmInputs: {
-      config.programs.vscode = inputs.lib.mkIf (hmInputs.config.home.username != "root")
-      {
-        enable = true;
-        package = inputs.pkgs.vscode.overrideAttrs (prev: { preFixup = prev.preFixup +
-        ''
-          gappsWrapperArgs+=(
-            ${builtins.concatStringsSep " " inputs.config.nixos.packages.packages._vscodeEnvFlags}
-          )
-        '';});
-        profiles.default =
+    nixos.packages.packages = with inputs.pkgs;
+    {
+      _packages =
+      [(
+        vscode-with-extensions.override
        {
-          enableExtensionUpdateCheck = false;
-          enableUpdateCheck = false;
-          extensions = inputs.pkgs.nix4vscode.forVscode
-          [
-            "github.copilot" "github.copilot-chat" "github.github-vscode-theme"
-            "intellsmi.comment-translate"
-            "ms-vscode.cmake-tools" "ms-vscode.cpptools-extension-pack" "ms-vscode.hexeditor"
-            "ms-vscode.remote-explorer"
-            "ms-vscode-remote.remote-ssh"
-            "donjayamanne.githistory" "fabiospampinato.vscode-diff"
-            "llvm-vs-code-extensions.vscode-clangd" "ms-ceintl.vscode-language-pack-zh-hans"
-            "oderwat.indent-rainbow"
-            "guyutongxue.cpp-reference" "thfriedrich.lammps" "leetcode.vscode-leetcode" # "znck.grammarly"
-            "james-yu.latex-workshop" "bbenoist.nix" "jnoortheen.nix-ide" "ccls-project.ccls"
-            "brettm12345.nixfmt-vscode"
-            "gruntfuggly.todo-tree"
-            # restrctured text
-            "lextudio.restructuredtext" "trond-snekvik.simple-rst" "swyddfa.esbonio" "chrisjsewell.myst-tml-syntax"
-            # markdown
-            "yzhang.markdown-all-in-one" "shd101wyy.markdown-preview-enhanced"
-            # vasp
-            "mystery.vasp-support"
-            "yutengjing.open-in-external-app"
-            # git graph
-            "mhutchie.git-graph"
-            # python
-            "ms-python.python"
-            # theme
-            "pkief.material-icon-theme"
-            # direnv
-            "mkhl.direnv"
-            # svg viewer
-            "vitaliymaz.vscode-svg-previewer"
-            # draw
-            "pomdtr.excalidraw-editor"
-            # typst
-            "myriad-dreamin.tinymist"
-            # grammaly alternative
-            "ltex-plus.vscode-ltex-plus"
-            # jupyter
-            "ms-toolsai.jupyter" "ms-toolsai.jupyter-keymap" "ms-toolsai.jupyter-renderers"
-            "ms-toolsai.vscode-jupyter-cell-tags" "ms-toolsai.vscode-jupyter-slideshow"
-            "ms-toolsai.datawrangler"
-          ];
-          keybindings =
-          [
-            # use alt+a to complete inline suggestions, instead of tab or ctrl+enter
-            {
-              key = "alt+a";
-              command = "editor.action.inlineSuggest.commit";
-              when = "inlineSuggestionVisible";
-            }
-            {
-              key = "tab";
-              command = "-editor.action.inlineSuggest.commit";
-            }
-            {
-              key = "ctrl+enter";
-              command = "-editor.action.inlineSuggest.commit";
-            }
-            # use ctrl+j to jump to pdf in latex
-            {
-              key = "ctrl+alt+j";
-              command = "-latex-workshop.synctex";
-            }
-            {
-              key = "ctrl+j";
-              command = "-workbench.action.togglePanel";
-            }
-            {
-              key = "ctrl+j";
-              command = "latex-workshop.synctex";
-              when = "editorTextFocus && editorLangId == 'latex'";
-            }
-            {
-              key = "ctrl+l alt+j";
-              command = "-latex-workshop.synctex";
-            }
-            # use ctrl+j=b to build latex
-            {
-              key = "ctrl+b";
-              command = "-workbench.action.toggleSidebarVisibility";
-            }
-            {
-              key = "ctrl+b";
-              command = "latex-workshop.build";
-              when = "editorLangId =~ /^latex$|^latex-expl3$|^rsweave$|^jlweave$|^pweave$/";
-            }
-            {
-              key = "ctrl+l alt+b";
-              command = "-latex-workshop.build";
-            }
-            # use alt+t to cd to current dir
-            {
-              key = "alt+t";
-              command = "workbench.action.terminal.sendSequence";
-              args.text = "cd '\${fileDirname}'\n";
-            }
-          ];
-          userSettings =
-          {
-            "security.workspace.trust.enabled" = false;
-            "editor.fontFamily" = "'FiraCode Nerd Font Mono', 'Noto Sans Mono CJK SC', 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback'";
-            "editor.fontLigatures" = true;
-            "workbench.iconTheme" = "material-icon-theme";
-            "cmake.configureOnOpen" = true;
-            "editor.mouseWheelZoom" = true;
-            "extensions.ignoreRecommendations" = true;
-            "editor.smoothScrolling" = true;
-            "editor.cursorSmoothCaretAnimation" = "on";
-            "workbench.list.smoothScrolling" = true;
-            "files.hotExit" = "off";
-            "editor.wordWrapColumn" = 120;
-            "window.restoreWindows" = "none";
-            "editor.inlineSuggest.enabled" = true;
-            "github.copilot.enable"."*" = true;
-            "editor.acceptSuggestionOnEnter" = "off";
-            "terminal.integrated.scrollback" = 10000;
-            "editor.rulers" = [ 120 ];
-            "indentRainbow.ignoreErrorLanguages" = [ "*" ];
-            "markdown.extension.completion.respectVscodeSearchExclude" = false;
-            "markdown.extension.print.absoluteImgPath" = false;
-            "editor.tabCompletion" = "on";
-            "workbench.colorTheme" = "GitHub Light";
-            "workbench.startupEditor" = "none";
-            "debug.toolBarLocation" = "docked";
-            "search.maxResults" = 100000;
-            "editor.action.inlineSuggest.commit" = "Ctrl+Space";
-            "window.dialogStyle" = "custom";
-            "redhat.telemetry.enabled" = true;
-            "[xml]"."editor.defaultFormatter" = "DotJoshJohnson.xml";
-            "git.ignoreLegacyWarning" = true;
-            "git.confirmSync" = false;
-            "cmake.configureArgs" = [ "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON" "-DCMAKE_EXPORT_COMPILE_COMMANDS=1" ];
-            "editor.wordWrap" = "wordWrapColumn";
-            "files.associations" = { "POSCAR" = "poscar"; "*.mod" = "lmps"; "*.vasp" = "poscar"; };
-            "editor.stickyScroll.enabled" = true;
-            "editor.minimap.showSlider" = "always";
-            "editor.unicodeHighlight.allowedLocales" = { "zh-hans" = true; "zh-hant" = true; };
-            "hexeditor.columnWidth" = 64;
-            "latex-workshop.synctex.afterBuild.enabled" = true;
-            "hexeditor.showDecodedText" = true;
-            "hexeditor.defaultEndianness" = "little";
-            "hexeditor.inspectorType" = "aside";
-            "commentTranslate.hover.concise" = true;
-            "commentTranslate.targetLanguage" = "en";
-            "[python]"."editor.formatOnType" = true;
-            "editor.minimap.renderCharacters" = false;
-            "update.mode" = "none";
-            "editor.tabSize" = 2;
-            "nix.enableLanguageServer" = true;
-            "nix.serverPath" = "nil";
-            "nix.formatterPath" = "nixpkgs-fmt";
-            "nix.serverSettings"."nil" =
-            {
-              "diagnostics"."ignored" = [ "unused_binding" "unused_with" ];
-              "formatting"."command" = [ "nixpkgs-fmt" ];
-            };
-            "xmake.envBehaviour" = "erase";
-            "git.openRepositoryInParentFolders" = "never";
-            "todo-tree.regex.regex" = "(//|#|<!--|;|/\\*|^|%|^[ \\t]*(-|\\d+.))\\s*($TAGS)";
-            "latex-workshop.latex.recipes" =
-            [
+          vscodeExtensions =
+            let extensions = builtins.listToAttrs (builtins.map
+              (set:
              {
-                name = "xelatex";
-                tools = [ "xelatex" "bibtex" "xelatex" "xelatex" ];
-              }
-              {
-                name = "latexmk";
-                tools = [ "latexmk" ];
-              }
-              {
-                name = "latexmk (latexmkrc)";
-                tools = [ "latexmk_rconly" ];
-              }
-              {
-                name = "latexmk (lualatex)";
-                tools = [ "lualatexmk" ];
-              }
-              {
-                name = "latexmk (xelatex)";
-                tools = [ "xelatexmk" ];
-              }
-              {
-                name = "pdflatex -> bibtex -> pdflatex * 2";
-                tools = [ "pdflatex" "bibtex" "pdflatex" "pdflatex" ];
-              }
-            ];
-            "latex-workshop.latex.recipe.default" = "xelatex";
-            "latex-workshop.bind.altKeymap.enabled" = true;
-            "latex-workshop.latex.autoBuild.run" = "never";
-            "cmake.showOptionsMovedNotification" = false;
-            "markdown.extension.toc.plaintext" = true;
-            "markdown.extension.katex.macros" = {};
-            "markdown-preview-enhanced.mathRenderingOption" = "MathJax";
-            "mesonbuild.downloadLanguageServer" = false;
-            "genieai.openai.model" = "gpt-3.5-turbo-instruct";
-            "codeium.enableConfig" = { "*" = true; "Log" = true; };
-            "fortran.notifications.releaseNotes" = false;
-            "markdown-preview-enhanced.enablePreviewZenMode" = true;
-            "ccls.misc.compilationDatabaseDirectory" = "build";
-            "C_Cpp.intelliSenseEngine" = "disabled";
-            "clangd.arguments" = [ "-header-insertion=never" ];
-            "cmake.ctestDefaultArgs" = [ "-T" "test" "--output-on-failure" "--verbose" ];
-            "terminal.integrated.mouseWheelZoom" = true;
-            "notebook.lineNumbers" = "on";
-            "editor.codeActionsOnSave" = {};
-            "jupyter.notebookFileRoot" = "\${workspaceFolder}";
-            "svg.preview.transparencyGrid" = false;
-            "svg.preview.boundingBox" = false;
-            "latex-workshop.latex.tools" =
-            [
-              {
-                name = "xelatex";
-                command = "xelatex";
-                args = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "latexmk";
-                command = "latexmk";
-                args = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "-pdf" "-outdir=%OUTDIR%" "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "lualatexmk";
-                command = "latexmk";
-                args =
-                  [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "-lualatex" "-outdir=%OUTDIR%" "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "xelatexmk";
-                command = "latexmk";
-                args =
-                  [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "-xelatex" "-outdir=%OUTDIR%" "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "latexmk_rconly";
-                command = "latexmk";
-                args = [ "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "pdflatex";
-                command = "pdflatex";
-                args = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOC%" ];
-                env = {};
-              }
-              {
-                name = "bibtex";
-                command = "bibtex";
-                args = [ "%DOCFILE%" ];
-                env = {};
-              }
-              {
-                name = "rnw2tex";
-                command = "Rscript";
-                args = [ "-e" "knitr::opts_knit$set(concordance = TRUE); knitr::knit('%DOCFILE_EXT%')" ];
-                env = {};
-              }
-              {
-                name = "jnw2tex";
-                command = "julia";
-                args = [ "-e" "using Weave; weave(\"%DOC_EXT%\", doctype=\"tex\")" ];
-                env = {};
-              }
-              {
-                name = "jnw2texminted";
-                command = "julia";
-                args = [ "-e" "using Weave; weave(\"%DOC_EXT%\", doctype=\"texminted\")" ];
-                env = {};
-              }
-              {
-                name = "pnw2tex";
-                command = "pweave";
-                args = [ "-f" "tex" "%DOC_EXT%" ];
-                env = {};
-              }
-              {
-                name = "pnw2texminted";
-                command = "pweave";
-                args = [ "-f" "texminted" "%DOC_EXT%" ];
-                env = {};
-              }
-              {
-                name = "tectonic";
-                command = "tectonic";
-                args = [ "--synctex" "--keep-logs" "--print" "%DOC%.tex" ];
-                env = {};
-              }
-            ];
-            "todo-tree.general.tags" = [ "BUG" "HACK" "FIXME" "TODO" ];
-            "ltex.additionalRules.motherTongue" = "zh-CN";
-            "ltex.ltex-ls.path" = "/run/current-system/sw";
-            "cmake.ignoreCMakeListsMissing" = true;
-            "[nix]"."editor.defaultFormatter" = "jnoortheen.nix-ide";
-            "todo-tree.filtering.excludedWorkspaces" = [ "/nix/remote/**" ];
-            "dataWrangler.outputRenderer.enabledTypes" =
-            {
-              "numpy.ndarray" = true;
-              "builtins.list" = true;
-              "builtins.dict" = true;
-            };
-            "ltex.language" = "auto";
-            # maybe this could fix typst preview freezing on large project
-            "tinymist.preview.partialRendering" = false;
-            "tinymist.preview.refresh" = "onSave";
-            "workbench.secondarySideBar.defaultVisibility" = "hidden";
-          };
-        };
-      };
-    })];
+                name = set;
+                value =
+                  # provided by nixpkgs
+                  vscode-extensions.${set} or {}
+                  # provided by nix-vscode-extensions, including pre-release versions, but prefer stable version
+                  // nix-vscode-extensions.vscode-marketplace.${set} or {}
+                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {}
+                  # some versions are too high for the current vscode, use old version from here to override it
+                  // (nix-vscode-extensions.forVSCodeVersion inputs.pkgs.vscode.version)
+                    .vscode-marketplace-release.${set} or {};
+              })
+              (inputs.lib.unique
+              (
+                (builtins.attrNames vscode-extensions)
+                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace)
+                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace-release)
+              )));
+            in with extensions;
+              (with github; [ copilot copilot-chat github-vscode-theme ])
+              ++ (with intellsmi; [ comment-translate ])
+              ++ (with ms-vscode; [ cmake-tools cpptools-extension-pack hexeditor remote-explorer ])
+              ++ (with ms-vscode-remote; [ remote-ssh ])
+              ++ [
+                donjayamanne.githistory fabiospampinato.vscode-diff
+                llvm-vs-code-extensions.vscode-clangd ms-ceintl.vscode-language-pack-zh-hans
+                oderwat.indent-rainbow
+                twxs.cmake guyutongxue.cpp-reference thfriedrich.lammps leetcode.vscode-leetcode # znck.grammarly
+                james-yu.latex-workshop bbenoist.nix jnoortheen.nix-ide ccls-project.ccls
+                brettm12345.nixfmt-vscode
+                gruntfuggly.todo-tree
+                # restrctured text
+                lextudio.restructuredtext trond-snekvik.simple-rst swyddfa.esbonio chrisjsewell.myst-tml-syntax
+                # markdown
+                yzhang.markdown-all-in-one shd101wyy.markdown-preview-enhanced
+                # vasp
+                mystery.vasp-support
+                yutengjing.open-in-external-app
+                # git graph
+                mhutchie.git-graph
+                # python
+                ms-python.python
+                # theme
+                pkief.material-icon-theme
+                # direnv
+                mkhl.direnv
+                # svg viewer
+                vitaliymaz.vscode-svg-previewer
+                # draw
+                pomdtr.excalidraw-editor
+                # typst
+                myriad-dreamin.tinymist
+                # grammaly alternative
+                ltex-plus.vscode-ltex-plus
+              ]
+              # jupyter
+              # TODO: pick all extensions from nixpkgs or nix-vscode-extensions, explicitly
+              ++ (with vscode-extensions.ms-toolsai;
+              [
+                jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
+                datawrangler
+              ]);
+          extraFlags = builtins.concatStringsSep " " inputs.config.nixos.packages.packages._vscodeEnvFlags;
+        }
+      )];
+    };
  };
 }
--- a/modules/packages/winapps/default.nix
+++ b/modules/packages/winapps/default.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.winapps = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
  config = let inherit (inputs.config.nixos.packages) winapps; in inputs.lib.mkIf (winapps != null)
  {
    nixos.packages.packages._packages =
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -15,57 +15,41 @@ inputs:
  };
  config = let inherit (inputs.config.nixos.services) gitea; in inputs.lib.mkIf (gitea != null)
  {
-    services =
+    services.gitea =
    {
-      gitea =
+      enable = true;
+      lfs.enable = true;
+      mailerPasswordFile = inputs.config.nixos.system.sops.secrets."gitea/mail".path;
+      database =
      {
-        enable = true;
-        lfs.enable = true;
-        mailerPasswordFile = inputs.config.nixos.system.sops.secrets."gitea/mail".path;
-        database =
-        {
-          createDatabase = false;
-          type = "postgres";
-          passwordFile = inputs.config.nixos.system.sops.secrets."gitea/db".path;
-        };
-        settings =
-        {
-          session.COOKIE_SECURE = true;
-          server =
-          {
-            ROOT_URL = "https://${gitea.hostname}";
-            DOMAIN = gitea.hostname;
-            HTTP_PORT = 3002;
-            SSH_DOMAIN = gitea.ssh.hostname;
-            SSH_PORT = inputs.lib.mkIf (gitea.ssh.port != null) gitea.ssh.port;
-            LFS_ALLOW_PURE_SSH = true;
-          };
-          mailer =
-          {
-            ENABLED = true;
-            FROM = "bot@chn.moe";
-            PROTOCOL = "smtps";
-            SMTP_ADDR = "mail.chn.moe";
-            SMTP_PORT = 465;
-            USER = "bot@chn.moe";
-          };
-          service.DISABLE_REGISTRATION = true;
-          security.LOGIN_REMEMBER_DAYS = 365;
-          "git.timeout" = builtins.listToAttrs (builtins.map (n: { name = n; value = 3600 * 8; })
-            [ "DEFAULT" "MIGRATE" "MIRROR" "CLONE" "PULL" "GC" ]);
-          "cron.git_gc_repos" = { ENABLED = true; SCHEDULE = "@monthly"; TIMEOUT = "2h"; };
-          "cron.gc_lfs" = { ENABLED = true; SCHEDULE = "@monthly"; NUMBER_TO_CHECK_PER_REPO = 0; };
-        };
-        package = inputs.pkgs.pkgs-unstable.gitea;
+        createDatabase = false;
+        type = "postgres";
+        passwordFile = inputs.config.nixos.system.sops.secrets."gitea/db".path;
      };
-      anubis.instances.gitea.settings =
+      settings =
      {
-        OG_PASSTHROUGH = true;
-        TARGET = "http://127.0.0.1:3002";
-        BIND_NETWORK = "tcp";
-        BIND = "127.0.0.1:3003";
-        WEBMASTER_EMAIL = "chn@chn.moe";
-        SERVE_ROBOTS_TXT = true;
+        session.COOKIE_SECURE = true;
+        server =
+        {
+          ROOT_URL = "https://${gitea.hostname}";
+          DOMAIN = gitea.hostname;
+          HTTP_PORT = 3002;
+          SSH_DOMAIN = gitea.ssh.hostname;
+          SSH_PORT = inputs.lib.mkIf (gitea.ssh.port != null) gitea.ssh.port;
+        };
+        mailer =
+        {
+          ENABLED = true;
+          FROM = "bot@chn.moe";
+          PROTOCOL = "smtps";
+          SMTP_ADDR = "mail.chn.moe";
+          SMTP_PORT = 465;
+          USER = "bot@chn.moe";
+        };
+        service.DISABLE_REGISTRATION = true;
+        security.LOGIN_REMEMBER_DAYS = 365;
+        "git.timeout" = builtins.listToAttrs (builtins.map (n: { name = n; value = 1800; })
+          [ "DEFAULT" "MIGRATE" "MIRROR" "CLONE" "PULL" "GC" ]);
      };
    };
    nixos =
@@ -78,10 +62,19 @@ inputs:
      };
      services =
      {
-        nginx.https.${gitea.hostname}.location."/".proxy.upstream = "http://127.0.0.1:3003";
+        nginx.https.${gitea.hostname}.location =
+        {
+          "/".proxy.upstream = "http://127.0.0.1:3002";
+          "/robots.txt".static.root =
+            let robotsFile = inputs.pkgs.fetchurl
+            {
+              url = "https://gitea.com/robots.txt";
+              sha256 = "144c5s3la4a85c9lygcnxhbxs3w5y23bkhhqx69fbp9yiqyxdkk2";
+            };
+            in "${inputs.pkgs.runCommand "robots.txt" {} "mkdir -p $out; cp ${robotsFile} $out/robots.txt"}";
+        };
        postgresql.instances.gitea = {};
      };
    };
-    systemd.services.gitea.path = [ inputs.pkgs.git-lfs-transfer ];
  };
 }
--- a/modules/services/lumericalLicenseManager/default.nix
+++ b/modules/services/lumericalLicenseManager/default.nix
@@ -4,7 +4,12 @@ inputs:
  {
    type = types.nullOr (types.submodule { options =
    {
-      macAddress = mkOption { type = types.str; };
+      macAddress = mkOption
+      {
+        type = types.str;
+        default = if inputs.config.nixos.system.network != null then "00:01:23:45:67:89" else null;
+      };
+      createFakeInterface = mkOption { type = types.bool; default = inputs.config.nixos.system.network != null; };
      autoStart = mkOption { type = types.bool; default = true; };
    };});
    default = null;
@@ -23,7 +28,16 @@ inputs:
        in [ "${license}:/home/ansys_inc/shared_files/licensing/license_files/ansyslmd.lic" ];
    };
    nixos.services.podman = {};
-    systemd.services.podman-lumericalLicenseManager.wantedBy =
-      inputs.lib.mkIf (!lumericalLicenseManager.autoStart) (inputs.lib.mkForce []);
+    systemd =
+    {
+      network = inputs.lib.mkIf lumericalLicenseManager.createFakeInterface
+      {
+        netdevs.ensFakeLumerical.netdevConfig = { Kind = "dummy"; Name = "ensFakeLumerical"; };
+        networks."10-ensFakeLumerical" =
+          { matchConfig.Name = "ensFakeLumerical"; linkConfig.MACAddress = lumericalLicenseManager.macAddress; };
+      };
+      services.podman-lumericalLicenseManager.wantedBy =
+        inputs.lib.mkIf (!lumericalLicenseManager.autoStart) (inputs.lib.mkForce []);
+    };
  };
 }
--- a/modules/services/mariadb.nix
+++ b/modules/services/mariadb.nix
@@ -13,7 +13,6 @@ inputs:
      };}));
      default = {};
    };
-    mountFrom = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
  };
  config = let inherit (inputs.config.nixos.services) mariadb; in inputs.lib.mkIf mariadb.enable
  {
@@ -31,7 +30,7 @@ inputs:
      };
      mysqlBackup =
      {
-        enable = mariadb.mountFrom == "nodatacow";
+        enable = true;
        singleTransaction = true;
        databases = builtins.map (db: db.value.database) (inputs.localLib.attrsToList mariadb.instances);
      };
@@ -50,10 +49,7 @@ inputs:
    nixos.system.sops.secrets = builtins.listToAttrs (builtins.map
      (db: { name = "mariadb/${db.value.user}"; value.owner = inputs.config.users.users.mysql.name; })
      (builtins.filter (db: db.value.passwordFile == null) (inputs.localLib.attrsToList mariadb.instances)));
-    environment.persistence = inputs.lib.mkIf (mariadb.mountFrom != null)
-    {
-      "/nix/${mariadb.mountFrom}".directories =
-        [{ directory = "/var/lib/mysql"; user = "mysql"; group = "mysql"; mode = "0750"; }];
-    };
+    environment.persistence."/nix/nodatacow".directories =
+      [{ directory = "/var/lib/mysql"; user = "mysql"; group = "mysql"; mode = "0750"; }];
  };
 }
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -51,8 +51,6 @@ inputs:
        # allow realip module to set ip
        set_real_ip_from 0.0.0.0/0;
        real_ip_header proxy_protocol;
-        # gitea needs long time to upload/download large files over ssh
-        client_body_timeout 1h;
      '';
      proxyTimeout = "1d";
      recommendedZstdSettings = true;
--- a/modules/services/nginx/http.nix
+++ b/modules/services/nginx/http.nix
@@ -66,8 +66,6 @@ inputs:
            {
              proxyPass = v.proxy.upstream;
              proxyWebsockets = v.proxy.websocket;
-              recommendedProxySettings = false;
-              recommendedProxySettingsNoHost = true;
              extraConfig = builtins.concatStringsSep "\n" (inputs.lib.mapAttrsToList
                (n: v: ''proxy_set_header ${n} "${v}";'')
                v.proxy.setHeaders);
--- a/modules/services/nginx/https.nix
+++ b/modules/services/nginx/https.nix
@@ -66,6 +66,7 @@ inputs:
                inherit (genericOptions) detectAuth;
                upstream = mkOption { type = types.nonEmptyStr; };
                websocket = mkOption { type = types.bool; default = false; };
+                grpc = mkOption { type = types.bool; default = false; };
                setHeaders = mkOption
                  { type = types.attrsOf types.str; default.Host = siteSubmoduleInputs.config._module.args.name; };
                # echo -n "username:password" | base64
@@ -234,12 +235,10 @@ inputs:
                    proxy =
                    {
                      proxyWebsockets = location.value.websocket;
-                      recommendedProxySettings = false;
-                      recommendedProxySettingsNoHost = true;
-                      proxyPass = location.value.upstream;
                      extraConfig = builtins.concatStringsSep "\n"
                      (
-                        (inputs.lib.mapAttrsToList (n: v: ''proxy_set_header ${n} "${v}";'')
+                        [ "${if location.value.grpc then "grpc" else "proxy"}_pass ${location.value.upstream};" ]
+                        ++ (inputs.lib.mapAttrsToList (n: v: ''proxy_set_header ${n} "${v}";'')
                          location.value.setHeaders)
                        ++ (inputs.lib.optionals
                          (location.value.detectAuth != null || site.value.global.detectAuth != null)
--- a/modules/services/nixvirt.nix
+++ b/modules/services/nixvirt.nix
@@ -21,7 +21,7 @@ inputs:
            storage =
            {
              name = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-              mountFrom = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+              nodatacow = mkOption { type = types.bool; default = false; };
              iso = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
            };
            memory =
@@ -199,12 +199,8 @@ inputs:
                    type = "file";
                    device = "disk";
                    driver = { name = "qemu"; type = "raw"; cache = "writeback"; discard = "unmap"; };
-                    source.file = builtins.concatStringsSep ""
-                    [
-                      (if (v.storage.mountFrom != null) then "/nix/${v.storage.mountFrom}" else "")
-                      "/var/lib/libvirt/images/"
-                      "${v.storage.name}.img"
-                    ];
+                    source.file = "${if v.storage.nodatacow then "/nix/nodatacow" else ""}/var/lib/libvirt/images/"
+                      + "${v.storage.name}.img";
                    target = { dev = "vda"; bus = "virtio"; };
                    boot.order = 1;
                  }
--- a/modules/services/peerBanHelper.nix
+++ b/modules/services/peerBanHelper.nix
@@ -1,16 +0,0 @@
-inputs:
-{
-  options.nixos.services.peerBanHelper = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) peerBanHelper; in inputs.lib.mkIf (peerBanHelper != null)
-  {
-    virtualisation.oci-containers.containers.peerBanHelper =
-    {
-      inherit (inputs.topInputs.self.src.peerBanHelper) image imageFile;
-      volumes = [ "peerBanHelper:/app/data" ];
-      ports = [ "9898:9898/tcp" ];
-      environment = { PUID = "0"; PGID = "0"; TZ = "UTC"; };
-    };
-    nixos.services.podman = {};
-  };
-}
--- a/modules/services/photoprism.nix
+++ b/modules/services/photoprism.nix
@@ -21,8 +21,8 @@ inputs:
    };
    systemd.services.photoprism =
    {
-      after = [ "mysql.service" ];
-      requires = [ "mysql.service" ];
+      after = [ "mariadb.service" ];
+      requires = [ "mariadb.service" ];
      serviceConfig.EnvironmentFile = inputs.config.nixos.system.sops.templates."photoprism/env".path; 
    };
    nixos =
--- a/modules/services/postgresql.nix
+++ b/modules/services/postgresql.nix
@@ -14,7 +14,7 @@ inputs:
      };}));
      default = {};
    };
-    mountFrom = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+    nodatacow = mkOption { type = types.bool; default = false; };
  };
  config = let inherit (inputs.config.nixos.services) postgresql; in inputs.lib.mkIf postgresql.enable
  {
@@ -52,7 +52,7 @@ inputs:
      };
      postgresqlBackup =
      {
-        enable = postgresql.mountFrom == "nodatacow";
+        enable = postgresql.nodatacow;
        pgdumpOptions = "-Fc";
        compression = "none";
        databases = builtins.map (db: db.value.database) (inputs.localLib.attrsToList postgresql.instances);
@@ -88,10 +88,7 @@ inputs:
    nixos.system.sops.secrets = builtins.listToAttrs (builtins.map
      (db: { name = "postgresql/${db.value.user}"; value.owner = inputs.config.users.users.postgres.name; })
      (builtins.filter (db: db.value.passwordFile == null) (inputs.localLib.attrsToList postgresql.instances)));
-    environment.persistence = inputs.lib.mkIf (postgresql.mountFrom != null)
-    {
-      "/nix/${postgresql.mountFrom}".directories =
-        [{ directory = "/var/lib/postgresql"; user = "postgres"; group = "postgres"; mode = "0750"; }];
-    };
+    environment.persistence."/nix/nodatacow".directories = inputs.lib.mkIf postgresql.nodatacow
+      [{ directory = "/var/lib/postgresql"; user = "postgres"; group = "postgres"; mode = "0750"; }];
  };
 }
--- a/modules/services/slurm.nix
+++ b/modules/services/slurm.nix
@@ -282,19 +282,6 @@ inputs:
                  };
                })
                slurm.tui.cpuQueues;
-              Fdtd.Queue = builtins.map
-                (queue:
-                {
-                  Name = queue.name;
-                  Recommended =
-                  {
-                    Cpus =
-                      if queue.allocateCpus != null then queue.allocateCpus
-                      else queue.mpiThreads * queue.openmpThreads;
-                    Memory = queue.memoryGB;
-                  };
-                })
-                slurm.tui.cpuQueues;
            }
            // (if slurm.tui.gpuQueues == null then {} else rec
            {
--- a/modules/services/xray/client.nix
+++ b/modules/services/xray/client.nix
@@ -49,7 +49,7 @@ inputs:
      {
        owner = inputs.config.users.users.v2ray.name;
        group = inputs.config.users.users.v2ray.group;
-        content = builtins.toJSON
+        content = let chinaDns = "223.5.5.5"; foreignDns = "8.8.8.8"; in builtins.toJSON
        {
          log.loglevel = "warning";
          dns =
@@ -59,19 +59,19 @@ inputs:
            # 若匹配域名列表失败，或者匹配成功但是查询到的 IP 不在期望的 IP 列表中，则回落到使用后两个 dns 依次查询。
            [
              {
-                address = "https://1.12.12.12/dns-query";
+                address = chinaDns;
                domains = [ "geosite:geolocation-cn" ];
                expectIPs = [ "geoip:cn" ];
                skipFallback = true;
              }
              {
-                address = "8.8.8.8";
+                address = foreignDns;
                domains = [ "geosite:geolocation-!cn" ];
                expectIPs = [ "geoip:!cn" ];
                skipFallback = true;
              }
-              { address = "https://1.12.12.12/dns-query"; expectIPs = [ "geoip:cn" ]; }
-              { address = "8.8.8.8"; }
+              { address = chinaDns; expectIPs = [ "geoip:cn" ]; }
+              { address = foreignDns; }
            ];
            disableCache = true;
            queryStrategy = "UseIPv4";
@@ -153,8 +153,8 @@ inputs:
            rules = builtins.map (rule: rule // { type = "field"; })
            [
              { inboundTag = [ "dns-in" ]; outboundTag = "dns-out"; }
-              { inboundTag = [ "dns-internal" ]; ip = [ "1.12.12.12" ]; outboundTag = "direct"; }
-              { inboundTag = [ "dns-internal" ]; ip = [ "8.8.8.8" ]; outboundTag = "proxy-vless"; }
+              { inboundTag = [ "dns-internal" ]; ip = [ chinaDns ]; outboundTag = "direct"; }
+              { inboundTag = [ "dns-internal" ]; ip = [ foreignDns ]; outboundTag = "proxy-vless"; }
              { inboundTag = [ "dns-internal" ]; outboundTag = "block"; }
              { inboundTag = [ "xmu-in" ]; outboundTag = "xmu-out"; }
              { inboundTag = [ "direct-in" ]; outboundTag = "direct"; }
--- a/modules/services/xray/xmuServer.nix
+++ b/modules/services/xray/xmuServer.nix
@@ -60,6 +60,6 @@ inputs:
      groups.v2ray.gid = inputs.config.nixos.user.gid.v2ray;
    };
    nixos.services.nginx.https.${xmuServer.hostname}.location =
-      { "/".return.return = "400"; "/xsession".proxy.upstream = "http://127.0.0.1:4727"; };
+      { "/".return.return = "400"; "/xsession".proxy = { upstream = "127.0.0.1:4727"; grpc = true; }; };
  };
 }
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -59,6 +59,5 @@ inputs:
      configurationRevision = inputs.topInputs.self.rev or "dirty";
      nixos = { versionSuffix = inputs.lib.mkForce ""; tags = [ inputs.topInputs.self.config.branch ]; };
    };
-    chaotic.nyx.cache.enable = false;
  };
 }
--- a/modules/system/fileSystems/default.nix
+++ b/modules/system/fileSystems/default.nix
@@ -61,13 +61,9 @@ inputs:
                  # zstd:15 5m33s 7.16G
                  # zstd:8 54s 7.32G
                  # zstd:3 17s 7.52G
-                  # use compress instead of compress-force, since compress-force force all data trunk to be < 128K
-                  # https://github.com/Zygo/bees/issues/298#issuecomment-3085228968
-                  "compress=zstd"
+                  "compress-force=zstd"
                  # large btrfs volume need more time to mount (default 90s might not be enough)
                  "x-systemd.mount-timeout=300s"
-                  # default noflushoncommit can cause data loss, especially working with beesd, when power lost
-                  "flushoncommit"
                ];
                neededForBoot = true;
              };
--- a/modules/system/fileSystems/impermanence.nix
+++ b/modules/system/fileSystems/impermanence.nix
@@ -67,7 +67,7 @@ inputs:
      "/nix/persistent".users.chn.directories =
      [
        "bin" "Desktop" "Documents" "Downloads" "Music" "Pictures" "repo" "share" "Public" "Videos" ".config"
-        ".local/share" ".ecdata" { directory = ".mozilla/firefox/default"; mode = "0700"; } ".steam" ".zotero"
+        ".local/share" ".ecdata" { directory = ".mozilla/firefox/default"; mode = "0700"; } ".steam" ".vscode" ".zotero"
        "Zotero"
      ];
    })
--- a/modules/system/fileSystems/nfs.nix
+++ b/modules/system/fileSystems/nfs.nix
@@ -29,11 +29,8 @@ inputs:
              neededForBoot = device.value.hard or true;
              options = builtins.concatLists
              [
-                [
-                  "actimeo=1" # sync every seconds
-                  "noatime"
-                  "x-gvfs-hide" # hide in file managers (e.g. dolphin)
-                ]
+                # sync every seconds
+                [ "actimeo=1" "noatime" ]
                # when try to mount at startup, wait 15 minutes before giving up
                (inputs.lib.optionals (device.value.hard or true) [ "retry=15" "x-systemd.device-timeout=15min" ])
                # do not fail, just try continuously in background
--- a/modules/system/fileSystems/rollingRootfs.nix
+++ b/modules/system/fileSystems/rollingRootfs.nix
@@ -41,7 +41,7 @@ inputs:
              ${waitDevice}

              # mount device
-              mount ${device} /mnt -m -o noatime,compress-force=zstd
+              mount ${device} /mnt -m

              # move old rootfs, create new one
              if [ -f /mnt/nix/rootfs/current/.timestamp ]
--- a/modules/system/font.nix
+++ b/modules/system/font.nix
@@ -10,8 +10,6 @@ inputs:
        noto-fonts source-han-sans source-han-serif source-code-pro hack-font jetbrains-mono hack-font inter
        noto-fonts-color-emoji roboto sarasa-gothic source-han-mono wqy_microhei wqy_zenhei noto-fonts-cjk-sans
        noto-fonts-emoji corefonts vistafonts vistafonts-chs dejavu_fonts nerd-fonts.fira-code
-        # needed by typst may template
-        lxgw-wenkai libertinus
      ];
      fontconfig.defaultFonts =
      {
--- a/modules/system/grub.nix
+++ b/modules/system/grub.nix
@@ -1,86 +1,80 @@
 inputs:
 {
-  options.nixos.system.grub = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.system.grub = let inherit (inputs.lib) mkOption types; in
  {
-    type = types.nullOr (types.submodule { options =
-    {
-      timeout = mkOption { type = types.int; default = 15; };
-      windowsEntries = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
-      # "efi" using efi, "efiRemovable" using efi with install grub removable, or dev path like "/dev/sda" using bios
-      installDevice = mkOption { type = types.str; default = "efi"; };
-    };});
-    default = { x86_64 = {}; aarch64 = null; }.${inputs.config.nixos.model.arch};
+    timeout = mkOption { type = types.int; default = 15; };
+    windowsEntries = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
+    # "efi" using efi, "efiRemovable" using efi with install grub removable, or dev path like "/dev/sda" using bios
+    installDevice = mkOption { type = types.str; default = "efi"; };
  };
-  config = let inherit (inputs.config.nixos.system) grub; in inputs.localLib.mkConditional (grub != null)
-    (inputs.lib.mkMerge
-    [
-      # general settings
-      { boot.loader.grub = { enable = true; useOSProber = false; }; }
-      # grub timeout
-      { boot.loader.timeout = grub.timeout; }
-      # grub install
+  config = let inherit (inputs.config.nixos.system) grub; in inputs.lib.mkMerge
+  [
+    # general settings
+    { boot.loader.grub = { enable = true; useOSProber = false; }; }
+    # grub timeout
+    { boot.loader.timeout = grub.timeout; }
+    # grub install
+    {
+      boot.loader =
      {
-        boot.loader =
+        grub =
        {
-          grub =
-          {
-            device = if builtins.elem grub.installDevice [ "efi" "efiRemovable" ] then "nodev" else grub.installDevice;
-            efiSupport = builtins.elem grub.installDevice [ "efi" "efiRemovable" ];
-            efiInstallAsRemovable = grub.installDevice == "efiRemovable";
-          };
-          efi.canTouchEfiVariables = grub.installDevice == "efi";
+          device = if builtins.elem grub.installDevice [ "efi" "efiRemovable" ] then "nodev" else grub.installDevice;
+          efiSupport = builtins.elem grub.installDevice [ "efi" "efiRemovable" ];
+          efiInstallAsRemovable = grub.installDevice == "efiRemovable";
        };
-      }
-      # extra grub entries
+        efi.canTouchEfiVariables = grub.installDevice == "efi";
+      };
+    }
+    # extra grub entries
+    {
+      boot.loader.grub =
      {
-        boot.loader.grub =
-        {
-          memtest86.enable = true;
-          extraFiles = inputs.lib.mkIf (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
-            { "shell.efi" = "${inputs.pkgs.genericPackages.edk2-uefi-shell}/shell.efi"; };
-          extraEntries = inputs.lib.mkMerge (builtins.concatLists
+        memtest86.enable = true;
+        extraFiles = inputs.lib.mkIf (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
+          { "shell.efi" = "${inputs.pkgs.genericPackages.edk2-uefi-shell}/shell.efi"; };
+        extraEntries = inputs.lib.mkMerge (builtins.concatLists
+        [
+          (builtins.map
+            (system:
+            ''
+              menuentry "${system.value}" {
+                insmod part_gpt
+                insmod fat
+                insmod search_fs_uuid
+                insmod chain
+                search --fs-uuid --set=root ${system.name}
+                chainloader /EFI/Microsoft/Boot/bootmgfw.efi
+              }
+            '')
+            (inputs.localLib.attrsToList grub.windowsEntries))
          [
-            (builtins.map
-              (system:
+            ''
+              menuentry "System shutdown" {
+                echo "System shutting down..."
+                halt
+              }
+              menuentry "System restart" {
+                echo "System rebooting..."
+                reboot
+              }
+            ''
+            (
+              inputs.lib.optionalString (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
              ''
-                menuentry "${system.value}" {
-                  insmod part_gpt
+                menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+                  fwsetup
+                }
+                menuentry "UEFI Shell" {
                  insmod fat
-                  insmod search_fs_uuid
                  insmod chain
-                  search --fs-uuid --set=root ${system.name}
-                  chainloader /EFI/Microsoft/Boot/bootmgfw.efi
-                }
-              '')
-              (inputs.localLib.attrsToList grub.windowsEntries))
-            [
-              ''
-                menuentry "System shutdown" {
-                  echo "System shutting down..."
-                  halt
-                }
-                menuentry "System restart" {
-                  echo "System rebooting..."
-                  reboot
+                  chainloader @bootRoot@/shell.efi
                }
              ''
-              (
-                inputs.lib.optionalString (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
-                ''
-                  menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
-                    fwsetup
-                  }
-                  menuentry "UEFI Shell" {
-                    insmod fat
-                    insmod chain
-                    chainloader @bootRoot@/shell.efi
-                  }
-                ''
-              )
-            ]
-          ]);
-        };
-      }
-    ])
-    { boot.loader.grub.enable = false; };
+            )
+          ]
+        ]);
+      };
+    }
+  ];
 }
--- a/modules/system/gui.nix
+++ b/modules/system/gui.nix
@@ -12,7 +12,7 @@ inputs:
      services =
      {
        desktopManager.plasma6.enable = inputs.lib.mkIf (gui.implementation == "kde") true;
-        greetd =
+        greetd = inputs.lib.mkDefault
        {
          enable = true;
          settings.default_session.command =
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -4,8 +4,8 @@ inputs:
  {
    variant = mkOption
    {
-      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "xanmod-unstable" "cachyos" ]);
-      default = { x86_64 = "xanmod-lts"; aarch64 = "nixos"; }.${inputs.config.nixos.model.arch};
+      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "xanmod-unstable" "steamos" ]);
+      default = "xanmod-lts";
    };
    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
  };
@@ -34,54 +34,25 @@ inputs:
        # network for srv3
        "igb"
        # touchscreen for one
-        "i2c-hid-acpi"
+        "pinctrl-tigerlake" "i2c-hid-acpi"
        # bridge network
        "bridge"
-        # disk for nas
-        "ahci" "nvme" "igc"
      ]
-        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ])
-        # touchscreen for one
-        ++ (inputs.lib.optionals (inputs.config.nixos.model.arch == "x86_64") [ "pinctrl-tigerlake" ]);
-      extraModulePackages = with inputs.config.boot.kernelPackages;
-      [
-        v4l2loopback
-        (if inputs.pkgs.stdenv.hostPlatform.linuxArch == "x86_64" then zenpower else inputs.pkgs.emptyDirectory)
-      ];
+        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
+      extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
      # force i2c-hid-acpi to load after pinctrl-tigerlake
      extraModprobeConfig = "softdep i2c-hid-acpi pre: pinctrl-tigerlake";
-      kernelParams = inputs.lib.mkMerge
-      [
-        [ "delayacct" ]
-        (inputs.lib.mkIf (builtins.elem "btrfs" kernel.patches) [ "btrfs.read_policy=queue" ])
-      ];
+      kernelParams = [ "delayacct" ];
      kernelPackages = inputs.lib.mkIf (kernel.variant != null)
      {
        nixos = inputs.pkgs.linuxPackages;
        xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
        xanmod-latest = inputs.pkgs.linuxPackages_xanmod_latest;
        xanmod-unstable = inputs.pkgs.pkgs-unstable.linuxPackages_xanmod_latest;
-        cachyos = inputs.pkgs.linuxPackages_cachyos;
+        steamos = inputs.pkgs.linuxPackages_jovian;
      }.${kernel.variant};
      kernelPatches =
-        let patches =
-        {
-          hibernate-progress = [{ name = "hibernate-progress"; patch = ./hibernate-progress.patch; }];
-          btrfs =
-            let configName =
-              if inputs.config.nixos.system.kernel.variant == "xanmod-unstable" then "structuredExtraConfig"
-              else "extraStructuredConfig";
-            in
-            [{
-              name = "btrfs";
-              patch = inputs.pkgs.fetchurl
-              {
-                url = "https://github.com/kakra/linux/pull/36.patch";
-                sha256 = "0wimihsvrxib6g23jcqdbvqlkqk6nbqjswfx9bzmpm1vlvzxj8m0";
-              };
-              ${configName}.BTRFS_EXPERIMENTAL = inputs.lib.kernel.yes;
-            }];
-        };
+        let patches.hibernate-progress = [{ name = "hibernate-progress"; patch = ./hibernate-progress.patch; }];
        in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
    };
  };
--- a/modules/system/nix-ld.nix
+++ b/modules/system/nix-ld.nix
@@ -1,10 +1,7 @@
 inputs:
 {
  options.nixos.system.nix-ld = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.arch == "x86_64" then {} else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = {}; };
  config = let inherit (inputs.config.nixos.system) nix-ld; in inputs.lib.mkIf (nix-ld != null)
  {
    programs.nix-ld =
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -33,8 +33,7 @@ inputs:
        max-jobs = 4;
        cores = 0;
        keep-going = true;
-        # do not keep unused outputs, backup it manually on nas
-        keep-outputs = false;
+        keep-outputs = true;
        connect-timeout = 5;
      };
      systemd.services.nix-daemon = { serviceConfig.CacheDirectory = "nix"; environment.TMPDIR = "/var/cache/nix"; };
--- a/modules/system/nixpkgs.nix
+++ b/modules/system/nixpkgs.nix
@@ -16,9 +16,19 @@ inputs:
  config = let inherit (inputs.config.nixos.system) nixpkgs; in
  {
    nixpkgs = inputs.localLib.buildNixpkgsConfig
-    {
-      inherit inputs;
-      nixpkgs = nixpkgs // { nixRoot = null; nixos = true; inherit (inputs.config.nixos.model) arch; };
-    };
+      { inherit inputs; nixpkgs = nixpkgs // { nixRoot = null; nixos = true; }; };
+    boot.kernelPatches = inputs.lib.mkIf
+      (nixpkgs.march != null && inputs.config.nixos.system.kernel.variant != "steamos")
+      [{
+        name = "native kernel";
+        patch = null;
+        extraStructuredConfig =
+          let kernelConfig = { znver2 = "MZEN2"; znver3 = "MZEN3"; znver4 = "MZEN4"; };
+          in
+          {
+            GENERIC_CPU = inputs.lib.kernel.no;
+            ${kernelConfig.${nixpkgs.march} or "M${inputs.lib.toUpper nixpkgs.march}"} = inputs.lib.kernel.yes;
+          };
+      }];
  };
 }
--- a/modules/system/uboot.nix
+++ b/modules/system/uboot.nix
@@ -1,19 +0,0 @@
-inputs:
-{
-  options.nixos.system.uboot = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule (submoduleInputs: { options =
-    {
-      buildArgs = mkOption { type = types.attrsOf types.anything; };
-      package = mkOption
-      {
-        type = types.package;
-        readOnly = true;
-        default = inputs.pkgs.buildUBoot submoduleInputs.config.buildArgs;
-      };
-    };}));
-    default = { x86_64 = null; aarch64 = {}; }.${inputs.config.nixos.model.arch};
-  };
-  config = let inherit (inputs.config.nixos.system) uboot; in inputs.lib.mkIf (uboot != null)
-    { boot.loader.generic-extlinux-compatible.enable = true; };
-}
--- a/modules/user/aleksana/default.nix
+++ b/modules/user/aleksana/default.nix
@@ -0,0 +1,5 @@
+inputs:
+{
+  config = let inherit (inputs.config.nixos) user; in inputs.lib.mkIf (builtins.elem "aleksana" user.users)
+    { users.users.aleksana.extraGroups = inputs.lib.mkIf (inputs.config.nixos.model.hostname == "srv3") [ "wheel" ]; };
+}
--- a/modules/user/aleksana/id_ed25519.pub
+++ b/modules/user/aleksana/id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfnbbQUshhe86KNshwZQNdKEbBWs8u5hurJdLkIsSYV
--- a/modules/user/alikia/id_ed25519.pub
+++ b/modules/user/alikia/id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnzvCcneAdb8lLDaCTFC0TunEfE5I0X1t1hXEFl7qgN
--- a/modules/user/default.nix
+++ b/modules/user/default.nix
@@ -36,7 +36,6 @@ inputs:
        zgq = 1022;
        qmx = 1023;
        yumieko = 1024;
-        xly = 1025;
        misskey-misskey = 2000;
        misskey-misskey-old = 2001;
        frp = 2002;
--- a/modules/user/xly/id_ed25519.pub
+++ b/modules/user/xly/id_ed25519.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFIaeMJBb+T+R5i+A4UOSgb/PI1fjn+bXoteSB/JonNs xly
--- a/packages/biu/include/biu/process.tpp
+++ b/packages/biu/include/biu/process.tpp
@@ -19,7 +19,6 @@ namespace biu::process
    using namespace biu::literals;

    // 进程是在创建时就开始运行的，而不是在 io_context.run() 时才开始运行
-    // 传入的 io_context 只是为了方便同步 io

    // seach actual program
    boost::filesystem::path actual_program = [&]
@@ -35,10 +34,9 @@ namespace biu::process
      if constexpr (Mode.ModifyEnv)
      {
        auto current = bp::environment::current();
-        std::unordered_map<bp::environment::key, bp::environment::value> env;
-        for (const auto& e : current) env[e.key()] = e.value();
+        std::unordered_map<bp::environment::key, bp::environment::value> env
+          (current.begin(), current.end());
        for (const auto& [key, value] : input.ExtraEnv) env[key] = value;
-        return env;
      }
      else return bp::environment::current();
    }();
@@ -47,40 +45,79 @@ namespace biu::process
    // prepare io pipes
    std::unique_ptr<boost::asio::writable_pipe> stdin_pipe;
    std::unique_ptr<boost::asio::readable_pipe> stdout_pipe, stderr_pipe;
-    auto create_pipe_on_necessary = [&context]<typename T, IoType V>(auto& pipe) -> decltype(auto)
-    {
-      if constexpr (V == IoType::Close) return nullptr;
-      else if constexpr (V == IoType::Direct) return T();
-      else if constexpr (V == IoType::String)
+    std::function<void(boost::asio::readable_pipe& p, std::string& result)> read_some =
+      [&read_some](auto& p, auto& result)
      {
-        pipe = std::make_unique<typename std::remove_reference_t<decltype(pipe)>::element_type>(context);
-        return (*pipe);
-      }
-      else std::unreachable();
-    };
+        auto buffer = std::make_shared<std::array<char, 1024>>();
+        p.async_read_some
+        (
+          boost::asio::buffer(*buffer),
+          [&, buffer](const boost::system::error_code& ec, std::size_t len)
+          {
+            Logger::Guard log;
+            if (!ec) { result.append(buffer->data(), len); read_some(p, result); log.debug("read {}"_f(len)); }
+            else log.debug("Error reading from pipe: {} {}"_f(ec.value(), ec.message()));
+          }
+        );
+      };
+    std::function<void(boost::asio::writable_pipe& p, std::string& result)> write_some =
+      [&write_some](auto& p, auto& result)
+      {
+        if (result.empty()) { p.close(); return; }
+        auto buffer = std::make_shared<std::array<char, 1024>>();
+        std::copy(result.begin(), result.end(), buffer->begin());
+        p.async_write_some
+        (
+          boost::asio::buffer(*buffer),
+          [&, buffer](const auto& ec, std::size_t len)
+          {
+            Logger::Guard log;
+            if (!ec) { result.erase(0, len); write_some(p, result); log.debug("write {}"_f(len)); }
+            else log.debug("Error reading from pipe: {} {}"_f(ec.value(), ec.message()));
+          }
+        );
+      };
    bp::process_stdio stdio
    {
-      .in = create_pipe_on_necessary.template operator()
-        <decltype(bp::process_stdio::in), Mode.Stdin>(stdin_pipe),
-      .out = create_pipe_on_necessary.template operator()
-        <decltype(bp::process_stdio::out), Mode.Stdout>(stdout_pipe),
-      .err = create_pipe_on_necessary.template operator()
-        <decltype(bp::process_stdio::err), Mode.Stderr>(stderr_pipe)
-    };
-    auto stdio_write = [&]
-    {
-      if constexpr (Mode.Stdin == IoType::String)
+      .in = [&] -> decltype(auto)
      {
-        boost::asio::write(*stdin_pipe, boost::asio::buffer(input.Stdin));
-        stdin_pipe->close();
-      }
-    };
-    auto stdio_read = [&]
-    {
-      if constexpr (Mode.Stdout == IoType::String)
-        boost::asio::read(*stdout_pipe, boost::asio::dynamic_buffer(result.Stdout));
-      if constexpr (Mode.Stderr == IoType::String)
-        boost::asio::read(*stderr_pipe, boost::asio::dynamic_buffer(result.Stderr));
+        if constexpr (Mode.Stdin == IoType::Close) return nullptr;
+        else if constexpr (Mode.Stdin == IoType::Direct)
+          return decltype(bp::process_stdio::in)();
+        else if constexpr (Mode.Stdin == IoType::String)
+        {
+          stdin_pipe = std::make_unique<boost::asio::writable_pipe>(context);
+          write_some(*stdin_pipe, input.Stdin);
+          return (*stdin_pipe);
+        }
+        else std::unreachable();
+      }(),
+      .out = [&] -> decltype(auto)
+      {
+        if constexpr (Mode.Stdout == IoType::Close) return nullptr;
+        else if constexpr (Mode.Stdout == IoType::Direct)
+          return decltype(bp::process_stdio::out)();
+        else if constexpr (Mode.Stdout == IoType::String)
+        {
+          stdout_pipe = std::make_unique<boost::asio::readable_pipe>(context);
+          read_some(*stdout_pipe, result.Stdout);
+          return (*stdout_pipe);
+        }
+        else std::unreachable();
+      }(),
+      .err = [&] -> decltype(auto)
+      {
+        if constexpr (Mode.Stderr == IoType::Close) return nullptr;
+        else if constexpr (Mode.Stderr == IoType::Direct)
+          return decltype(bp::process_stdio::err)();
+        else if constexpr (Mode.Stderr == IoType::String)
+        {
+          stderr_pipe = std::make_unique<boost::asio::readable_pipe>(context);
+          read_some(*stderr_pipe, result.Stderr);
+          return (*stderr_pipe);
+        }
+        else std::unreachable();
+      }()
    };
    log();

@@ -117,21 +154,25 @@ namespace biu::process
          timeout.async_wait
            ([&](auto ec) { if (!ec) sig.emit(boost::asio::cancellation_type::terminal); });
        });
-        stdio_write();
        context.run();
        finished.wait([](auto& v) { return v; });
-        stdio_read();
      });
    }
-    else Logger::try_exec([&]
+    else
    {
-      auto proc = bp::process
-        (context, actual_program, input.Args, std::move(stdio), std::move(env), std::forward<Ts>(args)...);
-      stdio_write();
-      proc.wait();
-      stdio_read();
-      result.ExitCode = proc.exit_code();
-    });
+      auto thread = std::thread([&]
+      {
+        Logger::try_exec([&]
+        {
+          auto proc = bp::process
+            (context, actual_program, input.Args, std::move(stdio), std::move(env), std::forward<Ts>(args)...);
+          proc.wait();
+          result.ExitCode = proc.exit_code();
+        });
+      });
+      context.run();
+      thread.join();
+    }
    return result;
  }
 }
--- a/packages/biu/test/process.cpp
+++ b/packages/biu/test/process.cpp
@@ -4,12 +4,7 @@ int main()
 {
  using namespace biu::literals;
  biu::Logger::Guard log;
-  auto result = biu::exec<{.SearchPath = true, .Timeout = true}>
-    ({.Program = "sleep", .Args = {"10"}, .Timeout = 3s});
+  auto result = biu::exec<{.SearchPath = true, .Timeout = true}>({.Program = "sleep", .Args = {"10"}, .Timeout = 3s});
  std::cout << "{}\n"_f(result.ExitCode);
  assert(!result);
-  auto result2 = biu::exec<{.SearchPath = true, .Timeout = true, .Stdin = biu::IoType::String}>
-    ({.Program = "sh", .Args = {"-s"}, .Stdin = "echo \\\n hello world", .Timeout = 10s});
-  std::cout << "{}\n"_f(result2.ExitCode);
-  assert(result2);
 }
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -145,13 +145,6 @@ inputs: rec
  speedtest = inputs.pkgs.callPackage ./speedtest.nix { src = inputs.topInputs.speedtest; };
  atat = inputs.pkgs.callPackage ./atat.nix { src = inputs.topInputs.self.src.atat; };
  atomkit = inputs.pkgs.callPackage ./atomkit.nix { src = inputs.topInputs.self.src.atomkit; };
-  xinli = inputs.pkgs.callPackage ./xinli
-    { inherit biu; stdenv = inputs.pkgs.clang18Stdenv; inherit (inputs.pkgs.pkgs-unstable) httplib; };
-  pybinding = inputs.pkgs.pkgs-2411.python310Packages.callPackage ./pybinding
-  {
-    src = inputs.topInputs.pybinding;
-    buildProxy = inputs.pkgs.lib.mkBuildproxy ./pybinding/proxy.nix;
-  };

  fromYaml = content: builtins.fromJSON (builtins.readFile
    (inputs.pkgs.runCommand "toJSON" {}
--- a/packages/hpcstat/src/disk.cpp
+++ b/packages/hpcstat/src/disk.cpp
@@ -53,7 +53,7 @@ namespace hpcstat::disk
      {
        if
        (
-          auto result = biu::exec<{.Stdout = biu::IoType::String}>
+          auto result = biu::exec
          ({
            // duc ls -d ./duc.db -b -D /data/gpfs01/jykang/linwei/xxx
            "{}/duc"_f(*ducbindir),
@@ -86,7 +86,7 @@ namespace hpcstat::disk
        if
        (
          // duc info -d ./duc.db
-          auto result = biu::exec<{.Stdout = biu::IoType::String}>
+          auto result = biu::exec
            ({"{}/duc"_f(*ducbindir), { "info", "-d", "{}/duc.db"_f(*datadir) }});
          !result
        )
--- a/packages/hpcstat/src/lfs.cpp
+++ b/packages/hpcstat/src/lfs.cpp
@@ -27,8 +27,7 @@ namespace hpcstat::lfs
        }
        else break;
      }
-      if (auto result = biu::exec<{.Stdout = biu::IoType::String}>({*bsub, args}); !result)
-        return std::nullopt;
+      if (auto result = biu::exec({*bsub, args}); !result) return std::nullopt;
      else
      {
        // Job <462270> is submitted to queue <normal_1day>.
@@ -45,7 +44,7 @@ namespace hpcstat::lfs
  {
    if
    (
-      auto result = biu::exec<{.SearchPath = true, .ModifyEnv = true, .Stdout = biu::IoType::String}>
+      auto result = biu::exec<{.SearchPath = true, .ModifyEnv = true}>
      ({
        .Program="bjobs",
        .Args={ "-a", "-o", "jobid submit_time stat cpu_used job_name", "-json" },
@@ -83,8 +82,7 @@ namespace hpcstat::lfs
  {
    if
    (
-      auto result = biu::exec<{.SearchPath = true, .Stdout = biu::IoType::String}>
-        ({"bjobs", { "-l", "{}"_f(jobid) }});
+      auto result = biu::exec<{.SearchPath = true}>({"bjobs", { "-l", "{}"_f(jobid) }});
      !result
    )
      return std::nullopt;
--- a/packages/hpcstat/src/ssh.cpp
+++ b/packages/hpcstat/src/ssh.cpp
@@ -12,7 +12,7 @@ namespace hpcstat::ssh
      return std::nullopt;
    else if
    (
-      auto output = biu::exec<{.Timeout = true, .Stdout = biu::IoType::String}>
+      auto output = biu::exec<{.Timeout = true}>
        ({.Program=std::filesystem::path(*sshbindir) / "ssh-add", .Args{ "-l" }, .Timeout=10s});
      !output
    )
@@ -41,7 +41,7 @@ namespace hpcstat::ssh
      return std::nullopt;
    else if
    (
-      auto output = biu::exec<{.Timeout = true, .Stdin = biu::IoType::String, .Stdout = biu::IoType::String}>
+      auto output = biu::exec<.Stdin = biu::IoType::String, .Timeout = true>
      ({
        .Program=std::filesystem::path(*sshbindir) / "ssh-keygen",
        .Args={
@@ -69,7 +69,7 @@ namespace hpcstat::ssh
      bf::create_directories(tempdir);
      auto signaturefile = tempdir / "signature";
      std::ofstream(signaturefile) << signature;
-      auto result = biu::exec<{.Timeout = true, .Stdin = biu::IoType::String}>
+      auto result = biu::exec<.Stdin = biu::IoType::String, .Timeout = true>
      ({
        .Program=std::filesystem::path(*sshbindir) / "ssh-keygen",
        .Args={
--- a/packages/pybinding/default.nix
+++ b/packages/pybinding/default.nix
@@ -1,12 +0,0 @@
-{ src, buildPythonPackage, setuptools, cmake, buildProxy, distutils, numpy, scipy, matplotlib, pytest }:
-buildPythonPackage
-{
-  name = "pybinding";
-  inherit src;
-  pyproject = true;
-  build-system = [ setuptools cmake distutils ];
-  dependencies = [ numpy scipy matplotlib pytest ];
-  dontUseCmakeConfigure = true;
-  preBuild = ''source ${buildProxy}'';
-  patches = [ ./fix.patch ];
-}
--- a/packages/pybinding/fix.patch
+++ b/packages/pybinding/fix.patch
@@ -1,24 +0,0 @@
-diff --git a/cppcore/include/numeric/arrayref.hpp b/cppcore/include/numeric/arrayref.hpp
-index e1ef1ba..722ebdc 100644
--- a/cppcore/include/numeric/arrayref.hpp
-+++ b/cppcore/include/numeric/arrayref.hpp
-@@ -7,6 +7,7 @@
- #include <numeric>
- #include <stdexcept>
- #include <array>
-+#include <cstdint>
- 
- namespace cpb { namespace num {
- 
-diff --git a/cppmodule/deps/pybind11/include/pybind11/attr.h b/cppmodule/deps/pybind11/include/pybind11/attr.h
-index 6962d6fc..f8261bc3 100644
--- a/cppmodule/deps/pybind11/include/pybind11/attr.h
-+++ b/cppmodule/deps/pybind11/include/pybind11/attr.h
-@@ -11,6 +11,7 @@
- #pragma once
- 
- #include "cast.h"
-+#include <cstdint>
- 
- NAMESPACE_BEGIN(PYBIND11_NAMESPACE)
- 
--- a/packages/pybinding/proxy.nix
+++ b/packages/pybinding/proxy.nix
@@ -1,130 +0,0 @@
-{ fetchurl }:
-[
-  {
-    url = "https://gitlab.com/libeigen/eigen/-/archive/3.3.3/eigen-3.3.3.tar.gz";
-    file = fetchurl
-    {
-      url = "https://gitlab.com/libeigen/eigen/-/archive/3.3.3/eigen-3.3.3.tar.gz";
-      hash = "sha256-/XJpQ5C9joFYYgVxfSz4I+cY9YS3eaFV23R9HmhIGi4=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "application/octet-stream";
-      "content-disposition" = "attachment; filename=eigen-3.3.3.tar.gz";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/variant.hpp";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/variant.hpp";
-      hash = "sha256-TsAoFQ3nrnXwS8cxg2RLiu6U7CxZGYHmIm7mHemTgSA=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "31575";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/recursive_wrapper.hpp";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/recursive_wrapper.hpp";
-      hash = "sha256-Su1xw27Ctf7TM8isDU8SGXiKg9rM9LvxEh8bUiaGnR0=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "2632";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/variant_visitor.hpp";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/mapbox/variant/v1.1.4/include/mapbox/variant_visitor.hpp";
-      hash = "sha256-JiPsMvUm0V8P/cXxM3BMHrCAk+cU2JGzWAoK5T2e9DI=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "743";
-    };
-  }
-  {
-    url = "https://github.com/p12tic/libsimdpp/archive//v2.0-rc2.tar.gz";
-    file = fetchurl
-    {
-      url = "https://github.com/p12tic/libsimdpp/archive//v2.0-rc2.tar.gz";
-      hash = "sha256-dLYHn29FfiMm8HGclKiB/XN4Xu71mpKGjGmTWcuXndg=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-disposition" = "attachment; filename=libsimdpp-2.0-rc2.tar.gz";
-      "content-type" = "application/x-gzip";
-      "content-length" = "287439";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/format.h";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/format.h";
-      hash = "sha256-7v0pfyt2c2KDtMhot68W9nt13pN+j2OswuuKeB/ZnBs=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "119800";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/format.cc";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/format.cc";
-      hash = "sha256-cwjmLJljDJ/iQbF5dD6PHnvUSGYfx1Elfq1kebFVzE0=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "28777";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/ostream.h";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/ostream.h";
-      hash = "sha256-is8VgEdM7FovPR6X3MuRGoPfd+Gm7vtHT+3r6rZasII=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "2830";
-    };
-  }
-  {
-    url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/ostream.cc";
-    file = fetchurl
-    {
-      url = "https://raw.githubusercontent.com/fmtlib/fmt/3.0.2/fmt/ostream.cc";
-      hash = "sha256-NKg67BJHmwd5YAIkOqjNEDjvqSspLFHN2+23W5XImSQ=";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "text/plain; charset=utf-8";
-      "content-length" = "1073";
-    };
-  }
-]
--- a/packages/sbatch-tui/CMakeLists.txt
+++ b/packages/sbatch-tui/CMakeLists.txt
@@ -12,7 +12,7 @@ endif()
 find_package(ftxui REQUIRED)
 find_package(biu REQUIRED)

-add_executable(sbatch-tui src/main.cpp src/vasp_gpu.cpp src/vasp_cpu.cpp src/mumax3.cpp src/fdtd.cpp)
+add_executable(sbatch-tui src/main.cpp src/vasp_gpu.cpp src/vasp_cpu.cpp src/mumax3.cpp)
 target_compile_features(sbatch-tui PUBLIC cxx_std_23)
 target_link_libraries(sbatch-tui PRIVATE ftxui::screen ftxui::dom ftxui::component biu::biu)
 target_include_directories(sbatch-tui PRIVATE $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>)
--- a/packages/sbatch-tui/include/sbatch-tui.hpp
+++ b/packages/sbatch-tui/include/sbatch-tui.hpp
@@ -17,7 +17,7 @@ namespace sbatch
    public: virtual void try_load_state(YAML::Node node) noexcept = 0;
    public: virtual YAML::Node save_state() const = 0;
    public: virtual ftxui::Component get_interface() = 0;
-    public: virtual std::vector<std::string> get_submit_command(std::string extra_sbatch_parameter) const = 0;
+    public: virtual std::string get_submit_command() const = 0;
    public: virtual ~Program() = default;
    
    // 用于注册程序
@@ -75,15 +75,4 @@ namespace sbatch
    };
    return ftxui::Checkbox(title, checked, checkbox_option);
  };
-  // 转义字符
-  inline std::string escape(std::string str)
-  {
-    return str | ranges::views::transform([](char c)
-    {
-      // only the following characters need to be escaped: $ ` \ " newline * @ space tab
-      if (std::set{'$', '`', '\\', '\"', '\n', '*', '@', ' ', '\t'}.contains(c))
-        return '\\' + std::string(1, c);
-      else return std::string(1, c);
-    }) | ranges::views::join("") | ranges::to<std::string>;
-  }
 }
--- a/packages/sbatch-tui/sbatch-tui.yaml
+++ b/packages/sbatch-tui/sbatch-tui.yaml
@@ -14,9 +14,3 @@ Program:
    Queue:
      - Name: localhost
        Gpu: [ "4060" ]
-  Fdtd:
-    Queue:
-      - Name: localhost
-        Recommended:
-          Cpus: 16
-          Memory: 64
--- a/packages/sbatch-tui/src/fdtd.cpp
+++ b/packages/sbatch-tui/src/fdtd.cpp
@@ -1,115 +0,0 @@
-# include <sbatch-tui.hpp>
-
-namespace sbatch
-{
-  class Fdtd : public Program
-  {
-    public: struct StateType
-    {
-      int QueueSelected = 0;
-      std::vector<std::string> QueueEntries;
-      int CpuSchemeSelected = 0;
-      std::vector<std::string> CpuSchemeEntries = { "Default", "Custom" };
-      std::string Cpus = "1";
-      bool Nomultithread = true;
-      int MemorySchemeSelected = 0;
-      std::vector<std::string> MemorySchemeEntries = { "Default", "All", "Custom" };
-      std::string Memory = "1";
-      std::string InputFile = "input.fsp";
-    };
-    protected: StateType State_;
-    protected: struct Recommended_ { int Cpus; std::optional<int> Memory; };
-    protected: std::vector<Recommended_> Recommendeds_;
-    public: virtual std::string get_name() const override { return "Lumerical FDTD"; }
-    public: virtual void load_config(YAML::Node node) override
-    {
-      for (auto queue : node["Queue"])
-      {
-        State_.QueueEntries.push_back(queue["Name"].as<std::string>());
-        Recommendeds_.push_back(queue["Recommended"].as<Recommended_>());
-      }
-    }
-    public: virtual void try_load_state(YAML::Node node) noexcept override
-    {
-      try
-      {
-        auto saved_state = node.as<decltype(State_)>();
-        if (saved_state.QueueSelected < State_.QueueEntries.size()) State_.QueueSelected = saved_state.QueueSelected;
-        if (saved_state.CpuSchemeSelected < State_.CpuSchemeEntries.size())
-          State_.CpuSchemeSelected = saved_state.CpuSchemeSelected;
-        State_.Cpus = saved_state.Cpus;
-        State_.Nomultithread = saved_state.Nomultithread;
-        if (saved_state.MemorySchemeSelected < State_.MemorySchemeEntries.size())
-          State_.MemorySchemeSelected = saved_state.MemorySchemeSelected;
-        State_.Memory = saved_state.Memory;
-        State_.InputFile = saved_state.InputFile;
-      }
-      catch (...) {}
-    }
-    public: virtual YAML::Node save_state() const override { return YAML::Node(State_); }
-    public: virtual ftxui::Component get_interface() override
-    {
-      return ftxui::Container::Vertical
-      ({
-        // 第一行
-        ftxui::Container::Horizontal
-        ({
-          // 队列
-          ftxui::Menu(&State_.QueueEntries, &State_.QueueSelected)
-            | with_title("Queue:", ftxui::Color::GrayDark),
-          // CPU 设置
-          ftxui::Container::Horizontal
-          ({
-            ftxui::Menu(&State_.CpuSchemeEntries, &State_.CpuSchemeSelected),
-            ftxui::Container::Vertical
-            ({
-              input(&State_.Cpus, "CPU: "),
-              checkbox("Disable multithread", &State_.Nomultithread)
-            })
-              | with_list_padding | with_separator
-              | ftxui::Maybe([&]{ return State_.CpuSchemeSelected == 1; })
-          }) | with_title("CPU:", ftxui::Color::GrayDark) | with_separator,
-          // 内存
-          ftxui::Container::Horizontal
-          ({
-            ftxui::Menu(&State_.MemorySchemeEntries, &State_.MemorySchemeSelected),
-            input(&State_.Memory, "Memory (GB): ")
-              | with_list_padding | with_separator
-              | ftxui::Maybe([&]{ return State_.MemorySchemeSelected == 2; })
-          }) | with_title("Memory:", ftxui::Color::GrayDark) | with_separator
-        }) | with_title("Resource allocation:") | with_bottom,
-        // 第三行：输入文件
-        ftxui::Container::Vertical({input(&State_.InputFile, "Input file: ")})
-          | with_title("Misc:")
-      });
-    }
-    public: virtual std::vector<std::string> get_submit_command(std::string extra_sbatch_parameter) const override
-    {
-      auto recommended = Recommendeds_[State_.QueueSelected];
-      auto cpu_string = [&]
-      {
-        if (State_.CpuSchemeSelected == 0)
-          return "--ntasks={} --cpus-per-task=1 --hint=nomultithread"_f(recommended.Cpus);
-        else if (State_.CpuSchemeSelected == 1) return "--ntasks={} --cpus-per-task=1{}"_f
-          (State_.Cpus, State_.Nomultithread ? " --hint=nomultithread" : "");
-        else std::unreachable();
-      }();
-      auto mem_string = [&]
-      {
-        if (State_.MemorySchemeSelected == 0) return recommended.Memory ? "--mem={}G"_f(*recommended.Memory) : "";
-        else if (State_.MemorySchemeSelected == 1) return "--mem=0"s;
-        else if (State_.MemorySchemeSelected == 2) return "--mem={}G"_f(State_.Memory);
-        else std::unreachable();
-      }();
-      return
-      {
-        "sbatch"s,
-        "--partition={} --nodes=1-1"_f(State_.QueueEntries[State_.QueueSelected]),
-        cpu_string, mem_string, "--export=ALL,ANSYSLMD_LICENSE_FILE=1055@127.0.0.1",
-        "--wrap=\"lumerical srun fdtd-engine-ompi-lcl {}\""_f(escape(State_.InputFile)),
-        extra_sbatch_parameter
-      };
-    }
-  };
-  template void Program::register_child_<Fdtd>();
-}
--- a/packages/sbatch-tui/src/main.cpp
+++ b/packages/sbatch-tui/src/main.cpp
@@ -8,7 +8,6 @@ int main()
 {
  using namespace biu::literals;
  using namespace sbatch;
-  biu::Logger::Guard log;

  // 初始化
  enum class UserCommandType { Continue, Back, Quit };
@@ -122,11 +121,9 @@ int main()
      else if (State.UserCommand == UserCommandType::Continue)
      {
        State.CurrentInterface = InterfaceType::Confirm;
-        State.SubmitCommand =
-          Programs[State.ProgramSelected]->get_submit_command(
-            "--job-name={} --output={}{}"_f
-              (escape(State.JobName), escape(State.OutputFile), State.LowPriority ? " --nice=10000" : ""))
-          | biu::toLvalue | ranges::views::join(" \\\n ") | ranges::to<std::string>;
+        State.SubmitCommand = Programs[State.ProgramSelected]->get_submit_command()
+          + "\n--job-name='{}' --output='{}'{}"_f
+            (State.JobName, State.OutputFile, State.LowPriority ? " --nice=10000" : "");
      }
      else if (!State.UserCommand) return EXIT_FAILURE;
      else std::unreachable();
@@ -151,10 +148,9 @@ int main()
        }
        catch (...) {}
        // 提交任务
-        log.debug("submit command: {}"_f(State.SubmitCommand));
-        // -c 对 \\n 的处理与通常情况下不同，我们需要用 -s 然后将命令通过标准输入传入
-        biu::exec<{.SearchPath = true, .Stdin = biu::IoType::String}>
-          ({.Program = "sh", .Args = { "-s"}, .Stdin = State.SubmitCommand});
+        boost::replace_all(State.SubmitCommand, "\n", " ");
+        biu::exec<{.SearchPath = true}>
+          ({"sh", { "-c", State.SubmitCommand }});
        break;
      }
      else if (!State.UserCommand) return EXIT_FAILURE;
--- a/packages/sbatch-tui/src/mumax3.cpp
+++ b/packages/sbatch-tui/src/mumax3.cpp
@@ -91,10 +91,10 @@ namespace sbatch
          | with_title("Misc:")
      });
    }
-    public: virtual std::vector<std::string> get_submit_command(std::string extra_sbatch_parameter) const override
+    public: virtual std::string get_submit_command() const override
    {
      auto cpu_string = [&]
-        { return State_.Nomultithread ? "--hint=nomultithread" : ""; }();
+        { return State_.Nomultithread ? " --hint=nomultithread" : ""; }();
      auto gpu_string = [&]
      {
        if (State_.GpuSchemeSelected == 0) return "--gpus=1"s;
@@ -109,14 +109,8 @@ namespace sbatch
        else if (State_.MemorySchemeSelected == 2) return "--mem={}G"_f(State_.Memory);
        else std::unreachable();
      }();
-      return
-      {
-        "sbatch"s,
-        "--partition={}"_f(State_.QueueEntries[State_.QueueSelected]),
-        gpu_string, cpu_string, mem_string,
-        "--wrap=\"mumax3 {}\""_f(escape(escape(State_.InputFile))),
-        extra_sbatch_parameter
-      };
+      return "sbatch --partition={}\n{}{} {}\n--wrap=\"mumax3 {}\""_f
+        (State_.QueueEntries[State_.QueueSelected], gpu_string, cpu_string, mem_string, State_.InputFile);
    }
  };
  template void Program::register_child_<Mumax3>();
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chn	03b5a4bfd6	modules.system.nixpkgs: fix native kernel patch	2025-08-07 23:15:32 +08:00
chn	1ce1582bf9	flake.lib.buildNixpkgsConfig: fix binaryen	2025-08-07 20:42:34 +08:00
chn	eeb5bc02e0	devices.steamdeck: init	2025-08-07 20:29:40 +08:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfnbbQUshhe86KNshwZQNdKEbBWs8u5hurJdLkIsSYV`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnzvCcneAdb8lLDaCTFC0TunEfE5I0X1t1hXEFl7qgN`
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFIaeMJBb+T+R5i+A4UOSgb/PI1fjn+bXoteSB/JonNs xly`