update everything

This reverts commit 03e205d93f.

.gitignore

@@ -5,3 +5,4 @@ outputs
 build
 .vscode
 .cache
+.ccls-cache

.sops.yaml

@@ -9,7 +9,10 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
   - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
   - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
   - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-  - &pcvm age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
+  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
+  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
+  - &srv1-node2 age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+  - &srv1-node3 age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5
 creation_rules:
   - path_regex: devices/pc/.*$
     key_groups:
@@ -56,8 +59,23 @@ creation_rules:
     - age:
       - *chn
       - *pi3b
-  - path_regex: devices/pcvm/.*$
+  - path_regex: devices/srv1/node0/.*$
     key_groups:
     - age:
       - *chn
-      - *pcvm
+      - *srv1-node0
+  - path_regex: devices/srv1/node1/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node1
+  - path_regex: devices/srv1/node2/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node2
+  - path_regex: devices/srv1/node3/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node3

blog/.gitignore

@@ -1,4 +0,0 @@
-/themes
-/public
-/.hugo_build.lock
-/resources/_gen

blog/archetypes/default.md

@@ -1,5 +0,0 @@
-+++
-title = '{{ replace .File.ContentBaseName "-" " " | title }}'
-date = {{ .Date }}
-draft = true
-+++

blog/content/_index.md

@@ -1,6 +0,0 @@
----
-title: Introduction
-type: docs
----
-
-这里是主页

blog/content/docs/example/_index.md

@@ -1,7 +0,0 @@
----
-weight: 1
-bookFlatSection: true
-title: "Example Site"
----
-
-{{< callout emoji="​:building_construction:" >}} 施工中 {{< /callout >}}

blog/content/posts/_index.md

@@ -1,5 +0,0 @@
----
-title: Blog
----
-
-我得在这里写点什么

blog/content/posts/helloworld.md

@@ -1,49 +0,0 @@
----
-title: Helloworld
-date: 2024-08-24T20:13:59+08:00
-draft: false
-summary: 为什么不问问神奇海螺呢？
-math: true
----
-
-# 一级标题
-
-## 二级标题
-
-### 三级标题
-
-hello world!
-
-* 无序列表1
-* 无序列表2
-* 无序列表3
-
-1. 有序列表1
-2. 有序列表2
-3. 有序列表3
-
-> 这是一个引用
-> 写了两行
-
-如果段与段之间
-没有空行
-会怎样？
-
-```c++
-#include <iostream>
-using namespace std;
-int main() {
-    cout << "Hello, World!" << endl;
-    return 0;
-}
-```
-
-这是一个行内代码`printf("Hello, World!\n");`，和行内公式 $E=mc^2$。
-
-$$
-\int_{-\infty}^{+\infty} e^{-x^2} \dd x = \sqrt{\pi}
-$$
-
-**这是粗体文本**，*这是斜体文本*。
-
-[这是一个链接](https://www.example.com)

blog/default.nix

@@ -1,13 +0,0 @@
-{ stdenv, hextra, hugo }: stdenv.mkDerivation
-{
-  name = "blog";
-  src = ./.;
-  nativeBuildInputs = [ hugo ];
-  configurePhase =
-  ''
-    mkdir themes
-    ln -s ${hextra} themes/hextra
-  '';
-  buildPhase = "hugo";
-  installPhase = "cp -r public $out";
-}

blog/hugo.yaml

@@ -1,144 +0,0 @@
-baseURL: https://blog.chn.moe/
-theme: hextra
-
-enableRobotsTXT: true
-enableGitInfo: false
-enableEmoji: true
-hasCJKLanguage: true
-
-# services:
-#   googleAnalytics:
-#     ID: G-MEASUREMENT_ID
-
-outputs:
-  home: [ html ]
-  page: [ html ]
-  section: [ html, rss ]
-
-defaultContentLanguage: zh-cn
-languages:
-  zh-cn:
-    languageName: 简体中文
-    languageCode: zh-CN
-    weight: 1
-    title: My New Hugo Site
-  en:
-    languageName: English
-    weight: 2
-    title: My New Hugo Site
-    contentDir: content/en
-
-# Needed for mermaid/katex shortcodes
-markup:
-  goldmark:
-    renderer:
-      unsafe: true
-  highlight:
-    noClasses: false
-
-enableInlineShortcodes: true
-
-menu:
-  main:
-    - identifier: documentation
-      name: Documentation
-      pageRef: /docs
-      weight: 1
-    - identifier: blog
-      name: Blog
-      pageRef: /blog
-      weight: 2
-    - identifier: about
-      name: About
-      pageRef: /about
-      weight: 3
-    - name: Search
-      weight: 4
-      params:
-        type: search
-    - name: GitHub
-      weight: 5
-      url: "https://github.com/imfing/hextra"
-      params:
-        icon: github
-  sidebar:
-    - identifier: more
-      name: More
-      params:
-        type: separator
-      weight: 1
-    - identifier: about
-      name: "About"
-      pageRef: "/about"
-      weight: 2
-    - identifier: hugoDocs
-      name: "Hugo Docs ↗"
-      url: "https://gohugo.io/documentation/"
-      weight: 3
-
-params:
-  description: Modern, responsive, batteries-included Hugo theme for creating beautiful static websites.
-  navbar:
-    displayTitle: true
-    displayLogo: true
-    logo:
-      path: images/logo.svg
-      dark: images/logo-dark.svg
-      # width: 40
-      # height: 20
-      # link: /
-    width: wide
-  page:
-    # full (100%), wide (90rem), normal (1280px)
-    width: normal
-  theme:
-    # light | dark | system
-    default: system
-    displayToggle: true
-  footer:
-    enable: true
-    displayCopyright: true
-    displayPoweredBy: true
-    width: normal
-  displayUpdatedDate: true
-  dateFormat: "January 2, 2006"
-  search:
-    enable: true
-    type: flexsearch
-    flexsearch:
-      # index page by: content | summary | heading | title
-      index: content
-      # full | forward | reverse | strict
-      # https://github.com/nextapps-de/flexsearch/#tokenizer-prefix-search
-      tokenize: forward
-  editURL:
-    enable: true
-    base: "https://github.com/imfing/hextra/edit/main/exampleSite/content"
-  blog:
-    list:
-      displayTags: true
-      # date | lastmod | publishDate | title | weight
-      sortBy: date
-      sortOrder: desc # or "asc"
-  highlight:
-    copy:
-      enable: true
-      # hover | always
-      display: hover
-  comments:
-    # TODO: enable cusdis
-    enable: false
-    type: giscus
-    # https://giscus.app/
-    giscus:
-      repo: imfing/hextra
-      repoId: R_kgDOJ9fJag
-      category: General
-      categoryId: DIC_kwDOJ9fJas4CY7gW
-      # mapping: pathname
-      # strict: 0
-      # reactionsEnabled: 1
-      # emitMetadata: 0
-      # inputPosition: top
-      # lang: en
-  math: true

devices/jykang.xmuhpc/.ssh/authorized_keys

@@ -4,6 +4,9 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJ/jzUQ6QuAjnAryvpWk7TReS6pnHxhEXY9RonojKk
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCtnVhZQsJfbs2w9hFZkx4qDhIs++7no+6r5TifP3Dq7epJYd2QYx4dI66XxTNhKxZjN6a4Xn5nFlYLtQJXOvzBLC8IBf1W5GCH0k/jqzzskS0/Ix/70HzcBwJk8ihWDkyON5Ki1BRCx34RNxth1BIxWyc5QT+lou+D92x8iAu/uOvmcAL3Ua0OlZwxw03hLp/PpS4ZnUqFjc2JVtarY7eQu/i3RwOZUaK6nT2EL8RObzk4xnieqsU5PWwA3voVjetqZaDQ+P7dimQXz/FaucroKxCNyTiy1oG4fdQpm2UDrH6ZfPvdQLYrtet6FQabXOxhV7MuR3jYtxZjs1kDVZIseIZ6IwjetaUoMxvIouRfYjOSIEo9Ek9o0+Yhku4r0uWmPDrymWugU1raMmlRxSUwdlzW+C7mQwtGbs/MG4MN4GWkM6id5DKlY2vYKUfrTzmhY1swCtzKq20fjvyX8qhJdcytgVlOrBZnPje6Qd55sI0RjdgJrBsxT2SYquez7U8= yjq@xmupc1
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDn1pfGen7kjPTHsbb8AgrUJWOeFPHK5S4M97Lcj3tvdcjZi2SXN6PwHQfh8/xGhZbTLPz/40S9O9/Dn30xkUTfnONirKt790jp7VEbOtPnjQPOd/KRNWlS3VV0BELuq5p633Mi13rP6JZtdKmU2uSkvvaUBfCppy3JaWv/B7HLJ48f8IzkdiT1px3dN1eQ4SFoHOiVG0ci5TGG6wfMdoAAnM9R1aXI4gDxnYjLYujpaNZ4hBOta/6ZK/PV0JufoXdIAZjubgk1Hv04XHXLR2Z0UhRM6x7UrZIOdM/LlnKmcVk408ZKEj/9m1xRyDsNoZ24CF++cmnwfBHrp9I5nvDI7xOTdZlOhzkiiPM3f4i6s2Qjdv4vpZ6AeE3Qt1LVQyAr67b4UMjHuYqSi2KgyCO6My2Ov2eRoS74EKcb8ejJv3O+XInmYUgDgTgDFT3CgQgK2DG45HiV6nOkaE/6iKx2JSOiYZTFc7TRcePfXF9JQD7dXFde6qm3EbIVyJIpCJ8= zem@xmupc1
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCW2fx1Sim7X2i/e/RBPEl1q/XbV7wa9pmZfnRINHIv24MCUgtNZ5GHEEW7dvzrQBeRj3I7CAyK8fbuhv/l8HuDtjxJJ1fmcBp9UG5vfpb/UTxayJxHBRrwokp2JL7HKVviI6d8FcNa/T0CMoUNYXnel6dE3B78k9Q0dDxlOGS1MzgsP3Pn66lm0ww9FRAVHe+KkhFmwyQ1VHUxHgK4QjCIt7+9+PJE7fK0aVWBsR309pui7Pbm6mgd4d6mwiBeVvxsNGnI4DsO1hz4N2GapuQy19PDiG7A4H41Z5RYQnv/3XTy4TBXOFQm77v6pyGkCmG6BGnRdvMB6C0hWPJvudbsA/BNp4ApL7/CrwTdLp1z6ToAOLvKrUQAM+hcbJimnFVMXqz7iSYg99XTnzue7ncecp19XiaDJbM47bGXcT4nTO5XaiMYi2xGAHIrij5GIuFF5ymKYSp5ejb1VucMdKlaaAmS10+wdUcuT7tzX/IuVr5aqg2dsxT5aJCRhZ1k2V0= xly@xmuhpc
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRpyIU8ZuYTa0LvsVHmJZ1FA7Lbp4PObjkwo+UcpCP8 wp@xmupc1
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGRZp8xp9hVO7e/6eflQsnFZj853IRVywc97cTevnWbg hjp@xmupc1
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwUhEAFHjkbUfOf0ng8I80YbKisbSeY4lq/byinV7lh wm
 
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmJoiGO5YD3lbbIOJ99Al2xxm6QS9q+dTCTtlALjYI5f9ICGZJT8PEGlV9BBNCRQdgb3i2LBzQi90Tq1oG6/PcTV3Mto2TawLz5+2+ym29eIq1QIhVTLmZskK815FpawWqxY6+xpGU3vP1WjrFBbhGtl+CCaN+P2TWNkrR8FjG2144hdAlFfEEqfQC+TXbsyJCYoExuxGDJo8ae0JGbz9w1A1UbjnHwKnoxvirTFEbw9IHJIcTdUwuQKOrwydboCOqeaHt74+BnnCOZhpYqMDacrknHITN4GfFFzbs6FsE8NAwFk6yvkNXXzoe60iveNXtCIYuWjG517LQgHAC5BdaPgqzYNg+eqSul72e+jjRs+KDioNqvprw+TcBBO1lXZ2VQFyWyAdV2Foyaz3Wk5qYlOpX/9JLEp6H3cU0XCFR25FdXmjQ4oXN1QEe+2akV8MQ9cWhFhDcbY8Q1EiMWpBVC1xbt4FwE8VCTByZOZsQ0wPVe/vkjANOo+brS3tsR18= 00@xmuhpc
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxcIWDQxVyIRqCGR4uWtrh4tLc025+q6du2GVsox8IzmBFkjNY8Au5GIMP5BKRstxFdg3f/wam8krckUN9rv5+OHB9U8HGz77Xs0FktqRVNMaDPdptePZQJ9A9eW3kkFDfQnORJtiVcEWfUBS3pi0QFOHylnG27YyC/Vjx9tjvtJWKsQEVTFJbFHPdi+G7lHTpqIGx+/a2JN9O6uVujXXYvjSVXsd+CWB9VMZMvYCIz2Ecb6RqR3brj4FhRRl8zyCj+J4ACYFdGWL98fTab2uPHbpVeKrefFFA43JOD/4zwBx/uw7MAQAq0GunTV3FpBfIAQHWgftf2fSlbz20oPjCwdYn9ZuGJOBUroryex7AKZmnSYM3biLHcctQfZtxqVPEU3W/62MUsI/kZb9RcF24JRksMoS2XWTiv2HFf5ijQGLXXOjqiTlGncwiKf65DwkDBsSxzgbXk5Uo86viq6UITFXPx/RytU+SUiN4Wb7wcBTjt/+tyQd1uqc7+3DCDXk= 01@xmuhpc

devices/nas/default.nix

@@ -40,8 +40,8 @@ inputs:
         };
         initrd.sshd.enable = true;
         nixpkgs.march = "silvermont";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-        networking = { hostname = "nas"; networkd = {}; };
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
+        networking.networkd = {};
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =

devices/pc/default.nix

@@ -36,12 +36,12 @@ inputs:
             # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
             "broadwell"
             # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-            "skylake"
+            "skylake" "cascadelake"
             # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
             # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
             "alderlake"
           ];
-          remote.master = { enable = true; hosts = [ "xmupc1" "xmupc2" ]; };
+          remote.master = { enable = true; hosts = [ "xmupc1" "xmupc2" "srv1-node0" "srv1-node1" ]; };
           githubToken.enable = true;
         };
         nixpkgs =
@@ -53,7 +53,6 @@ inputs:
           modules.modprobeConfig =
             [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
         };
-        networking.hostname = "pc";
         sysctl.laptop-mode = 5;
         gui.enable = true;
       };
@@ -69,8 +68,6 @@ inputs:
       };
       virtualization =
       {
-        waydroid.enable = true;
-        docker.enable = true;
         kvmHost = { enable = true; gui = true; };
         nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
       };
@@ -80,7 +77,6 @@ inputs:
         samba =
         {
           enable = true;
-          private = true;
           hostsAllowed = "192.168. 127.";
           shares =
           {
@@ -105,9 +101,9 @@ inputs:
                 "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
                 "dispatchcnglobal.yuanshen.com"
               ])
+            ++ [{ name = "4006024680.com"; value = "192.168.199.1"; }]
           );
         };
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
         acme.cert."debug.mirism.one" = {};
         frpClient =
         {
@@ -131,11 +127,20 @@ inputs:
         slurm =
         {
           enable = true;
-          cpu = { cores = 16; threads = 2; mpiThreads = 2; openmpThreads = 4; };
-          memoryMB = 90112;
-          gpus."4060" = 1;
+          master = "pc";
+          node.pc =
+          {
+            name = "pc"; address = "127.0.0.1";
+            cpu = { cores = 16; threads = 2; };
+            memoryMB = 90112;
+            gpus."4060" = 1;
+          };
+          partitions.localhost = [ "pc" ];
+          tui = { cpuMpiThreads = 4; cpuOpenmpThreads = 4; gpus = [ "4060" ]; };
         };
         ollama = {};
+        waydroid = {};
+        docker = {};
       };
       bugs = [ "xmunet" "backlight" "amdpstate" ];
     };
@@ -183,11 +188,6 @@ inputs:
         };
         system.nixos.tags = [ "nvidia" ];
       };
-      zen.configuration =
-      {
-        nixos.system.kernel = { variant = inputs.lib.mkForce "zen"; patches = inputs.lib.mkForce []; };
-        system.nixos.tags = [ "zen" ];
-      };
     };
   };
 }

devices/pc/secrets/default.yaml

@@ -22,6 +22,10 @@ nix:
     remote: ENC[AES256_GCM,data:uosYkxTCB0wiY+Uufk//OcBZFN3EzbZoQGZ95M9eZMjQ5AobAZqosi4laE+EMcZL1CqYqlWXaSoEUOB8biUaZPseo+1AX1TlmUgZ7QpkfOX0VKZu01C6C+lVyqVqMFq6z1BFyX/oeITMIfnd4a/2KwJCHLAZ4hMkJ5p+aJwByKGa3N/2m41HH/1S3z7pYQWj7YJxunTPPG6WNSiRncQki11rvmddwnXmsBF89+jW1Phge8U295haC57T5oIGPxR645IeTK4ZUlL8eVuZ+BhsnwbkYcaxvjSwe+DOIVPupR8GW+gis7KxwE89kqvnQhinamexcPUz4lGHlqO/Xn6jrJx6T/wXF+19epAzeHapYte3dTWNsdPwPLPJihT16YT5fwrLnH3zq8kexWz1crmnCGUoaBs4S2tHWHLgv2lTv0IHLx5F6ijpDBj/Avg9YILIURzdeea+rBxdycHasUDTVlJtYKRH5J+WbAKWI+oJ5qmXjIRUYL+O9xIUfOGO+1b3xs8MYxRWuvDV2P88N8vN,iv:yQQp5wjbSVn1oia5yL7d6GF9Vo704G0iOQRGMbzQHzg=,tag:bpBag5y5n+7ojOa8QOcDvA==,type:str]
 github:
     token: ENC[AES256_GCM,data:59z1zSofzUyv2Qfn8oS7dZplzJDtOD/zxhPm07MLbVLHt8mE57IGcw==,iv:nZ4JmIE1h496RN6BChvqo7XWHjur76jP4HMgqGBbMJQ=,tag:pUSGsofG7hvkvJxCRwkg1Q==,type:str]
+age: ENC[AES256_GCM,data:EPjip4/tz50e+blPko9NpzDamLRO6BVy64kDnGAhUJJ/bMw6V9Of8RzuiqUupIjEmFiUcgWf9ZsV5RZO3Ai9udq0W7mYS1Y/zn4=,iv:TBs/o6mp8t+S3Ma5/QhnLhzgl852HB3sEzKy9SvKJjU=,tag:2yMUVWPua2g0VOkaXpJzKQ==,type:str]
+user:
+    #ENC[AES256_GCM,data:a4mHxr7bn7BV,iv:FYQk3yv3XgxNO9CnrQefo3WqhO0Sf8Mihfp+Iw4AcWM=,tag:jebxvG+xUidghf5dOlvDYA==,type:comment]
+    zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -46,8 +50,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-24T03:34:07Z"
-    mac: ENC[AES256_GCM,data:+nJ/wuO5G6pEsCiBNEHOYrbiYyGXXIHu3ZUgEVwqLQ10W94EOGLUto61IGtkapk4xmaHYAVmUlq76g2hRGrndLVlUthGnEc5QoQKZoUmrxK7ux1R2ubv0s1k+l2HpRerr/I8X+hHyV0fdxT6ivkpq6OsEzHDnxgewDvYNZGQS4k=,iv:TuzO1Yo0MPms5RrG8+GbwSCOILp9BF7Jsv5JvcAPwFw=,tag:fUNc+ccQDE/jcMLuQ4thCQ==,type:str]
+    lastmodified: "2024-09-04T01:39:48Z"
+    mac: ENC[AES256_GCM,data:VkpF9zTWRLMriukAif6lfp8uy6+IcPDYUnXCQ5XLUtSstEyUoaVBjn+VVAoKkLX3MnyR6gyiYVWDDJmXrsyNoQpjRVQR0yu0p6p7sB3voGKiNxhw5qGwZj4IIXnHFWvktgWiawCiUkmSTUUHxe0XjAh7AWxjGqgAs/oyWGq/YfE=,iv:IQbJAhW/y18s57CAwRPeypQreBqQb0KkJAgIZ90QXJU=,tag:a0AB3l83j31Ex6PH9ziHRg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0

devices/pcarm/default.nix

@@ -1,28 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/CE84-E0D8" = "/boot";
-            btrfs."/dev/disk/by-uuid/61f51d93-d3e5-4028-a903-332fafbfd365" =
-              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
-          };
-          rollingRootfs = {};
-        };
-        networking = { hostname = "pcarm"; networkd = {}; };
-        nixpkgs.arch = "aarch64";
-        kernel.variant = "nixos";
-        sops.enable = false;
-      };
-      services.sshd = {};
-    };
-  };
-}

devices/pcvm/default.nix

@@ -1,28 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/AE90-1DD1" = "/boot";
-            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          };
-          decrypt.auto."/dev/disk/by-uuid/a9e4a508-3f0b-492e-b932-e2019be28615" = { mapper = "root"; ssd = true; };
-          rollingRootfs = {};
-        };
-        kernel.variant = "xanmod-latest";
-        networking.hostname = "pcvm";
-        initrd.sshd.enable = true;
-      };
-      hardware.cpus = [ "amd" ];
-      services.sshd = {};
-    };
-  };
-}

devices/pcvm/secrets.yaml

@@ -1,39 +0,0 @@
-hello: ENC[AES256_GCM,data:7xCy5PqPVdUNIdzqaGQLsPA88mAfRt6T57LjFDwOaTlhdejLPrBdyN4=,iv:dM0QWDpylPjnbtdNrjV8LHISNi/U718+xooFm0qTcbI=,tag:d5HbLG7yF3QRz7nP+4aeiA==,type:str]
-example_key: ENC[AES256_GCM,data:K5SD4k9jL5r4ZSUwNQ==,iv:mJrZshT0PKmT7OJE/ZBUWzq1Gc6xXymFbypxwQtQJq8=,tag:I4+AyMh+AVpmWa1fdIJpyA==,type:str]
-#ENC[AES256_GCM,data:vHj6+kNand8d1AzgXTaOMQ==,iv:j6b3SDqzVgY8U/puEm9UcpJYGK84gF/YIXzRbG0radQ=,tag:yzfXKHReJ0++3fhk2ztbBA==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:vRjjfVSy8g5mBZVM/oU=,iv:C+HE4Q157eNhEmcDJSMJINfMgztf6XfELCjotg8q3XU=,tag:JSQDItdYbCCs65tmbeR6tg==,type:str]
-    - ENC[AES256_GCM,data:xzfN6WiT8r8YcWtS+H4=,iv:btlOvqrn0pITT3rCTIjgS2b5TrfNKym0yPEnE7bJDqg=,tag:Wf40b8zBhrv452OKodkU+w==,type:str]
-example_number: ENC[AES256_GCM,data:akqZ12u1wl4Zww==,iv:hS3NBWI7o6dZLtsIsoVHYdtyqpUmbQrpMHPhRRzEd18=,tag:1voFm4LuupWJMGP3xd0k4A==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:wWEU8w==,iv:rf8uwo+sP9YFyPmoxROVVmrx+q6Yr0PIOWznM96w9XY=,tag:nVJdD1Z7U8zVRBxs8gLvQQ==,type:bool]
-    - ENC[AES256_GCM,data:gVe51tg=,iv:eOJ2TOWStHpckNyYx2UdLcipshFpjcWtEids5c+Q8bs=,tag:0iSjlC/TgNfl7ZtXmttgaQ==,type:bool]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTGliaUlvOVlxejZhSDZi
-            YU96S0VPOE5Ldk56WlJjTzBSRm9oYnBoQ0NBCnhJWmg3KzUrT1VyemRiSWtQeklS
-            UFFFTjdod0g1d1EvYWJoOElJSjIrWTgKLS0tIDlaQnJOMTZRUms4am1mQjV5MzFJ
-            QlhKL1ltY2lGZGU0clhIRTRsSW5BOTgK4gKbhvF1bV/YdKOxzqrecHPDAKPOd81V
-            YnWgLpP6h+zycx80iqwsfqiQJdPyDrfhB43ksn2oxsX0qXtLI9j9TQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRU1IRXZkbFQ4elgydTlv
-            VlRVKzJIWDVCZk5xaTd0Y2JXS2l0Mi85Zm1jCnNkS0NETm5SaG9WUE9Mb3RtbE5B
-            YTRmWHNXTk9hZHNBT0FxT1RNNnFMNEkKLS0tIGRWNWpLcDVtOEdGZHFPT3paeVo2
-            QWsreTlaVW5Bd2lZb3JZeTdjcG9WQlEKy3p4QnjPrJtfaueLKBzMz7VZ9QfrTer1
-            lEP8mInFprR65LtpoKabsTWQwkzURzB/OdbKSYG2o6Rlqy9L3d5eBw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-02T23:46:35Z"
-    mac: ENC[AES256_GCM,data:OncqYSgPSoge5Nw6eh0A4cm0KXSQhmSpGIu5WSv38LdMto5fNLIK2VRIwaXfq9nyf10bxNN7xSADj2GPhMiwlHM8nIQXtxdlWsZfEOc/qOWM8nz+9DPKtKGD6RZcDLDRhNTDxzPXGWIuY1tDKQpUlt/iDlymSskcqSrdTfBqCGk=,iv:NesxRr6FXXApE8aafnAV3x6hwCoAxoEly/QkcyAQ8Pw=,tag:3o37dr4vKLqEENIdj8RHXw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

devices/pi3b/default.nix

@@ -18,7 +18,7 @@ inputs:
           swap = [ "/nix/swap/swap" ];
           rollingRootfs = {};
         };
-        networking = { hostname = "pi3b"; networkd = {}; };
+        networking.networkd = {};
         nixpkgs.arch = "aarch64";
         kernel.variant = "nixos";
       };

devices/srv1/default.nix

@@ -0,0 +1,72 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount = let inherit (inputs.config.nixos.system.cluster) clusterName nodeName; in
+          {
+            vfat."/dev/disk/by-partlabel/${clusterName}-${nodeName}-boot" = "/boot";
+            btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root" =
+              { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        kernel.variant = "xanmod-lts";
+        gui.enable = true;
+      };
+      hardware.cpus = [ "intel" ];
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        smartd.enable = true;
+        slurm =
+        {
+          enable = true;
+          master = "srv1-node0";
+          node =
+          {
+            srv1-node0 =
+            {
+              name = "n0"; address = "192.168.178.1";
+              cpu = { sockets = 4; cores = 20; threads = 2; };
+              memoryMB = 122880;
+            };
+            srv1-node1 =
+            {
+              name = "n1"; address = "192.168.178.2";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 30720;
+            };
+            srv1-node2 =
+            {
+              name = "n2"; address = "192.168.178.3";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 30720;
+            };
+            srv1-node3 =
+            {
+              name = "n3"; address = "192.168.178.4";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 30720;
+            };
+          };
+          partitions =
+          {
+            localhost = [ "srv1-node0" ];
+            old = [ "srv1-node1" "srv1-node2" "srv1-node3" ];
+          };
+          tui = { cpuMpiThreads = 8; cpuOpenmpThreads = 10; };
+          setupFirewall = true;
+        };
+      };
+      user.users = [ "chn" ];
+    };
+  };
+}

devices/srv1/node0/default.nix

@@ -0,0 +1,64 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nix = { marches = [ "cascadelake" "broadwell" ]; remote.slave.enable = true; };
+        nixpkgs.march = "cascadelake";
+        networking.networkd.static =
+        {
+          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+          eno146 = { ip = "192.168.178.1"; mask = 24; };
+        };
+        cluster.nodeType = "master";
+      };
+      services =
+      {
+        xray.client =
+        {
+          enable = true;
+          dnsmasq.extraInterfaces = [ "eno146" ];
+        };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; threads = 4; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
+          wireguardIp = "192.168.83.9";
+        };
+      };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
+    };
+    services.nfs.server =
+    {
+      enable = true;
+      exports = 
+      ''
+        / 192.168.178.0/24(rw,no_root_squash,fsid=0,sync,crossmnt)
+        /home 192.168.178.0/24(rw,no_root_squash,sync,crossmnt)
+      '';
+    };
+    networking =
+    {
+      firewall.allowedTCPPorts = [ 2049 ];
+    };
+    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
+    services.rpcbind.enable = true;
+    fileSystems =
+    {
+      "/nix/share/home" =
+      {
+        device = "/home";
+        options = [ "rbind" ];
+      };
+    };
+    # without this, tproxy does not work
+    # TODO: why?
+    networking.firewall.trustedInterfaces = [ "eno146" ];
+  };
+}

devices/srv1/node0/secrets/default.yaml

@@ -0,0 +1,35 @@
+wireguard:
+    privateKey: ENC[AES256_GCM,data:egNwovz+DTKoaGs/QQXR3MD7AImGlMlBnYsAZ1nuYnlgTVPM28aiLJ4iLGM=,iv:cFcf/sjqTmGqceNwHnzrhs1IvhDPRJi5YkyFVpjrsrs=,tag:yUwvNYCHjK+7+xkM2cuQNQ==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:6JzTyJ+GVzLd0jWfvCc2dBdBVWz6RFH/8Gr73TNz6dNCyQjG,iv:ddGpYbIHN9PV3w6Oh65vEvv82jTChxgMdltIRPz++DY=,tag:nbFFk3S/y0hS3NFWGLPVJQ==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:IoRiruMV+bdf4qTSQBy9Npoyf1R0HkTdvxZShcSlvxlz7uKujWnlH4fc5eR6yytHcEZ9uPLib9XbGojUQOFERA==,iv:E0ac0DyhplaHEc2WmcXY0Fjpkt/pnY9PaATe0idqCRA=,tag:Vo/DBIUO6DBFCXQ1RLrchg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQUpac093NWh3bnZqWkFY
+            WGorTlk3WWJRb0RYVWVQc1JacU9GZDhFN0RnCkJkQnJoTkZtYkFEQ1JDZXA1Qzdp
+            dWxtc3RFbUd4TEZobXBQVWVlL3VETVEKLS0tIExoMUNidEZob2dtTWhmS0VHbDJn
+            RFNiU0xMOG1UNVY5TTYrcW1GTnIwb0kKyCl+eqpGtqN047+t1C/c1prIaP3tm1jk
+            1ObtsmGwCxDyIkayqB3WF9DWhNHipXHZXrWT+JQJTD30BABBex+ufg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WXJ0dmh3RTBMci9pVVh6
+            cWsyNHVub2U1RFhLSnJPSFI1S2lGV21nYm1ZCll2TUQybmtaaTdYd0dGSXVNV1Y3
+            TC9zbWJQOENsQm1Nc1ZwUTMvczJGK0UKLS0tIHJRemNhdWpRa1pkRnhTZjhCODNM
+            OThDMWRsWnVTbzRGTTZqSDBkNWZJMlEKdQ/ipO7O5OvaGa81c2P7fi1ncufueSzX
+            2njlHHz1gJCtjpktYaVvS6KSYtJoI9oNrF0YN5D/3kKW8TicsSGKaA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-15T10:53:47Z"
+    mac: ENC[AES256_GCM,data:0bZzNFEh3hRHLLImLLxYiN82QW4JAiyvuzRtE2MH8xa+VAE1kKy+ceED32zhEKl/yG/9lbGaz0bZz/+ouZyBd6ejvAbOaHZGRc+GY4VyLQfvpEx+7W19VVTGW1Wsae1zQv6WAML2cRsSbZX7FZNTGnTH8YKC9nXB+y+RTOtR7x0=,iv:+t1Agt5UmaloJ45onPWbcqu5geHNaMwF8WojmZeRiY8=,tag:IZbqzVl6LVVaJUHJSYkY4w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/srv1/node0/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:ul1xMmQ5FZVIKct4KbgnTStsT5cH3sRvmaApZez4WZ36zF3q3M4o0dcwuWXxl9Ay8+Kd1zzUCZy26FRj85IwAel6POkmIlXl51Awou3iWuGBqUlS6IL9MIERMR6lTlisOK2l2PJ7IJBichFwwDrxImnt06B68Z7JWOyrLMfQhwg=,iv:nHePsGpRWMj4CdZ8wxr4xCJAcSndHsRju+AMyK54vNw=,tag:+CC0EJbTmIjRijr1SZpF3g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRTJCOTJqclZqV2ZTb3NG\nSUV1VVNnUVpqZGVCc2hlTVBkQUVtVGlQdEhVCk1aNjhhbDZuajhQL1l1allHOXV1\naGRoWEpTZ2haTFFqRDhlclEySjVmMXMKLS0tIFpPdHZvekhDaS9yam5GSEVhZFlw\nZGN1QTVYQjZuUXd0NklqdytYRjRSNWcKC+AmUlZiefdfnP1l/sbQHBUaZGN6ciT8\n/yI2ed25uFGwCo0h+yLywbuNQTv7AiBFM3R+KBSjNDkFSgiGfblVNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0VHhFMi9RZ2VjeUxqTHAz\nZklRbkRGVkg3NDR2elYwbXRHZ1dSQTEwNXl3CkdidmwwVUZJWDllRVdYRWM0WEtX\ncXlHbnlZd1h1Ni9UTEtHK0Z2YzNHcWMKLS0tIHl5ME9UaDBFSkRXeEh4OWNRajZu\nOUdGcHA4Q1I4dS9RMUV0YUZBYmZyK3cKSxvVdG+P9+esK3miJdW9BqgJdEMEq4iS\njWgh5lmSQaat3UzjkOVPPp9Xu3DRpzTFq+dM8bdGDTbzAdrUhxj87w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-15T11:11:36Z",
+		"mac": "ENC[AES256_GCM,data:bV7T1HfvM2n8+Vus9oDO5yoWDGtWYOd6d/zJ86/sXB4psg7aXVNedYSn+98SJdpYKHRcSuMJ9D4h62nAawERB6u8EmW8kxh8fuVLb6tj+9fWF1iVqinL4LE3916+XzMqGzGVZZEXaVtPHqOue/D1sYtBrBCOEMMyq0cmLFY2JrE=,iv:eSrtmJLARmwuAQ1//x4XqCKDZybJmMtyefWyLPk+1j0=,tag:M5W+vO4RjVwS18C9wTIe2w==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}

devices/srv1/node1/default.nix

@@ -0,0 +1,56 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static =
+        {
+          eno1 = { ip = "192.168.1.11"; mask = 24; gateway = "192.168.1.1"; };
+          eno2 = { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        };
+        cluster.nodeType = "worker";
+        initrd.sshd.enable = true;
+        nix.remote.slave.enable = true;
+      };
+      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+    };
+    specialisation =
+    {
+      no-share-home.configuration =
+      {
+        nixos =
+        {
+          services.slurm.enable = inputs.lib.mkForce false;
+          system.cluster.nodeType = inputs.lib.mkForce "master";
+        };
+        system.nixos.tags = [ "no-share-home" ];
+      };
+    };
+    fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
+    {
+      "/home" =
+      {
+        device = "192.168.178.1:/home";
+        fsType = "nfs";
+        neededForBoot = true;
+      };
+    };
+    boot.initrd.network.enable = true; 
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    boot.initrd.systemd.extraBin =
+    {
+      "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+      "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+      "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+    };
+    services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+  };
+}

devices/srv1/node1/secrets/default.yaml

@@ -0,0 +1,30 @@
+hello: ENC[AES256_GCM,data:wA==,iv:kLAdTomvGSJRmZiO916Ort8crRCp05vlSamVMJ/gLbU=,tag:QTxIe+dhLWVljw9Svuu7Tg==,type:int]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaHcyMnpWRTAwRzJ0MTFi
+            elk3QXNqdXQ2MEttNXhBOGF1Vlk5cW12YTM4ClRkUm5zUUo5NjVrNnBlSFFPOVVR
+            V3VxVWZQQ0VvTm9KZ2Y1L3BpRkFDTjgKLS0tIDJadStsQ1Vya0FMa21Da3ZhUDVN
+            RVVTQXY2NkdzbVFLY1pYYTRLSGM5WDgKbFabN/iH2YDJaSXdm+7EebKS/As1zH43
+            HjUp2LHN85/WQEx3VheZRGJBwpNn/Tdunhm0yTdNA1jpzQnO9bIMXg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1TTlxNWhMS0dJbkZRSWsv
+            MitoM1NicmJzbVJBZnhUbnlJejBWVzU1TmpnCkxrVEs2eEE5VnVDN0NNaFZ0b3M0
+            SXFmc2JxblAvN29Eb2ZrR1llZkp6cmMKLS0tIGdQMjNIRXY2UGIxdGk2Q2V1MXJO
+            R1BkT1hoSWo1RlJnU0pCdTFYbDFoZmMKKF7cND1jSo+neTTJ+GwW4T0RTOX9mbME
+            58wjAtkrKSD2vDFMQ/vtPNiohAt6RMdClLVm50yh7Oh961YmvJYnbA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-16T03:04:24Z"
+    mac: ENC[AES256_GCM,data:2uq4QvP4l+WvV5G1FOj9nNmC9ZRvJcLUsLU0/Wrh7b6f+30g0lkw5M/WtHFd9CjrfB1O98Cvm3Y3ABsSTue5OLuAjACc+Jz5wvRbuLkWRNRU4HNdaAJIzN5Fqd6w+SR8vzLCe+NTcDlhEjdD0zcrRGD4+aM/cnn228sCTtRw1JY=,iv:MhHsNC/VJVPI8LVN9xuY4JZFlinuDI3C3Igo/O9/gbs=,tag:4jIbeOwspn7yZCrn8xKVrA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/srv1/node1/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:GHsftJ/b50XSTy3wCX/ms8iGhs7oQMrqw5R+7PxrjAm/VzcYJbAQjYButIeNYB2/r87IGKDEMAskowocqyuhamTZS9n6eElDBZrEoUXc9J/lZvXrNqBa2pDsR5a58X6Paj2kMn8Ke9M3vwHcgniEgZtC2h5u6VwbgPMZniqYT5w=,iv:KhGKrf0tXdLb0sWc6kB9lXjj9jOU+wsy76xGFRmwdz8=,tag:s+NBphi1n00GflKqujZcfA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPYWdxSzIrQzRaVnh3K292\nVGkwdWUxanpQbEllWlNvaHBoQ2VYR2pXcVZVCk14ZmxlK1pSWnpCZC8yaE84b1Ew\nNTJUTDErTUVxZzBqdGFORDc1TEo0REkKLS0tIFZJeFIvd3BDOGkwenMrWlAyVHdh\nTzRHNU02RWY4clJ4dk1IV3R4c0VTd2cKeX/tLKOnkbcAhkgCY+T4XWBgc7eUFecn\nfqd6Kxfg6P75OT6Z4ACKsHDGznGk8fYk+Ms67MSCGzr1HXaR14/eVQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxODlXSGpsYk5BZ1piSUhX\nUnlTQXpycmV3YlhLM01SMXZ2ZzFXWEU5MVNZCnVUNFRUTTVNaWVUZWY4dklFMmhW\nWUc1azJFNGJTZFVlRkdSZEd0eUozbk0KLS0tIDhUTFE3cHpFblZTa056R0lscHR4\nSXpoT2QrOU9mcDV2ZjR1bjV4cHZCdXMKyVyxBRY9oyhfj0ZMVRtjf8TT0qRJULwN\nosghj6bPqOFl3C9zBne1Xn/2mOj5lkMZP6MAMPtaW8nvsf/LkZx/Hg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-16T03:08:59Z",
+		"mac": "ENC[AES256_GCM,data:SjmuJVeJsamHE7Yv5Lvoyjp0CysTo3K1nyJgPI7KKp21H8Xq59g9/zbth4pCdIMHyt43MNUXFkhYD/Ox9ySoDEi2pr7H2kM9fcFM0W/ObM/gm/lt5jTLzzS+OkKys+Yw/WA2nIStSNq7rAb/SKFbHvj1P9YBsJxlOnBzTW7uu8g=,iv:tNjnqRX1D+vY8w7RxZzo+HdfjK9pXJpB5MKnb7EyUXk=,tag:PuLU5zmUH14ZxuTUPIz20Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}

devices/srv1/node2/default.nix

@@ -0,0 +1,53 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static.eno2 =
+          { ip = "192.168.178.3"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        cluster.nodeType = "worker";
+        initrd.sshd.enable = true;
+        nix.remote.slave.enable = true;
+      };
+      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+    };
+    specialisation =
+    {
+      no-share-home.configuration =
+      {
+        nixos =
+        {
+          services.slurm.enable = inputs.lib.mkForce false;
+          system.cluster.nodeType = inputs.lib.mkForce "master";
+        };
+        system.nixos.tags = [ "no-share-home" ];
+      };
+    };
+    fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
+    {
+      "/home" =
+      {
+        device = "192.168.178.1:/home";
+        fsType = "nfs";
+        neededForBoot = true;
+      };
+    };
+    boot.initrd.network.enable = true; 
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    boot.initrd.systemd.extraBin =
+    {
+      "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+      "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+      "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+    };
+    services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+  };
+}

devices/srv1/node2/secrets/default.yaml

@@ -0,0 +1,30 @@
+hello: ENC[AES256_GCM,data:/WGwXDnQio1BwD/zPoURTjVzTasWICOA7CBsgT5DbYIkKLt5DxzogeYWpiqjVg==,iv:BY82U/y9V8PYtn3Bre+nabGBcVgFbppIQZb7GhgY62I=,tag:JFqrezoWNJ8ZACCKQ43n5g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WlJNWmp2VUxpcXR3NE92
+            TnNuLzg0SVZKdmt1cEVZU2FodXZPdmt6Rm5rClhrbDh3SzFlMU9LVFpEZDFLUGZZ
+            d2RBTVNCamNBWFVEVW9FMjYxcUE4Rm8KLS0tIHBwYjlMU2tnUTZweDBYcmZXUC9l
+            OWFUeE9xdldpTUQ3cDFENjU4YUVwSkUKp7yZGpvKMSm6rvsoPbcaqVznL3wzGEXB
+            OGzrmgY083Gyjb5P/0wPY0ShGMWfWQW6vGchoqVuwr4oHKT3APcrIg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRjBjdGFEMjR6QnQ0a3Nz
+            c2lmVWE0bFh3amRULytZOVhYS3dkL2JmRVhVClVQalh1WjJqcWcxT3ZXMWduN3Nl
+            UzdFNXNQUmtaaTVIVVFVYXkyZEFPUncKLS0tIExrTDA0OEJzQklQOHNJZzBJdzJP
+            MVU1UW9lWFJnSTE2aC9ZL0huYURUK3MK5U4cLWRMm+FFo8ATE/OoAcHzYHFMpOtV
+            Q5kbq5PDMdp4qvoM3T4kLsB34oU55HjFvac0pilOhNRrz4xRMQgvoQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-20T05:30:52Z"
+    mac: ENC[AES256_GCM,data:nSrkKUo4yB57aetzdJ1sjSKcm5STQ6jfMhvY4/tXft2P9zRYigSP4PkZj7z+knxcIx9sFdA86h8X45oUjxaAa5xDJpgmvC/EEKxm5rZtVTxYYYdy40W72qThVuKUasWpYrrGZbZEbTu3Dad1yfJTilwofRtxoo1Nmj5lMvw+HRo=,iv:UvBSF5GLEj+hTZksrIV3Ow+HQ/xjqwCUuwqkdz8g0Qg=,tag:U5wJPhmeevB2i2GBgMGBFQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/srv1/node2/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:04fSLZEkne1LqLZNYpy1tFlKTVUgQNuX9L3cL66FVHD+LqGAyWJGlAnduY+fQMZdDhbBdeEnJKXjyQ2jdDCttuqbPRiJQChtD7ztf+oiP877N143iSY2G245aCjIrAzmFORkGZaQT7nD5oxgCPiLqJzkNPzgjN4HIDsVoYz6jtw=,iv:gTbiJmdXN/62/t53ddfDrYlNLe3AoujT4G03eFQXyZs=,tag:eAYfhXPERqsVKFSkcm+Abw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBb3JtVi92M2JUc3dKVzRt\na1kzNU8ycE1LTmdVZVNFNDNJZmpsTEdCK3hZCjNXajNpcGxXMDJxRjhPMmhFd2la\nZy8xUFZNZXhiVHFtbG9xVmJ3Q2d0NE0KLS0tIDlNWEJqcSsvQTFzc2FxL2F2bVVs\neS9UenMrYXNKbGJVTnZzN3VscWlrRk0K24RHbcTz56GV6AbQt7Yy9+1NClMpQFtk\nf/NO2RYuS0ciHwkJQEw7M48iJuwTSiv1pflXXkNvkl6/I7wPgS/eXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjFQbWd4SUhoOExTdnFk\nd3dVVytZaDAyc1F2eUowdmY0azFKbWJ2Z2pZCnhYQWJtVXVjTTRvTlI4SlVyVHh1\nZlBZTlFheVNKdzN5a0RHM3RkTDhzQncKLS0tIFlpbjRUSzdzS3ZuMW8welNRODdR\nWis0ajQrdUNqVWcwMWF4bVlUaWsrc00KfL/zF2RiAanljrNhRT99i2jPvLySMWXx\nEyzYRuTH8ZGXsX4T2VAPjreBt1ahJ/EgBWmCLibEVK62zWfdquAZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T05:31:41Z",
+		"mac": "ENC[AES256_GCM,data:7kp2KNU4O1yuBdu7cxzg8BytPWiP8hQ0/mWVKPPn4BXjFleyo8KzLC3XZn9Ovt2fHWiF/4hMreOPIDW1W+8n/DedLa2G+zkHiQDVBCyiLJ+FCELvNPdDwR37RvOJ0Oo3RtQaSK2xBhNwS2Qs1G7DemEGFrWXrZ/SeCG5H6bI4X4=,iv:zGG9jcC3McICjeYZd1aGud+VaUhLXg3J/demAqM4vUM=,tag:RINzMA36WfaTRuEy0cTQKQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}

devices/srv1/node3/default.nix

@@ -0,0 +1,53 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static.eno2 =
+          { ip = "192.168.178.4"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        cluster.nodeType = "worker";
+        initrd.sshd.enable = true;
+        nix.remote.slave.enable = true;
+      };
+      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+    };
+    specialisation =
+    {
+      no-share-home.configuration =
+      {
+        nixos =
+        {
+          services.slurm.enable = inputs.lib.mkForce false;
+          system.cluster.nodeType = inputs.lib.mkForce "master";
+        };
+        system.nixos.tags = [ "no-share-home" ];
+      };
+    };
+    fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
+    {
+      "/home" =
+      {
+        device = "192.168.178.1:/home";
+        fsType = "nfs";
+        neededForBoot = true;
+      };
+    };
+    boot.initrd.network.enable = true; 
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    boot.initrd.systemd.extraBin =
+    {
+      "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+      "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+      "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+    };
+    services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+  };
+}

devices/srv1/node3/secrets/default.yaml

@@ -0,0 +1,30 @@
+hello: ENC[AES256_GCM,data:DCfr682OxZ49pR5Q/sYZxqMdmUothpOOQOiKiPc0Xoh/gJ19qA0yVrO7aKk3Bg==,iv:B01Qfkiy3/B3MYskqFAxEZNoGjb8+A5wcyjq8Bj987k=,tag:e3/VHntKiG+/8xHz/nFXYg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQy8reUxHUm5leVk4dzhx
+            L0h2ZVVONnlEWlBXWlhKa082aXJGRlhIaUhZCkQxSFV3SHcyQjNCN3NyK3h0V1hN
+            SHVZYXJjenlPR2lrL1J0ZkpoTlQ3S1kKLS0tIEZPU2c4VHpzdEwzWTVTUk9OdDFI
+            em9JMjA0VFk3Q0NKSWt4YllkWHpYNWMKJxCl3tXFHSUfawt8pB21WLKvUWwTn+Jl
+            gz52soH0P/k7bg6Lx4gs5WywIIIOWnHg7p0BJS9BCmFWvXR442c2XQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaG1ZdERieVMzM2JjY3Zt
+            KzRTVCt6eVRsSmJXT3FKL0pSVHF0L25SSGlRCkg5bGVHcEhBam56bHdBcUZHRWF0
+            ODVkamc0RlJxNk5hRjMzTVRkYVNsam8KLS0tICsrTXdGMzZ2UmE1VmNyK3pwME1u
+            bHQzK1EvVEhvZFI5MjVxL0Q5UVZYdGsKJl2M3eOB0lRyu2VO1qDjW1pNJ9HhwAS6
+            g5yOa2fxLJn4bvmQAJYeNJ1Wi6sYaBvkbeOegjaKjW4ZvwhP5kWqRA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-20T06:02:54Z"
+    mac: ENC[AES256_GCM,data:OQYaHF7lMspMaXjK64fZhdd6w9EHWzvjYsJdGEEaSwj6nfgb8EPxn73hn8NMgubXnqxonqbrpwgUuI+u297ItEEsksWQGGe//UrLlAJlhPvgezOpeeBfT4iWUrbazam4Uakh457N9W0AX390D2VmDtSBMw60fqnIeSnJF6Jv5Gs=,iv:O0h2sKf4KibuP5ZfRWF8tEVnLyyZtwst66frYUC4Awo=,tag:y94K0y/nF4y1sfh+P/hWrA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/srv1/node3/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:9uBZv+GmpEqEbpE1E4szW3EPA6AJPUprWMQs2XwXq/VfrOfVG+Dz6PsAfPgOgii9KMPZb+358lfdhXbKF2cjflMw9Iz1wc2eU8vrbbU7toisLnuYBm2676wKzatQVbL0SHvlyScVIEwNphTJdIPJuMD0JrFMfDV7J/jdgwdpPRE=,iv:fk1YA7IXX/9/jU9jqAg4YrFZrprm9zoBw5avnKtvBnw=,tag:rfsCsir2C4UsUTgfvbRCVg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRm9wakd5Z2cwblM4a3c3\nVURGS3prTHJ5R1RzOGpXaXFOcFlNWGJCTGtjCmt3Q2M1Z0FaTGRscDlOamI2L2Yy\nQUlaNWJMcHdEVVIzMzdYVXdVZVpHd3MKLS0tIGlscllCSnJCS1JDNEVXWXhJVUNa\naFlPSU9lZnpPbFY3VkI3NkNtVlNTWHcKfRcjJroaUVDePl+mg22NndJfFciAuolg\nsOEaEZCH/cIJg0XTXfM18ZRUl4IuMmR3D2L4KAhzbfADNmC81mpMLw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZeDBPMWZnRXRPbkRXQVpm\nL0pwWDE4blRuYUV6QVJyOHBITUJjU1ViR25rCjRJTmF0MDhjNEhFQVNHZ3M4QUJ4\nQ05DbTlVbjhMMDhTdGlZN01tRUxOZE0KLS0tIEExMXZTSzJjeEdqcHBNWjhGSFIx\nQmJaSHh4dHdUTjRmWUZIUFdmVkI3YncKvCunmgurC7YO0Y5FssulaJ/VDvuiR5Y+\nOxfMe34ilsF+k8bTBAuYLlDCl8uQ14cPiOLAhAw1vdFgs9o8cs9MUg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T06:03:27Z",
+		"mac": "ENC[AES256_GCM,data:sEMEYJDZhhza1HvtmQ9maK9gXgBNfNGDhvSySoz/GuiTrs2Hhae/YI+o6DvYHPDUoOJGVwLjHVhfoIYw9CvoCZNm8Gn3fUSeP372x2kRAjFJYJ56qovU5hz7H/m1Mm9CQ38PvnsWMgc+dB1q0h01g4x7/URfjJDlU+Rq4n3f6B4=,iv:v/P0xSTBjGrmhzeAiS0eaQ4Y7pls9xCKPq9gysLuINY=,tag:SsCPc1av/pGpZS5AqzJdxA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}

devices/surface/default.nix

@@ -24,13 +24,11 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "skylake";
-        nix = { substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ]; githubToken.enable = true; };
+        nix = { substituters = [ "https://nix-store.chn.moe?priority=100" ]; githubToken.enable = true; };
         kernel = { variant = "xanmod-lts"; patches = [ "surface" "hibernate-progress" ]; };
-        networking.hostname = "surface";
         gui.enable = true;
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
-      virtualization = { docker.enable = true; waydroid.enable = true; };
       services =
       {
         snapper.enable = true;
@@ -45,7 +43,6 @@ inputs:
               "dispatchcnglobal.yuanshen.com"
             ]);
         };
-        firewall.trustedInterfaces = [ "virbr0" ];
         wireguard =
         {
           enable = true;
@@ -54,6 +51,8 @@ inputs:
           wireguardIp = "192.168.83.5";
         };
         beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
+        waydroid = {};
+        docker = {};
       };
       bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
       packages.vasp = null;

devices/surface/secrets.yaml

@@ -4,6 +4,7 @@ wireguard:
     privateKey: ENC[AES256_GCM,data:P/tyZHaEAahZUBF22dJEZb6mACm/wmUunPDG0vS7SNW3sWbzxRSut0haR/g=,iv:8VMv5iotmDrYDLiszcOvJHkD8l6uE+SboPSILr6KuzU=,tag:U/FIBhvghwDTvFtUWEqr4g==,type:str]
 github:
     token: ENC[AES256_GCM,data:SyqrpFfy+y7syReWs0Bi23651ew41Us8aqjImBTzkDanOtWQgIYC6g==,iv:H3Y/TuP3VvZv6MlRAdLOY0CiNUeoqGZRNg0s58ZSkQ8=,tag:rSf4E8Whvue/LZ+VlSqDDQ==,type:str]
+age: ENC[AES256_GCM,data:KEaMrk9eldR6oCqNqSpwhbJKj+JrN1KBkDL5p9itaszGf4tnDRidcleCQi1Ae17osYXIEh4+OxX/d6RKb9TP6JMLJe0iq6c9sC8=,iv:ztiP2Vz4AFZkd8ZG7xYlqYrV3JZYvmX07Ez6GtJ6yp0=,tag:PS8oSkkrrpgYYVfjbTtkaQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -28,8 +29,8 @@ sops:
             a2xybTRFUFZZN20zajZJTVNwVEpGcEEKglmFMk7z1q5IlZ+lZf9M0HtknmvcYt/P
             2/z5e8wLN1Hy0Zsbv0yIL/NmqwxAOGJOdzz7ElJszk/Y4kUr9aRasg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-24T03:36:38Z"
-    mac: ENC[AES256_GCM,data:Dv6WO5K0GFVm4Rt+GjXeE1vwqlPkP+kmRCGU41rbSR3YBcL8mkpBRQQXJiMU99cQQMK/rCGy+k91fhGnG5xFT/FdEZF8qUjRHPZ5MdWCjPOuY/LrXWnSnwwJa2neQLFH/ToUkNaGHCk/FngnZ/e0U43Rnwt3iHRDBG3io8oDY0M=,iv:Jf5EtkTuf/MFDq6UiOo8/31ev5zBiaP9WnlgsUgK5Y4=,tag:r6ql+UbXbG5A1vtbsGXnJQ==,type:str]
+    lastmodified: "2024-09-01T15:22:09Z"
+    mac: ENC[AES256_GCM,data:Br2+miNeZI41QyTXdhJ5Mdwq5no/d4kJgESwiltcRZV/Pax8R+GFeLDg/AQFoh1fLHU6bTX45SN0wnIrIeCnkoXV0U2RiT7bdtBaDrGxqnFvjMVE0VaUrj9bpagta13tahsEfI17cyUq4BqwS4BXx60RXvbvs9jZ5/dfpYunGsc=,iv:FfWYfS40XcFgF8lEYK4IHypLzz7svFxPL+WuudQm3oA=,tag:0KDBdf7w6BdcQ8Qt3k1isg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0

devices/vps4/default.nix

@@ -27,10 +27,12 @@ inputs:
         };
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
         nixpkgs.march = "znver2";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
         initrd.sshd.enable = true;
-        networking = { hostname = "vps4"; networkd = {}; };
+        networking.networkd = {};
         kernel.variant = "xanmod-latest";
+        nix-ld = null;
+        binfmt = null;
       };
       services =
       {

devices/vps6/default.nix

@@ -27,16 +27,16 @@ inputs:
         };
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
         nixpkgs.march = "sandybridge";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
         initrd.sshd.enable = true;
-        networking = { hostname = "vps6"; networkd = {}; };
+        networking.networkd = {};
         # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
       };
       services =
       {
         snapper.enable = true;
         sshd = {};
-        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 20; };
+        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 21; };
         frpServer = { enable = true; serverName = "frp.chn.moe"; };
         nginx =
         {
@@ -71,7 +71,7 @@ inputs:
         wireguard =
         {
           enable = true;
-          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" ];
+          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
           publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
           wireguardIp = "192.168.83.1";
           listenIp = "74.211.99.69";
@@ -79,7 +79,6 @@ inputs:
         };
         beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
       };
-      user.users = [ "chn" "zqq" ];
     };
     specialisation.generic.configuration =
     {

devices/vps6/secrets.yaml

@@ -44,6 +44,8 @@ xray-server:
         user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
         #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
         user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
+        #ENC[AES256_GCM,data:1g2gohLbiixMes8=,iv:E3HA6cAdv3BdLMcrrcWW4Zsc2KLtW7L8Xrk9Z57l49o=,tag:rZ7W9ckf7lzJ23u5zwQiwg==,type:comment]
+        user20: ENC[AES256_GCM,data:3UbVnn9oMRc0zZR46tWxwM9VFOvMOYm690csUomEVBcS3xPm,iv:KHuPXttLAFr7WT/qa/UYLY8GRsPWYZPyKNmdUh4iFQQ=,tag:jN8rQ0Gv+qnhwOWGH+CwlA==,type:str]
     private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 nginx:
     #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
@@ -87,8 +89,8 @@ sops:
             ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
             ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-30T10:43:57Z"
-    mac: ENC[AES256_GCM,data:Mg/DZghIkaWM5KEjk5zg3S0L5qPa8/rkc2ooSjA1ewzbDhTKls2tzv7fQqLx2WQtcJiKkoVx22UkiL0AzBwJdCr3473vx93ajTVK9HNu3jqXmuzSiv2iVS21EX9tyBNiL6uWlVAtlVfMMs69PEUF+EJIYY5TkVVPaQjzEebwo5w=,iv:tFON7RVSnNNHo5U4dRuMGDhH5iPGShW9uoda+apiIjI=,tag:3nG/u7vaChFBHoDsLLb23w==,type:str]
+    lastmodified: "2024-09-15T03:48:21Z"
+    mac: ENC[AES256_GCM,data:kZDIr2NHVew+BsreAoYNAcP/3i2A7U1RGIiA6qok1EsXLcunO+vfjIZl3L/0CEEH4+u6PEXQ51atzufqOGpoq9XqorBMRDEdlhitZZIUZm8Cji9BJxixeTUQ+KmFEbdw8H1XDIPWOQJCmTUbkOElMzHO4BNtTpdjE4u1IZ0bUiY=,iv:cCjln5wrScDz7A5/OHVoAj671VtkBmK7H0pnpKLsjD8=,tag:rohzoGp2V1sS03W0z5hM/A==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0

devices/vps7/default.nix

@@ -27,9 +27,10 @@ inputs:
         };
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
         nixpkgs.march = "znver2";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
         initrd.sshd.enable = true;
-        networking = { hostname = "vps7"; networkd = {}; };
+        networking.networkd = {};
+        kernel.variant = "xanmod-lts";
       };
       services =
       {
@@ -45,7 +46,7 @@ inputs:
           matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
         };
         vaultwarden.enable = true;
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 1024; loadAverage = 4; };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
         photoprism.enable = true;
         nextcloud = {};
         freshrss.enable = true;
@@ -63,12 +64,13 @@ inputs:
           peers = [ "vps6" ];
           publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
           wireguardIp = "192.168.83.2";
-          listenIp = "95.111.228.40";
+          listenIp = "144.126.144.62";
         };
         vikunja.enable = true;
         chatgpt = {};
         xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
         writefreely = {};
+        docker = {};
       };
     };
     specialisation.generic.configuration =

devices/vps7/secrets.yaml

@@ -35,6 +35,8 @@ rsshub:
     youtube-client-id: ENC[AES256_GCM,data:dPo4+HsfXHdxrgF9F0qJmOGcSHDCn2KIkHx3ZYZU94iv8ImiPI9dTRfoz0zq8UIN7rwIKidQu9GxCRrg9aXk34pc35SXzEh8JQ==,iv:ROVHb0QjVsNae9eJevG6qc5dc4gkrGt+Y7S2QYrzmQ4=,tag:Advoh75OKPC7CnIeL4GFbA==,type:str]
     youtube-client-secret: ENC[AES256_GCM,data:c/ALpo/4qJdccMgYiSLg9ZgG7ddaMYxHwJYZ/ogJN2ED21k=,iv:CkrIq+Vpuq28CsRNwdKRLnBq6L8NF37y4xhhnmHQHqQ=,tag:SKtHpm/QZWnGViDtSKlUUQ==,type:str]
     youtube-refresh-token: ENC[AES256_GCM,data:pnXQ1euCdix2H7IxudmUUcpxc2OUhciKT8OcGV89c/EpoXHgx1+eLxwY5rRszroWwjge9M001RGHngvD/ny3phfWAwYmIzMJxun2f7JCPe7ybMesWmPSkiqVBss1Zfic1uB8mNM/yw==,iv:8p8/vATY8F3YuGA1TtjekiuaKOMnQyTMjrwDBJaK4VU=,tag:/jVg9FDOuLMNrupgrywpBQ==,type:str]
+    twitter-auth-token: ENC[AES256_GCM,data:65SbHggbYtfSfaaxJxRgD6+HpOX4vIfjnVZmOAZ9illPMYOu9MIchQ==,iv:49UuC8n6AGj1skuHzQX39Q/QuKlB9IxogIfiiy1GBnw=,tag:Rq6b0H9UFVZ19tU8ZeelRg==,type:str]
+    bilibili-cookie: ENC[AES256_GCM,data:58nO7ADu2oH/OgLJNYrEEzhf1J0zt8EpuygnSANkGXJju5oSmtM7WLnaMEjC96q14OTTA9QLiFVsbxiFY1eUnraA5W7g7+6CYRXVRZaxz91D/dhKzHGTMjB/LynnNqEIc6liONlcHbyjZNQ+WIqPtjVpCKMN7Mi8cv81/cFX/1GqAwncgDD2oXh1hMPOVY4dYcGKuOG0GjlY6RgOgTPqU3HawQjnoWQjPF+lq2rnWD5HP9ZTxOYa7hm2GgPrxkq1fkRrq+kKYeDh+6M7VLDcm5Fpf+biq6F8fZWzmw4NlVZT9BG0vJFa,iv:vxYXg9Yg9qIWFQXtwTYa4Ds0KSxZYg3M6xdtXKbdaig=,tag:TzCPehk9w+BL4wwgDc1CPg==,type:str]
 mail:
     bot-encoded: ENC[AES256_GCM,data:HstqDfhKoLqDip9O+mwYGbNlNQ==,iv:CZSTfxJHhI6nG7501cQdJiZ9l3uKS7d5YsA8iVTUuoE=,tag:Rj3rvXJzDp8XzODV/gABog==,type:str]
     bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
@@ -144,8 +146,8 @@ sops:
             SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
             HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-20T15:48:48Z"
-    mac: ENC[AES256_GCM,data:buEby7ZmmEFARmRp3r7JwYdMck87u4c3TGkeF2pkc5ORnqIgwSH1XVSjlbK8vTBWz2FKXeQh9wkX3BMaam9dU873/yPBe54BnbZNggZ7jDDEpSTeddfTsM8mrka0xDO3CUHbwCsqYWFm4NLAbCfRPKhrjvSJVyEC85K3eO45Z6M=,iv:/7cOdSi6oiaaFRkSnR+1/XXapjlQdMgom31xrpIGXHk=,tag:XW4WX93bw45zPweblW4Dtg==,type:str]
+    lastmodified: "2024-09-02T23:57:33Z"
+    mac: ENC[AES256_GCM,data:Tp7uSF3G1WALzv7jPSXGyIJbwYLHz4sF73NUoAI6KPboLs3juhDiZjJfkBkIIv4BawWNTvvAQfBL6hbpPbn3bLpkTvU8TiHyP9yiY5kJkid37I2s8KOHHaxKSu4CXlkAeXdZX0I1iujAOsKYUd2GnN19V07K0qwCtZOVvZXvjsk=,iv:fcsE7qXrcoaRdTv0C4nmfNvIDXtTXiKyF7TCfnkvRPg=,tag:Dgdq4gT2lzhkXZ10uUCwwQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0

devices/xmupc1/README.md

@@ -5,7 +5,7 @@
 * 显卡：
   * 4090：24 G 显存。
   * 3090：24 G 显存。
-  * 2080Ti: 12 G 显存。
+  * P5000: 16 G 显存。
 * 硬盘：2 T。
 
 # 队列系统（SLURM）
@@ -34,7 +34,7 @@ sbatch
 提交一个 VASP GPU 任务的例子：
 
 ```bash
-sbatch --gpus=1 --ntasks-per-gpu=1 --job-name="my great job" vasp-nvidia
+sbatch --gpus=1 --ntasks-per-gpu=1 --job-name="my great job" --output=output.txt vasp-nvidia
 ```
 
 * `--gpus` 指定使用GPU 的情况：
@@ -50,7 +50,7 @@ sbatch --gpus=1 --ntasks-per-gpu=1 --job-name="my great job" vasp-nvidia
 提交一个 VASP CPU 任务的例子：
 
 ```bash
-sbatch --ntasks=4 --cpus-per-task=4 --hint=nomultithread --job-name="my great job" vasp-intel
+sbatch --ntasks=4 --cpus-per-task=4 --hint=nomultithread --job-name="my great job" --output=output.txt vasp-intel
 ```
 
 * `--ntasks=4 --cpus-per-task=4` 指定使用占用多少核。
@@ -85,6 +85,7 @@ scancel -u chn
 
 ```bash
 scontrol top 114514
+sudo scontrol update JobId=3337 Nice=-2147483645
 ```
 
 要显示一个任务的详细信息（不包括服务器重启之前算过的任务）：
@@ -130,6 +131,8 @@ sacct --units M --format=ALL -j 114514 | bat -S
 -s, --oversubscribe
 # 包裹一个二进制程序
 --wrap=
+# 设置为最低优先级
+--nice=10000
 ```
 
 # 支持的连接协议
@@ -188,9 +191,7 @@ RDP 暂时没有硬件加速（主要是毛玻璃之类的特效会有点卡）
 
 samba 就是 windows 共享文件夹的那个协议。
 
-* 地址：xmupc1.chn.moe
-* 用户名：自己名字的拼音首字母
-* 初始密码和 ssh 一样，你可以自己修改密码（使用 `smbpasswd` 命令）。samba 的密码和 ssh/rdp 的密码是分开的，它们使用不同的验证机制。
+* 地址：因为懒得管理暂时禁用。
 
 在 windows 上，可以直接在资源管理器中输入 `\\xmupc1.chn.moe` 访问。
 也可以将它作为一个网络驱动器添加（地址同样是 `\\xmupc1.chn.moe`）。

devices/xmupc1/default.nix

@@ -48,17 +48,15 @@ inputs:
           };
         };
         gui = { enable = true; preferred = false; autoStart = true; };
-        networking.hostname = "xmupc1";
         nix.remote.slave.enable = true;
       };
       hardware = { cpus = [ "amd" ]; gpu.type = "nvidia"; };
-      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      virtualization.kvmHost = { enable = true; gui = true; };
       services =
       {
         snapper.enable = true;
         sshd = { passwordAuthentication = true; groupBanner = true; };
         xray.client.enable = true;
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
         smartd.enable = true;
         beesd.instances =
         {
@@ -75,9 +73,16 @@ inputs:
         slurm =
         {
           enable = true;
-          cpu = { cores = 16; threads = 2; mpiThreads = 3; openmpThreads = 4; };
-          memoryMB = 94208;
-          gpus = { "2080_ti" = 1; "3090" = 1; "4090" = 1; };
+          master = "xmupc1";
+          node.xmupc1 =
+          {
+            name = "xmupc1"; address = "127.0.0.1";
+            cpu = { cores = 16; threads = 2; };
+            memoryMB = 94208;
+            gpus = { "p5000" = 1; "3090" = 1; "4090" = 1; };
+          };
+          partitions.localhost = [ "xmupc1" ];
+          tui = { cpuMpiThreads = 3; cpuOpenmpThreads = 4; gpus = [ "p5000" "3090" "4090" ]; };
         };
         xrdp = { enable = true; hostname = [ "xmupc1.chn.moe" ]; };
         samba =
@@ -88,9 +93,10 @@ inputs:
         };
         groupshare = {};
         hpcstat = {};
+        docker = {};
       };
       bugs = [ "xmunet" "amdpstate" ];
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "zqq" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" ];
     };
     services.hardware.bolt.enable = true;
   };

devices/xmupc1/secrets/default.yaml

@@ -15,8 +15,12 @@ users:
     yjq: ENC[AES256_GCM,data:ua0DINHutjt2Pk+SfHRQRV99mT3Cnw6rRKO8VRIAlP0dY6QhK9wkNdyRYWYRBKVrWgyFQMGNFYAxIpymjF/X7mBOVI2sOHLgkw==,iv:PUZ6S0KICuqoSA2sDLxdL4gtAOQnQXOUY+5f3qDZgpc=,tag:f39P34vAUOrV23BsKkRarA==,type:str]
     #ENC[AES256_GCM,data:6qNjSdjck4Vz,iv:c/GNqCNgRgwgL+2f6Vumtjb/ub9WCBSy8R02NRCDqk8=,tag:b/tucJsHTjSfcK0vgHtE8A==,type:comment]
     gb: ENC[AES256_GCM,data:3eAKBiJoC1owCHTFd3Xq8vI8VK980evePc92xCXJJ21M9D1MdbwN8ySZ3Ovjk7VfQmEo8oRv1Ll1sftyrXYoeTHmJsNDxCpR6A==,iv:Ju/ERNuGrgO5kYlbvmkbLJkgiW3Elou34AsJTFITCUg=,tag:POVlxYh9kZ1BMSbt97IVOQ==,type:str]
-    #ENC[AES256_GCM,data:oniighfvCNGWUwdhqg==,iv:RVUuZBqCd111QJ7MpgYBuP4fDCzm4NZAtbua9kXkrJM=,tag:21zF8E/3lBTDr54I9NKPVg==,type:comment]
-    zqq: ENC[AES256_GCM,data:Vjbbs8xIlH3+of7+kLGFVp4bIizU8D5R1qRbCqP5FhzTadXA8KD9/uiYxtrV3oxYGwZ/RlLvriHMClob4ihyDF4U2t8Dc4eVqA==,iv:FjCftpfKPZYThiNOyNkhx9uNyWIsjC5sK5WWcaEBtiY=,tag:MTL490c2SeFGx3EhxEdvkA==,type:str]
+    #ENC[AES256_GCM,data:/2y613pek/CO,iv:gqSh74Ac0BxPdO+fOsQ0K8t2YduwyTVOjMq/A5Wmoz0=,tag:jLUYXu7f27FruwH5rUUZSA==,type:comment]
+    wp: ENC[AES256_GCM,data:3jeHpeu1YlFhK2+o19q2/JyJPhZFivPbUQzJJbJZ15GzAVh7i1VsTSN31LufXAgsC8KjZHAPhEZlGYvnGpCvPzoISQa5NVAJdQ==,iv:bL3ohgbjA2agFKDwgw0H3LgiHTWB4Y5KlQAtHfEMr+w=,tag:SfLtj7iDcmV3dgOlITFvxA==,type:str]
+    #ENC[AES256_GCM,data:YIlY7n5pcJTp,iv:Y/+ogxaMgSl0vcMPRr3qdSHjjnnhY+N2Q6jFojzIDyQ=,tag:zat02jxJ8jI2uk8noslmHQ==,type:comment]
+    hjp: ENC[AES256_GCM,data:Ii4P9ZsUOEh3cqt3AKWlgUH1CMNnmHln9QNWdTRR3vZXkkR5j5qKAIrAltml/i3xFlt4hftYNufnupog4UlAVWQJhYBlhCSE4g==,iv:eKWmUcKItjd1dsvVP1se5CAhIFqV/eVH03gPJhBau1E=,tag:ZTE0BTSoDpJGqECklGjs2g==,type:str]
+    #ENC[AES256_GCM,data:hCgqHfpmeJ1Z,iv:pEKUNxhUyNAVtniTIQ2IpMPmXr2O+twq2/3Y2lIoqdw=,tag:RTqcI0XCoOymQD3r4+yS9Q==,type:comment]
+    zzn: ENC[AES256_GCM,data:/CSffToFJiBotXZ5rPkz0UNgI/iC0ftusPF2Ce6Of3XckjpCcikWj6n3ahJ24XsWQjp3EvacOiBorh+Kg16LjCEl0P2RMIitTQ==,iv:u9IFdp/jw7ehTshPzQVssLeh33iBYCPjSyJSLsc5EVo=,tag:/KXgmU7dcTKG8C4Y7NcMhw==,type:str]
 mariadb:
     slurm: ENC[AES256_GCM,data:qQMD8SKNmxb3PdScXNqppF9zkX7dV5i7rvljvZuhiI5zLnu77qYCHBW6ymh0mrY14N9NjxmQZhZWX/H8TvBlcg==,iv:J5N3LjCYW3QmuEkMBpl7qvPFW1Z9ZoPLkj45jKcIW9U=,tag:Tl+ld07+lVkmzt7f/f2MqQ==,type:str]
 hpcstat:
@@ -48,8 +52,8 @@ sops:
             ZDNHUjE2QVlCV3p0NHdKYW5IMHVBZzQKkZtfyvfroOntg3yRjMw4jQHiQj8eaB2h
             IeIHfW4y01mmVT2ofbtB0xYpjcl4gtUlQ8X3tn5iJ9P8gcVo0G598A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-21T09:56:03Z"
-    mac: ENC[AES256_GCM,data:9+AR9Y6ik+BH1Spk62LSTU1NFQ8ID0YROF+yf8ss2RqhfP6/5+lsrNjGC7gnEEMYF8UWVtChUuljIK3Q4MtT64JhDWgp8tenbpkJnRFGylzEe37MYajdDY7nrPP7iPUPNvS1ndo6vp/yuEigBXVhCtpjMObj7zIdGnLbtz0sczA=,iv:gNb8gVp9adnlZsMM2afOlFe46Vy15ELmC9vGaaeaInY=,tag:rltLL3WSZytjEemgjCy6Ng==,type:str]
+    lastmodified: "2024-08-31T15:59:56Z"
+    mac: ENC[AES256_GCM,data:zd3ivzjgdbwGZpZssHeIwwkKFfHDxo/dzvb8ptw9noZ4hDVoC5RL9M/OLN6GrRM0wtpNFZJDs7Zz0i1zMascXdVu6mou/0il6/96r+FkQVBJWbrkY36Lk7ntDAcQmZKWxSUfSF0JPHx1rbkIQSVtsLQrpui9UDxaY5DP23xjLQg=,iv:+ouEpSlo0EovK0Qh27tm7NXSYncbjEc/EMWfWHIrCqE=,tag:4CHXmsJ4LhFBmbep3Wil3w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0

devices/xmupc2/README.md

@@ -4,7 +4,7 @@
 * 内存：256 G。
 * 显卡：
   * 4090：24 G 显存。
-  * P5000：16 G 显存。
+  * ~~P5000：16 G 显存~~暂时拔掉了，否则 4090 供电不够。
 * 硬盘：18 T。
 
 # 支持的连接协议
@@ -18,14 +18,12 @@
 
 ## RDP
 
-* 地址：xmupc2.chn.moe
+* 地址：xmupc2.chn.moe:3390
 * 用户名：自己名字的拼音首字母
 * 密码和 ssh 一样（使用同样的验证机制）。
 
 ## samba
 
-* 地址：xmupc2.chn.moe
-* 用户名：自己名字的拼音首字母
-* 初始密码和 ssh 一样。
+因端口冲突暂时禁用。
 
 其它内容请阅读 [xmupc1](../xmupc1) 的说明，两台机器的软件大致是一样的。

devices/xmupc2/default.nix

@@ -41,17 +41,25 @@ inputs:
           };
         };
         gui = { enable = true; preferred = false; autoStart = true; };
-        networking.hostname = "xmupc2";
-        nix.remote.slave.enable = true;
+        nix =
+        {
+          marches =
+          [
+            "broadwell" "skylake"
+            # AVX512F CLWB AVX512VL AVX512BW AVX512DQ AVX512CD AVX512VNNI
+            # "cascadelake"
+          ];
+          remote.slave.enable = true;
+        };
+        grub.windowsEntries."8F50-83B8" = "猿神，启动！";
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "nvidia"; };
-      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      virtualization.kvmHost = { enable = true; gui = true; };
       services =
       {
         snapper.enable = true;
         sshd = { passwordAuthentication = true; groupBanner = true; };
         xray.client.enable = true;
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
         smartd.enable = true;
         beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
         wireguard =
@@ -64,16 +72,24 @@ inputs:
         slurm =
         {
           enable = true;
-          cpu = { sockets = 2; cores = 22; threads = 2; mpiThreads = 4; openmpThreads = 10; };
-          memoryMB = 253952;
-          gpus = { "4090" = 1; "p5000" = 1; };
+          master = "xmupc2";
+          node.xmupc2 =
+          {
+            name = "xmupc2"; address = "127.0.0.1";
+            cpu = { sockets = 2; cores = 22; threads = 2; };
+            memoryMB = 253952;
+            gpus."4090" = 1;
+          };
+          partitions.localhost = [ "xmupc2" ];
+          tui = { cpuMpiThreads = 8; cpuOpenmpThreads = 10; gpus = [ "4090" ]; };
         };
         xrdp = { enable = true; hostname = [ "xmupc2.chn.moe" ]; };
         samba = { enable = true; hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
         groupshare = {};
+        docker = {};
       };
       bugs = [ "xmunet" ];
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "zqq" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" ];
     };
   };
 }

devices/xmupc2/secrets/default.yaml

@@ -15,8 +15,10 @@ users:
     yjq: ENC[AES256_GCM,data:sGPQ0xALULREnhzl9g/V91M5osMglsSps6R4gYn5OZc/4xVC1phF3qajVN3YMOr7kKgkHbF2Rjm6/2vuK0k1iYZnFswUAmFlmw==,iv:5vG1hn7SlX6HCpas2BgxBSwWqLby8OCxcH3EKNvceIc=,tag:TVwFBAuosKnEOZecq1phXw==,type:str]
     #ENC[AES256_GCM,data:ALHxkRABA+ll,iv:r1IDiHLFcTdLID3q16zrLTavAwQfddC7bXMKcFZFveI=,tag:4Pd0/Q1BmH4gJjaM4hbqqQ==,type:comment]
     gb: ENC[AES256_GCM,data:z4CrtdmdLJJ0qZzr7qvihnluJQgjtciX56KdEmtemiRu0llEJk9qz6a23aJ7m40Sfc38elF1/LsvjOuBOC87+BVkKDCj76phag==,iv:WrFVxkr3snmqDXZx5kAYCLp7ixEIzxoT7El3rV7Ovqg=,tag:iExf2Y/HObHQrKMTRvqn7A==,type:str]
-    #ENC[AES256_GCM,data:UoNCXbGIHDNsmyCJxw==,iv:uTNvqg4xm7E+yn8vFaaihbEGEhLTZ2FNFNCYzdgiDlU=,tag:4bRSZbx6FFzA6MiBYVu0qw==,type:comment]
-    zqq: ENC[AES256_GCM,data:sfgufV++PfTrdeUBXZhmF1JoSpD8Nj+m0QKFrUMJG/pHb0AUagJEWEJwPsI+m91tZE0qxM271ks+WKqLElmyD4Ftw7ywWzTE0Q==,iv:R05QFUF+fvIHidWpHIR/D/e+UeciS5ehnx1kx+saCgM=,tag:3Awnd+pUQRxjjQ58SUX7Mg==,type:str]
+    #ENC[AES256_GCM,data:XfNExliq7noL,iv:K+rFlZHF1oY5rsTzaO0mgxiE1VlKdtPTifAaesg321k=,tag:Dja8NmPWZdJkf/J/96/wAw==,type:comment]
+    wp: ENC[AES256_GCM,data:yjMDez28pJUo6riIHypQQgjGFbuLwy87eG4ek/+Li2w8b4Cm5JckRvs26o+S0blfICc8WqIqEJGakT2wVBE5O1jGfniKn3PhTA==,iv:dOA318XRd2EXxmTIlk6GhlAR/FBpbKkbPJJCXTwFCxM=,tag:9MkXNUuAoplAzE+4eJpr0w==,type:str]
+    #ENC[AES256_GCM,data:YGcTkNCeu3m7,iv:jYmVrfRFwQoX1XxeSzS23wRMAD/AnzYBXQjI76Ke2FE=,tag:WJfSmjdggzPojDcJ6GzP+A==,type:comment]
+    hjp: ENC[AES256_GCM,data:0R5SfBFKuLGurwINnTj31FOrwwfY9bqVS1rG/a0HqIYd+Ui8/2ffFBx0Et+tYIqcxXEJpGbvse43V0naNKmFKlLanfcy9YV/Hg==,iv:mpAUmcVHWWLoreEsG9ha09jxte8mQCLt/A7nm04iX9Y=,tag:bia9pjL0MAcs9vj1gKCVCQ==,type:str]
 mariadb:
     slurm: ENC[AES256_GCM,data:9wLQ1zF/kDaiw0s3UaRpiHgmngU7u6hwyqpddSjev0+Z0v58Q2oiJtK8vn+2VlSxx5ACfqEFbzp0PZYAxd575w==,iv:q9JTkgDymOwkbZ/PaxRAAQrtO96QmGgZcQuLTFCMoS4=,tag:dwOHlOTgZqT/1jQ+oGf7UQ==,type:str]
 sops:
@@ -43,8 +45,8 @@ sops:
             M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
             LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-21T09:56:44Z"
-    mac: ENC[AES256_GCM,data:COodLhpL5EA5g15lgimsuxs1vmqJrLDVgtjw+0FLKTq6E1pcQ+zJl+dD0b9u5fYy9BBf56TI8TLJahVPR0eGxbDFlHmx8M9GStlTqaOE3jRsDT8GsihdlvLokyVt8jEfAnaWESTIgfehVL2TrLlsMnIsoVHrzdlEhX5ATXA3QOg=,iv:U/EwFmYWOcxi7ItkR/+MT8gTu7UobH5pxS00qrH/yyU=,tag:RVMcx4X0IS9yvpHrF0owpg==,type:str]
+    lastmodified: "2024-08-30T06:31:36Z"
+    mac: ENC[AES256_GCM,data:UUzv3IewuF4rhbrL2haJ0495p1d4wXA7LHa5ogc5TSv+ZAYuN/HL3VCXQzzKQrzqD3LtgC3DrGgmMNGVyAIzqVFYYxVuAwb03ov+lOp3SHvLTCMqkETbcE525aAIVWNqBXp7RBn7tKC4AD4y7AQihSYhBXO8VF1PeccjaCnN7R8=,iv:G0s8qchlgcm5HVshTKnGyt8nk+D4QYyP7n+5R0TOb8A=,tag:DspvfLf1pBs+/ol8GzT7Xw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723815556,
-        "narHash": "sha256-TgkChEFJHqrciuI1Va7buSs5RQHCSxbWRFmuOI+e2tY=",
+        "lastModified": 1726532433,
+        "narHash": "sha256-xyUZGXg38oXhWxbMPC4AJWpOn1IsB+w+taYkZomHupY=",
         "owner": "ezKEa",
         "repo": "aagl-gtk-on-nix",
-        "rev": "4d7fa422b50b612aa29bfb8487472f1cd9bad85b",
+        "rev": "f27ebcdcaf296f24b7a662facefec6b4d492b5c5",
         "type": "github"
       },
       "original": {
@@ -21,6 +21,22 @@
         "type": "github"
       }
     },
+    "blog": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726576113,
+        "narHash": "sha256-u/I6XYepAVGtkayYDm16IlaYOPEJFSyt/XRxG2YtgBw=",
+        "ref": "refs/heads/main",
+        "rev": "737eeef5116febf4c1dbc27737107dc616810d8d",
+        "revCount": 2,
+        "type": "git",
+        "url": "https://git.chn.moe/chn/blog.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.chn.moe/chn/blog.git"
+      }
+    },
     "blurred-wallpaper": {
       "flake": false,
       "locked": {
@@ -44,26 +60,26 @@
         ]
       },
       "locked": {
-        "lastModified": 1713974364,
-        "narHash": "sha256-ilZTVWSaNP1ibhQIIRXE+q9Lj2XOH+F9W3Co4QyY1eU=",
+        "lastModified": 1726983918,
+        "narHash": "sha256-eRGl50mhbJRT9Mk2NbePr6yzxzZRygndx4O7kObVa3g=",
         "ref": "refs/heads/master",
-        "rev": "de89197a4a7b162db7df9d41c9d07759d87c5709",
-        "revCount": 937,
+        "rev": "7370c1d1ef2421608e1355368361af92777a2c6c",
+        "revCount": 940,
         "type": "git",
-        "url": "https://pm.bsc.es/gitlab/rarias/bscpkgs.git"
+        "url": "https://git.chn.moe/chn/bscpkgs.git"
       },
       "original": {
         "type": "git",
-        "url": "https://pm.bsc.es/gitlab/rarias/bscpkgs.git"
+        "url": "https://git.chn.moe/chn/bscpkgs.git"
       }
     },
     "catppuccin": {
       "locked": {
-        "lastModified": 1724469296,
-        "narHash": "sha256-p3R4LUNk6gC+fTKRUm9ByXaoRIocnQMwVuJSIxECQ8o=",
+        "lastModified": 1726952185,
+        "narHash": "sha256-l/HbsQjJMT6tlf8KCooFYi3J6wjIips3n6/aWAoLY4g=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "874e668ddaf3687e8d38ccd0188a641ffefe1cfb",
+        "rev": "630b559cc1cb4c0bdd525af506935323e4ccd5d1",
         "type": "github"
       },
       "original": {
@@ -74,7 +90,6 @@
     },
     "chaotic": {
       "inputs": {
-        "compare-to": "compare-to",
         "fenix": "fenix",
         "flake-schemas": "flake-schemas",
         "home-manager": [
@@ -83,16 +98,14 @@
         "jovian": "jovian",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "systems": "systems",
-        "yafas": "yafas"
+        ]
       },
       "locked": {
-        "lastModified": 1724689493,
-        "narHash": "sha256-fNjxhUlj1/tsz4NmVvGiomEhnRlzRNi4/FUmYr7QO5I=",
+        "lastModified": 1727125297,
+        "narHash": "sha256-bsQPbe1v0Q+QSNvSTn+w7bQcjsj9NebS8zrx2JB2k4c=",
         "owner": "chaotic-cx",
         "repo": "nyx",
-        "rev": "9fbc509c51ab1e49b5c54a8c06d492830f6d8437",
+        "rev": "a803a24630c8d6108d88f2e35cf6c6d801c187b6",
         "type": "github"
       },
       "original": {
@@ -117,20 +130,6 @@
         "type": "github"
       }
     },
-    "compare-to": {
-      "locked": {
-        "lastModified": 1695341185,
-        "narHash": "sha256-htO6DSbWyCgaDkxi7foPjXwJFPzGjVt3RRUbPSpNtZY=",
-        "rev": "98b8e330823a3570d328720f87a1153f8a7f2224",
-        "revCount": 2,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/chaotic-cx/nix-empty-flake/0.1.2%2Brev-98b8e330823a3570d328720f87a1153f8a7f2224/018aba35-d228-7fa9-b205-7616c89ef4e0/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/chaotic-cx/nix-empty-flake/%3D0.1.2.tar.gz"
-      }
-    },
     "concurrencpp": {
       "flake": false,
       "locked": {
@@ -166,11 +165,11 @@
     "date": {
       "flake": false,
       "locked": {
-        "lastModified": 1715694668,
-        "narHash": "sha256-0dlwfPFUpIUp45KxfJIcD7J7ls6csPGx//qSt9Wp2CI=",
+        "lastModified": 1726273889,
+        "narHash": "sha256-yMiQTH6YRnpvoQe2yYIrT5asfM+yIJFGxcOzT1brLYo=",
         "owner": "HowardHinnant",
         "repo": "date",
-        "rev": "1ead6715dec030d340a316c927c877a3c4e5a00c",
+        "rev": "51ce7e131079c061533d741be5fe7cca57f2faac",
         "type": "github"
       },
       "original": {
@@ -203,11 +202,11 @@
     "eigen": {
       "flake": false,
       "locked": {
-        "lastModified": 1724459406,
-        "narHash": "sha256-CzysP5sq15+5U/hBBrP9lLecAa09OJH6a1bQ+pmWAVU=",
+        "lastModified": 1727215620,
+        "narHash": "sha256-X3GMEkX/5WcaTNF/MJ3QvSjXSkSE+EaujVyhwmbck58=",
         "owner": "libeigen",
         "repo": "eigen",
-        "rev": "c5189ac656c2bf5eead9bc967282cf084cbaeb64",
+        "rev": "7ad7c1d5c59ab0bf87f83003283f0cc8357789bd",
         "type": "gitlab"
       },
       "original": {
@@ -225,11 +224,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1724111875,
-        "narHash": "sha256-Cit1pRfzgq8G1vCMRQ4eE4YdaUJPCxvj0p3EvhIPAUY=",
+        "lastModified": 1726218245,
+        "narHash": "sha256-SotxHuixtryC9ByvC0VhYrYDDlyPjA34E2sc4BHzjmw=",
         "owner": "Mic92",
         "repo": "envfs",
-        "rev": "c8493adca165b700f53a53e06f578f3b9f64bcfc",
+        "rev": "918799f879c71a9a53e1da5300f3154a5b848bef",
         "type": "github"
       },
       "original": {
@@ -247,11 +246,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1724394478,
-        "narHash": "sha256-JSiv2uwI4UJo/4pxt4255BfzWCiEberJmBC6pCxnzas=",
+        "lastModified": 1726900127,
+        "narHash": "sha256-v3r7yJY8YE4HAzD5DXOxLkzj8YZKQ0xuccp9yppGW1U=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "2e7bcdc4ef73aa56abd2f970e5a8b9c0cc87e614",
+        "rev": "18eefba7fd0bf03e115785948758a44125a9fd68",
         "type": "github"
       },
       "original": {
@@ -387,11 +386,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "lastModified": 1726153070,
+        "narHash": "sha256-HO4zgY0ekfwO5bX0QH/3kJ/h4KvUDFZg8YpkNwIbg1U=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "bcef6817a8b2aa20a5a6dbb19b43e63c5bf8619a",
         "type": "github"
       },
       "original": {
@@ -405,11 +404,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "lastModified": 1726153070,
+        "narHash": "sha256-HO4zgY0ekfwO5bX0QH/3kJ/h4KvUDFZg8YpkNwIbg1U=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "bcef6817a8b2aa20a5a6dbb19b43e63c5bf8619a",
         "type": "github"
       },
       "original": {
@@ -420,21 +419,21 @@
     },
     "flake-schemas": {
       "locked": {
-        "lastModified": 1693491534,
-        "narHash": "sha256-ifw8Td8kD08J8DxFbYjeIx5naHcDLz7s2IFP3X42I/U=",
-        "rev": "c702cbb663d6d70bbb716584a2ee3aeb35017279",
-        "revCount": 21,
+        "lastModified": 1721999734,
+        "narHash": "sha256-G5CxYeJVm4lcEtaO87LKzOsVnWeTcHGKbKxNamNWgOw=",
+        "rev": "0a5c42297d870156d9c57d8f99e476b738dcd982",
+        "revCount": 75,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.1.1/018a4c59-80e1-708a-bb4d-854930c20f72/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.1.5/0190ef2f-61e0-794b-ba14-e82f225e55e6/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%3D0.1.1.tar.gz"
+        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%3D0.1.5.tar.gz"
       }
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1710146030,
@@ -451,6 +450,24 @@
       }
     },
     "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -468,7 +485,7 @@
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "flake-utils_4": {
       "inputs": {
         "systems": "systems_4"
       },
@@ -489,11 +506,11 @@
     "git-lfs-transfer": {
       "flake": false,
       "locked": {
-        "lastModified": 1723210978,
-        "narHash": "sha256-V/IvjUSWmp/QbSuaHzMT0AF4dqam1Ay8Uei5+11cmT8=",
+        "lastModified": 1725908800,
+        "narHash": "sha256-ipiGbIIxjq12QlN8k5SURH1XlnYivxMzYDEL5zh/Q9Q=",
         "owner": "charmbracelet",
         "repo": "git-lfs-transfer",
-        "rev": "2cab0ea18f7e5c07a6cc5490f861b6815abad119",
+        "rev": "edbf581042505b54aea7df83fbf8d82ac3c388a2",
         "type": "github"
       },
       "original": {
@@ -543,11 +560,11 @@
     "hextra": {
       "flake": false,
       "locked": {
-        "lastModified": 1724317530,
-        "narHash": "sha256-luENDR+fn9NbqNkn9wpLRnD41MeerFEUsrDgKRpnmg8=",
+        "lastModified": 1727125838,
+        "narHash": "sha256-THbmyRi8wb0p2Ko18ay+ZvxpVgl7FhoOHCI5RrIwu10=",
         "owner": "imfing",
         "repo": "hextra",
-        "rev": "c6de4b5b6b1ec04647b0235e9c8b1158b1d58c09",
+        "rev": "d367a443f1c7c93071b5f4ca2f522d07a888dc74",
         "type": "github"
       },
       "original": {
@@ -563,11 +580,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724435763,
-        "narHash": "sha256-UNky3lJNGQtUEXT2OY8gMxejakSWPTfWKvpFkpFlAfM=",
+        "lastModified": 1727111745,
+        "narHash": "sha256-EYLvFRoTPWtD+3uDg2wwQvlz88OrIr3zld+jFE5gDcY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c2cd2a52e02f1dfa1c88f95abeb89298d46023be",
+        "rev": "21c021862fa696c8199934e2153214ab57150cb6",
         "type": "github"
       },
       "original": {
@@ -578,11 +595,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1724489415,
-        "narHash": "sha256-ey8vhwY/6XCKoh7fyTn3aIQs7WeYSYtLbYEG87VCzX4=",
+        "lastModified": 1727198257,
+        "narHash": "sha256-/qMVI+SG9zvhLbQFOnqb4y4BH6DdK3DQHZU5qGptehc=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "c7f5b394397398c023000cf843986ee2571a1fd7",
+        "rev": "8514fff0f048557723021ffeb31ca55f69b67de3",
         "type": "github"
       },
       "original": {
@@ -600,11 +617,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724304322,
-        "narHash": "sha256-/nrlMDubg9oG2VNANRBxsas5RbcJtB6IIDPZC3yHLW8=",
+        "lastModified": 1726902390,
+        "narHash": "sha256-ESAD6AkxsQdV/j5ZBcO4Vg94J7Xd0nfpiEZpJtwSEhg=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "924a18ea8df89a39166dd202f3e73cd022825768",
+        "rev": "faf4c746c068dd8e41b1fa5f18beeabd34d4064c",
         "type": "github"
       },
       "original": {
@@ -632,11 +649,11 @@
     "lepton": {
       "flake": false,
       "locked": {
-        "lastModified": 1724686250,
-        "narHash": "sha256-Ngof+vfBm/3HFtjsNZGo9sWIHuoAet8v3f/FSMbARr4=",
+        "lastModified": 1727091413,
+        "narHash": "sha256-Id3YphCYrnw1vWy/z2psAEM71Tvy0t5q8pVdxneKYRg=",
         "owner": "black7375",
         "repo": "Firefox-UI-Fix",
-        "rev": "c346292707c4507e2ccd890adacba65c85dc62d1",
+        "rev": "c327fb7fe04949990993f6deb218d144e6b364c4",
         "type": "github"
       },
       "original": {
@@ -648,11 +665,11 @@
     "linux-surface": {
       "flake": false,
       "locked": {
-        "lastModified": 1723861744,
-        "narHash": "sha256-a4rrhMYb75Kk4G7JEZkacJPWI4u7o5xX88hwgty38D8=",
+        "lastModified": 1726862894,
+        "narHash": "sha256-Qt3h/JyGXj6nXb8SHv3lWv2vjnbj4lyOXpcuRjidWp4=",
         "owner": "linux-surface",
         "repo": "linux-surface",
-        "rev": "9103a6bf08d622fd583fd9839d2dc4ef9b2a46e2",
+        "rev": "c863f435d28498fb103d28616ba7d49e30a03d88",
         "type": "github"
       },
       "original": {
@@ -664,11 +681,11 @@
     "lmod": {
       "flake": false,
       "locked": {
-        "lastModified": 1724105894,
-        "narHash": "sha256-MhoKG0QwTAccK0NE8vnm325T8Azqy4VKf77LGaSDNZI=",
+        "lastModified": 1726330420,
+        "narHash": "sha256-hOhY9hr9U4914vVWEE0v+qP2KAMzFncEe8wZ+THCYw0=",
         "owner": "TACC",
         "repo": "Lmod",
-        "rev": "c7974de5ba3376c7bdc123c42a8e9c3648a84ec4",
+        "rev": "3d7ad3b7bc0868eab689f8ce493ad88acb44bd9e",
         "type": "github"
       },
       "original": {
@@ -680,11 +697,11 @@
     "matplotplusplus": {
       "flake": false,
       "locked": {
-        "lastModified": 1712716029,
-        "narHash": "sha256-R/skGbIyD67f/wGKebFkhqDxsFNw9exIK/tEauqaHCs=",
+        "lastModified": 1727155016,
+        "narHash": "sha256-AXO5Qrsnqm1Mo3lE8G5x3ofiXInx3eTPkXU6gUT49a0=",
         "owner": "alandefreitas",
         "repo": "matplotplusplus",
-        "rev": "734e4876611ae6ed216da47a7eb5c4b8e39785ce",
+        "rev": "e4ce4978db8ddc100dbfa895c38e7c51252a61bb",
         "type": "github"
       },
       "original": {
@@ -730,11 +747,11 @@
     "nameof": {
       "flake": false,
       "locked": {
-        "lastModified": 1715807436,
-        "narHash": "sha256-Mzcmin7p5wlNkbqvLE/GCOHnRu1R7/Dv0bsJe96w58U=",
+        "lastModified": 1726743126,
+        "narHash": "sha256-1TPWUHPCVX/JrWuw7+lidMxg/d3UH80h8ZQJTJKei3o=",
         "owner": "Neargye",
         "repo": "nameof",
-        "rev": "174b23d76e81f97766e8350aeab2a7cd49004bc9",
+        "rev": "3f1664327a3c841198f0a52962c48988d021a7a9",
         "type": "github"
       },
       "original": {
@@ -746,11 +763,11 @@
     "nc4nix": {
       "flake": false,
       "locked": {
-        "lastModified": 1724637826,
-        "narHash": "sha256-/ZI1Bs96JyTxOnG12Rqx2o8aYfwqKxF7IMCUIfLBX3w=",
+        "lastModified": 1727229835,
+        "narHash": "sha256-gIBIo/wIZMLZDOqJRnMy0I3DL0cN0exzV5wYc7e5dxU=",
         "owner": "helsinki-systems",
         "repo": "nc4nix",
-        "rev": "c082bb1e4d237090bec9cb845af43627766724a9",
+        "rev": "04e4f58dc1247caf0efd7ee1c463453b65b5ac8e",
         "type": "github"
       },
       "original": {
@@ -819,6 +836,27 @@
         "type": "github"
       }
     },
+    "nix-github-actions_2": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703863825,
+        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nix-index-database": {
       "inputs": {
         "nixpkgs": [
@@ -826,11 +864,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724576102,
-        "narHash": "sha256-uM7n5nNL6fmA0bwMJBNll11f4cMWOFa2Ni6F5KeIldM=",
+        "lastModified": 1726975622,
+        "narHash": "sha256-bPDZosnom0+02ywmMZAvmj7zvsQ6mVv/5kmvSgbTkaY=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "e333d62b70b179da1dd78d94315e8a390f2d12e5",
+        "rev": "c7515c2fdaf2e1f3f49856cef6cec95bb2138417",
         "type": "github"
       },
       "original": {
@@ -847,11 +885,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723950649,
-        "narHash": "sha256-dHMkGjwwCGj0c2MKyCjRXVBXq2Sz3TWbbM23AS7/5Hc=",
+        "lastModified": 1726975622,
+        "narHash": "sha256-bPDZosnom0+02ywmMZAvmj7zvsQ6mVv/5kmvSgbTkaY=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "392828aafbed62a6ea6ccab13728df2e67481805",
+        "rev": "c7515c2fdaf2e1f3f49856cef6cec95bb2138417",
         "type": "github"
       },
       "original": {
@@ -869,11 +907,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724635787,
-        "narHash": "sha256-01rsv0PLT/x5BZybqTnrlYipnG1CFF5s7ZX9otCnFlM=",
+        "lastModified": 1727228778,
+        "narHash": "sha256-vg1b7yLH8TgKsUi5KlctSx4GuET7MAoWUR7nqAGnU/Y=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "d1980fd00e84460f6769cc1684899fead5224080",
+        "rev": "fb86a415579cd38eb7b47c3ada597841b97e2ea9",
         "type": "github"
       },
       "original": {
@@ -915,11 +953,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1724690375,
-        "narHash": "sha256-ow1HWzTNnbHBUmnIK4kKAt0SR38iyjDObUGwej1soC8=",
+        "lastModified": 1727241804,
+        "narHash": "sha256-TOGSjuA+/xZgz/+HIC6dyYouT4X4qLHQ0eSXY731wBc=",
         "owner": "CHN-beta",
         "repo": "nixpkgs",
-        "rev": "7496c107d60dfbbc0c258550bbcc1d0df570aee4",
+        "rev": "2ca64bcc4748b2ceaa1d48f4140c21682dab9309",
         "type": "github"
       },
       "original": {
@@ -995,11 +1033,11 @@
     },
     "nixpkgs-24_05": {
       "locked": {
-        "lastModified": 1723938990,
-        "narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
+        "lastModified": 1726969270,
+        "narHash": "sha256-8fnFlXBgM/uSvBlLWjZ0Z0sOdRBesyNdH0+esxqizGc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
+        "rev": "23cbb250f3bf4f516a2d0bf03c51a30900848075",
         "type": "github"
       },
       "original": {
@@ -1023,14 +1061,14 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1722555339,
-        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
+        "lastModified": 1725233747,
+        "narHash": "sha256-Ss8QWLXdr2JCBPcYChJhz4xJm+h/xjl4G0c0XlP6a74=",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz"
       }
     },
     "nixpkgs-stable": {
@@ -1065,6 +1103,22 @@
         "type": "github"
       }
     },
+    "nu-scripts": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727036974,
+        "narHash": "sha256-MrGJexQ+47i74oCPXQYpKesQcJDZhrfMHOiu0psYv30=",
+        "owner": "nushell",
+        "repo": "nu_scripts",
+        "rev": "33ae4c55c249217a16424ccba2976aa2cc92867b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nushell",
+        "repo": "nu_scripts",
+        "type": "github"
+      }
+    },
     "nur-linyinfeng": {
       "inputs": {
         "devshell": "devshell",
@@ -1079,11 +1133,11 @@
         "treefmt-nix": "treefmt-nix_3"
       },
       "locked": {
-        "lastModified": 1724610772,
-        "narHash": "sha256-XAOnvYuIAMv7V2YVnVLUpMb+kzmxFxaXCaQASyJq7Ho=",
+        "lastModified": 1727159517,
+        "narHash": "sha256-e7ZUGuMf7JJTiXvkjmldXk3hbGxaVvOFvC/2YWRl5Zc=",
         "owner": "linyinfeng",
         "repo": "nur-packages",
-        "rev": "4593675609c0064d9a01e11df2e5c1ff369b98be",
+        "rev": "e1c84d2134d652699e912e6ef3010b3eef6adf61",
         "type": "github"
       },
       "original": {
@@ -1105,11 +1159,11 @@
         "treefmt-nix": "treefmt-nix_4"
       },
       "locked": {
-        "lastModified": 1724379880,
-        "narHash": "sha256-PatYnOuctc4rYrY7EqUDXbGkeRbyvhNIC845b0HS+oQ=",
+        "lastModified": 1727172363,
+        "narHash": "sha256-nJzfXFU4K6ZdrcgCJUTDBCdPMtKttQ+Dmm23dRij41E=",
         "owner": "xddxdd",
         "repo": "nur-packages",
-        "rev": "655aedb45bb67e16c7ac2a116614f28d36eec8b9",
+        "rev": "f5a0d458b2c10c3ced1f1d951e0d211748aeb1c4",
         "type": "github"
       },
       "original": {
@@ -1197,11 +1251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724556439,
-        "narHash": "sha256-gPR3sxkKxISUvydnqoj54znpUkK8av/HVFuFJuYUw3w=",
+        "lastModified": 1727210241,
+        "narHash": "sha256-lufS6uzSbSrggNCSgubymMQWnQMh7PvQ+lRZ8qH9Uoc=",
         "owner": "pjones",
         "repo": "plasma-manager",
-        "rev": "5c97fe8af2a2e561f14195ed357d8c451fdbff4c",
+        "rev": "a02fef2ece8084aff0b41700bb57d24d73574cd1",
         "type": "github"
       },
       "original": {
@@ -1210,6 +1264,46 @@
         "type": "github"
       }
     },
+    "pocketfft": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1722531938,
+        "narHash": "sha256-1kfMW9xGHtYiiCD4Qh4rXEuAi9EIzJ4lR+YLGjqzoaU=",
+        "owner": "mreineck",
+        "repo": "pocketfft",
+        "rev": "bb87ca50df0478415a12d9011dc374eeed4e9d93",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mreineck",
+        "repo": "pocketfft",
+        "type": "github"
+      }
+    },
+    "poetry2nix": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nix-github-actions": "nix-github-actions_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_5",
+        "treefmt-nix": "treefmt-nix_5"
+      },
+      "locked": {
+        "lastModified": 1725358301,
+        "narHash": "sha256-clY4INR7RjOVKya3FGNYvOhyFyUhd3dGQsnV2Za3rz0=",
+        "owner": "CHN-beta",
+        "repo": "poetry2nix",
+        "rev": "1f803d2b2faa5b785dfd2fafe99b2411731bf08c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "repo": "poetry2nix",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": "flake-compat_5",
@@ -1221,11 +1315,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1723803910,
-        "narHash": "sha256-yezvUuFiEnCFbGuwj/bQcqg7RykIEqudOy/RBrId0pc=",
+        "lastModified": 1726745158,
+        "narHash": "sha256-D5AegvGoEjt4rkKedmxlSEmC+nNLMBPWFxvmYnVLhjk=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "bfef0ada09e2c8ac55bbcd0831bd0c9d42e651ba",
+        "rev": "4e743a6920eab45e8ba0fbe49dc459f1423a4b74",
         "type": "github"
       },
       "original": {
@@ -1234,6 +1328,22 @@
         "type": "github"
       }
     },
+    "py4vasp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1718736886,
+        "narHash": "sha256-uAKhxPwiI3glSKMfynDIUrXQ7s2sfKw/PGVNoP40y00=",
+        "owner": "vasp-dev",
+        "repo": "py4vasp",
+        "rev": "661b9efed3824b36e67c559f4120b5ecfd231bce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vasp-dev",
+        "repo": "py4vasp",
+        "type": "github"
+      }
+    },
     "qchem": {
       "inputs": {
         "nixpkgs": [
@@ -1241,11 +1351,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724664864,
-        "narHash": "sha256-VEaGrv5sGNIdN6eQADXH9GylMp7X7qKCfOBmX93lsik=",
+        "lastModified": 1727173312,
+        "narHash": "sha256-uZCuMOChB56Pgp8ScFw6FFeeu9/RNsUn7zI15eN7RWU=",
         "owner": "Nix-QChem",
         "repo": "NixOS-QChem",
-        "rev": "7fcab915d585fd3c4261ec21585d4e9e117bc2c9",
+        "rev": "62f177cebbea78ce6bafcf4f76f4778120de23ea",
         "type": "github"
       },
       "original": {
@@ -1258,6 +1368,7 @@
     "root": {
       "inputs": {
         "aagl": "aagl",
+        "blog": "blog",
         "blurred-wallpaper": "blurred-wallpaper",
         "bscpkgs": "bscpkgs",
         "catppuccin": "catppuccin",
@@ -1293,10 +1404,14 @@
         "nixpkgs-23.05": "nixpkgs-23.05",
         "nixpkgs-23.11": "nixpkgs-23.11",
         "nodesoup": "nodesoup",
+        "nu-scripts": "nu-scripts",
         "nur-linyinfeng": "nur-linyinfeng",
         "nur-xddxdd": "nur-xddxdd",
         "openxlsx": "openxlsx",
         "plasma-manager": "plasma-manager",
+        "pocketfft": "pocketfft",
+        "poetry2nix": "poetry2nix",
+        "py4vasp": "py4vasp",
         "qchem": "qchem",
         "rsshub": "rsshub",
         "rycee": "rycee",
@@ -1313,11 +1428,11 @@
     "rsshub": {
       "flake": false,
       "locked": {
-        "lastModified": 1724689272,
-        "narHash": "sha256-iTkKoHSO/mD+TPR3hT9PO9TdHnxiqJDREyHb6a2LqaY=",
+        "lastModified": 1727232135,
+        "narHash": "sha256-L9xW1pNLkp2QcP6ecatJRsXUWuuF9RI5ZPoVP7Fyc2E=",
         "owner": "DIYgod",
         "repo": "RSSHub",
-        "rev": "6709293f140f38fbbcf3df8fc4e851f88800eafd",
+        "rev": "f9e891b360e6d776c78d92f8f68a1fc23ee41789",
         "type": "github"
       },
       "original": {
@@ -1329,11 +1444,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1724345276,
-        "narHash": "sha256-MKvjkqVL/RJ3QXOA8tSUoK7HHXVGSB2AL+vKxU4Cf+c=",
+        "lastModified": 1726443025,
+        "narHash": "sha256-nCmG4NJpwI0IoIlYlwtDwVA49yuspA2E6OhfCOmiArQ=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "9b724459b5900c2424f5069023d6596a8617284b",
+        "rev": "94b526fc86eaa0e90fb4d54a5ba6313aa1e9b269",
         "type": "github"
       },
       "original": {
@@ -1346,11 +1461,11 @@
     "rycee": {
       "flake": false,
       "locked": {
-        "lastModified": 1724645012,
-        "narHash": "sha256-XJ8B9ecksgZBlWV9pnDgBWVePyHDg/cLYJ/6YF/RdRA=",
+        "lastModified": 1727237003,
+        "narHash": "sha256-HD3pPxcLWykiscbwbAPVWeJ8NehzfoHV4PSQp5A89J8=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "70645c904b41b9ddf70f7218898c48df93e8254f",
+        "rev": "1f8ac3b4f0632fc9da864ecd4b1bbe51d61dde01",
         "type": "gitlab"
       },
       "original": {
@@ -1401,11 +1516,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723501126,
-        "narHash": "sha256-N9IcHgj/p1+2Pvk8P4Zc1bfrMwld5PcosVA0nL6IGdE=",
+        "lastModified": 1726524647,
+        "narHash": "sha256-qis6BtOOBBEAfUl7FMHqqTwRLB61OL5OFzIsOmRz2J4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "be0eec2d27563590194a9206f551a6f73d52fa34",
+        "rev": "e2d404a7ea599a013189aa42947f66cede0645c8",
         "type": "github"
       },
       "original": {
@@ -1432,16 +1547,16 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
         "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
         "type": "github"
       }
     },
@@ -1490,6 +1605,20 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "id": "systems",
+        "type": "indirect"
+      }
+    },
     "tgbot-cpp": {
       "flake": false,
       "locked": {
@@ -1556,11 +1685,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724338379,
-        "narHash": "sha256-kKJtaiU5Ou+e/0Qs7SICXF22DLx4V/WhG1P6+k4yeOE=",
+        "lastModified": 1727098951,
+        "narHash": "sha256-gplorAc0ISAUPemUNOnRUs7jr3WiLiHZb3DJh++IkZs=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "070f834771efa715f3e74cd8ab93ecc96fabc951",
+        "rev": "35dfece10c642eb52928a48bee7ac06a59f93e9a",
         "type": "github"
       },
       "original": {
@@ -1577,11 +1706,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1723808491,
-        "narHash": "sha256-rhis3qNuGmJmYC/okT7Dkc4M8CeUuRCSvW6kC2f3hBc=",
+        "lastModified": 1727098951,
+        "narHash": "sha256-gplorAc0ISAUPemUNOnRUs7jr3WiLiHZb3DJh++IkZs=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "1d07739554fdc4f8481068f1b11d6ab4c1a4167a",
+        "rev": "35dfece10c642eb52928a48bee7ac06a59f93e9a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_5": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1719749022,
+        "narHash": "sha256-ddPKHcqaKCIFSFc/cvxS14goUhCOAwsM1PbMr0ZtHMg=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "8df5ff62195d4e67e2264df0b7f5e8c9995fd0bd",
         "type": "github"
       },
       "original": {
@@ -1593,11 +1743,11 @@
     "v-sim": {
       "flake": false,
       "locked": {
-        "lastModified": 1722003028,
-        "narHash": "sha256-qGnlSrUwwVhCu3kSlklwQg08S7mFZ/RcfsVv3phuuko=",
+        "lastModified": 1726128818,
+        "narHash": "sha256-DsTsqmboCzTjrykPFde4PyQpjQ2ZW0yUmyWQGkZcYmI=",
         "owner": "l_sim",
         "repo": "v_sim",
-        "rev": "1b77971358002d3e92b18021551029e9db33e509",
+        "rev": "8e6b879bcc513d776b31150d7edb4f60049035eb",
         "type": "gitlab"
       },
       "original": {
@@ -1606,39 +1756,14 @@
         "type": "gitlab"
       }
     },
-    "yafas": {
-      "inputs": {
-        "flake-schemas": [
-          "chaotic",
-          "flake-schemas"
-        ],
-        "systems": [
-          "chaotic",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1695926485,
-        "narHash": "sha256-wNFFnItckgSs8XeYhhv8vlJs2WF09fSQaWgw4xkDqHQ=",
-        "owner": "UbiqueLambda",
-        "repo": "yafas",
-        "rev": "7772afd6686458ca0ddbc599a52cf5d337367653",
-        "type": "github"
-      },
-      "original": {
-        "owner": "UbiqueLambda",
-        "repo": "yafas",
-        "type": "github"
-      }
-    },
     "zpp-bits": {
       "flake": false,
       "locked": {
-        "lastModified": 1721553062,
-        "narHash": "sha256-rqL/xEhPzgCA16DP/LIix75VtqKpBS5Rm56fb5cxaGo=",
+        "lastModified": 1726003541,
+        "narHash": "sha256-VFWJa1gWuKdSpo4swv8qNNsqBVjjcZwUwJsPUK2mVak=",
         "owner": "eyalz800",
         "repo": "zpp_bits",
-        "rev": "81be2fa9652658e7b4a77f9f6ea3970eb3bbef6f",
+        "rev": "244f9c612f668bd466e2ee378a4998d3c577332c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -37,7 +37,8 @@
     };
     gricad = { url = "github:Gricad/nur-packages"; flake = false; };
     catppuccin.url = "github:catppuccin/nix";
-    bscpkgs = { url = "git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
+    bscpkgs = { url = "git+https://git.chn.moe/chn/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
+    poetry2nix = { url = "github:CHN-beta/poetry2nix"; inputs.nixpkgs.follows = "nixpkgs"; };
 
     misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
     rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -67,141 +68,23 @@
     git-lfs-transfer = { url = "github:charmbracelet/git-lfs-transfer"; flake = false; };
     nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
     hextra = { url = "github:imfing/hextra"; flake = false; };
+    nu-scripts = { url = "github:nushell/nu_scripts"; flake = false; };
+    py4vasp = { url = "github:vasp-dev/py4vasp"; flake = false; };
+    pocketfft = { url = "github:/mreineck/pocketfft"; flake = false; };
+    blog = { url = "git+https://git.chn.moe/chn/blog.git"; flake = false; };
 
     # does not support lfs yet
     # nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git"; flake = false; };
   };
 
-  outputs = inputs:
-    let
-      localLib = import ./lib.nix inputs.nixpkgs.lib;
-      devices = builtins.filter (dir: (builtins.readDir ./devices/${dir})."default.nix" or null == "regular" )
-        (builtins.attrNames (builtins.readDir ./devices));
-    in
-    {
-      packages.x86_64-linux = rec
-      {
-        pkgs = (import inputs.nixpkgs
-        {
-          system = "x86_64-linux";
-          config.allowUnfree = true;
-          overlays = [ inputs.self.overlays.default ];
-        });
-        default = inputs.nixpkgs.legacyPackages.x86_64-linux.writeText "systems"
-          (builtins.concatStringsSep "\n" (builtins.map
-            (system: builtins.toString inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel)
-            devices));
-        hpcstat =
-          let
-            openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
-              (prev: { doCheck = false; patches = prev.patches ++ [ ./packages/hpcstat/openssh.patch ];});
-            duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
-          in pkgs.pkgsStatic.localPackages.hpcstat.override
-            { inherit openssh duc; standalone = true; version = inputs.self.rev or "dirty"; };
-        ufo =
-          let
-            range-v3 = pkgs.pkgsStatic.range-v3.overrideAttrs (prev:
-            {
-              cmakeFlags = prev.cmakeFlags or []
-                ++ [ "-DRANGE_V3_DOCS=OFF" "-DRANGE_V3_TESTS=OFF" "-DRANGE_V3_EXAMPLES=OFF" ];
-              doCheck = false;
-            });
-            tbb = pkgs.pkgsStatic.tbb_2021_11.overrideAttrs (prev: { cmakeFlags = prev.cmakeFlags or [] ++
-              [ "-DTBB_TEST=OFF" ]; });
-            biu = pkgs.pkgsStatic.localPackages.biu.override { inherit range-v3; };
-            matplotplusplus = pkgs.pkgsStatic.localPackages.matplotplusplus.override { libtiff = null; };
-          in pkgs.pkgsStatic.localPackages.ufo.override { inherit biu tbb matplotplusplus; };
-        chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
-        blog = pkgs.callPackage ./blog { inherit (inputs) hextra; };
-      }
-      // (builtins.listToAttrs (builtins.map
-        (system:
-        {
-          name = system;
-          value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
-        })
-        devices)
-      );
-      nixosConfigurations =
-      (
-        (builtins.listToAttrs (builtins.map
-          (system:
-          {
-            name = system;
-            value = inputs.nixpkgs.lib.nixosSystem
-            {
-              system = "x86_64-linux";
-              specialArgs = { topInputs = inputs; inherit localLib; };
-              modules = localLib.mkModules
-              [
-                (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
-                  # replace pkgs with final to avoid infinite recursion
-                  { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
-                ./modules
-                ./devices/${system}
-              ];
-            };
-          })
-          devices))
-        // {
-          pi3b = inputs.nixpkgs.lib.nixosSystem
-          {
-            system = "aarch64-linux";
-            specialArgs = { topInputs = inputs; inherit localLib; };
-            modules = localLib.mkModules
-            [
-              (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
-                # replace pkgs with final to avoid infinite recursion
-                { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
-              ./modules
-              ./devices/pi3b
-            ];
-          };
-        }
-      );
-      overlays.default = final: prev:
-        { localPackages = (import ./packages { inherit (inputs) lib; pkgs = final; topInputs = inputs; }); };
-      config = { archive = false; branch = "production"; };
-      devShells.x86_64-linux = let inherit (inputs.self.packages.x86_64-linux) pkgs; in
-      {
-        biu = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ pkgs.localPackages.biu ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        hpcstat = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.hpcstat.override { version = null; }) ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        sbatch-tui = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.sbatch-tui ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        ufo = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.ufo.override { version = null; }) ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        chn-bsub = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.chn-bsub ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        winjob =
-          let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
-          in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-          {
-            inputsFrom = [ winjob ];
-            packages = [ clang-tools_18 ];
-            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-          };
-      };
-    };
+  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
+  {
+    packages.x86_64-linux = import ./flake/packages.nix { inherit inputs localLib; };
+    nixosConfigurations = import ./flake/nixos.nix { inherit inputs localLib; };
+    overlays.default = final: prev:
+      { localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; }); };
+    config = { archive = false; branch = "production"; };
+    devShells.x86_64-linux = import ./flake/dev.nix { inherit inputs; };
+    src = import ./flake/src.nix { inherit inputs; };
+  };
 }

flake/dev.nix

@@ -0,0 +1,41 @@
+{ inputs }: let inherit (inputs.self.nixosConfigurations.pc) pkgs; in
+{
+  biu = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.biu ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  hpcstat = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ (pkgs.localPackages.hpcstat.override { version = null; }) ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  sbatch-tui = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.sbatch-tui ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  ufo = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.ufo ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  chn-bsub = pkgs.mkShell
+  {
+    inputsFrom = [ pkgs.localPackages.chn-bsub ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  winjob =
+    let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
+    in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+    {
+      inputsFrom = [ winjob ];
+      packages = [ clang-tools_18 ];
+      CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+    };
+}

flake/lib.nix

@@ -54,4 +54,36 @@ lib: rec
             else null
           else null)
       (attrsToList (builtins.readDir path))));
+
+  # replace the value in a nested attrset. example:
+  # deepReplace
+  #   [ { path = [ "a" "b" 1 ]; value = "new value"; } ]
+  #   { a = { b = [ "old value" "old value" ]; }; }
+  # => { a = { b = [ "old value" "new value" ]; }; }
+  deepReplace = pattern: origin:
+    let replace = { path, value, content }:
+      if path == [] then
+        if (builtins.typeOf value) == "lambda" then value content
+        else value
+      else let currentPath = builtins.head path; nextPath = builtins.tail path; in
+        if (builtins.typeOf currentPath) == "string" then
+          if (builtins.typeOf content) != "set" then builtins.throw "content should be a set"
+          else builtins.mapAttrs
+            (n: v: if n == currentPath then replace { path = nextPath; inherit value; content = v; } else v) content
+        else if (builtins.typeOf currentPath) == "int" then
+          if (builtins.typeOf content) != "list" then builtins.throw "content should be a list"
+          else lib.imap0
+            (i: v: if i == currentPath then replace { path = nextPath; inherit value; content = v; } else v) content
+        else if (builtins.typeOf currentPath) != "lambda" then throw "path should be a lambda"
+        else
+          if (builtins.typeOf content) == "list" then builtins.map
+            (v: if currentPath v then replace { path = nextPath; inherit value; content = v; } else v) content
+          else if (builtins.typeOf content) == "set" then builtins.listToAttrs (builtins.map
+            (v: if currentPath v then replace { path = nextPath; inherit value; content = v; } else v)
+            (attrsToList content))
+          else throw "content should be a list or a set.";
+    in
+      if (builtins.typeOf pattern) != "list" then throw "pattern should be a list"
+      else if pattern == [] then origin
+      else deepReplace (builtins.tail pattern) (replace ((builtins.head pattern) // { content = origin; }));
 }

flake/nixos.nix

@@ -0,0 +1,51 @@
+{ inputs, localLib }:
+builtins.listToAttrs
+(
+  (builtins.map
+    (system:
+    {
+      name = system;
+      value = inputs.nixpkgs.lib.nixosSystem
+      {
+        system = let arch.pi3b = "aarch64-linux"; in arch.${system} or "x86_64-linux";
+        specialArgs = { topInputs = inputs; inherit localLib; };
+        modules = localLib.mkModules
+        [
+          {
+            config =
+            {
+              nixpkgs.overlays = [ inputs.self.overlays.default ];
+              nixos.system.networking.hostname = system;
+            };
+          }
+          ../modules
+          ../devices/${system}
+        ];
+      };
+    })
+    [ "nas" "pc" "pi3b" "surface" "vps4" "vps6" "vps7" "xmupc1" "xmupc2" ])
+  ++ (builtins.map
+    (node:
+    {
+      name = "srv1-${node}";
+      value = inputs.nixpkgs.lib.nixosSystem
+      {
+        system = "x86_64-linux";
+        specialArgs = { topInputs = inputs; inherit localLib; };
+        modules = localLib.mkModules
+        [
+          {
+            config =
+            {
+              nixpkgs.overlays = [ inputs.self.overlays.default ];
+              nixos.system.cluster = { clusterName = "srv1"; nodeName = node; };
+            };
+          }
+          ../modules
+          ../devices/srv1
+          ../devices/srv1/${node}
+        ];
+      };
+    })
+    [ "node0" "node1" "node2" "node3" ])
+)

flake/packages.nix

@@ -0,0 +1,29 @@
+{ inputs, localLib }: rec
+{
+  pkgs = (import inputs.nixpkgs
+  {
+    system = "x86_64-linux";
+    config.allowUnfree = true;
+    overlays = [ inputs.self.overlays.default ];
+  });
+  hpcstat =
+    let
+      openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
+        (prev: { doCheck = false; patches = prev.patches ++ [ ../packages/hpcstat/openssh.patch ];});
+      duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
+      # pkgsStatic.clangStdenv have a bug
+      # https://github.com/NixOS/nixpkgs/issues/177129
+      biu = pkgs.pkgsStatic.localPackages.biu.override { stdenv = pkgs.pkgsStatic.gcc14Stdenv; };
+    in pkgs.pkgsStatic.localPackages.hpcstat.override
+    {
+      inherit openssh duc biu;
+      standalone = true;
+      version = inputs.self.rev or "dirty";
+      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
+    };
+  chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
+  blog = pkgs.callPackage inputs.blog { inherit (inputs) hextra; };
+}
+// (builtins.listToAttrs (builtins.map
+  (system: { inherit (system) name; value = system.value.config.system.build.toplevel; })
+  (localLib.attrsToList inputs.self.outputs.nixosConfigurations)))

flake/src.nix

@@ -0,0 +1,10 @@
+{ inputs }: let inherit (inputs.self.packages.x86_64-linux) pkgs; in
+{
+  nixos-wallpaper = pkgs.fetchgit
+  {
+    url = "https://git.chn.moe/chn/nixos-wallpaper.git";
+    rev = "1ad78b20b21c9f4f7ba5f4c897f74276763317eb";
+    sha256 = "0faahbzsr44bjmwr6508wi5hg59dfb57fzh5x6jh7zwmv4pzhqlb";
+    fetchLFS = true;
+  };
+}

modules/default.nix

@@ -25,6 +25,7 @@ inputs:
             topInputs.qchem.overlays.default
             topInputs.aagl.overlays.default
             topInputs.bscpkgs.overlays.default
+            topInputs.poetry2nix.overlays.default
             (final: prev:
             {
               nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";

modules/hardware/gpu.nix

@@ -101,8 +101,8 @@ inputs:
       inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
       {
         opencl.enable = true;
+        initrd.enable = true; # needed for waydroid
         legacySupport.enable = true;
-        initrd.enable = true;
         amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
       };}
     )

modules/packages/desktop/default.nix

@@ -16,7 +16,7 @@ inputs:
           # system management
           # TODO: module should add yubikey-touch-detector into path
           gparted wayland-utils clinfo glxinfo vulkan-tools dracut yubikey-touch-detector btrfs-assistant snapper-gui
-          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x inputs.pkgs."pkgs-23.11".etcher wl-mirror
+          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x wl-mirror # inputs.pkgs."pkgs-23.11".etcher
           (
             writeShellScriptBin "xclip"
             ''
@@ -38,6 +38,7 @@ inputs:
           # themes
           catppuccin catppuccin-sddm catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
           (catppuccin-kde.override { flavour = [ "latte" ]; }) (catppuccin-kvantum.override { variant = "latte"; })
+          klassy
           localPackages.slate localPackages.blurred-wallpaper tela-circle-icon-theme
           # terminal
           warp-terminal
@@ -61,20 +62,20 @@ inputs:
           nix-template nil pnpm-lock-export bundix
           # instant messager
           element-desktop telegram-desktop discord fluffychat zoom-us signal-desktop slack nur-linyinfeng.wemeet
-          cinny-desktop nheko # qq nur-xddxdd.wechat-uos
+          nheko # qq nur-xddxdd.wechat-uos TODO: cinny-desktop
           # browser
           google-chrome tor-browser microsoft-edge
           # office
-          crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
-          davinci-resolve
-          texliveFull
+          crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk pdfchain hdfview
+          davinci-resolve texliveFull
+          # matplot++ needs old gnuplot
+          inputs.pkgs."pkgs-23.11".gnuplot
           # math, physics and chemistry
-          octaveFull root ovito localPackages.vesta localPackages.vaspkit localPackages.v-sim
-          (mathematica.overrideAttrs (prev: { postInstall = prev.postInstall or "" + "ln -s ${src} $out/src"; }))
-          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; }) jmol mpi
+          octaveFull root ovito localPackages.vesta localPackages.v-sim
+          (mathematica.overrideAttrs (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; }))
+          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; }) jmol mpi localPackages.ufo
           # virtualization
-          # TODO: broken on python 3.12: playonlinux
-          wineWowPackages.stagingFull virt-viewer bottles genymotion
+          wineWowPackages.stagingFull virt-viewer bottles genymotion playonlinux
           # media
           nur-xddxdd.svp
           # for kdenlive auto subtitle
@@ -82,25 +83,31 @@ inputs:
         ]
           ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
             (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
-          # TODO: fix it
-          # ++ inputs.lib.optional (inputs.config.nixos.system.nixpkgs.march != null) localPackages.mumax;
         _pythonPackages = [(pythonPackages: with pythonPackages;
         [
           phonopy scipy scikit-learn jupyterlab autograd # localPackages.pix2tex
-          # TODO: broken on python 3.12: tensorflow keras
+          # TODO: broken on python 3.12 tensorflow keras
         ])];
       };
       user.sharedModules =
       [{
         config.programs =
         {
-          plasma = 
+          plasma =
           {
             enable = true;
             configFile =
             {
               plasma-localerc = { Formats.LANG.value = "en_US.UTF-8"; Translations.LANGUAGE.value = "zh_CN"; };
               baloofilerc."Basic Settings".Indexing-Enabled.value = false;
+              plasmarc.Wallpapers.usersWallpapers.value =
+                let
+                  inherit (inputs.topInputs.self.src) nixos-wallpaper;
+                  isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
+                    [ "png" "jpg" "jpeg" "webp" ];
+                in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
+                  (builtins.filter (f: (isPicture f.name) && (f.value == "regular"))
+                    (inputs.localLib.attrsToList (builtins.readDir nixos-wallpaper))));
             };
             powerdevil =
               let config =

modules/packages/firefox.nix

@@ -12,7 +12,55 @@ inputs:
     {
       enable = true;
       languagePacks = [ "zh-CN" "en-US" ];
-      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator ];
+      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator firefoxpwa ];
+    };
+    nixos =
+    {
+      packages.packages._packages = [ inputs.pkgs.firefoxpwa ];
+      user.sharedModules =
+      [{
+        config =
+        {
+          programs.firefox =
+          {
+            enable = true;
+            nativeMessagingHosts = with inputs.pkgs;
+              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
+            # TODO: use fixed-version of plugins
+            policies.DefaultDownloadDirectory = "\${home}/Downloads";
+            profiles.default =
+            {
+              extensions = with inputs.pkgs.firefox-addons;
+              [
+                tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
+                metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
+                wappalyzer grammarly plasma-integration zotero-connector pwas-for-firefox smartproxy kiss-translator
+              ];
+              search = { default = "Google"; force = true; };
+              userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";
+              userContent = builtins.readFile "${inputs.topInputs.lepton}/userContent.css";
+              extraConfig = builtins.readFile "${inputs.topInputs.lepton}/user.js";
+              settings =
+              {
+                # general
+                "browser.search.region" = "CN";
+                "intl.locale.requested" = "zh-CN,en-US";
+                "browser.aboutConfig.showWarning" = false;
+                "browser.bookmarks.showMobileBookmarks" = true;
+                "browser.download.panel.shown" = true;
+                "browser.download.useDownloadDir" = true;
+                "browser.newtab.extensionControlled" = true;
+                "browser.toolbars.bookmarks.visibility" = "never";
+                # allow to apply userChrome.css
+                "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+                # automatically enable extensions
+                "extensions.autoDisableScopes" = 0;
+              };
+            };
+          };
+          home.file.".mozilla/firefox/profiles.ini".force = true;
+        };
+      }];
     };
   };
 }

modules/packages/mumax.nix

@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default =
+      if inputs.config.nixos.system.gui.enable
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+      then {}
+      else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
+  {
+    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];
+  };
+}

modules/packages/nushell.nix

@@ -0,0 +1,51 @@
+inputs:
+{
+  options.nixos.packages.nushell = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = {};
+  };
+  config = let inherit (inputs.config.nixos.packages) nushell; in inputs.lib.mkIf (nushell != null)
+  {
+    nixos =
+    {
+      packages.packages._packages = [ inputs.pkgs.nushell ];
+      user.sharedModules =
+      [{
+        config.programs =
+        {
+          nushell =
+          {
+            enable = true;
+            extraConfig =
+            ''
+              source ${inputs.topInputs.nu-scripts}/aliases/git/git-aliases.nu
+              $env.PATH = ($env.PATH | split row (char esep) | append "~/bin")
+            '';
+          };
+          carapace.enable = true;
+          oh-my-posh =
+          {
+            enable = true;
+            enableZshIntegration = false;
+            settings = inputs.localLib.deepReplace
+              [
+                {
+                  path = [ "blocks" 0 "segments" (v: v.type or "" == "path") "properties" "style" ];
+                  value = "powerlevel";
+                }
+                {
+                  path = [ "blocks" 0 "segments" (v: v.type or "" == "executiontime") "template" ];
+                  value = v: builtins.replaceStrings [ "⠀" ] [ " " ] v;
+                }
+              ]
+              (builtins.fromJSON (builtins.readFile
+                "${inputs.pkgs.oh-my-posh}/share/oh-my-posh/themes/atomic.omp.json"));
+          };
+          zoxide.enable = true;
+          direnv.enable = true;
+        };
+      }];
+    };
+  };
+}

modules/packages/server.nix

@@ -10,7 +10,7 @@ inputs:
       [
         # basic tools
         beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij ipfetch localPackages.pslist
-        fastfetch reptyr nushell duc ncdu progress libva-utils ksh neofetch
+        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch
         # lsxx
         pciutils usbutils lshw util-linux lsof dmidecode lm_sensors
         # top
@@ -26,7 +26,7 @@ inputs:
         # file system management
         sshfs e2fsprogs duperemove compsize exfatprogs
         # disk management
-        smartmontools hdparm
+        smartmontools hdparm megacli gptfdisk
         # encryption and authentication
         apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
         # networking
@@ -44,8 +44,10 @@ inputs:
         ++ (inputs.lib.optional (inputs.config.nixos.system.nixpkgs.arch == "x86_64") rar);
       _pythonPackages = [(pythonPackages: with pythonPackages;
       [
-        openai python-telegram-bot fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
         certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus
+        # for vasp plot-workfunc.py
+        ase
       ])];
     };
     programs =
@@ -64,5 +66,8 @@ inputs:
       fwupd.enable = true;
     };
     home-manager = { useGlobalPkgs = true; useUserPackages = true; };
+    # allow everyone run compsize
+    security.wrappers.compsize =
+      { setuid = true; owner = "root"; group = "root"; source = "${inputs.pkgs.compsize}/bin/compsize"; };
   };
 }

modules/packages/ssh.nix

@@ -30,12 +30,12 @@ inputs:
         vps7 =
         {
           ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIF5XkdilejDAlg5hZZD0oq69k8fQpe9hIJylTo/aLRgY";
-          hostnames = [ "vps7.chn.moe" "wireguard.vps7.chn.moe" "ssh.git.chn.moe" "95.111.228.40" "192.168.83.2" ];
+          hostnames = [ "vps7.chn.moe" "wireguard.vps7.chn.moe" "ssh.git.chn.moe" "144.126.144.62" "192.168.83.2" ];
         };
         "initrd.vps7" =
         {
           ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIGZyQpdQmEZw3nLERFmk2tS1gpSvXwW0Eish9UfhrRxC";
-          hostnames = [ "initrd.vps7.chn.moe" "95.111.228.40" ];
+          hostnames = [ "initrd.vps7.chn.moe" "144.126.144.62" ];
         };
         nas =
         {
@@ -77,6 +77,26 @@ inputs:
           ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIJZ/+divGnDr0x+UlknA84Tfu6TPD+zBGmxWZY4Z38P6";
           hostnames = [ "[xmupc2.chn.moe]:6394" "wireguard.xmupc2.chn.moe" "192.168.83.7" ];
         };
+        srv1-node0 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIDm6M1D7dBVhjjZtXYuzMj2P1fXNWN3O9wmwNssxEeDs";
+          hostnames = [ "srv1.chn.moe" "node0.srv1.chn.moe" "wireguard.node0.srv1.chn.moe" ];
+        };
+        srv1-node1 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIIFmG/ZzLDm23NeYa3SSI0a0uEyQWRFkaNRE9nB8egl7";
+          hostnames = [ "192.168.178.2" ];
+        };
+        srv1-node2 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIDhgEApzHhVPDvdVFPRuJ/zCDiR1K+rD4sZzH77imKPE";
+          hostnames = [ "192.168.178.3" ];
+        };
+        srv1-node3 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIO/4xbQNz6KNcEdjtBMGY8wUoFK1sCgamKl/r+kVjd7O";
+          hostnames = [ "192.168.178.4" ];
+        };
       };
       in builtins.listToAttrs (builtins.map
         (server:
@@ -112,7 +132,7 @@ inputs:
             [ "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
           ++ (builtins.map
             (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; forwardX11 = true; }; })
-            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" ])
+            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
           ++ (builtins.map
             (host:
             {
@@ -142,7 +162,10 @@ inputs:
             forwardAgent = true;
             extraOptions.AddKeysToAgent = "yes";
           };
-          "wireguard.jykang" = jykang // { host = "internal.jykang"; proxyJump = "wireguard.xmupc1"; };
+          "wireguard.jykang" = jykang // { host = "wireguard.jykang"; proxyJump = "wireguard.xmupc1"; };
+          srv1-node1 = { host = "srv1-node1"; hostname = "192.168.178.2"; proxyJump = "srv1"; };
+          srv1-node2 = { host = "srv1-node2"; hostname = "192.168.178.3"; proxyJump = "srv1"; };
+          srv1-node3 = { host = "srv1-node3"; hostname = "192.168.178.4"; proxyJump = "srv1"; };
         };
       };
     })];

modules/packages/vasp.nix

@@ -8,7 +8,12 @@ inputs:
   # TODO: add more options to correctly configure VASP
   config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
   {
-    nixos.packages.packages._packages = inputs.lib.optionals (inputs.config.nixos.system.nixpkgs.march != null)
-      (with inputs.pkgs.localPackages.vasp; [ intel nvidia vtstscripts ]);
+    nixos.packages.packages._packages = with inputs.pkgs;
+    (
+      [ localPackages.vasp.intel localPackages.vasp.vtstscripts localPackages.py4vasp localPackages.vaspkit ]
+        ++ (inputs.lib.optional
+          (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+          localPackages.vasp.nvidia)
+    );
   };
 }

modules/packages/vscode.nix

@@ -26,53 +26,34 @@ inputs:
                 ++ (builtins.attrNames vscode-extensions)
               )));
             in with extensions;
-              (with equinusocio; [ vsc-material-theme vsc-material-theme-icons ])
-              ++ (with github; [ copilot copilot-chat github-vscode-theme ])
-              ++ (with intellsmi; [ comment-translate deepl-translate ])
-              ++ (with ms-python; [ isort python vscode-pylance ])
-              ++ (with ms-toolsai;
-              [
-                jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
-              ])
-              ++ (with ms-vscode;
-              [
-                (cmake-tools.overrideAttrs { sourceRoot = "extension"; }) cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
-                test-adapter-converter
-              ])
-              ++ (with ms-vscode-remote; [ remote-ssh remote-containers remote-ssh-edit ])
+              (with github; [ copilot github-vscode-theme ])
+              ++ (with intellsmi; [ comment-translate ])
+              ++ (with ms-vscode; [ cmake-tools cpptools cpptools-extension-pack hexeditor remote-explorer ])
+              ++ (with ms-vscode-remote; [ remote-ssh ])
               ++ [
-                donjayamanne.githistory genieai.chatgpt-vscode fabiospampinato.vscode-diff cschlosser.doxdocgen
+                donjayamanne.githistory fabiospampinato.vscode-diff
                 llvm-vs-code-extensions.vscode-clangd ms-ceintl.vscode-language-pack-zh-hans
                 oderwat.indent-rainbow
                 twxs.cmake guyutongxue.cpp-reference thfriedrich.lammps leetcode.vscode-leetcode # znck.grammarly
-                james-yu.latex-workshop gimly81.matlab affenwiesel.matlab-formatter ckolkman.vscode-postgres
-                yzhang.markdown-all-in-one pkief.material-icon-theme bbenoist.nix ms-ossdata.vscode-postgresql
-                redhat.vscode-xml dotjoshjohnson.xml jnoortheen.nix-ide xdebug.php-debug
-                hbenl.vscode-test-explorer
-                jeff-hykin.better-cpp-syntax fredericbonnet.cmake-test-adapter mesonbuild.mesonbuild
-                hirse.vscode-ungit fortran-lang.linter-gfortran tboox.xmake-vscode ccls-project.ccls
-                feiskyer.chatgpt-copilot yukiuuh2936.vscode-modern-fortran-formatter wolframresearch.wolfram
-                njpipeorgan.wolfram-language-notebook brettm12345.nixfmt-vscode webfreak.debug
+                james-yu.latex-workshop bbenoist.nix jnoortheen.nix-ide ccls-project.ccls
+                brettm12345.nixfmt-vscode
                 gruntfuggly.todo-tree
                 # restrctured text
-                lextudio.restructuredtext trond-snekvik.simple-rst
+                lextudio.restructuredtext trond-snekvik.simple-rst swyddfa.esbonio chrisjsewell.myst-tml-syntax
                 # markdown
-                shd101wyy.markdown-preview-enhanced
+                yzhang.markdown-all-in-one shd101wyy.markdown-preview-enhanced
                 # vasp
                 mystery.vasp-support
                 yutengjing.open-in-external-app
-                # ChatGPT-like plugin
-                codeium.codeium
                 # git graph
                 mhutchie.git-graph
+                # python
+                ms-python.python
+                # theme
+                pkief.material-icon-theme
               ];
         }
       )];
-      _pythonPackages = [(pythonPackages: with pythonPackages;
-      [
-        # required by vscode extensions restrucuredtext
-        localPackages.esbonio
-      ])];
     };
   };
 }

modules/services/chatgpt.nix

@@ -34,15 +34,11 @@ inputs:
       '';
       secrets."chatgpt/key" = {};
     };
-    nixos =
+    nixos.services.nginx =
     {
-      services.nginx =
-      {
-        enable = true;
-        https."${chatgpt.hostname}".location."/".proxy =
-          { upstream = "http://127.0.0.1:6184"; detectAuth.users = [ "chat" ]; };
-      };
-      virtualization.docker.enable = true;
+      enable = true;
+      https."${chatgpt.hostname}".location."/".proxy =
+        { upstream = "http://127.0.0.1:6184"; detectAuth.users = [ "chat" ]; };
     };
   };
 }

modules/services/default.nix

@@ -3,7 +3,6 @@ inputs:
   imports = inputs.localLib.findModules ./.;
   options.nixos.services = let inherit (inputs.lib) mkOption types; in
   {
-    firewall.trustedInterfaces = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
     smartd.enable = mkOption { type = types.bool; default = false; };
     wallabag.enable = mkOption { type = types.bool; default = false; };
     noisetorch.enable = mkOption { type = types.bool; default = inputs.config.nixos.system.gui.preferred; };
@@ -16,7 +15,6 @@ inputs:
       inherit (builtins) map listToAttrs toString;
     in mkMerge
     [
-      { networking.firewall.trustedInterfaces = services.firewall.trustedInterfaces; }
       (mkIf services.smartd.enable { services.smartd.enable = true; })
       (
         mkIf services.wallabag.enable
@@ -61,19 +59,15 @@ inputs:
               # SYMFONY__ENV__TWOFACTOR_SENDER=bot@chn.moe
             secrets."mail/bot-encoded" = {};
           };
-          nixos =
+          nixos.services =
           {
-            services =
+            nginx =
             {
-              nginx =
-              {
-                enable = true;
-                https."wallabag.chn.moe".location."/".proxy.upstream = "http://127.0.0.1:4398";
-              };
-              postgresql.instances.wallabag = {};
-              redis.instances.wallabag = { user = "root"; port = 8790; };
+              enable = true;
+              https."wallabag.chn.moe".location."/".proxy.upstream = "http://127.0.0.1:4398";
             };
-            virtualization.docker.enable = true;
+            postgresql.instances.wallabag = {};
+            redis.instances.wallabag = { user = "root"; port = 8790; };
           };
         }
       )

modules/services/docker.nix

@@ -0,0 +1,38 @@
+inputs:
+{
+  options.nixos.services.docker = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkMerge
+  [
+    (
+      inputs.lib.mkIf (docker != null)
+      {
+        # system-wide docker is not needed
+        # virtualisation.docker.enable = true;
+        virtualisation.docker.rootless =
+        {
+          enable = true;
+          setSocketVariable = true;
+          daemon.settings =
+          {
+            features.buildkit = true;
+            # dns 127.0.0.1 make docker not work
+            dns = [ "1.1.1.1" ];
+            # prevent create btrfs subvol
+            storage-driver = "overlay2";
+          };
+        };
+      }
+    )
+    # some docker settings should be set unconditionally, as some services depend on them
+    {
+      virtualisation.docker =
+      {
+        enableNvidia = inputs.lib.mkIf inputs.config.nixos.system.nixpkgs.cuda.enable true;
+        # prevent create btrfs subvol
+        storageDriver = "overlay2";
+        daemon.settings.dns = [ "1.1.1.1" ];
+      };
+    }
+  ];
+}

modules/services/gitea.nix

@@ -43,6 +43,7 @@ inputs:
           SMTP_PORT = 465;
           USER = "bot@chn.moe";
         };
+        service.REGISTER_MANUAL_CONFIRM = true;
       };
     };
     nixos.services =

modules/services/groupshare.nix

@@ -4,7 +4,11 @@ inputs:
   {
     type = types.nullOr (types.submodule { options =
     {
-      users = mkOption { type = types.listOf types.nonEmptyStr; default = [ "chn" "gb" "xll" "yjq" "zem" ]; };
+      users = mkOption
+      {
+        type = types.listOf types.nonEmptyStr;
+        default = [ "chn" "gb" "xll" "yjq" "zem" "gb" "wp" "hjp" ];
+      };
     };});
     default = null;
   };

modules/services/huginn.nix

@@ -60,7 +60,6 @@ inputs:
           };
           mariadb.instances.huginn = {};
         };
-        virtualization.docker.enable = true;
       };
     };
 }

modules/services/ollama.nix

@@ -11,7 +11,6 @@ inputs:
         { enable = true; package = inputs.pkgs.genericPackages.open-webui; environment.WEBUI_AUTH = "False"; };
       nextjs-ollama-llm-ui.enable = true;
     };
-    # TODO: broken in python 3.12
-    # nixos.packages._packages = [ inputs.pkgs.oterm ];
+    nixos.packages.packages._packages = [ inputs.pkgs.oterm ];
   };
 }

modules/services/postgresql.nix

@@ -28,7 +28,7 @@ inputs:
         settings =
         {
           unix_socket_permissions = "0700";
-          shared_buffers = "8192MB";
+          shared_buffers = "512MB";
           work_mem = "512MB";
           autovacuum = "on";
         };

modules/services/rsshub.nix

@@ -13,22 +13,27 @@ inputs:
       inherit (builtins) map listToAttrs toString;
     in mkIf rsshub.enable
     {
-      systemd.services.rsshub =
+      systemd =
       {
-        description = "rsshub";
-        after = [ "network.target" "redis-rsshub.service" ];
-        requires = [ "redis-rsshub.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig =
+        services.rsshub =
         {
-          User = inputs.config.users.users.rsshub.name;
-          Group = inputs.config.users.users.rsshub.group;
-          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
-          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
-          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
-          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          description = "rsshub";
+          after = [ "network.target" "redis-rsshub.service" ];
+          requires = [ "redis-rsshub.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig =
+          {
+            User = inputs.config.users.users.rsshub.name;
+            Group = inputs.config.users.users.rsshub.group;
+            EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
+            WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
+            ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
+            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          };
+          restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
         };
+        tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
       };
       sops =
       {
@@ -46,11 +51,17 @@ inputs:
             YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
             YOUTUBE_CLIENT_SECRET='${placeholder."rsshub/youtube-client-secret"}'
             YOUTUBE_REFRESH_TOKEN='${placeholder."rsshub/youtube-refresh-token"}'
+            TWITTER_AUTH_TOKEN='${placeholder."rsshub/twitter-auth-token"}'
+            XDG_CONFIG_HOME='/var/cache/rsshub/chromium'
+            XDG_CACHE_HOME='/var/cache/rsshub/chromium'
+            BILIBILI_COOKIE_data0='${placeholder."rsshub/bilibili-cookie"}'
           '';
         secrets = (listToAttrs (map (secret: { name = "rsshub/${secret}"; value = {}; })
         [
           "pixiv-refreshtoken"
           "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
+          "twitter-auth-token"
+          "bilibili-cookie"
         ]));
       };
       users =

modules/services/send.nix

@@ -38,18 +38,14 @@ inputs:
           REDIS_PASSWORD=${inputs.config.sops.placeholder."redis/send"}
         '';
       };
-      nixos =
+      nixos.services =
       {
-        services =
+        nginx =
         {
-          nginx =
-          {
-            enable = true;
-            https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
-          };
-          redis.instances.send = { user = "root"; port = 9184; };
+          enable = true;
+          https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
         };
-        virtualization.docker.enable = true;
+        redis.instances.send = { user = "root"; port = 9184; };
       };
     };
 }

modules/services/slurm.nix

@@ -3,75 +3,110 @@ inputs:
   options.nixos.services.slurm = let inherit (inputs.lib) mkOption types; in
   {
     enable = mkOption { type = types.bool; default = false; };
-    cpu =
+    # 本机是否为控制节点，如果不是，填写控制节点的主机名
+    master = mkOption { type = types.nonEmptyStr; default = inputs.config.nixos.system.networking.hostname; };
+    node = mkOption { type = types.attrsOf (types.submodule (submoduleInputs: { options =
     {
-      sockets = mkOption { type = types.ints.unsigned; default = 1; };
-      cores = mkOption { type = types.ints.unsigned; };
-      threads = mkOption { type = types.ints.unsigned; default = 1; };
-      mpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
-      openmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
-    };
-    memoryMB = mkOption { type = types.ints.unsigned; };
-    gpus = mkOption { type = types.attrsOf types.ints.unsigned; };
-  };
-  config = let inherit (inputs.config.nixos.services) slurm; in inputs.lib.mkIf slurm.enable
-  {
-    services =
-    {
-      slurm =
+      # slurm 中使用的节点名称
+      name = mkOption { type = types.nonEmptyStr; };
+      address = mkOption { type = types.nonEmptyStr; };
+      cpu =
       {
-        server.enable = true;
-        package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
-          (prev: let inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev; in
-          {
-            buildInputs = prev.buildInputs ++ [ cuda_nvml_dev ];
-            LDFLAGS = [ "-L${cuda_nvml_dev}/lib/stubs" ];
-            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.wrapGAppsHook ];
-          });
-        clusterName = inputs.config.nixos.system.networking.hostname;
-        dbdserver =
+        sockets = mkOption { type = types.ints.unsigned; default = 1; };
+        cores = mkOption { type = types.ints.unsigned; default = 1; };
+        threads = mkOption { type = types.ints.unsigned; default = 1; };
+        mpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
+        openmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      };
+      memoryMB = mkOption { type = types.ints.unsigned; default = 1024; };
+      gpus = mkOption { type = types.nullOr (types.attrsOf types.ints.unsigned); default = null; };
+    };}));};
+    partitions = mkOption { type = types.attrsOf (types.listOf types.nonEmptyStr); default = {}; };
+    defaultPartition = mkOption { type = types.nonEmptyStr; default = "localhost"; };
+    tui =
+    {
+      cpuMpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      cpuOpenmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      gpus = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+    };
+    # 是否打开防火墙相应端口，对于多节点部署需要打开
+    setupFirewall = mkOption { type = types.bool; default = false; };
+  };
+  config = let inherit (inputs.config.nixos.services) slurm; in inputs.lib.mkIf slurm.enable (inputs.lib.mkMerge
+  [
+    # worker 配置
+    {
+      services =
+      {
+        slurm =
         {
-          enable = true;
-          dbdHost = "localhost";
-          storagePassFile = inputs.config.sops.secrets."slurm/db".path;
+          package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
+            (prev:
+              let
+                inherit (inputs.config.nixos.system.nixpkgs) cuda;
+                inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev;
+                additionalInputs = inputs.lib.optionals cuda.enable [ cuda_nvml_dev cuda_nvml_dev.lib ];
+                additionalFlags = inputs.lib.optional cuda.enable "-L${cuda_nvml_dev.lib}/lib/stubs";
+              in
+              {
+                buildInputs = prev.buildInputs or [] ++ additionalInputs;
+                LDFLAGS = prev.LDFLAGS or [] ++ additionalFlags;
+                nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.wrapGAppsHook ];
+                postInstall =
+                ''
+                  pushd contribs/pmi2
+                  make install
+                  popd
+                  pushd contribs/pmi
+                  make install
+                  popd
+                '' + prev.postInstall;
+              }
+            );
+          client.enable = true;
+          nodeName = builtins.map
+            (node:
+              let gpuString =
+                if node.value.gpus == null then ""
+                else "Gres=" + builtins.concatStringsSep "," (builtins.map
+                  (gpu: "gpu:${gpu.name}:${builtins.toString gpu.value}")
+                  (inputs.lib.attrsToList node.value.gpus));
+              in builtins.concatStringsSep " "
+              [
+                node.value.name
+                "NodeHostname=${node.name}"
+                "NodeAddr=${node.value.address}"
+                "RealMemory=${builtins.toString node.value.memoryMB}"
+                "Sockets=${builtins.toString node.value.cpu.sockets}"
+                "CoresPerSocket=${builtins.toString node.value.cpu.cores}"
+                "ThreadsPerCore=${builtins.toString node.value.cpu.threads}"
+                "${gpuString}"
+                "State=UNKNOWN"
+              ])
+            (inputs.localLib.attrsToList slurm.node);
+          partitionName = builtins.map
+            (partition:
+              let nodes = builtins.concatStringsSep "," partition.value;
+              in builtins.concatStringsSep " "
+              [
+                partition.name
+                "Nodes=${builtins.concatStringsSep "," (builtins.map (n: slurm.node.${n}.name) partition.value)}"
+                "Default=${if partition.name == slurm.defaultPartition then "YES" else "NO"}"
+                "MaxTime=INFINITE"
+                "State=UP"
+              ])
+            (inputs.localLib.attrsToList slurm.partitions);
+          procTrackType = "proctrack/cgroup";
+          controlMachine = slurm.master;
+          controlAddr = slurm.node.${slurm.master}.address;
           extraConfig =
-          ''
-            StorageHost=*
-            StorageLoc=slurm
-          '';
-        };
-        client.enable = true;
-        controlMachine = "localhost";
-        nodeName =
-          let gpuString = builtins.concatStringsSep "," (builtins.map
-            (gpu: "gpu:${gpu.name}:${builtins.toString gpu.value}")
-            (inputs.localLib.attrsToList slurm.gpus));
-          in inputs.lib.singleton (builtins.concatStringsSep " "
-          [
-            "localhost"
-            "RealMemory=${builtins.toString slurm.memoryMB}"
-            "Sockets=${builtins.toString slurm.cpu.sockets}"
-            "CoresPerSocket=${builtins.toString slurm.cpu.cores}"
-            "ThreadsPerCore=${builtins.toString slurm.cpu.threads}"
-            "Gres=${gpuString}"
-            "State=UNKNOWN"
-          ]);
-        partitionName = [ "localhost Nodes=localhost Default=YES MaxTime=INFINITE State=UP" ];
-        procTrackType = "proctrack/cgroup";
-        extraConfig =
-          let taskProlog =
-          ''
-            echo export CUDA_DEVICE_ORDER=PCI_BUS_ID
-            echo export SLURM_THREADS_PER_CPU=${builtins.toString slurm.cpu.threads}
-          '';
-          in
           ''
             SelectType=select/cons_tres
             SelectTypeParameters=CR_Core
             GresTypes=gpu
             DefCpuPerGPU=1
 
-            TaskProlog=${inputs.pkgs.writeShellScript "set_env" taskProlog}
+            TaskProlog=${inputs.pkgs.writeShellScript "set_env" "echo export CUDA_DEVICE_ORDER=PCI_BUS_ID"}
 
             AccountingStorageType=accounting_storage/slurmdbd
             AccountingStorageHost=localhost
@@ -83,57 +118,88 @@ inputs:
             SchedulerParameters=enable_user_top
 
             SlurmdDebug=debug2
+            DebugFlags=NO_CONF_HASH
+
+            # automatically resume node after drain
+            ReturnToService=2
           '';
-        extraConfigPaths =
-          let gpuString = builtins.concatStringsSep "\n" (builtins.map
-            (gpu: "Name=gpu Type=${gpu.name} Count=${builtins.toString gpu.value}")
-            (inputs.localLib.attrsToList slurm.gpus));
-          in [(inputs.pkgs.writeTextDir "gres.conf" "AutoDetect=nvml\n${gpuString}")];
-      };
-      munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
-    };
-    systemd =
-    {
-      services.slurmd.environment =
-      {
-        CUDA_PATH = "${inputs.pkgs.cudatoolkit}";
-        LD_LIBRARY_PATH = "${inputs.config.hardware.nvidia.package}/lib";
-      };
-      tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
-    };
-    sops =
-    {
-      secrets =
-      {
-        "munge.key" =
-        {
-          format = "binary";
-          sopsFile = "${builtins.dirOf inputs.config.sops.defaultSopsFile}/munge.key";
-          owner = inputs.config.systemd.services.munged.serviceConfig.User;
+          extraConfigPaths =
+            let gpus = slurm.node.${inputs.config.nixos.system.networking.hostname}.gpus or null;
+            in inputs.lib.mkIf (gpus != null)
+            (
+              let gpuString = builtins.concatStringsSep "\n" (builtins.map
+                (gpu: "Name=gpu Type=${gpu.name} Count=${builtins.toString gpu.value}")
+                (inputs.localLib.attrsToList gpus));
+              in [(inputs.pkgs.writeTextDir "gres.conf" "AutoDetect=nvml\n${gpuString}")]
+            );
         };
-        "slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
+        munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
       };
-    };
-    nixos =
-    {
-      packages.packages._packages = [(inputs.pkgs.localPackages.sbatch-tui.override { sbatchConfig =
+      systemd =
       {
-        cpuMpiThreads = slurm.cpu.mpiThreads;
-        cpuOpenmpThreads = slurm.cpu.openmpThreads;
-        gpuIds = builtins.concatStringsSep ", " (builtins.map (gpu: ''"${gpu}"'') (builtins.attrNames slurm.gpus));
-      };})];
-      user.sharedModules = [{ home.packages =
-      [
-        (inputs.pkgs.writeShellScriptBin "sbatch"
-        ''
-          if [ "$#" -eq 0 ]; then
-            sbatch-tui
-          else
-            /run/current-system/sw/bin/sbatch "$@"
-          fi
-        '')
-      ];}];
-      services.mariadb = { enable = true; instances.slurm = {}; };
-    };
-  };
+        services.slurmd.environment =
+          let gpus = slurm.node.${inputs.config.nixos.system.networking.hostname}.gpus or null;
+          in inputs.lib.mkIf (gpus != null)
+          {
+            CUDA_PATH = "${inputs.pkgs.cudatoolkit}";
+            LD_LIBRARY_PATH = "${inputs.config.hardware.nvidia.package}/lib";
+          };
+      };
+      sops.secrets."munge.key" =
+      {
+        format = "binary";
+        sopsFile = "${builtins.dirOf inputs.config.sops.defaultSopsFile}/munge.key";
+        owner = inputs.config.systemd.services.munged.serviceConfig.User;
+      };
+      networking.firewall =
+        let config = inputs.lib.mkIf slurm.setupFirewall [ 6818 ];
+        in { allowedTCPPorts = config; allowedUDPPorts = config; };
+    }
+    # master 配置
+    (inputs.lib.mkIf (slurm.master == inputs.config.nixos.system.networking.hostname)
+    {
+      services.slurm =
+      {
+        server.enable = true;
+        dbdserver =
+        {
+          enable = true;
+          dbdHost = "localhost";
+          storagePassFile = inputs.config.sops.secrets."slurm/db".path;
+          extraConfig =
+          ''
+            StorageHost=*
+            StorageLoc=slurm
+          '';
+        };
+      };
+      systemd.tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
+      sops.secrets."slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
+      nixos =
+      {
+        packages.packages._packages = [ inputs.pkgs.localPackages.sbatch-tui ];
+        user.sharedModules = [{ home.packages =
+        [
+          (inputs.pkgs.writeShellScriptBin "sbatch"
+          ''
+            if [ "$#" -eq 0 ]; then
+              sbatch-tui
+            else
+              /run/current-system/sw/bin/sbatch "$@"
+            fi
+          '')
+        ];}];
+        services.mariadb = { enable = true; instances.slurm = {}; };
+      };
+      environment.etc."sbatch-tui.yaml".text = builtins.toJSON
+      {
+        CpuMpiThreads = slurm.tui.cpuMpiThreads;
+        CpuOpenmpThreads = slurm.tui.cpuOpenmpThreads;
+        GpuIds = slurm.tui.gpus;
+      };
+      networking.firewall =
+        let config = inputs.lib.mkIf slurm.setupFirewall [ 6817 ];
+        in { allowedTCPPorts = config; allowedUDPPorts = config; };
+    })
+  ]);
 }

modules/services/synapse.nix

@@ -192,6 +192,7 @@ inputs:
                   admin_contact = "mailto:chn@chn.moe";
                   enable_registration = true;
                   registrations_require_3pid = [ "email" ];
+                  registration_requires_token = true;
                   turn_uris = [ "turns:coturn.chn.moe" "turn:coturn.chn.moe" ];
                   max_upload_size = "1024M";
                   web_client_location = "https://element.chn.moe/";

modules/services/waydroid.nix

@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.services.waydroid = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) waydroid; in inputs.lib.mkIf (waydroid != null)
+    { virtualisation.waydroid.enable = true; };
+}
+
+# sudo waydroid shell wm set-fix-to-user-rotation enabled
+# /var/lib/waydroid/waydroid_base.prop
+# default:
+# ro.hardware.gralloc=gbm
+# ro.hardware.egl=mesa
+# nvidia:
+# ro.hardware.gralloc=default
+# ro.hardware.egl=swiftshader

modules/services/wireguard.nix

@@ -41,7 +41,6 @@ inputs:
           firewall =
           {
             allowedUDPPorts = inputs.lib.mkIf (!wireguard.behindNat) [ wireguard.listenPort ];
-            trustedInterfaces = [ "wireguard" ];
           };
           wireguard.interfaces.wireguard =
           {

modules/services/xray/default.nix

@@ -15,7 +15,7 @@ inputs:
         extraInterfaces = mkOption
         {
           type = types.listOf types.nonEmptyStr;
-          default = inputs.lib.optional inputs.config.nixos.virtualization.docker.enable "docker0";
+          default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
         };
         hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
       };
@@ -25,6 +25,8 @@ inputs:
         noproxyTcpPorts = mkOption { type = types.listOf types.ints.unsigned; default = []; };
         noproxyUdpPorts = mkOption { type = types.listOf types.ints.unsigned; default = []; };
       };
+      # 是否允许代理来自其它机器的流量（相关端口会被放行）
+      allowForward = mkOption { type = types.bool; default = true; };
     };
     server = mkOption
     {
@@ -329,6 +331,13 @@ inputs:
           groups.v2ray.gid = inputs.config.nixos.user.gid.v2ray;
         };
         environment.etc."resolv.conf".text = "nameserver 127.0.0.1";
+        networking.firewall =
+        {
+          allowedTCPPorts = [ 53 ];
+          allowedUDPPorts = [ 53 ];
+          allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
+          allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
+        };
       }
     )
     (

modules/system/binfmt.nix

@@ -1,7 +1,7 @@
 inputs:
 {
   options.nixos.system.binfmt = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+    { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.system) binfmt; in inputs.lib.mkIf (binfmt != null)
   {
     programs.java = { enable = true; binfmt = true; };

modules/system/cluster.nix

@@ -0,0 +1,21 @@
+inputs:
+{
+  options.nixos.system.cluster = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      clusterName = mkOption { type = types.nonEmptyStr; };
+      nodeName = mkOption { type = types.nonEmptyStr; };
+      nodeType = mkOption { type = types.enum [ "master" "worker" ]; default = "worker"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.system) cluster; in inputs.lib.mkIf (cluster != null)
+  {
+    nixos.system.networking.hostname = "${cluster.clusterName}-${cluster.nodeName}";
+    # 作为从机时，home-manager 需要被禁用
+    systemd.services = inputs.lib.mkIf (cluster.nodeType == "worker") (builtins.listToAttrs (builtins.map
+      (user: { name = "home-manager-${user}"; value.enable = false; })
+      inputs.config.nixos.user.users));
+  };
+}

modules/system/default.nix

@@ -14,7 +14,7 @@ inputs:
     time.timeZone = "Asia/Shanghai";
     boot =
     {
-      supportedFilesystems = [ "ntfs" ];
+      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
       # consoleLogLevel = 7;
     };
     hardware.enableAllFirmware = true;

modules/system/envfs.nix

@@ -1,10 +1,10 @@
 inputs:
 {
   options.nixos.system.envfs = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.system) envfs; in inputs.lib.mkIf (envfs != null) (inputs.lib.mkMerge
-  [
-    (builtins.elemAt inputs.topInputs.envfs.nixosModules.envfs.imports 0 inputs)
-    { environment.variables.ENVFS_RESOLVE_ALWAYS = "1"; }
-  ]);
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.system) envfs; in inputs.lib.mkIf (envfs != null)
+  {
+    services.envfs.enable = true;
+    environment.variables.ENVFS_RESOLVE_ALWAYS = "1";
+  };
 }

modules/system/initrd.nix

@@ -34,7 +34,8 @@ inputs:
             services.resolved.enable = false;
           };
           # ip=dhcp only attain ipv4
-          kernelParams = [ "ip=on" ];
+          # ip=on will reset systemd-networkd configs
+          # kernelParams = [ "ip=on" ];
         };
       }
     )

modules/system/kernel/default.nix

@@ -31,6 +31,12 @@ inputs:
           "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
           # networking for nas
           "igb"
+          # disk for srv1
+          "megaraid_sas"
+          # disks for cluster
+          "nfs" "nfsv4"
+          # netowrk for srv1
+          "bnx2x" "tg3"
         ]
         ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ])
         # for pi3b to show message over hdmi while boot
@@ -128,11 +134,6 @@ inputs:
                   let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
                   in ./hibernate-progress-${version}.patch;
               }];
-              amdgpu =
-              [{
-                name = "amdgpu";
-                patch = ./0001-drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.patch;
-              }];
               # TODO: remove in 6.11
               btrfs =
               [{
@@ -141,6 +142,11 @@ inputs:
                   let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
                   in if version == "6.10" then ./btrfs.patch else null;
               }];
+              amdgpu =
+              [{
+                name = "amdgpu";
+                patch = ./0001-drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.patch;
+              }];
             };
           in builtins.concatLists (builtins.map (name: patches.${name}) (kernel.patches ++ [ "btrfs" ]));
       };

modules/system/networking.nix

@@ -16,8 +16,8 @@ inputs:
           {
             ip = mkOption { type = types.nonEmptyStr; };
             mask = mkOption { type = types.ints.unsigned; };
-            gateway = mkOption { type = types.nonEmptyStr; };
-            dns = mkOption { type = types.nonEmptyStr; default = null; };
+            gateway = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+            dns = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
           };});
           default = {};
         };
@@ -91,9 +91,11 @@ inputs:
               value =
               {
                 matchConfig.Name = network.name;
-                address = [ "${network.ip}/${builtins.toString network.mask}" ];
-                routes = [{ routeConfig.Gateway = network.gateway; }];
+                address = [ "${network.value.ip}/${builtins.toString network.value.mask}" ];
+                routes = inputs.lib.mkIf (network.value.gateway != null)
+                  [{ Gateway = network.value.gateway; Destination = "0.0.0.0/0"; }];
                 linkConfig.RequiredForOnline = "routable";
+                dns = inputs.lib.mkIf (network.value.dns != null) [ network.value.dns ];
               };
             })
             (inputs.localLib.attrsToList networking.networkd.static))
@@ -104,6 +106,8 @@ inputs:
         networkmanager.unmanaged = with networking.networkd; dhcp ++ (builtins.attrNames static);
         useNetworkd = true;
       };
+      # dnsable dns fallback, use provided dns servers or no dns
+      services.resolved.fallbackDns = [];
     })
     # wpa_supplicant
     (inputs.lib.mkIf (networking.wireless != [])

modules/system/nix-ld.nix

@@ -1,7 +1,7 @@
 inputs:
 {
   options.nixos.system.nix-ld = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+    { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.system) nix-ld; in inputs.lib.mkIf (nix-ld != null)
   {
     programs.nix-ld = { enable = true; libraries = [ inputs.pkgs.steam-run.fhsenv ]; };

modules/system/nix.nix

@@ -15,7 +15,7 @@ inputs:
         mandatoryFeatures = mkOption
         {
           type = types.listOf types.nonEmptyStr;
-          default = [ "gccarch-exact-${inputs.config.nixos.system.nixpkgs.march}" ];
+          default = [ "big-parallel" ];
         };
       };
       master =
@@ -88,7 +88,7 @@ inputs:
     })
     # substituters
     {
-      nix.settings.substituters = if nix.substituters == null then [ "https://cache.nixos.org/" ] else nix.substituters;
+      nix.settings.substituters = inputs.lib.mkIf (nix.substituters != null) nix.substituters;
     }
     # autoOptimiseStore
     (inputs.lib.mkIf nix.autoOptimiseStore

modules/system/nixpkgs.nix

@@ -23,7 +23,7 @@ inputs:
       nixpkgs =
         let
           permittedInsecurePackages =
-            [ "openssl_1_1" "python2" "zotero"  "electron_27" "electron_28" ];
+            [ "openssl_1_1" "python2" "zotero"  "electron_27" "electron_28" "olm" "fluffychat" ];
           hostPlatform = if nixpkgs.march != null
             then { system = "${nixpkgs.arch}-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
             else "${nixpkgs.arch}-linux";
@@ -46,7 +46,9 @@ inputs:
           }
           // (if nixpkgs.march == null then {} else
           {
-            oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "CORE-AVX512"; };
+            # TODO: change znver4 after update oneapi
+            # TODO: test znver3 do use AVX
+            oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "core-avx2"; };
               in match.${nixpkgs.march} or nixpkgs.march;
             nvhpcArch = nixpkgs.march;
             # contentAddressedByDefault = true;
@@ -115,6 +117,7 @@ inputs:
                   scalapack = prev.scalapack.overrideAttrs { doCheck = false; };
                   xdg-desktop-portal = prev.xdg-desktop-portal.overrideAttrs (prev:
                     { doCheck = false; nativeBuildInputs = prev.nativeBuildInputs ++ prev.nativeCheckInputs; });
+                  gsl = prev.gsl.overrideAttrs { doCheck = false; };
                 }
               )
               // (
@@ -133,19 +136,12 @@ inputs:
         name = "native kernel";
         patch = null;
         extraStructuredConfig =
-          let
-            kernelConfig =
-            {
-              alderlake = "MALDERLAKE";
-              sandybridge = "MSANDYBRIDGE";
-              silvermont = "MSILVERMONT";
-              broadwell = "MBROADWELL";
-              skylake = "MSKYLAKE";
-              znver2 = "MZEN2";
-              znver3 = "MZEN3";
-              znver4 = "MZEN4";
-            };
-          in { GENERIC_CPU = inputs.lib.kernel.no; ${kernelConfig.${nixpkgs.march}} = inputs.lib.kernel.yes; };
+          let kernelConfig = { znver2 = "MZEN2"; znver3 = "MZEN3"; znver4 = "MZEN4"; };
+          in
+          {
+            GENERIC_CPU = inputs.lib.kernel.no;
+            ${kernelConfig.${nixpkgs.march} or "M${inputs.lib.toUpper nixpkgs.march}"} = inputs.lib.kernel.yes;
+          };
       }];
     };
 }

modules/system/security.nix

@@ -43,5 +43,7 @@ inputs:
       sudo.extraConfig = "Defaults pwfeedback";
     };
     systemd.user.extraConfig = "DefaultLimitNOFILE=65536:524288";
+    # needed by xray tproxy if we want to forward traffic from other machine
+    networking.firewall.checkReversePath = false;
   };
 }

modules/system/sops.nix

@@ -5,28 +5,26 @@ inputs:
     enable = mkOption { type = types.bool; default = true; };
     keyPathPrefix = mkOption { type = types.str; default = "/nix/persistent"; };
   };
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (inputs.config.nixos.system) sops;
-    in mkIf sops.enable
+  config = let inherit (inputs.config.nixos.system) sops; in inputs.lib.mkIf sops.enable
+  {
+    sops =
     {
-      sops =
-      {
-        defaultSopsFile =
-          let deviceDir = "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.networking.hostname}";
-          in mkIf
-            (
-              builtins.pathExists "${deviceDir}/secrets.yaml"
-              || builtins.pathExists "${deviceDir}/secrets/default.yaml"
-            )
-            (
-              if builtins.pathExists "${deviceDir}/secrets.yaml" then "${deviceDir}/secrets.yaml"
-              else "${deviceDir}/secrets/default.yaml"
-            );
-        # sops start before impermanence, so we need to use the absolute path
-        age.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_ed25519_key" ];
-        gnupg.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_rsa_key" ];
-      };
+      defaultSopsFile =
+        let deviceDir =
+          if (inputs.config.nixos.system.cluster == null) then
+            "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.networking.hostname}"
+          else
+            "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.cluster.clusterName}"
+              + "/${inputs.config.nixos.system.cluster.nodeName}";
+        in inputs.lib.mkMerge
+        [
+          (inputs.lib.mkIf (builtins.pathExists "${deviceDir}/secrets.yaml") "${deviceDir}/secrets.yaml")
+          (inputs.lib.mkIf (builtins.pathExists "${deviceDir}/secrets/default.yaml")
+            "${deviceDir}/secrets/default.yaml")
+        ];
+      # sops start before impermanence, so we need to use the absolute path
+      age.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_ed25519_key" ];
+      gnupg.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_rsa_key" ];
     };
+  };
 }

modules/user/chn/default.nix

@@ -8,7 +8,8 @@ inputs:
       extraGroups = inputs.lib.intersectLists
         [ "adbusers" "networkmanager" "wheel" "wireshark" "libvirtd" "ipfs" ]
         (builtins.attrNames inputs.config.users.groups);
-      autoSubUidGidRange = true;
+      subUidRanges = [{ startUid = 100000; count = 65536; } ];
+      subGidRanges = [{ startGid = 100000; count = 65536; } ];
       hashedPassword = "$y$j9T$xJwVBoGENJEDSesJ0LfkU1$VEExaw7UZtFyB4VY1yirJvl7qS7oiF49KbEBrV0.hhC";
     };
     home-manager.users.chn =
@@ -85,7 +86,8 @@ inputs:
       };
     };
     environment.persistence =
-      let inherit (inputs.config.nixos.system) impermanence; in inputs.lib.mkIf impermanence.enable
+      let inherit (inputs.config.nixos.system) impermanence;
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
       {
         # TODO: make copy or soft link of files
         "${impermanence.persistence}".users.chn =

modules/user/chn/firefox.nix

@@ -1,45 +0,0 @@
-inputs:
-{
-  config = inputs.lib.mkIf (inputs.config.nixos.packages.firefox != null)
-  {
-    home-manager.users.chn.config =
-    {
-      programs.firefox =
-      {
-        enable = true;
-        nativeMessagingHosts = [ inputs.pkgs.plasma-browser-integration ];
-        # TODO: switch to chromium as default browser
-        # TODO: use fixed-version of plugins
-        policies.DefaultDownloadDirectory = "\${home}/Downloads";
-        profiles.default =
-        {
-          extensions = with inputs.pkgs.firefox-addons;
-          [
-            immersive-translate tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
-            metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
-            wappalyzer grammarly plasma-integration zotero-connector
-          ];
-          search = { default = "Google"; force = true; };
-          userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";
-          userContent = builtins.readFile "${inputs.topInputs.lepton}/userContent.css";
-          extraConfig = builtins.readFile "${inputs.topInputs.lepton}/user.js";
-          settings =
-          {
-            # general
-            "browser.search.region" = "CN";
-            "intl.locale.requested" = "zh-CN,en-US";
-            "browser.aboutConfig.showWarning" = false;
-            "browser.bookmarks.showMobileBookmarks" = true;
-            "browser.download.panel.shown" = true;
-            "browser.download.useDownloadDir" = true;
-            "browser.newtab.extensionControlled" = true;
-            "browser.toolbars.bookmarks.visibility" = "never";
-            # allow to apply userChrome.css
-            "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-          };
-        };
-      };
-      home.file.".mozilla/firefox/profiles.ini".force = true;
-    };
-  };
-}

modules/user/chn/id_ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOH3AvxMlB3omzH6SFQt0Z5+f05x9nMJpFfSLH4OIYV+ chn@pc

modules/user/chn/plasma/autostart.nix

@@ -67,7 +67,7 @@ inputs:
         (devices.${inputs.config.nixos.system.networking.hostname} or []));
     environment.persistence =
       let impermanence = inputs.config.nixos.system.impermanence;
-      in inputs.lib.mkIf impermanence.enable
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
       {
         "${impermanence.root}".users.chn.directories = [ ".config/autostart" ];
       };

modules/user/chn/plasma/konsole.nix

@@ -69,9 +69,7 @@ inputs:
     };
     environment.persistence =
       let impermanence = inputs.config.nixos.system.impermanence;
-      in inputs.lib.mkIf impermanence.enable (inputs.lib.mkMerge (builtins.map
-        (user:
-          { "${impermanence.root}".users.${user}.directories = [ ".local/share/konsole" ".local/share/yakuake" ]; })
-        inputs.config.nixos.user.users));
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
+        { "${impermanence.root}".users.chn.directories = [ ".local/share/konsole" ".local/share/yakuake" ]; };
   };
 }

modules/user/chn/plasma/theme.nix

@@ -4,29 +4,31 @@ inputs:
   {
     home-manager.users.chn.config =
     {
-      home.file.".config/Kvantum/catppuccin-latte-blue#/catppuccin-latte-blue#.kvconfig".source =
-        ./catppuccin-latte-blue.kvconfig;
       programs.plasma =
       {
         workspace =
         {
           theme = "breeze-light";
-          colorScheme = "CatppuccinLatteBlue";
+          colorScheme = "BreezeLight";
           cursor.theme = "breeze_cursors";
-          lookAndFeel = "Catppuccin-Latte-Blue";
+          lookAndFeel = "org.kde.klassylighttraditional.desktop";
           # ~/.config/kdeglobals [Icons]
-          iconTheme = "Tela-circle";
+          iconTheme = "klassy";
         };
         configFile =
         {
-          kdeglobals.KDE.widgetStyle.value = "kvantum";
-          "Kvantum/kvantum.kvconfig".General.theme.value = "catppuccin-latte-blue#";
           kwinrc =
           {
             Effect-blur.BlurStrength.value = 10;
             Effect-kwin4_effect_translucency.MoveResize.value = 75;
             Effect-wobblywindows =
-              { AdvancedMode.value = true; Drag.value = 85; Stiffness.value = 10; WobblynessLevel.value = 1; };
+            {
+              AdvancedMode.value = true;
+              Drag.value = 85;
+              Stiffness.value = 10;
+              WobblynessLevel.value = 1;
+              ResizeWobble.value = false;
+            };
             Plugins =
             {
               blurEnabled.value = true;

modules/user/chn/plasma/theme/catppuccin-latte-blue.kvconfig

@@ -1,466 +0,0 @@
-[%General]
-author=elkrien based on Arc Dark style
-comment=Catppuccin-Latte-Blue
-spread_menuitems=true
-left_tabs=true
-mirror_doc_tabs=true
-scroll_width=8
-attach_active_tab=true
-composite=true
-menu_shadow_depth=7
-tooltip_shadow_depth=0
-splitter_width=7
-check_size=16
-slider_width=4
-slider_handle_width=18
-slider_handle_length=18
-textless_progressbar=false
-menubar_mouse_tracking=true
-slim_toolbars=false
-toolbutton_style=1
-x11drag=menubar_and_primary_toolbar
-double_click=false
-translucent_windows=true
-blurring=true
-popup_blurring=true
-opaque=kaffeine,kmplayer,subtitlecomposer,kdenlive,vlc,smplayer,smplayer2,avidemux,avidemux2_qt4,avidemux3_qt4,avidemux3_qt5,kamoso,QtCreator,VirtualBox,trojita,dragon,digikam,qmplay2
-group_toolbar_buttons=false
-vertical_spin_indicators=false
-fill_rubberband=false
-spread_progressbar=true
-merge_menubar_with_toolbar=true
-small_icon_size=16
-large_icon_size=32
-button_icon_size=16
-scroll_arrows=false
-iconless_pushbutton=true
-toolbar_icon_size=16
-combo_as_lineedit=true
-button_contents_shift=false
-groupbox_top_label=true
-inline_spin_indicators=true
-joined_inactive_tabs=false
-layout_spacing=2
-submenu_overlap=0
-tooltip_delay=-1
-animate_states=false
-transient_scrollbar=true
-alt_mnemonic=true
-combo_menu=true
-layout_margin=4
-no_window_pattern=false
-respect_DE=true
-scroll_min_extent=36
-scrollable_menu=false
-scrollbar_in_view=false
-spin_button_width=16
-submenu_delay=250
-tree_branch_line=true
-progressbar_thickness=8
-click_behavior=0
-contrast=1.00
-dialog_button_layout=0
-drag_from_buttons=false
-hide_combo_checkboxes=false
-intensity=1.00
-no_inactiveness=false
-reduce_menu_opacity=20
-reduce_window_opacity=20
-saturation=1.00
-shadowless_popup=false
-transient_groove=false
-menu_blur_radius=0
-tooltip_blur_radius=0
-
-[GeneralColors]
-window.color=#EFF1F5
-base.color=#E6E9EF
-alt.base.color=#E6E9EF
-button.color=#CCD0DA
-light.color=#BCC0CC
-mid.light.color=#BCC0CC
-dark.color=#E6E9EF
-mid.color=#E6E9EF
-highlight.color=#1E66F5
-inactive.highlight.color=#1E66F5
-text.color=#4C4F69
-window.text.color=#4C4F69
-button.text.color=#4C4F69
-disabled.text.color=#ACB0BE
-tooltip.text.color=#4C4F69
-highlight.text.color=#E6E9EF
-link.color=#DC8A78
-link.visited.color=#1E66F5
-
-[ItemView]
-inherits=PanelButtonCommand
-frame.element=itemview
-interior.element=itemview
-frame=true
-interior=true
-text.iconspacing=3
-text.toggle.color=#E6E9EF
-
-[RadioButton]
-inherits=PanelButtonCommand
-frame=false
-interior.element=radio
-
-[CheckBox]
-inherits=PanelButtonCommand
-frame=false
-interior.element=checkbox
-
-[TreeExpander]
-indicator.element=tree
-indicator.size=8
-
-[ToolTip]
-frame.top=4
-frame.right=4
-frame.bottom=4
-frame.left=4
-frame=true
-
-[PanelButtonCommand]
-inherits=PanelButtonCommand
-interior.element=button
-frame.element=button
-text.normal.color=#4C4F69
-text.focus.color=#4C4F69
-text.press.color=#E6E9EF
-text.toggle.color=#E6E9EF
-
-[PanelButtonTool]
-inherits=PanelButtonCommand
-
-[DockTitle]
-inherits=PanelButtonCommand
-interior=false
-frame=false
-text.margin.top=5
-text.margin.bottom=5
-text.margin.left=5
-text.margin.right=5
-indicator.size=0
-
-[Dock]
-interior.element=toolbar
-frame.element=toolbar
-frame=true
-interior=true
-
-[GroupBox]
-inherits=PanelButtonCommand
-interior.element=tabframe
-interior=true
-frame=false
-
-[Focus]
-inherits=PanelButtonCommand
-frame=true
-frame.element=focus
-frame.top=1
-frame.bottom=1
-frame.left=1
-frame.right=1
-frame.patternsize=20
-
-[GenericFrame]
-inherits=PanelButtonCommand
-frame.element=common
-frame.top=1
-frame.bottom=1
-frame.left=1
-frame.right=1
-
-[Slider]
-inherits=PanelButtonCommand
-interior=true
-frame.element=slider
-interior.element=slider
-frame.top=3
-frame.bottom=3
-frame.left=3
-frame.right=3
-focusFrame=true
-
-[SliderCursor]
-inherits=PanelButtonCommand
-interior=true
-interior.element=slidercursor
-frame=false
-
-[LineEdit]
-inherits=PanelButtonCommand
-frame.element=lineedit
-interior.element=lineedit
-
-[IndicatorSpinBox]
-inherits=LineEdit
-frame.element=lineedit
-interior.element=lineedit
-frame.top=0
-frame.bottom=2
-frame.left=2
-frame.right=2
-indicator.size=8
-
-[DropDownButton]
-inherits=PanelButtonCommand
-frame.top=2
-frame.bottom=2
-frame.left=0
-frame.right=1
-indicator.size=8
-
-[ToolboxTab]
-inherits=PanelButtonCommand
-frame.element=tabframe
-frame.top=1
-frame.bottom=1
-frame.left=1
-frame.right=1
-
-[Tab]
-inherits=PanelButtonCommand
-interior.element=tab
-frame.element=tab
-frame.top=2
-frame.bottom=3
-frame.left=3
-frame.right=3
-indicator.size=10
-text.normal.color=#ACB0BE
-text.focus.color=#4C4F69
-text.press.color=#4C4F69
-text.toggle.color=#4C4F69
-focusFrame=true
-
-[TabBarFrame]
-inherits=GenericFrame
-frame=true
-frame.element=tabBarFrame
-interior=false
-frame.top=4
-frame.bottom=4
-frame.left=4
-frame.right=4
-
-[TabFrame]
-inherits=PanelButtonCommand
-frame.element=tabframe
-interior.element=tabframe
-
-[Dialog]
-inherits=TabBarFrame
-frame.element=tabframe
-interior=false
-frame=false
-frame.top=1
-frame.bottom=1
-frame.left=1
-frame.right=1
-
-[HeaderSection]
-inherits=PanelButtonCommand
-interior.element=header
-frame.element=header
-frame.top=0
-frame.bottom=1
-frame.left=1
-frame.right=1
-frame.expansion=0
-text.normal.color=#4C4F69
-text.focus.color=#1E66F5
-text.press.color=#4C4F69
-text.toggle.color=#4C4F69
-indicator.element=harrow
-
-[SizeGrip]
-inherits=PanelButtonCommand
-frame=false
-interior=false
-indicator.element=resize-grip
-indicator.size=0
-
-[Toolbar]
-inherits=PanelButtonCommand
-interior.element=menubar
-frame.element=menubar
-frame=true
-frame.bottom=4
-frame.left=4
-frame.right=4
-text.normal.color=#4C4F69
-text.focus.color=#4C4F69
-text.press.color=#1E66F5
-text.toggle.color=#1E66F5
-text.bold=false
-
-[MenuBar]
-inherits=PanelButtonCommand
-frame.element=menubar
-interior.element=menubar
-frame.bottom=0
-text.normal.color=#4C4F69
-frame.expansion=0
-text.bold=false
-
-[ToolbarButton]
-frame.element=tbutton
-interior.element=tbutton
-indicator.element=arrow
-text.normal.color=#4C4F69
-text.focus.color=#4C4F69
-text.press.color=#E6E9EF
-text.toggle.color=#E6E9EF
-text.bold=false
-
-[Scrollbar]
-inherits=PanelButtonCommand
-indicator.size=0
-interior=false
-frame=false
-
-[ScrollbarGroove]
-inherits=PanelButtonCommand
-interior=false
-frame=false
-
-[ScrollbarSlider]
-inherits=PanelButtonCommand
-interior=false
-frame.element=scrollbarslider
-frame.top=4
-frame.bottom=4
-frame.left=4
-frame.right=4
-
-[ProgressbarContents]
-inherits=PanelButtonCommand
-frame=true
-frame.element=progress-pattern
-interior.element=progress-pattern
-frame.top=2
-frame.bottom=2
-frame.left=2
-frame.right=2
-
-[Progressbar]
-inherits=PanelButtonCommand
-frame.element=progress
-interior.element=progress
-frame.top=2
-frame.bottom=2
-frame.left=2
-frame.right=2
-text.margin=0
-text.normal.color=#4C4F69
-text.focus.color=#4C4F69
-text.press.color=#E6E9EF
-text.toggle.color=#E6E9EF
-text.bold=false
-frame.expansion=18
-
-[RadioButton]
-inherits=PanelButtonCommand
-
-[Menu]
-frame.element=menu
-interior.element=menu
-inherits=PanelButtonCommand
-text.press.color=#E6E9EF
-text.toggle.color=#E6E9EF
-text.bold=false
-frame.top=3
-frame.bottom=3
-frame.left=3
-frame.right=3
-
-[MenuItem]
-inherits=PanelButtonCommand
-interior.element=menuitem
-indicator.size=8
-text.focus.color=#4C4F69
-text.press.color=#4C4F69
-
-[MenuBarItem]
-inherits=PanelButtonCommand
-interior.element=menubaritem
-frame=false
-text.margin.top=3
-text.margin.bottom=3
-text.margin.left=5
-text.margin.right=5
-
-[StatusBar]
-inherits=Toolbar
-frame.element=toolbar
-font.bold=true
-text.normal.color=#4C4F69
-frame=true
-frame.top=0
-frame.bottom=0
-
-[TitleBar]
-inherits=PanelButtonCommand
-frame=false
-interior=false
-text.margin.top=2
-text.margin.bottom=2
-text.margin.left=3
-text.margin.right=3
-
-[ComboBox]
-inherits=PanelButtonCommand
-indicator.size=8
-frame.top=3
-frame.bottom=3
-frame.left=3
-frame.right=3
-text.margin.top=1
-text.margin.bottom=1
-text.margin.left=3
-text.margin.right=3
-text.toggle.color=#4C4F69
-
-[ToolboxTab]
-inherits=PanelButtonCommand
-text.normal.color=#4C4F69
-text.press.color=#4C4F69
-text.focus.color=#4C4F69
-
-[Hacks]
-transparent_dolphin_view=true
-blur_konsole=true
-transparent_ktitle_label=true
-transparent_menutitle=true
-respect_darkness=true
-kcapacitybar_as_progressbar=true
-force_size_grip=false
-iconless_pushbutton=true
-iconless_menu=false
-disabled_icon_opacity=100
-lxqtmainmenu_iconsize=0
-normal_default_pushbutton=true
-single_top_toolbar=false
-tint_on_mouseover=0
-transparent_pcmanfm_sidepane=true
-transparent_pcmanfm_view=true
-blur_translucent=true
-centered_forms=false
-kinetic_scrolling=false
-middle_click_scroll=false
-no_selection_tint=false
-noninteger_translucency=false
-style_vertical_toolbars=false
-blur_only_active_window=false
-
-[Window]
-interior=true
-interior.element=window
-frame.top=0
-frame.bottom=0
-frame.left=0
-frame.right=0

modules/user/chn/plasma/wallpaper.nix

@@ -2,13 +2,7 @@ inputs:
 {
   config.home-manager.users.chn.config.programs.plasma.configFile =
     let
-      nixos-wallpaper = inputs.pkgs.fetchgit
-      {
-        url = "https://git.chn.moe/chn/nixos-wallpaper.git";
-        rev = "1ad78b20b21c9f4f7ba5f4c897f74276763317eb";
-        sha256 = "0faahbzsr44bjmwr6508wi5hg59dfb57fzh5x6jh7zwmv4pzhqlb";
-        fetchLFS = true;
-      };
+      inherit (inputs.topInputs.self.src) nixos-wallpaper;
       wallpaper =
       {
         pc = "${nixos-wallpaper}/pixiv-117612023.png";

modules/user/chn/sops.nix

@@ -0,0 +1,16 @@
+inputs:
+{
+  config = inputs.lib.mkIf
+  (
+    (builtins.elem "chn" inputs.config.nixos.user.users)
+      && (builtins.elem inputs.config.nixos.system.networking.hostname [ "pc" "surface" ])
+  )
+  {
+    home-manager.users.chn = homeInputs:
+    {
+      config.xdg.configFile."sops/age/keys.txt".source =
+        homeInputs.config.lib.file.mkOutOfStoreSymlink inputs.config.sops.secrets.age.path;
+    };
+    sops.secrets.age.owner = "chn";
+  };
+}

modules/user/default.nix

@@ -18,7 +18,10 @@ inputs:
         zem = 1004;
         gb = 1005;
         test = 1006;
-        zqq = 1007;
+        wp = 1007;
+        hjp = 1008;
+        zzn = 1009;
+        wm = 1010;
         misskey-misskey = 2000;
         misskey-misskey-old = 2001;
         frp = 2002;
@@ -81,9 +84,10 @@ inputs:
       home-manager.users = builtins.listToAttrs (builtins.map
         (name: { inherit name; value.imports = user.sharedModules; })
         user.users);
-      environment.persistence."${inputs.config.nixos.system.impermanence.persistence}".directories = builtins.map
-        (user: { directory = "/home/${user}"; inherit user; group = user; mode = "0700"; })
-        (builtins.filter (user: user != "chn") user.users);
+      environment.persistence."${inputs.config.nixos.system.impermanence.persistence}".directories =
+        inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker") (builtins.map
+          (user: { directory = "/home/${user}"; inherit user; group = user; mode = "0700"; })
+          (builtins.filter (user: user != "chn") user.users));
     }
     # set hashedPassword if it exist in secrets
     (
@@ -107,8 +111,7 @@ inputs:
       users.users.root =
       {
         shell = inputs.pkgs.zsh;
-        openssh.authorizedKeys.keys =
-          [ (builtins.readFile ./chn/id_ed25519_sk.pub) (builtins.readFile ./chn/id_ed25519.pub) ];
+        openssh.authorizedKeys.keys = [(builtins.readFile ./chn/id_ed25519_sk.pub)];
         hashedPassword = "$y$j9T$.UyKKvDnmlJaYZAh6./rf/$65dRqishAiqxCE6LEMjqruwJPZte7uiyYLVKpzdZNH5";
       };
       home-manager.users.root =

modules/user/hjp/id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGRZp8xp9hVO7e/6eflQsnFZj853IRVywc97cTevnWbg hjp@xmupc1

modules/user/wm/id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwUhEAFHjkbUfOf0ng8I80YbKisbSeY4lq/byinV7lh wm