test

update nvidia
update blog
2026-01-12 14:59:24 +08:00 · 2025-02-26 11:46:14 +08:00 · 2025-02-26 10:10:03 +08:00 · 2025-02-25 20:46:08 +08:00 · 2025-02-25 20:44:28 +08:00 · 2025-02-25 19:46:51 +08:00
122 changed files with 2021 additions and 1065 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,7 +4,6 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
-  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
  - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
@@ -33,11 +32,6 @@ creation_rules:
    - age:
      - *chn
      - *nas
-  - path_regex: devices/pi3b/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *pi3b
  - path_regex: devices/one/.*$
    key_groups:
    - age:
--- a/README.md
+++ b/README.md
@@ -0,0 +1,26 @@
+This is my NixOS configuration. I use it to manage:
+* some vps serving some websites and services (misskey, synapse), etc.
+* my laptop (Lenovo R9000P 2023), and my tablet (One Netbook One Mix 4).
+* some cluster for scientific computing (vasp, lammps, etc).
+With the following highlights:
+* All binary is compiled for specific CPU (`-march=xxx`, like that on Gentoo). 
+* All packages and configurations are managed by Nix, as much reproducible as possible.
+
+## Using overlay
+
+An overlay is provided through `outputs.overlays.default`, you could use it in your `configuration.nix` like this:
+
+```nix
+{
+  inputs.chn-nixos.url = "github:CHN-beta/nixos";
+  outputs.nixosConfigurations.my-host = inputs.nixpkgs.lib.nixosSystem
+  {
+    modules = [({pkgs, ...}: { config =
+    {
+      nixpkgs.overlays = [ inputs.chn-nixos.overlays.default ];
+      environment.systemPackages = [ pkgs.localPackages.vasp.intel ];
+    };})];
+  };
+}
+```
+
--- a/1
+++ b/1
@@ -1 +0,0 @@
-aaa
--- a/devices/cross/default.nix
+++ b/devices/cross/default.nix
@@ -0,0 +1 @@
+inputs: { imports = inputs.localLib.findModules ./.; }
--- a/devices/cross/luks-manual/default.nix
+++ b/devices/cross/luks-manual/default.nix
@@ -0,0 +1,22 @@
+inputs:
+let devices =
+{
+  nas =
+  {
+    "/dev/disk/by-uuid/a47f06e1-dc90-40a4-89ea-7c74226a5449".mapper = "root3";
+    "/dev/disk/by-uuid/b3408fb5-68de-405b-9587-5e6fbd459ea2".mapper = "root4";
+    "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
+  };
+  vps6."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
+  vps7."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
+};
+in
+{
+  config =
+  {
+    nixos.system.fileSystems.luks.manual =
+      let inherit (inputs.config.nixos.model) hostname;
+      in if devices ? ${hostname} then devices.${hostname} else inputs.lib.mkOptionDefault null;
+    home-manager.users.chn.config.nixos.decrypt = devices;
+  };
+}
--- a/modules/system/fileSystems/luks/nas.key
+++ b/modules/system/fileSystems/luks/nas.key
--- a/modules/system/fileSystems/luks/vps6.key
+++ b/modules/system/fileSystems/luks/vps6.key
--- a/modules/system/fileSystems/luks/vps7.key
+++ b/modules/system/fileSystems/luks/vps7.key
--- a/devices/cross/wireguard.nix
+++ b/devices/cross/wireguard.nix
@@ -0,0 +1,70 @@
+inputs:
+let devices =
+{
+  vps6 =
+  {
+    peers = [ "pc" "nas" "one" "vps7" "srv2-node0" "srv1-node0" ];
+    publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+    wireguardIp = "192.168.83.1";
+    listenIp = "74.211.99.69";
+    lighthouse = true;
+  };
+  vps7 =
+  {
+    peers = [ "vps6" ];
+    publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
+    wireguardIp = "192.168.83.2";
+    listenIp = "144.126.144.62";
+  };
+  pc =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
+    wireguardIp = "192.168.83.3";
+  };
+  nas =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+    wireguardIp = "192.168.83.4";
+  };
+  one =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
+    wireguardIp = "192.168.83.5";
+  };
+  srv2-node0 =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
+    wireguardIp = "192.168.83.7";
+  };
+  srv1-node0 =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
+    wireguardIp = "192.168.83.9";
+  };
+};
+in
+{
+  config.nixos.services.wireguard = inputs.lib.mkIf (devices ? ${inputs.config.nixos.model.hostname})
+  (
+    let
+      buildConfig = cfg:
+      {
+        inherit (cfg) publicKey wireguardIp;
+        lighthouse = inputs.lib.mkIf (cfg ? lighthouse) cfg.lighthouse;
+        behindNat = inputs.lib.mkIf (cfg ? behindNat) cfg.behindNat;
+        listenIp = inputs.lib.mkIf (cfg ? listenIp) cfg.listenIp;
+      };
+      this = devices.${inputs.config.nixos.model.hostname};
+    in (buildConfig this) // { peers = builtins.map (peer: buildConfig (devices.${peer})) this.peers; }
+  );
+}
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -24,17 +24,6 @@ inputs:
              };
            };
          };
-          luks.manual =
-          {
-            enable = true;
-            devices =
-            {
-              "/dev/disk/by-uuid/a47f06e1-dc90-40a4-89ea-7c74226a5449".mapper = "root3";
-              "/dev/disk/by-uuid/b3408fb5-68de-405b-9587-5e6fbd459ea2".mapper = "root4";
-              "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
-            };
-            delayedMount = [ "/" "/nix" ];
-          };
          swap = [ "/nix/swap/swap" ];
          rollingRootfs.waitDevices = [ "/dev/mapper/root4" ];
        };
@@ -48,20 +37,12 @@ inputs:
      {
        sshd = {};
        xray.client = { enable = true; dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1"; };
-        smartd.enable = true;
        beesd.instances =
        {
          root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
          nix = { device = "/nix"; hashTableSizeMB = 128; };
        };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
-          wireguardIp = "192.168.83.4";
-        };
-        misskey.instances.misskey = {};
+        smartd = {};
      };
    };
  };
--- a/devices/nas/secrets.yaml
+++ b/devices/nas/secrets.yaml
@@ -3,13 +3,7 @@ xray-client:
 acme:
    token: ENC[AES256_GCM,data:OrYgBRU1VPpkpDzYMFHINfPSHsXEKABdZOcgiAiBJKcreBoaSVHUvg==,iv:XIeZPJhzmUi5ZHKBCYN5UA9HWH1K+26SvcIWVrHAYDA=,tag:3F93syLBZjcHwnRRkUEjlw==,type:str]
 wireguard:
-    privateKey: ENC[AES256_GCM,data:VPlB4wSbWqSYw3rYRwfAMa39xrPcPZfz7sV2Cq3rmOhifnUPwggxnA+51do=,iv:utnyrB6Yfe5O94Oq4HDVFm/lQ9ZBoyvUT68r2G2PdwA=,tag:snm01vA+z2yKK8d2i5i2ig==,type:str]
-nginx:
-    maxmind-license: ENC[AES256_GCM,data:ezBawTyn+oPKKy6sQuj2BQXhnO4PTbxYWRpQR9URCxqD7bFlnmWU1Q==,iv:eD4yLDA209x6HFtDaqyj8kRxTImdyZCgOminHWb9vt4=,tag:mx+qPp4L9jHRvL90XH1RwA==,type:str]
-redis:
-    misskey-misskey: ENC[AES256_GCM,data:daHnurnqW0MI2uHd3gNT+ZczmytRdwBSsHGkCwNH9hJFMJW/U56HtjG5ivOQzYprWJ5uzgN98ivocbwzJEAGfg==,iv:aE9kvEErN06FNPPFQNchbmg/+SJCKT3QzCN/JTlZovk=,tag:iMo3MTssxKKT02zi8gCZPA==,type:str]
-postgresql:
-    misskey_misskey: ENC[AES256_GCM,data:QhsmKzYmAV0kGPhtRjTK7npt/Nop5JM9EFPpD8K6KfUJ48w+r+4vTORmERu7D2+fE3XDXxNZeSJg//bGxMmhfg==,iv:qkjkrqepjQ4kbwoaceQSzEP5TjLsiY7ih/ESj5RFpHw=,tag:UtZVW30xcsbGUjU2HjoUvw==,type:str]
+    privateKey: ENC[AES256_GCM,data:H+CDLqfMV5Kcd42LbrU1GpnyJYB1y0bSRBaRR9jNctmlReADRVuvA1y1zLM=,iv:SztfuX+Tm3bO82VfDOjjP2Bmv7IComa1poZfQ48YXVs=,tag:aA35tsgvZQDexSDgD4RjlQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -34,8 +28,8 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-05T02:43:05Z"
-    mac: ENC[AES256_GCM,data:NyXFwcVCCRfU+QSJVwov38SzRag1vhgfyQ0xtOheKtK/UaA+2Vqiqatp/lKWeri9ltpw5xWBYQnmE6aBHEkrj5RvoXeho3CUWiSqsB/3COn3FSfXGGJ2M642dnCtWqHfTrGNW7bhq/lBisODvtv+SAs108R5yYXhXWotUs/p+W0=,iv:Wsel2unj5X/dBCwt5sLzHmUIqm9c0uqzzpfnUkxq5cc=,tag:a5/I8GWuUOy4F4lOx9TH+w==,type:str]
+    lastmodified: "2025-01-19T03:04:43Z"
+    mac: ENC[AES256_GCM,data:ns1NlfKruRwlUv4u4J5i/lQmaEo0HVxEWZlauWBFO0AqXxdU9+X+MbufxkqqjbfSryJ3bqBSMdsVUNX87rZGoESWoLLiwLIRuRJTx7jtGppNiHN4LaP95TqliATWZAGZr/xUe2xNUrvgRqSgToT8ah6IxyZblTr1brnUMRTI+Gc=,iv:KbkkbkeJUrgNUmFbqCI2ifk0UDUfPJ80LTRTzaFRA9s=,tag:uKzMN2zURmBzWY4XUnOACg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.2
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -20,23 +20,17 @@ inputs:
          rollingRootfs = {};
        };
        nixpkgs.march = "tigerlake";
-        kernel.variant = "cachyos";
+        # recent kernel make touchscreen not work
+        kernel.variant = "xanmod-lts";
      };
      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
      {
        xray.client.enable = true;
-        smartd.enable = true;
        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
-          wireguardIp = "192.168.83.5";
-        };
        sshd = {};
      };
+      virtualization.kvmHost = { enable = true; gui = true; };
      bugs = [ "xmunet" ];
    };
  };
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -25,35 +25,29 @@ inputs:
          rollingRootfs = {};
        };
        grub.windowsEntries."08D3-10DE" = "Windows";
-        nix =
-        {
-          marches =
-          [
-            "znver2" "znver3" "znver4"
-            # FXSR SAHF XSAVE
-            "sandybridge"
-            # FXSR PREFETCHW RDRND SAHF
-            "silvermont"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
-            "broadwell"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-            "skylake" "cascadelake"
-            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
-            "tigerlake"
-            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
-            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
-            "alderlake"
-          ];
-        };
-        nixpkgs =
-          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
+        nix.marches =
+        [
+          "znver2" "znver3" "znver4"
+          # FXSR SAHF XSAVE
+          "sandybridge"
+          # FXSR PREFETCHW RDRND SAHF
+          "silvermont"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+          "broadwell"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+          "skylake" "cascadelake"
+          # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
+          "tigerlake"
+          # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+          # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+          "alderlake"
+        ];
+        nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
        kernel =
        {
          # TODO: switch to cachyos-lts
          variant = "xanmod-latest";
          patches = [ "hibernate-progress" ];
-          modules.modprobeConfig =
-            [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
        };
        sysctl.laptop-mode = 5;
      };
@@ -110,16 +104,8 @@ inputs:
          };
        };
        nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
-        smartd.enable = true;
        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
        beesd.instances.root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
-          wireguardIp = "192.168.83.3";
-        };
        gamemode = { enable = true; drmDevice = 0; };
        slurm =
        {
@@ -140,7 +126,7 @@ inputs:
        ananicy = {};
        keyd = {};
      };
-      bugs = [ "xmunet" "backlight" "amdpstate" ];
+      bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
      packages = { android-studio = {}; mathematica = {}; };
    };
    boot.loader.grub =
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -35,6 +35,11 @@ user:
    zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
 wechat2tg:
    token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:fqOn2FiLDWZeTUV3hrLIclHTVE0LBDKUW7BK1bRCe0ni5D+hsbM2NdUPWaT4dQ==,iv:j7zQdnz7x7xqVAA882gyCQdjukOLOEvpJ+h5QdS6IP0=,tag:ypeg5xmiqtQ3n+WoF1mNqQ==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:mmofAUxaBCFW,iv:/+bGUlHeNT5WgTtkzxoTFNCE5G+JJcJa6i9Ccbbrf0E=,tag:ax4wPxgSbh+yWd7Gpkapaw==,type:str]
+        hjp: ENC[AES256_GCM,data:T/M4wXMHa8Ko4g==,iv:eGzdteZgYRmIQp3qD79+Mhsvo5e9DL1ezkypnnofL6o=,tag:WjTPnEvU4H4tZG3GccpZrw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -59,8 +64,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-14T01:12:53Z"
-    mac: ENC[AES256_GCM,data:Ak+LR+PkQG1g9wwlfLtDN2Dm8GdGfbb0qA9Spb3X0LkdCSFLBWqW0Jf88gHB0j/4HszYVaCAUFs+OlTvTjOtboOCTM7tH6z3dd0sU+EMHeK9cPz9kmDlF1LFFhD8dyqytEwq8/xN2MlTmbVoYQvVoGsrD8tP0B9NBPaQiLMPcrQ=,iv:9DthG+HGB3lCxb85YpfitNw2PWYwpdqWTo660gTOUew=,tag:yAH6o3LkGfvKF1UOdgWyyQ==,type:str]
+    lastmodified: "2025-02-25T02:37:11Z"
+    mac: ENC[AES256_GCM,data:JjbAGoJowO96UKmgrEbnovS5T0jko5kqP4jRvG7NwBbxC2l8HETRI6lFgLep9AJYCWj8BK1kPM2FA53RqrACALMl22hjQcQZLnKCI1fHzv8xg112Sw0aP2rT1AouEbVOVqFSsF+Qa6wxVzfoijoqgxnjkBF3c4Dryget2yXEIfY=,iv:R+C1fRI6Wv+w47wZ7Yp03OYX3UQD1eV7wkL9flsZ5eQ=,tag:JnBaUvqbwfBe9Ygl8FkLdQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2
--- a/devices/pi3b/default.nix
+++ b/devices/pi3b/default.nix
@@ -1,42 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/ABC6-6B3E" = "/boot";
-            btrfs."/dev/disk/by-uuid/c459c6c0-23a6-4ef2-945a-0bfafa9a45b6" =
-              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
-          };
-          swap = [ "/nix/swap/swap" ];
-          rollingRootfs = {};
-        };
-        networking = {};
-        nixpkgs.arch = "aarch64";
-        kernel.variant = "nixos";
-      };
-      services =
-      {
-        snapper = null;
-        sshd = {};
-        xray.client.enable = true;
-        fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "X5SwWQk3JDT8BDxd04PYXTJi5E20mZKP6PplQ+GDnhI=";
-          wireguardIp = "192.168.83.8";
-        };
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 32; };
-      };
-    };
-  };
-}
--- a/devices/pi3b/secrets.yaml
+++ b/devices/pi3b/secrets.yaml
@@ -1,33 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:82Xg9VkmkLrKKcZfojA7dHqqMZh45n+eL4T5qZ1z/xy9k0q5,iv:/2j9flBDwjY6JW2mHYo1S2VE+ruu6gxrw8BzSyoiPcc=,tag:iq8wzfIRyq1T18k3vStVGw==,type:str]
-wireguard:
-    privateKey: ENC[AES256_GCM,data:8whySpY/4WPWx2+t7IOgn+qjKCsv+BgRtaAFLrP8L0fV3TJdLob5vwDplHk=,iv:kXTDwOyJNzbjPtlzQqNsXtuk3EXFdF9CAsYkvImbyDE=,tag:tsK9nCMmwEb0c08rJ3Iwyg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TzU0U2Facm5yWkYrREgw
-            a1Fxc1MxaHYwRWUzUHpsbDBHYVoxb1NKVDAwCjNuUFlabzJ0aWtGMFBQb05nSlRP
-            akwrWDI0QnZBYkFmSUpWZFFnYmQ2aDQKLS0tIGlIQ3lTREN4WXgxV3pNdjdaakF6
-            ZnppV1ZRZzZ5Smt2NGsyRndjTFdnV00KaWVPGLWPnqINH6AHKS/84kuYy/v1v4Tb
-            QdehcMiq5ZF5XLqOX5sMDLu8h96FIklqOSTZNFkzr+s9VYv/UO58rg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTEZERkRSZUdSN2dySnlI
-            aDFjdXFCWnlJZlpYQmR1WEE2RzdCaVp1WFEwCjd1N1ZpMUExZ0ZBWmFwSHg3RUs4
-            RkRYTjRMWmE5cTA4Z2JJUGgyN05HSmMKLS0tIFpKZmd2Q2k2bnNYK1V2ZnNQNUxH
-            aDU3Vm95ZkpvSTJDMjJEOFY1ZjhrQlUKLdMYiOj6tlzwLpwZsTQVSQ8hHart0ba3
-            NS7+SprzJRb0hQXrvyU6s9zho8dPOw8wiGbscmMXSVS/Kar3eQigmg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-03-28T13:31:33Z"
-    mac: ENC[AES256_GCM,data:fuppF9gFh3O6ZqJRTcVxNqVlz2y5f4xR39JIeInKblh4hNhrdnQg7oh8repoZeXHVRewGeGyxSqzUg+Twy8J+q+d6TSmiDVViD/SHse5rPns2Egt671geF7JmGEB/yKSCbECjGCp0QFgYYEg/vUOaV3v1a0s7LLTE/t2haPIaYc=,iv:f4T7JGxKB3WmEtETuSH7ApKRJ8ptPwZPfspyqc8+vmM=,tag:GF5br+e/p6qHsNCTjfIBCA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/devices/srv1/default.nix
+++ b/devices/srv1/default.nix
@@ -23,7 +23,6 @@ inputs:
      services =
      {
        sshd.passwordAuthentication = true;
-        smartd.enable = true;
        slurm =
        {
          enable = true;
@@ -34,25 +33,25 @@ inputs:
            {
              name = "n0"; address = "192.168.178.1";
              cpu = { sockets = 4; cores = 20; threads = 2; };
-              memoryMB = 122880;
+              memoryMB = 112 * 1024;
            };
            srv1-node1 =
            {
              name = "n1"; address = "192.168.178.2";
              cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 30720;
+              memoryMB = 56 * 1024;
            };
            srv1-node2 =
            {
              name = "n2"; address = "192.168.178.3";
              cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 61440;
+              memoryMB = 56 * 1024;
            };
            srv1-node3 =
            {
              name = "n3"; address = "192.168.178.4";
              cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 38912;
+              memoryMB = 32 * 1024;
            };
          };
          partitions =
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -18,13 +18,6 @@ inputs:
      {
        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; threads = 4; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
-          wireguardIp = "192.168.83.9";
-        };
        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
        samba =
        {
--- a/devices/srv1/node0/secrets/default.yaml
+++ b/devices/srv1/node0/secrets/default.yaml
@@ -25,6 +25,11 @@ users:
    GROUPIII-2: ENC[AES256_GCM,data:ifWnLx1YEewdviqHK8fdesM3c1m1T4g6twnz1cGv1yc4jit68pQWLrRMivdsM4tUcyU9GKwCaElVlvh+dgyy8EZQPKCbvJX6GA==,iv:T5FWReeZ0QOkGJiNfrVrUBhAhbXxlFQJKqQV2tzw9AQ=,tag:XClXGZDWGuoGxzPW7ne2Pg==,type:str]
    #ENC[AES256_GCM,data:t8QUVYG4v7fE,iv:N8hDAV7wulPHcfnYTXuZRhb9dQPZqKpfMKK1+ITaZTA=,tag:eKMJDOmqoWWQbv/mm3LaAw==,type:comment]
    GROUPIII-3: ENC[AES256_GCM,data:VlAA+g7SRZyhPSl0Gd1KS7dCwNgRA/o+d8anN88A7E8bSE1ckeTSp+J4YrbbUlLasLhliOZ/nDC0rti+hckGCrjMwweMorSIWg==,iv:7u1yNrN7uxHCF1MsJ2qt1jyQ0ZYYCYKUHwRff50P9oI=,tag:3raCWjdButfmcdy8mH25Jw==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:OVbdcyczH4O7TUsTL0fX3fhx9mL+8QQF3b9SIShmH/gwcJ1jy9WtWtx9wHRvFA==,iv:SX/fLPMkqmslHcRlqQQhqwodC0FHhWrpp6GR2eSF/vQ=,tag:0odoc4CpoI6yA08OWxmYRw==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:3XT6iMfK3+Oi,iv:eqDWPQ0uOj/htImZmLyeYgcjLH4/8E5Yx46XJFp4KUc=,tag:7nVlWPnoLRAH0JrNJ2MGFA==,type:str]
+        hjp: ENC[AES256_GCM,data:JWw/yuOu4flIEg==,iv:i5xr1j9XHjY2UNoBMrpH7YiNb6Oeea7yJAZp+LIYQjQ=,tag:r5Jj2kRPZYpX21xpsVyClg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -49,8 +54,8 @@ sops:
            OThDMWRsWnVTbzRGTTZqSDBkNWZJMlEKdQ/ipO7O5OvaGa81c2P7fi1ncufueSzX
            2njlHHz1gJCtjpktYaVvS6KSYtJoI9oNrF0YN5D/3kKW8TicsSGKaA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-29T06:38:23Z"
-    mac: ENC[AES256_GCM,data:n7MVBKCUW4xpIiVO4ysBqlG89LjzpDBx9GJWQTrSenLWV/YrIGUxA6QDlRg7yhqV9ldF9Q7hDve1KHw7OxKRx5ot5OZiD3Bq3TwJfS2DarJ2vi9oc1J+CXXach8gp3m4C4RkPJ/y1i3jB2nRfSw5Z/TtdPMbvGXlHh+hhriAqxM=,iv:tyBcXMZzgeUOgYJtU1XkptPOlNoFwH+4z6xTD89aKOw=,tag:apXU989ZL+D8WhWKFTdXTg==,type:str]
+    lastmodified: "2025-02-25T02:37:29Z"
+    mac: ENC[AES256_GCM,data:TAfa+s7zakHPggKZmnk6/WdffNi/uS872bv6rO9G+oMh6RsTW0YnqtgswjBsqaZkimYJyYaFmf0UfiuMbCXEmPMjRTBagYJ8i3yG4cmPpskZYtDQj/Xh/XkVulb/2v9WTG8IQ8g1FMrH1J6PkK2meqEG11h+3dI66FtmUD47beY=,iv:bfSElvPF53iotTZaQVflArNJ2FMV8ogySyQtr0Yy0FA=,tag:adL3coofeQGlIY+BUpxtMg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.2
--- a/devices/srv1/node1/default.nix
+++ b/devices/srv1/node1/default.nix
@@ -11,8 +11,6 @@ inputs:
          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
    };
    specialisation.no-share-home.configuration =
    {
--- a/devices/srv1/node2/default.nix
+++ b/devices/srv1/node2/default.nix
@@ -20,8 +20,6 @@ inputs:
        xray.client.enable = true;
        beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
      };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
      virtualization.kvmHost = { enable = true; gui = true; };
    };
    specialisation.no-share-home.configuration =
--- a/devices/srv1/node2/secrets/default.yaml
+++ b/devices/srv1/node2/secrets/default.yaml
@@ -0,0 +1,52 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:U+unsiKt9vNo/EXEpLHR0Ny3DxQEwx7a40KmwZDZki7RQEuM,iv:7w90HNM5lfh2VY20AcUEVdu5X2uxqXxR0hARncmMR60=,tag:xIbKc+9SF5LP/tY/XoGYxA==,type:str]
+users:
+    #ENC[AES256_GCM,data:bAA1+Mx9xsFr,iv:5GWh+DyuRydCKm8K1kaiTJIt4ReEugHFnKYfan6RAE4=,tag:VqcWjIMIYhkSj6f/ZclTVw==,type:comment]
+    xll: ENC[AES256_GCM,data:lqzwlETuKuKa2wh+ickMFiWyprcnIBfRBjri+NWoltxib/LWzEEbyetRc4AKyVaBiDhsOTw6MazPNy2mhcAFwb6pM+QKce5ntA==,iv:VaGQux8MJNPZeHwDpM+yJ47XvOul0qRE8xVdSWjYRhY=,tag:rBWdTPmJX9YsP0l1FtVbJw==,type:str]
+    #ENC[AES256_GCM,data:AgppEXaJcXhQ,iv:gI4nUzfy7w9yqaWlT1NYk1cHdErCJsrlilwYSGxxCdw=,tag:/A6zwbvQdhX9MLfAdXIVqw==,type:comment]
+    zem: ENC[AES256_GCM,data:t0rCwed8EzXbEuwTabzSLUd/Gln3YD9IT56JNVHwlodAvFYwtTDJe3cy7K17TmIkL1Nk/hAGzQ2BIZJxaKq7A5pSNIUO1zqMUQ==,iv:jSKCoNKQ5a91kK19w5mE0lJ9lh391ACq64UtLvJ4kLI=,tag:d6+IrgLyCw05vvLcCF5+yQ==,type:str]
+    #ENC[AES256_GCM,data:s39KO3hHcrOK,iv:ICtP2r9JMjcieHZdyHpj5Z1DympJUcHq2jPpjUwSOzM=,tag:Es3YS+mEg5I3SIujfs50jQ==,type:comment]
+    yjq: ENC[AES256_GCM,data:gOc59J2eiND+qJJRwLYvTymfrjWNRWw8IwLxDdS2cSu0yTN5SWF1eEg+tYmDqqhPmXkIlenL8VyIZD2P+Qi+Vi7l1pZMnneRCw==,iv:TsWOmHlClMgpXbNsCyvs+wkTvvKViAooA36+O4eQesk=,tag:jp5ZO9tlCPNTNZXWXCUEeg==,type:str]
+    #ENC[AES256_GCM,data:JmmZl+8nta5Q,iv:qWGS5i+ntmJ9x3HFClVdfypQKqSTUx827OFu/wxx3HQ=,tag:SzvgJtIQb1Z02GDwkAhveQ==,type:comment]
+    gb: ENC[AES256_GCM,data:pgwGyp/QC+h05grD345pJrJefm4NWd0e6mQEzrsqCbjMi9Ak2nUD+K09mIKQJ39NttC+NQZezRmKUJjDBH50s0O69nBlPOJtgA==,iv:ZLm6KUzD8fTq4YpxhdYjtp7bbDjP7Sy+0fnDO0W5GY0=,tag:H2mNHIQvHe+3YzZ9ITVdOg==,type:str]
+    #ENC[AES256_GCM,data:94hwxSaMkbIB,iv:4Xjukoo7rxeu4SWjwFeLo5fwSX6a8mpkTOIpnOnR/Io=,tag:XOjY6ziyDdMNo53NFSjcJQ==,type:comment]
+    wp: ENC[AES256_GCM,data:9/aVAQskZyQrfhVFVHfpdTWDLdoP2ZO7gG6bNcRpOJEBle3V9XqVSwmLViIIysy4XxoR3cym/7WXB96O3C8feK7sbihaRpT+Dg==,iv:WPnDArVKqV7u3EIQ0CMectK1W6gXKOo37oOybyob3As=,tag:1R/0qjRzif4/sTFSs55NuQ==,type:str]
+    #ENC[AES256_GCM,data:RluXnmnn8CAI,iv:OqzKfed5CARE/KKur0GXDpLBqStEva7YVoQMQX4+FnU=,tag:prOaqWk6ARxEKvnhOnCZhw==,type:comment]
+    hjp: ENC[AES256_GCM,data:Tb9vCi68B88UZc/ZVSxEI+esKOLlFcAPAaMk9FDmkBycZmzDjHfkUKCxVcOMtqeNSluVZ/5IFgowaYbk9ncK6yoYTjXjj1Z0lA==,iv:COs+ijt0h+UygyhWDQV23NRd/xBcfeqz6CO7D+xw7t8=,tag:RaIMaGrgHkidB9vqLR6cNw==,type:str]
+    #ENC[AES256_GCM,data:pymPvP+KjTd2,iv:g5tmBMQevuzES9FVlRten8Vzy5nvgamDNPo6Vy018T4=,tag:sMYZAyyAzEyS5CsAyC7xtw==,type:comment]
+    zzn: ENC[AES256_GCM,data:CJ8cOBjblYIc0GoiPnIbbWfYDfpQW5u31R9T/P0/aVuxi6P44wYYH0posVGthR1laqHIlu8bzgeRyTbBYir/Mw1AGokAnFLEPQ==,iv:dJXFcZ9f3xe3rcPzOLd6AMFh6EyJXlv3/+uR2x9XYsw=,tag:4I1WqtloUSXNeQ6AlVPY5g==,type:str]
+    #ENC[AES256_GCM,data:r1Rl1+lfgMad,iv:9RGwiYlePcXZFDxw5uc1yEwZ4N3lStmE1cGmsj5dPls=,tag:yGChsxZtIzDjMUgIkd+PdA==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:IIZpTdr5jpidbxYCQ+fODOHdoWI51upPI3yxYlrAAd+RE62t6PzAvHKFmKPivbHmQS5RZrJXE7zm9JtwiodRmPl0pYLxYNBpFQ==,iv:WQc1pOungm1gEqYPk/MITbjs1l83ikcys47CARRgoFk=,tag:sS2mXDIWl32ZZzDtictv9g==,type:str]
+    #ENC[AES256_GCM,data:VtrWQKVtCHtA,iv:ap/n2HxQ7dgKOA8rIfenv9LOwwAh1na8+I9O/k/wMxs=,tag:Vl03ortuZ5OS2qcBMnc59g==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:fkxYmHEQnCjx/srKBgjreIR0S7mcXyl1h3H80PFsH3A/yCGnJbFCGK1GW1++Q+tziOnEWCTLZ/l9dlPuB5BFSK7iHiVXtkOfVQ==,iv:z6duWl+LFpS5RJnCGxb3yvgHp96uJYoSsAThWrbGYfg=,tag:AKWisEg506eOgdp/4tLU7g==,type:str]
+    #ENC[AES256_GCM,data:e8HuWaLrvHx5,iv:ZKvfRQtOMV6v3MSCDVoPEsxldI+ZRYJBwrKAD8YZzPc=,tag:tPL3IyjC8f+S+6MoMJSd0A==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:if1S/3AxNLkWvDQJom+4EPRBOpkAPNTkEcqHHLAuEJATSNLlIhVLOPgt10cM4LWx2TdG8V2TcZip9qnr4ABHMsPF5vm6Y53r9Q==,iv:Rba0So8DXJrSC88mjwT8j2AVy84TPm0R6AVf2ZmXNBg=,tag:qiSeYLrw/6QJ7vMiPEZ66A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WlJNWmp2VUxpcXR3NE92
+            TnNuLzg0SVZKdmt1cEVZU2FodXZPdmt6Rm5rClhrbDh3SzFlMU9LVFpEZDFLUGZZ
+            d2RBTVNCamNBWFVEVW9FMjYxcUE4Rm8KLS0tIHBwYjlMU2tnUTZweDBYcmZXUC9l
+            OWFUeE9xdldpTUQ3cDFENjU4YUVwSkUKp7yZGpvKMSm6rvsoPbcaqVznL3wzGEXB
+            OGzrmgY083Gyjb5P/0wPY0ShGMWfWQW6vGchoqVuwr4oHKT3APcrIg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRjBjdGFEMjR6QnQ0a3Nz
+            c2lmVWE0bFh3amRULytZOVhYS3dkL2JmRVhVClVQalh1WjJqcWcxT3ZXMWduN3Nl
+            UzdFNXNQUmtaaTVIVVFVYXkyZEFPUncKLS0tIExrTDA0OEJzQklQOHNJZzBJdzJP
+            MVU1UW9lWFJnSTE2aC9ZL0huYURUK3MK5U4cLWRMm+FFo8ATE/OoAcHzYHFMpOtV
+            Q5kbq5PDMdp4qvoM3T4kLsB34oU55HjFvac0pilOhNRrz4xRMQgvoQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:42Z"
+    mac: ENC[AES256_GCM,data:tb6UXalJcNqd1bCJ4pdWQ5lctAXMrwAJsGagNIjtAklVx/0vibEBTvtVdI3CSNA3OuDguyXc/ECGEqlPNpoRq/F5JINfnirEbaBL6KhNkFxaSLVP7mu1u0KH93qhzA2j4jofderpxj+FvOOMVZNuZkrcSPDoufPA/ypY+YaKuu8=,iv:KPyXi7AD6FSmoZKYUDh2zLZnArvdcHau5XZHk8CbwI4=,tag:7T1jUJ7eNkY9VYt2eP+brg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/srv1/node2/secrets/munge.key
+++ b/devices/srv1/node2/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:04fSLZEkne1LqLZNYpy1tFlKTVUgQNuX9L3cL66FVHD+LqGAyWJGlAnduY+fQMZdDhbBdeEnJKXjyQ2jdDCttuqbPRiJQChtD7ztf+oiP877N143iSY2G245aCjIrAzmFORkGZaQT7nD5oxgCPiLqJzkNPzgjN4HIDsVoYz6jtw=,iv:gTbiJmdXN/62/t53ddfDrYlNLe3AoujT4G03eFQXyZs=,tag:eAYfhXPERqsVKFSkcm+Abw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBb3JtVi92M2JUc3dKVzRt\na1kzNU8ycE1LTmdVZVNFNDNJZmpsTEdCK3hZCjNXajNpcGxXMDJxRjhPMmhFd2la\nZy8xUFZNZXhiVHFtbG9xVmJ3Q2d0NE0KLS0tIDlNWEJqcSsvQTFzc2FxL2F2bVVs\neS9UenMrYXNKbGJVTnZzN3VscWlrRk0K24RHbcTz56GV6AbQt7Yy9+1NClMpQFtk\nf/NO2RYuS0ciHwkJQEw7M48iJuwTSiv1pflXXkNvkl6/I7wPgS/eXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjFQbWd4SUhoOExTdnFk\nd3dVVytZaDAyc1F2eUowdmY0azFKbWJ2Z2pZCnhYQWJtVXVjTTRvTlI4SlVyVHh1\nZlBZTlFheVNKdzN5a0RHM3RkTDhzQncKLS0tIFlpbjRUSzdzS3ZuMW8welNRODdR\nWis0ajQrdUNqVWcwMWF4bVlUaWsrc00KfL/zF2RiAanljrNhRT99i2jPvLySMWXx\nEyzYRuTH8ZGXsX4T2VAPjreBt1ahJ/EgBWmCLibEVK62zWfdquAZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T05:31:41Z",
+		"mac": "ENC[AES256_GCM,data:7kp2KNU4O1yuBdu7cxzg8BytPWiP8hQ0/mWVKPPn4BXjFleyo8KzLC3XZn9Ovt2fHWiF/4hMreOPIDW1W+8n/DedLa2G+zkHiQDVBCyiLJ+FCELvNPdDwR37RvOJ0Oo3RtQaSK2xBhNwS2Qs1G7DemEGFrWXrZ/SeCG5H6bI4X4=,iv:zGG9jcC3McICjeYZd1aGud+VaUhLXg3J/demAqM4vUM=,tag:RINzMA36WfaTRuEy0cTQKQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}
--- a/devices/srv1/node3/default.nix
+++ b/devices/srv1/node3/default.nix
@@ -11,8 +11,6 @@ inputs:
          { ip = "192.168.178.4"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
    };
    specialisation.no-share-home.configuration =
    {
--- a/devices/srv2/default.nix
+++ b/devices/srv2/default.nix
@@ -18,28 +18,22 @@ inputs:
          swap = [ "/nix/swap/swap" ];
          rollingRootfs = {};
        };
-        nixpkgs.cuda =
-        {
-          enable = true;
-          capabilities =
-          [
-            # p5000 p400
-            "6.1"
-            # 2080 Ti
-            "7.5"
-            # 3090
-            "8.6"
-            # 4090
-            "8.9"
-          ];
-          forwardCompat = false;
-        };
+        nixpkgs.cuda.capabilities =
+        [
+          # p5000 p400
+          "6.1"
+          # 2080 Ti
+          "7.5"
+          # 3090
+          "8.6"
+          # 4090
+          "8.9"
+        ];
      };
      hardware.gpu = { type = "nvidia"; nvidia.open = false; };
      services =
      {
        sshd = { passwordAuthentication = true; groupBanner = true; };
-        smartd.enable = true;
        slurm =
        {
          enable = true;
@@ -58,7 +52,7 @@ inputs:
              name = "n1"; address = "192.168.178.2";
              cpu = { cores = 16; threads = 2; };
              memoryMB = 80 * 1024;
-              gpus = { "p5000" = 1; "3090" = 1; "4090" = 1; };
+              gpus = { "3090" = 1; "4090" = 1; };
            };
          };
          partitions =
@@ -75,12 +69,12 @@ inputs:
              { name = "n0"; mpiThreads = 8; openmpThreads = 5; }
              { name = "n1"; mpiThreads = 3; openmpThreads = 4; }
            ];
-            gpuIds = [ "4090" "3090" "p5000" ];
+            gpuIds = [ "4090" "3090" ];
            gpuPartition = "all";
          };
        };
      };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
    };
  };
 }
--- a/devices/srv2/node0/default.nix
+++ b/devices/srv2/node0/default.nix
@@ -19,17 +19,11 @@ inputs:
      {
        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno2" ]; };
        beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; loadAverage = 8;  };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
-          wireguardIp = "192.168.83.7";
-        };
        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
        samba = { enable = true; hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
        groupshare = {};
        hpcstat = {};
+        ollama = {};
      };
    };
    # allow other machine access network by this machine
--- a/devices/srv2/node0/secrets/default.yaml
+++ b/devices/srv2/node0/secrets/default.yaml
@@ -27,7 +27,9 @@ hpcstat:
    key: ENC[AES256_GCM,data:+Z7MRDkLLdUqDwMrkafFKkBjeCkw+zgRoAoiVEwrr+LY0uMeW8nNYoaYrfz6Ig8CMCDgX3n/DMb0ibUeN32j3HShQIStbtUxRPGpQMyH+ealbvgskGriTFpST4VPyQxNACkUpq/e+sh2CmLbKkSxhamkjKOXwsfqrBlgVbEkp7u7HkWGuAaYL1oPGt0Q94fWXwH0UVhRYZYQ2iFA/S6SEZY8gxaTIGDKUdWU9+fOHzPQ5WfhxtKYU4p4ydyfYsAt6ffqnPSx/SI72GsUCOJ4981JX8TuvnEzx3gQLVFYheK6NibTWCy6eODbvguieVOTHSvCPTrHmoP12lHVWU2kKzLwv70Jl7sXyzKHYROG0D+/z/4DKlNeotKM/IA0q2cST08/lwSKN7WDDmrt+O6xXhvwby28ZYKEsSvvrfV+VIKzHPl84ZKbUEX5xv/GHc3THfznUvKKz5PzDiqrkjCkEt5PRMsVW9A6MU1+QEUr+sXLLtcUd2CCL87c8CpwNHJx1us6vJ4ji1gu0PGoT+60,iv:yU6j9W2Hs2D34uHMJqqPFbNy2pNEZY2kzXoNdhPMSmA=,tag:TNvEfMVrhu7HrNxY8qe5mg==,type:str]
 telegram:
    token: ENC[AES256_GCM,data:dCDqQhNiuIGJAdbun2uwCBV1smrpvKvwi5AGOs+QWK0ANNVBoSHuUNPeNH2Ivg==,iv:Vcp/OPW8IRPHlqumPxYAfVLtZbdG3rB8VeXM34xBYSk=,tag:vKMihlMdwrPY0XKErtgwIA==,type:str]
-    chat: ENC[AES256_GCM,data:zw2me9Jc7XKl,iv:b699uod4AtF37Ih/9qdQUZN/uhdN+UUeR0ojKogpuTI=,tag:BsDWzbk8175SX6b9ajsPlw==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:NoWnuxCZGkQx,iv:9eSyerth1oOTWJFdOeB1zL2QrXoPv+X2LTUDQZuxdkg=,tag:Ep66od22bQffeL41ff5a2w==,type:str]
+        hjp: ENC[AES256_GCM,data:+a6dMGEnrX5Dug==,iv:2l8TbmBNOB7nRfh9UoQi0S6CMRIYFeab6P3+8V8pwW0=,tag:AK4Rtu3N0o7Rqy0sjNe0EQ==,type:str]
 wireless:
    #ENC[AES256_GCM,data:xrg3Wxj/ghbWgg==,iv:6stu7voI5no2Y3YmnMrvTS8hev3eqjoWAyD5zTgyehc=,tag:cxkS7y7S1oM+/SJmlT10fw==,type:comment]
    457的5G: ENC[AES256_GCM,data:QjHlyGU4JIYymyh41T+c33T3EOpbqDOoD3U+v6/BzjlWLLeZQXU2hwPCVh4fi2bwn7yNkp4ygAYmFPVPZWoT1A==,iv:Tc6Guzsn5hkjWH6UWSb1KlfWCBXIi2OWdn/wttmCXnQ=,tag:FhyH6JmjSTuqSeFy+GyQhg==,type:str]
@@ -55,8 +57,8 @@ sops:
            M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
            LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-11T11:25:26Z"
-    mac: ENC[AES256_GCM,data:RFoPSvTM1+sxQNxHVWYw/PYOmIYFiYg81/ICZMsDtQdwRYUzCAoOmJFeWAKNRWRJgRW9cNYvaowcjuLGXGcCoWlepJ9T48G16Id7sL99Y5BHeul9UHsZTF5dWGvL7JoKbJr4lVJBU/oGNtNJib7qe9TO2ts5JYU511acJUBMKx0=,iv:ZZKLZ3wXRR6pi9zZuuizYXm5EvJY90zD9V7Eymz9XOU=,tag:edIQTpwNjGxm1zPQ9pvhuw==,type:str]
+    lastmodified: "2025-02-25T02:36:44Z"
+    mac: ENC[AES256_GCM,data:VF48FNkamR6RPowHxQxlgRNQZqCGbHvO5d1mk3Tj0WW99wMFIo4wrH4i000lGlUGXWhuPlYcxHtDzP6/984fBKYvHg1Q0a/x1cXB812lvWNhDQZwpIG8lvr2AQyKYYYFMcpgxk8GZFRd4eY7evlVIfW2gqyUZflRbZzTmKCa2f4=,iv:ndLQpwtO6rPNuQdBU/MSTtVderU9H14jTJs0vClQl4A=,tag:h4lQ8JYVBoxhO9S+ncpVxQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.2
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -16,12 +16,6 @@ inputs:
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          luks.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
          swap = [ "/nix/swap/swap" ];
          rollingRootfs = {};
        };
@@ -50,15 +44,7 @@ inputs:
            [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
          // (builtins.listToAttrs (builtins.map
            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
-            [
-              "xn--s8w913fdga" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
-              "send" "api" "git" "grafana" "peertube"
-            ]))
-          // (builtins.listToAttrs (builtins.map
-            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.nas.chn.moe"; })
-            [
-              "misskey"
-            ]));
+            [ "xn--s8w913fdga" "misskey" "synapse" "matrix" "send" "api" "git" "grafana" "peertube" ]));
          applications =
          {
            element.instances."element.chn.moe" = {};
@@ -74,15 +60,6 @@ inputs:
        httpua = {};
        mirism.enable = true;
        fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "pc" "nas" "one" "vps7" "srv2-node0" "pi3b" "srv1-node0" ];
-          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
-          wireguardIp = "192.168.83.1";
-          listenIp = "74.211.99.69";
-          lighthouse = true;
-        };
        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
      };
    };
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -66,7 +66,8 @@ wireguard:
    privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
 telegram:
    token: ENC[AES256_GCM,data:LskBPmXZk3hRZ2bChXZjmRzzGd2A2GKrUZMknCDXTpTzOdP/RDibRvgI75HLWg==,iv:9lJKuGLD5HuQinWvvAvwWFAvEJofUGkJsxKNpqZrGmI=,tag:pTmTOlsYIY6Uqd69AtrnBA==,type:str]
-    chat: ENC[AES256_GCM,data:0ehCIvd7sBFc,iv:OwdiIoPrt/e1YgsCrYcqqMYhsJuEtKW2pSKNVxahMV4=,tag:ig2CfQxwzv2ppIutU6371w==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:5kjoZ4G/NYRG,iv:jGMjDxKUJACTbC2SraMzKsXpC3QSIePJZSsjZ+8JG+c=,tag:dD8SPgIM/+VcmAd3fcZw8g==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -91,8 +92,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-14T12:02:33Z"
-    mac: ENC[AES256_GCM,data:2iQLMkj/qg+TQodFXqCaSOhj1G2NGGr1ZEDewDm/6H2zteppgEw4vRls5GPUrxTQnC22NHKqih7REWa0Xv7L4eALkxrVYqWkPVcxvlt1RauW8XrW1JJhhLj+E/52AKqOxGd1CviuyyQS2M2cZzk1t3gNDpSZ8YdmhjYPUHk2SCA=,iv:imFhB5A4LZYhE3NqIbQazMqBzEtdv/c6r7DcY9yJqKE=,tag:eRTl/1vbmI3YsLLEyFyIAg==,type:str]
+    lastmodified: "2025-02-25T02:32:20Z"
+    mac: ENC[AES256_GCM,data:mP+N/m77jBS1mQ4CsdRNZ38Z2da8BK00OqU+7q7LHxBpBzw+T9wQRQJ1esEq4cfTK8QLujJNZaFTixFHvo5a/mi0peymvdh4w+m5m9ph2UyKqcaRe+qt6MUuavkJYv86jBUxohnDAhPHmkXQOcgOGF1p7d47K08zUXqzOx4SETI=,iv:U5g1lMN5yzusKUPAfi+pZj7TAxnw8HEorMStDwnfnaU=,tag:nE4J/N4cjs0wyO+S6sY4Pw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2
--- a/devices/vps7/default.nix
+++ b/devices/vps7/default.nix
@@ -16,12 +16,6 @@ inputs:
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          luks.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
          swap = [ "/nix/swap/swap" ];
          rollingRootfs = {};
        };
@@ -34,8 +28,9 @@ inputs:
      services =
      {
        sshd = {};
-        rsshub.enable = true;
-        misskey.instances.misskey.hostname = "xn--s8w913fdga.chn.moe";
+        rsshub = {};
+        misskey.instances =
+          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
        synapse.instances =
        {
          synapse.matrixHostname = "synapse.chn.moe";
@@ -47,20 +42,12 @@ inputs:
        nextcloud = {};
        freshrss.enable = true;
        send = {};
-        huginn.enable = true;
+        huginn = {};
        fz-new-order = {};
        httpapi.enable = true;
        gitea = { enable = true; ssh = {}; };
-        grafana.enable = true;
+        grafana = {};
        fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
-          wireguardIp = "192.168.83.2";
-          listenIp = "144.126.144.62";
-        };
        xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
        docker = {};
        peertube = {};
--- a/devices/vps7/secrets.yaml
+++ b/devices/vps7/secrets.yaml
@@ -3,11 +3,12 @@ acme:
 nginx:
    detectAuth:
        chn: ENC[AES256_GCM,data:Gk0TTbnFcsvIgoDcen6B8w==,iv:kvyvygw9zDwaiTQ2vPFTHQex0EWDFg8M8U22AConQFM=,tag:ewAZ/nXxmTOhDAjW/A2OnA==,type:str]
-        led: ENC[AES256_GCM,data:Owax7cyp,iv:NCEKyicVCYZNgxJzlO90heUmwPjfXbZEcyXX09XQKI4=,tag:WMTCVMVCD9sJgAhRUsqvYg==,type:str]
+        led: ENC[AES256_GCM,data:Vb2p9v7U,iv:xJcKgvbc0KAP31uTpFiYlpvPoEHMWH3VkEqqyINKcyk=,tag:X2R+CHFj4N4i7cAK88IoSA==,type:str]
    maxmind-license: ENC[AES256_GCM,data:9aW4QR3K6S+eTqzIjVlNEwkG0wZ4u5jgRfe7CMwRlJlK4AmcS6c45Q==,iv:cPTN1K4Aag5sohGbCQUZHYTvcwAL7AhF+rrY3OvXGPs=,tag:d9GGUMHnfzRz9Cf2U+dBfw==,type:str]
 redis:
    rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
    misskey-misskey: ENC[AES256_GCM,data:OHjt9o+m++NT5aaFbwBT/wSMdUdgf4zscd/JxjCo5HDhC3WeWMJV7z//kATI5Dg4BWAhvPlL02Vrly4RraIzLw==,iv:sQB4/D2SsOuDR3bTrmlNg7o+6ehFznDsqVc3BX9pK20=,tag:tcwTBt/JhyW8ZTAIWIkWBA==,type:str]
+    misskey-misskey-old: ENC[AES256_GCM,data:amUqMycdXUFvjg66pXKnlZqiESBYMci0k8iYzj824SaEqHl3Nq/I0TjYX++xEUg+RGYyTIcSaj96HUANTKpc1A==,iv:ND1mQLHxltRlOdpJ80ywheGo6hkl7OgRyk9TguJMuTw=,tag:dhCCwnCOnyT2iXdEMK0szg==,type:str]
    nextcloud: ENC[AES256_GCM,data:jwN/CqwkU/5Rd6w75/bV2Yej9b0CoxZaiJEcZXFx+9XUPY3Xg1tQdEr1SALG8xzOEdoL6WBVs14NvrrL25GeTQ==,iv:p5+0AB52QqScJwMhNIrM/7HAcRPdD9Z8xV6uwIDOwIg=,tag:f1XbNDDRXvGl/dkV9Wp2Ug==,type:str]
    send: ENC[AES256_GCM,data:IGxj3cgp+fQBdupfK+IgPEQSPuXdM9LRSLGSATNIkzUWC6sQw1aaKTDuRc8cU2BG6quthRwuWnK/F7k3KrUi8Q==,iv:LI9MkaF4e47FPUyL7AXZpO+CdgF91ScdiqjrE8PZjJ4=,tag:eNugln5M0AhU1xmVWFN7Aw==,type:str]
    synapse-synapse: ENC[AES256_GCM,data:8CVbcN2FG4mRT4PnlOGsS7tDfS+6ojIJFvq2EwItxn1gg2Ghd/Bmx+5tS/Do2FrYp/Xiv1EqucomM50r5bXnmg==,iv:TT7zBKQ4M10XYVCn5aeSu9IqjrIEHHazPUCOTmgRAU0=,tag:0+Q9hZMBVDj1TnHj3xoTBA==,type:str]
@@ -15,6 +16,7 @@ redis:
    peertube: ENC[AES256_GCM,data:cN+cClNV1JD+Z1Wlp07MY7BmLr/EZYZZt04mxKKKN8RG1ZSMGykbc3hd00E14ubhCittJXSPbIWyO63lCGGEPg==,iv:3z1BR0j26LGfXwDDPYU/i8Qx/7529KKoar+xGZanirI=,tag:g/NSGDE1iEYJ1MStrV3rpg==,type:str]
 postgresql:
    misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
+    misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
    synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
    vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
    nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
@@ -30,6 +32,7 @@ rsshub:
    youtube-refresh-token: ENC[AES256_GCM,data:pnXQ1euCdix2H7IxudmUUcpxc2OUhciKT8OcGV89c/EpoXHgx1+eLxwY5rRszroWwjge9M001RGHngvD/ny3phfWAwYmIzMJxun2f7JCPe7ybMesWmPSkiqVBss1Zfic1uB8mNM/yw==,iv:8p8/vATY8F3YuGA1TtjekiuaKOMnQyTMjrwDBJaK4VU=,tag:/jVg9FDOuLMNrupgrywpBQ==,type:str]
    twitter-auth-token: ENC[AES256_GCM,data:65SbHggbYtfSfaaxJxRgD6+HpOX4vIfjnVZmOAZ9illPMYOu9MIchQ==,iv:49UuC8n6AGj1skuHzQX39Q/QuKlB9IxogIfiiy1GBnw=,tag:Rq6b0H9UFVZ19tU8ZeelRg==,type:str]
    bilibili-cookie: ENC[AES256_GCM,data:58nO7ADu2oH/OgLJNYrEEzhf1J0zt8EpuygnSANkGXJju5oSmtM7WLnaMEjC96q14OTTA9QLiFVsbxiFY1eUnraA5W7g7+6CYRXVRZaxz91D/dhKzHGTMjB/LynnNqEIc6liONlcHbyjZNQ+WIqPtjVpCKMN7Mi8cv81/cFX/1GqAwncgDD2oXh1hMPOVY4dYcGKuOG0GjlY6RgOgTPqU3HawQjnoWQjPF+lq2rnWD5HP9ZTxOYa7hm2GgPrxkq1fkRrq+kKYeDh+6M7VLDcm5Fpf+biq6F8fZWzmw4NlVZT9BG0vJFa,iv:vxYXg9Yg9qIWFQXtwTYa4Ds0KSxZYg3M6xdtXKbdaig=,tag:TzCPehk9w+BL4wwgDc1CPg==,type:str]
+    zhihu-cookies: ENC[AES256_GCM,data:DgpvRB7IuRe1KuPFqhCbtyFrC02AUlaA9UWS+d8ix0nweItXwZrkqC03lXQY7nJr54H3SfKXNhtUp4nJmV2hqNQOqekrXVsKrG++UmcAr5Ciw1lTmilqM220igJ9YwiHxtsZrWgp4sTPlTTQIFu5xrGnvlSntBjXAjzStTk1R4XRmLV427QuKbNNQ5MjPXS1PYrtN0d4/qXLx74pNd9ZsNd9F4V0E75Zt6vKE8F7aA==,iv:5Lu/HD8Iw655pg84eFs2eEQS68QqA99uMBHlgelZvrI=,tag:Pnd7VWIAgNt+1vo+vyWDpQ==,type:str]
 mail:
    bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
 synapse:
@@ -88,7 +91,8 @@ wireguard:
    privateKey: ENC[AES256_GCM,data:TS+toaJRgAvC78XVwTciXe2IG8++vaqXVCi/u/8Aej6qq1B9Cb6f20cp5K0=,iv:T/NkLvcYiWzIDG3jWtuhe/sH2GT4z5f0xdUGbSL901I=,tag:qN7YokFBj3Kbbx4ijHTRnw==,type:str]
 telegram:
    token: ENC[AES256_GCM,data:Mr6KrAzYoDXA+dPT3oXqK2wm9ahTjZ5GVE/iRPsmcM+S2MABT+8ramyHz9oIFw==,iv:nIZ8rpSxz2GwMbDQFfG3xauMQjiriZ1oxFMrEQeH7sQ=,tag:y5U1T1vV/mmdE/CeaeTR8g==,type:str]
-    chat: ENC[AES256_GCM,data:8w/0EI64a1dC,iv:dHu9JHcUY7QPd9YBKXnrRXQB2K6jpnLrSFs+1IJmkio=,tag:3ucN3uNnBxxRF+cbLsa1nQ==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:75gj6MtpqZzq,iv:HekPpI2oJtD2UnbmQnTMXV0UwFzxdBKO5b2LpIcFSw4=,tag:bRFAeDk/YFivDAoNc5vwdA==,type:str]
 xray-server:
    clients:
        #ENC[AES256_GCM,data:aAZS,iv:Z+iJG7yC6HJeNdKCCpsZSc9Ny7kAt6GYfXUtZozMb4A=,tag:iMfwjqqmLvu5a8YpF7a0zQ==,type:comment]
@@ -127,8 +131,8 @@ sops:
            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-13T03:06:27Z"
-    mac: ENC[AES256_GCM,data:aIgKGuyrNWt2etXCtqHXxXwLSTkGhX3wk9NcHXv4u/rkZ3wUz8iJv24whMIN+ZFhQmNV1TLuPncd/O6bYra1YmG0FXSyBkgfQdVbCAR7ys1yXpdz00zcC7zMqm3CeNui89DZH27P5z6cDtNG4Z/dLz6lpln/ummYcdcb+/7KbZQ=,iv:Gl8turVRflUOB3PWqLfwU4JPoy0k9zLKir4CKB9628s=,tag:aJ8PDOfn/XBeklIlSkC2vg==,type:str]
+    lastmodified: "2025-02-25T02:32:05Z"
+    mac: ENC[AES256_GCM,data:MnL2eu1sUS6RnWKJhi0Z3A/x4Qaw8Fgov1PdpkBMHuJVBvmcnT1w8AbsxbOZZMd2bp20NWIzosKXBNuoAJzQx+Mtigtw2mnAzs9zcLhHu6e7OvCDVQ3o9FUEz43V59VzLCDpyj2zvzFanPa9h/Aw6WTs2Qu16xaUB1FVFRzxYfg=,iv:FYNyF2KEWDbCDMTI5XCSeGOE4KSIFjX5VUqT20JMxCs=,tag:NcYVt8jtfAljJhs8m8gYFw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2
--- a/dns/config.yaml
+++ b/dns/config.yaml
@@ -0,0 +1,14 @@
+providers:
+  config:
+    class: octodns.provider.yaml.YamlProvider
+    directory: ./config
+  cloudflare:
+    class: octodns_cloudflare.CloudflareProvider
+    token: env/CLOUDFLARE_TOKEN
+    pagerules: false
+zones:
+  '*':
+    sources:
+      - cloudflare
+    targets:
+      - config
--- a/dns/config/chn.moe.yaml
+++ b/dns/config/chn.moe.yaml
@@ -0,0 +1,186 @@
+? ''
+: - type: A
+    value: 74.211.99.69
+  - type: MX
+    values:
+    - exchange: tuesday.mxrouting.net.
+      preference: 10
+    - exchange: tuesday-relay.mxrouting.net.
+      preference: 20
+  - type: TXT
+    value: v=spf1 include:mxlogin.com -all
+'*.vps4':
+  type: CNAME
+  value: vps4.chn.moe.
+'*.xsession':
+  type: CNAME
+  value: vps3.chn.moe.
+_xlog-challenge.xlog:
+  type: TXT
+  value: chn
+api:
+  type: CNAME
+  value: autoroute.chn.moe.
+autoroute:
+  type: NS
+  values:
+  - ns1.huaweicloud-dns.cn.
+  - ns1.huaweicloud-dns.com.
+  - ns1.huaweicloud-dns.net.
+  - ns1.huaweicloud-dns.org.
+blog:
+  type: CNAME
+  value: vps6.chn.moe.
+catalog:
+  type: CNAME
+  value: vps6.chn.moe.
+coturn:
+  type: CNAME
+  value: vps6.chn.moe.
+element:
+  type: CNAME
+  value: vps6.chn.moe.
+freshrss:
+  type: CNAME
+  value: vps7.chn.moe.
+frp:
+  type: CNAME
+  value: vps6.chn.moe.
+git:
+  type: CNAME
+  value: autoroute.chn.moe.
+grafana:
+  type: CNAME
+  value: autoroute.chn.moe.
+huginn:
+  type: CNAME
+  value: vps7.chn.moe.
+initrd.nas:
+  type: A
+  value: 192.168.1.2
+initrd.vps6:
+  type: CNAME
+  value: vps6.chn.moe.
+initrd.vps7:
+  type: CNAME
+  value: vps7.chn.moe.
+mail:
+  type: CNAME
+  value: tuesday.mxrouting.net.
+matrix:
+  type: CNAME
+  value: autoroute.chn.moe.
+misskey:
+  type: CNAME
+  value: vps6.chn.moe.
+nas:
+  type: A
+  value: 192.168.1.2
+nextcloud:
+  type: CNAME
+  value: vps7.chn.moe.
+nix-store:
+  type: CNAME
+  value: vps6.chn.moe.
+office:
+  type: A
+  value: 210.34.16.60
+peertube:
+  type: CNAME
+  value: autoroute.chn.moe.
+photoprism:
+  type: CNAME
+  value: vps7.chn.moe.
+rsshub:
+  type: CNAME
+  value: vps7.chn.moe.
+send:
+  type: CNAME
+  value: autoroute.chn.moe.
+srv1:
+  type: A
+  value: 59.77.36.250
+srv2:
+  type: CNAME
+  value: office.chn.moe.
+ssh.git:
+  type: CNAME
+  value: vps7.chn.moe.
+sticker:
+  type: CNAME
+  value: vps6.chn.moe.
+synapse:
+  type: CNAME
+  value: autoroute.chn.moe.
+synapse-admin:
+  type: CNAME
+  value: vps6.chn.moe.
+ua:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: CNAME
+  value: vps6.chn.moe.
+vaultwarden:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: CNAME
+  value: vps7.chn.moe.
+vps6:
+  type: A
+  value: 74.211.99.69
+vps6.xserver:
+  type: CNAME
+  value: vps6.chn.moe.
+vps7:
+  type: A
+  value: 144.126.144.62
+webdav:
+  type: CNAME
+  value: vps7.chn.moe.
+webmail:
+  type: CNAME
+  value: tuesday.mxrouting.net.
+wireguard.nas:
+  type: A
+  value: 192.168.83.4
+wireguard.one:
+  type: A
+  value: 192.168.83.5
+wireguard.pc:
+  type: A
+  value: 192.168.83.3
+wireguard.srv1:
+  type: A
+  value: 192.168.83.9
+wireguard.srv2:
+  type: A
+  value: 192.168.83.7
+wireguard.vps6:
+  type: A
+  value: 192.168.83.1
+wireguard.vps7:
+  type: A
+  value: 192.168.83.2
+www:
+  type: CNAME
+  value: vps3.chn.moe.
+x._domainkey:
+  type: TXT
+  value: v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6xvkOMNYyOlY5mCjyL+Wx9PIWljb7WKLurGNnPNrKOrmSKQBAOwKOgv6SWABsuQMSZnoi33QVrqL2pFrGwAnPbhmQSesdAQW/D2ktaTp6iaRCT2eZTGz+dNdi9HCk1Uzkee8hU7L7KZISnNhvOrbBYbaICOwJWVYjk8hqSbIgyhK90IsTmrs9S4E5PSGxLjJ
+    Cpo0X0DPTtPD4ipH7kHnnD5DRO3fkxCvMAuWbnnt5+iUn/NuFQSC//dMqzs+IklBzZWdm/3n3GijkI5XK9rxnvg8V2/bk7SzJy7qeuLJPgbQgVDHCcIJKR0Ugl6CxpqQ8Jvcf0X0AtixVoVEWoyFQIDAQAB
+xlog:
+  type: CNAME
+  value: xlog.autoroute.chn.moe.
+xsession.vps7:
+  type: CNAME
+  value: vps7.chn.moe.
+铜锣湾:
+  type: CNAME
+  value: autoroute.chn.moe.
+铜锣湾实验室:
+  type: CNAME
+  value: vps6.chn.moe.
--- a/dns/config/mirism.one.yaml
+++ b/dns/config/mirism.one.yaml
@@ -0,0 +1,3 @@
+entry:
+  type: CNAME
+  value: vps6.chn.moe.
--- a/dns/config/nekomia.moe.yaml
+++ b/dns/config/nekomia.moe.yaml
@@ -0,0 +1,3 @@
+? ''
+: type: ALIAS
+  value: vps6.chn.moe.
--- a/flake.lock
+++ b/flake.lock
@@ -25,11 +25,11 @@
    "blog": {
      "flake": false,
      "locked": {
-        "lastModified": 1736655114,
-        "narHash": "sha256-UARA0dfib7ZZSms8r8zrC4VVdc5wdUgrN5pEEYayXLc=",
+        "lastModified": 1740487529,
+        "narHash": "sha256-DuEKkIU1LwT6iA9SZtXgAaL1Hx73bk2f4hLxKxTJV+0=",
        "ref": "refs/heads/public",
-        "rev": "dcd52004853ed1f04a67822f9b5ddefa25670692",
-        "revCount": 12,
+        "rev": "af59d95111b08f5d566d44ffb84a4dd32cf7fd79",
+        "revCount": 19,
        "type": "git",
        "url": "https://git.chn.moe/chn/blog-public.git"
      },
@@ -655,6 +655,22 @@
        "type": "github"
      }
    },
+    "mac-style": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1717900224,
+        "narHash": "sha256-tYB4fJ87UnYczaW8/w32cBzbwCw1+IDHp8BnHSyqNNg=",
+        "owner": "SergioRibera",
+        "repo": "s4rchiso-plymouth-theme",
+        "rev": "856bf3b7d239f995e4e9dde8458b9823cf0e96e4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SergioRibera",
+        "repo": "s4rchiso-plymouth-theme",
+        "type": "github"
+      }
+    },
    "matplotplusplus": {
      "flake": false,
      "locked": {
@@ -674,11 +690,11 @@
    "misskey": {
      "flake": false,
      "locked": {
-        "lastModified": 1732375939,
-        "narHash": "sha256-ZlyBBJniDJ8yS3ALMQ9gfsVUDTzp/U4Pr3SOtE5FttY=",
+        "lastModified": 1738981864,
+        "narHash": "sha256-7tl+1vlk5FAWd9z5VIVxF90KvuhxAeJEn1tLuKNTNdk=",
        "ref": "refs/heads/chn-mod",
-        "rev": "bb3ae0b9c84126dada9ce7e13a42962a8889eba8",
-        "revCount": 26357,
+        "rev": "c557842f90fa618fa72f6cca6e719cfbbdaf1f10",
+        "revCount": 26500,
        "submodules": true,
        "type": "git",
        "url": "https://github.com/CHN-beta/misskey"
@@ -858,11 +874,11 @@
    "nixos-wallpaper": {
      "flake": false,
      "locked": {
-        "lastModified": 1715952274,
-        "narHash": "sha256-i2L4L9mV/wOl6QV+d8pyLZUHS+QIFJN5lYuQrP+CSjk=",
+        "lastModified": 1738512779,
+        "narHash": "sha256-481mZgrJ4OgXLh1Jz2I5+P+x55nd/4qMfHaBCYEpa0E=",
        "ref": "refs/heads/main",
-        "rev": "1ad78b20b21c9f4f7ba5f4c897f74276763317eb",
-        "revCount": 1,
+        "rev": "293d281e645c464e986b4dca78e03b1f8c53ca0a",
+        "revCount": 2,
        "type": "git",
        "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
      },
@@ -873,11 +889,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1736304997,
-        "narHash": "sha256-P7sYpFZfVbr0FrT1ID+58HvCzRZObzGLa8QhyW2DGwA=",
+        "lastModified": 1740535747,
+        "narHash": "sha256-7GtX5FHZE2k+2jVK6wMNvDTkYUksXJaLsUZ3U89IA0g=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "24e16d8b21f698cbe372be67b645a1919bfd0d20",
+        "rev": "022a396dc97e656a7680e24a0fa0953ef98aa8bc",
        "type": "github"
      },
      "original": {
@@ -963,6 +979,22 @@
        "type": "github"
      }
    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1739698908,
+        "narHash": "sha256-7LBhwsoOLw6WPsjIQ86n9BXuQTnXlW7PjoIM5n9JwbU=",
+        "owner": "CHN-beta",
+        "repo": "nixpkgs",
+        "rev": "12fbbac87857a29aac1f5f0a97f86d5bca1b43ef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nu-scripts": {
      "flake": false,
      "locked": {
@@ -1084,6 +1116,22 @@
        "type": "github"
      }
    },
+    "octodns-cloudflare": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1736639669,
+        "narHash": "sha256-5k6w5e5U1sr7qBJ2tXbmAJi/BMe6qT2W6x53vDEO4xs=",
+        "owner": "octodns",
+        "repo": "octodns-cloudflare",
+        "rev": "51c34b65b3405adeca395c0bba8b1b97af672f9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "octodns",
+        "repo": "octodns-cloudflare",
+        "type": "github"
+      }
+    },
    "openxlsx": {
      "flake": false,
      "locked": {
@@ -1223,6 +1271,7 @@
        "impermanence": "impermanence",
        "lepton": "lepton",
        "lmod": "lmod",
+        "mac-style": "mac-style",
        "matplotplusplus": "matplotplusplus",
        "misskey": "misskey",
        "mumax": "mumax",
@@ -1235,9 +1284,11 @@
        "nixpkgs": "nixpkgs",
        "nixpkgs-23.05": "nixpkgs-23.05",
        "nixpkgs-23.11": "nixpkgs-23.11",
+        "nixpkgs-unstable": "nixpkgs-unstable",
        "nu-scripts": "nu-scripts",
        "nur-linyinfeng": "nur-linyinfeng",
        "nur-xddxdd": "nur-xddxdd",
+        "octodns-cloudflare": "octodns-cloudflare",
        "openxlsx": "openxlsx",
        "plasma-manager": "plasma-manager",
        "pocketfft": "pocketfft",
@@ -1262,11 +1313,11 @@
    "rsshub": {
      "flake": false,
      "locked": {
-        "lastModified": 1734135595,
-        "narHash": "sha256-D0mAiHuAFLMBZvBzspbqAlqXXdhYG45fhrYVkCdmA48=",
+        "lastModified": 1737621586,
+        "narHash": "sha256-3rlojj//tAVCdPz9NkkgsSQqxe9478ExOL1LyH4spPM=",
        "owner": "DIYgod",
        "repo": "RSSHub",
-        "rev": "3a8d34ee3f8cc38907296e74e923754297e249d4",
+        "rev": "62a61e5e7945d539bf89175c96bac2b4ab148bba",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -6,6 +6,7 @@
    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-24.11";
    "nixpkgs-23.11".url = "github:CHN-beta/nixpkgs/nixos-23.11";
    "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
    home-manager = { url = "github:nix-community/home-manager/release-24.11"; inputs.nixpkgs.follows = "nixpkgs"; };
    sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
@@ -70,6 +71,8 @@
    highfive = { url = "git+https://github.com/CHN-beta/HighFive?submodules=1"; flake = false; };
    stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
    fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
+    octodns-cloudflare = { url = "github:octodns/octodns-cloudflare"; flake = false; };
+    mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme"; flake = false; };
  };

  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
--- a/flake/dev.nix
+++ b/flake/dev.nix
@@ -48,4 +48,11 @@
    packages = [ pkgs.clang-tools_18 ];
    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
  };
+  info = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.info ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+    hardeningDisable = [ "all" ];
+  };
 }
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -1,6 +1,6 @@
 { inputs, localLib }:
 let
-  machine = [ "nas" "pc" "pi3b" "vps6" "vps7" "one" ];
+  machine = [ "nas" "pc" "vps6" "vps7" "one" ];
  cluster = { srv1 = 4; srv2 = 2; };
 in builtins.listToAttrs
 (
@@ -10,13 +10,14 @@ in builtins.listToAttrs
      name = system;
      value = inputs.nixpkgs.lib.nixosSystem
      {
-        system = let arch.pi3b = "aarch64-linux"; in arch.${system} or "x86_64-linux";
+        system = "x86_64-linux";
        specialArgs = { topInputs = inputs; inherit localLib; };
        modules = localLib.mkModules
        [
          { config = { nixpkgs.overlays = [ inputs.self.overlays.default ]; nixos.model.hostname = system; }; }
          ../modules
          ../devices/${system}
+          ../devices/cross
        ];
      };
    })
@@ -44,6 +45,7 @@ in builtins.listToAttrs
              ../modules
              ../devices/${cluster.name}
              ../devices/${cluster.name}/${node}
+              ../devices/cross
            ];
          };
        })
--- a/flake/packages.nix
+++ b/flake/packages.nix
@@ -24,7 +24,7 @@
      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
    };
  chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
-  blog = pkgs.callPackage inputs.blog { inherit (inputs) hextra; };
+  blog = pkgs.localPackages.blog;
  vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
  {
    gfortran = pkgs.pkgsStatic.gfortran;
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -36,4 +36,17 @@
      sha256 = "18gsw2850ig1mg4spp39i0ygfcwx0lqnamysn5whiax22m8d5z67";
    };
  };
+  huginn = pkgs.dockerTools.pullImage
+  {
+    imageName = "ghcr.io/huginn/huginn";
+    imageDigest = "sha256:fdaa76b95534f3c3a799d527821681dd61b8b6fc24de0a7e109fc665b627f115";
+    sha256 = "062c18360asnzl610n11vd46621cvkj26ay21l82f16r12k4qzwy";
+    finalImageName = "huginn/huginn";
+    finalImageTag = "latest";
+  };
+  misskey =
+  {
+    "https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.6/aiscript-dev-aiscript-languageserver-0.1.6.tgz" = "0092d5r67bhf4xkvrdn4a2rm1drjzy7b5sw8mi7hp4pqvpc20ylr";
+    "https://github.com/misskey-dev/tabler-icons/archive/refs/tags/3.29.0-mi.1913+5921534bc.tar.gz" = "1snwwcgxwlp9jwlq6pj4q0mypzp0c7b28m49mcwvr6dzq9vlpy2s";
+  };
 }
--- a/modules/bugs/default.nix
+++ b/modules/bugs/default.nix
@@ -1,28 +1,38 @@
 inputs:
-  let
-    inherit (inputs.localLib) stripeTabs;
-    inherit (builtins) map attrNames;
-    inherit (inputs.lib) mkMerge mkIf mkOption types;
-    bugs =
+let bugs =
+{
+  # suspend & hibernate do not use platform
+  suspend-hibernate-no-platform.systemd.sleep.extraConfig =
+  ''
+    SuspendState=freeze
+    HibernateMode=shutdown
+  '';
+  # xmunet use old encryption
+  xmunet.nixpkgs.config.packageOverrides = pkgs: { wpa_supplicant = pkgs.wpa_supplicant.overrideAttrs
+    (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
+  backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
+  amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
+  iwlwifi =
+  {
+    nixos.system.kernel.modules.modprobeConfig =
+      [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
+    systemd.services = let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in
    {
-      # suspend & hibernate do not use platform
-      suspend-hibernate-no-platform.systemd.sleep.extraConfig =
-      ''
-        SuspendState=freeze
-        HibernateMode=shutdown
-      '';
-      # xmunet use old encryption
-      xmunet.nixpkgs.config.packageOverrides = pkgs: { wpa_supplicant = pkgs.wpa_supplicant.overrideAttrs
-        (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
-      backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
-      amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
+      load-iwlwifi = rec
+        { wantedBy = [ "hibernate.target" ]; before = wantedBy; script = "${modprobe} iwlwifi iwlmvm"; };
+      unload-iwlwifi = rec
+        { wantedBy = [ "hibernate.target" ]; after = wantedBy; script = "${modprobe} -r iwlwifi iwlmvm"; };
    };
-  in
-    {
-      options.nixos.bugs = mkOption
-      {
-        type = types.listOf (types.enum (attrNames bugs));
-        default = [];
-      };
-      config = mkMerge (map (bug: mkIf (builtins.elem bug inputs.config.nixos.bugs) bugs.${bug}) (attrNames bugs));
-    }
+  };
+};
+in
+{
+  options.nixos.bugs = inputs.lib.mkOption
+  {
+    type = inputs.lib.types.listOf (inputs.lib.types.enum (builtins.attrNames bugs));
+    default = [];
+  };
+  config = inputs.lib.mkMerge (builtins.map
+    (bug: inputs.lib.mkIf (builtins.elem bug inputs.config.nixos.bugs) bugs.${bug})
+    (builtins.attrNames bugs));
+}
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,46 +1,40 @@
-inputs:
-  let
-    inherit (inputs) topInputs;
-    inherit (inputs.localLib) mkModules;
-  in
-  {
-    imports = mkModules
-    [
-      topInputs.home-manager.nixosModules.home-manager
-      topInputs.sops-nix.nixosModules.sops
-      topInputs.nix-index-database.nixosModules.nix-index
-      topInputs.nur-xddxdd.nixosModules.setupOverlay
-      topInputs.impermanence.nixosModules.impermanence
-      topInputs.nix-flatpak.nixosModules.nix-flatpak
-      topInputs.chaotic.nixosModules.default
-      { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
-      topInputs.catppuccin.nixosModules.catppuccin
-      topInputs.aagl.nixosModules.default
-      (inputs:
+inputs: let inherit (inputs) topInputs; in
+{
+  imports = inputs.localLib.mkModules
+  [
+    topInputs.home-manager.nixosModules.home-manager
+    topInputs.sops-nix.nixosModules.sops
+    topInputs.nix-index-database.nixosModules.nix-index
+    topInputs.impermanence.nixosModules.impermanence
+    topInputs.nix-flatpak.nixosModules.nix-flatpak
+    topInputs.chaotic.nixosModules.default
+    { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
+    topInputs.catppuccin.nixosModules.catppuccin
+    topInputs.aagl.nixosModules.default
+    (inputs:
+    {
+      config =
      {
-        config =
-        {
-          nixpkgs.overlays =
-          [
-            topInputs.qchem.overlays.default
-            topInputs.bscpkgs.overlays.default
-            topInputs.aagl.overlays.default
-            (final: prev:
-            {
-              nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
-              nur-xddxdd = topInputs.nur-xddxdd.overlays.default final prev;
-              nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
-              firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
-              inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
-            })
-          ];
-          home-manager.sharedModules =
-          [
-            topInputs.plasma-manager.homeManagerModules.plasma-manager
-            topInputs.catppuccin.homeManagerModules.catppuccin
-          ];
-        };
-      })
-      ./hardware ./packages ./system ./virtualization ./services ./bugs ./user ./model.nix
-    ];
-  }
+        nixpkgs.overlays =
+        [
+          topInputs.qchem.overlays.default
+          topInputs.bscpkgs.overlays.default
+          topInputs.aagl.overlays.default
+          topInputs.nur-xddxdd.overlays.inSubTree
+          (final: prev:
+          {
+            nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions.${prev.system};
+            nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
+            firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
+            inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
+          })
+        ];
+        home-manager.sharedModules =
+        [
+          topInputs.plasma-manager.homeManagerModules.plasma-manager
+          topInputs.catppuccin.homeManagerModules.catppuccin
+        ];
+      };
+    })
+  ] ++ (inputs.localLib.findModules ./.);
+}
--- a/modules/hardware/default.nix
+++ b/modules/hardware/default.nix
@@ -24,7 +24,7 @@ inputs:
          printing =
          {
            enable = true;
-            drivers = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") [ inputs.pkgs.cnijfilter2 ];
+            drivers = [ inputs.pkgs.cnijfilter2 ];
            # TODO: remove in next update
            browsed.enable = false;
          };
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.model = let inherit (inputs.lib) mkOption types; in
  {
    hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
+    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
    private = mkOption { type = types.bool; default = false; };
    cluster = mkOption
    {
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -52,20 +52,20 @@ inputs:
          # download
          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
          # editor
-          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq obsidian
          # news
-          fluent-reader rssguard newsflash newsboat
+          fluent-reader rssguard newsflash newsboat follow
          # nix tools
          nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
          nix-template nil pnpm-lock-export bundix
          # instant messager
          element-desktop telegram-desktop discord zoom-us slack nur-linyinfeng.wemeet nheko
-          fluffychat signal-desktop qq nur-xddxdd.wechat-uos cinny-desktop
+          fluffychat signal-desktop qq nur-xddxdd.wechat-uos-sandboxed cinny-desktop
          # browser
          google-chrome tor-browser microsoft-edge
          # office
          crow-translate zotero pandoc libreoffice-qt texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply pspp
+          ydict texstudio panoply pspp paperwork
          # matplot++ needs old gnuplot
          inputs.pkgs."pkgs-23.11".gnuplot
          # math, physics and chemistry
--- a/modules/packages/lammps.nix
+++ b/modules/packages/lammps.nix
@@ -8,7 +8,7 @@ inputs:
  config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
  {
    nixos.packages.packages._packages =
-      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null;
+      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
      in
        if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
          .overrideAttrs (prev:
--- a/modules/packages/mumax.nix
+++ b/modules/packages/mumax.nix
@@ -5,7 +5,7 @@ inputs:
    type = types.nullOr (types.submodule {});
    default =
      if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
-        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
      then {}
      else null;
  };
--- a/modules/packages/server.nix
+++ b/modules/packages/server.nix
@@ -10,7 +10,7 @@ inputs:
      [
        # basic tools
        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq zellij ipfetch localPackages.pslist
-        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils
+        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty
        # lsxx
        pciutils usbutils lshw util-linux lsof dmidecode lm_sensors hwloc acpica-tools
        # top
@@ -22,26 +22,26 @@ inputs:
        # file manager
        tree eza trash-cli lsd broot file xdg-ninja mlocate
        # compress
-        pigz upx unzip zip lzip p7zip
+        pigz upx unzip zip lzip p7zip rar
        # file system management
        sshfs e2fsprogs duperemove compsize exfatprogs
        # disk management
-        smartmontools hdparm megacli gptfdisk
+        smartmontools hdparm gptfdisk megacli
        # encryption and authentication
-        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
+        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool libfido2
        # networking
        ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
        # nix tools
        nix-output-monitor nix-tree ssh-to-age nix-inspect
        # development
        gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
+        (octodns.withProviders (_: [ localPackages.octodns-cloudflare ]))
        # stupid things
        toilet lolcat localPackages.stickerpicker graph-easy
        # office
        pdfgrep ffmpeg-full # todo-txt-cli 
      ]
-        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ])
-        ++ (inputs.lib.optional (inputs.config.nixos.system.nixpkgs.arch == "x86_64") rar);
+        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
      _pythonPackages = [(pythonPackages: with pythonPackages;
      [
        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -14,7 +14,7 @@ inputs:
      (
        [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
          ++ (inputs.lib.optional
-            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
            localPackages.vasp.nvidia)
      );
      _pythonPackages = [(_: [ localPackages.py4vasp ])];
--- a/modules/packages/zsh/default.nix
+++ b/modules/packages/zsh/default.nix
@@ -27,6 +27,8 @@ inputs:
            plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
            theme = inputs.lib.mkDefault "clean";
          };
+          # ensure ~/.zlogin exists
+          loginExtra = " ";
        };
        # set bash history file path, avoid overwriting zsh history
        bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
--- a/modules/services/beesd.nix
+++ b/modules/services/beesd.nix
@@ -55,5 +55,6 @@ inputs:
      IOWeight = 1;
      Nice = 19;
    };
+    nixos.packages.packages._packages = [ inputs.pkgs.bees ];
  };
 }
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -3,18 +3,20 @@ inputs:
  imports = inputs.localLib.findModules ./.;
  options.nixos.services = let inherit (inputs.lib) mkOption types; in
  {
-    smartd.enable = mkOption { type = types.bool; default = false; };
-    noisetorch.enable = mkOption { type = types.bool; default = inputs.config.nixos.model.type == "desktop"; };
+    smartd = mkOption
+    {
+      type = types.nullOr (types.submodule {});
+      default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    };
+    noisetorch = mkOption
+    {
+      type = types.nullOr (types.submodule {});
+      default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    };
  };
-  config =
-    let
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (inputs.localLib) stripeTabs attrsToList;
-      inherit (inputs.config.nixos) services;
-      inherit (builtins) map listToAttrs toString;
-    in mkMerge
-    [
-      (mkIf services.smartd.enable { services.smartd.enable = true; })
-      (mkIf services.noisetorch.enable { programs.noisetorch.enable = true; })
-    ];
+  config = let inherit (inputs.config.nixos.services) smartd noisetorch; in inputs.lib.mkMerge
+  [
+    (inputs.lib.mkIf (smartd != null) { services.smartd.enable = true; })
+    (inputs.lib.mkIf (noisetorch != null) { programs.noisetorch.enable = true; })
+  ];
 }
--- a/modules/services/docker.nix
+++ b/modules/services/docker.nix
@@ -2,39 +2,29 @@ inputs:
 {
  options.nixos.services.docker = let inherit (inputs.lib) mkOption types; in mkOption
    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkMerge
-  [
-    (
-      inputs.lib.mkIf (docker != null)
-      {
-        virtualisation.docker =
-        {
-          enable = true;
-          rootless =
-          {
-            enable = true;
-            setSocketVariable = true;
-            daemon.settings =
-            {
-              features.buildkit = true;
-              # dns 127.0.0.1 make docker not work
-              dns = [ "1.1.1.1" ];
-              # prevent create btrfs subvol
-              storage-driver = "overlay2";
-            };
-          };
-        };
-        hardware.nvidia-container-toolkit.enable = inputs.lib.mkIf inputs.config.nixos.system.nixpkgs.cuda.enable true;
-      }
-    )
-    # some docker settings should be set unconditionally, as some services depend on them
+  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkIf (docker != null)
+  {
+    virtualisation.docker =
    {
-      virtualisation.docker =
+      enable = true;
+      # prevent create btrfs subvol
+      storageDriver = "overlay2";
+      daemon.settings.dns = [ "1.1.1.1" ];
+      rootless =
      {
-        # prevent create btrfs subvol
-        storageDriver = "overlay2";
-        daemon.settings.dns = [ "1.1.1.1" ];
+        enable = true;
+        setSocketVariable = true;
+        daemon.settings =
+        {
+          features.buildkit = true;
+          # dns 127.0.0.1 make docker not work
+          dns = [ "1.1.1.1" ];
+          # prevent create btrfs subvol
+          storage-driver = "overlay2";
+        };
      };
-    }
-  ];
+    };
+    hardware.nvidia-container-toolkit.enable = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.cuda != null) true;
+    networking.firewall.trustedInterfaces = [ "docker0" ];
+  };
 }
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -43,7 +43,8 @@ inputs:
          SMTP_PORT = 465;
          USER = "bot@chn.moe";
        };
-        service.REGISTER_MANUAL_CONFIRM = true;
+        service.DISABLE_REGISTRATION = true;
+        security.LOGIN_REMEMBER_DAYS = 365;
      };
    };
    nixos.services =
@@ -51,22 +52,16 @@ inputs:
      nginx =
      {
        enable = true;
-        https."${gitea.hostname}".location =
+        https.${gitea.hostname}.location =
        {
          "/".proxy.upstream = "http://127.0.0.1:3002";
          "/robots.txt".static.root =
-            let
-              robotsFile = inputs.pkgs.fetchurl
-              {
-                url = "https://gitea.com/robots.txt";
-                sha256 = "144c5s3la4a85c9lygcnxhbxs3w5y23bkhhqx69fbp9yiqyxdkk2";
-              };
-              robotsDir = inputs.pkgs.runCommand "robots.txt" {}
-              ''
-                mkdir -p $out
-                cp ${robotsFile} $out/robots.txt
-              '';
-            in "${robotsDir}";
+            let robotsFile = inputs.pkgs.fetchurl
+            {
+              url = "https://gitea.com/robots.txt";
+              sha256 = "144c5s3la4a85c9lygcnxhbxs3w5y23bkhhqx69fbp9yiqyxdkk2";
+            };
+            in "${inputs.pkgs.runCommand "robots.txt" {} "mkdir -p $out; cp ${robotsFile} $out/robots.txt"}";
        };
      };
      postgresql.instances.gitea = {};
--- a/modules/services/grafana.nix
+++ b/modules/services/grafana.nix
@@ -1,17 +1,18 @@
 inputs:
 {
-  options.nixos.services.grafana = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.grafana = let inherit (inputs.lib) mkOption types; in mkOption
  {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.str; default = "grafana.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) grafana;
-      inherit (inputs.lib) mkIf;
-    in mkIf grafana.enable
+    type = types.nullOr (types.submodule { options =
    {
-      services.grafana =
+      hostname = mkOption { type = types.str; default = "grafana.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) grafana; in inputs.lib.mkIf (grafana != null)
+  {
+    services =
+    {
+      grafana =
      {
        enable = true;
        declarativePlugins = with inputs.pkgs.grafanaPlugins; [];
@@ -44,24 +45,58 @@ inputs:
            password = "$__file{${inputs.config.sops.secrets."grafana/db".path}}";
          };
        };
-      };
-      nixos.services =
-      {
-        nginx =
+        provision =
        {
          enable = true;
-          https."${grafana.hostname}".location."/".proxy =
-            { upstream = "http://127.0.0.1:3001"; websocket = true; };
+          datasources.settings =
+          {
+            # prune = true;
+            datasources =
+            [{
+              name = "Prometheus";
+              type = "prometheus";
+              access = "proxy";
+              url = "http://localhost:9090";
+              editable = false;
+            }];
+          };
        };
-        postgresql.instances.grafana = {};
      };
-      sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
+      prometheus =
      {
-        "grafana/mail" = { owner = owner; key = "mail/bot"; };
-        "grafana/secret".owner = owner;
-        "grafana/chn".owner = owner;
-        "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
-        "mail/bot" = {};
+        enable = true;
+        exporters =
+        {
+          node = { enable = true; enabledCollectors = [ "systemd" ]; };
+        };
+        scrapeConfigs =
+        [{
+          job_name = "lapetus";
+          static_configs =
+            [{ targets = [ "127.0.0.1:${toString inputs.config.services.prometheus.exporters.node.port}" ]; }];
+        }];
+        extraFlags = [ "--storage.tsdb.max-block-chunk-segment-size=16MB" ];
      };
    };
+    nixos.services =
+    {
+      nginx =
+      {
+        enable = true;
+        https.${grafana.hostname}.location."/".proxy =
+          { upstream = "http://127.0.0.1:3001"; websocket = true; };
+      };
+      postgresql.instances.grafana = {};
+    };
+    sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
+    {
+      "grafana/mail" = { owner = owner; key = "mail/bot"; };
+      "grafana/secret".owner = owner;
+      "grafana/chn".owner = owner;
+      "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
+      "mail/bot" = {};
+    };
+    environment.persistence."/nix/nodatacow".directories =
+      [{ directory = "/var/lib/prometheus2"; user = "prometheus"; group = "prometheus"; mode = "0700"; }];
+  };
 }
--- a/modules/services/hpcstat.nix
+++ b/modules/services/hpcstat.nix
@@ -16,7 +16,7 @@ inputs:
            curl = "${inputs.pkgs.curl}/bin/curl";
            cat = "${inputs.pkgs.coreutils}/bin/cat";
            token = inputs.config.sops.secrets."telegram/token".path;
-            chat = inputs.config.sops.secrets."telegram/chat".path;
+            chat = inputs.config.sops.secrets."telegram/user/chn".path;
            date = "${inputs.pkgs.coreutils}/bin/date";
            hpcstat = "${inputs.pkgs.localPackages.hpcstat}/bin/hpcstat";
            ssh = "${inputs.pkgs.openssh}/bin/ssh -i ${key} -o StrictHostKeyChecking=no"
@@ -108,7 +108,7 @@ inputs:
    sops.secrets =
    {
      "telegram/token" = { group = "telegram"; mode = "0440"; };
-      "telegram/chat" = { group = "telegram"; mode = "0440"; };
+      "telegram/user/chn" = { group = "telegram"; mode = "0440"; };
      "hpcstat/key" = { owner = "hpcstat"; group = "hpcstat"; };
    };
    users =
--- a/modules/services/httpapi.nix
+++ b/modules/services/httpapi.nix
@@ -36,10 +36,10 @@ inputs:
            let
              placeholder = inputs.config.sops.placeholder;
              request = "https://api.telegram.org/bot${placeholder."telegram/token"}"
-                + "/sendMessage?chat_id=${placeholder."telegram/chat"}&text=";
+                + "/sendMessage?chat_id=${placeholder."telegram/user/chn"}&text=";
            in ''<?php print file_get_contents("${request}".urlencode($_GET["message"])); ?>'';
        };
-        secrets = { "telegram/token" = {}; "telegram/chat" = {}; };
+        secrets = { "telegram/token" = {}; "telegram/user/chn" = {}; };
      };
      systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" "Z /srv/api - nginx nginx" ];
    };
--- a/modules/services/huginn.nix
+++ b/modules/services/huginn.nix
@@ -1,65 +1,58 @@
 inputs:
 {
-  options.nixos.services.huginn = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.huginn = let inherit (inputs.lib) mkOption types; in mkOption
  {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.nonEmptyStr; default = "huginn.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (inputs.config.nixos.services) huginn;
-    in mkIf huginn.enable
+    type = types.nullOr (types.submodule { options =
    {
-      virtualisation.oci-containers.containers.huginn =
+      hostname = mkOption { type = types.str; default = "huginn.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) huginn; in inputs.lib.mkIf (huginn != null)
+  {
+    virtualisation.oci-containers.containers.huginn =
+    {
+      image = "huginn/huginn:5a1509b51188e0d16868be893c983d6fcfd232a5";
+      imageFile = inputs.topInputs.self.src.huginn;
+      ports = [ "127.0.0.1:3000:3000/tcp" ];
+      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
+      environmentFiles = [ inputs.config.sops.templates."huginn/env".path ];
+    };
+    sops =
+    {
+      templates."huginn/env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        MYSQL_PORT_3306_TCP_ADDR=host.docker.internal
+        HUGINN_DATABASE_NAME=huginn
+        HUGINN_DATABASE_USERNAME=huginn
+        HUGINN_DATABASE_PASSWORD=${placeholder."mariadb/huginn"}
+        DOMAIN=${huginn.hostname}
+        RAILS_ENV=production
+        FORCE_SSL=true
+        INVITATION_CODE=${placeholder."huginn/invitationCode"}
+        SMTP_DOMAIN=mail.chn.moe
+        SMTP_USER_NAME=bot@chn.moe
+        SMTP_PASSWORD="${placeholder."mail/bot"}"
+        SMTP_SERVER=mail.chn.moe
+        SMTP_SSL=true
+        EMAIL_FROM_ADDRESS=bot@chn.moe
+        TIMEZONE=Beijing
+        DO_NOT_CREATE_DATABASE=true
+      '';
+      secrets = { "huginn/invitationCode" = {}; "mail/bot" = {}; };
+    };
+    nixos =
+    {
+      services =
      {
-        image = "huginn/huginn:5a1509b51188e0d16868be893c983d6fcfd232a5";
-        imageFile = inputs.pkgs.dockerTools.pullImage
+        nginx =
        {
-          imageName = "ghcr.io/huginn/huginn";
-          imageDigest = "sha256:6f7a5b41457b94490210221a8bd3aae32d4ebfc2652f97c14919aa8036d7294e";
-          sha256 = "1ha6c6bwdpdl98cwwxw5fan0j77ylgaziidqhnyh6anpzq35f540";
-          finalImageName = "huginn/huginn";
-          finalImageTag = "5a1509b51188e0d16868be893c983d6fcfd232a5";
-        };
-        ports = [ "127.0.0.1:3000:3000/tcp" ];
-        extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
-        environmentFiles = [ inputs.config.sops.templates."huginn/env".path ];
-      };
-      sops =
-      {
-        templates."huginn/env".content = let placeholder = inputs.config.sops.placeholder; in
-        ''
-          MYSQL_PORT_3306_TCP_ADDR=host.docker.internal
-          HUGINN_DATABASE_NAME=huginn
-          HUGINN_DATABASE_USERNAME=huginn
-          HUGINN_DATABASE_PASSWORD=${placeholder."mariadb/huginn"}
-          DOMAIN=${huginn.hostname}
-          RAILS_ENV=production
-          FORCE_SSL=true
-          INVITATION_CODE=${placeholder."huginn/invitationCode"}
-          SMTP_DOMAIN=mail.chn.moe
-          SMTP_USER_NAME=bot@chn.moe
-          SMTP_PASSWORD="${placeholder."mail/bot"}"
-          SMTP_SERVER=mail.chn.moe
-          SMTP_SSL=true
-          EMAIL_FROM_ADDRESS=bot@chn.moe
-          TIMEZONE=Beijing
-          DO_NOT_CREATE_DATABASE=true
-        '';
-        secrets = { "huginn/invitationCode" = {}; "mail/bot" = {}; };
-      };
-      nixos =
-      {
-        services =
-        {
-          nginx =
-          {
-            enable = true;
-            https."${huginn.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:3000"; websocket = true; };
-          };
-          mariadb.instances.huginn = {};
+          enable = true;
+          https.${huginn.hostname}.location."/".proxy = { upstream = "http://127.0.0.1:3000"; websocket = true; };
        };
+        mariadb.instances.huginn = {};
+        docker = {};
      };
    };
+  };
 }
--- a/modules/services/misskey.nix
+++ b/modules/services/misskey.nix
@@ -4,137 +4,131 @@ inputs:
  {
    type = types.attrsOf (types.submodule { options =
    {
-      autoStart = mkOption { type = types.bool; default = true; };
      port = mkOption { type = types.ints.unsigned; default = 9726; };
      redis.port = mkOption { type = types.ints.unsigned; default = 3545; };
      hostname = mkOption { type = types.nonEmptyStr; default = "misskey.chn.moe"; };
    };});
    default = {};
  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) misskey;
-      inherit (inputs.localLib) attrsToList;
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (builtins) map listToAttrs toString replaceStrings filter;
-    in
-    {
-      systemd = mkMerge (map
-        (instance:
-        {
-          services."misskey-${instance.name}" = rec
-          {
-            enable = instance.value.autoStart;
-            description = "misskey ${instance.name}";
-            after = [ "network.target" "redis-misskey-${instance.name}.service" "postgresql.service" ];
-            requires = after;
-            wantedBy = [ "multi-user.target" ];
-            environment.MISSKEY_CONFIG_YML = inputs.config.sops.templates."misskey/${instance.name}.yml".path;
-            serviceConfig = rec
-            {
-              User = inputs.config.users.users."misskey-${instance.name}".name;
-              Group = inputs.config.users.users."misskey-${instance.name}".group;
-              WorkingDirectory = "/var/lib/misskey/${instance.name}/work";
-              ExecStart = "${WorkingDirectory}/bin/misskey";
-              CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-              AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-              Restart = "always";
-            };
-          };
-          tmpfiles.rules = let dir = "/var/lib/misskey/${instance.name}/files"; owner = "misskey-${instance.name}"; in
-            [ "d ${dir} 0700 ${owner} ${owner}" "Z ${dir} - ${owner} ${owner}" ];
-        })
-        (attrsToList misskey.instances));
-      fileSystems = mkMerge (map
-        (instance:
-        {
-          "/var/lib/misskey/${instance.name}/work" =
-          {
-            device = "${inputs.pkgs.localPackages.misskey}";
-            options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
-          };
-          "/var/lib/misskey/${instance.name}/work/files" =
-          {
-            device = "/var/lib/misskey/${instance.name}/files";
-            options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
-          };
-        })
-        (attrsToList misskey.instances));
-      sops.templates = listToAttrs (map
-        (instance:
-        {
-          name = "misskey/${instance.name}.yml";
-          value =
-          {
-            content =
-              let
-                placeholder = inputs.config.sops.placeholder;
-                redis = inputs.config.nixos.services.redis.instances."misskey-${instance.name}";
-              in
-              ''
-                url: https://${instance.value.hostname}/
-                port: ${toString instance.value.port}
-                db:
-                  host: 127.0.0.1
-                  port: 5432
-                  db: misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}
-                  user: misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}
-                  pass: ${placeholder."postgresql/misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}"}
-                  extra:
-                    statement_timeout: 600000
-                dbReplications: false
-                redis:
-                  host: 127.0.0.1
-                  port: ${toString redis.port}
-                  pass: ${placeholder."redis/misskey-${instance.name}"}
-                id: 'aid'
-                proxyBypassHosts:
-                  - api.deepl.com
-                  - api-free.deepl.com
-                  - www.recaptcha.net
-                  - hcaptcha.com
-                  - challenges.cloudflare.com
-                proxyRemoteFiles: true
-                signToActivityPubGet: true
-                maxFileSize: 1073741824
-              '';
-            owner = inputs.config.users.users."misskey-${instance.name}".name;
-          };
-        })
-        (attrsToList misskey.instances));
-      users = mkMerge (map
-        (instance:
-        {
-          users."misskey-${instance.name}" =
-          {
-            uid = inputs.config.nixos.user.uid."misskey-${instance.name}";
-            group = "misskey-${instance.name}";
-            home = "/var/lib/misskey/${instance.name}";
-            createHome = true;
-            isSystemUser = true;
-          };
-          groups."misskey-${instance.name}".gid = inputs.config.nixos.user.gid."misskey-${instance.name}";
-        })
-        (attrsToList misskey.instances));
-      nixos.services =
+  config = let inherit (inputs.config.nixos.services) misskey; in
+  {
+    systemd = inputs.lib.mkMerge (builtins.map
+      (instance:
      {
-        redis.instances = listToAttrs (map
-          (instance: { name = "misskey-${instance.name}"; value.port = instance.value.redis.port; })
-          (attrsToList misskey.instances));
-        postgresql.instances = listToAttrs (map
-          (instance: { name = "misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}"; value = {}; })
-          (attrsToList misskey.instances));
-        nginx =
+        services."misskey-${instance.name}" = rec
        {
-          enable = mkIf (misskey.instances != {}) true;
-          https = listToAttrs (map
-            (instance: with instance.value;
-            {
-              name = hostname;
-              value.location."/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
-            })
-            (attrsToList misskey.instances));
+          description = "misskey ${instance.name}";
+          after = [ "network.target" "redis-misskey-${instance.name}.service" "postgresql.service" ];
+          requires = after;
+          wantedBy = [ "multi-user.target" ];
+          environment.MISSKEY_CONFIG_YML = inputs.config.sops.templates."misskey/${instance.name}.yml".path;
+          serviceConfig = rec
+          {
+            User = "misskey-${instance.name}";
+            Group = "misskey-${instance.name}";
+            WorkingDirectory = "/var/lib/misskey/${instance.name}/work";
+            ExecStart = "${WorkingDirectory}/bin/misskey";
+            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+            Restart = "always";
+          };
        };
+        tmpfiles.rules = let dir = "/var/lib/misskey/${instance.name}/files"; owner = "misskey-${instance.name}"; in
+          [ "d ${dir} 0700 ${owner} ${owner}" "Z ${dir} - ${owner} ${owner}" ];
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    fileSystems = inputs.lib.mkMerge (builtins.map
+      (instance:
+      {
+        "/var/lib/misskey/${instance.name}/work" =
+        {
+          device = "${inputs.pkgs.localPackages.misskey}";
+          options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
+        };
+        "/var/lib/misskey/${instance.name}/work/files" =
+        {
+          device = "/var/lib/misskey/${instance.name}/files";
+          options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
+        };
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    sops.templates = builtins.listToAttrs (builtins.map
+      (instance:
+      {
+        name = "misskey/${instance.name}.yml";
+        value =
+        {
+          content =
+            let
+              placeholder = inputs.config.sops.placeholder;
+              redis = inputs.config.nixos.services.redis.instances."misskey-${instance.name}";
+            in
+            ''
+              url: https://${instance.value.hostname}/
+              port: ${toString instance.value.port}
+              db:
+                host: 127.0.0.1
+                port: 5432
+                db: misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}
+                user: misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}
+                pass: ${placeholder."postgresql/misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}"}
+                extra:
+                  statement_timeout: 600000
+              dbReplications: false
+              redis:
+                host: 127.0.0.1
+                port: ${builtins.toString redis.port}
+                pass: ${placeholder."redis/misskey-${instance.name}"}
+              id: 'aid'
+              proxyBypassHosts:
+                - api.deepl.com
+                - api-free.deepl.com
+                - www.recaptcha.net
+                - hcaptcha.com
+                - challenges.cloudflare.com
+              proxyRemoteFiles: true
+              signToActivityPubGet: true
+              maxFileSize: 1073741824
+              fulltextSearch:
+                provider: sqlPgroonga
+            '';
+          owner = "misskey-${instance.name}";
+        };
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    users = inputs.lib.mkMerge (builtins.map
+      (instance:
+      {
+        users."misskey-${instance.name}" =
+        {
+          uid = inputs.config.nixos.user.uid."misskey-${instance.name}";
+          group = "misskey-${instance.name}";
+          home = "/var/lib/misskey/${instance.name}";
+          createHome = true;
+          isSystemUser = true;
+        };
+        groups."misskey-${instance.name}".gid = inputs.config.nixos.user.gid."misskey-${instance.name}";
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    nixos.services =
+    {
+      redis.instances = builtins.listToAttrs (builtins.map
+        (instance: { name = "misskey-${instance.name}"; value.port = instance.value.redis.port; })
+        (inputs.localLib.attrsToList misskey.instances));
+      postgresql.instances = builtins.listToAttrs (builtins.map
+        (instance: { name = "misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}"; value = {}; })
+        (inputs.localLib.attrsToList misskey.instances));
+      nginx =
+      {
+        enable = inputs.lib.mkIf (misskey.instances != {}) true;
+        https = builtins.listToAttrs (builtins.map
+          (instance: with instance.value;
+          {
+            name = hostname;
+            value.location."/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
+          })
+          (inputs.localLib.attrsToList misskey.instances));
      };
    };
+  };
 }
--- a/modules/services/nginx/applications/blog.nix
+++ b/modules/services/nginx/applications/blog.nix
@@ -8,6 +8,6 @@ inputs:
  config = let inherit (inputs.config.nixos.services.nginx.applications) blog; in inputs.lib.mkIf (blog != null)
    {
      nixos.services.nginx.https."blog.chn.moe".location."/".static =
-        { root = builtins.toString inputs.topInputs.self.packages.x86_64-linux.blog; index = [ "index.html" ]; };
+        { root = "${inputs.pkgs.localPackages.blog}"; index = [ "index.html" ]; };
    };
 }
--- a/modules/services/nginx/applications/sticker/web/packs/LINE_nachonekodayo.json
+++ b/modules/services/nginx/applications/sticker/web/packs/LINE_nachonekodayo.json
--- a/modules/services/nginx/applications/sticker/web/packs/TheDonaldTrump.json
+++ b/modules/services/nginx/applications/sticker/web/packs/TheDonaldTrump.json
--- a/modules/services/nginx/applications/sticker/web/packs/csaexi.json
+++ b/modules/services/nginx/applications/sticker/web/packs/csaexi.json
--- a/modules/services/nginx/applications/sticker/web/packs/index.json
+++ b/modules/services/nginx/applications/sticker/web/packs/index.json
@@ -2,7 +2,18 @@
  "packs": [
    "Mare_by_WuMingv2Bot.json",
    "line_191054124446_by_moe_sticker_bot.json",
-    "Sakurada_Shiro.json"
+    "Sakurada_Shiro.json",
+    "loli_DaiSi_by_WuMingv2Bot.json",
+    "listentoweiwei_by_WuMingv2Bot.json",
+    "csaexi.json",
+    "wechat_transfer_zhcn.json",
+    "teamtimothy_bilibili.json",
+    "line26158619ac0d_by_moe_sticker_bot.json",
+    "LINE_nachonekodayo.json",
+    "zhehelima.json",
+    "TheDonaldTrump.json",
+    "line_173195293297_by_moe_sticker_bot.json",
+    "line261586194a0d_by_moe_sticker_bot.json"
  ],
  "homeserver_url": "https://matrix.chn.moe"
 }
--- a/modules/services/nginx/applications/sticker/web/packs/line261586194a0d_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line261586194a0d_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/line26158619ac0d_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line26158619ac0d_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/line_173195293297_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line_173195293297_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/listentoweiwei_by_WuMingv2Bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/listentoweiwei_by_WuMingv2Bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/loli_DaiSi_by_WuMingv2Bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/loli_DaiSi_by_WuMingv2Bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/teamtimothy_bilibili.json
+++ b/modules/services/nginx/applications/sticker/web/packs/teamtimothy_bilibili.json
--- a/modules/services/nginx/applications/sticker/web/packs/wechat_transfer_zhcn.json
+++ b/modules/services/nginx/applications/sticker/web/packs/wechat_transfer_zhcn.json
--- a/modules/services/nginx/applications/sticker/web/packs/zhehelima.json
+++ b/modules/services/nginx/applications/sticker/web/packs/zhehelima.json
--- a/modules/services/ollama.nix
+++ b/modules/services/ollama.nix
@@ -6,10 +6,8 @@ inputs:
  {
    services =
    {
-      ollama.enable = true;
-      open-webui =
-        { enable = true; package = inputs.pkgs.genericPackages.open-webui; environment.WEBUI_AUTH = "False"; };
-      nextjs-ollama-llm-ui.enable = true;
+      ollama = { enable = true; package = inputs.pkgs.pkgs-unstable.ollama; };
+      open-webui = { enable = true; environment.WEBUI_AUTH = "False"; package = inputs.pkgs.pkgs-unstable.open-webui; };
    };
    nixos.packages.packages._packages = [ inputs.pkgs.oterm ];
  };
--- a/modules/services/postgresql.nix
+++ b/modules/services/postgresql.nix
@@ -22,7 +22,8 @@ inputs:
      postgresql =
      {
        enable = true;
-        package = inputs.pkgs.postgresql_15;
+        package = inputs.pkgs.postgresql_17;
+        extensions = ps: with ps; [ pgroonga ];
        enableTCPIP = true;
        authentication = "host all all 0.0.0.0/0 md5";
        settings =
--- a/modules/services/rsshub.nix
+++ b/modules/services/rsshub.nix
@@ -1,82 +1,73 @@
 inputs:
 {
-  options.nixos.services.rsshub = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.rsshub = let inherit (inputs.lib) mkOption types; in mkOption
  {
-    enable = mkOption { type = types.bool; default = false; };
-    port = mkOption { type = types.ints.unsigned; default = 5221; };
-    hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) rsshub;
-      inherit (inputs.lib) mkIf;
-      inherit (builtins) map listToAttrs toString;
-    in mkIf rsshub.enable
+    type = types.nullOr (types.submodule { options =
    {
-      systemd =
+      hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) rsshub; in inputs.lib.mkIf (rsshub != null)
+  {
+    systemd =
+    {
+      services.rsshub =
      {
-        services.rsshub =
+        description = "rsshub";
+        after = [ "network.target" "redis-rsshub.service" ];
+        requires = [ "redis-rsshub.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig =
        {
-          description = "rsshub";
-          after = [ "network.target" "redis-rsshub.service" ];
-          requires = [ "redis-rsshub.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig =
-          {
-            User = inputs.config.users.users.rsshub.name;
-            Group = inputs.config.users.users.rsshub.group;
-            EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
-            WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
-            ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
-            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-          };
-          restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
-        };
-        tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
-      };
-      sops =
-      {
-        templates."rsshub/env".content =
-          let
-            placeholder = inputs.config.sops.placeholder;
-            redis = inputs.config.nixos.services.redis.instances.rsshub;
-          in
-          ''
-            PORT=${toString rsshub.port}
-            CACHE_TYPE=redis
-            REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:${toString redis.port}'
-            PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
-            YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
-            YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
-            YOUTUBE_CLIENT_SECRET='${placeholder."rsshub/youtube-client-secret"}'
-            YOUTUBE_REFRESH_TOKEN='${placeholder."rsshub/youtube-refresh-token"}'
-            TWITTER_AUTH_TOKEN='${placeholder."rsshub/twitter-auth-token"}'
-            XDG_CONFIG_HOME='/var/cache/rsshub/chromium'
-            XDG_CACHE_HOME='/var/cache/rsshub/chromium'
-            BILIBILI_COOKIE_data0='${placeholder."rsshub/bilibili-cookie"}'
-          '';
-        secrets = (listToAttrs (map (secret: { name = "rsshub/${secret}"; value = {}; })
-        [
-          "pixiv-refreshtoken"
-          "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
-          "twitter-auth-token"
-          "bilibili-cookie"
-        ]));
-      };
-      users =
-      {
-        users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
-        groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
-      };
-      nixos.services =
-      {
-        redis.instances.rsshub.port = 7116;
-        nginx =
-        {
-          enable = true;
-          https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:${toString rsshub.port}";
+          User = "rsshub";
+          Group = "rsshub";
+          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
+          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
+          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
        };
+        restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
      };
+      tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
    };
+    sops =
+    {
+      templates."rsshub/env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        PORT=5221
+        CACHE_TYPE=redis
+        REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:7116'
+        PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
+        YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
+        YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
+        YOUTUBE_CLIENT_SECRET='${placeholder."rsshub/youtube-client-secret"}'
+        YOUTUBE_REFRESH_TOKEN='${placeholder."rsshub/youtube-refresh-token"}'
+        TWITTER_AUTH_TOKEN='${placeholder."rsshub/twitter-auth-token"}'
+        ZHIHU_COOKIES='${placeholder."rsshub/zhihu-cookies"}'
+        XDG_CONFIG_HOME='/var/cache/rsshub/chromium'
+        XDG_CACHE_HOME='/var/cache/rsshub/chromium'
+        BILIBILI_COOKIE_data0='${placeholder."rsshub/bilibili-cookie"}'
+      '';
+      secrets = (builtins.listToAttrs (builtins.map (secret: { name = "rsshub/${secret}"; value = {}; })
+      [
+        "pixiv-refreshtoken"
+        "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
+        "twitter-auth-token"
+        "bilibili-cookie"
+        "zhihu-cookies"
+      ]));
+    };
+    users =
+    {
+      users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
+      groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
+    };
+    nixos.services =
+    {
+      redis.instances.rsshub.port = 7116;
+      nginx = { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
+    };
+  };
 }
--- a/modules/services/send.nix
+++ b/modules/services/send.nix
@@ -29,7 +29,7 @@ inputs:
      nginx =
      {
        enable = true;
-        https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
+        https.${send.hostname}.location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
      };
      redis.instances.send = { user = "root"; port = 9184; };
    };
--- a/modules/services/slurm.nix
+++ b/modules/services/slurm.nix
@@ -51,8 +51,8 @@ inputs:
              let
                inherit (inputs.config.nixos.system.nixpkgs) cuda;
                inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev;
-                additionalInputs = inputs.lib.optionals cuda.enable [ cuda_nvml_dev cuda_nvml_dev.lib ];
-                additionalFlags = inputs.lib.optional cuda.enable "-L${cuda_nvml_dev.lib}/lib/stubs";
+                additionalInputs = inputs.lib.optionals (cuda != null) [ cuda_nvml_dev cuda_nvml_dev.lib ];
+                additionalFlags = inputs.lib.optional (cuda != null) "-L${cuda_nvml_dev.lib}/lib/stubs";
              in
              {
                buildInputs = prev.buildInputs or [] ++ additionalInputs;
@@ -201,22 +201,56 @@ inputs:
            StorageLoc=slurm
          '';
        };
+        extraConfig =
+          ''
+            PrologSlurmctld=${inputs.config.security.wrapperDir}/slurm-info
+            EpilogSlurmctld=${inputs.config.security.wrapperDir}/slurm-info
+          '';
+      };
+      systemd =
+      {
+        services.slurmctld.after = [ "suid-sgid-wrappers.service" ];
+        tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
+      };
+      sops =
+      {
+        secrets = { "slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; }; }
+          // builtins.listToAttrs (builtins.map (n: { name = "telegram/${n}"; value = {}; })
+            [ "token" "user/chn" "user/hjp" ]);
+        templates."info.yaml" =
+        {
+          owner = "slurm";
+          content = let inherit (inputs.config.sops) placeholder; in builtins.toJSON
+          {
+            token = placeholder."telegram/token";
+            user =  builtins.listToAttrs (builtins.map (n: { name = n; value = placeholder."telegram/user/${n}"; })
+              [ "chn" "hjp" ]);
+            slurmConf = "${inputs.config.services.slurm.etcSlurm}/slurm.conf";
+          };
+        };
+      };
+      security.wrappers.info =
+      {
+        source =
+          let info = inputs.pkgs.localPackages.info.override
+          {
+            slurm = inputs.config.services.slurm.package;
+            configFile = inputs.config.sops.templates."info.yaml".path;
+          };
+          in "${info}/bin/info";
+        program = "slurm-info";
+        owner = "slurm";
+        group = "slurm";
+        permissions = "544";
+        capabilities = "cap_setuid,cap_setgid+ep";
      };
-      systemd.tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
-      sops.secrets."slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
      nixos =
      {
        packages.packages._packages = [ inputs.pkgs.localPackages.sbatch-tui ];
        user.sharedModules = [{ home.packages =
        [
          (inputs.pkgs.writeShellScriptBin "sbatch"
-          ''
-            if [ "$#" -eq 0 ]; then
-              sbatch-tui
-            else
-              /run/current-system/sw/bin/sbatch "$@"
-            fi
-          '')
+            ''if [ "$#" -eq 0 ]; then sbatch-tui; else /run/current-system/sw/bin/sbatch "$@"; fi'')
        ];}];
        services.mariadb = { enable = true; instances.slurm = {}; };
      };
--- a/modules/services/sshd/banner.txt
+++ b/modules/services/sshd/banner.txt
@@ -1,10 +1,10 @@
-                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓███████▓▒░  
+                       ░▒▓█▓▒░      ░▒▓█▓▒░▒▓███████▓▒░  
+                      ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                     ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                    ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
                  ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-                 ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-                ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-               ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-              ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-             ░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
+                 ░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░

      ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░  
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
--- a/modules/services/synapse.nix
+++ b/modules/services/synapse.nix
@@ -195,6 +195,8 @@ inputs:
                ];
                max_image_pixels = "32M";
                dynamic_thumbnails = false;
+                # this is required for displaying thumbnails in sticker widgets
+                enable_authenticated_media = false;
              });
          };
          secrets = (listToAttrs (map
--- a/modules/services/wechat2tg.nix
+++ b/modules/services/wechat2tg.nix
@@ -44,5 +44,6 @@ inputs:
      '';
      secrets."wechat2tg/token" = {};
    };
+    nixos.services.docker = {};
  };
 }
--- a/modules/services/wireguard.nix
+++ b/modules/services/wireguard.nix
@@ -1,91 +1,58 @@
 inputs:
 {
-  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in mkOption
  {
-    enable = mkOption { type = types.bool; default = false; };
-    # wg genkey | wg pubkey
-    publicKey = mkOption { type = types.nonEmptyStr; };
-    lighthouse = mkOption { type = types.bool; default = false; };
-    behindNat = mkOption
-    {
-      type = types.bool;
-      default = inputs.config.nixos.services.xray.client.enable;
-    };
-    listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
-    # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
-    listenPort = mkOption
-    {
-      type = types.ints.unsigned;
-      default = if inputs.config.nixos.services.wireguard.behindNat then 51821 else 51820;
-    };
-    wireguardIp = mkOption { type = types.nonEmptyStr; };
-    peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
+    type = types.nullOr (types.submodule (submoduleInputs: { options =
+      let generalOption =
+      {
+        publicKey = mkOption { type = types.nonEmptyStr; };
+        lighthouse = mkOption { type = types.bool; default = false; };
+        behindNat = mkOption { type = types.bool; default = false; };
+        listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+        wireguardIp = mkOption { type = types.nonEmptyStr; };
+      };
+      in generalOption
+        // { peers = mkOption { type = types.nonEmptyListOf (types.submodule { options = generalOption; }); }; };
+    }));
+    default = null;
  };
-  config =
-    let
-      inherit (inputs.lib) mkIf mkMerge;
-      inherit (inputs.config.nixos.services) wireguard;
-      inherit (builtins) map toString listToAttrs filter;
-    in mkIf wireguard.enable (mkMerge
+  config = let inherit (inputs.config.nixos.services) wireguard; in inputs.lib.mkIf (wireguard != null)
+  {
+    assertions =
    [
      {
-        assertions =
-        [{
-          assertion = !wireguard.behindNat -> wireguard.listenIp != null;
-          message = "wireguard.listenIp should be not null when behindNat is false.";
-        }];
+        assertion = !wireguard.behindNat -> wireguard.listenIp != null;
+        message = "wireguard.listenIp should not be null when behindNat is false.";
      }
      {
-        networking =
-        {
-          firewall =
-          {
-            allowedUDPPorts = inputs.lib.mkIf (!wireguard.behindNat) [ wireguard.listenPort ];
-            trustedInterfaces = [ "wireguard" ];
-          };
-          wireguard.interfaces.wireguard =
-          {
-            ips = [ "${wireguard.wireguardIp}/24" ];
-            inherit (wireguard) listenPort;
-            privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
-            peers = map
-              (peer:
-              {
-                publicKey = peer.publicKey;
-                allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
-                endpoint = mkIf (!peer.behindNat) "${peer.listenIp}:${builtins.toString peer.listenPort}";
-                persistentKeepalive = mkIf peer.lighthouse 5;
-              })
-              (map
-                (peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
-                wireguard.peers);
-          };
-        };
-        sops.secrets."wireguard/privateKey" = {};
-        # somehow fix wireguard connection
-        systemd.services = mkIf wireguard.behindNat (listToAttrs (map
+        assertion = inputs.config.nixos.services.xray.client.enable -> wireguard.behindNat;
+        message = "Wireguard is behind NAT when xray client is enabled.";
+      }
+    ];
+    networking =
+    {
+      firewall =
+      {
+        allowedUDPPorts = inputs.lib.mkIf (!wireguard.behindNat) [ 51820 ];
+        trustedInterfaces = [ "wireguard" ];
+      };
+      wireguard.interfaces.wireguard =
+      {
+        ips = [ "${wireguard.wireguardIp}/24" ];
+        # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
+        listenPort = inputs.localLib.mkConditional wireguard.behindNat 51821 51820;
+        privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
+        peers = builtins.map
          (peer:
          {
-            name = "wireguard-ping-${peer.name}";
-            value =
-            {
-              description = "ping ${peer.name}";
-              after = [ "network.target" ];
-              wantedBy = [ "multi-user.target" ];
-              serviceConfig =
-              {
-                ExecStart = "${inputs.pkgs.iputils}/bin/ping -i 5 ${peer.value.wireguardIp}";
-                Restart = "always";
-              };
-            };
+            inherit (peer) publicKey;
+            allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
+            endpoint = inputs.lib.mkIf (!peer.behindNat) "${peer.listenIp}:51820";
+            persistentKeepalive = inputs.lib.mkIf peer.lighthouse 5;
          })
-          (filter (peer: !peer.value.behindNat) (map
-            (peer:
-            {
-              name = peer;
-              value = inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard;
-            })
-            wireguard.peers))));
-      }
-    ]);
+          wireguard.peers;
+      };
+    };
+    sops.secrets."wireguard/privateKey" = {};
+  };
 }
--- a/modules/services/xray.nix
+++ b/modules/services/xray.nix
@@ -458,7 +458,7 @@ inputs:
            (map (n: { name = "xray-server/clients/user${toString n}"; value = {}; }) userList)
            // (builtins.listToAttrs (map
              (name: { name = "telegram/${name}"; value = { group = "telegram"; mode = "0440"; }; })
-              [ "token" "chat" ]))
+              [ "token" "user/chn" ]))
            // { "xray-server/private-key" = {}; };
        };
        systemd =
@@ -490,7 +490,7 @@ inputs:
                  sed = "${inputs.pkgs.gnused}/bin/sed";
                  cat = "${inputs.pkgs.coreutils}/bin/cat";
                  token = inputs.config.sops.secrets."telegram/token".path;
-                  chat = inputs.config.sops.secrets."telegram/chat".path;
+                  chat = inputs.config.sops.secrets."telegram/user/chn".path;
                in
                ''
                  message='${inputs.config.nixos.model.hostname} xray:\n'
@@ -539,8 +539,8 @@ inputs:
          nginx =
          {
            enable = true;
-            transparentProxy.map."${xray.server.serverName}" = 4726;
-            https."${xray.server.serverName}" =
+            transparentProxy.map.${xray.server.serverName} = 4726;
+            https.${xray.server.serverName} =
            {
              listen.main = { proxyProtocol = false; addToTransparentProxy = false; };
              location."/".return.return = "400";
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -16,6 +16,15 @@ inputs:
    {
      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
      # consoleLogLevel = 7;
+      plymouth =
+      {
+        enable = true;
+        theme = "mac-style";
+        themePackages = [(inputs.pkgs.callPackage inputs.topInputs.mac-style {})];
+      };
+      kernelParams = inputs.lib.mkIf
+        (builtins.elem inputs.config.nixos.system.grub.installDevice [ "efi" "efiRemovable" ])
+        [ "plymouth.use-simpledrm" ];
    };
    hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
    environment =
--- a/modules/system/fileSystems/cluster.nix
+++ b/modules/system/fileSystems/cluster.nix
@@ -7,11 +7,7 @@ inputs:
      { nixos.services.nfs = { root = "/"; exports = [ "/nix/persistent/home" ]; accessLimit = "192.168.178.0/24"; }; })
    # for cluster worker, mount nfs, disable some home manager files
    (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "worker")
-    {
-      nixos.system.fileSystems.mount.nfs = builtins.listToAttrs (builtins.map
-        (user: { name = "192.168.178.1:/nix/persistent/home/${user}"; value = "/home/${user}"; })
-        inputs.config.nixos.user.users);
-    })
+      { nixos.system.fileSystems.mount.nfs."192.168.178.1:/nix/persistent/home" = "/remote/home"; })
    # 将一部分由 home-manager 生成软链接的文件改为直接挂载，以兼容集群的设置
    {
      home-manager.users = builtins.listToAttrs (builtins.map
@@ -23,21 +19,18 @@ inputs:
            [ ".zshrc" ".zshenv" ".profile" ".bashrc" ".bash_profile" ".zlogin" ]);
        })
        inputs.config.nixos.user.users);
-      systemd.mounts = builtins.filter (mount: mount != null) (builtins.concatLists (builtins.map
+      systemd.mounts = builtins.concatLists (builtins.map
        (user: builtins.map
          (file:
-            let f = inputs.config.home-manager.users.${user}.config.home.file.${file}.source or null;
-            in if f == null then null else
-            {
-              what = "${f}";
-              where = "/home/${user}/${file}";
-              options = [ "bind" ];
-              wantedBy = [ "local-fs.target" ];
-            }
-          )
+          {
+            what = "${inputs.config.home-manager.users.${user}.home.file.${file}.source}";
+            where = "/home/${user}/${file}";
+            options = "bind";
+            wantedBy = [ "local-fs.target" ];
+          })
          [ ".zshrc" ".zshenv" ".profile" ".bashrc" ".bash_profile" ".zlogin" ]
        )
-        inputs.config.nixos.user.users));
+        inputs.config.nixos.user.users);
    }
  ];
 }
--- a/modules/system/fileSystems/impermanence.nix
+++ b/modules/system/fileSystems/impermanence.nix
@@ -33,16 +33,19 @@ inputs:
      };
    }
    # 挂载 /home/user
-    # 对于集群的工作节点，不做任何事情，这些目录已经挂载好
+    # 对于集群的工作节点，挂载 /remote/user 到 /home/user
    # 对于桌面用途的 chn，不需要挂载
    # 对于其它情况，则挂载 /nix/persistent/home/user 到 /home/user
    {
-      "/nix/persistent".directories = builtins.map
-        (user: { directory = "/home/${user}"; inherit user; group = user; mode = "0700"; })
-        (builtins.filter
-          (user: !(user == "chn" && inputs.config.nixos.model.type == "desktop"
-            || inputs.config.nixos.model.cluster.nodeType or null == "worker"))
-          inputs.config.nixos.user.users);
+      "${if inputs.config.nixos.model.cluster.nodeType or null == "worker" then "/remote" else "/nix/persistent"}" =
+      {
+        hideMounts = true;
+        directories = builtins.map
+          (user: { directory = "/home/${user}"; inherit user; group = user; mode = "0700"; })
+          (builtins.filter
+            (user: !(user == "chn" && inputs.config.nixos.model.type == "desktop"))
+            inputs.config.nixos.user.users);
+      };
    }
    # 挂载更详细的目录
    # 对于任何情况，`.cache` 都应该在重启后丢失
@@ -52,7 +55,7 @@ inputs:
        inputs.config.nixos.user.users);
    }
    # 对于桌面用途的 chn，有一些需要 persist 的目录
-    (inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop" && builtins.elem "chn" inputs.config.nixos.user.users)
+    (inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
    {
      "/nix/persistent".users.chn.directories =
      [
--- a/modules/system/fileSystems/luks/default.nix
+++ b/modules/system/fileSystems/luks/default.nix
@@ -12,19 +12,14 @@ inputs:
      };});
      default = {};
    };
-    manual =
+    manual = mkOption
    {
-      enable = mkOption { type = types.bool; default = false; };
-      devices = mkOption
+      type = types.nullOr (types.attrsOf (types.submodule { options =
      {
-        type = types.attrsOf (types.submodule { options =
-        {
-          mapper = mkOption { type = types.nonEmptyStr; };
-          ssd = mkOption { type = types.bool; default = false; };
-        };});
-        default = {};
-      };
-      delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+        mapper = mkOption { type = types.nonEmptyStr; };
+        ssd = mkOption { type = types.bool; default = false; };
+      };}));
+      default = null;
    };
  };
  config = let inherit (inputs.config.nixos.system.fileSystems) luks; in inputs.lib.mkMerge
@@ -56,7 +51,7 @@ inputs:
        })
        (builtins.filter (device: device.value.before != null) (inputs.localLib.attrsToList luks.auto)));
    };})
-    (inputs.lib.mkIf luks.manual.enable
+    (inputs.lib.mkIf (luks.manual != null)
    {
      boot.initrd =
      {
@@ -71,7 +66,7 @@ inputs:
            serviceConfig.Type = "oneshot";
            script = builtins.concatStringsSep "\n" (builtins.map
              (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
-              (inputs.localLib.attrsToList luks.manual.devices));
+              (inputs.localLib.attrsToList luks.manual));
          };
          extraBin.cryptsetup = "${inputs.pkgs.cryptsetup}/bin/cryptsetup";
        };
--- a/modules/system/fileSystems/luks/vps4.key
+++ b/modules/system/fileSystems/luks/vps4.key
--- a/modules/system/grub.nix
+++ b/modules/system/grub.nix
@@ -2,7 +2,7 @@ inputs:
 {
  options.nixos.system.grub = let inherit (inputs.lib) mkOption types; in
  {
-    timeout = mkOption { type = types.int; default = if inputs.config.nixos.model.type == "server" then 15 else 5; };
+    timeout = mkOption { type = types.int; default = 15; };
    windowsEntries = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
    # "efi" using efi, "efiRemovable" using efi with install grub removable, or dev path like "/dev/sda" using bios
    installDevice = mkOption { type = types.str; default = "efi"; };
@@ -30,7 +30,7 @@ inputs:
    {
      boot.loader.grub =
      {
-        memtest86.enable = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") true;
+        memtest86.enable = true;
        extraFiles = inputs.lib.mkIf (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
          { "shell.efi" = "${inputs.pkgs.genericPackages.edk2-uefi-shell}/shell.efi"; };
        extraEntries = inputs.lib.mkMerge (builtins.concatLists
--- a/modules/system/gui.nix
+++ b/modules/system/gui.nix
@@ -20,6 +20,7 @@ inputs:
        sessionVariables.GTK_USE_PORTAL = "1";
        persistence."/nix/rootfs/current".directories =
          [{ directory = "/var/lib/sddm"; user = "sddm"; group = "sddm"; mode = "0700"; }];
+        systemPackages = with inputs.pkgs; [ waybar ];
      };
      xdg.portal.extraPortals = builtins.map (p: inputs.pkgs."xdg-desktop-portal-${p}") [ "gtk" "wlr" ];
      i18n.inputMethod =
@@ -29,7 +30,17 @@ inputs:
        fcitx5.addons = builtins.map (p: inputs.pkgs."fcitx5-${p}")
          [ "rime" "chinese-addons" "mozc" "nord" "material-color" ];
      };
-      programs.dconf.enable = true;
+      programs =
+      {
+        dconf.enable = true;
+        hyprland = { enable = true; withUWSM = true; };
+        # waybar should not be pull in by graphical-session.target
+        waybar.enable = false;
+        iio-hyprland.enable = true;
+        hyprlock.enable = true;
+        uwsm.enable = true;
+      };
+      
    })
    # prefer gui or not
    (inputs.localLib.mkConditional (builtins.elem inputs.config.nixos.model.type [ "desktop" ])
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -35,9 +35,7 @@ inputs:
          # network for srv2
          "e1000e" "igb" "atlantic" "igc"
        ]
-        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ])
-        # for pi3b to show message over hdmi while boot
-        ++ (inputs.lib.optionals (kernel.variant == "nixos") [ "vc4" "bcm2835_dma" "i2c_bcm2835" ]);
+          ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
        extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
        extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
        kernelParams = [ "delayacct" ];
@@ -49,7 +47,6 @@ inputs:
          cachyos = inputs.pkgs.linuxPackages_cachyos;
          cachyos-lto = inputs.pkgs.linuxPackages_cachyos-lto;
          cachyos-server = inputs.pkgs.linuxPackages_cachyos-server;
-          rpi3 = inputs.pkgs.linuxPackages_rpi3;
          zen = inputs.pkgs.linuxPackages_zen;
        }.${kernel.variant};
        kernelPatches =
@@ -87,14 +84,10 @@ inputs:
          in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
      };
    }
-    (
-      inputs.lib.mkIf (kernel.variant == "rpi3")
-        { boot.initrd = { systemd.enableTpm2 = false; includeDefaultModules = false; }; }
-    )
    # enable scx when using cachyos
-    # (
-    #   inputs.lib.mkIf (builtins.elem kernel.variant [ "cachyos" "cachyos-lto" "cachyos-server" ])
-    #     { services.scx = { enable = true; scheduler = "scx_lavd"; extraArgs = [ "--autopower" ]; }; }
-    # )
+    (
+      inputs.lib.mkIf (builtins.elem kernel.variant [ "cachyos" "cachyos-lto" "cachyos-server" ])
+        { services.scx = { enable = true; scheduler = "scx_lavd"; extraArgs = [ "--autopower" ]; }; }
+    )
  ];
 }
--- a/modules/system/nixpkgs.nix
+++ b/modules/system/nixpkgs.nix
@@ -1,114 +0,0 @@
-inputs:
-{
-  options.nixos.system.nixpkgs = let inherit (inputs.lib) mkOption types; in
-  {
-    arch = mkOption { type = types.enum [ "x86_64" "aarch64" ]; default = "x86_64"; };
-    march = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
-    cuda =
-    {
-      enable = mkOption { type = types.bool; default = false; };
-      capabilities = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
-      forwardCompat = mkOption { type = types.nullOr types.bool; default = null; };
-    };
-  };
-  config =
-    let
-      inherit (builtins) map listToAttrs filter tryEval attrNames concatStringsSep toString;
-      inherit (inputs.lib) mkIf mkMerge;
-      inherit (inputs.lib.strings) hasPrefix splitString;
-      inherit (inputs.localLib) mkConditional attrsToList;
-      inherit (inputs.config.nixos.system) nixpkgs;
-    in
-    {
-      nixpkgs =
-        let
-          hostPlatform = if nixpkgs.march != null
-            then { system = "${nixpkgs.arch}-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
-            else "${nixpkgs.arch}-linux";
-          cudaConfig = inputs.lib.optionalAttrs nixpkgs.cuda.enable
-          (
-            { cudaSupport = true; }
-            // (inputs.lib.optionalAttrs (nixpkgs.cuda.capabilities != null)
-              { cudaCapabilities = nixpkgs.cuda.capabilities; })
-            // (inputs.lib.optionalAttrs (nixpkgs.cuda.forwardCompat != null)
-              { cudaForwardCompat = nixpkgs.cuda.forwardCompat; })
-          );
-          allowInsecurePredicate = p: inputs.lib.warn
-            "Allowing insecure package ${p.name or "${p.pname}-${p.version}"}" true;
-        in
-        {
-          inherit hostPlatform;
-          config = cudaConfig //
-          {
-            inherit allowInsecurePredicate;
-            allowUnfree = true;
-            qchem-config = { optArch = nixpkgs.march; useCuda = nixpkgs.cuda.enable; };
-            android_sdk.accept_license = true;
-          }
-          // (if nixpkgs.march == null then {} else
-          {
-            # TODO: change znver4 after update oneapi
-            # TODO: test znver3 do use AVX
-            oneapiArch = let match = {};
-              in match.${nixpkgs.march} or nixpkgs.march;
-            nvhpcArch = nixpkgs.march;
-            # contentAddressedByDefault = true;
-            enableCcache = true;
-          });
-          overlays =
-          [(final: prev:
-            let
-              inherit (final) system;
-              genericPackages = import inputs.topInputs.nixpkgs
-              {
-                inherit system;
-                config = { allowUnfree = true; inherit allowInsecurePredicate; };
-              };
-            in
-              { inherit genericPackages; }
-              // (
-                let
-                  source =
-                  {
-                    "pkgs-23.11" = "nixpkgs-23.11";
-                    "pkgs-23.05" = "nixpkgs-23.05";
-                  };
-                  packages = name: import inputs.topInputs.${source.${name}}
-                  {
-                    localSystem = hostPlatform;
-                    config = cudaConfig //
-                    {
-                      allowUnfree = true;
-                      # contentAddressedByDefault = true;
-                      inherit allowInsecurePredicate;
-                    };
-                  };
-                in builtins.listToAttrs (map
-                  (name: { inherit name; value = packages name; }) (builtins.attrNames source))
-              )
-              // (
-                inputs.lib.optionalAttrs (nixpkgs.march != null)
-                {
-                  # -march=xxx cause embree build failed
-                  # https://github.com/embree/embree/issues/115
-                  embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
-                }
-              )
-          )];
-        };
-      programs.ccache = { enable = true; cacheDir = "/var/lib/ccache"; };
-      nix.settings.extra-sandbox-paths = [ inputs.config.programs.ccache.cacheDir ];
-      boot.kernelPatches = mkIf (nixpkgs.march != null && inputs.config.nixos.system.kernel.variant != "steamos")
-      [{
-        name = "native kernel";
-        patch = null;
-        extraStructuredConfig =
-          let kernelConfig = { znver2 = "MZEN2"; znver3 = "MZEN3"; znver4 = "MZEN4"; };
-          in
-          {
-            GENERIC_CPU = inputs.lib.kernel.no;
-            ${kernelConfig.${nixpkgs.march} or "M${inputs.lib.toUpper nixpkgs.march}"} = inputs.lib.kernel.yes;
-          };
-      }];
-    };
-}
--- a/modules/system/nixpkgs/default.nix
+++ b/modules/system/nixpkgs/default.nix
@@ -0,0 +1,130 @@
+inputs:
+{
+  options.nixos.system.nixpkgs = let inherit (inputs.lib) mkOption types; in
+  {
+    march = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+    cuda = mkOption
+    {
+      type = types.nullOr (types.submodule { options =
+      {
+        capabilities = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
+        forwardCompat = mkOption { type = types.nullOr types.bool; default = false; };
+      };});
+      default = null;
+    };
+  };
+  config = let inherit (inputs.config.nixos.system) nixpkgs; in
+  {
+    nixpkgs =
+      let
+        hostPlatform = if nixpkgs.march != null
+          then { system = "x86_64-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
+          else "x86_64-linux";
+        cudaConfig = inputs.lib.optionalAttrs (nixpkgs.cuda != null)
+        (
+          { cudaSupport = true; }
+          // (inputs.lib.optionalAttrs (nixpkgs.cuda.capabilities != null)
+            { cudaCapabilities = nixpkgs.cuda.capabilities; })
+          // (inputs.lib.optionalAttrs (nixpkgs.cuda.forwardCompat != null)
+            { cudaForwardCompat = nixpkgs.cuda.forwardCompat; })
+        );
+        allowInsecurePredicate = p: inputs.lib.warn
+          "Allowing insecure package ${p.name or "${p.pname}-${p.version}"}" true;
+      in
+      {
+        inherit hostPlatform;
+        config = cudaConfig //
+        {
+          inherit allowInsecurePredicate;
+          allowUnfree = true;
+          qchem-config = { optArch = nixpkgs.march; useCuda = nixpkgs.cuda != null; };
+          android_sdk.accept_license = true;
+        }
+        // (if nixpkgs.march == null then {} else
+        {
+          # TODO: change znver4 after update oneapi
+          # TODO: test znver3 do use AVX
+          oneapiArch = let match = {}; in match.${nixpkgs.march} or nixpkgs.march;
+          nvhpcArch = nixpkgs.march;
+          # contentAddressedByDefault = true;
+          enableCcache = true;
+        });
+        overlays =
+        [(final: prev:
+          let
+            inherit (final) system;
+            genericPackages = import inputs.topInputs.nixpkgs
+              { inherit system; config = { allowUnfree = true; inherit allowInsecurePredicate; }; };
+          in
+            { inherit genericPackages; }
+            // (
+              let
+                source =
+                {
+                  "pkgs-23.11" = "nixpkgs-23.11";
+                  "pkgs-23.05" = "nixpkgs-23.05";
+                  pkgs-unstable =
+                  {
+                    source = "nixpkgs-unstable";
+                    overlay = final: prev:
+                      {}
+                      // inputs.lib.optionalAttrs (nixpkgs.march != null)
+                      {
+                        pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
+                        {
+                          scipy = prev.scipy.overridePythonAttrs (prev:
+                            { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
+                        })];
+                        rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
+                        ctranslate2 = (prev.ctranslate2.override { withCUDA = false; withCuDNN = false; })
+                          .overrideAttrs (prev:
+                            { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
+                      }
+                      // inputs.lib.optionalAttrs (nixpkgs.cuda != null)
+                      {
+                        ollama = prev.ollama.overrideAttrs (prev:
+                          { patches = prev.patches or [] ++ [ ./ollama.patch ]; });
+                      };
+                  };
+                };
+                packages = name: import inputs.topInputs.${source.${name}.source or source.${name}}
+                {
+                  localSystem = hostPlatform;
+                  config = cudaConfig //
+                  {
+                    allowUnfree = true;
+                    # contentAddressedByDefault = true;
+                    inherit allowInsecurePredicate;
+                  };
+                  overlays = [(source.${name}.overlay or (_: _: {}))];
+                };
+              in builtins.listToAttrs (builtins.map
+                (name: { inherit name; value = packages name; }) (builtins.attrNames source))
+            )
+            // (
+              inputs.lib.optionalAttrs (nixpkgs.march != null)
+              {
+                # -march=xxx cause embree build failed
+                # https://github.com/embree/embree/issues/115
+                embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
+                simde = prev.simde.override { stdenv = final.genericPackages.stdenv; };
+              }
+            )
+        )];
+      };
+    programs.ccache = { enable = true; cacheDir = "/var/lib/ccache"; };
+    nix.settings.extra-sandbox-paths = [ inputs.config.programs.ccache.cacheDir ];
+    boot.kernelPatches = inputs.lib.mkIf (nixpkgs.march != null)
+    [{
+      name = "native kernel";
+      patch = null;
+      extraStructuredConfig =
+        let kernelConfig = { znver2 = "MZEN2"; znver3 = "MZEN3"; znver4 = "MZEN4"; };
+        in
+        {
+          GENERIC_CPU = inputs.lib.kernel.no;
+          ${kernelConfig.${nixpkgs.march} or "M${inputs.lib.toUpper nixpkgs.march}"} = inputs.lib.kernel.yes;
+        };
+    }];
+  };
+}
--- a/modules/system/nixpkgs/ollama.patch
+++ b/modules/system/nixpkgs/ollama.patch
@@ -0,0 +1,12 @@
+diff --color -ur src/llama/ggml-impl.h src.patched/llama/ggml-impl.h
+--- src/llama/ggml-impl.h	2025-02-16 17:06:37.983174514 +0800
+++ src.patched/llama/ggml-impl.h	2025-02-16 17:07:53.002206262 +0800
+@@ -48,7 +48,7 @@
+ #include <arm_neon.h>
+ #endif
+ 
+-#if defined(__F16C__)
+#if defined(__F16C__) && !defined(__CUDACC__)
+ #include <immintrin.h>
+ #endif
+ 
--- a/modules/user/chn/default.nix
+++ b/modules/user/chn/default.nix
@@ -12,8 +12,16 @@ inputs:
      subGidRanges = [{ startGid = 100000; count = 65536; } ];
      hashedPassword = "$y$j9T$xJwVBoGENJEDSesJ0LfkU1$VEExaw7UZtFyB4VY1yirJvl7qS7oiF49KbEBrV0.hhC";
    };
-    home-manager.users.chn =
+    home-manager.users.chn = hmInputs:
    {
+      options.nixos.decrypt = inputs.lib.mkOption
+      {
+        type = inputs.lib.types.attrsOf (inputs.lib.types.attrsOf (inputs.lib.types.submodule { options =
+        {
+          mapper = inputs.lib.mkOption { type = inputs.lib.types.nonEmptyStr; };
+          ssd = inputs.lib.mkOption { type = inputs.lib.types.bool; default = false; };
+        };}));
+      };
      config =
      {
        programs.git = { userName = "chn"; userEmail = "chn@chn.moe"; };
@@ -24,15 +32,7 @@ inputs:
          [
            (
              let
-                servers = builtins.filter
-                  (system: system.value.enable)
-                  (builtins.map
-                    (system:
-                    {
-                      name = system.config.nixos.model.hostname;
-                      value = system.config.nixos.system.fileSystems.luks.manual;
-                    })
-                    (builtins.attrValues inputs.topInputs.self.nixosConfigurations));
+                servers = inputs.localLib.attrsToList hmInputs.config.nixos.decrypt;
                cat = "${inputs.pkgs.coreutils}/bin/cat";
                gpg = "${inputs.pkgs.gnupg}/bin/gpg";
                ssh = "${inputs.pkgs.openssh}/bin/ssh";
@@ -42,13 +42,13 @@ inputs:
                  (builtins.map (system: builtins.concatStringsSep "\n"
                    [
                      "decrypt-${system.name}() {"
-                      "  key=$(${cat} ${inputs.topInputs.self}/modules/system/fileSystems/luks/${system.name}.key \\"
+                      "  key=$(${cat} ${inputs.topInputs.self}/devices/cross/luks-manual/${system.name}.key \\"
                      "    | ${gpg} --decrypt)"
                      (builtins.concatStringsSep "\n" (builtins.map
                        (device: "  echo $key | ${ssh} root@initrd.${system.name}.chn.moe cryptsetup luksOpen "
                          + (if device.value.ssd then "--allow-discards " else "")
                          + "${device.name} ${device.value.mapper} -")
-                        (inputs.localLib.attrsToList system.value.devices)))
+                        (inputs.localLib.attrsToList system.value)))
                      "}"
                    ])
                    servers)
--- a/modules/user/chn/hyprland.conf
+++ b/modules/user/chn/hyprland.conf
@@ -0,0 +1,276 @@
+################
+### MONITORS ###
+################
+
+# See https://wiki.hyprland.org/Configuring/Monitors/
+monitor=,preferred,auto,auto
+
+
+###################
+### MY PROGRAMS ###
+###################
+
+# See https://wiki.hyprland.org/Configuring/Keywords/
+
+# Set programs that you use
+$terminal = kitty
+$fileManager = dolphin
+$menu = wofi --show drun
+
+
+#################
+### AUTOSTART ###
+#################
+
+# Autostart necessary processes (like notifications daemons, status bars, etc.)
+# Or execute your favorite apps at launch like this:
+
+# exec-once = $terminal
+# exec-once = nm-applet &
+# exec-once = waybar & hyprpaper & firefox
+
+
+#############################
+### ENVIRONMENT VARIABLES ###
+#############################
+
+# See https://wiki.hyprland.org/Configuring/Environment-variables/
+
+env = XCURSOR_SIZE,24
+env = HYPRCURSOR_SIZE,24
+
+
+#####################
+### LOOK AND FEEL ###
+#####################
+
+# Refer to https://wiki.hyprland.org/Configuring/Variables/
+
+# https://wiki.hyprland.org/Configuring/Variables/#general
+general {
+    gaps_in = 5
+    gaps_out = 20
+
+    border_size = 2
+
+    # https://wiki.hyprland.org/Configuring/Variables/#variable-types for info about colors
+    col.active_border = rgba(33ccffee) rgba(00ff99ee) 45deg
+    col.inactive_border = rgba(595959aa)
+
+    # Set to true enable resizing windows by clicking and dragging on borders and gaps
+    resize_on_border = false
+
+    # Please see https://wiki.hyprland.org/Configuring/Tearing/ before you turn this on
+    allow_tearing = false
+
+    layout = dwindle
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#decoration
+decoration {
+    rounding = 10
+
+    # Change transparency of focused and unfocused windows
+    active_opacity = 1.0
+    inactive_opacity = 1.0
+
+    shadow {
+        enabled = true
+        range = 4
+        render_power = 3
+        color = rgba(1a1a1aee)
+    }
+
+    # https://wiki.hyprland.org/Configuring/Variables/#blur
+    blur {
+        enabled = true
+        size = 3
+        passes = 1
+
+        vibrancy = 0.1696
+    }
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#animations
+animations {
+    enabled = yes, please :)
+
+    # Default animations, see https://wiki.hyprland.org/Configuring/Animations/ for more
+
+    bezier = easeOutQuint,0.23,1,0.32,1
+    bezier = easeInOutCubic,0.65,0.05,0.36,1
+    bezier = linear,0,0,1,1
+    bezier = almostLinear,0.5,0.5,0.75,1.0
+    bezier = quick,0.15,0,0.1,1
+
+    animation = global, 1, 10, default
+    animation = border, 1, 5.39, easeOutQuint
+    animation = windows, 1, 4.79, easeOutQuint
+    animation = windowsIn, 1, 4.1, easeOutQuint, popin 87%
+    animation = windowsOut, 1, 1.49, linear, popin 87%
+    animation = fadeIn, 1, 1.73, almostLinear
+    animation = fadeOut, 1, 1.46, almostLinear
+    animation = fade, 1, 3.03, quick
+    animation = layers, 1, 3.81, easeOutQuint
+    animation = layersIn, 1, 4, easeOutQuint, fade
+    animation = layersOut, 1, 1.5, linear, fade
+    animation = fadeLayersIn, 1, 1.79, almostLinear
+    animation = fadeLayersOut, 1, 1.39, almostLinear
+    animation = workspaces, 1, 1.94, almostLinear, fade
+    animation = workspacesIn, 1, 1.21, almostLinear, fade
+    animation = workspacesOut, 1, 1.94, almostLinear, fade
+}
+
+# Ref https://wiki.hyprland.org/Configuring/Workspace-Rules/
+# "Smart gaps" / "No gaps when only"
+# uncomment all if you wish to use that.
+# workspace = w[tv1], gapsout:0, gapsin:0
+# workspace = f[1], gapsout:0, gapsin:0
+# windowrulev2 = bordersize 0, floating:0, onworkspace:w[tv1]
+# windowrulev2 = rounding 0, floating:0, onworkspace:w[tv1]
+# windowrulev2 = bordersize 0, floating:0, onworkspace:f[1]
+# windowrulev2 = rounding 0, floating:0, onworkspace:f[1]
+
+# See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
+dwindle {
+    pseudotile = true # Master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
+    preserve_split = true # You probably want this
+}
+
+# See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
+master {
+    new_status = master
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#misc
+misc {
+    force_default_wallpaper = -1 # Set to 0 or 1 to disable the anime mascot wallpapers
+    disable_hyprland_logo = false # If true disables the random hyprland logo / anime girl background. :(
+}
+
+
+#############
+### INPUT ###
+#############
+
+# https://wiki.hyprland.org/Configuring/Variables/#input
+input {
+    kb_layout = us
+    kb_variant =
+    kb_model =
+    kb_options =
+    kb_rules =
+
+    follow_mouse = 1
+
+    sensitivity = 0 # -1.0 - 1.0, 0 means no modification.
+
+    touchpad {
+        natural_scroll = false
+    }
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#gestures
+gestures {
+    workspace_swipe = false
+}
+
+# Example per-device config
+# See https://wiki.hyprland.org/Configuring/Keywords/#per-device-input-configs for more
+device {
+    name = epic-mouse-v1
+    sensitivity = -0.5
+}
+
+
+###################
+### KEYBINDINGS ###
+###################
+
+# See https://wiki.hyprland.org/Configuring/Keywords/
+$mainMod = SUPER # Sets "Windows" key as main modifier
+
+# Example binds, see https://wiki.hyprland.org/Configuring/Binds/ for more
+bind = $mainMod, Q, exec, $terminal
+bind = $mainMod, C, killactive,
+bind = $mainMod, M, exit,
+bind = $mainMod, E, exec, $fileManager
+bind = $mainMod, V, togglefloating,
+bind = $mainMod, R, exec, $menu
+bind = $mainMod, P, pseudo, # dwindle
+bind = $mainMod, J, togglesplit, # dwindle
+
+# Move focus with mainMod + arrow keys
+bind = $mainMod, left, movefocus, l
+bind = $mainMod, right, movefocus, r
+bind = $mainMod, up, movefocus, u
+bind = $mainMod, down, movefocus, d
+
+# Switch workspaces with mainMod + [0-9]
+bind = $mainMod, 1, workspace, 1
+bind = $mainMod, 2, workspace, 2
+bind = $mainMod, 3, workspace, 3
+bind = $mainMod, 4, workspace, 4
+bind = $mainMod, 5, workspace, 5
+bind = $mainMod, 6, workspace, 6
+bind = $mainMod, 7, workspace, 7
+bind = $mainMod, 8, workspace, 8
+bind = $mainMod, 9, workspace, 9
+bind = $mainMod, 0, workspace, 10
+
+# Move active window to a workspace with mainMod + SHIFT + [0-9]
+bind = $mainMod SHIFT, 1, movetoworkspace, 1
+bind = $mainMod SHIFT, 2, movetoworkspace, 2
+bind = $mainMod SHIFT, 3, movetoworkspace, 3
+bind = $mainMod SHIFT, 4, movetoworkspace, 4
+bind = $mainMod SHIFT, 5, movetoworkspace, 5
+bind = $mainMod SHIFT, 6, movetoworkspace, 6
+bind = $mainMod SHIFT, 7, movetoworkspace, 7
+bind = $mainMod SHIFT, 8, movetoworkspace, 8
+bind = $mainMod SHIFT, 9, movetoworkspace, 9
+bind = $mainMod SHIFT, 0, movetoworkspace, 10
+
+# Example special workspace (scratchpad)
+bind = $mainMod, S, togglespecialworkspace, magic
+bind = $mainMod SHIFT, S, movetoworkspace, special:magic
+
+# Scroll through existing workspaces with mainMod + scroll
+bind = $mainMod, mouse_down, workspace, e+1
+bind = $mainMod, mouse_up, workspace, e-1
+
+# Move/resize windows with mainMod + LMB/RMB and dragging
+bindm = $mainMod, mouse:272, movewindow
+bindm = $mainMod, mouse:273, resizewindow
+
+# Laptop multimedia keys for volume and LCD brightness
+bindel = ,XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+
+bindel = ,XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-
+bindel = ,XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
+bindel = ,XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle
+bindel = ,XF86MonBrightnessUp, exec, brightnessctl s 10%+
+bindel = ,XF86MonBrightnessDown, exec, brightnessctl s 10%-
+
+# Requires playerctl
+bindl = , XF86AudioNext, exec, playerctl next
+bindl = , XF86AudioPause, exec, playerctl play-pause
+bindl = , XF86AudioPlay, exec, playerctl play-pause
+bindl = , XF86AudioPrev, exec, playerctl previous
+
+##############################
+### WINDOWS AND WORKSPACES ###
+##############################
+
+# See https://wiki.hyprland.org/Configuring/Window-Rules/ for more
+# See https://wiki.hyprland.org/Configuring/Workspace-Rules/ for workspace rules
+
+# Example windowrule v1
+# windowrule = float, ^(kitty)$
+
+# Example windowrule v2
+# windowrulev2 = float,class:^(kitty)$,title:^(kitty)$
+
+# Ignore maximize requests from apps. You'll probably like this.
+windowrulev2 = suppressevent maximize, class:.*
+
+# Fix some dragging issues with XWayland
+windowrulev2 = nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0
--- a/modules/user/chn/hyprland.nix
+++ b/modules/user/chn/hyprland.nix
@@ -0,0 +1,50 @@
+inputs:
+{
+  config = inputs.lib.mkIf (inputs.config.nixos.packages.desktop != null)
+  {
+    home-manager.users.chn.config =
+    {
+      programs.hyprlock =
+      {
+        enable = true;
+        settings =
+        {
+          general = { disable_loading_bar = true; hide_cursor = true; };
+          background.path = "${inputs.topInputs.nixos-wallpaper}/twitter-1884592003595592025.jpg";
+          input-field =
+          [{
+            # as least one entry is required even it is default
+            position = "0, 0";
+            # size = "200, 50";
+            # position = "0, -80";
+            # font_color = "rgb(202, 211, 245)";
+            # inner_color = "rgb(91, 96, 120)";
+            # outer_color = "rgb(24, 25, 38)";
+            # outline_thickness = 5;
+            # placeholder_text = '\'<span foreground="##cad3f5">Password...</span>'\';
+            # shadow_passes = 2;
+          }];
+        };
+      };
+      wayland.windowManager.hyprland =
+      {
+        enable = true;
+        settings =
+        {
+        };
+        extraConfig = builtins.readFile ./hyprland.conf;
+        systemd.enable = false;
+        xwayland.enable = true;
+      };
+      services.hyprpaper =
+      {
+        enable = true;
+        settings =
+        {
+          preload = [ "${inputs.topInputs.nixos-wallpaper}/twitter-1884592003595592025.jpg" ];
+          wallpaper = [ ",${inputs.topInputs.nixos-wallpaper}/twitter-1884592003595592025.jpg" ];
+        };
+      };
+    };
+  };
+}
--- a/modules/user/chn/plasma/autostart.nix
+++ b/modules/user/chn/plasma/autostart.nix
@@ -65,7 +65,6 @@ inputs:
          value.source = programs.${file}.path;
        })
        (devices.${inputs.config.nixos.model.hostname} or []));
-    environment.persistence."/nix/rootfs/current".users.chn.directories =
-      inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null != "worker") [ ".config/autostart" ];
+    environment.persistence."/nix/rootfs/current".users.chn.directories = [ ".config/autostart" ];
  };
 }
--- a/modules/user/chn/plasma/konsole.nix
+++ b/modules/user/chn/plasma/konsole.nix
@@ -68,7 +68,6 @@ inputs:
        (builtins.readFile "${inputs.pkgs.konsole}/share/konsole/Breeze.colorscheme");
    };
    environment.persistence."/nix/rootfs/current".users.chn.directories =
-      inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null != "worker")
-        [ ".local/share/konsole" ".local/share/yakuake" ];
+      [ ".local/share/konsole" ".local/share/yakuake" ];
  };
 }
--- a/modules/user/chn/ssh.nix
+++ b/modules/user/chn/ssh.nix
@@ -12,7 +12,7 @@ inputs:
          {
            xmuhk = { host = "xmuhk"; hostname = "10.26.14.56"; user = "xmuhk"; };
            xmuhk2 = { host = "xmuhk2"; hostname = "183.233.219.132"; user = "xmuhk"; port = 62022; };
-            jykang.setEnv.TERM = "chn_unset_ls_colors:chn_cd:linwei/chn:chn_debug:xterm-256color";
+            jykang.setEnv.TERM = "chn_unset_ls_colors:chn_cd:linwei/chn:xterm-256color";
            "wireguard.jykang" = jykang;
          }
          // (builtins.listToAttrs (builtins.map
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chn	12dbeb8de4	test	2025-02-26 11:46:14 +08:00
chn	8d9ef4d90a	update nvidia	2025-02-26 10:10:03 +08:00
chn	f2f3008c9b	update blog	2025-02-25 20:46:08 +08:00
chn	c88e5ea0b6	Revert "packages.sbatch-tui: do not use wrap" This reverts commit `789298596b`.	2025-02-25 20:44:28 +08:00
chn	e6cb5e0f42	update blog	2025-02-25 19:46:51 +08:00
chn	789298596b	packages.sbatch-tui: do not use wrap	2025-02-25 19:35:35 +08:00
chn	cca4970246	packages.hpcstat: add sqlite3 bin	2025-02-25 19:26:18 +08:00
chn	178363e24a	modules.user.chn: disable jykang debug	2025-02-25 19:25:58 +08:00
chn	38f9c86cfd	packages.hpcstat: fix export file name	2025-02-25 18:55:02 +08:00
chn	5ec1dafb9e	packages.hpcstat: fix subaccount export	2025-02-25 18:46:02 +08:00
chn	b2382557a6	packages.info: write to output	2025-02-25 13:11:20 +08:00
chn	9aa34c9c3c	modules.services.slurm: push to hjp	2025-02-25 10:41:41 +08:00
chn	1404c42fbd	secrets: move telegram/chat to telegram/user/chn	2025-02-25 10:34:04 +08:00
chn	b06bb55bdd	packages.info: push notice	2025-02-25 10:28:23 +08:00
chn	7050a83125	modules.system: plymouth use simpledrm on efi boot	2025-02-23 14:51:40 +08:00
chn	0e7cd83bf0	modules.packages.desktop: add follow	2025-02-23 11:55:39 +08:00
chn	54d57bce46	devices.one: fix touchscreen	2025-02-22 11:44:50 +08:00
chn	461c8669e2	modules.virtualization: mount virtio-win.iso	2025-02-21 17:20:07 +08:00
chn	0f7502cb99	modules.packages.desktop: sandbox wechat	2025-02-21 13:25:54 +08:00
chn	1c5c5b91ba	modules.packages.desktop: add obsidian	2025-02-19 19:33:48 +08:00
chn	3041dd1f6b	devices.one: enable kvmHost	2025-02-18 08:30:37 +08:00
chn	c7aaa3fa1c	devices.srv2.node0: enable ollama	2025-02-18 08:30:34 +08:00
chn	b00bd1f47e	modules.services.ollama: update	2025-02-16 19:33:52 +08:00
chn	e92a536da2	modules.services.gitea: 整理	2025-02-15 19:53:18 +08:00
chn	ccc0db6ff7	modules.services.gitea: add LOGIN_REMEMBER_DAYS	2025-02-15 19:46:08 +08:00
chn	d309ebb0db	modules.service.gitea: disable registration	2025-02-15 19:41:42 +08:00
chn	26fc0d71d8	modules.system: add plymouth theme	2025-02-15 12:01:47 +08:00
chn	82d27a66e6	devices.pc: switch to xanmod-latest kernel	2025-02-14 10:05:29 +08:00
chn	964bd11731	repackage blog	2025-02-13 17:11:22 +08:00
chn	56bd0d0b33	update blog	2025-02-13 17:08:31 +08:00
chn	b51f983321	modules.services.smartd: disable for vps	2025-02-13 12:51:54 +08:00
chn	b358685ec8	add some hyprland stuff	2025-02-13 12:44:07 +08:00
chn	01feb47942	Revert "devices.nas: enable gui" This reverts commit `9ead9eb054`.	2025-02-11 21:26:27 +08:00
chn	440327a265	modules.system.nixpkgs: remove support for steamos	2025-02-11 20:03:17 +08:00
chn	e599543982	modules.system.nixpkgs: 整理	2025-02-11 20:03:17 +08:00
chn	9ead9eb054	devices.nas: enable gui	2025-02-11 18:55:46 +08:00
chn	0c95d54f43	modules.model: type minimal -> vps	2025-02-11 18:55:46 +08:00
chn	c2871a15e9	modules.system.fileSystems.impermanence: fix	2025-02-11 18:55:46 +08:00
chn	c03f80b060	devices.pi3b: drop	2025-02-11 18:55:39 +08:00
chn	bd3e089791	devices.one: use xanmod-latest kernel	2025-02-11 18:25:03 +08:00
chn	90bc6720ed	fix libvirt	2025-02-10 23:38:26 +08:00
chn	e52bc40376	整理	2025-02-10 23:38:04 +08:00
chn	777a35e473	modules.user.chn: fix remote-decrypt	2025-02-10 20:34:46 +08:00
chn	f34d8dcd9a	modules.services.beesd: add bees to path	2025-02-10 10:55:01 +08:00
chn	6d5f947f4a	devices.pc: 整理	2025-02-09 19:34:47 +08:00
chn	e87e7815ad	update open-webui	2025-02-09 19:31:47 +08:00
chn	b4fa5cacb0	modules.system.fileSystems.luks.manual: 整理	2025-02-09 16:50:29 +08:00
chn	ead5304b49	modules.services.wireguard: 整理	2025-02-08 19:03:42 +08:00
chn	eeeb74d7cb	update misskey	2025-02-08 10:31:56 +08:00
chn	809c8923f6	devices.srv2: add zzn	2025-02-06 10:24:45 +08:00
chn	ed72bd91b9	modules.packages.server: add libfido2	2025-02-05 10:22:17 +08:00
chn	5f7957560e	modules.services: 整理	2025-02-04 21:55:54 +08:00
chn	cd65aeab6f	fix pytorch	2025-02-04 21:55:11 +08:00
chn	8769ebde59	modules.user.chn.hyprland: add config	2025-02-04 11:01:43 +08:00
chn	a26994c946	modules.services.ollama: simplify	2025-02-04 09:24:55 +08:00
chn	df1b014c4c	modules.user.chn.hyprland: enable	2025-02-03 19:42:18 +08:00
chn	f12a9c945f	modules.packages.server: add kitty	2025-02-03 18:18:50 +08:00
chn	d6a686dfab	packages.info: enhance	2025-02-03 10:33:49 +08:00
chn	8b1c09cdb1	flake: update nixos-wallpaper	2025-02-03 09:19:17 +08:00
chn	8b24eecb58	modules.bugs.iwlwifi: modify	2025-02-03 08:48:41 +08:00
chn	550250fa83	packages.info: finish	2025-02-02 23:32:44 +08:00
chn	f195c05031	packages.info: switch user	2025-02-02 22:01:46 +08:00
chn	4ebd8b0c71	packages.info: print username	2025-02-02 20:54:46 +08:00
chn	91237b73fe	modules.system.gui: enable hyprland	2025-02-02 17:04:17 +08:00
chn	796eb0ae50	package.info: finish	2025-01-31 19:25:07 +08:00
chn	73449f929e	packages.info: init	2025-01-31 09:16:44 +08:00
chn	78657b1c26	packages.nvhpc.stdenv: fix	2025-01-31 09:00:12 +08:00
chn	db8d3cf4c0	modules.services.sshd: adjust	2025-01-30 23:40:02 +08:00
chn	0588be0981	update misskey	2025-01-29 15:33:55 +08:00
chn	33f52fd862	packages.hpcstat: fix disk stat	2025-01-29 08:36:39 +08:00
chn	f3a77f1717	devices.srv2: remove p5000	2025-01-24 20:44:35 +08:00
chn	54c515e19c	modules.bugs: add iwlwifi	2025-01-24 15:51:27 +08:00
chn	8dc402648d	modules.packages.desktop: add paperwork	2025-01-23 20:20:50 +08:00
chn	968f0f2b15	modules.services.rsshub: update	2025-01-23 19:01:35 +08:00
chn	62e5fc9c2e	modules.services.huginn: update	2025-01-23 18:50:30 +08:00
chn	4722f810a9	modules.services.prometheus: fix	2025-01-23 18:41:25 +08:00
chn	15ac7e993a	modules.services.docker: fix	2025-01-23 18:33:52 +08:00
chn	089e2e5b73	modules.services.docker: fix firewall	2025-01-23 18:31:31 +08:00
chn	7ca28cf398	Revert "remove workaround" This reverts commit `09b7b587eb`.	2025-01-23 17:23:52 +08:00
chn	efc5f66cf7	modules.services.huginn: fix	2025-01-23 17:18:40 +08:00
chn	5dc25f5cf3	modules.services.grafana: fix	2025-01-22 21:35:15 +08:00
chn	2c737082d8	add dns	2025-01-21 19:29:24 +08:00
chn	e673d21b12	modules.packages.server: add octodns	2025-01-21 18:56:03 +08:00
chn	23a6d7362d	modules.services.grafana: fix prometheus db	2025-01-21 18:22:46 +08:00
chn	fdb6897d8d	modules.services.synapse: fix	2025-01-21 03:12:38 +08:00
chn	9ea8b6ad1a	Revert "devices.pc: switch to xanmod-latest kernel" This reverts commit `2f34d101de`.	2025-01-20 21:12:49 +08:00
chn	99dc89c431	Revert "modules.system.kernel: disable scx" This reverts commit `353a369ff1`.	2025-01-20 21:12:45 +08:00
chn	6f97bd6f0b	add sticker	2025-01-20 15:11:06 +08:00
chn	08ff296c81	modules.user.chn: fix	2025-01-20 12:03:34 +08:00
chn	f45cd7166e	packages.sbatch-tui: fix	2025-01-20 10:48:46 +08:00
chn	e4bbfe2846	modules.services.grafana: enhance	2025-01-19 18:02:34 +08:00
chn	bb9af1189a	devices.srv1: adjust memory limit	2025-01-19 12:27:04 +08:00
chn	74fc71b23a	Revert "devices.nas: move old misskey to nas" This reverts commit `a420681cfc`.	2025-01-19 11:06:04 +08:00
chn	5d2d80324c	modules.services.misskey: 整理	2025-01-19 09:28:11 +08:00
chn	51a35f56ac	modules.services.misskey: update	2025-01-19 09:08:39 +08:00
chn	6d59264d02	modules.services.postgresql: enable pgroonga	2025-01-19 09:01:12 +08:00
chn	f379a60eac	modules.services.postgresql: update to 17	2025-01-18 10:09:36 +08:00
chn	b26b489cf6	modules.system.grub: default 15s timeout	2025-01-18 09:59:50 +08:00
chn	aa55f46d2d	devices.srv1: remove ref to node0	2025-01-17 11:59:05 +08:00
chn	896f61bab8	add readme	2025-01-16 11:52:28 +08:00
chn	8ac144ec32	update blog	2025-01-15 13:19:05 +08:00
chn	741b6185a4	modules.system.fileSystems.cluster: fix	2025-01-15 12:39:51 +08:00
chn	c3a8e7c9ff	Revert "modules.system.fileSystems.cluster: fix" This reverts commit `f41ce5f887`.	2025-01-15 12:28:03 +08:00
chn	f41ce5f887	modules.system.fileSystems.cluster: fix	2025-01-15 11:52:29 +08:00
chn	89930d56ff	modules.system.fileSystems.cluster: fix	2025-01-15 10:28:58 +08:00
chn	99274e1548	modules.system.fileSystems.cluster: fix	2025-01-15 10:00:52 +08:00
chn	d692187dab	modules.system.fileSystems.cluster: fix	2025-01-15 09:23:16 +08:00
chn	53bcc359b1	packages.nvhpc.mpi: preserve source	2025-01-14 21:41:42 +08:00
chn	409738d239	devices.srv2: fix	2025-01-14 21:38:36 +08:00
chn	12a460c86b	modules.system.fileSystems: fix	2025-01-14 21:32:41 +08:00
				`@@ -0,0 +1 @@`
				`inputs: { imports = inputs.localLib.findModules ./.; }`