devices.xmupc2: init

system.fileSystems.rollingRootfs: fix
packages: add tor-browser
2026-01-11 23:09:22 +08:00 · 2024-03-09 12:53:32 +08:00 · 2024-03-08 18:43:42 +08:00 · 2024-03-08 14:55:16 +08:00 · 2024-03-08 14:22:15 +08:00 · 2024-03-08 13:51:10 +08:00
152 changed files with 4806 additions and 3141 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+*.png filter=lfs diff=lfs merge=lfs -text
+*.icm filter=lfs diff=lfs merge=lfs -text
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -3,40 +3,36 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
-  - &yoga age1qrea4twxdhd7fnvlq5v45528c90qy6hp2wa55kghsxzgut6n6fxs7w6u42
+  - &surface age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
-  - &xmupc1 age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
 creation_rules:
-  - path_regex: secrets/pc/.*$
+  - path_regex: devices/pc/secrets/.*$
    key_groups:
    - age:
      - *chn
      - *pc
-  - path_regex: secrets/vps6/.*$
+  - path_regex: devices/vps6/secrets/.*$
    key_groups:
    - age:
      - *chn
      - *vps6
-  - path_regex: secrets/vps7/.*$
+  - path_regex: devices/vps7/secrets/.*$
    key_groups:
    - age:
      - *chn
      - *vps7
-  - path_regex: secrets/nas/.*$
+  - path_regex: devices/nas/secrets/.*$
    key_groups:
    - age:
      - *chn
      - *nas
-  - path_regex: secrets/xmupc1/.*$
+  - path_regex: devices/surface/secrets/.*$
    key_groups:
    - age:
      - *chn
-  - path_regex: secrets/yoga/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *yoga
-  - path_regex: secrets/xmupc1/.*$
+      - *surface
+  - path_regex: devices/xmupc1/secrets/.*$
    key_groups:
    - age:
      - *chn
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -0,0 +1,101 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/13BC-F0C9" = "/boot/efi";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/0e184f3b-af6c-4f5d-926a-2559f2dc3063"."/boot" = "/boot";
+              "/dev/mapper/nix"."/nix" = "/nix";
+              "/dev/mapper/root1" =
+              {
+                "/nix/rootfs" = "/nix/rootfs";
+                "/nix/persistent" = "/nix/persistent";
+                "/nix/nodatacow" = "/nix/nodatacow";
+                "/nix/rootfs/current" = "/";
+                "/nix/backup" = "/nix/backup";
+              };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices =
+            {
+              "/dev/disk/by-uuid/5cf1d19d-b4a5-4e67-8e10-f63f0d5bb649".mapper = "root1";
+              "/dev/disk/by-uuid/aa684baf-fd8a-459c-99ba-11eb7636cb0d".mapper = "root2";
+              "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
+            };
+            delayedMount = [ "/" "/nix" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs.device = "/dev/mapper/root1";
+        };
+        initrd.sshd.enable = true;
+        grub.installDevice = "efi";
+        nixpkgs.march = "silvermont";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        kernel.patches = [ "cjktty" "lantian" ];
+        networking.hostname = "nas";
+        gui.preferred = false;
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
+      packages.packageSet = "desktop-fat";
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        samba =
+        {
+          enable = true;
+          hostsAllowed = "192.168. 127.";
+          shares = { home.path = "/home"; root.path = "/"; };
+        };
+        sshd.enable = true;
+        xray.client =
+        {
+          enable = true;
+          serverAddress = "74.211.99.69";
+          serverName = "vps6.xserver.chn.moe";
+          dns.extraInterfaces = [ "docker0" ];
+        };
+        xrdp = { enable = true; hostname = [ "nas.chn.moe" "office.chn.moe" ]; };
+        groupshare.enable = true;
+        smartd.enable = true;
+        beesd =
+        {
+          enable = true;
+          instances =
+          {
+            root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
+            nix = { device = "/nix"; hashTableSizeMB = 128; };
+          };
+        };
+        frpClient =
+        {
+          enable = true;
+          serverName = "frp.chn.moe";
+          user = "nas";
+          stcp.hpc = { localIp = "hpc.xmu.edu.cn"; localPort = 22; };
+        };
+        nginx = { enable = true; applications.webdav.instances."local.webdav.chn.moe" = {}; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+          wireguardIp = "192.168.83.4";
+        };
+      };
+      users.users = [ "chn" "xll" "zem" "yjq" "gb" ];
+    };
+  };
+}
--- a/devices/nas/secrets/default.yaml
+++ b/devices/nas/secrets/default.yaml
@@ -1,14 +1,12 @@
 xray-client:
    uuid: ENC[AES256_GCM,data:97aX07G5FPumdWcDxnYOs6fRgljXWuwyNXGg1d7zdbUUfNnb,iv:+wAC/DZXsg+evYFA4DMfLw5Ut3ExQl1RgZ/2AsNQDpo=,tag:ebD77muITHof+FQMydWobg==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:zWLXEH628ZVDZk7U/9zEXocJatCJr7hZrCmh/pifPlxVvVud5RQxLvgRvhQ=,iv:YFn7spiIcaW/l8dQZvGhsERi81L2RKLUE/55Bht0TMQ=,tag:fVdIRCMeT6o0lrGVDjCVlA==,type:str]
 acme:
    cloudflare.ini: ENC[AES256_GCM,data:/LpP1qoVS+CG+5ska6vtmagHNrhcgr5e1QRzDdbdCYGnDB8Nca/GmIogzHCXsogQY/rwGTCZoXLKKEGToYiThwk=,iv:R++I0ued2wrVsmM/vYvBVMOp9M7HyZIfDOVOlg7GALE=,tag:gYchPuh8MHk3EEnGb9g4WA==,type:str]
 users:
    xll: ENC[AES256_GCM,data:XLSsz6fZ23PPaJS1Y5C3FAOks3wzb2f+Pv8TgyKrDBfMeoLk1M37A00OGJ2wsYxkuR0JV6Uoh+hhRpTUjOQnmLfQrBxPxxP8DA==,iv:jxEZX/flxxduM1sdrYfGHfMtFMYduMg0Lr6hY1pkAPg=,tag:CYy0y1e2S2Txz1OSh+XDHA==,type:str]
    zem: ENC[AES256_GCM,data:VCVLfGO9a06XhAOBciFf1u7A5jaQikAt2wZf+dCAi1BglXpM6Hof1yAunadYOwLOBFgGlP19kX53CBBlZtaqZFL2GRDzXP0woQ==,iv:AFYtHCCkzNrllN/fjQ8GKYs2TyV3uj3BsU5n1tBQAmM=,tag:5dP7c5N4yG2NS4T+Vg0Zpg==,type:str]
    yjq: ENC[AES256_GCM,data:yn6eGrySCxlRsFioaE2p1qlTHkIGC9l64+edjuDvt232xc+iFeD03EYfuulyr0GxYFwnlAwtaJnyMi5eOrSd1W6HeV3Canzdbw==,iv:qTc6vA8uQza8CB+BvffEN9GqHkiwNM4h9RkqQR14ylk=,tag:UZ2GYCJLjcWLuVXlscLviw==,type:str]
-    yxy: ENC[AES256_GCM,data:71vjvwr29lfPCarnblpbW3WVyJK8EMV+cR4prc4AM3r0PG4z88P6i0IrzSy8XwkVPrEasfYXxn+vDbzXyi7kIWaWXrkjcyGTxg==,iv:LfkinvbIhchvgfgixIY8Wg6esrc+TOS4YWqRTJ0qfvw=,tag:mLPw6z8DOPrHsRpUHn3/gw==,type:str]
+    gb: ENC[AES256_GCM,data:jIR3EVdATYUgWmW4J8RdURJRmDBC84t0S/c2EzWwtFMtjgKlqg52fIfQ66i7RnIYRAoF+s4Ex0aLSejWgzQ69NA/AF0AIS7Y/Q==,iv:mvTCTP0E74QlvM8TcY4o49G5kNGs5HFx3YUrj6mCrwM=,tag:LXfIOyAB10XuHA6Cg7LBeQ==,type:str]
 frp:
    token: ENC[AES256_GCM,data:zYRZoWa3Llv0NiPXtSfhWUn+wt4uIcw8Wa+QBTzn7gLk6UVIA4FD7FLABBKoFbwg62Fo79Nn,iv:YZdOYkJf6BN76Z68nCtetKElJkqKiYmcx6UmLoIXSdo=,tag:5sC2vt3Z21KhgOU9mrfXhg==,type:str]
    stcp:
@@ -43,8 +41,8 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-07T08:57:07Z"
-    mac: ENC[AES256_GCM,data:Ihd7p3JU6zwn5tI3XkINrNJcsxdFjTsLdVpZLUvQez2jiNWq1kGP4QeJSBzqq/1Sgowc/PdWULlw8T21LitQalhBwaODVt/dNk0gkHYqrlDMVD90/MthAPKy+vT4YLhBkDC5W00em1qEfLYo5IXazM/0e1aZ7QcwEpp5775ICPc=,iv:Yp32/LLdcDHxdmXnwqJ6OiOm/4mipMlccSRXMMgO8gc=,tag:5T5R4JiJUsbKGrHjfVw92Q==,type:str]
+    lastmodified: "2024-03-07T12:35:21Z"
+    mac: ENC[AES256_GCM,data:bR4PPHaGX6VCRP+Ze96sccnwYxnZkfpmJp6iMBzr+W3JRd0VjTEwTH8aNn1WIsNFXco+BCmwroJR07oKYnbusBYgiEeHnkhXvyAELETs7BitH8JrUtSsGs2wJDfkU9fWf6BNT7oHGpP69Tyrl+8v+Q8jyLV8kW8+c7uJPyT2ACQ=,iv:Hl2eX7TV6lgWjUim0m4r44Ji0c9QDH+qzpDyBOTeVp4=,tag:6xkFMQMwEP7IhpXEB4o+hQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/pc/color/TPLCD_161B_Default.icm
+++ b/devices/pc/color/TPLCD_161B_Default.icm
--- a/devices/pc/color/TPLCD_161B_Native.icm
+++ b/devices/pc/color/TPLCD_161B_Native.icm
--- a/devices/pc/color/TPLCD_161B_Native_HDR.icm
+++ b/devices/pc/color/TPLCD_161B_Native_HDR.icm
--- a/devices/pc/color/TPLCD_161B_REC709.icm
+++ b/devices/pc/color/TPLCD_161B_REC709.icm
--- a/devices/pc/color/TPLCD_161B_sRGB.icm
+++ b/devices/pc/color/TPLCD_161B_sRGB.icm
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -0,0 +1,187 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.auto =
+          {
+            "/dev/disk/by-uuid/55fdd19f-0f1d-4c37-bd4e-6df44fc31f26" = { mapper = "root"; ssd = true; };
+            "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
+              { mapper = "swap"; ssd = true; before = [ "root" ]; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
+        };
+        grub =
+        {
+          # TODO: install windows
+          # windowsEntries = { "7317-1DB6" = "Windows"; "7321-FA9C" = "Windows for malware"; };
+          installDevice = "efi";
+        };
+        nix =
+        {
+          marches =
+          [
+            "znver2" "znver3" "znver4"
+            # FXSR SAHF XSAVE
+            "sandybridge"
+            # FXSR PREFETCHW RDRND SAHF
+            "silvermont"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+            "broadwell"
+            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+            "skylake"
+            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+            "alderlake"
+          ];
+        };
+        nixpkgs =
+          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
+        kernel.patches = [ "cjktty" "lantian" "hibernate-progress" ];
+        networking.hostname = "pc";
+        sysctl.laptop-mode = 5;
+      };
+      hardware =
+      {
+        cpus = [ "amd" ];
+        gpu = { type = "amd+nvidia"; prime.busId = { amd = "8:0:0"; nvidia = "1:0:0"; }; dynamicBoost = true; };
+        bluetooth.enable = true;
+        joystick.enable = true;
+        printer.enable = true;
+        sound.enable = true;
+        legion.enable = true;
+      };
+      packages.packageSet = "workstation";
+      virtualization =
+      {
+        waydroid.enable = true;
+        docker.enable = true;
+        kvmHost = { enable = true; gui = true; autoSuspend = [ "win10" "hardconnect" ]; };
+        nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
+      };
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        samba =
+        {
+          enable = true;
+          private = true;
+          hostsAllowed = "192.168. 127.";
+          shares =
+          {
+            media.path = "/run/media/chn";
+            home.path = "/home/chn";
+            mnt.path = "/mnt";
+            share.path = "/home/chn/share";
+          };
+        };
+        sshd.enable = true;
+        xray.client =
+        {
+          enable = true;
+          serverAddress = "74.211.99.69";
+          serverName = "vps6.xserver.chn.moe";
+          dns =
+          {
+            extraInterfaces = [ "docker0" ];
+            hosts =
+            {
+              "mirism.one" = "74.211.99.69";
+              "beta.mirism.one" = "74.211.99.69";
+              "ng01.mirism.one" = "74.211.99.69";
+              "debug.mirism.one" = "127.0.0.1";
+              "initrd.vps6.chn.moe" = "74.211.99.69";
+              "nix-store.chn.moe" = "127.0.0.1";
+              "initrd.nas.chn.moe" = "192.168.1.185";
+            };
+          };
+        };
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        acme = { enable = true; cert."debug.mirism.one" = {}; };
+        frpClient =
+        {
+          enable = true;
+          serverName = "frp.chn.moe";
+          user = "pc";
+          stcpVisitor."yy.vnc".localPort = 6187;
+        };
+        nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
+        smartd.enable = true;
+        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
+        beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 4096; threads = 4; }; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
+          wireguardIp = "192.168.83.3";
+        };
+        gamemode = { enable = true; drmDevice = 1; };
+        slurm = { enable = true; cpu = { cores = 16; threads = 2; }; memoryMB = 94208; gpus."4060" = 1; };
+        xrdp = { enable = true; hostname = [ "pc.chn.moe" ]; };
+      };
+      bugs = [ "xmunet" "backlight" "amdpstate" ];
+    };
+    services.colord.enable = true;
+    virtualisation.virtualbox.host = { enable = true; enableExtensionPack = true; };
+    specialisation =
+    {
+      nvidia.configuration =
+      {
+        nixos =
+        {
+          hardware.gpu.type = inputs.lib.mkForce "nvidia";
+          services.gamemode.drmDevice = inputs.lib.mkForce 0;
+        };
+        system.nixos.tags = [ "nvidia" ];
+      };
+      hybrid-sync.configuration =
+      {
+        nixos.hardware.gpu.prime.mode = "sync";
+        system.nixos.tags = [ "hybrid-sync" ];
+      };
+      amd.configuration =
+      {
+        nixos.hardware.gpu = { type = inputs.lib.mkForce "amd"; dynamicBoost = inputs.lib.mkForce false; };
+        boot =
+        {
+          extraModprobeConfig =
+          ''
+            blacklist nouveau
+            options nouveau modeset=0
+          '';
+          blacklistedKernelModules = [ "nvidia" "nvidia_drm" "nvidia_modeset" ];
+        };
+        services.udev.extraRules =
+        ''
+          # Remove NVIDIA USB xHCI Host Controller devices, if present
+          ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{power/control}="auto", ATTR{remove}="1"
+          # Remove NVIDIA USB Type-C UCSI devices, if present
+          ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{power/control}="auto", ATTR{remove}="1"
+          # Remove NVIDIA Audio devices, if present
+          ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{power/control}="auto", ATTR{remove}="1"
+          # Remove NVIDIA VGA/3D controller devices
+          ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x03[0-9]*", ATTR{power/control}="auto", ATTR{remove}="1"
+        '';
+        system.nixos.tags = [ "amd" ];
+      };
+    };
+  };
+}
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -16,10 +16,10 @@ redis:
    misskey-misskey: ENC[AES256_GCM,data:vcvQ/hs/F3BZd1sfvWwfEeB8vVoqdnprxobcmL6xsmg=,iv:S32yrjrjj56HbxTlfFGjOb+sO2M9KKEDEazCrpQWj6Q=,tag:iwnvqwQEdd6jicx9jJBdbg==,type:str]
 meilisearch:
    misskey-misskey: ENC[AES256_GCM,data:/wYR3Bz4LRk/Ks0vizlZS3Ebf5qVfnlBBqZEm/ZIBFdDuhddgu71cqCjTHIKQ6CYh3CoUyguKIIFWku/kOCHKA==,iv:dllKvZwxvZC4pVyEMOB9WNiVBsVxzo5kwbdYKCzzyrY=,tag:MvzqalVvBkyJoLbirN0V8Q==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:kNm9hwMa/EhDeOCeZw1jEnroolTkeEeAxpSEDko6tHSDHwHbhfjr01ZzHKE=,iv:q2qCi99XgZJvRuF1dm16sK6BFIoa9QUN8p4LSiZq28o=,tag:ApOKdA91LBiWHv6TuXMkpA==,type:str]
 wireguard:
    privateKey: ENC[AES256_GCM,data:oIpiXJvEoyryS4eEutoe85Af0L5a5iNuOsCWCat9KEhr2ecY/vRimk/1fbA=,iv:dm2hTSNX7Q38yASon5o1jxEJZbWPXUWYydXYMBHF/sE=,tag:yrANhwIF/wHQGHGA1bfPgw==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:fGvNMmqk7Cee28VJ1QoBVrBbgIUbj/F1W0SRjdP8N4K/M8Wx4AVm1kAr0IAhPWyDLXlIjM1NUvuEV5BpYDBdjg==,iv:rFTMJ4x2kgENQUA8ftSaLjdOc25i5mWR3UYbdq54vjs=,tag:6feD0eCSv7bcHWBveLNJwg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -44,8 +44,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-07T08:55:33Z"
-    mac: ENC[AES256_GCM,data:3WDgwrlyzb0QfhCpGEKSguLZpRE68APpUclQaP4/2O5pX8E/HZ9tXVQNNVeOqozHWIe8sM5/kvY4vXEiXc1t2qrJk4JdPNI7fMIWf7QAYQWcFDNbSquUNp1VSmNp3Aka3xSS1wyVWnQOs6JY9rdbmeOcLQq0jE2sNDvivtBeJJQ=,iv:xt94toLZ91J9Twigu4FiyeYIg27u9oPkzduCUaLIgts=,tag:chf+LnNJMrnMf191BorOvg==,type:str]
+    lastmodified: "2024-03-07T12:35:41Z"
+    mac: ENC[AES256_GCM,data:Krgtb791wR+S0PQyV2h0Uyh7MKx9fOTHbetmgLoiGOHL8FMSvmWt3LCMQy+RyjnOIj9XRwb8l+kyTqkgeN4zEfKd1uuOh95Z/hLWhCkWs4dPaBu6Uw4aekH9ZUmQJZIr1lt2AIayRsVjaU0dIl4FOcLW+93ls95aluhvPPloJX0=,iv:MmJFdVpF4ZfxMRwbxPV/TC1Qt957vl0QvU0MZzUWdm8=,tag:6+VVFDdPSTycxnKO7Td6VA==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/pc/secrets/munge.key
+++ b/devices/pc/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:ftogJ/2oPME8sVbyNAuI3t3GEzUmdCadyjf2g/bjGNx3AoV0jU0SDxnBLDFfoR1rEtV00zfgCMPDGsEXavg+QVvoICpvvhckXMOLXe37H3Ff0wDVJtL4BBIK3oVh/SiYaRm/+uR0x6HW37KX50RRvKvpQoRdMVNnvtKbMjmQVIA=,iv:MOHfTIavoU643K10jSR3HruzoofOqqVspYgiaLc294o=,tag:zjDTPKwAOh/nqkquvAQpbw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TTB1bHFXcDhoMk1QVzJ0\nUUplcGVBVUhoOEt0Rnc2ZStDUUpjZmV0eGpvCjFQSGl4TjlMT2R5RExNZWxwOUtz\nSWhhSUtFN0JISzJhclpCMFZDQ09jK28KLS0tIGJydDNoY3hBbEhBYUNYZGZCaWpQ\nQnVDalJCcWpIRTdVaWkzeGVNSGpDRWsKWXoMC8NApfenn191aRwdAjD0iM5+C3R6\nXKpHxfhc1Gf6paxBhketFU+AwWsKiBDKh0gntV49F+YSriPa7uI3FA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzclYwVjdOZnQ1Y2dlUi9n\naXQya21QVHZ0KzMxTkVuTEJuazB4WklqdFdvCmpMd0h6OXUvZSttOFpmeUdsSlNs\nQkhQaVJqVFdidFNMejljV2h3WUFTaFUKLS0tIGNBemY5R1N3T00zMEthZjBsWXZh\nVXRtNG5UV3I3WG5LYUphNUNyUDI5WXcKVQpMe3zYgzHOtQQvo8Vvz94lYR6TBFuV\nD7ztr4rD/Vdk3hkSGZQvdzGjNDdGpac38LUN9vtFQbzMofykcn/etw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-24T05:48:31Z",
+		"mac": "ENC[AES256_GCM,data:kCLcS6xeMijD8Bxa0MBUbFH2pdXX6BdGL1SztHHPet8loMkiCfgEiyp9l/QjszWa3G6zx3K+0wXXtRXmrNAxThnIgMZQVGCy4Ucw7fp8Pral/5eaJNlZGb56JQPF9ZDHb9YQPDPImaEAKYUtzayyaZAGJGlCmIIhVVhXTx7iiig=,iv:MXRDA/6YnVUbLdYAIrMvrdb2iPsi4Bmr06SPCU8CCVc=,tag:9hT7Xo0tRnHTgAaivKj4QQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
--- a/devices/surface/default.nix
+++ b/devices/surface/default.nix
@@ -0,0 +1,76 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules [ inputs.topInputs.nixos-hardware.nixosModules.microsoft-surface-pro-intel ];
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/7179-9C69" = "/boot/efi";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/c6d35075-85fe-4129-aaa8-f436ab85ce43"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.auto =
+          {
+            "/dev/disk/by-uuid/4f7420f9-ea19-4713-b084-2ac8f0a963ac" = { mapper = "root"; ssd = true; };
+            "/dev/disk/by-uuid/88bd9d44-928b-40a2-8f3d-6dcd257c4601" =
+              { mapper = "swap"; ssd = true; before = [ "root" ]; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
+        };
+        nixpkgs.march = "skylake";
+        grub.installDevice = "efi";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        kernel.patches = [ "cjktty" "lantian" "surface" ];
+        networking.hostname = "surface";
+      };
+      hardware =
+      {
+        cpus = [ "intel" ];
+        gpu.type = "intel";
+        bluetooth.enable = true;
+        joystick.enable = true;
+        printer.enable = true;
+        sound.enable = true;
+      };
+      packages.packageSet = "desktop-fat";
+      virtualization = { docker.enable = true; waydroid.enable = true; };
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        sshd.enable = true;
+        xray.client =
+        {
+          enable = true;
+          serverAddress = "74.211.99.69";
+          serverName = "vps6.xserver.chn.moe";
+          dns.extraInterfaces = [ "docker0" ];
+        };
+        firewall.trustedInterfaces = [ "virbr0" ];
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "j7qEeODVMH31afKUQAmKRGLuqg8Bxd0dIPbo17LHqAo=";
+          wireguardIp = "192.168.83.5";
+        };
+        beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 512; }; };
+      };
+      bugs = [ "xmunet" ];
+    };
+    boot.kernelParams = [ "intel_iommu=off" ];
+    environment.systemPackages = with inputs.pkgs; [ maliit-keyboard maliit-framework ];
+    powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';
+  };
+}
--- a/devices/surface/secrets/default.yaml
+++ b/devices/surface/secrets/default.yaml
@@ -0,0 +1,33 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:WEBAH3PQM5ahNpH/kvTtcjcJ2GllmmRlBR2oclG6AimGenSg,iv:TMp0WTOe9fuELSZoVGenl5XSZUFoiYUBEMWMn4NFv1g=,tag:GJTE0EELcZkrnGAKLYer1g==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:P/tyZHaEAahZUBF22dJEZb6mACm/wmUunPDG0vS7SNW3sWbzxRSut0haR/g=,iv:8VMv5iotmDrYDLiszcOvJHkD8l6uE+SboPSILr6KuzU=,tag:U/FIBhvghwDTvFtUWEqr4g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzV1pvWkVGSFg5TVAvRlhu
+            TnFnMEszcDRWWHlQanAyRkRpQWdqQkdhTzFvCjBqUG4xNFBiRnlSeTNQSmdkVkdD
+            UlVCQjRFVExuZHdrSnViajZGZ3c2dWsKLS0tIHlQYU5VeGpEQzllMmxLSnJZZzZx
+            N1R3Mkhxa0dOVlJiU0V2OEZVVzZVMFkKae3c1axl22uxh9wMygAHs6q1WA5ImOS8
+            uzKSthWSqtC7DMqgUFaaSjBYM2TN3l402syx71xVFyyAmCcGZbbJcg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSHJVRGIwQUFpVER5SWxq
+            YjJOT0lXN3dFOFpjMFlWV3JCbmZFN0hnNEJBClpQUEczK2RWTGlVTmJRbVZaUC8y
+            bEFrL1RjTTNlYVNnRVRBZlRjaTlnUEEKLS0tIE5GM01pTGFFcWVVSWEvUHE3Z08r
+            a2xybTRFUFZZN20zajZJTVNwVEpGcEEKglmFMk7z1q5IlZ+lZf9M0HtknmvcYt/P
+            2/z5e8wLN1Hy0Zsbv0yIL/NmqwxAOGJOdzz7ElJszk/Y4kUr9aRasg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-02-16T14:25:17Z"
+    mac: ENC[AES256_GCM,data:lpZ+Jd5LF35ESBOmOoq7pbNHze7rJiQsiq8cOgf8+cWnAqVh1bccG0cFe7R8uBhmuKIqp7TwkORDFuD+KFCZW14cbR4SP3vndSoYzKxIBdKTObR95w2ETst+prUtQ3fvFeEtlJexeljikfprWf2pGo1OzPophAyocgT31z2iMjs=,iv:Bryz+kqRvXYPj6YuxeDhQfLsgYqHXrA+lHFX18m2GGE=,tag:A7mvmguWoOir2JoIprgL4A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -0,0 +1,84 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/24577c0e-d56b-45ba-8b36-95a848228600"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
+        nixpkgs.march = "sandybridge";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        initrd.sshd.enable = true;
+        networking.hostname = "vps6";
+      };
+      packages.packageSet = "server";
+      services =
+      {
+        snapper.enable = false;
+        sshd.enable = true;
+        xray.server = { enable = true; serverName = "vps6.xserver.chn.moe"; };
+        frpServer = { enable = true; serverName = "frp.chn.moe"; };
+        nginx =
+        {
+          streamProxy.map =
+          {
+            "anchor.fm" = { upstream = "anchor.fm:443"; proxyProtocol = false; };
+            "podcasters.spotify.com" = { upstream = "podcasters.spotify.com:443"; proxyProtocol = false; };
+            "xlog.chn.moe" = { upstream = "cname.xlog.app:443"; proxyProtocol = false; };
+          }
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.pc.chn.moe"; })
+            [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
+            [
+              "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
+              "send" "kkmeeting" "api" "git" "grafana" "vikunja"
+            ]));
+          applications =
+          {
+            element.instances."element.chn.moe" = {};
+            synapse-admin.instances."synapse-admin.chn.moe" = {};
+            catalog.enable = true;
+            blog.enable = true;
+            main.enable = true;
+          };
+        };
+        coturn.enable = true;
+        httpua.enable = true;
+        mirism.enable = true;
+        fail2ban.enable = true;
+        wireguard =
+        {
+          enable = true;
+          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" ];
+          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+          wireguardIp = "192.168.83.1";
+          listenIp = "74.211.99.69";
+          lighthouse = true;
+        };
+        beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 64; }; };
+      };
+    };
+  };
+}
--- a/devices/vps6/secrets/default.yaml
+++ b/devices/vps6/secrets/default.yaml
@@ -10,8 +10,7 @@ xray-server:
        user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
        #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
        user2: ENC[AES256_GCM,data:e7ITe2ZouKr8dXT7SYATyzbzHaVeu6AKt1OcQKk3U0nsQgoa,iv:UbOOuojy6OAFEH8lGhKe5Hs+2K6FX5MZ8Br9AB007gs=,tag:5XeB4YngzTcHZvCpXe/ZXA==,type:str]
-        #ENC[AES256_GCM,data:vEit6GESM5G+Xw==,iv:A7uisdmzB2qiPeYkut6k8D3xxpVIBy/JE9cctC/cDQQ=,tag:ZY7Ttu5AUqjIxB4BIHEucQ==,type:comment]
-        user3: ENC[AES256_GCM,data:Q3GlAiELNXurVN3nv5k8Zt1/zqctYb3gvHZ4KnXApCRdShHT,iv:ihJ76k4NcwitdYCS0y4/UlH4K63vwmAY63bCWSi9dkk=,tag:XaH97gpAdaFkUiUTb50aLw==,type:str]
+        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
        #ENC[AES256_GCM,data:bnnxo/I=,iv:8jOo0P+8gk05O1vnxOiyGhaeD4wyuaaA3CCr8/DbzII=,tag:J6VSJZoko3EiWyn0ATcmqA==,type:comment]
@@ -48,6 +47,7 @@ xray-server:
        user20: ENC[AES256_GCM,data:uRSG6jOks7utk2bRdd5sndvqVnSGRhjkts2f3+V7JdEwQf4k,iv:xZdVv/H5RuliwSEWmgLViLquWZ5znGOpP9YwwLJfsyo=,tag:JR3BsCKkHpkE7woTaMHXwQ==,type:str]
        #ENC[AES256_GCM,data:37f8REUu8PU0lfg=,iv:WOhsotX/O7Gg+YgkK5Fuw/njKz+1OgKSx0vXl1A32XY=,tag:IyjPLut59RuK/PpCyK4ZAQ==,type:comment]
        user21: ENC[AES256_GCM,data:9cd7IY3zzoziXznclguxbmmZ5hfc2H1DPa+KW1geuybRlpB9,iv:NKwdt7ppRuNpn44f1ypNOoPS27Yqk3Z31ABQbflS9Gg=,tag:S2B1vR0PVd3FYu24XwTfpQ==,type:str]
+        #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
        user22: ENC[AES256_GCM,data:sCOmhXaJjzDIiuwP3Nh+yXQRYCppATzVWIdjOoMOlu+OFT+U,iv:HKRsCLJ/2jr7rGkM04uv4V1GKQheo2oxeFu4zqxcIAc=,tag:1swUo08hSzJ1PmQr/dBcgQ==,type:str]
        user23: ENC[AES256_GCM,data:rgS6IdC4DBLvWWBkf5Db54yaNvagfISm5tHUD1KgeqrCR5x/,iv:ANQYEXssMfbU0bvk25dVYq+yQlMiVEyQCwrGPw1AGxc=,tag:d9sOvvxheWwsE/SeOgcWUQ==,type:str]
        user24: ENC[AES256_GCM,data:3bn/ZG0En/OgY4PA4Ir8MaVWpJbX+ywpkoXQn7HChT+xhKFZ,iv:Jw8AG7vTc6j4VznekF6x2LXkoSFz960yqsSjPm1ORvw=,tag:EszCODBuLULKHJHh4Itq7A==,type:str]
@@ -73,8 +73,6 @@ send:
    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
 coturn:
    auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:1zvyGKsyJESAbf6tUCy6hX93rDXEYNA5QBsqV4Ag4+cksToQ5IubchciQt4=,iv:ZG+pCofTTGx6LcJ05qohotRcX6MK4JsUzL2DfmKE4eI=,tag:o/Vm72d4QbfLXoSVwXZYhw==,type:str]
 wireguard:
    privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
 sops:
@@ -101,8 +99,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-08T08:32:56Z"
-    mac: ENC[AES256_GCM,data:mE2I5XIv+xcbaaZmnXfxCYmb5BMGc+D4AqdmFeYDrUPLZgtaSZvJkP0pVDhJcRy7L5VooGgBaI/OFWrQMLgP0Oz2s092AwiDmCV8jLQQrXs1X+ABdHLXTLvjhnOMTk8ZV0KizWJLEuCFgZ0lS6mjVHQNDW1d2TNxAhM7JvTyOVw=,iv:BZw32WlqgQzz6j5gxS1U4l10K8C5YBZAvYotilBXPA0=,tag:oc4EqeWQK9kkPgiIHfiLjQ==,type:str]
+    lastmodified: "2024-03-07T12:36:12Z"
+    mac: ENC[AES256_GCM,data:VECN4xQhoulbsTzIZpXKYY5/8ZuC+fkSluMPJbfqcvCCvvcyclIKJJQZin5SYAxGxewQZdeyZ4sfZ+lo+0/gXiiHQPz+jqrURGIWailfnUhM/6ziHVxXAdAq2j0XNDGt1Xf+rprG+R7xhqBHK6jt/EMJBuT4ar9heo/aJBtU2hk=,iv:pYzKQAVdY0qJKRzq4eESQNd94PpK8q6xwpOowtmreVQ=,tag:LlzVVl5U/uU3eJNck9LnrQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/vps7/default.nix
+++ b/devices/vps7/default.nix
@@ -0,0 +1,79 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/e36287f7-7321-45fa-ba1e-d126717a65f0"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          decrypt.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
+        nixpkgs.march = "broadwell";
+        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        initrd.sshd.enable = true;
+        networking.hostname = "vps7";
+        gui.preferred = false;
+      };
+      packages.packageSet = "desktop";
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        sshd.enable = true;
+        rsshub.enable = true;
+        wallabag.enable = true;
+        misskey.instances =
+        {
+          misskey.hostname = "xn--s8w913fdga.chn.moe";
+          misskey-old = { port = 9727; redis.port = 3546; meilisearch.enable = false; };
+        };
+        synapse.instances =
+        {
+          synapse.matrixHostname = "synapse.chn.moe";
+          matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
+        };
+        xrdp = { enable = true; hostname = [ "vps7.chn.moe" ]; };
+        vaultwarden.enable = true;
+        beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 1024; }; };
+        photoprism.enable = true;
+        nextcloud.enable = true;
+        freshrss.enable = true;
+        send.enable = true;
+        huginn.enable = true;
+        fz-new-order.enable = true;
+        nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; };
+        httpapi.enable = true;
+        gitea.enable = true;
+        grafana.enable = true;
+        fail2ban.enable = true;
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
+          wireguardIp = "192.168.83.2";
+          listenIp = "95.111.228.40";
+        };
+        vikunja.enable = true;
+      };
+    };
+  };
+}
--- a/devices/vps7/secrets/default.yaml
+++ b/devices/vps7/secrets/default.yaml
@@ -27,6 +27,7 @@ postgresql:
    grafana: ENC[AES256_GCM,data:ZLtDIZ3oKasE4r1WNllNe/rkXxqRS+QAJI7EGPKhiFF1BtAxD46UpGQnUag3yg0gP/8+3COQs6camVSxcKFL1A==,iv:wMj3keVjNpVwNMwlt4E3ds1EYjLNIZ/S3RydhOlmYWU=,tag:ZRn7NWaUPbf2rHYLoLYw+w==,type:str]
    akkoma: ENC[AES256_GCM,data:6piRt7BbMBLVGdot+VyoJN3/S8DoPNTYHFh/1coHSLNmiA6kU/6sca4Bts1Up/Vu164oTsFAr1JsKx6tzNzAPg==,iv:qplA1GXHwzVrmjm7eagCk3PFa7DRdwaf+p7N1HLb6mw=,tag:W6WedSK3R1IgZVo/0Hr9vA==,type:str]
    synapse_matrix: ENC[AES256_GCM,data:5j+TYJ3vYUqu6CdRDYAT558DsTWbX4Rh+HuukPog5HGXlhneL3RnxVeGBR9CV1rlCP1NY99Nm8roBG+BcyPYHQ==,iv:CboB6lzqxAE/8ZlzaTU3bxw94N6OAhrq8pZ0AfxQiUc=,tag:z6cM3ufgbMn5n5PzgqdRjw==,type:str]
+    vikunja: ENC[AES256_GCM,data:syb4NYBxL3DdmZmcC+em0klmm6bkkIL/DH/gnzShYRiaezRFskT+yay9govn++SpbuvkoCJq/GYAFxNL+hcVtw==,iv:TQUgdzYQ0gqsAmux9v3BAQFNzHnCTZ+X/OC0b9Bfya8=,tag:b1AsiAW5XzA3DzGdf8J03g==,type:str]
 meilisearch:
    misskey-misskey: ENC[AES256_GCM,data:4s+qqd6mmstioC0XmG/vA6ED9mzu1vRJVPFFalRiqnnsFy0dYEU87H+y12eOp/KDSLdTNvpp6Z6jCNvxnpDXzQ==,iv:x6L9OPu/dwVsD9pYb4dqavw9NesMbo7LB+rwz6veAR4=,tag:/BBqV2sHIgPas7XsZydh2g==,type:str]
 rsshub:
@@ -53,8 +54,6 @@ synapse:
        form: ENC[AES256_GCM,data:7HF7HMUH1BTJgXXP6cpUiVj0jCwGW57bx9wKTJu7PnRsNuAam/+nKX7Zfg7WD+gSBlA=,iv:SYeUsuFVgAA6U6STCtKT5c5E8Kglh3x7hy6+Op4n0W8=,tag:eICmHTwwn0KcgNhdDGnusA==,type:str]
        signing-key: ENC[AES256_GCM,data:hzxxDbGp1L09O7+ueUSa5lJOY/QvF2zvHdpueEHjaPQEToQt9mr2loeTQHC7ObTegfLb9UHrI1jn4A==,iv:KngfahwYZZmDQ5LeOUPWptTMGAC8TZm1G0FWcrwCwsw=,tag:U9pW6/boBIpiswn67Ezrfw==,type:str]
        sliding-sync: ENC[AES256_GCM,data:BeA6g98IWDP6hnLFI77QqG6esDwB6j3OPzAv3eJxWoTajAsByHSgSYP1vHN5Iok6IgvSSmkf0/HiOJy1Ca8IIA==,iv:ca+t/rYwc/fAVUcz0JTmrRQCOcbDNscbnE8BpHkx/OE=,tag:eEfhUChUt4kRnO82XqRY4g==,type:str]
-nebula:
-    key: ENC[AES256_GCM,data:9o6EkfTWOU0KwnJsgHML4E7VOfzo3LHnlOkV8ubhi6aayXImC3lAaoPrqUI=,iv:KHprijN7z+4FIIW+D5klDM9a9VzMJ5xawPc7jJtbHmk=,tag:0DAmxoz8D5f38ndPbkNW+g==,type:str]
 vaultwarden:
    admin_token: ENC[AES256_GCM,data:muavuOY88Lm4rSEoCp4IIPp7Z+sqf36VwpnPgf+K6IwwFkUgYM1GO80ogReYWqqUM6ij1Yzl5D9ncUbq+aGTKQ==,iv:jA4MRJlz71CMmPnWjb2tGbbIoMkEsESUowhXDckKKMI=,tag:l0HaJmnU29YeFUxjOgN3Kg==,type:str]
 mariadb:
@@ -105,6 +104,8 @@ grafana:
    chn: ENC[AES256_GCM,data:0bbjggWS1MdcUIQiQyPlBTULm+faKDpJbmZmV6vSw8k=,iv:am65WQzUE+AvQrQV+NSF5u6RCWn7EetyPsdy4Cuvyyw=,tag:lxNUM1cIYVSXVgwEnS1Hdw==,type:str]
 wireguard:
    privateKey: ENC[AES256_GCM,data:TS+toaJRgAvC78XVwTciXe2IG8++vaqXVCi/u/8Aej6qq1B9Cb6f20cp5K0=,iv:T/NkLvcYiWzIDG3jWtuhe/sH2GT4z5f0xdUGbSL901I=,tag:qN7YokFBj3Kbbx4ijHTRnw==,type:str]
+vikunja:
+    jwtsecret: ENC[AES256_GCM,data:p6e22qPJzTGB21oWhSr8AA4bfrele9ZOHVtZ8BHgX21IhoKdm58coGtSX1CGXR7J6+1/74RdLY9K88nGrM1F1w==,iv:DGUO8rhf7Lg9dTqSmzlR/Jd2K4oUjO8w9E5bihwsykI=,tag:SpX6UI0QIju/tC1fIL9CCg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -129,8 +130,8 @@ sops:
            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-20T06:27:19Z"
-    mac: ENC[AES256_GCM,data:i7AN+Sd4C61GSzT409mYd6D2tQzDyONIUsto52b1mV8hIJ4Q/U9VT5wumRjm4dGUWqrq9oFdD0/iUL1CmEdasBN7VFwNEpSYl6yhzU7zX3Re3N/0mffeW0Fx/38LdvywusJAHC9yWvsNMblKDnYxGm/UI2W/7QRMDyr8jnU6La0=,iv:Ua+K1m27GkkrUn+wcylkwrdWnq1yzFG1NMVzYAiW/6k=,tag:Gqqk5zOU3Ax2Al5CvXEV7g==,type:str]
+    lastmodified: "2024-03-07T12:36:38Z"
+    mac: ENC[AES256_GCM,data:Pe1wXpemyIGckkldnOy7sWYTp/SlHT7ffNzJbeNwK9hSRGbpU9as7BQ8IenrHbO9U5QT7oij3PdzLk88ImVCbu0rZ8P6k6JbbrSEUSeN+9IRPnMDbIcpd+HQ+Ite4UjLwX7UxPuy0yRCYHiu2Fu2JpdWf+uL5bc/ZFnJ887+3lA=,iv:JmII0faZo+upukOJeCS7AbpCr2wKR5YjPX/W+kJnFUE=,tag:w5woNqrhJbZM38/RPWYmnw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/xmupc1/README.md
+++ b/devices/xmupc1/README.md
@@ -0,0 +1,125 @@
+# slurm
+
+## 基本概念
+
+队列系统换成了 slurm。这是个正经的队列系统（不像之前那样是临时手搓的），可靠性应该会好很多。
+学校的 hpc 上用的是 PBS，和这个不一样，但很多概念是相通的，例如队列、节点等（当然这里只有一个队列和一个节点）。
+这里简单记录一下如何使用。更多内容，网上随便搜一下 slurm 的教程就可以找到很多介绍，也可以看官网文档。
+
+先说明一下机器的硬件配置：CPU 有 16 个核，每个核 2 线程，也就是总共 32 个线程。
+slurm 限制 CPU 按照核（而不是线程）分配，
+  提交任务时， `sbatch` 命令中的 `cpu` 或者 `core` （它俩是同义词）都是指核的数量而不是线程数
+  （也就是说，实际运行的线程数要再乘以 2）。
+
+VASP 支持两个层面的并行，一个叫 MPI，一个叫 OpenMP，实际运行的线程数是两者的乘积。
+MPI 并行的数量就是提交任务时指定的 task 的数量，
+  OpenMP 并行的数量等于提交任务时指定的分配给每个 task 的 CPU 的数量再乘以 2，
+  也就是最终的线程数等于指定的 CPU 数量乘以 2。
+此外还有一个限制：当使用 GPU 时，MPI 并行的数量必须等于 GPU 的数量，否则 VASP 会在开头报个警告然后只用 CPU 计算（但不会报错）。
+
+## 常用命令
+
+提交一个 VASP GPU 任务的例子：
+
+```bash
+sbatch --gpus=1 --ntasks-per-gpu=1 --job-name="my great job" vasp-nvidia-6.4.0 mpirun vasp-std
+```
+
+* `--gpus=1` 指定使用一个 GPU（排到这个任务时哪个空闲就使用哪个）。
+  可以指定具体使用哪个GPU，例如 `--gpus=4090:1`。
+  可以简写为 `-G`。
+  这个选项实际上是 `--gres` 选项的一种简便写法，当需求更复杂时（例如，指定使用一个 3090 和一个 4090）时，就需要用 `--gres`。
+  例如：`--gres=gpu:3090:1,gpu:4090:1`。
+  “gre” 是 “generic resource” 的缩写。
+* `--ntasks-per-gpu=1` 是一定要写的。
+* `--job-name=` 指定任务的名字。可以简写为 `-J`。也可以不指定。
+* 默认情况下，一个 task 会搭配分配一个 CPU 核（两个线程），一般不用修改。如果一定要修改，用 `--cpus-per-task`。
+
+提交一个 VASP CPU 任务的例子：
+
+```bash
+sbatch --ntasks=2 --cpus-per-task=2 --job-name="my great job" vasp-gnu-6.4.0 mpirun vasp-std
+```
+
+* `--ntasks=2` 指定在 MPI 层面上并行的数量。
+  可以简写为 `-n`。
+* `--cpus-per-task=2` 指定每个 task 使用的 CPU 核的数量，OpenMP 并行的数量等于这个数再乘以 2。
+
+要列出已经提交（包括已经完成、取消、失败）的任务：
+
+```bash
+squeue -t all -l
+```
+
+取消一个任务：
+
+```bash
+# 按任务的 id 取消
+scancel 114514
+# 按任务的名字取消
+scancel -n my_great_job
+# 取消一个用户的所有任务
+scancel -u chn
+```
+
+要将自己已经提交的一个任务优先级提到最高（只是自己已经提交任务的最高，不影响别人的任务）：
+
+```bash
+scontrol top job_id
+```
+
+## sbatch 的更多参数
+
+```bash
+# 提交一个新任务，但是礼让后面的任务（推迟到指定时间再开始排队）
+--begin=16:00 --begin=now+1hour
+# 指定工作目录
+--chdir=/path/to/your/workdir
+# 指定备注
+--comment="my great job"
+# 指定任务的 ddl，算不完就杀掉
+--deadline=now+1hour
+# 标准错误输出写到别的文件里
+--error=error.log
+# 将一些环境变量传递给任务（=ALL是默认行为）
+--export=ALL,MY_ENV_VAR=my_value
+# 不传递现在的环境变量
+--export=NONE
+# 打开一个文件作为标准输入
+--input=
+# 发生一些事件（任务完成等）时发邮件
+--mail-type=NONE,BEGIN,END,FAIL,REQUEUE,ALL --mail-user=chn@chn.moe
+# 要求分配内存（不会真的限制内存使用，只是在分配资源时会考虑）
+--mem=20G --mem-per-cpu --mem-per-gpu
+# 输出文件是否覆盖
+--open-mode={append|truncate}
+# 指定输出文件
+-o, --output=<filename_pattern>
+# 不排队，直接跑（超额分配）
+-s, --oversubscribe
+# 包裹一个二进制程序
+--wrap=
+```
+
+# ssh
+
+ssh 就是 putty winscp 之类的工具使用的那个协议。
+
+* 地址：office.chn.moe（如果在校外，需要厦大 VPN）
+* 端口：6007
+* 用户名：自己名字的拼音首字母
+* 可以用密码登陆，也可以用证书登陆。
+
+要从本机登陆到学校 hpc 的 jykang 账户，使用下面的命令：
+
+```bash
+ssh jykang
+```
+
+# rdp
+
+就是 windows 那个远程桌面。
+
+* 地址：xmupc1.chn.moe（如果在校外，需要厦大 VPN）
+* 用户名：自己名字的拼音首字母
+* 密码和 ssh 一样。
--- a/devices/xmupc1/default.nix
+++ b/devices/xmupc1/default.nix
@@ -0,0 +1,117 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/467C-02E3" = "/boot/efi";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/2f9060bc-09b5-4348-ad0f-3a43a91d158b" = { "/nix" = "/nix"; "/nix/boot" = "/boot"; };
+              "/dev/disk/by-uuid/a04a1fb0-e4ed-4c91-9846-2f9e716f6e12" =
+              {
+                "/nix/rootfs" = "/nix/rootfs";
+                "/nix/persistent" = "/nix/persistent";
+                "/nix/nodatacow" = "/nix/nodatacow";
+                "/nix/rootfs/current" = "/";
+              };
+            };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs =
+          {
+            device = "/dev/disk/by-uuid/a04a1fb0-e4ed-4c91-9846-2f9e716f6e12";
+            waitDevices = [ "/dev/disk/by-partuuid/cdbfc7d4-965e-42f2-89a3-eb2202849429" ];
+          };
+        };
+        grub.installDevice = "efi";
+        nixpkgs =
+        {
+          march = "znver3";
+          cuda =
+          {
+            enable = true;
+            capabilities =
+            [
+              # 2080 Ti
+              "7.5"
+              # 3090
+              "8.6"
+              # 4090
+              "8.9"
+            ];
+            forwardCompat = false;
+          };
+        };
+        gui = { preferred = false; autoStart = true; };
+        kernel.patches = [ "cjktty" "lantian" ];
+        networking.hostname = "xmupc1";
+      };
+      hardware =
+      {
+        cpus = [ "amd" ];
+        gpu.type = "nvidia";
+        bluetooth.enable = true;
+        joystick.enable = true;
+        printer.enable = true;
+        sound.enable = true;
+      };
+      packages.packageSet = "workstation";
+      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        sshd = { enable = true; passwordAuthentication = true; };
+        xray.client =
+        {
+          enable = true;
+          serverAddress = "74.211.99.69";
+          serverName = "vps6.xserver.chn.moe";
+          dns.extraInterfaces = [ "docker0" ];
+        };
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        smartd.enable = true;
+        beesd =
+        {
+          enable = true;
+          instances =
+          {
+            root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
+            nix = { device = "/nix"; hashTableSizeMB = 512; };
+          };
+        };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
+          wireguardIp = "192.168.83.6";
+        };
+        slurm =
+        {
+          enable = true;
+          cpu = { cores = 16; threads = 2; };
+          memoryMB = 94208;
+          gpus = { "3090" = 1; "4090" = 1; };
+        };
+        xrdp = { enable = true; hostname = [ "xmupc1.chn.moe" ]; };
+        samba =
+        {
+          enable = true;
+          hostsAllowed = "192.168. 127.";
+          shares = { home.path = "/home"; root.path = "/"; };
+        };
+      };
+      bugs = [ "xmunet" "amdpstate" ];
+      users.users = [ "chn" "xll" "zem" "yjq" "gb" ];
+    };
+    services.hardware.bolt.enable = true;
+  };
+}
--- a/devices/xmupc1/secrets/default.yaml
+++ b/devices/xmupc1/secrets/default.yaml
@@ -0,0 +1,44 @@
+acme:
+    cloudflare.ini: ENC[AES256_GCM,data:PjCyozvFTXxA///enYYbaMZ8ISfFjJviLVKfdOcMSi5G3CEjEsp1Ez4krbgy4/eJo4v9HfTN0bMmUnl2OHOyzTg=,iv:e1iQZ5JUHkzfnfP956Lzl3FWs11xdULctA5MZsALtU0=,tag:8X2Q/Hixxn/ci4XRSUDidg==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:/7R7w+fiMw54Cmd7y/wT/s8RMqFMf3Fc0Mph0ZhURmCzowkmLEhtmw==,iv:i+Z+2NbssI864Edwf73SQfaeFuWoqr+U8eQ/8R23FOk=,tag:8ITlkS97vlsmHM1HDk6/3A==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:4PM/d263HgBseIgRplgo5ahJ8u8HuPznXt2hW5O+VawS6WjP,iv:98Ymj4eiCGQPMcaHBI9zJAaRagm82mF0LY2c9bzA+/s=,tag:8imXq/hxAxS5XKy0uWIBPw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:Azaqung7llErB7/IdnOnEkwjQ39yQHKcO7VgvMDCDTExM7nS0zx+yMYX4ls=,iv:FX8oLHMBVEnKkYOg8q2A9vFmtRZDws5T87+lEl7+2G8=,tag:DdOQUbNKB6JK7Tp6McQ0Og==,type:str]
+users:
+    xll: ENC[AES256_GCM,data:tGzKVg4prhg9oXOSX0FJIAWdF79CWsFuiU8U12dSnkBIgRXPZlJkz9mLLTENm6SjftItt/ku4MDj94KnM+nPYkIorTYtEuergg==,iv:oavvRf7/21LuDksUiXLfR2/qQNz5O6JyroxX1DwC6gc=,tag:qYbW1ZQtXo+2qGrl5wuZkA==,type:str]
+    zem: ENC[AES256_GCM,data:r2BDtAfMohsnoqw51/flvkiXe/EtJtDhakEyOTPX2E7cikfPtPD9iJPd2RnNkS3QPBKg08ex5ce2e3ywzGgNX5RKrxIacpxSSA==,iv:VfhEqTvS9qVFGif+SkBdz8VR6BXEnncMYcPQW4qqNk8=,tag:t4JBEhX+6iqnrd0JoLKpmA==,type:str]
+    yjq: ENC[AES256_GCM,data:Yb9gVDrWhpmBYI8JlGee30J+PVFVGLo4btFVGToUVj3Sr2bPetY96mEJoxYQha7SPKBoZ7+ePzWYiYOi43MZ6sYndj3C6sYmYg==,iv:2H2+ZmIIDJAKds1XSMqVcUpsix3rbxLkVlBIIAK3ifg=,tag:7redx03BsscRrk+e7dqXdg==,type:str]
+    gb: ENC[AES256_GCM,data:ZoprrHc2l0nkqy4ujYQfxNENMEnfpRhCIxX7jMPoWeTrJt2sE1AloWeVFsArJKTx8krpW96X3AXpUIauMH9kc/CviPop2QMgDw==,iv:fOIVPEHDvyZ45G9uRbx2gBE0KuZy+aEWALlXusDJ1YU=,tag:G6hZLn9/99Kj+wZAeNyxkQ==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:qQMD8SKNmxb3PdScXNqppF9zkX7dV5i7rvljvZuhiI5zLnu77qYCHBW6ymh0mrY14N9NjxmQZhZWX/H8TvBlcg==,iv:J5N3LjCYW3QmuEkMBpl7qvPFW1Z9ZoPLkj45jKcIW9U=,tag:Tl+ld07+lVkmzt7f/f2MqQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RWIreCtMeTZ0UE9Zd2di
+            VE9tR0x6SUNyWjlPV1BqMU5Tb0RTSXNGN2hNCkxuVjFFb0xJZTBMekxqdE96RlRh
+            czF0dHQxdVhsNE5tVWg0Q2RmYktsWDgKLS0tIFY3dHRlbFpsWUsyTzA3RVR1Qyts
+            UUJHMU13cm1lOXhRYzhSWlFyTFltYWcKDUxABRGskWWpHEFL44gHYzAqaQ3AmBDt
+            LcL/4IiEs3TwOpuY+WTVx8JKZBOsxcSlNahiDuCnoTbL4gZTPnd0pA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwbHd4ZHhsTk5leDlreC9E
+            TVAzRXVuS0Judk5zTGVWRVhWSUhpMFdscEg0ClVFYzZYZG9hNjJKTlRVZ1I3eXVq
+            M2Y5by85dE1QM25yQ3g3bFVSL2tsVlkKLS0tIHVYbGxrT0hOQkZ5SHBsQ3UyaVly
+            ZDNHUjE2QVlCV3p0NHdKYW5IMHVBZzQKkZtfyvfroOntg3yRjMw4jQHiQj8eaB2h
+            IeIHfW4y01mmVT2ofbtB0xYpjcl4gtUlQ8X3tn5iJ9P8gcVo0G598A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-02-26T06:04:25Z"
+    mac: ENC[AES256_GCM,data:2d3i3rcRYrB58vJuyhP4AIB11Ns+zQq0Pli1LF4sAKb75OmJ/qlRcwJKlOCASdY95FfzOQDGjfZheg58fVSd9EbYxX+npMXGUiODa8JRTHgQye3/qjFv14v49zKFJ0dNs13XnOEA4QAry/7gDlb0+M44bNRGPSZSoFX2yJ53smw=,iv:I1YDN6+26BmaWR84kq9zXNXjQ4cRvtzrS2Q13PlUjp0=,tag:sgxcTpOr7T2oXjb5qLRrqw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/devices/xmupc1/secrets/munge.key
+++ b/devices/xmupc1/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:tuEymMXW0f7Rui5wrz/xozphTEq6ffkYIfNIoURFNHwH2Cg+aKHz2ox0gk02BJARhPMDrxCYlChkcrEI0ma/T0eBe9sWz3tA8AOwU1lHSZ06d/JWzW7IUIyTac2mnjt3/jY/qpnR4A8wtHwD0j4zkzXgUgFwq7k/fs24acEE4Jo=,iv:iDTS0xswLrwkOYmfomE5hluVONgJYia/RjINDy7T3R0=,tag:oIYNpFCuT2D+X1QEJJiHew==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aFRRa0NsOUp5MEg3UHcx\nc3g1VFZEQS9Tci9QSnNFYnIrT3hUdVU5cWxjCnU5UXVEdTFXczJzcHVvSjF2WHdB\nYmpyQVVaUFozKzJIZThBbXUxb2k2YzAKLS0tIHE1QXVrOXo1Y3VXMzJJYitWU3Qv\neDF1cndrSi94clh1cS9NczN0UW9pOXcKtrnIj3WovMYdcg5nWnnyRhJhTGLrlwxW\nxQ6bmNrfbZedmCNdjY2lPXmudMXJ8YlWe/HGCe94x3iFlaSwCIGUsA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocFl1SHJEemRySlBnMmNn\nVW9RS1NNdlo4M3l2WGlQaHJmbDBHcjMwaVVnCnY5WExPOXZJVEdYSlJ6UTRBMGJj\ncmlYaUNVV1hnWTNkaWVuV2VuaXN2eU0KLS0tIDBTYnd2NmVYTUJKaHZWRWo3ZlUx\nTEtPZWc2RE1XNG9WTXFOTllWVUVWeUkK+9aLz1rygGAQjpG+oMNUtrDkQaDfg+2q\nnl/CtZZrFD6NXGw6Di0X5t9fQu295NTJ/0qjXnfMigG8gDtxkE+/7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-26T06:04:53Z",
+		"mac": "ENC[AES256_GCM,data:y0RkPyUwwff95BFL951TxS/x5ORzMsxFJVjopSw+8iVtswD8MT1nmsbwyth4C9OnJ/IAtnZk/CjAt72a68AZpPI+2W/JqJq20ohFoquDNhTlsoyLWdO3Vjrd+Wo3hp0+iKQ3e/uYrF1sTqQO9a3OIxu2sVLM0gEDmIe2nJpLJQo=,iv:EjXTQvVdjzfClNfQ3rPxAFVWVqr7sSOz4ap+nshPEAk=,tag:DcIlf9W7NNqQ+gf8f46MwQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
--- a/devices/xmupc2/default.nix
+++ b/devices/xmupc2/default.nix
@@ -0,0 +1,114 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/467C-02E3" = "/boot/efi";
+            btrfs =
+            {
+              "/dev/disk/by-uuid/2f9060bc-09b5-4348-ad0f-3a43a91d158b" = { "/nix" = "/nix"; "/nix/boot" = "/boot"; };
+              "/dev/disk/by-uuid/a04a1fb0-e4ed-4c91-9846-2f9e716f6e12" =
+              {
+                "/nix/rootfs" = "/nix/rootfs";
+                "/nix/persistent" = "/nix/persistent";
+                "/nix/nodatacow" = "/nix/nodatacow";
+                "/nix/rootfs/current" = "/";
+              };
+            };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs =
+          {
+            device = "/dev/disk/by-uuid/a04a1fb0-e4ed-4c91-9846-2f9e716f6e12";
+            waitDevices = [ "/dev/disk/by-partuuid/cdbfc7d4-965e-42f2-89a3-eb2202849429" ];
+          };
+        };
+        grub.installDevice = "efi";
+        nixpkgs =
+        {
+          march = "skylake";
+          cuda =
+          {
+            enable = true;
+            capabilities =
+            [
+              # p5000 p400
+              "6.1"
+              # 2080 Ti
+              "7.5"
+              # 3090
+              "8.6"
+              # 4090
+              "8.9"
+            ];
+            forwardCompat = false;
+          };
+        };
+        gui = { preferred = false; autoStart = true; };
+        kernel.patches = [ "cjktty" "lantian" ];
+        networking.hostname = "xmupc2";
+      };
+      hardware =
+      {
+        cpus = [ "intel" ];
+        gpu.type = "nvidia";
+        bluetooth.enable = true;
+        joystick.enable = true;
+        printer.enable = true;
+        sound.enable = true;
+      };
+      packages.packageSet = "workstation";
+      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      services =
+      {
+        snapper.enable = true;
+        fontconfig.enable = true;
+        sshd = { enable = true; passwordAuthentication = true; };
+        xray.client =
+        {
+          enable = true;
+          serverAddress = "74.211.99.69";
+          serverName = "vps6.xserver.chn.moe";
+          dns.extraInterfaces = [ "docker0" ];
+        };
+        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+        smartd.enable = true;
+        beesd =
+        {
+          enable = true;
+          instances = { root = { device = "/"; hashTableSizeMB = 16384; threads = 4; }; };
+        };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
+          wireguardIp = "192.168.83.7";
+        };
+        slurm =
+        {
+          enable = true;
+          cpu = { cores = 16; threads = 2; };
+          memoryMB = 94208;
+          gpus = { "3090" = 1; "4090" = 1; };
+        };
+        xrdp = { enable = true; hostname = [ "xmupc2.chn.moe" ]; };
+        samba =
+        {
+          enable = true;
+          hostsAllowed = "192.168. 127.";
+          shares = { home.path = "/home"; root.path = "/"; };
+        };
+      };
+      bugs = [ "xmunet" "amdpstate" ];
+      users.users = [ "chn" "xll" "zem" "yjq" "gb" ];
+    };
+  };
+}
--- a/devices/xmupc2/secrets/default.yaml
+++ b/devices/xmupc2/secrets/default.yaml
@@ -0,0 +1,44 @@
+acme:
+    cloudflare.ini: ENC[AES256_GCM,data:PjCyozvFTXxA///enYYbaMZ8ISfFjJviLVKfdOcMSi5G3CEjEsp1Ez4krbgy4/eJo4v9HfTN0bMmUnl2OHOyzTg=,iv:e1iQZ5JUHkzfnfP956Lzl3FWs11xdULctA5MZsALtU0=,tag:8X2Q/Hixxn/ci4XRSUDidg==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:/7R7w+fiMw54Cmd7y/wT/s8RMqFMf3Fc0Mph0ZhURmCzowkmLEhtmw==,iv:i+Z+2NbssI864Edwf73SQfaeFuWoqr+U8eQ/8R23FOk=,tag:8ITlkS97vlsmHM1HDk6/3A==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:4PM/d263HgBseIgRplgo5ahJ8u8HuPznXt2hW5O+VawS6WjP,iv:98Ymj4eiCGQPMcaHBI9zJAaRagm82mF0LY2c9bzA+/s=,tag:8imXq/hxAxS5XKy0uWIBPw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:Azaqung7llErB7/IdnOnEkwjQ39yQHKcO7VgvMDCDTExM7nS0zx+yMYX4ls=,iv:FX8oLHMBVEnKkYOg8q2A9vFmtRZDws5T87+lEl7+2G8=,tag:DdOQUbNKB6JK7Tp6McQ0Og==,type:str]
+users:
+    xll: ENC[AES256_GCM,data:tGzKVg4prhg9oXOSX0FJIAWdF79CWsFuiU8U12dSnkBIgRXPZlJkz9mLLTENm6SjftItt/ku4MDj94KnM+nPYkIorTYtEuergg==,iv:oavvRf7/21LuDksUiXLfR2/qQNz5O6JyroxX1DwC6gc=,tag:qYbW1ZQtXo+2qGrl5wuZkA==,type:str]
+    zem: ENC[AES256_GCM,data:r2BDtAfMohsnoqw51/flvkiXe/EtJtDhakEyOTPX2E7cikfPtPD9iJPd2RnNkS3QPBKg08ex5ce2e3ywzGgNX5RKrxIacpxSSA==,iv:VfhEqTvS9qVFGif+SkBdz8VR6BXEnncMYcPQW4qqNk8=,tag:t4JBEhX+6iqnrd0JoLKpmA==,type:str]
+    yjq: ENC[AES256_GCM,data:Yb9gVDrWhpmBYI8JlGee30J+PVFVGLo4btFVGToUVj3Sr2bPetY96mEJoxYQha7SPKBoZ7+ePzWYiYOi43MZ6sYndj3C6sYmYg==,iv:2H2+ZmIIDJAKds1XSMqVcUpsix3rbxLkVlBIIAK3ifg=,tag:7redx03BsscRrk+e7dqXdg==,type:str]
+    gb: ENC[AES256_GCM,data:ZoprrHc2l0nkqy4ujYQfxNENMEnfpRhCIxX7jMPoWeTrJt2sE1AloWeVFsArJKTx8krpW96X3AXpUIauMH9kc/CviPop2QMgDw==,iv:fOIVPEHDvyZ45G9uRbx2gBE0KuZy+aEWALlXusDJ1YU=,tag:G6hZLn9/99Kj+wZAeNyxkQ==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:qQMD8SKNmxb3PdScXNqppF9zkX7dV5i7rvljvZuhiI5zLnu77qYCHBW6ymh0mrY14N9NjxmQZhZWX/H8TvBlcg==,iv:J5N3LjCYW3QmuEkMBpl7qvPFW1Z9ZoPLkj45jKcIW9U=,tag:Tl+ld07+lVkmzt7f/f2MqQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RWIreCtMeTZ0UE9Zd2di
+            VE9tR0x6SUNyWjlPV1BqMU5Tb0RTSXNGN2hNCkxuVjFFb0xJZTBMekxqdE96RlRh
+            czF0dHQxdVhsNE5tVWg0Q2RmYktsWDgKLS0tIFY3dHRlbFpsWUsyTzA3RVR1Qyts
+            UUJHMU13cm1lOXhRYzhSWlFyTFltYWcKDUxABRGskWWpHEFL44gHYzAqaQ3AmBDt
+            LcL/4IiEs3TwOpuY+WTVx8JKZBOsxcSlNahiDuCnoTbL4gZTPnd0pA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwbHd4ZHhsTk5leDlreC9E
+            TVAzRXVuS0Judk5zTGVWRVhWSUhpMFdscEg0ClVFYzZYZG9hNjJKTlRVZ1I3eXVq
+            M2Y5by85dE1QM25yQ3g3bFVSL2tsVlkKLS0tIHVYbGxrT0hOQkZ5SHBsQ3UyaVly
+            ZDNHUjE2QVlCV3p0NHdKYW5IMHVBZzQKkZtfyvfroOntg3yRjMw4jQHiQj8eaB2h
+            IeIHfW4y01mmVT2ofbtB0xYpjcl4gtUlQ8X3tn5iJ9P8gcVo0G598A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-02-26T06:04:25Z"
+    mac: ENC[AES256_GCM,data:2d3i3rcRYrB58vJuyhP4AIB11Ns+zQq0Pli1LF4sAKb75OmJ/qlRcwJKlOCASdY95FfzOQDGjfZheg58fVSd9EbYxX+npMXGUiODa8JRTHgQye3/qjFv14v49zKFJ0dNs13XnOEA4QAry/7gDlb0+M44bNRGPSZSoFX2yJ53smw=,iv:I1YDN6+26BmaWR84kq9zXNXjQ4cRvtzrS2Q13PlUjp0=,tag:sgxcTpOr7T2oXjb5qLRrqw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/devices/xmupc2/secrets/munge.key
+++ b/devices/xmupc2/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:tuEymMXW0f7Rui5wrz/xozphTEq6ffkYIfNIoURFNHwH2Cg+aKHz2ox0gk02BJARhPMDrxCYlChkcrEI0ma/T0eBe9sWz3tA8AOwU1lHSZ06d/JWzW7IUIyTac2mnjt3/jY/qpnR4A8wtHwD0j4zkzXgUgFwq7k/fs24acEE4Jo=,iv:iDTS0xswLrwkOYmfomE5hluVONgJYia/RjINDy7T3R0=,tag:oIYNpFCuT2D+X1QEJJiHew==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aFRRa0NsOUp5MEg3UHcx\nc3g1VFZEQS9Tci9QSnNFYnIrT3hUdVU5cWxjCnU5UXVEdTFXczJzcHVvSjF2WHdB\nYmpyQVVaUFozKzJIZThBbXUxb2k2YzAKLS0tIHE1QXVrOXo1Y3VXMzJJYitWU3Qv\neDF1cndrSi94clh1cS9NczN0UW9pOXcKtrnIj3WovMYdcg5nWnnyRhJhTGLrlwxW\nxQ6bmNrfbZedmCNdjY2lPXmudMXJ8YlWe/HGCe94x3iFlaSwCIGUsA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocFl1SHJEemRySlBnMmNn\nVW9RS1NNdlo4M3l2WGlQaHJmbDBHcjMwaVVnCnY5WExPOXZJVEdYSlJ6UTRBMGJj\ncmlYaUNVV1hnWTNkaWVuV2VuaXN2eU0KLS0tIDBTYnd2NmVYTUJKaHZWRWo3ZlUx\nTEtPZWc2RE1XNG9WTXFOTllWVUVWeUkK+9aLz1rygGAQjpG+oMNUtrDkQaDfg+2q\nnl/CtZZrFD6NXGw6Di0X5t9fQu295NTJ/0qjXnfMigG8gDtxkE+/7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-26T06:04:53Z",
+		"mac": "ENC[AES256_GCM,data:y0RkPyUwwff95BFL951TxS/x5ORzMsxFJVjopSw+8iVtswD8MT1nmsbwyth4C9OnJ/IAtnZk/CjAt72a68AZpPI+2W/JqJq20ohFoquDNhTlsoyLWdO3Vjrd+Wo3hp0+iKQ3e/uYrF1sTqQO9a3OIxu2sVLM0gEDmIe2nJpLJQo=,iv:EjXTQvVdjzfClNfQ3rPxAFVWVqr7sSOz4ap+nshPEAk=,tag:DcIlf9W7NNqQ+gf8f46MwQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,9 @@
  {
    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-23.11";
    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
-    nixpkgs-2305.url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    "nixpkgs-22.11".url = "github:NixOS/nixpkgs/nixos-22.11";
+    "nixpkgs-22.05".url = "github:NixOS/nixpkgs/nixos-22.05";
    home-manager = { url = "github:nix-community/home-manager/release-23.11"; inputs.nixpkgs.follows = "nixpkgs"; };
    sops-nix =
    {
@@ -13,36 +15,57 @@
      inputs = { nixpkgs.follows = "nixpkgs"; nixpkgs-stable.follows = "nixpkgs"; };
    };
    aagl = { url = "github:ezKEa/aagl-gtk-on-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs-unstable"; };
    nur.url = "github:nix-community/NUR";
    nixos-cn = { url = "github:nixos-cn/flakes"; inputs.nixpkgs.follows = "nixpkgs"; };
    nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-vscode-extensions = { url = "github:nix-community/nix-vscode-extensions"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-alien =
-    {
-      url = "github:thiagokokada/nix-alien";
-      inputs = { nixpkgs.follows = "nixpkgs"; nix-index-database.follows = "nix-index-database"; };
-    };
    impermanence.url = "github:nix-community/impermanence";
-    qchem = { url = "github:Nix-QChem/NixOS-QChem"; inputs.nixpkgs.follows = "nixpkgs"; };
+    qchem = { url = "github:Nix-QChem/NixOS-QChem/release-23.11"; inputs.nixpkgs.follows = "nixpkgs"; };
    nixd = { url = "github:nix-community/nixd"; inputs.nixpkgs.follows = "nixpkgs"; };
    napalm = { url = "github:nix-community/napalm"; inputs.nixpkgs.follows = "nixpkgs"; };
    nixpak = { url = "github:nixpak/nixpak"; inputs.nixpkgs.follows = "nixpkgs"; };
    deploy-rs = { url = "github:serokell/deploy-rs"; inputs.nixpkgs.follows = "nixpkgs"; };
    pnpm2nix-nzbr = { url = "github:CHN-beta/pnpm2nix-nzbr"; inputs.nixpkgs.follows = "nixpkgs"; };
-    lmix = { url = "github:CHN-beta/lmix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    dguibert-nur-packages = { url = "github:CHN-beta/dguibert-nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    plasma-manager =
    {
      url = "github:pjones/plasma-manager";
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
    nix-doom-emacs = { url = "github:nix-community/nix-doom-emacs"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nixos-hardware.url = "github:CHN-beta/nixos-hardware";
+    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-fast-build = { url = "github:/Mic92/nix-fast-build"; inputs.nixpkgs.follows = "nixpkgs"; };
+
+    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
+    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
+    zpp-bits = { url = "github:eyalz800/zpp_bits"; flake = false; };
+    citation-style-language = { url = "git+https://github.com/zepinglee/citeproc-lua?submodules=1"; flake = false; };
+    concurrencpp = { url = "github:David-Haim/concurrencpp"; flake = false; };
+    cppcoro = { url = "github:Garcia6l20/cppcoro"; flake = false; };
+    date = { url = "github:HowardHinnant/date"; flake = false; };
+    eigen = { url = "gitlab:libeigen/eigen"; flake = false; };
+    matplotplusplus = { url = "github:alandefreitas/matplotplusplus"; flake = false; };
+    nameof = { url = "github:Neargye/nameof"; flake = false; };
+    nodesoup = { url = "github:olvb/nodesoup"; flake = false; };
+    tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
+    v-sim = { url = "gitlab:l_sim/v_sim"; flake = false; };
+    win11os-kde = { url = "github:yeyushengfan258/Win11OS-kde"; flake = false; };
+    fluent-kde = { url = "github:vinceliuice/Fluent-kde"; flake = false; };
+    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
+    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
+    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
+    linux-surface = { url = "github:linux-surface/linux-surface"; flake = false; };
+    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
+    lmod = { url = "github:TACC/Lmod"; flake = false; };
+    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
  };

  outputs = inputs:
    let
      localLib = import ./local/lib inputs.nixpkgs.lib;
+      devices = builtins.attrNames (builtins.readDir ./devices);
    in
    {
      packages.x86_64-linux =
@@ -50,7 +73,7 @@
        default = inputs.nixpkgs.legacyPackages.x86_64-linux.writeText "systems"
          (builtins.concatStringsSep "\n" (builtins.map
            (system: builtins.toString inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel)
-            [ "pc" "vps6" "vps7" "nas" "yoga" ]));
+            devices));
      }
      // (
        builtins.listToAttrs (builtins.map
@@ -59,569 +82,32 @@
            name = system;
            value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
          })
-          [ "pc" "vps6" "vps7" "nas" "yoga" "xmupc1" ])
+          devices)
      );
      # ssh-keygen -t rsa -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_rsa_key
      # ssh-keygen -t ed25519 -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_ed25519_key
      # systemd-machine-id-setup --root=/mnt/nix/persistent
-      nixosConfigurations =
-        let
-          system =
+      nixosConfigurations = builtins.listToAttrs (builtins.map
+        (system:
+        {
+          name = system;
+          value = inputs.nixpkgs.lib.nixosSystem
          {
-            pc =
-            {
-              system =
+            system = "x86_64-linux";
+            specialArgs = { topInputs = inputs; inherit localLib; };
+            modules = localLib.mkModules
+            [
+              (moduleInputs:
              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.auto =
-                  {
-                    "/dev/disk/by-uuid/55fdd19f-0f1d-4c37-bd4e-6df44fc31f26" = { mapper = "root"; ssd = true; };
-                    "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
-                      { mapper = "swap"; ssd = true; before = [ "root" ]; };
-                  };
-                  swap = [ "/dev/mapper/swap" ];
-                  resume = "/dev/mapper/swap";
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub =
-                {
-                  windowsEntries = { "7317-1DB6" = "Windows"; "7321-FA9C" = "Windows for malware"; };
-                  installDevice = "efi";
-                };
-                nix =
-                {
-                  marches =
-                  [
-                    "alderlake"
-                    # CX16
-                    "sandybridge"
-                    # CX16 SAHF FXSR
-                    "silvermont"
-                    # RDSEED MWAITX SHA CLZERO CX16 SSE4A ABM CLFLUSHOPT WBNOINVD
-                    "znver2" "znver3"
-                    # CX16 SAHF FXSR HLE RDSEED
-                    "broadwell"
-                  ];
-                  keepOutputs = true;
-                };
-                nixpkgs =
-                  { march = "alderlake"; cuda = { enable = true; capabilities = [ "8.6" ]; forwardCompat = false; }; };
-                kernel.patches = [ "cjktty" "lantian" ];
-                impermanence.enable = true;
-                networking.hostname = "pc";
-                sysctl.laptop-mode = 5;
-              };
-              hardware =
-              {
-                cpus = [ "intel" ];
-                gpus = [ "intel" "nvidia" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                prime = { enable = true; mode = "offload"; busId = { intel = "PCI:0:2:0"; nvidia = "PCI:1:0:0"; }; };
-                gamemode.drmDevice = 1;
-              };
-              packages.packageSet = "workstation";
-              virtualization =
-              {
-                waydroid.enable = true;
-                docker.enable = true;
-                kvmHost = { enable = true; gui = true; autoSuspend = [ "win10" "hardconnect" ]; };
-                # kvmGuest.enable = true;
-                nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
-              };
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  private = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares =
-                  {
-                    media.path = "/run/media/chn";
-                    home.path = "/home/chn";
-                    mnt.path = "/mnt";
-                    share.path = "/home/chn/share";
-                  };
-                };
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns =
-                  {
-                    extraInterfaces = [ "docker0" ];
-                    hosts =
-                    {
-                      "mirism.one" = "74.211.99.69";
-                      "beta.mirism.one" = "74.211.99.69";
-                      "ng01.mirism.one" = "74.211.99.69";
-                      "debug.mirism.one" = "127.0.0.1";
-                      "initrd.vps6.chn.moe" = "74.211.99.69";
-                      "nix-store.chn.moe" = "127.0.0.1";
-                      "initrd.nas.chn.moe" = "192.168.1.185";
-                    };
-                  };
-                };
-                firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
-                acme = { enable = true; cert."debug.mirism.one" = {}; };
-                frpClient =
-                {
-                  enable = true;
-                  serverName = "frp.chn.moe";
-                  user = "pc";
-                  stcpVisitor."yy.vnc".localPort = 6187;
-                };
-                nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
-                smartd.enable = true;
-                misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
-                beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 2048; }; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
-                  wireguardIp = "192.168.83.3";
-                };
-              };
-              bugs =
-              [
-                "suspend-hibernate-no-platform" "hibernate-iwlwifi" "suspend-lid-no-wakeup" "xmunet"
-                "suspend-hibernate-waydroid" "power"
-              ];
-            };
-            vps6 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/24577c0e-d56b-45ba-8b36-95a848228600"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
-                    delayedMount = [ "/" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
-                nixpkgs.march = "sandybridge";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                initrd.sshd.enable = true;
-                impermanence.enable = true;
-                networking.hostname = "vps6";
-              };
-              packages.packageSet = "server";
-              services =
-              {
-                snapper.enable = true;
-                sshd.enable = true;
-                xrayServer = { enable = true; serverName = "vps6.xserver.chn.moe"; };
-                frpServer = { enable = true; serverName = "frp.chn.moe"; };
-                nginx =
-                {
-                  streamProxy.map =
-                  {
-                    "anchor.fm" = { upstream = "anchor.fm:443"; proxyProtocol = false; };
-                    "podcasters.spotify.com" = { upstream = "podcasters.spotify.com:443"; proxyProtocol = false; };
-                    "xlog.chn.moe" = { upstream = "cname.xlog.app:443"; proxyProtocol = false; };
-                  }
-                  // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.pc.chn.moe"; })
-                    [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
-                  // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
-                    [
-                      "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
-                      "send" "kkmeeting" "api" "git" "grafana"
-                    ]));
-                  applications =
-                  {
-                    element.instances."element.chn.moe" = {};
-                    synapse-admin.instances."synapse-admin.chn.moe" = {};
-                    catalog.enable = true;
-                    blog.enable = true;
-                    main.enable = true;
-                  };
-                };
-                coturn.enable = true;
-                httpua.enable = true;
-                mirism.enable = true;
-                fail2ban.enable = true;
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "pc" "nas" "vps7" ];
-                  publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
-                  wireguardIp = "192.168.83.1";
-                  externalIp = "74.211.99.69";
-                  lighthouse = true;
-                };
-              };
-            };
-            vps7 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/e36287f7-7321-45fa-ba1e-d126717a65f0"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
-                    delayedMount = [ "/" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
-                nixpkgs.march = "broadwell";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                initrd.sshd.enable = true;
-                impermanence.enable = true;
-                networking.hostname = "vps7";
-                gui.preferred = false;
-              };
-              packages.packageSet = "desktop";
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                sshd.enable = true;
-                rsshub.enable = true;
-                wallabag.enable = true;
-                misskey.instances =
-                {
-                  misskey.hostname = "xn--s8w913fdga.chn.moe";
-                  misskey-old = { port = 9727; redis.port = 3546; meilisearch.enable = false; };
-                };
-                synapse.instances =
-                {
-                  synapse.matrixHostname = "synapse.chn.moe";
-                  matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
-                };
-                xrdp = { enable = true; hostname = [ "vps7.chn.moe" ]; };
-                vaultwarden.enable = true;
-                beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 1024; }; };
-                photoprism.enable = true;
-                nextcloud.enable = true;
-                freshrss.enable = true;
-                send.enable = true;
-                huginn.enable = true;
-                fz-new-order.enable = true;
-                nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; };
-                httpapi.enable = true;
-                mastodon.enable = true;
-                gitea.enable = true;
-                grafana.enable = true;
-                fail2ban.enable = true;
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
-                  wireguardIp = "192.168.83.2";
-                  externalIp = "95.111.228.40";
-                };
-              };
-            };
-            nas =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/13BC-F0C9" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/0e184f3b-af6c-4f5d-926a-2559f2dc3063"."/boot" = "/boot";
-                      "/dev/mapper/nix"."/nix" = "/nix";
-                      "/dev/mapper/root1" =
-                      {
-                        "/nix/rootfs" = "/nix/rootfs";
-                        "/nix/persistent" = "/nix/persistent";
-                        "/nix/nodatacow" = "/nix/nodatacow";
-                        "/nix/rootfs/current" = "/";
-                        "/nix/backup" = "/nix/backup";
-                      };
-                    };
-                  };
-                  decrypt.manual =
-                  {
-                    enable = true;
-                    devices =
-                    {
-                      "/dev/disk/by-uuid/5cf1d19d-b4a5-4e67-8e10-f63f0d5bb649".mapper = "root1";
-                      "/dev/disk/by-uuid/aa684baf-fd8a-459c-99ba-11eb7636cb0d".mapper = "root2";
-                      "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
-                    };
-                    delayedMount = [ "/" "/nix" ];
-                  };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root1"; path = "/nix/rootfs"; };
-                };
-                initrd.sshd.enable = true;
-                grub.installDevice = "efi";
-                nixpkgs.march = "silvermont";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "nas";
-                gui.preferred = false;
-              };
-              hardware = { cpus = [ "intel" ]; gpus = [ "intel" ]; };
-              packages.packageSet = "desktop";
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares = { home.path = "/home"; root.path = "/"; };
-                };
-                sshd = { enable = true; passwordAuthentication = true; };
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                xrdp = { enable = true; hostname = [ "nas.chn.moe" "office.chn.moe" ]; };
-                groupshare.enable = true;
-                smartd.enable = true;
-                beesd =
-                {
-                  enable = true;
-                  instances =
-                  {
-                    root = { device = "/"; hashTableSizeMB = 2048; };
-                    nix = { device = "/nix"; hashTableSizeMB = 128; };
-                  };
-                };
-                frpClient =
-                {
-                  enable = true;
-                  serverName = "frp.chn.moe";
-                  user = "nas";
-                  stcp.hpc = { localIp = "hpc.xmu.edu.cn"; localPort = 22; };
-                };
-                nginx = { enable = true; applications.webdav.instances."local.webdav.chn.moe" = {}; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
-                  wireguardIp = "192.168.83.4";
-                };
-              };
-              users.users = [ "chn" "xll" "zem" "yjq" "yxy" ];
-            };
-            yoga =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/86B8-CF80" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/e252f81d-b4b3-479f-8664-380a9b73cf83"."/boot" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  decrypt.auto."/dev/disk/by-uuid/8186d34e-005c-4461-94c7-1003a5bd86c0" =
-                    { mapper = "root"; ssd = true; };
-                  swap = [ "/nix/swap/swap" ];
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                nixpkgs.march = "silvermont";
-                grub.installDevice = "efi";
-                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "yoga";
-              };
-              hardware =
-              {
-                cpus = [ "intel" ];
-                gpus = [ "intel" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                halo-keyboard.enable = true;
-              };
-              packages.packageSet = "desktop-fat";
-              virtualization.docker.enable = true;
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                firewall.trustedInterfaces = [ "virbr0" ];
-              };
-              bugs = [ "xmunet" ];
-            };
-            xmupc1 =
-            {
-              system =
-              {
-                fileSystems =
-                {
-                  mount =
-                  {
-                    vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
-                    btrfs =
-                    {
-                      "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
-                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-                    };
-                  };
-                  swap = [ "/dev/mapper/swap" ];
-                  resume = "/dev/mapper/swap";
-                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
-                };
-                grub.installDevice = "efi";
-                nixpkgs =
-                {
-                  march = "znver3";
-                  cuda =
-                  {
-                    enable = true;
-                    capabilities =
-                    [
-                      # 2080 Ti
-                      "7.5"
-                      # 3090
-                      "8.6"
-                      # 4090
-                      "8.9"
-                    ];
-                    forwardCompat = false;
-                  };
-                };
-                gui.preferred = false;
-                kernel.patches = [ "cjktty" ];
-                impermanence.enable = true;
-                networking.hostname = "xmupc1";
-              };
-              hardware =
-              {
-                cpus = [ "amd" ];
-                gpus = [ "nvidia" ];
-                bluetooth.enable = true;
-                joystick.enable = true;
-                printer.enable = true;
-                sound.enable = true;
-                gamemode.drmDevice = 1;
-              };
-              packages.packageSet = "workstation";
-              virtualization = { docker.enable = true; kvmHost = { enable = true; gui = true; }; };
-              services =
-              {
-                snapper.enable = true;
-                fontconfig.enable = true;
-                samba =
-                {
-                  enable = true;
-                  private = true;
-                  hostsAllowed = "192.168. 127.";
-                  shares =
-                  {
-                    media.path = "/run/media/chn";
-                    home.path = "/home/chn";
-                    mnt.path = "/mnt";
-                    share.path = "/home/chn/share";
-                  };
-                };
-                sshd.enable = true;
-                xrayClient =
-                {
-                  enable = true;
-                  serverAddress = "74.211.99.69";
-                  serverName = "vps6.xserver.chn.moe";
-                  dns.extraInterfaces = [ "docker0" ];
-                };
-                firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
-                acme = { enable = true; cert."debug.mirism.one" = {}; };
-                smartd.enable = true;
-                beesd = { enable = true; instances.root = { device = "/nix/persistent"; hashTableSizeMB = 2048; }; };
-                wireguard =
-                {
-                  enable = true;
-                  peers = [ "vps6" ];
-                  publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
-                  wireguardIp = "192.168.83.5";
-                };
-              };
-              bugs = [ "xmunet" "firefox" ];
-            };
+                config.nixpkgs.overlays = [(final: prev: { localPackages =
+                  import ./local/pkgs { inherit (moduleInputs) lib; pkgs = final; topInputs = inputs; };})];
+              })
+              ./modules
+              ./devices/${system}
+            ];
          };
-        in builtins.listToAttrs (builtins.map
-          (system:
-          {
-            name = system.name;
-            value = inputs.nixpkgs.lib.nixosSystem
-            {
-              system = "x86_64-linux";
-              specialArgs = { topInputs = inputs; inherit localLib; };
-              modules = localLib.mkModules
-              [
-                (inputs: { config.nixpkgs.overlays = [(final: prev:
-                  { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); })]; })
-                ./modules
-                { config.nixos = system.value; }
-              ];
-            };
-          })
-          (localLib.attrsToList system));
+        })
+        devices);
      # sudo HTTPS_PROXY=socks5://127.0.0.1:10884 nixos-install --flake .#bootstrap --option substituters http://127.0.0.1:5000 --option require-sigs false --option system-features gccarch-silvermont
      # nix-serve -p 5000
      # nix copy --substitute-on-destination --to ssh://server /run/current-system
@@ -657,10 +143,12 @@
                inputs.self.nixosConfigurations.${node};
            };
          })
-          [ "vps6" "vps7" "nas" "yoga" ]);
+          [ "vps6" "vps7" "nas" "surface" "xmupc1" ]
+        );
      };
      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks inputs.self.deploy) inputs.deploy-rs.lib;
      overlays.default = final: prev:
        { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); };
+      config.archive = false;
    };
 }
--- a/local/lib/default.nix
+++ b/local/lib/default.nix
@@ -1,6 +1,6 @@
 lib:
 {
-  attrsToList = Attrs: builtins.map ( name: { inherit name; value = Attrs.${name}; } ) ( builtins.attrNames Attrs );
+  attrsToList = attrs: builtins.map (name: { inherit name; value = attrs.${name}; }) (builtins.attrNames attrs);
  mkConditional = condition: trueResult: falseResult: let inherit (lib) mkMerge mkIf; in
    mkMerge [ ( mkIf condition trueResult ) ( mkIf (!condition) falseResult ) ];

--- a/local/pkgs/aocc/default.nix
+++ b/local/pkgs/aocc/default.nix
@@ -0,0 +1 @@
+1k9anln9hmdjflrkq4iacrmhma7gfrfj6d0b8ywxys0wfpdvy12v
--- a/local/pkgs/blurred-wallpaper/default.nix
+++ b/local/pkgs/blurred-wallpaper/default.nix
@@ -0,0 +1,11 @@
+{ stdenv, src }: stdenv.mkDerivation
+{
+  name = "blurred-wallpaper";
+  inherit src;
+  phases = [ "installPhase" ];
+  installPhase =
+  ''
+    mkdir -p $out/share/plasma/wallpapers/a2n.blur
+    cp -r $src/* $out/share/plasma/wallpapers/a2n.blur
+  '';
+}
--- a/local/pkgs/chromiumos-touch-keyboard/default.nix
+++ b/local/pkgs/chromiumos-touch-keyboard/default.nix
@@ -1,18 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, cmake }: stdenv.mkDerivation rec
-{
-  pname = "chromiumos-touch-keyboard";
-  version = "1.4.1";
-  src = fetchFromGitHub
-  {
-    owner = "CHN-beta";
-    repo = "chromiumos_touch_keyboard";
-    rev = "32b72240ccac751a1b983152f65aa5b19503ffcf";
-    sha256 = "eFesDSBS2VzTOVfepgXYGynWvkrCSdCV9C/gcG/Ocbg=";
-  };
-  cmakeFlags = [ "-DCMAKE_CXX_FLAGS=-Wno-error=stringop-truncation" ];
-  nativeBuildInputs = [ cmake ];
-  postInstall =
-  ''
-    cp $out/etc/touch_keyboard/layouts/YB1-X9x-pc105.csv $out/etc/touch_keyboard/layout.csv
-  '';
-}
--- a/local/pkgs/citation-style-language/default.nix
+++ b/local/pkgs/citation-style-language/default.nix
@@ -1,22 +1,14 @@
-{ stdenvNoCC, texlive, fetchFromGitHub }: stdenvNoCC.mkDerivation (finalAttrs: rec
+{ stdenvNoCC, texlive, src }: stdenvNoCC.mkDerivation (finalAttrs:
 {
-  pname = "citation-style-language";
-  version = "0.4.5";
-  passthru = {
+  name = "citation-style-language";
+  inherit src;
+  passthru =
+  {
    pkgs = [ finalAttrs.finalPackage ];
    tlDeps = with texlive; [ latex ];
    tlType = "run";
  };

-  src = fetchFromGitHub
-  {
-    owner = "zepinglee";
-    repo = "citeproc-lua";
-    rev = "v${version}";
-    sha256 = "XH+GH+t/10hr4bfaod8F9JPxmBnAQlDmpSvQNDQsslM=";
-    fetchSubmodules = true;
-  };
-
  nativeBuildInputs = [ texlive.combined.scheme-full ];
  dontConfigure = true;
  dontBuild = true;
--- a/local/pkgs/concurrencpp/default.nix
+++ b/local/pkgs/concurrencpp/default.nix
@@ -1,13 +1,6 @@
-{ stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation rec
+{ stdenv, cmake, src }: stdenv.mkDerivation
 {
-  pname = "concurrencpp";
-  version = "0.1.7";
-  src = fetchFromGitHub
-  {
-    owner = "David-Haim";
-    repo = "concurrencpp";
-    rev = "v.${version}";
-    sha256 = "4qT29YVjKEWcMrI5R5Ps8aD4grAAgz5VOxANjpp1oTo=";
-  };
+  name = "concurrencpp";
+  inherit src;
  nativeBuildInputs = [ cmake ];
 }
--- a/local/pkgs/cppcoro/default.nix
+++ b/local/pkgs/cppcoro/default.nix
@@ -1,13 +1,7 @@
-{ stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation
+{ stdenv, cmake, src }: stdenv.mkDerivation
 {
  name = "cppcoro";
-  src = fetchFromGitHub
-  {
-    owner = "Garcia6l20";
-    repo = "cppcoro";
-    rev = "e1d53e620b0eee828915ada179cd7ca8e66ca855";
-    sha256 = "luBkf1x5kqXaVbQM01yWRmA5QvrQNZkFVCjRctJdnXc=";
-  };
+  inherit src;
  nativeBuildInputs = [ cmake ];
  patches = [ ./cppcoro-include-utility.patch ];
 }
--- a/local/pkgs/date/default.nix
+++ b/local/pkgs/date/default.nix
@@ -1,18 +1,13 @@
-{ stdenv, fetchFromGitHub }: stdenv.mkDerivation
+{ stdenv, src }: stdenv.mkDerivation
 {
  name = "date";
-  src = fetchFromGitHub
-  {
-    owner = "HowardHinnant";
-    repo = "date";
-    rev = "cc4685a21e4a4fdae707ad1233c61bbaff241f93";
-    sha256 = "KilhBEeLMvHtS76Gu0UhzE8lhS1+sCwQ1UL4pswKXTs=";
-  };
+  inherit src;
  phases = [ "installPhase" ];
  installPhase =
  ''
    runHook preInstall
    mkdir -p $out
    cp -r $src/{include,src} $out
+    runHook postInstall
  '';
 }
--- a/local/pkgs/default.nix
+++ b/local/pkgs/default.nix
@@ -1,48 +1,69 @@
-{ lib, pkgs }: with pkgs; rec
+{ lib, pkgs, topInputs }: with pkgs; rec
 {
  typora = callPackage ./typora {};
  vesta = callPackage ./vesta {};
-  oneapi = callPackage ./oneapi {};
-  rsshub = callPackage ./rsshub {};
-  misskey = callPackage ./misskey { nodejs = nodejs_21; };
+  rsshub = callPackage ./rsshub { src = topInputs.rsshub; };
+  misskey = callPackage ./misskey { nodejs = nodejs_21; src = topInputs.misskey; };
  mk-meili-mgn = callPackage ./mk-meili-mgn {};
-  # vasp = callPackage ./vasp
-  # {
-  #   stdenv = pkgs.lmix-pkgs.intel21Stdenv;
-  #   intel-mpi = pkgs.lmix-pkgs.intel-oneapi-mpi_2021_9_0;
-  #   ifort = pkgs.lmix-pkgs.intel-oneapi-ifort_2021_9_0;
-  # };
-  vasp = callPackage ./vasp
-  {
-    openmp = llvmPackages.openmp;
-    openmpi = pkgs.openmpi.override { cudaSupport = false; };
-  };
  vaspkit = callPackage ./vaspkit { attrsToList = (import ../lib lib).attrsToList; };
-  v_sim = callPackage ./v_sim {};
-  concurrencpp = callPackage ./concurrencpp { stdenv = gcc13Stdenv; };
+  v-sim = callPackage ./v-sim { src = topInputs.v-sim; };
+  concurrencpp = callPackage ./concurrencpp { stdenv = gcc13Stdenv; src = topInputs.concurrencpp; };
  eigengdb = python3Packages.callPackage ./eigengdb {};
-  nodesoup = callPackage ./nodesoup {};
-  matplotplusplus = callPackage ./matplotplusplus { inherit nodesoup glad; };
-  zpp-bits = callPackage ./zpp-bits {};
-  eigen = callPackage ./eigen {};
-  nameof = callPackage ./nameof {};
+  nodesoup = callPackage ./nodesoup { src = topInputs.nodesoup; };
+  matplotplusplus = callPackage ./matplotplusplus { inherit nodesoup glad; src = topInputs.matplotplusplus; };
+  zpp-bits = callPackage ./zpp-bits { src = topInputs.zpp-bits; };
+  eigen = callPackage ./eigen { src = topInputs.eigen; };
+  nameof = callPackage ./nameof { src = topInputs.nameof; };
  pslist = callPackage ./pslist {};
  glad = callPackage ./glad {};
  chromiumos-touch-keyboard = callPackage ./chromiumos-touch-keyboard {};
  yoga-support = callPackage ./yoga-support {};
-  tgbot-cpp = callPackage ./tgbot-cpp {};
+  tgbot-cpp = callPackage ./tgbot-cpp { src = topInputs.tgbot-cpp; };
  biu = callPackage ./biu { inherit concurrencpp tgbot-cpp nameof; stdenv = gcc13Stdenv; };
-  citation-style-language = callPackage ./citation-style-language {};
+  citation-style-language = callPackage ./citation-style-language { src = topInputs.citation-style-language; };
  mirism = callPackage ./mirism
  {
    inherit cppcoro nameof tgbot-cpp date;
-    nghttp2 = nghttp2-2305.override { enableAsioLib = true; };
+    nghttp2 = pkgs."nghttp2-23.05".override { enableAsioLib = true; };
  };
-  cppcoro = callPackage ./cppcoro {};
-  date = callPackage ./date {};
+  cppcoro = callPackage ./cppcoro { src = topInputs.cppcoro; };
+  date = callPackage ./date { src = topInputs.date; };
  esbonio = python3Packages.callPackage ./esbonio {};
  pix2tex = python3Packages.callPackage ./pix2tex {};
  pyreadline3 = python3Packages.callPackage ./pyreadline3 {};
  torchdata = python3Packages.callPackage ./torchdata {};
  torchtext = python3Packages.callPackage ./torchtext { inherit torchdata; };
+  win11os-kde = callPackage ./win11os-kde { src = topInputs.win11os-kde; };
+  fluent-kde = callPackage ./fluent-kde { src = topInputs.fluent-kde; };
+  blurred-wallpaper = callPackage ./blurred-wallpaper { src = topInputs.blurred-wallpaper; };
+  slate = callPackage ./slate { src = topInputs.slate; };
+  nvhpc = callPackage ./nvhpc {};
+  lmod = callPackage ./lmod { src = topInputs.lmod; };
+  vasp =
+  {
+    source = callPackage ./vasp/source.nix {};
+    gnu = callPackage ./vasp/gnu
+    {
+      inherit (llvmPackages) openmp;
+      inherit (unstablePackages) wannier90;
+      hdf5 = hdf5.override { mpiSupport = true; fortranSupport = true; };
+    };
+    nvidia = callPackage ./vasp/nvidia
+    {
+      inherit lmod;
+      nvhpc = nvhpc."24.1";
+      hdf5 = hdf5-nvhpc.override { nvhpc = nvhpc."24.1"; };
+      inherit (unstablePackages) wannier90;
+    };
+    intel = callPackage ./vasp/intel
+    {
+      inherit lmod;
+      oneapi = oneapi."2022.2";
+      hdf5 = hdf5.override { mpiSupport = true; fortranSupport = true; };
+      inherit (unstablePackages) wannier90;
+    };
+  };
+  hdf5-nvhpc = callPackage ./hdf5-nvhpc { inherit lmod; inherit (hdf5) src; nvhpc = nvhpc."24.1"; };
+  oneapi = callPackage ./oneapi {};
+  mumax = callPackage ./mumax { src = topInputs.mumax; };
 }
--- a/local/pkgs/eigen/default.nix
+++ b/local/pkgs/eigen/default.nix
@@ -1,12 +1,6 @@
-{ lib, stdenv, fetchFromGitLab, cmake }: stdenv.mkDerivation rec
+{ lib, stdenv, cmake, src }: stdenv.mkDerivation
 {
  name = "eigen";
-  src = fetchFromGitLab
-  {
-    owner = "libeigen";
-    repo = name;
-    rev = "6d829e766ff1b1ab867d93631163cbc63ed5798f";
-    sha256 = "BXUnizcRPrOyiPpoyYJ4VVOjlG49aj80mgzPKmEYPKU=";
-  };
+  inherit src;
  nativeBuildInputs = [ cmake ];
 }
--- a/local/pkgs/esbonio/default.nix
+++ b/local/pkgs/esbonio/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchPypi, buildPythonPackage }: buildPythonPackage rec
 {
  pname = "esbonio";
-  version = "0.16.3";
+  version = "0.16.4";
  src = fetchPypi
  {
    inherit pname version;
-    sha256 = "1ggxdzl95fy0zxpyd1pcylhif1x604wk4wy7sv9322hc84b708zx";
+    sha256 = "1MBNBLCEBD6HtlxEASc4iZaXYyNdih2MIHoxK84jMdI=";
  };
  doCheck = false;
 }
--- a/local/pkgs/fluent-kde/default.nix
+++ b/local/pkgs/fluent-kde/default.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, src }: stdenv.mkDerivation
+{
+  name = "fluent-kde";
+  inherit src;
+  installPhase =
+  ''
+    mkdir -p $out/share/aurorae/themes
+    cp -r $src/aurorae/* $out/share/aurorae/themes
+    mkdir -p $out/share/color-schemes
+    cp -r $src/color-schemes/*.colors $out/share/color-schemes
+    mkdir -p $out/share/Kvantum
+    cp -r $src/Kvantum/Fluent* $out/share/Kvantum
+    mkdir -p $out/share/plasma/desktoptheme
+    cp -r $src/plasma/desktoptheme/* $out/share/plasma/desktoptheme
+    mkdir -p $out/share/plasma/layout-templates
+    cp -r $src/plasma/layout-templates/* $out/share/plasma/layout-templates
+    mkdir -p $out/share/plasma/look-and-feel
+    cp -r $src/plasma/look-and-feel/com.github.vinceliuice.Fluent* $out/share/plasma/look-and-feel
+    mkdir -p $out/share/wallpapers
+    cp -r $src/wallpaper/* $out/share/wallpapers
+  '';
+}
--- a/local/pkgs/hdf5-nvhpc/default.nix
+++ b/local/pkgs/hdf5-nvhpc/default.nix
@@ -0,0 +1,40 @@
+{
+  buildFHSEnv, writeScript, stdenvNoCC,
+  src,
+  nvhpc, lmod, cmake, gfortran,
+  config, nvhpcArch ? config.nvhpcArch or "px"
+}:
+let
+  buildEnv = buildFHSEnv
+  {
+    name = "buildEnv";
+    targetPkgs = pkgs: with pkgs; [ zlib ];
+    extraBwrapArgs = [ "--bind" "$out" "$out" ];
+  };
+  buildScript = writeScript "build"
+  ''
+    . ${lmod}/share/lmod/lmod/init/bash
+    module use ${nvhpc}/share/nvhpc/modulefiles
+    module load nvhpc
+    mkdir build
+    cd build
+    cmake -DCMAKE_INSTALL_PREFIX=$out -DHDF5_INSTALL_CMAKE_DIR=$out/lib/cmake \
+      -DHDF5_BUILD_FORTRAN=ON -DHDF5_ENABLE_PARALLEL=ON -DBUILD_SHARED_LIBS=ON ..
+    make -j$NIX_BUILD_CORES
+    make install
+  '';
+in stdenvNoCC.mkDerivation
+{
+  name = "hdf5-nvhpc";
+  inherit src;
+  dontConfigure = true;
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake gfortran ];
+  buildPhase =
+  ''
+    mkdir -p $out
+    ${buildEnv}/bin/buildEnv ${buildScript}
+  '';
+  dontInstall = true;
+  requiredSystemFeatures = [ "nvhpcarch-${nvhpcArch}" ];
+}
--- a/local/pkgs/lmod/default.nix
+++ b/local/pkgs/lmod/default.nix
@@ -0,0 +1,14 @@
+{
+  stdenv, src,
+  tcl,
+  procps, bc, lua
+}:
+stdenv.mkDerivation
+{
+  name = "lmod";
+  inherit src;
+  buildInputs = [ tcl ];
+  nativeBuildInputs = [ procps bc (lua.withPackages (ps: with ps; [ luaposix ])) ];
+  configurePhase = ''./configure --prefix=$out/share'';
+  postUnpack = "patchShebangs .";
+}
--- a/local/pkgs/matplotplusplus/default.nix
+++ b/local/pkgs/matplotplusplus/default.nix
@@ -1,17 +1,10 @@
 {
-  stdenv, fetchFromGitHub, cmake, pkg-config, substituteAll,
+  stdenv, src, cmake, pkg-config, substituteAll,
  gnuplot, libjpeg, libtiff, zlib, libpng, lapack, blas, fftw, opencv, nodesoup, cimg, glfw, libGL, python3, glad
 }: stdenv.mkDerivation
 {
-  pname = "matplotplusplus";
-  version = "1.2.0";
-  src = fetchFromGitHub
-  {
-    owner = "alandefreitas";
-    repo = "matplotplusplus";
-    rev = "a40344efa9dc5ea0c312e6e9ef4eb7238d98dc12";
-    sha256 = "6/dH/Rl2aAb8b+Ji5LwzkC+GWPOCBnYCrjy0qk8u/+I=";
-  };
+  name = "matplotplusplus";
+  inherit src;
  cmakeFlags =
  [
    "-DBUILD_SHARED_LIBS=ON" "-DMATPLOTPP_BUILD_SHARED_LIBS=ON" "-DMATPLOTPP_BUILD_EXAMPLES=OFF"
--- a/local/pkgs/mirism/default.nix
+++ b/local/pkgs/mirism/default.nix
@@ -8,7 +8,7 @@
  src = requireFile
  {
    inherit name;
-    sha256 = "1q3f4q4ln9dz68dfc35jybgv861f7acqiiykkm7jxviz8jdgn8c7";
+    sha256 = "0f50pvdafhlmrlbf341mkp9q50v4ld5pbx92d2w1633f18zghbzf";
    hashMode = "recursive";
    message = "Source file not found.";
  };
--- a/local/pkgs/misskey/default.nix
+++ b/local/pkgs/misskey/default.nix
@@ -1,22 +1,14 @@
 {
-  lib, stdenv, mkPnpmPackage, fetchFromGitHub, fetchurl, nodejs, writeShellScript, buildFHSEnv,
-  bash, cypress, vips, pkg-config
+  lib, stdenv, mkPnpmPackage, fetchurl, nodejs, writeShellScript, buildFHSEnv,
+  bash, cypress, vips, pkg-config, src, libtensorflow
 }:
 let
-  pname = "misskey";
-  version = "2023.12.2";
-  src = fetchFromGitHub
-  {
-    owner = "CHN-beta";
-    repo = "misskey";
-    rev = "579e1b00c1dc053a598ac4fd777459067860cdea";
-    hash = "sha256-jrUqfj8RaF8JeQ6qh8O071o4IWXNhKz6XiC92htJsbY=";
-    fetchSubmodules = true;
-  };
+  name = "misskey";
  originalPnpmPackage = mkPnpmPackage
  {
-    inherit pname version src nodejs;
+    inherit name src nodejs;
    copyPnpmStore = true;
+    extraIntegritySha256."https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.5/aiscript-dev-aiscript-languageserver-0.1.5.tgz" = "1mhnwa8h48bc21f0zv8q93aphiqz9i70r7m4xsa4sd1mlncfgyl7";
  };
  startScript = writeShellScript "misskey"
  ''
@@ -28,7 +20,7 @@ let
 in
  stdenv.mkDerivation rec
  {
-    inherit version src pname;
+    inherit src name;
    buildInputs =
    [
      bash nodejs nodejs.pkgs.typescript nodejs.pkgs.pnpm nodejs.pkgs.gulp cypress vips pkg-config
@@ -40,6 +32,7 @@ in
    ''
      export HOME=$NIX_BUILD_TOP # Some packages need a writable HOME
      export npm_config_nodedir=${nodejs}
+      pnpm config set reporter append-only

      runHook preConfigure

--- a/local/pkgs/mumax/default.nix
+++ b/local/pkgs/mumax/default.nix
@@ -0,0 +1,22 @@
+{ buildGoModule, cudatoolkit, src, config, cudaCapabilities ? config.cudaCapabilities, gcc, makeWrapper }:
+# TODO: use addDriverRunpath
+buildGoModule
+{
+  name = "mumax";
+  inherit src;
+  vendorHash = null;
+  nativeBuildInputs = [ cudatoolkit gcc makeWrapper ];
+  CUDA_CC = builtins.concatStringsSep " " cudaCapabilities;
+  CPATH = "${cudatoolkit}/include";
+  LIBRARY_PATH = "${cudatoolkit}/lib/stubs";
+  doCheck = false;
+  postInstall =
+  ''
+    rm $out/bin/{doc,test}
+    for i in $out/bin/*; do
+      if [ -f $i ]; then
+        wrapProgram $i --prefix LD_LIBRARY_PATH ":" "/run/opengl-driver/lib:${cudatoolkit}/lib"
+      fi
+    done
+  '';
+}
--- a/local/pkgs/nameof/default.nix
+++ b/local/pkgs/nameof/default.nix
@@ -1,14 +1,7 @@
-{ lib, stdenv, fetchFromGitHub }: stdenv.mkDerivation rec
+{ lib, stdenv, src }: stdenv.mkDerivation
 {
-  pname = "nameof";
-  version = "0.10.3";
-  src = fetchFromGitHub
-  {
-    owner = "Neargye";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "eHG0Y/BQGbwTrBHjq9SeSiIXaVqWp7PxIq7vCIECYPk=";
-  };
+  name = "nameof";
+  inherit src;
  phases = [ "installPhase" ];
  installPhase =
  ''
--- a/local/pkgs/nodesoup/default.nix
+++ b/local/pkgs/nodesoup/default.nix
@@ -1,13 +1,7 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, cairo, pcre2, xorg }: stdenv.mkDerivation rec
+{ stdenv, src, cmake, pkg-config, cairo, pcre2, xorg }: stdenv.mkDerivation
 {
  name = "nodesoup";
-  src = fetchFromGitHub
-  {
-    owner = "olvb";
-    repo = "nodesoup";
-    rev = "3158ad082bb0cd1abee75418b12b35522dbca74f";
-    sha256 = "tFLq6QC3U3uvcuWsdRy2wnwcmAfH2MkI2oMcAiUBHSo=";
-  };
+  inherit src;
  buildInputs = [ cairo pcre2.dev xorg.libXdmcp.dev ];
  nativeBuildInputs = [ cmake pkg-config ];
 }
--- a/local/pkgs/nvhpc/default.nix
+++ b/local/pkgs/nvhpc/default.nix
@@ -0,0 +1,42 @@
+{
+  stdenvNoCC, fetchurl, buildFHSEnv,
+  gfortran, flock
+}:
+let
+  versions =
+  {
+    "24.1" = "1n0x1x7ywvr3623ylvrjagayn44mbvfas3c3062p7y3asmgjx697";
+    "23.1" = "1xg933f4n1bw39y1x1vrjrbzpx36sbmjgvi332hfck3dbx0n982m";
+  };
+  releaseName = version:
+    let versions = builtins.splitVersion version;
+    in "nvhpc_20${builtins.elemAt versions 0}_${builtins.concatStringsSep "" versions}_Linux_x86_64_cuda_multi";
+  builder = buildFHSEnv
+  {
+    name = "builder";
+    targetPkgs = pkgs: with pkgs; [ coreutils ];
+    extraBwrapArgs = [ "--bind" "$out" "$out" ];
+  };
+in let buildNvhpc = version: stdenvNoCC.mkDerivation
+{
+  pname = "nvhpc";
+  inherit version;
+  src = fetchurl
+  {
+    url = "https://developer.download.nvidia.com/hpc-sdk/${version}/${releaseName version}.tar.gz";
+    sha256 = versions.${version};
+  };
+  dontFixup = true;
+  dontBuild = true;
+  buildInputs = [ gfortran flock ];
+  installPhase =
+  ''
+    export NVHPC_SILENT=true
+    export NVHPC_INSTALL_TYPE=single
+    export NVHPC_INSTALL_DIR=$out/share/nvhpc
+    # $out should exist before bwrap
+    mkdir -p $out
+    ${builder}/bin/builder ./install
+  '';
+};
+in builtins.mapAttrs (version: _: buildNvhpc version) versions
--- a/local/pkgs/oneapi/default.nix
+++ b/local/pkgs/oneapi/default.nix
@@ -0,0 +1,88 @@
+{
+  stdenvNoCC, fetchurl, buildFHSEnv,
+  ncurses
+}:
+let
+  versions =
+  {
+    "2022.2" =
+    {
+      basekit =
+      {
+        id = "18673";
+        version = "2022.2.0.262";
+        sha256 = "03qx6sb58mkhc7iyc8va4y1ihj6l3155dxwmqj8dfw7j2ma7r5f6";
+        components =
+        [
+          "intel.oneapi.lin.dpcpp-ct"
+          "intel.oneapi.lin.dpcpp_dbg"
+          "intel.oneapi.lin.dpl"
+          "intel.oneapi.lin.tbb.devel"
+          "intel.oneapi.lin.ccl.devel"
+          "intel.oneapi.lin.dpcpp-cpp-compiler"
+          "intel.oneapi.lin.dpl"
+          "intel.oneapi.lin.mkl.devel"
+        ];
+      };
+      hpckit =
+      {
+        id = "18679";
+        version = "2022.2.0.191";
+        sha256 = "0swz4w9bn58wwqjkqhjqnkcs8k8ms9nn9s8k7j5w6rzvsa6817d2";
+      };
+    };
+    "2024.0" =
+    {
+      basekit =
+      {
+        id = "163da6e4-56eb-4948-aba3-debcec61c064";
+        version = "2024.0.1.46";
+        sha256 = "1sp1fgjv8xj8qxf8nv4lr1x5cxz7xl5wv4ixmfmcg0gyk28cjq1g";
+      };
+      hpckit =
+      {
+        id = "67c08c98-f311-4068-8b85-15d79c4f277a";
+        version = "2024.0.1.38";
+        sha256 = "06vpdz51w2v4ncgk8k6y2srlfbbdqdmb4v4bdwb67zsg9lmf8fp9";
+      };
+    };
+  };
+  builder = buildFHSEnv
+  {
+    name = "builder";
+    targetPkgs = pkgs: with pkgs; [ coreutils zlib ];
+    extraBwrapArgs = [ "--bind" "$out" "$out" ];
+    runScript = "sh";
+  };
+  componentString = components: if components == null then "--components default" else
+    " --components " + (builtins.concatStringsSep ":" components);
+in let buildOneapi = version: stdenvNoCC.mkDerivation rec
+{
+  pname = "oneapi";
+  inherit version;
+  basekit = fetchurl
+  {
+    url = "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/${versions.${version}.basekit.id}/"
+      + "l_BaseKit_p_${versions.${version}.basekit.version}_offline.sh";
+    sha256 = versions.${version}.basekit.sha256;
+  };
+  hpckit = fetchurl
+  {
+    url = "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/${versions.${version}.hpckit.id}/"
+      + "l_HPCKit_p_${versions.${version}.hpckit.version}_offline.sh";
+    sha256 = versions.${version}.hpckit.sha256;
+  };
+  phases = [ "installPhase" ];
+  nativeBuildInputs = [ ncurses ];
+  installPhase =
+  ''
+    mkdir -p $out
+    ${builder}/bin/builder ${basekit} -a --silent --eula accept --install-dir $out/share/intel \
+      ${componentString versions.${version}.basekit.components or null}
+    ${builder}/bin/builder ${hpckit} -a --silent --eula accept --install-dir $out/share/intel \
+      ${componentString versions.${version}.hpckit.components or null}
+    ${builder}/bin/builder $out/share/intel/modulefiles-setup.sh --output-dir=$out/share/intel/modulefiles \
+      --ignore-latest
+  '';
+};
+in builtins.mapAttrs (version: _: buildOneapi version) versions
--- a/local/pkgs/rsshub/default.nix
+++ b/local/pkgs/rsshub/default.nix
@@ -1,16 +1,9 @@
 {
-  lib, stdenv, mkPnpmPackage, fetchFromGitHub, nodejs, writeShellScript,
-  chromium, bash
+  lib, stdenv, mkPnpmPackage, nodejs, writeShellScript,
+  chromium, bash, src
 }:
 let
  name = "rsshub";
-  src = fetchFromGitHub
-  {
-    owner = "DIYgod";
-    repo = "RSSHub";
-    rev = "38a5b0c193bf77d71c4eea33db6e76bc8b565d0b";
-    hash = "sha256-gJsT9W2fFiy2IG89E5th49DpBHsPMfsdONyzAKDG48c=";
-  };
  originalPnpmPackage = mkPnpmPackage { inherit name src nodejs; };
  nodeModules = originalPnpmPackage.nodeModules.overrideAttrs { PUPPETEER_SKIP_DOWNLOAD = true; };
  rsshub-unwrapped = stdenv.mkDerivation
--- a/local/pkgs/slate/default.nix
+++ b/local/pkgs/slate/default.nix
@@ -0,0 +1,10 @@
+{ stdenv, src }: stdenv.mkDerivation
+{
+  name = "slate";
+  src = "${src}/Slate.tar.gz";
+  installPhase =
+  ''
+    mkdir -p $out/share/yakuake/skins/Slate
+    cp -r * $out/share/yakuake/skins/Slate
+  '';
+}
--- a/local/pkgs/tgbot-cpp/default.nix
+++ b/local/pkgs/tgbot-cpp/default.nix
@@ -1,14 +1,7 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, boost, openssl, zlib, curl }: stdenv.mkDerivation rec
+{ stdenv, src, cmake, pkg-config, boost, openssl, zlib, curl }: stdenv.mkDerivation rec
 {
-  pname = "tgbot-cpp";
-  version = "1.7.2";
-  src = fetchFromGitHub
-  {
-    owner = "reo7sp";
-    repo = "tgbot-cpp";
-    rev = "v${version}";
-    sha256 = "TKirSxEUqFB1WtzNEfU4EJK3p7V5xcFIvA2+QVX7TlA=";
-  };
+  name = "tgbot-cpp";
+  inherit src;
  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ boost openssl zlib curl.dev ];
  propagatedBuildInputs = buildInputs;
--- a/local/pkgs/typora/default.nix
+++ b/local/pkgs/typora/default.nix
@@ -1,42 +0,0 @@
-{ lib, stdenv, steam-run, fetchurl, writeShellScript }:
-let
-  typora-dist = stdenv.mkDerivation rec
-  {
-    pname = "typora-dist";
-    version = "1.7.6";
-    src = fetchurl
-    {
-      url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
-      sha256 = "19xgv83zk3mhniswwrb341sr9j4sb9pqy47jamrmkc3w8famxpd3";
-    };
-
-    dontFixup = true;
-
-    unpackPhase =
-    ''
-      ar x ${src}
-      tar xf data.tar.xz
-    '';
-    installPhase =
-    ''
-      mkdir -p $out
-      mv usr/share $out
-    '';
-  };
-in stdenv.mkDerivation rec
-{
-  pname = "typora";
-  inherit (typora-dist) version;
-  BuildInputs = [ typora-dist steam-run ];
-  startScript = writeShellScript "typora" "${steam-run}/bin/steam-run ${typora-dist}/share/typora/Typora $@";
-  phases = [ "installPhase" ];
-  installPhase =
-  ''
-    mkdir -p $out/bin $out/share/applications
-    ln -s ${startScript} $out/bin/typora
-    cp ${typora-dist}/share/applications/typora.desktop $out/share/applications
-    sed -i "s|Exec=.*|Exec=${startScript} %U|g" $out/share/applications/typora.desktop
-    sed -i "s|Icon=.*|Icon=${typora-dist}/share/icons/hicolor/256x256/apps/typora.png|g" \
-      $out/share/applications/typora.desktop
-  '';
-}
--- a/local/pkgs/v-sim/default.nix
+++ b/local/pkgs/v-sim/default.nix
@@ -1,19 +1,12 @@
 {
-  stdenv, lib, fetchFromGitLab,
+  stdenv, lib, src,
  wrapGAppsHook, autoreconfHook, autoconf, libtool, intltool, gettext, automake, gtk-doc, pkg-config, gfortran, libxslt,
  glib, gtk3, epoxy, libyaml
 }:
 stdenv.mkDerivation
 {
-  pname = "v_sim";
-  version = "3.8.0_p20230824";
-  src = fetchFromGitLab
-  {
-    owner = "l_sim";
-    repo = "v_sim";
-    rev = "8abc67b56795c19a8e2357d442b556c71d2441cb";
-    sha256 = "KQNd3BGvkZVsfIPVLEEMBptiFQYeCbWGR28ds2Y+w2Y=";
-  };
+  name = "v-sim";
+  inherit src;
  buildInputs = [ glib gtk3 epoxy libyaml ];
  nativeBuildInputs =
  [
--- a/local/pkgs/vasp/constr_cell_relax.F
+++ b/local/pkgs/vasp/constr_cell_relax.F
@@ -0,0 +1,22 @@
+SUBROUTINE CONSTR_CELL_RELAX(FCELL)
+  USE prec
+  REAL(q) FCELL(3,3)
+
+  LOGICAL FILFLG
+  INTEGER ICELL(3,3)
+  INQUIRE(FILE='OPTCELL',EXIST=FILFLG)
+  IF (FILFLG) THEN
+      OPEN(67,FILE='OPTCELL',FORM='FORMATTED',STATUS='OLD')
+      DO J=1,3
+        READ(67,"(3I1)") (ICELL(I,J),I=1,3)
+      ENDDO
+      CLOSE(67)
+      DO J=1,3
+      DO I=1,3
+        IF (ICELL(I,J)==0) FCELL(I,J)=0.0
+      ENDDO
+      ENDDO
+  ENDIF
+
+  RETURN
+END SUBROUTINE
--- a/local/pkgs/vasp/default.nix
+++ b/local/pkgs/vasp/default.nix
@@ -1,77 +0,0 @@
-# {
-#   stdenv, requireFile, config, rsync, intel-mpi, ifort,
-#   mkl
-# }:
-# stdenv.mkDerivation rec
-# {
-#   pname = "vasp";
-#   version = "6.4.0";
-#   # nix-store --query --hash $(nix store add-path ./vasp-6.4.0)
-#   src = requireFile
-#   {
-#     name = "${pname}-${version}";
-#     sha256 = "189i1l5q33ynmps93p2mwqf5fx7p4l50sls1krqlv8ls14s3m71f";
-#     hashMode = "recursive";
-#     message = "Source file not found.";
-#   };
-#   VASP_TARGET_CPU = if config ? oneapiArch then "-x${config.oneapiArch}" else "";
-#   MKLROOT = mkl;
-#   makeFlags = "DEPS=1";
-#   enableParallelBuilding = true;
-#   buildInputs = [ mkl intel-mpi ifort ];
-#   nativeBuildInputs = [ rsync ];
-#   configurePhase =
-#   ''
-#     cp arch/makefile.include.intel makefile.include
-#     echo "CPP_OPTIONS += -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj" >> makefile.include
-#     echo "OBJECTS_LIB += getshmem.o" >> makefile.include
-#     mkdir -p bin
-#   '';
-#   installPhase =
-#   ''
-#     mkdir -p $out/bin
-#     for i in std gam ncl; do
-#       cp bin/vasp_$i $out/bin/vasp-cpu-${version}-$i
-#     done
-#   '';
-#   doStrip = false;
-#   doFixup = false;
-# }
-{
-  stdenvNoCC, requireFile, rsync, blas, scalapack, openmpi, openmp, gfortran, gcc, fftwMpi
-}:
-stdenvNoCC.mkDerivation rec
-{
-  pname = "vasp";
-  version = "6.4.0";
-  # nix-store --query --hash $(nix store add-path ./vasp-6.4.0)
-  src = requireFile
-  {
-    name = "${pname}-${version}";
-    sha256 = "189i1l5q33ynmps93p2mwqf5fx7p4l50sls1krqlv8ls14s3m71f";
-    hashMode = "recursive";
-    message = "Source file not found.";
-  };
-  # VASP_TARGET_CPU = if config ? oneapiArch then "-x${config.oneapiArch}" else "";
-  # MKLROOT = mkl;
-  makeFlags = "DEPS=1";
-  enableParallelBuilding = true;
-  buildInputs = [ blas scalapack openmpi openmp gfortran gfortran.cc gcc fftwMpi.dev fftwMpi ];
-  nativeBuildInputs = [ rsync ];
-  FFTW_ROOT = fftwMpi.dev;
-  configurePhase =
-  ''
-    cp ${./makefile.include/${version}-gnu} makefile.include
-    chmod +w makefile.include
-    echo "CPP_OPTIONS += -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj" >> makefile.include
-    echo "OBJECTS_LIB += getshmem.o" >> makefile.include
-    mkdir -p bin
-  '';
-  installPhase =
-  ''
-    mkdir -p $out/bin
-    for i in std gam ncl; do
-      cp bin/vasp_$i $out/bin/vasp-gnu-${version}-$i
-    done
-  '';
-}
--- a/local/pkgs/vasp/gnu/default.nix
+++ b/local/pkgs/vasp/gnu/default.nix
@@ -0,0 +1,46 @@
+{
+  stdenvNoCC, requireFile, writeShellApplication,
+  rsync, blas, scalapack, mpi, openmp, gfortran, gcc, fftwMpi, hdf5, wannier90
+}:
+let
+  sources = import ../source.nix { inherit requireFile; };
+  vasp = version: stdenvNoCC.mkDerivation rec
+  {
+    pname = "vasp-gnu";
+    inherit version;
+    src = sources.${version};
+    configurePhase =
+    ''
+      cp ${./makefile.include-${version}} makefile.include
+      cp ${../constr_cell_relax.F} src/constr_cell_relax.F
+      mkdir -p bin
+    '';
+    enableParallelBuilding = true;
+    makeFlags = "DEPS=1";
+    buildInputs = [ blas scalapack mpi openmp fftwMpi.dev fftwMpi hdf5 hdf5.dev wannier90 ];
+    nativeBuildInputs = [ rsync gfortran gfortran.cc gcc ];
+    FFTW_ROOT = fftwMpi.dev;
+    HDF5_ROOT = hdf5.dev;
+    WANNIER90_ROOT = wannier90;
+    installPhase =
+    ''
+      mkdir -p $out/bin
+      for i in std gam ncl; do
+        cp bin/vasp_$i $out/bin/vasp-$i
+      done
+    '';
+  };
+  startScript = version: writeShellApplication
+  {
+    name = "vasp-gnu-${version}";
+    runtimeInputs = [ (vasp version) ];
+    text =
+    ''
+      if [ -n "''${SLURM_CPUS_PER_TASK-}" ] && [ -n "''${SLURM_THREADS_PER_CPU-}" ]; then
+        export OMP_NUM_THREADS=$(( SLURM_CPUS_PER_TASK * SLURM_THREADS_PER_CPU ))
+      fi
+      export PATH=$PATH:$PWD
+      exec "$@"
+    '';
+  };
+in builtins.mapAttrs (version: _: startScript version) sources
--- a/local/pkgs/vasp/gnu/makefile.include-6.3.1
+++ b/local/pkgs/vasp/gnu/makefile.include-6.3.1
@@ -0,0 +1,92 @@
+# Default precompiler options
+CPP_OPTIONS = -DHOST=\"LinuxGNU\" \
+              -DMPI -DMPI_BLOCK=8000 -Duse_collective \
+              -DscaLAPACK \
+              -DCACHE_SIZE=4000 \
+              -Davoidalloc \
+              -Dvasp6 \
+              -Duse_bse_te \
+              -Dtbdyn \
+              -Dfock_dblbuf \
+              -D_OPENMP -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj
+
+CPP         = gcc -E -C -w $*$(FUFFIX) >$*$(SUFFIX) $(CPP_OPTIONS)
+
+FC          = mpif90 -fopenmp
+FCL         = mpif90 -fopenmp
+
+FREE        = -ffree-form -ffree-line-length-none
+
+FFLAGS      = -w -ffpe-summary=none
+
+OFLAG       = -O2
+OFLAG_IN    = $(OFLAG)
+DEBUG       = -O0
+
+OBJECTS     = fftmpiw.o fftmpi_map.o fftw3d.o fft3dlib.o
+OBJECTS_O1 += fftw3d.o fftmpi.o fftmpiw.o
+OBJECTS_O2 += fft3dlib.o
+
+# For what used to be vasp.5.lib
+CPP_LIB     = $(CPP)
+FC_LIB      = $(FC)
+CC_LIB      = gcc
+CFLAGS_LIB  = -O
+FFLAGS_LIB  = -O1
+FREE_LIB    = $(FREE)
+
+OBJECTS_LIB = linpack_double.o getshmem.o
+
+# For the parser library
+CXX_PARS    = g++
+LLIBS       = -lstdc++
+
+##
+## Customize as of this point! Of course you may change the preceding
+## part of this file as well if you like, but it should rarely be
+## necessary ...
+##
+
+# When compiling on the target machine itself, change this to the
+# relevant target when cross-compiling for another architecture
+# VASP_TARGET_CPU ?= -march=native
+# FFLAGS     += $(VASP_TARGET_CPU)
+
+# For gcc-10 and higher (comment out for older versions)
+FFLAGS     += -fallow-argument-mismatch
+
+# BLAS and LAPACK (mandatory)
+# OPENBLAS_ROOT ?= /path/to/your/openblas/installation
+# BLASPACK    = -L$(OPENBLAS_ROOT)/lib -lopenblas
+BLASPACK    = -lblas
+
+# scaLAPACK (mandatory)
+# SCALAPACK_ROOT ?= /path/to/your/scalapack/installation
+# SCALAPACK   = -L$(SCALAPACK_ROOT)/lib -lscalapack
+SCALAPACK = -lscalapack
+
+LLIBS      += $(SCALAPACK) $(BLASPACK)
+
+# FFTW (mandatory)
+FFTW_ROOT  ?= /path/to/your/fftw/installation
+LLIBS      += -L$(FFTW_ROOT)/lib -lfftw3 -lfftw3_omp
+INCS       += -I$(FFTW_ROOT)/include
+
+# HDF5-support (optional but strongly recommended)
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include
+
+# For the VASP-2-Wannier90 interface (optional)
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+
+# For the fftlib library (recommended)
+#CPP_OPTIONS+= -Dsysv
+#FCL        += fftlib.o
+#CXX_FFTLIB  = g++ -fopenmp -std=c++11 -DFFTLIB_THREADSAFE
+#INCS_FFTLIB = -I./include -I$(FFTW_ROOT)/include
+#LIBS       += fftlib
+#LLIBS      += -ldl
--- a/local/pkgs/vasp/gnu/makefile.include-6.4.0
+++ b/local/pkgs/vasp/gnu/makefile.include-6.4.0
@@ -8,7 +8,7 @@ CPP_OPTIONS = -DHOST=\"LinuxGNU\" \
              -Duse_bse_te \
              -Dtbdyn \
              -Dfock_dblbuf \
-              -D_OPENMP
+              -D_OPENMP -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj

 CPP         = gcc -E -C -w $*$(FUFFIX) >$*$(SUFFIX) $(CPP_OPTIONS)

@@ -35,7 +35,7 @@ CFLAGS_LIB  = -O
 FFLAGS_LIB  = -O1
 FREE_LIB    = $(FREE)

-OBJECTS_LIB = linpack_double.o
+OBJECTS_LIB = linpack_double.o getshmem.o

 # For the parser library
 CXX_PARS    = g++
@@ -68,21 +68,20 @@ SCALAPACK = -lscalapack
 LLIBS      += $(SCALAPACK) $(BLASPACK)

 # FFTW (mandatory)
-# FFTW_ROOT  ?= /path/to/your/fftw/installation
-# LLIBS      += -L$(FFTW_ROOT)/lib -lfftw3 -lfftw3_omp
-LLIBS      += -lfftw3 -lfftw3_omp
+FFTW_ROOT  ?= /path/to/your/fftw/installation
+LLIBS      += -L$(FFTW_ROOT)/lib -lfftw3 -lfftw3_omp
 INCS       += -I$(FFTW_ROOT)/include

 # HDF5-support (optional but strongly recommended)
-#CPP_OPTIONS+= -DVASP_HDF5
-#HDF5_ROOT  ?= /path/to/your/hdf5/installation
-#LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
-#INCS       += -I$(HDF5_ROOT)/include
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include

 # For the VASP-2-Wannier90 interface (optional)
-#CPP_OPTIONS    += -DVASP2WANNIER90
-#WANNIER90_ROOT ?= /path/to/your/wannier90/installation
-#LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier

 # For the fftlib library (recommended)
 CPP_OPTIONS+= -Dsysv
--- a/local/pkgs/vasp/intel/default.nix
+++ b/local/pkgs/vasp/intel/default.nix
@@ -0,0 +1,71 @@
+{
+  buildFHSEnv, writeScript, stdenvNoCC, requireFile, substituteAll, symlinkJoin,
+  config, oneapiArch ? config.oneapiArch or "SSE3",
+  oneapi, gfortran, gcc, glibc, lmod, rsync, which, hdf5, wannier90
+}:
+let
+  versions = import ../source.nix;
+  buildEnv = buildFHSEnv
+  {
+    name = "buildEnv";
+    # make "module load mpi" success
+    targetPkgs = pkgs: with pkgs; [ zlib (writeTextDir "etc/release" "") ];
+  };
+  buildScript = writeScript "build"
+  ''
+    . ${lmod}/share/lmod/lmod/init/bash
+    module use ${oneapi}/share/intel/modulefiles
+    module load tbb compiler-rt oclfpga # dependencies
+    module load mpi mkl compiler
+    mkdir -p bin
+    make DEPS=1 -j$NIX_BUILD_CORES std
+  '';
+  include = version: substituteAll
+  {
+    src = ./makefile.include-${version};
+    inherit oneapiArch;
+    gcc = symlinkJoin { name = "gcc"; paths = [ gfortran gfortran.cc gcc ]; };
+  };
+  vasp = version: stdenvNoCC.mkDerivation rec
+  {
+    pname = "vasp";
+    inherit version;
+    src = requireFile
+    {
+      name = "${pname}-${version}";
+      sha256 = versions.${version};
+      hashMode = "recursive";
+      message = "Source file not found.";
+    };
+    configurePhase =
+    ''
+      cp ${include version} makefile.include
+      cp ${../constr_cell_relax.F} src/constr_cell_relax.F
+    '';
+    enableParallelBuilding = false;
+    buildInputs = [ hdf5 hdf5.dev wannier90 glibc glibc.dev ];
+    nativeBuildInputs = [ gfortran gfortran.cc gcc rsync which ];
+    HDF5_ROOT = hdf5.dev;
+    WANNIER90_ROOT = wannier90;
+    buildPhase = "${buildEnv}/bin/buildEnv ${buildScript}";
+    installPhase =
+    ''
+      mkdir -p $out/bin
+      for i in std gam ncl; do cp bin/vasp_$i $out/bin/vasp-$i; done
+    '';
+  };
+  startScript = version: writeScript "vasp-intel-${version}"
+  ''
+    . ${lmod}/share/lmod/lmod/init/bash
+    module use ${oneapi}/share/intel/modulefiles
+    module load tbb compiler-rt oclfpga # dependencies
+    module load mpi mkl compiler
+    exec "$@"
+  '';
+  runEnv = version: buildFHSEnv
+  {
+    name = "vasp-intel-${version}";
+    targetPkgs = pkgs: with pkgs; [ zlib (vasp version) (writeTextDir "etc/release" "") ];
+    runScript = startScript version;
+  };
+in builtins.mapAttrs (version: _: runEnv version) versions
--- a/local/pkgs/vasp/intel/makefile.include-6.3.1
+++ b/local/pkgs/vasp/intel/makefile.include-6.3.1
@@ -0,0 +1,82 @@
+# Default precompiler options
+CPP_OPTIONS = -DHOST=\"LinuxIFC\" \
+              -DMPI -DMPI_BLOCK=8000 -Duse_collective \
+              -DscaLAPACK \
+              -DCACHE_SIZE=4000 \
+              -Davoidalloc \
+              -Dvasp6 \
+              -Duse_bse_te \
+              -Dtbdyn \
+              -Dfock_dblbuf \
+              -D_OPENMP -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj
+
+CPP         = fpp -f_com=no -free -w0  $*$(FUFFIX) $*$(SUFFIX) $(CPP_OPTIONS)
+
+FC          = I_MPI_FC=ifort mpif90 -qopenmp
+FCL         = I_MPI_FC=ifort mpif90
+
+FREE        = -free -names lowercase
+
+FFLAGS      = -assume byterecl -w
+
+OFLAG       = -O2
+OFLAG_IN    = $(OFLAG)
+DEBUG       = -O0
+
+OBJECTS     = fftmpiw.o fftmpi_map.o fftw3d.o fft3dlib.o
+OBJECTS_O1 += fftw3d.o fftmpi.o fftmpiw.o
+OBJECTS_O2 += fft3dlib.o
+
+# For what used to be vasp.5.lib
+CPP_LIB     = $(CPP)
+FC_LIB      = $(FC)
+CC_LIB      = icc
+CFLAGS_LIB  = -O
+FFLAGS_LIB  = -O1
+FREE_LIB    = $(FREE)
+
+OBJECTS_LIB = linpack_double.o getshmem.o
+
+# For the parser library
+CXX_PARS    = icpc
+LLIBS       = -lstdc++
+
+##
+## Customize as of this point! Of course you may change the preceding
+## part of this file as well if you like, but it should rarely be
+## necessary ...
+##
+
+# When compiling on the target machine itself, change this to the
+# relevant target when cross-compiling for another architecture
+VASP_TARGET_CPU ?= -x@oneapiArch@
+FFLAGS     += $(VASP_TARGET_CPU)
+ 
+# Intel MKL for FFTW, BLAS, LAPACK, and scaLAPACK
+# (Note: for Intel Parallel Studio's MKL use -mkl instead of -qmkl)
+FCL        += -qmkl
+MKLROOT    ?= /path/to/your/mkl/installation
+INCS        =-I$(MKLROOT)/include/fftw
+
+# Use a separate scaLAPACK installation (optional but recommended in combination with OpenMPI)
+# Comment out the two lines below if you want to use scaLAPACK from MKL instead
+#SCALAPACK_ROOT ?= /path/to/your/scalapack/installation
+#LLIBS      += -L${SCALAPACK_ROOT}/lib -lscalapack
+
+# HDF5-support (optional but strongly recommended)
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include
+
+# For the VASP-2-Wannier90 interface (optional)
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+
+# For the fftlib library (hardly any benefit in combination with MKL's FFTs)
+#CPP_OPTION += -Dsysv
+#FCL         = mpif90 fftlib.o -qmkl
+#CXX_FFTLIB  = icpc -qopenmp -std=c++11 -DFFTLIB_USE_MKL -DFFTLIB_THREADSAFE
+#INCS_FFTLIB = -I./include -I$(MKLROOT)/include/fftw
+#LIBS       += fftlib
--- a/local/pkgs/vasp/intel/makefile.include-6.4.0
+++ b/local/pkgs/vasp/intel/makefile.include-6.4.0
@@ -0,0 +1,82 @@
+# Default precompiler options
+CPP_OPTIONS = -DHOST=\"LinuxIFC\" \
+              -DMPI -DMPI_BLOCK=8000 -Duse_collective \
+              -DscaLAPACK \
+              -DCACHE_SIZE=4000 \
+              -Davoidalloc \
+              -Dvasp6 \
+              -Duse_bse_te \
+              -Dtbdyn \
+              -Dfock_dblbuf \
+              -D_OPENMP -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj
+
+CPP         = fpp -f_com=no -free -w0  $*$(FUFFIX) $*$(SUFFIX) $(CPP_OPTIONS)
+
+FC          = I_MPI_F90=ifort mpif90 -qopenmp
+FCL         = I_MPI_F90=ifort mpif90
+
+FREE        = -free -names lowercase
+
+FFLAGS      = -assume byterecl -w
+
+OFLAG       = -O2
+OFLAG_IN    = $(OFLAG)
+DEBUG       = -O0
+
+OBJECTS     = fftmpiw.o fftmpi_map.o fftw3d.o fft3dlib.o
+OBJECTS_O1 += fftw3d.o fftmpi.o fftmpiw.o
+OBJECTS_O2 += fft3dlib.o
+
+# For what used to be vasp.5.lib
+CPP_LIB     = $(CPP)
+FC_LIB      = $(FC)
+CC_LIB      = icc
+CFLAGS_LIB  = -O
+FFLAGS_LIB  = -O1
+FREE_LIB    = $(FREE)
+
+OBJECTS_LIB = linpack_double.o getshmem.o
+
+# For the parser library
+CXX_PARS    = icpc
+LLIBS       = -lstdc++
+
+##
+## Customize as of this point! Of course you may change the preceding
+## part of this file as well if you like, but it should rarely be
+## necessary ...
+##
+
+# When compiling on the target machine itself, change this to the
+# relevant target when cross-compiling for another architecture
+VASP_TARGET_CPU ?= -x@oneapiArch@
+FFLAGS     += $(VASP_TARGET_CPU)
+ 
+# Intel MKL for FFTW, BLAS, LAPACK, and scaLAPACK
+# (Note: for Intel Parallel Studio's MKL use -mkl instead of -qmkl)
+FCL        += -qmkl
+MKLROOT    ?= /path/to/your/mkl/installation
+INCS        =-I$(MKLROOT)/include/fftw
+
+# Use a separate scaLAPACK installation (optional but recommended in combination with OpenMPI)
+# Comment out the two lines below if you want to use scaLAPACK from MKL instead
+#SCALAPACK_ROOT ?= /path/to/your/scalapack/installation
+#LLIBS      += -L${SCALAPACK_ROOT}/lib -lscalapack
+
+# HDF5-support (optional but strongly recommended)
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include
+
+# For the VASP-2-Wannier90 interface (optional)
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+
+# For the fftlib library (hardly any benefit in combination with MKL's FFTs)
+#CPP_OPTION += -Dsysv
+#FCL         = mpif90 fftlib.o -qmkl
+#CXX_FFTLIB  = icpc -qopenmp -std=c++11 -DFFTLIB_USE_MKL -DFFTLIB_THREADSAFE
+#INCS_FFTLIB = -I./include -I$(MKLROOT)/include/fftw
+#LIBS       += fftlib
--- a/local/pkgs/vasp/nvidia/default.nix
+++ b/local/pkgs/vasp/nvidia/default.nix
@@ -0,0 +1,71 @@
+{
+  buildFHSEnv, writeScript, stdenvNoCC, requireFile, substituteAll,
+  config, cudaCapabilities ? config.cudaCapabilities, nvhpcArch ? config.nvhpcArch or "px",
+  nvhpc, lmod, mkl, gfortran, rsync, which, hdf5, wannier90
+}:
+let
+  sources = import ../source.nix { inherit requireFile; };
+  buildEnv = buildFHSEnv
+  {
+    name = "buildEnv";
+    targetPkgs = pkgs: with pkgs; [ zlib ];
+  };
+  buildScript = writeScript "build"
+  ''
+    . ${lmod}/share/lmod/lmod/init/bash
+    module use ${nvhpc}/share/nvhpc/modulefiles
+    module load nvhpc
+    mkdir -p bin
+    make DEPS=1 -j$NIX_BUILD_CORES
+  '';
+  include = version: substituteAll
+  {
+    src = ./makefile.include-${version};
+    cudaCapabilities = builtins.concatStringsSep "," (builtins.map
+      (cap: "cc${builtins.replaceStrings ["."] [""] cap}")
+      cudaCapabilities);
+    inherit nvhpcArch;
+  };
+  vasp = version: stdenvNoCC.mkDerivation rec
+  {
+    pname = "vasp";
+    inherit version;
+    src = sources.${version};
+    configurePhase =
+    ''
+      cp ${include version} makefile.include
+      cp ${../constr_cell_relax.F} src/constr_cell_relax.F
+    '';
+    enableParallelBuilding = true;
+    buildInputs = [ mkl hdf5 wannier90 ];
+    nativeBuildInputs = [ gfortran rsync which ];
+    MKLROOT = "${mkl}";
+    HDF5_ROOT = "${hdf5}";
+    WANNIER90_ROOT = "${wannier90}";
+    buildPhase = "${buildEnv}/bin/buildEnv ${buildScript}";
+    installPhase =
+    ''
+      mkdir -p $out/bin
+      for i in std gam ncl; do cp bin/vasp_$i $out/bin/vasp-$i; done
+    '';
+    requiredSystemFeatures = [ "nvhpcarch-${nvhpcArch}" ];
+  };
+  startScript = version: writeScript "vasp-nvidia-${version}"
+  ''
+    . ${lmod}/share/lmod/lmod/init/bash
+    module use ${nvhpc}/share/nvhpc/modulefiles
+    module load nvhpc
+
+    # if SLURM_CPUS_PER_TASK and SLURM_THREADS_PER_CPU are set, use them to set OMP_NUM_THREADS
+    if [ -n "''${SLURM_CPUS_PER_TASK-}" ] && [ -n "''${SLURM_THREADS_PER_CPU-}" ]; then
+      export OMP_NUM_THREADS=$(( SLURM_CPUS_PER_TASK * SLURM_THREADS_PER_CPU ))
+    fi
+    exec "$@"
+  '';
+  runEnv = version: buildFHSEnv
+  {
+    name = "vasp-nvidia-${version}";
+    targetPkgs = pkgs: with pkgs; [ zlib (vasp version) ];
+    runScript = startScript version;
+  };
+in builtins.mapAttrs (version: _: runEnv version) sources
--- a/local/pkgs/vasp/nvidia/makefile.include-6.3.1
+++ b/local/pkgs/vasp/nvidia/makefile.include-6.3.1
@@ -0,0 +1,109 @@
+# Default precompiler options
+CPP_OPTIONS = -DHOST=\"LinuxNV\" \
+              -DMPI -DMPI_BLOCK=8000 -Duse_collective \
+              -DscaLAPACK \
+              -DCACHE_SIZE=4000 \
+              -Davoidalloc \
+              -Dvasp6 \
+              -Duse_bse_te \
+              -Dtbdyn \
+              -Dqd_emulate \
+              -Dfock_dblbuf \
+              -D_OPENMP \
+              -D_OPENACC \
+              -DUSENCCL -DUSENCCLP2P -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj
+
+CPP         = nvfortran -Mpreprocess -Mfree -Mextend -E $(CPP_OPTIONS) $*$(FUFFIX)  > $*$(SUFFIX)
+
+# N.B.: you might need to change the cuda-version here
+#       to one that comes with your NVIDIA-HPC SDK
+FC          = mpif90 -acc -gpu=@cudaCapabilities@ -mp
+FCL         = mpif90 -acc -gpu=@cudaCapabilities@ -mp -c++libs
+
+FREE        = -Mfree
+
+FFLAGS      = -Mbackslash -Mlarge_arrays
+
+OFLAG       = -fast
+
+DEBUG       = -Mfree -O0 -traceback
+
+OBJECTS     = fftmpiw.o fftmpi_map.o fftw3d.o fft3dlib.o
+
+LLIBS       = -cudalib=cublas,cusolver,cufft,nccl -cuda
+
+# Redefine the standard list of O1 and O2 objects
+SOURCE_O1  := pade_fit.o
+SOURCE_O2  := pead.o
+
+# For what used to be vasp.5.lib
+CPP_LIB     = $(CPP)
+FC_LIB      = nvfortran
+CC_LIB      = nvc -w
+CFLAGS_LIB  = -O
+FFLAGS_LIB  = -O1 -Mfixed
+FREE_LIB    = $(FREE)
+
+OBJECTS_LIB = linpack_double.o getshmem.o
+
+# For the parser library
+CXX_PARS    = nvc++ --no_warnings
+
+##
+## Customize as of this point! Of course you may change the preceding
+## part of this file as well if you like, but it should rarely be
+## necessary ...
+##
+# When compiling on the target machine itself , change this to the
+# relevant target when cross-compiling for another architecture
+VASP_TARGET_CPU ?= -tp=@nvhpcArch@
+FFLAGS     += $(VASP_TARGET_CPU)
+
+# Specify your NV HPC-SDK installation (mandatory)
+#... first try to set it automatically
+NVROOT      =$(shell which nvfortran | awk -F /compilers/bin/nvfortran '{ print $$1 }')
+
+# If the above fails, then NVROOT needs to be set manually
+#NVHPC      ?= /opt/nvidia/hpc_sdk
+#NVVERSION   = 21.11
+#NVROOT      = $(NVHPC)/Linux_x86_64/$(NVVERSION)
+
+## Improves performance when using NV HPC-SDK >=21.11 and CUDA >11.2
+#OFLAG_IN   = -fast -Mwarperf
+#SOURCE_IN  := nonlr.o
+
+# Software emulation of quadruple precsion (mandatory)
+QD         ?= $(NVROOT)/compilers/extras/qd
+LLIBS      += -L$(QD)/lib -lqdmod -lqd
+INCS       += -I$(QD)/include/qd
+
+# Intel MKL for FFTW, BLAS, LAPACK, and scaLAPACK
+MKLROOT    ?= /path/to/your/mkl/installation
+LLIBS_MKL   = -Mmkl -L$(MKLROOT)/lib -lmkl_scalapack_lp64 -lmkl_blacs_openmpi_lp64
+INCS       += -I$(MKLROOT)/include/fftw
+
+# Use a separate scaLAPACK installation (optional but recommended in combination with OpenMPI)
+# Comment out the two lines below if you want to use scaLAPACK from MKL instead
+# SCALAPACK_ROOT ?= /path/to/your/scalapack/installation
+# LLIBS_MKL   = -L$(SCALAPACK_ROOT)/lib -lscalapack -Mmkl
+
+LLIBS      += $(LLIBS_MKL)
+
+# HDF5-support (optional but strongly recommended)
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include
+
+# For the VASP-2-Wannier90 interface (optional)
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+
+# For the fftlib library (hardly any benefit for the OpenACC GPU port, especially in combination with MKL's FFTs)
+#CPP_OPTIONS+= -Dsysv
+#FCL        += fftlib.o
+#CXX_FFTLIB  = nvc++ -mp --no_warnings -std=c++11 -DFFTLIB_USE_MKL -DFFTLIB_THREADSAFE
+#INCS_FFTLIB = -I./include -I$(MKLROOT)/include/fftw
+#LIBS       += fftlib
+#LLIBS      += -ldl
--- a/local/pkgs/vasp/nvidia/makefile.include-6.4.0
+++ b/local/pkgs/vasp/nvidia/makefile.include-6.4.0
@@ -0,0 +1,109 @@
+# Default precompiler options
+CPP_OPTIONS = -DHOST=\"LinuxNV\" \
+              -DMPI -DMPI_INPLACE -DMPI_BLOCK=8000 -Duse_collective \
+              -DscaLAPACK \
+              -DCACHE_SIZE=4000 \
+              -Davoidalloc \
+              -Dvasp6 \
+              -Duse_bse_te \
+              -Dtbdyn \
+              -Dqd_emulate \
+              -Dfock_dblbuf \
+              -D_OPENMP \
+              -D_OPENACC \
+              -DUSENCCL -DUSENCCLP2P -Duse_shmem -Dshmem_bcast_buffer -Dshmem_rproj
+
+CPP         = nvfortran -Mpreprocess -Mfree -Mextend -E $(CPP_OPTIONS) $*$(FUFFIX)  > $*$(SUFFIX)
+
+# N.B.: you might need to change the cuda-version here
+#       to one that comes with your NVIDIA-HPC SDK
+FC          = mpif90 -acc -gpu=@cudaCapabilities@ -mp
+FCL         = mpif90 -acc -gpu=@cudaCapabilities@ -mp -c++libs
+
+FREE        = -Mfree
+
+FFLAGS      = -Mbackslash -Mlarge_arrays
+
+OFLAG       = -fast
+
+DEBUG       = -Mfree -O0 -traceback
+
+OBJECTS     = fftmpiw.o fftmpi_map.o fftw3d.o fft3dlib.o
+
+LLIBS       = -cudalib=cublas,cusolver,cufft,nccl -cuda
+
+# Redefine the standard list of O1 and O2 objects
+SOURCE_O1  := pade_fit.o minimax_dependence.o
+SOURCE_O2  := pead.o
+
+# For what used to be vasp.5.lib
+CPP_LIB     = $(CPP)
+FC_LIB      = nvfortran
+CC_LIB      = nvc -w
+CFLAGS_LIB  = -O
+FFLAGS_LIB  = -O1 -Mfixed
+FREE_LIB    = $(FREE)
+
+OBJECTS_LIB = linpack_double.o getshmem.o
+
+# For the parser library
+CXX_PARS    = nvc++ --no_warnings
+
+##
+## Customize as of this point! Of course you may change the preceding
+## part of this file as well if you like, but it should rarely be
+## necessary ...
+##
+# When compiling on the target machine itself , change this to the
+# relevant target when cross-compiling for another architecture
+VASP_TARGET_CPU ?= -tp=@nvhpcArch@
+FFLAGS     += $(VASP_TARGET_CPU)
+
+# Specify your NV HPC-SDK installation (mandatory)
+#... first try to set it automatically
+NVROOT      =$(shell which nvfortran | awk -F /compilers/bin/nvfortran '{ print $$1 }')
+
+# If the above fails, then NVROOT needs to be set manually
+#NVHPC      ?= /opt/nvidia/hpc_sdk
+#NVVERSION   = 21.11
+#NVROOT      = $(NVHPC)/Linux_x86_64/$(NVVERSION)
+
+## Improves performance when using NV HPC-SDK >=21.11 and CUDA >11.2
+#OFLAG_IN   = -fast -Mwarperf
+#SOURCE_IN  := nonlr.o
+
+# Software emulation of quadruple precsion (mandatory)
+QD         ?= $(NVROOT)/compilers/extras/qd
+LLIBS      += -L$(QD)/lib -lqdmod -lqd
+INCS       += -I$(QD)/include/qd
+
+# Intel MKL for FFTW, BLAS, LAPACK, and scaLAPACK
+MKLROOT    ?= /path/to/your/mkl/installation
+LLIBS_MKL   = -Mmkl -L$(MKLROOT)/lib -lmkl_scalapack_lp64 -lmkl_blacs_openmpi_lp64
+INCS       += -I$(MKLROOT)/include/fftw
+
+# Use a separate scaLAPACK installation (optional but recommended in combination with OpenMPI)
+# Comment out the two lines below if you want to use scaLAPACK from MKL instead
+# SCALAPACK_ROOT ?= /path/to/your/scalapack/installation
+# LLIBS_MKL   = -L$(SCALAPACK_ROOT)/lib -lscalapack -Mmkl
+
+LLIBS      += $(LLIBS_MKL)
+
+# HDF5-support (optional but strongly recommended)
+CPP_OPTIONS+= -DVASP_HDF5
+HDF5_ROOT  ?= /path/to/your/hdf5/installation
+LLIBS      += -L$(HDF5_ROOT)/lib -lhdf5_fortran
+INCS       += -I$(HDF5_ROOT)/include
+
+# For the VASP-2-Wannier90 interface (optional)
+CPP_OPTIONS    += -DVASP2WANNIER90
+WANNIER90_ROOT ?= /path/to/your/wannier90/installation
+LLIBS          += -L$(WANNIER90_ROOT)/lib -lwannier
+
+# For the fftlib library (hardly any benefit for the OpenACC GPU port, especially in combination with MKL's FFTs)
+#CPP_OPTIONS+= -Dsysv
+#FCL        += fftlib.o
+#CXX_FFTLIB  = nvc++ -mp --no_warnings -std=c++11 -DFFTLIB_USE_MKL -DFFTLIB_THREADSAFE
+#INCS_FFTLIB = -I./include -I$(MKLROOT)/include/fftw
+#LIBS       += fftlib
+#LLIBS      += -ldl
--- a/local/pkgs/vasp/source.nix
+++ b/local/pkgs/vasp/source.nix
@@ -0,0 +1,16 @@
+{ requireFile }:
+let
+  hashes =
+  {
+    # nix-store --query --hash $(nix store add-path ./vasp-6.4.0)
+    "6.3.1" = "1xdr5kjxz6v2li73cbx1ls5b1lnm6z16jaa4fpln7d3arnnr1mgx";
+    "6.4.0" = "189i1l5q33ynmps93p2mwqf5fx7p4l50sls1krqlv8ls14s3m71f";
+  };
+  sources = version: sha256: requireFile
+  {
+    name = "vasp-${version}";
+    inherit sha256;
+    hashMode = "recursive";
+    message = "Source file not found.";
+  };
+in builtins.mapAttrs sources hashes
--- a/local/pkgs/vaspkit/default.nix
+++ b/local/pkgs/vaspkit/default.nix
@@ -7,15 +7,15 @@ let
    hashMode = "recursive";
    message = "POTCAR not found.";
  };
-  unwrapped = stdenv.mkDerivation
+  unwrapped = stdenv.mkDerivation rec
  {
    pname = "vaspkit-unwrapped";
-    version = "1.4.1";
+    version = "1.5.1";
    buildInputs = [ autoPatchelfHook stdenv.cc.cc ];
    src = fetchurl
    {
-      url = "mirror://sourceforge/vaspkit/Binaries/vaspkit.1.4.1.linux.x64.tar.gz";
-      sha256 = "0i5m7nbvqk7hzxisyydjvs2l8lnvj9vsxa170783kv9zmp51lnvs";
+      url = "mirror://sourceforge/vaspkit/Binaries/vaspkit.${version}.linux.x64.tar.gz";
+      sha256 = "1cbj1mv7vx18icwlk9d2vfavsfd653943xg2ywzd8b7pb43xrfs1";
    };
    installPhase =
    ''
--- a/local/pkgs/win11os-kde/default.nix
+++ b/local/pkgs/win11os-kde/default.nix
@@ -0,0 +1,20 @@
+{ lib, stdenv, src }: stdenv.mkDerivation
+{
+  name = "win11os-kde";
+  inherit src;
+  installPhase =
+  ''
+    mkdir -p $out/share/aurorae/themes
+    cp -r $src/aurorae/* $out/share/aurorae/themes
+    mkdir -p $out/share/color-schemes
+    cp -r $src/color-schemes/*.colors $out/share/color-schemes
+    mkdir -p $out/share/Kvantum
+    cp -r $src/Kvantum/* $out/share/Kvantum
+    mkdir -p $out/share/plasma/desktoptheme
+    cp -r $src/plasma/desktoptheme/* $out/share/plasma/desktoptheme
+    mkdir -p $out/share/plasma/look-and-feel
+    cp -r $src/plasma/look-and-feel/* $out/share/plasma/look-and-feel
+    mkdir -p $out/share/wallpapers
+    cp -r $src/wallpaper/* $out/share/wallpapers
+  '';
+}
--- a/local/pkgs/zpp-bits/default.nix
+++ b/local/pkgs/zpp-bits/default.nix
@@ -1,14 +1,7 @@
-{ stdenv, fetchFromGitHub }: stdenv.mkDerivation rec
+{ stdenv, src }: stdenv.mkDerivation
 {
-  pname = "zpp-bits";
-  version = "4.4.19";
-  src = fetchFromGitHub
-  {
-    owner = "eyalz800";
-    repo = "zpp_bits";
-    rev = "v${version}";
-    sha256 = "ejIwrvCFALuBQbQhTfzjBb11oMR/akKnboB60GWbjlQ=";
-  };
+  inherit src;
+  name = "zpp-bits";
  phases = [ "installPhase" ];
  installPhase =
  ''
--- a/modules/bugs/default.nix
+++ b/modules/bugs/default.nix
@@ -79,6 +79,8 @@ inputs:
        };
      firefox.programs.firefox.enable = inputs.lib.mkForce false;
      power.boot.kernelParams = [ "cpufreq.default_governor=powersave" ];
+      backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
+      amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
    };
  in
    {
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -21,21 +21,20 @@ inputs:
          [
            topInputs.qchem.overlays.default
            topInputs.nixd.overlays.default
-            topInputs.nix-alien.overlays.default
            topInputs.napalm.overlays.default
            topInputs.pnpm2nix-nzbr.overlays.default
-            topInputs.lmix.overlays.default
            topInputs.aagl.overlays.default
-            (import "${topInputs.dguibert-nur-packages}/overlays/nvhpc-overlay")
            (final: prev:
            {
              nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
              nur-xddxdd = topInputs.nur-xddxdd.overlays.default final prev;
+              nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
              deploy-rs =
                { inherit (prev) deploy-rs; inherit ((topInputs.deploy-rs.overlay final prev).deploy-rs) lib; };
              # needed by mirism
-              nghttp2-2305 =
-                inputs.pkgs.callPackage "${inputs.topInputs.nixpkgs-2305}/pkgs/development/libraries/nghttp2" {};
+              "nghttp2-23.05" =
+                inputs.pkgs.callPackage "${inputs.topInputs."nixpkgs-23.05"}/pkgs/development/libraries/nghttp2" {};
+              firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
            })
          ];
          home-manager.sharedModules =
--- a/modules/hardware/default.nix
+++ b/modules/hardware/default.nix
@@ -1,5 +1,6 @@
 inputs:
 {
+  imports = inputs.localLib.mkModules [ ./gpu.nix ./legion.nix ];
  options.nixos.hardware = let inherit (inputs.lib) mkOption types; in
  {
    bluetooth.enable = mkOption { type = types.bool; default = false; };
@@ -7,15 +8,6 @@ inputs:
    printer.enable = mkOption { type = types.bool; default = false; };
    sound.enable = mkOption { type = types.bool; default = false; };
    cpus = mkOption { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
-    gpus = mkOption { type = types.listOf (types.enum [ "intel" "nvidia" "amd" ]); default = []; };
-    prime =
-    {
-      enable = mkOption { type = types.bool; default = false; };
-      mode = mkOption { type = types.enum [ "offload" "sync" ]; default = "offload"; };
-      busId = mkOption { type = types.attrsOf types.str; default = {}; };
-    };
-    gamemode.drmDevice = mkOption { type = types.int; default = 0; };
-    halo-keyboard.enable = mkOption { type = types.bool; default = false; };
  };
  config =
    let
@@ -81,140 +73,5 @@ inputs:
              concatLists (map (cpu: modules.${cpu}) hardware.cpus);
        }
      )
-      # gpus
-      (
-        mkIf (hardware.gpus != [])
-        {
-          boot.initrd.availableKernelModules =
-            let
-              modules =
-              {
-                intel = [ "i915" ];
-                nvidia = [ "nvidia" "nvidia_drm" "nvidia_modeset" "nvidia_uvm" ];
-                amd = [ "amdgpu" ];
-              };
-            in
-              concatLists (map (gpu: modules.${gpu}) hardware.gpus);
-          hardware =
-          {
-            opengl =
-            {
-              enable = true;
-              driSupport = true;
-              extraPackages =
-                with inputs.pkgs;
-                let
-                  packages =
-                  {
-                    intel = [ intel-compute-runtime intel-media-driver libvdpau-va-gl ]; # intel-vaapi-driver
-                    nvidia = [ vaapiVdpau ];
-                    amd = [];
-                  };
-                in
-                  concatLists (map (gpu: packages.${gpu}) hardware.gpus);
-              driSupport32Bit = true;
-            };
-            nvidia.nvidiaSettings = builtins.elem "nvidia" hardware.gpus;
-          };
-        }
-      )
-      (mkIf (builtins.elem "intel" hardware.gpus) { services.xserver.deviceSection = ''Driver "modesetting"''; })
-      # prime
-      (
-        mkIf hardware.prime.enable
-        {
-          hardware.nvidia = mkMerge
-          [
-            (
-              mkIf (hardware.prime.mode == "offload")
-              {
-                prime.offload = { enable = true; enableOffloadCmd = true; };
-                powerManagement = { finegrained = true; enable = true; };
-              }
-            )
-            (
-              mkIf (hardware.prime.mode == "sync")
-              {
-                prime = { sync.enable = true; };
-                # prime.forceFullCompositionPipeline = true;
-              }
-            )
-            {
-              prime = listToAttrs
-                (map (gpu: { inherit (gpu) value; name = "${gpu.name}BusId"; }) (attrsToList hardware.prime.busId));
-            }
-            
-          ];
-        }
-      )
-      { programs.gamemode.settings.gpu.gpu_device = "${toString hardware.gamemode.drmDevice}"; }
-      # halo-keyboard
-      (mkIf hardware.halo-keyboard.enable
-      (
-        let
-          keyboard = inputs.pkgs.localPackages.chromiumos-touch-keyboard;
-          support = inputs.pkgs.localPackages.yoga-support;
-        in
-        {
-          services.udev.packages = [ keyboard support ];
-          systemd.services =
-          {
-            touch-keyboard-handler.serviceConfig =
-            {
-              Type = "simple";
-              WorkingDirectory = "/etc/touch_keyboard";
-              ExecStart = "${keyboard}/bin/touch_keyboard_handler";
-            };
-            yogabook-modes-handler.serviceConfig =
-            {
-              Type = "simple";
-              ExecStart = "${support}/bin/yogabook-modes-handler";
-              StandardOutput = "journal";
-            };
-            monitor-sensor =
-            {
-              wantedBy = [ "default.target" ];
-              serviceConfig =
-              {
-                Type = "simple";
-                ExecStart = "${inputs.pkgs.iio-sensor-proxy}/bin/monitor-sensor --hinge";
-              };
-            };
-          };
-          environment.etc."touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
-          boot.initrd =
-          {
-            services.udev.packages = [ keyboard support ];
-            systemd =
-            {
-              extraBin =
-              {
-                touch_keyboard_handler = "${keyboard}/bin/touch_keyboard_handler";
-                yogabook-modes-handler = "${support}/bin/yogabook-modes-handler";
-              };
-              services =
-              {
-                touch-keyboard-handler =
-                {
-                  serviceConfig =
-                  {
-                    Type = "simple";
-                    WorkingDirectory = "/etc/touch_keyboard";
-                    ExecStart = "${keyboard}/bin/touch_keyboard_handler";
-                  };
-                };
-                yogabook-modes-handler.serviceConfig =
-                {
-                  Type = "simple";
-                  ExecStart = "${support}/bin/yogabook-modes-handler";
-                  StandardOutput = "journal";
-                };
-              };
-
-            };
-            extraFiles."/etc/touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
-          };
-        }
-      ))
    ];
 }
--- a/modules/hardware/gpu.nix
+++ b/modules/hardware/gpu.nix
@@ -0,0 +1,95 @@
+inputs:
+{
+  options.nixos.hardware.gpu = let inherit (inputs.lib) mkOption types; in
+  {
+    type = mkOption
+    {
+      type = types.nullOr (types.enum
+      [
+        # single gpu
+        "intel" "nvidia" "amd"
+        # hibrid gpu: use nvidia prime offload mode
+        "intel+nvidia" "amd+nvidia"
+      ]);
+      default = null;
+    };
+    dynamicBoost = mkOption { type = types.bool; default = false; };
+    prime =
+    {
+      mode = mkOption { type = types.enum [ "offload" "sync" ]; default = "offload"; };
+      busId = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
+    };
+  };
+  config = let inherit (inputs.config.nixos.hardware) gpu; in inputs.lib.mkIf (gpu.type != null) (inputs.lib.mkMerge
+  [
+    # generic settings
+    (
+      let gpus = inputs.lib.strings.splitString "+" gpu.type; in
+      {
+        boot.initrd.availableKernelModules =
+          let modules =
+          {
+            intel = [ "i915" ];
+            nvidia = [ "nvidia" "nvidia_drm" "nvidia_modeset" ]; # nvidia-uvm should not be loaded
+            amd = [ "amdgpu" ];
+          };
+          in builtins.concatLists (builtins.map (gpu: modules.${gpu}) gpus);
+        hardware =
+        {
+          opengl =
+          {
+            enable = true;
+            driSupport = true;
+            driSupport32Bit = true;
+            extraPackages =
+              let packages = with inputs.pkgs;
+              {
+                intel = [ intel-vaapi-driver libvdpau-va-gl intel-media-driver ];
+                nvidia = [ vaapiVdpau ];
+                amd = [ amdvlk rocmPackages.clr rocmPackages.clr.icd ];
+              };
+              in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
+            extraPackages32 =
+              let packages = { intel = []; nvidia = []; amd = [ inputs.pkgs.driversi686Linux.amdvlk ]; };
+              in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
+          };
+          nvidia = inputs.lib.mkIf (builtins.elem "nvidia" gpus)
+          {
+            modesetting.enable = true;
+            powerManagement.enable = true;
+            dynamicBoost.enable = inputs.lib.mkIf gpu.dynamicBoost true;
+            nvidiaSettings = true;
+            forceFullCompositionPipeline = true;
+            # package = inputs.config.boot.kernelPackages.nvidiaPackages.production;
+            prime.allowExternalGpu = true;
+          };
+        };
+        boot =
+        {
+          kernelParams = inputs.lib.mkIf (builtins.elem "amd" gpus)
+            [ "radeon.cik_support=0" "amdgpu.cik_support=1" "radeon.si_support=0" "amdgpu.si_support=1" "iommu=pt" ];
+          blacklistedKernelModules = [ "nouveau" ];
+        };
+        environment.variables.VDPAU_DRIVER = inputs.lib.mkIf (builtins.elem "intel" gpus) "va_gl";
+        services.xserver.videoDrivers =
+          let driver = { intel = "modesetting"; amd = "amdgpu"; nvidia = "nvidia"; };
+          in builtins.map (gpu: driver.${gpu}) gpus;
+      }
+    )
+    # nvidia prime offload
+    (
+      inputs.lib.mkIf (inputs.lib.strings.hasSuffix "+nvidia" gpu.type) { hardware.nvidia =
+      {
+        prime =
+        {
+          offload = inputs.lib.mkIf (gpu.prime.mode == "offload") { enable = true; enableOffloadCmd = true; };
+          sync = inputs.lib.mkIf (gpu.prime.mode == "sync") { enable = true; };
+        }
+        // builtins.listToAttrs (builtins.map
+          (gpu: { name = "${if gpu.name == "amd" then "amdgpu" else gpu.name}BusId"; value = "PCI:${gpu.value}"; })
+          (inputs.localLib.attrsToList gpu.prime.busId));
+        powerManagement.finegrained = inputs.lib.mkIf (gpu.prime.mode == "offload") true;
+      };}
+    )
+  ]);
+}
--- a/modules/hardware/legion.nix
+++ b/modules/hardware/legion.nix
@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.hardware.legion = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+  };
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+      inherit (inputs.config.nixos.hardware) legion;
+    in mkIf legion.enable
+    {
+      environment.systemPackages = [ inputs.pkgs.lenovo-legion ];
+      boot.extraModulePackages = [ inputs.config.boot.kernelPackages.lenovo-legion-module ];
+    };
+}
--- a/modules/packages/desktop-fat/default.nix
+++ b/modules/packages/desktop-fat/default.nix
@@ -1,9 +1,6 @@
 inputs:
 {
-  imports = inputs.localLib.mkModules
-  [
-    ./chromium.nix
-  ];
+  imports = inputs.localLib.mkModules [ ./steam.nix ];
  config =
    let
      inherit (inputs.lib) mkIf;
@@ -16,7 +13,7 @@ inputs:
          _packages =
          [
            # system management
-            etcher btrfs-assistant snapper-gui libsForQt5.qtstyleplugin-kvantum
+            etcher btrfs-assistant snapper-gui libsForQt5.qtstyleplugin-kvantum ventoy-full cpu-x
            # password and key management
            yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden
            # download
@@ -24,24 +21,30 @@ inputs:
            # development
            scrcpy weston cage openbox krita
            # media
-            spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc
+            spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc obs-studio
+            waifu2x-converter-cpp inkscape blender
            # editor
-            localPackages.typora
+            typora
            # themes
            orchis-theme plasma-overdose-kde-theme materia-kde-theme graphite-kde-theme arc-kde-theme materia-theme
            # news
            fluent-reader
            # nix tools
-            deploy-rs.deploy-rs nixpkgs-fmt
+            deploy-rs.deploy-rs nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps
+            nix-prefetch-docker
            # instant messager
-            element-desktop telegram-desktop discord fluffychat
+            element-desktop telegram-desktop discord fluffychat zoom-us signal-desktop slack nur-linyinfeng.wemeet
            # browser
            google-chrome
            # office
-            crow-translate zotero pandoc ydict
+            crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
+            (texlive.combine { inherit (texlive) scheme-full; inherit (localPackages) citation-style-language; })
+            nextcloud-client
+            # math, physics and chemistry
+            octaveFull root ovito localPackages.vesta localPackages.vaspkit localPackages.v-sim
          ] ++ (with inputs.lib; filter isDerivation (attrValues plasma5Packages.kdeGear));
        };
      };
-      programs = { steam.enable = true; kdeconnect.enable = true; };
+      programs.kdeconnect.enable = true;
    };
 }
--- a/modules/packages/desktop-fat/steam.nix
+++ b/modules/packages/desktop-fat/steam.nix
@@ -0,0 +1,23 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
+    {
+      programs.steam =
+      {
+        enable = true;
+        package = inputs.pkgs.steam.override (prev:
+        {
+          steam = prev.steam.overrideAttrs (prev:
+          {
+            postInstall = prev.postInstall +
+            ''
+              sed -i 's#Comment\[zh_CN\]=.*$#Comment\[zh_CN\]=思题慕®学习平台#' $out/share/applications/steam.desktop
+            '';
+          });
+        });
+      };
+    };
+}
--- a/modules/packages/desktop-fat/chromium.nix
+++ b/modules/packages/desktop-fat/chromium.nix
@@ -3,8 +3,9 @@ inputs:
  config =
    let
      inherit (inputs.lib) mkIf;
-    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
+    in mkIf (builtins.elem "desktop" inputs.config.nixos.packages._packageSets)
    {
+      programs.chromium = { enable = true; extraOpts.PasswordManagerEnabled = false; };
      nixos.users.sharedModules =
      [{
        config.programs.chromium =
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -1,6 +1,6 @@
 inputs:
 {
-  imports = inputs.localLib.mkModules [ ./vscode.nix ];
+  imports = inputs.localLib.mkModules [ ./vscode.nix ./firefox.nix ./chromium.nix ./plasma ];
  config =
    let
      inherit (inputs.lib) mkIf;
@@ -11,30 +11,35 @@ inputs:
        packages._packages = with inputs.pkgs;
        [
          # system management
-          gparted wl-clipboard-x11 kio-fuse
-          wayland-utils clinfo glxinfo vulkan-tools dracut
+          gparted kio-fuse wayland-utils clinfo glxinfo vulkan-tools dracut
+          (
+            writeShellScriptBin "xclip"
+            ''
+              #!${bash}/bin/bash
+              if [ "$XDG_SESSION_TYPE" = "x11" ]; then
+                exec ${xclip}/bin/xclip -sel clip "$@"
+              else
+                exec ${wl-clipboard-x11}/bin/xclip "$@"
+              fi
+            ''
+          )
+          # color management
+          argyllcms xcalib
          # networking
          remmina putty mtr-gui
          # media
          mpv nomacs
          # themes
-          tela-circle-icon-theme
+          tela-circle-icon-theme localPackages.win11os-kde localPackages.fluent-kde localPackages.blurred-wallpaper
+          localPackages.slate utterly-nord-plasma
        ];
-        users.sharedModules =
-        [{
-          config.home.file.".config/baloofilerc".text =
-          ''
-            [Basic Settings]
-            Indexing-Enabled=false
-          '';
-        }];
      };
      programs =
      {
        adb.enable = true;
        wireshark = { enable = true; package = inputs.pkgs.wireshark; };
-        firefox = { enable = true; languagePacks = [ "zh-CN" "en-US" ]; };
        vim.package = inputs.pkgs.vim-full;
+        yubikey-touch-detector.enable = true;
      };
      nixpkgs.config.packageOverrides = pkgs: 
      {
--- a/modules/packages/desktop/firefox.nix
+++ b/modules/packages/desktop/firefox.nix
@@ -0,0 +1,58 @@
+inputs:
+{
+  config = inputs.lib.mkIf (builtins.elem "desktop" inputs.config.nixos.packages._packageSets)
+  {
+    nixos.users.sharedModules = [{ config =
+    {
+      programs.firefox =
+      {
+        enable = true;
+        # TODO: switch to 24.05
+        # nativeMessagingHosts = [ inputs.pkgs.plasma-browser-integration ];
+        package = inputs.pkgs.firefox.override { nativeMessagingHosts = [ inputs.pkgs.plasma-browser-integration ]; };
+        policies.DefaultDownloadDirectory = "\${home}/Downloads";
+        profiles.default =
+        {
+          extensions = with inputs.pkgs.firefox-addons;
+          [
+            immersive-translate tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
+            metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
+            wappalyzer grammarly plasma-integration
+            (
+              buildFirefoxXpiAddon rec
+              {
+                pname = "zotero-connector";
+                version = "5.0.119";
+                addonId = "zotero@chnm.gmu.edu";
+                url = "https://download.zotero.org/connector/firefox/release/Zotero_Connector-${version}.xpi";
+                sha256 = "17yhkp5nrx325q3amlasb4nsw0bldm8i2i9fh8ql2hwj8fmy25mr";
+                meta = {};
+              }
+            )
+          ];
+          search = { default = "Google"; force = true; };
+          userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";
+          userContent = builtins.readFile "${inputs.topInputs.lepton}/userContent.css";
+          extraConfig = builtins.readFile "${inputs.topInputs.lepton}/user.js";
+          settings =
+          {
+            # general
+            "browser.search.region" = "CN";
+            "intl.locale.requested" = "zh-CN,en-US";
+            "browser.aboutConfig.showWarning" = false;
+            "browser.bookmarks.showMobileBookmarks" = true;
+            "browser.download.panel.shown" = true;
+            "browser.download.useDownloadDir" = true;
+            "browser.newtab.extensionControlled" = true;
+            "browser.toolbars.bookmarks.visibility" = "never";
+            # allow to apply userChrome.css
+            "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+          };
+        };
+      };
+      home.file.".mozilla/firefox/profiles.ini".force = true;
+    };}];
+    # still enable global firefox, to install language packs
+    programs.firefox = { enable = true; languagePacks = [ "zh-CN" "en-US" ]; };
+  };
+}
--- a/modules/packages/desktop/plasma/default.nix
+++ b/modules/packages/desktop/plasma/default.nix
@@ -0,0 +1,98 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules [ ./konsole.nix ];
+  config.nixos.users.sharedModules = inputs.lib.mkIf inputs.config.nixos.system.gui.enable
+  [{
+    config.programs.plasma = inputs.lib.mkMerge
+    [
+      # TODO: autostart, panel, discard user changed settings
+      # general
+      {
+        enable = true;
+        configFile.plasma-localerc = { Formats.LANG = "en_US.UTF-8"; Translations.LANGUAGE = "zh_CN"; };
+      }
+      # kwin
+      {
+        kwin.titlebarButtons =
+        {
+          right = [ "help" "keep-below-windows" "keep-above-windows" "minimize" "maximize" "close" ];
+          left = [ "more-window-actions" ];
+        };
+        windows.allowWindowsToRememberPositions = false;
+        configFile =
+        {
+          plasmanotifyrc.Notifications.PopupPosition = "BottomRight";
+          kwinrc =
+          {
+            Tiling.padding = 4;
+            Wayland."InputMethod[$e]" = "/run/current-system/sw/share/applications/org.fcitx.Fcitx5.desktop";
+            Windows.RollOverDesktops = true;
+            Compositing = { AllowTearing = false; WindowsBlockCompositing = false; };
+          };
+        };
+      }
+      # baloo
+      { configFile.baloofilerc."Basic Settings".Indexing-Enabled = false; }
+      # dolphin and file chooser
+      {
+        configFile =
+        {
+          dolphinrc =
+          {
+            General = { ShowFullPath = true; FilterBar = true; RememberOpenedTabs = false; };
+            PreviewSettings.Plugins = builtins.concatStringsSep ","
+            [
+              "blenderthumbnail"
+              "comicbookthumbnail"
+              "djvuthumbnail"
+              "ebookthumbnail"
+              "exrthumbnail"
+              "marble_thumbnail_geojson"
+              "marble_thumbnail_gpx"
+              "jpegthumbnail"
+              "marble_thumbnail_kmz"
+              "marble_thumbnail_kml"
+              "kraorathumbnail"
+              "windowsimagethumbnail"
+              "windowsexethumbnail"
+              "mltpreview"
+              "mobithumbnail"
+              "opendocumentthumbnail"
+              "marble_thumbnail_osm"
+              "palathumbcreator"
+              "gsthumbnail"
+              "rawthumbnail"
+              "svgthumbnail"
+              "imagethumbnail"
+              "fontthumbnail"
+              "directorythumbnail"
+              "textthumbnail"
+              "webarchivethumbnail"
+              "ffmpegthumbs"
+              "audiothumbnail"
+            ];
+          };
+          kdeglobals."KFileDialog Settings" =
+          {
+            "Allow Expansion" = true;
+            "Automatically select filename extension" = true;
+            "Show Bookmarks" = true;
+            "Show Full Path" = true;
+            "Show Inline Previews" = true;
+            "Show Preview" = true;
+            "Show Speedbar" = true;
+            "Show hidden files" = true;
+            "Sort by" = "Name";
+            "Sort directories first" = true;
+            "Sort hidden files last" = true;
+            "View Style" = "DetailTree";
+          };
+        };
+      }
+      # krunner
+      { configFile.krunnerrc = { General.FreeFloating = true; Plugins.baloosearchEnabled = false; }; }
+      # lock screen
+      { configFile.kscreenlockerrc.Daemon.Autolock = false; }
+    ];
+  }];
+}
--- a/modules/packages/desktop/plasma/konsole.nix
+++ b/modules/packages/desktop/plasma/konsole.nix
@@ -0,0 +1,84 @@
+inputs:
+{
+  config = inputs.lib.mkIf inputs.config.nixos.system.gui.enable
+  {
+    nixos.users.sharedModules =
+    [(hmInputs: {
+      config =
+      {
+        programs.plasma =
+        {
+          overrideConfig = true;
+          overrideConfigFiles = [ "konsolerc" "yakuakerc" ];
+          configFile =
+          {
+            yakuakerc =
+            {
+              Appearance =
+              {
+                HideSkinBorders = true;
+                Skin = "Slate";
+                Translucency = true;
+              };
+              "Desktop Entry".DefaultProfile = "plasma-manager.profile";
+              Dialogs.FirstRun = false;
+              Window =
+              {
+                KeepOpen = false;
+                KeepOpenAfterLastSessionCloses = true;
+                ShowSystrayIcon = false;
+              };
+            };
+            konsolerc =
+            {
+              "Desktop Entry".DefaultProfile = "plasma-manager.profile";
+              "MainWindow.Toolbar sessionToolbar".ToolButtonStyle = "IconOnly";
+            };
+          };
+          dataFile."konsole/plasma-manager.profile" =
+          {
+            Appearance =
+            {
+              AntiAliasFonts = true;
+              BoldIntense = true;
+              ColorScheme = "Breeze";
+              Font = "FiraCode Nerd Font Mono,10,-1,5,50,0,0,0,0,0";
+              UseFontLineChararacters = true;
+              WordModeAttr = false;
+            };
+            "Cursor Options".CursorShape = 1;
+            General =
+            {
+              Name = "plasma-manager";
+              Parent = "FALLBACK/";
+              TerminalCenter = true;
+              TerminalMargin = 1;
+            };
+            "Interaction Options" =
+            {
+              AutoCopySelectedText = true;
+              TrimLeadingSpacesInSelectedText = true;
+              TrimTrailingSpacesInSelectedText = true;
+              UnderlineFilesEnabled = true;
+            };
+            Scrolling =
+            {
+              HistoryMode = 2;
+              ReflowLines = false;
+            };
+            "Terminal Features".BlinkingCursorEnabled = true;
+          };
+        };
+        home.file.".local/share/konsole/Breeze.colorscheme".text = builtins.replaceStrings
+          [ "Opacity=1" ] [ "Opacity=0.9\nBlur=true" ]
+          (builtins.readFile "${inputs.pkgs.konsole}/share/konsole/Breeze.colorscheme");
+      };
+    })];
+    environment.persistence =
+      let impermanence = inputs.config.nixos.system.impermanence;
+      in inputs.lib.mkIf impermanence.enable (inputs.lib.mkMerge (builtins.map
+        (user:
+          { "${impermanence.root}".users.${user}.directories = [ ".local/share/konsole" ".local/share/yakuake" ]; })
+        inputs.config.nixos.users.users));
+  };
+}
--- a/modules/packages/desktop/vscode.nix
+++ b/modules/packages/desktop/vscode.nix
@@ -22,7 +22,7 @@ inputs:
              ])
              ++ (with ms-vscode;
              [
-                cmake-tools cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
+                (cmake-tools.overrideAttrs { sourceRoot = "extension"; }) cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
                test-adapter-converter
              ])
              ++ (with ms-vscode-remote; [ remote-ssh remote-containers remote-ssh-edit ])
@@ -44,6 +44,9 @@ inputs:
                lextudio.restructuredtext trond-snekvik.simple-rst
                # markdown
                shd101wyy.markdown-preview-enhanced
+                # vasp
+                mystery.vasp-support
+                yutengjing.open-in-external-app
              ];
          }
        )];
--- a/modules/packages/server/default.nix
+++ b/modules/packages/server/default.nix
@@ -4,6 +4,7 @@ inputs:
  [
    ./ssh
    ./zsh
+    ./gpg.nix
  ];
  config =
    let
@@ -16,7 +17,7 @@ inputs:
      {
        packages = with inputs.pkgs;
        {
-          _packages = 
+          _packages =
          [
            # shell
            ksh
@@ -24,7 +25,7 @@ inputs:
            beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij neofetch ipfetch localPackages.pslist
            fastfetch reptyr
            # lsxx
-            pciutils usbutils lshw util-linux lsof
+            pciutils usbutils lshw util-linux lsof dmidecode
            # top
            iotop iftop htop btop powertop s-tui
            # editor
@@ -44,12 +45,17 @@ inputs:
            # networking
            ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
            # nix tools
-            nix-output-monitor nix-tree ssh-to-age
+            nix-output-monitor nix-tree ssh-to-age (callPackage "${inputs.topInputs.nix-fast-build}" {})
            # office
-            todo-txt-cli
+            todo-txt-cli pdfgrep
            # development
            gdb try inputs.topInputs.plasma-manager.packages.x86_64-linux.rc2nix hexo-cli
          ] ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
+          _pythonPackages = [(pythonPackages: with pythonPackages;
+          [
+            openai python-telegram-bot fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+            certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus
+          ])];
        };
        users.sharedModules = [(home-inputs:
        {
@@ -108,7 +114,6 @@ inputs:
        nix-index-database.comma.enable = true;
        nix-index.enable = true;
        command-not-found.enable = false;
-        gnupg.agent = { enable = true; enableSSHSupport = true; };
        autojump.enable = true;
        git =
        {
--- a/modules/packages/server/gpg.nix
+++ b/modules/packages/server/gpg.nix
@@ -0,0 +1,10 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
+    {
+      programs.gnupg.agent = { enable = true; pinentryFlavor = "tty"; };
+    };
+}
--- a/modules/packages/server/ssh/default.nix
+++ b/modules/packages/server/ssh/default.nix
@@ -41,6 +41,11 @@ inputs:
              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
              hostnames = [ "initrd.nas.chn.moe" "[office.chn.moe]:5440" "192.168.1.185" ];
            };
+            surface =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdm3DcfHdcLP0oSpVrWwIZ/b9lZuakBSPwCFz2BdTJ7";
+              hostnames = [ "192.168.1.166" "wireguard.surface.chn.moe" "192.168.83.5" ];
+            };
            pc =
            {
              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
@@ -56,6 +61,11 @@ inputs:
              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
              hostnames = [ "github.com" ];
            };
+            xmupc1 =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINTvfywkKRwMrVp73HfHTfjhac2Tn9qX/lRjLr09ycHp";
+              hostnames = [ "[office.chn.moe]:6007" "[xmupc1.chn.moe]:6007" "wireguard.xmupc1.chn.moe" "192.168.83.6" ];
+            };
          };
        in listToAttrs (concatLists (map
          (server:
@@ -96,7 +106,14 @@ inputs:
            else []
          ))
          (attrsToList servers)));
-      programs.ssh = { enableAskPassword = true; askPassword = "${inputs.pkgs.systemd}/bin/systemd-ask-password"; };
+      programs.ssh =
+      {
+        startAgent = true;
+        enableAskPassword = true;
+        askPassword = "${inputs.pkgs.systemd}/bin/systemd-ask-password";
+        extraConfig = "AddKeysToAgent yes";
+      };
+      environment.sessionVariables.SSH_ASKPASS_REQUIRE = "prefer";
      nixos.users.sharedModules =
      [(hmInputs: {
        config.programs.ssh =
@@ -109,7 +126,10 @@ inputs:
          (
            (builtins.map
              (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-              [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "wireguard.nas" ])
+              [
+                "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "wireguard.nas" "wireguard.surface"
+                "wireguard.xmupc1"
+              ])
            ++ (builtins.map
              (host:
              {
@@ -128,6 +148,9 @@ inputs:
                        usernameMap =
                        {
                          chn = "linwei/chn";
+                          xll = "linwei/Xll";
+                          yjq = "linwei/yjq";
+                          gb = "kangjunyong/gongbin";
                        };
                        cdString =
                          if host == "jykang" && (usernameMap ? ${hmInputs.config.home.username}) then
@@ -154,6 +177,7 @@ inputs:
          // {
            xmupc1 = { host = "xmupc1"; hostname = "office.chn.moe"; port = 6007; };
            nas = { host = "nas"; hostname = "office.chn.moe"; port = 5440; };
+            surface = { host = "surface"; hostname = "192.168.1.166"; };
            gitea = { host = "gitea"; hostname = "ssh.git.chn.moe"; };
          };
        };
--- a/modules/packages/server/ssh/surface_rsa.pub
+++ b/modules/packages/server/ssh/surface_rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJAyDl52UVGFPTV/rXFERrXAMY5qZ3g+tpg9HOGdw86G4Nr8Xp/cTxZjF4kSfIkSrGblAV9Lm4US0fW3pGOQu5qQrSAENxqHxdlEyzt7izyF2CklDUeTjs3KHOIZMvSli4z014NPcswBbjwB9Lyrw0fCQ9P1vYkrUHEzL2SMxdack1EQPcMF4MxblDqc+eQhdMCkKE8T1Cb1ZqxeLVMPn9CwjG18JoxL+/xs+MjcsSXYWcoqYTfgfhguMbh0D4Eo32MHS/IzRSxnOHJxhG5xYePcyBlb/CxQuYA+RTqKNE85j7GcL2oEmeZ1b++/9qFT9grwVh+UOBRO2xiMzKDF24nXPJ+eLyd6Z/3swGT4rTVDnrXV5eZUkWLHN093IdLJCTtPVrKV9OxEKr5sU2W0edpirNrlGq7/MYkJX9EbQctDFA69XfQkZlGK9xGutqSgEaVlY54fS0Due+NDrNBPfMKJ9MTmFDOY+NYn05El2rMD39OKbGbCR5ASwSSBlcQeE=
--- a/modules/packages/server/ssh/xmupc1_rsa.pub
+++ b/modules/packages/server/ssh/xmupc1_rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVbOvoFVaGkqYzIWsmMFlpkE+TDAONOWWaJBQ0K4fiOLy7uh02b/jYNZrbllPDP+Gq+ikYEJnJX2ceDsh9mLtJTznBQXgJOMUZDYy0enu7hYLKMmRTgJntzHjMbZENMhP+I3N9JnQ1PQz7lICg1xkEBQm2CESYCCjo0rJKYplPH1bo02myEazKlKTn6tu40ysrYOoJO8+jwbUDqtWATjSZtgYojuh6dbIoK3O+Ntgwl4W0NqXEqXYXTWpU0qKOqAsP/9F9WJ5d1wVNNbvmcAJ26dkYaiPCNgW4MGTucAgoxM6IPVVj9U+OEZLoCPsqAGCT02vH5MoDNTmGaSv0DjuYOzz5C+jAhMCznXFXCI4bfawvuda/WwGIniB5iKNSBZt3XxYyUw4YBcVCNiWUt9bIgEvnR4E8HYHdjNrbQ0Z58L6DcPSySLQer7C658Vo/nRUlBq6lIWYhcdjxHHkP9iFtuFW1HmoUKkuaLl+uiflrSppX9wt8eaPwGgGIHkLwgc=
--- a/modules/packages/server/zsh/default.nix
+++ b/modules/packages/server/zsh/default.nix
@@ -5,62 +5,67 @@ inputs:
      inherit (inputs.lib) mkIf;
    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
    {
-      nixos.users.sharedModules = [(home-inputs: { config.programs.zsh =
+      nixos.users.sharedModules = [(home-inputs: { config.programs =
      {
-        enable = true;
-        initExtraBeforeCompInit =
-        ''
-          # p10k instant prompt
-          P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
-          [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
-          HYPHEN_INSENSITIVE="true"
-          export PATH=~/bin:$PATH
-          function br
-          {
-            local cmd cmd_file code
-            cmd_file=$(mktemp)
-            if broot --outcmd "$cmd_file" "$@"; then
-              cmd=$(<"$cmd_file")
-              command rm -f "$cmd_file"
-              eval "$cmd"
-            else
-              code=$?
-              command rm -f "$cmd_file"
-              return "$code"
-            fi
-          }
-          alias todo="todo.sh"
-        '';
-        plugins =
-        [
-          {
-            file = "powerlevel10k.zsh-theme";
-            name = "powerlevel10k";
-            src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
-          }
-          {
-            file = "p10k.zsh";
-            name = "powerlevel10k-config";
-            src = ./p10k-config;
-          }
-          {
-            name = "zsh-lsd";
-            src = inputs.pkgs.fetchFromGitHub
-            {
-              owner = "z-shell";
-              repo = "zsh-lsd";
-              rev = "65bb5ac49190beda263aae552a9369127961632d";
-              hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
-            };
-          }
-        ];
-        history =
+        zsh =
        {
-          path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
-          extended = true;
-          save = 100000000;
-          size = 100000000;
+          enable = true;
+          initExtraBeforeCompInit =
+          ''
+            # p10k instant prompt
+            P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
+            [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
+            HYPHEN_INSENSITIVE="true"
+            export PATH=~/bin:$PATH
+            function br
+            {
+              local cmd cmd_file code
+              cmd_file=$(mktemp)
+              if broot --outcmd "$cmd_file" "$@"; then
+                cmd=$(<"$cmd_file")
+                command rm -f "$cmd_file"
+                eval "$cmd"
+              else
+                code=$?
+                command rm -f "$cmd_file"
+                return "$code"
+              fi
+            }
+            alias todo="todo.sh"
+          '';
+          plugins =
+          [
+            {
+              file = "powerlevel10k.zsh-theme";
+              name = "powerlevel10k";
+              src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
+            }
+            {
+              file = "p10k.zsh";
+              name = "powerlevel10k-config";
+              src = ./p10k-config;
+            }
+            {
+              name = "zsh-lsd";
+              src = inputs.pkgs.fetchFromGitHub
+              {
+                owner = "z-shell";
+                repo = "zsh-lsd";
+                rev = "65bb5ac49190beda263aae552a9369127961632d";
+                hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
+              };
+            }
+          ];
+          history =
+          {
+            path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
+            extended = true;
+            save = 100000000;
+            size = 100000000;
+          };
        };
+        # set bash history file path, avoid overwriting zsh history
+        bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
      };})];
      programs.zsh =
      {
--- a/modules/packages/workstation/default.nix
+++ b/modules/packages/workstation/default.nix
@@ -14,48 +14,37 @@ inputs:
            # password and key management
            electrum jabref
            # system management
-            wl-mirror ventoy-full
+            wl-mirror nvtop
            # nix tools
-            nix-template appimage-run nil nixd nix-alien nix-serve node2nix nix-prefetch-github prefetch-npm-deps
-            nix-prefetch-docker pnpm-lock-export bundix
+            nix-template nil pnpm-lock-export bundix
            # instant messager
-            zoom-us signal-desktop qq nur-xddxdd.wechat-uos slack inputs.config.nur.repos.linyinfeng.wemeet
-            cinny-desktop nheko
-            # office
-            libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
-            (texlive.combine { inherit (texlive) scheme-full; inherit (localPackages) citation-style-language; })
+            qq nur-xddxdd.wechat-uos cinny-desktop nheko
            # development
            jetbrains.clion android-studio dbeaver cling clang-tools_16 ccls fprettify aircrack-ng
            # media
-            nur-xddxdd.svp obs-studio waifu2x-converter-cpp inkscape blender
+            nur-xddxdd.svp
            # virtualization
            wineWowPackages.stagingFull virt-viewer bottles # wine64
            # text editor
            appflowy notion-app-enhanced joplin-desktop standardnotes logseq
            # math, physics and chemistry
-            mathematica octaveFull root ovito paraview localPackages.vesta qchem.quantum-espresso
-            localPackages.vasp localPackages.vaspkit jmol localPackages.v_sim
+            mathematica paraview jmol mpi localPackages.mumax quantum-espresso
            # encryption and password management
            john crunch hashcat
            # container and vm
-            genymotion # davinci-resolve playonlinux
+            genymotion davinci-resolve playonlinux
            # browser
-            microsoft-edge
+            microsoft-edge tor-browser
            # news
            rssguard newsflash newsboat
-          ];
+          ]
+          ++ (builtins.concatLists (builtins.map
+            (compiler: builtins.map (version: localPackages.vasp.${compiler}.${version}) [ "6.3.1" "6.4.0" ])
+            [ "gnu" "nvidia" ]));
          _pythonPackages = [(pythonPackages: with pythonPackages;
          [
-            phonopy tensorflow keras openai scipy scikit-learn jupyterlab autograd
-            # localPackages.pix2tex
-            inquirerpy requests python-telegram-bot tqdm fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
-            certifi charset-normalizer idna orjson psycopg2 localPackages.eigengdb
+            phonopy tensorflow keras scipy scikit-learn jupyterlab autograd # localPackages.pix2tex
          ])];
-          _prebuildPackages =
-          [
-            httplib magic-enum xtensor boost cereal cxxopts ftxui yaml-cpp gfortran gcc10 python2
-            gcc13Stdenv
-          ];
        };
        users.sharedModules =
        [{
@@ -76,29 +65,6 @@ inputs:
        anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
        honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
        nix-ld.enable = true;
-        gamemode =
-        {
-          enable = true;
-          settings =
-          {
-            general.renice = 10;
-            gpu =
-            {
-              apply_gpu_optimisations = "accept-responsibility";
-              nv_powermizer_mode = 1;
-            };
-            custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
-            {
-              start = "${notify-send} 'GameMode started'";
-              end = "${notify-send} 'GameMode ended'";
-            };
-          };
-        };
-        chromium =
-        {
-          enable = true;
-          extraOpts.PasswordManagerEnabled = false;
-        };
      };
    };
 }
--- a/modules/services/beesd.nix
+++ b/modules/services/beesd.nix
@@ -8,8 +8,14 @@ inputs:
      type = types.attrsOf (types.oneOf
      [
        types.nonEmptyStr
-        (types.submodule { options =
-          { device = mkOption { type = types.nonEmptyStr; }; hashTableSizeMB = mkOption { type = types.int; }; };})
+        (types.submodule
+        {
+          options =
+          {
+            device = mkOption { type = types.nonEmptyStr; };
+            hashTableSizeMB = mkOption { type = types.ints.unsigned; default = 1024; };
+            threads = mkOption { type = types.ints.unsigned; default = 1; };
+          };})
      ]);
      default = {};
    };
@@ -30,7 +36,7 @@ inputs:
            {
              spec = instance.value.device or instance.value;
              hashTableSizeMB = instance.value.hashTableSizeMB or 1024;
-              extraOptions = [ "--thread-count" "1" "--scan-mode" "3" ];
+              extraOptions = [ "--thread-count" "${toString instance.value.threads or 1}" "--scan-mode" "3" ];
            };
          })
          (attrsToList beesd.instances));
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -40,6 +40,9 @@ inputs:
    ./fail2ban.nix
    ./wireguard.nix
    ./akkoma.nix
+    ./gamemode.nix
+    ./vikunja.nix
+    ./slurm.nix
  ];
  options.nixos.services = let inherit (inputs.lib) mkOption types; in
  {
--- a/modules/services/fontconfig.nix
+++ b/modules/services/fontconfig.nix
@@ -14,14 +14,18 @@ inputs:
      {
        fontDir.enable = true;
        packages = with inputs.pkgs;
-          [ noto-fonts source-han-sans source-han-serif source-code-pro hack-font jetbrains-mono nerdfonts ];
+        [
+          noto-fonts source-han-sans source-han-serif source-code-pro hack-font jetbrains-mono nerdfonts hack-font inter
+          noto-fonts-color-emoji roboto sarasa-gothic source-han-mono wqy_microhei wqy_zenhei
+        ];
        fontconfig.defaultFonts =
        {
          emoji = [ "Noto Color Emoji" ];
-          monospace = [ "Noto Sans Mono CJK SC" "Sarasa Mono SC" "DejaVu Sans Mono"];
-          sansSerif = [ "Noto Sans CJK SC" "Source Han Sans SC" "DejaVu Sans" ];
-          serif = [ "Noto Serif CJK SC" "Source Han Serif SC" "DejaVu Serif" ];
+          monospace = [ "Hack" "Source Han Mono SC" ];
+          sansSerif = [ "Inter" "Liberation Sans" "Source Han Sans SC" ];
+          serif = [ "Liberation Serif" "Source Han Serif SC" ];
        };
      };
+      nixos.users.sharedModules = [{ config.xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".force = true; }];
    };
 }
--- a/modules/services/gamemode.nix
+++ b/modules/services/gamemode.nix
@@ -0,0 +1,30 @@
+inputs:
+{
+  options.nixos.services.gamemode = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    drmDevice = mkOption { type = types.int; };
+  };
+  config = let inherit (inputs.config.nixos.services) gamemode; in inputs.lib.mkIf gamemode.enable
+  {
+    programs.gamemode =
+    {
+      enable = true;
+      settings =
+      {
+        general.renice = 10;
+        gpu =
+        {
+          apply_gpu_optimisations = "accept-responsibility";
+          nv_powermizer_mode = 1;
+          gpu_device = builtins.toString gamemode.drmDevice;
+        };
+        custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
+        {
+          start = "${notify-send} 'GameMode started'";
+          end = "${notify-send} 'GameMode ended'";
+        };
+      };
+    };
+  };
+}
--- a/modules/services/mirism.nix
+++ b/modules/services/mirism.nix
@@ -32,6 +32,8 @@ inputs:
                User = inputs.config.users.users.mirism.name;
                Group = inputs.config.users.users.mirism.group;
                ExecStart = "${inputs.pkgs.localPackages.mirism}/bin/${instance}";
+                RuntimeMaxSec = "1d";
+                Restart = "always";
              };
            };
          })
--- a/modules/services/misskey.nix
+++ b/modules/services/misskey.nix
@@ -114,7 +114,7 @@ inputs:
                  apiKey: ${placeholder."meilisearch/misskey-${instance.name}"}
                  ssl: false
                  index: misskey
-                  scope: globa
+                  scope: global
              '' else "");
            owner = inputs.config.users.users."misskey-${instance.name}".name;
          };
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -52,20 +52,26 @@ inputs:
            # nix-prefetch-url --unpack
            maps = inputs.pkgs.fetchNextcloudApp
            {
-              url = githubRelease "nextcloud/maps" "v1.1.1/maps-1.1.1.tar.gz";
+              url = githubRelease "nextcloud/maps" "v1.3.1/maps-1.3.1.tar.gz";
              sha256 = "1rcmqnm5364h5gaq1yy6b6d7k17napgn0yc9ymrnn75bps9s71v9";
              license = "agpl3";
            };
            phonetrack = inputs.pkgs.fetchNextcloudApp
            {
-              url = githubRelease "julien-nc/phonetrack" "v0.7.6/phonetrack-0.7.6.tar.gz";
-              sha256 = "1p15vw7c5c1h08czyxi1r6svjd5hjmnc0i6is4vl3xq2kfjmcyyx";
+              url = githubRelease "julien-nc/phonetrack" "v0.7.7/phonetrack-0.7.7.tar.gz";
+              sha256 = "1xvdmb2wlcldv8lk4jb8akhi80w26m2jpazfcz641frjm333kxch";
              license = "agpl3";
            };
            twofactor_webauthn = inputs.pkgs.fetchNextcloudApp
            {
-              url = githubRelease "nextcloud-releases/twofactor_webauthn" "v1.3.0/twofactor_webauthn-v1.3.0.tar.gz";
-              sha256 = "0z6m2chq5kxc8f10g6n1lh51yi10svy2qp5gp0v8xs71apqcc2wx";
+              url = githubRelease "nextcloud-releases/twofactor_webauthn" "v1.3.2/twofactor_webauthn-v1.3.2.tar.gz";
+              sha256 = "1p4ng7nprlcgw7sdfd7wqx5az86a856f1v470lahg2nfbx3fg296";
+              license = "agpl3";
+            };
+            calendar = inputs.pkgs.fetchNextcloudApp
+            {
+              url = githubRelease "nextcloud-releases/calendar" "v4.6.5/calendar-v4.6.5.tar.gz";
+              sha256 = "18mi6ccq640jq21hmir35v2967h07bjv226072d9qz5qkzkmrhss";
              license = "agpl3";
            };
          };
--- a/modules/services/nginx/applications/main.nix
+++ b/modules/services/nginx/applications/main.nix
@@ -7,7 +7,8 @@ inputs:
  config =
    let
      inherit (inputs.config.nixos.services.nginx.applications) main;
-    in
+      inherit (inputs.lib) mkIf;
+    in mkIf main.enable
    {
      nixos.services.nginx.https."chn.moe".location =
      {
--- a/modules/services/slurm.nix
+++ b/modules/services/slurm.nix
@@ -0,0 +1,114 @@
+inputs:
+{
+  options.nixos.services.slurm = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    cpu =
+    {
+      cores = mkOption { type = types.ints.unsigned; };
+      threads = mkOption { type = types.ints.unsigned; default = 1; };
+    };
+    memoryMB = mkOption { type = types.ints.unsigned; };
+    gpus = mkOption { type = types.attrsOf types.ints.unsigned; };
+  };
+  config = let inherit (inputs.config.nixos.services) slurm; in inputs.lib.mkIf slurm.enable
+  {
+    services =
+    {
+      slurm =
+      {
+        server.enable = true;
+        package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
+          (prev: let inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev; in
+          {
+            buildInputs = prev.buildInputs ++ [ cuda_nvml_dev ];
+            LDFLAGS = [ "-L${cuda_nvml_dev}/lib/stubs" ];
+            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.wrapGAppsHook ];
+          });
+        clusterName = inputs.config.nixos.system.networking.hostname;
+        dbdserver =
+        {
+          enable = true;
+          dbdHost = "localhost";
+          storagePassFile = inputs.config.sops.secrets."slurm/db".path;
+          extraConfig =
+          ''
+            StorageHost=*
+            StorageLoc=slurm
+          '';
+        };
+        client.enable = true;
+        controlMachine = "localhost";
+        nodeName =
+          let gpuString = builtins.concatStringsSep "," (builtins.map
+            (gpu: "gpu:${gpu.name}:${builtins.toString gpu.value}")
+            (inputs.localLib.attrsToList slurm.gpus));
+          in inputs.lib.singleton (builtins.concatStringsSep " "
+          [
+            "localhost"
+            "RealMemory=${builtins.toString slurm.memoryMB}"
+            "Sockets=1"
+            "CoresPerSocket=${builtins.toString slurm.cpu.cores}"
+            "ThreadsPerCore=${builtins.toString slurm.cpu.threads}"
+            "Gres=${gpuString}"
+            "State=UNKNOWN"
+          ]);
+        partitionName = [ "localhost Nodes=localhost Default=YES MaxTime=INFINITE State=UP" ];
+        procTrackType = "proctrack/cgroup";
+        extraConfig =
+          let taskProlog =
+          ''
+            echo export CUDA_DEVICE_ORDER=PCI_BUS_ID
+            echo export SLURM_THREADS_PER_CPU=${builtins.toString slurm.cpu.threads}
+          '';
+          in
+          ''
+            SelectType=select/cons_tres
+            SelectTypeParameters=CR_Core
+            GresTypes=gpu
+            TaskProlog=${inputs.pkgs.writeShellScript "set_env" taskProlog}
+
+            AccountingStorageType=accounting_storage/slurmdbd
+            AccountingStorageHost=localhost
+            AccountingStoreFlags=job_comment,job_env,job_extra,job_script
+
+            JobCompType=jobcomp/filetxt
+            JobCompLoc=/var/log/slurmctld/jobcomp.log
+
+            SchedulerParameters=enable_user_top
+
+            SlurmdDebug=debug2
+          '';
+        extraConfigPaths =
+          let gpuString = builtins.concatStringsSep "\n" (builtins.map
+            (gpu: "Name=gpu Type=${gpu.name} Count=${builtins.toString gpu.value}")
+            (inputs.localLib.attrsToList slurm.gpus));
+          in [(inputs.pkgs.writeTextDir "gres.conf" "AutoDetect=nvml\n${gpuString}")];
+      };
+      munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
+    };
+    systemd =
+    {
+      services.slurmd.environment =
+      {
+        CUDA_PATH = "${inputs.pkgs.cudatoolkit}";
+        LD_LIBRARY_PATH = "${inputs.config.hardware.nvidia.package}/lib";
+      };
+      tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
+    };
+    sops =
+    {
+      secrets =
+      {
+        "munge.key" =
+        {
+          format = "binary";
+          sopsFile = "${builtins.dirOf inputs.config.sops.defaultSopsFile}/munge.key";
+          owner = inputs.config.systemd.services.munged.serviceConfig.User;
+        };
+        "slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
+      };
+    };
+    nixos.services.mariadb = { enable = true; instances.slurm = {}; };
+  };
+}
--- a/modules/services/vikunja.nix
+++ b/modules/services/vikunja.nix
@@ -0,0 +1,44 @@
+inputs:
+{
+  options.nixos.services.vikunja = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    autoStart = mkOption { type = types.bool; default = true; };
+    port = mkOption { type = types.ints.unsigned; default = 3456; };
+    hostname = mkOption { type = types.nonEmptyStr; default = "vikunja.chn.moe"; };
+  };
+  config = let inherit (inputs.config.nixos.services) vikunja; in inputs.lib.mkIf vikunja.enable
+  {
+    services.vikunja =
+    {
+      enable = true;
+      environmentFiles = [ inputs.config.sops.templates."vikunja.env".path ];
+      settings =
+      {
+        service.timezone = "Asia/Shanghai";
+        mailer = { enable = true; host = "mail.chn.moe"; username = "bot@chn.moe"; fromemail = "bot@chn.moe"; };
+        defaultsettings.discoverable_by_email = true;
+      };
+      inherit (vikunja) port;
+      frontendScheme = "https";
+      frontendHostname = vikunja.hostname;
+      database.type = "postgres";
+    };
+    sops =
+    {
+      templates."vikunja.env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        VIKUNJA_SERVICE_JWTSECRET=${placeholder."vikunja/jwtsecret"}
+        VIKUNJA_DATABASE_PASSWORD=${placeholder."postgresql/vikunja"}
+        VIKUNJA_MAILER_PASSWORD=${placeholder."mail/bot"}
+      '';
+      secrets = { "vikunja/jwtsecret" = {}; "mail/bot" = {}; };
+    };
+    systemd.services.vikunja-api.enable = vikunja.autoStart;
+    nixos.services =
+    {
+      postgresql = { enable = true; instances.vikunja = {}; };
+      nginx = { enable = true; https.${vikunja.hostname}.global.configName = vikunja.hostname; };
+    };
+  };
+}
--- a/modules/services/wireguard.nix
+++ b/modules/services/wireguard.nix
@@ -3,45 +3,88 @@ inputs:
  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
  {
    enable = mkOption { type = types.bool; default = false; };
-    peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
    # wg genkey | wg pubkey
    publicKey = mkOption { type = types.nonEmptyStr; };
-    wireguardIp = mkOption { type = types.nonEmptyStr; };
-    externalIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
    lighthouse = mkOption { type = types.bool; default = false; };
+    behindNat = mkOption
+    {
+      type = types.bool;
+      default = inputs.config.nixos.services.xray.client.enable;
+    };
+    listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+    # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
+    listenPort = mkOption
+    {
+      type = types.ints.unsigned;
+      default = if inputs.config.nixos.services.wireguard.behindNat then 51821 else 51820;
+    };
+    wireguardIp = mkOption { type = types.nonEmptyStr; };
+    peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
  };
  config =
    let
-      inherit (inputs.lib) mkIf;
+      inherit (inputs.lib) mkIf mkMerge;
      inherit (inputs.config.nixos.services) wireguard;
-      inherit (builtins) map toString;
-    in mkIf wireguard.enable
-    {
-      networking =
-        let
-          # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
-          port = 51820 + (if inputs.config.nixos.services.xrayClient.enable then 1 else 0);
-        in
+      inherit (builtins) map toString listToAttrs filter;
+    in mkMerge
+    [
+      {
+        assertions =
+        [{
+          assertion = !wireguard.behindNat -> wireguard.listenIp != null;
+          message = "wireguard.listenIp should be not null when behindNat is false.";
+        }];
+      }
+      (
+        mkIf wireguard.enable
        {
-          firewall = { allowedUDPPorts = [ port ]; trustedInterfaces = [ "wireguard" ]; };
-          wireguard.interfaces.wireguard =
+          networking =
          {
-            ips = [ "${wireguard.wireguardIp}/24" ];
-            listenPort = port;
-            privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
-            peers = map
+            firewall = { allowedUDPPorts = [ wireguard.listenPort ]; trustedInterfaces = [ "wireguard" ]; };
+            wireguard.interfaces.wireguard =
+            {
+              ips = [ "${wireguard.wireguardIp}/24" ];
+              inherit (wireguard) listenPort;
+              privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
+              peers = map
+                (peer:
+                {
+                  publicKey = peer.publicKey;
+                  allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
+                  endpoint = mkIf (!peer.behindNat) "${peer.listenIp}:${builtins.toString peer.listenPort}";
+                  persistentKeepalive = mkIf peer.lighthouse 5;
+                })
+                (map
+                  (peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
+                  wireguard.peers);
+            };
+          };
+          sops.secrets."wireguard/privateKey" = {};
+          # somehow fix wireguard connection
+          systemd.services = mkIf wireguard.behindNat (listToAttrs (map
+            (peer:
+            {
+              name = "wireguard-ping-${peer.name}";
+              value =
+              {
+                description = "ping ${peer.name}";
+                after = [ "network.target" ];
+                wantedBy = [ "multi-user.target" ];
+                serviceConfig =
+                {
+                  ExecStart = "${inputs.pkgs.iputils}/bin/ping -i 5 ${peer.value.wireguardIp}";
+                  Restart = "always";
+                };
+              };
+            })
+            (filter (peer: !peer.value.behindNat) (map
              (peer:
              {
-                publicKey = peer.publicKey;
-                allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
-                endpoint = mkIf (peer.externalIp != null) "${peer.externalIp}:51820";
-                persistentKeepalive = 3;
+                name = peer;
+                value = inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard;
              })
-              (map
-                (peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
-                wireguard.peers);
-          };
-        };
-      sops.secrets."wireguard/privateKey" = {};
-    };
+              wireguard.peers))));
+        }
+      )
+    ];
 }
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`1k9anln9hmdjflrkq4iacrmhma7gfrfj6d0b8ywxys0wfpdvy12v`
				`@@ -0,0 +1 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJAyDl52UVGFPTV/rXFERrXAMY5qZ3g+tpg9HOGdw86G4Nr8Xp/cTxZjF4kSfIkSrGblAV9Lm4US0fW3pGOQu5qQrSAENxqHxdlEyzt7izyF2CklDUeTjs3KHOIZMvSli4z014NPcswBbjwB9Lyrw0fCQ9P1vYkrUHEzL2SMxdack1EQPcMF4MxblDqc+eQhdMCkKE8T1Cb1ZqxeLVMPn9CwjG18JoxL+/xs+MjcsSXYWcoqYTfgfhguMbh0D4Eo32MHS/IzRSxnOHJxhG5xYePcyBlb/CxQuYA+RTqKNE85j7GcL2oEmeZ1b++/9qFT9grwVh+UOBRO2xiMzKDF24nXPJ+eLyd6Z/3swGT4rTVDnrXV5eZUkWLHN093IdLJCTtPVrKV9OxEKr5sU2W0edpirNrlGq7/MYkJX9EbQctDFA69XfQkZlGK9xGutqSgEaVlY54fS0Due+NDrNBPfMKJ9MTmFDOY+NYn05El2rMD39OKbGbCR5ASwSSBlcQeE=
				`@@ -0,0 +1 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVbOvoFVaGkqYzIWsmMFlpkE+TDAONOWWaJBQ0K4fiOLy7uh02b/jYNZrbllPDP+Gq+ikYEJnJX2ceDsh9mLtJTznBQXgJOMUZDYy0enu7hYLKMmRTgJntzHjMbZENMhP+I3N9JnQ1PQz7lICg1xkEBQm2CESYCCjo0rJKYplPH1bo02myEazKlKTn6tu40ysrYOoJO8+jwbUDqtWATjSZtgYojuh6dbIoK3O+Ntgwl4W0NqXEqXYXTWpU0qKOqAsP/9F9WJ5d1wVNNbvmcAJ26dkYaiPCNgW4MGTucAgoxM6IPVVj9U+OEZLoCPsqAGCT02vH5MoDNTmGaSv0DjuYOzz5C+jAhMCznXFXCI4bfawvuda/WwGIniB5iKNSBZt3XxYyUw4YBcVCNiWUt9bIgEvnR4E8HYHdjNrbQ0Z58L6DcPSySLQer7C658Vo/nRUlBq6lIWYhcdjxHHkP9iFtuFW1HmoUKkuaLl+uiflrSppX9wt8eaPwGgGIHkLwgc=