modules.system.nix: set connect-timeout

This reverts commit 21e9f53b39.

devices/cross/secrets/default.yaml

@@ -28,6 +28,9 @@ users:
     pen: ENC[AES256_GCM,data:XOKXV0YSFbHC3I3xO8fpWvYerNfVFg2afs+CUp2MZB+yt9KR5bTJdVOfUGldLbWH5CR4v5FxTrTujv24wJ710Rfyugxh9aFJ/w==,iv:tHLoO+XpdUk8S56QUiJQOpVO9C5epam9PMubMN+8fHw=,tag:H0srWRigNUedQMIAfJlfjg==,type:str]
     #ENC[AES256_GCM,data:K6O0TIYYGZmM8iOwsQ==,iv:xtT8Psnoy51V9gsRo335+VT56FXTcMQ3d4/tnuWouew=,tag:k8irtZ33G3UFK++rzcmyiw==,type:comment]
     reonokiy: ENC[AES256_GCM,data:fPKdOPAKbXUvK5Jj08T0iSD23mhhkTXCexgB5q3v5JS4c6V4S+W14WOkS4UHrMQls/rHslw0NyMzS5G27A+5vN+EN+xJZfuRGg==,iv:tSdNOgs61tyt7/hUKt8bfKvpq9qOQU14ligdxBs/ATs=,tag:6IoS/p2StKtFREIpxsWkdg==,type:str]
+    #ENC[AES256_GCM,data:cZznknXjlWF6eoEaTA==,iv:tdw/54W2evO1o5sq1syz3k0DZrm/rjflxqJpB9LZgvg=,tag:d60Ctc5YeSmhZJUURUmeSg==,type:comment]
+    zqq: ENC[AES256_GCM,data:iFtM0pxIvXPHBnLEfHdmYGVWXuroDLgUaAKF+DmuBdq1NY+pr33oXNJzckFZfWgpIOuCm4cNg5j5R6nsG+zk2VWdi2vuITT4jA==,iv:qfBC/D1gJYXOZ0Fy2DkAb+ImDgXZWU6R/Z50hbVDR98=,tag:eCr6lbSieWDCNaTYzoQ0qQ==,type:str]
+    zgq: ENC[AES256_GCM,data:cHYFToQ5ulEcb741Gg3X4lKj8ZJy1zcLHpkVQjQXt5hRAQtPsiPlegi2a1nUIAUb6sI//4ffcytlXpdK2sXewFe3ZiIXy3UVjQ==,iv:fKaPxpfh5ssOwAbmEsAPaQ45KrNtkHZb96IzWc6pD9s=,tag:Vt91B77SjxYaZ/HvWVBufA==,type:str]
 telegram:
     token: ENC[AES256_GCM,data:zfMATU2E6cwoiyfszV35vkQG6JSk00y589wmGEf4wQNncPhNsvh+NcSfnTwHTQ==,iv:Q46mUquhUZLGQsCDYitk4IPu24MpVnYmi7aHyZL/b1E=,tag:QVbrwAA9mWK/ToJfGIs9ug==,type:str]
     user:
@@ -174,7 +177,7 @@ sops:
             UnR5Y24rSTk3WUV1VUgvQUFCVUxPZUEKv/lTy02gZYn4jF1uGtm+LhJd0m59Xe99
             +unmqUDh0ZqAhJU8o0jrBiWs1lXOHU7CkIom7tGEMHGUxHkS+Z/6GQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-14T01:17:28Z"
-    mac: ENC[AES256_GCM,data:r1FWYKz9aJtmhH7MLPqwZjG0W7LULScGd63CnIqsm2AbFIs6DgW33zDsgwrl1oblx/zYGda3irB5s1+otR38DU0VE7jqLYzHpb3eLsE986ZTwe9Tujy6BJm2Pyng60BJTTBwKU8awS2WpbTUivK1aVivNfBffQIL5Scv/qkyH3U=,iv:1USu0hh8IM2T/w1Fm/udGswPJcxKmvcG6XwlS2ku6iY=,tag:F/rZiGc3KTaNA0YtrWF3+w==,type:str]
+    lastmodified: "2025-07-05T04:25:07Z"
+    mac: ENC[AES256_GCM,data:x7wXcdExnf3grO9uS90dQMCSTgJiCyz5sdiek4EnYPsb/EVXfbzYnOo05T3ns8nNfQb6jCKBr/TZO6ZhOneaa/b8uZrG3c4EtDRVptm6+8PydgG5pv5ZiVLb83XR/t11xLWyzc8livLiTPb2RT0UglznOWCGPz20ULoI+JphGGc=,iv:iE7sRIyY2Espmaushcb0VJMjUZYhSGAqRdhmQRMkndU=,tag:0qsijRFyFshIKZTwVbvntw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.2

devices/cross/wireguard.nix

@@ -2,6 +2,7 @@ inputs:
 let
   publicKey =
   {
+    vps4 = "sUB97q3lPyGkFqPmjETzDP71J69ZVfaUTWs85+HA12g=";
     vps6 = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
     pc = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
     nas = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
@@ -61,7 +62,7 @@ let
           # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
           (builtins.listToAttrs
           (
-            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps6" "srv3" ])
+            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps4" "vps6" "srv3" ])
               ++ (builtins.map (n: { name = n; value = null; }) [ "pc" "nas" "one" "srv1-node0" "srv2-node0" ])
           ))
           # 校内网络

devices/nas/default.nix

@@ -4,7 +4,7 @@ inputs:
   {
     nixos =
     {
-      model = { type = "desktop"; private = true; };
+      model.private = true;
       system =
       {
         fileSystems =
@@ -19,26 +19,15 @@ inputs:
         };
         initrd.sshd = {};
         nixpkgs.march = "silvermont";
-        networking = {};
+        network = {};
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =
       {
         sshd = {};
-        xray.client =
-        {
-          enable = true;
-          # TODO: remove on next month
-          xray =
-          {
-            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
-            serverName = "xserver.srv3.chn.moe";
-          };
-          dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1";
-        };
+        xray.client.dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1";
         beesd."/".hashTableSizeMB = 10 * 128;
         nfs."/" = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc";
-        btrbk = [ "pc" "vps6" "srv3" ];
       };
     };
   };

devices/nas/secrets.yaml

@@ -1,17 +1,7 @@
 xray-client:
     uuid: ENC[AES256_GCM,data:97aX07G5FPumdWcDxnYOs6fRgljXWuwyNXGg1d7zdbUUfNnb,iv:+wAC/DZXsg+evYFA4DMfLw5Ut3ExQl1RgZ/2AsNQDpo=,tag:ebD77muITHof+FQMydWobg==,type:str]
 wireguard: ENC[AES256_GCM,data:JaOSq474mGOoQQcdJ/j9fYo2e1vjXMPxJ69TOd079FrSkbzbIteWww5f8Xo=,iv:uy/NC2+tibL61XJDZK/spKjV9u0oXK4YzjFjYmCAL0k=,tag:en+c8cHaPvDqJL+EpQjr0g==,type:str]
-wireless:
-    #ENC[AES256_GCM,data:wjStmDz44D13rg==,iv:7Qdqk/3VfS6kZNMSD6P4zyuRkzgIb1PcH56rWBhuD80=,tag:RVfRu9zMAenZBk3+RFC9wg==,type:comment]
-    "457": ENC[AES256_GCM,data:at6sfLdZUj7JTkumDLzoBoM6rNH3SGXvzso2ryYEXiFzy24e8cMKql2Sw3CHqWH9+cS6+rzuRLLeLJQMDN3dHw==,iv:nHEdqAIF7WK6kPkm01LoDmypvkHOhIR+tf9cAlv+1hs=,tag:3lMuOZ4qatv1LOSMwMiEoQ==,type:str]
-store:
-    signingKey: ENC[AES256_GCM,data:Y1nbOt2boQQ94oBjQDoH7J7tkCIVx4f7Nrq0AC5Bqq/uGZnd7UCPv8hLnbjVcPTPHLMwnwzD9yvdYrLv+Q2HZJJQfQjO+sXkVZI4TpFJkqTofvrmDk4PL5tkh/4=,iv:eOM6wCO/qQaf5MMXWLROKFkfo6avm6IWWpgK1mNx6VY=,tag:ZC5xsTDdyCe1VxaBIC0ozQ==,type:str]
-btrbk: ENC[AES256_GCM,data:OADRHx+lXPSvvSApg4faq9uqsjExmlZzGnud8uygWJoIUeP6OJNukBfQIMD1SjSLH0q9kmQ6D7NpYzjx9uSQ07MS5cK4RQXFBOEdJwD86QMJEFietGMceAxCYCOSFAgZH4OF4HFCoiDONXZDOZLfIDzGqIfejbJlM0CTDozeKNu6dUn8SbprBNddg6wSI0S/v+tIBN1SgF5CzytCCh9APzNaEvBl6bF9DTNY8AGaGQXyQwZAJ+dx1jtCQhHzXGJ755BPxgKRj4WvlwSfwVCEWykg7d0RQsvnXMvKe0MJyvg5LHa6+dPsldUooo6jq+KV51tCno0xQQtac5bJ2ZEsALlAayuj/NT5PfFKE1ZK34YMBmfUa3+fhW7DIggASIVy+SV7BTfYk29GoYjrtS7gH948J+ko0LnypcrGDTVnmWIJQlgwLPegI0jO8IWBI8yP8npQBTMm9SQQtbN0VIMVQueWnFcgbcR43lvVhkkA7b3a8sRNZGQBip4AJ3kQXF2VkSji,iv:5989jmkk4Rci7bohQLE8rgYp4lTRRcE6c/Bh6nz+ncQ=,tag:MH6mCPXwjsB/ov3xHhn9aQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
           enc: |
@@ -31,8 +21,7 @@ sops:
             by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
             kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-07T10:50:31Z"
-    mac: ENC[AES256_GCM,data:a51pRxylo+/XMLxEqy0rMdigrVJ0sSWsienWWP+dGz2oaJpytH3XzFfninsEic4om7jlN8m6ITa9t6P5yvainrX5hLii7Z2/aZELRGCQdGgm2SEWgLMuKyJpkRHXkD4pnooUwE8b0OgRogusQUZw0yVGZYkngWrRXRvXF6lpd5A=,iv:ZBU0HFCJqNUGnkJVB+QM1+tlbC0ex+HJafydUpEInkk=,tag:cZT+fgf9NVRIvdeGgxUzCQ==,type:str]
-    pgp: []
+    lastmodified: "2025-06-09T01:22:01Z"
+    mac: ENC[AES256_GCM,data:OxRUW3e2SXTTdb7Iwvsf/UaHsTIVxohJwRIFExh5N/dJhU9Ui8omKBjkooiGaysrZEVEZNAWSp2zvTPXUdZrtW2fikyhF6Fsg7jUFFTqhV/sjYMy7gISbfkcGF9SuYGByuuySyXPqsfg+ESeBmMVZiqDSEPYJWu+q8OwThdhsAM=,iv:UnSfmuxcV+tr7wd59Xg0MG2QbP2uOshVhN5C++9ZSzA=,tag:cWiG85xv2OuiBOoAlvVBGw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.2

devices/one/default.nix

@@ -24,19 +24,9 @@ inputs:
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =
       {
-        xray.client =
-        {
-          enable = true;
-          # TODO: remove on next month
-          xray =
-          {
-            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
-            serverName = "xserver.srv3.chn.moe";
-          };
-        };
+        xray.client = {};
         beesd."/".hashTableSizeMB = 64;
         sshd = {};
-        kvm = {};
       };
       bugs = [ "xmunet" ];
     };

devices/pc/default.nix

@@ -19,7 +19,7 @@ inputs:
               "/nix/remote/jykang.xmuhpc" = "/data/gpfs01/jykang/.nix";
             };
             nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.nas"}:/" =
-              { mountPoint = "/nix/nas"; hard = false; };
+              { mountPoint = "/nix/remote/nas"; hard = false; };
           };
           luks.auto =
           {
@@ -52,13 +52,12 @@ inputs:
           "alderlake"
         ];
         nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
-        kernel.variant = "cachyos-lts";
         sysctl.laptop-mode = 5;
       };
       hardware =
       {
         cpus = [ "amd" ];
-        gpu = { type = "nvidia"; nvidia = { dynamicBoost = true; driver = "beta"; }; };
+        gpu = { type = "nvidia"; nvidia.dynamicBoost = true; };
         legion = {};
       };
       services =
@@ -75,45 +74,17 @@ inputs:
           };
         };
         sshd = {};
-        xray.client =
-        {
-          enable = true;
-          # TODO: remove on next month
-          xray =
-          {
-            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
-            serverName = "xserver.srv3.chn.moe";
-          };
-          dnsmasq.hosts = builtins.listToAttrs
-          (
-            (builtins.map
-              (name: { inherit name; value = "144.34.225.59"; })
-              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
-            ++ (builtins.map
-              (name: { inherit name; value = "0.0.0.0"; })
-              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
-          )
-          // {
-            "4006024680.com" = "192.168.199.1";
-            "hpc.xmu.edu.cn" = "121.192.191.11";
-          };
-        };
+        xray.client.dnsmasq.hosts = builtins.listToAttrs
+        (
+          (builtins.map
+            (name: { inherit name; value = "144.34.225.59"; })
+            [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
+        )
+        // { "4006024680.com" = "192.168.199.1"; };
         acme.cert."debug.mirism.one" = {};
-        frpClient =
-        {
-          enable = true;
-          serverName = "frp.chn.moe";
-          user = "pc";
-          stcpVisitor =
-          {
-            "yy.vnc".localPort = 6187;
-            "temp.ssh".localPort = 6188;
-          };
-        };
         nix-serve = {};
         misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
         beesd."/" = { hashTableSizeMB = 4 * 128; threads = 4; };
-        gamemode = { enable = true; drmDevice = 0; };
         slurm =
         {
           enable = true;
@@ -136,14 +107,14 @@ inputs:
         docker = {};
         ananicy = {};
         keyd = {};
-        lumericalLicenseManager = {};
         searx = {};
         kvm = {};
         nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
         nfs."/" = "192.168.84.0/24";
       };
       bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
-      packages = { android-studio = {}; mathematica = {}; };
+      packages = { android-studio = {}; mathematica = {}; vasp = {}; lammps = {}; };
+      user.users = [ "chn" "test" ];
     };
     boot.loader.grub =
     {
@@ -177,7 +148,6 @@ inputs:
     services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
     # 允许kvm读取物理硬盘
     users.users.qemu-libvirtd.extraGroups = [ "disk" ];
-    networking.extraHosts = "144.34.225.59 mirism.one beta.mirism.one ng01.mirism.one";
     services.colord.enable = true;
   };
 }

devices/pc/secrets/default.yaml

@@ -1,10 +1,5 @@
 xray-client:
     uuid: ENC[AES256_GCM,data:XU7/GZ8cJmDwNsrQfoFHrquZT5QkjvTPZfnghX3BLyvPLlrX,iv:e/BQkZ5ydWD4P/qT9OUloB8/cXImfkG3YZnuIeNLoTc=,tag:EW3ZBzGnyIrUfcMeJqm4aA==,type:str]
-frp:
-    token: ENC[AES256_GCM,data:0mE8/cWqHKNquCIiqgbjcNhipKk7KEfbZ+qRYbu+iZr7AH9QjfYZQiMJNp4Aa3JWwBLYAnpf,iv:ID4cc8Tn0H9b1CimXlPamMlhlAkafhRApDHo/CCQ4BE=,tag:BUuU/BCj16R7FlKlpubawA==,type:str]
-    stcp:
-        yy.vnc: ENC[AES256_GCM,data:IsZWkNGYHrbQcgvOSURDnA==,iv:4XO8RFBdNopLKYxCACmkXLMPu0wIVx64y0C7m2bsTVA=,tag:fMHzU9aQm0bRr8pTKwpuHQ==,type:str]
-        temp.ssh: ENC[AES256_GCM,data:XG9WpTR8Bw==,iv:XiMTPN8Gx1nNssf4r+VXTvUATiUNsOYJ2jeHjhDSyTs=,tag:JS3NlA4cs/6IA19PJYrStg==,type:str]
 store:
     signingKey: ENC[AES256_GCM,data:TsB1nA0Rf2AsYyH59WpUK53pTCX2JdrGQjkJ9A9BfWLLmw3EMnPoaLHG12rv1R2/xRU7rP+iVhXb77g60I/Kn4ehun3ogMmK1oEAKyQcxudBUJFk+SeijaQLr2A=,iv:e2rdGBVOPS1nyC3pXhs5r0WyEkqxcpCnX3eAcBCj93M=,tag:HwccjH2Wms5/TevU2IuzNw==,type:str]
 postgresql:
@@ -16,8 +11,6 @@ mariadb:
     slurm: ENC[AES256_GCM,data:fGvNMmqk7Cee28VJ1QoBVrBbgIUbj/F1W0SRjdP8N4K/M8Wx4AVm1kAr0IAhPWyDLXlIjM1NUvuEV5BpYDBdjg==,iv:rFTMJ4x2kgENQUA8ftSaLjdOc25i5mWR3UYbdq54vjs=,tag:6feD0eCSv7bcHWBveLNJwg==,type:str]
 nix:
     remote: ENC[AES256_GCM,data:uosYkxTCB0wiY+Uufk//OcBZFN3EzbZoQGZ95M9eZMjQ5AobAZqosi4laE+EMcZL1CqYqlWXaSoEUOB8biUaZPseo+1AX1TlmUgZ7QpkfOX0VKZu01C6C+lVyqVqMFq6z1BFyX/oeITMIfnd4a/2KwJCHLAZ4hMkJ5p+aJwByKGa3N/2m41HH/1S3z7pYQWj7YJxunTPPG6WNSiRncQki11rvmddwnXmsBF89+jW1Phge8U295haC57T5oIGPxR645IeTK4ZUlL8eVuZ+BhsnwbkYcaxvjSwe+DOIVPupR8GW+gis7KxwE89kqvnQhinamexcPUz4lGHlqO/Xn6jrJx6T/wXF+19epAzeHapYte3dTWNsdPwPLPJihT16YT5fwrLnH3zq8kexWz1crmnCGUoaBs4S2tHWHLgv2lTv0IHLx5F6ijpDBj/Avg9YILIURzdeea+rBxdycHasUDTVlJtYKRH5J+WbAKWI+oJ5qmXjIRUYL+O9xIUfOGO+1b3xs8MYxRWuvDV2P88N8vN,iv:yQQp5wjbSVn1oia5yL7d6GF9Vo704G0iOQRGMbzQHzg=,tag:bpBag5y5n+7ojOa8QOcDvA==,type:str]
-wechat2tg:
-    token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
 searx:
     secret-key: ENC[AES256_GCM,data:KhIP+Rz3rMfNgPEGTlKGvm6gl1/ZuPI=,iv:GcaLEJHKJO3n6IaeiFr9PaJ6eNx04/VjX3UgmBF429g=,tag:HkplyH9hTHUaEZ709TyitA==,type:str]
 sops:
@@ -44,8 +37,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-13T05:59:15Z"
-    mac: ENC[AES256_GCM,data:/m/cioV71s7HJ7ObIDCr69wDLn2xk/lTRqmUCx46u7tzOwMsYqU6DghBsZuaUN1r22CbMi1wtmSziDisKStOGY27pswNe7IuEo4IhVz5sJNxcWCxpYo8ttrCUeaJ7Y0vFbseIn1l1UObfubhhvVdxDsE0RoxLK7Ka8hJW5aEksM=,iv:GKmlbRXFexMegBWBVx4vusA0ceZZnwGIN2FkSpGXMdY=,tag:yoCnH94Ph0AUjkN3CTg6wA==,type:str]
+    lastmodified: "2025-05-24T11:27:02Z"
+    mac: ENC[AES256_GCM,data:uNkThOX3NEUeiaJVavZ0rCpQRT+GbRXADiMuAwb/tg38fBrKQeUO9ohicl/UfiDFRTfCaiuH3T757jX2b51go2s0B6n7DOvPYYZ5EWGnM69RFxrdDfWfge8n8/SHmuKR9dPJb/eSa8HAs8uDnqBPoR5SqG5lnyZs3a7P/kjK2T4=,iv:snmnuYmcuyhGs4YrIGFLmDffFE9yecB/vsM0MvxBR4k=,tag:vbqA7jvVCFHvLoLmKbfO4g==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.2

devices/srv1/default.nix

@@ -62,7 +62,8 @@ inputs:
           ];
         };
       };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" ];
+      packages.vasp = {};
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" "zgq" ];
     };
   };
 }

devices/srv1/node0/default.nix

@@ -8,26 +8,26 @@ inputs:
       system =
       {
         nixpkgs.march = "cascadelake";
-        networking.static =
+        network =
         {
-          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
-          eno146 = { ip = "192.168.178.1"; mask = 24; };
+          static =
+          {
+            eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+            eno146 = { ip = "192.168.178.1"; mask = 24; };
+          };
+          masquerade = [ "eno146" ];
+          trust = [ "eno146" ];
         };
       };
       services =
       {
-        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
+        sshd.motd = true;
+        xray.client.dnsmasq.extraInterfaces = [ "eno146" ];
         beesd."/" = { hashTableSizeMB = 128; threads = 4; };
-        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
         samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
       };
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
     };
-    # allow other machine access network by this machine
-    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
-    # without this, tproxy does not work
-    # TODO: why?
-    networking.firewall.trustedInterfaces = [ "eno146" ];
   };
 }

devices/srv1/node1/default.nix

@@ -7,13 +7,14 @@ inputs:
       system =
       {
         nixpkgs.march = "broadwell";
-        networking.static.eno2 =
-          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        network =
+        {
+          static.eno2 =
+            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+          trust = [ "eno2" ];
+        };
       };
       services.beesd."/".threads = 4;
     };
-    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv1/node2/default.nix

@@ -7,26 +7,25 @@ inputs:
       system =
       {
         nixpkgs.march = "broadwell";
-        networking.static =
+        network =
         {
-          br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
-          eno2 = { ip = "192.168.178.3"; mask = 24; };
+          static =
+          {
+            br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
+            eno2 = { ip = "192.168.178.3"; mask = 24; };
+          };
+          trust = [ "eno2" ];
+          bridge.br0.interfaces = [ "eno1" ];
         };
         fileSystems.mount.btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
           { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
       };
       services =
       {
-        xray.client.enable = true;
+        xray.client = {};
         beesd."/".threads = 4;
         kvm.nodatacow = true;
       };
     };
-    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "eno2" ];
-    # add a bridge for kvm
-    # 设置桥接之后，不能再给eno1配置ip，需要转而给 br0 配置ip
-    networking.bridges.br0.interfaces = [ "eno1" ];
   };
 }

devices/srv2/default.nix

@@ -15,7 +15,7 @@ inputs:
             btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root1" =
               { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc"}:/" =
-              { mountPoint = "/nix/pc"; hard = false; };
+              { mountPoint = "/nix/remote/pc"; hard = false; };
           };
           swap = [ "/nix/swap/swap" ];
           rollingRootfs = {};
@@ -32,10 +32,10 @@ inputs:
           "8.9"
         ];
       };
-      hardware.gpu = { type = "nvidia"; nvidia.open = false; };
+      hardware.gpu.type = "nvidia";
       services =
       {
-        sshd = { passwordAuthentication = true; groupBanner = true; };
+        sshd = {};
         slurm =
         {
           enable = true;
@@ -80,7 +80,8 @@ inputs:
           };
         };
       };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
+      packages = { vasp = {}; mumax = {}; lammps = {}; };
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" "zqq" ];
     };
   };
 }

devices/srv2/node0/default.nix

@@ -9,30 +9,24 @@ inputs:
       system =
       {
         nixpkgs.march = "skylake";
-        networking =
+        network =
         {
           static.eno2 = { ip = "192.168.178.1"; mask = 24; };
           wireless = [ "457的5G" ];
+          masquerade = [ "eno2" ];
+          trust = [ "eno2" ];
         };
       };
       services =
       {
-        xray.client =
-        {
-          enable = true;
-          dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; };
-        };
+        xray.client = { dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; }; };
         beesd."/" = { hashTableSizeMB = 16 * 128; loadAverage = 8; };
-        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
         samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
         groupshare = {};
         hpcstat = {};
         ollama = {};
+        sshd = { groupBanner = true; motd = true; };
       };
     };
-    # allow other machine access network by this machine
-    systemd.network.networks."10-eno2".networkConfig.IPMasquerade = "both";
-    # without this, tproxy does not work
-    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv2/node1/default.nix

@@ -8,14 +8,15 @@ inputs:
       system =
       {
         nixpkgs.march = "znver3";
-        networking.static.enp58s0 =
-          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        network =
+        {
+          static.enp58s0 =
+            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+          trust = [ "enp58s0" ];
+        };
       };
       services.beesd."/".hashTableSizeMB = 64;
     };
     services.hardware.bolt.enable = true;
-    boot.initrd.systemd.network.networks."10-enp58s0" = inputs.config.systemd.network.networks."10-enp58s0";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "enp58s0" ];
   };
 }

devices/srv3/default.nix

@@ -19,12 +19,16 @@ inputs:
         };
         nixpkgs.march = "haswell";
         initrd.sshd = {};
-        networking.static.eno1 =
+        network =
         {
-          ip = "23.135.236.216";
-          mask = 24;
-          gateway = "23.135.236.1";
-          dns = "8.8.8.8";
+          bridge.nixvirt.interfaces = [ "eno1" ];
+          static.nixvirt =
+          {
+            ip = "23.135.236.216";
+            mask = 24;
+            gateway = "23.135.236.1";
+            dns = "8.8.8.8";
+          };
         };
       };
       hardware.cpus = [ "intel" ];
@@ -36,12 +40,14 @@ inputs:
         {
           alikia =
           {
-            hardware = { memoryMB = 1024; cpus = 1; };
+            memory.sizeMB = 1024;
+            cpu.count = 1;
             network = { address = 2; portForward.tcp = [{ host = 5689; guest = 22; }]; };
           };
           pen =
           {
-            hardware = { memoryMB = 512; cpus = 1; };
+            memory.sizeMB = 512;
+            cpu.count = 1;
             network =
             {
               address = 3;
@@ -62,7 +68,8 @@ inputs:
           test =
           {
             owner = "chn";
-            hardware = { memoryMB = 512; cpus = 1; };
+            memory.sizeMB = 512;
+            cpu.count = 1;
             network =
             {
               address = 4;
@@ -72,7 +79,8 @@ inputs:
           };
           reonokiy =
           {
-            hardware = { memoryMB = 4 * 1024; cpus = 4; };
+            memory.sizeMB = 4 * 1024;
+            cpu.count = 4;
             network = { address = 5; portForward.tcp = [{ host = 5694; guest = 22; }]; };
           };
         };
@@ -87,15 +95,14 @@ inputs:
         vaultwarden.enable = true;
         photoprism.enable = true;
         nextcloud = {};
-        freshrss.enable = true;
+        freshrss = {};
         send = {};
         huginn = {};
-        fz-new-order = {};
         httpapi.enable = true;
         gitea = { enable = true; ssh = {}; };
         grafana = {};
         fail2ban = {};
-        xray.server.serverName = "xserver.srv3.chn.moe";
+        xray.server = {};
         docker = {};
         peertube = {};
         nginx.applications.webdav.instances."webdav.chn.moe" = {};
@@ -103,7 +110,5 @@ inputs:
       };
       user.users = [ "chn" "aleksana" "alikia" "pen" "reonokiy" ];
     };
-    # TODO: use a generic way
-    boot.initrd.systemd.network.networks."10-eno1" = inputs.config.systemd.network.networks."10-eno1";
   };
 }

devices/srv3/secrets.yaml

@@ -66,27 +66,6 @@ freshrss:
     chn: ENC[AES256_GCM,data:Z4UmsXv1KiVfZMIQOEHH,iv:pF5lQLggkxm9y7taDVcp366JKp8U+8akNEdPA+Nf9Uo=,tag:0TajgUI/VgM3FxG1j6c/jA==,type:str]
 huginn:
     invitationCode: ENC[AES256_GCM,data:JDN913i+zf6+obWxrNAbgx1NJGPyewRm,iv:lqnjbSk46J0ZJN6ccbbiCiOK92W8fj2mWRwQHKqy2dc=,tag:UYZesryRlfAMo7xhKQ7zgw==,type:str]
-fz-new-order:
-    token: ENC[AES256_GCM,data:JdMiu4du4S4fLg7b8LATG4g8NlahIFPvilGd1MsXNeMtnQs=,iv:fWBFYAVlfzi1dD/TpiA5N0JMY/LHTYPZGSh4sbK1BZc=,tag:LQTZe3DNk8xoy2+G4zld9A==,type:str]
-    uids:
-        #ENC[AES256_GCM,data:btt80rJcGg==,iv:DCBo36NMFiQO+dXom+AYTrSMYEAGCNXdMTJDIQVRlFA=,tag:LzoynD0J9surdmcFvVf/NQ==,type:comment]
-        user0: ENC[AES256_GCM,data:53ag/e8f4aVEkUVszd7MzxNpDBBIkqGMneASW9/m5xU=,iv:LEZoitbzvTFAiXKZAPPOok/WaKsuTWgvd41Rq4/FMP4=,tag:opV15bhvDF1FR0UURsm+Iw==,type:str]
-        #ENC[AES256_GCM,data:jXeZGm4rrw==,iv:hxZ6AU6FLzoUSJIeUh4zjuR6kvDfDhJCpvG47M+jRdc=,tag:AqMF7SJ96OEh0G8cgqvvuA==,type:comment]
-        user1: ENC[AES256_GCM,data:emM3ffDBmymM9367YJG0lvYpw7iRl24fHSd5G4C4g6U=,iv:sJ9zLlgU2zZGFpeuIZXtL0Dqvd8RwbKU/a6HFdZTnvU=,tag:L6M7H24DXMvV55pYRiX8WA==,type:str]
-        #ENC[AES256_GCM,data:gMDlZq2HXQ==,iv:hyJ2gkzrt0BZ3rO5rmz1tiS3jbrrA3VjpqjgPXQymjQ=,tag:aOWFyhuTjV9umsWJ0VjJDg==,type:comment]
-        user2: ENC[AES256_GCM,data:b4jqm4Xm9dU2tYqqddKcHYcOh0Ol9W309fpQPcG2cQo=,iv:EKUDKnbYX8MTqd/G4NaQUVZ4mZAw3GvAlDe7XIVvVZQ=,tag:+oO6MaA6PFVbnP2ahfAArw==,type:str]
-        #ENC[AES256_GCM,data:L0wkMIIuSA==,iv:j0LGq9Xe+Dru8bCwt93T51ZaK0ex/7CZJdBDn6jhq7w=,tag:EU4/62fe3p7QjpfSMAYHCQ==,type:comment]
-        user3: ENC[AES256_GCM,data:dWJzu6S6T598TiKqX48LUcT1BAc0/gVy1tAknkvmg8k=,iv:KWl/av7a3hj27p+S2hhe2QpcNMFGJPsnnCjcaqzjOqc=,tag:HQbtRPxO8OnfKIBqTDjKlA==,type:str]
-        #ENC[AES256_GCM,data:8/kYjPRSEA==,iv:etABb0TqNHhEs3/HGuRixEJUGhyXSTXI3cvhTTAUlXA=,tag:IfPzvdSamLcY1dRJls74GQ==,type:comment]
-        user4: ENC[AES256_GCM,data:F6tbn2WBo9HrM+fmtf70GrNJyZ6qJ2HrNdJG788zMKM=,iv:Dx/7MUJVZO61u/DqwrrqmWIVpx4Qpi88SMflCRvj7Wc=,tag:WH6tsk/69+EEz2DS1srrNw==,type:str]
-    config0:
-        username: ENC[AES256_GCM,data:DDGErXyt,iv:7Z3U++o930QhngC+NzNna32F2AKSWjEFnJYXY00rCM4=,tag:L83e1KTQkVwSWSwhTwTzYQ==,type:str]
-        password: ENC[AES256_GCM,data:Jy9Gbo0i,iv:ZthlQ0x5At9TUbh6MUiLkZUoVdCG0gp0SEyMtxKhnjM=,tag:fKmnopQ/sVFQsmb2ISOk0A==,type:str]
-        comment: ENC[AES256_GCM,data:lb51oO8l,iv:4Iac4P+zfa7/T+aq5429VbdHoK7+WZkj1nC+yPOoIy0=,tag:NRl5GjjKn4OHfIGDNh+3MA==,type:str]
-    config1:
-        username: ENC[AES256_GCM,data:/QlSea1D,iv:0gMEI2JJudtKHE9J7IlI8Hsfo0jQwCy2Ap8EXxVqUVo=,tag:2DnWRv1b2VhtV5wSnnOzqg==,type:str]
-        password: ENC[AES256_GCM,data:FHd4UPV2,iv:jI5BwcfxTBj2igdFUQtKS4LGnt5O96Kp3RPvnpXxFR8=,tag:Lfe8paHNQ44nRb/gk0oUbg==,type:str]
-        comment: ENC[AES256_GCM,data:QILd5mRa,iv:mmM6h721UIXTuRL7k9TDOPdRrqMuq5M8krz5yWR20Mw=,tag:ALpQZjR6W0X44rST8U74NQ==,type:str]
 grafana:
     secret: ENC[AES256_GCM,data:1Wfq8QmhzKBObdktheFPySzXYlOJzHWbYYQXgn3beLOwSlW9f7bUn+wIrRoj1e8WlFJkAU2xywzjzzy/UwpSYA==,iv:/0YoHTs54O+cT6VVt1U5CYXr2qEdY2kijOlnMZMW4d0=,tag:SD/IELlcgfS7p9NBEa6D/g==,type:str]
     chn: ENC[AES256_GCM,data:8R92k7RH1491u6lfQdM0U3SG8TPi3vWhZyj810XSjnA=,iv:8v6ijLHgoTPT6MGoP/lWB+UEZCCgOpvfskWCJJ63Udo=,tag:k9SHzJ9d54Rny3n8EbksOw==,type:str]
@@ -96,48 +75,8 @@ xray-server:
         user0: ENC[AES256_GCM,data:n6gIZGYdT6wEfKgizFvIE802AkpR8BpSPSZrQ5WP/aZWzLUL,iv:AxnwFOzmIRm3nTLpi8/4lkv+TjO4y4RZQtHO0GriD8o=,tag:nllDCaLZd6JNS2JqwvgVyg==,type:str]
         #ENC[AES256_GCM,data:uhAauqQ1oQ==,iv:0Sr6YjarjkLmBq5H1ELb3SYBzrTVhqIE6qPxc9HYeKY=,tag:NvGGSY99Y7d3OTnpOr2p2g==,type:comment]
         user1: ENC[AES256_GCM,data:EcEySx/n52rN5REPEWNjCuWywokvOetadbljqPpDPADTeeSk,iv:7r3CdvHJT1iZvx1Xn53It1ZxIkdLVIeQ+Q03zISm94k=,tag:8cIGZUlIhVgRc2FeU931kQ==,type:str]
-        #ENC[AES256_GCM,data:qbXmxTn+Mwk3zw==,iv:8F/0ELOwXMrKaigfRmwvGREujqNwM6XjIeaPyr6JS5U=,tag:PF/PAQCwzH7uOj+xgM0rKw==,type:comment]
-        user2: ENC[AES256_GCM,data:cA2oKqGsKuZyydMQspbSrWqsQIAde/VtGIPybC2gr3Bg355H,iv:YOj+6f6YR3Ze3x5IrqdqzXp9e3v1jdAu8re1Is6Q4eQ=,tag:n/CV6+PX/y+okpJwRraSDA==,type:str]
-        #ENC[AES256_GCM,data:VcLtO+6YWg==,iv:TWM3IY00V+LaJzk+E8ji/v7Ol4TCvSP/FHzFsV5MGIE=,tag:CijsW2O/AKpWgQUm6ipPeg==,type:comment]
-        user3: ENC[AES256_GCM,data:F3HK6znDEsN8UO7B9vBs03jyjqoQ+MGCcNJuOeglSBzLD2Hy,iv:TKBRe8Qmn9DL4AEilX20YcKbz6bydKsQUuUd5lyM2jE=,tag:nAyrTD4zkJ6CjLuj29zuJQ==,type:str]
-        #ENC[AES256_GCM,data:UFE3pg02VA==,iv:thT5OYPIHLIjKB7uiAk5vff8rtsgwncdo+U0KmW3uTE=,tag:qGWmSsI1mzg8ZbpunxBuyw==,type:comment]
-        user4: ENC[AES256_GCM,data:FYMQFFTCue+umBl5OwJvlZ+NyocsRbkycr+y1L6d6LPdR9px,iv:ZX9Z0dqmBvvXlz+oEYd7vQ5rW5lvmlc+bneDguQld30=,tag:y3d7aDWOtO0T3Yf5pGnffQ==,type:str]
         #ENC[AES256_GCM,data:KuuPQQ==,iv:LGGqLFV4CnUMLWaNbHj6bRseetvdMdSOefV1FeYlJSA=,tag:wXlqKM2BuoMRZAwYbv5eOg==,type:comment]
         user5: ENC[AES256_GCM,data:T5p0POx9Cnqdlp0blEYvAnRNIDOCNVdpOBR4rVQ1/07/rOCX,iv:EZx6ToeORzHoG+aEPi9oiTcwp4bOIAJpPUvemhYM96Q=,tag:aSS+RY5rEzr62mbE+JDanw==,type:str]
-        #ENC[AES256_GCM,data:tmlMaaDT4Q==,iv:zDBCjdBioiXGbJve03VcwCt81hiFxyKqql9rp6zW25g=,tag:cxedo8U2FICH5yMoPXwQMg==,type:comment]
-        user6: ENC[AES256_GCM,data:LzYfIXgZP0q9FpxDM6skSTiwOxEO+N5wuFq86KAazqe8zS/h,iv:Jh7bWMVr5U69L1uARLMUciWvv/aRjJJeEXvU5bo8e3A=,tag:PxesHErVSlkbuNeeRpQfEA==,type:str]
-        #ENC[AES256_GCM,data:boB2Ug==,iv:echGnXhoj2wX7GDj302nbirmzQFCqql2jtY0JaNyla4=,tag:7YnhNwCFZ9rOstanr0wGcw==,type:comment]
-        user7: ENC[AES256_GCM,data:s1O6GRn/9T9DWKlcXJTnOoAPZnPgHGBpZZcEDAKRtiYAI/5p,iv:JyaGsolN5WgQekPYxJiJbniuxLPf3+elHHbd3+ZrLtc=,tag:32wNUTqyyaKoPRQdB4U0SA==,type:str]
-        #ENC[AES256_GCM,data:cvG7WQcnwj+u9A==,iv:ui40+u9yE/Prksmiqed1NjuHyNP2RGtgSMazfI8ultc=,tag:he2F4i71Z8gFdW3fmRdhUA==,type:comment]
-        user8: ENC[AES256_GCM,data:roCYRvszJo7weozfIRoGgUhIs1f2a5/a2d1b/Iy6WEbbehOS,iv:tcOsL0SE4qMRPZIGOlzRIaMJvcapx2H9HK4D8qmSbIs=,tag:Z0skFdgtpjSR7jli3dwd5A==,type:str]
-        #ENC[AES256_GCM,data:IFXAXr0RVg/DCA==,iv:pKdnsUFX4XXJIZleA71fAfua1ibSa/2tgjdqnhbt/Rg=,tag:2Fv397j/uJDFZ/uvBxtrQw==,type:comment]
-        user9: ENC[AES256_GCM,data:5HP+OVmf+dsS8sDHakC7Yx1HVutMoTbITONHQiSvHw+17M9J,iv:TYDf7lx04pHohbGBbPJvOAoIGUKqil59k4Pt405/9kA=,tag:HUxT/uSR8sYCXQ8uX69Fqg==,type:str]
-        #ENC[AES256_GCM,data:7TJeKZM=,iv:FKcgDOtV417n1xmufqB3WENrbZ0V93sI5/XhiDYouMw=,tag:TchW2jgxZAXHvvMYY089dA==,type:comment]
-        user10: ENC[AES256_GCM,data:+u1KwJo3Y4enFM2RVr379GF7O6r9bWofUEZ2994IIC+Ce2NV,iv:ssKA5y3JM4tm+JdVznQFUAYmlrHaWd8hQXs6R/aEXN8=,tag:Q5uuM1sBZJRYBe4XXTL3ZQ==,type:str]
-        #ENC[AES256_GCM,data:O3qEWI+vFA==,iv:R7HLFRNszV6yXwciNfk/rTbDQYLmKsTCQFCfWIpJdfY=,tag:DjuM2a48/lDF11aLIf3Fgw==,type:comment]
-        user11: ENC[AES256_GCM,data:4HDGJq9nl8oGeQEo0XBEUiJweAaZ9yWc9Ib1TM91Djj2jH8d,iv:1i9/bZhHkhc8dP9Pg4gIRnCms61AP9VYxAG4acV3gpQ=,tag:vID9DEXZu3wGbXDqsLVEAg==,type:str]
-        #ENC[AES256_GCM,data:CdJubErTSg==,iv:UKn0lvbCzJnE241Tg3yjSx4xZNbp5sa/NfgIlRNU5z8=,tag:6FMGY6hbMQQFoN31z4e4uw==,type:comment]
-        user12: ENC[AES256_GCM,data:U+ynUYI+l6McI9oWF4PNiLUwvNowdseZ5gO8o73cX8MsXS2+,iv:r0KIBXczRkubZqyM/LUBPp/x9Zb/rvDJIKGGKkR3EfY=,tag:yn7806HD7ei57UtpuPjlkg==,type:str]
-        #ENC[AES256_GCM,data:3trgclrgDXhKUg==,iv:qyLmCBaB5ql950diUj7YlPi6P3a0hYH8adADEI0AGrU=,tag:Oleq79giA9/gYBO8Carznw==,type:comment]
-        user13: ENC[AES256_GCM,data:M6JXRrqnKrdihAA1aUg9zzJfhCK5TLLRf4wZkemnlHyaXnLL,iv:OA6i+BGYTr9gILE3jzFILLZvPRZeAvmSbXEStihN3aw=,tag:WcpTKRC8crDhzKHcxjtICQ==,type:str]
-        #ENC[AES256_GCM,data:VryB1AM=,iv:6FdWfpQ53bdpkXZ22gpy8GxKb1X7bak0K/Oa56mP7Uw=,tag:VBg7u7MSMl4Pr72W6ugYEg==,type:comment]
-        user14: ENC[AES256_GCM,data:g8y07VaxsuTs74L5xF/XDlmYetOfXFwHEr+FCHRtFLKwTAVq,iv:TjT49pTk97l3u1wGG7BmqZr/LAMC2765er3HGarOANw=,tag:zt1ojulNjWcuKIdix6NFJw==,type:str]
-        #ENC[AES256_GCM,data:Bawjfo3ubW1eXA==,iv:m2/ViC9AIZUV3Wl9EBYV5L0QQDw7QgXPpQ7WX22XpQ8=,tag:1wqpie9BuDi7BiDCvRIWog==,type:comment]
-        user15: ENC[AES256_GCM,data:2Ylnb7ZJgr3ha0rXrjkscPX9zJI2L9aydfL5Ndl2b9cJmVUC,iv:mu0GlGGXH4njmi4KzsvFSJN2zC5IcXVQ6oqVv2ClWpM=,tag:AIhnDqQehLyJY+wh7RWTYg==,type:str]
-        #ENC[AES256_GCM,data:uORLUE+excPAuw==,iv:K1Qch9qkg5T59+lcMC7vHWu1mnOv2dH5cOAZHX8HhgQ=,tag:chVMn/kb3Rr3f2igjbsAUA==,type:comment]
-        user16: ENC[AES256_GCM,data:D4lPjTb2kaYfUSCCRaMpGNtzLIfvPvfiJK+kkTQtSMOBglpN,iv:FCpHHBSKDYA+H6fgabNggXJlenzg5am5excBknpD1uU=,tag:FPQaBfLiZ5PBJa8gCpBfTA==,type:str]
-        #ENC[AES256_GCM,data:Cfs0Ul9BHWW/oQ==,iv:OOcRWmc7fy2RnE7+TtSBauKa1k1/unC1nFJ2SJ3yWqk=,tag:q6MjcXEYuep1eRw5BJspqw==,type:comment]
-        user17: ENC[AES256_GCM,data:2mzbUcGRye0cdgQxoTzSeKaM+m1dUPvKq61uBnGvZDFXrqQ7,iv:hxkruf0Xo1ZNJ/ym5YdLGJF5aK5nXZMJ46XC18Aksmc=,tag:KrUCTgDgYndxhi8QSYpGwA==,type:str]
-        #ENC[AES256_GCM,data:vHvpcqJaH2hPTg==,iv:S1WbgLU+15FMJr699YGY4f9r8wIg880tjJo6W6APhx0=,tag:F7fbA83eco8/Qd6u4vUMbA==,type:comment]
-        user18: ENC[AES256_GCM,data:LwZKy71ecB/E2EMIaUuFV0a7j+16EWo8LA9/0Gc8lpXAQpaT,iv:+cjrRDSvW7KFGDlpI6W+eDi3bux+eQl6NXNjnUoj7L0=,tag:PurtN+Vede0DNTQqbea1Ig==,type:str]
-        #ENC[AES256_GCM,data:rhbv9bL/0d7pGA==,iv:XvKiQWO72BfHhVRyti5ST9+f9tPUne2IcMNC08kD9r8=,tag:qhA6q4MrX3lAELrrGM8LCQ==,type:comment]
-        user19: ENC[AES256_GCM,data:jOyA913cS21eGwjUPY/XrQUBofoHwsCHghpmjzGx7cBzk/K0,iv:wXAnuSUhJ+gwGvMF7/YsfgeTHOvQC+S6rM5DzypvOuo=,tag:b/FsoypjkVYLSfyowNL2Nw==,type:str]
-        #ENC[AES256_GCM,data:Q48F7+SNdz7duKY=,iv:KIb6lIJWAVXKekBhwPztkySYDA7IP4jMjDsWy+waeFQ=,tag:s8hEz2zrh1ZXNKi/IuVV4Q==,type:comment]
-        user20: ENC[AES256_GCM,data:D6+eQdWO/W4P1ul9zQLpUQxqNA+kytz5ZHH6HmU/jwSuq3hU,iv:U4H7Ez0P3gWBLVeQ6O4PN4AmVP7Ij3oArhMmfT1BWic=,tag:l6TNsJFXXH/+yMcszkVRrQ==,type:str]
-        #ENC[AES256_GCM,data:F8qJksiC3Z8GbJc=,iv:yDBYQLUFFSXMn5Vo69rXzGBWzA+GkYw1qHS/ShisH7w=,tag:mnxj03thlYN5KhKDUO7hug==,type:comment]
-        user21: ENC[AES256_GCM,data:QeSxzBR6fLAyoUsA4aGKilYHcF42SNdkwjdwWZbxNvqZU6bf,iv:ocZGB4i8M7qM9Ypp3BUlGIdGL0AQx8NdO5yBZFLB6fk=,tag:WMFmljoJSnCU8BL/GfiZMg==,type:str]
-        #ENC[AES256_GCM,data:LxUne7UMT32f,iv:AyVaLB7Ni6HB5BE+InEG99TQsEzdQG7EXoHXC8PLGlQ=,tag:j5GoVfDsqoHypkxYFNPjyg==,type:comment]
-        user22: ENC[AES256_GCM,data:lzFvCb/zbTZs2jmYUfl3onGeWjBCdjxcIzAIff/fm6Qre+HZ,iv:eSiosE3eOrl7iLnOV41w+pwdtcske/4R1Bf1D1qxsOo=,tag:r69jFKp/FlxN3MEL5E6EXA==,type:str]
     private-key: ENC[AES256_GCM,data:xz7xFt/g++E79bIl6AeBWATHDB+gHBIoXo5vdWTeyrAT1RtllgYie9k3Fg==,iv:x7fdmSINQA+F7a08jpuvCAg7vIZpsYaoX+EnitJMUCk=,tag:GAb/RRdAOlteIQPxeIMAXQ==,type:str]
 peertube:
     secrets: ENC[AES256_GCM,data:OR3OA8qJsq1gAYiv1rShNa8eODzIxPOpVbqbnseSCMUNx4+FeOgReTLl7cXHPxbBkrJbsfEq5XYm1QtRtxotdw==,iv:6vz0ezsFuCNsBduNhm4VQ+it6oEJF/eMxktVFhdXgug=,tag:hmW7BwF9C53SAHhu2HBLYg==,type:str]
@@ -165,7 +104,7 @@ sops:
             d0h3aDh5QXFZYWJFdmNVYnJxQ3pBeVUKTl0XVvtwJcz+RpSylgDPl/R8msInxvWX
             eQGmrDHibeE1V+KSDiuNzC4MVRIrOnh1beHrhnVQ86HwPVgJqs2FoQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-16T02:55:19Z"
-    mac: ENC[AES256_GCM,data:fsqb3NvXwyoGWfcJEV04XcWiifB/zEW+LU8twQ2sY3cZWR5KHAWgVXCXrCunYiSy/Q5nf+ldTgoXKdmNu1pVOJQQXRCY1q1y9MV36msAfIUc1hdkDlo2ka5+d4aBcpqr5nPo5ZU6GJ5by1p8WIPSOWCGfsqMMlKhIWJ+8YaqokU=,iv:cfveyxa/0/qKRHc6wsjAC9stZSkgF85khnp3LTtF+K0=,tag:5vVFg0isyJcg3Twhq5Ouaw==,type:str]
+    lastmodified: "2025-06-09T01:35:04Z"
+    mac: ENC[AES256_GCM,data:q2BolEBB6Ik8yx6NHnnE3Wcl2rGVZN86dpfLJrrFOxWd8fZyfBQ/00v4dUZSZw0aQoMj1V2RBDyVtScuRiH0NVb6+RfX+0t3zTEf6guuJdurczLBz9+D51+Th3KE1uk+UjI7J+Q/TOWTvoGMj8P4XZCXQsCDIct/vbLGqNB9CgM=,iv:/6xR7KXXLejm9Iuqcxc/7IqLEckNhmaJTKzJGonSrng=,tag:XdeCoEkHefw2HqTGSchUJA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

devices/test-pc-vm/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "znver4";
-        networking = {};
+        network = {};
       };
       hardware.cpus = [ "amd" ];
       services.sshd = {};

devices/test-pc/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "znver4";
-        networking = {};
+        network = { dhcp = [ "nixvirt" ]; bridge.nixvirt.interfaces = [ "enp1s0" ]; };
       };
       hardware.cpus = [ "amd" ];
       services =
@@ -29,17 +29,19 @@ inputs:
           {
             chn =
             {
-              hardware = { memoryMB = 2048; cpus = 4; };
+              memory = { sizeMB = 2048; dedicated = true; };
+              cpu = { count = 4; set = builtins.genList builtins.toString 4; };
               network =
               {
-                address = 2;
-                portForward = { tcp = [{ host = 5693; guest = 22; }]; web = [ "example.chn.moe" ]; };
+                bridge = true;
+                vnc.port = 15901;
               };
             };
             chn2 =
             {
               owner = "chn";
-              hardware = { memoryMB = 2048; cpus = 4; };
+              memory.sizeMB = 2048;
+              cpu.count = 4;
               network = { address = 3; portForward.tcp = [{ host = 5694; guest = 22; }]; };
             };
           };

devices/test/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "haswell";
-        networking = {};
+        network = {};
       };
       hardware.cpus = [ "intel" ];
       services =

devices/vps4/default.nix

@@ -22,14 +22,13 @@ inputs:
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
         nixpkgs.march = "znver2";
         initrd.sshd = {};
-        networking = {};
+        network = {};
       };
       services =
       {
         sshd = {};
         fail2ban = {};
-        beesd."/".hashTableSizeMB = 64;
-        xray.server.serverName = "xserver.vps4.chn.moe";
+        xray.server = {};
       };
     };
   };

devices/vps4/secrets.yaml

@@ -4,27 +4,45 @@ xray-server:
         user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
         #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
         user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
-        #ENC[AES256_GCM,data:3KN/1hzeR2I=,iv:iaqJJD6iURTUlIL8e8P7fsAzJYo+y3NGZXgWmPX+4ao=,tag:e8g/JgVrMrWJamUMpiv2pQ==,type:comment]
-        user2: ENC[AES256_GCM,data:58PnLCwDayOYinsPCYPeMvuKiF7b4tZtbmEJFWEl+2Nu6HL2,iv:hSv3jCtkLm4rrm/4+ot10CBhobGwtnK5db5wR1S/XrU=,tag:SQbynYp8pDSqj4tAK6JBMQ==,type:str]
+        #ENC[AES256_GCM,data:4Y00hDJ+8Hjq3Q==,iv:XWZYNC1T5B55B43tcuzzvOOFtHqZJ9XDuEaYQOO5cR4=,tag:5oNFsqUtSiv8CY6aHyGjNQ==,type:comment]
+        user2: ENC[AES256_GCM,data:MRMdc7LRYqgRsfKKW6LnP14g3JoFT6g7jzkXW8gIAeqypyoc,iv:tfPBD2FkIljz3xasYNJsj3vh2lEObrvSZ95FyCgWcTs=,tag:B1PQpyX24DqrPscL/pjZmQ==,type:str]
+        #ENC[AES256_GCM,data:gGd3kkNcyIwOXg4=,iv:vILDvtdvopPM8lZDDpedvtXYHpoPvPn1A8AJca41r9A=,tag:2LMImcmdyPKsQDloq7041Q==,type:comment]
+        user3: ENC[AES256_GCM,data:+KUVcqy18t6Fd+QNgB5DeZkNSA6lsjebO+xnzxzIjWuZ9UmS,iv:qugbmBv9jk1yfH2s0A0jla0DR3jkdXLVUeWGcj6v68U=,tag:4FUf/guDzPqgDcb1086WTA==,type:str]
+        #ENC[AES256_GCM,data:jCgKe0t2xQ==,iv:UE48L/JpobN6LUd6Z9RlsUGSJ1sHHgiL6xj8lPztwJc=,tag:xnwWLQm+GIUzsfBO/TXhrg==,type:comment]
+        user4: ENC[AES256_GCM,data:3yrdvbcH/ToAQpTLppSVp2FNGjatyBInKP85bAY9OrEtzhhQ,iv:4zvb1nzKjrCNWWKelOnDhsNBAC7Ak6ZpJlvQKqGJrgc=,tag:dBOTBJDJhJsKHKg/vGmpxQ==,type:str]
+        #ENC[AES256_GCM,data:2ptsDQ==,iv:dEzyk6NQcFZQPx8h/ViCqtRaQ/8dfMTVKBq+iguk6nU=,tag:11SLIAhtcHja4G9HUXr9Ng==,type:comment]
+        user5: ENC[AES256_GCM,data:NO9rpzFkySistf9++oXpo1tBaa4XtPtcCGR+2IWmhQYEH/l1,iv:OG+U0avgo9mjmU3soxRNL71ZC7Ee4ijpsJMRn3jYvhw=,tag:QuBFX2KHgNJ+f3RwqEH4+Q==,type:str]
         #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
-        user3: ENC[AES256_GCM,data:WCVr0ylGm2SHtOGulb8TD/cI2xJXrbvY1d6+STXGxf0d0izb,iv:vhNshb38AVpwKCFRwUVruCQ0SxhHrOmwQ+IoQZeUj1k=,tag:OfdIjRrTAuVZBOEXTtnrQQ==,type:str]
+        user7: ENC[AES256_GCM,data:Ie8M385wtRx8bWIdCupnda799kL0OLBsWdk9pHTY7IxxaZbn,iv:OrRYOkaC9uI9E1Eb8GYqmYr9VAUM895oO8NSdvxUPCQ=,tag:NZTUE4KnUjhg/auoALavTA==,type:str]
+        #ENC[AES256_GCM,data:Wwq+ypJgx6OcXA==,iv:dSvFz4I5tFx+ZVClxNGKwcbIQe7OY43OzAhqRiDK2TQ=,tag:CYUs1cJ/zqc+Y0yFec7Upw==,type:comment]
+        user8: ENC[AES256_GCM,data:2GyFDXIiAN3mTobwnY4czV2Egoin3B5Ih+aet3yT+krPTkPq,iv:NwrzO//HXwKMudgD+yK1hsj9o71RG6BfBle3logvuLE=,tag:WWpioPsnhHvVSrzAmN16Sg==,type:str]
+        #ENC[AES256_GCM,data:vVz6E2juGqXS1Q==,iv:9itEkwMsW8cqSzwV2EZtgJVgaW7aJJ5fw1rLuKFwiKM=,tag:9hRADkot8kELoYAgd6Dz7Q==,type:comment]
+        user9: ENC[AES256_GCM,data:HgSVrry+nKGW9X9N6h8hsI9VETKtSEi+/ZC9QvNZW4zETQxt,iv:ERgmCDPBpboA/+Sxeq6BvWoMxsv3Kkczqb/mbXz9pOk=,tag:bklzRg9toKy//6T8xdtbRw==,type:str]
+        #ENC[AES256_GCM,data:2sHxXec=,iv:aA61+cmDw4rHab7RuRRK3eUDx5d6gpmfw4RpQ6Nd0mc=,tag:H9kovJyn3Te3ir9X234VGA==,type:comment]
+        user10: ENC[AES256_GCM,data:CqrwaZp1fHd/WEGQH3xWI8DZ2/AavCqwTtwZeHmnrct5yoD3,iv:IBOHGQlw+uQt8Ryp/mCDcglfSPNXvvHOjNnrT+7nOHQ=,tag:tEkGEtPaOBK+P3LrQzOLsQ==,type:str]
+        #ENC[AES256_GCM,data:oB64XheVxA==,iv:Ci9apSqTHQ02IFhqVvlC3hO8yWRKELVtJE3H/CUgFyY=,tag:4uV2aYzzZAUW+OZf7QEVPg==,type:comment]
+        user11: ENC[AES256_GCM,data:pk9b5lFhuAfhKMcTUIdlx6eQHn+MJaPQEs6flmUhhHA2ygj/,iv:UGuPrxJPh+V7vSFjmgmBc9vhg7qye5SrNCFiiTcnDk0=,tag:D/B4PTafZe4r/W/dVWC2CA==,type:str]
+        #ENC[AES256_GCM,data:Rw4BWXZutQ==,iv:rXe2i1G/xQkpBl0wh6VIzaNoidCc3JL4sy6v5hcOF/M=,tag:2tZyH8B0ZL7XptKHk6TcAQ==,type:comment]
+        user12: ENC[AES256_GCM,data:CsbquwEn+iOKCzda8z26FYk2i5aPk2xzqGIYORiD4lotvnFE,iv:zHPmlT4LAc6NDjXrExze23dZZFIj0c1eR4WW74cu+qs=,tag:5MDFrZNgv54mK05ImSvpkw==,type:str]
+        #ENC[AES256_GCM,data:vqYkwGVcQ8yZbA==,iv:1ckVSiAgjuT/K0MuVHe8D2hHE7X2qxCHpb+y6nrFCsI=,tag:so9oFl6bXlJT2O+prplazw==,type:comment]
+        user13: ENC[AES256_GCM,data:KUraqncs8iPr7z+COfJ1z0TLNLlgctxy8FCav95+kkVXtStx,iv:Uv90bnVmmQh6f9pKOWmEKCul5VPxF7rrQ9GYrsCGPp8=,tag:I0r5o8xIYuq5/MIXSOHT3Q==,type:str]
+        #ENC[AES256_GCM,data:F2x+2zrePYDkCA==,iv:aTMeqvGVI43xLsN9submgciiJEjY4hYypJ9RJLIBYTE=,tag:quKW+MATVzRw1bda2jGjdg==,type:comment]
+        user16: ENC[AES256_GCM,data:BjnUUnNyqUvvPbfa1CeYvcVbMOwz6/Em4YhxRgmlicOSwro+,iv:LULwzjV5PRihTHNZFJ21IrDG3rW3qX4CYwF4Xu1KdZg=,tag:pZAI4OEx24d6h/h9JyQ/hA==,type:str]
+        #ENC[AES256_GCM,data:aka1O9hn/dZX3Q==,iv:rWik4cYtHY/Z3xQ0p/i49zTXVmKEQDV4OMn12UaQr3Q=,tag:hPm4bugH9RAtsykj0BJ0Pw==,type:comment]
+        user17: ENC[AES256_GCM,data:URZqRUDtG5FDrZDsmI7CFn4ilp97GJtgaVVB+j0dRUdtVGoq,iv:iUkcr6Oo29y5PIGF/GJRltn5DD19yEcBIsJAaYs43AI=,tag:gzSsjeQxvjvfFVkDHPkfvQ==,type:str]
+        #ENC[AES256_GCM,data:JkMniTrakuonAA==,iv:V5KmQL+C5O2mb3ktlm1ITjLaa1NxToQlyToqYbGme9U=,tag:UTZm05uyb5j0Pf9vuxyIxg==,type:comment]
+        user18: ENC[AES256_GCM,data:fFtnkBnaOktHaIfk7dN2U73UkloToiLvP3Pg2VAqPzvTE49h,iv:DZrba7RWmaeOQsqh3Kq/IuFS9so5u5ItK5WwV/65FYE=,tag:v+pOozYvrJJIsj7A/a3S/g==,type:str]
+        #ENC[AES256_GCM,data:gR0WsUYdBZBWjA==,iv:rnXZQaDNu+cEzneEa6/2pO+qUXl/fut8FJ3n90A6ATs=,tag:azNGPfWv+ZgOU/B5PMCVZg==,type:comment]
+        user19: ENC[AES256_GCM,data:S8VSoBIR/RqwctgYPtyIPEK2hXLr4LZ/jJvvFHA6CGgp9/Ff,iv:8eLCZEaiquwZyswwLkLoJcl7UPWTVYmQqZ2egAGFWWM=,tag:VgJiSt8eRcRhppMXkAkmKg==,type:str]
+        #ENC[AES256_GCM,data:vWW1bNyENgcspxI=,iv:xXCrjHyxVtodkVu/wgy1OrHGGm20nEd1iyparWcycYE=,tag:FRu132btquzXkiLXlnq1Iw==,type:comment]
+        user20: ENC[AES256_GCM,data:Wux6pzwor0B1A9d1y0QEpcNnYn1pObloHxghSONHcsQ266/7,iv:jWSuswV6vTQdL764I/zxFC5gkFOa5Qwj54rggmmZX7I=,tag:4hmqBTn0T3a6Sjt9lofwbg==,type:str]
+        #ENC[AES256_GCM,data:IJWHWxbhy+gxhxk=,iv:HzMi211JiVfHUhEJm+q/K0tCjUEXDhollUf8Bm+HVA0=,tag:P22Q/h+DUhhJayZftcvVfg==,type:comment]
+        user21: ENC[AES256_GCM,data:0X5x3SATZm25kVf8cu7TGm2t95DneLAqhP16fRQCtROzyZyg,iv:dmlwRmubnRq2fNdNz3lVlAVYpPjVHkFm60IvPcajjds=,tag:eDJYYf3eRw+FxfaHiRDk5Q==,type:str]
+        #ENC[AES256_GCM,data:O3ovvRYzFrQY,iv:/Zs8e6u7wdp18AacZ3WWBvn5PDtXDnQ6ZyqLiyYmvAY=,tag:HmhKBI3aRCIR34vOEnv1iA==,type:comment]
+        user22: ENC[AES256_GCM,data:ee0naewdOjIxA0QEpmUyOSu++sUJQneEufhJBHiyOR7jAPTU,iv:09fZ0dLUZHp9wM2lCiIcTzFey2AkWBmnUCfq8W3FM6Y=,tag:dHBVo/Ok3Q9vy1pIbWC1Kw==,type:str]
     private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
-acme:
-    token: ENC[AES256_GCM,data:JBeN7SVxKGOe6er0eS7/v8YrXdv0nCK/KZc8Ygq0G7FIGu4hO662kg==,iv:rf59MgUCYlAA5h18wtdWoUyb2VPB13OPuJjz1VsI2dU=,tag:ViPrwduD8aWf8i8vmBG78A==,type:str]
-nginx:
-    detectAuth:
-        chn: ENC[AES256_GCM,data:lQHDpv8/Yl5/nycHoeTnCw==,iv:ernNxRpcTOSAllDpqRFVFg3qEw/slEEPPXDFq1AhNL0=,tag:2AVALUf9cDyOgCqI9wwgQQ==,type:str]
-        led: ENC[AES256_GCM,data:zyCiiH21,iv:iEYyNClDsCpWE2oNjt2NqQZ88xOOlMr0yycjKTPdmlw=,tag:kQfbshXfTBA5PtUAgpgCcA==,type:str]
-        chat: ENC[AES256_GCM,data:pXu0WPWmvUzvl2expDpQPqWwi1A4abg72npsaYXDXRcg6aVU0Ec+tgM2+uz2hT9rh3mNoBxadYXDc/zeOL1UCg==,iv:iln5UGGBK2s5pGS03PtolWTkx6KrnYBAWCFnI0V2Bag=,tag:EahTDoPIBkgWnp4MOoTCmw==,type:str]
-    maxmind-license: ENC[AES256_GCM,data:8OioibcXQ9IZ0OQhJ/zHSBQjfdHzkoqwUx5zR8Zq0atNw6SSf7vKrg==,iv:z6WTI2yeqP0h7EqKG114nRQpFVJlNzZspgS6gIFtpt4=,tag:a0dBt9pXJnncBiSKt9dsAQ==,type:str]
-telegram:
-    token: ENC[AES256_GCM,data:Si6yTh48HpA8OkkkvgHwtJYFhF8tW3oaQbldjwBc09QJxp9AoKgASMnZtbDZYA==,iv:GrNyZXjaZMviSjy/LGHHrYTr5PFvDkCXmT3MU4+SLpc=,tag:YifB1tKFLqsgXB/YLqYK4w==,type:str]
-    chat: ENC[AES256_GCM,data:ydPky0W4ZWqn,iv:uWQrZDz2GCxiKRaijM89Npt0fQeSNHbQzDefkZCkUAE=,tag:OJQwV/889Vp2/4wjbN41JA==,type:str]
+wireguard: ENC[AES256_GCM,data:3h+cpSHULgwlI/zOI0IL4t4diDzm7qWW1sOWZqkFRWCB0CAfGyydGNlZkqA=,iv:pVpmw0aEDssQSr724h9NvJqFMHu0NupDfCSt1RWVnUk=,tag:fonuszujTzeo2HqO1OokEw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
           enc: |
@@ -44,8 +62,7 @@ sops:
             Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
             1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-25T03:19:55Z"
-    mac: ENC[AES256_GCM,data:v6yb7ZYcnPw/8SqEJnSWzmlE17PenjnBH2X8HZp+kIDXzNFyNvD19FcbCBZjwyjBLvN1ZF4M9FS7Y4+CvvMrN/4JcFufcY/V1NrOd8IZisfAT5N3WuopPee4IN9WEyPVOsbFnesZo6/wJKuqlV1UR8UZxCd3/wHXob9Lkz45cBw=,iv:XKIUiRfP0lj8V/Z1HbvhBankdcAjQqM8Way6TWjJJMY=,tag:PLYsVj6BmR132oWsxEKnfg==,type:str]
-    pgp: []
+    lastmodified: "2025-06-09T01:35:34Z"
+    mac: ENC[AES256_GCM,data:40uhvaJNu1ELo6xHYECEOTE0lVcrcMmZKJpLmE28D2pyXnl6UQza0j9O7944+Ii+VroSvm7juB86gR8/x6URabQF0l2HTiYtBvyPicxdobB209i5JSULiCUe1zlfz8WyQ4VnPAJ9SJny59ucMYxMh8RM4UPtXWLs5whcqt5ooSk=,iv:5odm078cRXnwTA233NV7edcYTfMmTLFLrGRhE/oi8SU=,tag:2t06LMMrRkmbAQbCad6URA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.10.2

devices/vps6/default.nix

@@ -22,13 +22,12 @@ inputs:
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
         nixpkgs.march = "znver2";
         initrd.sshd = {};
-        networking = {};
-        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
+        network = {};
       };
       services =
       {
         sshd = {};
-        xray.server.serverName = "vps6.xserver.chn.moe";
+        xray.server = {};
         frpServer = { enable = true; serverName = "frp.chn.moe"; };
         nginx =
         {
@@ -63,10 +62,26 @@ inputs:
         beesd."/" = {};
       };
     };
-    specialisation.generic.configuration =
+    networking.nftables.tables.forward =
     {
-      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
-      system.nixos.tags = [ "generic" ];
+      family = "inet";
+      content = let srv2 = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg0.srv2-node0"; in
+      ''
+        chain prerouting {
+          type nat hook prerouting priority dstnat; policy accept;
+          tcp dport 7011 fib daddr type local counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
+        }
+        chain output {
+          type nat hook output priority dstnat; policy accept;
+          # 需要忽略透明代理发出的流量（gid 不是 nginx）
+          meta skgid != ${builtins.toString inputs.config.users.groups.nginx.gid} tcp dport 7011 fib daddr type local \
+            counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
+        }
+        chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname wg0 meta mark & 4 == 4 counter masquerade
+        }
+      '';
     };
   };
 }

devices/vps6/secrets.yaml

@@ -7,47 +7,41 @@ xray-server:
         #ENC[AES256_GCM,data:OVgDU+zqcQ==,iv:8KuEqBuL5Ca6pUOFFA+vySJx/h3BhGAAC0CgnxiW46o=,tag:TY1MajSSy2RjKVI2SSAAFw==,type:comment]
         user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
         #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
-        user2: ENC[AES256_GCM,data:e7ITe2ZouKr8dXT7SYATyzbzHaVeu6AKt1OcQKk3U0nsQgoa,iv:UbOOuojy6OAFEH8lGhKe5Hs+2K6FX5MZ8Br9AB007gs=,tag:5XeB4YngzTcHZvCpXe/ZXA==,type:str]
-        #ENC[AES256_GCM,data:93BxR0AEdQ==,iv:rf69GWpuxYt7fu1Fyv55pynuQDhi+TA5CwZK3cc3yBo=,tag:/hLy6atNMxLw6G3/qgMM4g==,type:comment]
+        user2: ENC[AES256_GCM,data:+MKTpaA8hO8q0kyY0V1csedLOtIf760Vr0+WllGe9lgMJ5da,iv:5txOM3sFOhKVX4EVozb8XHWLU0fUNxCF9YAwTYaTL6c=,tag:jkgOVgiEc5phY1XNETsdpA==,type:str]
+        #ENC[AES256_GCM,data:m0iCqLI8ELaPb9g=,iv:bsh7JHILbOZJ+bgGr0U0rDanjUVGgDzYGhboezspEjE=,tag:o7A4SXoCXk5LXmZ1bidg/w==,type:comment]
         user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
         #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
-        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
+        user4: ENC[AES256_GCM,data:/kBaGAqbewLav+WCJPHm1py3pvb7bA/YO2DeBP2FTCZv44wA,iv:iwxV6KHu00oITH/58kBFmf43lkgTU3BHJ/kb9FPnRSE=,tag:ns+6Dvhf/D15bZc0fd6zLA==,type:str]
         #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
         user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
-        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
-        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
         #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
         user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
         #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
-        user8: ENC[AES256_GCM,data:H1gPtqF8vryD0rVH7HYzpMuZ3lufOBYczKwaTr4PidQtTyQK,iv:wh7NwFc/1ogNrnTTpm5L9dBqDVkvWiIsJZelR2mtR4Q=,tag:oEFdMFZJ9UYhsSVdefJ4rg==,type:str]
+        user8: ENC[AES256_GCM,data:AnZb12dioiCamubOb6fsGWoM55zfPMeRbu+j8bRRcMfSQFJf,iv:rB+4B11JFC0oS2ExUW18f5WvhnE4EuHh3IiEyxWeY3A=,tag:jt+3yxDvhusvB8ppbdAwzw==,type:str]
         #ENC[AES256_GCM,data:aYWIiLxs1UvupQ==,iv:AisokHuAzD5B6fEF6ak8WfAe151CM3a8MsaWC4uJPnw=,tag:cdk5S4n9ulyWrqsD+jcqYg==,type:comment]
-        user9: ENC[AES256_GCM,data:HVK9KvGfOcwn1joc3VrkjBjE6hrxQPOBD5RTtQUgBPepToh6,iv:VK9aQ64L/GajpledBxC8PNB1BdNYEqwcdL3GKttgxvs=,tag:O/piztCYBARtAFxTMNXGaA==,type:str]
+        user9: ENC[AES256_GCM,data:+SA+VcZcy5ckuS/46Dn093VvuqxrIACuqMAMx6Ko5yw0DVdW,iv:TeLXb1WI7uhcPDkXYSlKIxdE6Kz+nCnlB+ZYpWcaF4I=,tag:YB0sPD9yHMARhiMJs7JKcA==,type:str]
         #ENC[AES256_GCM,data:eCl1bK4=,iv:oYA2CFW6OGGrRYx6OHRYJpbEyFh575UjztvHaXA8UG8=,tag:Pw7xsisQB2Dd0KJeWFq6bQ==,type:comment]
-        user10: ENC[AES256_GCM,data:xjVkr/wy7OxRuNZKfQagfNxdVxTEyQP1ZhnR6jHy2gjBQ0RD,iv:G6iOBCHOqlvfEENY/ega/TUm81wgT2OOdZKZ6bPfg9o=,tag:p8AMa3bGsIl0hWQ09lSzgA==,type:str]
+        user10: ENC[AES256_GCM,data:Pec0CVGia/ZIaq7WerZlr0/waJ/Ev1OKwt7V3PBxBSFMLi7p,iv:wYTdhv4Xoe58KBIwV1vk/V4IcdVzQrBgmzGaRD7qHQs=,tag:IZVt5LmjTUge8XntujJlTA==,type:str]
         #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
-        user11: ENC[AES256_GCM,data:BIZ2zRgGv5/9AexiZZvu+m4A62YUWtAkjWWMu89GteqpWMBq,iv:13IJcDf18LjoxJk7uoKnuFZT6Ihxrxsy7DBaAaiFqus=,tag:RN7wj+uPneCkqNlMRyYrXw==,type:str]
+        user11: ENC[AES256_GCM,data:IFIVzbnZCyn0j7AG0ClBT4byyZyVtRk1JqlWsojqPIVenek2,iv:ONdq1qIXG2kbAjuM/tHSPxce7oD/MHcBw1pBYm9DlEk=,tag:OuzeX0K+fSO7jWadb1uSRQ==,type:str]
         #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
-        user12: ENC[AES256_GCM,data:FAF9lXOzXW9CrZgnQ1a2+E8snZj2+JHqP5Gny92k09o/Wzga,iv:/qZuAtFmUQE7A9lMzJUoCvGx+3Sv9Ioh2ahch3puaC4=,tag:urwbLwGkSX3e85NCjyPhhg==,type:str]
+        user12: ENC[AES256_GCM,data:iTZViWyKkCU1y6mvB0NzkXf3I98U/+nCs21ZD6M285YKaU6q,iv:vFgA3sv/7ENcw3gyJLiiHLwroXtVJjAxZXViqjXF3mQ=,tag:u3b9Uu6TIPPYX0TW5X5Sjg==,type:str]
         #ENC[AES256_GCM,data:HueqiREBet2bxQ==,iv:WCjTAGg2gXgBSvY3zc/YyB/1X0XjvphPduVXLsjOwH8=,tag:wC+On6lyyYQ1Dt/BHDvONw==,type:comment]
-        user13: ENC[AES256_GCM,data:ExbnvWDIBqga5+k2mpoT8AKBOXAvUNMjBTPXUKrmtWzz4l+L,iv:UI7CvSx2FHYGf6BEHS4e3iwHZZWkl2Zt5xg2WdKbLvY=,tag:ad0c7YW2Bxo+Dn+BoSZ0Ng==,type:str]
-        #ENC[AES256_GCM,data:R8lN5T0=,iv:FXLf8Vtjg+PkwNhxXWDViMKqwn7tFMaPhio9zhnudZw=,tag:34gxRH+P9lmkUxlOPKcYMg==,type:comment]
-        user14: ENC[AES256_GCM,data:dgNPPlJD5JOFPbKhlvlRHBLmUNKeDm/JAiawUVpBE7H07Box,iv:w+t9BkqYvlxVKr+x0MwtBz0/YSR/7z1OnZLIoPdW4gc=,tag:CR3GLbaO0jSQgA2HuwzRqg==,type:str]
-        #ENC[AES256_GCM,data:X80nhW5a/JQ1IQ==,iv:2UTsNLLDr4uBAEcPyvmep1fqH43JLUiHc/zqQWChfDk=,tag:DJEArs1nVnlcJgqM2uy17A==,type:comment]
-        user15: ENC[AES256_GCM,data:6AskiMLLl0HV6tm2rYpV46XW0jePQy+wme2oi3M7He7WsgVM,iv:lGfnFn69Vnjv5J3rp5sRazD5/B+8Nk8MNG7HIyf4HKA=,tag:Vbg82tdn3noOfhKVVx0Phg==,type:str]
+        user13: ENC[AES256_GCM,data:ID/A7yCWQIWRoU7Emhel2ASZfTweqXYmpC5q6Fm6ptD0XfCu,iv:YrFjIilO4pH+QxVVDTqwkufj2VSC38y9lAJfD8w522I=,tag:1v/T7vWeh0LMi0OL0FVs9g==,type:str]
         #ENC[AES256_GCM,data:4jJkbMD9Psxrag==,iv:arRtRaNrqnYcT7vE3wqgl/y8/65ORaxqTdGw55AKDP8=,tag:pRpta6mXfy0XCyzMA4+cEQ==,type:comment]
-        user16: ENC[AES256_GCM,data:fo6KJXlPDn7+FmxjEJQo9d79rDYemLFx6LanYZcJpKJR7Gxq,iv:yEUKPNZ9idrSqyVO9fhksP/7bjPMT/LzNK2VSq503/c=,tag:M87D44SIo9JzDB3ZyKu7fA==,type:str]
+        user16: ENC[AES256_GCM,data:esInSvj+a90TAl+b/n9m2iJsH7e6tlQRwSsoLBCy8KA9a0Z3,iv:U4c0pZzqS1s5H6XW3YRSCvDhtxnwCnyKR/tObefX2Rw=,tag:YtY/t4xsmZaj4lC39XQ5SA==,type:str]
         #ENC[AES256_GCM,data:/Kec+CdtnT11EA==,iv:DnmbWfgriaE6XAnMqq2UXhHhN+Rd/3YRodKVUCJo6p4=,tag:NimqZpbslKxwzoljaZqEdw==,type:comment]
-        user17: ENC[AES256_GCM,data:gQInIcNFxJuCSsMDGq4yTp5JdMMmJRy1tY3PGLoLuuIXWV0a,iv:ya4n9Z7T9/bxeHqi5QqwJprEzDMsT6X0BuEXRS67wWk=,tag:RcjQfAHv8uc3PgN5c4bySA==,type:str]
+        user17: ENC[AES256_GCM,data:6h343SreoMqz5ZHkdyDI/je4v10r5zBV7cWc6Pj4x5sI2cvE,iv:7WSikMxAZJUnv3+GPq40d8r9JkKRRH/SPW5F5fy5HHY=,tag:6h5Z7+WXT/dLNeEIrC0UGw==,type:str]
         #ENC[AES256_GCM,data:h7E4P6BiGjktYg==,iv:DhkK3NNppBqo3sXt9U7kbgfaBPYcSEX2hu6VOAesDiE=,tag:XoVbZklwCmU1EBhv0ujcSw==,type:comment]
-        user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
+        user18: ENC[AES256_GCM,data:HJj0e6EHXEYmDXlZcS8UlfEQo/4y47w3sYKgb2Ojq6E4vMdE,iv:xThlGl/DDLLgoY5VkBSCx9HIvxy2ZlO5Q987vIMu0lA=,tag:gB07jP6Do4/6RmVaLB3Ecg==,type:str]
         #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
-        user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
+        user19: ENC[AES256_GCM,data:unW8dOhNbPNLWd7X2prpD82tcqUua7msq8nX3ykFs8STsuto,iv:OLaZ9XQDFGaA1VENgsSn/3HQXp957Zf9MD9GPZ4KLE8=,tag:UK27LK+De3AzbI2mEIsQpw==,type:str]
         #ENC[AES256_GCM,data:1g2gohLbiixMes8=,iv:E3HA6cAdv3BdLMcrrcWW4Zsc2KLtW7L8Xrk9Z57l49o=,tag:rZ7W9ckf7lzJ23u5zwQiwg==,type:comment]
         user20: ENC[AES256_GCM,data:3UbVnn9oMRc0zZR46tWxwM9VFOvMOYm690csUomEVBcS3xPm,iv:KHuPXttLAFr7WT/qa/UYLY8GRsPWYZPyKNmdUh4iFQQ=,tag:jN8rQ0Gv+qnhwOWGH+CwlA==,type:str]
         #ENC[AES256_GCM,data:GzxXsTbEvdHV7A0=,iv:uxUG4hnYEsmJtnqbEwamwhtLt3UClt7ktmkGyAFdxsc=,tag:sF8YQ2cejAezI3Bbp9qKIw==,type:comment]
         user21: ENC[AES256_GCM,data:hgDJ11crZaWcKrc+ZDQklXwpnvt/sMbARkx3sLZfQGZqQZeA,iv:2Re+hdJuT5yg/qTymfpN+KdU3criOmwuqqg+SHb8iAo=,tag:s16N6u5cRDaoWxnrCkamuw==,type:str]
         #ENC[AES256_GCM,data:U0CcBBJraJj9,iv:9kuHsHkSDdDT0Gi/3Oy608RArrg+4cgeii5zWbsGuPA=,tag:EvqqMNvNcWBwie28t0+52w==,type:comment]
-        user22: ENC[AES256_GCM,data:G+Ls2+bbcP4RmeYhPF44STdbqNiw0UZVxac6GQXJUyCehgjm,iv:vXbwtGWgBINUauS4rsDj+4yoropzZ4IHOZxF9/jLPTY=,tag:SN1BZbQTOfcAF6krXEXtjA==,type:str]
+        user22: ENC[AES256_GCM,data:LClSrxtBzuJUD4J4QaYXHUr8XSi+N7Zh193j/YeBZRm9sjgf,iv:djiq3+iVnuKK2HveoCm/j8FezzrHRGnjbyoO6iGm6eA=,tag:N5hqYyvJGxnwT8wbxdnjiA==,type:str]
     private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 send:
     redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
@@ -55,10 +49,6 @@ coturn:
     auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
 wireguard: ENC[AES256_GCM,data:5M7EAy/6+2UASWkjxE0Jrxwl0aNdAVZaUjQnD1wU3YvOAQ/c2DSL8hVtKf8=,iv:a2tXFf1+aP0JhdNtzP8e82KJ71m2o8nx+G0wIx4VMig=,tag:l4TS4QBz2fIkC9/GnZgHnQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
           enc: |
@@ -78,8 +68,7 @@ sops:
             ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
             ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-16T14:15:31Z"
-    mac: ENC[AES256_GCM,data:XOG+e115arZG1uvFoLxCfAqr2pLI2ndS6bZKRyQlWaJK0Gti8RpQt1jVZ+Q3y5Ga8tpAvd7k5MYgRL0/H400ENCleM3vsh5s3VXjlSSxq4mfdkwhUH2E0t8OQyf8VXvs0SXZKhTOljETPu1pggB6iFUfEZ5e0kKRLRYWI4Tt94Y=,iv:mt60iMiKTcQP4b/f684j2IyFSWYzmq3XGK19CfZB53c=,tag:NyhQ0Lptv2E4jHuYAxcelA==,type:str]
-    pgp: []
+    lastmodified: "2025-06-09T01:33:33Z"
+    mac: ENC[AES256_GCM,data:sRZaOvmwZqoxNFKrWtY19t4As7CEu1kXNR1XWO1uo28KEWQJ2n9HLRsdinjG70j/bFyTkXXiBz6Vlhx2RkdhHURKxe/UKuv/5szuGV/aE0NUGu+jYIaSbbIZpv1FkuUYuRFbuaSJnejEyQYW9ahaJYAJgXutqMY/e4xgUJ7Ooeo=,iv:PvAvKe/23u+aPP2moiNrkEqi0CgP9VCwfzcKC8S8Z1w=,tag:YburNo3mniyi4jyUjMF8DQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.2

doc/todo.md

@@ -1,6 +1,14 @@
-* 使用 wrap 好的 intel 编译器。
-* 在挂载根目录前（创建 rootfs 时），按用户复制需要的文件
-* 挑选一个好看的主题
-* 尝试一些别的计算软件
-* 解决 vscode 中的英语语法检查插件，尝试 valentjn.vscode-ltex
-* 调整 xmupc1 xmupc2 启动分区
+* 测试 huggin rsshub
+* 打包 intel 编译器
+* 切换到 niri，清理 plasma
+* 调整其它用户的 zsh 配置
+* 调整 motd
+* 找到 wg1 不能稳定工作的原因；确定 persistentKeepalive 发包的协议、是否会被正确 NAT。
+* 备份系统
+* 备份数据
+* 清理 mariadb，移动到 persistent
+* 清理多余文件
+* 移动日志到 persistent
+* 更新 srv1
+* 告知将代理改到 xserver2
+* 准备单独一个的 archive

doc/upgrade.md

@@ -1,8 +1,8 @@
 * merge upstream, update flake
 * update src
 * fix all build errors
-* update modules
-* update postgresql nextcloud mariadb
+* update modules (synapse)
+* update postgresql nextcloud
 * update stateVersion
 * switch
 * fix disabled packages

flake.nix

@@ -13,31 +13,21 @@
     sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
     nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
     nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-vscode-extensions = { url = "github:nix-community/nix-vscode-extensions"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-vscode-extensions =
+    {
+      url = "github:nix-community/nix-vscode-extensions?ref=4a7f92bdabb365936a8e8958948536cc2ceac7ba";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     impermanence.url = "github:CHN-beta/impermanence";
-    qchem = { url = "github:Nix-QChem/NixOS-QChem/master"; inputs.nixpkgs.follows = "nixpkgs"; };
     plasma-manager =
     {
       url = "github:pjones/plasma-manager";
       inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
     };
-    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
-    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-flatpak.url = "github:gmodena/nix-flatpak";
-    chaotic =
-    {
-      url = "github:chaotic-cx/nyx";
-      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
-    };
-    gricad = { url = "github:Gricad/nur-packages"; flake = false; };
     catppuccin = { url = "github:catppuccin/nix"; inputs.nixpkgs.follows = "nixpkgs"; };
     bscpkgs = { url = "github:CHN-beta/bscpkgs"; inputs.nixpkgs.follows = "nixpkgs"; };
-    winapps = { url = "github:winapps-org/winapps/feat-nix-packaging"; inputs.nixpkgs.follows = "nixpkgs"; };
-    # TODO: switch to stable branch
-    aagl = { url = "github:ezKEa/aagl-gtk-on-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    cachyos-lts.url = "github:drakon64/nixos-cachyos-kernel";
     nixvirt = { url = "github:CHN-beta/NixVirt"; inputs.nixpkgs.follows = "nixpkgs"; };
-    shadowrz = { url = "github:ShadowRZ/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    buildproxy = { url = "github:polygon/nix-buildproxy"; inputs.nixpkgs.follows = "nixpkgs"; };
 
     misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
     rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -50,13 +40,10 @@
     tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
     v-sim = { url = "gitlab:l_sim/v_sim/master"; flake = false; };
     rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
-    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
-    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
     lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
     mumax = { url = "github:CHN-beta/mumax"; flake = false; };
-    openxlsx = { url = "github:troldal/OpenXLSX"; flake = false; };
+    openxlsx = { url = "github:troldal/OpenXLSX?rev=f85f7f1bd632094b5d78d4d1f575955fc3801886"; flake = false; };
     sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
-    sockpp = { url = "github:fpagliughi/sockpp"; flake = false; };
     nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
     hextra = { url = "github:imfing/hextra"; flake = false; };
     nu-scripts = { url = "github:nushell/nu_scripts"; flake = false; };
@@ -64,13 +51,13 @@
     pocketfft = { url = "github:mreineck/pocketfft"; flake = false; };
     blog = { url = "git+https://git.chn.moe/chn/blog-public.git?lfs=1"; flake = false; };
     nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git?lfs=1"; flake = false; };
-    spectroscopy = { url = "github:skelton-group/Phonopy-Spectroscopy"; flake = false; };
     vaspberry = { url = "github:Infant83/VASPBERRY"; flake = false; };
     ufo = { url = "git+https://git.chn.moe/chn/ufo.git?lfs=1"; flake = false; };
     stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
     fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
     mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme?lfs=1"; flake = false; };
     phono3py = { url = "github:phonopy/phono3py"; flake = false; };
+    sticker = { url = "git+https://git.chn.moe/chn/sticker.git?lfs=1"; flake = false; };
   };
 
   outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in

flake/branch.nix

@@ -1 +1 @@
-"next"
+"production"

flake/dev.nix

@@ -34,20 +34,6 @@
     packages = [ pkgs.clang-tools_18 ];
     CMAKE_EXPORT_COMPILE_COMMANDS = "1";
   };
-  winjob =
-    let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
-    in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-    {
-      inputsFrom = [ winjob ];
-      packages = [ clang-tools_18 ];
-      CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-    };
-  mirism = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
-  {
-    inputsFrom = [ pkgs.localPackages.mirism ];
-    packages = [ pkgs.clang-tools_18 ];
-    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-  };
   info = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
   {
     inputsFrom = [ pkgs.localPackages.info ];

flake/dns/config/chn.moe.nix

@@ -5,11 +5,11 @@ let
     autoroute = [ "api" "git" "grafana" "matrix" "peertube" "send" "synapse" "vikunja" "铜锣湾" ];
     nas = [ "initrd.nas" ];
     office = [ "srv2-node0" ];
-    vps4 = [ "initrd.vps4" "xserver.vps4" ];
+    vps4 = [ "initrd.vps4" "xserver2.vps4" ];
     vps6 =
     [
       "blog" "catalog" "coturn" "element" "frp" "initrd.vps6" "misskey" "sticker" "synapse-admin" "tgapi"
-      "ua" "vps6.xserver" "铜锣湾实验室"
+      "ua" "xserver2" "xserver2.vps6" "铜锣湾实验室"
     ];
     "xlog.autoroute" = [ "xlog" ];
     "wg0.srv1-node0" = [ "wg0.srv1" ];
@@ -17,11 +17,12 @@ let
     srv3 =
     [
       "chat" "freshrss" "huginn" "initrd.srv3" "nextcloud" "photoprism" "rsshub" "ssh.git" "vaultwarden" "webdav"
-      "xserver.srv3" "example"
+      "xserver2.srv3" "example"
     ];
     srv1-node0 = [ "srv1" ];
     srv2-node0 = [ "srv2" ];
     "wg1.pc" = [ "nix-store" ];
+    "wg1.nas" = [ "nix-store.nas" ];
   };
   a =
   {

flake/packages.nix

@@ -23,7 +23,6 @@
       version = inputs.self.rev or "dirty";
       stdenv = pkgs.pkgsStatic.gcc14Stdenv;
     };
-  inherit (pkgs.localPackages) blog;
   inherit (pkgs.localPackages.pkgsStatic) chn-bsub;
   vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
   {
@@ -37,13 +36,18 @@
       else if builtins.isAttrs x then builtins.concatMap getDrv (builtins.attrValues x)
       else if builtins.isList x then builtins.concatMap getDrv x
       else [];
-    in pkgs.writeClosure (getDrv (inputs.self.outputs.src));
+    in pkgs.concatText "src" (getDrv (inputs.self.outputs.src));
   dns-push = pkgs.callPackage ./dns
   {
     inherit localLib;
     tokenPath = inputs.self.nixosConfigurations.pc.config.sops.secrets."acme/token".path;
     octodns = pkgs.octodns.withProviders (_: with pkgs.octodns-providers; [ cloudflare ]);
   };
+  archive =
+    let devices =
+      [ "nas" "one" "pc" "srv1-node0" "srv1-node1" "srv1-node2" "srv2-node0" "srv2-node1" "srv3" "vps4" "vps6" ];
+    in pkgs.writeText "archive" (builtins.concatStringsSep "\n" (builtins.map
+      (d: "${inputs.self.outputs.nixosConfigurations.${d}.config.system.build.toplevel}") devices));
 }
 // (builtins.listToAttrs (builtins.map
   (system: { inherit (system) name; value = system.value.config.system.build.toplevel; })

flake/src.nix

@@ -45,13 +45,13 @@
     {
       patch = pkgs.fetchzip
       {
-        url = "http://theory.cm.utexas.edu/code/vtstcode-205.tgz";
-        sha256 = "008c3q67v5f0ld1f8wdrz2z2kmlzicnxh2bm0akk7i8mnsph0lal";
+        url = "http://theory.cm.utexas.edu/code/vtstcode-204.tgz";
+        sha256 = "00qpqiabl568fwqjnmwqwr0jwg7s56xd9lv9lw8q4qxqy19cpg62";
       };
       script = pkgs.fetchzip
       {
         url = "http://theory.cm.utexas.edu/code/vtstscripts.tgz";
-        sha256 = "0ixzaqwca5l9yvdq03czgqknszb769pxgc9zq1bgxsp921nvk8mq";
+        sha256 = "0wz9sw72w5gydvavm6sbcfssvvdiw8gh8hs0d0p0b23839dw4w6j";
       };
     };
   };
@@ -63,35 +63,7 @@
     finalImageName = "ghcr.io/huginn/huginn";
     finalImageTag = "latest";
   };
-  misskey =
-  {
-    "https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.6/aiscript-dev-aiscript-languageserver-0.1.6.tgz" = "0092d5r67bhf4xkvrdn4a2rm1drjzy7b5sw8mi7hp4pqvpc20ylr";
-    "https://github.com/misskey-dev/tabler-icons/archive/refs/tags/3.30.0-mi.1932+ab127beee.tar.gz" = "09aa34a02rdpcvrhl6xddzy173pg7pi9i551s692ggc3pq7fmdhw";
-  };
-  xmuvpn = pkgs.dockerTools.pullImage
-  {
-    imageName = "hagb/docker-easyconnect";
-    imageDigest = "sha256:1c3a86e41c1d2425a4fd555d279deaec6ff1e3c2287853eb16d23c9cb6dc3409";
-    sha256 = "1jpk2y46lnk0mi6ir7hdx0p6378p0v6qjbh6jm9a4cv5abw0mb2k";
-    finalImageName = "hagb/docker-easyconnec";
-    finalImageTag = "7.6.7";
-  };
-  lumerical =
-  {
-    lumerical = pkgs.requireFile
-    {
-      name = "lumerical.zip";
-      sha256 = "03nfacykfzal29jdmygrgkl0fqsc3yqp4ig86h1h9sirci87k94c";
-      hashMode = "recursive";
-      message = "Source not found.";
-    };
-    licenseManagerImage = pkgs.requireFile
-    {
-      name = "lumericalLicenseManager.tar";
-      sha256 = "VOtYMnDRUP74O2lAqMqBDLnXtNS8AhbBhyZBj/2aVoE=";
-      message = "Source not found.";
-    };
-  };
+  misskey = {};
   vesta =
   {
     version = "3.90.5a";
@@ -142,12 +114,32 @@
   mathematica = pkgs.mathematica.src;
   oneapi =
   {
-      src = pkgs.fetchurl
+    src = pkgs.fetchurl
     {
       url = "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/2cf9c083-82b5-4a8f-a515-c599b09dcefc/"
         + "intel-oneapi-hpc-toolkit-2025.1.1.40_offline.sh";
       sha256 = "1qjy9dsnskwqsk66fm99b3cch1wp3rl9dx7y884p3x5kwiqdma2x";
     };
     version = "2025.1";
+    fullVersion = "2025.1.1.40";
+    components =
+    [
+      "intel.oneapi.lin.dpcpp-cpp-common,v=2025.1.1+10"
+      "intel.oneapi.lin.dpcpp-cpp-common.runtime,v=2025.1.1+10"
+      "intel.oneapi.lin.ifort-compiler,v=2025.1.1+10"
+      "intel.oneapi.lin.compilers-common.runtime,v=2025.1.1+10"
+      "intel.oneapi.lin.mpi.runtime,v=2021.15.0+493"
+      "intel.oneapi.lin.umf,v=0.10.0+355"
+      "intel.oneapi.lin.tbb.runtime,v=2022.1.0+425"
+      "intel.oneapi.lin.compilers-common,v=2025.1.1+10"
+    ];
+  };
+  rsshub =  pkgs.dockerTools.pullImage
+  {
+    imageName = "diygod/rsshub";
+    imageDigest = "sha256:1f9d97263033752bf5e20c66a75e134e6045b6d69ae843c1f6610add696f8c22";
+    hash = "sha256-zN47lhQc3EX28LmGF4N3rDUPqumwmhfGn1OpvBYd2Vw=";
+    finalImageName = "rsshub";
+    finalImageTag = "latest";
   };
 }

modules/default.nix

@@ -6,11 +6,7 @@ inputs: let inherit (inputs) topInputs; in
     topInputs.sops-nix.nixosModules.sops
     topInputs.nix-index-database.nixosModules.nix-index
     topInputs.impermanence.nixosModules.impermanence
-    topInputs.nix-flatpak.nixosModules.nix-flatpak
-    topInputs.chaotic.nixosModules.default
-    { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
     topInputs.catppuccin.nixosModules.catppuccin
-    topInputs.aagl.nixosModules.default
     topInputs.nixvirt.nixosModules.default
     (inputs:
     {

modules/hardware/gpu.nix

@@ -100,7 +100,7 @@ inputs:
       inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
       {
         opencl.enable = true;
-        initrd.enable = true; # needed for waydroid
+        initrd.enable = true;
         legacySupport.enable = true;
         amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
       };}

modules/model.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.model = let inherit (inputs.lib) mkOption types; in
   {
     hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
+    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
     private = mkOption { type = types.bool; default = false; };
     cluster = mkOption
     {

modules/packages/android-studio.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.android-studio = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) android-studio; in inputs.lib.mkIf (android-studio != null)
   {
     nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ];

modules/packages/bash.nix

@@ -0,0 +1,17 @@
+inputs:
+{
+  options.nixos.packages.bash = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) bash; in inputs.lib.mkIf (bash != null)
+  {
+    nixos.user.sharedModules = [(homeInputs:
+    {
+      config =
+      {
+        # set bash history file path, avoid overwriting zsh history
+        programs.bash = { enable = true; historyFile =  "${homeInputs.config.xdg.dataHome}/bash/bash_history"; };
+        home.shell.enableBashIntegration = true;
+      };
+    })];
+  };
+}

modules/packages/chromium.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.chromium = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) chromium; in inputs.lib.mkIf (chromium != null)
   {

modules/packages/desktop.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.desktop = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) desktop; in inputs.lib.mkIf (desktop != null)
   {
@@ -15,8 +15,7 @@ inputs:
         [
           # system management
           # TODO: module should add yubikey-touch-detector into path
-          gparted wayland-utils clinfo glxinfo vulkan-tools dracut yubikey-touch-detector btrfs-assistant snapper-gui
-          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x wl-mirror geekbench xpra
+          gparted yubikey-touch-detector btrfs-assistant kdePackages.qtstyleplugin-kvantum cpu-x wl-mirror xpra
           (
             writeShellScriptBin "xclip"
             ''
@@ -24,69 +23,50 @@ inputs:
               else exec ${wl-clipboard-x11}/bin/xclip "$@"; fi
             ''
           )
-          # color management
-          argyllcms xcalib
           # networking
-          remmina putty mtr-gui
+          remmina putty kdePackages.krdc
           # media
-          mpv nomacs simplescreenrecorder imagemagick gimp-with-plugins netease-cloud-music-gtk qcm
-          waifu2x-converter-cpp blender paraview vlc whalebird spotify obs-studio
-          (inkscape-with-extensions.override { inkscapeExtensions = null; })
-          # themes
-          klassy-qt6 localPackages.slate localPackages.blurred-wallpaper tela-circle-icon-theme
-          catppuccin catppuccin-sddm catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
-          (catppuccin-kde.override { flavour = [ "latte" ]; }) (catppuccin-kvantum.override { variant = "latte"; })
-          # terminal
-          warp-terminal
+          mpv nomacs simplescreenrecorder imagemagick gimp-with-plugins qcm waifu2x-converter-cpp blender paraview vlc
+          obs-studio (inkscape-with-extensions.override { inkscapeExtensions = null; }) kdePackages.kcolorchooser
+          kdePackages.kdenlive
           # development
-          adb-sync scrcpy dbeaver-bin cling aircrack-ng
-          weston cage openbox krita fprettify # jetbrains.clion 
-          # desktop sharing
-          rustdesk-flutter
+          adb-sync scrcpy dbeaver-bin aircrack-ng fprettify
           # password and key management
           yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden hashcat
-          electrum jabref john crunch
+          kdePackages.kleopatra
           # download
-          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
+          qbittorrent wgetpaste rclone
           # editor
-          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq obsidian code-cursor
+          typora
           # news
-          fluent-reader rssguard newsflash newsboat follow
+          fluent-reader newsflash follow
           # nix tools
-          nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
-          nix-template nil bundix
+          nixpkgs-fmt nixd nix-serve nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
+          # required by vscode nix tools
+          nil
           # instant messager
-          element-desktop telegram-desktop discord zoom-us slack nur-linyinfeng.wemeet nheko
-          fluffychat signal-desktop qq nur-xddxdd.wechat-uos-sandboxed cinny-desktop
+          element-desktop telegram-desktop discord zoom-us slack nheko
           # browser
-          google-chrome tor-browser microsoft-edge
+          google-chrome tor-browser
           # office
-          crow-translate zotero pandoc texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply pspp libreoffice-qt6-fresh ocrmypdf typst # paperwork
+          crow-translate zotero pandoc texliveFull poppler_utils pdftk pdfchain activitywatch
+          ydict pspp libreoffice-qt6-fresh ocrmypdf typst
           # required by ltex-plus.vscode-ltex-plus
           ltex-ls ltex-ls-plus
           # matplot++ needs old gnuplot
           inputs.pkgs.pkgs-2311.gnuplot
           # math, physics and chemistry
-          octaveFull ovito localPackages.vesta localPackages.v-sim jmol mpi geogebra6 localPackages.ufo
-          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14;
-            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; })
-          inputs.pkgs.pkgs-2311.hdfview numbat qalculate-qt
+          octaveFull mpi geogebra6 qalculate-qt
           # virtualization
-          virt-viewer bottles wineWowPackages.stagingFull genymotion playonlinux
+          bottles wineWowPackages.stagingFull
           # media
           nur-xddxdd.svp
           # for kdenlive auto subtitle
           openai-whisper
-        ]
-          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
-            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
+        ];
         _pythonPackages = [(pythonPackages: with pythonPackages;
         [
-          phonopy scipy scikit-learn jupyterlab autograd inputs.pkgs.localPackages.phono3py
-          tensorflow keras
-          # for phonopy
-          inputs.pkgs.localPackages.spectroscopy numpy 
+          scipy scikit-learn jupyterlab autograd numpy 
         ])];
       };
       user.sharedModules =
@@ -105,9 +85,15 @@ inputs:
                   inherit (inputs.topInputs) nixos-wallpaper;
                   isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
                     [ "png" "jpg" "jpeg" "webp" ];
+                  listDirRecursive =
+                    let listDir = dir:
+                      if dir.value == "directory" then builtins.concatLists
+                        (builtins.map (f: listDir f) (inputs.localLib.attrsToList (builtins.readDir dir.name)))
+                      else [ dir ];
+                    in dir: listDir { name = dir; value = "directory"; };
                 in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
                   (builtins.filter (f: (isPicture f.name) && (f.value == "regular"))
-                    (inputs.localLib.attrsToList (builtins.readDir nixos-wallpaper))));
+                    (listDirRecursive nixos-wallpaper)));
             };
             powerdevil =
               let config =
@@ -134,9 +120,7 @@ inputs:
       wireshark = { enable = true; package = inputs.pkgs.wireshark; };
       yubikey-touch-detector.enable = true;
       kdeconnect.enable = true;
-      anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
-      honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
-      sleepy-launcher = { enable = true; package = inputs.pkgs.sleepy-launcher; };
+      kde-pim = { enable = true; kmail = true; };
     };
     services.pcscd.enable = true;
   };

modules/packages/firefox.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.firefox = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) firefox; in inputs.lib.mkIf (firefox != null)
   {
@@ -12,11 +12,10 @@ inputs:
     {
       enable = true;
       languagePacks = [ "zh-CN" "en-US" ];
-      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator firefoxpwa ];
+      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator ];
     };
     nixos =
     {
-      packages.packages._packages = [ inputs.pkgs.firefoxpwa ];
       user.sharedModules =
       [{
         config =
@@ -25,7 +24,7 @@ inputs:
           {
             enable = true;
             nativeMessagingHosts = with inputs.pkgs;
-              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
+              [ kdePackages.plasma-browser-integration uget-integrator ];
             # TODO: use fixed-version of plugins
             policies.DefaultDownloadDirectory = "\${home}/Downloads";
             profiles.default =
@@ -33,8 +32,8 @@ inputs:
               extensions.packages = with inputs.pkgs.firefox-addons;
               [
                 tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
-                metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
-                wappalyzer grammarly plasma-integration zotero-connector pwas-for-firefox smartproxy kiss-translator
+                metamask pakkujs rsshub-radar rsspreview tabliss tree-style-tab ublock-origin
+                wappalyzer grammarly plasma-integration zotero-connector smartproxy kiss-translator
               ];
               search = { default = "google"; force = true; };
               userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";

modules/packages/flatpak.nix

@@ -1,12 +0,0 @@
-inputs:
-{
-  options.nixos.packages.flatpak = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-  };
-  config = let inherit (inputs.config.nixos.packages) flatpak; in inputs.lib.mkIf (flatpak != null)
-  {
-    services.flatpak = { enable = true; uninstallUnmanaged = true; };
-  };
-}

modules/packages/lammps.nix

@@ -1,22 +1,23 @@
 inputs:
 {
   options.nixos.packages.lammps = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
   {
-    nixos.packages.packages._packages =
-      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
-      in
-        if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
-          .overrideAttrs (prev:
-          {
-            cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
-            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
-            buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
-          }))]
-        else [ inputs.pkgs.lammps-mpi ];
+    nixos.packages =
+    {
+      molecule = {};
+      packages._packages =
+        let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
+        in
+          if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
+            .overrideAttrs (prev:
+            {
+              cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
+              nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
+              buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
+            }))]
+          else [ inputs.pkgs.lammps-mpi ];
+    };
   };
 }

modules/packages/mathematica.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
     { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; };
 }

modules/packages/minimal.nix

@@ -1,16 +1,16 @@
 inputs:
 {
-  options.nixos.packages.server = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.packages.minimal = let inherit (inputs.lib) mkOption types; in mkOption
     { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) server; in inputs.lib.mkIf (server != null)
+  config = let inherit (inputs.config.nixos.packages) minimal; in inputs.lib.mkIf (minimal != null)
   {
     nixos.packages.packages =
     {
       _packages = with inputs.pkgs;
       [
         # basic tools
-        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq zellij ipfetch localPackages.pslist
-        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty
+        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq ipfetch localPackages.pslist
+        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty glib
         # lsxx
         pciutils usbutils lshw util-linux lsof dmidecode lm_sensors hwloc acpica-tools
         # top
@@ -24,7 +24,7 @@ inputs:
         # compress
         pigz upx unzip zip lzip p7zip rar
         # file system management
-        sshfs e2fsprogs duperemove compsize exfatprogs
+        sshfs e2fsprogs compsize exfatprogs
         # disk management
         smartmontools hdparm gptfdisk megacli
         # encryption and authentication
@@ -39,16 +39,9 @@ inputs:
         # stupid things
         toilet lolcat localPackages.stickerpicker graph-easy
         # office
-        pdfgrep ffmpeg-full hdf5 # todo-txt-cli
+        pdfgrep ffmpeg-full hdf5
       ]
         ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
-      _pythonPackages = [(pythonPackages: with pythonPackages;
-      [
-        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
-        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus odfpy
-        # for vasp plot-workfunc.py
-        ase
-      ])];
     };
     programs =
     {

modules/packages/molecule.nix

@@ -0,0 +1,20 @@
+inputs:
+{
+  options.nixos.packages.molecule = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) molecule; in inputs.lib.mkIf (molecule != null)
+  {
+    nixos.packages.packages =
+    {
+      _packages = with inputs.pkgs;
+        [ ovito localPackages.vesta localPackages.v-sim localPackages.ufo inputs.pkgs.pkgs-2311.hdfview ];
+      _pythonPackages = [(pythonPackages: with pythonPackages;
+      [
+        phonopy inputs.pkgs.localPackages.phono3py
+      ])];
+    };
+  };
+}

modules/packages/mumax.nix

@@ -1,14 +1,7 @@
 inputs:
 {
   options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default =
-      if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
-        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
-      then {}
-      else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
   {
     nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];

modules/packages/nushell.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.nushell = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = {};
-  };
+    { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.packages) nushell; in inputs.lib.mkIf (nushell != null)
   {
     nixos =

modules/packages/steam.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.steam = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) steam; in inputs.lib.mkIf (steam != null)
   {

modules/packages/vasp.nix

@@ -1,25 +1,23 @@
 inputs:
 {
   options.nixos.packages.vasp = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    # default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-    # TODO: fix vasp
-    default = null;
-  };
-  # TODO: add more options to correctly configure VASP
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
   {
-    nixos.packages.packages = with inputs.pkgs;
+    nixos.packages =
     {
-      _packages =
-      (
-        [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
-          ++ (inputs.lib.optional
-            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
-            localPackages.vasp.nvidia)
-      );
-      _pythonPackages = [(_: [ localPackages.py4vasp ])];
+      molecule = {};
+      packages = with inputs.pkgs;
+      {
+        _packages =
+        (
+          [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
+            ++ (inputs.lib.optional
+              (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+              localPackages.vasp.nvidia)
+        );
+        _pythonPackages = [(_: [ localPackages.py4vasp ])];
+      };
     };
   };
 }

modules/packages/vscode.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.vscode = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) vscode; in inputs.lib.mkIf (vscode != null)
   {
@@ -18,9 +18,15 @@ inputs:
               (set:
               {
                 name = set;
-                value = vscode-extensions.${set} or {}
-                  // nix-vscode-extensions.vscode-marketplace.${set}
-                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {};
+                value =
+                  # provided by nixpkgs
+                  vscode-extensions.${set} or {}
+                  # provided by nix-vscode-extensions, including pre-release versions, but prefer stable version
+                  // nix-vscode-extensions.vscode-marketplace.${set} or {}
+                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {}
+                  # some versions are too high for the current vscode, use old version from here to override it
+                  // (nix-vscode-extensions.forVSCodeVersion inputs.pkgs.vscode.version)
+                    .vscode-marketplace-release.${set} or {};
               })
               (inputs.lib.unique
               (
@@ -29,7 +35,7 @@ inputs:
                   ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace-release)
               )));
             in with extensions;
-              (with github; [ copilot github-vscode-theme ])
+              (with github; [ copilot copilot-chat github-vscode-theme ])
               ++ (with intellsmi; [ comment-translate ])
               ++ (with ms-vscode; [ cmake-tools cpptools-extension-pack hexeditor remote-explorer ])
               ++ (with ms-vscode-remote; [ remote-ssh ])

modules/packages/winapps/default.nix

@@ -1,47 +0,0 @@
-inputs:
-{
-  options.nixos.packages.winapps = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-  };
-  config = let inherit (inputs.config.nixos.packages) winapps; in inputs.lib.mkIf (winapps != null)
-  {
-    nixos.packages.packages._packages =
-    [
-      (inputs.pkgs.callPackage "${inputs.topInputs.winapps}/packages/winapps" {})
-      (inputs.pkgs.runCommand "winapps-windows" {}
-      ''
-        mkdir -p $out/share/applications
-        cp ${inputs.pkgs.replaceVars ./windows.desktop { path = inputs.topInputs.winapps; }} \
-          $out/share/applications/windows.desktop
-      '')
-    ]
-      ++ builtins.map
-        (p: inputs.pkgs.runCommand "winapps-${p}" {}
-        ''
-          mkdir -p $out/share/applications
-          source ${inputs.topInputs.winapps}/apps/${p}/info
-          # replace \ with \\
-          WIN_EXECUTABLE=$(echo $WIN_EXECUTABLE | sed 's/\\/\\\\/g')
-          # replace space with \s
-          WIN_EXECUTABLE=$(echo $WIN_EXECUTABLE | sed 's/ /\\s/g')
-          cat > $out/share/applications/${p}.desktop << EOF
-          [Desktop Entry]
-          Name=$NAME
-          Exec=winapps manual "$WIN_EXECUTABLE" %F
-          Terminal=false
-          Type=Application
-          Icon=${inputs.topInputs.winapps}/apps/${p}/icon.svg
-          StartupWMClass=$FULL_NAME
-          Comment=$FULL_NAME
-          Categories=$CATEGORIES
-          MimeType=$MIME_TYPES
-          EOF
-        '')
-        [
-          "access-o365" "acrobat-x-pro" "cmd" "excel-o365" "explorer" "illustrator-cc" "powerpoint-o365"
-          "visual-studio-comm" "word-o365"
-        ];
-  };
-}

modules/packages/winapps/windows.desktop

@@ -1,9 +0,0 @@
-[Desktop Entry]
-Name=Windows
-Exec=winapps windows %F
-Terminal=false
-Type=Application
-Icon=@path@/icons/windows.svg
-StartupWMClass=Micorosoft Windows
-Comment=Micorosoft Windows
-Categories=Windows

modules/packages/zellij.nix

@@ -0,0 +1,17 @@
+inputs:
+{
+  options.nixos.packages.zellij = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) zellij; in inputs.lib.mkIf (zellij != null)
+  {
+    nixos =
+    {
+      packages.packages._packages = [ inputs.pkgs.zellij ];
+      user.sharedModules =
+      [{
+        config.programs.zellij =
+          { enable = true; settings = { show_startup_tips = false; show_release_notes = false; }; };
+      }];
+    };
+  };
+}

modules/packages/zsh/default.nix

@@ -4,85 +4,71 @@ inputs:
     { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.packages) zsh; in inputs.lib.mkIf (zsh != null)
   {
-    nixos.user.sharedModules = [(home-inputs: { config.programs = inputs.lib.mkMerge
-    [
-      # general config
-      {
-        zsh =
+    nixos.user.sharedModules = [(home-inputs:
+    {
+      config = inputs.lib.mkMerge
+      [
         {
-          enable = true;
-          history =
-          {
-            path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
-            extended = true;
-            save = 100000000;
-            size = 100000000;
-          };
-          syntaxHighlighting.enable = true;
-          autosuggestion.enable = true;
-          enableCompletion = true;
-          oh-my-zsh =
+          programs.zsh =
           {
             enable = true;
-            plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
-            theme = inputs.lib.mkDefault "clean";
+            history =
+            {
+              path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
+              extended = true;
+              save = 100000000;
+              size = 100000000;
+            };
+            syntaxHighlighting.enable = true;
+            autosuggestion.enable = true;
+            enableCompletion = true;
+            oh-my-zsh =
+            {
+              enable = true;
+              plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
+              theme = inputs.lib.mkDefault "clean";
+            };
+            # ensure ~/.zlogin exists
+            loginExtra = " ";
           };
-          # ensure ~/.zlogin exists
-          loginExtra = " ";
-        };
-        # set bash history file path, avoid overwriting zsh history
-        bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
-      }
-      # config for root and chn
-      {
-        zsh = inputs.lib.mkIf (builtins.elem home-inputs.config.home.username [ "chn" "root" "aleksana" "alikia" ])
+          home.shell.enableZshIntegration = true;
+        }
         {
-          plugins =
-          [
+          programs.zsh = inputs.lib.mkIf
+            (builtins.elem home-inputs.config.home.username [ "chn" "root" "aleksana" "alikia" ])
             {
-              file = "powerlevel10k.zsh-theme";
-              name = "powerlevel10k";
-              src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
-            }
-            { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
-            {
-              name = "zsh-lsd";
-              src = inputs.pkgs.fetchFromGitHub
-              {
-                owner = "z-shell";
-                repo = "zsh-lsd";
-                rev = "65bb5ac49190beda263aae552a9369127961632d";
-                hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
-              };
-            }
-          ];
-          initContent = inputs.lib.mkOrder 550
-          ''
-            # p10k instant prompt
-            P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
-            [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
-            HYPHEN_INSENSITIVE="true"
-            export PATH=~/bin:$PATH
-            function br
-            {
-              local cmd cmd_file code
-              cmd_file=$(mktemp)
-              if broot --outcmd "$cmd_file" "$@"; then
-                cmd=$(<"$cmd_file")
-                command rm -f "$cmd_file"
-                eval "$cmd"
-              else
-                code=$?
-                command rm -f "$cmd_file"
-                return "$code"
-              fi
-            }
-            alias todo="todo.sh"
-          '';
-          oh-my-zsh.theme = "";
-        };
-      }
-    ];})];
+              plugins =
+              [
+                {
+                  file = "powerlevel10k.zsh-theme";
+                  name = "powerlevel10k";
+                  src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
+                }
+                { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
+                {
+                  name = "zsh-lsd";
+                  src = inputs.pkgs.fetchFromGitHub
+                  {
+                    owner = "z-shell";
+                    repo = "zsh-lsd";
+                    rev = "65bb5ac49190beda263aae552a9369127961632d";
+                    hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
+                  };
+                }
+              ];
+              initContent = inputs.lib.mkOrder 550
+              ''
+                # p10k instant prompt
+                P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
+                [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
+                HYPHEN_INSENSITIVE="true"
+                export PATH=~/bin:$PATH
+              '';
+              oh-my-zsh.theme = "";
+            };
+        }
+      ];
+    })];
     environment.pathsToLink = [ "/share/zsh" ];
     programs.zsh.enable = true;
   };

modules/services/btrbk.nix

@@ -1,45 +0,0 @@
-inputs:
-{
-  options.nixos.services.btrbk = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.listOf types.nonEmptyStr; default = []; };
-  config = let inherit (inputs.config.nixos.services) btrbk; in inputs.lib.mkMerge
-  [
-    {
-      services.btrbk.sshAccess =
-      [{
-        key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6VCXHvPZO7tB0Xo2VNEXkaijWCDxVIpfSuz8OrcUfU btrbk";
-        roles = [ "source" "info" ];
-      }];
-    }
-    (inputs.lib.mkIf (btrbk != [])
-    {
-      services.btrbk =
-      {
-        ioSchedulingClass = "idle";
-        instances = builtins.listToAttrs (builtins.map
-          (host:
-          {
-            name = host;
-            value =
-            {
-              onCalendar = "*-*-* 4:00:00";
-              settings =
-              {
-                timestamp_format = "short";
-                snapshot_dir = "/nix/btrbk/snapshot";
-                snapshot_preserve_min = "1w";
-                target_preserve_min = "1m";
-                ssh_user = "btrbk";
-                ssh_identity = inputs.config.sops.secrets.btrbk.path;
-                volume."ssh://${host}.chn.moe/nix" = { subvolume.persistent= {}; target = "/nix/btrbk/${host}"; };
-              };
-            };
-          })
-          btrbk);
-      };
-      sops.secrets.btrbk.owner = "btrbk";
-      systemd.timers = builtins.listToAttrs (builtins.map
-        (host: { name = "btrbk-${host}"; value.timerConfig.RandomizedDelaySec = 7200; }) btrbk);
-    })
-  ];
-}

modules/services/docker.nix

@@ -21,6 +21,7 @@ inputs:
           dns = [ "1.1.1.1" ];
           # prevent create btrfs subvol
           storage-driver = "overlay2";
+          live-restore = true;
         };
       };
     };

modules/services/freshrss.nix

@@ -1,52 +1,33 @@
 inputs:
 {
-  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) freshrss;
-      inherit (inputs.lib) mkIf;
-    in mkIf freshrss.enable
+    type = types.nullOr (types.submodule { options =
     {
-      services.freshrss =
-      {
-        enable = true;
-        baseUrl = "https://${freshrss.hostname}";
-        defaultUser = "chn";
-        passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
-        database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
-        virtualHost = null;
-      };
-      sops.secrets =
-      {
-        "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
-        "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
-      };
-      systemd.services.freshrss-config.after = [ "mysql.service" ];
-      nixos.services =
-      {
-        mariadb = { enable = true; instances.freshrss = {}; };
-        nginx.https.${freshrss.hostname} =
-        {
-          location =
-          {
-            "/".static =
-            {
-              root = "${inputs.pkgs.freshrss}/p";
-              index = [ "index.php" ];
-              tryFiles = [ "$uri" "$uri/" "$uri/index.php" ];
-            };
-            "~ ^.+?\.php(/.*)?$".php =
-            {
-              root = "${inputs.pkgs.freshrss}/p";
-              fastcgiPass =
-                "unix:${inputs.config.services.phpfpm.pools.${inputs.config.services.freshrss.pool}.socket}";
-            };
-          };
-        };
-      };
+      hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) freshrss; in inputs.lib.mkIf (freshrss != null)
+  {
+    services.freshrss =
+    {
+      enable = true;
+      baseUrl = "https://${freshrss.hostname}";
+      defaultUser = "chn";
+      passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
+      database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
     };
+    sops.secrets =
+    {
+      "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
+      "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
+    };
+    systemd.services.freshrss-config.after = [ "mysql.service" ];
+    nixos.services =
+    {
+      mariadb = { enable = true; instances.freshrss = {}; };
+      nginx.https.${freshrss.hostname}.global.configName = "freshrss";
+    };
+  };
 }

modules/services/fz-new-order/default.nix

@@ -1,99 +0,0 @@
-inputs:
-{
-  options.nixos.services.fz-new-order = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) fz-new-order; in inputs.lib.mkIf (fz-new-order != null)
-  {
-    users =
-    {
-      users.fz-new-order =
-      {
-        uid = inputs.config.nixos.user.uid.fz-new-order;
-        group = "fz-new-order";
-        home = "/var/lib/fz-new-order";
-        createHome = true;
-        isSystemUser = true;
-      };
-      groups.fz-new-order.gid = inputs.config.nixos.user.gid.fz-new-order;
-    };
-    systemd =
-    {
-      timers.fz-new-order =
-      {
-        wantedBy = [ "timers.target" ];
-        timerConfig = { OnBootSec = "10m"; OnUnitActiveSec = "10m"; Unit = "fz-new-order.service"; };
-      };
-      services.fz-new-order = rec
-      {
-        description = "fz-new-order";
-        after = [ "network.target" ];
-        requires = after;
-        serviceConfig =
-        {
-          User = inputs.config.users.users."fz-new-order".name;
-          Group = inputs.config.users.users."fz-new-order".group;
-          WorkingDirectory = "/var/lib/fz-new-order";
-          ExecStart =
-            let
-              src = inputs.pkgs.replaceVars ./main.cpp
-                { config_file = inputs.config.sops.templates."fz-new-order/config.json".path; };
-              binary = inputs.pkgs.stdenv.mkDerivation
-              {
-                name = "fz-new-order";
-                inherit src;
-                buildInputs = with inputs.pkgs; [ jsoncpp.dev cereal fmt httplib ];
-                dontUnpack = true;
-                buildPhase =
-                ''
-                  runHook preBuild
-                  g++ -std=c++20 -O2 -o fz-new-order ${src} -ljsoncpp -lfmt
-                  runHook postBuild
-                '';
-                installPhase =
-                ''
-                  runHook preInstall
-                  mkdir -p $out/bin
-                  cp fz-new-order $out/bin/fz-new-order
-                  runHook postInstall
-                '';
-              };
-            in "${binary}/bin/fz-new-order";
-        };
-      };
-      tmpfiles.rules =
-      [
-        "d /var/lib/fz-new-order 0700 fz-new-order fz-new-order"
-        "Z /var/lib/fz-new-order - fz-new-order fz-new-order"
-      ];
-    };
-    sops = let userNum = 5; configNum = 2; in
-    {
-      templates."fz-new-order/config.json" =
-      {
-        owner = inputs.config.users.users."fz-new-order".name;
-        group = inputs.config.users.users."fz-new-order".group;
-        content = let placeholder = inputs.config.sops.placeholder; in builtins.toJSON
-        {
-          token = placeholder."fz-new-order/token";
-          uids = builtins.map (j: placeholder."fz-new-order/uids/user${builtins.toString j}")
-            (builtins.genList (n: n) userNum);
-          config = builtins.map
-            (i: builtins.listToAttrs (builtins.map
-              (attrName: { name = attrName; value = placeholder."fz-new-order/config${toString i}/${attrName}"; })
-              [ "username" "password" "comment" ]))
-            (builtins.genList (n: n) configNum);
-        };
-      };
-      secrets =
-        { "fz-new-order/token" = {}; }
-        // (builtins.listToAttrs (builtins.map
-          (i: { name = "fz-new-order/uids/user${toString i}"; value = {}; })
-          (builtins.genList (n: n) userNum)))
-        // (builtins.listToAttrs (builtins.concatLists (builtins.map
-          (i: builtins.map
-            (attrName: { name = "fz-new-order/config${builtins.toString i}/${attrName}"; value = {}; })
-            [ "username" "password" "comment" ])
-          (builtins.genList (n: n) configNum))));
-    };
-  };
-}

modules/services/fz-new-order/main.cpp

@@ -1,244 +0,0 @@
-# include <iostream>
-# include <set>
-# include <sstream>
-# include <filesystem>
-# include <cereal/types/set.hpp>
-# include <cereal/archives/json.hpp>
-# include <fmt/format.h>
-# include <fmt/ranges.h>
-# include <httplib.h>
-# include <json/json.h>
-
-std::string urlencode(std::string s)
-{
-  auto hexchar = [](unsigned char c, unsigned char &hex1, unsigned char &hex2)
-  {
-    hex1 = c / 16;
-    hex2 = c % 16;
-    hex1 += hex1 <= 9 ? '0' : 'a' - 10;
-    hex2 += hex2 <= 9 ? '0' : 'a' - 10;
-  };
-  const char *str = s.c_str();
-  std::vector<char> v(s.size());
-  v.clear();
-  for (std::size_t i = 0, l = s.size(); i < l; i++)
-  {
-    char c = str[i];
-    if
-    (
-      (c >= '0' && c <= '9')
-        || (c >= 'a' && c <= 'z')
-        || (c >= 'A' && c <= 'Z')
-        || c == '-' || c == '_' || c == '.' || c == '!' || c == '~'
-        || c == '*' || c == '\'' || c == '(' || c == ')'
-    )
-      v.push_back(c);
-    else
-    {
-      v.push_back('%');
-      unsigned char d1, d2;
-      hexchar(c, d1, d2);
-      v.push_back(d1);
-      v.push_back(d2);
-    }
-  }
-  return std::string(v.cbegin(), v.cend());
-}
-
-void oneshot
-(
-  const std::string& username, const std::string& password, const std::string& comment,
-  const std::set<std::string>& wxuser, const std::string& token
-)
-{
-  httplib::Client fzclient("http://scmv9.fengzhansy.com:8882");
-  httplib::Client wxclient("http://wxpusher.zjiecode.com");
-  auto& log = std::clog;
-
-  try
-  {
-    // get JSESSIONID
-    auto cookie_jsessionid = [&]() -> std::string
-    {
-      log << "get /scmv9/login.jsp\n";
-      auto result = fzclient.Get("/scmv9/login.jsp");
-      if (result.error() != httplib::Error::Success)
-        throw std::runtime_error("request failed");
-      auto it = result.value().headers.find("Set-Cookie");
-      if (it == result.value().headers.end() || it->first != "Set-Cookie")
-        throw std::runtime_error("find cookie failed");
-      log << fmt::format("set_cookie JSESSIONID {}\n", it->second.substr(0, it->second.find(';')));
-      return it->second.substr(0, it->second.find(';'));
-    }();
-
-    // login
-    auto cookie_pppp = [&]() -> std::string
-    {
-      auto body = fmt::format("method=dologinajax&rand=1234&userc={}&mdid=P&passw={}", username, password);
-      httplib::Headers headers =
-      {
-        { "X-Requested-With", "XMLHttpRequest" },
-        {
-          "User-Agent",
-          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
-        },
-        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
-        { "Origin", "http://scmv9.fengzhansy.com:8882" },
-        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/login.jsp" },
-        { "Cookie", cookie_jsessionid }
-      };
-      log << "post /scmv9/data.jsp\n";
-      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
-      if (result.error() != httplib::Error::Success)
-        throw std::runtime_error("request failed");
-      log << fmt::format("set_cookie pppp {}\n", fmt::format("pppp={}%40{}", username, password));
-      return fmt::format("pppp={}%40{}", username, password);
-    }();
-
-    // get order list
-    auto order_list = [&]() -> std::map<std::string, std::pair<std::string, std::string>>
-    {
-      auto body = fmt::format("method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=dd_qry&nv%5B%5D=bill&nv%5B%5D=&nv%5B%5D=storeid&nv%5B%5D=&nv%5B%5D=vendorid&nv%5B%5D={}&nv%5B%5D=qr_status&nv%5B%5D=&nv%5B%5D=ddprt&nv%5B%5D=%25&nv%5B%5D=fdate&nv%5B%5D=&nv%5B%5D=tdate&nv%5B%5D=&nv%5B%5D=shfdate&nv%5B%5D=&nv%5B%5D=shtdate&nv%5B%5D=&nv%5B%5D=fy_pno&nv%5B%5D=1&nv%5B%5D=fy_psize&nv%5B%5D=10", username);
-      httplib::Headers headers =
-      {
-        { "X-Requested-With", "XMLHttpRequest" },
-        {
-          "User-Agent",
-          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
-        },
-        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
-        { "Origin", "http://scmv9.fengzhansy.com:8882"
-        },
-        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
-        { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
-      };
-      log << "post /scmv9/data.jsp\n";
-      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
-      if (result.error() != httplib::Error::Success)
-        throw std::runtime_error("request failed");
-      log << fmt::format("get result {}\n", result.value().body);
-      std::stringstream result_body(result.value().body);
-      Json::Value root;
-      result_body >> root;
-      std::map<std::string, std::pair<std::string, std::string>> orders;
-      for (unsigned i = 0; i < root["dt"][1].size(); i++)
-      {
-        log << fmt::format
-        (
-          "insert order {} {} {}\n", root["dt"][1][i].asString(), root["dt"][2][i].asString(),
-          root["dt"][4][i].asString()
-        );
-        orders.insert({root["dt"][1][i].asString(), {root["dt"][2][i].asString(), root["dt"][4][i].asString()}});
-      }
-      return orders;
-    }();
-
-    // read order old
-    auto order_old = [&]() -> std::set<std::string>
-    {
-      if (!std::filesystem::exists("orders.json"))
-        return {};
-      else
-      {
-        std::ifstream ins("orders.json");
-        cereal::JSONInputArchive ina(ins);
-        std::set<std::string> data;
-        cereal::load(ina, data);
-        return data;
-      }
-    }();
-
-    // push new order info
-    for (const auto& order : order_list)
-      if (!order_old.contains(order.first))
-      {
-        auto body = fmt::format
-        (
-          "method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=ddsp_qry&nv%5B%5D=bill&nv%5B%5D={}",
-          order.first
-        );
-        httplib::Headers headers =
-        {
-          { "X-Requested-With", "XMLHttpRequest" },
-          {
-            "User-Agent",
-            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
-          },
-          { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
-          { "Origin", "http://scmv9.fengzhansy.com:8882" },
-          { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
-          { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
-        };
-        log << "post /scmv9/data.jsp\n";
-        auto result = fzclient.Post
-          ("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
-        if (result.error() != httplib::Error::Success)
-          throw std::runtime_error("request failed");
-        log << fmt::format("get result {}\n", result.value().body);
-        std::stringstream result_body(result.value().body);
-        Json::Value root;
-        result_body >> root;
-
-        std::stringstream push_body;
-        double all_cost = 0;
-        push_body << fmt::format
-        (
-          "{} {} {}店\n", comment, order.second.second.substr(order.second.second.find('-') + 1),
-          order.second.first.substr(1, 2)
-        );
-        for (unsigned i = 0; i < root["dt"][6].size(); i++)
-        {
-          push_body << fmt::format
-          (
-            "{} {}{}\n", root["dt"][6][i].asString().substr(root["dt"][6][i].asString().length() - 4),
-            root["dt"][7][i].asString(), root["dt"][5][i].asString()
-          );
-          // 订货金额 maybe empty ???
-          if (root["dt"][10][i].asString() != "")
-            all_cost += std::stod(root["dt"][10][i].asString());
-        }
-        push_body << fmt::format("共{:.2f}元\n", all_cost);
-        log << fmt::format("push to wx {}\n", push_body.str());
-        auto encoded = urlencode(push_body.str());
-            
-        for (const auto& wxu : wxuser)
-        {
-          auto path = fmt::format
-            ("/api/send/message/?appToken={}&content={}&uid={}", token, encoded, wxu);
-          auto wxresult = wxclient.Get(path.c_str());
-        }
-      }
-
-    // save data
-    {
-      for (const auto& order : order_list)
-        if (!order_old.contains(order.first))
-          order_old.insert(order.first);
-      std::ofstream os("orders.json");
-      cereal::JSONOutputArchive oa(os);
-      cereal::save(oa, order_old);
-    }
-  }
-  catch (const std::exception& ex)
-  {
-    log << ex.what() << "\n" << std::flush;
-    std::terminate();
-  }
-}
-
-int main(int argc, char** argv)
-{
-  Json::Value configs;
-  std::ifstream("@config_file@") >> configs;
-  auto config_uids = configs["uids"];
-  std::set<std::string> uids;
-  for (auto& uid : config_uids)
-    uids.insert(uid.asString());
-  for (auto& config : configs["config"])
-    oneshot
-    (
-      config["username"].asString(), config["password"].asString(), config["comment"].asString(),
-      uids, configs["token"].asString()
-    );
-}
-

modules/services/gamemode.nix

@@ -1,30 +0,0 @@
-inputs:
-{
-  options.nixos.services.gamemode = let inherit (inputs.lib) mkOption types; in
-  {
-    enable = mkOption { type = types.bool; default = false; };
-    drmDevice = mkOption { type = types.int; };
-  };
-  config = let inherit (inputs.config.nixos.services) gamemode; in inputs.lib.mkIf gamemode.enable
-  {
-    programs.gamemode =
-    {
-      enable = true;
-      settings =
-      {
-        general.renice = 10;
-        gpu =
-        {
-          apply_gpu_optimisations = "accept-responsibility";
-          nv_powermizer_mode = 1;
-          gpu_device = builtins.toString gamemode.drmDevice;
-        };
-        custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
-        {
-          start = "${notify-send} 'GameMode started'";
-          end = "${notify-send} 'GameMode ended'";
-        };
-      };
-    };
-  };
-}

modules/services/gitea.nix

@@ -45,6 +45,8 @@ inputs:
         };
         service.DISABLE_REGISTRATION = true;
         security.LOGIN_REMEMBER_DAYS = 365;
+        "git.timeout" = builtins.listToAttrs (builtins.map (n: { name = n; value = 1800; })
+          [ "DEFAULT" "MIGRATE" "MIRROR" "CLONE" "PULL" "GC" ]);
       };
     };
     nixos.services =

modules/services/kvm.nix

@@ -43,7 +43,7 @@ inputs:
     {
       persistence."/nix/nodatacow".directories = inputs.lib.mkIf kvm.nodatacow
         [{ directory = "/var/lib/libvirt/images"; mode = "0711"; }];
-      systemPackages = with inputs.pkgs; [ qemu_full win-spice guestfs-tools virt-manager ];
+      systemPackages = with inputs.pkgs; [ qemu_full win-spice guestfs-tools virt-manager virt-viewer ];
     };
     systemd =
     {

modules/services/lumericalLicenseManager/Dockerfile

@@ -1,24 +0,0 @@
-# 大概这样做：
-# cp ~/repo/stuff/44/xxxx/{LicenseManager,Crack,License} .
-# sed -i s/xxxx/000123456789/ License/license.txt
-# docker build . -t lumericallicensemanager:2023r1
-# docker image save > image.tar
-# nix store add-file ./image.tar --name lumericalLicenseManager.tar
-# nix hash file /nix/store/g9f9xjfkvp1kbarz19i6qw7i9fg9pagx-lumericalLicenseManager.tar
-
-FROM centos:7
-
-USER root
-
-COPY ./LicenseManager /tmp/LicenseManager
-RUN chmod +x /tmp/LicenseManager/INSTALL && \
-  /tmp/LicenseManager/INSTALL -silent -install_dir /home/ansys_inc -lm && \
-  rm -rf /tmp/LicenseManager
-COPY ./Crack/ansys_inc/ /home/ansys_inc
-RUN sed -i "s|127.0.0.1|0.0.0.0|g" /home/ansys_inc/shared_files/licensing/tools/tomcat/conf/server.xml
-RUN chmod -R 777 /home/ansys_inc
-RUN ln -s ld-linux-x86-64.so.2 /lib64/ld-lsb-x86-64.so.3
-COPY ./License/license.txt /home/ansys_inc/shared_files/licensing/license_files/ansyslmd.lic
-
-WORKDIR /home/ansys_inc/shared_files/licensing
-CMD ["/bin/sh", "-c", "(./start_ansysli &); (./start_lmcenter &); tail -f /dev/null"]

modules/services/lumericalLicenseManager/default.nix

@@ -1,17 +0,0 @@
-inputs:
-{
-  options.nixos.services.lumericalLicenseManager = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) lumericalLicenseManager;
-    in inputs.lib.mkIf (lumericalLicenseManager != null)
-  {
-    virtualisation.oci-containers.containers.lumericalLicenseManager =
-    {
-      image = "lumericallicensemanager:2023r1";
-      imageFile = inputs.topInputs.self.src.lumerical.licenseManagerImage;
-      ports = [ "127.0.0.1:1084:1084/tcp" "127.0.0.1:1055:1055/tcp" "127.0.0.1:2325:2325/tcp" ];
-      extraOptions = [ "--mac-address=00:01:23:45:67:89" ];
-    };
-    nixos.services.docker = {};
-  };
-}

modules/services/nextcloud.nix

@@ -16,7 +16,7 @@ inputs:
       hostName = nextcloud.hostname;
       appstoreEnable = false;
       https = true;
-      package = inputs.pkgs.nextcloud30;
+      package = inputs.pkgs.nextcloud31;
       maxUploadSize = "10G";
       config =
       {
@@ -57,7 +57,7 @@ inputs:
           };
         in builtins.listToAttrs (builtins.map
           (package: { name = package; value = inputs.pkgs.fetchNextcloudApp (getInfo package); })
-          [ "maps" "phonetrack" "twofactor_webauthn" "calendar" ]);
+          [ "phonetrack" "twofactor_webauthn" "calendar" ]);
     };
     nixos.services =
     {

modules/services/nginx/applications/sticker.nix

@@ -11,7 +11,7 @@ inputs:
         mkdir -p $out
         cp -r ${inputs.topInputs.stickerpicker}/web/* $out
         chmod -R +w $out
-        cp -r ${./web}/* $out
+        cp -r ${inputs.topInputs.sticker}/web/* $out
       '');
       index = [ "index.html" ];
     };

modules/services/nginx/applications/sticker/.gitignore

@@ -1,2 +0,0 @@
-/config.json
-/sticker-import.session

modules/services/nginx/applications/sticker/web/packs/index.json

@@ -1,19 +0,0 @@
-{
-  "packs": [
-    "Mare_by_WuMingv2Bot.json",
-    "line_191054124446_by_moe_sticker_bot.json",
-    "Sakurada_Shiro.json",
-    "loli_DaiSi_by_WuMingv2Bot.json",
-    "listentoweiwei_by_WuMingv2Bot.json",
-    "csaexi.json",
-    "wechat_transfer_zhcn.json",
-    "teamtimothy_bilibili.json",
-    "line26158619ac0d_by_moe_sticker_bot.json",
-    "LINE_nachonekodayo.json",
-    "zhehelima.json",
-    "TheDonaldTrump.json",
-    "line_173195293297_by_moe_sticker_bot.json",
-    "line261586194a0d_by_moe_sticker_bot.json"
-  ],
-  "homeserver_url": "https://matrix.chn.moe"
-}

modules/services/nginx/default.nix

@@ -362,41 +362,17 @@ inputs:
             access_log syslog:server=unix:/dev/log transparent_proxy;
           }
         '';
+        # TODO: use existing options
         systemd.services.nginx-proxy =
           let
             ip = "${inputs.pkgs.iproute2}/bin/ip";
-            nft = "${inputs.pkgs.nftables}/bin/nft";
-            nftConfigFile = inputs.pkgs.writeText "nginx.nft"
-            ''
-              table inet nginx {
-                chain output {
-                  type route hook output priority mangle; policy accept;
-                  # 由本机发出、gid 为 nginx、但源地址不是本地监听的地址，说明是透明代理的第一个包，将这个流标记
-                  # 但这个包本身不需要处理，正常路由即可。
-                  meta skgid ${builtins.toString inputs.config.users.groups.nginx.gid} fib saddr type != local \
-                    ct state new counter ct mark set ct mark | 2
-                  # 由本机发出、作为透明代理的回复，它不能按照通常的路由，它需要被打上标记并被路由到本地
-                  # 这对应于透明代理到本地的服务的情况
-                  ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
-                  return
-                }
-                # 还需要处理透明代理到其它机器的情况，它们的回复需要在 prerouting 中标记
-                chain prerouting {
-                  type filter hook prerouting priority mangle; policy accept;
-                  ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
-                  return
-                }
-              }
-            '';
             start = inputs.pkgs.writeShellScript "nginx-proxy.start"
             ''
-              ${nft} -f ${nftConfigFile}
               ${ip} rule add fwmark 2/2 table 200
               ${ip} route add local 0.0.0.0/0 dev lo table 200
             '';
             stop = inputs.pkgs.writeShellScript "nginx-proxy.stop"
             ''
-              ${nft} delete table inet nginx
               ${ip} rule del fwmark 2/2 table 200
               ${ip} route del local 0.0.0.0/0 dev lo table 200
             '';
@@ -414,6 +390,30 @@ inputs:
             wants = [ "network.target" ];
             wantedBy= [ "multi-user.target" ];
           };
+        networking.nftables.tables.nginx =
+        {
+          family = "inet";
+          content =
+          ''
+            chain output {
+              type route hook output priority mangle; policy accept;
+              # 由本机发出、gid 为 nginx、但源地址不是本地监听的地址，说明是透明代理的第一个包，将这个流标记
+              # 但这个包本身不需要处理，正常路由即可。
+              meta skgid ${builtins.toString inputs.config.users.groups.nginx.gid} fib saddr type != local \
+                ct state new counter ct mark set ct mark | 2
+              # 由本机发出、作为透明代理的回复，它不能按照通常的路由，它需要被打上标记并被路由到本地
+              # 这对应于透明代理到本地的服务的情况
+              ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
+              return
+            }
+            # 还需要处理透明代理到其它机器的情况，它们的回复需要在 prerouting 中标记
+            chain prerouting {
+              type filter hook prerouting priority mangle; policy accept;
+              ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
+              return
+            }
+          '';
+        };
       })
       # streamProxy
       {

modules/services/nixseperatedebuginfo.nix

@@ -1,12 +1,9 @@
 inputs:
 {
   options.nixos.services.nixseparatedebuginfo = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config =
-    let inherit (inputs.config.nixos.services) nixseparatedebuginfo; in inputs.lib.mkIf (nixseparatedebuginfo != {})
+    let inherit (inputs.config.nixos.services) nixseparatedebuginfo; in inputs.lib.mkIf (nixseparatedebuginfo != null)
     {
       services.nixseparatedebuginfod.enable = true;
       environment.persistence."/nix/nodatacow".directories =

modules/services/nixvirt.nix

@@ -1,4 +1,3 @@
-# TODO: fix libvirtd network
 inputs:
 {
   options.nixos.services.nixvirt = let inherit (inputs.lib) mkOption types; in mkOption
@@ -19,19 +18,31 @@ inputs:
           {
             uuid = mkOption { type = types.nonEmptyStr; default = defaultUuid; };
             owner = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-            hardware =
+            storage =
             {
-              storage = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-              memoryMB = mkOption { type = types.ints.unsigned; };
-              cpus = mkOption { type = types.ints.unsigned; };
-              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
+              name = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
+              nodatacow = mkOption { type = types.bool; default = false; };
+            };
+            memory =
+            {
+              sizeMB = mkOption { type = types.ints.unsigned; };
+              dedicated = mkOption { type = types.bool; default = false; };
+            };
+            cpu =
+            {
+              count = mkOption { type = types.ints.unsigned; };
+              hyprthread = mkOption { type = types.bool; default = false; };
+              set = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
             };
             network =
             {
-              address = mkOption { type = types.ints.unsigned; };
+              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
+              address = mkOption { type = types.nullOr types.ints.unsigned; default = null; };
+              bridge = mkOption { type = types.bool; default = false; };
               vnc =
               {
-                port = mkOption { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
+                port = mkOption
+                  { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
                 openFirewall = mkOption { type = types.bool; default = true; };
               };
               portForward = rec
@@ -54,6 +65,13 @@ inputs:
   };
   config = let inherit (inputs.config.nixos.services) nixvirt; in inputs.lib.mkIf (nixvirt != null)
   {
+    assertions = builtins.map
+      (vm:
+      {
+        assertion = vm.value.cpu.set != null -> builtins.length vm.value.cpu.set == vm.value.cpu.count;
+        message = "nixvirt.instance.${vm.name}.cpu.set must have the same length as cpu.count";
+      })
+      (inputs.localLib.attrsToList nixvirt.instance);
     virtualisation =
     {
       libvirt =
@@ -63,7 +81,12 @@ inputs:
         connections."qemu:///system" = let inherit (inputs.topInputs.nixvirt) lib; in
         {
           domains = builtins.map
-            (vm: { definition = inputs.config.sops.templates."${vm.name}.xml".path; active = true; restart = false; })
+            (vm:
+            {
+              definition = inputs.config.sops.templates."nixvirt/${vm.name}.xml".path;
+              active = true;
+              restart = false;
+            })
             (inputs.localLib.attrsToList nixvirt.instance);
           networks =
           [{
@@ -74,25 +97,23 @@ inputs:
                 host = builtins.map
                   (vm:
                   {
-                    inherit (vm.hardware) mac;
+                    inherit (vm.network) mac;
                     ip = "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}";
                   })
-                  (builtins.attrValues nixvirt.instance);
+                  (builtins.filter (vm: vm.network.address != null) (builtins.attrValues nixvirt.instance));
               in lib.network.writeXML (base // { ip = base.ip // { dhcp = base.ip.dhcp // { inherit host; }; }; });
             active = true;
+            # never restart the network
+            # when adding a new VM, add dhcp resolve manually, by:
+            # sudo virsh net-update default add ip-dhcp-host "<host mac='' ip='192.168.122.' />" --live
+            restart = false;
           }];
-          pools =
-          [{
-            definition = lib.pool.writeXML
-            {
-              name = "default";
-              uuid = "6fc75fcc-fb95-48b6-8fa4-0e59b6c1b6c7";
-              type = "dir";
-              target.path = "/var/lib/libvirt/images";
-            };
-            active = true;
-            # do not define image here, since it still needs to be created manually
-          }];
+          # do not use it to define disk, since it is not declartive
+          # create disk manually, by:
+          # sudo qemu-img create -f raw /var/lib/libvirt/images/test.img 20G
+          # sudo chown qemu-libvirt:qemu-libvirt /var/lib/libvirt/images/test.img
+          # sudo chmod 600 /var/lib/libvirt/images/test.img
+          pools = [];
         };
       };
       libvirtd.qemu.verbatimConfig =
@@ -128,50 +149,113 @@ inputs:
       templates = builtins.listToAttrs (builtins.map
         (vm:
         {
-          name = "${vm.name}.xml";
-          value.content =
-            let
-              inherit (inputs.topInputs.nixvirt) lib;
-              base = lib.domain.templates.linux
-              {
-                inherit (vm) name;
-                inherit (vm.value) uuid;
-                memory = { count = vm.value.hardware.memoryMB; unit = "MiB"; };
-                storage_vol = { pool = "default"; volume = "${vm.value.hardware.storage}.img"; };
-                install_vol = "${inputs.topInputs.self.src.iso.netboot}";
-                virtio_video = false;
-              };
-            in lib.domain.getXML (base //
+          name = "nixvirt/${vm.name}.xml";
+          value.content = inputs.topInputs.nixvirt.lib.domain.getXML
+          # port from 8bcc23e27a62297254d0e9c87281e650ff777132
+          {
+            inherit (vm) name;
+            inherit (vm.value) uuid;
+            type = "kvm";
+            vcpu = { placement = "static"; count = vm.value.cpu.count; };
+            cputune = inputs.lib.optionalAttrs (vm.value.cpu.set != null)
             {
-              devices =
-                # remove spicevmc, which needs spice
-                (builtins.removeAttrs base.devices [ "channel" "redirdev" "sound" "audio" ])
-                // {
-                  graphics =
-                  {
-                    type = "vnc";
-                    autoport = false;
-                    port = vm.value.network.vnc.port;
-                    listen.type = "address";
-                    passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
-                  };
-                  interface = base.devices.interface // { mac.address = vm.value.hardware.mac; };
-                  disk = builtins.map (disk: disk // { driver = disk.driver // { type = "raw"; }; }) base.devices.disk;
-                };
-              cpu = base.cpu // { topology = { sockets = 1; dies = 1; cores = vm.value.hardware.cpus; threads = 1; };};
-              vcpu = { placement = "static"; count = vm.value.hardware.cpus; };
-              os = (builtins.removeAttrs base.os [ "boot" ]) //
+              vcpupin = builtins.genList
+                (cpu: { vcpu = cpu; cpuset = builtins.elemAt vm.value.cpu.set cpu; })
+                vm.value.cpu.count;
+            };
+            memory =
+            {
+              count = vm.value.memory.sizeMB;
+              unit = "MiB";
+              nosharepages = vm.value.memory.dedicated;
+              locked = vm.value.memory.dedicated;
+            };
+            os =
+            {
+              type = "hvm";
+              arch = "x86_64";
+              machine = "q35";
+              bootmenu = { enable = true; timeout = 15000; };
+              loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
+              nvram =
               {
-                loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
-                nvram =
-                {
-                  template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
-                  path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
-                  templateFormat = "raw";
-                  format = "raw";
-                };
+                template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
+                path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
+                templateFormat = "raw";
+                format = "raw";
               };
-            });
+            };
+            features = { acpi = {}; apic = {}; };
+            cpu =
+            {
+              mode = "host-passthrough";
+              topology =
+              {
+                sockets = 1;
+                dies = 1;
+                cores = if vm.value.cpu.hyprthread then vm.value.cpu.count / 2 else vm.value.cpu.count;
+                threads = if vm.value.cpu.hyprthread then 2 else 1;
+              };
+            };
+            clock =
+            {
+              offset = "utc";
+              timer =
+              [
+                { name = "rtc"; tickpolicy = "catchup"; }
+                { name = "pit"; tickpolicy = "delay"; }
+                { name = "hpet"; present = false; }
+              ];
+            };
+            devices =
+            {
+              emulator = "${inputs.config.virtualisation.libvirtd.qemu.package}/bin/qemu-system-x86_64";
+              disk =
+              [
+                {
+                  type = "file";
+                  device = "disk";
+                  driver = { name = "qemu"; type = "raw"; cache = "none"; discard = "unmap"; };
+                  source.file = "${if vm.value.storage.nodatacow then "/nix/nodatacow" else ""}/var/lib/libvirt/images/"
+                    + "${vm.value.storage.name}.img";
+                  target = { dev = "vda"; bus = "virtio"; };
+                  boot.order = 1;
+                }
+                {
+                  type = "file";
+                  device = "cdrom";
+                  driver = { name = "qemu"; type = "raw"; };
+                  source.file = "${inputs.topInputs.self.src.iso.netboot}";
+                  target = { dev = "sdc"; bus = "sata"; };
+                  readonly = true;
+                  boot.order = 10;
+                }
+              ];
+              interface =
+              {
+                type = "bridge";
+                model.type = "virtio";
+                mac.address = vm.value.network.mac;
+                source.bridge = if vm.value.network.bridge then "nixvirt" else "virbr0";
+              };
+              input =
+              [
+                { type = "tablet"; bus = "usb"; }
+                { type = "mouse"; bus = "ps2"; }
+                { type = "keyboard"; bus = "ps2"; }
+              ];
+              graphics =
+              {
+                type = "vnc";
+                autoport = false;
+                port = vm.value.network.vnc.port;
+                listen.type = "address";
+                passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
+              };
+              video.model = { type = "qxl"; ram = 65536; vram = 65536; vgamem = 16384; heads = 1; primary = true; };
+              rng = { model = "virtio"; backend = { model = "random"; source = /dev/urandom; }; };
+            };
+          };
         })
         (inputs.localLib.attrsToList nixvirt.instance));
       secrets = builtins.listToAttrs (builtins.map
@@ -204,23 +288,25 @@ inputs:
       group = "root";
       setuid = true;
     };
-    networking.firewall.allowedTCPPorts = builtins.map (vm: vm.network.vnc.port)
-      (builtins.filter (vm: vm.network.vnc.openFirewall) (builtins.attrValues nixvirt.instance));
-    systemd.services.nixvirt-forward =
-      let
-        nftRules = builtins.concatLists (builtins.concatLists (builtins.map
-          (vm: builtins.map
-            (protocol: builtins.map
-              (port: "${protocol} dport ${builtins.toString port.host} fib daddr type local counter dnat ip to "
-                + "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}"
-                + ":${builtins.toString port.guest}")
-              vm.network.portForward.${protocol})
-            [ "tcp" "udp" ])
-          (builtins.attrValues nixvirt.instance)));
-        nft = "${inputs.pkgs.nftables}/bin/nft";
-        nftConfigFile = inputs.pkgs.writeText "nixvirt.nft"
-        ''
-          table inet nixvirt {
+    networking =
+    {
+      firewall.allowedTCPPorts = builtins.map (vm: vm.network.vnc.port)
+        (builtins.filter (vm: vm.network.vnc.openFirewall) (builtins.attrValues nixvirt.instance));
+      nftables.tables.nixvirt =
+      {
+        family = "inet";
+        content =
+          let nftRules = builtins.concatLists (builtins.concatLists (builtins.map
+            (vm: builtins.map
+              (protocol: builtins.map
+                (port: "${protocol} dport ${builtins.toString port.host} fib daddr type local counter dnat ip to "
+                  + "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}"
+                  + ":${builtins.toString port.guest}")
+                vm.network.portForward.${protocol})
+              [ "tcp" "udp" ])
+            (builtins.attrValues nixvirt.instance)));
+          in
+          ''
             chain prerouting {
               type nat hook prerouting priority dstnat; policy accept;
               ${builtins.concatStringsSep "\n" nftRules}
@@ -229,22 +315,13 @@ inputs:
               type nat hook output priority dstnat; policy accept;
               ${builtins.concatStringsSep "\n" nftRules}
             }
-          }
-        '';
-        start = inputs.pkgs.writeShellScript "nixvirt.start" "${nft} -f ${nftConfigFile}";
-        stop = inputs.pkgs.writeShellScript "nixvirt.stop" "${nft} delete table inet nixvirt";
-      in
-      {
-        description = "nixvirt port forward";
-        after = [ "nftables.service" "nixvirt.service" ];
-        serviceConfig =
-        {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = start;
-          ExecStop = stop;
-        };
-        wantedBy= [ "multi-user.target" ];
+          '';
       };
+    };
+    boot.kernelParams =
+      let cpusets = builtins.concatLists (builtins.map
+        (vm: vm.cpu.set)
+        (builtins.filter (vm: vm.cpu.set != null) (builtins.attrValues nixvirt.instance)));
+      in inputs.lib.mkIf (cpusets != []) [ "isolcpus=${builtins.concatStringsSep "," cpusets}" ];
   };
 }

modules/services/rsshub.nix

@@ -4,41 +4,26 @@ inputs:
   {
     type = types.nullOr (types.submodule { options =
     {
-      hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
+      hostname = mkOption { type = types.str; default = "rsshub.chn.moe"; };
     };});
     default = null;
   };
   config = let inherit (inputs.config.nixos.services) rsshub; in inputs.lib.mkIf (rsshub != null)
   {
-    systemd =
+    virtualisation.oci-containers.containers.rsshub =
     {
-      services.rsshub =
-      {
-        description = "rsshub";
-        after = [ "network.target" "redis-rsshub.service" ];
-        requires = [ "redis-rsshub.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig =
-        {
-          User = "rsshub";
-          Group = "rsshub";
-          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
-          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
-          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
-          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        };
-        restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
-      };
-      tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
+      image = "rsshub:latest";
+      imageFile = inputs.topInputs.self.src.rsshub;
+      ports = [ "127.0.0.1:5221:5221/tcp" ];
+      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
+      environmentFiles = [ inputs.config.sops.templates."rsshub/env".path ];
     };
     sops =
     {
       templates."rsshub/env".content = let placeholder = inputs.config.sops.placeholder; in
       ''
         PORT=5221
-        CACHE_TYPE=redis
-        REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:7116'
+        CACHE_TYPE=memory
         PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
         YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
         YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
@@ -59,15 +44,7 @@ inputs:
         "zhihu-cookies"
       ]));
     };
-    users =
-    {
-      users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
-      groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
-    };
-    nixos.services =
-    {
-      redis.instances.rsshub.port = 7116;
-      nginx = { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
-    };
+    nixos.services.nginx =
+      { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
   };
 }

modules/services/slurm.nix

@@ -53,7 +53,7 @@ inputs:
       {
         slurm =
         {
-          package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
+          package = (inputs.pkgs.slurm.override { enableX11 = false; enableNVML = false; }).overrideAttrs
             (prev:
               let
                 inherit (inputs.config.nixos.system.nixpkgs) cuda;

modules/services/sshd/default.nix

@@ -6,6 +6,7 @@ inputs:
     {
       passwordAuthentication = mkOption { type = types.bool; default = false; };
       groupBanner = mkOption { type = types.bool; default = false; };
+      motd = mkOption { type = types.bool; default = false; };
     };});
     default = null;
   };
@@ -25,8 +26,7 @@ inputs:
         };
       };
     }
-    # 如果是服务器，那么启用 motd
-    (inputs.lib.mkIf (inputs.config.nixos.model.type == "server")
+    (inputs.lib.mkIf sshd.motd
     {
       nixos =
       {
@@ -34,7 +34,7 @@ inputs:
           [ (inputs.pkgs.fancy-motd.overrideAttrs { src = inputs.topInputs.fancy-motd; }) ];
         user.sharedModules = [(home-inputs: { config.programs.zsh.loginExtra =
         ''
-          [ -f /etc/fancy-motd/banner ] && lolcat -f /etc/fancy-motd/banner
+          [ -f /etc/fancy-motd/banner ] && (lolcat -f /etc/fancy-motd/banner 2> /dev/null)
           motd
         '';})];
       };

modules/services/synapse.nix

@@ -1,5 +1,4 @@
-# port from nixpkgs#70dc536a
-# TODO: update
+# port from nixpkgs#a87068b8
 inputs:
 {
   options.nixos.services.synapse.instances = let inherit (inputs.lib) mkOption types; in mkOption
@@ -42,7 +41,7 @@ inputs:
       {
         services."synapse-${instance.name}" =
           let
-            package = inputs.pkgs.pkgs-unstable.matrix-synapse.override
+            package = inputs.pkgs.matrix-synapse.override
               { extras = [ "url-preview" "postgres" "redis" ]; plugins = []; };
             config = inputs.config.sops.templates."synapse/${instance.name}/config.yaml".path;
             homeserver = "${package}/bin/synapse_homeserver";
@@ -50,9 +49,11 @@ inputs:
           {
             description = "synapse-${instance.name}";
             enable = instance.value.autoStart;
+            wants = [ "network-online.target" ];
             after = [ "network-online.target" "postgresql.service" ];
             requires = [ "network-online.target" "postgresql.service" ];
             wantedBy = [ "multi-user.target" ];
+            environment = { LD_PRELOAD = "${inputs.pkgs.jemalloc}/lib/libjemalloc.so"; PYTHONMALLOC = "malloc"; };
             serviceConfig =
             {
               ExecStart = "${homeserver} --config-path ${config} --keys-directory ${workdir}";

modules/services/waydroid.nix

@@ -1,16 +0,0 @@
-inputs:
-{
-  options.nixos.services.waydroid = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) waydroid; in inputs.lib.mkIf (waydroid != null)
-    { virtualisation.waydroid.enable = true; };
-}
-
-# sudo waydroid shell wm set-fix-to-user-rotation enabled
-# /var/lib/waydroid/waydroid_base.prop
-# default:
-# ro.hardware.gralloc=gbm
-# ro.hardware.egl=mesa
-# nvidia:
-# ro.hardware.gralloc=default
-# ro.hardware.egl=swiftshader

modules/services/wechat2tg.nix

@@ -1,49 +0,0 @@
-inputs:
-{
-  options.nixos.services.wechat2tg = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) wechat2tg; in inputs.lib.mkIf (wechat2tg != null)
-  {
-    virtualisation.oci-containers.containers.wechat2tg =
-    {
-      image = "finalpi/wechat2tg:v1.3.3";
-      imageFile = inputs.pkgs.dockerTools.pullImage
-      {
-        imageName = "finalpi/wechat2tg";
-        imageDigest = "sha256:48e3aff3f501847f063318b41ca34af7d83278847d2eee40d7ffbf439ee4c194";
-        sha256 = "04hq577d981mdfz0xwklhj9ifgnpbv91d6zkf37awfrbsiqfkrr6";
-        finalImageName = "finalpi/wechat2tg";
-        finalImageTag = "v1.3.3";
-      };
-      volumes = [ "wechat2tg-config:/app/storage" "wechat2tg-files:/app/save-files" ];
-      environmentFiles = [ inputs.config.sops.templates."wechat2tg/env".path ];
-    };
-    sops =
-    {
-      templates."wechat2tg/env".content = let placeholder = inputs.config.sops.placeholder; in
-      ''
-        BOT_TOKEN=${placeholder."wechat2tg/token"}
-        # PROXY_HOST: ""
-        # PROXY_PORT: ""
-        # Proxy type: socks5, http, https
-        # PROXY_PROTOCOL: 'socks5'
-        # Optional username and password
-        # PROXY_USERNAME: ""
-        # PROXY_PASSWORD: ""
-        # API_ID: ""
-        # API_HASH: ""
-        ROOM_MESSAGE='<i>🌐#[topic]</i> ---- <b>👤#[(alias)] #[name]: </b>'
-        OFFICIAL_MESSAGE='<b>📣#[name]: </b>'
-        CONTACT_MESSAGE='<b>👤#[alias_first]: </b>'
-        ROOM_MESSAGE_GROUP='<b>👤#[(alias)] #[name]: </b>'
-        OFFICIAL_MESSAGE_GROUP='<b>📣#[name]: </b>'
-        CONTACT_MESSAGE_GROUP='<b>👤#[alias_first]: </b>'
-        CREATE_ROOM_NAME='#[topic]'
-        CREATE_CONTACT_NAME='#[alias]#[[name]]'
-        MESSAGE_DISPLAY='#[identity]#[br]#[body]'
-      '';
-      secrets."wechat2tg/token" = {};
-    };
-    nixos.services.docker = {};
-  };
-}

modules/services/xmuvpn/default.nix

@@ -1,46 +0,0 @@
-inputs:
-{
-  options.nixos.services.xmuvpn = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) xmuvpn; in inputs.lib.mkIf (xmuvpn != null)
-  {
-    assertions =
-    [{
-      assertion = inputs.config.nixos.services.xray.client.enable;
-      message = "Xray should be enabled.";
-    }];
-    virtualisation.oci-containers.containers.xmuvpn =
-    {
-      image = "hagb/docker-easyconnect";
-      imageFile = inputs.topInputs.self.src.xmuvpn;
-      ports = [ "127.0.0.1:5901:5901/tcp" "127.0.0.1:10069:1080/tcp" ];
-      extraOptions = [ "--dns=223.5.5.5" "--device=/dev/net/tun" "--cap-add=NET_ADMIN" ];
-      volumes = [ "xmuvpn:/root" ];
-      environment = { PASSWORD = "xxxx"; PING_ADDR = "office.chn.moe"; };
-    };
-    nixos.services.docker = {};
-    systemd.services.xmuvpn-forwarder =
-    {
-      description = "xmuvpn forwarder daemon";
-      after = [ "network.target" "v2ray-forwarder.service" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig =
-        let ipset = "${inputs.pkgs.ipset}/bin/ipset";
-        in
-        {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = inputs.pkgs.writeShellScript "xmuvpn-forwarder.start"
-            (builtins.concatStringsSep "\n" (builtins.map
-              (host: "${ipset} add xmu_net ${host}")
-              [
-                # when add new ip, remember to also add it to router
-                "218.193.58.125" "210.34.0.35" "121.192.191.10" "10.24.84.31" "59.77.0.143" "59.77.36.248"
-                "172.27.124.24" "59.77.36.156" "59.77.36.223" "210.34.0.84" "218.193.50.157"
-                "210.34.16.60" "10.26.14.70" "10.26.14.56" "210.34.16.20" "59.77.36.250"
-              ]));
-          ExecStop = inputs.pkgs.writeShellScript "xmuvpn-forwarder.stop" "${ipset} flush xmu_net";
-        };
-    };
-  };
-}

modules/services/xmuvpn/xmuvpn

@@ -1,38 +0,0 @@
-#!/bin/sh /etc/rc.common
-# Copyright (C) 2010 Jo-Philipp Wich
-
-START=99
-STOP=01
-
-start() {
-  ipset create xmunet hash:net
-  ipset add xmunet 218.193.58.125
-  ipset add xmunet 210.34.0.35
-  ipset add xmunet 121.192.191.10
-  ipset add xmunet 10.24.84.31
-  ipset add xmunet 59.77.0.143
-  ipset add xmunet 59.77.36.248
-  ipset add xmunet 172.27.124.24
-  ipset add xmunet 59.77.36.156
-  ipset add xmunet 59.77.36.223
-  ipset add xmunet 210.34.0.84
-  ipset add xmunet 218.193.50.157
-  ipset add xmunet 210.34.16.60
-  ipset add xmunet 10.26.14.70
-  ipset add xmunet 10.26.14.56
-  ipset add xmunet 210.34.16.20
-  ipset add xmunet 59.77.36.250
-  iptables -t mangle -A PREROUTING ! -s 192.168.1.2 -m set --match-set xmunet dst -j MARK --set-mark 1/1
-  ip route add unicast 0.0.0.0/0 via 192.168.1.2 dev br-lan table 100
-  ip rule add fwmark 1/1 table 100
-}
-
-stop() {
-  iptables -t mangle -D PREROUTING ! -s 192.168.1.2 -m set --match-set xmunet dst -j MARK --set-mark 1/1 -w
-  # somehow -w does not work
-  sleep 1
-  ip rule del fwmark 1/1 table 100
-  ip route del table 100
-  ipset flush xmunet
-  ipset destroy xmunet
-}

modules/services/xray.nix

@@ -2,32 +2,38 @@ inputs:
 {
   options.nixos.services.xray = let inherit (inputs.lib) mkOption types; in
   {
-    client =
+    client = mkOption
     {
-      enable = mkOption { type = types.bool; default = false; };
-      xray =
+      type = types.nullOr (types.submodule (submoduleInputs: { options =
       {
-        serverAddress = mkOption { type = types.nonEmptyStr; default = "144.34.225.59"; };
-        serverName = mkOption { type = types.nonEmptyStr; default = "vps6.xserver.chn.moe"; };
-      };
-      dnsmasq =
-      {
-        extraInterfaces = mkOption
+        xray =
         {
-          type = types.listOf types.nonEmptyStr;
-          default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
+          serverName = mkOption { type = types.nonEmptyStr; default = "xserver2.chn.moe"; };
+          serverAddress = mkOption
+          {
+            type = types.nonEmptyStr;
+            default = inputs.topInputs.self.config.dns."chn.moe".getAddress
+              (inputs.lib.removeSuffix ".chn.moe" submoduleInputs.config.xray.serverName);
+          };
         };
-        hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
-      };
-      v2ray-forwarder.noproxyUsers = mkOption { type = types.listOf types.nonEmptyStr; default = [ "gb" "xll" ]; };
-      # 是否允许代理来自其它机器的流量（相关端口会被放行）
-      allowForward = mkOption { type = types.bool; default = true; };
+        dnsmasq =
+        {
+          extraInterfaces = mkOption
+          {
+            type = types.listOf types.nonEmptyStr;
+            default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
+          };
+          hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
+        };
+        v2ray-forwarder.noproxyUsers = mkOption { type = types.listOf types.nonEmptyStr; default = [ "gb" "xll" ]; };
+      };}));
+      default = null;
     };
     server = mkOption
     {
       type = types.nullOr (types.submodule { options =
       {
-        serverName = mkOption { type = types.nonEmptyStr; };
+        serverName = mkOption { type = types.nonEmptyStr; default = "xserver2.chn.moe"; };
       };});
       default = null;
     };
@@ -37,12 +43,12 @@ inputs:
     {
       assertions =
       [{
-        assertion = !(xray.client.enable && xray.server != null);
+        assertion = !(xray.client != null && xray.server != null);
         message = "Currenty xray.client and xray.server could not be simutaniusly enabled.";
       }];
     }
     (
-      inputs.lib.mkIf xray.client.enable
+      inputs.lib.mkIf (xray.client != null)
       {
         services =
         {
@@ -57,7 +63,7 @@ inputs:
               server = [ "127.0.0.1#10853" ];
               interface = xray.client.dnsmasq.extraInterfaces ++ [ "lo" ];
               bind-dynamic = true;
-              address = map (host: "/${host.name}/${host.value}")
+              address = builtins.map (host: "/${host.name}/${host.value}")
                 (inputs.localLib.attrsToList xray.client.dnsmasq.hosts);
             };
           };
@@ -69,132 +75,127 @@ inputs:
           {
             owner = inputs.config.users.users.v2ray.name;
             group = inputs.config.users.users.v2ray.group;
-            content =
-              let
-                chinaDns = "223.5.5.5";
-                foreignDns = "8.8.8.8";
-              in
-              builtins.toJSON
+            content = let chinaDns = "223.5.5.5"; foreignDns = "8.8.8.8"; in builtins.toJSON
+            {
+              log.loglevel = "warning";
+              dns =
               {
-                log.loglevel = "warning";
-                dns =
-                {
-                  servers =
-                  # 先尝试匹配域名列表进行查询，若匹配成功则使用前两个 dns 查询。
-                  # 若匹配域名列表失败，或者匹配成功但是查询到的 IP 不在期望的 IP 列表中，则回落到使用后两个 dns 依次查询。
-                  [
-                    {
-                      address = chinaDns;
-                      domains = [ "geosite:geolocation-cn" ];
-                      expectIPs = [ "geoip:cn" ];
-                      skipFallback = true;
-                    }
-                    {
-                      address = foreignDns;
-                      domains = [ "geosite:geolocation-!cn" ];
-                      expectIPs = [ "geoip:!cn" ];
-                      skipFallback = true;
-                    }
-                    { address = chinaDns; expectIPs = [ "geoip:cn" ]; }
-                    { address = foreignDns; }
-                  ];
-                  disableCache = true;
-                  queryStrategy = "UseIPv4";
-                  tag = "dns-internal";
-                };
-                inbounds =
+                servers =
+                # 先尝试匹配域名列表进行查询，若匹配成功则使用前两个 dns 查询。
+                # 若匹配域名列表失败，或者匹配成功但是查询到的 IP 不在期望的 IP 列表中，则回落到使用后两个 dns 依次查询。
                 [
                   {
-                    port = 10853;
-                    protocol = "dokodemo-door";
-                    settings = { address = "8.8.8.8"; network = "tcp,udp"; port = 53; };
-                    tag = "dns-in";
+                    address = chinaDns;
+                    domains = [ "geosite:geolocation-cn" ];
+                    expectIPs = [ "geoip:cn" ];
+                    skipFallback = true;
                   }
                   {
-                    port = 10880;
-                    protocol = "dokodemo-door";
-                    settings = { network = "tcp,udp"; followRedirect = true; };
-                    streamSettings.sockopt.tproxy = "tproxy";
-                    sniffing = { enabled = true; destOverride = [ "http" "tls" "quic" ]; routeOnly = true; };
-                    tag = "common-in";
+                    address = foreignDns;
+                    domains = [ "geosite:geolocation-!cn" ];
+                    expectIPs = [ "geoip:!cn" ];
+                    skipFallback = true;
                   }
-                  {
-                    port = 10881;
-                    protocol = "dokodemo-door";
-                    settings = { network = "tcp,udp"; followRedirect = true; };
-                    streamSettings.sockopt.tproxy = "tproxy";
-                    tag = "xmu-in";
-                  }
-                  {
-                    port = 10883;
-                    protocol = "dokodemo-door";
-                    settings = { network = "tcp,udp"; followRedirect = true; };
-                    streamSettings.sockopt.tproxy = "tproxy";
-                    tag = "proxy-in";
-                  }
-                  { port = 10884; protocol = "socks"; settings.udp = true; tag = "proxy-socks-in"; }
-                  { port = 10882; protocol = "socks"; settings.udp = true; tag = "direct-in"; }
+                  { address = chinaDns; expectIPs = [ "geoip:cn" ]; }
+                  { address = foreignDns; }
                 ];
-                outbounds =
-                [
-                  {
-                    protocol = "vless";
-                    settings.vnext =
-                    [{
-                      address = xray.client.xray.serverAddress;
-                      port = 443;
-                      users =
-                      [{
-                        id = inputs.config.sops.placeholder."xray-client/uuid";
-                        encryption = "none";
-                        flow = "xtls-rprx-vision-udp443";
-                      }];
-                    }];
-                    streamSettings =
-                    {
-                      network = "raw";
-                      security = "reality";
-                      realitySettings =
-                      {
-                        serverName = xray.client.xray.serverName;
-                        publicKey = "Nl0eVZoDF9d71_3dVsZGJl3UWR9LCv3B14gu7G6vhjk";
-                        fingerprint = "firefox";
-                      };
-                    };
-                    tag = "proxy-vless";
-                  }
-                  { protocol = "freedom"; tag = "direct"; }
-                  { protocol = "dns"; tag = "dns-out"; }
-                  {
-                    protocol = "socks";
-                    settings.servers = [{ address = "127.0.0.1"; port = 10069; }];
-                    tag = "xmu-out";
-                  }
-                  { protocol = "blackhole"; tag = "block"; }
-                ];
-                routing =
-                {
-                  domainStrategy = "AsIs";
-                  rules = builtins.map (rule: rule // { type = "field"; })
-                  [
-                    { inboundTag = [ "dns-in" ]; outboundTag = "dns-out"; }
-                    { inboundTag = [ "dns-internal" ]; ip = [ chinaDns ]; outboundTag = "direct"; }
-                    { inboundTag = [ "dns-internal" ]; ip = [ foreignDns ]; outboundTag = "proxy-vless"; }
-                    { inboundTag = [ "dns-internal" ]; outboundTag = "block"; }
-                    { inboundTag = [ "xmu-in" ]; outboundTag = "xmu-out"; }
-                    { inboundTag = [ "direct-in" ]; outboundTag = "direct"; }
-                    { inboundTag = [ "proxy-in" "proxy-socks-in" ]; outboundTag = "proxy-vless"; }
-                    { inboundTag = [ "common-in" ]; domain = [ "geosite:geolocation-cn" ]; outboundTag = "direct"; }
-                    {
-                      inboundTag = [ "common-in" ];
-                      domain = [ "geosite:geolocation-!cn" ];
-                      outboundTag = "proxy-vless";
-                    }
-                    { inboundTag = [ "common-in" ]; ip = [ "geoip:cn" ]; outboundTag = "direct"; }
-                    { inboundTag = [ "common-in" ]; outboundTag = "proxy-vless"; }
-                  ];
-                };
+                disableCache = true;
+                queryStrategy = "UseIPv4";
+                tag = "dns-internal";
               };
+              inbounds =
+              [
+                {
+                  port = 10853;
+                  protocol = "dokodemo-door";
+                  settings = { address = "8.8.8.8"; network = "tcp,udp"; port = 53; };
+                  tag = "dns-in";
+                }
+                {
+                  port = 10880;
+                  protocol = "dokodemo-door";
+                  settings = { network = "tcp,udp"; followRedirect = true; };
+                  streamSettings.sockopt.tproxy = "tproxy";
+                  sniffing = { enabled = true; destOverride = [ "http" "tls" "quic" ]; routeOnly = true; };
+                  tag = "common-in";
+                }
+                {
+                  port = 10881;
+                  protocol = "dokodemo-door";
+                  settings = { network = "tcp,udp"; followRedirect = true; };
+                  streamSettings.sockopt.tproxy = "tproxy";
+                  tag = "xmu-in";
+                }
+                {
+                  port = 10883;
+                  protocol = "dokodemo-door";
+                  settings = { network = "tcp,udp"; followRedirect = true; };
+                  streamSettings.sockopt.tproxy = "tproxy";
+                  tag = "proxy-in";
+                }
+                { port = 10884; protocol = "socks"; settings.udp = true; tag = "proxy-socks-in"; }
+                { port = 10882; protocol = "socks"; settings.udp = true; tag = "direct-in"; }
+              ];
+              outbounds =
+              [
+                {
+                  protocol = "vless";
+                  settings.vnext =
+                  [{
+                    address = xray.client.xray.serverAddress;
+                    port = 443;
+                    users =
+                    [{
+                      id = inputs.config.sops.placeholder."xray-client/uuid";
+                      encryption = "none";
+                      flow = "xtls-rprx-vision-udp443";
+                    }];
+                  }];
+                  streamSettings =
+                  {
+                    network = "raw";
+                    security = "reality";
+                    realitySettings =
+                    {
+                      inherit (xray.client.xray) serverName;
+                      publicKey = "Nl0eVZoDF9d71_3dVsZGJl3UWR9LCv3B14gu7G6vhjk";
+                      fingerprint = "firefox";
+                    };
+                  };
+                  tag = "proxy-vless";
+                }
+                { protocol = "freedom"; tag = "direct"; }
+                { protocol = "dns"; tag = "dns-out"; }
+                {
+                  protocol = "socks";
+                  settings.servers = [{ address = "127.0.0.1"; port = 10069; }];
+                  tag = "xmu-out";
+                }
+                { protocol = "blackhole"; tag = "block"; }
+              ];
+              routing =
+              {
+                domainStrategy = "AsIs";
+                rules = builtins.map (rule: rule // { type = "field"; })
+                [
+                  { inboundTag = [ "dns-in" ]; outboundTag = "dns-out"; }
+                  { inboundTag = [ "dns-internal" ]; ip = [ chinaDns ]; outboundTag = "direct"; }
+                  { inboundTag = [ "dns-internal" ]; ip = [ foreignDns ]; outboundTag = "proxy-vless"; }
+                  { inboundTag = [ "dns-internal" ]; outboundTag = "block"; }
+                  { inboundTag = [ "xmu-in" ]; outboundTag = "xmu-out"; }
+                  { inboundTag = [ "direct-in" ]; outboundTag = "direct"; }
+                  { inboundTag = [ "proxy-in" "proxy-socks-in" ]; outboundTag = "proxy-vless"; }
+                  { inboundTag = [ "common-in" ]; domain = [ "geosite:geolocation-cn" ]; outboundTag = "direct"; }
+                  {
+                    inboundTag = [ "common-in" ];
+                    domain = [ "geosite:geolocation-!cn" ];
+                    outboundTag = "proxy-vless";
+                  }
+                  { inboundTag = [ "common-in" ]; ip = [ "geoip:cn" ]; outboundTag = "direct"; }
+                  { inboundTag = [ "common-in" ]; outboundTag = "proxy-vless"; }
+                ];
+              };
+            };
           };
           secrets."xray-client/uuid" = {};
         };
@@ -220,87 +221,21 @@ inputs:
             description = "v2ray-forwarder Daemon";
             after = [ "network.target" ];
             wantedBy = [ "multi-user.target" ];
-            serviceConfig =
-              let
-                ip = "${inputs.pkgs.iproute2}/bin/ip";
-                nft = "${inputs.pkgs.nftables}/bin/nft";
-                autoPort = "10880";
-                xmuPort = "10881";
-                proxyPort = "10883";
-              in
-              {
-                Type = "oneshot";
-                RemainAfterExit = true;
-                ExecStart =
-                  let
-                    loNet =
-                    [
-                      "0.0.0.0/8" "10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12"
-                      "192.0.0.0/24" "192.88.99.0/24" "192.168.0.0/16" "59.77.0.143" "198.18.0.0/15"
-                      "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "240.0.0.0/4"
-                    ];
-                    loNetStr = builtins.concatStringsSep ", " loNet;
-                    noproxyUserStr = builtins.concatStringsSep ", " (builtins.map
-                      (user: builtins.toString inputs.config.nixos.user.uid.${user})
-                      (xray.client.v2ray-forwarder.noproxyUsers ++ [ "v2ray" ]));
-                    nftConfigFile = inputs.pkgs.writeText "v2ray.nft"
-                    ''
-                      table inet v2ray {
-                        set lo_net { type ipv4_addr; flags interval; elements = { ${loNetStr} }; }
-                        set xmu_net { type ipv4_addr; flags interval; }
-                        set noproxy_net { type ipv4_addr; flags interval; elements = { 223.5.5.5 }; }
-                        set noproxy_src_net { type ipv4_addr; flags interval; }
-                        set proxy_net { type ipv4_addr; flags interval; elements = { 8.8.8.8 }; }
-
-                        chain prerouting {
-                          type filter hook prerouting priority mangle; policy accept;
-                          meta l4proto != { tcp, udp } counter return
-
-                          # 对于目标地址为本机的新建的流，标记并永不代理
-                          fib daddr type local ct state new counter ct mark set ct mark | 1 return
-                          ct mark & 1 == 1 counter return
-
-                          ip saddr @noproxy_src_net return
-                          ip daddr @noproxy_net return
-                          ip saddr != 172.16.0.0/12 ip daddr @xmu_net meta l4proto { tcp, udp } \
-                            tproxy ip to :${xmuPort} meta mark set meta mark | 1
-                          ip daddr @proxy_net meta l4proto { tcp, udp } tproxy ip to :${proxyPort} \
-                            meta mark set meta mark | 1
-                          ip daddr @lo_net return
-                          meta l4proto { tcp, udp } tproxy ip to :${autoPort} meta mark set meta mark | 1
-
-                          return
-                        }
-
-                        chain output {
-                          type route hook output priority mangle; policy accept;
-                          ct mark & 1 == 1 counter return
-                          meta skuid { ${noproxyUserStr} } return
-
-                          ip saddr @noproxy_src_net return
-                          ip daddr @noproxy_net return
-                          ip daddr @xmu_net meta mark set meta mark | 1
-                          ip daddr @proxy_net meta mark set meta mark | 1
-                          ip daddr @lo_net return
-                          meta l4proto { tcp, udp } meta mark set meta mark | 1
-
-                          return
-                        }
-                      }
-                    '';
-                  in inputs.pkgs.writeShellScript "v2ray-forwarder.start"
-                  ''
-                    ${nft} -f ${nftConfigFile}
-                    ${ip} rule add fwmark 1/1 table 100
-                    ${ip} route add local 0.0.0.0/0 dev lo table 100
-                  '';
-                ExecStop = inputs.pkgs.writeShellScript "v2ray-forwarder.stop"
-                ''
-                  ${nft} delete table inet v2ray
-                  ${ip} rule del fwmark 1/1 table 100
-                  ${ip} route del local 0.0.0.0/0 dev lo table 100
-                '';
-              };
+            serviceConfig = let ip = "${inputs.pkgs.iproute2}/bin/ip"; in
+            {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              ExecStart = inputs.pkgs.writeShellScript "v2ray-forwarder.start"
+              ''
+                ${ip} rule add fwmark 1/1 table 100
+                ${ip} route add local 0.0.0.0/0 dev lo table 100
+              '';
+              ExecStop = inputs.pkgs.writeShellScript "v2ray-forwarder.stop"
+              ''
+                ${ip} rule del fwmark 1/1 table 100
+                ${ip} route del local 0.0.0.0/0 dev lo table 100
+              '';
+            };
           };
         };
         users =
@@ -309,12 +244,77 @@ inputs:
           groups.v2ray.gid = inputs.config.nixos.user.gid.v2ray;
         };
         environment.etc."resolv.conf".text = "nameserver 127.0.0.1";
-        networking.firewall =
+        networking =
         {
-          allowedTCPPorts = [ 53 ];
-          allowedUDPPorts = [ 53 ];
-          allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
-          allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
+          nftables.tables.v2ray =
+          {
+            family = "inet";
+            content =
+              let
+                autoPort = "10880";
+                xmuPort = "10881";
+                proxyPort = "10883";
+                loNet =
+                [
+                  "0.0.0.0/8" "10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12"
+                  "192.0.0.0/24" "192.88.99.0/24" "192.168.0.0/16" "59.77.0.143" "198.18.0.0/15"
+                  "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "240.0.0.0/4"
+                ];
+                loNetStr = builtins.concatStringsSep ", " loNet;
+                noproxyUserStr = builtins.concatStringsSep ", " (builtins.map
+                  (user: builtins.toString inputs.config.nixos.user.uid.${user})
+                  (xray.client.v2ray-forwarder.noproxyUsers ++ [ "v2ray" ]));
+              in
+              ''
+                set lo_net { type ipv4_addr; flags interval; elements = { ${loNetStr} }; }
+                set xmu_net { type ipv4_addr; flags interval; }
+                set noproxy_net { type ipv4_addr; flags interval; elements = { 223.5.5.5 }; }
+                set noproxy_src_net { type ipv4_addr; flags interval; }
+                set proxy_net { type ipv4_addr; flags interval; elements = { 8.8.8.8 }; }
+
+                chain prerouting {
+                  type filter hook prerouting priority mangle; policy accept;
+                  meta l4proto != { tcp, udp } counter return
+
+                  # 对于目标地址为本机的新建的流，标记并永不代理
+                  fib daddr type local ct state new counter ct mark set ct mark | 1 return
+                  ct mark & 1 == 1 counter return
+
+                  ip saddr @noproxy_src_net return
+                  ip daddr @noproxy_net return
+                  ip saddr != 172.16.0.0/12 ip daddr @xmu_net meta l4proto { tcp, udp } \
+                    tproxy ip to :${xmuPort} meta mark set meta mark | 1
+                  ip daddr @proxy_net meta l4proto { tcp, udp } tproxy ip to :${proxyPort} \
+                    meta mark set meta mark | 1
+                  ip daddr @lo_net return
+                  meta l4proto { tcp, udp } tproxy ip to :${autoPort} meta mark set meta mark | 1
+
+                  return
+                }
+
+                chain output {
+                  type route hook output priority mangle; policy accept;
+                  ct mark & 1 == 1 counter return
+                  meta skuid { ${noproxyUserStr} } return
+
+                  ip saddr @noproxy_src_net return
+                  ip daddr @noproxy_net return
+                  ip daddr @xmu_net meta mark set meta mark | 1
+                  ip daddr @proxy_net meta mark set meta mark | 1
+                  ip daddr @lo_net return
+                  meta l4proto { tcp, udp } meta mark set meta mark | 1
+
+                  return
+                }
+              '';
+          };
+          firewall =
+          {
+            allowedTCPPorts = [ 53 ];
+            allowedUDPPorts = [ 53 ];
+            allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
+            allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
+          };
         };
       }
     )
@@ -326,11 +326,7 @@ inputs:
             .xray-server.clients;
         in
         {
-          services.xray =
-          {
-            enable = true;
-            settingsFile = inputs.config.sops.templates."xray-server.json".path;
-          };
+          services.xray = { enable = true; settingsFile = inputs.config.sops.templates."xray-server.json".path; };
           sops =
           {
             templates."xray-server.json" =
@@ -352,7 +348,7 @@ inputs:
                       protocol = "vless";
                       settings =
                       {
-                        clients = map
+                        clients = builtins.map
                           (n:
                           {
                             id = inputs.config.sops.placeholder."xray-server/clients/${n}";

modules/services/xrdp.nix

@@ -1,36 +0,0 @@
-inputs:
-{
-  options.nixos.services.xrdp = let inherit (inputs.lib) mkOption types; in
-  {
-    enable = mkOption { type = types.bool; default = false; };
-    port = mkOption { type = types.ints.unsigned; default = 3389; };
-    hostname = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
-  };
-  config = let inherit (inputs.config.nixos.services) xrdp;
-    in inputs.lib.mkIf xrdp.enable (inputs.lib.mkMerge
-    [
-      {
-        services.xrdp =
-        {
-          enable = true;
-          port = xrdp.port;
-          openFirewall = true;
-          defaultWindowManager = "${inputs.pkgs.plasma-workspace}/bin/startplasma-x11";
-        };
-      }
-      (
-        inputs.lib.mkIf (xrdp.hostname != null)
-        (
-          let mainDomain = builtins.elemAt xrdp.hostname 0;
-          in
-          {
-            services.xrdp =
-              let keydir = inputs.config.security.acme.certs.${mainDomain}.directory;
-              in { sslCert = "${keydir}/full.pem"; sslKey = "${keydir}/key.pem"; };
-            nixos.services.acme.cert.${mainDomain} =
-              { domains = xrdp.hostname; group = inputs.config.systemd.services.xrdp.serviceConfig.Group; };
-          }
-        )
-      )
-    ]);
-}

modules/system/binfmt.nix

@@ -1,6 +1,8 @@
 inputs:
 {
-  config =
+  options.nixos.system.binfmt = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.system) binfmt; in inputs.lib.mkIf (binfmt != null)
   {
     programs.java = { enable = true; binfmt = true; };
     boot.binfmt.emulatedSystems = [ "aarch64-linux" "x86_64-windows" ];

modules/system/default.nix

@@ -16,9 +16,6 @@ inputs:
     {
       supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
       # consoleLogLevel = 7;
-      kernelParams = inputs.lib.mkIf
-        (builtins.elem inputs.config.nixos.system.grub.installDevice [ "efi" "efiRemovable" ])
-        [ "plymouth.use-simpledrm" ];
     };
     hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
     environment =
@@ -50,13 +47,12 @@ inputs:
     i18n = { defaultLocale = "C.UTF-8"; supportedLocales = [ "all" ]; };
     users.mutableUsers = false;
     virtualisation.oci-containers.backend = "docker";
-    home-manager.sharedModules = [{ home.stateVersion = "22.11"; }];
+    home-manager.sharedModules = [{ home.stateVersion = "25.05"; }];
     system =
     {
-      stateVersion = "22.11";
+      stateVersion = "25.05";
       configurationRevision = inputs.topInputs.self.rev or "dirty";
       nixos = { versionSuffix = inputs.lib.mkForce ""; tags = [ inputs.topInputs.self.config.branch ]; };
     };
-    chaotic.nyx.cache.enable = false;
   };
 }

modules/system/envfs.nix

@@ -1,6 +1,11 @@
 inputs:
 {
-  config =
+  options.nixos.system.envfs = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.system) envfs; in inputs.lib.mkIf (envfs != null)
   {
     services.envfs.enable = true;
     environment.variables.ENVFS_RESOLVE_ALWAYS = "1";

modules/system/fileSystems/cluster.nix

@@ -4,10 +4,10 @@ inputs:
   [
     # for cluster master, export NFS
     (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "master")
-      { nixos.services.nfs."/nix/persistent/home" = "192.168.178.0/24"; })
+      { nixos.services.nfs."/" = "192.168.178.0/24"; })
     # for cluster worker, mount nfs, disable some home manager files
-    (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "worker")
-      { nixos.system.fileSystems.mount.nfs."192.168.178.1:/nix/persistent/home" = "/remote/home"; })
+    (let inherit (inputs.config.nixos.model) cluster; in inputs.lib.mkIf (cluster.nodeType or null == "worker")
+      { nixos.system.fileSystems.mount.nfs."192.168.178.1:/" = "/nix/remote/${cluster.clusterName}"; })
     # 将一部分由 home-manager 生成软链接的文件改为直接挂载，以兼容集群的设置
     (let files = [ ".zshrc" ".zshenv" ".profile" ".bashrc" ".bash_profile" ".zlogin" ]; in
     {