services.frpClient: stcp allow all users

This reverts commit 303d67ca06.

.sops.yaml

@@ -4,49 +4,40 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
   - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
   - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
   - &yoga age1qrea4twxdhd7fnvlq5v45528c90qy6hp2wa55kghsxzgut6n6fxs7w6u42
-  - &pe age1cahahn9hp265dkhduaec65vugk8fct2vt9ur6y54m4mgmyx4v4fq0etjhv
   - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
+  - &xmupc1 age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
 creation_rules:
-  - path_regex: secrets/pc\.yaml$
+  - path_regex: secrets/pc/.*$
     key_groups:
     - age:
       - *chn
       - *pc
-  - path_regex: secrets/vps6\.yaml$
+  - path_regex: secrets/vps6/.*$
     key_groups:
     - age:
       - *chn
       - *vps6
-  - path_regex: secrets/vps4\.yaml$
-    key_groups:
-    - age:
-      - *chn
-  - path_regex: secrets/vps7\.yaml$
+  - path_regex: secrets/vps7/.*$
     key_groups:
     - age:
       - *chn
       - *vps7
-  - path_regex: secrets/nas\.yaml$
+  - path_regex: secrets/nas/.*$
     key_groups:
     - age:
       - *chn
       - *nas
-  - path_regex: secrets/xmupc1\.yaml$
+  - path_regex: secrets/xmupc1/.*$
     key_groups:
     - age:
       - *chn
-  - path_regex: secrets/yoga\.yaml$
+  - path_regex: secrets/yoga/.*$
     key_groups:
     - age:
       - *chn
       - *yoga
-  - path_regex: secrets/pe\.yaml$
+  - path_regex: secrets/xmupc1/.*$
     key_groups:
     - age:
       - *chn
-      - *pe
-  - path_regex: secrets/gitlab/jws\.bin$
-    key_groups:
-    - age:
-      - *chn
-      - *vps7
+      - *xmupc1

flake.lock

@@ -1124,11 +1124,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1701744842,
-        "narHash": "sha256-HAiQCcPM+E8f1zDBSIzKtHYNh4Qfyxa6bHh9D+8Djps=",
+        "lastModified": 1702961405,
+        "narHash": "sha256-H7TRw7SHZhC07K+E8YpDrDv19SMmA4sThQQPIrQ3vxg=",
         "owner": "CHN-beta",
         "repo": "nixpkgs",
-        "rev": "2cb2dfd2b159149779caca7a8380e3a2f13b8b71",
+        "rev": "530eea7ffc7a0c010557714f6d48981085d9b932",
         "type": "github"
       },
       "original": {
@@ -1140,11 +1140,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1701744886,
-        "narHash": "sha256-Q2vefBJAMlNadKvOK843HgAggnekXG4Wpja7gUq45Os=",
+        "lastModified": 1703507584,
+        "narHash": "sha256-GvjQ462NjjmA2OXGT5ZjHJGA7BrqfsrUpMx4Iq6xkrI=",
         "owner": "CHN-beta",
         "repo": "nixpkgs",
-        "rev": "68938e58d0ff77b5ce842a8b423074f45693a6a2",
+        "rev": "105eaff164520aeca4401cf1e8cf87ef4f106a84",
         "type": "github"
       },
       "original": {

flake.nix

@@ -59,32 +59,16 @@
             name = system;
             value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
           })
-          [ "pc" "vps6" "vps7" "nas" "yoga" ])
+          [ "pc" "vps6" "vps7" "nas" "yoga" "xmupc1" ])
       );
-      nixosConfigurations = builtins.listToAttrs (builtins.map
-        (system:
-        {
-          name = system.name;
-          value = inputs.nixpkgs.lib.nixosSystem
+      # ssh-keygen -t rsa -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_rsa_key
+      # ssh-keygen -t ed25519 -C root@pe -f /mnt/nix/persistent/etc/ssh/ssh_host_ed25519_key
+      # systemd-machine-id-setup --root=/mnt/nix/persistent
+      nixosConfigurations =
+        let
+          system =
           {
-            system = "x86_64-linux";
-            specialArgs = { topInputs = inputs; inherit localLib; };
-            modules = localLib.mkModules
-            (
-              [
-                (inputs: { config.nixpkgs.overlays = [(final: prev:
-                  { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); })]; })
-                ./modules
-              ]
-              ++ system.value
-            );
-          };
-        })
-        (localLib.attrsToList
-        {
-          pc =
-          [
-            (inputs: { config.nixos =
+            pc =
             {
               system =
               {
@@ -130,12 +114,12 @@
                   ];
                   keepOutputs = true;
                 };
-                nixpkgs = { march = "alderlake"; cudaSupport = true; replaceTensorflow = true; };
-                gui = { enable = true; preferred = true; };
-                kernel.patches = [ "cjktty" ];
+                nixpkgs =
+                  { march = "alderlake"; cuda = { enable = true; capabilities = [ "8.6" ]; forwardCompat = false; }; };
+                kernel.patches = [ "cjktty" "lantian" ];
                 impermanence.enable = true;
-                networking =
-                  { hostname = "pc"; nebula = { enable = true; lighthouse = "vps6.chn.moe"; useRelay = true; }; };
+                networking.hostname = "pc";
+                sysctl.laptop-mode = 5;
               };
               hardware =
               {
@@ -206,20 +190,23 @@
                 };
                 nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
                 smartd.enable = true;
-                nginx.transparentProxy.externalIp = [ "192.168.82.3" ];
                 misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
                 beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 2048; }; };
+                wireguard =
+                {
+                  enable = true;
+                  peers = [ "vps6" ];
+                  publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
+                  wireguardIp = "192.168.83.3";
+                };
               };
               bugs =
               [
-                "intel-hdmi" "suspend-hibernate-no-platform" "hibernate-iwlwifi" "suspend-lid-no-wakeup" "xmunet"
-                "suspend-hibernate-waydroid" "embree"
+                "suspend-hibernate-no-platform" "hibernate-iwlwifi" "suspend-lid-no-wakeup" "xmunet"
+                "suspend-hibernate-waydroid" "power"
               ];
-            };})
-          ];
-          vps6 = 
-          [
-            (inputs: { config.nixos =
+            };
+            vps6 =
             {
               system =
               {
@@ -244,14 +231,10 @@
                 };
                 grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
                 nixpkgs.march = "sandybridge";
-                nix =
-                {
-                  substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-                  autoOptimiseStore = true;
-                };
+                nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
                 initrd.sshd.enable = true;
                 impermanence.enable = true;
-                networking = { hostname = "vps6"; nebula.enable = true; };
+                networking.hostname = "vps6";
               };
               packages.packageSet = "server";
               services =
@@ -262,7 +245,6 @@
                 frpServer = { enable = true; serverName = "frp.chn.moe"; };
                 nginx =
                 {
-                  transparentProxy.externalIp = [ "74.211.99.69" "192.168.82.1" ];
                   streamProxy.map =
                   {
                     "anchor.fm" = { upstream = "anchor.fm:443"; proxyProtocol = false; };
@@ -270,29 +252,39 @@
                     "xlog.chn.moe" = { upstream = "cname.xlog.app:443"; proxyProtocol = false; };
                   }
                   // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "internal.pc.chn.moe"; })
+                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.pc.chn.moe"; })
                     [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
                   // (builtins.listToAttrs (builtins.map
-                    (site: { name = "${site}.chn.moe"; value.upstream.address = "internal.vps7.chn.moe"; })
-                    [ "xn--s8w913fdga" "misskey" "synapse" "send" "kkmeeting" "api" "gitlab" "grafana" ]));
+                    (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
+                    [
+                      "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
+                      "send" "kkmeeting" "api" "git" "grafana"
+                    ]));
                   applications =
                   {
                     element.instances."element.chn.moe" = {};
                     synapse-admin.instances."synapse-admin.chn.moe" = {};
                     catalog.enable = true;
                     blog.enable = true;
+                    main.enable = true;
                   };
                 };
                 coturn.enable = true;
                 httpua.enable = true;
                 mirism.enable = true;
                 fail2ban.enable = true;
+                wireguard =
+                {
+                  enable = true;
+                  peers = [ "pc" "nas" "vps7" ];
+                  publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+                  wireguardIp = "192.168.83.1";
+                  externalIp = "74.211.99.69";
+                  lighthouse = true;
+                };
               };
-            };})
-          ];
-          vps7 =
-          [
-            (inputs: { config.nixos =
+            };
+            vps7 =
             {
               system =
               {
@@ -320,8 +312,8 @@
                 nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
                 initrd.sshd.enable = true;
                 impermanence.enable = true;
-                networking = { hostname = "vps7"; nebula = { enable = true; lighthouse = "vps6.chn.moe"; }; };
-                gui.enable = true;
+                networking.hostname = "vps7";
+                gui.preferred = false;
               };
               packages.packageSet = "desktop";
               services =
@@ -330,14 +322,17 @@
                 fontconfig.enable = true;
                 sshd.enable = true;
                 rsshub.enable = true;
-                nginx.transparentProxy.externalIp = [ "95.111.228.40" "192.168.82.2" ];
                 wallabag.enable = true;
                 misskey.instances =
                 {
                   misskey.hostname = "xn--s8w913fdga.chn.moe";
                   misskey-old = { port = 9727; redis.port = 3546; meilisearch.enable = false; };
                 };
-                synapse.enable = true;
+                synapse.instances =
+                {
+                  synapse.matrixHostname = "synapse.chn.moe";
+                  matrix = { port = 8009; redisPort = 6380; slidingSyncPort = 9001; };
+                };
                 xrdp = { enable = true; hostname = [ "vps7.chn.moe" ]; };
                 vaultwarden.enable = true;
                 beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 1024; }; };
@@ -350,15 +345,20 @@
                 nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; };
                 httpapi.enable = true;
                 mastodon.enable = true;
-                gitlab.enable = true;
+                gitea.enable = true;
                 grafana.enable = true;
                 fail2ban.enable = true;
+                wireguard =
+                {
+                  enable = true;
+                  peers = [ "vps6" ];
+                  publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
+                  wireguardIp = "192.168.83.2";
+                  externalIp = "95.111.228.40";
+                };
               };
-            };})
-          ];
-          nas =
-          [
-            (inputs: { config.nixos =
+            };
+            nas =
             {
               system =
               {
@@ -401,9 +401,8 @@
                 nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
                 kernel.patches = [ "cjktty" ];
                 impermanence.enable = true;
-                networking =
-                  { hostname = "nas"; nebula = { enable = true; lighthouse = "vps6.chn.moe"; useRelay = true; }; };
-                gui.enable = true;
+                networking.hostname = "nas";
+                gui.preferred = false;
               };
               hardware = { cpus = [ "intel" ]; gpus = [ "intel" ]; };
               packages.packageSet = "desktop";
@@ -444,19 +443,18 @@
                   user = "nas";
                   stcp.hpc = { localIp = "hpc.xmu.edu.cn"; localPort = 22; };
                 };
-                nginx =
+                nginx = { enable = true; applications.webdav.instances."local.webdav.chn.moe" = {}; };
+                wireguard =
                 {
                   enable = true;
-                  transparentProxy.externalIp = [ "192.168.82.4" "192.168.1.185" ];
-                  applications.webdav.instances."local.webdav.chn.moe" = {};
+                  peers = [ "vps6" ];
+                  publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+                  wireguardIp = "192.168.83.4";
                 };
               };
-              users.users = [ "root" "chn" "xll" "zem" "yjq" "yxy" ];
-            };})
-          ];
-          yoga =
-          [
-            (inputs: { config.nixos =
+              users.users = [ "chn" "xll" "zem" "yjq" "yxy" ];
+            };
+            yoga =
             {
               system =
               {
@@ -477,7 +475,6 @@
                   rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
                 };
                 nixpkgs.march = "silvermont";
-                gui.enable = true;
                 grub.installDevice = "efi";
                 nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
                 kernel.patches = [ "cjktty" ];
@@ -511,9 +508,120 @@
                 firewall.trustedInterfaces = [ "virbr0" ];
               };
               bugs = [ "xmunet" ];
-            };})
-          ];
-        }));
+            };
+            xmupc1 =
+            {
+              system =
+              {
+                fileSystems =
+                {
+                  mount =
+                  {
+                    vfat."/dev/disk/by-uuid/3F57-0EBE" = "/boot/efi";
+                    btrfs =
+                    {
+                      "/dev/disk/by-uuid/02e426ec-cfa2-4a18-b3a5-57ef04d66614"."/" = "/boot";
+                      "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+                    };
+                  };
+                  swap = [ "/dev/mapper/swap" ];
+                  resume = "/dev/mapper/swap";
+                  rollingRootfs = { device = "/dev/mapper/root"; path = "/nix/rootfs"; };
+                };
+                grub.installDevice = "efi";
+                nixpkgs =
+                {
+                  march = "znver3";
+                  cuda =
+                  {
+                    enable = true;
+                    capabilities =
+                    [
+                      # 2080 Ti
+                      "7.5"
+                      # 3090
+                      "8.6"
+                      # 4090
+                      "8.9"
+                    ];
+                    forwardCompat = false;
+                  };
+                };
+                gui.preferred = false;
+                kernel.patches = [ "cjktty" ];
+                impermanence.enable = true;
+                networking.hostname = "xmupc1";
+              };
+              hardware =
+              {
+                cpus = [ "amd" ];
+                gpus = [ "nvidia" ];
+                bluetooth.enable = true;
+                joystick.enable = true;
+                printer.enable = true;
+                sound.enable = true;
+                gamemode.drmDevice = 1;
+              };
+              packages.packageSet = "workstation";
+              virtualization = { docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+              services =
+              {
+                snapper.enable = true;
+                fontconfig.enable = true;
+                samba =
+                {
+                  enable = true;
+                  private = true;
+                  hostsAllowed = "192.168. 127.";
+                  shares =
+                  {
+                    media.path = "/run/media/chn";
+                    home.path = "/home/chn";
+                    mnt.path = "/mnt";
+                    share.path = "/home/chn/share";
+                  };
+                };
+                sshd.enable = true;
+                xrayClient =
+                {
+                  enable = true;
+                  serverAddress = "74.211.99.69";
+                  serverName = "vps6.xserver.chn.moe";
+                  dns.extraInterfaces = [ "docker0" ];
+                };
+                firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
+                acme = { enable = true; cert."debug.mirism.one" = {}; };
+                smartd.enable = true;
+                beesd = { enable = true; instances.root = { device = "/nix/persistent"; hashTableSizeMB = 2048; }; };
+                wireguard =
+                {
+                  enable = true;
+                  peers = [ "vps6" ];
+                  publicKey = "JEY7D4ANfTpevjXNvGDYO6aGwtBGRXsf/iwNwjwDRQk=";
+                  wireguardIp = "192.168.83.5";
+                };
+              };
+              bugs = [ "xmunet" "firefox" ];
+            };
+          };
+        in builtins.listToAttrs (builtins.map
+          (system:
+          {
+            name = system.name;
+            value = inputs.nixpkgs.lib.nixosSystem
+            {
+              system = "x86_64-linux";
+              specialArgs = { topInputs = inputs; inherit localLib; };
+              modules = localLib.mkModules
+              [
+                (inputs: { config.nixpkgs.overlays = [(final: prev:
+                  { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; }); })]; })
+                ./modules
+                { config.nixos = system.value; }
+              ];
+            };
+          })
+          (localLib.attrsToList system));
       # sudo HTTPS_PROXY=socks5://127.0.0.1:10884 nixos-install --flake .#bootstrap --option substituters http://127.0.0.1:5000 --option require-sigs false --option system-features gccarch-silvermont
       # nix-serve -p 5000
       # nix copy --substitute-on-destination --to ssh://server /run/current-system

local/lib/default.nix

@@ -32,4 +32,9 @@ lib:
     in
       # Split into lines. Strip leading tabs. Concat back to string.
       builtins.concatStringsSep "\n" (stripTabs (lib.strings.splitString "\n" text));
+  
+  # find an element in a list, return the index
+  findIndex = e: list:
+    let findIndex_ = i: list: if (builtins.elemAt list i) == e then i else findIndex_ (i + 1) list;
+    in findIndex_ 0 list;
 }

local/pkgs/default.nix

@@ -4,7 +4,7 @@
   vesta = callPackage ./vesta {};
   oneapi = callPackage ./oneapi {};
   rsshub = callPackage ./rsshub {};
-  misskey = callPackage ./misskey {};
+  misskey = callPackage ./misskey { nodejs = nodejs_21; };
   mk-meili-mgn = callPackage ./mk-meili-mgn {};
   # vasp = callPackage ./vasp
   # {
@@ -41,4 +41,8 @@
   cppcoro = callPackage ./cppcoro {};
   date = callPackage ./date {};
   esbonio = python3Packages.callPackage ./esbonio {};
+  pix2tex = python3Packages.callPackage ./pix2tex {};
+  pyreadline3 = python3Packages.callPackage ./pyreadline3 {};
+  torchdata = python3Packages.callPackage ./torchdata {};
+  torchtext = python3Packages.callPackage ./torchtext { inherit torchdata; };
 }

local/pkgs/mirism/default.nix

@@ -8,7 +8,7 @@
   src = requireFile
   {
     inherit name;
-    sha256 = "10r40j4d6nnj930c8rw925akpim8f8sixh1lqrwdyp561nw774s4";
+    sha256 = "1q3f4q4ln9dz68dfc35jybgv861f7acqiiykkm7jxviz8jdgn8c7";
     hashMode = "recursive";
     message = "Source file not found.";
   };

local/pkgs/misskey/default.nix

@@ -1,95 +1,45 @@
 {
-  lib, stdenv, mkPnpmPackage, fetchFromGitHub, fetchurl, nodejs_20, writeShellScript, buildFHSEnv,
+  lib, stdenv, mkPnpmPackage, fetchFromGitHub, fetchurl, nodejs, writeShellScript, buildFHSEnv,
   bash, cypress, vips, pkg-config
 }:
 let
   pname = "misskey";
-  version = "2023.11.1";
+  version = "2023.12.0";
   src = fetchFromGitHub
   {
     owner = "CHN-beta";
     repo = "misskey";
-    rev = "1e5134816cc23600a0448a62b34aadfe573c3bbc";
-    sha256 = "ihkFVTpwEELmxAw4Lw01pWr8j6u2oLpfcw3laVUFCO4=";
+    rev = "bec1dc37598b71c377643ee77330d4d6f7eb31f2";
+    sha256 = "sha256-svLpG4xQ2mtsJ6gm+Ap8fZKTOl5V68XybGDvymsV4F4=";
     fetchSubmodules = true;
   };
   originalPnpmPackage = mkPnpmPackage
   {
-    inherit pname version src;
-    nodejs = nodejs_20;
+    inherit pname version src nodejs;
     copyPnpmStore = true;
   };
   startScript = writeShellScript "misskey"
   ''
-    export PATH=${lib.makeBinPath [ bash nodejs_20 nodejs_20.pkgs.pnpm nodejs_20.pkgs.gulp cypress ]}:$PATH
+    export PATH=${lib.makeBinPath [ bash nodejs nodejs.pkgs.pnpm nodejs.pkgs.gulp cypress ]}:$PATH
     export CYPRESS_RUN_BINARY="${cypress}/bin/Cypress"
     export NODE_ENV=production
     pnpm run migrateandstart
   '';
-  re2 = stdenv.mkDerivation rec
-  {
-    pname = "re2";
-    version = "1.20.8";
-    srcs =
-    [
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-120.br";
-        sha256 = "0f2l658xxc2112mbqpkyfic3vhjgdyafbfi14b6n40skyd6lijcq";
-      })
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-120.gz";
-        sha256 = "1v5n8i16188xpwx1jr8gcc1a99v83hlbh5hldl4i376vh0lwsxlq";
-      })
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-115.br";
-        sha256 = "0cyqmgqk5cwik27wh4ynaf94v4w6p1fsavm07xh8xfmdim2sr9kd";
-      })
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-115.gz";
-        sha256 = "0i3iykw13d5qfd5s6pq6kx6cbd64vfb3w65f9bnj87qz44la84ic";
-      })
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-108.br";
-        sha256 = "1467frfapqhi839r2v0p0wh76si3lihwzwgl9098mj7mwhjfl4lx";
-      })
-      (fetchurl
-      {
-        url = "https://github.com/uhop/node-re2/releases/download/1.20.8/linux-x64-108.gz";
-        sha256 = "0hykpqdrn55x83v1kzz6bdvrp24hgz3rwmwbdfl2saz576krzg1c";
-      })
-    ];
-    phases = [ "installPhase" ];
-    installPhase =
-    ''
-      mkdir -p $out/${version}
-      for i in $srcs
-      do
-        cp $i $out/${version}/''${i#*-}
-      done
-    '';
-  };
 in
   stdenv.mkDerivation rec
   {
     inherit version src pname;
     buildInputs =
     [
-      bash nodejs_20 nodejs_20.pkgs.typescript nodejs_20.pkgs.pnpm nodejs_20.pkgs.gulp cypress vips pkg-config
+      bash nodejs nodejs.pkgs.typescript nodejs.pkgs.pnpm nodejs.pkgs.gulp cypress vips pkg-config
     ];
     nativeBuildInputs = buildInputs;
     CYPRESS_RUN_BINARY = "${cypress}/bin/Cypress";
     NODE_ENV = "production";
-    RE2_DOWNLOAD_MIRROR = "${re2}";
-    RE2_DOWNLOAD_SKIP_PATH = "true";
     configurePhase =
     ''
       export HOME=$NIX_BUILD_TOP # Some packages need a writable HOME
-      export npm_config_nodedir=${nodejs_20}
+      export npm_config_nodedir=${nodejs}
 
       runHook preConfigure
 
@@ -121,6 +71,6 @@ in
     '';
     passthru =
     {
-      inherit originalPnpmPackage startScript re2;
+      inherit originalPnpmPackage startScript;
     };
   }

local/pkgs/pix2tex/default.nix

@@ -0,0 +1,32 @@
+{
+  lib, fetchFromGitHub, buildPythonPackage,
+  # general dependencies:
+  tqdm, munch, torch, opencv, requests, einops, transformers, tokenizers, numpy, pillow, pyyaml, pandas, timm,
+  albumentations,
+  # gui
+  pyqt6, pyqt6-webengine, pyside6, pynput, screeninfo,
+  # api
+  streamlit, fastapi, uvicorn, python-multipart,
+  # training
+  # python-Levenshtein, torchtext, imagesize
+  # highlight
+  pygments
+}: buildPythonPackage
+{
+  name = "pix2tex";
+  src = fetchFromGitHub
+  {
+    owner = "lukas-blecher";
+    repo = "LaTeX-OCR";
+    rev = "1781514fb8c92ea9f94057295fdae0e683f4648e";
+    hash = "sha256-I3B8eH7zV2zIogDt9znkEzp4EeBjY6NfI4jsl+v/8aM=";
+  };
+  patches = [ ./remove-version-requires.patch ];
+  propagatedBuildInputs =
+  [
+    tqdm munch torch opencv requests einops transformers tokenizers numpy pillow pyyaml pandas timm albumentations
+    pyqt6 pyqt6-webengine pyside6 pynput screeninfo
+    streamlit fastapi uvicorn python-multipart
+    pygments
+  ];
+}

local/pkgs/pix2tex/remove-version-requires.patch

@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index 29b26cb..511012f 100644
+--- a/setup.py
++++ b/setup.py
+@@ -64,7 +64,7 @@ setuptools.setup(
+         'Pillow>=9.1.0',
+         'PyYAML>=5.4.1',
+         'pandas>=1.0.0',
+-        'timm==0.5.4',
++        'timm>=0.5.4',
+         'albumentations>=0.5.2',
+         'pyreadline3>=3.4.1; platform_system=="Windows"',
+     ],

local/pkgs/pyreadline3/default.nix

@@ -0,0 +1,14 @@
+{
+  lib, fetchFromGitHub, buildPythonPackage
+}: buildPythonPackage rec
+{
+  pname = "pyreadline3";
+  version = "3.4.1";
+  src = fetchFromGitHub
+  {
+    owner = "pyreadline3";
+    repo = "pyreadline3";
+    rev = "v${version}";
+    hash = "sha256-02/gkx955NupVKXSu/xBQQtY4SEP4zxbNQYg1oQ/nGY=";
+  };
+}

local/pkgs/rsshub/default.nix

@@ -8,8 +8,8 @@ let
   {
     owner = "DIYgod";
     repo = "RSSHub";
-    rev = "2cfde2ce5e8bd3591feb85543bb4e0df940aad46";
-    sha256 = "dSq774Qnnpn4y5ky8tHC8ceEx92lXl9G0S5z/XRcoEk=";
+    rev = "38a5b0c193bf77d71c4eea33db6e76bc8b565d0b";
+    hash = "sha256-gJsT9W2fFiy2IG89E5th49DpBHsPMfsdONyzAKDG48c=";
   };
   originalPnpmPackage = mkPnpmPackage { inherit name src nodejs; };
   nodeModules = originalPnpmPackage.nodeModules.overrideAttrs { PUPPETEER_SKIP_DOWNLOAD = true; };

local/pkgs/torchdata/default.nix

@@ -0,0 +1,20 @@
+{
+  lib, fetchFromGitHub, buildPythonPackage,
+  torch, urllib3, requests, cmake, pkg-config, ninja
+}: buildPythonPackage rec
+{
+  pname = "torchdata";
+  version = "0.7.1";
+  src = fetchFromGitHub
+  {
+    owner = "pytorch";
+    repo = "data";
+    rev = "v${version}";
+    hash = "sha256-SOeu+mI4p2tHX0YyctrDBcrz2/zYcwH9GGJ+6ytRmjQ=";
+    fetchSubmodules = true;
+  };
+  dontUseCmakeConfigure = true;
+  pyproject = true;
+  propagatedBuildInputs = [ torch urllib3 requests ];
+  nativeBuildInputs = [ cmake pkg-config ninja ];
+}

local/pkgs/torchtext/default.nix

@@ -0,0 +1,20 @@
+{
+  lib, fetchFromGitHub, buildPythonPackage,
+  tqdm, requests, torch, numpy, torchdata, cmake
+}: buildPythonPackage rec
+{
+  pname = "torchtext";
+  version = "0.16.1";
+  src = fetchFromGitHub
+  {
+    owner = "pytorch";
+    repo = "text";
+    rev = "v${version}";
+    hash = "sha256-4a33AWdd1VZwRL5vTawo0yplpw+qcNMetbfE1h1kafE=";
+    fetchSubmodules = true;
+  };
+  dontUseCmakeConfigure = true;
+  pyproject = true;
+  propagatedBuildInputs = [ tqdm requests torch numpy torchdata ];
+  nativeBuildInputs = [ cmake ];
+}

modules/bugs/default.nix

@@ -5,8 +5,6 @@ inputs:
     inherit (inputs.lib) mkMerge mkIf mkOption types;
     bugs =
     {
-      # intel i915 hdmi
-      intel-hdmi.boot.kernelPatches = [{ name = "intel-hdmi"; patch = ./intel-hdmi.patch; }];
       # suspend & hibernate do not use platform
       suspend-hibernate-no-platform.systemd.sleep.extraConfig =
       ''
@@ -47,6 +45,10 @@ inputs:
             then
               echo LID0 > /proc/acpi/wakeup
             fi
+            if ${cat} /proc/acpi/wakeup | ${grep} XHCI | ${grep} -q enabled
+            then
+              echo XHCI > /proc/acpi/wakeup
+            fi
           '';
         wantedBy = [ "multi-user.target" ];
       };
@@ -76,8 +78,7 @@ inputs:
           };
         };
       firefox.programs.firefox.enable = inputs.lib.mkForce false;
-      embree.nixpkgs.overlays =
-        [(final: prev: { embree = prev.embree.override { stdenv = final.genericPackages.stdenv; }; })];
+      power.boot.kernelParams = [ "cpufreq.default_governor=powersave" ];
     };
   in
     {

modules/bugs/intel-hdmi.patch

@@ -1,14 +0,0 @@
-diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
-index 55544d484318..d6f257f8fd14 100644
---- a/drivers/gpu/drm/i915/display/intel_bios.c
-+++ b/drivers/gpu/drm/i915/display/intel_bios.c
-@@ -2708,7 +2708,7 @@ static void parse_ddi_port(struct intel_bios_encoder_data *devdata)
- 	if (i915->display.vbt.ports[port]) {
- 		drm_dbg_kms(&i915->drm,
- 			    "More than one child device for port %c in VBT, using the first.\n",
- 			    port_name(port));
--		return;
-+		// return;
- 	}
- 
- 	sanitize_device_type(devdata, port);

modules/hardware/default.nix

@@ -7,7 +7,7 @@ inputs:
     printer.enable = mkOption { type = types.bool; default = false; };
     sound.enable = mkOption { type = types.bool; default = false; };
     cpus = mkOption { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
-    gpus = mkOption { type = types.listOf (types.enum [ "intel" "nvidia" ]); default = []; };
+    gpus = mkOption { type = types.listOf (types.enum [ "intel" "nvidia" "amd" ]); default = []; };
     prime =
     {
       enable = mkOption { type = types.bool; default = false; };
@@ -91,6 +91,7 @@ inputs:
               {
                 intel = [ "i915" ];
                 nvidia = [ "nvidia" "nvidia_drm" "nvidia_modeset" "nvidia_uvm" ];
+                amd = [ "amdgpu" ];
               };
             in
               concatLists (map (gpu: modules.${gpu}) hardware.gpus);
@@ -107,6 +108,7 @@ inputs:
                   {
                     intel = [ intel-compute-runtime intel-media-driver libvdpau-va-gl ]; # intel-vaapi-driver
                     nvidia = [ vaapiVdpau ];
+                    amd = [];
                   };
                 in
                   concatLists (map (gpu: packages.${gpu}) hardware.gpus);
@@ -161,23 +163,13 @@ inputs:
             {
               Type = "simple";
               WorkingDirectory = "/etc/touch_keyboard";
-              # ExecStartPre = let sh = "${inputs.pkgs.bash}/bin/sh"; in
-              # [
-              #   ''-${sh} -c "echo 0 > /sys/class/pwm/pwmchip1/export"''
-              #   ''${sh} -c "echo 0 > /sys/class/pwm/pwmchip1/pwm0/enable"''
-              #   ''${sh} -c "echo 1 > /sys/class/pwm/pwmchip1/pwm0/enable"''
-              # ];
               ExecStart = "${keyboard}/bin/touch_keyboard_handler";
             };
-            yogabook-modes-handler =
+            yogabook-modes-handler.serviceConfig =
             {
-              wantedBy = [ "default.target" ];
-              serviceConfig =
-              {
-                Type = "simple";
-                ExecStart = "${support}/bin/yogabook-modes-handler";
-                StandardOutput = "journal";
-              };
+              Type = "simple";
+              ExecStart = "${support}/bin/yogabook-modes-handler";
+              StandardOutput = "journal";
             };
             monitor-sensor =
             {
@@ -190,6 +182,38 @@ inputs:
             };
           };
           environment.etc."touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
+          boot.initrd =
+          {
+            services.udev.packages = [ keyboard support ];
+            systemd =
+            {
+              extraBin =
+              {
+                touch_keyboard_handler = "${keyboard}/bin/touch_keyboard_handler";
+                yogabook-modes-handler = "${support}/bin/yogabook-modes-handler";
+              };
+              services =
+              {
+                touch-keyboard-handler =
+                {
+                  serviceConfig =
+                  {
+                    Type = "simple";
+                    WorkingDirectory = "/etc/touch_keyboard";
+                    ExecStart = "${keyboard}/bin/touch_keyboard_handler";
+                  };
+                };
+                yogabook-modes-handler.serviceConfig =
+                {
+                  Type = "simple";
+                  ExecStart = "${support}/bin/yogabook-modes-handler";
+                  StandardOutput = "journal";
+                };
+              };
+
+            };
+            extraFiles."/etc/touch_keyboard".source = "${keyboard}/etc/touch_keyboard";
+          };
         }
       ))
     ];

modules/packages/default.nix

@@ -1,10 +1,16 @@
 inputs:
 {
-  options.nixos.packages = let inherit (inputs.lib) mkOption types; in
-  {
-    packageSet = mkOption
-    {
-      type = types.enum
+  imports = inputs.localLib.mkModules
+  [
+    ./server
+    ./desktop
+    ./desktop-fat
+    ./workstation
+  ];
+  options.nixos.packages =
+    let
+      inherit (inputs.lib) mkOption types;
+      packageSets =
       [
         # no gui, only used for specific purpose
         "server"
@@ -14,586 +20,53 @@ inputs:
         # nearly everything
         "workstation"
       ];
-      default = "server";
+    in
+    {
+      packageSet = mkOption { type = types.enum packageSets; default = "server"; };
+      extraPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      excludePackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      extraPythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      excludePythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      extraPrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      excludePrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      _packageSets = mkOption
+      {
+        type = types.listOf types.nonEmptyStr;
+        readOnly = true;
+        default = builtins.genList (i: builtins.elemAt packageSets i)
+          ((inputs.localLib.findIndex inputs.config.nixos.packages.packageSet packageSets) + 1);
+      };
+      _packages = mkOption { type = types.listOf types.unspecified; default = []; };
+      _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+      _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
     };
-    extraPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    excludePackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    extraPythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    excludePythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    extraPrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    excludePrebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    _packages = mkOption { type = types.listOf types.unspecified; default = []; };
-    _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-  };
   config =
     let
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (builtins) concatLists map listToAttrs;
-      inherit (inputs.localLib) attrsToList;
-    in mkMerge
-    [
-      # >= server
-      {
-        nixos =
-        {
-          packages = with inputs.pkgs;
+      inherit (builtins) concatLists map;
+    in
+    {
+      environment.systemPackages = let inherit (inputs.lib.lists) subtractLists; in with inputs.config.nixos.packages;
+        (subtractLists excludePackages (_packages ++ extraPackages))
+        ++ [
+          (inputs.pkgs.python3.withPackages (pythonPackages:
+            subtractLists
+              (concatLists (map (packageFunction: packageFunction pythonPackages) excludePythonPackages))
+              (concatLists (map (packageFunction: packageFunction pythonPackages)
+                (_pythonPackages ++ extraPythonPackages)))))
+          (inputs.pkgs.callPackage ({ stdenv }: stdenv.mkDerivation
           {
-            _packages = 
-            [
-              # shell
-              ksh
-              # basic tools
-              beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij neofetch ipfetch localPackages.pslist
-              fastfetch reptyr
-              # lsxx
-              pciutils usbutils lshw util-linux lsof
-              # top
-              iotop iftop htop btop powertop s-tui
-              # editor
-              nano bat
-              # downloader
-              wget aria2 curl yt-dlp
-              # file manager
-              tree eza trash-cli lsd broot file xdg-ninja mlocate
-              # compress
-              pigz rar upx unzip zip lzip p7zip
-              # file system management
-              sshfs e2fsprogs adb-sync duperemove compsize
-              # disk management
-              smartmontools hdparm
-              # encryption and authentication
-              apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
-              # networking
-              ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils
-              # nix tools
-              nix-output-monitor nix-tree ssh-to-age
-              # office
-              todo-txt-cli
-              # development
-              gdb try inputs.topInputs.plasma-manager.packages.x86_64-linux.rc2nix
-            ] ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
-            _pythonPackages = [(pythonPackages: with pythonPackages;
-            [
-              inquirerpy requests python-telegram-bot tqdm fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
-              certifi charset-normalizer idna orjson psycopg2 localPackages.eigengdb
-            ])];
-          };
-          users.sharedModules = [(home-inputs:
-          {
-            config.programs =
-            {
-              zsh =
-              {
-                enable = true;
-                initExtraBeforeCompInit =
-                ''
-                  # p10k instant prompt
-                  P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
-                  [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
-                  HYPHEN_INSENSITIVE="true"
-                  export PATH=~/bin:$PATH
-                  function br
-                  {
-                    local cmd cmd_file code
-                    cmd_file=$(mktemp)
-                    if broot --outcmd "$cmd_file" "$@"; then
-                      cmd=$(<"$cmd_file")
-                      command rm -f "$cmd_file"
-                      eval "$cmd"
-                    else
-                      code=$?
-                      command rm -f "$cmd_file"
-                      return "$code"
-                    fi
-                  }
-                  alias todo="todo.sh"
-                '';
-                plugins =
-                [
-                  {
-                    file = "powerlevel10k.zsh-theme";
-                    name = "powerlevel10k";
-                    src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
-                  }
-                  {
-                    file = "p10k.zsh";
-                    name = "powerlevel10k-config";
-                    src = ./p10k-config;
-                  }
-                  {
-                    name = "zsh-lsd";
-                    src = inputs.pkgs.fetchFromGitHub
-                    {
-                      owner = "z-shell";
-                      repo = "zsh-lsd";
-                      rev = "029a9cb0a9b39c9eb6c5b5100dd9182813332250";
-                      sha256 = "sha256-oWjWnhiimlGBMaZlZB+OM47jd9hporKlPNwCx6524Rk=";
-                    };
-                  }
-                ];
-                history =
-                {
-                  path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
-                  extended = true;
-                  save = 100000000;
-                  size = 100000000;
-                };
-              };
-              direnv = { enable = true; nix-direnv.enable = true; };
-              git =
-              {
-                enable = true;
-                lfs.enable = true;
-                extraConfig =
-                {
-                  core.editor = if inputs.config.nixos.system.gui.preferred then "code --wait" else "vim";
-                  advice.detachedHead = false;
-                  merge.conflictstyle = "diff3";
-                  diff.colorMoved = "default";
-                };
-                package = inputs.pkgs.gitFull;
-                delta =
-                {
-                  enable = true;
-                  options =
-                  {
-                    side-by-side = true;
-                    navigate = true;
-                    syntax-theme = "GitHub";
-                    light = true;
-                    zero-style = "syntax white";
-                    line-numbers-zero-style = "#ffffff";
-                  };
-                };
-              };
-              ssh =
-              {
-                enable = true;
-                controlMaster = "auto";
-                controlPersist = "1m";
-                compression = true;
-              };
-              vim =
-              {
-                enable = true;
-                defaultEditor = true;
-                packageConfigurable = inputs.config.programs.vim.package;
-                settings =
-                {
-                  number = true;
-                  expandtab = false;
-                  shiftwidth = 2;
-                  tabstop = 2;
-                };
-                extraConfig =
-                ''
-                  set clipboard=unnamedplus
-                  colorscheme evening
-                '';
-              };
-            };
-          })];
-        };
-        programs =
-        {
-          nix-index-database.comma.enable = true;
-          nix-index.enable = true;
-          zsh =
-          {
-            enable = true;
-            syntaxHighlighting.enable = true;
-            autosuggestions.enable = true;
-            enableCompletion = true;
-            ohMyZsh =
-            {
-              enable = true;
-              plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
-              customPkgs = with inputs.pkgs; [ zsh-nix-shell ];
-            };
-          };
-          command-not-found.enable = false;
-          adb.enable = true;
-          gnupg.agent = { enable = true; enableSSHSupport = true; };
-          autojump.enable = true;
-          git =
-          {
-            enable = true;
-            package = inputs.pkgs.gitFull;
-            lfs.enable = true;
-            config =
-            {
-              init.defaultBranch = "main";
-              core = { quotepath = false; editor = "vim"; };
-            };
-          };
-          # yazi.enable = true;
-        };
-        services =
-        {
-          fwupd.enable = true;
-          udev.packages = with inputs.pkgs; [ yubikey-personalization libfido2 ];
-          openssh.knownHosts =
-            let
-              servers =
-              {
-                vps6 =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
-                  hostnames = [ "internal.vps6.chn.moe" "vps6.chn.moe" "74.211.99.69" "192.168.82.1" ];
-                };
-                "initrd.vps6" =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4DKB/zzUYco5ap6k9+UxeO04LL12eGvkmQstnYxgnS";
-                  hostnames = [ "initrd.vps6.chn.moe" "74.211.99.69" ];
-                };
-                vps7 =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5XkdilejDAlg5hZZD0oq69k8fQpe9hIJylTo/aLRgY";
-                  hostnames = [ "internal.vps7.chn.moe" "vps7.chn.moe" "95.111.228.40" "192.168.82.2" ];
-                };
-                "initrd.vps7" =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZyQpdQmEZw3nLERFmk2tS1gpSvXwW0Eish9UfhrRxC";
-                  hostnames = [ "initrd.vps7.chn.moe" "95.111.228.40" ];
-                };
-                nas =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIktNbEcDMKlibXg54u7QOLt0755qB/P4vfjwca8xY6V";
-                  hostnames = [ "internal.nas.chn.moe" "[office.chn.moe]:5440" "192.168.82.4" "192.168.1.185" ];
-                };
-                "initrd.nas" =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
-                  hostnames = [ "[office.chn.moe]:5440" "192.168.1.185" ];
-                };
-                pc =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
-                  hostnames = [ "internal.pc.chn.moe" "192.168.8.2.3" ];
-                };
-                hpc =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVpsQW3kZt5alHC6mZhay3ZEe2fRGziG4YJWCv2nn/O";
-                  hostnames = [ "hpc.xmu.edu.cn" ];
-                };
-                github =
-                {
-                  ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
-                  hostnames = [ "github.com" ];
-                };
-              };
-            in listToAttrs (concatLists (map
-              (server:
-              (
-                if builtins.pathExists ./ssh/${server.name}_rsa.pub then
-                [{
-                  name = "${server.name}-rsa";
-                  value =
-                  {
-                    publicKey = builtins.readFile ./ssh/${server.name}_rsa.pub;
-                    hostNames = server.value.hostnames;
-                  };
-                }]
-                else []
-              )
-              ++ (
-                if builtins.pathExists ./ssh/${server.name}_ecdsa.pub then
-                [{
-                  name = "${server.name}-ecdsa";
-                  value =
-                  {
-                    publicKey = builtins.readFile ./ssh/${server.name}_ecdsa.pub;
-                    hostNames = server.value.hostnames;
-                  };
-                }]
-                else []
-              )
-              ++ (
-                if server.value ? ed25519 then
-                [{
-                  name = "${server.name}-ed25519";
-                  value =
-                  {
-                    publicKey = server.value.ed25519;
-                    hostNames = server.value.hostnames;
-                  };
-                }]
-                else []
-              ))
-              (attrsToList servers)));
-        };
-        home-manager = { useGlobalPkgs = true; useUserPackages = true; };
-      }
-      # >= desktop
-      (
-        mkIf (builtins.elem inputs.config.nixos.packages.packageSet [ "desktop" "desktop-fat" "workstation" ] )
-        {
-          nixos =
-          {
-            packages = with inputs.pkgs;
-            {
-              _packages =
-              [
-                # system management
-                gparted snapper-gui libsForQt5.qtstyleplugin-kvantum wl-clipboard-x11 kio-fuse wl-mirror
-                wayland-utils clinfo glxinfo vulkan-tools dracut                
-                # networking
-                remmina putty mtr-gui
-                # password and key management
-                bitwarden
-                # office
-                crow-translate zotero pandoc ydict logseq
-                # media
-                mpv nomacs
-                # themes
-                tela-circle-icon-theme
-                (
-                  vscode-with-extensions.override
-                  {
-                    vscodeExtensions = with nix-vscode-extensions.vscode-marketplace;
-                      (with equinusocio; [ vsc-community-material-theme vsc-material-theme-icons ])
-                      ++ (with github; [ copilot copilot-chat copilot-labs github-vscode-theme ])
-                      ++ (with intellsmi; [ comment-translate deepl-translate ])
-                      ++ (with ms-python; [ isort python vscode-pylance ])
-                      ++ (with ms-toolsai;
-                      [
-                        jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
-                      ])
-                      ++ (with ms-vscode;
-                      [
-                        cmake-tools cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
-                        test-adapter-converter
-                      ])
-                      ++ (with ms-vscode-remote; [ remote-ssh remote-containers remote-ssh-edit ])
-                      ++ [
-                        donjayamanne.githistory genieai.chatgpt-vscode fabiospampinato.vscode-diff cschlosser.doxdocgen
-                        llvm-vs-code-extensions.vscode-clangd ms-ceintl.vscode-language-pack-zh-hans
-                        oderwat.indent-rainbow
-                        twxs.cmake guyutongxue.cpp-reference znck.grammarly thfriedrich.lammps leetcode.vscode-leetcode
-                        james-yu.latex-workshop gimly81.matlab affenwiesel.matlab-formatter ckolkman.vscode-postgres
-                        yzhang.markdown-all-in-one pkief.material-icon-theme bbenoist.nix ms-ossdata.vscode-postgresql
-                        redhat.vscode-xml dotjoshjohnson.xml jnoortheen.nix-ide xdebug.php-debug
-                        hbenl.vscode-test-explorer
-                        jeff-hykin.better-cpp-syntax fredericbonnet.cmake-test-adapter mesonbuild.mesonbuild
-                        hirse.vscode-ungit fortran-lang.linter-gfortran tboox.xmake-vscode ccls-project.ccls
-                        feiskyer.chatgpt-copilot yukiuuh2936.vscode-modern-fortran-formatter wolframresearch.wolfram
-                        njpipeorgan.wolfram-language-notebook brettm12345.nixfmt-vscode webfreak.debug
-                        gruntfuggly.todo-tree
-                        # restrctured text
-                        lextudio.restructuredtext trond-snekvik.simple-rst
-                      ];
-                  }
-                )
-              ];
-              _pythonPackages = [(pythonPackages: with pythonPackages;
-              [
-                # required by vscode extensions restrucuredtext
-                localPackages.esbonio
-              ])];
-            };
-            users.sharedModules =
-            [{
-              config.home.file.".config/baloofilerc".text =
-              ''
-                [Basic Settings]
-                Indexing-Enabled=false
-              '';
-            }];
-          };
-          programs =
-          {
-            wireshark = { enable = true; package = inputs.pkgs.wireshark; };
-            firefox = { enable = true; languagePacks = [ "zh-CN" "en-US" ]; };
-            vim.package = inputs.pkgs.vim-full;
-          };
-          nixpkgs.config.packageOverrides = pkgs: 
-          {
-            telegram-desktop = pkgs.telegram-desktop.overrideAttrs (attrs:
-            {
-              patches = (if (attrs ? patches) then attrs.patches else []) ++ [ ./telegram.patch ];
-            });
-          };
-          services.pcscd.enable = true;
-        }
-      )
-      # >= desktop-fat
-      (
-        mkIf (builtins.elem inputs.config.nixos.packages.packageSet [ "desktop-fat" "workstation" ] )
-        {
-          nixos =
-          {
-            packages = with inputs.pkgs;
-            {
-              _packages =
-              [
-                # system management
-                etcher btrfs-assistant
-                # password and key management
-                yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui electrum jabref
-                # download
-                qbittorrent nur-xddxdd.baidupcs-go wgetpaste
-                # development
-                scrcpy weston cage openbox krita
-                # media
-                spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc
-                # editor
-                localPackages.typora hdfview
-                # themes
-                orchis-theme plasma-overdose-kde-theme materia-kde-theme graphite-kde-theme arc-kde-theme materia-theme
-                # news
-                fluent-reader rssguard newsflash newsboat
-                # nix tools
-                deploy-rs.deploy-rs nixpkgs-fmt
-                # instant messager
-                element-desktop telegram-desktop discord inputs.config.nur.repos.linyinfeng.wemeet # native
-                cinny-desktop # nur-xddxdd.wine-wechat thunder
-                # browser
-                google-chrome microsoft-edge
-              ] ++ (with inputs.lib; filter isDerivation (attrValues plasma5Packages.kdeGear));
-            };
-            users.sharedModules =
-            [{
-              config.programs =
-              {
-                chromium =
-                {
-                  enable = true;
-                  extensions =
-                  [
-                    { id = "mpkodccbngfoacfalldjimigbofkhgjn"; } # Aria2 Explorer
-                    { id = "nngceckbapebfimnlniiiahkandclblb"; } # Bitwarden
-                    { id = "kbfnbcaeplbcioakkpcpgfkobkghlhen"; } # Grammarly
-                    { id = "ihnfpdchjnmlehnoeffgcbakfmdjcckn"; } # Pixiv Fanbox Downloader
-                    { id = "cimiefiiaegbelhefglklhhakcgmhkai"; } # Plasma Integration
-                    { id = "dkndmhgdcmjdmkdonmbgjpijejdcilfh"; } # Powerful Pixiv Downloader
-                    { id = "padekgcemlokbadohgkifijomclgjgif"; } # Proxy SwitchyOmega
-                    { id = "kefjpfngnndepjbopdmoebkipbgkggaa"; } # RSSHub Radar
-                    { id = "abpdnfjocnmdomablahdcfnoggeeiedb"; } # Save All Resources
-                    { id = "nbokbjkabcmbfdlbddjidfmibcpneigj"; } # SmoothScroll
-                    { id = "onepmapfbjohnegdmfhndpefjkppbjkm"; } # SuperCopy 超级复制
-                    { id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; } # uBlock Origin
-                    { id = "gppongmhjkpfnbhagpmjfkannfbllamg"; } # Wappalyzer
-                    { id = "hkbdddpiemdeibjoknnofflfgbgnebcm"; } # YouTube™ 双字幕
-                    { id = "ekhagklcjbdpajgpjgmbionohlpdbjgc"; } # Zotero Connector
-                    { id = "ikhdkkncnoglghljlkmcimlnlhkeamad"; } # 划词翻译
-                    { id = "dhdgffkkebhmkfjojejmpbldmpobfkfo"; } # 篡改猴
-                    { id = "hipekcciheckooncpjeljhnekcoolahp"; } # Tabliss
-                    { id = "nkbihfbeogaeaoehlefnkodbefgpgknn"; } # MetaMask
-                  ];
-                };
-                obs-studio =
-                {
-                  enable = true;
-                  plugins = with inputs.pkgs.obs-studio-plugins;
-                    [ wlrobs obs-vaapi obs-nvfbc droidcam-obs obs-vkcapture ];
-                };
-                doom-emacs = { enable = true; doomPrivateDir = ./doom.d; };
-              };
-            }];
-          };
-          programs = { steam.enable = true; kdeconnect.enable = true; };
-        }
-      )
-      # >= workstation
-      (
-        mkIf (inputs.config.nixos.packages.packageSet == "workstation")
-        {
-          nixos.packages = with inputs.pkgs;
-          {
-            _packages =
-            [
-              # nix tools
-              nix-template appimage-run nil nixd nix-alien nix-serve node2nix nix-prefetch-github prefetch-npm-deps
-              nix-prefetch-docker pnpm-lock-export bundix
-              # instant messager
-              zoom-us signal-desktop qq nur-xddxdd.wechat-uos slack # jail
-              # office
-              libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain
-              (texlive.combine { inherit (texlive) scheme-full; inherit (localPackages) citation-style-language; })
-              # development
-              jetbrains.clion android-studio dbeaver cling clang-tools_16 ccls fprettify aircrack-ng
-              # media
-              nur-xddxdd.svp obs-studio waifu2x-converter-cpp inkscape blender
-              # virtualization
-              wineWowPackages.stagingFull virt-viewer bottles # wine64
-              # text editor
-              appflowy notion-app-enhanced joplin-desktop standardnotes
-              # math, physics and chemistry
-              mathematica octaveFull root ovito paraview localPackages.vesta qchem.quantum-espresso
-              localPackages.vasp localPackages.vaspkit jmol localPackages.v_sim
-              # encryption and password management
-              john crunch hashcat
-              # container and vm
-              genymotion # davinci-resolve playonlinux
-            ];
-            _pythonPackages = [(pythonPackages: with pythonPackages;
-            [
-              phonopy tensorflow keras openai scipy scikit-learn jupyterlab autograd
-            ])];
-            _prebuildPackages =
-            [
-              httplib magic-enum xtensor boost cereal cxxopts ftxui yaml-cpp gfortran gcc10 python2
-              gcc13Stdenv
-            ];
-          };
-          programs =
-          {
-            anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
-            honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
-            nix-ld.enable = true;
-            gamemode =
-            {
-              enable = true;
-              settings =
-              {
-                general.renice = 10;
-                gpu =
-                {
-                  apply_gpu_optimisations = "accept-responsibility";
-                  nv_powermizer_mode = 1;
-                };
-                custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
-                {
-                  start = "${notify-send} 'GameMode started'";
-                  end = "${notify-send} 'GameMode ended'";
-                };
-              };
-            };
-            chromium =
-            {
-              enable = true;
-              extraOpts.PasswordManagerEnabled = false;
-            };
-          };
-        }
-      )
-      # apply package configs
-      {
-        environment.systemPackages = let inherit (inputs.lib.lists) subtractLists; in with inputs.config.nixos.packages;
-          (subtractLists excludePackages (_packages ++ extraPackages))
-          ++ [
-            (inputs.pkgs.python3.withPackages (pythonPackages:
-              subtractLists
-                (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-                  excludePythonPackages))
-                (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-                  (_pythonPackages ++ extraPythonPackages)))))
-            (inputs.pkgs.callPackage ({ stdenv }: stdenv.mkDerivation
-            {
-              name = "prebuild-packages";
-              propagateBuildInputs = subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages);
-              phases = [ "installPhase" ];
-              installPhase =
-              ''
-                runHook preInstall
-                mkdir -p $out
-                runHook postInstall
-              '';
-            }) {})
-          ];
-      }
-    ];
+            name = "prebuild-packages";
+            propagateBuildInputs = subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages);
+            phases = [ "installPhase" ];
+            installPhase =
+            ''
+              runHook preInstall
+              mkdir -p $out
+              runHook postInstall
+            '';
+          }) {})
+        ];
+    };
 }
 
     # programs.firejail =

modules/packages/desktop-fat/chromium.nix

@@ -0,0 +1,39 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
+    {
+      nixos.users.sharedModules =
+      [{
+        config.programs.chromium =
+        {
+          enable = true;
+          extensions =
+          [
+            { id = "mpkodccbngfoacfalldjimigbofkhgjn"; } # Aria2 Explorer
+            { id = "nngceckbapebfimnlniiiahkandclblb"; } # Bitwarden
+            { id = "kbfnbcaeplbcioakkpcpgfkobkghlhen"; } # Grammarly
+            { id = "ihnfpdchjnmlehnoeffgcbakfmdjcckn"; } # Pixiv Fanbox Downloader
+            { id = "cimiefiiaegbelhefglklhhakcgmhkai"; } # Plasma Integration
+            { id = "dkndmhgdcmjdmkdonmbgjpijejdcilfh"; } # Powerful Pixiv Downloader
+            { id = "padekgcemlokbadohgkifijomclgjgif"; } # Proxy SwitchyOmega
+            { id = "kefjpfngnndepjbopdmoebkipbgkggaa"; } # RSSHub Radar
+            { id = "abpdnfjocnmdomablahdcfnoggeeiedb"; } # Save All Resources
+            { id = "nbokbjkabcmbfdlbddjidfmibcpneigj"; } # SmoothScroll
+            { id = "onepmapfbjohnegdmfhndpefjkppbjkm"; } # SuperCopy 超级复制
+            { id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; } # uBlock Origin
+            { id = "gppongmhjkpfnbhagpmjfkannfbllamg"; } # Wappalyzer
+            { id = "hkbdddpiemdeibjoknnofflfgbgnebcm"; } # YouTube™ 双字幕
+            { id = "ekhagklcjbdpajgpjgmbionohlpdbjgc"; } # Zotero Connector
+            { id = "ikhdkkncnoglghljlkmcimlnlhkeamad"; } # 划词翻译
+            { id = "dhdgffkkebhmkfjojejmpbldmpobfkfo"; } # 篡改猴
+            { id = "hipekcciheckooncpjeljhnekcoolahp"; } # Tabliss
+            { id = "nkbihfbeogaeaoehlefnkodbefgpgknn"; } # MetaMask
+            { id = "bpoadfkcbjbfhfodiogcnhhhpibjhbnh"; } # 沉浸式翻译
+          ];
+        };
+      }];
+    };
+}

modules/packages/desktop-fat/default.nix

@@ -0,0 +1,47 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules
+  [
+    ./chromium.nix
+  ];
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "desktop-fat" inputs.config.nixos.packages._packageSets)
+    {
+      nixos =
+      {
+        packages = with inputs.pkgs;
+        {
+          _packages =
+          [
+            # system management
+            etcher btrfs-assistant snapper-gui libsForQt5.qtstyleplugin-kvantum
+            # password and key management
+            yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden
+            # download
+            qbittorrent nur-xddxdd.baidupcs-go wgetpaste
+            # development
+            scrcpy weston cage openbox krita
+            # media
+            spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc
+            # editor
+            localPackages.typora
+            # themes
+            orchis-theme plasma-overdose-kde-theme materia-kde-theme graphite-kde-theme arc-kde-theme materia-theme
+            # news
+            fluent-reader
+            # nix tools
+            deploy-rs.deploy-rs nixpkgs-fmt
+            # instant messager
+            element-desktop telegram-desktop discord fluffychat
+            # browser
+            google-chrome
+            # office
+            crow-translate zotero pandoc ydict
+          ] ++ (with inputs.lib; filter isDerivation (attrValues plasma5Packages.kdeGear));
+        };
+      };
+      programs = { steam.enable = true; kdeconnect.enable = true; };
+    };
+}

modules/packages/desktop/default.nix

@@ -0,0 +1,49 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules [ ./vscode.nix ];
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "desktop" inputs.config.nixos.packages._packageSets)
+    {
+      nixos =
+      {
+        packages._packages = with inputs.pkgs;
+        [
+          # system management
+          gparted wl-clipboard-x11 kio-fuse
+          wayland-utils clinfo glxinfo vulkan-tools dracut
+          # networking
+          remmina putty mtr-gui
+          # media
+          mpv nomacs
+          # themes
+          tela-circle-icon-theme
+        ];
+        users.sharedModules =
+        [{
+          config.home.file.".config/baloofilerc".text =
+          ''
+            [Basic Settings]
+            Indexing-Enabled=false
+          '';
+        }];
+      };
+      programs =
+      {
+        adb.enable = true;
+        wireshark = { enable = true; package = inputs.pkgs.wireshark; };
+        firefox = { enable = true; languagePacks = [ "zh-CN" "en-US" ]; };
+        vim.package = inputs.pkgs.vim-full;
+      };
+      nixpkgs.config.packageOverrides = pkgs: 
+      {
+        telegram-desktop = pkgs.telegram-desktop.overrideAttrs (attrs:
+        {
+          patches = (if (attrs ? patches) then attrs.patches else []) ++ [ ./telegram.patch ];
+        });
+      };
+      services.pcscd.enable = true;
+    };
+}
+

modules/packages/desktop/vscode.nix

@@ -0,0 +1,57 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "desktop" inputs.config.nixos.packages._packageSets)
+    {
+      nixos.packages = with inputs.pkgs;
+      {
+        _packages =
+        [(
+          vscode-with-extensions.override
+          {
+            vscodeExtensions = with nix-vscode-extensions.vscode-marketplace;
+              (with equinusocio; [ vsc-community-material-theme vsc-material-theme-icons ])
+              ++ (with github; [ copilot copilot-chat github-vscode-theme ])
+              ++ (with intellsmi; [ comment-translate deepl-translate ])
+              ++ (with ms-python; [ isort python vscode-pylance ])
+              ++ (with ms-toolsai;
+              [
+                jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
+              ])
+              ++ (with ms-vscode;
+              [
+                cmake-tools cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
+                test-adapter-converter
+              ])
+              ++ (with ms-vscode-remote; [ remote-ssh remote-containers remote-ssh-edit ])
+              ++ [
+                donjayamanne.githistory genieai.chatgpt-vscode fabiospampinato.vscode-diff cschlosser.doxdocgen
+                llvm-vs-code-extensions.vscode-clangd ms-ceintl.vscode-language-pack-zh-hans
+                oderwat.indent-rainbow
+                twxs.cmake guyutongxue.cpp-reference znck.grammarly thfriedrich.lammps leetcode.vscode-leetcode
+                james-yu.latex-workshop gimly81.matlab affenwiesel.matlab-formatter ckolkman.vscode-postgres
+                yzhang.markdown-all-in-one pkief.material-icon-theme bbenoist.nix ms-ossdata.vscode-postgresql
+                redhat.vscode-xml dotjoshjohnson.xml jnoortheen.nix-ide xdebug.php-debug
+                hbenl.vscode-test-explorer
+                jeff-hykin.better-cpp-syntax fredericbonnet.cmake-test-adapter mesonbuild.mesonbuild
+                hirse.vscode-ungit fortran-lang.linter-gfortran tboox.xmake-vscode ccls-project.ccls
+                feiskyer.chatgpt-copilot yukiuuh2936.vscode-modern-fortran-formatter wolframresearch.wolfram
+                njpipeorgan.wolfram-language-notebook brettm12345.nixfmt-vscode webfreak.debug
+                gruntfuggly.todo-tree
+                # restrctured text
+                lextudio.restructuredtext trond-snekvik.simple-rst
+                # markdown
+                shd101wyy.markdown-preview-enhanced
+              ];
+          }
+        )];
+        _pythonPackages = [(pythonPackages: with pythonPackages;
+        [
+          # required by vscode extensions restrucuredtext
+          localPackages.esbonio
+        ])];
+      };
+    };
+}

modules/packages/server/default.nix

@@ -0,0 +1,134 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules
+  [
+    ./ssh
+    ./zsh
+  ];
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+      inherit (builtins) concatLists map listToAttrs;
+      inherit (inputs.localLib) attrsToList;
+    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
+    {
+      nixos =
+      {
+        packages = with inputs.pkgs;
+        {
+          _packages = 
+          [
+            # shell
+            ksh
+            # basic tools
+            beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij neofetch ipfetch localPackages.pslist
+            fastfetch reptyr
+            # lsxx
+            pciutils usbutils lshw util-linux lsof
+            # top
+            iotop iftop htop btop powertop s-tui
+            # editor
+            nano bat
+            # downloader
+            wget aria2 curl yt-dlp
+            # file manager
+            tree eza trash-cli lsd broot file xdg-ninja mlocate
+            # compress
+            pigz rar upx unzip zip lzip p7zip
+            # file system management
+            sshfs e2fsprogs adb-sync duperemove compsize exfatprogs
+            # disk management
+            smartmontools hdparm
+            # encryption and authentication
+            apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
+            # networking
+            ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
+            # nix tools
+            nix-output-monitor nix-tree ssh-to-age
+            # office
+            todo-txt-cli
+            # development
+            gdb try inputs.topInputs.plasma-manager.packages.x86_64-linux.rc2nix hexo-cli
+          ] ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
+        };
+        users.sharedModules = [(home-inputs:
+        {
+          config.programs =
+          {
+            direnv = { enable = true; nix-direnv.enable = true; };
+            git =
+            {
+              enable = true;
+              lfs.enable = true;
+              extraConfig =
+              {
+                core.editor = if inputs.config.nixos.system.gui.preferred then "code --wait" else "vim";
+                advice.detachedHead = false;
+                merge.conflictstyle = "diff3";
+                diff.colorMoved = "default";
+              };
+              package = inputs.pkgs.gitFull;
+              delta =
+              {
+                enable = true;
+                options =
+                {
+                  side-by-side = true;
+                  navigate = true;
+                  syntax-theme = "GitHub";
+                  light = true;
+                  zero-style = "syntax white";
+                  line-numbers-zero-style = "#ffffff";
+                };
+              };
+            };
+            vim =
+            {
+              enable = true;
+              defaultEditor = true;
+              packageConfigurable = inputs.config.programs.vim.package;
+              settings =
+              {
+                number = true;
+                expandtab = false;
+                shiftwidth = 2;
+                tabstop = 2;
+              };
+              extraConfig =
+              ''
+                set clipboard=unnamedplus
+                colorscheme evening
+              '';
+            };
+          };
+        })];
+      };
+      programs =
+      {
+        nix-index-database.comma.enable = true;
+        nix-index.enable = true;
+        command-not-found.enable = false;
+        gnupg.agent = { enable = true; enableSSHSupport = true; };
+        autojump.enable = true;
+        git =
+        {
+          enable = true;
+          package = inputs.pkgs.gitFull;
+          lfs.enable = true;
+          config =
+          {
+            init.defaultBranch = "main";
+            core = { quotepath = false; editor = "vim"; };
+          };
+        };
+        yazi.enable = true;
+        mosh.enable = true;
+      };
+      services =
+      {
+        fwupd.enable = true;
+        udev.packages = with inputs.pkgs; [ yubikey-personalization libfido2 ];
+      };
+      home-manager = { useGlobalPkgs = true; useUserPackages = true; };
+    };
+}

modules/packages/server/ssh/default.nix

@@ -0,0 +1,161 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+      inherit (builtins) concatLists map listToAttrs;
+      inherit (inputs.localLib) attrsToList;
+    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
+    {
+      services.openssh.knownHosts =
+        let
+          servers =
+          {
+            vps6 =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
+              hostnames = [ "vps6.chn.moe" "wireguard.vps6.chn.moe" "74.211.99.69" "192.168.83.1" ];
+            };
+            "initrd.vps6" =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4DKB/zzUYco5ap6k9+UxeO04LL12eGvkmQstnYxgnS";
+              hostnames = [ "initrd.vps6.chn.moe" "74.211.99.69" ];
+            };
+            vps7 =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5XkdilejDAlg5hZZD0oq69k8fQpe9hIJylTo/aLRgY";
+              hostnames = [ "vps7.chn.moe" "wireguard.vps7.chn.moe" "ssh.git.chn.moe" "95.111.228.40" "192.168.83.2" ];
+            };
+            "initrd.vps7" =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZyQpdQmEZw3nLERFmk2tS1gpSvXwW0Eish9UfhrRxC";
+              hostnames = [ "initrd.vps7.chn.moe" "95.111.228.40" ];
+            };
+            nas =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIktNbEcDMKlibXg54u7QOLt0755qB/P4vfjwca8xY6V";
+              hostnames = [ "wireguard.nas.chn.moe" "[office.chn.moe]:5440" "192.168.1.185" "192.168.83.4" ];
+            };
+            "initrd.nas" =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
+              hostnames = [ "initrd.nas.chn.moe" "[office.chn.moe]:5440" "192.168.1.185" ];
+            };
+            pc =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
+              hostnames = [ "wireguard.pc.chn.moe" "192.168.83.3" ];
+            };
+            hpc =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVpsQW3kZt5alHC6mZhay3ZEe2fRGziG4YJWCv2nn/O";
+              hostnames = [ "hpc.xmu.edu.cn" ];
+            };
+            github =
+            {
+              ed25519 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+              hostnames = [ "github.com" ];
+            };
+          };
+        in listToAttrs (concatLists (map
+          (server:
+          (
+            if builtins.pathExists ./ssh/${server.name}_rsa.pub then
+            [{
+              name = "${server.name}-rsa";
+              value =
+              {
+                publicKey = builtins.readFile ./ssh/${server.name}_rsa.pub;
+                hostNames = server.value.hostnames;
+              };
+            }]
+            else []
+          )
+          ++ (
+            if builtins.pathExists ./ssh/${server.name}_ecdsa.pub then
+            [{
+              name = "${server.name}-ecdsa";
+              value =
+              {
+                publicKey = builtins.readFile ./ssh/${server.name}_ecdsa.pub;
+                hostNames = server.value.hostnames;
+              };
+            }]
+            else []
+          )
+          ++ (
+            if server.value ? ed25519 then
+            [{
+              name = "${server.name}-ed25519";
+              value =
+              {
+                publicKey = server.value.ed25519;
+                hostNames = server.value.hostnames;
+              };
+            }]
+            else []
+          ))
+          (attrsToList servers)));
+      nixos.users.sharedModules =
+      [(hmInputs: {
+        config.programs.ssh =
+        {
+          enable = true;
+          controlMaster = "auto";
+          controlPersist = "1m";
+          compression = true;
+          matchBlocks = builtins.listToAttrs
+          (
+            (builtins.map
+              (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
+              [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "wireguard.nas" ])
+            ++ (builtins.map
+              (host:
+              {
+                name = host;
+                value =
+                {
+                  host = host;
+                  hostname = "hpc.xmu.edu.cn";
+                  user = host;
+                  extraOptions =
+                  {
+                    PubkeyAcceptedAlgorithms = "+ssh-rsa";
+                    HostkeyAlgorithms = "+ssh-rsa";
+                    SetEnv =
+                      let
+                        usernameMap =
+                        {
+                          chn = "linwei/chn";
+                        };
+                        cdString =
+                          if host == "jykang" && (usernameMap ? ${hmInputs.config.home.username}) then
+                            ":chn_cd:${usernameMap.${hmInputs.config.home.username}}"
+                          else "";
+                      in "TERM=chn_unset_ls_colors${cdString}:xterm-256color";
+                    # in .bash_profile:
+                    # if [[ $TERM == chn_unset_ls_colors* ]]; then
+                    #   export TERM=${TERM#*:}
+                    #   export CHN_LS_USE_COLOR=1
+                    # fi
+                    # if [[ $TERM == chn_cd* ]]; then
+                    #   export TERM=${TERM#*:}
+                    #   cd ~/${TERM%%:*}
+                    #   export TERM=${TERM#*:}
+                    # fi
+                    # in .bashrc
+                    # [ -n "$CHN_LS_USE_COLOR" ] && alias ls="ls --color=auto"
+                  };
+                };
+              })
+              [ "wlin" "jykang" "hwang" ])
+          )
+          // {
+            xmupc1 = { host = "xmupc1"; hostname = "office.chn.moe"; port = 6007; };
+            nas = { host = "nas"; hostname = "office.chn.moe"; port = 5440; };
+            gitea = { host = "gitea"; hostname = "ssh.git.chn.moe"; };
+          };
+        };
+      })];
+    };
+}

modules/packages/server/zsh/default.nix

@@ -0,0 +1,79 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "server" inputs.config.nixos.packages._packageSets)
+    {
+      nixos.users.sharedModules = [(home-inputs: { config.programs.zsh =
+      {
+        enable = true;
+        initExtraBeforeCompInit =
+        ''
+          # p10k instant prompt
+          P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
+          [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
+          HYPHEN_INSENSITIVE="true"
+          export PATH=~/bin:$PATH
+          function br
+          {
+            local cmd cmd_file code
+            cmd_file=$(mktemp)
+            if broot --outcmd "$cmd_file" "$@"; then
+              cmd=$(<"$cmd_file")
+              command rm -f "$cmd_file"
+              eval "$cmd"
+            else
+              code=$?
+              command rm -f "$cmd_file"
+              return "$code"
+            fi
+          }
+          alias todo="todo.sh"
+        '';
+        plugins =
+        [
+          {
+            file = "powerlevel10k.zsh-theme";
+            name = "powerlevel10k";
+            src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
+          }
+          {
+            file = "p10k.zsh";
+            name = "powerlevel10k-config";
+            src = ./p10k-config;
+          }
+          {
+            name = "zsh-lsd";
+            src = inputs.pkgs.fetchFromGitHub
+            {
+              owner = "z-shell";
+              repo = "zsh-lsd";
+              rev = "029a9cb0a9b39c9eb6c5b5100dd9182813332250";
+              sha256 = "sha256-oWjWnhiimlGBMaZlZB+OM47jd9hporKlPNwCx6524Rk=";
+            };
+          }
+        ];
+        history =
+        {
+          path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
+          extended = true;
+          save = 100000000;
+          size = 100000000;
+        };
+      };})];
+      programs.zsh =
+      {
+        enable = true;
+        syntaxHighlighting.enable = true;
+        autosuggestions.enable = true;
+        enableCompletion = true;
+        ohMyZsh =
+        {
+          enable = true;
+          plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
+          customPkgs = with inputs.pkgs; [ zsh-nix-shell ];
+        };
+      };
+    };
+}

modules/packages/workstation/default.nix

@@ -0,0 +1,104 @@
+inputs:
+{
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+    in mkIf (builtins.elem "workstation" inputs.config.nixos.packages._packageSets)
+    {
+      nixos =
+      {
+        packages = with inputs.pkgs;
+        {
+          _packages =
+          [
+            # password and key management
+            electrum jabref
+            # system management
+            wl-mirror ventoy-full
+            # nix tools
+            nix-template appimage-run nil nixd nix-alien nix-serve node2nix nix-prefetch-github prefetch-npm-deps
+            nix-prefetch-docker pnpm-lock-export bundix
+            # instant messager
+            zoom-us signal-desktop qq nur-xddxdd.wechat-uos slack inputs.config.nur.repos.linyinfeng.wemeet
+            cinny-desktop nheko
+            # office
+            libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
+            (texlive.combine { inherit (texlive) scheme-full; inherit (localPackages) citation-style-language; })
+            # development
+            jetbrains.clion android-studio dbeaver cling clang-tools_16 ccls fprettify aircrack-ng
+            # media
+            nur-xddxdd.svp obs-studio waifu2x-converter-cpp inkscape blender
+            # virtualization
+            wineWowPackages.stagingFull virt-viewer bottles # wine64
+            # text editor
+            appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+            # math, physics and chemistry
+            mathematica octaveFull root ovito paraview localPackages.vesta qchem.quantum-espresso
+            localPackages.vasp localPackages.vaspkit jmol localPackages.v_sim
+            # encryption and password management
+            john crunch hashcat
+            # container and vm
+            genymotion # davinci-resolve playonlinux
+            # browser
+            microsoft-edge
+            # news
+            rssguard newsflash newsboat
+          ];
+          _pythonPackages = [(pythonPackages: with pythonPackages;
+          [
+            phonopy tensorflow keras openai scipy scikit-learn jupyterlab autograd
+            # localPackages.pix2tex
+            inquirerpy requests python-telegram-bot tqdm fastapi pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+            certifi charset-normalizer idna orjson psycopg2 localPackages.eigengdb
+          ])];
+          _prebuildPackages =
+          [
+            httplib magic-enum xtensor boost cereal cxxopts ftxui yaml-cpp gfortran gcc10 python2
+            gcc13Stdenv
+          ];
+        };
+        users.sharedModules =
+        [{
+          config.programs =
+          {
+            obs-studio =
+            {
+              enable = true;
+              plugins = with inputs.pkgs.obs-studio-plugins;
+                [ wlrobs obs-vaapi obs-nvfbc droidcam-obs obs-vkcapture ];
+            };
+            doom-emacs = { enable = true; doomPrivateDir = ./doom.d; };
+          };
+        }];
+      };
+      programs =
+      {
+        anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
+        honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
+        nix-ld.enable = true;
+        gamemode =
+        {
+          enable = true;
+          settings =
+          {
+            general.renice = 10;
+            gpu =
+            {
+              apply_gpu_optimisations = "accept-responsibility";
+              nv_powermizer_mode = 1;
+            };
+            custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
+            {
+              start = "${notify-send} 'GameMode started'";
+              end = "${notify-send} 'GameMode ended'";
+            };
+          };
+        };
+        chromium =
+        {
+          enable = true;
+          extraOpts.PasswordManagerEnabled = false;
+        };
+      };
+    };
+}

modules/services/akkoma.nix

@@ -0,0 +1,51 @@
+inputs:
+{
+  options.nixos.services.akkoma = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.str; default = "akkoma.chn.moe"; };
+  };
+  config =
+    let
+      inherit (inputs.config.nixos.services) akkoma;
+      inherit (inputs.lib) mkIf;
+    in mkIf akkoma.enable
+    {
+      services.akkoma =
+      {
+        enable = true;
+        config.":pleroma" =
+        {
+          "Pleroma.Web.Endpoint".url.host = akkoma.hostname;
+          "Pleroma.Repo" =
+          {
+            adapter = (inputs.pkgs.formats.elixirConf { }).lib.mkRaw "Ecto.Adapters.Postgres";
+            hostname = "127.0.0.1";
+            username = "akkoma";
+            password._secret = inputs.config.sops.secrets."akkoma/db".path;
+            database = "akkoma";
+          };
+          ":instance" =
+          {
+            name = "艹";
+            email = "grass@grass.squre";
+            description = "艹艹艹艹艹";
+          };
+        };
+      };
+      nixos.services =
+      {
+        nginx =
+        {
+          enable = true;
+          https."${akkoma.hostname}" =
+          {
+            global.tlsCert = "/var/lib/akkoma";
+            location."/".proxy = { upstream = "http://127.0.0.1:4000"; websocket = true; };
+          };
+        };
+        postgresql.instances.akkoma = {};
+      };
+      sops.secrets."akkoma/db" = { owner = "akkoma"; key = "postgresql/akkoma"; };
+    };
+}

modules/services/default.nix

@@ -35,9 +35,11 @@ inputs:
     ./httpapi.nix
     ./mirism.nix
     ./mastodon.nix
-    ./gitlab.nix
+    ./gitea.nix
     ./grafana.nix
     ./fail2ban.nix
+    ./wireguard.nix
+    ./akkoma.nix
   ];
   options.nixos.services = let inherit (inputs.lib) mkOption types; in
   {

modules/services/frp.nix

@@ -113,6 +113,7 @@ inputs:
                     type = "stcp";
                     transport.useCompression = true;
                     secretKey = inputs.config.sops.placeholder."frp/stcp/${stcp.name}";
+                    allowUsers = [ "*" ];
                     inherit (stcp.value) localIp localPort;
                   })
                   (attrsToList frpClient.stcp));
@@ -139,7 +140,11 @@ inputs:
                 (attrsToList (with frpClient; stcp // stcpVisitor)))
             );
           };
-          users = { users.frp = { isSystemUser = true; group = "frp"; }; groups.frp = {}; };
+          users =
+          {
+            users.frp = { uid = inputs.config.nixos.system.user.user.frp; group = "frp"; isSystemUser = true; };
+            groups.frp.gid = inputs.config.nixos.system.user.group.frp;
+          };
         }
       )
       (
@@ -186,7 +191,11 @@ inputs:
             secrets."frp/token" = {};
           };
           nixos.services.acme = { enable = true; cert.${frpServer.serverName}.group = "frp"; };
-          users = { users.frp = { isSystemUser = true; group = "frp"; }; groups.frp = {}; };
+          users =
+          {
+            users.frp = { uid = inputs.config.nixos.system.user.user.frp; group = "frp"; isSystemUser = true; };
+            groups.frp.gid = inputs.config.nixos.system.user.group.frp;
+          };
           networking.firewall.allowedTCPPorts = [ 7000 ];
         }
       )

modules/services/fz-new-order/default.nix

@@ -15,8 +15,14 @@ inputs:
       users =
       {
         users.fz-new-order =
-          { isSystemUser = true; group = "fz-new-order"; home = "/var/lib/fz-new-order"; createHome = true; };
-        groups.fz-new-order = {};
+        {
+          uid = inputs.config.nixos.system.user.user.fz-new-order;
+          group = "fz-new-order";
+          home = "/var/lib/fz-new-order";
+          createHome = true;
+          isSystemUser = true;
+        };
+        groups.fz-new-order.gid = inputs.config.nixos.system.user.group.fz-new-order;
       };
       systemd =
       {
@@ -70,6 +76,11 @@ inputs:
               in "${binary}/bin/fz-new-order";
           };
         };
+        tmpfiles.rules =
+        [
+          "d /var/lib/fz-new-order 0700 fz-new-order fz-new-order"
+          "Z /var/lib/fz-new-order - fz-new-order fz-new-order"
+        ];
       };
       sops = let userNum = 6; configNum = 2; in
       {

modules/services/gitea.nix

@@ -0,0 +1,54 @@
+inputs:
+{
+  options.nixos.services.gitea = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.str; default = "git.chn.moe"; };
+  };
+  config =
+    let
+      inherit (inputs.config.nixos.services) gitea;
+      inherit (inputs.lib) mkIf;
+    in mkIf gitea.enable
+    {
+      services.gitea =
+      {
+        enable = true;
+        lfs.enable = true;
+        mailerPasswordFile = inputs.config.sops.secrets."gitea/mail".path;
+        database =
+          { createDatabase = false; type = "postgres"; passwordFile = inputs.config.sops.secrets."gitea/db".path; };
+        settings =
+        {
+          session.COOKIE_SECURE = true;
+          server =
+          {
+            ROOT_URL = "https://${gitea.hostname}";
+            DOMAIN = gitea.hostname;
+            HTTP_PORT = 3002;
+            SSH_DOMAIN = "ssh.${gitea.hostname}";
+          };
+          mailer =
+          {
+            ENABLED = true;
+            FROM = "bot@chn.moe";
+            PROTOCOL = "smtps";
+            SMTP_ADDR = "mail.chn.moe";
+            SMTP_PORT = 465;
+            USER = "bot@chn.moe";
+          };
+        };
+      };
+      nixos.services =
+      {
+        nginx = { enable = true; https."${gitea.hostname}".location."/".proxy.upstream = "http://127.0.0.1:3002"; };
+        postgresql.instances.gitea = {};
+      };
+      sops.secrets =
+      {
+        "gitea/mail" = { owner = "gitea"; key = "mail/bot"; };
+        "gitea/db" = { owner = "gitea"; key = "postgresql/gitea"; };
+        "mail/bot" = {};
+      };
+    };
+}

modules/services/gitlab.nix

@@ -1,67 +0,0 @@
-inputs:
-{
-  options.nixos.services.gitlab = let inherit (inputs.lib) mkOption types; in
-  {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.str; default = "gitlab.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) gitlab;
-      inherit (inputs.lib) mkIf;
-    in mkIf gitlab.enable
-    {
-      services.gitlab =
-      {
-        enable = true;
-        host = gitlab.hostname;
-        port = 443;
-        https = true;
-        smtp =
-        {
-          enable = true;
-          address = "mail.chn.moe";
-          username = "bot@chn.moe";
-          passwordFile = inputs.config.sops.secrets."gitlab/mail".path;
-          tls = true;
-          enableStartTLSAuto = false;
-          port = 465;
-          domain = gitlab.hostname;
-          authentication = "login";
-        };
-        extraConfig.gitlab.email_from = "bot@chn.moe";
-        secrets =
-        {
-          secretFile = inputs.config.sops.secrets."gitlab/secret".path;
-          otpFile = inputs.config.sops.secrets."gitlab/otp".path;
-          jwsFile = inputs.config.sops.secrets."gitlab/jws".path;
-          dbFile = inputs.config.sops.secrets."gitlab/dbFile".path;
-        };
-        initialRootPasswordFile = inputs.config.sops.secrets."gitlab/root".path;
-        initialRootEmail = "bot@chn.moe";
-        databasePasswordFile = inputs.config.sops.secrets."gitlab/db".path;
-        databaseHost = "127.0.0.1";
-      };
-      nixos.services =
-      {
-        nginx =
-        {
-          enable = true;
-          https."${gitlab.hostname}".location."/".proxy.upstream = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-        };
-        postgresql.instances.gitlab = {};
-      };
-      sops.secrets = let owner = inputs.config.services.gitlab.user; in
-      {
-        "gitlab/mail" = { owner = owner; key = "mail/bot"; };
-        "gitlab/secret".owner = owner;
-        "gitlab/otp".owner = owner;
-        "gitlab/jws" =
-          { owner = owner; sopsFile = "${inputs.topInputs.self}/secrets/gitlab/jws.bin"; format = "binary"; };
-        "gitlab/dbFile".owner = owner;
-        "gitlab/root".owner = owner;
-        "gitlab/db" = { owner = owner; key = "postgresql/gitlab"; };
-        "mail/bot" = {};
-      };
-    };
-}

modules/services/groupshare.nix

@@ -9,20 +9,25 @@ inputs:
   config =
     let
       inherit (inputs.lib) mkIf;
-      inherit (builtins) listToAttrs map concatLists;
+      inherit (builtins) listToAttrs map concatLists concatStringsSep;
       inherit (inputs.config.nixos.services) groupshare;
       users = inputs.config.users.groups.groupshare.members;
     in mkIf groupshare.enable
     {
-      users.groups.groupshare = {};
+      users.groups.groupshare.gid = inputs.config.nixos.system.user.group.groupshare;
       systemd.tmpfiles.rules = [ "d /var/lib/groupshare" ]
         ++ (concatLists (map
           (user:
           [
             "d /var/lib/groupshare/${user} 2750 ${user} groupshare"
-            # sudo setfacl -m 'xxx' dir
-            ("a /var/lib/groupshare/${user} - - - - "
-              + "d:u:${user}:rwX,u:${user}:rwX,d:g:groupshare:r-X,g:groupshare:r-X,d:o::---,o::---,d:m::r-x,m::r-x")
+            "Z /var/lib/groupshare/${user} - ${user} groupshare"
+            ("A /var/lib/groupshare/${user} - - - - "
+              # d 指 default, 即目录下新创建的文件和目录的权限
+              # 大写 X 指仅给目录执行权限
+              # m 指 mask, 即对于所有者以外的用户, 该用户的权限最大为 m 指定的权限
+              + (concatStringsSep "," (concatLists (map
+                (perm: [ "d:${perm}" perm ])
+                [ "u:${user}:rwX" "g:groupshare:r-X" "o::---" "m::r-x" ]))))
           ])
           users));
       fileSystems = listToAttrs (map

modules/services/httpapi.nix

@@ -9,7 +9,7 @@ inputs:
     let
       inherit (inputs.config.nixos.services) httpapi;
       inherit (inputs.lib) mkIf;
-      inherit (builtins) toString;
+      inherit (builtins) toString map;
     in mkIf httpapi.enable
     {
       nixos.services =
@@ -25,7 +25,6 @@ inputs:
             fastcgiPass = inputs.config.nixos.services.phpfpm.instances.httpapi.fastcgi;
           };
         };
-        phpfpm.instances.httpapi = {};
       };
       sops =
       {
@@ -41,6 +40,6 @@ inputs:
         };
         secrets."httpapi/token" = {};
       };
-      systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" ];
+      systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" "Z /srv/api - nginx nginx" ];
     };
 }

modules/services/meilisearch.nix

@@ -17,7 +17,7 @@ inputs:
     let
       inherit (inputs.config.nixos.services) meilisearch;
       inherit (inputs.localLib) stripeTabs attrsToList;
-      inherit (builtins) map listToAttrs;
+      inherit (builtins) map listToAttrs concatLists;
     in
     {
       systemd =
@@ -73,14 +73,15 @@ inputs:
             };
           })
           (attrsToList meilisearch.instances));
-        tmpfiles.rules = map
+        tmpfiles.rules = concatLists (map
           (instance:
             let
               user = instance.value.user;
               group = inputs.config.users.users.${instance.value.user}.group;
+              dir = "/var/lib/meilisearch/${instance.name}";
             in
-              "d /var/lib/meilisearch/${instance.name} 0700 ${user} ${group}")
-          (attrsToList meilisearch.instances);
+              [ "d ${dir} 0700 ${user} ${group}" "Z ${dir} - ${user} ${group}" ])
+          (attrsToList meilisearch.instances));
       };
       sops =
       {

modules/services/mirism.nix

@@ -11,7 +11,11 @@ inputs:
       inherit (builtins) map listToAttrs toString concatLists;
     in mkIf mirism.enable
     {
-      users = { users.mirism = { isSystemUser = true; group = "mirism"; }; groups.mirism = {}; };
+      users =
+      {
+        users.mirism = { uid = inputs.config.nixos.system.user.user.mirism; group = "mirism"; isSystemUser = true; };
+        groups.mirism.gid = inputs.config.nixos.system.user.group.mirism;
+      };
       systemd =
       {
         services = listToAttrs (map
@@ -32,7 +36,9 @@ inputs:
             };
           })
           [ "ng01" "beta" ]);
-        tmpfiles.rules = [ "d /srv/entry.mirism 0700 nginx nginx" "d /srv/mirism 0700 nginx nginx" ];
+        tmpfiles.rules = concatLists (map
+          (dir: [ "d /srv/${dir}mirism 0700 nginx nginx" "Z /srv/${dir}mirism - nginx nginx" ])
+          [ "" "entry." ]);
       };
       nixos.services =
       {

modules/services/misskey.nix

@@ -48,8 +48,8 @@ inputs:
               Restart = "always";
             };
           };
-          tmpfiles.rules =
-            [ "d /var/lib/misskey/${instance.name}/files 0700 misskey-${instance.name} misskey-${instance.name}" ];
+          tmpfiles.rules = let dir = "/var/lib/misskey/${instance.name}/files"; owner = "misskey-${instance.name}"; in
+            [ "d ${dir} 0700 ${owner} ${owner}" "Z ${dir} - ${owner} ${owner}" ];
         })
         (attrsToList misskey.instances));
       fileSystems = mkMerge (map
@@ -89,7 +89,7 @@ inputs:
                   user: misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}
                   pass: ${placeholder."postgresql/misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}"}
                   extra:
-                    statement_timeout: 60000
+                    statement_timeout: 600000
                 dbReplications: false
                 redis:
                   host: 127.0.0.1
@@ -125,12 +125,13 @@ inputs:
         {
           users."misskey-${instance.name}" =
           {
-            isSystemUser = true;
+            uid = inputs.config.nixos.system.user.user."misskey-${instance.name}";
             group = "misskey-${instance.name}";
             home = "/var/lib/misskey/${instance.name}";
             createHome = true;
+            isSystemUser = true;
           };
-          groups."misskey-${instance.name}" = {};
+          groups."misskey-${instance.name}".gid = inputs.config.nixos.system.user.group."misskey-${instance.name}";
         })
         (attrsToList misskey.instances));
       nixos.services =

modules/services/nginx/applications/blog.nix

@@ -12,6 +12,6 @@ inputs:
     {
       nixos.services.nginx.https."blog.chn.moe".location."/".static =
         { root = "/srv/blog"; index = [ "index.html" ]; };
-      systemd.tmpfiles.rules = [ "d /srv/blog 0700 nginx nginx" ];
+      systemd.tmpfiles.rules = [ "d /srv/blog 0700 nginx nginx" "Z /srv/blog - nginx nginx" ];
     };
 }

modules/services/nginx/applications/catalog.nix

@@ -12,6 +12,6 @@ inputs:
     {
       nixos.services.nginx.https."catalog.chn.moe".location."/".static =
         { root = "/srv/catalog"; index = [ "index.html" ]; };
-      systemd.tmpfiles.rules = [ "d /srv/catalog 0700 nginx nginx" ];
+      systemd.tmpfiles.rules = [ "d /srv/catalog 0700 nginx nginx" "Z /srv/catalog - nginx nginx" ];
     };
 }

modules/services/nginx/applications/default.nix

@@ -8,5 +8,6 @@ inputs:
     ./webdav.nix
     ./blog.nix
     ./catalog.nix
+    ./main.nix
   ];
 }

modules/services/nginx/applications/element.nix

@@ -5,7 +5,7 @@ inputs:
     type = types.attrsOf (types.submodule (submoduleInputs: { options =
     {
       hostname = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-      defaultServer = mkOption { type = types.nullOr types.nonEmptyStr; default = "element.chn.moe"; };
+      defaultServer = mkOption { type = types.nullOr types.nonEmptyStr; default = "matrix.chn.moe"; };
     };}));
     default = {};
   };

modules/services/nginx/applications/kkmeeting.nix

@@ -13,6 +13,6 @@ inputs:
     {
       nixos.services.nginx.https.${kkmeeting.hostname}.location."/".static =
         { root = "/srv/kkmeeting"; index = "auto"; charset = "utf-8"; };
-      systemd.tmpfiles.rules = [ "d /srv/kkmeeting 0700 nginx nginx" ];
+      systemd.tmpfiles.rules = [ "d /srv/kkmeeting 0700 nginx nginx" "Z /srv/kkmeeting - nginx nginx" ];
     };
 }

modules/services/nginx/applications/main.nix

@@ -0,0 +1,22 @@
+inputs:
+{
+  options.nixos.services.nginx.applications.main = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+  };
+  config =
+    let
+      inherit (inputs.config.nixos.services.nginx.applications) main;
+    in
+    {
+      nixos.services.nginx.https."chn.moe".location =
+      {
+        "/".return.return = "302 https://xn--s8w913fdga.chn.moe/@chn";
+        "/.well-known/matrix/server".proxy =
+        {
+          setHeaders.Host = "matrix.chn.moe";
+          upstream = "https://matrix.chn.moe";
+        };
+      };
+    };
+}

modules/services/nginx/applications/webdav.nix

@@ -28,7 +28,7 @@ inputs:
       systemd = mkMerge (map
         (site:
         {
-          tmpfiles.rules = [ "d ${site.path} 0700 nginx nginx" ];
+          tmpfiles.rules = [ "d ${site.path} 0700 nginx nginx" "Z ${site.path} - nginx nginx" ];
           services.nginx.serviceConfig.ReadWritePaths = [ site.path ];
         })
         (attrValues instances));

modules/services/nginx/default.nix

@@ -29,7 +29,7 @@ inputs:
     {
       # only disable in some rare cases
       enable = mkOption { type = types.bool; default = true; };
-      externalIp = mkOption { type = types.listOf types.nonEmptyStr; };
+      externalIp = mkOption { type = types.listOf types.nonEmptyStr; default = [ "0.0.0.0" ]; };
       # proxy to 127.0.0.1:${specified port}
       map = mkOption { type = types.attrsOf types.ints.unsigned; default = {}; };
     };
@@ -94,6 +94,7 @@ inputs:
             default = null;
           };
           rewriteHttps = mkOption { type = types.bool; default = true; };
+          tlsCert = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
         };
         listen = mkOption
         {
@@ -547,7 +548,11 @@ inputs:
                   # do not automatically add http2 listen
                   http2 = false;
                   onlySSL = true;
-                  useACMEHost = site.name;
+                  useACMEHost = mkIf (site.value.global.tlsCert == null) site.name;
+                  sslCertificate = mkIf (site.value.global.tlsCert != null)
+                    "${site.value.global.tlsCert}/fullchain.pem";
+                  sslCertificateKey = mkIf (site.value.global.tlsCert != null)
+                    "${site.value.global.tlsCert}/privkey.pem";
                   locations = listToAttrs (map
                   (location:
                   {

modules/services/phpfpm.nix

@@ -50,10 +50,20 @@ inputs:
     users =
     {
       users = listToAttrs (map
-        (pool: { inherit (pool) name; value = { isSystemUser = true; group = pool.name; extraGroups = [ "nginx" ]; }; })
+        (pool:
+        {
+          inherit (pool) name;
+          value =
+          {
+            uid = inputs.config.nixos.system.user.user.${pool.name};
+            group = pool.name;
+            extraGroups = [ "nginx" ];
+            isSystemUser = true;
+          };
+        })
         (filter (pool: pool.value.user == null) (attrsToList phpfpm.instances)));
       groups = listToAttrs (map
-        (pool: { inherit (pool) name; value = {}; })
+        (pool: { inherit (pool) name; value.gid = inputs.config.nixos.system.user.group.${pool.name}; })
         (filter (pool: pool.value.user == null) (attrsToList phpfpm.instances)));
     };
   };

modules/services/postgresql.nix

@@ -10,6 +10,7 @@ inputs:
         database = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
         user = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
         passwordFile = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+        initializeFlags = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
       };}));
       default = {};
     };
@@ -51,7 +52,6 @@ inputs:
           # chattr +C /path/to/dir
           # cp -a --reflink=never /path/to/dir_old/. /path/to/dir
           # rm -rf /path/to/dir_old
-          ensureDatabases = map (db: db.value.database) (attrsToList postgresql.instances);
           ensureUsers = map (db: { name = db.value.user; }) (attrsToList postgresql.instances);
         };
         postgresqlBackup =
@@ -68,15 +68,26 @@ inputs:
             passwordFile =
               if db.value.passwordFile or null != null then db.value.passwordFile
               else inputs.config.sops.secrets."postgresql/${db.value.user}".path;
-            in
-            # set user password
-            "$PSQL -tAc \"ALTER USER ${db.value.user} with encrypted password '$(cat ${passwordFile})'\""
-            # set db owner
-              + "\n"
-              + "$PSQL -tAc \"select pg_catalog.pg_get_userbyid(d.datdba) FROM pg_catalog.pg_database d"
-              + " WHERE d.datname = '${db.value.database}' ORDER BY 1\""
-              + " | grep -E '^${db.value.user}$' -q"
-              + " || $PSQL -tAc \"ALTER DATABASE ${db.value.database} OWNER TO ${db.value.user}\"")
+            initializeFlag =
+              if db.value.initializeFlags != {} then
+                " WITH "
+                + (concatStringsSep " " (map
+                  (flag: ''${flag.name} = "${flag.value}"'')
+                  (attrsToList db.value.initializeFlags)))
+              else "";
+          in
+          # create database if not exist
+          "$PSQL -tAc \"SELECT 1 FROM pg_database WHERE datname = '${db.value.database}'\" | grep -q 1"
+            + " || $PSQL -tAc 'CREATE DATABASE \"${db.value.database}\"${initializeFlag}'"
+          # set user password
+            + "\n"
+            + "$PSQL -tAc \"ALTER USER ${db.value.user} with encrypted password '$(cat ${passwordFile})'\""
+          # set db owner
+            + "\n"
+            + "$PSQL -tAc \"select pg_catalog.pg_get_userbyid(d.datdba) FROM pg_catalog.pg_database d"
+            + " WHERE d.datname = '${db.value.database}' ORDER BY 1\""
+            + " | grep -E '^${db.value.user}$' -q"
+            + " || $PSQL -tAc \"ALTER DATABASE ${db.value.database} OWNER TO ${db.value.user}\"")
         (attrsToList postgresql.instances)));
       sops.secrets = listToAttrs (map
         (db: { name = "postgresql/${db.value.user}"; value.owner = inputs.config.users.users.postgres.name; })

modules/services/rsshub.nix

@@ -52,7 +52,11 @@ inputs:
           "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
         ]));
       };
-      users = { users.rsshub = { isSystemUser = true; group = "rsshub"; }; groups.rsshub = {}; };
+      users =
+      {
+        users.rsshub = { uid = inputs.config.nixos.system.user.user.rsshub; group = "rsshub"; isSystemUser = true; };
+        groups.rsshub.gid = inputs.config.nixos.system.user.group.rsshub;
+      };
       nixos.services =
       {
         redis.instances.rsshub.port = 7116;

modules/services/synapse.nix

@@ -1,111 +1,316 @@
+# port from nixpkgs#70dc536a
 inputs:
 {
-  options.nixos.services.synapse = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.synapse.instances = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    autoStart = mkOption { type = types.bool; default = true; };
-    port = mkOption { type = types.ints.unsigned; default = 8008; };
-    hostname = mkOption { type = types.nonEmptyStr; default = "synapse.chn.moe"; };
+    type = types.attrsOf (types.submodule (submoduleInputs: { options =
+    {
+      autoStart = mkOption { type = types.bool; default = true; };
+      port = mkOption { type = types.ints.unsigned; default = 8008; };
+      redisPort = mkOption { type = types.ints.unsigned; default = 6379; };
+      slidingSyncPort = mkOption { type = types.ints.unsigned; default = 9000; };
+      hostname = mkOption
+      {
+        type = types.nonEmptyStr;
+        default = "${submoduleInputs.config._module.args.name}.chn.moe";
+      };
+      matrixHostname = mkOption { type = types.nonEmptyStr; default = "chn.moe"; };
+      slidingSyncHostname = mkOption
+      {
+        type = types.nonEmptyStr;
+        default = "syncv3.${submoduleInputs.config.hostname}";
+      };
+      # , synapse_homeserver --config-path homeserver.yaml --generate-config --report-stats=yes --server-name xxx
+    };}));
+    default = {};
   };
   config =
     let
       inherit (inputs.config.nixos.services) synapse;
-      inherit (inputs.lib) mkIf;
-      inherit (builtins) map listToAttrs;
-    in mkIf synapse.enable
+      inherit (inputs.lib) mkIf mkMerge;
+      inherit (builtins) map listToAttrs replaceStrings concatLists;
+      inherit (inputs.localLib) attrsToList;
+    in
     {
-      services.matrix-synapse =
-      {
-        enable = true;
-        settings =
+      users = mkMerge (map
+        (instance:
         {
-          server_name = synapse.hostname;
-          listeners =
-          [{
-            bind_addresses = [ "0.0.0.0" ];
-            port = 8008;
-            resources = [{ names = [ "client" "federation" ]; compress = false; }];
-            tls = false;
-            type = "http";
-            x_forwarded = true;
-          }];
-          database.name = "psycopg2";
-          admin_contact = "mailto:chn@chn.moe";
-          enable_registration = true;
-          registrations_require_3pid = [ "email" ];
-          turn_uris = [ "turns:coturn.chn.moe" "turn:coturn.chn.moe" ];
-          max_upload_size = "1024M";
-          web_client_location = "https://element.chn.moe/";
-          serve_server_wellknown = true;
-          report_stats = true;
-          trusted_key_servers = [{ server_name = "matrix.org"; }];
-          suppress_key_server_warning = true;
-          log_config = (inputs.pkgs.formats.yaml {}).generate "log.yaml"
+          users."synapse-${instance.name}" =
           {
-            version = 1;
-            formatters.precise.format =
-              "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s";
-            handlers.console = { class = "logging.StreamHandler"; formatter = "precise"; };
-            root = { level = "INFO"; handlers = [ "console" ]; };
-            disable_existing_loggers = true;
+            uid = inputs.config.nixos.system.user.user."synapse-${instance.name}";
+            group = "synapse-${instance.name}";
+            home = "/var/lib/synapse/${instance.name}";
+            createHome = true;
+            isSystemUser = true;
+            shell = "${inputs.pkgs.bash}/bin/bash";
           };
-        };
-        extraConfigFiles = [ inputs.config.sops.templates."synapse/password.yaml".path ];
-      };
-      sops =
-      {
-        templates."synapse/password.yaml" =
+          groups."synapse-${instance.name}".gid = inputs.config.nixos.system.user.group."synapse-${instance.name}";
+        })
+        (attrsToList synapse.instances));
+      systemd = mkMerge (map
+        (instance: let workdir = "/var/lib/synapse/${instance.name}"; in
         {
-          owner = inputs.config.systemd.services.matrix-synapse.serviceConfig.User;
-          group = inputs.config.systemd.services.matrix-synapse.serviceConfig.Group;
-          content = builtins.readFile ((inputs.pkgs.formats.yaml {}).generate "password.yaml"
+          services =
           {
-            database =
-            {
-              name = "psycopg2";
-              args =
+            "synapse-${instance.name}" =
+              let
+                package = inputs.pkgs.matrix-synapse.override
+                  { extras = [ "url-preview" "postgres" "redis" ]; plugins = []; };
+                config = inputs.config.sops.templates."synapse/${instance.name}/config.yaml".path;
+                homeserver = "${package}/bin/synapse_homeserver";
+              in
               {
-                user = "synapse";
-                password = inputs.config.sops.placeholder."postgresql/synapse";
-                database = "synapse";
-                host = "127.0.0.1";
-                port = "5432";
+                description = "synapse-${instance.name}";
+                enable = instance.value.autoStart;
+                after = [ "network-online.target" "postgresql.service" ];
+                requires = [ "postgresql.service" ];
+                wantedBy = [ "multi-user.target" ];
+                serviceConfig =
+                {
+                  ExecStart = "${homeserver} --config-path ${config} --keys-directory ${workdir}";
+                  Type = "notify";
+                  User = "synapse-${instance.name}";
+                  Group = "synapse-${instance.name}";
+                  WorkingDirectory = workdir;
+                  ExecReload = "${inputs.pkgs.util-linux}/bin/kill -HUP $MAINPID";
+                  Restart = "on-failure";
+                  UMask = "0077";
+                  CapabilityBoundingSet = [ "" ];
+
+                  # hardening
+                  LockPersonality = true;
+                  NoNewPrivileges = true;
+                  PrivateDevices = true;
+                  PrivateTmp = true;
+                  PrivateUsers = true;
+                  ProcSubset = "pid";
+                  ProtectClock = true;
+                  ProtectControlGroups = true;
+                  ProtectHome = true;
+                  ProtectHostname = true;
+                  ProtectKernelLogs = true;
+                  ProtectKernelModules = true;
+                  ProtectKernelTunables = true;
+                  ProtectProc = "invisible";
+                  ProtectSystem = "strict";
+                  ReadWritePaths = [ workdir ];
+                  RemoveIPC = true;
+                  RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+                  RestrictNamespaces = true;
+                  RestrictRealtime = true;
+                  RestrictSUIDSGID = true;
+                  SystemCallArchitectures = "native";
+                  SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+                };
               };
-              allow_unsafe_locale = true;
-            };
-            turn_shared_secret = inputs.config.sops.placeholder."synapse/coturn";
-            registration_shared_secret = inputs.config.sops.placeholder."synapse/registration";
-            macaroon_secret_key = inputs.config.sops.placeholder."synapse/macaroon";
-            form_secret = inputs.config.sops.placeholder."synapse/form";
-            signing_key_path = inputs.config.sops.secrets."synapse/signing-key".path;
-            email =
+            "synapse-sliding-sync-${instance.name}" =
             {
-              smtp_host = "mail.chn.moe";
-              smtp_port = 25;
-              smtp_user = "bot@chn.moe";
-              smtp_pass = inputs.config.sops.placeholder."mail/bot";
-              require_transport_security = true;
-              notif_from = "Your Friendly %(app)s homeserver <bot@chn.moe>";
-              app_name = "Haonan Chen's synapse";
+              after = [ "synapse-${instance.name}.service" ];
+              wants = [ "synapse-${instance.name}.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig =
+              {
+                User = "synapse-${instance.name}";
+                Group = "synapse-${instance.name}";
+                EnvironmentFile = inputs.config.sops.templates."synapse/${instance.name}-sliding-sync/env".path;
+                ExecStart = inputs.lib.getExe inputs.pkgs.matrix-sliding-sync;
+                WorkingDirectory = workdir + "-sliding-sync";
+                Restart = "on-failure";
+                RestartSec = "1s";
+              };
             };
-          });
-        };
-        secrets = (listToAttrs (map
-          (secret: { name = "synapse/${secret}"; value = {}; })
-          [ "coturn" "registration" "macaroon" "form" ]))
-          // { "synapse/signing-key".owner = inputs.config.systemd.services.matrix-synapse.serviceConfig.User; }
-          // { "mail/bot" = {}; };
-      };
+          };
+          tmpfiles.rules =
+          [
+            "d /var/lib/synapse 0755 root root"
+            "d ${workdir} 0700 synapse-${instance.name} synapse-${instance.name}"
+            "Z ${workdir} - synapse-${instance.name} synapse-${instance.name}"
+            "d ${workdir}-sliding-sync 0700 synapse-${instance.name} synapse-${instance.name}"
+            "Z ${workdir}-sliding-sync - synapse-${instance.name} synapse-${instance.name}"
+          ];
+        })
+        (attrsToList synapse.instances));
+      sops = mkMerge (map
+        (instance:
+        {
+          templates =
+          {
+            "synapse/${instance.name}/config.yaml" =
+            {
+              owner = "synapse-${instance.name}";
+              group = "synapse-${instance.name}";
+              content =
+                let
+                  inherit (inputs.config.sops) placeholder;
+                in builtins.readFile ((inputs.pkgs.formats.yaml {}).generate "${instance.name}.yaml"
+                {
+                  server_name = instance.value.matrixHostname;
+                  public_baseurl = "https://${instance.value.hostname}/";
+                  listeners =
+                  [{
+                    bind_addresses = [ "127.0.0.1" ];
+                    inherit (instance.value) port;
+                    resources = [{ names = [ "client" "federation" ]; compress = false; }];
+                    tls = false;
+                    type = "http";
+                    x_forwarded = true;
+                  }];
+                  database =
+                  {
+                    name = "psycopg2";
+                    args =
+                    {
+                      user = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
+                      password = placeholder."postgresql/synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
+                      database = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
+                      host = "127.0.0.1";
+                      port = "5432";
+                    };
+                    allow_unsafe_locale = true;
+                  };
+                  redis =
+                  {
+                    enabled = true;
+                    port = instance.value.redisPort;
+                    password = placeholder."redis/synapse-${instance.name}";
+                  };
+                  turn_shared_secret = placeholder."synapse/${instance.name}/coturn";
+                  registration_shared_secret = placeholder."synapse/${instance.name}/registration";
+                  macaroon_secret_key = placeholder."synapse/${instance.name}/macaroon";
+                  form_secret = placeholder."synapse/${instance.name}/form";
+                  signing_key_path = inputs.config.sops.secrets."synapse/${instance.name}/signing-key".path;
+                  email =
+                  {
+                    smtp_host = "mail.chn.moe";
+                    smtp_port = 25;
+                    smtp_user = "bot@chn.moe";
+                    smtp_pass = placeholder."mail/bot";
+                    require_transport_security = true;
+                    notif_from = "Your Friendly %(app)s homeserver <bot@chn.moe>";
+                    app_name = "Haonan Chen's synapse";
+                  };
+                  admin_contact = "mailto:chn@chn.moe";
+                  enable_registration = true;
+                  registrations_require_3pid = [ "email" ];
+                  turn_uris = [ "turns:coturn.chn.moe" "turn:coturn.chn.moe" ];
+                  max_upload_size = "1024M";
+                  web_client_location = "https://element.chn.moe/";
+                  extra_well_known_client_content."org.matrix.msc3575.proxy".url =
+                    "https://${instance.value.slidingSyncHostname}";
+                  report_stats = true;
+                  trusted_key_servers =
+                  [{
+                    server_name = "matrix.org";
+                    verify_keys."ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
+                  }];
+                  suppress_key_server_warning = true;
+                  log_config = (inputs.pkgs.formats.yaml {}).generate "log.yaml"
+                  {
+                    version = 1;
+                    formatters.precise.format =
+                      "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s";
+                    handlers.console = { class = "logging.StreamHandler"; formatter = "precise"; };
+                    root = { level = "INFO"; handlers = [ "console" ]; };
+                    disable_existing_loggers = true;
+                  };
+                  pid_file = "/run/synapse-${instance.name}.pid";
+                  media_store_path = "/var/lib/synapse/${instance.name}/media_store";
+                  presence.enabled = true;
+                  url_preview_enabled = true;
+                  url_preview_ip_range_blacklist =
+                  [
+                    "10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12" "192.0.0.0/24"
+                    "192.0.2.0/24" "192.168.0.0/16" "192.88.99.0/24" "198.18.0.0/15" "198.51.100.0/24" "2001:db8::/32"
+                    "203.0.113.0/24" "224.0.0.0/4" "::1/128" "fc00::/7" "fe80::/10" "fec0::/10" "ff00::/8"
+                  ];
+                  max_image_pixels = "32M";
+                  dynamic_thumbnails = false;
+                });
+            };
+            "synapse/${instance.name}-sliding-sync/env" =
+            {
+              owner = "synapse-${instance.name}";
+              group = "synapse-${instance.name}";
+              content =
+                let
+                  inherit (inputs.config.sops) placeholder;
+                  pgString = "postgresql://"
+                    + "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}"
+                    + ":${placeholder."postgresql/synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}"}"
+                    + "@127.0.0.1:5432"
+                    + "/synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}_sliding_sync"
+                    + "?sslmode=disable";
+                in
+                ''
+                  SYNCV3_SERVER=https://${instance.value.hostname}
+                  SYNCV3_DB=${pgString}
+                  SYNCV3_SECRET=${placeholder."synapse/${instance.name}/sliding-sync"}
+                  SYNCV3_BINDADDR=127.0.0.1:${toString instance.value.slidingSyncPort}
+                '';
+            };
+          };
+          secrets = (listToAttrs (map
+            (secret: { name = "synapse/${instance.name}/${secret}"; value = {}; })
+            [ "coturn" "registration" "macaroon" "form" "sliding-sync" ]))
+            // { "synapse/${instance.name}/signing-key".owner = "synapse-${instance.name}"; }
+            // { "mail/bot" = {}; };
+        })
+        (attrsToList synapse.instances));
       nixos.services =
       {
-        postgresql = { enable = true; instances.synapse = {}; };
+        postgresql =
+        {
+          enable = mkIf (synapse.instances != {}) true;
+          instances = listToAttrs (concatLists (map
+            (instance:
+            [
+              {
+                name = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
+                value.initializeFlags = { TEMPLATE = "template0"; LC_CTYPE = "C"; LC_COLLATE = "C"; };
+              }
+              {
+                name = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}_sliding_sync";
+                value.user = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
+              }
+            ])
+            (attrsToList synapse.instances)));
+        };
+        redis.instances = listToAttrs (map
+          (instance: { name = "synapse-${instance.name}"; value.port = instance.value.redisPort; })
+          (attrsToList synapse.instances));
         nginx =
         {
-          enable = true;
-          https.${synapse.hostname}.location."/".proxy =
-            { upstream = "http://127.0.0.1:${toString synapse.port}"; websocket = true; };
+          enable = mkIf (synapse.instances != {}) true;
+          https = listToAttrs (concatLists (map
+            (instance: with instance.value;
+            [
+              {
+                name = hostname;
+                value.location =
+                {
+                  "/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
+                  "/.well-known/matrix/server".static =
+                  {
+                    root = builtins.toString (inputs.pkgs.writeTextFile
+                    {
+                      name = "server";
+                      text = builtins.toJSON
+                      {
+                        "m.server" = "${hostname}:443";
+                      };
+                      destination = "/.well-known/matrix/server";
+                    });
+                  };
+                };
+              }
+              {
+                name = slidingSyncHostname;
+                value.location."/".proxy =
+                  { upstream = "http://127.0.0.1:${toString slidingSyncPort}"; websocket = true; };
+              }
+            ])
+            (attrsToList synapse.instances)));
         };
       };
-      systemd.services.matrix-synapse.enable = synapse.autoStart;
     };
 }

modules/services/wireguard.nix

@@ -0,0 +1,47 @@
+inputs:
+{
+  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
+    # wg genkey | wg pubkey
+    publicKey = mkOption { type = types.nonEmptyStr; };
+    wireguardIp = mkOption { type = types.nonEmptyStr; };
+    externalIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+    lighthouse = mkOption { type = types.bool; default = false; };
+  };
+  config =
+    let
+      inherit (inputs.lib) mkIf;
+      inherit (inputs.config.nixos.services) wireguard;
+      inherit (builtins) map toString;
+    in mkIf wireguard.enable
+    {
+      networking =
+        let
+          # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
+          port = 51820 + (if inputs.config.nixos.services.xrayClient.enable then 1 else 0);
+        in
+        {
+          firewall = { allowedUDPPorts = [ port ]; trustedInterfaces = [ "wireguard" ]; };
+          wireguard.interfaces.wireguard =
+          {
+            ips = [ "${wireguard.wireguardIp}/24" ];
+            listenPort = port;
+            privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
+            peers = map
+              (peer:
+              {
+                publicKey = peer.publicKey;
+                allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
+                endpoint = mkIf (peer.externalIp != null) "${peer.externalIp}:51820";
+                persistentKeepalive = 3;
+              })
+              (map
+                (peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
+                wireguard.peers);
+          };
+        };
+      sops.secrets."wireguard/privateKey" = {};
+    };
+}

modules/services/xray.nix

@@ -299,7 +299,11 @@ inputs:
                 };
             };
           };
-          users = { users.v2ray = { isSystemUser = true; group = "v2ray"; }; groups.v2ray = {}; };
+          users =
+          {
+            users.v2ray = { uid = inputs.config.nixos.system.user.user.v2ray; group = "v2ray"; isSystemUser = true; };
+            groups.v2ray.gid = inputs.config.nixos.system.user.group.v2ray;
+          };
           environment.etc."resolv.conf".text = "nameserver 127.0.0.1";
         }
       )
@@ -482,7 +486,11 @@ inputs:
               timerConfig = { OnCalendar = "*-*-* 0:00:00"; Unit = "xray-stat.service"; };
             };
           };
-          users = { users.v2ray = { isSystemUser = true; group = "v2ray"; }; groups.v2ray = {}; };
+          users =
+          {
+            users.v2ray = { uid = inputs.config.nixos.system.user.user.v2ray; group = "v2ray"; isSystemUser = true; };
+            groups.v2ray.gid = inputs.config.nixos.system.user.group.v2ray;
+          };
           nixos.services =
           {
             acme = { enable = true; cert.${xrayServer.serverName}.group = inputs.config.users.users.nginx.group; };

modules/system/default.nix

@@ -14,6 +14,8 @@ inputs:
     ./systemd.nix
     ./security.nix
     ./sops.nix
+    ./user.nix
+    ./sysctl.nix
   ];
   config =
   {
@@ -21,13 +23,6 @@ inputs:
     time.timeZone = "Asia/Shanghai";
     boot =
     {
-      kernel.sysctl =
-      {
-        "vm.oom_kill_allocating_task" = true;
-        "vm.oom_dump_tasks" = false;
-        "vm.overcommit_memory" = 1;
-        "kernel.sysrq" = 438;
-      };
       supportedFilesystems = [ "ntfs" ];
       consoleLogLevel = 7;
     };

modules/system/gui.nix

@@ -2,12 +2,14 @@ inputs:
 {
   options.nixos.system.gui = let inherit (inputs.lib) mkOption types; in
   {
-    enable = mkOption { type = types.bool; default = false; };
-    preferred = mkOption { type = types.bool; default = false; };
+    enable = mkOption
+      { type = types.bool; default = builtins.elem "desktop" inputs.config.nixos.packages._packageSets; };
+    preferred = mkOption { type = types.bool; default = inputs.config.nixos.system.gui.enable; };
     autoStart = mkOption { type = types.bool; default = inputs.config.nixos.system.gui.preferred; };
   };
   config =
     let
+      inherit (builtins) map;
       inherit (inputs.lib) mkIf;
       inherit (inputs.config.nixos.system) gui;
     in mkIf gui.enable
@@ -29,7 +31,7 @@ inputs:
       i18n.inputMethod =
       {
         enabled = "fcitx5";
-        fcitx5.addons = with inputs.pkgs; [ fcitx5-rime fcitx5-chinese-addons fcitx5-mozc ];
+        fcitx5.addons = map (p: inputs.pkgs."fcitx5-${p}") [ "rime" "chinese-addons" "mozc" "nord" "material-color" ];
       };
       programs = { dconf.enable = true; xwayland.enable = true; };
     };

modules/system/impermanence.nix

@@ -20,7 +20,7 @@ inputs:
           hideMounts = true;
           directories =
           [
-            "/etc/NetworkManager/system-connections"
+            { directory = "/etc/NetworkManager/system-connections"; mode = "0700"; }
             "/home"
             "/root"
             "/var/db"

modules/system/kernel.nix

@@ -2,8 +2,7 @@ inputs:
 {
   options.nixos.system.kernel = let inherit (inputs.lib) mkOption types; in
   {
-    useLts = mkOption { type = types.bool; default = false; };
-    patches = mkOption { type = types.listOf (types.enum [ "cjktty" ]); default = []; };
+    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
     modules =
     {
       install = mkOption { type = types.listOf types.str; default = []; };
@@ -28,11 +27,13 @@ inputs:
         "virtio_net" "virtio_pci" "xhci_pci" "virtio_ring" "virtio_scsi" "cryptd" "crypto_simd" "libaes"
         # networking for nas
         "igb"
-      ] ++ kernel.modules.initrd ++ (if (!kernel.useLts) then [ "lenovo-yogabook" ] else []);
+        # yoga
+        "lenovo_yogabook"
+      ];
       extraModulePackages = (with inputs.config.boot.kernelPackages; [ v4l2loopback ]) ++ kernel.modules.install;
       extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
       kernelParams = [ "delayacct" "acpi_osi=Linux" ];
-      kernelPackages = inputs.pkgs."linuxPackages_xanmod${if kernel.useLts then "" else "_latest"}";
+      kernelPackages = inputs.pkgs.linuxPackages_xanmod_latest;
       kernelPatches =
         let
           patches =
@@ -53,13 +54,26 @@ inputs:
                       hashes =
                       {
                         "6.1" = "11ddiammvjxx2m9v32p25l1ai759a1d6xhdpszgnihv7g2fzigf5";
-                        "6.5" = "0ckmbx53js04lrcvcsf8qk935v2pl9w0af2v1mqghfs0krakfgfh";
+                        "6.6" = "19ib0syj3207ifr315gdrnpv6nhh435fmgl05c7k715nng40i827";
                       };
                     in hashes."${major}.${minor}";
                 };
               extraStructuredConfig =
                 { FONT_CJK_16x16 = inputs.lib.kernel.yes; FONT_CJK_32x32 = inputs.lib.kernel.yes; };
             };
+            lantian =
+            {
+              patch = null;
+              # pick from xddxdd/nur-packages dce93a
+              extraStructuredConfig = with inputs.lib.kernel;
+              {
+                ACPI_PCI_SLOT = yes;
+                ENERGY_MODEL = yes;
+                PARAVIRT_TIME_ACCOUNTING = yes;
+                PM_AUTOSLEEP = yes;
+                WQ_POWER_EFFICIENT_DEFAULT = yes;
+              };
+            };
           };
         in
           builtins.map (name: { inherit name; } // patches.${name}) kernel.patches;

modules/system/nix.nix

@@ -6,7 +6,7 @@ inputs:
     marches = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
     keepOutputs = mkOption { type = types.bool; default = false; };
     substituters = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
-    autoOptimiseStore = mkOption { type = types.bool; default = false; };
+    autoOptimiseStore = mkOption { type = types.bool; default = true; };
   };
   config =
     let

modules/system/nixpkgs.nix

@@ -3,136 +3,154 @@ inputs:
   options.nixos.system.nixpkgs = let inherit (inputs.lib) mkOption types; in
   {
     march = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
-    cudaSupport = mkOption { type = types.bool; default = false; };
+    cuda =
+    {
+      enable = mkOption { type = types.bool; default = false; };
+      capabilities = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
+      forwardCompat = mkOption { type = types.nullOr types.bool; default = null; };
+    };
     replaceTensorflow = mkOption { type = types.bool; default = false; };
   };
   config =
     let
       inherit (builtins) map listToAttrs filter tryEval attrNames concatStringsSep toString;
-      inherit (inputs.lib) mkIf;
+      inherit (inputs.lib) mkIf mkMerge;
       inherit (inputs.lib.strings) hasPrefix splitString;
       inherit (inputs.localLib) mkConditional attrsToList;
       inherit (inputs.config.nixos.system) nixpkgs;
-    in
-    {
-      nixpkgs =
-        let
-          permittedInsecurePackages =
-            [ "openssl_1_1" "electron_19" "python2" "electron_12" "electron_24" "zotero" ];
-          hostPlatform = mkConditional (nixpkgs.march != null)
-            { system = "x86_64-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
-            "x86_64-linux";
-          noBuildPackages =
-          [
-            # chromium
-            "chromium" "electron" "webkitgtk"
-            # old python release
-            "python310"
-            # nodejs
-            "nodejs"
-            # haskell
-            "haskell"
-            # meta tools
-            "fastfetch"
-            # libreoffice
-            "libreoffice" "libreoffice-qt" "libreoffice-fresh"
-            # java
-            "openjdk" "jetbrains"
-          ];
-        in
-        {
-          inherit hostPlatform;
-          config =
+    in mkMerge
+    [
+      {
+        nixpkgs =
+          let
+            permittedInsecurePackages =
+              [ "openssl_1_1" "electron_19" "python2" "electron_12" "electron_24" "zotero" ];
+            hostPlatform = mkConditional (nixpkgs.march != null)
+              { system = "x86_64-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
+              "x86_64-linux";
+            noBuildPackages = [];
+            # noBuildPackages =
+            # [
+            #   # chromium
+            #   "chromium" "electron" "webkitgtk"
+            #   # old python release
+            #   "python310"
+            #   # nodejs
+            #   "nodejs"
+            #   # haskell
+            #   "haskell"
+            #   # libreoffice
+            #   "libreoffice" "libreoffice-qt" "libreoffice-fresh"
+            #   # java
+            #   "openjdk" "jetbrains"
+            # ];
+          in
           {
-            permittedInsecurePackages = map
-              (package: inputs.pkgs.${package}.name)
-              (filter (package: inputs.pkgs ? ${package}) permittedInsecurePackages);
-            allowUnfree = true;
-            cudaSupport = nixpkgs.cudaSupport;
-            qchem-config = mkIf (nixpkgs.march != null) { optArch = nixpkgs.march; };
-            oneapiArch = mkIf (nixpkgs.march != null) nixpkgs.march;
-          };
-          overlays =
-          [(final: prev:
-            let
-              genericPackages = import inputs.topInputs.nixpkgs
-              {
-                system = "x86_64-linux";
-                config =
+            inherit hostPlatform;
+            config =
+            {
+              permittedInsecurePackages = map
+                (package: inputs.pkgs.${package}.name)
+                (filter (package: inputs.pkgs ? ${package}) permittedInsecurePackages);
+              allowUnfree = true;
+              qchem-config = { optArch = nixpkgs.march; useCuda = nixpkgs.cuda.enable; };
+              oneapiArch = mkIf (nixpkgs.march != null) nixpkgs.march;
+            };
+            overlays =
+            [(final: prev:
+              let
+                genericPackages = import inputs.topInputs.nixpkgs
                 {
-                  allowUnfree = true;
-                  permittedInsecurePackages = let pkgs = inputs.topInputs.nixpkgs.legacyPackages.x86_64-linux; in map
-                    (package: pkgs.${package}.name)
-                    (filter (package: pkgs ? ${package}) permittedInsecurePackages);
-                };
-              };
-              targetPythonVersion = inputs.lib.lists.take 2 (splitString "." genericPackages.python3.version);
-              targetPythonName = "python${concatStringsSep "" targetPythonVersion}";
-            in
-              { inherit genericPackages; }
-              // {
-                unstablePackages = import inputs.topInputs.nixpkgs-unstable
-                {
-                  localSystem = hostPlatform;
+                  system = "x86_64-linux";
                   config =
                   {
                     allowUnfree = true;
-                    permittedInsecurePackages =
-                      let pkgs = inputs.topInputs.nixpkgs-unstable.legacyPackages.x86_64-linux;
-                      in map
-                        (package: pkgs.${package}.name)
-                        (filter (package: pkgs ? ${package}) permittedInsecurePackages);
+                    permittedInsecurePackages = let pkgs = inputs.topInputs.nixpkgs.legacyPackages.x86_64-linux; in map
+                      (package: pkgs.${package}.name)
+                      (filter (package: pkgs ? ${package}) permittedInsecurePackages);
                   };
                 };
-              }
-              // (
-                if nixpkgs.march != null then
-                  let replacedPackages = filter
-                    (package: let pname = tryEval genericPackages.${package}.pname or null;
-                      in (pname.success && (builtins.elem pname.value noBuildPackages)
-                        || builtins.elem package noBuildPackages))
-                    (filter
-                      (package: builtins.any (prefix: hasPrefix prefix package) noBuildPackages)
-                      (attrNames genericPackages));
-                  in listToAttrs (map
-                    (package: { name = package; value = genericPackages.${package}; })
-                    replacedPackages)
-                else {}
-              )
-              // (
-                if nixpkgs.replaceTensorflow then
-                {
-                  ${targetPythonName} = prev.${targetPythonName}.override { packageOverrides = final: prev:
+                targetPythonVersion = inputs.lib.lists.take 2 (splitString "." genericPackages.python3.version);
+                targetPythonName = "python${concatStringsSep "" targetPythonVersion}";
+              in
+                { inherit genericPackages; }
+                // {
+                  unstablePackages = import inputs.topInputs.nixpkgs-unstable
                   {
-                    tensorflow = prev.tensorflow.override
+                    localSystem = hostPlatform;
+                    config =
                     {
-                      cudaSupport = false;
-                      customBazelBuild = genericPackages.${targetPythonName}.pkgs.tensorflow.passthru.bazel-build;
+                      allowUnfree = true;
+                      permittedInsecurePackages =
+                        let pkgs = inputs.topInputs.nixpkgs-unstable.legacyPackages.x86_64-linux;
+                        in map
+                          (package: pkgs.${package}.name)
+                          (filter (package: pkgs ? ${package}) permittedInsecurePackages);
                     };
-                  };};
+                  };
                 }
-                else {}
-              )
-          )];
-        };
-      programs.ccache = { enable = true; cacheDir = "/var/lib/ccache"; };
-      nix.settings.extra-sandbox-paths = [ inputs.config.programs.ccache.cacheDir ];
-      boot.kernelPatches = mkIf (nixpkgs.march != null)
-      [{
-        name = "native kernel";
-        patch = null;
-        extraStructuredConfig =
-          let
-            kernelConfig =
-            {
-              alderlake = "MALDERLAKE";
-              sandybridge = "MSANDYBRIDGE";
-              silvermont = "MSILVERMONT";
-              broadwell = "MBROADWELL";
-              znver2 = "MZEN2";
-              znver3 = "MZEN3";
-            };
-          in { GENERIC_CPU = inputs.lib.kernel.no; ${kernelConfig.${nixpkgs.march}} = inputs.lib.kernel.yes; };
-      }];
-    };
+                // (
+                  if nixpkgs.march != null then
+                    let replacedPackages = filter
+                      (package: let pname = tryEval genericPackages.${package}.pname or null;
+                        in (pname.success && (builtins.elem pname.value noBuildPackages)
+                          || builtins.elem package noBuildPackages))
+                      (filter
+                        (package: builtins.any (prefix: hasPrefix prefix package) noBuildPackages)
+                        (attrNames genericPackages));
+                    in listToAttrs (map
+                      (package: { name = package; value = genericPackages.${package}; })
+                      replacedPackages)
+                  else {}
+                )
+                // (
+                  if nixpkgs.march != null then
+                    { embree = prev.embree.override { stdenv = final.genericPackages.stdenv; }; }
+                  else {}
+                )
+                // (
+                  if nixpkgs.replaceTensorflow then
+                  {
+                    ${targetPythonName} = prev.${targetPythonName}.override { packageOverrides = final: prev:
+                    {
+                      tensorflow = prev.tensorflow.override
+                      {
+                        cudaSupport = false;
+                        customBazelBuild = genericPackages.${targetPythonName}.pkgs.tensorflow.passthru.bazel-build;
+                      };
+                    };};
+                  }
+                  else {}
+                )
+            )];
+          };
+        programs.ccache = { enable = true; cacheDir = "/var/lib/ccache"; };
+        nix.settings.extra-sandbox-paths = [ inputs.config.programs.ccache.cacheDir ];
+        boot.kernelPatches = mkIf (nixpkgs.march != null)
+        [{
+          name = "native kernel";
+          patch = null;
+          extraStructuredConfig =
+            let
+              kernelConfig =
+              {
+                alderlake = "MALDERLAKE";
+                sandybridge = "MSANDYBRIDGE";
+                silvermont = "MSILVERMONT";
+                broadwell = "MBROADWELL";
+                znver2 = "MZEN2";
+                znver3 = "MZEN3";
+              };
+            in { GENERIC_CPU = inputs.lib.kernel.no; ${kernelConfig.${nixpkgs.march}} = inputs.lib.kernel.yes; };
+        }];
+      }
+      {
+        nixpkgs.config = mkIf nixpkgs.cuda.enable
+        (
+          { cudaSupport = true; }
+            // (if nixpkgs.cuda.capabilities != null then { cudaCapabilities = nixpkgs.cuda.capabilities; } else {})
+            // (if nixpkgs.cuda.forwardCompat != null then { cudaForwardCompat = nixpkgs.cuda.forwardCompat; }
+              else {}));
+      }
+    ];
 }

modules/system/security.nix

@@ -4,31 +4,35 @@ inputs:
   {
     # allow non-root users to access intel gpu performance counters
     boot.kernel.sysctl."dev.i915.perf_stream_paranoid" = false;
-    security.pam =
+    security =
     {
-      u2f =
+      pam =
       {
-        enable = true;
-        cue = true;
-        appId = "pam://chn.moe";
-        origin = "pam://chn.moe";
-        # generate using: `pamu2fcfg -u chn -o pam://chn.moe -i pam://chn.moe`
-        authFile = inputs.pkgs.writeText "yubikey_mappings" (builtins.concatStringsSep "\n"
-        [
-          (builtins.concatStringsSep ":"
+        u2f =
+        {
+          enable = true;
+          cue = true;
+          appId = "pam://chn.moe";
+          origin = "pam://chn.moe";
+          # generate using: `pamu2fcfg -u chn -o pam://chn.moe -i pam://chn.moe`
+          authFile = inputs.pkgs.writeText "yubikey_mappings" (builtins.concatStringsSep "\n"
           [
-            "chn"
-            (builtins.concatStringsSep ","
+            (builtins.concatStringsSep ":"
             [
-              "83Y3cLxhcmwbDOH1h67SQ1xy0dFBcoKYM0VO/YVq+9lpOpdPdmFaB7BNngO3xCmAxJeO/Fg9jNmEF9vMJEmAaw=="
-              "9bSjr+12JVwtHlyoa70J7w3bEQff+MwLxg5elzdP1OGHcfWGkolRvS+luAgcWjKn1g0swaYdnklCYWYOoCAJbA=="
-              "es256"
-              "+presence"
+              "chn"
+              (builtins.concatStringsSep ","
+              [
+                "83Y3cLxhcmwbDOH1h67SQ1xy0dFBcoKYM0VO/YVq+9lpOpdPdmFaB7BNngO3xCmAxJeO/Fg9jNmEF9vMJEmAaw=="
+                "9bSjr+12JVwtHlyoa70J7w3bEQff+MwLxg5elzdP1OGHcfWGkolRvS+luAgcWjKn1g0swaYdnklCYWYOoCAJbA=="
+                "es256"
+                "+presence"
+              ])
             ])
-          ])
-        ]);
+          ]);
+        };
+        yubico = { enable = true; id = "91291"; };
       };
-      yubico = { enable = true; id = "91291"; };
+      sudo.extraConfig = "Defaults pwfeedback";
     };
   };
 }

modules/system/sops.nix

@@ -13,7 +13,8 @@ inputs:
     {
       sops =
       {
-        defaultSopsFile = ../../secrets/${inputs.config.networking.hostName}.yaml;
+        defaultSopsFile =
+          "${inputs.topInputs.self}/secrets/${inputs.config.nixos.system.networking.hostname}/default.yaml";
         # sops start before impermanence, so we need to use the absolute path
         age.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_ed25519_key" ];
         gnupg.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_rsa_key" ];

modules/system/sysctl.nix

@@ -0,0 +1,24 @@
+inputs:
+{
+  options.nixos.system.sysctl = let inherit (inputs.lib) mkOption types; in
+  {
+    laptop-mode = mkOption { type = types.nullOr types.int; default = null; };
+  };
+  config =
+    let
+      inherit (inputs.lib) mkIf mkMerge;
+      inherit (inputs.config.nixos.system) sysctl;
+    in mkMerge
+    [
+      {
+        boot.kernel.sysctl =
+        {
+          "vm.oom_kill_allocating_task" = true;
+          "vm.oom_dump_tasks" = false;
+          "vm.overcommit_memory" = 1;
+          "kernel.sysrq" = 438;
+        };
+      }
+      (mkIf (sysctl.laptop-mode != null) { boot.kernel.sysctl."vm.laptop_mode" = sysctl.laptop-mode; })
+    ];
+}

modules/system/user.nix

@@ -0,0 +1,39 @@
+inputs:
+{
+  options.nixos.system.user = let inherit (inputs.lib) mkOption types; in
+  {
+    user = mkOption
+    {
+      type = types.attrsOf types.ints.unsigned;
+      readOnly = true;
+      default =
+      {
+        chn = 1000;
+        xll = 1001;
+        yjq = 1002;
+        yxy = 1003;
+        zem = 1004;
+        misskey-misskey = 2000;
+        misskey-misskey-old = 2001;
+        frp = 2002;
+        mirism = 2003;
+        httpapi = 2004;
+        httpua = 2005;
+        rsshub = 2006;
+        v2ray = 2007;
+        fz-new-order = 2008;
+        synapse-synapse = 2009;
+        synapse-matrix = 2010;
+      };
+    };
+    group = mkOption
+    {
+      type = types.attrsOf types.ints.unsigned;
+      readOnly = true;
+      default = inputs.config.nixos.system.user.user //
+      {
+        groupshare = 3000;
+      };
+    };
+  };
+}

modules/users/chn/default.nix

@@ -1,5 +1,6 @@
 inputs:
 {
+  # imports = inputs.localLib.mkModules [ ./plasma.nix ];
   config =
     let
       inherit (inputs.lib) mkIf;
@@ -8,7 +9,6 @@ inputs:
     {
       users.users.chn =
       {
-        isNormalUser = true;
         extraGroups = inputs.lib.intersectLists
           [ "adbusers" "networkmanager" "wheel" "wireshark" "libvirtd" "video" "audio" "groupshare" ]
           (builtins.attrNames inputs.config.users.groups);
@@ -21,10 +21,10 @@ inputs:
           # ykman fido credentials delete f2c1ca2d
           # ssh-keygen -t ed25519-sk -O resident
           # ssh-keygen -K
-          (builtins.concatStringsSep ""
+          (builtins.concatStringsSep " "
           [
-            "sk-ssh-ed25519@openssh.com "
-            "AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEU/JPpLxsk8UWXiZr8CPNG+4WKFB92o1Ep9OEstmPLzAAAABHNzaDo= "
+            "sk-ssh-ed25519@openssh.com"
+            "AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEU/JPpLxsk8UWXiZr8CPNG+4WKFB92o1Ep9OEstmPLzAAAABHNzaDo="
             "chn@pc"
           ])
         ];
@@ -37,40 +37,8 @@ inputs:
           programs =
           {
             git = { userName = "chn"; userEmail = "chn@chn.moe"; };
-            ssh.matchBlocks = builtins.listToAttrs
-            (
-              (builtins.map
-                (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-                [ "internal.pc" "vps5" "vps6" "internal.vps6" "vps7" "internal.vps7" "internal.nas" ])
-              ++ (builtins.map
-                (host:
-                {
-                  name = host;
-                  value =
-                  {
-                    host = host;
-                    hostname = "hpc.xmu.edu.cn";
-                    user = host;
-                    extraOptions =
-                    {
-                      PubkeyAcceptedAlgorithms = "+ssh-rsa";
-                      HostkeyAlgorithms = "+ssh-rsa";
-                      SetEnv = "TERM=chn_unset_ls_colors:xterm-256color";
-                      # in .bash_profile:
-                      # if [[ $TERM == chn_unset_ls_colors* ]]; then
-                      #   export TERM=${TERM#*:}
-                      #   export CHN_LS_USE_COLOR=1
-                      # fi
-                      # in .bashrc
-                      # [ -n "$CHN_LS_USE_COLOR" ] && alias ls="ls --color=auto"
-                    };
-                  };
-                })
-                [ "wlin" "jykang" "hwang" ])
-            )
-            // {
-              xmupc1 = { host = "xmupc1"; hostname = "office.chn.moe"; port = 6007; };
-              nas = { host = "nas"; hostname = "office.chn.moe"; port = 5440; };
+            ssh.matchBlocks =
+            {
               # identityFile = "~/.ssh/xmuhk_id_rsa";
               xmuhk = { host = "xmuhk"; hostname = "10.26.14.56"; user = "xmuhk"; };
               xmuhk2 = { host = "xmuhk2"; hostname = "183.233.219.132"; user = "xmuhk"; port = 62022; };

modules/users/chn/plasma.nix

@@ -0,0 +1,853 @@
+{
+  config.home-manager.users.chn.config.programs.plasma =
+  {
+    enable = true;
+    shortcuts =
+    {
+      # crow translate
+      "io.crow_translate.CrowTranslate.desktop"."TranslateSelectedText" = "Ctrl+Alt+E";
+
+      # display
+      "kded5"."display" = [ "Display" "Meta+P" ];
+      "kwin"."view_actual_size" = "Meta+0";
+      "kwin"."view_zoom_in" = ["Meta++" "Meta+="];
+      "kwin"."view_zoom_out" = "Meta+-";
+      "org_kde_powerdevil"."Decrease Screen Brightness" = "Monitor Brightness Down";
+      "org_kde_powerdevil"."Increase Screen Brightness" = "Monitor Brightness Up";
+
+      # volume
+      "kmix" =
+      {
+        "decrease_volume" = "Volume Down";
+        "increase_volume" = "Volume Up";
+        "mic_mute" = [ "Meta+Volume Mute" ];
+        "mute" = "Volume Mute";
+      };
+
+      # session
+      "ksmserver" =
+      {
+        "Lock Session" = [ "Meta+L" "Screensaver" ];
+        "Log Out" = "Ctrl+Alt+Del";
+      };
+      "org_kde_powerdevil"."Turn Off Screen" = "Meta+Ctrl+L";
+
+      # mouse
+      "kwin"."MoveMouseToCenter" = "Meta+F6";
+
+      # window
+      "kwin"."Overview" = "Meta+Tab";
+      "kwin"."Show Desktop" = "Meta+D";
+      "kwin"."Suspend Compositing" = "Alt+Shift+F12";
+      "kwin"."Walk Through Windows" = "Alt+Tab";
+      "kwin"."Walk Through Windows (Reverse)" = "Alt+Shift+Backtab";
+      "kwin"."Window Above Other Windows" = "Meta+Shift+PgUp";
+      "kwin"."Window Below Other Windows" = "Meta+Shift+PgDown";
+      "kwin"."Window Close" = "Alt+F4";
+      "kwin"."Window Maximize" = "Meta+PgUp";
+      "kwin"."Window Minimize" = "Meta+PgDown";
+      "kwin"."Window Operations Menu" = "Alt+F3";
+      "kwin"."Window Quick Tile Bottom" = "Meta+Down";
+      "kwin"."Window Quick Tile Left" = "Meta+Left";
+      "kwin"."Window Quick Tile Right" = "Meta+Right";
+      "kwin"."Window Quick Tile Top" = "Meta+Up";
+
+      # virtual desktop
+      "kwin"."Switch One Desktop Down" = "Meta+Ctrl+Down";
+      "kwin"."Switch One Desktop Up" = "Meta+Ctrl+Up";
+      "kwin"."Switch One Desktop to the Left" = "Meta+Ctrl+Left";
+      "kwin"."Switch One Desktop to the Right" = "Meta+Ctrl+Right";
+      "kwin"."Window One Desktop Down" = "Meta+Ctrl+Shift+Down";
+      "kwin"."Window One Desktop Up" = "Meta+Ctrl+Shift+Up";
+      "kwin"."Window One Desktop to the Left" = "Meta+Ctrl+Shift+Left";
+      "kwin"."Window One Desktop to the Right" = "Meta+Ctrl+Shift+Right";
+
+      # media
+      "mediacontrol"."nextmedia" = "Media Next";
+      "mediacontrol"."pausemedia" = "Media Pause";
+      "mediacontrol"."playpausemedia" = [ "Pause" "Media Play" ];
+      "mediacontrol"."previousmedia" = "Media Previous";
+      "mediacontrol"."stopmedia" = "Media Stop";
+
+      # dolphin
+      "org.kde.dolphin.desktop"."_launch" = "Meta+E";
+
+      # konsole
+      "org.kde.konsole.desktop"."_launch" = "Ctrl+Alt+T";
+
+      # krunner
+      "org.kde.krunner.desktop"."_launch" = "Alt+Space";
+
+      # screenshot
+      "org.kde.spectacle.desktop"."ActiveWindowScreenShot" = "Meta+Print";
+      "org.kde.spectacle.desktop"."CurrentMonitorScreenShot" = [ ];
+      "org.kde.spectacle.desktop"."FullScreenScreenShot" = "Shift+Print";
+      "org.kde.spectacle.desktop"."OpenWithoutScreenshot" = [ ];
+      "org.kde.spectacle.desktop"."RectangularRegionScreenShot" = "Meta+Shift+Print";
+      "org.kde.spectacle.desktop"."WindowUnderCursorScreenShot" = "Meta+Ctrl+Print";
+      "org.kde.spectacle.desktop"."_launch" = "Print";
+
+      # settings
+      "systemsettings.desktop"."_launch" = "Meta+I";
+
+      # yakuake
+      "yakuake"."toggle-window-state" = "Meta+Space";
+    };
+    configFile =
+    {
+      # baloo
+      # "baloofilerc"."Basic Settings"."Indexing-Enabled" = false;
+
+      # dolphin
+      "dolphinrc"."General"."ShowFullPath" = true;
+      "dolphinrc"."PreviewSettings"."Plugins" = "blenderthumbnail,comicbookthumbnail,djvuthumbnail,ebookthumbnail,exrthumbnail,marble_thumbnail_geojson,marble_thumbnail_gpx,jpegthumbnail,marble_thumbnail_kmz,marble_thumbnail_kml,kraorathumbnail,windowsimagethumbnail,windowsexethumbnail,mltpreview,mobithumbnail,opendocumentthumbnail,marble_thumbnail_osm,palathumbcreator,gsthumbnail,rawthumbnail,svgthumbnail,imagethumbnail,fontthumbnail,directorythumbnail,textthumbnail,webarchivethumbnail,ffmpegthumbs,audiothumbnail";
+
+      "kactivitymanagerdrc"."activities"."f305b694-8f87-46ec-a9b1-4425c55a077e" = "Default";
+      "kactivitymanagerdrc"."activities-icons"."242e672c-3145-4b8f-acc4-7663d17dabcc" = "activities";
+      "kactivitymanagerdrc"."main"."currentActivity" = "f305b694-8f87-46ec-a9b1-4425c55a077e";
+      "kactivitymanagerdrc"."main"."runningActivities" = "f305b694-8f87-46ec-a9b1-4425c55a077e";
+      "kactivitymanagerdrc"."main"."stoppedActivities" = "";
+      "kcminputrc"."ButtonRebinds.Mouse"."ExtraButton1" = "Key,PgDown";
+      "kcminputrc"."ButtonRebinds.Mouse"."ExtraButton2" = "Key,PgUp";
+      "kcminputrc"."Libinput.2321.21128.HTIX5288:00 0911:5288 Touchpad"."ClickMethod" = 2;
+      "kcminputrc"."Libinput.2321.21128.HTIX5288:00 0911:5288 Touchpad"."MiddleButtonEmulation" = true;
+      "kcminputrc"."Libinput.2321.21128.HTIX5288:00 0911:5288 Touchpad"."TapToClick" = true;
+      "kcminputrc"."Mouse"."X11LibInputXAccelProfileFlat" = false;
+      "kcminputrc"."Mouse"."XLbInptAccelProfileFlat" = true;
+      "kcminputrc"."Mouse"."XLbInptPointerAcceleration" = 0.6;
+      "kcminputrc"."Mouse"."cursorTheme" = "breeze_cursors";
+      "kcminputrc"."Tmp"."update_info" = "delete_cursor_old_default_size.upd:DeleteCursorOldDefaultSize";
+      "kded5rc"."Module-browserintegrationreminder"."autoload" = false;
+      "kded5rc"."Module-device_automounter"."autoload" = false;
+      "kded5rc"."PlasmaBrowserIntegration"."shownCount" = 4;
+      "kdeglobals"."DirSelect Dialog"."DirSelectDialog Size" = "1920,1050";
+      "kdeglobals"."General"."AllowKDEAppsToRememberWindowPositions" = true;
+      "kdeglobals"."General"."BrowserApplication" = "firefox.desktop";
+      "kdeglobals"."General"."LastUsedCustomAccentColor" = "61,212,37";
+      "kdeglobals"."General"."XftAntialias" = true;
+      "kdeglobals"."General"."XftHintStyle" = "hintslight";
+      "kdeglobals"."General"."XftSubPixel" = "rgb";
+      "kdeglobals"."KDE"."SingleClick" = true;
+      "kdeglobals"."KDE"."widgetStyle" = "kvantum";
+      "kdeglobals"."KFileDialog Settings"."Allow Expansion" = true;
+      "kdeglobals"."KFileDialog Settings"."Automatically select filename extension" = true;
+      "kdeglobals"."KFileDialog Settings"."Breadcrumb Navigation" = false;
+      "kdeglobals"."KFileDialog Settings"."Decoration position" = 2;
+      "kdeglobals"."KFileDialog Settings"."LocationCombo Completionmode" = 5;
+      "kdeglobals"."KFileDialog Settings"."PathCombo Completionmode" = 5;
+      "kdeglobals"."KFileDialog Settings"."Preview Width" = 688;
+      "kdeglobals"."KFileDialog Settings"."Show Bookmarks" = true;
+      "kdeglobals"."KFileDialog Settings"."Show Full Path" = true;
+      "kdeglobals"."KFileDialog Settings"."Show Inline Previews" = false;
+      "kdeglobals"."KFileDialog Settings"."Show Preview" = false;
+      "kdeglobals"."KFileDialog Settings"."Show Speedbar" = true;
+      "kdeglobals"."KFileDialog Settings"."Show hidden files" = true;
+      "kdeglobals"."KFileDialog Settings"."Sort by" = "Name";
+      "kdeglobals"."KFileDialog Settings"."Sort directories first" = true;
+      "kdeglobals"."KFileDialog Settings"."Sort hidden files last" = false;
+      "kdeglobals"."KFileDialog Settings"."Sort reversed" = false;
+      "kdeglobals"."KFileDialog Settings"."Speedbar Width" = 89;
+      "kdeglobals"."KFileDialog Settings"."View Style" = "DetailTree";
+      "kdeglobals"."KScreen"."ScreenScaleFactors" = "eDP-1=1;DP-1=1;";
+      "kdeglobals"."KShortcutsDialog Settings"."Dialog Size" = "600,480";
+      "kdeglobals"."PreviewSettings"."MaximumRemoteSize" = 0;
+      "kdeglobals"."WM"."activeBackground" = "247,247,247";
+      "kdeglobals"."WM"."activeBlend" = "153,153,153";
+      "kdeglobals"."WM"."activeForeground" = "120,120,120";
+      "kdeglobals"."WM"."inactiveBackground" = "242,242,242";
+      "kdeglobals"."WM"."inactiveBlend" = "221,221,221";
+      "kdeglobals"."WM"."inactiveForeground" = "170,170,170";
+      "kgammarc"."ConfigFile"."use" = "kgammarc";
+      "kglobalshortcutsrc"."ActivityManager"."_k_friendly_name" = "活动管理器";
+      "kglobalshortcutsrc"."KDE Keyboard Layout Switcher"."_k_friendly_name" = "键盘布局切换器";
+      "kglobalshortcutsrc"."io.crow_translate.CrowTranslate.desktop"."_k_friendly_name" = "Crow Translate";
+      "kglobalshortcutsrc"."juk"."_k_friendly_name" = "JuK";
+      "kglobalshortcutsrc"."kaccess"."_k_friendly_name" = "无障碍辅助";
+      "kglobalshortcutsrc"."kcm_touchpad"."_k_friendly_name" = "触摸板";
+      "kglobalshortcutsrc"."kded5"."_k_friendly_name" = "KDE Daemon";
+      "kglobalshortcutsrc"."khotkeys"."_k_friendly_name" = "Custom Shortcuts Service";
+      "kglobalshortcutsrc"."kmix"."_k_friendly_name" = "音频音量";
+      "kglobalshortcutsrc"."ksmserver"."_k_friendly_name" = "会话管理";
+      "kglobalshortcutsrc"."kwin"."_k_friendly_name" = "KWin";
+      "kglobalshortcutsrc"."mediacontrol"."_k_friendly_name" = "媒体控制器";
+      "kglobalshortcutsrc"."org.kde.dolphin.desktop"."_k_friendly_name" = "Dolphin";
+      "kglobalshortcutsrc"."org.kde.kcalc.desktop"."_k_friendly_name" = "KCalc";
+      "kglobalshortcutsrc"."org.kde.konsole.desktop"."_k_friendly_name" = "Konsole";
+      "kglobalshortcutsrc"."org.kde.krunner.desktop"."_k_friendly_name" = "KRunner";
+      "kglobalshortcutsrc"."org.kde.plasma.emojier.desktop"."_k_friendly_name" = "Emoji Selector";
+      "kglobalshortcutsrc"."org.kde.spectacle.desktop"."_k_friendly_name" = "Spectacle 截图工具";
+      "kglobalshortcutsrc"."org_kde_powerdevil"."_k_friendly_name" = "电源管理";
+      "kglobalshortcutsrc"."plasmashell"."_k_friendly_name" = "Plasma";
+      "kglobalshortcutsrc"."systemsettings.desktop"."_k_friendly_name" = "System Settings";
+      "kglobalshortcutsrc"."yakuake"."_k_friendly_name" = "Yakuake";
+      "khotkeysrc"."Data"."DataCount" = 3;
+      "khotkeysrc"."Data_1"."Comment" = "KMenuEdit Global Shortcuts";
+      "khotkeysrc"."Data_1"."DataCount" = 1;
+      "khotkeysrc"."Data_1"."Enabled" = true;
+      "khotkeysrc"."Data_1"."Name" = "KMenuEdit";
+      "khotkeysrc"."Data_1"."SystemGroup" = 1;
+      "khotkeysrc"."Data_1"."Type" = "ACTION_DATA_GROUP";
+      "khotkeysrc"."Data_1Conditions"."Comment" = "";
+      "khotkeysrc"."Data_1Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_1_1"."Comment" = "Comment";
+      "khotkeysrc"."Data_1_1"."Enabled" = true;
+      "khotkeysrc"."Data_1_1"."Name" = "Search";
+      "khotkeysrc"."Data_1_1"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_1_1Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_1_1Actions0"."CommandURL" = "http://google.com";
+      "khotkeysrc"."Data_1_1Actions0"."Type" = "COMMAND_URL";
+      "khotkeysrc"."Data_1_1Conditions"."Comment" = "";
+      "khotkeysrc"."Data_1_1Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_1_1Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_1_1Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_1_1Triggers0"."Key" = "";
+      "khotkeysrc"."Data_1_1Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_1_1Triggers0"."Uuid" = "{d03619b6-9b3c-48cc-9d9c-a2aadb485550}";
+      "khotkeysrc"."Data_2"."Comment" = "This group contains various examples demonstrating most of the features of KHotkeys. (Note that this group and all its actions are disabled by default.)";
+      "khotkeysrc"."Data_2"."DataCount" = 8;
+      "khotkeysrc"."Data_2"."Enabled" = false;
+      "khotkeysrc"."Data_2"."ImportId" = "kde32b1";
+      "khotkeysrc"."Data_2"."Name" = "Examples";
+      "khotkeysrc"."Data_2"."SystemGroup" = 0;
+      "khotkeysrc"."Data_2"."Type" = "ACTION_DATA_GROUP";
+      "khotkeysrc"."Data_2Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_1"."Comment" = "After pressing Ctrl+Alt+I, the KSIRC window will be activated, if it exists. Simple.";
+      "khotkeysrc"."Data_2_1"."Enabled" = false;
+      "khotkeysrc"."Data_2_1"."Name" = "Activate KSIRC Window";
+      "khotkeysrc"."Data_2_1"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_1Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_1Actions0"."Type" = "ACTIVATE_WINDOW";
+      "khotkeysrc"."Data_2_1Actions0Window"."Comment" = "KSIRC window";
+      "khotkeysrc"."Data_2_1Actions0Window"."WindowsCount" = 1;
+      "khotkeysrc"."Data_2_1Actions0Window0"."Class" = "ksirc";
+      "khotkeysrc"."Data_2_1Actions0Window0"."ClassType" = 1;
+      "khotkeysrc"."Data_2_1Actions0Window0"."Comment" = "KSIRC";
+      "khotkeysrc"."Data_2_1Actions0Window0"."Role" = "";
+      "khotkeysrc"."Data_2_1Actions0Window0"."RoleType" = 0;
+      "khotkeysrc"."Data_2_1Actions0Window0"."Title" = "";
+      "khotkeysrc"."Data_2_1Actions0Window0"."TitleType" = 0;
+      "khotkeysrc"."Data_2_1Actions0Window0"."Type" = "SIMPLE";
+      "khotkeysrc"."Data_2_1Actions0Window0"."WindowTypes" = 33;
+      "khotkeysrc"."Data_2_1Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_1Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_1Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_1Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_1Triggers0"."Key" = "Ctrl+Alt+I";
+      "khotkeysrc"."Data_2_1Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_1Triggers0"."Uuid" = "{24dd86db-8cad-4cfe-90c1-4dc99fd82b3c}";
+      "khotkeysrc"."Data_2_2"."Comment" = "After pressing Alt+Ctrl+H the input of 'Hello' will be simulated, as if you typed it.  This is especially useful if you have call to frequently type a word (for instance, 'unsigned').  Every keypress in the input is separated by a colon ':'. Note that the keypresses literally mean keypresses, so you have to write what you would press on the keyboard. In the table below, the left column shows the input and the right column shows what to type.\n\n\"enter\" (i.e. new line)                Enter or Return\na (i.e. small a)                          A\nA (i.e. capital a)                       Shift+A\n: (colon)                                  Shift+;\n' '  (space)                              Space";
+      "khotkeysrc"."Data_2_2"."Enabled" = false;
+      "khotkeysrc"."Data_2_2"."Name" = "Type 'Hello'";
+      "khotkeysrc"."Data_2_2"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_2Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_2Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_2Actions0"."Input" = "Shift+H:E:L:L:O\n";
+      "khotkeysrc"."Data_2_2Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_2Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_2Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_2Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_2Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_2Triggers0"."Key" = "Ctrl+Alt+H";
+      "khotkeysrc"."Data_2_2Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_2Triggers0"."Uuid" = "{9a310197-d2b6-4ef8-a227-072d734024ab}";
+      "khotkeysrc"."Data_2_3"."Comment" = "This action runs Konsole, after pressing Ctrl+Alt+T.";
+      "khotkeysrc"."Data_2_3"."Enabled" = false;
+      "khotkeysrc"."Data_2_3"."Name" = "Run Konsole";
+      "khotkeysrc"."Data_2_3"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_3Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_3Actions0"."CommandURL" = "konsole";
+      "khotkeysrc"."Data_2_3Actions0"."Type" = "COMMAND_URL";
+      "khotkeysrc"."Data_2_3Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_3Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_3Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_3Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_3Triggers0"."Key" = "Ctrl+Alt+T";
+      "khotkeysrc"."Data_2_3Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_3Triggers0"."Uuid" = "{a07e67fe-65e3-4ea3-a533-9cbb1e14b221}";
+      "khotkeysrc"."Data_2_4"."Comment" = "Read the comment on the \"Type 'Hello'\" action first.\n\nQt Designer uses Ctrl+F4 for closing windows.  In KDE, however, Ctrl+F4 is the shortcut for going to virtual desktop 4, so this shortcut does not work in Qt Designer.  Further, Qt Designer does not use KDE's standard Ctrl+W for closing the window.\n\nThis problem can be solved by remapping Ctrl+W to Ctrl+F4 when the active window is Qt Designer. When Qt Designer is active, every time Ctrl+W is pressed, Ctrl+F4 will be sent to Qt Designer instead. In other applications, the effect of Ctrl+W is unchanged.\n\nWe now need to specify three things: A new shortcut trigger on 'Ctrl+W', a new keyboard input action sending Ctrl+F4, and a new condition that the active window is Qt Designer.\nQt Designer seems to always have title 'Qt Designer by Trolltech', so the condition will check for the active window having that title.";
+      "khotkeysrc"."Data_2_4"."Enabled" = false;
+      "khotkeysrc"."Data_2_4"."Name" = "Remap Ctrl+W to Ctrl+F4 in Qt Designer";
+      "khotkeysrc"."Data_2_4"."Type" = "GENERIC_ACTION_DATA";
+      "khotkeysrc"."Data_2_4Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_4Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_4Actions0"."Input" = "Ctrl+F4";
+      "khotkeysrc"."Data_2_4Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_4Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_4Conditions"."ConditionsCount" = 1;
+      "khotkeysrc"."Data_2_4Conditions0"."Type" = "ACTIVE_WINDOW";
+      "khotkeysrc"."Data_2_4Conditions0Window"."Comment" = "Qt Designer";
+      "khotkeysrc"."Data_2_4Conditions0Window"."WindowsCount" = 1;
+      "khotkeysrc"."Data_2_4Conditions0Window0"."Class" = "";
+      "khotkeysrc"."Data_2_4Conditions0Window0"."ClassType" = 0;
+      "khotkeysrc"."Data_2_4Conditions0Window0"."Comment" = "";
+      "khotkeysrc"."Data_2_4Conditions0Window0"."Role" = "";
+      "khotkeysrc"."Data_2_4Conditions0Window0"."RoleType" = 0;
+      "khotkeysrc"."Data_2_4Conditions0Window0"."Title" = "Qt Designer by Trolltech";
+      "khotkeysrc"."Data_2_4Conditions0Window0"."TitleType" = 2;
+      "khotkeysrc"."Data_2_4Conditions0Window0"."Type" = "SIMPLE";
+      "khotkeysrc"."Data_2_4Conditions0Window0"."WindowTypes" = 33;
+      "khotkeysrc"."Data_2_4Triggers"."Comment" = "";
+      "khotkeysrc"."Data_2_4Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_4Triggers0"."Key" = "Ctrl+W";
+      "khotkeysrc"."Data_2_4Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_4Triggers0"."Uuid" = "{bb31801d-1f7e-497a-acdd-d6ac4dc651b9}";
+      "khotkeysrc"."Data_2_5"."Comment" = "By pressing Alt+Ctrl+W a D-Bus call will be performed that will show the minicli. You can use any kind of D-Bus call, just like using the command line 'qdbus' tool.";
+      "khotkeysrc"."Data_2_5"."Enabled" = false;
+      "khotkeysrc"."Data_2_5"."Name" = "Perform D-Bus call 'qdbus org.kde.krunner /App display'";
+      "khotkeysrc"."Data_2_5"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_5Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_5Actions0"."Arguments" = "";
+      "khotkeysrc"."Data_2_5Actions0"."Call" = "popupExecuteCommand";
+      "khotkeysrc"."Data_2_5Actions0"."RemoteApp" = "org.kde.krunner";
+      "khotkeysrc"."Data_2_5Actions0"."RemoteObj" = "/App";
+      "khotkeysrc"."Data_2_5Actions0"."Type" = "DBUS";
+      "khotkeysrc"."Data_2_5Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_5Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_5Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_5Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_5Triggers0"."Key" = "Ctrl+Alt+W";
+      "khotkeysrc"."Data_2_5Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_5Triggers0"."Uuid" = "{811d3453-4611-4e42-864b-e7325b45969b}";
+      "khotkeysrc"."Data_2_6"."Comment" = "Read the comment on the \"Type 'Hello'\" action first.\n\nJust like the \"Type 'Hello'\" action, this one simulates keyboard input, specifically, after pressing Ctrl+Alt+B, it sends B to XMMS (B in XMMS jumps to the next song). The 'Send to specific window' checkbox is checked and a window with its class containing 'XMMS_Player' is specified; this will make the input always be sent to this window. This way, you can control XMMS even if, for instance, it is on a different virtual desktop.\n\n(Run 'xprop' and click on the XMMS window and search for WM_CLASS to see 'XMMS_Player').";
+      "khotkeysrc"."Data_2_6"."Enabled" = false;
+      "khotkeysrc"."Data_2_6"."Name" = "Next in XMMS";
+      "khotkeysrc"."Data_2_6"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_6Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_6Actions0"."DestinationWindow" = 1;
+      "khotkeysrc"."Data_2_6Actions0"."Input" = "B";
+      "khotkeysrc"."Data_2_6Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow"."Comment" = "XMMS window";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow"."WindowsCount" = 1;
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."Class" = "XMMS_Player";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."ClassType" = 1;
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."Comment" = "XMMS Player window";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."Role" = "";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."RoleType" = 0;
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."Title" = "";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."TitleType" = 0;
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."Type" = "SIMPLE";
+      "khotkeysrc"."Data_2_6Actions0DestinationWindow0"."WindowTypes" = 33;
+      "khotkeysrc"."Data_2_6Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_6Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_6Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_6Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_6Triggers0"."Key" = "Ctrl+Alt+B";
+      "khotkeysrc"."Data_2_6Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_6Triggers0"."Uuid" = "{14de0367-f2e2-4535-a8b0-3a4aa9acc58b}";
+      "khotkeysrc"."Data_2_7"."Comment" = "Konqueror in KDE3.1 has tabs, and now you can also have gestures.\n\nJust press the middle mouse button and start drawing one of the gestures, and after you are finished, release the mouse button. If you only need to paste the selection, it still works, just click the middle mouse button. (You can change the mouse button to use in the global settings).\n\nRight now, there are the following gestures available:\nmove right and back left - Forward (Alt+Right)\nmove left and back right - Back (Alt+Left)\nmove up and back down  - Up (Alt+Up)\ncircle counterclockwise - Reload (F5)\n\nThe gesture shapes can be entered by performing them in the configuration dialog. You can also look at your numeric pad to help you: gestures are recognized like a 3x3 grid of fields, numbered 1 to 9.\n\nNote that you must perform exactly the gesture to trigger the action. Because of this, it is possible to enter more gestures for the action. You should try to avoid complicated gestures where you change the direction of mouse movement more than once.  For instance, 45654 or 74123 are simple to perform, but 1236987 may be already quite difficult.\n\nThe conditions for all gestures are defined in this group. All these gestures are active only if the active window is Konqueror (class contains 'konqueror').";
+      "khotkeysrc"."Data_2_7"."DataCount" = 4;
+      "khotkeysrc"."Data_2_7"."Enabled" = false;
+      "khotkeysrc"."Data_2_7"."Name" = "Konqi Gestures";
+      "khotkeysrc"."Data_2_7"."SystemGroup" = 0;
+      "khotkeysrc"."Data_2_7"."Type" = "ACTION_DATA_GROUP";
+      "khotkeysrc"."Data_2_7Conditions"."Comment" = "Konqueror window";
+      "khotkeysrc"."Data_2_7Conditions"."ConditionsCount" = 1;
+      "khotkeysrc"."Data_2_7Conditions0"."Type" = "ACTIVE_WINDOW";
+      "khotkeysrc"."Data_2_7Conditions0Window"."Comment" = "Konqueror";
+      "khotkeysrc"."Data_2_7Conditions0Window"."WindowsCount" = 1;
+      "khotkeysrc"."Data_2_7Conditions0Window0"."Class" = "konqueror";
+      "khotkeysrc"."Data_2_7Conditions0Window0"."ClassType" = 1;
+      "khotkeysrc"."Data_2_7Conditions0Window0"."Comment" = "Konqueror";
+      "khotkeysrc"."Data_2_7Conditions0Window0"."Role" = "";
+      "khotkeysrc"."Data_2_7Conditions0Window0"."RoleType" = 0;
+      "khotkeysrc"."Data_2_7Conditions0Window0"."Title" = "";
+      "khotkeysrc"."Data_2_7Conditions0Window0"."TitleType" = 0;
+      "khotkeysrc"."Data_2_7Conditions0Window0"."Type" = "SIMPLE";
+      "khotkeysrc"."Data_2_7Conditions0Window0"."WindowTypes" = 33;
+      "khotkeysrc"."Data_2_7_1"."Comment" = "";
+      "khotkeysrc"."Data_2_7_1"."Enabled" = false;
+      "khotkeysrc"."Data_2_7_1"."Name" = "Back";
+      "khotkeysrc"."Data_2_7_1"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_7_1Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_7_1Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_7_1Actions0"."Input" = "Alt+Left";
+      "khotkeysrc"."Data_2_7_1Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_7_1Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_7_1Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_7_1Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_2_7_1Triggers"."TriggersCount" = 3;
+      "khotkeysrc"."Data_2_7_1Triggers0"."GesturePointData" = "0,0.0625,1,1,0.5,0.0625,0.0625,1,0.875,0.5,0.125,0.0625,1,0.75,0.5,0.1875,0.0625,1,0.625,0.5,0.25,0.0625,1,0.5,0.5,0.3125,0.0625,1,0.375,0.5,0.375,0.0625,1,0.25,0.5,0.4375,0.0625,1,0.125,0.5,0.5,0.0625,0,0,0.5,0.5625,0.0625,0,0.125,0.5,0.625,0.0625,0,0.25,0.5,0.6875,0.0625,0,0.375,0.5,0.75,0.0625,0,0.5,0.5,0.8125,0.0625,0,0.625,0.5,0.875,0.0625,0,0.75,0.5,0.9375,0.0625,0,0.875,0.5,1,0,0,1,0.5";
+      "khotkeysrc"."Data_2_7_1Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_1Triggers1"."GesturePointData" = "0,0.0833333,1,0.5,0.5,0.0833333,0.0833333,1,0.375,0.5,0.166667,0.0833333,1,0.25,0.5,0.25,0.0833333,1,0.125,0.5,0.333333,0.0833333,0,0,0.5,0.416667,0.0833333,0,0.125,0.5,0.5,0.0833333,0,0.25,0.5,0.583333,0.0833333,0,0.375,0.5,0.666667,0.0833333,0,0.5,0.5,0.75,0.0833333,0,0.625,0.5,0.833333,0.0833333,0,0.75,0.5,0.916667,0.0833333,0,0.875,0.5,1,0,0,1,0.5";
+      "khotkeysrc"."Data_2_7_1Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_1Triggers2"."GesturePointData" = "0,0.0833333,1,1,0.5,0.0833333,0.0833333,1,0.875,0.5,0.166667,0.0833333,1,0.75,0.5,0.25,0.0833333,1,0.625,0.5,0.333333,0.0833333,1,0.5,0.5,0.416667,0.0833333,1,0.375,0.5,0.5,0.0833333,1,0.25,0.5,0.583333,0.0833333,1,0.125,0.5,0.666667,0.0833333,0,0,0.5,0.75,0.0833333,0,0.125,0.5,0.833333,0.0833333,0,0.25,0.5,0.916667,0.0833333,0,0.375,0.5,1,0,0,0.5,0.5";
+      "khotkeysrc"."Data_2_7_1Triggers2"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_2"."Comment" = "";
+      "khotkeysrc"."Data_2_7_2"."Enabled" = false;
+      "khotkeysrc"."Data_2_7_2"."Name" = "Forward";
+      "khotkeysrc"."Data_2_7_2"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_7_2Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_7_2Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_7_2Actions0"."Input" = "Alt+Right";
+      "khotkeysrc"."Data_2_7_2Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_7_2Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_7_2Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_7_2Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_2_7_2Triggers"."TriggersCount" = 3;
+      "khotkeysrc"."Data_2_7_2Triggers0"."GesturePointData" = "0,0.0625,0,0,0.5,0.0625,0.0625,0,0.125,0.5,0.125,0.0625,0,0.25,0.5,0.1875,0.0625,0,0.375,0.5,0.25,0.0625,0,0.5,0.5,0.3125,0.0625,0,0.625,0.5,0.375,0.0625,0,0.75,0.5,0.4375,0.0625,0,0.875,0.5,0.5,0.0625,1,1,0.5,0.5625,0.0625,1,0.875,0.5,0.625,0.0625,1,0.75,0.5,0.6875,0.0625,1,0.625,0.5,0.75,0.0625,1,0.5,0.5,0.8125,0.0625,1,0.375,0.5,0.875,0.0625,1,0.25,0.5,0.9375,0.0625,1,0.125,0.5,1,0,0,0,0.5";
+      "khotkeysrc"."Data_2_7_2Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_2Triggers1"."GesturePointData" = "0,0.0833333,0,0.5,0.5,0.0833333,0.0833333,0,0.625,0.5,0.166667,0.0833333,0,0.75,0.5,0.25,0.0833333,0,0.875,0.5,0.333333,0.0833333,1,1,0.5,0.416667,0.0833333,1,0.875,0.5,0.5,0.0833333,1,0.75,0.5,0.583333,0.0833333,1,0.625,0.5,0.666667,0.0833333,1,0.5,0.5,0.75,0.0833333,1,0.375,0.5,0.833333,0.0833333,1,0.25,0.5,0.916667,0.0833333,1,0.125,0.5,1,0,0,0,0.5";
+      "khotkeysrc"."Data_2_7_2Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_2Triggers2"."GesturePointData" = "0,0.0833333,0,0,0.5,0.0833333,0.0833333,0,0.125,0.5,0.166667,0.0833333,0,0.25,0.5,0.25,0.0833333,0,0.375,0.5,0.333333,0.0833333,0,0.5,0.5,0.416667,0.0833333,0,0.625,0.5,0.5,0.0833333,0,0.75,0.5,0.583333,0.0833333,0,0.875,0.5,0.666667,0.0833333,1,1,0.5,0.75,0.0833333,1,0.875,0.5,0.833333,0.0833333,1,0.75,0.5,0.916667,0.0833333,1,0.625,0.5,1,0,0,0.5,0.5";
+      "khotkeysrc"."Data_2_7_2Triggers2"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_3"."Comment" = "";
+      "khotkeysrc"."Data_2_7_3"."Enabled" = false;
+      "khotkeysrc"."Data_2_7_3"."Name" = "Up";
+      "khotkeysrc"."Data_2_7_3"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_7_3Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_7_3Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_7_3Actions0"."Input" = "Alt+Up";
+      "khotkeysrc"."Data_2_7_3Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_7_3Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_7_3Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_7_3Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_2_7_3Triggers"."TriggersCount" = 3;
+      "khotkeysrc"."Data_2_7_3Triggers0"."GesturePointData" = "0,0.0625,-0.5,0.5,1,0.0625,0.0625,-0.5,0.5,0.875,0.125,0.0625,-0.5,0.5,0.75,0.1875,0.0625,-0.5,0.5,0.625,0.25,0.0625,-0.5,0.5,0.5,0.3125,0.0625,-0.5,0.5,0.375,0.375,0.0625,-0.5,0.5,0.25,0.4375,0.0625,-0.5,0.5,0.125,0.5,0.0625,0.5,0.5,0,0.5625,0.0625,0.5,0.5,0.125,0.625,0.0625,0.5,0.5,0.25,0.6875,0.0625,0.5,0.5,0.375,0.75,0.0625,0.5,0.5,0.5,0.8125,0.0625,0.5,0.5,0.625,0.875,0.0625,0.5,0.5,0.75,0.9375,0.0625,0.5,0.5,0.875,1,0,0,0.5,1";
+      "khotkeysrc"."Data_2_7_3Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_3Triggers1"."GesturePointData" = "0,0.0833333,-0.5,0.5,1,0.0833333,0.0833333,-0.5,0.5,0.875,0.166667,0.0833333,-0.5,0.5,0.75,0.25,0.0833333,-0.5,0.5,0.625,0.333333,0.0833333,-0.5,0.5,0.5,0.416667,0.0833333,-0.5,0.5,0.375,0.5,0.0833333,-0.5,0.5,0.25,0.583333,0.0833333,-0.5,0.5,0.125,0.666667,0.0833333,0.5,0.5,0,0.75,0.0833333,0.5,0.5,0.125,0.833333,0.0833333,0.5,0.5,0.25,0.916667,0.0833333,0.5,0.5,0.375,1,0,0,0.5,0.5";
+      "khotkeysrc"."Data_2_7_3Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_3Triggers2"."GesturePointData" = "0,0.0833333,-0.5,0.5,0.5,0.0833333,0.0833333,-0.5,0.5,0.375,0.166667,0.0833333,-0.5,0.5,0.25,0.25,0.0833333,-0.5,0.5,0.125,0.333333,0.0833333,0.5,0.5,0,0.416667,0.0833333,0.5,0.5,0.125,0.5,0.0833333,0.5,0.5,0.25,0.583333,0.0833333,0.5,0.5,0.375,0.666667,0.0833333,0.5,0.5,0.5,0.75,0.0833333,0.5,0.5,0.625,0.833333,0.0833333,0.5,0.5,0.75,0.916667,0.0833333,0.5,0.5,0.875,1,0,0,0.5,1";
+      "khotkeysrc"."Data_2_7_3Triggers2"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_4"."Comment" = "";
+      "khotkeysrc"."Data_2_7_4"."Enabled" = false;
+      "khotkeysrc"."Data_2_7_4"."Name" = "Reload";
+      "khotkeysrc"."Data_2_7_4"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_7_4Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_7_4Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_2_7_4Actions0"."Input" = "F5";
+      "khotkeysrc"."Data_2_7_4Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_2_7_4Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_7_4Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_7_4Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_2_7_4Triggers"."TriggersCount" = 3;
+      "khotkeysrc"."Data_2_7_4Triggers0"."GesturePointData" = "0,0.03125,0,0,1,0.03125,0.03125,0,0.125,1,0.0625,0.03125,0,0.25,1,0.09375,0.03125,0,0.375,1,0.125,0.03125,0,0.5,1,0.15625,0.03125,0,0.625,1,0.1875,0.03125,0,0.75,1,0.21875,0.03125,0,0.875,1,0.25,0.03125,-0.5,1,1,0.28125,0.03125,-0.5,1,0.875,0.3125,0.03125,-0.5,1,0.75,0.34375,0.03125,-0.5,1,0.625,0.375,0.03125,-0.5,1,0.5,0.40625,0.03125,-0.5,1,0.375,0.4375,0.03125,-0.5,1,0.25,0.46875,0.03125,-0.5,1,0.125,0.5,0.03125,1,1,0,0.53125,0.03125,1,0.875,0,0.5625,0.03125,1,0.75,0,0.59375,0.03125,1,0.625,0,0.625,0.03125,1,0.5,0,0.65625,0.03125,1,0.375,0,0.6875,0.03125,1,0.25,0,0.71875,0.03125,1,0.125,0,0.75,0.03125,0.5,0,0,0.78125,0.03125,0.5,0,0.125,0.8125,0.03125,0.5,0,0.25,0.84375,0.03125,0.5,0,0.375,0.875,0.03125,0.5,0,0.5,0.90625,0.03125,0.5,0,0.625,0.9375,0.03125,0.5,0,0.75,0.96875,0.03125,0.5,0,0.875,1,0,0,0,1";
+      "khotkeysrc"."Data_2_7_4Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_4Triggers1"."GesturePointData" = "0,0.0277778,0,0,1,0.0277778,0.0277778,0,0.125,1,0.0555556,0.0277778,0,0.25,1,0.0833333,0.0277778,0,0.375,1,0.111111,0.0277778,0,0.5,1,0.138889,0.0277778,0,0.625,1,0.166667,0.0277778,0,0.75,1,0.194444,0.0277778,0,0.875,1,0.222222,0.0277778,-0.5,1,1,0.25,0.0277778,-0.5,1,0.875,0.277778,0.0277778,-0.5,1,0.75,0.305556,0.0277778,-0.5,1,0.625,0.333333,0.0277778,-0.5,1,0.5,0.361111,0.0277778,-0.5,1,0.375,0.388889,0.0277778,-0.5,1,0.25,0.416667,0.0277778,-0.5,1,0.125,0.444444,0.0277778,1,1,0,0.472222,0.0277778,1,0.875,0,0.5,0.0277778,1,0.75,0,0.527778,0.0277778,1,0.625,0,0.555556,0.0277778,1,0.5,0,0.583333,0.0277778,1,0.375,0,0.611111,0.0277778,1,0.25,0,0.638889,0.0277778,1,0.125,0,0.666667,0.0277778,0.5,0,0,0.694444,0.0277778,0.5,0,0.125,0.722222,0.0277778,0.5,0,0.25,0.75,0.0277778,0.5,0,0.375,0.777778,0.0277778,0.5,0,0.5,0.805556,0.0277778,0.5,0,0.625,0.833333,0.0277778,0.5,0,0.75,0.861111,0.0277778,0.5,0,0.875,0.888889,0.0277778,0,0,1,0.916667,0.0277778,0,0.125,1,0.944444,0.0277778,0,0.25,1,0.972222,0.0277778,0,0.375,1,1,0,0,0.5,1";
+      "khotkeysrc"."Data_2_7_4Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_7_4Triggers2"."GesturePointData" = "0,0.0277778,0.5,0,0.5,0.0277778,0.0277778,0.5,0,0.625,0.0555556,0.0277778,0.5,0,0.75,0.0833333,0.0277778,0.5,0,0.875,0.111111,0.0277778,0,0,1,0.138889,0.0277778,0,0.125,1,0.166667,0.0277778,0,0.25,1,0.194444,0.0277778,0,0.375,1,0.222222,0.0277778,0,0.5,1,0.25,0.0277778,0,0.625,1,0.277778,0.0277778,0,0.75,1,0.305556,0.0277778,0,0.875,1,0.333333,0.0277778,-0.5,1,1,0.361111,0.0277778,-0.5,1,0.875,0.388889,0.0277778,-0.5,1,0.75,0.416667,0.0277778,-0.5,1,0.625,0.444444,0.0277778,-0.5,1,0.5,0.472222,0.0277778,-0.5,1,0.375,0.5,0.0277778,-0.5,1,0.25,0.527778,0.0277778,-0.5,1,0.125,0.555556,0.0277778,1,1,0,0.583333,0.0277778,1,0.875,0,0.611111,0.0277778,1,0.75,0,0.638889,0.0277778,1,0.625,0,0.666667,0.0277778,1,0.5,0,0.694444,0.0277778,1,0.375,0,0.722222,0.0277778,1,0.25,0,0.75,0.0277778,1,0.125,0,0.777778,0.0277778,0.5,0,0,0.805556,0.0277778,0.5,0,0.125,0.833333,0.0277778,0.5,0,0.25,0.861111,0.0277778,0.5,0,0.375,0.888889,0.0277778,0.5,0,0.5,0.916667,0.0277778,0.5,0,0.625,0.944444,0.0277778,0.5,0,0.75,0.972222,0.0277778,0.5,0,0.875,1,0,0,0,1";
+      "khotkeysrc"."Data_2_7_4Triggers2"."Type" = "GESTURE";
+      "khotkeysrc"."Data_2_8"."Comment" = "After pressing Win+E (Tux+E) a WWW browser will be launched, and it will open http://www.kde.org . You may run all kind of commands you can run in minicli (Alt+F2).";
+      "khotkeysrc"."Data_2_8"."Enabled" = false;
+      "khotkeysrc"."Data_2_8"."Name" = "Go to KDE Website";
+      "khotkeysrc"."Data_2_8"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_2_8Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_2_8Actions0"."CommandURL" = "http://www.kde.org";
+      "khotkeysrc"."Data_2_8Actions0"."Type" = "COMMAND_URL";
+      "khotkeysrc"."Data_2_8Conditions"."Comment" = "";
+      "khotkeysrc"."Data_2_8Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_2_8Triggers"."Comment" = "Simple_action";
+      "khotkeysrc"."Data_2_8Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_2_8Triggers0"."Key" = "Meta+E";
+      "khotkeysrc"."Data_2_8Triggers0"."Type" = "SHORTCUT";
+      "khotkeysrc"."Data_2_8Triggers0"."Uuid" = "{01088b4f-cb8e-4f32-9b6e-fc5c20408aa1}";
+      "khotkeysrc"."Data_3"."Comment" = "Basic Konqueror gestures.";
+      "khotkeysrc"."Data_3"."DataCount" = 14;
+      "khotkeysrc"."Data_3"."Enabled" = true;
+      "khotkeysrc"."Data_3"."ImportId" = "konqueror_gestures_kde321";
+      "khotkeysrc"."Data_3"."Name" = "Konqueror Gestures";
+      "khotkeysrc"."Data_3"."SystemGroup" = 0;
+      "khotkeysrc"."Data_3"."Type" = "ACTION_DATA_GROUP";
+      "khotkeysrc"."Data_3Conditions"."Comment" = "Konqueror window";
+      "khotkeysrc"."Data_3Conditions"."ConditionsCount" = 1;
+      "khotkeysrc"."Data_3Conditions0"."Type" = "ACTIVE_WINDOW";
+      "khotkeysrc"."Data_3Conditions0Window"."Comment" = "Konqueror";
+      "khotkeysrc"."Data_3Conditions0Window"."WindowsCount" = 1;
+      "khotkeysrc"."Data_3Conditions0Window0"."Class" = "^konqueror\s";
+      "khotkeysrc"."Data_3Conditions0Window0"."ClassType" = 3;
+      "khotkeysrc"."Data_3Conditions0Window0"."Comment" = "Konqueror";
+      "khotkeysrc"."Data_3Conditions0Window0"."Role" = "konqueror-mainwindow#1";
+      "khotkeysrc"."Data_3Conditions0Window0"."RoleType" = 0;
+      "khotkeysrc"."Data_3Conditions0Window0"."Title" = "file:/ - Konqueror";
+      "khotkeysrc"."Data_3Conditions0Window0"."TitleType" = 0;
+      "khotkeysrc"."Data_3Conditions0Window0"."Type" = "SIMPLE";
+      "khotkeysrc"."Data_3Conditions0Window0"."WindowTypes" = 1;
+      "khotkeysrc"."Data_3_1"."Comment" = "Press, move left, release.";
+      "khotkeysrc"."Data_3_1"."Enabled" = true;
+      "khotkeysrc"."Data_3_1"."Name" = "Back";
+      "khotkeysrc"."Data_3_1"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_10"."Comment" = "Opera-style: Press, move up, release.\nNOTE: Conflicts with 'New Tab', and as such is disabled by default.";
+      "khotkeysrc"."Data_3_10"."Enabled" = false;
+      "khotkeysrc"."Data_3_10"."Name" = "Stop Loading";
+      "khotkeysrc"."Data_3_10"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_10Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_10Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_10Actions0"."Input" = "Escape\n";
+      "khotkeysrc"."Data_3_10Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_10Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_10Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_10Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_10Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_10Triggers0"."GesturePointData" = "0,0.125,-0.5,0.5,1,0.125,0.125,-0.5,0.5,0.875,0.25,0.125,-0.5,0.5,0.75,0.375,0.125,-0.5,0.5,0.625,0.5,0.125,-0.5,0.5,0.5,0.625,0.125,-0.5,0.5,0.375,0.75,0.125,-0.5,0.5,0.25,0.875,0.125,-0.5,0.5,0.125,1,0,0,0.5,0";
+      "khotkeysrc"."Data_3_10Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_11"."Comment" = "Going up in URL/directory structure.\nMozilla-style: Press, move up, move left, move up, release.";
+      "khotkeysrc"."Data_3_11"."Enabled" = true;
+      "khotkeysrc"."Data_3_11"."Name" = "Up";
+      "khotkeysrc"."Data_3_11"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_11Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_11Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_11Actions0"."Input" = "Alt+Up";
+      "khotkeysrc"."Data_3_11Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_11Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_11Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_11Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_11Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_11Triggers0"."GesturePointData" = "0,0.0625,-0.5,1,1,0.0625,0.0625,-0.5,1,0.875,0.125,0.0625,-0.5,1,0.75,0.1875,0.0625,-0.5,1,0.625,0.25,0.0625,1,1,0.5,0.3125,0.0625,1,0.875,0.5,0.375,0.0625,1,0.75,0.5,0.4375,0.0625,1,0.625,0.5,0.5,0.0625,1,0.5,0.5,0.5625,0.0625,1,0.375,0.5,0.625,0.0625,1,0.25,0.5,0.6875,0.0625,1,0.125,0.5,0.75,0.0625,-0.5,0,0.5,0.8125,0.0625,-0.5,0,0.375,0.875,0.0625,-0.5,0,0.25,0.9375,0.0625,-0.5,0,0.125,1,0,0,0,0";
+      "khotkeysrc"."Data_3_11Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_12"."Comment" = "Going up in URL/directory structure.\nOpera-style: Press, move up, move left, move up, release.\nNOTE: Conflicts with  \"Activate Previous Tab\", and as such is disabled by default.";
+      "khotkeysrc"."Data_3_12"."Enabled" = false;
+      "khotkeysrc"."Data_3_12"."Name" = "Up #2";
+      "khotkeysrc"."Data_3_12"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_12Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_12Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_12Actions0"."Input" = "Alt+Up\n";
+      "khotkeysrc"."Data_3_12Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_12Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_12Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_12Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_12Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_12Triggers0"."GesturePointData" = "0,0.0625,-0.5,1,1,0.0625,0.0625,-0.5,1,0.875,0.125,0.0625,-0.5,1,0.75,0.1875,0.0625,-0.5,1,0.625,0.25,0.0625,-0.5,1,0.5,0.3125,0.0625,-0.5,1,0.375,0.375,0.0625,-0.5,1,0.25,0.4375,0.0625,-0.5,1,0.125,0.5,0.0625,1,1,0,0.5625,0.0625,1,0.875,0,0.625,0.0625,1,0.75,0,0.6875,0.0625,1,0.625,0,0.75,0.0625,1,0.5,0,0.8125,0.0625,1,0.375,0,0.875,0.0625,1,0.25,0,0.9375,0.0625,1,0.125,0,1,0,0,0,0";
+      "khotkeysrc"."Data_3_12Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_13"."Comment" = "Press, move up, move right, release.";
+      "khotkeysrc"."Data_3_13"."Enabled" = true;
+      "khotkeysrc"."Data_3_13"."Name" = "Activate Next Tab";
+      "khotkeysrc"."Data_3_13"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_13Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_13Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_13Actions0"."Input" = "Ctrl+.\n";
+      "khotkeysrc"."Data_3_13Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_13Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_13Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_13Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_13Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_13Triggers0"."GesturePointData" = "0,0.0625,-0.5,0,1,0.0625,0.0625,-0.5,0,0.875,0.125,0.0625,-0.5,0,0.75,0.1875,0.0625,-0.5,0,0.625,0.25,0.0625,-0.5,0,0.5,0.3125,0.0625,-0.5,0,0.375,0.375,0.0625,-0.5,0,0.25,0.4375,0.0625,-0.5,0,0.125,0.5,0.0625,0,0,0,0.5625,0.0625,0,0.125,0,0.625,0.0625,0,0.25,0,0.6875,0.0625,0,0.375,0,0.75,0.0625,0,0.5,0,0.8125,0.0625,0,0.625,0,0.875,0.0625,0,0.75,0,0.9375,0.0625,0,0.875,0,1,0,0,1,0";
+      "khotkeysrc"."Data_3_13Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_14"."Comment" = "Press, move up, move left, release.";
+      "khotkeysrc"."Data_3_14"."Enabled" = true;
+      "khotkeysrc"."Data_3_14"."Name" = "Activate Previous Tab";
+      "khotkeysrc"."Data_3_14"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_14Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_14Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_14Actions0"."Input" = "Ctrl+,";
+      "khotkeysrc"."Data_3_14Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_14Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_14Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_14Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_14Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_14Triggers0"."GesturePointData" = "0,0.0625,-0.5,1,1,0.0625,0.0625,-0.5,1,0.875,0.125,0.0625,-0.5,1,0.75,0.1875,0.0625,-0.5,1,0.625,0.25,0.0625,-0.5,1,0.5,0.3125,0.0625,-0.5,1,0.375,0.375,0.0625,-0.5,1,0.25,0.4375,0.0625,-0.5,1,0.125,0.5,0.0625,1,1,0,0.5625,0.0625,1,0.875,0,0.625,0.0625,1,0.75,0,0.6875,0.0625,1,0.625,0,0.75,0.0625,1,0.5,0,0.8125,0.0625,1,0.375,0,0.875,0.0625,1,0.25,0,0.9375,0.0625,1,0.125,0,1,0,0,0,0";
+      "khotkeysrc"."Data_3_14Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_1Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_1Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_1Actions0"."Input" = "Alt+Left";
+      "khotkeysrc"."Data_3_1Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_1Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_1Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_1Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_1Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_1Triggers0"."GesturePointData" = "0,0.125,1,1,0.5,0.125,0.125,1,0.875,0.5,0.25,0.125,1,0.75,0.5,0.375,0.125,1,0.625,0.5,0.5,0.125,1,0.5,0.5,0.625,0.125,1,0.375,0.5,0.75,0.125,1,0.25,0.5,0.875,0.125,1,0.125,0.5,1,0,0,0,0.5";
+      "khotkeysrc"."Data_3_1Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_2"."Comment" = "Press, move down, move up, move down, release.";
+      "khotkeysrc"."Data_3_2"."Enabled" = true;
+      "khotkeysrc"."Data_3_2"."Name" = "Duplicate Tab";
+      "khotkeysrc"."Data_3_2"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_2Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_2Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_2Actions0"."Input" = "Ctrl+Shift+D\n";
+      "khotkeysrc"."Data_3_2Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_2Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_2Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_2Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_2Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_2Triggers0"."GesturePointData" = "0,0.0416667,0.5,0.5,0,0.0416667,0.0416667,0.5,0.5,0.125,0.0833333,0.0416667,0.5,0.5,0.25,0.125,0.0416667,0.5,0.5,0.375,0.166667,0.0416667,0.5,0.5,0.5,0.208333,0.0416667,0.5,0.5,0.625,0.25,0.0416667,0.5,0.5,0.75,0.291667,0.0416667,0.5,0.5,0.875,0.333333,0.0416667,-0.5,0.5,1,0.375,0.0416667,-0.5,0.5,0.875,0.416667,0.0416667,-0.5,0.5,0.75,0.458333,0.0416667,-0.5,0.5,0.625,0.5,0.0416667,-0.5,0.5,0.5,0.541667,0.0416667,-0.5,0.5,0.375,0.583333,0.0416667,-0.5,0.5,0.25,0.625,0.0416667,-0.5,0.5,0.125,0.666667,0.0416667,0.5,0.5,0,0.708333,0.0416667,0.5,0.5,0.125,0.75,0.0416667,0.5,0.5,0.25,0.791667,0.0416667,0.5,0.5,0.375,0.833333,0.0416667,0.5,0.5,0.5,0.875,0.0416667,0.5,0.5,0.625,0.916667,0.0416667,0.5,0.5,0.75,0.958333,0.0416667,0.5,0.5,0.875,1,0,0,0.5,1";
+      "khotkeysrc"."Data_3_2Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_3"."Comment" = "Press, move down, move up, release.";
+      "khotkeysrc"."Data_3_3"."Enabled" = true;
+      "khotkeysrc"."Data_3_3"."Name" = "Duplicate Window";
+      "khotkeysrc"."Data_3_3"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_3Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_3Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_3Actions0"."Input" = "Ctrl+D\n";
+      "khotkeysrc"."Data_3_3Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_3Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_3Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_3Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_3Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_3Triggers0"."GesturePointData" = "0,0.0625,0.5,0.5,0,0.0625,0.0625,0.5,0.5,0.125,0.125,0.0625,0.5,0.5,0.25,0.1875,0.0625,0.5,0.5,0.375,0.25,0.0625,0.5,0.5,0.5,0.3125,0.0625,0.5,0.5,0.625,0.375,0.0625,0.5,0.5,0.75,0.4375,0.0625,0.5,0.5,0.875,0.5,0.0625,-0.5,0.5,1,0.5625,0.0625,-0.5,0.5,0.875,0.625,0.0625,-0.5,0.5,0.75,0.6875,0.0625,-0.5,0.5,0.625,0.75,0.0625,-0.5,0.5,0.5,0.8125,0.0625,-0.5,0.5,0.375,0.875,0.0625,-0.5,0.5,0.25,0.9375,0.0625,-0.5,0.5,0.125,1,0,0,0.5,0";
+      "khotkeysrc"."Data_3_3Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_4"."Comment" = "Press, move right, release.";
+      "khotkeysrc"."Data_3_4"."Enabled" = true;
+      "khotkeysrc"."Data_3_4"."Name" = "Forward";
+      "khotkeysrc"."Data_3_4"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_4Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_4Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_4Actions0"."Input" = "Alt+Right";
+      "khotkeysrc"."Data_3_4Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_4Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_4Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_4Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_4Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_4Triggers0"."GesturePointData" = "0,0.125,0,0,0.5,0.125,0.125,0,0.125,0.5,0.25,0.125,0,0.25,0.5,0.375,0.125,0,0.375,0.5,0.5,0.125,0,0.5,0.5,0.625,0.125,0,0.625,0.5,0.75,0.125,0,0.75,0.5,0.875,0.125,0,0.875,0.5,1,0,0,1,0.5";
+      "khotkeysrc"."Data_3_4Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_5"."Comment" = "Press, move down, move half up, move right, move down, release.\n(Drawing a lowercase 'h'.)";
+      "khotkeysrc"."Data_3_5"."Enabled" = true;
+      "khotkeysrc"."Data_3_5"."Name" = "Home";
+      "khotkeysrc"."Data_3_5"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_5Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_5Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_5Actions0"."Input" = "Alt+Home\n";
+      "khotkeysrc"."Data_3_5Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_5Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_5Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_5Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_5Triggers"."TriggersCount" = 2;
+      "khotkeysrc"."Data_3_5Triggers0"."GesturePointData" = "0,0.0461748,0.5,0,0,0.0461748,0.0461748,0.5,0,0.125,0.0923495,0.0461748,0.5,0,0.25,0.138524,0.0461748,0.5,0,0.375,0.184699,0.0461748,0.5,0,0.5,0.230874,0.0461748,0.5,0,0.625,0.277049,0.0461748,0.5,0,0.75,0.323223,0.0461748,0.5,0,0.875,0.369398,0.065301,-0.25,0,1,0.434699,0.065301,-0.25,0.125,0.875,0.5,0.065301,-0.25,0.25,0.75,0.565301,0.065301,-0.25,0.375,0.625,0.630602,0.0461748,0,0.5,0.5,0.676777,0.0461748,0,0.625,0.5,0.722951,0.0461748,0,0.75,0.5,0.769126,0.0461748,0,0.875,0.5,0.815301,0.0461748,0.5,1,0.5,0.861476,0.0461748,0.5,1,0.625,0.90765,0.0461748,0.5,1,0.75,0.953825,0.0461748,0.5,1,0.875,1,0,0,1,1";
+      "khotkeysrc"."Data_3_5Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_5Triggers1"."GesturePointData" = "0,0.0416667,0.5,0,0,0.0416667,0.0416667,0.5,0,0.125,0.0833333,0.0416667,0.5,0,0.25,0.125,0.0416667,0.5,0,0.375,0.166667,0.0416667,0.5,0,0.5,0.208333,0.0416667,0.5,0,0.625,0.25,0.0416667,0.5,0,0.75,0.291667,0.0416667,0.5,0,0.875,0.333333,0.0416667,-0.5,0,1,0.375,0.0416667,-0.5,0,0.875,0.416667,0.0416667,-0.5,0,0.75,0.458333,0.0416667,-0.5,0,0.625,0.5,0.0416667,0,0,0.5,0.541667,0.0416667,0,0.125,0.5,0.583333,0.0416667,0,0.25,0.5,0.625,0.0416667,0,0.375,0.5,0.666667,0.0416667,0,0.5,0.5,0.708333,0.0416667,0,0.625,0.5,0.75,0.0416667,0,0.75,0.5,0.791667,0.0416667,0,0.875,0.5,0.833333,0.0416667,0.5,1,0.5,0.875,0.0416667,0.5,1,0.625,0.916667,0.0416667,0.5,1,0.75,0.958333,0.0416667,0.5,1,0.875,1,0,0,1,1";
+      "khotkeysrc"."Data_3_5Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_6"."Comment" = "Press, move right, move down, move right, release.\nMozilla-style: Press, move down, move right, release.";
+      "khotkeysrc"."Data_3_6"."Enabled" = true;
+      "khotkeysrc"."Data_3_6"."Name" = "Close Tab";
+      "khotkeysrc"."Data_3_6"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_6Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_6Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_6Actions0"."Input" = "Ctrl+W\n";
+      "khotkeysrc"."Data_3_6Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_6Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_6Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_6Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_6Triggers"."TriggersCount" = 2;
+      "khotkeysrc"."Data_3_6Triggers0"."GesturePointData" = "0,0.0625,0,0,0,0.0625,0.0625,0,0.125,0,0.125,0.0625,0,0.25,0,0.1875,0.0625,0,0.375,0,0.25,0.0625,0.5,0.5,0,0.3125,0.0625,0.5,0.5,0.125,0.375,0.0625,0.5,0.5,0.25,0.4375,0.0625,0.5,0.5,0.375,0.5,0.0625,0.5,0.5,0.5,0.5625,0.0625,0.5,0.5,0.625,0.625,0.0625,0.5,0.5,0.75,0.6875,0.0625,0.5,0.5,0.875,0.75,0.0625,0,0.5,1,0.8125,0.0625,0,0.625,1,0.875,0.0625,0,0.75,1,0.9375,0.0625,0,0.875,1,1,0,0,1,1";
+      "khotkeysrc"."Data_3_6Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_6Triggers1"."GesturePointData" = "0,0.0625,0.5,0,0,0.0625,0.0625,0.5,0,0.125,0.125,0.0625,0.5,0,0.25,0.1875,0.0625,0.5,0,0.375,0.25,0.0625,0.5,0,0.5,0.3125,0.0625,0.5,0,0.625,0.375,0.0625,0.5,0,0.75,0.4375,0.0625,0.5,0,0.875,0.5,0.0625,0,0,1,0.5625,0.0625,0,0.125,1,0.625,0.0625,0,0.25,1,0.6875,0.0625,0,0.375,1,0.75,0.0625,0,0.5,1,0.8125,0.0625,0,0.625,1,0.875,0.0625,0,0.75,1,0.9375,0.0625,0,0.875,1,1,0,0,1,1";
+      "khotkeysrc"."Data_3_6Triggers1"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_7"."Comment" = "Press, move up, release.\nConflicts with Opera-style 'Up #2', which is disabled by default.";
+      "khotkeysrc"."Data_3_7"."Enabled" = true;
+      "khotkeysrc"."Data_3_7"."Name" = "New Tab";
+      "khotkeysrc"."Data_3_7"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_7Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_7Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_7Actions0"."Input" = "Ctrl+Shift+N";
+      "khotkeysrc"."Data_3_7Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_7Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_7Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_7Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_7Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_7Triggers0"."GesturePointData" = "0,0.125,-0.5,0.5,1,0.125,0.125,-0.5,0.5,0.875,0.25,0.125,-0.5,0.5,0.75,0.375,0.125,-0.5,0.5,0.625,0.5,0.125,-0.5,0.5,0.5,0.625,0.125,-0.5,0.5,0.375,0.75,0.125,-0.5,0.5,0.25,0.875,0.125,-0.5,0.5,0.125,1,0,0,0.5,0";
+      "khotkeysrc"."Data_3_7Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_8"."Comment" = "Press, move down, release.";
+      "khotkeysrc"."Data_3_8"."Enabled" = true;
+      "khotkeysrc"."Data_3_8"."Name" = "New Window";
+      "khotkeysrc"."Data_3_8"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_8Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_8Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_8Actions0"."Input" = "Ctrl+N\n";
+      "khotkeysrc"."Data_3_8Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_8Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_8Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_8Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_8Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_8Triggers0"."GesturePointData" = "0,0.125,0.5,0.5,0,0.125,0.125,0.5,0.5,0.125,0.25,0.125,0.5,0.5,0.25,0.375,0.125,0.5,0.5,0.375,0.5,0.125,0.5,0.5,0.5,0.625,0.125,0.5,0.5,0.625,0.75,0.125,0.5,0.5,0.75,0.875,0.125,0.5,0.5,0.875,1,0,0,0.5,1";
+      "khotkeysrc"."Data_3_8Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."Data_3_9"."Comment" = "Press, move up, move down, release.";
+      "khotkeysrc"."Data_3_9"."Enabled" = true;
+      "khotkeysrc"."Data_3_9"."Name" = "Reload";
+      "khotkeysrc"."Data_3_9"."Type" = "SIMPLE_ACTION_DATA";
+      "khotkeysrc"."Data_3_9Actions"."ActionsCount" = 1;
+      "khotkeysrc"."Data_3_9Actions0"."DestinationWindow" = 2;
+      "khotkeysrc"."Data_3_9Actions0"."Input" = "F5";
+      "khotkeysrc"."Data_3_9Actions0"."Type" = "KEYBOARD_INPUT";
+      "khotkeysrc"."Data_3_9Conditions"."Comment" = "";
+      "khotkeysrc"."Data_3_9Conditions"."ConditionsCount" = 0;
+      "khotkeysrc"."Data_3_9Triggers"."Comment" = "Gesture_triggers";
+      "khotkeysrc"."Data_3_9Triggers"."TriggersCount" = 1;
+      "khotkeysrc"."Data_3_9Triggers0"."GesturePointData" = "0,0.0625,-0.5,0.5,1,0.0625,0.0625,-0.5,0.5,0.875,0.125,0.0625,-0.5,0.5,0.75,0.1875,0.0625,-0.5,0.5,0.625,0.25,0.0625,-0.5,0.5,0.5,0.3125,0.0625,-0.5,0.5,0.375,0.375,0.0625,-0.5,0.5,0.25,0.4375,0.0625,-0.5,0.5,0.125,0.5,0.0625,0.5,0.5,0,0.5625,0.0625,0.5,0.5,0.125,0.625,0.0625,0.5,0.5,0.25,0.6875,0.0625,0.5,0.5,0.375,0.75,0.0625,0.5,0.5,0.5,0.8125,0.0625,0.5,0.5,0.625,0.875,0.0625,0.5,0.5,0.75,0.9375,0.0625,0.5,0.5,0.875,1,0,0,0.5,1";
+      "khotkeysrc"."Data_3_9Triggers0"."Type" = "GESTURE";
+      "khotkeysrc"."DirSelect Dialog"."DirSelectDialog Size[$d]" = "";
+      "khotkeysrc"."General"."AccentColor[$d]" = "";
+      "khotkeysrc"."General"."AllowKDEAppsToRememberWindowPositions[$d]" = "";
+      "khotkeysrc"."General"."BrowserApplication[$d]" = "";
+      "khotkeysrc"."General"."ColorSchemeHash[$d]" = "";
+      "khotkeysrc"."General"."ColorScheme[$d]" = "";
+      "khotkeysrc"."General"."LastUsedCustomAccentColor[$d]" = "";
+      "khotkeysrc"."General"."XftAntialias[$d]" = "";
+      "khotkeysrc"."General"."XftHintStyle[$d]" = "";
+      "khotkeysrc"."General"."XftSubPixel[$d]" = "";
+      "khotkeysrc"."General"."accentColorFromWallpaper[$d]" = "";
+      "khotkeysrc"."Gestures"."Disabled" = true;
+      "khotkeysrc"."Gestures"."MouseButton" = 2;
+      "khotkeysrc"."Gestures"."Timeout" = 300;
+      "khotkeysrc"."GesturesExclude"."Comment" = "";
+      "khotkeysrc"."GesturesExclude"."WindowsCount" = 0;
+      "khotkeysrc"."Icons"."Theme[$d]" = "";
+      "khotkeysrc"."KDE"."LookAndFeelPackage[$d]" = "";
+      "khotkeysrc"."KDE"."SingleClick[$d]" = "";
+      "khotkeysrc"."KDE"."widgetStyle[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Allow Expansion[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Automatically select filename extension[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Breadcrumb Navigation[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Decoration position[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."LocationCombo Completionmode[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."PathCombo Completionmode[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Preview Width[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show Bookmarks[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show Full Path[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show Inline Previews[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show Preview[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show Speedbar[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Show hidden files[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Sort by[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Sort directories first[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Sort hidden files last[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Sort reversed[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."Speedbar Width[$d]" = "";
+      "khotkeysrc"."KFileDialog Settings"."View Style[$d]" = "";
+      "khotkeysrc"."KScreen"."ScreenScaleFactors[$d]" = "";
+      "khotkeysrc"."KShortcutsDialog Settings"."Dialog Size[$d]" = "";
+      "khotkeysrc"."Main"."AlreadyImported" = "defaults,kde32b1,konqueror_gestures_kde321";
+      "khotkeysrc"."Main"."Disabled" = false;
+      "khotkeysrc"."PreviewSettings"."MaximumRemoteSize[$d]" = "";
+      "khotkeysrc"."Voice"."Shortcut" = "";
+      "khotkeysrc"."WM"."activeBackground[$d]" = "";
+      "khotkeysrc"."WM"."activeBlend[$d]" = "";
+      "khotkeysrc"."WM"."activeForeground[$d]" = "";
+      "khotkeysrc"."WM"."inactiveBackground[$d]" = "";
+      "khotkeysrc"."WM"."inactiveBlend[$d]" = "";
+      "khotkeysrc"."WM"."inactiveForeground[$d]" = "";
+      "kiorc"."Confirmations"."ConfirmDelete" = true;
+      "kiorc"."Confirmations"."ConfirmEmptyTrash" = true;
+      "kiorc"."Confirmations"."ConfirmTrash" = false;
+      "kiorc"."Executable scripts"."behaviourOnLaunch" = "alwaysAsk";
+      "klipperrc"."General"."IgnoreImages" = false;
+      "klipperrc"."General"."MaxClipItems" = 100;
+      "kmixrc"."Global"."AllowDocking" = false;
+      "kmixrc"."Global"."AutoStart" = false;
+      "kmixrc"."Global"."ConfigVersion" = 3;
+      "kmixrc"."Global"."MasterMixer" = "PulseAudio::Playback_Devices:1";
+      "kmixrc"."Global"."MasterMixerDevice" = "auto_null";
+      "kmixrc"."Global"."MixerIgnoreExpression" = "Modem";
+      "kmixrc"."Global"."Size" = "0,0";
+      "kmixrc"."Global"."Visible" = false;
+      "kmixrc"."Profiles"."PulseAudio::Capture_Devices:1" = "PulseAudio.捕获设备.1.default";
+      "kmixrc"."Profiles"."PulseAudio::Capture_Streams:1" = "PulseAudio.捕获流.1.default";
+      "kmixrc"."Profiles"."PulseAudio::Playback_Devices:1" = "PulseAudio.播放设备.1.default";
+      "kmixrc"."Profiles"."PulseAudio::Playback_Streams:1" = "PulseAudio.播放流.1.default";
+      "kmixrc"."View.PulseAudio.捕获设备.1.default.PulseAudio::Capture_Devices:1.alsa_input.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp_6__source"."Split" = false;
+      "kmixrc"."View.PulseAudio.捕获设备.1.default.PulseAudio::Capture_Devices:1.alsa_input.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp__source"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放流.1.default.PulseAudio::Playback_Streams:1.restore:sink-input-by-media-role:event"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放设备.1.default.PulseAudio::Playback_Devices:1.alsa_output.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp_3__sink"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放设备.1.default.PulseAudio::Playback_Devices:1.alsa_output.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp_4__sink"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放设备.1.default.PulseAudio::Playback_Devices:1.alsa_output.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp_5__sink"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放设备.1.default.PulseAudio::Playback_Devices:1.alsa_output.pci-0000_00_1f.3-platform-skl_hda_dsp_generic.HiFi__hw_sofhdadsp__sink"."Split" = false;
+      "kmixrc"."View.PulseAudio.播放设备.1.default.PulseAudio::Playback_Devices:1.auto_null"."Split" = false;
+      "kmixrc"."配置"."Height 1600" = 455;
+      "kmixrc"."配置"."Width 2560" = 554;
+      "krunnerrc"."General"."FreeFloating" = true;
+      "krunnerrc"."Plugins"."baloosearchEnabled" = false;
+      "kscreenlockerrc"."Daemon"."Autolock" = false;
+      "kscreenlockerrc"."Greeter.Wallpaper.org.kde.image.General"."Image" = "/home/chn/Desktop/.桌面/HlszomyrfyxKLtpkVixEtikq_x4_chop.png";
+      "kscreenlockerrc"."Greeter.Wallpaper.org.kde.image.General"."PreviewImage" = "/home/chn/Desktop/.桌面/HlszomyrfyxKLtpkVixEtikq_x4_chop.png";
+      "ksmserverrc"."General"."loginMode" = "emptySession";
+      "ksmserverrc"."SubSession: 3435a388-a8b3-4d1d-9794-b8c30162ce16"."count" = 0;
+      "ksmserverrc"."SubSession: 6a473a77-85df-4e49-8c74-bdb06d1f0efd"."count" = 0;
+      "kwalletrc"."Wallet"."First Use" = false;
+      "kwinrc"."Compositing"."AllowTearing" = false;
+      "kwinrc"."Desktops"."Id_1" = "59c97a39-ae86-42a2-a6a2-e355b275189a";
+      "kwinrc"."Desktops"."Id_2" = "46153339-1363-403c-9622-35430b0557e5";
+      "kwinrc"."Desktops"."Id_3" = "d1990814-e34a-4d65-b29d-9869aa390130";
+      "kwinrc"."Desktops"."Id_4" = "55b646ba-2f52-4af6-84ad-6e83b93c0669";
+      "kwinrc"."Desktops"."Number" = 4;
+      "kwinrc"."Desktops"."Rows" = 2;
+      "kwinrc"."Effect-blur"."BlurStrength" = 10;
+      "kwinrc"."Effect-kwin4_effect_translucency"."MoveResize" = 75;
+      "kwinrc"."Effect-wobblywindows"."AdvancedMode" = true;
+      "kwinrc"."Effect-wobblywindows"."Drag" = 85;
+      "kwinrc"."Effect-wobblywindows"."Stiffness" = 10;
+      "kwinrc"."Effect-wobblywindows"."WobblynessLevel" = 1;
+      "kwinrc"."Plugins"."blurEnabled" = true;
+      "kwinrc"."Plugins"."contrastEnabled" = false;
+      "kwinrc"."Plugins"."kwin4_effect_dimscreenEnabled" = true;
+      "kwinrc"."Plugins"."kwin4_effect_translucencyEnabled" = true;
+      "kwinrc"."Plugins"."padding" = 4;
+      "kwinrc"."Plugins"."wobblywindowsEnabled" = true;
+      "kwinrc"."SubSession: 3435a388-a8b3-4d1d-9794-b8c30162ce16"."active" = "-1";
+      "kwinrc"."SubSession: 3435a388-a8b3-4d1d-9794-b8c30162ce16"."count" = 0;
+      "kwinrc"."SubSession: 6a473a77-85df-4e49-8c74-bdb06d1f0efd"."active" = "-1";
+      "kwinrc"."SubSession: 6a473a77-85df-4e49-8c74-bdb06d1f0efd"."count" = 0;
+      "kwinrc"."Tiling"."padding" = 4;
+      "kwinrc"."Tiling.0d3998b5-12fb-5e5d-9844-298a9a2f96a3"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.213a9620-187e-58a6-b80b-85d8fb95dfce"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.285712a6-31d1-5e3a-95e8-b6f4629caf9f"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.2aa85c1b-f9f4-51c2-831e-dbbd6aea2576"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.3e6a13d3-7d29-5922-82c3-84e8bdf10429"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.40fb0ae6-4d25-5480-b243-0f4924570b92"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.41dbdd7d-3355-5b44-a3d8-6b9d76bd8f49"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.4c85f5bb-4dcb-5bec-8433-5c0e6860d679"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.5b7a5ba4-43cc-5910-8e98-f358f9d54b43"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.68ef4fec-9971-5899-9f5a-9bafaac6d016"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.7b033d70-7be4-564a-8cb5-131fc76f4517"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.8abeadb8-e20c-502f-a422-649967e677bd"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.930227d2-176d-55ae-b42d-99afaeafa61d"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.94554398-f51f-5d08-8909-838a65d2021f"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.9ce2bb81-955c-5eca-bf8f-a2b96c1bd574"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.9fff9751-4241-5809-b520-d1e4f7ee6716"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.a0d5ed6f-d993-5652-af90-8090aaea58f1"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.af1f9f4e-7675-5e65-b3ad-cab439cd3ed4"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.b08bfea5-80c9-53b4-a9ac-29c5c722ee85"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.b31b477c-d7e2-5305-b59d-f5c58bb123c5"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.c9dcef5c-605f-5b87-bbbf-1a493981abea"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.ed4b5b12-e8f0-5571-a0dd-1bf2e3d208f2"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Tiling.fe059470-320a-5189-aef7-d3a016f73584"."tiles" = "{\"layoutDirection\":\"horizontal\",\"tiles\":[{\"width\":0.25},{\"width\":0.5},{\"width\":0.25}]}";
+      "kwinrc"."Wayland"."InputMethod[$e]" = "/run/current-system/sw/share/applications/org.fcitx.Fcitx5.desktop";
+      "kwinrc"."Windows"."RollOverDesktops" = true;
+      "kwinrc"."Xwayland"."Scale" = 1;
+      "kwinrc"."Xwayland"."XwaylandEavesdrops" = "Combinations";
+      "kwinrc"."org.kde.kdecoration2"."ButtonsOnLeft" = "M";
+      "kwinrc"."org.kde.kdecoration2"."ButtonsOnRight" = "BFIAX";
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."Description" = "org.kde.kruler 的设置";
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."above" = true;
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."aboverule" = 2;
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."skipswitcher" = true;
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."skipswitcherrule" = 2;
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."wmclass" = "org.kde.kruler";
+      "kwinrulesrc"."06734e18-08f2-47f9-a6dc-9085d95fe9b0"."wmclassmatch" = 1;
+      "kwinrulesrc"."1"."Description" = "element 的设置";
+      "kwinrulesrc"."1"."activity" = "00000000-0000-0000-0000-000000000000";
+      "kwinrulesrc"."1"."activityrule" = 2;
+      "kwinrulesrc"."1"."wmclass" = "element";
+      "kwinrulesrc"."1"."wmclassmatch" = 1;
+      "kwinrulesrc"."2"."Description" = "org.telegram.desktop 的设置";
+      "kwinrulesrc"."2"."activity" = "00000000-0000-0000-0000-000000000000";
+      "kwinrulesrc"."2"."activityrule" = 2;
+      "kwinrulesrc"."2"."wmclass" = "org.telegram.desktop";
+      "kwinrulesrc"."2"."wmclassmatch" = 1;
+      "kwinrulesrc"."3"."Description" = "org.kde.kruler 的设置";
+      "kwinrulesrc"."3"."above" = true;
+      "kwinrulesrc"."3"."aboverule" = 2;
+      "kwinrulesrc"."3"."skipswitcher" = true;
+      "kwinrulesrc"."3"."skipswitcherrule" = 2;
+      "kwinrulesrc"."3"."wmclass" = "org.kde.kruler";
+      "kwinrulesrc"."3"."wmclassmatch" = 1;
+      "kwinrulesrc"."8c1ccf0b-abf4-4d24-a848-522a76a2440d"."Description" = "element 的设置";
+      "kwinrulesrc"."8c1ccf0b-abf4-4d24-a848-522a76a2440d"."activity" = "00000000-0000-0000-0000-000000000000";
+      "kwinrulesrc"."8c1ccf0b-abf4-4d24-a848-522a76a2440d"."activityrule" = 2;
+      "kwinrulesrc"."8c1ccf0b-abf4-4d24-a848-522a76a2440d"."wmclass" = "element";
+      "kwinrulesrc"."8c1ccf0b-abf4-4d24-a848-522a76a2440d"."wmclassmatch" = 1;
+      "kwinrulesrc"."General"."count" = 3;
+      "kwinrulesrc"."General"."rules" = "1,2,3";
+      "kwinrulesrc"."e75e010c-c094-4e6c-a98e-fe011e563466"."Description" = "org.telegram.desktop 的设置";
+      "kwinrulesrc"."e75e010c-c094-4e6c-a98e-fe011e563466"."activity" = "00000000-0000-0000-0000-000000000000";
+      "kwinrulesrc"."e75e010c-c094-4e6c-a98e-fe011e563466"."activityrule" = 2;
+      "kwinrulesrc"."e75e010c-c094-4e6c-a98e-fe011e563466"."wmclass" = "org.telegram.desktop";
+      "kwinrulesrc"."e75e010c-c094-4e6c-a98e-fe011e563466"."wmclassmatch" = 1;
+      "kxkbrc"."Layout"."DisplayNames" = "";
+      "kxkbrc"."Layout"."LayoutList" = "us";
+      "kxkbrc"."Layout"."Use" = true;
+      "kxkbrc"."Layout"."VariantList" = "";
+      "plasma-localerc"."Formats"."LANG" = "en_US.UTF-8";
+      "plasma-localerc"."Translations"."LANGUAGE" = "zh_CN";
+      "plasmanotifyrc"."Notifications"."PopupPosition" = "BottomRight";
+      "plasmarc"."Wallpapers"."usersWallpapers" = "/home/chn/Desktop/.桌面/twin_96734339_x2.png,/home/chn/Desktop/.桌面/E_yCTfDUUAgykjX_x8.jpeg,/home/chn/Desktop/.桌面/102692178_p0_[L1][x2.00].png,/home/chn/Desktop/.桌面/111392869_p0.png,/home/chn/Desktop/.桌面/HlszomyrfyxKLtpkVixEtikq_x4_chop.png";
+      "systemsettingsrc"."KFileDialog Settings"."detailViewIconSize" = 16;
+    };
+  };
+}

modules/users/default.nix

@@ -1,11 +1,31 @@
 inputs:
 {
+  imports = inputs.localLib.mkModules [ ./chn ./root ./xll ./yjq ./yxy ./zem ];
   options.nixos.users = let inherit (inputs.lib) mkOption types; in
   {
-    users = mkOption { type = types.listOf types.nonEmptyStr; default = [ "root" "chn" ]; };
+    users = mkOption { type = types.listOf types.nonEmptyStr; default = [ "chn" ]; };
     sharedModules = mkOption { type = types.listOf types.anything; default = []; };
   };
-  imports = inputs.localLib.mkModules [ ./chn ./root ./xll ./yjq ./yxy ./zem ];
+  config =
+    let
+      inherit (inputs.config.nixos) users;
+      inherit (builtins) map;
+      inherit (inputs.lib) mkMerge;
+    in
+    {
+      users = mkMerge (map
+        (name:
+        {
+          users.${name} =
+          {
+            uid = inputs.config.nixos.system.user.user.${name};
+            group = name;
+            isNormalUser = true;
+          };
+          groups.${name}.gid = inputs.config.nixos.system.user.group.${name};
+        })
+        users.users);
+    };
 }
 
 # environment.persistence."/impermanence".users.chn =

modules/users/root/default.nix

@@ -4,7 +4,7 @@ inputs:
     let
       inherit (inputs.lib) mkIf;
       inherit (inputs.config.nixos) users;
-    in mkIf (builtins.elem "root" users.users)
+    in
     {
       users.users.root =
       {

modules/users/xll/default.nix

@@ -8,7 +8,6 @@ inputs:
     {
       users.users.xll =
       {
-        isNormalUser = true;
         extraGroups = inputs.lib.intersectLists
           [ "groupshare" "video" ]
           (builtins.attrNames inputs.config.users.groups);

modules/users/yjq/default.nix

@@ -8,7 +8,6 @@ inputs:
     {
       users.users.yjq =
       {
-        isNormalUser = true;
         extraGroups = inputs.lib.intersectLists
           [ "groupshare" "video" ]
           (builtins.attrNames inputs.config.users.groups);

modules/users/yxy/default.nix

@@ -8,7 +8,6 @@ inputs:
     {
       users.users.yxy =
       {
-        isNormalUser = true;
         extraGroups = inputs.lib.intersectLists
           [ "groupshare" "video" ]
           (builtins.attrNames inputs.config.users.groups);

modules/users/zem/default.nix

@@ -2,23 +2,22 @@ inputs:
 {
   config =
     let
-    inherit (inputs.lib) mkIf;
-    inherit (inputs.config.nixos) users;
-  in mkIf (builtins.elem "zem" users.users)
-  {
-    users.users.zem =
+      inherit (inputs.lib) mkIf;
+      inherit (inputs.config.nixos) users;
+    in mkIf (builtins.elem "zem" users.users)
     {
-      isNormalUser = true;
-      extraGroups = inputs.lib.intersectLists
-        [ "groupshare" "video" ]
-        (builtins.attrNames inputs.config.users.groups);
-      hashedPasswordFile = inputs.config.sops.secrets."users/zem".path;
-      openssh.authorizedKeys.keys = [ (builtins.readFile ./id_rsa.pub) ];
-      shell = inputs.pkgs.zsh;
-      autoSubUidGidRange = true;
+      users.users.zem =
+      {
+        extraGroups = inputs.lib.intersectLists
+          [ "groupshare" "video" ]
+          (builtins.attrNames inputs.config.users.groups);
+        hashedPasswordFile = inputs.config.sops.secrets."users/zem".path;
+        openssh.authorizedKeys.keys = [ (builtins.readFile ./id_rsa.pub) ];
+        shell = inputs.pkgs.zsh;
+        autoSubUidGidRange = true;
+      };
+      home-manager.users.zem.imports = users.sharedModules;
+      sops.secrets."users/zem".neededForUsers = true;
+      nixos.services.groupshare.mountPoints = [ "/home/zem/groupshare" ];
     };
-    home-manager.users.zem.imports = users.sharedModules;
-    sops.secrets."users/zem".neededForUsers = true;
-    nixos.services.groupshare.mountPoints = [ "/home/zem/groupshare" ];
-  };
 }

secrets/gitlab/jws.bin

@@ -1,24 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Al5NNNTib+gGITYXCC7y2eBnbMtDEg12PPIKhu5aYsX1y5hEzf8plZAQUpjipwW+MRGP8y13kjtvgmYEW+2hjPKkvB1V0wVWwyVlJW9z4c/8+XZQ6iHTbdczxKbSj9swXO+pbnt6n20ofKSB5eCJbaHWG6Fd1ln7S0sataprlccwSF/WoJuwL5Hk654ldN4EA6i/2QHcUZFeVCc7cx+j9kBp6optwydV+V/skp88sJ9mecLXDrfFnNqzEFK4U6s2lMnhSfDtYGCC6RlC63hslSS6aqYrVn7KJqoI1v2pMBWbTSjO4ZJZkjy4RBjcnbYotfEji8zJ1QEJ/49IjrMkDxxT/shdmk5G8F2Zf1f9bo6Ge6yBJffw3oBAnjZe7z4QgHQzbQmuEMmgZ6C+XMyvtFNXbCcBIjFPIiaMujj4aT7S1HBGyVIoYUTRiLsTF8cilsazIid65ps7ydkHJjDZigigcuunogBJ7WtOs1wU2j/O8LDwStMnJ33aib4M4dVAn896KyIltN2lber4zQcshce+Ld2Y5UPU9wUD6dcx+Ezmma0OCgvoAB8TmZ1L+6heBWf27hb+Z2eHQlatLDhnZrQ7OrO76eL3aBHDXbDHv5IDMRTntb4strUqDD6JPAN+L8HS8D3rhVK54OHVMMPyIWzkWJRpLjyrI2m0bgxlpNPDz97ACu1Mlu0ebbhWTYMOYeBZjNvyyvf2W0Bp01sgnImQkFbfoxwZchvtDAhfCeW4GtlF2GI2iwCCtbe09hCO+hf9ulQQsoPcS875n3QlLv8SiFh24MEmj2JwfbrfeCb4QZxh6d+A63PBZxurhk1eDfVHjWa/e23A7hdv8NJ9Qfd5ah5jDgEHwLzu0HOE+afsJieYYHLhEUmv0/+HIyLG3soWfDLjy+i73p3avtaFv0GHXZx8D5NQB7Gy3445Px9Yd75xOI2kasI1sHbJuDgtLzNImNhfnA3L9EwTNyHMVpPH+1dUOV3qw+UH34tD8iJfSdV1WYp3ewxnrPFWuuLnZp0Z8LhtXW/FHlBQGAOoth0gdixy9wxEfxN93bXYMDHLzwxLA8vQ3b5inWMEptKXWKGjfASa8N63K0+r0SAbLMYNp7QvJycaswiust2dYhxbwFE30eQKrf07IWoYEKSKOBJD6mgO2O89W9Zn0KXvcYB4gU+emHRUAURZVQ2JMKT17L7h/y2FJj7nQV9M9iCp+Z4svwl6ur4FwIJ6NjkNqiyL9e6fAeWwi/8ip3WIjSosk4H8et/D757D9Kd9TxBAijfyMdDEwNi7ign7WIa2dkKjZIt3TS2ZxdE8zlc9MYUqc04ncqfuw3LolBlnwVscQgO3zf99yaMBA0KL4fm+Wps7Yqx+SVWz/W614AqJDqPYmdqs4T7LQYGmRYAsb3T6SRHDAU/v7Z9moAXvxc5t20fChm6p6nJc8kpG0kYhyoh7EbVefMqhwxVL97QKgoqzMjH+cXUEGdFS07bKETCuMep9wL2wH1DqAU3jwzrhmJebjuvtr7Q1Y7Ea0CTx+mCkWp6puX7xwHMFoSkMVvc1Kw5Bao1uI+ENIMKcSB2JST5fvYkzFNfl21ellJo4sqpLl30LNrjAi7Mv2oxw7hERZCvMewEyqOX4jplQyGtg3rv9hZnZZ+vy0T/Dn0gRruF5+lc32rkPaYWN8KEsOilXnoP+1014ScfnDD0gK/I/pLkTrxZYXjpSFU2J+qwif8NtcYghbMT5u3B6nv5rdmhF0RPUG2qgVvQDG5e6inzPidyGLGMxzPVFGDNg25tQTnG9YO833FNTV0DS6ThZOHjW6AntDcxvtSc6GqKCOomBPD0vmsGAOEVxLCWTQ6j422obThFZu6QQSjoyPKWwukeHWA1MEMdNY79bf1qACxoBJvSh+Xg/M9POvySHxVbFItvvRPTQYii9i4Cr0DpDhmK8pH27AqIc1tyaFfb2n0q/OGqjsvExFhA0mDn8x6D9spt9j7hRixHFFmqMSAins8NolbOPeY/uVq2WqaU4w3sPSIM/on20eadpsC5O22xt5UQXGQYn3d7TtpvInJ7r3gU5pp/Sjoe4Qw68sl4BZ3u8jYUOuVUqVztcilqqcqMUf96qDVnGjetLtL1c+BTDqcefZmSaEUIDe8gyKbvuY5rB0OqkxZ6F6shXiJRKGLQOfGL7mhh9GCgUTa/VhXaZmcOuc9jS0hCl4cZbEaIJr+SdChqHvwCnvFLyh3DpUwEh8S1E8MK3v6J3pQRPEgWSji3ntJxakGbW6tHb,iv:w+4KWqVK5p9UrAulfCwq1naoJoBmLYxWhRlYeG3x08c=,tag:hMDB+QP1AXRU0iBd3ZSxGg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSbDRxK0taVzlwWEJPNFNk\nWVVtS09Jb1AzaUhkeGlTNlJBOXUyTEs1MEVjCnEwOGMyV0tJVDNwTzhQb25Fb1lz\nRkJqbFZMa1VkWVBFOWc0NVIwU2E1SEEKLS0tIExqOEZFUThmYThnbzBpZC9TcGc2\nSFNRQmNmdGlPZnE1cXlMT1VKNTU4NkUK19Xik2Nc2UB6hREBiClAx8fQQd0/lhma\nq0e0KEOIlJfH9Yowc/oT+zZust/i7O69mIK8cS3XWF8eUqFzj4aG8w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MGxNN2xIOFYvYWxuQTJy\ndktHSjU3cnJWN1diQTJKaVRPVU52MG1XUVUwCk9nVTZIbkllQjhGK0JweE1EbGFp\nTXZoakZpODRTM3BzUkp3Wk1WRmtwbnMKLS0tIGhkdmIzTXJwUHc3dHlHV3phTVVr\nQS9kalRPdkRZM0FBbXF6SDh6YzA0QVkKGTVwOIO6JgEKSb78s8erh+McXjtfuQQm\nlhX1NRb8Uk/SYhvrnfjMTUIQ9i2yqPn1cBuhp/MNgSsSS49q5anRNA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2023-11-20T06:57:24Z",
-		"mac": "ENC[AES256_GCM,data:QiRf8cKJeTkEQOK3qJCi2uise8RDyg0zcZOVX0XE6YSE6mDivg2LC8mKuSBFVPw1vX+99l7aOBDEqKALD0sQIOQjd0lySJTLp4TDbSP43QoVQ5KmUtUUzeByDkH6DUBnFuXWlvyD5kOokqGvxkYXvyihdji8yDQz8rlw6xlwNPU=,iv:C3Wd+I2yal/tFpURBRvPygOtPedJ4kLsVNmOip9CUio=,tag:NIq54bGg863j+/k15npz8A==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/nas/default.yaml

@@ -17,6 +17,8 @@ nginx:
     detectAuth:
         chn: ENC[AES256_GCM,data:44vsExbVhO3gnD4Gme92eQ==,iv:LyDvZebs1sDL1/hZQiZdHoPBm4hXtBy56jR73zSH6Aw=,tag:w5xPHnK9XOSS0+97q8b5gQ==,type:str]
     maxmind-license: ENC[AES256_GCM,data:JbAnFQiDcJGwvb89sG2ro77nwwOWcDnqVcA902jwb2zzZci7PpXROw==,iv:eifkWK0oN73Ekn3oWzy6XbYK2GU+4tlnLPJ+96WOWJY=,tag:35ulsshxtUfOsSQOLgAt0g==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:VPlB4wSbWqSYw3rYRwfAMa39xrPcPZfz7sV2Cq3rmOhifnUPwggxnA+51do=,iv:utnyrB6Yfe5O94Oq4HDVFm/lQ9ZBoyvUT68r2G2PdwA=,tag:snm01vA+z2yKK8d2i5i2ig==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -41,8 +43,8 @@ sops:
             by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
             kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-17T14:11:34Z"
-    mac: ENC[AES256_GCM,data:8ii7sqkHlhdCAqBoDZEBU7Q6gNe6qyOby2ADyX5uaHu7kKe95+lCa14iqLZV5ekjIiNuTWLjOMmHtuZN5OiRVDIsmNMWKDv7Drt3CVpDv0dLC1Za0gNn7asmNnFh1Esfr1eLJuN09UY4qKN+LFbz4phxLh+f1CZBKTVTH5dHsbo=,iv:vnb/UB6miHo0D7HGGVxnoE0+kS+SRmFijPnlKIAmbuI=,tag:oQ9/JjG5Sn+y/bLxswOGaQ==,type:str]
+    lastmodified: "2023-12-07T08:57:07Z"
+    mac: ENC[AES256_GCM,data:Ihd7p3JU6zwn5tI3XkINrNJcsxdFjTsLdVpZLUvQez2jiNWq1kGP4QeJSBzqq/1Sgowc/PdWULlw8T21LitQalhBwaODVt/dNk0gkHYqrlDMVD90/MthAPKy+vT4YLhBkDC5W00em1qEfLYo5IXazM/0e1aZ7QcwEpp5775ICPc=,iv:Yp32/LLdcDHxdmXnwqJ6OiOm/4mipMlccSRXMMgO8gc=,tag:5T5R4JiJUsbKGrHjfVw92Q==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

secrets/pc/default.yaml

@@ -18,6 +18,8 @@ meilisearch:
     misskey-misskey: ENC[AES256_GCM,data:/wYR3Bz4LRk/Ks0vizlZS3Ebf5qVfnlBBqZEm/ZIBFdDuhddgu71cqCjTHIKQ6CYh3CoUyguKIIFWku/kOCHKA==,iv:dllKvZwxvZC4pVyEMOB9WNiVBsVxzo5kwbdYKCzzyrY=,tag:MvzqalVvBkyJoLbirN0V8Q==,type:str]
 nebula:
     key: ENC[AES256_GCM,data:kNm9hwMa/EhDeOCeZw1jEnroolTkeEeAxpSEDko6tHSDHwHbhfjr01ZzHKE=,iv:q2qCi99XgZJvRuF1dm16sK6BFIoa9QUN8p4LSiZq28o=,tag:ApOKdA91LBiWHv6TuXMkpA==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:oIpiXJvEoyryS4eEutoe85Af0L5a5iNuOsCWCat9KEhr2ecY/vRimk/1fbA=,iv:dm2hTSNX7Q38yASon5o1jxEJZbWPXUWYydXYMBHF/sE=,tag:yrANhwIF/wHQGHGA1bfPgw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -42,8 +44,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-11T11:10:21Z"
-    mac: ENC[AES256_GCM,data:ro3ROIx/9+pnS2Cdz44NKYZ0kDDdLPZJyXkBpYSuCrkotLzyDrx9Kjx1FR4CrQQeA4hOPQ9Z5qJVC1shef+UgwDwemiUhR3zq9BQv0PmsRYilT19o2W9tmgfbM0NiXISeN9w0MttlBUASq7mBUDbTFRViL9fAppRixkANLxVxmw=,iv:YR6QQNYQoK3v6RHUUWerM2cXU5oYQkSRfr58QDnw5H4=,tag:6Ig+RlVySAYEEiZTo8bs3A==,type:str]
+    lastmodified: "2023-12-07T08:55:33Z"
+    mac: ENC[AES256_GCM,data:3WDgwrlyzb0QfhCpGEKSguLZpRE68APpUclQaP4/2O5pX8E/HZ9tXVQNNVeOqozHWIe8sM5/kvY4vXEiXc1t2qrJk4JdPNI7fMIWf7QAYQWcFDNbSquUNp1VSmNp3Aka3xSS1wyVWnQOs6JY9rdbmeOcLQq0jE2sNDvivtBeJJQ=,iv:xt94toLZ91J9Twigu4FiyeYIg27u9oPkzduCUaLIgts=,tag:chf+LnNJMrnMf191BorOvg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

secrets/pe.yaml

@@ -1,31 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:oWBCrslSr59qmoGPdyDorwVlgmS4LeP1EVgfxBz21/s/14M2,iv:OmhMp8D+CjRq/6EcJsspKvTLTfXiwaikhqoTxMDb4Nk=,tag:K1A+QqVoQnusUbyy71v26Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Q0xRZFNTdGovWUUwY0dG
-            TXZzTElxK0FzU0dmZjhHUjhhOVJrdlJZM2d3CnpYS3Y0emYwZGhWeWM5blVwSlBz
-            SW82UU1BTXNkU1lpdjRnNzVsc2FlUjgKLS0tIGJiM0dNZ1RGTHJqaVhHNTVEMVp2
-            S3JoL2ZzZXo1SllnS08yTW53bFhQdG8KS1W8aDpXR2tvk94cynn0CVy+/dQeF1r1
-            daZmmEhxEn5PhLsY9ESnmkyMBahILtS4aVZHhPAjbExYevd4olLA4A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1cahahn9hp265dkhduaec65vugk8fct2vt9ur6y54m4mgmyx4v4fq0etjhv
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGT2d2TnJKckRNWGx3QlFh
-            eW40OENNc2huVjdvVmk1SFByOXp1VngwbldBCjc1dXZhZk5RUnhhVFNNRnAvaUMx
-            cEtRSEVsTy9UMU95a21EVlV6YlpVNnMKLS0tIDNXZnFXWlN3MkQrVW9NWmdZNFJ6
-            SThRUGRvbHVaemNnWDQ1OVErdThYdncKNRjXQ4pOOX7FbItLJT4ALwd/SBcNyIgV
-            xtLKnNqh9zIV1SwJEre01MKRRkSZ51MLAmnzK/4ZYX3UBdw7xqv5Ag==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-22T06:50:20Z"
-    mac: ENC[AES256_GCM,data:fSopSz5q80h4lESJEyrkRVsDzW/JlzIsFFgEYMs7BMO2i5PKP3riEBNW9auPADvxmmcT0i7GghZ18ConbSHuIP5eqVBBYrfyIyVy1yMTY/I8HpC8AoZKCHca5Xx//5rBBJL/9n5px1KTex2mbw5LkvdFhCzX49NobV54VagNsB8=,iv:Lf6EcaBmYGF+Fbo+YPSE8y+E/X+4EV+k7389JSspDAQ=,tag:oF4AbdW1jKmPcWGSnEW5CA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3

secrets/vps6/default.yaml

@@ -46,6 +46,7 @@ xray-server:
         user19: ENC[AES256_GCM,data:Qjajmu6cfACT4eho6BK56zRd7BSXxo4fUeJ2RRawopVFZESJ,iv:QZN81pQxspe76V90NQxzsKmMwtvaC1qwuvd5a6WbrdU=,tag:/+LYeQLqvwM60DgIPtZzKA==,type:str]
         #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
         user20: ENC[AES256_GCM,data:uRSG6jOks7utk2bRdd5sndvqVnSGRhjkts2f3+V7JdEwQf4k,iv:xZdVv/H5RuliwSEWmgLViLquWZ5znGOpP9YwwLJfsyo=,tag:JR3BsCKkHpkE7woTaMHXwQ==,type:str]
+        #ENC[AES256_GCM,data:37f8REUu8PU0lfg=,iv:WOhsotX/O7Gg+YgkK5Fuw/njKz+1OgKSx0vXl1A32XY=,tag:IyjPLut59RuK/PpCyK4ZAQ==,type:comment]
         user21: ENC[AES256_GCM,data:9cd7IY3zzoziXznclguxbmmZ5hfc2H1DPa+KW1geuybRlpB9,iv:NKwdt7ppRuNpn44f1ypNOoPS27Yqk3Z31ABQbflS9Gg=,tag:S2B1vR0PVd3FYu24XwTfpQ==,type:str]
         user22: ENC[AES256_GCM,data:sCOmhXaJjzDIiuwP3Nh+yXQRYCppATzVWIdjOoMOlu+OFT+U,iv:HKRsCLJ/2jr7rGkM04uv4V1GKQheo2oxeFu4zqxcIAc=,tag:1swUo08hSzJ1PmQr/dBcgQ==,type:str]
         user23: ENC[AES256_GCM,data:rgS6IdC4DBLvWWBkf5Db54yaNvagfISm5tHUD1KgeqrCR5x/,iv:ANQYEXssMfbU0bvk25dVYq+yQlMiVEyQCwrGPw1AGxc=,tag:d9sOvvxheWwsE/SeOgcWUQ==,type:str]
@@ -74,6 +75,8 @@ coturn:
     auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
 nebula:
     key: ENC[AES256_GCM,data:1zvyGKsyJESAbf6tUCy6hX93rDXEYNA5QBsqV4Ag4+cksToQ5IubchciQt4=,iv:ZG+pCofTTGx6LcJ05qohotRcX6MK4JsUzL2DfmKE4eI=,tag:o/Vm72d4QbfLXoSVwXZYhw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -98,8 +101,8 @@ sops:
             ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
             ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-27T10:46:22Z"
-    mac: ENC[AES256_GCM,data:renVu1WSVq06Yt5XAfTHhk4wZDxzwzROlstyc3HNiK3pUbXlJVIEXRBkSVa9i2YUWNAxRikjRVhpSOM9X1a5Yd9PLhOQx/jL3Ld2EwOScwI3Z1CGZ3JE1mtfBYA4O+idAywiu/Wy5T7VoeGWAfCP5/aByudlIiyK6JUCnkVNU18=,iv:EwpazsOCsv/5w2FcWZgiY/2Fin8TkmdYrfVjSx7ubFU=,tag:7xRyw4+HvfLQouV//dJhNA==,type:str]
+    lastmodified: "2023-12-08T08:32:56Z"
+    mac: ENC[AES256_GCM,data:mE2I5XIv+xcbaaZmnXfxCYmb5BMGc+D4AqdmFeYDrUPLZgtaSZvJkP0pVDhJcRy7L5VooGgBaI/OFWrQMLgP0Oz2s092AwiDmCV8jLQQrXs1X+ABdHLXTLvjhnOMTk8ZV0KizWJLEuCFgZ0lS6mjVHQNDW1d2TNxAhM7JvTyOVw=,iv:BZw32WlqgQzz6j5gxS1U4l10K8C5YBZAvYotilBXPA0=,tag:oc4EqeWQK9kkPgiIHfiLjQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

secrets/vps7/default.yaml

@@ -13,16 +13,20 @@ redis:
     nextcloud: ENC[AES256_GCM,data:jwN/CqwkU/5Rd6w75/bV2Yej9b0CoxZaiJEcZXFx+9XUPY3Xg1tQdEr1SALG8xzOEdoL6WBVs14NvrrL25GeTQ==,iv:p5+0AB52QqScJwMhNIrM/7HAcRPdD9Z8xV6uwIDOwIg=,tag:f1XbNDDRXvGl/dkV9Wp2Ug==,type:str]
     send: ENC[AES256_GCM,data:IGxj3cgp+fQBdupfK+IgPEQSPuXdM9LRSLGSATNIkzUWC6sQw1aaKTDuRc8cU2BG6quthRwuWnK/F7k3KrUi8Q==,iv:LI9MkaF4e47FPUyL7AXZpO+CdgF91ScdiqjrE8PZjJ4=,tag:eNugln5M0AhU1xmVWFN7Aw==,type:str]
     mastodon: ENC[AES256_GCM,data:E5aMRzqd1dqcw66uZwWoT+LDH30mg1vZjk3lhKIXKPd36MANE6z04aBPcAHyHT71jEYsect9JXagC4MUJBuSSQ==,iv:4IjTTNSTraL33fInlTkB2ZylcEaaKi5pgvugZIk24e0=,tag:32JSTNpF2cxYh/NEAS6jZQ==,type:str]
+    synapse-synapse: ENC[AES256_GCM,data:8CVbcN2FG4mRT4PnlOGsS7tDfS+6ojIJFvq2EwItxn1gg2Ghd/Bmx+5tS/Do2FrYp/Xiv1EqucomM50r5bXnmg==,iv:TT7zBKQ4M10XYVCn5aeSu9IqjrIEHHazPUCOTmgRAU0=,tag:0+Q9hZMBVDj1TnHj3xoTBA==,type:str]
+    synapse-matrix: ENC[AES256_GCM,data:eJ9GXDVLPg1C+Zjpj3NnWUyZxDbOZ61f+gs/bkZgdWjeu61MEMtU/Hh+p/ceAn3y0aPi0ZTcd+zSgIPIkcj+qg==,iv:uTdS4uguNJErc+DDW4H6dsRFkqlkHtaCfR8LR/d9nvY=,tag:UhY9xbe1r7FUpyid2nSt5Q==,type:str]
 postgresql:
     wallabag: ENC[AES256_GCM,data:ANwvEE3K/W/hU34Y7RvlbUuJNo2bOaRfeusYM9pRxXQOdG4XpwYfd/DprsrVjlkrMFuTurUR5j6UNHWh+ILDbQ==,iv:K8doqhVosz+OosMrLJXrSxairr84EeGs3EWgVQjpkS8=,tag:WjDzy7ubm/GVlBkW0O3znQ==,type:str]
     misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
     misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
-    synapse: ENC[AES256_GCM,data:Orfse2arRGMujA8MloqOp+iVr0+uCVtlMZJNAA36J3UCog5ExE8HE6G5wIvvoP0o/PNToYc9Jgn8T7iWdU6FIA==,iv:XQ6/bDfIRmvZ3VdTqH5Gaiu2emd5kV+q6RjNXDQEtkc=,tag:Yq+w9oxv2yhpsQfMRp4HaQ==,type:str]
+    synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
     vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
     nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
     mastodon: ENC[AES256_GCM,data:IQxoNjZILazu5cxkEzFAqqmGSsOffMQHoRB7AC2NqI/+CJSVsfdwiSVfxN+Jc9dmrqCjscUSxaWCMHnrZj/JyQ==,iv:d6tyj/w0uH2E3qHjEcopVhnmE/Pq0qN9PHthSArryyw=,tag:kfJsxqkErFcG11B0CmiIKw==,type:str]
-    gitlab: ENC[AES256_GCM,data:YC1Ubpc9zWK8rb5FvZAEYjNWqVF8tZL6Nxqa18Wyq7KAh2Rv2tjl0iVlVzhtaBf28gF++nJVu9LcATaOuHH9sw==,iv:j+t4PwizJNkWZkhzdqU01/P5MeS2nSk6XNlvxJ17hC0=,tag:0gtBn9has+xrtJCn6MAyyA==,type:str]
+    gitea: ENC[AES256_GCM,data:EAuFPlUFvtARh4wbevoIUwZ886nS+3O9Jy7q/SkaTDx7PkQKGhZcPPxY45AG0QQrjSaI3cGLzDBMutFMXP0BMA==,iv:0cLOsopAfyMLHJDowyZirVR5nqLrjSLHYtnPC8GXReE=,tag:BwG5UibGLS16rwJbH/0ZyQ==,type:str]
     grafana: ENC[AES256_GCM,data:ZLtDIZ3oKasE4r1WNllNe/rkXxqRS+QAJI7EGPKhiFF1BtAxD46UpGQnUag3yg0gP/8+3COQs6camVSxcKFL1A==,iv:wMj3keVjNpVwNMwlt4E3ds1EYjLNIZ/S3RydhOlmYWU=,tag:ZRn7NWaUPbf2rHYLoLYw+w==,type:str]
+    akkoma: ENC[AES256_GCM,data:6piRt7BbMBLVGdot+VyoJN3/S8DoPNTYHFh/1coHSLNmiA6kU/6sca4Bts1Up/Vu164oTsFAr1JsKx6tzNzAPg==,iv:qplA1GXHwzVrmjm7eagCk3PFa7DRdwaf+p7N1HLb6mw=,tag:W6WedSK3R1IgZVo/0Hr9vA==,type:str]
+    synapse_matrix: ENC[AES256_GCM,data:5j+TYJ3vYUqu6CdRDYAT558DsTWbX4Rh+HuukPog5HGXlhneL3RnxVeGBR9CV1rlCP1NY99Nm8roBG+BcyPYHQ==,iv:CboB6lzqxAE/8ZlzaTU3bxw94N6OAhrq8pZ0AfxQiUc=,tag:z6cM3ufgbMn5n5PzgqdRjw==,type:str]
 meilisearch:
     misskey-misskey: ENC[AES256_GCM,data:4s+qqd6mmstioC0XmG/vA6ED9mzu1vRJVPFFalRiqnnsFy0dYEU87H+y12eOp/KDSLdTNvpp6Z6jCNvxnpDXzQ==,iv:x6L9OPu/dwVsD9pYb4dqavw9NesMbo7LB+rwz6veAR4=,tag:/BBqV2sHIgPas7XsZydh2g==,type:str]
 rsshub:
@@ -35,11 +39,20 @@ mail:
     bot-encoded: ENC[AES256_GCM,data:HstqDfhKoLqDip9O+mwYGbNlNQ==,iv:CZSTfxJHhI6nG7501cQdJiZ9l3uKS7d5YsA8iVTUuoE=,tag:Rj3rvXJzDp8XzODV/gABog==,type:str]
     bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
 synapse:
-    coturn: ENC[AES256_GCM,data:d0slDodWSVCMMgYXeLYcESuS3q2OkRI0fGTPAn1Ho+WLc/g8IHwSDtLt6W8j9UiBn1TpLVHnI71M6SZLwZK2XQ==,iv:nF89F/ezZFgCrS1WLLTgdV6pksSSgntJUdJ8Q2hVME4=,tag:Z0bJFFRdZCinrFDH9gyGwg==,type:str]
-    registration: ENC[AES256_GCM,data:bvDx/RaGLd7wkQIGz6+GKNHzuwjaoC2IOIY5Nu+/UAAjlwtTv5fhjlxq1ylTctvaeto=,iv:2mcSGeocXboBcY3SHkio8tnj+7rM1o5gOHZGYBP5x+Q=,tag:3vcVHR03NyIq6DvbPApFkg==,type:str]
-    macaroon: ENC[AES256_GCM,data:SUJe+4q7QlWBceL/cyJxrjl9OV9o2//YEu3k4rzRRg3eSgiDphyL8MWzoO/WH8MzaH8=,iv:2tTQVj9kHa3Lb3ZqnxwSfpyWEDq77gtxS+iBqKuTLpY=,tag:XnKKMg8sxw3WQtJvfcyXcA==,type:str]
-    form: ENC[AES256_GCM,data:N/5El9TMbVL0zKTiTgtjdhk3PeRmWV7grckZ6NrroaXqt0I1HCCUGJQA+Qd7fp5SKV0=,iv:AfP6PrsyU6cCQa3LEUivN3k5pv/JARVzEigHJLopasU=,tag:CT0/7czF+VNnlb5yN8EZXg==,type:str]
-    signing-key: ENC[AES256_GCM,data:ZCayvU2lElUnuyVDL05XjO3v2P78ha9i9PEcLvpBLgNeYkh7nH9Z4kIAP6Pmbw39ufaSJuo5tZZPmA==,iv:CfxqL7dJbmG/jEcdDe+Su8uxsA4dkOq/CCOGlb3EDIk=,tag:9728QS3GLnTcerzDgtQEWw==,type:str]
+    synapse:
+        coturn: ENC[AES256_GCM,data:9MDq0eXLHjJ8Cd2d1iogS1lnjI0A2+0ZK8OtLKRLqT16BVzQQJyhbkAYwkn1+9ppfrazsHFGrk7DVsA7PWjdmA==,iv:SOjwZIyzkMK9Q1fGkmBSr6nSIarNe/WeD91GPJRuZjg=,tag:1GljmXdK80NKTPSg6xJz0A==,type:str]
+        registration: ENC[AES256_GCM,data:MmRJ3el59XaTwFImuCsiAm2zXeGhgvyUyw9AIv7FvxR4N3YWnHKALcQJtG52N4bmLXU=,iv:vm2R7XGzGET0eTcD2trl3xD2I09NzYmx5NPIY4KK4xM=,tag:exm8/ehPufeqtp6j61ap0Q==,type:str]
+        macaroon: ENC[AES256_GCM,data:2/8GuF/a+ocVtLN0PU17JDvXw/RoXX/CXFHPlI9THl5bY8lBm6tEawijnOKVoFLovfU=,iv:GPAr3ZjqLf9ixevsZoQgs4cPkv0VL4WJoFfQZOdThlw=,tag:HRt/igDEfUJ3K39mG7b9Fg==,type:str]
+        form: ENC[AES256_GCM,data:Z9cYL9ibRWmOhAYtB269n0cWZSvL4zGgc03ZRag0m8cz2j0god/Fn/w6kx3cyGK1C70=,iv:Yst6WSV63IvbMF5nnicIoBj77eSwVMnAHtHrKo2UcDk=,tag:4qf6F2rdctcCf4J9vECvYg==,type:str]
+        signing-key: ENC[AES256_GCM,data:BbPJiNcVTqMAL2XG3K3CIbsb8EM4r8ct/WxPK10FHRwAnqChKy3CAviYU9gewO/tNZXHvUYUAUbPww==,iv:IZB/40EE3DIxAqagdH/a4kcSmiec5l24XLCQKCQNaRo=,tag:/1t0WAPBYmYrPTx4V4wgkw==,type:str]
+        sliding-sync: ENC[AES256_GCM,data:POXExkTRRhXin4lD4MA61xsuzYXCT6U7QtQWtNnEb6kUWRrAvS9mqk+JTBn3onCzf2Azhi3WQOY/t+OiQFXI1w==,iv:GJfJSGb6t/q9KdVCr0dVVcD+e0yZUQzrJrtuhOlYJIE=,tag:ovd1ZXRkk7VoNo8KoYDViA==,type:str]
+    matrix:
+        coturn: ENC[AES256_GCM,data:MwZKkYMefshuk46Cne4wn9ooFH8RCDbrxp+MbLJWli9iPHuzJJzUuQNU9EDL0aNbzyYEMt/7DErw42z6KrpGww==,iv:u/SVVTgfJO2FakiYU+uLHXjA4tHU/W6ASsR3S31+pWs=,tag:VTeKNOKwm2bsiZAOVXeBOQ==,type:str]
+        registration: ENC[AES256_GCM,data:+pA61vTg12lYUyXjLrHSY7y/ExfTQffLlGUI4HBOSFFPTck7bu68FrCaHOIBTtEMfjU=,iv:Ex/phkBZxglG8HiRz+m7h2HNanpq2Pxwbm08vdM3xFc=,tag:mM3YEa70FnCeYIUthK4TeA==,type:str]
+        macaroon: ENC[AES256_GCM,data:/+RaayKiPPpVV7OWWdaSkSSRHMjb8d58lZcpvltN9cYkN1btvMViEgdLSlfqzRRlPUE=,iv:pg9GXgNsrVWKlUAiCKZ2pYXugRH6MsBIMpHKoYWYLik=,tag:/mj5Ak7XAX/FH7sNPEVALw==,type:str]
+        form: ENC[AES256_GCM,data:7HF7HMUH1BTJgXXP6cpUiVj0jCwGW57bx9wKTJu7PnRsNuAam/+nKX7Zfg7WD+gSBlA=,iv:SYeUsuFVgAA6U6STCtKT5c5E8Kglh3x7hy6+Op4n0W8=,tag:eICmHTwwn0KcgNhdDGnusA==,type:str]
+        signing-key: ENC[AES256_GCM,data:hzxxDbGp1L09O7+ueUSa5lJOY/QvF2zvHdpueEHjaPQEToQt9mr2loeTQHC7ObTegfLb9UHrI1jn4A==,iv:KngfahwYZZmDQ5LeOUPWptTMGAC8TZm1G0FWcrwCwsw=,tag:U9pW6/boBIpiswn67Ezrfw==,type:str]
+        sliding-sync: ENC[AES256_GCM,data:BeA6g98IWDP6hnLFI77QqG6esDwB6j3OPzAv3eJxWoTajAsByHSgSYP1vHN5Iok6IgvSSmkf0/HiOJy1Ca8IIA==,iv:ca+t/rYwc/fAVUcz0JTmrRQCOcbDNscbnE8BpHkx/OE=,tag:eEfhUChUt4kRnO82XqRY4g==,type:str]
 nebula:
     key: ENC[AES256_GCM,data:9o6EkfTWOU0KwnJsgHML4E7VOfzo3LHnlOkV8ubhi6aayXImC3lAaoPrqUI=,iv:KHprijN7z+4FIIW+D5klDM9a9VzMJ5xawPc7jJtbHmk=,tag:0DAmxoz8D5f38ndPbkNW+g==,type:str]
 vaultwarden:
@@ -90,6 +103,8 @@ gitlab:
 grafana:
     secret: ENC[AES256_GCM,data:QYhopqGcHGr+24qYlfaTdMtnyzmIZYG4PcvS9KYqC24W3M+HmloCkPHh7Y3ZTVg8MnrDGOcbA9YPLdY7eh/u4g==,iv:dh7egVIem2bgDbmWJ1sqH9fLdIYbAIQjnjNvyuEjVq0=,tag:DbIRVHbCcpKGcNc6sDTasA==,type:str]
     chn: ENC[AES256_GCM,data:0bbjggWS1MdcUIQiQyPlBTULm+faKDpJbmZmV6vSw8k=,iv:am65WQzUE+AvQrQV+NSF5u6RCWn7EetyPsdy4Cuvyyw=,tag:lxNUM1cIYVSXVgwEnS1Hdw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:TS+toaJRgAvC78XVwTciXe2IG8++vaqXVCi/u/8Aej6qq1B9Cb6f20cp5K0=,iv:T/NkLvcYiWzIDG3jWtuhe/sH2GT4z5f0xdUGbSL901I=,tag:qN7YokFBj3Kbbx4ijHTRnw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -114,8 +129,8 @@ sops:
             SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
             HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-20T15:47:13Z"
-    mac: ENC[AES256_GCM,data:n8vx3iRkmku3bOkkglONc8VHQTXSbO0jVrjrKEXwjvNnfk7mwBXK2YNu622V2Ap2BhmHvQjxD9Du/r2UE2+d5saCjtkhlt/HLQZlbjtiguL9xQj1qSG2MiU4kIC6rsKpNc9Ae93fOQ/LGjdIhZT6V5LNERyX84nbeXzCTBwRNbU=,iv:TAiBT2JKtFVwl8XrQ7Bl2Go9T6JC/tCQP747lAPtq+M=,tag:eIueYKVPBsX6iiT2pxv2+g==,type:str]
+    lastmodified: "2023-12-20T06:27:19Z"
+    mac: ENC[AES256_GCM,data:i7AN+Sd4C61GSzT409mYd6D2tQzDyONIUsto52b1mV8hIJ4Q/U9VT5wumRjm4dGUWqrq9oFdD0/iUL1CmEdasBN7VFwNEpSYl6yhzU7zX3Re3N/0mffeW0Fx/38LdvywusJAHC9yWvsNMblKDnYxGm/UI2W/7QRMDyr8jnU6La0=,iv:Ua+K1m27GkkrUn+wcylkwrdWnq1yzFG1NMVzYAiW/6k=,tag:Gqqk5zOU3Ax2Al5CvXEV7g==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

secrets/xmupc1/default.yaml

@@ -2,10 +2,10 @@ acme:
     cloudflare.ini: ENC[AES256_GCM,data:k7ojGrQQN81OGh391ISD0vfmQF7P3Iiuyx4ck7FxB9h3hFyl6HsiJxp3tIKsFBirbHzePEtXZOYmYUkqqw2i8dY=,iv:RX1BpzeznkrXhLVoI1YwrlRDnkQqGYNw/xwQvN8P9JM=,tag:TOfGt4QwxAY2j/c1deKFoA==,type:str]
 nginx:
     maxmind-license: ENC[AES256_GCM,data:VmOiT6FYFEkMYTstz+4+4MSZSeOgHQh437j6Ccd/EhYVEa8iKI1PfA==,iv:C90KL+tv3ZpbnHqsKv0hLUprM1RKagCdU2ne3Z9Hor4=,tag:QVlJZL+bnVpjEzy4VF31vA==,type:str]
-frp:
-    token: ENC[AES256_GCM,data:lo/To0asGgHnajc6GD6zh+e9onIwQ6XdfTA5wg7g+fvslzxH6eXhV+14Wkb86E2fn7AAlru+,iv:d2MHOCwc5E8nAcqjWxdzONPpjdFfJ01f01Q7a7C2CT4=,tag:5zzciq12PqWT29G+BaT1XQ==,type:str]
 xray-client:
     uuid: ENC[AES256_GCM,data:+UJjAWH31CbeQjWoFNeBW5Sqt/RoBTbgouelDYGKfK5G6uY+,iv:AzIpLV7NYeqZUmZ6PZNYFbml9TUPRLTFPeiRQm8S7X0=,tag:/lDbaFCUHmVYDHtmrMisGA==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:49BPDoNzzTJFRpIXw3wMRStwd66aG848Z5EUMPwMMZdWeFPBdDB6cHm9zQM=,iv:R6zsmALbV3YMFlIQlGpLqL5mNXeQXn6MbhAFB7T+nLI=,tag:WOrebshoF1V0u2+GnBMTXw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -21,8 +21,8 @@ sops:
             UDRVZ3luNkRQNFdtYUF4bm4vd05mdkEKlX67g6DrurDVrSG2+5lj4wZ+8xfEpu9K
             jAZ8pt1pCsrbkGOWOBD5PqbWn0X1Dms6F4qiyefcQlmIjhXc9/PPLQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-23T12:19:57Z"
-    mac: ENC[AES256_GCM,data:beF84oGJhqGwl7E7jan9oZMlJmPZrQdC0ZAif/zpCYwdy53v9J4R5RM7pKZ0CFQA+ubwW4GZXrv2qTLayV2FgRtu+TBWLeRF5t34AcfyMHmChiIuAjHljVv3Y0Cus3Ctt2quMpyvmYEGvq+bGPzi5BY+cu4PSQZUsUUDImjw7/g=,iv:pUEJKfzZ5loUJvzpCRHNpUK4aM2OiCQ8RLFZRr2iiVU=,tag:ibGL5Wb1PJhMck5RnPtobA==,type:str]
+    lastmodified: "2023-12-14T15:20:08Z"
+    mac: ENC[AES256_GCM,data:jPdmavg3atcQZoQwKCJf8f5TQ5L8l3snCSCv6MYJpbV3qjSCDKAxpJduXBlbSxWgUXv5dwuPbhCKnTIJhoWAEh+pE4BR+c5+nk9fL89IxaHZftlxj1hhPBoZRUyQLPe5ZaFyXFcwWNc93PZxOQ/g4z97C2v358puY3fDyOxOyqI=,iv:YvaCLaeYXMnJW0WL4TxUBqh8acXHOHuRXxJr1qH3VLM=,tag:AJH7q9zySk899IEuPo94UA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1