暂存

2026-01-13 14:19:23 +08:00 · 2024-06-22 15:55:31 +08:00
109 changed files with 2024 additions and 1551 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,7 +1,6 @@
 keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &chn age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
  - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
-  - &vps4 age1nnd6u8l20julg4jz4l6kw5gmj6h2tsngpm7n8dx59umgw2s66y4shq6jv4
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
  - &surface age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
@@ -9,18 +8,12 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
  - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-  - &pcvm age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
 creation_rules:
  - path_regex: devices/pc/.*$
    key_groups:
    - age:
      - *chn
      - *pc
-  - path_regex: devices/vps4/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *vps4
  - path_regex: devices/vps6/.*$
    key_groups:
    - age:
@@ -56,8 +49,3 @@ creation_rules:
    - age:
      - *chn
      - *pi3b
-  - path_regex: devices/pcvm/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *pcvm
--- a/.webui_secret_key
+++ b/.webui_secret_key
@@ -1 +0,0 @@
-1c2lE/E3swpYeU8F
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -14,19 +14,18 @@ inputs:
            btrfs =
            {
              "/dev/disk/by-uuid/066be4fd-8617-4fe1-9654-c133c2996d33"."/" = "/boot";
-              "/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
          decrypt.auto =
          {
-            "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root1"; ssd = true; };
-            "/dev/disk/by-uuid/a9bf47e2-8731-4236-a3eb-0666d49f6150" = { mapper = "root2"; ssd = true; };
+            "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root"; ssd = true; };
            "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
-              { mapper = "swap"; ssd = true; before = [ "root1" "root2" ]; };
+              { mapper = "swap"; ssd = true; before = [ "root" ]; };
          };
          swap = [ "/dev/mapper/swap" ];
          resume = "/dev/mapper/swap";
-          rollingRootfs.waitDevices = [ "/dev/mapper/root2" ];
+          rollingRootfs = {};
        };
        grub =
        {
@@ -56,13 +55,7 @@ inputs:
        };
        nixpkgs =
          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
-        kernel =
-        {
-          variant = "xanmod-latest";
-          patches = [ "cjktty" "hibernate-progress" ];
-          modules.modprobeConfig =
-            [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
-        };
+        kernel = { variant = "cachyos"; patches = [ "cjktty" "hibernate-progress" ]; };
        networking.hostname = "pc";
        sysctl.laptop-mode = 5;
        gui.enable = true;
@@ -146,14 +139,16 @@ inputs:
          memoryMB = 90112;
          gpus."4060" = 1;
        };
-        ollama = {};
+        xrdp = { enable = true; hostname = [ "pc.chn.moe" ]; };
      };
      bugs = [ "xmunet" "backlight" "amdpstate" ];
    };
    boot.kernelParams =
    [
      "acpi_osi=!" ''acpi_osi="Windows 2015"''
-      "amdgpu.sg_display=0" # 混合模式下避免外接屏幕闪烁，和内置外接屏幕延迟
+      "mt7921e.disable_aspm=y"  # 避免休眠恢复后无 wifi，似乎有时还是有问题
+      "amdgpu.sg_display=0"     # 混合模式下避免外接屏幕闪烁，和内置外接屏幕延迟
+      "acpi.ec_no_wakeup"       # 睡眠时避免开盖唤醒，似乎没有用
    ];
    # 禁止鼠标等在睡眠时唤醒
    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
@@ -164,7 +159,7 @@ inputs:
      hideMounts = true;
      users.chn.directories = builtins.map
        (dir: { directory = "repo/${dir}"; user = "chn"; group = "chn"; mode = "0755"; })
-        [ "lammps-SiC" "BPD-paper" "kurumi-asmr" "linwei-stuff" "BPD-paper-old" "SiC-20240705" ];
+        [ "lammps-SiC" "BPD-paper" "kurumi-asmr" "linwei-stuff" "BPD-paper-old" ];
    };
    specialisation =
    {
@@ -177,10 +172,10 @@ inputs:
        };
        system.nixos.tags = [ "nvidia" ];
      };
-      cachyos.configuration =
+      xanmod.configuration =
      {
-        nixos.system.kernel.variant = inputs.lib.mkForce "cachyos";
-        system.nixos.tags = [ "cachyos" ];
+        nixos.system.kernel.variant = inputs.lib.mkForce "xanmod-latest";
+        system.nixos.tags = [ "xanmod" ];
      };
    };
  };
--- a/devices/pcvm/default.nix
+++ b/devices/pcvm/default.nix
@@ -1,33 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            vfat."/dev/disk/by-uuid/AE90-1DD1" = "/boot/efi";
-            btrfs =
-            {
-              "/dev/disk/by-uuid/5a043ec5-7b47-4b0d-ad89-8c3ce5650fcd"."/" = "/boot";
-              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-            };
-          };
-          decrypt.auto."/dev/disk/by-uuid/a9e4a508-3f0b-492e-b932-e2019be28615" = { mapper = "root"; ssd = true; };
-          rollingRootfs = {};
-        };
-        grub.installDevice = "efi";
-        kernel.variant = "xanmod-latest";
-        networking.hostname = "pcvm";
-        initrd.sshd.enable = true;
-      };
-      hardware.cpus = [ "amd" ];
-      packages.packageSet = "server";
-      services.sshd = {};
-    };
-  };
-}
--- a/devices/pcvm/secrets.yaml
+++ b/devices/pcvm/secrets.yaml
@@ -1,39 +0,0 @@
-hello: ENC[AES256_GCM,data:7xCy5PqPVdUNIdzqaGQLsPA88mAfRt6T57LjFDwOaTlhdejLPrBdyN4=,iv:dM0QWDpylPjnbtdNrjV8LHISNi/U718+xooFm0qTcbI=,tag:d5HbLG7yF3QRz7nP+4aeiA==,type:str]
-example_key: ENC[AES256_GCM,data:K5SD4k9jL5r4ZSUwNQ==,iv:mJrZshT0PKmT7OJE/ZBUWzq1Gc6xXymFbypxwQtQJq8=,tag:I4+AyMh+AVpmWa1fdIJpyA==,type:str]
-#ENC[AES256_GCM,data:vHj6+kNand8d1AzgXTaOMQ==,iv:j6b3SDqzVgY8U/puEm9UcpJYGK84gF/YIXzRbG0radQ=,tag:yzfXKHReJ0++3fhk2ztbBA==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:vRjjfVSy8g5mBZVM/oU=,iv:C+HE4Q157eNhEmcDJSMJINfMgztf6XfELCjotg8q3XU=,tag:JSQDItdYbCCs65tmbeR6tg==,type:str]
-    - ENC[AES256_GCM,data:xzfN6WiT8r8YcWtS+H4=,iv:btlOvqrn0pITT3rCTIjgS2b5TrfNKym0yPEnE7bJDqg=,tag:Wf40b8zBhrv452OKodkU+w==,type:str]
-example_number: ENC[AES256_GCM,data:akqZ12u1wl4Zww==,iv:hS3NBWI7o6dZLtsIsoVHYdtyqpUmbQrpMHPhRRzEd18=,tag:1voFm4LuupWJMGP3xd0k4A==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:wWEU8w==,iv:rf8uwo+sP9YFyPmoxROVVmrx+q6Yr0PIOWznM96w9XY=,tag:nVJdD1Z7U8zVRBxs8gLvQQ==,type:bool]
-    - ENC[AES256_GCM,data:gVe51tg=,iv:eOJ2TOWStHpckNyYx2UdLcipshFpjcWtEids5c+Q8bs=,tag:0iSjlC/TgNfl7ZtXmttgaQ==,type:bool]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTGliaUlvOVlxejZhSDZi
-            YU96S0VPOE5Ldk56WlJjTzBSRm9oYnBoQ0NBCnhJWmg3KzUrT1VyemRiSWtQeklS
-            UFFFTjdod0g1d1EvYWJoOElJSjIrWTgKLS0tIDlaQnJOMTZRUms4am1mQjV5MzFJ
-            QlhKL1ltY2lGZGU0clhIRTRsSW5BOTgK4gKbhvF1bV/YdKOxzqrecHPDAKPOd81V
-            YnWgLpP6h+zycx80iqwsfqiQJdPyDrfhB43ksn2oxsX0qXtLI9j9TQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRU1IRXZkbFQ4elgydTlv
-            VlRVKzJIWDVCZk5xaTd0Y2JXS2l0Mi85Zm1jCnNkS0NETm5SaG9WUE9Mb3RtbE5B
-            YTRmWHNXTk9hZHNBT0FxT1RNNnFMNEkKLS0tIGRWNWpLcDVtOEdGZHFPT3paeVo2
-            QWsreTlaVW5Bd2lZb3JZeTdjcG9WQlEKy3p4QnjPrJtfaueLKBzMz7VZ9QfrTer1
-            lEP8mInFprR65LtpoKabsTWQwkzURzB/OdbKSYG2o6Rlqy9L3d5eBw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-02T23:46:35Z"
-    mac: ENC[AES256_GCM,data:OncqYSgPSoge5Nw6eh0A4cm0KXSQhmSpGIu5WSv38LdMto5fNLIK2VRIwaXfq9nyf10bxNN7xSADj2GPhMiwlHM8nIQXtxdlWsZfEOc/qOWM8nz+9DPKtKGD6RZcDLDRhNTDxzPXGWIuY1tDKQpUlt/iDlymSskcqSrdTfBqCGk=,iv:NesxRr6FXXApE8aafnAV3x6hwCoAxoEly/QkcyAQ8Pw=,tag:3o37dr4vKLqEENIdj8RHXw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/devices/surface/default.nix
+++ b/devices/surface/default.nix
@@ -60,7 +60,7 @@ inputs:
    services.iptsd.config =
    {
      Touch = { DisableOnPalm = true; DisableOnStylus = true; Overshoot = 0.5; };
-      Contacts = { Neutral = "Average"; NeutralValue = 10; };
+      Contacts = { Neutral = "Average"; NeutralValue = 100; };
    };
  };
 }
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -12,25 +12,19 @@ inputs:
          {
            btrfs =
            {
-              "/dev/disk/by-uuid/403fe853-8648-4c16-b2b5-3dfa88aee351"."/boot" = "/boot";
+              "/dev/disk/by-uuid/24577c0e-d56b-45ba-8b36-95a848228600"."/boot" = "/boot";
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          decrypt.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
          swap = [ "/nix/swap/swap" ];
          rollingRootfs = {};
        };
-        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
        nixpkgs.march = "znver2";
        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
        initrd.sshd.enable = true;
        networking = { hostname = "vps4"; networkd = {}; };
-        kernel.variant = "xanmod-latest";
+        kernel.variant = "cachyos-server";
      };
      services =
      {
--- a/devices/vps4/secrets.yaml
+++ b/devices/vps4/secrets.yaml
@@ -1,13 +1,58 @@
-hello: ENC[AES256_GCM,data:mX0hKnLdaujfHSyIikkannf8DDo+r7R0,iv:my9nYiaburkWHQLsNetqD3dYVwsEkJhC7hoh0XagoOk=,tag:D7uhoFGMrTWT3K4LNMFcUA==,type:str]
-example_key: ENC[AES256_GCM,data:ezHOG8aSXYlosn7ymQ==,iv:NLm785UMihcL1K/M4u7k+P2XftyLlIxtQGPmMLc+rs8=,tag:h9xk+do8pYzxYzUaKKb1PQ==,type:str]
-#ENC[AES256_GCM,data:pgOf9IVK9ijocRr0uEO0ZA==,iv:aQ2dvfAVhkFWtcDM4VeJQa+NN6kw9IlvidL/usoP/lE=,tag:49iS4s1EfQK5VhlF9nqWRQ==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:W8QJiOY6ofqE+XRodK0=,iv:KQ/mYY4N/YA9LhZvJtPJPqRVQq4ob/xa8JSQY06Vm4M=,tag:7NQgidSCjER//ru3AXgLzQ==,type:str]
-    - ENC[AES256_GCM,data:nNML0iYEFdW4S5rJVHM=,iv:LQ1/E/7FExXB16Ur4b59XAUlWSFPub6LQBaFCY+a2lE=,tag:LqPymQ7k5ZsS8d9Z09xJuA==,type:str]
-example_number: ENC[AES256_GCM,data:UiALks+CeKFusw==,iv:8gQ0aB+9YHXKVDX7moqdQmNJLGDNGfo+glezE39xXgQ=,tag:sJG+DJNzCtx+l4bBgQTtCQ==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:n3cV5g==,iv:z2p5oh8BhEMvwwIDaO8aM8VfxmsR6Z7473pd348tsmU=,tag:oSYsNuk6vY21Nepy8Hkb7g==,type:bool]
-    - ENC[AES256_GCM,data:ns3chHI=,iv:db8M/qF03VKaT/8Q4NqfCdI1zAU9H8JWZFqnzwI7QvI=,tag:FdgUanhezouVdv+9a9/gxQ==,type:bool]
+acme:
+    cloudflare.ini: ENC[AES256_GCM,data:X1v1QuOZemIuxldd1bzIvbUsq+8HMGLh91zUB+fnrxaW40z0OQh9L1rF/0Nj3gmUmgT4KEV7nkHFYYpZBp4/Kyc=,iv:fQmbhx9wV3l+DVPaBrAyJbTCsS3q3s5F9Go1F7pZ2pQ=,tag:P4vuruX460YSOUsx6zGHXQ==,type:str]
+frp:
+    token: ENC[AES256_GCM,data:T8b1ku4HNCNSJ+33QgIt1GILFA4wTu3Qd0rDqHPVgdqsGo0R90k0u8z+dElSO7q9PapTqUbZ,iv:hwnMu6JxfYLgw4TyhujX5dI2IAytgZh+Bexhgta6ATQ=,tag:lqgwvXlS/jGPxasmk5Vh3w==,type:str]
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:DXEC,iv:SZ1AhmK6fWQ/HGDk97kDUcRN84zQMp99eiz4SpRhig8=,tag:Fkdf28ZvB8XKCxSYdjuuHw==,type:comment]
+        user0: ENC[AES256_GCM,data:rJ00sfe/oJSry6Ixn4Bn+p41syqsOrdWv6fRGVCwPvn/unMY,iv:htTvFMvhIRkORA/gIU8J7CgA+tOncYQWh7sUh+F6XDs=,tag:VrSJBD7ti9WtSLHoWjMClw==,type:str]
+        #ENC[AES256_GCM,data:OVgDU+zqcQ==,iv:8KuEqBuL5Ca6pUOFFA+vySJx/h3BhGAAC0CgnxiW46o=,tag:TY1MajSSy2RjKVI2SSAAFw==,type:comment]
+        user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
+        #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
+        user2: ENC[AES256_GCM,data:e7ITe2ZouKr8dXT7SYATyzbzHaVeu6AKt1OcQKk3U0nsQgoa,iv:UbOOuojy6OAFEH8lGhKe5Hs+2K6FX5MZ8Br9AB007gs=,tag:5XeB4YngzTcHZvCpXe/ZXA==,type:str]
+        #ENC[AES256_GCM,data:93BxR0AEdQ==,iv:rf69GWpuxYt7fu1Fyv55pynuQDhi+TA5CwZK3cc3yBo=,tag:/hLy6atNMxLw6G3/qgMM4g==,type:comment]
+        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
+        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
+        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
+        #ENC[AES256_GCM,data:PTYBkBHs16U=,iv:qr3u7OveM1CmTBIf9gZK4fTRuLCpcZCwf8jmnd1L3Co=,tag:w3O41NG7yCwCVqPGh/6SXA==,type:comment]
+        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
+        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
+        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
+        #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
+        user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
+        #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
+        user8: ENC[AES256_GCM,data:H1gPtqF8vryD0rVH7HYzpMuZ3lufOBYczKwaTr4PidQtTyQK,iv:wh7NwFc/1ogNrnTTpm5L9dBqDVkvWiIsJZelR2mtR4Q=,tag:oEFdMFZJ9UYhsSVdefJ4rg==,type:str]
+        #ENC[AES256_GCM,data:aYWIiLxs1UvupQ==,iv:AisokHuAzD5B6fEF6ak8WfAe151CM3a8MsaWC4uJPnw=,tag:cdk5S4n9ulyWrqsD+jcqYg==,type:comment]
+        user9: ENC[AES256_GCM,data:HVK9KvGfOcwn1joc3VrkjBjE6hrxQPOBD5RTtQUgBPepToh6,iv:VK9aQ64L/GajpledBxC8PNB1BdNYEqwcdL3GKttgxvs=,tag:O/piztCYBARtAFxTMNXGaA==,type:str]
+        #ENC[AES256_GCM,data:b839t/OihMOmz0gIcTo43r2MIw==,iv:8kaAFG7DhFOoitcvbFaAvE1NUSLFrFhy1KiMrqs4r/c=,tag:G4vSADa52ZfN5y5ytoFJoQ==,type:comment]
+        user10: ENC[AES256_GCM,data:xjVkr/wy7OxRuNZKfQagfNxdVxTEyQP1ZhnR6jHy2gjBQ0RD,iv:G6iOBCHOqlvfEENY/ega/TUm81wgT2OOdZKZ6bPfg9o=,tag:p8AMa3bGsIl0hWQ09lSzgA==,type:str]
+        #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
+        user11: ENC[AES256_GCM,data:BIZ2zRgGv5/9AexiZZvu+m4A62YUWtAkjWWMu89GteqpWMBq,iv:13IJcDf18LjoxJk7uoKnuFZT6Ihxrxsy7DBaAaiFqus=,tag:RN7wj+uPneCkqNlMRyYrXw==,type:str]
+        #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
+        user12: ENC[AES256_GCM,data:FAF9lXOzXW9CrZgnQ1a2+E8snZj2+JHqP5Gny92k09o/Wzga,iv:/qZuAtFmUQE7A9lMzJUoCvGx+3Sv9Ioh2ahch3puaC4=,tag:urwbLwGkSX3e85NCjyPhhg==,type:str]
+        #ENC[AES256_GCM,data:HueqiREBet2bxQ==,iv:WCjTAGg2gXgBSvY3zc/YyB/1X0XjvphPduVXLsjOwH8=,tag:wC+On6lyyYQ1Dt/BHDvONw==,type:comment]
+        user13: ENC[AES256_GCM,data:ExbnvWDIBqga5+k2mpoT8AKBOXAvUNMjBTPXUKrmtWzz4l+L,iv:UI7CvSx2FHYGf6BEHS4e3iwHZZWkl2Zt5xg2WdKbLvY=,tag:ad0c7YW2Bxo+Dn+BoSZ0Ng==,type:str]
+        #ENC[AES256_GCM,data:R8lN5T0=,iv:FXLf8Vtjg+PkwNhxXWDViMKqwn7tFMaPhio9zhnudZw=,tag:34gxRH+P9lmkUxlOPKcYMg==,type:comment]
+        user14: ENC[AES256_GCM,data:dgNPPlJD5JOFPbKhlvlRHBLmUNKeDm/JAiawUVpBE7H07Box,iv:w+t9BkqYvlxVKr+x0MwtBz0/YSR/7z1OnZLIoPdW4gc=,tag:CR3GLbaO0jSQgA2HuwzRqg==,type:str]
+    telegram:
+        token: ENC[AES256_GCM,data:xsJoGgQ8pLeZqA2alGKkCyrvnjY6rVF5TlXn4GWDrStFBl65XXzwVY/9ZZthYQ==,iv:qTLfpRUyuIGFM668URfknhSRtx3WEHp/WTGzGUPuFd4=,tag:p8mF0tM+t02g7v2EQZN3Vg==,type:str]
+        chat: ENC[AES256_GCM,data:X1JxFQw0bPCu,iv:hf+TOSH2p9RdnXDFKxTpSRzxDLdJyzNHVV8MfOQuGWY=,tag:iiWw9IFiBGOOyOSl9Jj2wQ==,type:str]
+    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
+nginx:
+    #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
+    #ENC[AES256_GCM,data:rVTLpe3uIQ5LArPnEY8N8kjtHq8kZddbqR+nyUaia72Y7PWEfHzy6wgx3Q==,iv:AZEufH3zfVL0XbUh3CQZGYcx6zIMFV4tF+jHf73IplU=,tag:B/UbtQh5dGrctNih2uoO8w==,type:comment]
+    #ENC[AES256_GCM,data:InzwjKl3R4SJSXTz5u1Pt0kf2HYEtKfSkJO0cbPhhXADNp2/Tn0nwQJFy9EzpMvK9mw8+l5LadbY0tIwmTVvV5yxUQo78HcgXWInfp/zJ+GG1L/RQOHck74lEA==,iv:UBMRYPd0loOQBs3mNyndiKPu72aRA8HbOKWDfUWPQg8=,tag:t/ONqdwpWcbo/2vy5TOjlA==,type:comment]
+    #ENC[AES256_GCM,data:HTinhnsAbVujUOuLIVT/CkvdtTN9Nk7wZKZ5SyrPC+vZ/cB9E10FffMYLQ==,iv:Clby9A7MIUSknNFkzKuWEDL0yUW/ctd6KShCIEYrDZA=,tag:CJKORoXrspDjRmaSHUnlqw==,type:comment]
+    #ENC[AES256_GCM,data:cwAb68VgebTwCCeAFUbOG0CUAuggfRnLNv9NWldJN+E9NY4WKxs12Nz7yX/vtelcqqJ2TOUL78uAR88Nzavv7VtCTZRivWjRG6GvAUyRdv8lAZo=,iv:PScTSTCuVnsoZlvyTVL+ZgqqEm4m2/fUqWzPwE+PvuY=,tag:1jeRsHqgMheXbcnhRicsnw==,type:comment]
+    #ENC[AES256_GCM,data:V5XRrTvyeezkcJqw1/BhhZz5K/egpl+PtNwjAGELjWRp7IqDfRsInxBKEg==,iv:LdOTkL22HvaNbiUi6hG8o0ownfZ22OKFGxCuGPqG8xU=,tag:/06I/mLzBlgS489iuwFTuw==,type:comment]
+    #ENC[AES256_GCM,data:i9PXzaO1od7HimP/6vxYfh30SxFbdXRDcnXujH3VrvngFcWaVcXgigncp3cboi6RoERSZ6yakxviVyEBIS4v0qRfombj2UtJg8N3Kg==,iv:aohIMhAYfZhlGDrcEvi+Qc16nF8ZgrPUGhWj/7nl8Fs=,tag:o70qsk/2cAbZgbVBwfl3Ew==,type:comment]
+    maxmind-license: ENC[AES256_GCM,data:sESU6uK9EYLido9/0sXO2Zw1SjuKmxPh4r3giJcaG7068gn1kByjsA==,iv:htnFgnLrH35zSvmlRAdoRDLFIpKroKO5dW9TNK9soUc=,tag:6pJuc54SrKP5n0kJJ7fGyA==,type:str]
+send:
+    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
+coturn:
+    auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -17,23 +62,23 @@ sops:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaE9nWEZFaE51alYyTUgr
-            RVBKZ1MvNitBdGpMWURIUkhCTlF6Y1hueVFjCnp2Q0JVL0t2UEZrSmxMbFVwZ0k5
-            QVZDdXNjWmg0S3BIaXF0NDBHOThiMDAKLS0tIDBpenAyTE51MWVkaHFvTFhzNmVV
-            WnlKUFZWNWtaYUpPZkplSm04Q3RFb00Kghj7jLLcLpc8njNyxPj6JWZbBRn2Ou9j
-            FJLfCGLePuJPmdBBN4AGHmtrkfw/SMZJ50DXhKSJSxM91zuJSqFV1g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1QXc4NzREZHlhMDV2WXlM
+            a2I4d1pjWm9Xd2gzUDUwZ1ZSTkFGR1ZQNDJzCmJwcWFxRWNNVGxTNno2b1NxNktO
+            aHhINXBjdmE3alFGYk9kUHZ1UzdJUk0KLS0tIFdKMDlvb1Z2Qi8xRjl0MXpKMDMz
+            cVVNdDRDNmtHZlJEcVRXR1FLVkZrMWcKn2iTHH7/52fJNXcbDFbzOxNAaiQRA0nO
+            we74EeNzcaaQwuEmBQPKxd/g7/kjhnHzTkoX3OneXMd/gBZMn2knXw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nnd6u8l20julg4jz4l6kw5gmj6h2tsngpm7n8dx59umgw2s66y4shq6jv4
+        - recipient: age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYkJ1NllUR1pMaUdmZ3Z6
-            OEVLWC9nZHNxNWJSZ3VZUVZ3eWlLNWN5V24wClZ3dTh3SVNRS0Z4TFJrNDJBVnJj
-            aDhYNTdSV2JmUVNXR1ZkN1BOdzZzRHcKLS0tIFNhUGIxRVM5MFdvUWZWOG5kYlFM
-            RjZtLzY5b00vMExFSU1xZEl0NFJQQlEK4yUe3V0u6A3niES0Nq28rRYZ1fTEL0Fh
-            RBGZNCute1SShrLZPgNr/lFAc6d8DH6N0IuDKcjguuWtyHY/LFYuYw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBycEw1bXA4QUZkUzJ0Z3pM
+            Z0xHam5SLzRGV21XYUtxTFh1VnhQUk1NbzAwCkU1Z3VTR1FtZ05GOWNDOENlZTgz
+            SitzYXo2Q2VEaGtLTGE2UGRoUDkxN28KLS0tIHhRS2Y1cnQreC9Fc2FLdGR1ZXdJ
+            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
+            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-27T09:40:19Z"
-    mac: ENC[AES256_GCM,data:ZdocsIbkzcWsTia7s98T5hjM5HDyBc1a0pwAb3IEFAom9Q0LjOs02BjsBKQT9Z+eMU+Ugkaz+kgP4hwYbcUuAbiVChU6sLMxUPwQDE8E7sJINZvJzth4Kl5SF4qz9fEuY8ZTP1hHc/HC6fSfWm+zH8n755aBjrzdIUvPV0Qv3xI=,iv:SSjyvgMSgZsoKHspRrNJpkmRTDdFqQlJGLUybyMcXbg=,tag:EBLpGZLNwDZxsWwh7Eva7w==,type:str]
+    lastmodified: "2024-03-28T10:31:05Z"
+    mac: ENC[AES256_GCM,data:6Z+ltjbvQaYhDPoiCN7ajQeWcp6vj3TIcUXUm/r/tZU4mIOvfxA7hxW971b76bYPTeVwgp7ZB9qQy9emDHV9i+aSyJpTPKQHRRz5J+T+NJhTP/IL3R3VmG89ssC6NH8FSk0S487JkPd8tNz+G6bvwFCPRxRLNj1pXX0Dp6tgwIw=,iv:xLw2iX1ODAbJCTJ8fEvG7SdZ1GnGwADIckH8DibVM2Y=,tag:TTzlHdcyIQr/92ZHmViRXQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -36,7 +36,7 @@ inputs:
      {
        snapper.enable = true;
        sshd = {};
-        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 20; };
+        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 19; };
        frpServer = { enable = true; serverName = "frp.chn.moe"; };
        nginx =
        {
@@ -81,10 +81,5 @@ inputs:
        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
      };
    };
-    specialisation.generic.configuration =
-    {
-      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
-      system.nixos.tags = [ "generic" ];
-    };
  };
 }
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -42,8 +42,6 @@ xray-server:
        user17: ENC[AES256_GCM,data:gQInIcNFxJuCSsMDGq4yTp5JdMMmJRy1tY3PGLoLuuIXWV0a,iv:ya4n9Z7T9/bxeHqi5QqwJprEzDMsT6X0BuEXRS67wWk=,tag:RcjQfAHv8uc3PgN5c4bySA==,type:str]
        #ENC[AES256_GCM,data:h7E4P6BiGjktYg==,iv:DhkK3NNppBqo3sXt9U7kbgfaBPYcSEX2hu6VOAesDiE=,tag:XoVbZklwCmU1EBhv0ujcSw==,type:comment]
        user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
-        #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
-        user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 nginx:
    #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
@@ -87,8 +85,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-30T10:43:57Z"
-    mac: ENC[AES256_GCM,data:Mg/DZghIkaWM5KEjk5zg3S0L5qPa8/rkc2ooSjA1ewzbDhTKls2tzv7fQqLx2WQtcJiKkoVx22UkiL0AzBwJdCr3473vx93ajTVK9HNu3jqXmuzSiv2iVS21EX9tyBNiL6uWlVAtlVfMMs69PEUF+EJIYY5TkVVPaQjzEebwo5w=,iv:tFON7RVSnNNHo5U4dRuMGDhH5iPGShW9uoda+apiIjI=,tag:3nG/u7vaChFBHoDsLLb23w==,type:str]
+    lastmodified: "2024-06-18T11:57:30Z"
+    mac: ENC[AES256_GCM,data:63Bxo5BTq/CyLE90e3nkaJ0A7nvgZHlocSuZixurNXzr5Ow7X+KOxM6fOCSLt7NpGiSxu5a3jJi/piNIvYEHyflhWEqdJuC6mYdVp35U0WezcKwkwwdP+Nvx+nf6m2JHdZ4d2uGOM+Er4f59TSAI+dB5GeT4KZ1PJy9Ai/pr6cs=,iv:rx1c3iCtp+Nti2tzrvWe6vLoKfX10LXd2q+1HTKlQEA=,tag:FIAp+yEM2O+wJrWiNRAfow==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/vps7/default.nix
+++ b/devices/vps7/default.nix
@@ -26,7 +26,7 @@ inputs:
          rollingRootfs = {};
        };
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
-        nixpkgs.march = "znver2";
+        nixpkgs.march = "broadwell";
        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
        initrd.sshd.enable = true;
        networking = { hostname = "vps7"; networkd = {}; };
@@ -71,10 +71,5 @@ inputs:
        xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
      };
    };
-    specialisation.generic.configuration =
-    {
-      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
-      system.nixos.tags = [ "generic" ];
-    };
  };
 }
--- a/devices/vps7/secrets.yaml
+++ b/devices/vps7/secrets.yaml
@@ -68,18 +68,21 @@ freshrss:
 huginn:
    invitationCode: ENC[AES256_GCM,data:+m2AabRzUiCFy3MAKTB8d1IE05WHTcmZ,iv:ccdIPHl9N+bvPR/QCwZUwZOfWTeW6gWhhBjOpL85JRg=,tag:Ir2085K04XUGkAuoCG+7VQ==,type:str]
 fz-new-order:
+    manager: ENC[AES256_GCM,data:qZc5U3SZQPWzcKVjN2+A2qWNae4GItcjvEQFgkThvIQ=,iv:fJpiUlViiUg1ea/zGhgedQG7TeTbeb9dPviYoiUBLqI=,tag:6T7rgJflsjgK++28SgsLtg==,type:str]
    token: ENC[AES256_GCM,data:qhwWRflJbW1QMOhiPfbTIrEdQJyVtfZ1QycCgstdKD1Nh40=,iv:GvZ8MJig64l34jkvuJbMMjyNaPT5yz0/pFCc6KEPTvA=,tag:cMXo/6F9thl8k2iAhT507Q==,type:str]
    uids:
+        #ENC[AES256_GCM,data:WJszzA==,iv:KvyEnUu69+L5ZxNbRmjtP2R+8lHKgdlMN0WuvDbYgE4=,tag:LP2FJ2HXWZJmTdvXpHflVQ==,type:comment]
+        user0: ENC[AES256_GCM,data:Qw18Ht6qXo3n7DD9NgNB+3IRbCmKuvJQiK5UBsg/FC8=,iv:TeeTcR0tnRrniySqKrsKfOfr2JO7+kqS3iETdCFX5ZA=,tag:rRo2yNku9JWxmILWBS/Wyw==,type:str]
        #ENC[AES256_GCM,data:O3DOE3jFCg==,iv:9shUoHCLXsJPKHELlyWdreouEcyOqhsfVI2KaqwC4CU=,tag:tYKVv+/DuesSijZwWGdrig==,type:comment]
-        user0: ENC[AES256_GCM,data:2sieulGmi7mCYrJH24djrrmHArrFbOHZ9wUuKvY4f2k=,iv:lb5ODFOeQQ+D9HZnMw48n/DGRB7L51U4frBVcPx1mvk=,tag:MwZua6u+G478uGOwtGu4fQ==,type:str]
+        user1: ENC[AES256_GCM,data:vY4qTPNqdFp2H348jAgvwKktywdVVvQK/lR2NgRE4Ho=,iv:DrweeSEJ5ETomIkRtkcVboiQindzBoxvxjlSmrQIfI8=,tag:sMz1ITHkDclBc4OY91dMGg==,type:str]
        #ENC[AES256_GCM,data:yeA9zF8Tug==,iv:VZuWLZnt1RBmkBWudKVvgJkYfqxIj/umEHVCfR6IG3k=,tag:1kj7HyjVT59n05VYJ1uP+w==,type:comment]
-        user1: ENC[AES256_GCM,data:Aw0ydspmf+PXKU27Pdzn4q/nY4sxXCADL1WGB7vm3eo=,iv:uTmVvGlW1HfdvoNbupSw3GyShsWTGVCoNrvVJ5BPUy0=,tag:k9KIoCWM6bSprwR8dmN+Hg==,type:str]
+        user2: ENC[AES256_GCM,data:7hlq1FEauGcKkStREDbxA3tOA5NmFo9AbXiOPUt+kZ4=,iv:urOP3ENSviWRKDIWGc1P5PkEtkoBSCSYlgGqJQznp8s=,tag:NNKCW5bFPY7t/PC7dsSJwg==,type:str]
        #ENC[AES256_GCM,data:4G7DyLVVgQ==,iv:Ht/exln1QtL2BxjCaOTIXHRPDiSFYP4zIa7VaeMCuhE=,tag:btVLXf+WS/YgzRFbVFoAfQ==,type:comment]
-        user2: ENC[AES256_GCM,data:P5gmhaQ+VOWVOjTrsx34zUS8dsqIkzCwOImIE8TIfUc=,iv:IoJIUcNJmaBTyr0Ut6R7BN/UqyK8p4HtiwbXUl171pE=,tag:k99PGSL1cEALTmFVWH1uSg==,type:str]
+        user3: ENC[AES256_GCM,data:nBTbmp9OP14ayVBz1UGC5g76txfUwxL2NPQCKGxsQyw=,iv:2B8ISdT+8WpfeiU9peKoMlpwcRoGZVh11VyAnS9IKP4=,tag:uBMxqrPlb6TaftnAMqodKw==,type:str]
        #ENC[AES256_GCM,data:TGrZBuCRgQ==,iv:9IOJ3Bkw9udS/y93TTtZ9o79aDq3Bb+DMEogJG77iqA=,tag:S/XcPX1f89IyfZnMoR9s/A==,type:comment]
-        user3: ENC[AES256_GCM,data:cAzf2X20rtQYyz1rLK6b4jo8utuUOdUHVYfCWdfPTDY=,iv:L5cg7aNdfnLTH2dKl4bWCqaujJ9tIvBJrJIoDIaBLwk=,tag:9Al6Wig4lz1my6hgozSsIA==,type:str]
+        user4: ENC[AES256_GCM,data:LVendDEBlPUCkXPfgbYf2X0EgJsAdLKjAudXeAgy2Is=,iv:bR0emkQa6OHUP1ucgAvJU0eEop0gp+3rwDB5XJhh4+s=,tag:YZsW9Yyr+ey9AbTO3ucWDg==,type:str]
        #ENC[AES256_GCM,data:b4iJ73sUoQ==,iv:A2hmi7lCR15E5jVR8E71GQuHgF4TdjDuQadXOtBon6k=,tag:eopTJdjN16u7PtpZdhKymQ==,type:comment]
-        user4: ENC[AES256_GCM,data:nUJ0lPuFOUVGCtq0IRSh5dAkAna7hoow1YOtFEgSoZc=,iv:D8phoZxdbQ2/Zaeq8498eRb0a7SZD5WnVdKv+u2pBak=,tag:Obu01n34JjyAVnF0f3uKzg==,type:str]
+        user5: ENC[AES256_GCM,data:wG4awLnfB4B0qLWG6Aj+OslLMnViPjIzicfB4ZzkZPA=,iv:b9C1IDmZTMV0RYXqkM/Y3khZeSQEOISrQyPjhQe3WKM=,tag:cRMtLNU6TCwTQG4UVhvTng==,type:str]
    config0:
        username: ENC[AES256_GCM,data:p8+q8u1A,iv:9s52kS5yLB4vQuGVXNtA4amZqT3eHTTybsbsQZRiFnk=,tag:7SA4SEzMHpP9H/rwoE+UJQ==,type:str]
        password: ENC[AES256_GCM,data:58+gFodT,iv:ohZlT1BwnzCYv84xHgFsLRkiPMpE8lB8QVHwr0QtDWc=,tag:XF047RnXs6IbKsTnsm0D6g==,type:str]
@@ -140,8 +143,8 @@ sops:
            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-11T13:55:38Z"
-    mac: ENC[AES256_GCM,data:5mYdz+1v6LZBW2TiM6CROaU6TUtFemOvbqJUQfqO3Lr8UnDM9AdH/fD//xDYNR1T1tMhBJf04Jchle7jRl45HKCzuyOGFOABu2m25nJeJGGDTSVDaRUUgCcmN4NQ0h1ep9gmZM9u2g5KLdmenXqcVD2tVgWNLykHtEZ/MyyEPC4=,iv:te1/rjBWhBIvJol51S4hehI4gxr3nsTH+YhmINDfy0U=,tag:mGXzGi309B1er8atMJta3g==,type:str]
+    lastmodified: "2024-06-08T09:15:52Z"
+    mac: ENC[AES256_GCM,data:EY6sFc4EcTuxPgIZQ51HFZZZf+khb7mkNEvb6U12kCtoJAEo+i83uszwBZCo/QWw6VCCt9c//9y0mNH4FjZPJAxweJHcRtanyTXa5jdyv12qINUceYe7Uhcb7JuiiEns9DEbrr3UeAKfbPC+N5mD/2trzht0E8hqnFlWU/fysz8=,iv:saymdP4nFveEWx0JrBR2bW8SUl6xCJKhYqw+CsrfRG8=,tag:CHGvJAO8hpSMNdU2YE2OGw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
--- a/devices/xmupc2/default.nix
+++ b/devices/xmupc2/default.nix
@@ -77,12 +77,5 @@ inputs:
      bugs = [ "xmunet" ];
      user.users = [ "chn" "xll" "zem" "yjq" "gb" ];
    };
-    environment.persistence."/nix/archive" =
-    {
-      hideMounts = true;
-      users.chn.directories = builtins.map
-        (dir: { directory = "repo/${dir}"; user = "chn"; group = "chn"; mode = "0755"; })
-        [ "lammps-SiC" "linwei-stuff" ];
-    };
  };
 }
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@@ -3,28 +3,31 @@

  inputs =
  {
-    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-24.05";
+    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
    "nixpkgs-23.11".url = "github:CHN-beta/nixpkgs/nixos-23.11";
    "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
    "nixpkgs-22.11".url = "github:NixOS/nixpkgs/nixos-22.11";
    "nixpkgs-22.05".url = "github:NixOS/nixpkgs/nixos-22.05";
-    home-manager = { url = "github:nix-community/home-manager"; inputs.nixpkgs.follows = "nixpkgs"; };
+    home-manager = { url = "github:nix-community/home-manager/release-24.05"; inputs.nixpkgs.follows = "nixpkgs"; };
    sops-nix =
    {
      url = "github:Mic92/sops-nix";
      inputs = { nixpkgs.follows = "nixpkgs"; nixpkgs-stable.follows = "nixpkgs"; };
    };
-    aagl = { url = "github:ezKEa/aagl-gtk-on-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
+    aagl = { url = "github:ezKEa/aagl-gtk-on-nix/release-24.05"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs-unstable"; };
    nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-vscode-extensions = { url = "github:nix-community/nix-vscode-extensions"; inputs.nixpkgs.follows = "nixpkgs"; };
    impermanence.url = "github:nix-community/impermanence";
    qchem = { url = "github:Nix-QChem/NixOS-QChem/master"; inputs.nixpkgs.follows = "nixpkgs"; };
+    deploy-rs = { url = "github:serokell/deploy-rs"; inputs.nixpkgs.follows = "nixpkgs"; };
    plasma-manager =
    {
      url = "github:pjones/plasma-manager";
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
+    nix-doom-emacs = { url = "github:nix-community/nix-doom-emacs"; inputs.nixpkgs.follows = "nixpkgs"; };
    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    nixos-hardware.url = "github:CHN-beta/nixos-hardware";
    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
@@ -51,6 +54,8 @@
    nodesoup = { url = "github:olvb/nodesoup"; flake = false; };
    tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
    v-sim = { url = "gitlab:l_sim/v_sim"; flake = false; };
+    win11os-kde = { url = "github:yeyushengfan258/Win11OS-kde"; flake = false; };
+    fluent-kde = { url = "github:vinceliuice/Fluent-kde"; flake = false; };
    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
@@ -63,7 +68,6 @@
    zxorm = { url = "github:CHN-beta/zxorm"; flake = false; };
    openxlsx = { url = "github:troldal/OpenXLSX"; flake = false; };
    sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
-    sockpp = { url = "github:fpagliughi/sockpp"; flake = false; };

    # does not support lfs yet
    # nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git"; flake = false; };
@@ -76,12 +80,15 @@
        (builtins.attrNames (builtins.readDir ./devices));
    in
    {
-      packages =
-      {
-        x86_64-linux = rec
+      packages.x86_64-linux =
+        let pkgs = (import inputs.nixpkgs
+        {
+          system = "x86_64-linux";
+          config.allowUnfree = true;
+          overlays = [ inputs.self.overlays.default ];
+        });
+        in
        {
-          pkgs = (import inputs.nixpkgs
-            { system = "x86_64-linux"; config.allowUnfree = true; overlays = [ inputs.self.overlays.default ]; });
          default = inputs.nixpkgs.legacyPackages.x86_64-linux.writeText "systems"
            (builtins.concatStringsSep "\n" (builtins.map
              (system: builtins.toString inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel)
@@ -95,6 +102,7 @@
              { inherit openssh duc; standalone = true; version = inputs.self.rev or "dirty"; };
          ufo = pkgs.pkgsStatic.localPackages.ufo.override { version = inputs.self.rev or "dirty"; };
          chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
+          nixpkgs = pkgs;
        }
        // (
          builtins.listToAttrs (builtins.map
@@ -104,24 +112,7 @@
              value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
            })
            devices)
-          );
-        x86_64-w64-mingw32 = rec
-        {
-          pkgs = (import inputs.nixpkgs
-          {
-            crossSystem = inputs.nixpkgs.lib.systems.examples.mingwW64 // { isStatic = true; };
-            system = "x86_64-linux";
-            config.allowUnfree = true;
-            overlays = [ inputs.self.overlays.default ];
-          });
-          boost = pkgs.boost.override { zstd = null; };
-          magic-enum = pkgs.magic-enum.overrideAttrs (prev: { cmakeFlags = prev.cmakeFlags ++
-            [ "-DMAGIC_ENUM_OPT_BUILD_EXAMPLES=OFF" "-DMAGIC_ENUM_OPT_BUILD_TESTS=OFF" ]; });
-          range-v3 = pkgs.range-v3.overrideAttrs (prev: { cmakeFlags = prev.cmakeFlags ++
-            [ "-DRANGE_V3_DOCS=OFF" "-DRANGE_V3_TESTS=OFF" "-DRANGE_V3_EXAMPLES=OFF" ]; });
-          winjob = pkgs.localPackages.winjob.override { inherit boost range-v3; };
-        };
-      };
+        );
      nixosConfigurations =
      (
        (builtins.listToAttrs (builtins.map
@@ -159,49 +150,70 @@
          };
        }
      );
+      deploy =
+      {
+        sshUser = "root";
+        user = "root";
+        fastConnection = true;
+        autoRollback = false;
+        magicRollback = false;
+        nodes = builtins.listToAttrs (builtins.map
+          (node:
+          {
+            name = node;
+            value =
+            {
+              hostname = node;
+              profiles.system.path = inputs.self.nixosConfigurations.${node}.pkgs.deploy-rs.lib.activate.nixos
+                inputs.self.nixosConfigurations.${node};
+            };
+          })
+          [ "vps6" "vps7" "nas" "surface" "xmupc1" "xmupc2" "pi3b" ]
+        );
+      };
+      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks inputs.self.deploy) inputs.deploy-rs.lib;
      overlays.default = final: prev:
        { localPackages = (import ./local/pkgs { inherit (inputs) lib; pkgs = final; topInputs = inputs; }); };
      config = { archive = false; branch = "production"; };
-      devShells.x86_64-linux = let inherit (inputs.self.packages.x86_64-linux) pkgs; in
-      {
-        biu = pkgs.mkShell
+      devShells.x86_64-linux =
+        let pkgs = (import inputs.nixpkgs
        {
-          inputsFrom = [ pkgs.localPackages.biu ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        hpcstat = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+          system = "x86_64-linux";
+          config.allowUnfree = true;
+          overlays = [ inputs.self.overlays.default ];
+        });
+        in
        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.hpcstat.override { version = null; }) ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        sbatch-tui = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.sbatch-tui ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        ufo = pkgs.mkShell
-        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.ufo.override { version = null; }) ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        chn-bsub = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.chn-bsub ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        winjob =
-          let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
-          in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+          biu = pkgs.mkShell
          {
-            inputsFrom = [ winjob ];
-            packages = [ clang-tools_18 ];
+            inputsFrom = with pkgs.localPackages; [ biu ];
+            buildInputs = [ pkgs.clang-tools_18 ];
            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
          };
-      };
+          hpcstat = pkgs.mkShell
+          {
+            inputsFrom = [ (inputs.self.packages.x86_64-linux.hpcstat.override { version = null; }) ];
+            packages = [ pkgs.clang-tools_18 ];
+            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+          };
+          sbatch-tui = pkgs.mkShell
+          {
+            inputsFrom = with pkgs.localPackages; [ sbatch-tui ];
+            buildInputs = [ pkgs.clang-tools_18 ];
+            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+          };
+          ufo = pkgs.mkShell
+          {
+            inputsFrom = [ (inputs.self.packages.x86_64-linux.ufo.override { version = null; }) ];
+            packages = [ pkgs.clang-tools_18 ];
+            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+          };
+          chn-bsub = pkgs.mkShell
+          {
+            inputsFrom = with pkgs.localPackages; [ chn-bsub ];
+            buildInputs = [ pkgs.clang-tools_18 ];
+            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+          };
+        };
    };
 }
--- a/local/pkgs/biu/CMakeLists.txt
+++ b/local/pkgs/biu/CMakeLists.txt
@@ -14,15 +14,16 @@ endif()
 find_package(magic_enum REQUIRED)
 find_package(fmt REQUIRED)
 find_package(Boost REQUIRED COMPONENTS headers iostreams filesystem)
+find_package(Eigen3 REQUIRED)
 find_package(range-v3 REQUIRED)
 find_path(NAMEOF_INCLUDE_DIR nameof.hpp REQUIRED)
-find_package(Eigen3 REQUIRED)
+find_path(ZPP_BITS_INCLUDE_DIR zpp_bits.h REQUIRED)

 add_library(biu src/common.cpp)
 target_include_directories(biu PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
  $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}> ${NAMEOF_INCLUDE_DIR} ${ZPP_BITS_INCLUDE_DIR})
 target_link_libraries(biu PUBLIC magic_enum::magic_enum fmt::fmt Boost::headers Boost::iostreams Boost::filesystem
-  range-v3::range-v3 Eigen3::Eigen)
+  Eigen3::Eigen range-v3::range-v3)
 set_property(TARGET biu PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 install(TARGETS biu EXPORT biuTargets LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
  ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
@@ -40,8 +41,3 @@ add_executable(test-serialize test/serialize.cpp)
 target_link_libraries(test-serialize PRIVATE biu)
 set_property(TARGET test-serialize PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 add_test(NAME test-serialize COMMAND test-serialize)
-
-add_executable(test-process test/process.cpp)
-target_link_libraries(test-process PRIVATE biu)
-set_property(TARGET test-process PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
-add_test(NAME test-process COMMAND test-process)
--- a/local/pkgs/biu/default.nix
+++ b/local/pkgs/biu/default.nix
@@ -1,11 +1,11 @@
 {
-  stdenv, cmake, lib,
+  stdenv, cmake,
  magic-enum, fmt, boost, eigen, range-v3, nameof, zpp-bits
 }: stdenv.mkDerivation rec
 {
  name = "biu";
  src = ./.;
-  buildInputs = [ magic-enum fmt boost range-v3 nameof zpp-bits eigen ];
+  buildInputs = [ magic-enum fmt boost eigen range-v3 nameof zpp-bits ];
  propagatedBuildInputs = buildInputs;
  nativeBuildInputs = [ cmake ];
  doCheck = true;
--- a/local/pkgs/biu/include/biu/common.hpp
+++ b/local/pkgs/biu/include/biu/common.hpp
@@ -72,24 +72,27 @@ namespace biu

    namespace detail_
    {
-      struct ExecMode { bool DirectStdin = false, DirectStdout = false, DirectStderr = false, SearchPath = false; };
-      template <ExecMode Mode> struct ExecResult
+      template <bool DirectStdout, bool DirectStderr> struct ExecResult
      {
        int ExitCode;
-        std::conditional_t<Mode.DirectStdout, Empty, std::string> Stdout;
-        std::conditional_t<Mode.DirectStderr, Empty, std::string> Stderr;
+        std::conditional_t<DirectStdout, Empty, std::string> Stdout;
+        std::conditional_t<DirectStderr, Empty, std::string> Stderr;
        operator bool() const;
      };
-      template <ExecMode Mode> struct ExecInput
-      {
-        std::conditional_t<Mode.SearchPath, std::string, std::filesystem::path> Program;
-        std::vector<std::string> Args;
-        std::conditional_t<Mode.DirectStdin, Empty, std::string> Stdin = {};
-        std::map<std::string, std::string> ExtraEnv = {};
-        std::optional<std::chrono::milliseconds> Timeout;
-      };
+      struct ExecInput { bool DirectStdin = false, DirectStdout = false, DirectStderr = false, SearchPath = false; };
    }
-    template <detail_::ExecMode Mode = {}> detail_::ExecResult<Mode> exec(detail_::ExecInput<Mode> input);
+    template <detail_::ExecInput Input = {}> requires (!Input.DirectStdin)
+      detail_::ExecResult<Input.DirectStdout, Input.DirectStderr> exec
+    (
+      std::conditional_t<Input.SearchPath, std::string, std::filesystem::path> program, std::vector<std::string> args,
+      std::optional<std::string> stdin_string = {}, std::map<std::string, std::string> extra_env = {}
+    );
+    template <detail_::ExecInput Input = {}> requires (Input.DirectStdin)
+      detail_::ExecResult<Input.DirectStdout, Input.DirectStderr> exec
+    (
+      std::conditional_t<Input.SearchPath, std::string, std::filesystem::path> program, std::vector<std::string> args,
+      std::map<std::string, std::string> extra_env = {}
+    );

    static_assert(sizeof(char) == sizeof(std::byte));
    template <typename Char = std::byte, typename T> requires (std::same_as<Char, std::byte>)
--- a/local/pkgs/biu/src/common.cpp
+++ b/local/pkgs/biu/src/common.cpp
@@ -18,54 +18,87 @@ namespace biu
      else return value;
    }

-    template <detail_::ExecMode Mode> detail_::ExecResult<Mode>::operator bool() const { return ExitCode == 0; }
-
-    template <detail_::ExecMode Mode> detail_::ExecResult<Mode> exec(detail_::ExecInput<Mode> input)
+    template <bool DirectStdout, bool DirectStderr>
+      detail_::ExecResult<DirectStdout, DirectStderr>::operator bool() const
+      { return ExitCode == 0; }
+#   define BIU_EXECRESULT_PRED(r, state) BOOST_PP_NOT_EQUAL(state, 4)
+#   define BIU_EXECRESULT_OP(r, state) BOOST_PP_INC(state)
+#   define BIU_EXECRESULT_MACRO(r, state) \
+      template detail_::ExecResult<(state & 1) != 0, (state & 2) != 0>::operator bool() const;
+    BOOST_PP_FOR(0, BIU_EXECRESULT_PRED, BIU_EXECRESULT_OP, BIU_EXECRESULT_MACRO)
+    namespace detail_
    {
-      namespace bp = boost::process;
-
-      // decide input/output format, prepare environment, seach actual program
-      bp::ipstream stdout_stream, stderr_stream;
-      bp::opstream input_stream;
-      auto&& stdin_format = [&]
-        { if constexpr (Mode.DirectStdin) return bp::std_in < stdin; else return bp::std_in < input_stream; }();
-      auto&& stdout_format = [&]
-        { if constexpr (Mode.DirectStdout) return bp::std_out > stdout; else return bp::std_out > stdout_stream; }();
-      auto&& stderr_format = [&]
-        { if constexpr (Mode.DirectStderr) return bp::std_err > stderr; else return bp::std_err > stderr_stream; }();
-      auto&& actual_program = [&]
+      template <ExecInput Input>
+        detail_::ExecResult<Input.DirectStdout, Input.DirectStderr> exec
+      (
+        std::conditional_t<Input.SearchPath, std::string, std::filesystem::path> program, std::vector<std::string> args,
+        std::optional<std::string> stdin_string, std::map<std::string, std::string> extra_env
+      )
      {
-        if constexpr (Mode.SearchPath) return bp::search_path(input.Program);
-        else return input.Program.string();
-      }();
-      bp::environment env = boost::this_process::environment();
-      for (const auto& [key, value] : input.ExtraEnv) env[key] = value;
-
-      // start
-      auto process = bp::child
-        (actual_program, bp::args(input.Args), stdout_format, stderr_format, stdin_format, env);
-      if constexpr (!Mode.DirectStdin) { input_stream << input.Stdin; input_stream.pipe().close(); }
-
-      // wait for exit
-      if (input.Timeout) { if (!process.wait_for(*input.Timeout)) process.terminate(); }
-      else process.wait();
-
-      // collect output
-      detail_::ExecResult<Mode> result;
-      result.ExitCode = process.exit_code();
-      if constexpr (!Mode.DirectStdout) result.Stdout = {std::istreambuf_iterator<char>{stdout_stream.rdbuf()}, {}};
-      if constexpr (!Mode.DirectStderr) result.Stderr = {std::istreambuf_iterator<char>{stderr_stream.rdbuf()}, {}};
-      return result;
+        namespace bp = boost::process;
+        bp::ipstream stdout_stream, stderr_stream;
+        bp::opstream input_stream;
+        auto&& stdout_format = [&]
+          { if constexpr (Input.DirectStdout) return bp::std_out > stdout; else return bp::std_out > stdout_stream; }();
+        auto&& stderr_format = [&]
+          { if constexpr (Input.DirectStderr) return bp::std_err > stderr; else return bp::std_err > stderr_stream; }();
+        auto&& actual_program =
+          [&]{ if constexpr (Input.SearchPath) return bp::search_path(program); else return program.string(); }();
+        std::unique_ptr<bp::child> process;
+        bp::environment env = boost::this_process::environment();
+        for (const auto& [key, value] : extra_env) env[key] = value;
+        process = [&]
+        {
+          if constexpr (Input.DirectStdin) return std::make_unique<bp::child>
+            (actual_program, bp::args(args), stdout_format, stderr_format, bp::std_in < stdin, env);
+          else if (stdin_string) return std::make_unique<bp::child>
+            (actual_program, bp::args(args), stdout_format, stderr_format, bp::std_in < input_stream, env);
+          else return std::make_unique<bp::child>
+            (actual_program, bp::args(args), stdout_format, stderr_format, bp::std_in < bp::null, env);
+        }();
+        if (stdin_string) { input_stream << *stdin_string; input_stream.pipe().close(); }
+        process->wait();
+        return
+        {
+          .ExitCode = process->exit_code(),
+          .Stdout = [&]
+          {
+            if constexpr (Input.DirectStdout) return Empty{};
+            else return std::string{std::istreambuf_iterator<char>{stdout_stream.rdbuf()}, {}};
+          }(),
+          .Stderr = [&]
+          {
+            if constexpr (Input.DirectStderr) return Empty{};
+            else return std::string{std::istreambuf_iterator<char>{stderr_stream.rdbuf()}, {}};
+          }()
+        };
+      }
    }
-
-#   define BIU_EXEC_PRED(r, i) BOOST_PP_NOT_EQUAL(i, 16)
-#   define BIU_EXEC_OP(r, i) BOOST_PP_INC(i)
-#   define BIU_EXEC_MACRO(r, i) \
-    namespace detail_ \
-      { constexpr ExecMode ExecMode##i {(i & 1) != 0, (i & 2) != 0, (i & 4) != 0, (i & 8) != 0}; } \
-    template detail_::ExecResult<detail_::ExecMode##i>::operator bool() const; \
-    template detail_::ExecResult<detail_::ExecMode##i> \
-      exec<detail_::ExecMode##i>(detail_::ExecInput<detail_::ExecMode##i>);
+    template <detail_::ExecInput Input> requires (!Input.DirectStdin)
+      detail_::ExecResult<Input.DirectStdout, Input.DirectStderr> exec
+    (
+      std::conditional_t<Input.SearchPath, std::string, std::filesystem::path> program, std::vector<std::string> args,
+      std::optional<std::string> stdin_string, std::map<std::string, std::string> extra_env
+    )
+      { return detail_::exec<Input>(program, args, stdin_string, extra_env); }
+    template <detail_::ExecInput Input> requires (Input.DirectStdin)
+      detail_::ExecResult<Input.DirectStdout, Input.DirectStderr> exec
+    (
+      std::conditional_t<Input.SearchPath, std::string, std::filesystem::path> program, std::vector<std::string> args,
+      std::map<std::string, std::string> extra_env
+    )
+      { return detail_::exec<Input>(program, args, {}, extra_env); }
+#   define BIU_EXEC_PRED(r, state) BOOST_PP_NOT_EQUAL(state, 8)
+#   define BIU_EXEC_OP(r, state) BOOST_PP_INC(state)
+#   define BIU_EXEC_MACRO(r, state) \
+  template detail_::ExecResult<(state & 1) != 0, (state & 2) != 0> \
+    exec<{false, (state & 1) != 0, (state & 2) != 0, (state & 4) != 0}> \
+    (std::conditional_t<(state & 4) != 0, std::string, std::filesystem::path>, std::vector<std::string>, \
+      std::optional<std::string>, std::map<std::string, std::string>); \
+  template detail_::ExecResult<(state & 1) != 0, (state & 2) != 0> \
+    exec<{true, (state & 1) != 0, (state & 2) != 0, (state & 4) != 0}> \
+    (std::conditional_t<(state & 4) != 0, std::string, std::filesystem::path>, std::vector<std::string>, \
+      std::map<std::string, std::string>);
    BOOST_PP_FOR(0, BIU_EXEC_PRED, BIU_EXEC_OP, BIU_EXEC_MACRO)
  }
 }
--- a/local/pkgs/biu/test/process.cpp
+++ b/local/pkgs/biu/test/process.cpp
@@ -1,9 +0,0 @@
-# include <biu.hpp>
-
-int main()
-{
-  using namespace biu::literals;
-  auto result = biu::exec<{.SearchPath = true}>({.Program = "sleep", .Args = {"10"}, .Timeout = 3s});
-  std::cout << "{}\n"_f(result.ExitCode);
-  assert(!result);
-}
--- a/local/pkgs/chn-bsub/.clangd
+++ b/local/pkgs/chn-bsub/.clangd
@@ -0,0 +1,3 @@
+CompileFlags:
+  Add: [ -Wall, -Wextra, -std=c++23 ]
+  Compiler: g++
--- a/local/pkgs/chn-bsub/.envrc
+++ b/local/pkgs/chn-bsub/.envrc
@@ -0,0 +1 @@
+use flake .#chn-bsub
--- a/local/pkgs/chn-bsub/CMakeLists.txt
+++ b/local/pkgs/chn-bsub/CMakeLists.txt
@@ -13,11 +13,12 @@ find_package(ftxui REQUIRED)
 find_package(Boost REQUIRED COMPONENTS filesystem iostreams)
 find_package(range-v3 REQUIRED)
 find_package(biu REQUIRED)
+find_package(nlohmann_json REQUIRED)

 add_executable(chn-bsub src/main.cpp)
 target_compile_features(chn-bsub PUBLIC cxx_std_23)
 target_link_libraries(chn-bsub PRIVATE fmt::fmt ftxui::screen ftxui::dom ftxui::component Boost::filesystem
-  range-v3::range-v3 biu::biu)
+  range-v3::range-v3 biu::biu nlohmann_json::nlohmann_json)

 install(TARGETS chn-bsub RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

--- a/local/pkgs/chn-bsub/default.nix
+++ b/local/pkgs/chn-bsub/default.nix
@@ -1,12 +1,12 @@
 {
  stdenv, lib, sbatchConfig ? null, substituteAll, runCommand,
-  cmake, pkg-config, ftxui, biu
+  cmake, pkg-config, ftxui, biu, nlohmann_json
 }:
 stdenv.mkDerivation
 {
  name = "chn-bsub";
  src = ./.;
-  buildInputs = [ ftxui biu ];
+  buildInputs = [ ftxui biu nlohmann_json ];
  nativeBuildInputs = [ cmake pkg-config ];
  postInstall = "ln -s chn-bsub $out/bin/chn_bsub";
 }
--- a/local/pkgs/chn-bsub/src/main.cpp
+++ b/local/pkgs/chn-bsub/src/main.cpp
@@ -3,200 +3,336 @@
 # include <ftxui/component/component.hpp>
 # include <ftxui/component/component_options.hpp>
 # include <ftxui/component/screen_interactive.hpp>
+# include <ftxui/dom/table.hpp>
 # include <boost/process.hpp>
 # include <boost/algorithm/string.hpp>
+# include <range/v3/range.hpp>
+# include <range/v3/view.hpp>
+# include <nlohmann/json.hpp>
 # include <biu.hpp>

 using namespace biu::literals;

 int main()
 {
-	// 需要绑定到界面上的变量
-	struct
-	{
-		std::array<int, 3> vasp_version_selected = {0, 0, 0};
-		std::vector<std::string> vasp_version_entries_level1 = {"640", "631"};
-		std::map<std::string, std::vector<std::string>> vasp_version_entries_level2 = 
-		{
-			{"640", {"(default)", "fixc", "optcell_vtst_wannier90", "shmem", "vtst"}},
-			{"631", {"shmem"}}
-		};
-		std::vector<std::string> vasp_version_entries_level3 = {"std", "gam", "ncl"};
+  // 需要绑定到界面上的变量
+  struct
+  {
+    std::array<int, 3> vasp_version_selected = { 0, 0, 0 };
+    std::vector<std::string> vasp_version_entries_level1 = { "640", "631" };
+    std::map<std::string, std::vector<std::string>> vasp_version_entries_level2 = 
+    {
+      { "640", { "(default)", "fixc", "optcell_vtst_wannier90", "shmem", "vtst" }},
+      { "631", { "shmem" } }
+    };
+    std::vector<std::string> vasp_version_entries_level3 = { "std", "gam", "ncl" };

-		int queue_selected = 0;
-		std::vector<std::string> queue_entries =
-		{
-			"normal_1day", "normal_1week", "normal",
-			"normal_1day_new", "ocean_530_1day", "ocean6226R_1day"
-		};
-		std::map<std::string, std::size_t> max_cores =
-		{
-			{"normal_1day", 28}, {"normal_1week", 28}, {"normal", 20},
-			{"normal_1day_new", 24}, {"ocean_530_1day", 24}, {"ocean6226R_1day", 32}
-		};
-		std::string ncores = "";
-		std::string job_name = []
-		{
-			// /data/gpfs01/jykang/linwei/chn/lammps-SiC
-			std::vector<std::string> paths;
-			boost::split(paths, std::filesystem::current_path().string(),
-				boost::is_any_of("/"));
-			if (paths.size() < 7)
-				return "my-great-job"s;
-			else
-				return paths[5] + "_" + paths.back();
-		}();
-		std::string bsub = "";
-		std::string user_command = "";
-	} state;
+    int queue_selected = 0;
+    std::vector<std::string> queue_entries =
+    {
+      "normal_1day", "normal_1day_new", "ocean_530_1day", "ocean6226R_1day",
+      "normal_1week", "normal_2week", "normal"
+    };
+    std::atomic<bool> queue_detail_show = false;
+    std::map<std::string, std::string> queue_hosts =
+    {
+      { "normal_1day", "normal_1day" },
+      { "normal_1day_new", "charge_s_normal" },
+      { "ocean_530_1day", "hd_sd530" },
+      { "ocean6226R_1day", "hd_sd530_6226R" },
+      { "normal_1week", "normal_1week" },
+      { "normal_2week", "b_node" },
+      { "normal", "cnodes" }
+    };
+    std::map<std::string, std::string> queue_timelimit =
+    {
+      { "normal_1day", "1 day" },
+      { "normal_1day_new", "1 day" },
+      { "ocean_530_1day", "1 day" },
+      { "ocean6226R_1day", "1 day" },
+      { "normal_1week", "7 day" },
+      { "normal_2week", "14 day" },
+      { "normal", "14 day" }
+    };
+    std::optional<std::vector<std::vector<std::string>>> queue_detail = [this]
+      -> std::optional<std::vector<std::vector<std::string>>>
+    {
+      std::vector<std::vector<std::string>> result;
+      result.push_back({ "number of nodes (total/busy/free)" });
+      for (auto& queue : queue_entries)
+      {
+        if
+        (
+          auto result = biu::exec<{.SearchPath=true}>
+            ("bhosts", { "-o", "hname max run", "-json", queue_hosts[queue] });
+          !result
+        )
+          return std::nullopt;
+        else
+        {
+          auto json = nlohmann::json::parse(result.Stdout);
+          auto total = json["HOSTS"].get<std::size_t>();
+          auto records = json["RECORDS"].get<std::vector<nlohmann::json>>();
+          auto busy = (records
+            | ranges::views::filter
+              ([](auto& record){ return record["RUN"].template get<std::size_t>() > 0; })).size();
+          auto free = total - busy;
+        }
+      }
+      return result;
+    }();
+    std::string ncores = "";
+    std::string job_name = []
+    {
+      // /data/gpfs01/jykang/linwei/chn/lammps-SiC
+      std::vector<std::string> paths;
+      boost::split(paths, std::filesystem::current_path().string(), boost::is_any_of("/"));
+      if (paths.size() < 7) return "my-great-job"s;
+      else return paths[5] + "_" + paths.back();
+    }();
+    std::string bsub = "";
+    std::string user_command = "";
+  } state;

-	// 为组件增加标题栏
-	auto component_with_title = [](std::string title, ftxui::Component component)
-	{
-		return ftxui::Renderer(component, [title, component]
-		{
-			return ftxui::vbox
-			({
-				ftxui::text(title) | ftxui::bgcolor(ftxui::Color::Blue),
-				component->Render(),
-				ftxui::separator()
-			});
-		});
-	};
+  // 为组件增加标题栏和分割线
+  auto with_title = [](std::string title)
+  {
+    return [title](ftxui::Element element)
+    {
+      return ftxui::vbox
+        (ftxui::text(title) | ftxui::bgcolor(ftxui::Color::Blue), element, ftxui::separatorLight());
+    };
+  };
+  // 为组件增加空白以填充界面
+  auto with_padding = [](ftxui::Element element) -> ftxui::Element
+  {
+    auto empty = ftxui::emptyElement() | ftxui::flex_grow;
+    return ftxui::vbox(empty, ftxui::hbox(empty, element | ftxui::center, empty), empty);
+  };
+  // 在组件左边增加分割线
+  auto with_separator = [](ftxui::Element element)
+    { return ftxui::hbox(ftxui::separatorLight(), element); };
+  // 在组件左边增加小标题
+  auto with_subtitle = [](std::string title)
+    { return [title](ftxui::Element element) { return ftxui::hbox(ftxui::text(title), element); }; };

-	// 构建界面, 需要至少 25 行 47 列
-	auto screen = ftxui::ScreenInteractive::Fullscreen();
-	auto request_interface = [&state, &screen, &component_with_title]
-	{
-		auto vasp_version_level1 = ftxui::Menu
-			(&state.vasp_version_entries_level1, &state.vasp_version_selected[0])
-			| ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 8);
-		std::vector<ftxui::Component> vasp_version_level2_children;
-		for (auto& i : state.vasp_version_entries_level1)
-			vasp_version_level2_children.push_back(ftxui::Menu
-			(
-				&state.vasp_version_entries_level2[i],
-				&state.vasp_version_selected[1]
-			));
-		auto vasp_version_level2 = ftxui::Container::Tab
-		(
-			vasp_version_level2_children,
-			&state.vasp_version_selected[0]
-		) | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 27);
-		auto vasp_version_level3 = ftxui::Menu
-			(&state.vasp_version_entries_level3, &state.vasp_version_selected[2])
-			| ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 8);
-		auto vasp_version = component_with_title("Select vasp version:",
-			ftxui::Container::Horizontal
-				({vasp_version_level1, vasp_version_level2, vasp_version_level3})
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 5));
-		auto queue = component_with_title("Select queue:",
-			ftxui::Menu(&state.queue_entries, &state.queue_selected)
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 6));
-		auto ncores = component_with_title("Input cores you want to use:",
-			ftxui::Input(&state.ncores, "(leave blank to use all cores)"))
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 3);
-		auto job_name = component_with_title("Job name:",
-			ftxui::Input(&state.job_name, ""))
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 3);
-		auto continue_button = ftxui::Button("Continue",
-			[&]{state.user_command = "continue"; screen.ExitLoopClosure()();});
-		auto quit_button = ftxui::Button("Quit",
-			[&]{state.user_command = "quit"; screen.ExitLoopClosure()();});
-		return ftxui::Container::Vertical
-		({
-			vasp_version, queue, ncores, job_name,
-			ftxui::Container::Horizontal({continue_button, quit_button})
-		}) | ftxui::borderHeavy
-			| ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 47)
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 24);
-	}();
-	auto confirm_interface = [&state, &screen, &component_with_title]
-	{
-		ftxui::InputOption input_option;
-		input_option.multiline = true;
-		return ftxui::Container::Vertical
-		({
-			component_with_title
-			(
-				"Double check & modify submit command:",
-				ftxui::Input(&state.bsub, "", input_option)
-			)
-				| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 7),
-			ftxui::Container::Horizontal
-			({
-				ftxui::Button("Submit",
-					[&]{state.user_command = "submit"; screen.ExitLoopClosure()();}),
-				ftxui::Button("Quit",
-					[&]{state.user_command = "quit"; screen.ExitLoopClosure()();}),
-				ftxui::Button("Back",
-					[&]{state.user_command = "back"; screen.ExitLoopClosure()();})
-			}),
-			ftxui::Renderer([]{return ftxui::vbox
-			({
-				ftxui::separator(),
-				ftxui::text("Source code:"),
-				ftxui::text("https://github.com/CHN-beta/chn_bsub.git"),
-				ftxui::text("Star & PR are welcome!"),
-			});})
-		}) | ftxui::borderHeavy
-			| ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 47)
-			| ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 14);
-	}();
+  // 构建界面
+  auto screen = ftxui::ScreenInteractive::Fullscreen();
+  auto request_interface = ftxui::Container::Vertical
+  ({
+    ftxui::Container::Horizontal
+    ({
+      ftxui::Menu(&state.vasp_version_entries_level1, &state.vasp_version_selected[0]),
+      ftxui::Container::Tab
+      (
+        {
+          ftxui::Menu(&state.vasp_version_entries_level2[0], &state.vasp_version_selected[1]),
+          ftxui::Menu(&state.vasp_version_entries_level2[1], &state.vasp_version_selected[1])
+        },
+        &state.vasp_version_selected[0]
+      ) | with_separator,
+      ftxui::Menu(&state.vasp_version_entries_level3, &state.vasp_version_selected[2]) | with_separator
+    }) | with_title("VASP version"),
+    ftxui::Container::Horizontal
+    ({
+      ftxui::Menu(&state.queue_entries, &state.queue_selected) | with_title("Queue\n"),
+      ftxui::Table
+      (
+        state.queue_detail
+          | ranges::views::transform([](auto& line){ line | ranges::views::transform([](auto& text){ return ftxui::text() }) })
+    })

-	// 实际投递任务
-	auto submit = [](std::string bsub)
-	{
-		// replace \n with space
-		boost::replace_all(bsub, "\n", " ");
-		auto process = boost::process::child
-		(
-			boost::process::search_path("sh"), "-c", bsub,
-			boost::process::std_in.close(),
-			boost::process::std_out > stdout,
-			boost::process::std_err > stderr
-		);
-		process.wait();
-	};

-	// 进入事件循环
-	while (true)
-	{
-		screen.Loop(request_interface);
-		if (state.user_command == "quit")
-			return EXIT_FAILURE;
-		else if (state.user_command != "continue")
-			throw std::runtime_error("user_command is not recognized");
-		state.bsub = fmt::format
-		(
-			"bsub -J '{}'\n-q {}\n-n {}\n-R 'span[hosts=1]'\n-o 'output.txt'\nchn_vasp.sh {}",
-			state.job_name,
-			state.queue_entries[state.queue_selected],
-			state.ncores.empty() ? state.max_cores[state.queue_entries[state.queue_selected]] :
-				std::stoi(state.ncores),
-			[&]
-			{
-				auto version_level1 = state.vasp_version_entries_level1[state.vasp_version_selected[0]];
-				auto version_level2 = state.vasp_version_entries_level2[version_level1]
-					[state.vasp_version_selected[1]];
-				auto version_level3 = state.vasp_version_entries_level3[state.vasp_version_selected[2]];
-				return fmt::format
-				(
-					"{}{}_{}",
-					version_level1,
-					version_level2 == "(default)" ? ""s : "_" + version_level2,
-					version_level3
-				);
-			}()
-		);
-		screen.Loop(confirm_interface);
-		if (state.user_command == "quit")
-			return EXIT_FAILURE;
-		else if (state.user_command == "back")
-			continue;
-		else if (state.user_command != "submit")
-			throw std::runtime_error("user_command is not recognized");
-		submit(state.bsub);
-		break;
-	}
+
+
+      std::vector<ftxui::Component> vasp_version_level2_children;
+      for (auto& i : state.vasp_version_entries_level1)
+        vasp_version_level2_children.push_back(ftxui::Menu
+        (
+          &state.vasp_version_entries_level2[i],
+          &state.vasp_version_selected[1]
+        ));
+      auto vasp_version_level2 = ftxui::Container::Tab
+      (
+        vasp_version_level2_children,
+        &state.vasp_version_selected[0]
+      ) | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 27);
+    })
+
+
+
+    ftxui::Menu(&state.vasp_version_entries, &state.vasp_version_selected)
+      | with_title("Select VASP version:"),
+    ftxui::Container::Horizontal
+    ({
+      ftxui::Menu(&state.device_type_entries, &state.device_type_selected),
+      ftxui::Container::Vertical([&]
+      {
+        std::vector<std::shared_ptr<ftxui::ComponentBase>> devices;
+        auto checkbox_option = ftxui::CheckboxOption::Simple();
+        checkbox_option.transform = [](const ftxui::EntryState& s)
+        {
+          auto prefix = ftxui::text(s.state ? "[X] " : "[ ] ");
+          auto t = ftxui::text(s.label);
+          if (s.active) t |= ftxui::bold;
+          if (s.focused) t |= ftxui::inverted;
+          return ftxui::hbox({prefix, t});
+        };
+        for (int i = 0; i < state.device_selected.size(); i++)
+          devices.push_back(ftxui::Checkbox
+            (state.device_entries[i], &state.device_selected[i], checkbox_option));
+        return devices;
+      }()) | with_separator | ftxui::Maybe([&]{ return state.device_type_selected == 1; }),
+      ftxui::Container::Vertical
+      ({
+        ftxui::Input(&state.mpi_threads) | ftxui::size(ftxui::WIDTH, ftxui::GREATER_THAN, 3)
+          | with_subtitle("MPI threads: "),
+        ftxui::Input(&state.openmp_threads) | ftxui::size(ftxui::WIDTH, ftxui::GREATER_THAN, 3)
+          | with_subtitle("OpenMP threads: ")
+      }) | with_separator | ftxui::Maybe([&]{ return state.device_type_selected == 2; }),
+    }) | with_title("Select device:"),
+    ftxui::Input(&state.job_name) | with_title("Job name:"),
+    ftxui::Input(&state.output_file) | with_title("Output file:"),
+    ftxui::Container::Horizontal
+    ({
+      ftxui::Button("Continue",
+        [&]{ state.user_command = "continue"; screen.ExitLoopClosure()(); }),
+      ftxui::Button("Quit",
+        [&]{ state.user_command = "quit"; screen.ExitLoopClosure()(); })
+    })
+  }) | ftxui::borderHeavy | with_padding;
+  
+  [&state, &screen]
+  {
+    auto vasp_version_level1 = ftxui::Menu
+      (&state.vasp_version_entries_level1, &state.vasp_version_selected[0])
+      | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 8);
+    std::vector<ftxui::Component> vasp_version_level2_children;
+    for (auto& i : state.vasp_version_entries_level1)
+      vasp_version_level2_children.push_back(ftxui::Menu
+      (
+        &state.vasp_version_entries_level2[i],
+        &state.vasp_version_selected[1]
+      ));
+    auto vasp_version_level2 = ftxui::Container::Tab
+    (
+      vasp_version_level2_children,
+      &state.vasp_version_selected[0]
+    ) | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 27);
+    auto vasp_version_level3 = ftxui::Menu
+      (&state.vasp_version_entries_level3, &state.vasp_version_selected[2])
+      | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 8);
+    auto vasp_version = component_with_title("Select vasp version:",
+      ftxui::Container::Horizontal
+        ({vasp_version_level1, vasp_version_level2, vasp_version_level3})
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 5));
+    auto queue = component_with_title("Select queue:",
+      ftxui::Menu(&state.queue_entries, &state.queue_selected)
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 6));
+    auto ncores = component_with_title("Input cores you want to use:",
+      ftxui::Input(&state.ncores, "(leave blank to use all cores)"))
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 3);
+    auto job_name = component_with_title("Job name:",
+      ftxui::Input(&state.job_name, ""))
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 3);
+    auto continue_button = ftxui::Button("Continue",
+      [&]{state.user_command = "continue"; screen.ExitLoopClosure()();});
+    auto quit_button = ftxui::Button("Quit",
+      [&]{state.user_command = "quit"; screen.ExitLoopClosure()();});
+    return ftxui::Container::Vertical
+    ({
+      vasp_version, queue, ncores, job_name,
+      ftxui::Container::Horizontal({continue_button, quit_button})
+    }) | ftxui::borderHeavy
+      | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 47)
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 24);
+  }();
+  auto confirm_interface = [&state, &screen, &component_with_title]
+  {
+    ftxui::InputOption input_option;
+    input_option.multiline = true;
+    return ftxui::Container::Vertical
+    ({
+      component_with_title
+      (
+        "Double check & modify submit command:",
+        ftxui::Input(&state.bsub, "", input_option)
+      )
+        | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 7),
+      ftxui::Container::Horizontal
+      ({
+        ftxui::Button("Submit",
+          [&]{state.user_command = "submit"; screen.ExitLoopClosure()();}),
+        ftxui::Button("Quit",
+          [&]{state.user_command = "quit"; screen.ExitLoopClosure()();}),
+        ftxui::Button("Back",
+          [&]{state.user_command = "back"; screen.ExitLoopClosure()();})
+      }),
+      ftxui::Renderer([]{return ftxui::vbox
+      ({
+        ftxui::separator(),
+        ftxui::text("Source code:"),
+        ftxui::text("https://github.com/CHN-beta/chn_bsub.git"),
+        ftxui::text("Star & PR are welcome!"),
+      });})
+    }) | ftxui::borderHeavy
+      | ftxui::size(ftxui::WIDTH, ftxui::EQUAL, 47)
+      | ftxui::size(ftxui::HEIGHT, ftxui::EQUAL, 14);
+  }();
+
+  // 实际投递任务
+  auto submit = [](std::string bsub)
+  {
+    // replace \n with space
+    boost::replace_all(bsub, "\n", " ");
+    auto process = boost::process::child
+    (
+      boost::process::search_path("sh"), "-c", bsub,
+      boost::process::std_in.close(),
+      boost::process::std_out > stdout,
+      boost::process::std_err > stderr
+    );
+    process.wait();
+  };
+
+  // 进入事件循环
+  while (true)
+  {
+    screen.Loop(request_interface);
+    if (state.user_command == "quit")
+      return EXIT_FAILURE;
+    else if (state.user_command != "continue")
+      throw std::runtime_error("user_command is not recognized");
+    state.bsub = fmt::format
+    (
+      "bsub -J '{}'\n-q {}\n-n {}\n-R 'span[hosts=1]'\n-o 'output.txt'\nchn_vasp.sh {}",
+      state.job_name,
+      state.queue_entries[state.queue_selected],
+      state.ncores.empty() ? state.max_cores[state.queue_entries[state.queue_selected]] :
+        std::stoi(state.ncores),
+      [&]
+      {
+        auto version_level1 = state.vasp_version_entries_level1[state.vasp_version_selected[0]];
+        auto version_level2 = state.vasp_version_entries_level2[version_level1]
+          [state.vasp_version_selected[1]];
+        auto version_level3 = state.vasp_version_entries_level3[state.vasp_version_selected[2]];
+        return fmt::format
+        (
+          "{}{}_{}",
+          version_level1,
+          version_level2 == "(default)" ? ""s : "_" + version_level2,
+          version_level3
+        );
+      }()
+    );
+    screen.Loop(confirm_interface);
+    if (state.user_command == "quit")
+      return EXIT_FAILURE;
+    else if (state.user_command == "back")
+      continue;
+    else if (state.user_command != "submit")
+      throw std::runtime_error("user_command is not recognized");
+    submit(state.bsub);
+    break;
+  }
 }
--- a/local/pkgs/concurrencpp/default.nix
+++ b/local/pkgs/concurrencpp/default.nix
--- a/local/pkgs/date/default.nix
+++ b/local/pkgs/date/default.nix
--- a/local/pkgs/default.nix
+++ b/local/pkgs/default.nix
@@ -1,24 +1,32 @@
 inputs: rec
 {
-  vesta = inputs.pkgs.callPackage ./vesta.nix {};
-  rsshub = inputs.pkgs.callPackage ./rsshub.nix { inherit mkPnpmPackage; src = inputs.topInputs.rsshub; };
-  misskey = inputs.pkgs.callPackage ./misskey.nix { inherit mkPnpmPackage; src = inputs.topInputs.misskey; };
-  mk-meili-mgn = inputs.pkgs.callPackage ./mk-meili-mgn.nix {};
-  vaspkit = inputs.pkgs.callPackage ./vaspkit.nix { inherit (inputs.localLib) attrsToList; };
-  v-sim = inputs.pkgs.callPackage ./v-sim.nix { src = inputs.topInputs.v-sim; };
-  concurrencpp = inputs.pkgs.callPackage ./concurrencpp.nix { src = inputs.topInputs.concurrencpp; };
-  eigengdb = inputs.pkgs.python3Packages.callPackage ./eigengdb.nix {};
-  nodesoup = inputs.pkgs.callPackage ./nodesoup.nix { src = inputs.topInputs.nodesoup; };
-  matplotplusplus = inputs.pkgs.callPackage ./matplotplusplus.nix
+  typora = inputs.pkgs.callPackage ./typora {};
+  vesta = inputs.pkgs.callPackage ./vesta {};
+  rsshub = inputs.pkgs.callPackage ./rsshub.nix
+  {
+    inherit mkPnpmPackage;
+    src = inputs.topInputs.rsshub;
+    nodejs = nodejs-with-pnpm9.override { nodejs = inputs.pkgs.nodejs_22; };
+  };
+  misskey = inputs.pkgs.callPackage ./misskey.nix
+    { inherit mkPnpmPackage; src = inputs.topInputs.misskey; nodejs = nodejs-with-pnpm9; };
+  mk-meili-mgn = inputs.pkgs.callPackage ./mk-meili-mgn {};
+  vaspkit = inputs.pkgs.callPackage ./vaspkit { inherit (inputs.localLib) attrsToList; };
+  v-sim = inputs.pkgs.callPackage ./v-sim { src = inputs.topInputs.v-sim; };
+  concurrencpp = inputs.pkgs.callPackage ./concurrencpp { src = inputs.topInputs.concurrencpp; };
+  eigengdb = inputs.pkgs.python3Packages.callPackage ./eigengdb {};
+  nodesoup = inputs.pkgs.callPackage ./nodesoup { src = inputs.topInputs.nodesoup; };
+  matplotplusplus = inputs.pkgs.callPackage ./matplotplusplus
    { inherit nodesoup glad; src = inputs.topInputs.matplotplusplus; };
-  zpp-bits = inputs.pkgs.callPackage ./zpp-bits.nix { src = inputs.topInputs.zpp-bits; };
-  eigen = inputs.pkgs.callPackage ./eigen.nix { src = inputs.topInputs.eigen; };
-  nameof = inputs.pkgs.callPackage ./nameof.nix { src = inputs.topInputs.nameof; };
-  pslist = inputs.pkgs.callPackage ./pslist.nix {};
-  glad = inputs.pkgs.callPackage ./glad.nix {};
-  yoga-support = inputs.pkgs.callPackage ./yoga-support.nix {};
-  tgbot-cpp = inputs.pkgs.callPackage ./tgbot-cpp.nix { src = inputs.topInputs.tgbot-cpp; };
-  mirism = inputs.pkgs.callPackage ./mirism.nix
+  zpp-bits = inputs.pkgs.callPackage ./zpp-bits { src = inputs.topInputs.zpp-bits; };
+  eigen = inputs.pkgs.callPackage ./eigen { src = inputs.topInputs.eigen; };
+  nameof = inputs.pkgs.callPackage ./nameof { src = inputs.topInputs.nameof; };
+  pslist = inputs.pkgs.callPackage ./pslist {};
+  glad = inputs.pkgs.callPackage ./glad {};
+  chromiumos-touch-keyboard = inputs.pkgs.callPackage ./chromiumos-touch-keyboard {};
+  yoga-support = inputs.pkgs.callPackage ./yoga-support {};
+  tgbot-cpp = inputs.pkgs.callPackage ./tgbot-cpp { src = inputs.topInputs.tgbot-cpp; };
+  mirism = inputs.pkgs.callPackage ./mirism
  {
    inherit cppcoro nameof tgbot-cpp date;
    nghttp2 = inputs.pkgs.callPackage "${inputs.topInputs."nixpkgs-23.05"}/pkgs/development/libraries/nghttp2"
@@ -26,52 +34,54 @@ inputs: rec
    stdenv = inputs.pkgs.gcc12Stdenv;
  };
  cppcoro = inputs.pkgs.callPackage ./cppcoro { src = inputs.topInputs.cppcoro; };
-  date = inputs.pkgs.callPackage ./date.nix { src = inputs.topInputs.date; };
-  esbonio = inputs.pkgs.python3Packages.callPackage ./esbonio.nix {};
+  date = inputs.pkgs.callPackage ./date { src = inputs.topInputs.date; };
+  esbonio = inputs.pkgs.python3Packages.callPackage ./esbonio {};
  pix2tex = inputs.pkgs.python3Packages.callPackage ./pix2tex {};
-  pyreadline3 = inputs.pkgs.python3Packages.callPackage ./pyreadline3.nix {};
-  torchdata = inputs.pkgs.python3Packages.callPackage ./torchdata.nix {};
-  torchtext = inputs.pkgs.python3Packages.callPackage ./torchtext.nix { inherit torchdata; };
+  pyreadline3 = inputs.pkgs.python3Packages.callPackage ./pyreadline3 {};
+  torchdata = inputs.pkgs.python3Packages.callPackage ./torchdata {};
+  torchtext = inputs.pkgs.python3Packages.callPackage ./torchtext { inherit torchdata; };
+  win11os-kde = inputs.pkgs.callPackage ./win11os-kde { src = inputs.topInputs.win11os-kde; };
+  fluent-kde = inputs.pkgs.callPackage ./fluent-kde { src = inputs.topInputs.fluent-kde; };
  blurred-wallpaper = inputs.pkgs.callPackage ./blurred-wallpaper.nix { src = inputs.topInputs.blurred-wallpaper; };
-  slate = inputs.pkgs.callPackage ./slate.nix { src = inputs.topInputs.slate; };
-  nvhpc = inputs.pkgs.callPackage ./nvhpc.nix {};
-  lmod = inputs.pkgs.callPackage ./lmod.nix { src = inputs.topInputs.lmod; };
+  slate = inputs.pkgs.callPackage ./slate { src = inputs.topInputs.slate; };
+  nvhpc = inputs.pkgs.callPackage ./nvhpc {};
+  lmod = inputs.pkgs.callPackage ./lmod { src = inputs.topInputs.lmod; };
  vasp = rec
  {
    src = inputs.pkgs.callPackage ./vasp/source.nix {};
    gnu = inputs.pkgs.callPackage ./vasp/gnu
    {
      inherit (inputs.pkgs.llvmPackages) openmp;
-      inherit src;
+      inherit wannier90 src;
      hdf5 = inputs.pkgs.hdf5.override { mpiSupport = true; fortranSupport = true; cppSupport = false; };
    };
    nvidia = inputs.pkgs.callPackage ./vasp/nvidia
-      { inherit lmod nvhpc vtst src; hdf5 = hdf5-nvhpc; };
+      { inherit lmod nvhpc wannier90 vtst src; hdf5 = hdf5-nvhpc; };
    intel = inputs.pkgs.callPackage ./vasp/intel
-      { inherit lmod oneapi vtst src; hdf5 = hdf5-oneapi; };
+      { inherit lmod oneapi wannier90 vtst src; hdf5 = hdf5-oneapi; };
+    wannier90 = inputs.pkgs.callPackage
+      "${inputs.topInputs.nixpkgs-unstable}/pkgs/by-name/wa/wannier90/package.nix" {};
    hdf5-nvhpc = inputs.pkgs.callPackage ./vasp/hdf5-nvhpc { inherit lmod nvhpc; inherit (inputs.pkgs.hdf5) src; };
    hdf5-oneapi = inputs.pkgs.callPackage ./vasp/hdf5-oneapi { inherit lmod oneapi; inherit (inputs.pkgs.hdf5) src; };
    vtst = (inputs.pkgs.callPackage ./vasp/vtst.nix {});
    vtstscripts = inputs.pkgs.callPackage ./vasp/vtstscripts.nix {};
  };
  # TODO: use other people packaged hpc version
-  oneapi = inputs.pkgs.callPackage ./oneapi.nix {};
-  mumax = inputs.pkgs.callPackage ./mumax.nix { src = inputs.topInputs.mumax; };
-  kylin-virtual-keyboard = inputs.pkgs.libsForQt5.callPackage ./kylin-virtual-keyboard.nix
+  oneapi = inputs.pkgs.callPackage ./oneapi {};
+  mumax = inputs.pkgs.callPackage ./mumax { src = inputs.topInputs.mumax; };
+  kylin-virtual-keyboard = inputs.pkgs.libsForQt5.callPackage ./kylin-virtual-keyboard
    { src = inputs.topInputs.kylin-virtual-keyboard; };
  biu = inputs.pkgs.callPackage ./biu { inherit nameof zpp-bits; };
-  zxorm = inputs.pkgs.callPackage ./zxorm.nix { src = inputs.topInputs.zxorm; };
-  hpcstat = inputs.pkgs.callPackage ./hpcstat
-    { inherit sqlite-orm date biu openxlsx; stdenv = inputs.pkgs.gcc14Stdenv; };
-  openxlsx = inputs.pkgs.callPackage ./openxlsx.nix { src = inputs.topInputs.openxlsx; };
-  sqlite-orm = inputs.pkgs.callPackage ./sqlite-orm.nix { src = inputs.topInputs.sqlite-orm; };
+  zxorm = inputs.pkgs.callPackage ./zxorm { src = inputs.topInputs.zxorm; };
+  hpcstat = inputs.pkgs.callPackage ./hpcstat { inherit nameof sqlite-orm zpp-bits date biu openxlsx; };
+  openxlsx = inputs.pkgs.callPackage ./openxlsx { src = inputs.topInputs.openxlsx; };
+  sqlite-orm = inputs.pkgs.callPackage ./sqlite-orm { src = inputs.topInputs.sqlite-orm; };
  mkPnpmPackage = inputs.pkgs.callPackage ./mkPnpmPackage.nix {};
+  nodejs-with-pnpm9 = inputs.pkgs.callPackage ./nodejs-with-pnpm9.nix {};
  sbatch-tui = inputs.pkgs.callPackage ./sbatch-tui { inherit biu; };
  ufo = inputs.pkgs.callPackage ./ufo
    { inherit concurrencpp biu glad matplotplusplus zpp-bits; tbb = inputs.pkgs.tbb_2021_11; };
  chn-bsub = inputs.pkgs.callPackage ./chn-bsub { inherit biu; };
-  winjob = inputs.pkgs.callPackage ./winjob { stdenv = inputs.pkgs.gcc14Stdenv; };
-  sockpp = inputs.pkgs.callPackage ./sockpp.nix { src = inputs.topInputs.sockpp; };

  fromYaml = content: builtins.fromJSON (builtins.readFile
    (inputs.pkgs.runCommand "toJSON" {}
--- a/local/pkgs/eigen/default.nix
+++ b/local/pkgs/eigen/default.nix
--- a/local/pkgs/eigengdb/default.nix
+++ b/local/pkgs/eigengdb/default.nix
--- a/local/pkgs/esbonio/default.nix
+++ b/local/pkgs/esbonio/default.nix
--- a/local/pkgs/fluent-kde/default.nix
+++ b/local/pkgs/fluent-kde/default.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, src }: stdenv.mkDerivation
+{
+  name = "fluent-kde";
+  inherit src;
+  installPhase =
+  ''
+    mkdir -p $out/share/aurorae/themes
+    cp -r $src/aurorae/* $out/share/aurorae/themes
+    mkdir -p $out/share/color-schemes
+    cp -r $src/color-schemes/*.colors $out/share/color-schemes
+    mkdir -p $out/share/Kvantum
+    cp -r $src/Kvantum/Fluent* $out/share/Kvantum
+    mkdir -p $out/share/plasma/desktoptheme
+    cp -r $src/plasma/desktoptheme/* $out/share/plasma/desktoptheme
+    mkdir -p $out/share/plasma/layout-templates
+    cp -r $src/plasma/layout-templates/* $out/share/plasma/layout-templates
+    mkdir -p $out/share/plasma/look-and-feel
+    cp -r $src/plasma/look-and-feel/com.github.vinceliuice.Fluent* $out/share/plasma/look-and-feel
+    mkdir -p $out/share/wallpapers
+    cp -r $src/wallpaper/* $out/share/wallpapers
+  '';
+}
--- a/local/pkgs/glad/default.nix
+++ b/local/pkgs/glad/default.nix
--- a/local/pkgs/hpcstat/.clangd
+++ b/local/pkgs/hpcstat/.clangd
@@ -1,3 +1,3 @@
 CompileFlags:
-  Add: [ -Wall, -Wextra, -std=c++26 ]
+  Add: [ -Wall, -Wextra, -std=c++23 ]
  Compiler: g++
--- a/local/pkgs/hpcstat/CMakeLists.txt
+++ b/local/pkgs/hpcstat/CMakeLists.txt
@@ -1,5 +1,4 @@
-# cmake_minimum_required(VERSION 3.30)
-cmake_minimum_required(VERSION 3.29)
+cmake_minimum_required(VERSION 3.14)
 project(hpcstat VERSION 0.0.0 LANGUAGES CXX)
 enable_testing()
 include(GNUInstallDirs)
@@ -15,7 +14,9 @@ set(HPCSTAT_VERSION "unknown" CACHE STRING "Version of the hpcstat")
 find_package(Boost REQUIRED COMPONENTS headers filesystem)
 find_package(SqliteOrm REQUIRED)
 find_package(nlohmann_json REQUIRED)
+find_path(ZPP_BITS_INCLUDE_DIR zpp_bits.h REQUIRED)
 find_package(range-v3 REQUIRED)
+find_path(NAMEOF_INCLUDE_DIR nameof.hpp REQUIRED)
 find_package(date REQUIRED)
 find_package(httplib REQUIRED)
 find_package(termcolor REQUIRED)
@@ -24,9 +25,8 @@ find_package(OpenXLSX REQUIRED)

 add_executable(hpcstat src/main.cpp src/env.cpp src/keys.cpp src/ssh.cpp src/sql.cpp src/lfs.cpp src/common.cpp
  src/push.cpp src/disk.cpp)
-# target_compile_features(hpcstat PRIVATE cxx_std_26)
-target_compile_options(hpcstat PRIVATE "-std=c++26")
-target_include_directories(hpcstat PRIVATE ${PROJECT_SOURCE_DIR}/include)
+target_compile_features(hpcstat PRIVATE cxx_std_23)
+target_include_directories(hpcstat PRIVATE ${PROJECT_SOURCE_DIR}/include ${ZPP_BITS_INCLUDE_DIR})
 target_link_libraries(hpcstat PRIVATE Boost::headers Boost::filesystem sqlite_orm::sqlite_orm
  nlohmann_json::nlohmann_json range-v3::range-v3 date::date date::date-tz httplib::httplib
  termcolor::termcolor biu::biu OpenXLSX::OpenXLSX)
--- a/local/pkgs/hpcstat/default.nix
+++ b/local/pkgs/hpcstat/default.nix
@@ -1,12 +1,13 @@
 {
  stdenv, cmake, pkg-config, standalone ? false, version ? null, makeWrapper, lib,
-  sqlite-orm, nlohmann_json, range-v3, openssh, sqlite, date, httplib, openssl, openxlsx, termcolor, duc, biu
+  boost, fmt, sqlite-orm, nlohmann_json, zpp-bits, range-v3, nameof, openssh, sqlite, date, httplib, openssl, openxlsx,
+  termcolor, duc, biu
 }: stdenv.mkDerivation
 {
  name = "hpcstat";
  src = ./.;
  buildInputs =
-    [ sqlite-orm nlohmann_json range-v3 sqlite date httplib termcolor openssl biu openxlsx ];
+    [ boost fmt sqlite-orm nlohmann_json zpp-bits range-v3 nameof sqlite date httplib termcolor openssl biu openxlsx ];
  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
  cmakeFlags = lib.optionals (version != null) [ "-DHPCSTAT_VERSION=${version}" ];
  postInstall =
--- a/local/pkgs/hpcstat/include/hpcstat/common.hpp
+++ b/local/pkgs/hpcstat/include/hpcstat/common.hpp
@@ -15,6 +15,7 @@
 # include <date/date.h>
 # include <date/tz.h>
 # include <boost/interprocess/sync/file_lock.hpp>
+# include <zpp_bits.h>
 # include <biu.hpp>

 namespace hpcstat
--- a/local/pkgs/hpcstat/src/disk.cpp
+++ b/local/pkgs/hpcstat/src/disk.cpp
@@ -31,11 +31,11 @@ namespace hpcstat::disk
    else if
    (
      auto result = biu::exec<{.DirectStdout = true, .DirectStderr = true}>
-      ({
+      (
        // duc index -d ./duc.db -p ~
        "{}/duc"_f(*ducbindir),
        { "index", "-d", "{}/duc.db"_f(*datadir), "-p", *homedir }
-      });
+      );
      !result
    )
      { std::cerr << "failed to index\n"; return false; }
@@ -57,14 +57,14 @@ namespace hpcstat::disk
        if
        (
          auto result = biu::exec
-          ({
+          (
            // duc ls -d ./duc.db -b -D /data/gpfs01/jykang/linwei/xxx
            "{}/duc"_f(*ducbindir),
            {
              "ls", "-d", "{}/duc.db"_f(*datadir), "-b", "-D",
              "{}{}{}"_f(*homedir, path ? "/" : "", path.value_or(""))
            }
-          });
+          );
          !result
        )
          { std::cerr << "failed to ls {}\n"_f(path); return {}; }
@@ -90,7 +90,7 @@ namespace hpcstat::disk
        (
          // duc info -d ./duc.db
          auto result = biu::exec
-            ({"{}/duc"_f(*ducbindir), { "info", "-d", "{}/duc.db"_f(*datadir) }});
+            ("{}/duc"_f(*ducbindir), { "info", "-d", "{}/duc.db"_f(*datadir) });
          !result
        )
          { std::cerr << "failed to get duc info\n"; return {}; }
--- a/local/pkgs/hpcstat/src/lfs.cpp
+++ b/local/pkgs/hpcstat/src/lfs.cpp
@@ -27,7 +27,7 @@ namespace hpcstat::lfs
        }
        else break;
      }
-      if (auto result = biu::exec({*bsub, args}); !result) return std::nullopt;
+      if (auto result = biu::exec(*bsub, args); !result) return std::nullopt;
      else
      {
        // Job <462270> is submitted to queue <normal_1day>.
@@ -45,11 +45,10 @@ namespace hpcstat::lfs
    if
    (
      auto result = biu::exec<{.SearchPath = true}>
-      ({
-        .Program="bjobs",
-        .Args={ "-a", "-o", "jobid submit_time stat cpu_used job_name", "-json" },
-        .ExtraEnv={ { "LSB_DISPLAY_YEAR", "Y" } }
-      });
+      (
+        "bjobs", { "-a", "-o", "jobid submit_time stat cpu_used job_name", "-json" },
+        {}, { { "LSB_DISPLAY_YEAR", "Y" } }
+      );
      !result
    )
      return std::nullopt;
@@ -80,11 +79,7 @@ namespace hpcstat::lfs
  }
  std::optional<std::string> bjobs_detail(unsigned jobid)
  {
-    if
-    (
-      auto result = biu::exec<{.SearchPath = true}>({"bjobs", { "-l", "{}"_f(jobid) }});
-      !result
-    )
+    if (auto result = biu::exec<{.SearchPath = true}>("bjobs", { "-l", "{}"_f(jobid) }); !result)
      return std::nullopt;
    else return result.Stdout;
  }
--- a/local/pkgs/hpcstat/src/main.cpp
+++ b/local/pkgs/hpcstat/src/main.cpp
@@ -7,6 +7,7 @@
 # include <hpcstat/disk.hpp>
 # include <range/v3/view.hpp>
 # include <boost/exception/diagnostic_information.hpp>
+# include <boost/filesystem.hpp>
 # include <termcolor/termcolor.hpp>

 int main(int argc, const char** argv)
@@ -15,6 +16,10 @@ int main(int argc, const char** argv)
  using namespace std::literals;
  try
  {
+    auto lockfile = (boost::filesystem::temp_directory_path() / "hpcstat.lock").string();
+    std::ofstream{lockfile};
+    boost::interprocess::file_lock lock(lockfile.c_str());
+
    std::vector<std::string> args(argv, argv + argc);

    if (args.size() == 1)
@@ -22,7 +27,11 @@ int main(int argc, const char** argv)
      std::cout << "Usage: hpcstat initdb|login|logout|submitjob|finishjob|verify|export|version|diskstat\n";
      return 1;
    }
-    else if (args[1] == "initdb") { if (!sql::initdb()) { std::cerr << "Failed to initialize database\n"; return 1; } }
+    else if (args[1] == "initdb")
+    {
+      lock.lock();
+      if (!sql::initdb()) { std::cerr << "Failed to initialize database\n"; return 1; }
+    }
    else if (args[1] == "login")
    {
      if (env::interactive()) std::cout << "Communicating with the agent..." << std::flush;
@@ -41,6 +50,7 @@ int main(int argc, const char** argv)
        auto signature = ssh::sign(biu::serialize<char>(data), *fp);
        if (!signature) return 1;
        data.Signature = *signature;
+        lock.lock();
        sql::writedb(data);
        if (env::interactive())
        {
@@ -78,7 +88,7 @@ int main(int argc, const char** argv)
    {
      if (auto session_id = env::env("XDG_SESSION_ID", true); !session_id)
        return 1;
-      else sql::writedb(sql::LogoutData{ .Time = now(), .SessionId = *session_id });
+      else { lock.lock(); sql::writedb(sql::LogoutData{ .Time = now(), .SessionId = *session_id }); }
    }
    else if (args[1] == "submitjob")
    {
@@ -101,12 +111,14 @@ int main(int argc, const char** argv)
        auto signature = ssh::sign(biu::serialize<char>(data), *fp);
        if (!signature) return 1;
        data.Signature = *signature;
+        lock.lock();
        sql::writedb(data);
        std::cout << "Job <{}> was submitted to <{}> by <{}>.\n"_f(bsub->first, bsub->second, Keys[*fp].Username);
      }
    }
    else if (args[1] == "finishjob")
    {
+      lock.lock();
      if (auto fp = ssh::fingerprint(); !fp) return 1;
      else if (auto session = env::env("XDG_SESSION_ID", true); !session)
        return 1;
@@ -154,10 +166,12 @@ int main(int argc, const char** argv)
      auto begin = sys_seconds(sys_days(month(month_n) / 1 / year_n)).time_since_epoch().count();
      auto end = sys_seconds(sys_days(month(month_n) / 1 / year_n + months(1)))
        .time_since_epoch().count();
+      lock.lock();
      if (!sql::export_data(begin, end, "{}{}.xlsx"_f(year_n, month_n))) return 1;
    }
    else if (args[1] == "push")
    {
+      lock.lock();
      if (auto jobs = sql::check_job_status(); !jobs) return 1;
      else if (!push::push(*jobs)) return 1;
    }
--- a/local/pkgs/hpcstat/src/sql.cpp
+++ b/local/pkgs/hpcstat/src/sql.cpp
@@ -8,16 +8,14 @@
 # define SQLITE_ORM_OPTIONAL_SUPPORTED
 # include <sqlite_orm/sqlite_orm.h>
 # include <OpenXLSX.hpp>
-# include <boost/filesystem.hpp>

 namespace hpcstat::sql
 {
-  auto connect(std::optional<std::string> dbfile = std::nullopt, bool need_lock = true)
+  auto connect(std::optional<std::string> dbfile = std::nullopt)
  {
-    // a function to actually connecto to db
-    auto conn = [](std::string dbfile) { return std::make_optional(sqlite_orm::make_storage
+    auto conn = [&]() { return std::make_optional(sqlite_orm::make_storage
    (
-      dbfile,
+      *dbfile,
      sqlite_orm::make_table
      (
        "login",
@@ -72,52 +70,31 @@ namespace hpcstat::sql
        sqlite_orm::make_column("status", &CheckJobData::Status)
      )
    ));};
-
-    // a class to take care of lock
-    struct conn_with_lock
-    {
-      // lock should be declared before conn, so that it will be destructed after conn
-      boost::interprocess::file_lock lock;
-      decltype(conn(std::declval<std::string>())) connection;
-    };
-
-    // set default db path
    if (!dbfile)
    {
      if (auto datadir = env::env("HPCSTAT_DATADIR", true); !datadir)
-        return conn_with_lock{};
+        return decltype(conn())();
      else dbfile = std::filesystem::path(*datadir) / "hpcstat.db";
    }
-
-    // set file lock
-    auto lockfile = (boost::filesystem::temp_directory_path() / "hpcstat.lock").string();
-    std::ofstream{lockfile};  // create file
-    boost::interprocess::file_lock lock(lockfile.c_str());
-    if (need_lock) lock.lock();
-
-    // try to connect
-    if (auto result = conn(*dbfile); !result)
-      { std::cerr << "Failed to connect to database.\n"; return conn_with_lock{}; }
-    else
-    {
-      result->busy_timeout(10000);
-      return conn_with_lock{std::move(lock), std::move(result)};
-    }
+    auto result = conn();
+    if (!result) std::cerr << "Failed to connect to database.\n";
+    else result->busy_timeout(10000);
+    return result;
  }
  bool initdb()
  {
-    if (auto [lock, conn] = connect(); !conn) return false;
+    if (auto conn = connect(); !conn) return false;
    else { conn->sync_schema(); return true; }
  }
  bool writedb(auto value)
-    { if (auto [lock, conn] = connect(); !conn) return false; else { conn->insert(value); return true; } }
+    { if (auto conn = connect(); !conn) return false; else { conn->insert(value); return true; } }
  template bool writedb(LoginData);
  template bool writedb(LogoutData);
  template bool writedb(SubmitJobData);
  template bool writedb(FinishJobData);
  std::optional<std::set<unsigned>> finishjob_remove_existed(std::map<unsigned, std::string> jobid_submit_time)
  {
-    if (auto [lock, conn] = connect(); !conn) return std::nullopt;
+    if (auto conn = connect(); !conn) return std::nullopt;
    else
    {
      auto all_job = jobid_submit_time | ranges::views::keys | ranges::to<std::vector<unsigned>>;
@@ -133,8 +110,7 @@ namespace hpcstat::sql
  std::optional<std::vector<std::tuple<std::string, std::string, std::string>>>
    verify(std::string old_db, std::string new_db)
  {
-    auto [_, old_conn] = connect(old_db);
-    auto [_, new_conn] = connect(new_db);
+    auto old_conn = connect(old_db), new_conn = connect(new_db);
    if (!old_conn || !new_conn) { std::cerr << "Failed to connect to database.\n"; return std::nullopt; }
    else
    {
@@ -177,8 +153,7 @@ namespace hpcstat::sql
    }
  }
  // search corresponding job in submit table
-  std::optional<SubmitJobData> search_job_in_submit
-    (auto connection, unsigned job_id, std::string submit_time)
+  std::optional<SubmitJobData> search_job_in_submit(auto connection, unsigned job_id, std::string submit_time)
  {
    std::optional<SubmitJobData> result;
    long submit_date = [&]
@@ -210,7 +185,7 @@ namespace hpcstat::sql
  }
  bool export_data(long start_time, long end_time, std::string filename)
  {
-    if (auto [lock, conn] = connect(); !conn) return false;
+    if (auto conn = connect(); !conn) return false;
    else
    {
      // 对于一个账户的总计
@@ -337,7 +312,7 @@ namespace hpcstat::sql
  std::optional<std::map<unsigned, std::tuple<std::string, std::string, std::string, std::optional<std::string>>>>
    check_job_status()
  {
-    if (auto [lock, conn] = connect(); !conn) return std::nullopt;
+    if (auto conn = connect(); !conn) return std::nullopt;
    else if (auto jobs_current = lfs::bjobs_list(); !jobs_current) return std::nullopt;
    else
    {
--- a/local/pkgs/hpcstat/src/ssh.cpp
+++ b/local/pkgs/hpcstat/src/ssh.cpp
@@ -12,8 +12,7 @@ namespace hpcstat::ssh
      return std::nullopt;
    else if
    (
-      auto output = biu::exec
-        ({.Program=std::filesystem::path(*sshbindir) / "ssh-add", .Args{ "-l" }, .Timeout=10s});
+      auto output = biu::exec(std::filesystem::path(*sshbindir) / "ssh-add", { "-l" });
      !output
    )
      { std::cerr << "Failed to get ssh fingerprints\n"; return std::nullopt; }
@@ -42,15 +41,14 @@ namespace hpcstat::ssh
    else if
    (
      auto output = biu::exec
-      ({
-        .Program=std::filesystem::path(*sshbindir) / "ssh-keygen",
-        .Args={
+      (
+        std::filesystem::path(*sshbindir) / "ssh-keygen",
+        {
          "-Y", "sign", "-q", "-f", "{}/keys/{}"_f(*sharedir, Keys[fingerprint].PubkeyFilename),
          "-n", "hpcstat@chn.moe", "-"
        },
-        .Stdin=message,
-        .Timeout=10s
-      });
+        message
+      );
      !output
    )
      { std::cerr << "Failed to sign message: {}\n"_f(message); return {}; }
@@ -70,16 +68,15 @@ namespace hpcstat::ssh
      auto signaturefile = tempdir / "signature";
      std::ofstream(signaturefile) << signature;
      auto result = biu::exec
-      ({
-        .Program=std::filesystem::path(*sshbindir) / "ssh-keygen",
-        .Args={
+      (
+        std::filesystem::path(*sshbindir) / "ssh-keygen",
+        {
          "-Y", "verify",
          "-f", "{}/keys/{}"_f(*sharedir, Keys[fingerprint].PubkeyFilename),
          "-n", "hpcstat@chn.moe", "-s", signaturefile.string()
        },
-        .Stdin=message,
-        .Timeout=10s
-      });
+        message
+      );
      std::filesystem::remove_all(tempdir.string());
      return result;
    }
--- a/local/pkgs/kylin-virtual-keyboard/default.nix
+++ b/local/pkgs/kylin-virtual-keyboard/default.nix
--- a/local/pkgs/lmod/default.nix
+++ b/local/pkgs/lmod/default.nix
--- a/local/pkgs/matplotplusplus/default.nix
+++ b/local/pkgs/matplotplusplus/default.nix
--- a/local/pkgs/mirism/default.nix
+++ b/local/pkgs/mirism/default.nix
--- a/local/pkgs/misskey.nix
+++ b/local/pkgs/misskey.nix
@@ -1,11 +1,11 @@
 {
-  lib, mkPnpmPackage, nodejs, writeShellScript, src,
-  bash, cypress, vips, python3
+  lib, mkPnpmPackage, nodejs, writeShellScript,
+  bash, cypress, vips, src
 }: (mkPnpmPackage.override { inherit nodejs; })
  {
    inherit src;
    extraIntegritySha256."https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.6/aiscript-dev-aiscript-languageserver-0.1.6.tgz" = "0092d5r67bhf4xkvrdn4a2rm1drjzy7b5sw8mi7hp4pqvpc20ylr";
-    extraNativeBuildInputs = [ bash nodejs.pkgs.typescript nodejs.pkgs.gulp python3 ];
+    extraNativeBuildInputs = [ bash nodejs.pkgs.typescript nodejs.pkgs.gulp ];
    extraAttrs =
    {
      CYPRESS_INSTALL_BINARY = "0";
--- a/local/pkgs/mk-meili-mgn/default.nix
+++ b/local/pkgs/mk-meili-mgn/default.nix
--- a/local/pkgs/mumax/default.nix
+++ b/local/pkgs/mumax/default.nix
--- a/local/pkgs/nameof/default.nix
+++ b/local/pkgs/nameof/default.nix
--- a/local/pkgs/nodejs-with-pnpm9.nix
+++ b/local/pkgs/nodejs-with-pnpm9.nix
@@ -0,0 +1,15 @@
+{ nodejs, fetchurl }: nodejs.overrideAttrs (prev:
+{
+  passthru.pkgs = prev.passthru.pkgs.extend (final: prev:
+  {
+    pnpm = prev.pnpm.override
+    {
+      version = "9.1.0";
+      src = fetchurl
+      {
+        url = "https://registry.npmjs.org/pnpm/-/pnpm-9.1.0.tgz";
+        sha512 = "Z/WHmRapKT5c8FnCOFPVcb6vT3U8cH9AyyK+1fsVeMaq07bEEHzLO6CzW+AD62IaFkcayDbIe+tT+dVLtGEnJA==";
+      };
+    };
+  });
+})
--- a/local/pkgs/nodesoup/default.nix
+++ b/local/pkgs/nodesoup/default.nix
--- a/local/pkgs/nvhpc/default.nix
+++ b/local/pkgs/nvhpc/default.nix
--- a/local/pkgs/oneapi/default.nix
+++ b/local/pkgs/oneapi/default.nix
--- a/local/pkgs/openxlsx/default.nix
+++ b/local/pkgs/openxlsx/default.nix
--- a/local/pkgs/pslist/default.nix
+++ b/local/pkgs/pslist/default.nix
--- a/local/pkgs/pyreadline3/default.nix
+++ b/local/pkgs/pyreadline3/default.nix
--- a/local/pkgs/sbatch-tui/src/main.cpp
+++ b/local/pkgs/sbatch-tui/src/main.cpp
@@ -115,7 +115,8 @@ int main()
  {
    // replace \n with space
    boost::replace_all(submit_command, "\n", " ");
-    biu::exec<{.DirectStdout = true, .DirectStderr = true, .SearchPath = true}>({"sh", { "-c", submit_command }});
+    biu::exec<{.DirectStdout = true, .DirectStderr = true, .SearchPath = true}>
+      ("sh", { "-c", submit_command });
  };

  // 进入事件循环
--- a/local/pkgs/slate/default.nix
+++ b/local/pkgs/slate/default.nix
--- a/local/pkgs/sockpp.nix
+++ b/local/pkgs/sockpp.nix
@@ -1,7 +0,0 @@
-{ stdenv, src, cmake, pkg-config }: stdenv.mkDerivation
-{
-  name = "sockpp";
-  inherit src;
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [];
-}
--- a/local/pkgs/sqlite-orm/default.nix
+++ b/local/pkgs/sqlite-orm/default.nix
--- a/local/pkgs/tgbot-cpp/default.nix
+++ b/local/pkgs/tgbot-cpp/default.nix
--- a/local/pkgs/torchdata/default.nix
+++ b/local/pkgs/torchdata/default.nix
--- a/local/pkgs/torchtext/default.nix
+++ b/local/pkgs/torchtext/default.nix
--- a/local/pkgs/v-sim/default.nix
+++ b/local/pkgs/v-sim/default.nix
--- a/local/pkgs/vaspkit/default.nix
+++ b/local/pkgs/vaspkit/default.nix
--- a/local/pkgs/vesta/default.nix
+++ b/local/pkgs/vesta/default.nix
--- a/local/pkgs/win11os-kde/default.nix
+++ b/local/pkgs/win11os-kde/default.nix
@@ -0,0 +1,20 @@
+{ lib, stdenv, src }: stdenv.mkDerivation
+{
+  name = "win11os-kde";
+  inherit src;
+  installPhase =
+  ''
+    mkdir -p $out/share/aurorae/themes
+    cp -r $src/aurorae/* $out/share/aurorae/themes
+    mkdir -p $out/share/color-schemes
+    cp -r $src/color-schemes/*.colors $out/share/color-schemes
+    mkdir -p $out/share/Kvantum
+    cp -r $src/Kvantum/* $out/share/Kvantum
+    mkdir -p $out/share/plasma/desktoptheme
+    cp -r $src/plasma/desktoptheme/* $out/share/plasma/desktoptheme
+    mkdir -p $out/share/plasma/look-and-feel
+    cp -r $src/plasma/look-and-feel/* $out/share/plasma/look-and-feel
+    mkdir -p $out/share/wallpapers
+    cp -r $src/wallpaper/* $out/share/wallpapers
+  '';
+}
--- a/local/pkgs/winjob/.clangd
+++ b/local/pkgs/winjob/.clangd
@@ -1,3 +0,0 @@
-CompileFlags:
-  Add: [ -Wall, -Wextra, -std=c++26 ]
-  Compiler: g++
--- a/local/pkgs/winjob/.envrc
+++ b/local/pkgs/winjob/.envrc
@@ -1 +0,0 @@
-use flake .#winjob
--- a/local/pkgs/winjob/CMakeLists.txt
+++ b/local/pkgs/winjob/CMakeLists.txt
@@ -1,39 +0,0 @@
-# cmake_minimum_required(VERSION 3.30)
-cmake_minimum_required(VERSION 3.29)
-project(winjob VERSION 0.0.0 LANGUAGES CXX)
-enable_testing()
-include(GNUInstallDirs)
-
-if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
-  message("Setting build type to 'Release' as none was specified.")
-  set(CMAKE_BUILD_TYPE Release CACHE STRING "Choose the type of build." FORCE)
-  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo")
-endif()
-
-set(WINJOB_VERSION "unknown" CACHE STRING "Version of the winjob")
-
-find_package(Boost REQUIRED COMPONENTS headers filesystem)
-find_package(nlohmann_json REQUIRED)
-find_package(range-v3 REQUIRED)
-
-add_executable(winjob src/winjob.cpp)
-# target_compile_features(winjob PRIVATE cxx_std_26)
-target_compile_options(winjob PRIVATE "-std=c++26")
-target_include_directories(winjob PRIVATE ${PROJECT_SOURCE_DIR}/include)
-target_link_libraries(winjob PRIVATE Boost::headers Boost::filesystem
-  nlohmann_json::nlohmann_json range-v3::range-v3)
-target_compile_definitions(winjob PRIVATE winjob_VERSION="${winjob_VERSION}")
-
-add_executable(winjobd src/winjobd.cpp)
-# target_compile_features(winjob PRIVATE cxx_std_26)
-target_compile_options(winjobd PRIVATE "-std=c++26")
-target_include_directories(winjobd PRIVATE ${PROJECT_SOURCE_DIR}/include)
-target_link_libraries(winjobd PRIVATE Boost::headers Boost::filesystem
-  nlohmann_json::nlohmann_json range-v3::range-v3)
-target_compile_definitions(winjobd PRIVATE winjob_VERSION="${winjob_VERSION}")
-
-install(TARGETS winjob RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-
-get_property(ImportedTargets DIRECTORY "${CMAKE_SOURCE_DIR}" PROPERTY IMPORTED_TARGETS)
-message("Imported targets: ${ImportedTargets}")
-message("List of compile features: ${CMAKE_CXX_COMPILE_FEATURES}")
--- a/local/pkgs/winjob/default.nix
+++ b/local/pkgs/winjob/default.nix
@@ -1,11 +0,0 @@
-{
-  stdenv, cmake, pkg-config, version ? null, lib,
-  nlohmann_json, range-v3, boost
-}: stdenv.mkDerivation
-{
-  name = "winjob";
-  src = ./.;
-  buildInputs = [ nlohmann_json range-v3 boost ];
-  nativeBuildInputs = [ cmake pkg-config ];
-  cmakeFlags = lib.optionals (version != null) [ "-DWINJOB_VERSION=${version}" ];
-}
--- a/local/pkgs/winjob/src/winjob.cpp
+++ b/local/pkgs/winjob/src/winjob.cpp
@@ -1,21 +0,0 @@
-# include <boost/asio.hpp>
-# include <iostream>
-
-int main()
-{
-  boost::asio::io_context io_context;
-  boost::asio::local::stream_protocol::endpoint ep("/tmp/winjobd.sock");
-  // send a message to the server
-  boost::asio::local::stream_protocol::socket socket(io_context);
-  socket.connect(ep);
-  std::string message = "Hello, world!\n";
-  boost::asio::write(socket, boost::asio::buffer(message));
-  // receive a message from the server
-  boost::asio::streambuf buf;
-  boost::asio::read_until(socket, buf, '\n');
-  std::istream is(&buf);
-  std::string line;
-  std::getline(is, line);
-  std::cout << "Received: " << line << '\n';
-  return 0;
-}
--- a/local/pkgs/winjob/src/winjobd.cpp
+++ b/local/pkgs/winjob/src/winjobd.cpp
@@ -1,43 +0,0 @@
-# include <boost/asio.hpp>
-# include <iostream>
-
-int main()
-{
-  boost::asio::io_context io_context;
-  boost::asio::local::stream_protocol::endpoint ep("/tmp/winjobd.sock");
-  boost::asio::local::stream_protocol::acceptor acceptor(io_context, ep);
-  auto getuid = [](boost::asio::local::stream_protocol::socket& socket)
-  {
-    struct ucred ucred;
-    socklen_t len = sizeof(ucred);
-    if (getsockopt(socket.native_handle(), SOL_SOCKET, SO_PEERCRED, &ucred, &len) == -1)
-    {
-      std::cerr << "Failed to get SO_PEERCRED\n";
-      return 0u;
-    }
-    return ucred.uid;
-  };
-  std::function<void(const boost::system::error_code&, boost::asio::local::stream_protocol::socket)> func =
-    [&](const boost::system::error_code& ec, boost::asio::local::stream_protocol::socket socket)
-  {
-    if (ec)
-    {
-      std::cerr << "Failed to accept connection\n";
-      return;
-    }
-    std::cout << "Accepted connection\n";
-    boost::asio::streambuf buf;
-    boost::asio::read_until(socket, buf, '\n');
-    std::istream is(&buf);
-    std::string line;
-    std::getline(is, line);
-    std::cout << "Received: " << line << '\n';
-    std::cout << "Peer UID: " << getuid(socket) << '\n';
-    // write a message to the client
-    std::string message = "thanks for the message\n";
-    boost::asio::write(socket, boost::asio::buffer(message));
-    acceptor.async_accept(func);
-  };
-  acceptor.async_accept(func);
-  io_context.run();
-}
--- a/local/pkgs/yoga-support/default.nix
+++ b/local/pkgs/yoga-support/default.nix
--- a/local/pkgs/zpp-bits/default.nix
+++ b/local/pkgs/zpp-bits/default.nix
--- a/local/pkgs/zxorm/default.nix
+++ b/local/pkgs/zxorm/default.nix
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -30,6 +30,8 @@ inputs:
              nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
              nur-xddxdd = topInputs.nur-xddxdd.overlays.default final prev;
              nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
+              deploy-rs =
+                { inherit (prev) deploy-rs; inherit ((topInputs.deploy-rs.overlay final prev).deploy-rs) lib; };
              firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
              inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
            })
@@ -37,6 +39,7 @@ inputs:
          home-manager.sharedModules =
          [
            topInputs.plasma-manager.homeManagerModules.plasma-manager
+            topInputs.nix-doom-emacs.hmModule
            topInputs.catppuccin.homeManagerModules.catppuccin
          ];
        };
--- a/modules/hardware/cpus.nix
+++ b/modules/hardware/cpus.nix
@@ -1,29 +0,0 @@
-inputs:
-{
-  options.nixos.hardware.cpus = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
-  config = let inherit (inputs.config.nixos.hardware) cpus; in inputs.lib.mkIf (cpus != [])
-  {
-    hardware.cpu = builtins.listToAttrs
-      (builtins.map (name: { inherit name; value = { updateMicrocode = true; }; }) cpus);
-    boot =
-    {
-      initrd.availableKernelModules =
-        let modules =
-        {
-          intel =
-          [
-            "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp"
-          ];
-          amd = [];
-        };
-        in builtins.concatLists (builtins.map (cpu: modules.${cpu}) cpus);
-      kernelParams =
-        let params = { intel = [ "intel_iommu=off" ]; amd = [ "amd_iommu=fullflush" ]; };
-        in builtins.concatLists (builtins.map (cpu: params.${cpu}) cpus);
-    };
-    environment.systemPackages =
-      let packages = with inputs.pkgs; { intel = []; amd = [ zenmonitor ]; };
-      in builtins.concatLists (builtins.map (cpu: packages.${cpu}) cpus);
-  };
-}
--- a/modules/hardware/default.nix
+++ b/modules/hardware/default.nix
@@ -11,6 +11,7 @@ inputs:
      joystick = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
      printer = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
      sound = mkOption { type = types.nullOr (types.submodule {}); inherit default; };
+      cpus = mkOption { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
    };
  config = let inherit (inputs.config.nixos) hardware; in inputs.lib.mkMerge
  [
@@ -43,5 +44,29 @@ inputs:
        security.rtkit.enable = true;
      }
    )
+    # cpus
+    (
+      inputs.lib.mkIf (hardware.cpus != [])
+      {
+        hardware.cpu = builtins.listToAttrs
+          (map (name: { inherit name; value = { updateMicrocode = true; }; }) hardware.cpus);
+        boot =
+        {
+          initrd.availableKernelModules =
+            let modules =
+            {
+              intel =
+              [
+                "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp"
+              ];
+              amd = [];
+            };
+            in builtins.concatLists (map (cpu: modules.${cpu}) hardware.cpus);
+          kernelParams =
+            let params = { intel = [ "intel_iommu=off" ]; amd = [ "amd_iommu=fullflush" ]; };
+            in builtins.concatLists (map (cpu: params.${cpu}) hardware.cpus);
+        };
+      }
+    )
  ];
 }
--- a/modules/hardware/gpu.nix
+++ b/modules/hardware/gpu.nix
@@ -35,22 +35,27 @@ inputs:
          {
            intel = [ "i915" ];
            nvidia = [ "nvidia" "nvidia_drm" "nvidia_modeset" ]; # nvidia-uvm should not be loaded
-            amd = [];
+            amd = [ "amdgpu" ];
          };
          in builtins.concatLists (builtins.map (gpu: modules.${gpu}) gpus);
        hardware =
        {
-          graphics =
+          opengl =
          {
            enable = true;
+            driSupport = true;
+            driSupport32Bit = true;
            extraPackages =
              let packages = with inputs.pkgs;
              {
                intel = [ intel-vaapi-driver libvdpau-va-gl intel-media-driver ];
                nvidia = [ vaapiVdpau ];
-                amd = [];
+                amd = [ amdvlk rocmPackages.clr rocmPackages.clr.icd ];
              };
              in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
+            extraPackages32 =
+              let packages = { intel = []; nvidia = []; amd = [ inputs.pkgs.driversi686Linux.amdvlk ]; };
+              in builtins.concatLists (builtins.map (gpu: packages.${gpu}) gpus);
          };
          nvidia = inputs.lib.mkIf (builtins.elem "nvidia" gpus)
          {
@@ -67,7 +72,12 @@ inputs:
            open = inputs.lib.mkIf (gpu.nvidia.driver == "beta") true;
          };
        };
-        boot.blacklistedKernelModules = [ "nouveau" ];
+        boot =
+        {
+          kernelParams = inputs.lib.mkIf (builtins.elem "amd" gpus)
+            [ "radeon.cik_support=0" "amdgpu.cik_support=1" "radeon.si_support=0" "amdgpu.si_support=1" ];
+          blacklistedKernelModules = [ "nouveau" ];
+        };
        environment.variables.VDPAU_DRIVER = inputs.lib.mkIf (builtins.elem "intel" gpus) "va_gl";
        services.xserver.videoDrivers =
          let driver = { intel = "modesetting"; amd = "amdgpu"; nvidia = "nvidia"; };
@@ -89,15 +99,5 @@ inputs:
        powerManagement.finegrained = inputs.lib.mkIf (gpu.nvidia.prime.mode == "offload") true;
      };}
    )
-    # amdgpu
-    (
-      inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
-      {
-        opencl.enable = true;
-        legacySupport.enable = true;
-        initrd.enable = true;
-        amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
-      };}
-    )
  ]);
 }
--- a/modules/packages/desktop-extra.nix
+++ b/modules/packages/desktop-extra.nix
@@ -19,13 +19,13 @@ inputs:
          scrcpy weston cage openbox krita
          # media
          spotify yesplaymusic simplescreenrecorder imagemagick gimp netease-cloud-music-gtk vlc obs-studio
-          waifu2x-converter-cpp inkscape blender whalebird
+          waifu2x-converter-cpp inkscape blender
          # editor
          typora
          # news
          fluent-reader
          # nix tools
-          nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps
+          deploy-rs.deploy-rs nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps
          nix-prefetch-docker
          # instant messager
          element-desktop telegram-desktop discord fluffychat zoom-us signal-desktop slack nur-linyinfeng.wemeet
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -26,9 +26,12 @@ inputs:
        # media
        mpv nomacs
        # themes
-        catppuccin catppuccin-sddm catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
-        (catppuccin-kde.override { flavour = [ "latte" ]; }) (catppuccin-kvantum.override { variant = "latte"; })
-        localPackages.slate localPackages.blurred-wallpaper tela-circle-icon-theme
+        localPackages.win11os-kde localPackages.fluent-kde localPackages.blurred-wallpaper
+        localPackages.slate utterly-nord-plasma utterly-round-plasma-style catppuccin catppuccin-sddm
+        catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
+        (catppuccin-kde.override { flavour = [ "latte" ]; })
+        (catppuccin-gtk.override { variant = "latte"; })
+        (tela-circle-icon-theme.override { allColorVariants = true; })
        # terminal
        warp-terminal
        # development
@@ -49,6 +52,20 @@ inputs:
      {
        patches = (if (attrs ? patches) then attrs.patches else []) ++ [ ./telegram.patch ];
      });
+      kdePackages = prev.kdePackages.overrideScope (final: prev:
+      {
+        kwin = prev.kwin.overrideAttrs (prev: { patches = prev.patches ++
+        [
+          {
+            "6.0.5" = inputs.pkgs.fetchurl
+            {
+              url = "https://aur.archlinux.org/cgit/aur.git/plain/explicit-sync.patch?h=kwin-explicit-sync"
+                + "&id=b6fb7e1b8651365af426cfc7be0d03b9615fdd3a";
+              sha256 = "1zcksalmkf0mifmv0zl5awy1ch3fvfkkknxqk4mqg0vk1bbpjh2b";
+            };
+          }.${prev.version}
+        ]; });
+      });
    })];
    services.pcscd.enable = true;
  };
--- a/modules/packages/server.nix
+++ b/modules/packages/server.nix
@@ -6,7 +6,7 @@ inputs:
    [
      # basic tools
      beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq zellij ipfetch localPackages.pslist
-      fastfetch reptyr nushell duc ncdu progress
+      fastfetch reptyr nushellFull duc ncdu progress
      # lsxx
      pciutils usbutils lshw util-linux lsof dmidecode lm_sensors
      # top
--- a/modules/packages/ssh.nix
+++ b/modules/packages/ssh.nix
@@ -5,16 +5,6 @@ inputs:
    services.openssh.knownHosts =
      let servers =
      {
-        vps4 =
-        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIF7Y0tjt1XLPjqJ8HEB26W9jVfJafRQ3pv5AbPaxEc/Z";
-          hostnames = [ "vps4.chn.moe" "104.234.37.61" ];
-        };
-        "initrd.vps4" =
-        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIJkOPTFvX9f+Fn/KHOIvUgoRiJfq02T42lVGQhpMUGJq";
-          hostnames = [ "initrd.vps4.chn.moe" "104.234.37.61" ];
-        };
        vps6 =
        {
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
@@ -107,7 +97,7 @@ inputs:
        (
          (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-            [ "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
+            [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
          ++ (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; forwardX11 = true; }; })
            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" ])
@@ -125,7 +115,7 @@ inputs:
            })
            [ "wlin" "hwang" ])
        )
-        // rec {
+        // {
          xmupc1 = { host = "xmupc1"; hostname = "xmupc1.chn.moe"; port = 6007; forwardX11 = true; };
          xmupc2 = { host = "xmupc2"; hostname = "xmupc2.chn.moe"; port = 6394; forwardX11 = true; };
          nas = { host = "nas"; hostname = "office.chn.moe"; port = 5440; };
@@ -140,7 +130,6 @@ inputs:
            forwardAgent = true;
            extraOptions.AddKeysToAgent = "yes";
          };
-          "internal.jykang" = jykang // { host = "internal.jykang"; proxyJump = "wireguard.nas"; };
        };
      };
    })];
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -2,7 +2,6 @@ inputs:
 {
  config = inputs.lib.mkIf (builtins.elem "workstation" inputs.config.nixos.packages._packageSets)
  {
-    nixos.packages._packages = inputs.lib.optionals (inputs.config.nixos.system.nixpkgs.march != null)
-      (with inputs.pkgs.localPackages.vasp; [ intel nvidia vtstscripts ]);
+    nixos.packages._packages = with inputs.pkgs.localPackages.vasp; [ intel nvidia vtstscripts ];
  };
 }
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -21,7 +21,7 @@ inputs:
                ++ (builtins.attrNames vscode-extensions)
              )));
            in with extensions;
-              (with equinusocio; [ vsc-material-theme vsc-material-theme-icons ])
+              (with equinusocio; [ vsc-community-material-theme vsc-material-theme-icons ])
              ++ (with github; [ copilot copilot-chat github-vscode-theme ])
              ++ (with intellsmi; [ comment-translate deepl-translate ])
              ++ (with ms-python; [ isort python vscode-pylance ])
--- a/modules/packages/workstation.nix
+++ b/modules/packages/workstation.nix
@@ -29,7 +29,7 @@ inputs:
          # math, physics and chemistry
          (mathematica.overrideAttrs (prev: { postInstall = prev.postInstall or "" + "ln -s ${src} $out/src"; }))
          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; })
-          paraview jmol mpi
+          paraview jmol mpi localPackages.mumax
          # encryption and password management
          john crunch hashcat
          # container and vm
@@ -38,7 +38,7 @@ inputs:
          microsoft-edge tor-browser
          # news
          rssguard newsflash newsboat
-        ] ++ inputs.lib.optional (inputs.config.nixos.system.nixpkgs.march != null) localPackages.mumax;
+        ];
        _pythonPackages = [(pythonPackages: with pythonPackages;
        [
          phonopy tensorflow keras scipy scikit-learn jupyterlab autograd # localPackages.pix2tex
--- a/modules/services/fz-new-order/default.nix
+++ b/modules/services/fz-new-order/default.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.services.fz-new-order = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
  config = let inherit (inputs.config.nixos.services) fz-new-order; in inputs.lib.mkIf (fz-new-order != null)
  {
    users =
@@ -69,7 +72,7 @@ inputs:
        "Z /var/lib/fz-new-order - fz-new-order fz-new-order"
      ];
    };
-    sops = let userNum = 5; configNum = 2; in
+    sops = let userNum = 6; configNum = 2; in
    {
      templates."fz-new-order/config.json" =
      {
@@ -77,6 +80,7 @@ inputs:
        group = inputs.config.users.users."fz-new-order".group;
        content = let placeholder = inputs.config.sops.placeholder; in builtins.toJSON
        {
+          manager = placeholder."fz-new-order/manager";
          token = placeholder."fz-new-order/token";
          uids = builtins.map (j: placeholder."fz-new-order/uids/user${builtins.toString j}")
            (builtins.genList (n: n) userNum);
@@ -88,7 +92,7 @@ inputs:
        };
      };
      secrets =
-        { "fz-new-order/token" = {}; }
+        { "fz-new-order/manager" = {}; "fz-new-order/token" = {}; }
        // (builtins.listToAttrs (builtins.map
          (i: { name = "fz-new-order/uids/user${toString i}"; value = {}; })
          (builtins.genList (n: n) userNum)))
--- a/modules/services/fz-new-order/main.cpp
+++ b/modules/services/fz-new-order/main.cpp
@@ -48,7 +48,7 @@ std::string urlencode(std::string s)
 void oneshot
 (
  const std::string& username, const std::string& password, const std::string& comment,
-  const std::set<std::string>& wxuser, const std::string& token
+  const std::set<std::string>& wxuser, const std::set<std::string>& manager, const std::string& token
 )
 {
  httplib::Client fzclient("http://scmv9.fengzhansy.com:8882");
@@ -152,6 +152,16 @@ void oneshot
    for (const auto& order : order_list)
      if (!order_old.contains(order.first))
      {
+        for (const auto& user : manager)
+        {
+          auto path = fmt::format
+          (
+            "/api/send/message/?appToken={}&content={}&uid={}",
+            token, urlencode(fmt::format("push {}", order.first)), user
+          );
+          auto wxresult = wxclient.Get(path.c_str());
+        }
+
        auto body = fmt::format
        (
          "method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=ddsp_qry&nv%5B%5D=bill&nv%5B%5D={}",
@@ -238,7 +248,7 @@ int main(int argc, char** argv)
    oneshot
    (
      config["username"].asString(), config["password"].asString(), config["comment"].asString(),
-      uids, configs["token"].asString()
+      uids, { configs["manager"].asString() }, configs["token"].asString()
    );
 }

--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -19,6 +19,11 @@ inputs:
    services.gitea =
    {
      enable = true;
+      package = inputs.pkgs.gitea.overrideAttrs { src = builtins.fetchurl
+      {
+        url = "https://dl.gitea.com/gitea/1.22.0-rc1/gitea-src-1.22.0-rc1.tar.gz";
+        sha256 = "1h7kjzk7zck7j2advcxc0gsmv3qkwmhcnqi9zl7ypiffy40p6l9y";
+      };};
      lfs.enable = true;
      mailerPasswordFile = inputs.config.sops.secrets."gitea/mail".path;
      database =
--- a/modules/services/ollama.nix
+++ b/modules/services/ollama.nix
@@ -1,16 +0,0 @@
-inputs:
-{
-  options.nixos.services.ollama = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) ollama; in inputs.lib.mkIf (ollama != null)
-  {
-    services =
-    {
-      ollama.enable = true;
-      open-webui =
-        { enable = true; package = inputs.pkgs.genericPackages.open-webui; environment.WEBUI_AUTH = "False"; };
-      nextjs-ollama-llm-ui.enable = true;
-    };
-    nixos.packages._packages = [ inputs.pkgs.oterm ];
-  };
-}
--- a/modules/services/xray/disable-splice.patch
+++ b/modules/services/xray/disable-splice.patch
@@ -1,14 +1,16 @@
+diff --git a/disable-splice.patch b/disable-splice.patch
+new file mode 100644
+index 0000000..e69de29
 diff --git a/proxy/proxy.go b/proxy/proxy.go
-index db92051..54d36b4 100644
+index 6a5a179..ca71241 100644
 --- a/proxy/proxy.go
 +++ b/proxy/proxy.go
-@@ -504,7 +504,8 @@ func CopyRawConnIfExist(ctx context.Context, readerConn net.Conn, writerConn net
- 				splice = false
- 			}
- 		}
-		if splice {
-+		_ = splice
-+		if false {
- 			newError("CopyRawConn splice").WriteToLog(session.ExportIDToError(ctx))
- 			statWriter, _ := writer.(*dispatcher.SizeStatWriter)
- 			//runtime.Gosched() // necessary
+@@ -474,7 +474,7 @@ func CopyRawConnIfExist(ctx context.Context, readerConn net.Conn, writerConn net
+ 	readerConn, readCounter, _ := UnwrapRawConn(readerConn)
+ 	writerConn, _, writeCounter := UnwrapRawConn(writerConn)
+ 	reader := buf.NewReader(readerConn)
+-	if inbound := session.InboundFromContext(ctx); inbound != nil {
+	if inbound := session.InboundFromContext(ctx); false {
+ 		if tc, ok := writerConn.(*net.TCPConn); ok && readerConn != nil && writerConn != nil && (runtime.GOOS == "linux" || runtime.GOOS == "android") {
+ 			for inbound.CanSpliceCopy != 3 {
+ 				if inbound.CanSpliceCopy == 1 {
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -3,13 +3,7 @@ inputs:
  imports = inputs.localLib.findModules ./.;
  config =
  {
-    services =
-    {
-      dbus.implementation = "broker";
-      fstrim.enable = true;
-      acpid.enable = true;
-      kubo = { enable = true; autoMount = true; };
-    };
+    services = { dbus.implementation = "broker"; fstrim.enable = true; acpid.enable = true; };
    time.timeZone = "Asia/Shanghai";
    boot =
    {
--- a/modules/system/fileSystems/vps4.key
+++ b/modules/system/fileSystems/vps4.key
--- a/modules/system/gui.nix
+++ b/modules/system/gui.nix
@@ -20,9 +20,8 @@ inputs:
    {
      sessionVariables =
      {
-        GTK_USE_PORTAL = "1";
-        NIXOS_OZONE_WL = inputs.lib.mkIf gui.preferred "1";
-        KWIN_DRM_DISABLE_TRIPLE_BUFFERING = "1";
+        "GTK_USE_PORTAL" = "1";
+        "NIXOS_OZONE_WL" = inputs.lib.mkIf gui.preferred "1";
      };
      plasma6.excludePackages = inputs.lib.mkIf (!gui.preferred) [ inputs.pkgs.kdePackages.plasma-nm ];
      persistence = let inherit (inputs.config.nixos.system) impermanence; in inputs.lib.mkIf impermanence.enable
--- a/modules/system/initrd.nix
+++ b/modules/system/initrd.nix
@@ -12,29 +12,22 @@ inputs:
      };
    };
  };
-  config = let inherit (inputs.config.nixos.system) initrd; in inputs.lib.mkMerge
-  [
-    {
-      boot =
-      {
-        initrd.systemd.enable = true;
-        kernelParams = [ "boot.shell_on_fail" "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1" ];
-      };
-    }
-    (
-      inputs.lib.mkIf (initrd.sshd.enable)
-      {
-        boot =
+  config =
+    let
+      inherit (inputs.config.nixos.system) initrd;
+      inherit (inputs.lib) mkIf mkMerge;
+    in mkMerge
+    [
+      { boot.initrd.systemd.enable = true; }
+      (
+        mkIf (initrd.sshd.enable)
        {
-          initrd =
+          boot =
          {
-            network = { enable = true; ssh = { enable = true; hostKeys = initrd.sshd.hostKeys; }; };
-            # resolved does not work in initrd, causing network.target to fail
-            services.resolved.enable = false;
+            initrd.network = { enable = true; ssh = { enable = true; hostKeys = initrd.sshd.hostKeys; }; };
+            kernelParams = [ "ip=dhcp" ];
          };
-          kernelParams = [ "ip=dhcp" ];
-        };
-      }
-    )
-  ];
+        }
+      )
+    ];
 }
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -33,7 +33,7 @@ inputs:
      nix.settings =
      {
        system-features = [ "big-parallel" "nixos-test" "benchmark" ];
-        experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
+        experimental-features = [ "nix-command" "flakes" ];
        keep-failed = true;
        max-substitution-jobs = 4;
        trusted-public-keys = [ "chn:Cc+nowW1LIpe1kyXOZmNaznFDiH1glXmpb4A+WD/DTE=" ];
@@ -47,7 +47,10 @@ inputs:
      systemd.services.nix-daemon = { serviceConfig.CacheDirectory = "nix"; environment.TMPDIR = "/var/cache/nix"; };
    }
    # nix daemon use lower io/cpu priority
-    { nix = { daemonIOSchedClass = "idle"; daemonCPUSchedPolicy = "idle"; }; }
+    {
+      nix = { daemonIOSchedClass = "idle"; daemonCPUSchedPolicy = "idle"; };
+      systemd.services.nix-daemon.serviceConfig = { Slice = "-.slice"; Nice = "19"; };
+    }
    # nix channel & nix flake registry
    {
      nix =
@@ -55,6 +58,7 @@ inputs:
        registry =
        {
          nixpkgs.flake = inputs.topInputs.nixpkgs;
+          nixpkgs-unstable.flake = inputs.topInputs.nixpkgs-unstable;
          nixos.flake = inputs.topInputs.self;
        };
        nixPath = [ "nixpkgs=${inputs.topInputs.nixpkgs}" ];
@@ -64,9 +68,10 @@ inputs:
        etc =
        {
          "channels/nixpkgs".source = inputs.topInputs.nixpkgs.outPath;
+          "channels/nixpkgs-unstable".source = inputs.topInputs.nixpkgs-unstable.outPath;
          "nixos".source = inputs.topInputs.self.outPath;
        };
-        variables.COMMA_NIXPKGS_FLAKE = "nixpkgs";
+        variables.COMMA_NIXPKGS_FLAKE = "nixpkgs-unstable";
      };
    }
    # marches
--- a/modules/system/nixpkgs.nix
+++ b/modules/system/nixpkgs.nix
@@ -23,7 +23,7 @@ inputs:
      nixpkgs =
        let
          permittedInsecurePackages =
-            [ "openssl_1_1" "python2" "zotero"  "electron_27" "electron_28" ];
+            [ "openssl_1_1" "electron_19" "python2" "electron_12" "electron_24" "zotero" "electron_25" ];
          hostPlatform = if nixpkgs.march != null
            then { system = "${nixpkgs.arch}-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }
            else "${nixpkgs.arch}-linux";
@@ -40,7 +40,9 @@ inputs:
          inherit hostPlatform;
          config = cudaConfig //
          {
-            permittedInsecurePackages = map (package: inputs.pkgs.${package}.name) permittedInsecurePackages;
+            permittedInsecurePackages = map
+              (package: inputs.pkgs.${package}.name)
+              (filter (package: inputs.pkgs ? ${package}) permittedInsecurePackages);
            allowUnfree = true;
            qchem-config = { optArch = nixpkgs.march; useCuda = nixpkgs.cuda.enable; };
          }
@@ -49,8 +51,6 @@ inputs:
            oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "CORE-AVX512"; };
              in match.${nixpkgs.march} or nixpkgs.march;
            nvhpcArch = nixpkgs.march;
-            # contentAddressedByDefault = true;
-            enableCcache = true;
          });
          overlays =
          [(final: prev:
@@ -73,24 +73,23 @@ inputs:
                let
                  source =
                  {
+                    unstablePackages = "nixpkgs-unstable";
                    "pkgs-23.11" = "nixpkgs-23.11";
                    "pkgs-23.05" = "nixpkgs-23.05";
                    "pkgs-22.11" = "nixpkgs-22.11";
                    "pkgs-22.05" = "nixpkgs-22.05";
                  };
-                  permittedInsecurePackages."pkgs-23.11" = [ "electron_19" ];
                  packages = name: import inputs.topInputs.${source.${name}}
                  {
                    localSystem = hostPlatform;
                    config = cudaConfig //
                    {
                      allowUnfree = true;
-                      # contentAddressedByDefault = true;
                      permittedInsecurePackages =
                        let pkgs = inputs.topInputs.${source.${name}}.legacyPackages.${system};
                        in map
                          (package: pkgs.${package}.name)
-                          permittedInsecurePackages.${name} or [];
+                          (filter (package: pkgs ? ${package}) permittedInsecurePackages);
                    };
                  };
                in builtins.listToAttrs (map
@@ -105,8 +104,6 @@ inputs:
                  ispc = genericPackages.ispc;
                  opencolorio = prev.opencolorio.overrideAttrs { doCheck = false; };
                  redis = prev.redis.overrideAttrs { doCheck = false; };
-                  krita = final.genericPackages.krita;
-                  geos = prev.geos.overrideAttrs { doCheck = false; };
                }
              )
              // (
--- a/modules/system/security.nix
+++ b/modules/system/security.nix
@@ -15,7 +15,7 @@ inputs:
          appId = "pam://chn.moe";
          origin = "pam://chn.moe";
          # generate using: `pamu2fcfg -u chn -o pam://chn.moe -i pam://chn.moe`
-          authFile = builtins.toString (inputs.pkgs.writeText "yubikey_mappings" (builtins.concatStringsSep "\n"
+          authFile = inputs.pkgs.writeText "yubikey_mappings" (builtins.concatStringsSep "\n"
          [
            (builtins.concatStringsSep ":"
            [
@@ -28,7 +28,7 @@ inputs:
                "+presence"
              ])
            ])
-          ]));
+          ]);
        };
        yubico = { enable = true; id = "91291"; };
        loginLimits =
--- a/Show More
+++ b/Show More