update root

modules.services.docker: fix
modules.services.wechat2tg: init
2026-01-12 09:49:22 +08:00 · 2024-12-10 22:21:11 +08:00 · 2024-12-10 12:55:08 +08:00 · 2024-12-10 12:46:01 +08:00 · 2024-12-09 23:03:01 +08:00 · 2024-12-09 22:55:10 +08:00
50 changed files with 435 additions and 407 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ build
 .vscode
 .cache
 .ccls-cache
+archive
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,14 +1,13 @@
 keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &chn age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
  - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
-  - &vps4 age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
-  - &surface age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
  - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
+  - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
  - &srv1-node2 age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
@@ -19,11 +18,6 @@ creation_rules:
    - age:
      - *chn
      - *pc
-  - path_regex: devices/vps4/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *vps4
  - path_regex: devices/vps6/.*$
    key_groups:
    - age:
@@ -39,11 +33,6 @@ creation_rules:
    - age:
      - *chn
      - *nas
-  - path_regex: devices/surface/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *surface
  - path_regex: devices/xmupc1/.*$
    key_groups:
    - age:
@@ -59,6 +48,11 @@ creation_rules:
    - age:
      - *chn
      - *pi3b
+  - path_regex: devices/one/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *one
  - path_regex: devices/srv1/node0/.*$
    key_groups:
    - age:
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -0,0 +1,50 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      model = { type = "desktop"; private = true; };
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-partlabel/one-boot" = "/boot";
+            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          luks.auto."/dev/disk/by-partlabel/one-root" = { mapper = "root"; ssd = true; };
+          swap = [ "/nix/swap/swap" ];
+          resume = { device = "/dev/mapper/root"; offset = 728784; };
+          rollingRootfs = {};
+        };
+        nixpkgs.march = "tigerlake";
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
+      services =
+      {
+        snapper.enable = true;
+        xray.client.enable = true;
+        smartd.enable = true;
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
+          wireguardIp = "192.168.83.5";
+        };
+        sshd = {};
+      };
+      bugs = [ "xmunet" ];
+    };
+    boot.kernelParams = [ "acpi_osi=!" ''acpi_osi="Windows 2015"'' ];
+    security =
+    {
+      pam.services.kde.rules.auth.pass =
+        { modulePath = "pam_succeed_if.so"; args = [ "user" "=" "chn" ]; control = "sufficient"; order = 0; };
+      sudo.wheelNeedsPassword = false;
+    };
+  };
+}
--- a/devices/one/secrets.yaml
+++ b/devices/one/secrets.yaml
@@ -0,0 +1,40 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:GmfSlDQjO4aBq3u50jnFjOR9VxamYHzokUrO9IpIGuBx0j8e,iv:++O2wBUCnHDPowRgtxPQJQePXP2Cda74WXQvlKHbHNw=,tag:XDWhiXwT718RgrBw7L5yzw==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:+zy72VDj8hs1GH7E1U04WhiGq0xkIPGC8pHbAYR70OK5E6EOdkQwKA==,iv:oYNSrOH3pLhltYw2NX1d4s6jiUgMssWiIK//62i0ptQ=,tag:C5ekSVjmwSEphsTZ/DLcsg==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:/x9HJWh4Kpp5xy4TfuC/bP4Z/gMOFgAalz91cewHj1/tPxFe5R/nQA==,iv:K696zu685ydzwFMKIrqz1GiYLMKGM1dLNDWdhH4U0L8=,tag:nFwqXc7RPIYcQxVIu6GWgw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:NgA5rHB6GwqiNSx1mhxObywuiZWq5qpcNrlpk6HaD9hzQoL0j1IrrgMCqkU=,iv:ZZUlSJeQPN2/JxjhR08FdEZl3gCFuNpJ3M93C6JovHs=,tag:rCtWHOYCmgZKF1lRlIAReA==,type:str]
+github:
+    token: ENC[AES256_GCM,data:rGiseVhDBU+rNcz92QXHeqAQ4lC7l5dba8d7rGUIIoEcpBVGwGh/5w==,iv:lf4aMBAQxI140qJsMLqHpI3dKRw6HiV20cyn0WFWbT8=,tag:w1P9MrqgUAmPzVWkIFs1jg==,type:str]
+age: ENC[AES256_GCM,data:5QX7wYQpbKSX88bAWSRqi8Y3Pmwb1KZ6LYrHURs7N2VHjbXOaSM9lm1GRrUjUHQE/r2CUku3TnMphczBMb0qLxSliay7QB2W0+o=,iv:qCTpul0ESBN7NWznBR8546A+Is7x7+Su4yHDX1b+FNY=,tag:aVU7B5lygQrBh5l260jJLQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOUJWMm5xT040cEoxQit5
+            ZnhhQWVyWjlnejhzQlEvVVg3ZGVJb05iL1hjCnF5bzFTUTZFYkNQR0k5U0xmOW1t
+            TXhsRHFIeVBBSXc1UURON2M4MDlTMEUKLS0tIGdSbTdZdmdjY0dmNjkrRjd0VkhK
+            eWV6SDJqT1B2MEp1MURkV0E4S3Z0Zm8KX9lEjG4u2QRe1zH+13rbedCWl1B7vvl8
+            2iMHj1qQ4JkCeq83llEH5IuDXKYnKKXSi8l3nU/l6Aw6yx/KHDFK/g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2K3VKTVJqMTl2cWxUZHhM
+            OVg5ZjN0VGNpVXQ5M1FKZHloZ0ZnWTZ2ZWowCjJIYTlhRU8wd1JienlUTHIwWXYw
+            eFY1d2MxeStBd013VmszbTUzTkF6U2cKLS0tIDdDNXp4OTdQRjN0MGdIOS9oSldU
+            ZW5PT3VYZWhDMkZUeHViZE41eUhna2sKc8J8mJ8ge9KMb5p6Xi/vRIIXZMEj6Ih+
+            LjLKsgDfMbqNqKaQXSvC3tbvI/dDoiStyCsf4rkTY9QOkyEI80MtXg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-09T13:35:05Z"
+    mac: ENC[AES256_GCM,data:2ILRlQddIKvJubKth/y7+UndarVUv2VQNZmaSbMc/m35qY5nln6Oy32TmCASS5EX+wWXwb/8waWlniPrDQLKdB2vE8PdqQQiYbHgmUQU7bauG8jLPNag47CNhTLMd6C1xymWS42Ie56pi0eNazCXoxIApNBXGtM/ITtBjCMDBHE=,iv:6NLogRo0ibBR+gTb52yAY9l6zrrWdC97whHe0c2tV54=,tag:CNwvVwEBbckgjUG54BhXjQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -4,7 +4,7 @@ inputs:
  {
    nixos =
    {
-      model.type = "desktop";
+      model = { type = "desktop"; private = true; };
      system =
      {
        fileSystems =
@@ -38,11 +38,12 @@ inputs:
            "broadwell"
            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
            "skylake" "cascadelake"
+            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
+            "tigerlake"
            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
            "alderlake"
          ];
-          githubToken.enable = true;
        };
        nixpkgs =
          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
@@ -97,10 +98,7 @@ inputs:
              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
            ++ (builtins.map
              (name: { inherit name; value = "0.0.0.0"; })
-              [
-                "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
-                "dispatchcnglobal.yuanshen.com"
-              ])
+              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
            ++ [{ name = "4006024680.com"; value = "192.168.199.1"; }]
          );
        };
@@ -144,7 +142,7 @@ inputs:
        keyd = {};
      };
      bugs = [ "xmunet" "backlight" "amdpstate" ];
-      packages.android-studio = {};
+      packages = { android-studio = {}; mathematica = {}; };
    };
    boot.loader.grub =
    {
@@ -154,6 +152,7 @@ inputs:
        "SetupBrowser.efi" = ./bios/SetupBrowser.efi;
        "UiApp.efi" = ./bios/UiApp.efi;
        "EFI/Boot/Bootx64.efi" = ./bios/Bootx64.efi;
+        "nixos.iso" = inputs.topInputs.self.src.iso;
      };
      extraEntries = 
      ''
@@ -162,6 +161,15 @@ inputs:
          insmod chain
          chainloader @bootRoot@/EFI/Boot/Bootx64.efi
        }
+        menuentry 'Live ISO' {
+          set iso_path=@bootRoot@/nixos.iso
+          export iso_path
+          search --set=root --file "$iso_path"
+          loopback loop "$iso_path"
+          root=(loop)
+          configfile /boot/grub/loopback.cfg
+          loopback --delete loop
+        }
      '';
    };
    # 禁止鼠标等在睡眠时唤醒
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -26,6 +26,8 @@ age: ENC[AES256_GCM,data:EPjip4/tz50e+blPko9NpzDamLRO6BVy64kDnGAhUJJ/bMw6V9Of8Rz
 user:
    #ENC[AES256_GCM,data:a4mHxr7bn7BV,iv:FYQk3yv3XgxNO9CnrQefo3WqhO0Sf8Mihfp+Iw4AcWM=,tag:jebxvG+xUidghf5dOlvDYA==,type:comment]
    zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
+wechat2tg:
+    token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -50,8 +52,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-04T01:39:48Z"
-    mac: ENC[AES256_GCM,data:VkpF9zTWRLMriukAif6lfp8uy6+IcPDYUnXCQ5XLUtSstEyUoaVBjn+VVAoKkLX3MnyR6gyiYVWDDJmXrsyNoQpjRVQR0yu0p6p7sB3voGKiNxhw5qGwZj4IIXnHFWvktgWiawCiUkmSTUUHxe0XjAh7AWxjGqgAs/oyWGq/YfE=,iv:IQbJAhW/y18s57CAwRPeypQreBqQb0KkJAgIZ90QXJU=,tag:a0AB3l83j31Ex6PH9ziHRg==,type:str]
+    lastmodified: "2024-12-10T04:14:38Z"
+    mac: ENC[AES256_GCM,data:WLaeLyNQgw7DuRL/mAPRyHPR+i4YuYhf8TT5/5e6Hg14Fs2uvewHB7d2RLefRAg5IlCFerKioNuaAVDK079wCS95OjK5pAuq4rXIcodYSF7wD/yHfdsGp3ptr68rkdurcN1iSw4Xw+gkUjjq3irQYqtTQNGde4ez4O8KEe2tnHo=,iv:o+0siRY3emKZEDCuqya4A29h6F3oNSKGOjEshCXE+UM=,tag:77x58NANaAOsjxFKwuBmvQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.1
--- a/devices/surface/default.nix
+++ b/devices/surface/default.nix
@@ -1,66 +0,0 @@
-inputs:
-{
-  imports = inputs.localLib.mkModules [ inputs.topInputs.nixos-hardware.nixosModules.microsoft-surface-pro-intel ];
-  config =
-  {
-    nixos =
-    {
-      model.type = "desktop";
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            vfat."/dev/disk/by-uuid/4596-D670" = "/boot";
-            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          };
-          luks.auto =
-          {
-            "/dev/disk/by-uuid/eda0042b-ffd5-47d1-b828-4cf99d744c9f" = { mapper = "root1"; ssd = true; };
-            "/dev/disk/by-uuid/41d83848-f3dd-4b2f-946f-de1d2ae1cbd4" = { mapper = "swap"; ssd = true; };
-          };
-          swap = [ "/dev/mapper/swap" ];
-          resume = "/dev/mapper/swap";
-          rollingRootfs = {};
-        };
-        nixpkgs.march = "skylake";
-        nix = { substituters = [ "https://nix-store.chn.moe?priority=100" ]; githubToken.enable = true; };
-        kernel = { variant = "xanmod-latest"; patches = [ "surface" "hibernate-progress" ]; };
-      };
-      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
-      services =
-      {
-        snapper.enable = true;
-        sshd = {};
-        xray.client =
-        {
-          enable = true;
-          dnsmasq.hosts = builtins.listToAttrs (builtins.map
-            (name: { inherit name; value = "0.0.0.0"; })
-            [
-              "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
-              "dispatchcnglobal.yuanshen.com"
-            ]);
-        };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "j7qEeODVMH31afKUQAmKRGLuqg8Bxd0dIPbo17LHqAo=";
-          wireguardIp = "192.168.83.5";
-        };
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
-        waydroid = {};
-        docker = {};
-      };
-      bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
-    };
-    powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';
-    services.iptsd.config =
-    {
-      Touchscreen = { DisableOnPalm = true; DisableOnStylus = true; Overshoot = 0.5; };
-      Contacts = { Neutral = "Average"; NeutralValue = 10; };
-    };
-  };
-}
--- a/devices/surface/secrets.yaml
+++ b/devices/surface/secrets.yaml
@@ -1,36 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:WEBAH3PQM5ahNpH/kvTtcjcJ2GllmmRlBR2oclG6AimGenSg,iv:TMp0WTOe9fuELSZoVGenl5XSZUFoiYUBEMWMn4NFv1g=,tag:GJTE0EELcZkrnGAKLYer1g==,type:str]
-wireguard:
-    privateKey: ENC[AES256_GCM,data:P/tyZHaEAahZUBF22dJEZb6mACm/wmUunPDG0vS7SNW3sWbzxRSut0haR/g=,iv:8VMv5iotmDrYDLiszcOvJHkD8l6uE+SboPSILr6KuzU=,tag:U/FIBhvghwDTvFtUWEqr4g==,type:str]
-github:
-    token: ENC[AES256_GCM,data:SyqrpFfy+y7syReWs0Bi23651ew41Us8aqjImBTzkDanOtWQgIYC6g==,iv:H3Y/TuP3VvZv6MlRAdLOY0CiNUeoqGZRNg0s58ZSkQ8=,tag:rSf4E8Whvue/LZ+VlSqDDQ==,type:str]
-age: ENC[AES256_GCM,data:KEaMrk9eldR6oCqNqSpwhbJKj+JrN1KBkDL5p9itaszGf4tnDRidcleCQi1Ae17osYXIEh4+OxX/d6RKb9TP6JMLJe0iq6c9sC8=,iv:ztiP2Vz4AFZkd8ZG7xYlqYrV3JZYvmX07Ez6GtJ6yp0=,tag:PS8oSkkrrpgYYVfjbTtkaQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzV1pvWkVGSFg5TVAvRlhu
-            TnFnMEszcDRWWHlQanAyRkRpQWdqQkdhTzFvCjBqUG4xNFBiRnlSeTNQSmdkVkdD
-            UlVCQjRFVExuZHdrSnViajZGZ3c2dWsKLS0tIHlQYU5VeGpEQzllMmxLSnJZZzZx
-            N1R3Mkhxa0dOVlJiU0V2OEZVVzZVMFkKae3c1axl22uxh9wMygAHs6q1WA5ImOS8
-            uzKSthWSqtC7DMqgUFaaSjBYM2TN3l402syx71xVFyyAmCcGZbbJcg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSHJVRGIwQUFpVER5SWxq
-            YjJOT0lXN3dFOFpjMFlWV3JCbmZFN0hnNEJBClpQUEczK2RWTGlVTmJRbVZaUC8y
-            bEFrL1RjTTNlYVNnRVRBZlRjaTlnUEEKLS0tIE5GM01pTGFFcWVVSWEvUHE3Z08r
-            a2xybTRFUFZZN20zajZJTVNwVEpGcEEKglmFMk7z1q5IlZ+lZf9M0HtknmvcYt/P
-            2/z5e8wLN1Hy0Zsbv0yIL/NmqwxAOGJOdzz7ElJszk/Y4kUr9aRasg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-01T15:22:09Z"
-    mac: ENC[AES256_GCM,data:Br2+miNeZI41QyTXdhJ5Mdwq5no/d4kJgESwiltcRZV/Pax8R+GFeLDg/AQFoh1fLHU6bTX45SN0wnIrIeCnkoXV0U2RiT7bdtBaDrGxqnFvjMVE0VaUrj9bpagta13tahsEfI17cyUq4BqwS4BXx60RXvbvs9jZ5/dfpYunGsc=,iv:FfWYfS40XcFgF8lEYK4IHypLzz7svFxPL+WuudQm3oA=,tag:0KDBdf7w6BdcQ8Qt3k1isg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.0
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -1,44 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            btrfs =
-            {
-              "/dev/disk/by-uuid/403fe853-8648-4c16-b2b5-3dfa88aee351"."/boot" = "/boot";
-              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-            };
-          };
-          luks.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
-          swap = [ "/nix/swap/swap" ];
-          rollingRootfs = {};
-        };
-        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
-        nixpkgs.march = "znver2";
-        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
-        initrd.sshd = {};
-        networking = {};
-      };
-      services =
-      {
-        snapper.enable = true;
-        sshd = {};
-        fail2ban = {};
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
-        xray.server = { serverName = "xserver.vps4.chn.moe"; userNumber = 4; };
-      };
-    };
-  };
-}
--- a/devices/vps4/secrets.yaml
+++ b/devices/vps4/secrets.yaml
@@ -1,51 +0,0 @@
-xray-server:
-    clients:
-        #ENC[AES256_GCM,data:d7cv,iv:RHzGIDLuuKejCTQ5YlNNITkCS3VoprsqH/kHckdpAv0=,tag:3cYw7uyUmXALo3v7SiqLJA==,type:comment]
-        user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
-        #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
-        user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
-        #ENC[AES256_GCM,data:3KN/1hzeR2I=,iv:iaqJJD6iURTUlIL8e8P7fsAzJYo+y3NGZXgWmPX+4ao=,tag:e8g/JgVrMrWJamUMpiv2pQ==,type:comment]
-        user2: ENC[AES256_GCM,data:58PnLCwDayOYinsPCYPeMvuKiF7b4tZtbmEJFWEl+2Nu6HL2,iv:hSv3jCtkLm4rrm/4+ot10CBhobGwtnK5db5wR1S/XrU=,tag:SQbynYp8pDSqj4tAK6JBMQ==,type:str]
-        #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
-        user3: ENC[AES256_GCM,data:WCVr0ylGm2SHtOGulb8TD/cI2xJXrbvY1d6+STXGxf0d0izb,iv:vhNshb38AVpwKCFRwUVruCQ0SxhHrOmwQ+IoQZeUj1k=,tag:OfdIjRrTAuVZBOEXTtnrQQ==,type:str]
-    private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
-acme:
-    token: ENC[AES256_GCM,data:JBeN7SVxKGOe6er0eS7/v8YrXdv0nCK/KZc8Ygq0G7FIGu4hO662kg==,iv:rf59MgUCYlAA5h18wtdWoUyb2VPB13OPuJjz1VsI2dU=,tag:ViPrwduD8aWf8i8vmBG78A==,type:str]
-nginx:
-    detectAuth:
-        chn: ENC[AES256_GCM,data:lQHDpv8/Yl5/nycHoeTnCw==,iv:ernNxRpcTOSAllDpqRFVFg3qEw/slEEPPXDFq1AhNL0=,tag:2AVALUf9cDyOgCqI9wwgQQ==,type:str]
-        led: ENC[AES256_GCM,data:zyCiiH21,iv:iEYyNClDsCpWE2oNjt2NqQZ88xOOlMr0yycjKTPdmlw=,tag:kQfbshXfTBA5PtUAgpgCcA==,type:str]
-        chat: ENC[AES256_GCM,data:pXu0WPWmvUzvl2expDpQPqWwi1A4abg72npsaYXDXRcg6aVU0Ec+tgM2+uz2hT9rh3mNoBxadYXDc/zeOL1UCg==,iv:iln5UGGBK2s5pGS03PtolWTkx6KrnYBAWCFnI0V2Bag=,tag:EahTDoPIBkgWnp4MOoTCmw==,type:str]
-    maxmind-license: ENC[AES256_GCM,data:8OioibcXQ9IZ0OQhJ/zHSBQjfdHzkoqwUx5zR8Zq0atNw6SSf7vKrg==,iv:z6WTI2yeqP0h7EqKG114nRQpFVJlNzZspgS6gIFtpt4=,tag:a0dBt9pXJnncBiSKt9dsAQ==,type:str]
-telegram:
-    token: ENC[AES256_GCM,data:Si6yTh48HpA8OkkkvgHwtJYFhF8tW3oaQbldjwBc09QJxp9AoKgASMnZtbDZYA==,iv:GrNyZXjaZMviSjy/LGHHrYTr5PFvDkCXmT3MU4+SLpc=,tag:YifB1tKFLqsgXB/YLqYK4w==,type:str]
-    chat: ENC[AES256_GCM,data:ydPky0W4ZWqn,iv:uWQrZDz2GCxiKRaijM89Npt0fQeSNHbQzDefkZCkUAE=,tag:OJQwV/889Vp2/4wjbN41JA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNamN1TytweDd3blJsR2ZH
-            ZmlocFZjT3ZaUjlVbG1vVSt4a2s2SjJIaGtRCjRneDV6cHYwdGJOY1BDVS9DeDVC
-            cDdNbUdtSGRHNU1yZFpPc1MzRS92ME0KLS0tIFpmamNmTFYrRGRqbTFVSzBhUlNa
-            VllXdzZ3bEc3UFY0YjZRKzBUcGgyVkUKqI1ojiLbF87alAkEwyrm8wuW2fLbmj8d
-            YBIpoDCZ7AwR5uHWQAtl7BWJV1zab+rA3zvaf2BsrVA1A+RWOtYT/Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWitsSnRVSzJDZG9ZSE5I
-            bmt2NEFDanR3aFJyYVNnU1NlUldRb2RUVXhNClQrTkgzR1dPNWp3endZTUl5SmRs
-            dEtkSWk4aWJEc2hhbWlXZkxpNGhacFUKLS0tIGZNSG43R0NKYmdFMzdXbmJjSExJ
-            Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
-            1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-25T03:19:55Z"
-    mac: ENC[AES256_GCM,data:v6yb7ZYcnPw/8SqEJnSWzmlE17PenjnBH2X8HZp+kIDXzNFyNvD19FcbCBZjwyjBLvN1ZF4M9FS7Y4+CvvMrN/4JcFufcY/V1NrOd8IZisfAT5N3WuopPee4IN9WEyPVOsbFnesZo6/wJKuqlV1UR8UZxCd3/wHXob9Lkz45cBw=,iv:XKIUiRfP0lj8V/Z1HbvhBankdcAjQqM8Way6TWjJJMY=,tag:PLYsVj6BmR132oWsxEKnfg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.0
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -78,7 +78,7 @@ inputs:
        wireguard =
        {
          enable = true;
-          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
+          peers = [ "pc" "nas" "one" "vps7" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
          wireguardIp = "192.168.83.1";
          listenIp = "74.211.99.69";
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -14,7 +14,7 @@ xray-server:
        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
-        #ENC[AES256_GCM,data:PTYBkBHs16U=,iv:qr3u7OveM1CmTBIf9gZK4fTRuLCpcZCwf8jmnd1L3Co=,tag:w3O41NG7yCwCVqPGh/6SXA==,type:comment]
+        #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
@@ -91,8 +91,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-26T04:24:17Z"
-    mac: ENC[AES256_GCM,data:AXhLmyZWGD6KvMkyHqmCERE6eNE3pD5Pa/9mRBWZe4hiXL4mKTzCn5C/ODGQ1ZeQjDdP+awjJRvLRjMiYFhVlU8rKpg/f2G1gDr4cIbr61sCdzXKX8wFW0G7bJWxxpAC4X59+u9EJ3sNcyf7bJrMdkTzTYpgXh29mtl2bprcdJQ=,iv:pK4hYexcWng3GwOmWGqgyMsmATnXgcwR3NH4UxCwpvE=,tag:zpv64JWoXc5cDCukDuW51g==,type:str]
+    lastmodified: "2024-12-09T04:05:38Z"
+    mac: ENC[AES256_GCM,data:ViclEjB/F9dS2fdtKPlegQPdPY9GeHW6AqnBcf18RlG9V+jnyym0RgkrmOiNokbD4WZSO+o/Y//hFzSeiqINHuNs5SvoslXy23bnThrnf8pDeoowJITV3eQZgNw78qKqJxoXft4b79xetSdZasI1W4YxE/PCjdpkOtgJZ7I5oTI=,iv:se5pq320AEnRuZAA3hO7H2LarCJwnK2sTmZU+s4DYBg=,tag:g4aS5C8PWj+mzbSSK61Z3g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.1
--- a/flake.lock
+++ b/flake.lock
@@ -641,22 +641,6 @@
        "type": "github"
      }
    },
-    "linux-surface": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1729447945,
-        "narHash": "sha256-DmYbfi7scxWDHlqZA7ZidCnpMexC34+T4DA7yTs5GAI=",
-        "owner": "linux-surface",
-        "repo": "linux-surface",
-        "rev": "260b202ade51ae01f4bf5f4a5516559bd5f04973",
-        "type": "github"
-      },
-      "original": {
-        "owner": "linux-surface",
-        "repo": "linux-surface",
-        "type": "github"
-      }
-    },
    "lmod": {
      "flake": false,
      "locked": {
@@ -877,21 +861,6 @@
        "type": "github"
      }
    },
-    "nixos-hardware": {
-      "locked": {
-        "lastModified": 1732536142,
-        "narHash": "sha256-DlwQrOBZET55+tOy2eO3DdAmH9B5xSQzj0TcuWClyF8=",
-        "owner": "CHN-beta",
-        "repo": "nixos-hardware",
-        "rev": "20d99c009ced76a49be02d7ba709b2ce5378c806",
-        "type": "github"
-      },
-      "original": {
-        "owner": "CHN-beta",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
    "nixos-stable": {
      "locked": {
        "lastModified": 1720535198,
@@ -926,11 +895,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1732698814,
-        "narHash": "sha256-YY5C05PuviuPbNwNvgE31B4vCY0frFVDaKkJJOPeVUk=",
+        "lastModified": 1733112343,
+        "narHash": "sha256-m3lTc9Ox5dSk4qh21KYHdTM8XawO3Aw1Vo8amzQdYOs=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "118675e11354b79593944bbd2a14f752bee02695",
+        "rev": "14db57c1be0752022482dabbc6229a7a10ccd6c5",
        "type": "github"
      },
      "original": {
@@ -958,11 +927,11 @@
    },
    "nixpkgs-23.11": {
      "locked": {
-        "lastModified": 1716265408,
-        "narHash": "sha256-i5aFF2iw707QrRvLNiLG936p3GXXulDMTKSknhBGwYI=",
+        "lastModified": 1733710340,
+        "narHash": "sha256-+USCPTSnxB1Mx5Klyh6RNhWhce3YsPY+CjNLs6mOD5A=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "c64afe35ab605d20caf19e4bff3ff816b1944c24",
+        "rev": "291b26c472d9f4b2840fd625eec6c49c3023deac",
        "type": "github"
      },
      "original": {
@@ -1154,22 +1123,6 @@
        "type": "github"
      }
    },
-    "pentapy": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1712784869,
-        "narHash": "sha256-HRXl8GfNH7CatEDtbkLA985IaDYvb4sH0h/cejlnLQ4=",
-        "owner": "GeoStat-Framework",
-        "repo": "pentapy",
-        "rev": "e78f674dc0d3e1af652616b5d922c88166f76e11",
-        "type": "github"
-      },
-      "original": {
-        "owner": "GeoStat-Framework",
-        "repo": "pentapy",
-        "type": "github"
-      }
-    },
    "plasma-manager": {
      "inputs": {
        "home-manager": [
@@ -1314,7 +1267,6 @@
        "home-manager": "home-manager",
        "impermanence": "impermanence",
        "lepton": "lepton",
-        "linux-surface": "linux-surface",
        "lmod": "lmod",
        "matplotplusplus": "matplotplusplus",
        "misskey": "misskey",
@@ -1324,7 +1276,6 @@
        "nix-flatpak": "nix-flatpak",
        "nix-index-database": "nix-index-database",
        "nix-vscode-extensions": "nix-vscode-extensions",
-        "nixos-hardware": "nixos-hardware",
        "nixos-wallpaper": "nixos-wallpaper",
        "nixpkgs": "nixpkgs",
        "nixpkgs-23.05": "nixpkgs-23.05",
@@ -1333,7 +1284,6 @@
        "nur-linyinfeng": "nur-linyinfeng",
        "nur-xddxdd": "nur-xddxdd",
        "openxlsx": "openxlsx",
-        "pentapy": "pentapy",
        "plasma-manager": "plasma-manager",
        "pocketfft": "pocketfft",
        "poetry2nix": "poetry2nix",
@@ -1679,11 +1629,11 @@
    "ufo": {
      "flake": false,
      "locked": {
-        "lastModified": 1732177086,
-        "narHash": "sha256-zmrzTQGXkR54igJUhYp0pFqS2RdV69Wi/wgyFME/K+E=",
+        "lastModified": 1733296869,
+        "narHash": "sha256-CBXaEPfXe2ENpZdm97Scr5ZOLpI1czoa8L8N3K8ITVU=",
        "ref": "refs/heads/main",
-        "rev": "28e4d29f2c70d1f3b80a092b75b81a4793455980",
-        "revCount": 65,
+        "rev": "d584951fd71867f37aca6ba50e276591ce7d3451",
+        "revCount": 74,
        "type": "git",
        "url": "https://git.chn.moe/chn/ufo.git"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -19,7 +19,6 @@
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
-    nixos-hardware.url = "github:CHN-beta/nixos-hardware";
    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-flatpak.url = "github:gmodena/nix-flatpak";
    chaotic =
@@ -48,7 +47,6 @@
    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
-    linux-surface = { url = "github:linux-surface/linux-surface"; flake = false; };
    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
    lmod = { url = "github:TACC/Lmod"; flake = false; };
    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
@@ -68,7 +66,6 @@
    ufo = { url = "git+https://git.chn.moe/chn/ufo.git"; flake = false; };
    highfive = { url = "git+https://github.com/CHN-beta/HighFive?submodules=1"; flake = false; };
    stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
-    pentapy = { url = "github:GeoStat-Framework/pentapy"; flake = false; };
  };

  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
@@ -76,11 +73,7 @@
    packages.x86_64-linux = import ./flake/packages.nix { inherit inputs localLib; };
    nixosConfigurations = import ./flake/nixos.nix { inherit inputs localLib; };
    overlays.default = final: prev:
-    {
-      localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; });
-      pythonPackagesExtensions = prev.pythonPackagesExtensions ++
-        (final: prev: import ./packages/python { inherit localLib; pkgs = final; topInputs = inputs; });
-    };
+      { localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; }); };
    config = { archive = false; branch = "production"; };
    devShells.x86_64-linux = import ./flake/dev.nix { inherit inputs; };
    src = import ./flake/src.nix { inherit inputs; };
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -23,7 +23,7 @@ builtins.listToAttrs
        ];
      };
    })
-    [ "nas" "pc" "pi3b" "surface" "vps4" "vps6" "vps7" "xmupc1" "xmupc2" ])
+    [ "nas" "pc" "pi3b" "vps6" "vps7" "xmupc1" "xmupc2" "one" ])
  ++ (builtins.map
    (node:
    {
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -1,4 +1,10 @@
 { inputs }: let inherit (inputs.self.packages.x86_64-linux) pkgs; in
 {
  git-lfs-transfer = "sha256-V2cnWCyzxwxlOXXTB8Kz4X4VHvu0H/SqHBzPFwlp73o=";
+  iso = pkgs.fetchurl
+  {
+    url = "https://releases.nixos.org/nixos/24.11/nixos-24.11beta709057.0c582677378f"
+      + "/nixos-plasma6-24.11beta709057.0c582677378f-x86_64-linux.iso";
+    sha256 = "000wmfn6k5awqwsx9qldhdgahv4k09w4yzmvf0djs51qjdpha082";
+  };
 }
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -4,8 +4,7 @@ inputs:
  {
    hostname = mkOption { type = types.nonEmptyStr; };
    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
-    # not implemented yet
-    # private = mkOption { type = types.bool; };
+    private = mkOption { type = types.bool; default = false; };
    cluster = mkOption
    {
      type = types.nullOr (types.submodule { options =
--- a/modules/packages/default.nix
+++ b/modules/packages/default.nix
@@ -12,18 +12,22 @@ inputs:
    _packages = mkOption { type = types.listOf types.unspecified; default = []; };
    _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
    _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
+    _pythonEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+    _vscodeEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
  };
  config =
  {
    environment.systemPackages = with inputs.config.nixos.packages.packages;
      (inputs.lib.lists.subtractLists excludePackages (_packages ++ extraPackages))
      ++ [
-        (inputs.pkgs.python3.withPackages (pythonPackages:
-          inputs.lib.lists.subtractLists
-            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-              excludePythonPackages))
-            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-              (_pythonPackages ++ extraPythonPackages)))))
+        (
+          (inputs.pkgs.python3.withPackages (pythonPackages:
+            inputs.lib.lists.subtractLists
+              (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+                excludePythonPackages))
+              (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+                (_pythonPackages ++ extraPythonPackages)))))
+          .override (prev: { makeWrapperArgs = prev.makeWrapperArgs or [] ++ _pythonEnvFlags; }))
        (inputs.pkgs.writeTextDir "share/prebuild-packages"
          (builtins.concatStringsSep "\n" (builtins.map builtins.toString
            (inputs.lib.lists.subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages)))))
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -52,7 +52,7 @@ inputs:
          # download
          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
          # editor
-          typora # appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq
          # news
          fluent-reader rssguard newsflash newsboat
          # nix tools
@@ -65,14 +65,14 @@ inputs:
          google-chrome tor-browser microsoft-edge
          # office
          crow-translate zotero pandoc libreoffice-qt texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply
+          ydict texstudio panoply pspp
          # matplot++ needs old gnuplot
          inputs.pkgs."pkgs-23.11".gnuplot
          # math, physics and chemistry
-          octaveFull root ovito localPackages.vesta localPackages.v-sim jmol mpi localPackages.ufo
-          (mathematica.overrideAttrs (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; }))
+          octaveFull ovito localPackages.vesta localPackages.v-sim jmol mpi geogebra6 localPackages.ufo
          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14;
-            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; }) 
+            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; })
+          inputs.pkgs."pkgs-23.11".hdfview
          # virtualization
          virt-viewer bottles wineWowPackages.stagingFull genymotion playonlinux
          # media
--- a/modules/packages/mathematica.nix
+++ b/modules/packages/mathematica.nix
@@ -0,0 +1,13 @@
+inputs:
+{
+  options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
+  {
+    nixos.packages.packages._packages = [ (inputs.pkgs.mathematica.overrideAttrs
+      (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; })) ];
+  };
+}
--- a/modules/packages/root.nix
+++ b/modules/packages/root.nix
@@ -0,0 +1,40 @@
+inputs:
+{
+  options.nixos.packages.root = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.packages) root; in inputs.lib.mkIf (root != null)
+  {
+    nixos.packages.packages =
+      let
+        root = inputs.pkgs.root.overrideAttrs rec
+        {
+          version = "6.34.00-rc1";
+          src = inputs.pkgs.fetchurl
+          {
+            url = "https://root.cern/download/root_v${version}.source.tar.gz";
+            sha256 = "1fx6nyv3drcb16a36np7h3vmjlm937j6y9vxkv0sny0grrxcj9lw";
+          };
+          patches = [];
+        };
+        jupyterPath = inputs.pkgs.jupyter-kernel.create { definitions.root = rec
+        {
+          displayName = "ROOT";
+          language = "c++";
+          argv = [ "/run/current-system/sw/bin/python3" "-m" "JupyROOT.kernel.rootkernel" "-f" "{connection_file}" ];
+          logo64 = "${root}/etc/root/notebook/kernels/root/logo-64x64.png";
+          logo32 = inputs.pkgs.runCommand "logo-32x32.png" {}
+            "${inputs.pkgs.imagemagick}/bin/convert ${logo64} -resize 32x32 $out";
+        };};
+      in
+      {
+        _packages = [ root ];
+        _pythonPackages = [(pythonPackages: with pythonPackages; [ metakernel notebook ])];
+        _pythonEnvFlags =
+        [
+          "--prefix JUPYTER_PATH : ${jupyterPath}"
+          "--suffix NIX_PYTHONPATH : ${root}/lib"
+        ];
+        _vscodeEnvFlags = [ "--prefix JUPYTER_PATH : ${jupyterPath}" ];
+      };
+  };
+}
--- a/modules/packages/server.nix
+++ b/modules/packages/server.nix
@@ -36,7 +36,7 @@ inputs:
        # development
        gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
        # stupid things
-        toilet lolcat localPackages.stickerpicker
+        toilet lolcat localPackages.stickerpicker graph-easy
        # office
        pdfgrep ffmpeg-full # todo-txt-cli 
      ]
--- a/modules/packages/ssh.nix
+++ b/modules/packages/ssh.nix
@@ -7,16 +7,6 @@ inputs:
    services.openssh.knownHosts =
      let servers =
      {
-        vps4 =
-        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIF7Y0tjt1XLPjqJ8HEB26W9jVfJafRQ3pv5AbPaxEc/Z";
-          hostnames = [ "vps4.chn.moe" "104.234.37.61" ];
-        };
-        "initrd.vps4" =
-        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIJkOPTFvX9f+Fn/KHOIvUgoRiJfq02T42lVGQhpMUGJq";
-          hostnames = [ "initrd.vps4.chn.moe" "104.234.37.61" ];
-        };
        vps6 =
        {
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
@@ -47,15 +37,15 @@ inputs:
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
          hostnames = [ "initrd.nas.chn.moe" "192.168.1.2" ];
        };
-        surface =
+        one =
        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIFdm3DcfHdcLP0oSpVrWwIZ/b9lZuakBSPwCFz2BdTJ7";
-          hostnames = [ "192.168.1.4" "wireguard.surface.chn.moe" "192.168.83.5" ];
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIC5i2Z/vK0D5DBRg3WBzS2ejM0U+w3ZPDJRJySdPcJ5d";
+          hostnames = [ "wireguard.one.chn.moe" "192.168.1.4" "192.168.83.5" ];
        };
        pc =
        {
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
-          hostnames = [ "wireguard.pc.chn.moe" "[office.chn.moe]:3673" "192.168.1.105" "192.168.83.3" ];
+          hostnames = [ "wireguard.pc.chn.moe" "[office.chn.moe]:3673" "192.168.1.3" "192.168.83.3" ];
        };
        hpc =
        {
@@ -131,10 +121,10 @@ inputs:
        (
          (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-            [ "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
+            [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" "wireguard.one" ])
          ++ (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; forwardX11 = true; }; })
-            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
+            [ "wireguard.pc" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
          ++ (builtins.map
            (host:
            {
@@ -154,7 +144,7 @@ inputs:
          xmupc2 = { host = "xmupc2"; hostname = "xmupc2.chn.moe"; port = 6394; forwardX11 = true; };
          nas = { host = "nas"; hostname = "192.168.1.2"; forwardX11 = true; };
          pc = { host = "pc"; hostname = "192.168.1.3"; forwardX11 = true; };
-          surface = { host = "surface"; hostname = "192.168.1.4"; forwardX11 = true; };
+          one = { host = "one"; hostname = "192.168.1.4"; forwardX11 = true; };
          gitea = { host = "gitea"; hostname = "ssh.git.chn.moe"; };
          jykang =
          {
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -18,12 +18,15 @@ inputs:
              (set:
              {
                name = set;
-                value = nix-vscode-extensions.vscode-marketplace.${set} // vscode-extensions.${set} or {};
+                value = vscode-extensions.${set} or {}
+                  // nix-vscode-extensions.vscode-marketplace.${set}
+                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {};
              })
              (inputs.lib.unique
              (
-                (builtins.attrNames nix-vscode-extensions.vscode-marketplace)
-                ++ (builtins.attrNames vscode-extensions)
+                (builtins.attrNames vscode-extensions)
+                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace)
+                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace-release)
              )));
            in with extensions;
              (with github; [ copilot github-vscode-theme ])
@@ -53,8 +56,10 @@ inputs:
                pkief.material-icon-theme
              ]
              # jupyter
-              ++ (with ms-toolsai;
+              # TODO: use last release
+              ++ (with vscode-extensions.ms-toolsai;
                [ jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow ]);
+          extraFlags = builtins.concatStringsSep " " inputs.config.nixos.packages.packages._vscodeEnvFlags;
        }
      )];
    };
--- a/modules/services/docker.nix
+++ b/modules/services/docker.nix
@@ -7,19 +7,21 @@ inputs:
    (
      inputs.lib.mkIf (docker != null)
      {
-        # system-wide docker is not needed
-        # virtualisation.docker.enable = true;
-        virtualisation.docker.rootless =
+        virtualisation.docker =
        {
          enable = true;
-          setSocketVariable = true;
-          daemon.settings =
+          rootless =
          {
-            features.buildkit = true;
-            # dns 127.0.0.1 make docker not work
-            dns = [ "1.1.1.1" ];
-            # prevent create btrfs subvol
-            storage-driver = "overlay2";
+            enable = true;
+            setSocketVariable = true;
+            daemon.settings =
+            {
+              features.buildkit = true;
+              # dns 127.0.0.1 make docker not work
+              dns = [ "1.1.1.1" ];
+              # prevent create btrfs subvol
+              storage-driver = "overlay2";
+            };
          };
        };
      }
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -16,7 +16,7 @@ inputs:
      hostName = nextcloud.hostname;
      appstoreEnable = false;
      https = true;
-      package = inputs.pkgs.nextcloud29;
+      package = inputs.pkgs.nextcloud30;
      maxUploadSize = "10G";
      config =
      {
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -250,6 +250,9 @@ inputs:
              # nginx will try to redirect https://blog.chn.moe/docs to https://blog.chn.moe:3068/docs/ in default
              # this make it redirect to /docs/ without hostname
              absolute_redirect off;
+              # allow realip module to set ip
+              set_real_ip_from 0.0.0.0/0;
+              real_ip_header proxy_protocol;
            '';
            proxyTimeout = "1d";
            recommendedZstdSettings = true;
--- a/modules/services/wechat2tg.nix
+++ b/modules/services/wechat2tg.nix
@@ -0,0 +1,48 @@
+inputs:
+{
+  options.nixos.services.wechat2tg = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) wechat2tg; in inputs.lib.mkIf (wechat2tg != null)
+  {
+    virtualisation.oci-containers.containers.wechat2tg =
+    {
+      image = "finalpi/wechat2tg:v1.3.3";
+      imageFile = inputs.pkgs.dockerTools.pullImage
+      {
+        imageName = "finalpi/wechat2tg";
+        imageDigest = "sha256:48e3aff3f501847f063318b41ca34af7d83278847d2eee40d7ffbf439ee4c194";
+        sha256 = "04hq577d981mdfz0xwklhj9ifgnpbv91d6zkf37awfrbsiqfkrr6";
+        finalImageName = "finalpi/wechat2tg";
+        finalImageTag = "v1.3.3";
+      };
+      volumes = [ "wechat2tg-config:/app/storage" "wechat2tg-files:/app/save-files" ];
+      environmentFiles = [ inputs.config.sops.templates."wechat2tg/env".path ];
+    };
+    sops =
+    {
+      templates."wechat2tg/env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        BOT_TOKEN=${placeholder."wechat2tg/token"}
+        # PROXY_HOST: ""
+        # PROXY_PORT: ""
+        # Proxy type: socks5, http, https
+        # PROXY_PROTOCOL: 'socks5'
+        # Optional username and password
+        # PROXY_USERNAME: ""
+        # PROXY_PASSWORD: ""
+        # API_ID: ""
+        # API_HASH: ""
+        ROOM_MESSAGE='<i>🌐#[topic]</i> ---- <b>👤#[(alias)] #[name]: </b>'
+        OFFICIAL_MESSAGE='<b>📣#[name]: </b>'
+        CONTACT_MESSAGE='<b>👤#[alias_first]: </b>'
+        ROOM_MESSAGE_GROUP='<b>👤#[(alias)] #[name]: </b>'
+        OFFICIAL_MESSAGE_GROUP='<b>📣#[name]: </b>'
+        CONTACT_MESSAGE_GROUP='<b>👤#[alias_first]: </b>'
+        CREATE_ROOM_NAME='#[topic]'
+        CREATE_CONTACT_NAME='#[alias]#[[name]]'
+        MESSAGE_DISPLAY='#[identity]#[br]#[body]'
+      '';
+      secrets."wechat2tg/token" = {};
+    };
+  };
+}
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -17,7 +17,7 @@ inputs:
      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
      # consoleLogLevel = 7;
    };
-    hardware = { enableAllFirmware = true; bluetooth.enable = true; };
+    hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
    environment =
    {
      sessionVariables = rec
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -4,7 +4,8 @@ inputs:
  {
    variant = mkOption
    {
-      type = types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lto" "cachyos-server" "zen" ];
+      type = types.nullOr (types.enum
+        [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lto" "cachyos-server" "zen" ]);
      default = "xanmod-lts";
    };
    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
@@ -38,7 +39,7 @@ inputs:
        extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
        extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
        kernelParams = [ "delayacct" ];
-        kernelPackages =
+        kernelPackages = inputs.lib.mkIf (kernel.variant != null)
        {
          nixos = inputs.pkgs.linuxPackages;
          xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
@@ -73,45 +74,6 @@ inputs:
                  HZ = inputs.lib.mkForce (freeform "1000");
                };
              }];
-              surface =
-                let
-                  version =
-                    let versionArray = builtins.splitVersion inputs.config.boot.kernelPackages.kernel.version;
-                    in "${builtins.elemAt versionArray 0}.${builtins.elemAt versionArray 1}";
-                  kernelPatches = builtins.map
-                    (file:
-                    {
-                      name = "surface-${file.name}";
-                      patch = "${inputs.topInputs.linux-surface}/patches/${version}/${file.name}";
-                    })
-                    (builtins.filter
-                      (file: file.value == "regular")
-                      (inputs.localLib.attrsToList (builtins.readDir
-                        "${inputs.topInputs.linux-surface}/patches/${version}")));
-                  kernelConfig = builtins.removeAttrs
-                    (builtins.listToAttrs (builtins.concatLists (builtins.map
-                      (configString:
-                        if builtins.match "CONFIG_.*=." configString == [] then
-                        (
-                          let match = builtins.match "CONFIG_(.*)=(.)" configString; in with inputs.lib.kernel;
-                          [{
-                            name = builtins.elemAt match 0;
-                            value = { m = module; y = yes; }.${builtins.elemAt match 1};
-                          }]
-                        )
-                        else if builtins.match "# CONFIG_.* is not set" configString == [] then
-                        [{
-                          name = builtins.elemAt (builtins.match "# CONFIG_(.*) is not set" configString) 0;
-                          value = inputs.lib.kernel.unset;
-                        }]
-                        else if builtins.match "#.*" configString == [] then []
-                        else if configString == "" then []
-                        else throw "could not parse: ${configString}"
-                      )
-                      (inputs.lib.strings.splitString "\n"
-                        (builtins.readFile "${inputs.topInputs.linux-surface}/configs/surface-${version}.config")))))
-                    [ "VIDEO_IPU3_IMGU" ];
-                in kernelPatches ++ [{ name = "surface-config"; patch = null; extraStructuredConfig = kernelConfig; }];
              hibernate-progress =
              [{
                name = "hibernate-progress";
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -22,7 +22,7 @@ inputs:
        hosts = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
      };
    };
-    githubToken.enable = mkOption { type = types.bool; default = false; };
+    githubToken.enable = mkOption { type = types.bool; default = inputs.config.nixos.model.private; };
  };
  config = let inherit (inputs.config.nixos.system) nix; in inputs.lib.mkMerge
  [
--- a/modules/user/chn/default.nix
+++ b/modules/user/chn/default.nix
@@ -32,11 +32,11 @@ inputs:
            // (builtins.listToAttrs (builtins.map
              (system: { name = system; value = { forwardAgent = true; extraOptions.AddKeysToAgent = "yes"; }; })
              [
-                "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "nas" "wireguard.nas" "pc"
-                "wireguard.surface" "xmupc1" "wireguard.xmupc1" "xmupc2" "wireguard.xmupc2"
+                "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "nas" "wireguard.nas" "pc"
+                "xmupc1" "wireguard.xmupc1" "xmupc2" "wireguard.xmupc2" "one" "wireguard.one"
              ]));
            extraConfig =
-              inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.hostname [ "pc" "surface" ])
+              inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.hostname [ "pc" ])
              ''
                IdentityFile ~/.ssh/id_rsa
                IdentityFile ~/.ssh/id_ed25519_sk
--- a/modules/user/chn/plasma/autostart.nix
+++ b/modules/user/chn/plasma/autostart.nix
@@ -49,14 +49,14 @@ inputs:
          };
          crow-translate = rec
          {
-            fileName = "io.crow_translate.CrowTranslate.desktop";
+            fileName = "org.kde.CrowTranslate.desktop";
            path = "${inputs.pkgs.crow-translate}/share/applications/${fileName}";
          };
        };
        devices =
        {
          pc = [ "nheko" "kclockd" "yakuake" "telegram" "element" "kmail" "discord" "crow-translate" ];
-          surface = [ "kclockd" "yakuake" "telegram" "element" "crow-translate" ];
+          one = [ "kclockd" "yakuake" "telegram" "element" "kmail" "crow-translate" ];
        };
      in builtins.listToAttrs (builtins.map
        (file:
--- a/modules/user/chn/plasma/wallpaper.nix
+++ b/modules/user/chn/plasma/wallpaper.nix
@@ -6,7 +6,6 @@ inputs:
      wallpaper =
      {
        pc = "${nixos-wallpaper}/pixiv-117612023.png";
-        surface = "${nixos-wallpaper}/fanbox-6682738.png";
      }.${inputs.config.nixos.model.hostname} or "${nixos-wallpaper}/pixiv-96734339-x2.png";
    in
    {
--- a/modules/user/chn/sops.nix
+++ b/modules/user/chn/sops.nix
@@ -1,10 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf
-  (
-    (builtins.elem "chn" inputs.config.nixos.user.users)
-      && (builtins.elem inputs.config.nixos.model.hostname [ "pc" "surface" ])
-  )
+  config = inputs.lib.mkIf ((builtins.elem "chn" inputs.config.nixos.user.users) && inputs.config.nixos.model.private)
  {
    home-manager.users.chn = homeInputs:
    {
--- a/packages/biu/CMakeLists.txt
+++ b/packages/biu/CMakeLists.txt
@@ -27,6 +27,7 @@ find_package(HDF5 REQUIRED)
 find_package(concurrencpp REQUIRED)
 find_path(POCKETFFT_INCLUDE_DIR pocketfft.h REQUIRED)
 find_package(yaml-cpp REQUIRED)
+find_package(glaze REQUIRED)

 add_library(biu src/common.cpp src/hdf5.cpp src/string.cpp)
 target_include_directories(biu PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
@@ -34,7 +35,7 @@ target_include_directories(biu PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_D
  ${LIBBACKTRACE_INCLUDE_DIR} ${POCKETFFT_INCLUDE_DIR})
 target_link_libraries(biu PUBLIC magic_enum::magic_enum fmt::fmt Boost::headers Boost::iostreams Boost::filesystem
  range-v3::range-v3 Eigen3::Eigen HighFive TgBot::TgBot ${LIBBACKTRACE_LIBRARY} hdf5::hdf5 concurrencpp::concurrencpp
-  yaml-cpp::yaml-cpp)
+  yaml-cpp::yaml-cpp glaze::glaze)
 target_compile_features(biu PUBLIC cxx_std_23)
 target_compile_options(biu PUBLIC -Wno-gnu-string-literal-operator-template)
 install(TARGETS biu EXPORT biuTargets LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
@@ -83,6 +84,10 @@ set_property(TARGET test-yaml PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 add_test(NAME test-yaml COMMAND test-yaml)
 add_executable(test-logger test/logger.cpp)
 target_link_libraries(test-logger PRIVATE biu)
-target_compile_definitions(test-logger PRIVATE BIU_LOGGING_DEBUG BIU_LOGGING_SOURCE_ROOT="${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_definitions(test-logger PRIVATE BIU_LOGGER_DEBUG BIU_LOGGER_SOURCE_ROOT="${CMAKE_CURRENT_SOURCE_DIR}")
 set_property(TARGET test-logger PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 add_test(NAME test-logger COMMAND test-logger)
+add_executable(test-glaze test/glaze.cpp)
+target_link_libraries(test-glaze PRIVATE biu)
+set_property(TARGET test-glaze PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
+add_test(NAME test-glaze COMMAND test-glaze)
--- a/packages/biu/biuConfig.cmake
+++ b/packages/biu/biuConfig.cmake
@@ -14,3 +14,4 @@ find_package(HDF5 REQUIRED)
 find_package(concurrencpp REQUIRED)
 find_path(POCKETFFT_INCLUDE_DIR pocketfft.h REQUIRED)
 find_package(yaml-cpp REQUIRED)
+find_package(glaze REQUIRED)
--- a/packages/biu/default.nix
+++ b/packages/biu/default.nix
@@ -1,7 +1,7 @@
 {
  stdenv, cmake, lib,
  magic-enum, fmt, boost, eigen, range-v3, nameof, zpp-bits, highfive, tgbot-cpp, libbacktrace, hdf5, concurrencpp,
-  pocketfft, yaml-cpp
+  pocketfft, yaml-cpp, glaze
 }: stdenv.mkDerivation rec
 {
  name = "biu";
@@ -9,7 +9,7 @@
  buildInputs =
  [
    magic-enum fmt boost range-v3 nameof zpp-bits eigen highfive tgbot-cpp libbacktrace hdf5
-    concurrencpp pocketfft yaml-cpp
+    concurrencpp pocketfft yaml-cpp glaze
  ];
  propagatedBuildInputs = buildInputs;
  nativeBuildInputs = [ cmake ];
--- a/packages/biu/include/biu.hpp
+++ b/packages/biu/include/biu.hpp
@@ -15,4 +15,5 @@
 # include <biu/fft.tpp>
 # include <biu/yaml.tpp>
 # include <biu/serialize.tpp>
+# include <biu/glaze.tpp>
 # include <range/v3/all.hpp>
--- a/packages/biu/include/biu/glaze.hpp
+++ b/packages/biu/include/biu/glaze.hpp
@@ -0,0 +1,31 @@
+# pragma once
+# include <biu/eigen.hpp>
+# include <glaze/glaze.hpp>
+
+namespace glz::detail
+{
+  template <biu::EigenMatrix Matrix> struct from<JSON, Matrix>
+  {
+    template <auto Opts> static void op(Matrix& matrix, auto&&... args);
+  };
+
+  template <biu::EigenMatrix Matrix> struct to<JSON, Matrix>
+  {
+    template <auto Opts> static void op(Matrix& matrix, auto&&... args) noexcept;
+  };
+}
+
+template <typename Scalar, int Rows, int Cols, int Options, int MaxRows, int MaxCols>
+struct glz::meta<Eigen::Matrix<Scalar, Rows, Cols, Options, MaxRows, MaxCols>>
+{
+   static constexpr std::string_view name = join_v
+   <
+    chars<"Eigen::Matrix<">, name_v<Scalar>, chars<",">,
+    chars<num_to_string<Rows>::value>, chars<",">,
+    chars<num_to_string<Cols>::value>, chars<",">,
+    chars<num_to_string<Options>::value>, chars<",">,
+    chars<num_to_string<MaxRows>::value>, chars<",">,
+    chars<num_to_string<MaxCols>::value>,
+    chars<">">
+  >;
+};
--- a/packages/biu/include/biu/glaze.tpp
+++ b/packages/biu/include/biu/glaze.tpp
@@ -0,0 +1,15 @@
+# pragma once
+# include <biu/glaze.hpp>
+
+template <biu::EigenMatrix Matrix> template <auto Opts> void
+  glz::detail::from<glz::JSON, Matrix>::op(Matrix& matrix, auto&&... args)
+{
+  decltype(matrix | biu::fromEigen) std_matrix;
+  read<JSON>::op<Opts>(std_matrix, args...);
+  matrix = std_matrix | biu::toEigen<>;
+}
+template <biu::EigenMatrix Matrix> template <auto Opts> void
+  glz::detail::to<glz::JSON, Matrix>::op(Matrix& matrix, auto&&... args) noexcept
+{
+  write<JSON>::op<Opts>(matrix | biu::fromEigen, args...);
+}
--- a/packages/biu/include/biu/logger.tpp
+++ b/packages/biu/include/biu/logger.tpp
@@ -84,8 +84,13 @@ namespace biu
 		auto&& lock = Threads_.lock();
 		if (auto thread_id = get_thread_id(); lock->contains(thread_id)) lock.value()[thread_id]++;
 		else lock->emplace(thread_id, 1);
+		auto try_format = []<typename T>(T&& value) -> std::string
+		{
+			if constexpr (fmt::is_formattable<T, char>::value) return "{}"_f(std::forward<T>(value));
+			else return "({})"_f(nameof::nameof_full_type<T>());
+		};
 		if constexpr (sizeof...(Param) > 0)
-			debug("begin function with {{{}}}."_f(fmt::join({"{}"_f(std::forward<Param>(param))...}, ", ")));
+			debug("begin function with {{{}}}."_f(fmt::join({try_format(std::forward<Param>(param))...}, ", ")));
 		else debug("begin function.");
 	}

@@ -123,10 +128,10 @@ namespace biu
 				time,
 				get_thread_id() % std::numeric_limits<std::uint16_t>::max(),
 				Indent_,
+				message,
 				source_file.empty() ? "??"s : source_file,
 				stack[0].source_line() == 0 ? "??"s : "{}"_f(stack[0].source_line()),
-				stack[0].name(),
-				message
+				stack[0].name()
 			) << std::flush;
 # else
 			*lock->Stream << "[ {:%T} {:02x} {:02} ] {}\n"_f
--- a/packages/biu/include/biu/yaml.hpp
+++ b/packages/biu/include/biu/yaml.hpp
@@ -24,11 +24,21 @@ namespace YAML
    static Node encode(const Optional&);
    static bool decode(const Node& node, Optional&);
  };
+  template <biu::SpecializationOf<std::unique_ptr> Ptr> struct convert<Ptr>
+  {
+    static Node encode(const Ptr&);
+    static bool decode(const Node& node, Ptr&);
+  };
  template <biu::Set Set> struct convert<Set>
  {
    static Node encode(const Set&);
    static bool decode(const Node& node, Set&);
  };
+  template <biu::Enumerable Enum> struct convert<Enum>
+  {
+    static Node encode(const Enum&);
+    static bool decode(const Node& node, Enum&);
+  };
  template <typename T> struct convert
  {
    static Node encode(const T&);
--- a/packages/biu/include/biu/yaml.tpp
+++ b/packages/biu/include/biu/yaml.tpp
@@ -5,6 +5,8 @@
 # include <biu/eigen.hpp>
 # include <boost/pfr.hpp>
 # include <boost/pfr/core_name.hpp>
+# include <nameof.hpp>
+# include <magic_enum.hpp>

 namespace YAML
 {
@@ -50,6 +52,23 @@ namespace YAML
    }
    return true;
  }
+  template <biu::SpecializationOf<std::unique_ptr> Ptr> Node convert<Ptr>::encode(const Ptr& ptr)
+  {
+    if (ptr) return convert<typename Ptr::element_type>::encode(*ptr);
+    else return YAML::Node{};
+  }
+  template <biu::SpecializationOf<std::unique_ptr> Ptr> bool convert<Ptr>::decode
+    (const Node& node, Ptr& ptr)
+  {
+    if (!node.IsDefined() || node.IsNull()) ptr = nullptr;
+    else
+    {
+      auto* value = new typename Ptr::element_type;
+      if (!convert<typename Ptr::element_type>::decode(node, *value)) return false;
+      ptr.reset(value);
+    }
+    return true;
+  }
  template <biu::Set Set> Node convert<Set>::encode(const Set& set)
    { return convert<std::vector<typename Set::value_type>>::encode(set | ranges::to_vector); }
  template <biu::Set Set> bool convert<Set>::decode(const Node& node, Set& set)
@@ -59,6 +78,16 @@ namespace YAML
    set = vec | ranges::to<Set>;
    return true;
  }
+  template <biu::Enumerable Enum> Node convert<Enum>::encode(const Enum& e)
+    { return convert<std::string_view>::encode(nameof::nameof_enum(e)); }
+  template <biu::Enumerable Enum> bool convert<Enum>::decode(const Node& node, Enum& e)
+  {
+    std::string name;
+    if (!convert<std::string>::decode(node, name)) return false;
+    auto optional_value = magic_enum::enum_cast<Enum>(name);
+    if (!optional_value) return false;
+    else { e = *optional_value; return true; }
+  }
  template <typename T> Node convert<T>::encode(const T& t)
  {
    YAML::Node node;
--- a/packages/biu/test/common.cpp
+++ b/packages/biu/test/common.cpp
@@ -1,4 +1,5 @@
 # include <biu.hpp>
+# include <glaze/glaze.hpp>

 int main()
 {
--- a/packages/biu/test/glaze.cpp
+++ b/packages/biu/test/glaze.cpp
@@ -0,0 +1,20 @@
+// # include <biu.hpp>
+# include <glaze/glaze.hpp>
+# include <Eigen/Dense>
+# include <glaze/ext/eigen.hpp>
+
+struct aaa
+{
+  int a = 1;
+  double b = 2;
+  std::string c = "3";
+  Eigen::Matrix3d d = Eigen::Matrix3d::Identity();
+  bool operator==(const aaa&) const = default;
+} bbb;
+
+int main()
+{
+  auto result = glz::write_json(bbb.d).value();
+  // auto result2 = glz::read_json<aaa>(result).value();
+  // assert(bbb == result2);
+}
--- a/packages/biu/test/logger.cpp
+++ b/packages/biu/test/logger.cpp
@@ -1,5 +1,5 @@
 # include <biu.hpp>
 int main()
 {
-  biu::Logger::Guard guard;
+  biu::Logger::Guard log("test", nullptr, std::ofstream());
 }
--- a/packages/biu/test/yaml.cpp
+++ b/packages/biu/test/yaml.cpp
@@ -8,6 +8,7 @@ int main()
 a: [ 1, 2, 3 ]
 b: [ [ 1, 2, 3 ], [ 4, 5, 6 ], [ 7, 8, 9 ] ]
 c: [ 1, 2 ]
+d: null
 )";
  auto node = YAML::Load(data);
  auto a = node["a"].as<Eigen::Vector3i>();
@@ -30,12 +31,19 @@ c: [ 1, 2 ]
    Eigen::Vector3i a;
    Eigen::Matrix3i b;
    std::complex<double> c;
+    std::unique_ptr<Eigen::Matrix3d> d;
  };
  auto a3 = node.as<A>();
  assert(a3.a == a);
  assert(a3.b == b);
  assert(a3.c == c);
+  assert(a3.d == nullptr);
  auto e = node["c"].as<std::set<int>>();
  assert((e == std::set<int>{1, 2}));
  node["c"] = e;
+  std::string data2 = R"(
+a: AAA
+)";
+  enum class E { AAA, BBB, CCC };
+  auto f = YAML::Load(data2)["a"].as<E>();
 }
--- a/packages/python/default.nix
+++ b/packages/python/default.nix
--- a/packages/python/pentapy.nix
+++ b/packages/python/pentapy.nix
@@ -1,6 +0,0 @@
-{ src, buildPythonPackage, setuptools, wheel }: buildPythonPackage
-{
-  name = "penapy";
-  inherit src;
-  pyproject = true;
-}
Author	SHA1	Message	Date
chn	b7c141cec3	update root	2024-12-10 22:21:11 +08:00
chn	4e29c56e60	modules.services.docker: fix	2024-12-10 12:55:08 +08:00
chn	cf239245a8	modules.services.wechat2tg: init	2024-12-10 12:46:01 +08:00
chn	f243649c38	devices.one: disable password	2024-12-09 23:03:01 +08:00
chn	f007f86033	Revert "services.fprintd: init" This reverts commit `b3af5b20b0`.	2024-12-09 22:55:10 +08:00
chn	b3af5b20b0	services.fprintd: init	2024-12-09 22:54:54 +08:00
chn	2de65449fe	devices.one: fix	2024-12-09 22:54:22 +08:00
chn	33051ff2f0	modules.user.chn.sops: fix	2024-12-09 16:53:39 +08:00
chn	748bd5e1ff	modules.user.chn.autostart: fix	2024-12-09 16:50:40 +08:00
chn	877ba67974	modules.packages.ssh: fix pc's IP address	2024-12-09 16:45:56 +08:00
chn	5be51a3dfd	devices.one: enable sshd	2024-12-09 16:08:49 +08:00
chn	88db84c3cf	modules.system: disable hddtemp	2024-12-09 16:05:59 +08:00
chn	2bb122cca0	devices.one: setup ssh and wireguard	2024-12-09 15:58:54 +08:00
chn	b91d4fa527	modules.system: enable hddtemp and iio sensors	2024-12-09 15:51:08 +08:00
chn	528b3d8ffc	devices.one: install	2024-12-09 13:41:59 +08:00
chn	e28e554ea9	fix libpsl in nixpkgs-23.11	2024-12-09 10:15:10 +08:00
chn	1d45a3d544	devices.one: init	2024-12-07 15:37:56 +08:00
chn	a229ec031c	modules.packages.desktop: add pspp	2024-12-07 14:01:24 +08:00
chn	e65d7854ad	devices.pc: enable tigerlake support	2024-12-06 21:35:32 +08:00
chn	6e4123f294	update ufo	2024-12-05 07:12:15 +08:00
chn	454792d0c0	packages.biu: yaml support enum	2024-12-04 14:10:19 +08:00
chn	78b5bc8504	modules.packages.server: add graph-easy	2024-12-04 12:36:18 +08:00
chn	63050aa2f1	modules.services.nginx: fix	2024-12-02 23:35:22 +08:00
chn	8f1225f6c7	modules.packages: fix vscode	2024-12-02 18:18:49 +08:00
chn	c22bc23c79	packages.biu: fix logger	2024-12-02 16:36:11 +08:00
chn	cace73c340	packages.biu: fix debug log	2024-12-02 15:58:27 +08:00
chn	063d5d3f15	packages.biu: partially implement glaze	2024-12-02 13:30:43 +08:00
chn	22737dedbd	modules.services.nextcloud: update to 30	2024-12-02 11:35:05 +08:00
chn	0030a7f35c	devices.vps4: drop	2024-12-02 11:22:50 +08:00
chn	5102ee5878	packages.biu: add support for std::unique_ptr	2024-12-02 11:19:20 +08:00
chn	1e1eb52c22	modules.packages.desktop: add some package	2024-12-01 16:05:15 +08:00
chn	a95a4ea675	modules.packages.desktop: add geogebra hdfview	2024-12-01 14:07:14 +08:00
chn	6cdb04407c	fix genshin	2024-11-30 23:54:45 +08:00
chn	a54dd066ed	modules.packages.root: init	2024-11-30 21:23:10 +08:00
chn	4f3c571ea9	devices.pc: add iso boot option	2024-11-30 17:45:19 +08:00
chn	13f6b9da81	devices.surface: remove	2024-11-29 21:36:02 +08:00
chn	28ccf400d5	devices.surface: fix	2024-11-29 16:19:22 +08:00
chn	78bed7c2ba	Revert "downgrade iptsd" This reverts commit `cfdfb7d078`.	2024-11-29 16:19:00 +08:00
chn	cfdfb7d078	downgrade iptsd	2024-11-29 15:27:22 +08:00
chn	5841eae211	devices.surface: fix	2024-11-29 15:07:52 +08:00
chn	4c95017b99	modules.system.kernel: fix	2024-11-29 14:29:50 +08:00
chn	394a3a60c0	devices.surface: use nixos kernel	2024-11-29 14:16:48 +08:00
chn	eaf74c6f3b	modules.system.kernel: allow null variant	2024-11-29 13:16:28 +08:00
chn	2423a0b68f	devices.surface: use xanmod-lts	2024-11-29 13:06:36 +08:00
chn	319153a57e	modules.packages.mathematica: init	2024-11-29 12:44:17 +08:00