暂存

2026-01-12 09:49:22 +08:00 · 2024-11-28 22:15:03 +08:00
50 changed files with 407 additions and 435 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,3 @@ build
 .vscode
 .cache
 .ccls-cache
-archive
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,13 +1,14 @@
 keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &chn age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
  - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
+  - &vps4 age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
+  - &surface age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
  - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-  - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
  - &srv1-node2 age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
@@ -18,6 +19,11 @@ creation_rules:
    - age:
      - *chn
      - *pc
+  - path_regex: devices/vps4/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *vps4
  - path_regex: devices/vps6/.*$
    key_groups:
    - age:
@@ -33,6 +39,11 @@ creation_rules:
    - age:
      - *chn
      - *nas
+  - path_regex: devices/surface/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *surface
  - path_regex: devices/xmupc1/.*$
    key_groups:
    - age:
@@ -48,11 +59,6 @@ creation_rules:
    - age:
      - *chn
      - *pi3b
-  - path_regex: devices/one/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *one
  - path_regex: devices/srv1/node0/.*$
    key_groups:
    - age:
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -1,50 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      model = { type = "desktop"; private = true; };
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            vfat."/dev/disk/by-partlabel/one-boot" = "/boot";
-            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          };
-          luks.auto."/dev/disk/by-partlabel/one-root" = { mapper = "root"; ssd = true; };
-          swap = [ "/nix/swap/swap" ];
-          resume = { device = "/dev/mapper/root"; offset = 728784; };
-          rollingRootfs = {};
-        };
-        nixpkgs.march = "tigerlake";
-      };
-      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
-      services =
-      {
-        snapper.enable = true;
-        xray.client.enable = true;
-        smartd.enable = true;
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
-          wireguardIp = "192.168.83.5";
-        };
-        sshd = {};
-      };
-      bugs = [ "xmunet" ];
-    };
-    boot.kernelParams = [ "acpi_osi=!" ''acpi_osi="Windows 2015"'' ];
-    security =
-    {
-      pam.services.kde.rules.auth.pass =
-        { modulePath = "pam_succeed_if.so"; args = [ "user" "=" "chn" ]; control = "sufficient"; order = 0; };
-      sudo.wheelNeedsPassword = false;
-    };
-  };
-}
--- a/devices/one/secrets.yaml
+++ b/devices/one/secrets.yaml
@@ -1,40 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:GmfSlDQjO4aBq3u50jnFjOR9VxamYHzokUrO9IpIGuBx0j8e,iv:++O2wBUCnHDPowRgtxPQJQePXP2Cda74WXQvlKHbHNw=,tag:XDWhiXwT718RgrBw7L5yzw==,type:str]
-acme:
-    token: ENC[AES256_GCM,data:+zy72VDj8hs1GH7E1U04WhiGq0xkIPGC8pHbAYR70OK5E6EOdkQwKA==,iv:oYNSrOH3pLhltYw2NX1d4s6jiUgMssWiIK//62i0ptQ=,tag:C5ekSVjmwSEphsTZ/DLcsg==,type:str]
-nginx:
-    maxmind-license: ENC[AES256_GCM,data:/x9HJWh4Kpp5xy4TfuC/bP4Z/gMOFgAalz91cewHj1/tPxFe5R/nQA==,iv:K696zu685ydzwFMKIrqz1GiYLMKGM1dLNDWdhH4U0L8=,tag:nFwqXc7RPIYcQxVIu6GWgw==,type:str]
-wireguard:
-    privateKey: ENC[AES256_GCM,data:NgA5rHB6GwqiNSx1mhxObywuiZWq5qpcNrlpk6HaD9hzQoL0j1IrrgMCqkU=,iv:ZZUlSJeQPN2/JxjhR08FdEZl3gCFuNpJ3M93C6JovHs=,tag:rCtWHOYCmgZKF1lRlIAReA==,type:str]
-github:
-    token: ENC[AES256_GCM,data:rGiseVhDBU+rNcz92QXHeqAQ4lC7l5dba8d7rGUIIoEcpBVGwGh/5w==,iv:lf4aMBAQxI140qJsMLqHpI3dKRw6HiV20cyn0WFWbT8=,tag:w1P9MrqgUAmPzVWkIFs1jg==,type:str]
-age: ENC[AES256_GCM,data:5QX7wYQpbKSX88bAWSRqi8Y3Pmwb1KZ6LYrHURs7N2VHjbXOaSM9lm1GRrUjUHQE/r2CUku3TnMphczBMb0qLxSliay7QB2W0+o=,iv:qCTpul0ESBN7NWznBR8546A+Is7x7+Su4yHDX1b+FNY=,tag:aVU7B5lygQrBh5l260jJLQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOUJWMm5xT040cEoxQit5
-            ZnhhQWVyWjlnejhzQlEvVVg3ZGVJb05iL1hjCnF5bzFTUTZFYkNQR0k5U0xmOW1t
-            TXhsRHFIeVBBSXc1UURON2M4MDlTMEUKLS0tIGdSbTdZdmdjY0dmNjkrRjd0VkhK
-            eWV6SDJqT1B2MEp1MURkV0E4S3Z0Zm8KX9lEjG4u2QRe1zH+13rbedCWl1B7vvl8
-            2iMHj1qQ4JkCeq83llEH5IuDXKYnKKXSi8l3nU/l6Aw6yx/KHDFK/g==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2K3VKTVJqMTl2cWxUZHhM
-            OVg5ZjN0VGNpVXQ5M1FKZHloZ0ZnWTZ2ZWowCjJIYTlhRU8wd1JienlUTHIwWXYw
-            eFY1d2MxeStBd013VmszbTUzTkF6U2cKLS0tIDdDNXp4OTdQRjN0MGdIOS9oSldU
-            ZW5PT3VYZWhDMkZUeHViZE41eUhna2sKc8J8mJ8ge9KMb5p6Xi/vRIIXZMEj6Ih+
-            LjLKsgDfMbqNqKaQXSvC3tbvI/dDoiStyCsf4rkTY9QOkyEI80MtXg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-09T13:35:05Z"
-    mac: ENC[AES256_GCM,data:2ILRlQddIKvJubKth/y7+UndarVUv2VQNZmaSbMc/m35qY5nln6Oy32TmCASS5EX+wWXwb/8waWlniPrDQLKdB2vE8PdqQQiYbHgmUQU7bauG8jLPNag47CNhTLMd6C1xymWS42Ie56pi0eNazCXoxIApNBXGtM/ITtBjCMDBHE=,iv:6NLogRo0ibBR+gTb52yAY9l6zrrWdC97whHe0c2tV54=,tag:CNwvVwEBbckgjUG54BhXjQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.1
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -4,7 +4,7 @@ inputs:
  {
    nixos =
    {
-      model = { type = "desktop"; private = true; };
+      model.type = "desktop";
      system =
      {
        fileSystems =
@@ -38,12 +38,11 @@ inputs:
            "broadwell"
            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
            "skylake" "cascadelake"
-            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
-            "tigerlake"
            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
            "alderlake"
          ];
+          githubToken.enable = true;
        };
        nixpkgs =
          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
@@ -98,7 +97,10 @@ inputs:
              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
            ++ (builtins.map
              (name: { inherit name; value = "0.0.0.0"; })
-              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
+              [
+                "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
+                "dispatchcnglobal.yuanshen.com"
+              ])
            ++ [{ name = "4006024680.com"; value = "192.168.199.1"; }]
          );
        };
@@ -142,7 +144,7 @@ inputs:
        keyd = {};
      };
      bugs = [ "xmunet" "backlight" "amdpstate" ];
-      packages = { android-studio = {}; mathematica = {}; };
+      packages.android-studio = {};
    };
    boot.loader.grub =
    {
@@ -152,7 +154,6 @@ inputs:
        "SetupBrowser.efi" = ./bios/SetupBrowser.efi;
        "UiApp.efi" = ./bios/UiApp.efi;
        "EFI/Boot/Bootx64.efi" = ./bios/Bootx64.efi;
-        "nixos.iso" = inputs.topInputs.self.src.iso;
      };
      extraEntries = 
      ''
@@ -161,15 +162,6 @@ inputs:
          insmod chain
          chainloader @bootRoot@/EFI/Boot/Bootx64.efi
        }
-        menuentry 'Live ISO' {
-          set iso_path=@bootRoot@/nixos.iso
-          export iso_path
-          search --set=root --file "$iso_path"
-          loopback loop "$iso_path"
-          root=(loop)
-          configfile /boot/grub/loopback.cfg
-          loopback --delete loop
-        }
      '';
    };
    # 禁止鼠标等在睡眠时唤醒
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -26,8 +26,6 @@ age: ENC[AES256_GCM,data:EPjip4/tz50e+blPko9NpzDamLRO6BVy64kDnGAhUJJ/bMw6V9Of8Rz
 user:
    #ENC[AES256_GCM,data:a4mHxr7bn7BV,iv:FYQk3yv3XgxNO9CnrQefo3WqhO0Sf8Mihfp+Iw4AcWM=,tag:jebxvG+xUidghf5dOlvDYA==,type:comment]
    zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
-wechat2tg:
-    token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -52,8 +50,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-10T04:14:38Z"
-    mac: ENC[AES256_GCM,data:WLaeLyNQgw7DuRL/mAPRyHPR+i4YuYhf8TT5/5e6Hg14Fs2uvewHB7d2RLefRAg5IlCFerKioNuaAVDK079wCS95OjK5pAuq4rXIcodYSF7wD/yHfdsGp3ptr68rkdurcN1iSw4Xw+gkUjjq3irQYqtTQNGde4ez4O8KEe2tnHo=,iv:o+0siRY3emKZEDCuqya4A29h6F3oNSKGOjEshCXE+UM=,tag:77x58NANaAOsjxFKwuBmvQ==,type:str]
+    lastmodified: "2024-09-04T01:39:48Z"
+    mac: ENC[AES256_GCM,data:VkpF9zTWRLMriukAif6lfp8uy6+IcPDYUnXCQ5XLUtSstEyUoaVBjn+VVAoKkLX3MnyR6gyiYVWDDJmXrsyNoQpjRVQR0yu0p6p7sB3voGKiNxhw5qGwZj4IIXnHFWvktgWiawCiUkmSTUUHxe0XjAh7AWxjGqgAs/oyWGq/YfE=,iv:IQbJAhW/y18s57CAwRPeypQreBqQb0KkJAgIZ90QXJU=,tag:a0AB3l83j31Ex6PH9ziHRg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.0
--- a/devices/surface/default.nix
+++ b/devices/surface/default.nix
@@ -0,0 +1,66 @@
+inputs:
+{
+  imports = inputs.localLib.mkModules [ inputs.topInputs.nixos-hardware.nixosModules.microsoft-surface-pro-intel ];
+  config =
+  {
+    nixos =
+    {
+      model.type = "desktop";
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            vfat."/dev/disk/by-uuid/4596-D670" = "/boot";
+            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          luks.auto =
+          {
+            "/dev/disk/by-uuid/eda0042b-ffd5-47d1-b828-4cf99d744c9f" = { mapper = "root1"; ssd = true; };
+            "/dev/disk/by-uuid/41d83848-f3dd-4b2f-946f-de1d2ae1cbd4" = { mapper = "swap"; ssd = true; };
+          };
+          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
+        };
+        nixpkgs.march = "skylake";
+        nix = { substituters = [ "https://nix-store.chn.moe?priority=100" ]; githubToken.enable = true; };
+        kernel = { variant = "xanmod-latest"; patches = [ "surface" "hibernate-progress" ]; };
+      };
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        xray.client =
+        {
+          enable = true;
+          dnsmasq.hosts = builtins.listToAttrs (builtins.map
+            (name: { inherit name; value = "0.0.0.0"; })
+            [
+              "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
+              "dispatchcnglobal.yuanshen.com"
+            ]);
+        };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "j7qEeODVMH31afKUQAmKRGLuqg8Bxd0dIPbo17LHqAo=";
+          wireguardIp = "192.168.83.5";
+        };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
+        waydroid = {};
+        docker = {};
+      };
+      bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
+    };
+    powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';
+    services.iptsd.config =
+    {
+      Touchscreen = { DisableOnPalm = true; DisableOnStylus = true; Overshoot = 0.5; };
+      Contacts = { Neutral = "Average"; NeutralValue = 10; };
+    };
+  };
+}
--- a/devices/surface/secrets.yaml
+++ b/devices/surface/secrets.yaml
@@ -0,0 +1,36 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:WEBAH3PQM5ahNpH/kvTtcjcJ2GllmmRlBR2oclG6AimGenSg,iv:TMp0WTOe9fuELSZoVGenl5XSZUFoiYUBEMWMn4NFv1g=,tag:GJTE0EELcZkrnGAKLYer1g==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:P/tyZHaEAahZUBF22dJEZb6mACm/wmUunPDG0vS7SNW3sWbzxRSut0haR/g=,iv:8VMv5iotmDrYDLiszcOvJHkD8l6uE+SboPSILr6KuzU=,tag:U/FIBhvghwDTvFtUWEqr4g==,type:str]
+github:
+    token: ENC[AES256_GCM,data:SyqrpFfy+y7syReWs0Bi23651ew41Us8aqjImBTzkDanOtWQgIYC6g==,iv:H3Y/TuP3VvZv6MlRAdLOY0CiNUeoqGZRNg0s58ZSkQ8=,tag:rSf4E8Whvue/LZ+VlSqDDQ==,type:str]
+age: ENC[AES256_GCM,data:KEaMrk9eldR6oCqNqSpwhbJKj+JrN1KBkDL5p9itaszGf4tnDRidcleCQi1Ae17osYXIEh4+OxX/d6RKb9TP6JMLJe0iq6c9sC8=,iv:ztiP2Vz4AFZkd8ZG7xYlqYrV3JZYvmX07Ez6GtJ6yp0=,tag:PS8oSkkrrpgYYVfjbTtkaQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzV1pvWkVGSFg5TVAvRlhu
+            TnFnMEszcDRWWHlQanAyRkRpQWdqQkdhTzFvCjBqUG4xNFBiRnlSeTNQSmdkVkdD
+            UlVCQjRFVExuZHdrSnViajZGZ3c2dWsKLS0tIHlQYU5VeGpEQzllMmxLSnJZZzZx
+            N1R3Mkhxa0dOVlJiU0V2OEZVVzZVMFkKae3c1axl22uxh9wMygAHs6q1WA5ImOS8
+            uzKSthWSqtC7DMqgUFaaSjBYM2TN3l402syx71xVFyyAmCcGZbbJcg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ck5vzs0xqx0jplmuksrkh45xwmkm2t05m2wyq5k2w2mnkmn79fxs6tvl3l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSHJVRGIwQUFpVER5SWxq
+            YjJOT0lXN3dFOFpjMFlWV3JCbmZFN0hnNEJBClpQUEczK2RWTGlVTmJRbVZaUC8y
+            bEFrL1RjTTNlYVNnRVRBZlRjaTlnUEEKLS0tIE5GM01pTGFFcWVVSWEvUHE3Z08r
+            a2xybTRFUFZZN20zajZJTVNwVEpGcEEKglmFMk7z1q5IlZ+lZf9M0HtknmvcYt/P
+            2/z5e8wLN1Hy0Zsbv0yIL/NmqwxAOGJOdzz7ElJszk/Y4kUr9aRasg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-01T15:22:09Z"
+    mac: ENC[AES256_GCM,data:Br2+miNeZI41QyTXdhJ5Mdwq5no/d4kJgESwiltcRZV/Pax8R+GFeLDg/AQFoh1fLHU6bTX45SN0wnIrIeCnkoXV0U2RiT7bdtBaDrGxqnFvjMVE0VaUrj9bpagta13tahsEfI17cyUq4BqwS4BXx60RXvbvs9jZ5/dfpYunGsc=,iv:FfWYfS40XcFgF8lEYK4IHypLzz7svFxPL+WuudQm3oA=,tag:0KDBdf7w6BdcQ8Qt3k1isg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -0,0 +1,44 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/403fe853-8648-4c16-b2b5-3dfa88aee351"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          luks.manual =
+          {
+            enable = true;
+            devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
+            delayedMount = [ "/" ];
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
+        nixpkgs.march = "znver2";
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
+        initrd.sshd = {};
+        networking = {};
+      };
+      services =
+      {
+        snapper.enable = true;
+        sshd = {};
+        fail2ban = {};
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
+        xray.server = { serverName = "xserver.vps4.chn.moe"; userNumber = 4; };
+      };
+    };
+  };
+}
--- a/devices/vps4/secrets.yaml
+++ b/devices/vps4/secrets.yaml
@@ -0,0 +1,51 @@
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:d7cv,iv:RHzGIDLuuKejCTQ5YlNNITkCS3VoprsqH/kHckdpAv0=,tag:3cYw7uyUmXALo3v7SiqLJA==,type:comment]
+        user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
+        #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
+        user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
+        #ENC[AES256_GCM,data:3KN/1hzeR2I=,iv:iaqJJD6iURTUlIL8e8P7fsAzJYo+y3NGZXgWmPX+4ao=,tag:e8g/JgVrMrWJamUMpiv2pQ==,type:comment]
+        user2: ENC[AES256_GCM,data:58PnLCwDayOYinsPCYPeMvuKiF7b4tZtbmEJFWEl+2Nu6HL2,iv:hSv3jCtkLm4rrm/4+ot10CBhobGwtnK5db5wR1S/XrU=,tag:SQbynYp8pDSqj4tAK6JBMQ==,type:str]
+        #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
+        user3: ENC[AES256_GCM,data:WCVr0ylGm2SHtOGulb8TD/cI2xJXrbvY1d6+STXGxf0d0izb,iv:vhNshb38AVpwKCFRwUVruCQ0SxhHrOmwQ+IoQZeUj1k=,tag:OfdIjRrTAuVZBOEXTtnrQQ==,type:str]
+    private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:JBeN7SVxKGOe6er0eS7/v8YrXdv0nCK/KZc8Ygq0G7FIGu4hO662kg==,iv:rf59MgUCYlAA5h18wtdWoUyb2VPB13OPuJjz1VsI2dU=,tag:ViPrwduD8aWf8i8vmBG78A==,type:str]
+nginx:
+    detectAuth:
+        chn: ENC[AES256_GCM,data:lQHDpv8/Yl5/nycHoeTnCw==,iv:ernNxRpcTOSAllDpqRFVFg3qEw/slEEPPXDFq1AhNL0=,tag:2AVALUf9cDyOgCqI9wwgQQ==,type:str]
+        led: ENC[AES256_GCM,data:zyCiiH21,iv:iEYyNClDsCpWE2oNjt2NqQZ88xOOlMr0yycjKTPdmlw=,tag:kQfbshXfTBA5PtUAgpgCcA==,type:str]
+        chat: ENC[AES256_GCM,data:pXu0WPWmvUzvl2expDpQPqWwi1A4abg72npsaYXDXRcg6aVU0Ec+tgM2+uz2hT9rh3mNoBxadYXDc/zeOL1UCg==,iv:iln5UGGBK2s5pGS03PtolWTkx6KrnYBAWCFnI0V2Bag=,tag:EahTDoPIBkgWnp4MOoTCmw==,type:str]
+    maxmind-license: ENC[AES256_GCM,data:8OioibcXQ9IZ0OQhJ/zHSBQjfdHzkoqwUx5zR8Zq0atNw6SSf7vKrg==,iv:z6WTI2yeqP0h7EqKG114nRQpFVJlNzZspgS6gIFtpt4=,tag:a0dBt9pXJnncBiSKt9dsAQ==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:Si6yTh48HpA8OkkkvgHwtJYFhF8tW3oaQbldjwBc09QJxp9AoKgASMnZtbDZYA==,iv:GrNyZXjaZMviSjy/LGHHrYTr5PFvDkCXmT3MU4+SLpc=,tag:YifB1tKFLqsgXB/YLqYK4w==,type:str]
+    chat: ENC[AES256_GCM,data:ydPky0W4ZWqn,iv:uWQrZDz2GCxiKRaijM89Npt0fQeSNHbQzDefkZCkUAE=,tag:OJQwV/889Vp2/4wjbN41JA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNamN1TytweDd3blJsR2ZH
+            ZmlocFZjT3ZaUjlVbG1vVSt4a2s2SjJIaGtRCjRneDV6cHYwdGJOY1BDVS9DeDVC
+            cDdNbUdtSGRHNU1yZFpPc1MzRS92ME0KLS0tIFpmamNmTFYrRGRqbTFVSzBhUlNa
+            VllXdzZ3bEc3UFY0YjZRKzBUcGgyVkUKqI1ojiLbF87alAkEwyrm8wuW2fLbmj8d
+            YBIpoDCZ7AwR5uHWQAtl7BWJV1zab+rA3zvaf2BsrVA1A+RWOtYT/Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWitsSnRVSzJDZG9ZSE5I
+            bmt2NEFDanR3aFJyYVNnU1NlUldRb2RUVXhNClQrTkgzR1dPNWp3endZTUl5SmRs
+            dEtkSWk4aWJEc2hhbWlXZkxpNGhacFUKLS0tIGZNSG43R0NKYmdFMzdXbmJjSExJ
+            Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
+            1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-25T03:19:55Z"
+    mac: ENC[AES256_GCM,data:v6yb7ZYcnPw/8SqEJnSWzmlE17PenjnBH2X8HZp+kIDXzNFyNvD19FcbCBZjwyjBLvN1ZF4M9FS7Y4+CvvMrN/4JcFufcY/V1NrOd8IZisfAT5N3WuopPee4IN9WEyPVOsbFnesZo6/wJKuqlV1UR8UZxCd3/wHXob9Lkz45cBw=,iv:XKIUiRfP0lj8V/Z1HbvhBankdcAjQqM8Way6TWjJJMY=,tag:PLYsVj6BmR132oWsxEKnfg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -78,7 +78,7 @@ inputs:
        wireguard =
        {
          enable = true;
-          peers = [ "pc" "nas" "one" "vps7" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
+          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
          wireguardIp = "192.168.83.1";
          listenIp = "74.211.99.69";
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -14,7 +14,7 @@ xray-server:
        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
-        #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
+        #ENC[AES256_GCM,data:PTYBkBHs16U=,iv:qr3u7OveM1CmTBIf9gZK4fTRuLCpcZCwf8jmnd1L3Co=,tag:w3O41NG7yCwCVqPGh/6SXA==,type:comment]
        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
@@ -91,8 +91,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-09T04:05:38Z"
-    mac: ENC[AES256_GCM,data:ViclEjB/F9dS2fdtKPlegQPdPY9GeHW6AqnBcf18RlG9V+jnyym0RgkrmOiNokbD4WZSO+o/Y//hFzSeiqINHuNs5SvoslXy23bnThrnf8pDeoowJITV3eQZgNw78qKqJxoXft4b79xetSdZasI1W4YxE/PCjdpkOtgJZ7I5oTI=,iv:se5pq320AEnRuZAA3hO7H2LarCJwnK2sTmZU+s4DYBg=,tag:g4aS5C8PWj+mzbSSK61Z3g==,type:str]
+    lastmodified: "2024-09-26T04:24:17Z"
+    mac: ENC[AES256_GCM,data:AXhLmyZWGD6KvMkyHqmCERE6eNE3pD5Pa/9mRBWZe4hiXL4mKTzCn5C/ODGQ1ZeQjDdP+awjJRvLRjMiYFhVlU8rKpg/f2G1gDr4cIbr61sCdzXKX8wFW0G7bJWxxpAC4X59+u9EJ3sNcyf7bJrMdkTzTYpgXh29mtl2bprcdJQ=,iv:pK4hYexcWng3GwOmWGqgyMsmATnXgcwR3NH4UxCwpvE=,tag:zpv64JWoXc5cDCukDuW51g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.0
--- a/flake.lock
+++ b/flake.lock
@@ -641,6 +641,22 @@
        "type": "github"
      }
    },
+    "linux-surface": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729447945,
+        "narHash": "sha256-DmYbfi7scxWDHlqZA7ZidCnpMexC34+T4DA7yTs5GAI=",
+        "owner": "linux-surface",
+        "repo": "linux-surface",
+        "rev": "260b202ade51ae01f4bf5f4a5516559bd5f04973",
+        "type": "github"
+      },
+      "original": {
+        "owner": "linux-surface",
+        "repo": "linux-surface",
+        "type": "github"
+      }
+    },
    "lmod": {
      "flake": false,
      "locked": {
@@ -861,6 +877,21 @@
        "type": "github"
      }
    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1732536142,
+        "narHash": "sha256-DlwQrOBZET55+tOy2eO3DdAmH9B5xSQzj0TcuWClyF8=",
+        "owner": "CHN-beta",
+        "repo": "nixos-hardware",
+        "rev": "20d99c009ced76a49be02d7ba709b2ce5378c806",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
    "nixos-stable": {
      "locked": {
        "lastModified": 1720535198,
@@ -895,11 +926,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1733112343,
-        "narHash": "sha256-m3lTc9Ox5dSk4qh21KYHdTM8XawO3Aw1Vo8amzQdYOs=",
+        "lastModified": 1732698814,
+        "narHash": "sha256-YY5C05PuviuPbNwNvgE31B4vCY0frFVDaKkJJOPeVUk=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "14db57c1be0752022482dabbc6229a7a10ccd6c5",
+        "rev": "118675e11354b79593944bbd2a14f752bee02695",
        "type": "github"
      },
      "original": {
@@ -927,11 +958,11 @@
    },
    "nixpkgs-23.11": {
      "locked": {
-        "lastModified": 1733710340,
-        "narHash": "sha256-+USCPTSnxB1Mx5Klyh6RNhWhce3YsPY+CjNLs6mOD5A=",
+        "lastModified": 1716265408,
+        "narHash": "sha256-i5aFF2iw707QrRvLNiLG936p3GXXulDMTKSknhBGwYI=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "291b26c472d9f4b2840fd625eec6c49c3023deac",
+        "rev": "c64afe35ab605d20caf19e4bff3ff816b1944c24",
        "type": "github"
      },
      "original": {
@@ -1123,6 +1154,22 @@
        "type": "github"
      }
    },
+    "pentapy": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1712784869,
+        "narHash": "sha256-HRXl8GfNH7CatEDtbkLA985IaDYvb4sH0h/cejlnLQ4=",
+        "owner": "GeoStat-Framework",
+        "repo": "pentapy",
+        "rev": "e78f674dc0d3e1af652616b5d922c88166f76e11",
+        "type": "github"
+      },
+      "original": {
+        "owner": "GeoStat-Framework",
+        "repo": "pentapy",
+        "type": "github"
+      }
+    },
    "plasma-manager": {
      "inputs": {
        "home-manager": [
@@ -1267,6 +1314,7 @@
        "home-manager": "home-manager",
        "impermanence": "impermanence",
        "lepton": "lepton",
+        "linux-surface": "linux-surface",
        "lmod": "lmod",
        "matplotplusplus": "matplotplusplus",
        "misskey": "misskey",
@@ -1276,6 +1324,7 @@
        "nix-flatpak": "nix-flatpak",
        "nix-index-database": "nix-index-database",
        "nix-vscode-extensions": "nix-vscode-extensions",
+        "nixos-hardware": "nixos-hardware",
        "nixos-wallpaper": "nixos-wallpaper",
        "nixpkgs": "nixpkgs",
        "nixpkgs-23.05": "nixpkgs-23.05",
@@ -1284,6 +1333,7 @@
        "nur-linyinfeng": "nur-linyinfeng",
        "nur-xddxdd": "nur-xddxdd",
        "openxlsx": "openxlsx",
+        "pentapy": "pentapy",
        "plasma-manager": "plasma-manager",
        "pocketfft": "pocketfft",
        "poetry2nix": "poetry2nix",
@@ -1629,11 +1679,11 @@
    "ufo": {
      "flake": false,
      "locked": {
-        "lastModified": 1733296869,
-        "narHash": "sha256-CBXaEPfXe2ENpZdm97Scr5ZOLpI1czoa8L8N3K8ITVU=",
+        "lastModified": 1732177086,
+        "narHash": "sha256-zmrzTQGXkR54igJUhYp0pFqS2RdV69Wi/wgyFME/K+E=",
        "ref": "refs/heads/main",
-        "rev": "d584951fd71867f37aca6ba50e276591ce7d3451",
-        "revCount": 74,
+        "rev": "28e4d29f2c70d1f3b80a092b75b81a4793455980",
+        "revCount": 65,
        "type": "git",
        "url": "https://git.chn.moe/chn/ufo.git"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -19,6 +19,7 @@
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    nixos-hardware.url = "github:CHN-beta/nixos-hardware";
    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-flatpak.url = "github:gmodena/nix-flatpak";
    chaotic =
@@ -47,6 +48,7 @@
    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
+    linux-surface = { url = "github:linux-surface/linux-surface"; flake = false; };
    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
    lmod = { url = "github:TACC/Lmod"; flake = false; };
    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
@@ -66,6 +68,7 @@
    ufo = { url = "git+https://git.chn.moe/chn/ufo.git"; flake = false; };
    highfive = { url = "git+https://github.com/CHN-beta/HighFive?submodules=1"; flake = false; };
    stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
+    pentapy = { url = "github:GeoStat-Framework/pentapy"; flake = false; };
  };

  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
@@ -73,7 +76,11 @@
    packages.x86_64-linux = import ./flake/packages.nix { inherit inputs localLib; };
    nixosConfigurations = import ./flake/nixos.nix { inherit inputs localLib; };
    overlays.default = final: prev:
-      { localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; }); };
+    {
+      localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; });
+      pythonPackagesExtensions = prev.pythonPackagesExtensions ++
+        (final: prev: import ./packages/python { inherit localLib; pkgs = final; topInputs = inputs; });
+    };
    config = { archive = false; branch = "production"; };
    devShells.x86_64-linux = import ./flake/dev.nix { inherit inputs; };
    src = import ./flake/src.nix { inherit inputs; };
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -23,7 +23,7 @@ builtins.listToAttrs
        ];
      };
    })
-    [ "nas" "pc" "pi3b" "vps6" "vps7" "xmupc1" "xmupc2" "one" ])
+    [ "nas" "pc" "pi3b" "surface" "vps4" "vps6" "vps7" "xmupc1" "xmupc2" ])
  ++ (builtins.map
    (node:
    {
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -1,10 +1,4 @@
 { inputs }: let inherit (inputs.self.packages.x86_64-linux) pkgs; in
 {
  git-lfs-transfer = "sha256-V2cnWCyzxwxlOXXTB8Kz4X4VHvu0H/SqHBzPFwlp73o=";
-  iso = pkgs.fetchurl
-  {
-    url = "https://releases.nixos.org/nixos/24.11/nixos-24.11beta709057.0c582677378f"
-      + "/nixos-plasma6-24.11beta709057.0c582677378f-x86_64-linux.iso";
-    sha256 = "000wmfn6k5awqwsx9qldhdgahv4k09w4yzmvf0djs51qjdpha082";
-  };
 }
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -4,7 +4,8 @@ inputs:
  {
    hostname = mkOption { type = types.nonEmptyStr; };
    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
-    private = mkOption { type = types.bool; default = false; };
+    # not implemented yet
+    # private = mkOption { type = types.bool; };
    cluster = mkOption
    {
      type = types.nullOr (types.submodule { options =
--- a/modules/packages/default.nix
+++ b/modules/packages/default.nix
@@ -12,22 +12,18 @@ inputs:
    _packages = mkOption { type = types.listOf types.unspecified; default = []; };
    _pythonPackages = mkOption { type = types.listOf types.unspecified; default = []; };
    _prebuildPackages = mkOption { type = types.listOf types.unspecified; default = []; };
-    _pythonEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-    _vscodeEnvFlags = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
  };
  config =
  {
    environment.systemPackages = with inputs.config.nixos.packages.packages;
      (inputs.lib.lists.subtractLists excludePackages (_packages ++ extraPackages))
      ++ [
-        (
-          (inputs.pkgs.python3.withPackages (pythonPackages:
-            inputs.lib.lists.subtractLists
-              (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-                excludePythonPackages))
-              (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
-                (_pythonPackages ++ extraPythonPackages)))))
-          .override (prev: { makeWrapperArgs = prev.makeWrapperArgs or [] ++ _pythonEnvFlags; }))
+        (inputs.pkgs.python3.withPackages (pythonPackages:
+          inputs.lib.lists.subtractLists
+            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+              excludePythonPackages))
+            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
+              (_pythonPackages ++ extraPythonPackages)))))
        (inputs.pkgs.writeTextDir "share/prebuild-packages"
          (builtins.concatStringsSep "\n" (builtins.map builtins.toString
            (inputs.lib.lists.subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages)))))
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -52,7 +52,7 @@ inputs:
          # download
          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
          # editor
-          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+          typora # appflowy notion-app-enhanced joplin-desktop standardnotes logseq
          # news
          fluent-reader rssguard newsflash newsboat
          # nix tools
@@ -65,14 +65,14 @@ inputs:
          google-chrome tor-browser microsoft-edge
          # office
          crow-translate zotero pandoc libreoffice-qt texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply pspp
+          ydict texstudio panoply
          # matplot++ needs old gnuplot
          inputs.pkgs."pkgs-23.11".gnuplot
          # math, physics and chemistry
-          octaveFull ovito localPackages.vesta localPackages.v-sim jmol mpi geogebra6 localPackages.ufo
+          octaveFull root ovito localPackages.vesta localPackages.v-sim jmol mpi localPackages.ufo
+          (mathematica.overrideAttrs (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; }))
          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14;
-            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; })
-          inputs.pkgs."pkgs-23.11".hdfview
+            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; }) 
          # virtualization
          virt-viewer bottles wineWowPackages.stagingFull genymotion playonlinux
          # media
--- a/modules/packages/mathematica.nix
+++ b/modules/packages/mathematica.nix
@@ -1,13 +0,0 @@
-inputs:
-{
-  options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = null;
-  };
-  config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
-  {
-    nixos.packages.packages._packages = [ (inputs.pkgs.mathematica.overrideAttrs
-      (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; })) ];
-  };
-}
--- a/modules/packages/root.nix
+++ b/modules/packages/root.nix
@@ -1,40 +0,0 @@
-inputs:
-{
-  options.nixos.packages.root = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) root; in inputs.lib.mkIf (root != null)
-  {
-    nixos.packages.packages =
-      let
-        root = inputs.pkgs.root.overrideAttrs rec
-        {
-          version = "6.34.00-rc1";
-          src = inputs.pkgs.fetchurl
-          {
-            url = "https://root.cern/download/root_v${version}.source.tar.gz";
-            sha256 = "1fx6nyv3drcb16a36np7h3vmjlm937j6y9vxkv0sny0grrxcj9lw";
-          };
-          patches = [];
-        };
-        jupyterPath = inputs.pkgs.jupyter-kernel.create { definitions.root = rec
-        {
-          displayName = "ROOT";
-          language = "c++";
-          argv = [ "/run/current-system/sw/bin/python3" "-m" "JupyROOT.kernel.rootkernel" "-f" "{connection_file}" ];
-          logo64 = "${root}/etc/root/notebook/kernels/root/logo-64x64.png";
-          logo32 = inputs.pkgs.runCommand "logo-32x32.png" {}
-            "${inputs.pkgs.imagemagick}/bin/convert ${logo64} -resize 32x32 $out";
-        };};
-      in
-      {
-        _packages = [ root ];
-        _pythonPackages = [(pythonPackages: with pythonPackages; [ metakernel notebook ])];
-        _pythonEnvFlags =
-        [
-          "--prefix JUPYTER_PATH : ${jupyterPath}"
-          "--suffix NIX_PYTHONPATH : ${root}/lib"
-        ];
-        _vscodeEnvFlags = [ "--prefix JUPYTER_PATH : ${jupyterPath}" ];
-      };
-  };
-}
--- a/modules/packages/server.nix
+++ b/modules/packages/server.nix
@@ -36,7 +36,7 @@ inputs:
        # development
        gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
        # stupid things
-        toilet lolcat localPackages.stickerpicker graph-easy
+        toilet lolcat localPackages.stickerpicker
        # office
        pdfgrep ffmpeg-full # todo-txt-cli 
      ]
--- a/modules/packages/ssh.nix
+++ b/modules/packages/ssh.nix
@@ -7,6 +7,16 @@ inputs:
    services.openssh.knownHosts =
      let servers =
      {
+        vps4 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIF7Y0tjt1XLPjqJ8HEB26W9jVfJafRQ3pv5AbPaxEc/Z";
+          hostnames = [ "vps4.chn.moe" "104.234.37.61" ];
+        };
+        "initrd.vps4" =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIJkOPTFvX9f+Fn/KHOIvUgoRiJfq02T42lVGQhpMUGJq";
+          hostnames = [ "initrd.vps4.chn.moe" "104.234.37.61" ];
+        };
        vps6 =
        {
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
@@ -37,15 +47,15 @@ inputs:
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIAoMu0HEaFQsnlJL0L6isnkNZdRq0OiDXyaX3+fl3NjT";
          hostnames = [ "initrd.nas.chn.moe" "192.168.1.2" ];
        };
-        one =
+        surface =
        {
-          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIC5i2Z/vK0D5DBRg3WBzS2ejM0U+w3ZPDJRJySdPcJ5d";
-          hostnames = [ "wireguard.one.chn.moe" "192.168.1.4" "192.168.83.5" ];
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIFdm3DcfHdcLP0oSpVrWwIZ/b9lZuakBSPwCFz2BdTJ7";
+          hostnames = [ "192.168.1.4" "wireguard.surface.chn.moe" "192.168.83.5" ];
        };
        pc =
        {
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIMSfREi19OSwQnhdsE8wiNwGSFFJwNGN0M5gN+sdrrLJ";
-          hostnames = [ "wireguard.pc.chn.moe" "[office.chn.moe]:3673" "192.168.1.3" "192.168.83.3" ];
+          hostnames = [ "wireguard.pc.chn.moe" "[office.chn.moe]:3673" "192.168.1.105" "192.168.83.3" ];
        };
        hpc =
        {
@@ -121,10 +131,10 @@ inputs:
        (
          (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; }; })
-            [ "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" "wireguard.one" ])
+            [ "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
          ++ (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; forwardX11 = true; }; })
-            [ "wireguard.pc" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
+            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
          ++ (builtins.map
            (host:
            {
@@ -144,7 +154,7 @@ inputs:
          xmupc2 = { host = "xmupc2"; hostname = "xmupc2.chn.moe"; port = 6394; forwardX11 = true; };
          nas = { host = "nas"; hostname = "192.168.1.2"; forwardX11 = true; };
          pc = { host = "pc"; hostname = "192.168.1.3"; forwardX11 = true; };
-          one = { host = "one"; hostname = "192.168.1.4"; forwardX11 = true; };
+          surface = { host = "surface"; hostname = "192.168.1.4"; forwardX11 = true; };
          gitea = { host = "gitea"; hostname = "ssh.git.chn.moe"; };
          jykang =
          {
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -18,15 +18,12 @@ inputs:
              (set:
              {
                name = set;
-                value = vscode-extensions.${set} or {}
-                  // nix-vscode-extensions.vscode-marketplace.${set}
-                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {};
+                value = nix-vscode-extensions.vscode-marketplace.${set} // vscode-extensions.${set} or {};
              })
              (inputs.lib.unique
              (
-                (builtins.attrNames vscode-extensions)
-                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace)
-                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace-release)
+                (builtins.attrNames nix-vscode-extensions.vscode-marketplace)
+                ++ (builtins.attrNames vscode-extensions)
              )));
            in with extensions;
              (with github; [ copilot github-vscode-theme ])
@@ -56,10 +53,8 @@ inputs:
                pkief.material-icon-theme
              ]
              # jupyter
-              # TODO: use last release
-              ++ (with vscode-extensions.ms-toolsai;
+              ++ (with ms-toolsai;
                [ jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow ]);
-          extraFlags = builtins.concatStringsSep " " inputs.config.nixos.packages.packages._vscodeEnvFlags;
        }
      )];
    };
--- a/modules/services/docker.nix
+++ b/modules/services/docker.nix
@@ -7,21 +7,19 @@ inputs:
    (
      inputs.lib.mkIf (docker != null)
      {
-        virtualisation.docker =
+        # system-wide docker is not needed
+        # virtualisation.docker.enable = true;
+        virtualisation.docker.rootless =
        {
          enable = true;
-          rootless =
+          setSocketVariable = true;
+          daemon.settings =
          {
-            enable = true;
-            setSocketVariable = true;
-            daemon.settings =
-            {
-              features.buildkit = true;
-              # dns 127.0.0.1 make docker not work
-              dns = [ "1.1.1.1" ];
-              # prevent create btrfs subvol
-              storage-driver = "overlay2";
-            };
+            features.buildkit = true;
+            # dns 127.0.0.1 make docker not work
+            dns = [ "1.1.1.1" ];
+            # prevent create btrfs subvol
+            storage-driver = "overlay2";
          };
        };
      }
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -16,7 +16,7 @@ inputs:
      hostName = nextcloud.hostname;
      appstoreEnable = false;
      https = true;
-      package = inputs.pkgs.nextcloud30;
+      package = inputs.pkgs.nextcloud29;
      maxUploadSize = "10G";
      config =
      {
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -250,9 +250,6 @@ inputs:
              # nginx will try to redirect https://blog.chn.moe/docs to https://blog.chn.moe:3068/docs/ in default
              # this make it redirect to /docs/ without hostname
              absolute_redirect off;
-              # allow realip module to set ip
-              set_real_ip_from 0.0.0.0/0;
-              real_ip_header proxy_protocol;
            '';
            proxyTimeout = "1d";
            recommendedZstdSettings = true;
--- a/modules/services/wechat2tg.nix
+++ b/modules/services/wechat2tg.nix
@@ -1,48 +0,0 @@
-inputs:
-{
-  options.nixos.services.wechat2tg = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) wechat2tg; in inputs.lib.mkIf (wechat2tg != null)
-  {
-    virtualisation.oci-containers.containers.wechat2tg =
-    {
-      image = "finalpi/wechat2tg:v1.3.3";
-      imageFile = inputs.pkgs.dockerTools.pullImage
-      {
-        imageName = "finalpi/wechat2tg";
-        imageDigest = "sha256:48e3aff3f501847f063318b41ca34af7d83278847d2eee40d7ffbf439ee4c194";
-        sha256 = "04hq577d981mdfz0xwklhj9ifgnpbv91d6zkf37awfrbsiqfkrr6";
-        finalImageName = "finalpi/wechat2tg";
-        finalImageTag = "v1.3.3";
-      };
-      volumes = [ "wechat2tg-config:/app/storage" "wechat2tg-files:/app/save-files" ];
-      environmentFiles = [ inputs.config.sops.templates."wechat2tg/env".path ];
-    };
-    sops =
-    {
-      templates."wechat2tg/env".content = let placeholder = inputs.config.sops.placeholder; in
-      ''
-        BOT_TOKEN=${placeholder."wechat2tg/token"}
-        # PROXY_HOST: ""
-        # PROXY_PORT: ""
-        # Proxy type: socks5, http, https
-        # PROXY_PROTOCOL: 'socks5'
-        # Optional username and password
-        # PROXY_USERNAME: ""
-        # PROXY_PASSWORD: ""
-        # API_ID: ""
-        # API_HASH: ""
-        ROOM_MESSAGE='<i>🌐#[topic]</i> ---- <b>👤#[(alias)] #[name]: </b>'
-        OFFICIAL_MESSAGE='<b>📣#[name]: </b>'
-        CONTACT_MESSAGE='<b>👤#[alias_first]: </b>'
-        ROOM_MESSAGE_GROUP='<b>👤#[(alias)] #[name]: </b>'
-        OFFICIAL_MESSAGE_GROUP='<b>📣#[name]: </b>'
-        CONTACT_MESSAGE_GROUP='<b>👤#[alias_first]: </b>'
-        CREATE_ROOM_NAME='#[topic]'
-        CREATE_CONTACT_NAME='#[alias]#[[name]]'
-        MESSAGE_DISPLAY='#[identity]#[br]#[body]'
-      '';
-      secrets."wechat2tg/token" = {};
-    };
-  };
-}
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -17,7 +17,7 @@ inputs:
      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
      # consoleLogLevel = 7;
    };
-    hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
+    hardware = { enableAllFirmware = true; bluetooth.enable = true; };
    environment =
    {
      sessionVariables = rec
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -4,8 +4,7 @@ inputs:
  {
    variant = mkOption
    {
-      type = types.nullOr (types.enum
-        [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lto" "cachyos-server" "zen" ]);
+      type = types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lto" "cachyos-server" "zen" ];
      default = "xanmod-lts";
    };
    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
@@ -39,7 +38,7 @@ inputs:
        extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
        extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
        kernelParams = [ "delayacct" ];
-        kernelPackages = inputs.lib.mkIf (kernel.variant != null)
+        kernelPackages =
        {
          nixos = inputs.pkgs.linuxPackages;
          xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
@@ -74,6 +73,45 @@ inputs:
                  HZ = inputs.lib.mkForce (freeform "1000");
                };
              }];
+              surface =
+                let
+                  version =
+                    let versionArray = builtins.splitVersion inputs.config.boot.kernelPackages.kernel.version;
+                    in "${builtins.elemAt versionArray 0}.${builtins.elemAt versionArray 1}";
+                  kernelPatches = builtins.map
+                    (file:
+                    {
+                      name = "surface-${file.name}";
+                      patch = "${inputs.topInputs.linux-surface}/patches/${version}/${file.name}";
+                    })
+                    (builtins.filter
+                      (file: file.value == "regular")
+                      (inputs.localLib.attrsToList (builtins.readDir
+                        "${inputs.topInputs.linux-surface}/patches/${version}")));
+                  kernelConfig = builtins.removeAttrs
+                    (builtins.listToAttrs (builtins.concatLists (builtins.map
+                      (configString:
+                        if builtins.match "CONFIG_.*=." configString == [] then
+                        (
+                          let match = builtins.match "CONFIG_(.*)=(.)" configString; in with inputs.lib.kernel;
+                          [{
+                            name = builtins.elemAt match 0;
+                            value = { m = module; y = yes; }.${builtins.elemAt match 1};
+                          }]
+                        )
+                        else if builtins.match "# CONFIG_.* is not set" configString == [] then
+                        [{
+                          name = builtins.elemAt (builtins.match "# CONFIG_(.*) is not set" configString) 0;
+                          value = inputs.lib.kernel.unset;
+                        }]
+                        else if builtins.match "#.*" configString == [] then []
+                        else if configString == "" then []
+                        else throw "could not parse: ${configString}"
+                      )
+                      (inputs.lib.strings.splitString "\n"
+                        (builtins.readFile "${inputs.topInputs.linux-surface}/configs/surface-${version}.config")))))
+                    [ "VIDEO_IPU3_IMGU" ];
+                in kernelPatches ++ [{ name = "surface-config"; patch = null; extraStructuredConfig = kernelConfig; }];
              hibernate-progress =
              [{
                name = "hibernate-progress";
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -22,7 +22,7 @@ inputs:
        hosts = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
      };
    };
-    githubToken.enable = mkOption { type = types.bool; default = inputs.config.nixos.model.private; };
+    githubToken.enable = mkOption { type = types.bool; default = false; };
  };
  config = let inherit (inputs.config.nixos.system) nix; in inputs.lib.mkMerge
  [
--- a/modules/user/chn/default.nix
+++ b/modules/user/chn/default.nix
@@ -32,11 +32,11 @@ inputs:
            // (builtins.listToAttrs (builtins.map
              (system: { name = system; value = { forwardAgent = true; extraOptions.AddKeysToAgent = "yes"; }; })
              [
-                "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "nas" "wireguard.nas" "pc"
-                "xmupc1" "wireguard.xmupc1" "xmupc2" "wireguard.xmupc2" "one" "wireguard.one"
+                "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.pc" "nas" "wireguard.nas" "pc"
+                "wireguard.surface" "xmupc1" "wireguard.xmupc1" "xmupc2" "wireguard.xmupc2"
              ]));
            extraConfig =
-              inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.hostname [ "pc" ])
+              inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.hostname [ "pc" "surface" ])
              ''
                IdentityFile ~/.ssh/id_rsa
                IdentityFile ~/.ssh/id_ed25519_sk
--- a/modules/user/chn/plasma/autostart.nix
+++ b/modules/user/chn/plasma/autostart.nix
@@ -49,14 +49,14 @@ inputs:
          };
          crow-translate = rec
          {
-            fileName = "org.kde.CrowTranslate.desktop";
+            fileName = "io.crow_translate.CrowTranslate.desktop";
            path = "${inputs.pkgs.crow-translate}/share/applications/${fileName}";
          };
        };
        devices =
        {
          pc = [ "nheko" "kclockd" "yakuake" "telegram" "element" "kmail" "discord" "crow-translate" ];
-          one = [ "kclockd" "yakuake" "telegram" "element" "kmail" "crow-translate" ];
+          surface = [ "kclockd" "yakuake" "telegram" "element" "crow-translate" ];
        };
      in builtins.listToAttrs (builtins.map
        (file:
--- a/modules/user/chn/plasma/wallpaper.nix
+++ b/modules/user/chn/plasma/wallpaper.nix
@@ -6,6 +6,7 @@ inputs:
      wallpaper =
      {
        pc = "${nixos-wallpaper}/pixiv-117612023.png";
+        surface = "${nixos-wallpaper}/fanbox-6682738.png";
      }.${inputs.config.nixos.model.hostname} or "${nixos-wallpaper}/pixiv-96734339-x2.png";
    in
    {
--- a/modules/user/chn/sops.nix
+++ b/modules/user/chn/sops.nix
@@ -1,6 +1,10 @@
 inputs:
 {
-  config = inputs.lib.mkIf ((builtins.elem "chn" inputs.config.nixos.user.users) && inputs.config.nixos.model.private)
+  config = inputs.lib.mkIf
+  (
+    (builtins.elem "chn" inputs.config.nixos.user.users)
+      && (builtins.elem inputs.config.nixos.model.hostname [ "pc" "surface" ])
+  )
  {
    home-manager.users.chn = homeInputs:
    {
--- a/packages/biu/CMakeLists.txt
+++ b/packages/biu/CMakeLists.txt
@@ -27,7 +27,6 @@ find_package(HDF5 REQUIRED)
 find_package(concurrencpp REQUIRED)
 find_path(POCKETFFT_INCLUDE_DIR pocketfft.h REQUIRED)
 find_package(yaml-cpp REQUIRED)
-find_package(glaze REQUIRED)

 add_library(biu src/common.cpp src/hdf5.cpp src/string.cpp)
 target_include_directories(biu PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
@@ -35,7 +34,7 @@ target_include_directories(biu PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_D
  ${LIBBACKTRACE_INCLUDE_DIR} ${POCKETFFT_INCLUDE_DIR})
 target_link_libraries(biu PUBLIC magic_enum::magic_enum fmt::fmt Boost::headers Boost::iostreams Boost::filesystem
  range-v3::range-v3 Eigen3::Eigen HighFive TgBot::TgBot ${LIBBACKTRACE_LIBRARY} hdf5::hdf5 concurrencpp::concurrencpp
-  yaml-cpp::yaml-cpp glaze::glaze)
+  yaml-cpp::yaml-cpp)
 target_compile_features(biu PUBLIC cxx_std_23)
 target_compile_options(biu PUBLIC -Wno-gnu-string-literal-operator-template)
 install(TARGETS biu EXPORT biuTargets LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
@@ -84,10 +83,6 @@ set_property(TARGET test-yaml PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 add_test(NAME test-yaml COMMAND test-yaml)
 add_executable(test-logger test/logger.cpp)
 target_link_libraries(test-logger PRIVATE biu)
-target_compile_definitions(test-logger PRIVATE BIU_LOGGER_DEBUG BIU_LOGGER_SOURCE_ROOT="${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_definitions(test-logger PRIVATE BIU_LOGGING_DEBUG BIU_LOGGING_SOURCE_ROOT="${CMAKE_CURRENT_SOURCE_DIR}")
 set_property(TARGET test-logger PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
 add_test(NAME test-logger COMMAND test-logger)
-add_executable(test-glaze test/glaze.cpp)
-target_link_libraries(test-glaze PRIVATE biu)
-set_property(TARGET test-glaze PROPERTY CXX_STANDARD 23 CXX_STANDARD_REQUIRED ON)
-add_test(NAME test-glaze COMMAND test-glaze)
--- a/packages/biu/biuConfig.cmake
+++ b/packages/biu/biuConfig.cmake
@@ -14,4 +14,3 @@ find_package(HDF5 REQUIRED)
 find_package(concurrencpp REQUIRED)
 find_path(POCKETFFT_INCLUDE_DIR pocketfft.h REQUIRED)
 find_package(yaml-cpp REQUIRED)
-find_package(glaze REQUIRED)
--- a/packages/biu/default.nix
+++ b/packages/biu/default.nix
@@ -1,7 +1,7 @@
 {
  stdenv, cmake, lib,
  magic-enum, fmt, boost, eigen, range-v3, nameof, zpp-bits, highfive, tgbot-cpp, libbacktrace, hdf5, concurrencpp,
-  pocketfft, yaml-cpp, glaze
+  pocketfft, yaml-cpp
 }: stdenv.mkDerivation rec
 {
  name = "biu";
@@ -9,7 +9,7 @@
  buildInputs =
  [
    magic-enum fmt boost range-v3 nameof zpp-bits eigen highfive tgbot-cpp libbacktrace hdf5
-    concurrencpp pocketfft yaml-cpp glaze
+    concurrencpp pocketfft yaml-cpp
  ];
  propagatedBuildInputs = buildInputs;
  nativeBuildInputs = [ cmake ];
--- a/packages/biu/include/biu.hpp
+++ b/packages/biu/include/biu.hpp
@@ -15,5 +15,4 @@
 # include <biu/fft.tpp>
 # include <biu/yaml.tpp>
 # include <biu/serialize.tpp>
-# include <biu/glaze.tpp>
 # include <range/v3/all.hpp>
--- a/packages/biu/include/biu/glaze.hpp
+++ b/packages/biu/include/biu/glaze.hpp
@@ -1,31 +0,0 @@
-# pragma once
-# include <biu/eigen.hpp>
-# include <glaze/glaze.hpp>
-
-namespace glz::detail
-{
-  template <biu::EigenMatrix Matrix> struct from<JSON, Matrix>
-  {
-    template <auto Opts> static void op(Matrix& matrix, auto&&... args);
-  };
-
-  template <biu::EigenMatrix Matrix> struct to<JSON, Matrix>
-  {
-    template <auto Opts> static void op(Matrix& matrix, auto&&... args) noexcept;
-  };
-}
-
-template <typename Scalar, int Rows, int Cols, int Options, int MaxRows, int MaxCols>
-struct glz::meta<Eigen::Matrix<Scalar, Rows, Cols, Options, MaxRows, MaxCols>>
-{
-   static constexpr std::string_view name = join_v
-   <
-    chars<"Eigen::Matrix<">, name_v<Scalar>, chars<",">,
-    chars<num_to_string<Rows>::value>, chars<",">,
-    chars<num_to_string<Cols>::value>, chars<",">,
-    chars<num_to_string<Options>::value>, chars<",">,
-    chars<num_to_string<MaxRows>::value>, chars<",">,
-    chars<num_to_string<MaxCols>::value>,
-    chars<">">
-  >;
-};
--- a/packages/biu/include/biu/glaze.tpp
+++ b/packages/biu/include/biu/glaze.tpp
@@ -1,15 +0,0 @@
-# pragma once
-# include <biu/glaze.hpp>
-
-template <biu::EigenMatrix Matrix> template <auto Opts> void
-  glz::detail::from<glz::JSON, Matrix>::op(Matrix& matrix, auto&&... args)
-{
-  decltype(matrix | biu::fromEigen) std_matrix;
-  read<JSON>::op<Opts>(std_matrix, args...);
-  matrix = std_matrix | biu::toEigen<>;
-}
-template <biu::EigenMatrix Matrix> template <auto Opts> void
-  glz::detail::to<glz::JSON, Matrix>::op(Matrix& matrix, auto&&... args) noexcept
-{
-  write<JSON>::op<Opts>(matrix | biu::fromEigen, args...);
-}
--- a/packages/biu/include/biu/logger.tpp
+++ b/packages/biu/include/biu/logger.tpp
@@ -84,13 +84,8 @@ namespace biu
 		auto&& lock = Threads_.lock();
 		if (auto thread_id = get_thread_id(); lock->contains(thread_id)) lock.value()[thread_id]++;
 		else lock->emplace(thread_id, 1);
-		auto try_format = []<typename T>(T&& value) -> std::string
-		{
-			if constexpr (fmt::is_formattable<T, char>::value) return "{}"_f(std::forward<T>(value));
-			else return "({})"_f(nameof::nameof_full_type<T>());
-		};
 		if constexpr (sizeof...(Param) > 0)
-			debug("begin function with {{{}}}."_f(fmt::join({try_format(std::forward<Param>(param))...}, ", ")));
+			debug("begin function with {{{}}}."_f(fmt::join({"{}"_f(std::forward<Param>(param))...}, ", ")));
 		else debug("begin function.");
 	}

@@ -128,10 +123,10 @@ namespace biu
 				time,
 				get_thread_id() % std::numeric_limits<std::uint16_t>::max(),
 				Indent_,
-				message,
 				source_file.empty() ? "??"s : source_file,
 				stack[0].source_line() == 0 ? "??"s : "{}"_f(stack[0].source_line()),
-				stack[0].name()
+				stack[0].name(),
+				message
 			) << std::flush;
 # else
 			*lock->Stream << "[ {:%T} {:02x} {:02} ] {}\n"_f
--- a/packages/biu/include/biu/yaml.hpp
+++ b/packages/biu/include/biu/yaml.hpp
@@ -24,21 +24,11 @@ namespace YAML
    static Node encode(const Optional&);
    static bool decode(const Node& node, Optional&);
  };
-  template <biu::SpecializationOf<std::unique_ptr> Ptr> struct convert<Ptr>
-  {
-    static Node encode(const Ptr&);
-    static bool decode(const Node& node, Ptr&);
-  };
  template <biu::Set Set> struct convert<Set>
  {
    static Node encode(const Set&);
    static bool decode(const Node& node, Set&);
  };
-  template <biu::Enumerable Enum> struct convert<Enum>
-  {
-    static Node encode(const Enum&);
-    static bool decode(const Node& node, Enum&);
-  };
  template <typename T> struct convert
  {
    static Node encode(const T&);
--- a/packages/biu/include/biu/yaml.tpp
+++ b/packages/biu/include/biu/yaml.tpp
@@ -5,8 +5,6 @@
 # include <biu/eigen.hpp>
 # include <boost/pfr.hpp>
 # include <boost/pfr/core_name.hpp>
-# include <nameof.hpp>
-# include <magic_enum.hpp>

 namespace YAML
 {
@@ -52,23 +50,6 @@ namespace YAML
    }
    return true;
  }
-  template <biu::SpecializationOf<std::unique_ptr> Ptr> Node convert<Ptr>::encode(const Ptr& ptr)
-  {
-    if (ptr) return convert<typename Ptr::element_type>::encode(*ptr);
-    else return YAML::Node{};
-  }
-  template <biu::SpecializationOf<std::unique_ptr> Ptr> bool convert<Ptr>::decode
-    (const Node& node, Ptr& ptr)
-  {
-    if (!node.IsDefined() || node.IsNull()) ptr = nullptr;
-    else
-    {
-      auto* value = new typename Ptr::element_type;
-      if (!convert<typename Ptr::element_type>::decode(node, *value)) return false;
-      ptr.reset(value);
-    }
-    return true;
-  }
  template <biu::Set Set> Node convert<Set>::encode(const Set& set)
    { return convert<std::vector<typename Set::value_type>>::encode(set | ranges::to_vector); }
  template <biu::Set Set> bool convert<Set>::decode(const Node& node, Set& set)
@@ -78,16 +59,6 @@ namespace YAML
    set = vec | ranges::to<Set>;
    return true;
  }
-  template <biu::Enumerable Enum> Node convert<Enum>::encode(const Enum& e)
-    { return convert<std::string_view>::encode(nameof::nameof_enum(e)); }
-  template <biu::Enumerable Enum> bool convert<Enum>::decode(const Node& node, Enum& e)
-  {
-    std::string name;
-    if (!convert<std::string>::decode(node, name)) return false;
-    auto optional_value = magic_enum::enum_cast<Enum>(name);
-    if (!optional_value) return false;
-    else { e = *optional_value; return true; }
-  }
  template <typename T> Node convert<T>::encode(const T& t)
  {
    YAML::Node node;
--- a/packages/biu/test/common.cpp
+++ b/packages/biu/test/common.cpp
@@ -1,5 +1,4 @@
 # include <biu.hpp>
-# include <glaze/glaze.hpp>

 int main()
 {
--- a/packages/biu/test/glaze.cpp
+++ b/packages/biu/test/glaze.cpp
@@ -1,20 +0,0 @@
-// # include <biu.hpp>
-# include <glaze/glaze.hpp>
-# include <Eigen/Dense>
-# include <glaze/ext/eigen.hpp>
-
-struct aaa
-{
-  int a = 1;
-  double b = 2;
-  std::string c = "3";
-  Eigen::Matrix3d d = Eigen::Matrix3d::Identity();
-  bool operator==(const aaa&) const = default;
-} bbb;
-
-int main()
-{
-  auto result = glz::write_json(bbb.d).value();
-  // auto result2 = glz::read_json<aaa>(result).value();
-  // assert(bbb == result2);
-}
--- a/packages/biu/test/logger.cpp
+++ b/packages/biu/test/logger.cpp
@@ -1,5 +1,5 @@
 # include <biu.hpp>
 int main()
 {
-  biu::Logger::Guard log("test", nullptr, std::ofstream());
+  biu::Logger::Guard guard;
 }
--- a/packages/biu/test/yaml.cpp
+++ b/packages/biu/test/yaml.cpp
@@ -8,7 +8,6 @@ int main()
 a: [ 1, 2, 3 ]
 b: [ [ 1, 2, 3 ], [ 4, 5, 6 ], [ 7, 8, 9 ] ]
 c: [ 1, 2 ]
-d: null
 )";
  auto node = YAML::Load(data);
  auto a = node["a"].as<Eigen::Vector3i>();
@@ -31,19 +30,12 @@ d: null
    Eigen::Vector3i a;
    Eigen::Matrix3i b;
    std::complex<double> c;
-    std::unique_ptr<Eigen::Matrix3d> d;
  };
  auto a3 = node.as<A>();
  assert(a3.a == a);
  assert(a3.b == b);
  assert(a3.c == c);
-  assert(a3.d == nullptr);
  auto e = node["c"].as<std::set<int>>();
  assert((e == std::set<int>{1, 2}));
  node["c"] = e;
-  std::string data2 = R"(
-a: AAA
-)";
-  enum class E { AAA, BBB, CCC };
-  auto f = YAML::Load(data2)["a"].as<E>();
 }
--- a/packages/python/default.nix
+++ b/packages/python/default.nix
--- a/packages/python/pentapy.nix
+++ b/packages/python/pentapy.nix
@@ -0,0 +1,6 @@
+{ src, buildPythonPackage, setuptools, wheel }: buildPythonPackage
+{
+  name = "penapy";
+  inherit src;
+  pyproject = true;
+}