devices.srv3: add port forwarding

2026-01-12 21:39:26 +08:00 · 2025-05-07 13:05:31 +08:00
251 changed files with 6018 additions and 5589 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,6 @@
+*.png filter=lfs diff=lfs merge=lfs -text
+*.icm filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text
+*.webp filter=lfs diff=lfs merge=lfs -text
+*.efi filter=lfs diff=lfs merge=lfs -text
 flake/branch.nix merge=ours
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,8 +1,8 @@
 keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &chn age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
  - &pc age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
-  - &vps4 age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
  - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
+  - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
  - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
  - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
@@ -11,16 +11,13 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &srv2-node0 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &srv2-node1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
  - &srv3 age1n4lhfwv7g0vhx54exmwx9yv2z04m3h2lunzpa5zdzgtcvjjuf5nqc36g8a
-  - &test age1vgqvdqqe3mn0gvh0hydvu9c5f9yn5vek08cagyvwjhyta6utpvuq00g9c2
-  - &test-pc age17a8y4yr2ckuek67rt786ujuf7705gvj3vv6ezktxxmgayea9zcyqet7hgc
-  - &test-pc-vm age1wmcayhf9eyx9e9yp97850mqas9ns455crce8hfmvnupgcxd6sews5r0cln
 creation_rules:
  - path_regex: devices/pc/.*$
    key_groups: [{ age: [ *chn, *pc ] }]
-  - path_regex: devices/vps4/.*$
-    key_groups: [{ age: [ *chn, *vps4 ] }]
  - path_regex: devices/vps6/.*$
    key_groups: [{ age: [ *chn, *vps6 ] }]
+  - path_regex: devices/vps7/.*$
+    key_groups: [{ age: [ *chn, *vps7 ] }]
  - path_regex: devices/nas/.*$
    key_groups: [{ age: [ *chn, *nas ] }]
  - path_regex: devices/one/.*$
@@ -41,16 +38,10 @@ creation_rules:
    key_groups: [{ age: [ *chn, *srv2-node1 ] }]
  - path_regex: devices/srv3/.*$
    key_groups: [{ age: [ *chn, *srv3 ] }]
-  - path_regex: devices/test/.*$
-    key_groups: [{ age: [ *chn, *test ] }]
-  - path_regex: devices/test-pc/.*$
-    key_groups: [{ age: [ *chn, *test-pc ] }]
-  - path_regex: devices/test-pc-vm/.*$
-    key_groups: [{ age: [ *chn, *test-pc-vm ] }]
  - path_regex: devices/cross/secrets/default.yaml$
    key_groups:
-    - age: [ *chn, *pc, *vps4, *vps6, *nas, *one, *srv1-node0, *srv1-node1, *srv1-node2, *srv2-node0, *srv2-node1,
-      *srv3, *test, *test-pc, *test-pc-vm]
+    - age: [ *chn, *pc, *vps6, *vps7, *nas, *one, *srv1-node0, *srv1-node1, *srv1-node2, *srv2-node0, *srv2-node1,
+        *srv3 ]
  - path_regex: devices/cross/secrets/chn.yaml$
    key_groups:
    - age: [ *chn, *pc, *one, *nas ]
--- a/devices/cross/luks-manual/default.nix
+++ b/devices/cross/luks-manual/default.nix
@@ -7,8 +7,8 @@ let devices =
    "/dev/disk/by-partlabel/nas-root4".mapper = "root4";
    "/dev/disk/by-partlabel/nas-swap" = { mapper = "swap"; ssd = true; };
  };
-  vps4."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
  vps6."/dev/disk/by-uuid/961d75f0-b4ad-4591-a225-37b385131060" = { mapper = "root"; ssd = true; };
+  vps7."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
  srv3 =
  {
    "/dev/disk/by-partlabel/srv3-root1" = { mapper = "root1"; ssd = true; };
--- a/devices/cross/luks-manual/vps4.key
+++ b/devices/cross/luks-manual/vps4.key
--- a/devices/cross/luks-manual/vps7.key
+++ b/devices/cross/luks-manual/vps7.key
--- a/devices/cross/secrets/default.yaml
+++ b/devices/cross/secrets/default.yaml
@@ -24,160 +24,133 @@ users:
    aleksana: ENC[AES256_GCM,data:xRqQLPpcv0Ymz7wV0jDDz1i6eKIZKEXvqofO58VSHEC9aVSTLV7aXLw2kQ8PrAPo4FAkne2F6MYQGRwZFIHOjxfhw+ncXVDHxg==,iv:OSbT/f2LRUFY3DEyCCbWkPzwsrsNdVz6ah5ITRt+Kjc=,tag:00z36RTe76p1uxFCchGcpg==,type:str]
    #ENC[AES256_GCM,data:xAGWajpTpg2keMthwQ==,iv:sQreB2mExZlWgVsig7885zf4LI6RFSitYUnD4ngvhfQ=,tag:viEY1wUVlDCqKm5ucQWzsA==,type:comment]
    alikia: ENC[AES256_GCM,data:N4lyS8XZSxP3su+Frz00BPU+II+N6nosu4yOLPSG7zxefcJoG7i5bG3bzb1OQLc/x4fTuD2Wd6mEy6q66cizBkGn3xQHZIaW2w==,iv:FO64ACjOS6+UzWKP5WdcFOGZTzslfetX/VAxyUPZ3ds=,tag:6Kf0MCRUj9cbxyk4TsH8iA==,type:str]
-    #ENC[AES256_GCM,data:1br5bc3q0jBn4WrJzQ==,iv:YmIFhDd9Wl4dcKJLBC6A3v7oUXhBin6ZOuJknSiaYfw=,tag:8gtEBug4vHQkxN/9tLjqSw==,type:comment]
-    pen: ENC[AES256_GCM,data:XOKXV0YSFbHC3I3xO8fpWvYerNfVFg2afs+CUp2MZB+yt9KR5bTJdVOfUGldLbWH5CR4v5FxTrTujv24wJ710Rfyugxh9aFJ/w==,iv:tHLoO+XpdUk8S56QUiJQOpVO9C5epam9PMubMN+8fHw=,tag:H0srWRigNUedQMIAfJlfjg==,type:str]
-    #ENC[AES256_GCM,data:K6O0TIYYGZmM8iOwsQ==,iv:xtT8Psnoy51V9gsRo335+VT56FXTcMQ3d4/tnuWouew=,tag:k8irtZ33G3UFK++rzcmyiw==,type:comment]
-    reonokiy: ENC[AES256_GCM,data:fPKdOPAKbXUvK5Jj08T0iSD23mhhkTXCexgB5q3v5JS4c6V4S+W14WOkS4UHrMQls/rHslw0NyMzS5G27A+5vN+EN+xJZfuRGg==,iv:tSdNOgs61tyt7/hUKt8bfKvpq9qOQU14ligdxBs/ATs=,tag:6IoS/p2StKtFREIpxsWkdg==,type:str]
-    #ENC[AES256_GCM,data:cZznknXjlWF6eoEaTA==,iv:tdw/54W2evO1o5sq1syz3k0DZrm/rjflxqJpB9LZgvg=,tag:d60Ctc5YeSmhZJUURUmeSg==,type:comment]
-    zqq: ENC[AES256_GCM,data:iFtM0pxIvXPHBnLEfHdmYGVWXuroDLgUaAKF+DmuBdq1NY+pr33oXNJzckFZfWgpIOuCm4cNg5j5R6nsG+zk2VWdi2vuITT4jA==,iv:qfBC/D1gJYXOZ0Fy2DkAb+ImDgXZWU6R/Z50hbVDR98=,tag:eCr6lbSieWDCNaTYzoQ0qQ==,type:str]
-    zgq: ENC[AES256_GCM,data:cHYFToQ5ulEcb741Gg3X4lKj8ZJy1zcLHpkVQjQXt5hRAQtPsiPlegi2a1nUIAUb6sI//4ffcytlXpdK2sXewFe3ZiIXy3UVjQ==,iv:fKaPxpfh5ssOwAbmEsAPaQ45KrNtkHZb96IzWc6pD9s=,tag:Vt91B77SjxYaZ/HvWVBufA==,type:str]
+    #ENC[AES256_GCM,data:uqC97mEfHBf7wU25Xg==,iv:s1HIo4kj6CIvuKVKqOzF/7TMguOH/ZG6Bf/BVhEw1ak=,tag:pxUKeAJ1WaDVzHYa7MpiHQ==,type:comment]
+    pen: ENC[AES256_GCM,data:tdlAzxmO0lFKU0umoAHO5iTr29ws2g14EO1A6Du1sLQbBXWp2fQ1PPmct1kEHC+PlrbTdvoxy/GU6kq+HdMP8/Pxi076hN2ouw==,iv:LuLfXUTptvfwk9qPsqyrFdoikhba3rZ766Ef9YgWiAY=,tag:EIe5gpSIqZw2mdIxfVrjhw==,type:str]
 telegram:
    token: ENC[AES256_GCM,data:zfMATU2E6cwoiyfszV35vkQG6JSk00y589wmGEf4wQNncPhNsvh+NcSfnTwHTQ==,iv:Q46mUquhUZLGQsCDYitk4IPu24MpVnYmi7aHyZL/b1E=,tag:QVbrwAA9mWK/ToJfGIs9ug==,type:str]
    user:
        chn: ENC[AES256_GCM,data:mTt2D+SkvVL8,iv:L0Pk5p46E2kKBdRWCGpwOKS0BsbIhZUslpIFWvkssMY=,tag:+AjbNJ1SW/8Mx1HLpWAd2w==,type:str]
        hjp: ENC[AES256_GCM,data:ZXTQhax0gT4PKw==,iv:MerbaWWC4SLazEuuJrxAxf9e5aaX9xpq9St+h9aqvMQ=,tag:x9knShK90OKZPcn9fKzvMA==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:M8/R019chds8zr2BqnRnKP40NZxwq4fz06NaOeOOFYecLyDjIOq5mg==,iv:VPr4XD0Y+6G1P1xwMDyrWPiTvCYdiMV0nPcmqCvIA3Y=,tag:KEyCIHRmRkNviA4bMTMybg==,type:str]
 nginx:
    maxmind-license: ENC[AES256_GCM,data:MtmNo6hHlU75N6PvzF7P5i6Q+myV4Keb1JRXVeHxTennNpKfAndsKg==,iv:DqM91JX+1WX8Zqzha2Tm3ztFaSzKYQg+b9NvUm+6jxY=,tag:XnDTBL9MA/B8XfPZqdk7Eg==,type:str]
-acme:
-    token: ENC[AES256_GCM,data:DrNdcyf2tiZ5nmjYmsG13V63ZuZhNG1c/kkGM7eXQWvRvDbu37nKWA==,iv:xc4gtNvZ/BYG+KmT1XgFfG3Z17bBLURazG8tz4/laxE=,tag:khnYVQWjiiaQC9VsJyLV6A==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyR09MUytUL2h3cWlIanNF
-            VWd6SVNWOGVlVVpGbGtyQWxnZlk0cEx2TFJzCmhtbGRFcDdlWDAxU3NneXloSS9U
-            WXBtQmg4dFhOb3J3bThCUDliUmJ4NVUKLS0tIG1uQjdiODdHWVVrVGIwb2lPN1V1
-            QjVyWFAzQTRDWXMyMXdUNytKcy9abmsKZ6maa6DoKPkDAYXGLVoLWIi3fzzs1SVF
-            C/9y2PG/j7F8Pd4hUHl7ILWN/VNbYKQwGYp59+kKeAzeSHkJeTTKyg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RzdocjRWTTFGWVdqb2JE
+            RDBiWjVNOHBSMlFNMHZOOFYxRzlVZmhKQ2w0CkpGbHRnNTY2NGdzVGx5QmprblNZ
+            YmxCd2Q2VW1SOVZIeDk3Q09LdHdheG8KLS0tIFl5WThUOGozc0xBYVBVVEVFdU4v
+            N2NKcnAwUE8zMDJhaWhqWTljNHppSjgKp4cb4FLsULkDS1VPZT9TLe8z8IH5Jt4d
+            nCqerHvO5j8yo3tPs0BXS675i2HAnup0KQZay7NV7bztbRhWtTiF/A==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ffvr5pqd2lfj24e3fh53s92z6h76fda3du4y4k6r3yjumdwvpfgqzj033a
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZaitpVkkvNEFOMEZXK2s0
-            Z1o0UTZ4NFRrd2NqNzhNVWhncmdWWDlzZ2swCkthMU50WldYajN1eEZCRVRUZ2d6
-            TU8za1R0aUdCV3hZaVlIRE01UHdYc2MKLS0tIFNWcFdVWGc5dUVtWnVVbGh1WFVU
-            UzFsYS9tL0xNeDBmQWIrTVB2MkVtdVUKjMADWap5h4NGj3ESamUHz3+8AtO2sOL6
-            wFm/sTfEuhFqO8bodtBXB/veQOrr97Dw8PhO/6CO5JdGTEyFIZ3DoQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXOFprRWZQaVpMQkxJN2Vw
-            RVB6QXN6bDJPcEt3YURaby9PZm1FZHhDRmtZClBiV0JobHZRejhWVzhOZThRTTJ1
-            UE91bzdWMjJvYllIWXBmQkNReThIc00KLS0tIGRLa0V1b3ZWSVQzc01sUlBMVzBz
-            blZyM0FpelBoTE5Ia2J3S2c0WE5FcVEKKTJ5jzNLkLixv+8DlcTrR9sWs6GihPG6
-            x9w/Zu5H4DK9EVFyksTujRZZMI6o4lHzl2VIrgkTNQUwIPtsqo5KMQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMnJuVVJjTWRIdzdiYlVS
+            RHo1OEx3Y29yL3NuVmduN1loaTgxR01kVXowCjl0ZVhVd1liUnJSWEVRNlR5MzdY
+            R29Pc0dJSXJvb2FjTDAwRW9xUCtQT2MKLS0tIFRUdHovemMvQkhUbkYzSVZyWmkv
+            ZGlKUHAySWVlKytIUThXQlNPSERadEkK8L3GpqrTiuRaFtICkQmc8RSxBz2XykMZ
+            irVZmqwE3787Ku3obqdBNPyB6w6tBGuf2g13PBpbctlYEioz9k5gKQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQWwvbXZoNHFxM1Y3L0pO
-            cDlML1ZWWXppeWxaZjZwOFVvbHNubmxEYUI4ClB6Wm00dTRFUE8xTFNlUmdacjFU
-            VGNiMFk1SHpOVnJ6RWdyVXk3WGkxZm8KLS0tIDFnamZqa1VqdUVXWFN5YW5CNGhh
-            UHc5bCsvVFV2eDlLR2Q3STFCQXpZRzgKSVvG8HcDtBJAh8iNrQd+UKbgs/k5Yf2t
-            KqMdODturfudk8QJn3pR97essszrsK/HS4yptp71bBSj3qK50Lp/rg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSWDViT3JyRktZYldxN3Z0
+            V3RWSXlOT0JEd0xJWlk3TzUyRFpFRytSRmtzCk4vNUk0UFN3bkRaaGdzenFwK3Ez
+            WjdDVi80RGdENmp3TzBuRElFQmVwMmMKLS0tIHpsZU1XQ3p5N3FwNjJmRHMrSFVI
+            TE9odnJrWGx6UFltTjN3WHNobTlqa3cKifobNMMKnEckbPp+mfeQVDldbLzvGM4/
+            y6oSeXQzRKQwFOIH6z4nQjMiMKvpHDEcIbTzCrQ0QCxGKywH6PzmuQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHS1lrQmkyRVNkWFFhWEpm
+            MXhOOEVWTTZQdkp6ajlFVGEvdmd1QlVQQXlBCjc5a1RobjhOb0ZXL2ZlSFVxV2hP
+            OXVVMXpqN2hGQnZOcmVVbzBQT3QvYTQKLS0tIE1KSm5RRDBabTBTaDl4d29Fb1o3
+            Wk5MNy9hQ1E1eTdzdG1Yb3Z2NlNTZlkKivBHX1XApj7EGG4k2N/5quJ2bINNt5lF
+            DTFZfjfZY5TKMxq+/LoxMB9i/eRXxcUNUA9Bkex0HhE+VZS2AcTgAw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Rkc2MVhUc0tTUkNsenQ2
-            aVM1dG9MSVpwaFloU1ZRWmVsaEtYVGY3NlFnCm5PM0VpWVFKdExJbExIMnZ0Tmw1
-            eCtVdkRpVW9lcFA5bWwwbWNaYTMzejQKLS0tIHA4MTd1anM4NWtmQUx1cVlsWFVQ
-            bk5iV2xRazdoZnY1dGhKSGFFdUFWY3MKGoxBih7fDQoZFxj8JjiRAl8D3/8xWBeq
-            RS/8C6v+/V+Afnv9QN6uYt0l4YeGn8tv1TRNWXHZl0A6DFjzouwhZw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpKy8yRHphTTcwc0dhYWFV
+            SnNEZWQ4d1d6Qmx1VGJ3aVdJRms3SDZ1NkdzCjVpYUx0bW0vb1NMKzlQOWU5YWdT
+            VlhXdEk0bGMvR0hjOFNBMWJuS2NUNlEKLS0tIENQWDZROFRuODh0N3h2RzVSVDZE
+            c25adTFUVUh4NThIb0F4aStlUVJGaFkKirqc9ny+BYJgNuGlwLxdpTSPVe3V69oO
+            qGN+m/nWfoPGO1hWZ55qR08P94VcP7KW0eK9r+TdrwQp9T1rOtHWZA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzN2hsZGExRnFaclpUNEdr
-            bkJJM2gySmtzUlVmZWoxZ3pST2l2dGtCdnhnClNWeVZqWTJ1Mk1pMGZCaXppU0lY
-            RUtlT3YrQmZuVTZ3TjJYMlhGMTVMMncKLS0tIDJsaVQ3aHZIWHhXOFJ1WmpQUDNk
-            SjBSRm4wWjhpUzFmVUtwdGUvbmVIV0EKzgfa9i+VJLPvBRrFbNavZtG1hK6jazoD
-            WHkWedx4AUUJQQlp12Wetj/0yY9jF3BLv/wvEAusq6Z4dO2aHr3sRA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaWpFOUV1S2lGREdZak45
+            OVhCSk40OTMwMVhKZWJibmFsY0o1aE1PQWk4Cit6emhXU1QzV0ZueWs5R3VTRUg4
+            TjZrK2RIOUN1ZU12THZqR09YeWtyMjQKLS0tIFR4SUlCYk1rd2U4SlkvRi9SODR6
+            Nk5KamEzUTJkNi9lOFN3VXlEME5LN0kKwjcReB2V8kpavQTXift2KmHm603zTzw9
+            Cx+UO+hkOQGsOLg+Q9A8t850vuqwuq28XHFQFJ7Ac5owhxCpriH9uA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcWFOcXAyYjNoSEhLdEtC
-            ang3bHJ2RmtaL2RManE0K3B0elg4aHJmODB3ClZLSXA5MmhVT2ZZSm9KSUlod3BB
-            V05lT3h0a3NQZnMrNERwNk1LTHRiVlkKLS0tIElESTNEVUpZbk93WFpXNnRTYzY5
-            K2tkMlVCRnBKdVRzWk9aQy9kUUx3L1kKNO9LsaJDfF0v/XCMYV0lmHLFakbVjj+H
-            wGJZQYgu/sETDZQVMeu42fQ++IKElmpfq2/o6+gM7aI0RxLqnBryfw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUm5INDhONE9hZjU5MGRn
+            ZzZLdUNPeHNSSHUrZzRxbTdjRGxhd2wyRWgwCjMzc2UrUEVOUTJqckR6WXpRR1p5
+            TlA5MUtFRXBjazBhc3Rzc3MraFl1dzQKLS0tIFpYajU3Q2hPajhFbURSaXZ3MURT
+            UXduR3Vvam54RmhoQkdrN1N2ejdEVmsKeC/robT8ijuPAQt75xnLFi+cz9i0idfU
+            xCgD6JpqaIMwalpIAuVh6KD/tE9mwWIZSeNk2InGX7/bWmMEB8Dcgw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrYnBzd1k5UEhXZ0wxSU02
-            elZkYlhDWC9CbWFkRlM2bCs2dzNTSlk4TUJnCm1WVnVxaUYwZ1QvNHJRb29ER21P
-            UWhOb2tETWRJR09Sb0l6VXRMaU5KZlkKLS0tIFA3TldTUmJ0Y0xJemJPS0wwK05D
-            SHVXTGUraDE4anJOZFFuaHBKV1lMSWMKemZfKWbI0YR4QuR5zqvGKSnU3HzwZHvo
-            DJ9u2eq7R7OwtDscn9qCwPThORxLMWdI3n+3+XVwAysqW2efrvnGgA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUENVYm1DQ2h1aUxQaE5u
+            VlBIcU8rdzNaZk5wWHpPNnhPUlVIWGtucjFFCmY4dWdSMy9WSWhBWmZUZGVnWlNP
+            K0lFK1NLcGpzSDRXSG5SaUdxamgxekkKLS0tIGJWR0dTZ3kyd0dZSVRQVE93Rytl
+            R1pKVklVbUlZZk1IaUpYVzlQUkplV1kKKN8vFbUrnsxgw5ViYoMBoyxqUOxnpmaQ
+            YqMYedsrnvWvCx9xyu3Kj/MJ88zQchJzdVfg0dUcbY6KRz51m9HE2Q==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZOFZQZmRHVUdjTXpDbFFm
-            SGt1d2lmYXVZa21iSFhMOTUzMmRIU3BIOUI4CmFvT1BMZmE1eC9tV3dJbVJ4ME8z
-            N25hc0NyZmtMbGFxYmtPSkFkSGZ4bFEKLS0tIE5sUFBTanJONjhtR3BnYjVYdlYr
-            NVZNeDFJOGJIdFlacE9LMmFuakZYUkUKmuK+ogCs3WH9TiGiUfRZ9L98aqRli91A
-            1xHYMJOc5FwI+jaHp1m7nkn+egIOmKvyyejI2ZHQ84tItS+aoiI0bw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTmhtaXFZL1dTV1FZVktv
+            VUFMc2o3U2pubTgvbmNZMVIvcGVOZ0UrNGlrCnRwMENSUi80aWxjZ0xpQTVaU2Qr
+            OVUzYVdVTFpxWVB0WXZKTkV0akwxK0EKLS0tIEovQkZzMUFlM210MFZuMHdqVi8r
+            ZTR1VVB5akRxeWVtaUxoYUxKOEpSUzQK5sh8HyaZY1ww5vcoIktuVs/XUF88HYAO
+            tmJiqZniKeOJT4xpBCQoelJ++oVzSqEAg4h5jgCXWN6dstrc71oVrA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRHdHMFAvRFRCNmNES2R0
-            Q3ptRDVrQ3JHaXBxSUlldVd5WUNFc1ZQeDBFCnNiMFErODJhbk5LQ1VGd01oU1N2
-            eXk4Q3VRcUNNWURDUitUMWNOQlJaeWsKLS0tIDRKQ2M1Rnpla3o1NTlCeC9wbGJo
-            cGZxcDUyYzZBMXRpbi94RkcvQXc5aDAKrHpvCDpECN5HS1qeNoiOwKWpT46bLQBd
-            404XgHar20AswgDIjAMp5KJ1pkluQ9j5pVKNFjqJ+9sb3RLYM7Z06Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjSWdybjBIZ2dieFZUbXY0
+            RjNZc200SXBrMkM2b2NQY01vQ2dUQ3RYWURZCnY1bUJ5TjZkdllxRkhRc1VkbVpR
+            cU5YU2V0RUhuaVFHNXhTd0JGNzVZVk0KLS0tIEc1L1dqYkZsN2xNMnlhKzgyeXRC
+            Z0YybnhlK0tNQWw0UXNsY0hzcFVTVncKXXjQiIi4TAdDbeoL7uN0IQmjd1koP0OX
+            2CVpK81DSNGPhS9wvrwE8QHkY10q07CHPWl7qr45ksD1XNG4PoTTFA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvR3RhUHBORW1BNFh5M1c0
-            QlhmUDY1T0ZmN2dGaUhLOVkxN2NiUklBU1hVCjY0MXBoNmw0ekpQYlMzdFZhNFA5
-            NE9XdnlaaGdiSU1BYkRvcThaYmpVcTAKLS0tIGk4UHMwK20yQ2w0N0hoQnZYK2Fk
-            czU0M2dQbU8rMkZJbEJaZ1NhcE1yZFEKUWe5IaDuPjfQ/m76m6DdvF8HWmDiVH1k
-            IQk6sIJfbcINGOVP+JYGJPWgq6LGg1EdW4ONctosVk6kxRO30N0rVQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbi9wUEpGdjBYOE94NG1B
+            SXB5clBwdDl1OTZPcjdMMmU4ODlUQndBejI4CldtWDFlNjl6bG5IcUErZVE0OENx
+            QlBQYThrdzA5eDBMbk5acXYzb3BxVlUKLS0tIEJEc2MrejlSS0RVUkh2R2x0cjU5
+            QUVaU2I4eHc3MGxaTzd2VW5hN3RscW8KzzdxiJ2BLDUEKAq+a1dVzJp3uAD39hUV
+            gMsCnltQoWjGOFHWIXVWSOCB5HQ8MxeZpt8N/ZYKM1UnfhBFDfXRWw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1n4lhfwv7g0vhx54exmwx9yv2z04m3h2lunzpa5zdzgtcvjjuf5nqc36g8a
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1YXF5aGRobkFVdFQzRFBp
-            NnhvdWtxU2dxa2s4d2FiYnBrdmMvakU1cFhvCnJ4NWVCc0t2ajFpdWVMM25XUnE4
-            a3E3N0laOEYwNDBNdTc4WjdZR2R3M1EKLS0tIC9WRGpJSUhhM0JGZVJWaHlvSkRH
-            bXErdTlYQWh3cmZITWxIeDYzaklWbmcKKG08GymtessnDUfg/AgmQh9eyJx25Y+c
-            RyhAdNl6Lu2Hv7e/oqr23SmwFuhzgPl6eL8t1Nz3s1KraShZazjpQA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdVFHbnpZWjZDRWh5Z24y
+            WmFWUGJ3bi9tbW9OYWJaOFQxdWtQYms0dUU4CmpRUnlLbTliY0FqS2JwMGpLNTgw
+            cGN4MUVJeEI4WEhYcjRDSDIxS2NKWGcKLS0tIExQc0xvd0pFK25IWml0RDgxVlpU
+            ZGsrNGpmYXFUUEEvVktjbnF5RHJ0eVkKJ6n4gnl0zcq9mHTWL+5bxJeLE1qKqAKV
+            3ycuAffiQ0Oxv1tSOXjt6ODSds7jDS3Kq2I7q4nG5eqZLiwFXCh25Q==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vgqvdqqe3mn0gvh0hydvu9c5f9yn5vek08cagyvwjhyta6utpvuq00g9c2
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSK2tkZXZkYWZWcEFhS1h2
-            YTk2N3F4L3AzNzdmZXhLRXpOLzlRa1NNSXlnCjRNL3paejlRUTZrVEFwdWdzRzVp
-            NVFReGwrZk9IdVhQSnFzK3lVMWRPOTgKLS0tIGs2azNoQm51ZDZrOEJDbEhRVTFu
-            aVdEZ0s4SjljZFc5ZTJwK3ZON3VlRVkKB1apktkRqW0R/Epn3bZf/Aym5evUmxm+
-            TLkJxTT6TVcgjobcpFvMmI+pqRWfh5Opj9a9lSe5QvsXxdgOs0mvzg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17a8y4yr2ckuek67rt786ujuf7705gvj3vv6ezktxxmgayea9zcyqet7hgc
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNWlhIdTdtNkpZU3Y5T1Vl
-            WjZXLzJYVDdweFpITEh6cmszOVYrZWI5eTM0CmNSTnd4T3g0dFNiTDNCM2hEOTVo
-            OS85R0VqdEZkTlhGWFNRZFpXZGlWTFEKLS0tIHQ1YWJrZERJUlZwZnU3RThucVRL
-            NHdwcGl2Wk11TFdCd25OTE1nVDNYd2MKOxa2f7bFgFE2zCR1kKtC6giQhr1P79W0
-            MKxil/x2T8rBNkK6sN0PjkphKdg9LVit86ilHPwTgnkl9oz8Cs6X5A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1wmcayhf9eyx9e9yp97850mqas9ns455crce8hfmvnupgcxd6sews5r0cln
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmL1ZjRzJNQVFNekFUVlQv
-            SmJWMDRZMXNDaTNNd093b25kSk5nTDg0K244CmVLK08xKzlleXpWblRkbGZVMENi
-            U0NGVVhycUN6OEZDNjFBUndSdnRLdE0KLS0tIHJEeTVIY2xwZWdqdG9JRVhsRENq
-            UnR5Y24rSTk3WUV1VUgvQUFCVUxPZUEKv/lTy02gZYn4jF1uGtm+LhJd0m59Xe99
-            +unmqUDh0ZqAhJU8o0jrBiWs1lXOHU7CkIom7tGEMHGUxHkS+Z/6GQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-11T01:54:15Z"
-    mac: ENC[AES256_GCM,data:LTpoXloCTzNtcYOqwA8UXtaorMzFBmFKb6LdOH7mjMDLsqIGIoWeVClt7WPP76K1amsmqjFLYkrdraqqHabLJB2/XKoSObkgZzLoF0YsknMsgJhkqEb9IwCBILBfAJdgwhuZQKHrMKRs5pePqJYSX2ZlgL4MRkwc6U6GVChRLxY=,iv:MZky3t9fGPtNqEdGEG1SYxhuWqDppNutaFI4GitmoKY=,tag:YaTLM9PSH2rAdb5syDvK1g==,type:str]
+    lastmodified: "2025-05-06T13:14:58Z"
+    mac: ENC[AES256_GCM,data:MzQA214BZViGjvCVGtY5GvmQ/k56DTd2B2Dgn3Rnxty6eTQC6p4B1gGwhwRFtKFWC6IkUXvN69CPB4cBKkFbSmFr5ye0ckBTTu02GQ3ynJmVey4BCJ5ocYoG4eAqKtjicHWiez+zYPQSf15a0uigZuYK/N4ZzDlK/K0j7QByQYU=,iv:wp5oMy6u2vWHTY6cO8PZE5CCBqqYyYAZhNe9NMMQh4w=,tag:X/OG/E15ffn2QD0kMnlqVA==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/cross/ssh.nix
+++ b/devices/cross/ssh.nix
@@ -2,17 +2,19 @@ inputs:
 let
  devices =
  {
-    vps4 =
-    {
-      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIF7Y0tjt1XLPjqJ8HEB26W9jVfJafRQ3pv5AbPaxEc/Z";
-      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIJkOPTFvX9f+Fn/KHOIvUgoRiJfq02T42lVGQhpMUGJq";
-    };
    vps6 =
    {
      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIO5ZcvyRyOnUCuRtqrM/Qf+AdUe3a5bhbnfyhw2FSLDZ";
      # 通过 initrd.xxx.chn.moe 访问
      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIB4DKB/zzUYco5ap6k9+UxeO04LL12eGvkmQstnYxgnS";
    };
+    vps7 =
+    {
+      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIF5XkdilejDAlg5hZZD0oq69k8fQpe9hIJylTo/aLRgY";
+      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIGZyQpdQmEZw3nLERFmk2tS1gpSvXwW0Eish9UfhrRxC";
+      # 默认仅包括wireguard访问的域名和直接访问的域名，这里写额外的域名
+      extraAccess = [ "ssh.git" ];
+    };
    nas =
    {
      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIIktNbEcDMKlibXg54u7QOLt0755qB/P4vfjwca8xY6V";
@@ -44,8 +46,6 @@ let
    {
      publicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIIg2wuwWqIOWNx1kVmreF6xTrGaW7rIaXsEPfCMe+5P9";
      initrdPublicKey = "AAAAC3NzaC1lZDI1NTE5AAAAIPW7XPhNsIV0ZllaueVMHIRND97cHb6hE9O21oLaEdCX";
-      # 默认仅包括wireguard访问的域名和直接访问的域名，这里写额外的域名
-      extraAccess = [ "ssh.git" ];
    };
  };
 in
--- a/devices/cross/wireguard.nix
+++ b/devices/cross/wireguard.nix
@@ -2,8 +2,8 @@ inputs:
 let
  publicKey =
  {
-    vps4 = "sUB97q3lPyGkFqPmjETzDP71J69ZVfaUTWs85+HA12g=";
    vps6 = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+    vps7 = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
    pc = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
    nas = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
    one = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
@@ -62,7 +62,7 @@ let
          # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
          (builtins.listToAttrs
          (
-            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps4" "vps6" "srv3" ])
+            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps6" "vps7" "srv3" ])
              ++ (builtins.map (n: { name = n; value = null; }) [ "pc" "nas" "one" "srv1-node0" "srv2-node0" ])
          ))
          # 校内网络
--- a/devices/jykang.xmuhpc/default.nix
+++ b/devices/jykang.xmuhpc/default.nix
@@ -1,8 +1,8 @@
-# sudo nix build --store 'local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log' .#jykang
-# sudo nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log' -qR ./result | grep -Fxv -f <(ssh jykang find .nix/store -maxdepth 1 -exec realpath '{}' '\;') | sudo xargs nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log' --export | xz -T0 | pv > jykang.nar.xz
-# cat data.nar | nix-store --import
-{ inputs, localLib }:
-let pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
+# sudo nix build --store 'local?store=/data/gpfs01/jykang/.nix/store&real=/nix/store' .#jykang
+# sudo nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&real=/nix/store' -qR ./result | sudo xargs nix-store --store 'local?store=/data/gpfs01/jykang/.nix/store&real=/nix/store' --export > data.nar
+# cat data.nar  | nix-store --import
+inputs:
+let pkgs = import inputs.nixpkgs (import ../../modules/system/nixpkgs/buildNixpkgsConfig.nix
 {
  inputs = { inherit (inputs.nixpkgs) lib; topInputs = inputs; };
  nixpkgs = { march = null; cuda = null; nixRoot = "/data/gpfs01/jykang/.nix"; };
@@ -10,7 +10,6 @@ let pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
 in pkgs.symlinkJoin
 {
  name = "jykang";
-  paths = with pkgs; [ hello iotop gnuplot localPackages.vaspkit pv btop ];
+  paths = with pkgs; [ hello iotop gnuplot ];
  postBuild = "echo ${inputs.self.rev or "dirty"} > $out/.version";
-  passthru = { inherit pkgs; };
 }
--- a/devices/jykang.xmuhpc/files/.bashrc
+++ b/devices/jykang.xmuhpc/files/.bashrc
@@ -35,7 +35,7 @@ if [ -f /etc/bashrc ]; then
 fi

 if [ -z "${BASHRC_SOURCED-}" ]; then
-	export PATH=$HOME/.nix/state/gcroots/current/bin:$HPCSTAT_SSH_BINDIR:$PATH:$HOME/bin:$HOME/linwei/chn/software/scripts
+	export PATH=$HPCSTAT_SSH_BINDIR:$PATH:$HOME/bin:$HOME/linwei/chn/software/scripts:$HOME/.nix/state/gcroots/current/bin
 	export BASHRC_SOURCED=1
 	if [ "${HPCSTAT_SUBACCOUNT}" == "lyj" ]; then
 		export PATH=$HOME/wuyaping/lyj/bin:$PATH
--- a/devices/jykang.xmuhpc/files/.config/nix/nix.conf
+++ b/devices/jykang.xmuhpc/files/.config/nix/nix.conf
@@ -1,2 +0,0 @@
-store = local?store=/data/gpfs01/jykang/.nix/store&state=/data/gpfs01/jykang/.nix/state&log=/data/gpfs01/jykang/.nix/log
-experimental-features = flakes nix-command
--- a/devices/jykang.xmuhpc/files/.ssh/authorized_keys
+++ b/devices/jykang.xmuhpc/files/.ssh/authorized_keys
@@ -10,7 +10,6 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwUhEAFHjkbUfOf0ng8I80YbKisbSeY4lq/byinV7lh
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5bg5cayOLfnfUBJz8LeyaYfP41s9pIqUgXn6w9xtvR lly
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBoDGk9HYphkngx2Ix/vef2ZntdVNK1kbS9pY8+TzI41 yxf
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJi6O1Sf1BBV1dYyH1jcHiws+ntwVfV29+6Paq1CQaET hss
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlBxisj3sU9QC8UC5gX6sakf7G03ybbkmHtD2cybuZA qmx

 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmJoiGO5YD3lbbIOJ99Al2xxm6QS9q+dTCTtlALjYI5f9ICGZJT8PEGlV9BBNCRQdgb3i2LBzQi90Tq1oG6/PcTV3Mto2TawLz5+2+ym29eIq1QIhVTLmZskK815FpawWqxY6+xpGU3vP1WjrFBbhGtl+CCaN+P2TWNkrR8FjG2144hdAlFfEEqfQC+TXbsyJCYoExuxGDJo8ae0JGbz9w1A1UbjnHwKnoxvirTFEbw9IHJIcTdUwuQKOrwydboCOqeaHt74+BnnCOZhpYqMDacrknHITN4GfFFzbs6FsE8NAwFk6yvkNXXzoe60iveNXtCIYuWjG517LQgHAC5BdaPgqzYNg+eqSul72e+jjRs+KDioNqvprw+TcBBO1lXZ2VQFyWyAdV2Foyaz3Wk5qYlOpX/9JLEp6H3cU0XCFR25FdXmjQ4oXN1QEe+2akV8MQ9cWhFhDcbY8Q1EiMWpBVC1xbt4FwE8VCTByZOZsQ0wPVe/vkjANOo+brS3tsR18= 00@xmuhpc
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxcIWDQxVyIRqCGR4uWtrh4tLc025+q6du2GVsox8IzmBFkjNY8Au5GIMP5BKRstxFdg3f/wam8krckUN9rv5+OHB9U8HGz77Xs0FktqRVNMaDPdptePZQJ9A9eW3kkFDfQnORJtiVcEWfUBS3pi0QFOHylnG27YyC/Vjx9tjvtJWKsQEVTFJbFHPdi+G7lHTpqIGx+/a2JN9O6uVujXXYvjSVXsd+CWB9VMZMvYCIz2Ecb6RqR3brj4FhRRl8zyCj+J4ACYFdGWL98fTab2uPHbpVeKrefFFA43JOD/4zwBx/uw7MAQAq0GunTV3FpBfIAQHWgftf2fSlbz20oPjCwdYn9ZuGJOBUroryex7AKZmnSYM3biLHcctQfZtxqVPEU3W/62MUsI/kZb9RcF24JRksMoS2XWTiv2HFf5ijQGLXXOjqiTlGncwiKf65DwkDBsSxzgbXk5Uo86viq6UITFXPx/RytU+SUiN4Wb7wcBTjt/+tyQd1uqc7+3DCDXk= 01@xmuhpc
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -4,7 +4,7 @@ inputs:
  {
    nixos =
    {
-      model = { type = "server"; private = true; };
+      model = { type = "desktop"; private = true; };
      system =
      {
        fileSystems =
@@ -19,15 +19,15 @@ inputs:
        };
        initrd.sshd = {};
        nixpkgs.march = "silvermont";
-        network = {};
+        networking = {};
      };
-      hardware.gpu.type = "intel";
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
      {
        sshd = {};
-        xray = { client.dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1"; xmuServer = {}; };
-        beesd."/".hashTableSizeMB = 10 * 128;
-        nfs."/" = [(inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc")];
+        xray.client = { enable = true; dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1"; };
+        beesd = { "/" = { hashTableSizeMB = 10 * 128; threads = 4; }; "/nix" = {}; };
+        nfs."/" = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc";
      };
    };
  };
--- a/devices/nas/secrets.yaml
+++ b/devices/nas/secrets.yaml
@@ -1,8 +1,16 @@
 xray-client:
    uuid: ENC[AES256_GCM,data:97aX07G5FPumdWcDxnYOs6fRgljXWuwyNXGg1d7zdbUUfNnb,iv:+wAC/DZXsg+evYFA4DMfLw5Ut3ExQl1RgZ/2AsNQDpo=,tag:ebD77muITHof+FQMydWobg==,type:str]
 wireguard: ENC[AES256_GCM,data:JaOSq474mGOoQQcdJ/j9fYo2e1vjXMPxJ69TOd079FrSkbzbIteWww5f8Xo=,iv:uy/NC2+tibL61XJDZK/spKjV9u0oXK4YzjFjYmCAL0k=,tag:en+c8cHaPvDqJL+EpQjr0g==,type:str]
-xray-xmu-server: ENC[AES256_GCM,data:3O5rFi5szla70M/c62JV4nGWKPSOREImrOucjeVYf9bde6K8,iv:PGCqlmHtaNuWOtAAeJ6O+CWFpMszijozU1OpUFrftjs=,tag:iGTOoNvQhhZy2FL9jy1KIQ==,type:str]
+wireless:
+    #ENC[AES256_GCM,data:wjStmDz44D13rg==,iv:7Qdqk/3VfS6kZNMSD6P4zyuRkzgIb1PcH56rWBhuD80=,tag:RVfRu9zMAenZBk3+RFC9wg==,type:comment]
+    "457": ENC[AES256_GCM,data:at6sfLdZUj7JTkumDLzoBoM6rNH3SGXvzso2ryYEXiFzy24e8cMKql2Sw3CHqWH9+cS6+rzuRLLeLJQMDN3dHw==,iv:nHEdqAIF7WK6kPkm01LoDmypvkHOhIR+tf9cAlv+1hs=,tag:3lMuOZ4qatv1LOSMwMiEoQ==,type:str]
+store:
+    signingKey: ENC[AES256_GCM,data:Y1nbOt2boQQ94oBjQDoH7J7tkCIVx4f7Nrq0AC5Bqq/uGZnd7UCPv8hLnbjVcPTPHLMwnwzD9yvdYrLv+Q2HZJJQfQjO+sXkVZI4TpFJkqTofvrmDk4PL5tkh/4=,iv:eOM6wCO/qQaf5MMXWLROKFkfo6avm6IWWpgK1mNx6VY=,tag:ZC5xsTDdyCe1VxaBIC0ozQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -22,7 +30,8 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-30T10:53:22Z"
-    mac: ENC[AES256_GCM,data:XJIKLsszOcJfL9RDcFs7nTDfVIxUGtwhKZhkC7eCKni03b3M/sl2cIwAJ/L20Q+riP2HFcS1ljQA+SjlnY29KWr7DqJ1dM0qcqHjMSlWjurMWPgD4Lf8C7kx2J+6naYiQotQb6y7AfRF9XxAJUaHQe9DdlqHT/bmbtVW5VN1tzs=,iv:IhU7Wo19KOsqxdlSuZg3KtDc08E0dUq2Ahb1J09iLK4=,tag:N9TumoFTKEw/4DT51Lyjjg==,type:str]
+    lastmodified: "2025-04-23T07:15:56Z"
+    mac: ENC[AES256_GCM,data:Ex0JCgpvxHoEOVB+O+cXLIU5S3IWMgznUMDM6G3JhE+KuVyGyze+Cf0BRHLAtko2aszyIIMOx3NH2DoCl6m7gR9UbPRwzIwwnuaGGZ0Va8hTjosB/76LtDT6w3xkLdV4AjmYCu/Q1I01CvjL3OVQO1JLYn3V8JaU8WImy2wfhoQ=,iv:81aBMh8ls1MH/VybwEvr3aQtETnIHLv45i57Q5j8yt8=,tag:BBeuyAbajgsNQSq/7Un79Q==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -17,16 +17,17 @@ inputs:
          luks.auto."/dev/disk/by-partlabel/one-root" = { mapper = "root"; ssd = true; };
          swap = [ "/nix/swap/swap" ];
          resume = { device = "/dev/mapper/root"; offset = 4728064; };
+          rollingRootfs = {};
        };
        nixpkgs.march = "tigerlake";
      };
-      hardware.gpu.type = "intel";
+      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
      {
-        xray.client = {};
+        xray.client.enable = true;
        beesd."/".hashTableSizeMB = 64;
        sshd = {};
-        waydroid = {};
+        kvm = {};
      };
      bugs = [ "xmunet" ];
    };
--- a/devices/pc/bios/Bootx64.efi
+++ b/devices/pc/bios/Bootx64.efi
--- a/devices/pc/bios/DisplayEngine.efi
+++ b/devices/pc/bios/DisplayEngine.efi
--- a/devices/pc/bios/SetupBrowser.efi
+++ b/devices/pc/bios/SetupBrowser.efi
--- a/devices/pc/bios/UiApp.efi
+++ b/devices/pc/bios/UiApp.efi
--- a/devices/pc/color/TPLCD_161B_Default.icm
+++ b/devices/pc/color/TPLCD_161B_Default.icm
--- a/devices/pc/color/TPLCD_161B_Native.icm
+++ b/devices/pc/color/TPLCD_161B_Native.icm
--- a/devices/pc/color/TPLCD_161B_Native_HDR.icm
+++ b/devices/pc/color/TPLCD_161B_Native_HDR.icm
--- a/devices/pc/color/TPLCD_161B_REC709.icm
+++ b/devices/pc/color/TPLCD_161B_REC709.icm
--- a/devices/pc/color/TPLCD_161B_sRGB.icm
+++ b/devices/pc/color/TPLCD_161B_sRGB.icm
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -12,15 +12,9 @@ inputs:
          mount =
          {
            vfat."/dev/disk/by-uuid/7A60-4232" = "/boot";
-            btrfs."/dev/mapper/root1" =
-            {
-              "/nix" = "/nix";
-              "/nix/rootfs/current" = "/";
-              "/nix/remote/jykang.xmuhpc" = "/data/gpfs01/jykang/.nix";
-              "/nix/remote/xmuhk" = "/public/home/xmuhk/.nix";
-            };
+            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.nas"}:/" =
-              { mountPoint = "/nix/remote/nas"; hard = false; };
+              { mountPoint = "/nix/nas"; hard = false; };
          };
          luks.auto =
          {
@@ -29,35 +23,39 @@ inputs:
              { mapper = "swap"; ssd = true; before = [ "root1" ]; };
          };
          swap = [ "/dev/mapper/swap" ];
+          resume = "/dev/mapper/swap";
+          rollingRootfs = {};
        };
        grub.windowsEntries."08D3-10DE" = "Windows";
-        nix =
-        {
-          marches =
-          [
-            "znver2" "znver3" "znver4"
-            # FXSR SAHF XSAVE
-            "sandybridge"
-            # FXSR PREFETCHW RDRND SAHF
-            "silvermont"
-            # SAHF FXSR XSAVE RDRND LZCNT HLE
-            "haswell"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
-            "broadwell"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-            "skylake" "cascadelake"
-            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
-            "tigerlake"
-            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
-            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
-            "alderlake"
-          ];
-          remote.master.host.srv2-node0 = [ "skylake" ];
-        };
+        nix.marches =
+        [
+          "znver2" "znver3" "znver4"
+          # FXSR SAHF XSAVE
+          "sandybridge"
+          # FXSR PREFETCHW RDRND SAHF
+          "silvermont"
+          # SAHF FXSR XSAVE RDRND LZCNT HLE
+          "haswell"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+          "broadwell"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+          "skylake" "cascadelake"
+          # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
+          "tigerlake"
+          # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+          # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+          "alderlake"
+        ];
        nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
+        kernel.variant = "cachyos-lts";
        sysctl.laptop-mode = 5;
      };
-      hardware = { gpu = { type = "nvidia"; nvidia.dynamicBoost = true; }; legion = {}; };
+      hardware =
+      {
+        cpus = [ "amd" ];
+        gpu = { type = "nvidia"; nvidia = { dynamicBoost = true; driver = "beta"; }; };
+        legion = {};
+      };
      services =
      {
        samba =
@@ -72,20 +70,39 @@ inputs:
          };
        };
        sshd = {};
-        xray = 
+        xray.client =
        {
-          client.dnsmasq.hosts = builtins.listToAttrs
+          enable = true;
+          dnsmasq.hosts = builtins.listToAttrs
          (
            (builtins.map
              (name: { inherit name; value = "144.34.225.59"; })
              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
+            ++ (builtins.map
+              (name: { inherit name; value = "0.0.0.0"; })
+              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
          )
-          // { "4006024680.com" = "192.168.199.1"; };
-          xmuClient = {};
+          // {
+            "4006024680.com" = "192.168.199.1";
+            "hpc.xmu.edu.cn" = "121.192.191.11";
+          };
+        };
+        acme.cert."debug.mirism.one" = {};
+        frpClient =
+        {
+          enable = true;
+          serverName = "frp.chn.moe";
+          user = "pc";
+          stcpVisitor =
+          {
+            "yy.vnc".localPort = 6187;
+            "temp.ssh".localPort = 6188;
+          };
        };
        nix-serve = {};
        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
        beesd."/" = { hashTableSizeMB = 4 * 128; threads = 4; };
+        gamemode = { enable = true; drmDevice = 0; };
        slurm =
        {
          enable = true;
@@ -105,17 +122,17 @@ inputs:
          };
        };
        ollama = {};
-        podman = {};
+        docker = {};
        ananicy = {};
        keyd = {};
-        lumericalLicenseManager.macAddress = "74:5d:22:c7:d2:97";
+        lumericalLicenseManager = {};
        searx = {};
-        kvm.aarch64 = true;
+        kvm = {};
        nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
-        nfs."/" = [ "192.168.84.0/24" ];
+        nfs."/" = "192.168.84.0/24";
      };
      bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
-      packages = { mathematica = {}; vasp = {}; android-studio = {}; };
+      packages = { android-studio = {}; mathematica = {}; };
    };
    boot.loader.grub =
    {
@@ -149,6 +166,7 @@ inputs:
    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
    # 允许kvm读取物理硬盘
    users.users.qemu-libvirtd.extraGroups = [ "disk" ];
+    networking.extraHosts = "144.34.225.59 mirism.one beta.mirism.one ng01.mirism.one";
    services.colord.enable = true;
  };
 }
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -1,5 +1,10 @@
 xray-client:
    uuid: ENC[AES256_GCM,data:XU7/GZ8cJmDwNsrQfoFHrquZT5QkjvTPZfnghX3BLyvPLlrX,iv:e/BQkZ5ydWD4P/qT9OUloB8/cXImfkG3YZnuIeNLoTc=,tag:EW3ZBzGnyIrUfcMeJqm4aA==,type:str]
+frp:
+    token: ENC[AES256_GCM,data:0mE8/cWqHKNquCIiqgbjcNhipKk7KEfbZ+qRYbu+iZr7AH9QjfYZQiMJNp4Aa3JWwBLYAnpf,iv:ID4cc8Tn0H9b1CimXlPamMlhlAkafhRApDHo/CCQ4BE=,tag:BUuU/BCj16R7FlKlpubawA==,type:str]
+    stcp:
+        yy.vnc: ENC[AES256_GCM,data:IsZWkNGYHrbQcgvOSURDnA==,iv:4XO8RFBdNopLKYxCACmkXLMPu0wIVx64y0C7m2bsTVA=,tag:fMHzU9aQm0bRr8pTKwpuHQ==,type:str]
+        temp.ssh: ENC[AES256_GCM,data:XG9WpTR8Bw==,iv:XiMTPN8Gx1nNssf4r+VXTvUATiUNsOYJ2jeHjhDSyTs=,tag:JS3NlA4cs/6IA19PJYrStg==,type:str]
 store:
    signingKey: ENC[AES256_GCM,data:TsB1nA0Rf2AsYyH59WpUK53pTCX2JdrGQjkJ9A9BfWLLmw3EMnPoaLHG12rv1R2/xRU7rP+iVhXb77g60I/Kn4ehun3ogMmK1oEAKyQcxudBUJFk+SeijaQLr2A=,iv:e2rdGBVOPS1nyC3pXhs5r0WyEkqxcpCnX3eAcBCj93M=,tag:HwccjH2Wms5/TevU2IuzNw==,type:str]
 postgresql:
@@ -11,12 +16,15 @@ mariadb:
    slurm: ENC[AES256_GCM,data:fGvNMmqk7Cee28VJ1QoBVrBbgIUbj/F1W0SRjdP8N4K/M8Wx4AVm1kAr0IAhPWyDLXlIjM1NUvuEV5BpYDBdjg==,iv:rFTMJ4x2kgENQUA8ftSaLjdOc25i5mWR3UYbdq54vjs=,tag:6feD0eCSv7bcHWBveLNJwg==,type:str]
 nix:
    remote: ENC[AES256_GCM,data:uosYkxTCB0wiY+Uufk//OcBZFN3EzbZoQGZ95M9eZMjQ5AobAZqosi4laE+EMcZL1CqYqlWXaSoEUOB8biUaZPseo+1AX1TlmUgZ7QpkfOX0VKZu01C6C+lVyqVqMFq6z1BFyX/oeITMIfnd4a/2KwJCHLAZ4hMkJ5p+aJwByKGa3N/2m41HH/1S3z7pYQWj7YJxunTPPG6WNSiRncQki11rvmddwnXmsBF89+jW1Phge8U295haC57T5oIGPxR645IeTK4ZUlL8eVuZ+BhsnwbkYcaxvjSwe+DOIVPupR8GW+gis7KxwE89kqvnQhinamexcPUz4lGHlqO/Xn6jrJx6T/wXF+19epAzeHapYte3dTWNsdPwPLPJihT16YT5fwrLnH3zq8kexWz1crmnCGUoaBs4S2tHWHLgv2lTv0IHLx5F6ijpDBj/Avg9YILIURzdeea+rBxdycHasUDTVlJtYKRH5J+WbAKWI+oJ5qmXjIRUYL+O9xIUfOGO+1b3xs8MYxRWuvDV2P88N8vN,iv:yQQp5wjbSVn1oia5yL7d6GF9Vo704G0iOQRGMbzQHzg=,tag:bpBag5y5n+7ojOa8QOcDvA==,type:str]
+wechat2tg:
+    token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
 searx:
    secret-key: ENC[AES256_GCM,data:KhIP+Rz3rMfNgPEGTlKGvm6gl1/ZuPI=,iv:GcaLEJHKJO3n6IaeiFr9PaJ6eNx04/VjX3UgmBF429g=,tag:HkplyH9hTHUaEZ709TyitA==,type:str]
-xray-xmu-client:
-    uuid: ENC[AES256_GCM,data:XiUkReTJLAxZNWFVeD6EiOtUX5tsyPLFi6QyDBdHyB4v5/mD,iv:QppdtP2CFDEVhlrmDJKYBGc1zYGJvpGYxLfsBAMxDSI=,tag:jzMSFRit+aBzWMkaa3+5hA==,type:str]
-    cookie: ENC[AES256_GCM,data:fx/cqNNpI71FslngfeXFQA==,iv:xZEtOsKgS/8xNqF4B6NKI9+klrpNcraW17KKirMnEfM=,tag:YyczKED2Yo0D6I+RvMjJLg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -36,7 +44,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-30T11:24:37Z"
-    mac: ENC[AES256_GCM,data:V6Gs9hCPIb42nW81Gmy1dz5LFLeX97UuzVbvst/rtuSJHdFzXKxYqIGjHNRK5mGWG/NdTXQ79ELlvpSOgKYAk6gn9ZMn9wCDDbe6spDoGBWL4Ky7mCiSPRcLZ++J+2nP0Q987kZ6IMdMWkFNJmOKWBX/nnp4/aicwyteqNHt4cI=,iv:1wWS0D4RJeWKERfqMQRB75Nh1oKSQzF+r5yOphMrg9Q=,tag:DBPZx1+X7nMLW9xsyEn62A==,type:str]
+    lastmodified: "2025-04-13T05:59:15Z"
+    mac: ENC[AES256_GCM,data:/m/cioV71s7HJ7ObIDCr69wDLn2xk/lTRqmUCx46u7tzOwMsYqU6DghBsZuaUN1r22CbMi1wtmSziDisKStOGY27pswNe7IuEo4IhVz5sJNxcWCxpYo8ttrCUeaJ7Y0vFbseIn1l1UObfubhhvVdxDsE0RoxLK7Ka8hJW5aEksM=,iv:GKmlbRXFexMegBWBVx4vusA0ceZZnwGIN2FkSpGXMdY=,tag:yoCnH94Ph0AUjkN3CTg6wA==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/srv1/default.nix
+++ b/devices/srv1/default.nix
@@ -16,8 +16,10 @@ inputs:
              { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
          };
          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
        };
      };
+      hardware.cpus = [ "intel" ];
      services =
      {
        sshd.passwordAuthentication = true;
@@ -60,8 +62,7 @@ inputs:
          ];
        };
      };
-      packages = { vasp = {}; lumerical = {}; };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" "zgq" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" ];
    };
  };
 }
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -8,21 +8,15 @@ inputs:
      system =
      {
        nixpkgs.march = "cascadelake";
-        network =
+        networking.static =
        {
-          static =
-          {
-            eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
-            eno146 = { ip = "192.168.178.1"; mask = 24; };
-          };
-          masquerade = [ "eno146" ];
-          trust = [ "eno146" ];
+          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+          eno146 = { ip = "192.168.178.1"; mask = 24; };
        };
      };
      services =
      {
-        sshd.motd = true;
-        xray.client.dnsmasq.extraInterfaces = [ "eno146" ];
+        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
        beesd."/" = { hashTableSizeMB = 128; threads = 4; };
        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
@@ -30,5 +24,10 @@ inputs:
      packages.packages._prebuildPackages =
        [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
    };
+    # allow other machine access network by this machine
+    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
+    # without this, tproxy does not work
+    # TODO: why?
+    networking.firewall.trustedInterfaces = [ "eno146" ];
  };
 }
--- a/devices/srv1/node1/default.nix
+++ b/devices/srv1/node1/default.nix
@@ -7,14 +7,13 @@ inputs:
      system =
      {
        nixpkgs.march = "broadwell";
-        network =
-        {
-          static.eno2 =
-            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-          trust = [ "eno2" ];
-        };
+        networking.static.eno2 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd."/".threads = 4;
    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
  };
 }
--- a/devices/srv1/node2/default.nix
+++ b/devices/srv1/node2/default.nix
@@ -7,25 +7,26 @@ inputs:
      system =
      {
        nixpkgs.march = "broadwell";
-        network =
+        networking.static =
        {
-          static =
-          {
-            br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
-            eno2 = { ip = "192.168.178.3"; mask = 24; };
-          };
-          trust = [ "eno2" ];
-          bridge.br0.interfaces = [ "eno1" ];
+          br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
+          eno2 = { ip = "192.168.178.3"; mask = 24; };
        };
        fileSystems.mount.btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
          { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
      };
      services =
      {
-        xray.client = {};
+        xray.client.enable = true;
        beesd."/".threads = 4;
        kvm.nodatacow = true;
      };
    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+    # add a bridge for kvm
+    # 设置桥接之后，不能再给eno1配置ip，需要转而给 br0 配置ip
+    networking.bridges.br0.interfaces = [ "eno1" ];
  };
 }
--- a/devices/srv2/default.nix
+++ b/devices/srv2/default.nix
@@ -7,13 +7,18 @@ inputs:
      model.type = "server";
      system =
      {
-        fileSystems.mount = let inherit (inputs.config.nixos.model.cluster) clusterName nodeName; in
+        fileSystems =
        {
-          vfat."/dev/disk/by-partlabel/${clusterName}-${nodeName}-boot" = "/boot";
-          btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root1" =
-            { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc"}:/" =
-            { mountPoint = "/nix/remote/pc"; hard = false; };
+          mount = let inherit (inputs.config.nixos.model.cluster) clusterName nodeName; in
+          {
+            vfat."/dev/disk/by-partlabel/${clusterName}-${nodeName}-boot" = "/boot";
+            btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root1" =
+              { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            nfs."${inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc"}:/" =
+              { mountPoint = "/nix/pc"; hard = false; };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
        };
        nixpkgs.cuda.capabilities =
        [
@@ -27,10 +32,10 @@ inputs:
          "8.9"
        ];
      };
-      hardware.gpu.type = "nvidia";
+      hardware.gpu = { type = "nvidia"; nvidia.open = false; };
      services =
      {
-        sshd = {};
+        sshd = { passwordAuthentication = true; groupBanner = true; };
        slurm =
        {
          enable = true;
@@ -75,8 +80,7 @@ inputs:
          };
        };
      };
-      packages.vasp = {};
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" "zqq" "qmx" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
    };
  };
 }
--- a/devices/srv2/node0/default.nix
+++ b/devices/srv2/node0/default.nix
@@ -5,30 +5,34 @@ inputs:
    nixos =
    {
      model.cluster.nodeType = "master";
+      hardware.cpus = [ "intel" ];
      system =
      {
        nixpkgs.march = "skylake";
-        network =
+        networking =
        {
          static.eno2 = { ip = "192.168.178.1"; mask = 24; };
-          wireless = [ "409" ];
-          masquerade = [ "eno2" ];
-          trust = [ "eno2" ];
+          wireless = [ "457的5G" ];
        };
-        nix.remote.slave = {};
-        fileSystems.swap = [ "/dev/disk/by-partlabel/srv2-node0-swap" ];
      };
      services =
      {
-        xray.client = { dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; }; };
+        xray.client =
+        {
+          enable = true;
+          dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; };
+        };
        beesd."/" = { hashTableSizeMB = 16 * 128; loadAverage = 8; };
        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
        groupshare = {};
        hpcstat = {};
        ollama = {};
-        sshd = { groupBanner = true; motd = true; };
      };
    };
+    # allow other machine access network by this machine
+    systemd.network.networks."10-eno2".networkConfig.IPMasquerade = "both";
+    # without this, tproxy does not work
+    networking.firewall.trustedInterfaces = [ "eno2" ];
  };
 }
--- a/devices/srv2/node0/secrets.yaml
+++ b/devices/srv2/node0/secrets.yaml
@@ -6,9 +6,13 @@ mariadb:
 hpcstat:
    key: ENC[AES256_GCM,data:+Z7MRDkLLdUqDwMrkafFKkBjeCkw+zgRoAoiVEwrr+LY0uMeW8nNYoaYrfz6Ig8CMCDgX3n/DMb0ibUeN32j3HShQIStbtUxRPGpQMyH+ealbvgskGriTFpST4VPyQxNACkUpq/e+sh2CmLbKkSxhamkjKOXwsfqrBlgVbEkp7u7HkWGuAaYL1oPGt0Q94fWXwH0UVhRYZYQ2iFA/S6SEZY8gxaTIGDKUdWU9+fOHzPQ5WfhxtKYU4p4ydyfYsAt6ffqnPSx/SI72GsUCOJ4981JX8TuvnEzx3gQLVFYheK6NibTWCy6eODbvguieVOTHSvCPTrHmoP12lHVWU2kKzLwv70Jl7sXyzKHYROG0D+/z/4DKlNeotKM/IA0q2cST08/lwSKN7WDDmrt+O6xXhvwby28ZYKEsSvvrfV+VIKzHPl84ZKbUEX5xv/GHc3THfznUvKKz5PzDiqrkjCkEt5PRMsVW9A6MU1+QEUr+sXLLtcUd2CCL87c8CpwNHJx1us6vJ4ji1gu0PGoT+60,iv:yU6j9W2Hs2D34uHMJqqPFbNy2pNEZY2kzXoNdhPMSmA=,tag:TNvEfMVrhu7HrNxY8qe5mg==,type:str]
 wireless:
-    #ENC[AES256_GCM,data:n9OPSJsB7yNk,iv:xQzKJxqPB7uT83m/B4UoOje6NQbPLhuHR7Hp93oNz8A=,tag:gtsTx6ALnS/7fIDd7VimOg==,type:comment]
-    "409": ENC[AES256_GCM,data:XJ2apDx9E4RM7YzK6wYzxn4eBkVS3l6LIaMtUai2MZ/W0xkaixyV/g/s+cVQtgph2gEcNoLOWbsxr3h8CsrOTA==,iv:O643ytrgHKB4RM6lZKZcr0fLmS2icRnek9praw43jWc=,tag:6Pk7CmiJyvAeW/1V4mvRJQ==,type:str]
+    #ENC[AES256_GCM,data:xrg3Wxj/ghbWgg==,iv:6stu7voI5no2Y3YmnMrvTS8hev3eqjoWAyD5zTgyehc=,tag:cxkS7y7S1oM+/SJmlT10fw==,type:comment]
+    457的5G: ENC[AES256_GCM,data:QjHlyGU4JIYymyh41T+c33T3EOpbqDOoD3U+v6/BzjlWLLeZQXU2hwPCVh4fi2bwn7yNkp4ygAYmFPVPZWoT1A==,iv:Tc6Guzsn5hkjWH6UWSb1KlfWCBXIi2OWdn/wttmCXnQ=,tag:FhyH6JmjSTuqSeFy+GyQhg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -28,7 +32,8 @@ sops:
            M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
            LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-10T10:08:37Z"
-    mac: ENC[AES256_GCM,data:ELeHLFJuOUs8CFIuu08zqp56AijpxxLKlfUo6cWmqwURy/BC6CTFqkNwsD8NirCzSsNTRnwk3pAVXPjJCrk8rnnH4uqiA639h3qMdEpHJLsVhv2+ounGObW7+R/IYJQaSmBWHzZimQsAbp2eVufu3mnu3wjUOhXM6xs0ofuxLWM=,iv:M7PK2S4Okb0MhsJ6d/bJfkMUOoXUMwbWVsHiuxE6Nt4=,tag:4QwSM0dU0mY5Xs03RS1FUw==,type:str]
+    lastmodified: "2025-04-10T10:44:43Z"
+    mac: ENC[AES256_GCM,data:6EeWT8IiCGyRdR/9WDoTTM8bBuhzf2LtP1kahCgfvFpU6g5HB+qG5O0eXaL0DMKg7OQJKHIS/wZVaEierVwno0CnP1WR7y9l6Rlab2nVG4YCNkEkwqZgIWFOUi0aZrZQc7WC3rUk1gxiJK38nEa4ebk8oqAbyHyKHsFAeUcMbqA=,iv:oqRLvYsXct+OwcymXslEH4o03vLNeV2eU/4zK8R+gKs=,tag:0d1DYjCGRewUd4aHPIpFSw==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/srv2/node1/default.nix
+++ b/devices/srv2/node1/default.nix
@@ -4,19 +4,18 @@ inputs:
  {
    nixos =
    {
+      hardware.cpus = [ "amd" ];
      system =
      {
        nixpkgs.march = "znver3";
-        network =
-        {
-          static.enp58s0 =
-            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-          trust = [ "enp58s0" ];
-        };
-        fileSystems.swap = [ "/nix/swap/swap" ];
+        networking.static.enp58s0 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd."/".hashTableSizeMB = 64;
    };
    services.hardware.bolt.enable = true;
+    boot.initrd.systemd.network.networks."10-enp58s0" = inputs.config.systemd.network.networks."10-enp58s0";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "enp58s0" ];
  };
 }
--- a/devices/srv3/README.md
+++ b/devices/srv3/README.md
@@ -12,7 +12,7 @@
  * 希望内存中的数据一直驻留在内存中（而不是被交换到 swap 中）。
 * **可能会超售**，但我凭良心保证，当你需要时，仍然可以占满内存和硬盘；长期占满硬盘和内存不算滥用。
  * 前期肯定不会超售（笑死，根本没有那么多用户）。
-  * 永远不会滥售；但后期可能会视情况调整价格。如果涨价，会延迟三个月生效。如果降价则立即生效。
+  * 永远不会滥售；但后期可能会视情况调整价格。
  * 万一出现卖超太多了、不够用的情况，我会自掏腰包增加母鸡配置。
 * 实现细节：
  * 硬盘会使用 raw 格式，放置在启用 CoW 的 btrfs 子卷中；不预先分配，用到时再分配。
@@ -41,9 +41,10 @@
  独立的 IPv6 免费，但暂不支持（技术上没有准备好，如果有人有需要我就去准备）。
 * 只卖朋友和朋友的朋友（总之得有人保证别拿去做坏事）。
  若此定价对您来说仍然难以接受，可以联系我，打五折或者免费。
-* 此价格 2025 年 9 月 17 日前有效。之后大概率也不会调整，但保留调整的权利。
+* 此价格有效期三个月（2025-05-17 至 2025-08-17）。
+  05-17 前免费，08-17 后定价会视情况调整（例如将流量计入收费项目，内存部分相应降价），在那之前会公布新的定价。
 * 预计收入无法覆盖成本。如果某个月的收入高于成本，承诺会将多出的部分捐出去。
-* 非 kvm 虚拟机的服务（例如，只跑一个 podman 容器，只跑某一个服务）定价私聊，大致上是上方价格再加上我的工作成本（事少的免费，事多的就要实收了）。
+* 非 kvm 虚拟机的服务（例如，只跑一个 docker 容器，只跑某一个服务）定价私聊，大致上是上方价格再加上我的工作成本（事少的免费，事多的就要实收了）。
 * 配置随时可以调整。所以按照自己这个月够用的来就行，不需要为未来留余量。但每次调整都需要重启虚拟机。
 * 母鸡价格 40 美元每月，配置在下方列出。
  * 机房: LAX3 （IP：srv3.chn.moe）
@@ -85,9 +86,9 @@

 **如何调整虚拟机启动顺序（重启到 iso 而不是硬盘）？**

-先重启虚拟机，然后马上连接 VNC，可以看到“Tiano Core”的提示。这个提示只会停留 15 秒，所以重启虚拟机后要迅速连接 VNC。
-在这个界面按 ESC 就可以进入虚拟机的 BIOS，在这里可以修改虚拟机的一些设置（就像实体机的 BIOS 那样）。
-如果只是想临时从 ISO 启动，可以在这里选择“Boot Manager”，然后选择带 “CDROM” 那一项就可以了。
+先重启虚拟机，然后马上连接 VNC，就可以看到“按 ESC 选择启动菜单”或者“Tina Core”的提示。在这个界面按 F2 或者 ESC 就可以临时调整启动顺序。
+
+这个界面只会停留 15 秒，所以重启虚拟机后要迅速连接 VNC。

 **如何调整硬盘大小？**

--- a/devices/srv3/default.nix
+++ b/devices/srv3/default.nix
@@ -15,98 +15,39 @@ inputs:
            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
          };
          swap = [ "/dev/mapper/swap" ];
+          rollingRootfs = {};
        };
        nixpkgs.march = "haswell";
        initrd.sshd = {};
-        network =
+        networking.static.eno1 =
        {
-          bridge.nixvirt.interfaces = [ "eno1" ];
-          static.nixvirt =
-          {
-            ip = "23.135.236.216";
-            mask = 24;
-            gateway = "23.135.236.1";
-            dns = "8.8.8.8";
-          };
+          ip = "23.135.236.216";
+          mask = 24;
+          gateway = "23.135.236.1";
+          dns = "8.8.8.8";
        };
      };
+      hardware.cpus = [ "intel" ];
      services =
      {
-        beesd."/" = { hashTableSizeMB = 128; threads = 4;};
+        # 大部分空间用于存储虚拟机（nodatacow），其它内容不多
+        beesd."/".hashTableSizeMB = 32;
        sshd = {};
-        nixvirt.instance =
+        nixvirt =
        {
-          alikia =
-          {
-            memory.sizeMB = 1024;
-            cpu.count = 1;
-            network = { address = 2; portForward.tcp = [{ host = 5689; guest = 22; }]; };
-          };
+          alikia = { memoryGB = 1; cpus = 1; address = 2; portForward.tcp = [{ host = 5689; guest = 22; }]; };
          pen =
          {
-            memory.sizeMB = 512;
-            cpu.count = 1;
-            network =
-            {
-              address = 3;
-              portForward =
-              {
-                tcp =
-                [
-                  { host = 5690; guest = 22; }
-                  { host = 5691; guest = 80; }
-                  { host = 5692; guest = 443; }
-                  { host = 22000; guest = 22000; }
-                ];
-                udp = [{ host = 22000; guest = 22000; }];
-                web = [ "natsume.nohost.me" ];
-              };
-            };
-          };
-          test =
-          {
-            owner = "chn";
-            memory.sizeMB = 4096;
-            cpu.count = 4;
-            network =
-            {
-              address = 4;
-              vnc.openFirewall = false;
-              portForward = { tcp = [{ host = 5693; guest = 22; }]; web = [ "example.chn.moe" ]; };
-            };
-          };
-          reonokiy =
-          {
-            memory.sizeMB = 4 * 1024;
-            cpu.count = 4;
-            network = { address = 5; portForward.tcp = [{ host = 5694; guest = 22; }]; };
+            memoryGB = 1;
+            cpus = 1;
+            address = 3;
+            portForward.tcp = [ { host = 5690; guest = 22; } { host = 5691; guest = 80; }{ host = 5692; guest = 443; }];
          };
        };
-        rsshub = {};
-        misskey.instances =
-          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
-        synapse.instances =
-        {
-          synapse.matrixHostname = "synapse.chn.moe";
-          matrix = { port = 8009; redisPort = 6380; };
-        };
-        vaultwarden = {};
-        photoprism = {};
-        nextcloud = {};
-        freshrss = {};
-        send = {};
-        huginn = {};
-        httpapi = {};
-        gitea = {};
-        grafana = {};
-        fail2ban = {};
-        xray.server = {};
-        podman = {};
-        peertube = {};
-        nginx.applications.webdav.instances."webdav.chn.moe" = {};
-        open-webui.ollamaHost = "192.168.83.3";
      };
-      user.users = [ "chn" "aleksana" "alikia" "pen" "reonokiy" ];
+      user.users = [ "chn" "aleksana" "alikia" "pen" ];
    };
+    # TODO: use a generic way
+    boot.initrd.systemd.network.networks."10-eno1" = inputs.config.systemd.network.networks."10-eno1";
  };
 }
--- a/devices/srv3/secrets.yaml
+++ b/devices/srv3/secrets.yaml
@@ -1,90 +1,12 @@
 wireguard: ENC[AES256_GCM,data:Coe4iIEnJVDb4a9KUVTRkXl4kng5Zo6x1Iyr0ErgR2b9bN287mvO6jPUPSc=,iv:fiNUUKobJjitcoxBemIah5Cl5+dSz2Q7sbiOT8bDrRM=,tag:rHfNeRGTxnyVYAu8P/2ewA==,type:str]
 nixvirt:
    alikia: ENC[AES256_GCM,data:sP3sWN0RrBU=,iv:TetUcaxsRXl0QsGAyXbVUAW12AXjChVN1/X+ku+3nO4=,tag:kBupoPqVlwHuCnwVdBJBKQ==,type:str]
-    pen: ENC[AES256_GCM,data:okvzUul3UXk=,iv:hcBhsUMP8jdhhKuKdHD1lZi8ixNAC729HfMQ79UzyNk=,tag:SRRav39ScHn0O/sf86CIOw==,type:str]
-    test: ENC[AES256_GCM,data:MYlMmzgbW9c=,iv:q1qPAwFTh0fj2IHBIlnrOMbTU2BnwIYzOFUHVqWCY/Q=,tag:Mb2bJJemg/LxpKI5whNvQw==,type:str]
-    reonokiy: ENC[AES256_GCM,data:J/ZM0Vavmnk=,iv:ZT1cMF/JWLWmXyBx331XkBQerOhLJeOd0a53jcSC4S4=,tag:/WCwzOg5LlAS5ZaiI5DSIw==,type:str]
-nginx:
-    detectAuth:
-        chn: ENC[AES256_GCM,data:cek6iIlJXgU191uzq44rTw==,iv:r7aMj5UzH1sbKkxvS8oyw6kpIcpRygD4ype8qkmnNa0=,tag:x2jWZnnFCO0sHj/OS2BQbA==,type:str]
-        led: ENC[AES256_GCM,data:JiCmbknE,iv:Z2RFOWIPUk2jaR6qd4PgRb7LwwHSKNapPQq996Mx+yI=,tag:mq6Vtwjw31DKig3Dl4xU+w==,type:str]
-redis:
-    rsshub: ENC[AES256_GCM,data:+wEclSJGMLBMt7Ss2fMlUgq5kRyNiOheQnRvVtbW47eG2mFODBaw04Qftb80aaSE6YpCTNslBGdIjcpIC7FTUA==,iv:6Caod/1AnUxEEC7ZwVrtDZ1kP6Qu50R+9I3eda/p0pk=,tag:/EYXZ6yl3QupVrzIHQMdbA==,type:str]
-    misskey-misskey: ENC[AES256_GCM,data:nCrH0B3A5B6yMAgTd5TA56PKqJUxwtHeS6BvuUseyKAVbqH581TGsO80mNQ0AJRjviw5o3ftTay79nJnmGld6Q==,iv:fhGcgbpNBo9yUpFDWtuzMos2iPhMdWyc88S0fZDxGao=,tag:QIZ72z5VBqd5pFgaEvMTZg==,type:str]
-    misskey-misskey-old: ENC[AES256_GCM,data:WS+SVmxYs3cNc/+sJQLNYDO0ZkZvmqzW9hCGdDae/N06KGicgiGOKV8LDe1UviGGGzXzB5VG0YvAprEGhUURcQ==,iv:6Ur9FL2+RzU4tfK2V4TaaCpempS1JSSMHz6ebg3mp7c=,tag:qCNqJ3SauPdpxo3f4NVg2g==,type:str]
-    nextcloud: ENC[AES256_GCM,data:pwxtefU7CjTxyogcpPpvQxvdnYIpggaBHZ+/PaT9lhVfvFcNtBBZ1eeOGbUXMZc7BnkFAUDVTVjr5KV75CeX6Q==,iv:65K3PsNfesaAJ7rSRI66o5UEM3SW5KdUnGc4h9WMkUE=,tag:e2nx9vTlkGekvhm8lYsMkg==,type:str]
-    send: ENC[AES256_GCM,data:QCfqbGYuBrlwfuHiSsZIZ1OBVnSO9QjhlPWGVRysKbQK+As/RGbJ5QYtPOyKfRg2L1d5Irfu1aGRoVrzpA8O1Q==,iv:MWzJP+JBwf131X030MnzNKMJ3d4Fq/GtbHpuan4N53Y=,tag:z29HS/FQXTvgN1e1HZFJkg==,type:str]
-    synapse-synapse: ENC[AES256_GCM,data:C6eXXK6SvMmvIa8dVjttorYBScC1SfILqXPMYDCpewVyJCUFzQK3NB8KUz9TMov4P5n+Lm5YItjrUgnhNJA5jQ==,iv:ziJ5JK/+M9d+R6/O/4hQy5DPBw/4XSZVQvIcy55aHRY=,tag:nv0rre2/kyhKu4C5JSE5dg==,type:str]
-    synapse-matrix: ENC[AES256_GCM,data:E72t568kxMjz+x+nC0kIJJFfgt6njlW8Wx6RuqnI736vW7IaA7scNVQ03lXpqZlKS1M7wUhb1QRPowJxNjSK7A==,iv:5qGHIWb7XXrnbjPQVWt+EcX/yDEV4Ny+TIo5OaRHwOk=,tag:O+SQBmZ7xpToSJYmcSCRWA==,type:str]
-    peertube: ENC[AES256_GCM,data:lxf5JtlGfDsYY2kzqaas8zPmS3u7Xch6onLVe2yoQZL6Eeb94V8yncqezGFcsGv1k3Xfr4ncoEraupO3RtKYSw==,iv:VM3SAORs2Ol/WKYCffLlHNPAzA37Kp2fgToM1faS7Ew=,tag:gwI80Kn00QOU+9vRsUKchQ==,type:str]
-postgresql:
-    misskey_misskey: ENC[AES256_GCM,data:BUHwrGGcniD/7+hSHkXegopgG1bRGSt+OXJxKdMOEyeawAkG96af+njJ+WgcZ6KAzQdWtqJATdiTOxpznkvKfA==,iv:9hF/jcGyWFNPzzqVyaVXEabeaGDE92bpVYq1oxvQGOY=,tag:nZObCyAfuMr+B+rlUhCMMA==,type:str]
-    misskey_misskey_old: ENC[AES256_GCM,data:saLuu3wFcqRW2yNF9aZZ4zc6njm6pqqcUUqRTbijXELvZwMy+G+OMKuvgsh71NLDJiNDZdOBAOdUUXlC+okBFQ==,iv:kcHjlpndXENhASkenLN8fNLJjHmcuLN+i7+a+fLjxyU=,tag:Sbr74hl4GsCts2Diw8veRw==,type:str]
-    synapse_synapse: ENC[AES256_GCM,data:NfXD6BHV9za79NW1kLvJjdOLeHjtcrzx9O9W65jgHYneEmUNKO1nuBgs3PrI8tkBPkmn55UdC+4v2WFjHWXrkQ==,iv:YdF0liKfIBT3CHCr1ufguu9qqYpfXfjOhJY5BO79orE=,tag:OWyN3Zh6uvm10LmCBipJ4w==,type:str]
-    vaultwarden: ENC[AES256_GCM,data:4thZ0nGnbprVntYH2wG2PAgAJcAYuexQPOJBSpC1ivQgNbmn89L5pSANx5fvYewa834mlqSWHWeSqIw/81tDqg==,iv:d6gARu6yGzALNZrgpvaxWqM1cdkalA17GZ4EVWHqYUc=,tag:guYaW+Ds1TylCLw/naD2mA==,type:str]
-    nextcloud: ENC[AES256_GCM,data:jeJSAF+oeEXL2BqKbzngnSVvpxE5yuzRq2LLu6EyKT76xHP/whP7QuRxns23dsJnUr55qaRUzDunvoFco8MCZw==,iv:0lxolTDXskNvrVEAC4dV/mIgCMi3B0xH+xVT40Brii0=,tag:YvUtW172rmKK6pY/+4WhXQ==,type:str]
-    gitea: ENC[AES256_GCM,data:D+WDCVPTAcOg/gpxlcaNHFVHBC8uKOs5VZKQYuF0qNZQn0H0dWQS89K3DsgjBKck7ugiZOyXKUHISBVrfBn+VQ==,iv:qkahWBx8q1g6wlzXKM5Bl1PqxwkprCZzzCq1vGWaj7E=,tag:hWX9jF2qx60QrOForU7LLw==,type:str]
-    grafana: ENC[AES256_GCM,data:Hm92Qnz5QVWwk6P61vrnnxDFLtdVx2vOMKwy3sRSv+KDnNSYvRNyLQUkyuf7Nh0S167XgAxDPTZQb9k6AjO36g==,iv:oXmfVDr63NGv4rRBb12V9l9dNXxQK7Se/2fbK40d2a0=,tag:DNeeRwEShxUhowkIfr1feg==,type:str]
-    synapse_matrix: ENC[AES256_GCM,data:HdhB5WAxBa+BaFBVoIo6RwhOxhN5WrTLR11kah9H1sBS5GDPldDw0H274faWFwE/UwXO2ggBEAYvACXr/rXkvQ==,iv:NxOsZqxsP9BSgdlW43AuQGw0VjSGx77wygjdDcINf8s=,tag:CtbG4zcXG2QFFP4dGgOxzg==,type:str]
-    peertube: ENC[AES256_GCM,data:6P8muSWzJ+A71nZZKlCXRCRwr1HWu7yrSw5bkeHg5As917frrbOMmDCpf21H0q+eagx/ZrRIWod2JXc2YGKCfg==,iv:G/zZeYbDCHffACCvhJlKlJ1cUCkw0+raq5G1ubqIRAg=,tag:HeQA3ueNo/t+8JR9jVUUPQ==,type:str]
-rsshub:
-    pixiv-refreshtoken: ENC[AES256_GCM,data:3nQdmn5RAaeqeI7S/0gPUGOzt7rkizpk3Ouz+pXwbqKBpikXKm4amvwg1Q==,iv:sze0u8un0xyumqHj0YeKcBD9xKZRW77rQdQn7auIf8I=,tag:bWqg+/pBaQJ2J3hjx05hlw==,type:str]
-    youtube-key: ENC[AES256_GCM,data:NZPG5iYrkOof+L3SKp9SqXmXOt37hvqCxTTibkzXv5TBPcCjPhCe,iv:Re6966w0oRtvHDCt9eYvswDMLNKcM+stIAA+P1qpWbg=,tag:0jNqPlGoXr0bHGMgHUZXCA==,type:str]
-    youtube-client-id: ENC[AES256_GCM,data:7BOIrxA5FIUo/31p3yqrLJKJhV9IUB25//w343eBoAnr3uD6J9zeLO3nIQv99vItioqFA1RmygCeer9pG7j/FI/MmmT8nGzPcw==,iv:mzKY2XghoXhKTTkO6EiG+ZJFsM39TX6UXJbzh0UA7vc=,tag:w7oiCvURV8yFxxoFR2P/jw==,type:str]
-    youtube-client-secret: ENC[AES256_GCM,data:JCyNb9biROLSx0RHkr0FqZ26nhU/LRBEnzfx91mmq+Ux0/A=,iv:fEMmanWtWaKBVUJVIeMSu+XV3v8xeccDY3DTJr4LOsk=,tag:bT+XedAZu94h053/1zr7Ow==,type:str]
-    youtube-refresh-token: ENC[AES256_GCM,data:TXNvLTfF4K5RT4D0anzXds/fcdPy3FXddGt5xxLIaxbKIqCAtsQyLEhA+SfQXaBk6T/yKIhtd/H/BLu1jOkiZsFL/8i5GSRSIXyagFrCfh/7tEqhCB0u52Hz5Xy4pkZiqd/AXx84Og==,iv:s+q2ffpJP/rcKu/Pw4KosM5/7boFPArJxgbqL0f1ZkI=,tag:chUtPpJbYuhjv09lRdXHMw==,type:str]
-    twitter-auth-token: ENC[AES256_GCM,data:scLoap0kDJW8Q9+h9S/JKYafyCUgx75RV7akHY/BYEmFhRNRq5Z2Lg==,iv:GhP3nyaK18PDcoHc18zhuuPAPnfEWgUagBrZNDY3toQ=,tag:qsE2rIgrmlxBW8D3i10KUw==,type:str]
-    bilibili-cookie: ENC[AES256_GCM,data:fdAX5CpbJZv3fxRdA5SpFwNUZ0jYgYuv8SyKfbJzm5toQ8S5TrQ9WnQk6Jwweqmg3VDRD5l6l/irGsRlLdjt3p7fyAJy0wtzY0jD1xGw8XhdKWevMTysg1YQcMijkJSI0oHpofis975M6EDjcURPWwlR6GqW6POOpMep97siOxiNyBi32TbZHqvIWa1YfyuMcngYMEsShpzWAZCCvLYXoBINXebG1JPHU2xua7EHMO+VH7UFNVCyBYmOw4iXBJ4YFaXqxjQTBza4GDDZ/RVBvO5Egdjovjpj1DR/hOEG4xJHpg6xTsFw,iv:WQTVuovkZjzuu5w743GkMcWqu2p7dmPr9sKHemkbxG4=,tag:eszbpreVfC4LtxnRte241Q==,type:str]
-    zhihu-cookies: ENC[AES256_GCM,data:ssemzXs7ub4z7pw4hWGSfzBfKH/xzv8bhtqC1dDbZJCnwZ4D4/U9ES9QDrPeKT5AjbdLV/WBvJqWKcwTQjGnRhMrgK2MU2/8Et61mur5WE5GPQjwhWV5JaTMhSxKS3pZtpyvIgy+0iwOj8QQS6mbujHnpb/y0fhszlmUQPBL4eIxm269/FyjBLeRivrJvSmMpLQxxwh2/GTojMPH2F3bclsdMHgZhvYGdJ65hSWn2Q==,iv:PffeWFhC+dYkLSDQKuIHRRDjqE7By/ZIuZIhkjCGDig=,tag:p4iJwqLfqkiKOi/KnoyfQA==,type:str]
-mail:
-    bot: ENC[AES256_GCM,data:XngvO9b98ccRoW9WgfX/Pg==,iv:SE8SK49zhYhDxl6f2UonCzTPcKg23CzbI5V/fOh5zOA=,tag:IXGwnSU+Vx0BQxjgvyBnCQ==,type:str]
-synapse:
-    synapse:
-        coturn: ENC[AES256_GCM,data:TQqNzjJV8iM46JZQOKqkydkSrDFH2El4EE1ZCjUPpZ6EM7UHfjjxP536sm7c7adxIZzrj2TlzKufhlGFYfZ8xQ==,iv:OVguyW8sQzfczVHMaMTg6+J0wzTzeTb2zZkXnMEZ4Jk=,tag:dYLMU2bHyg/IR1oyujsoRQ==,type:str]
-        registration: ENC[AES256_GCM,data:MXlRld2ugF3qDVPbrd3TGiwdFhJEcxKDsvmEV4P9Qap/zp1WcMzfo+wAeXtq18MV7Fw=,iv:ztN6q+1ql9b4NMiyuDEmWbnpWeOPmbEftymMDQ3C53M=,tag:+BI9t1jSNNcfrIU6AaDOXw==,type:str]
-        macaroon: ENC[AES256_GCM,data:hVkFqtfaOL64qNGjIfmSORm0D8lOvA/H3Mrm11Glrgy11ACjh+zI1CSglQC0SmaKSP0=,iv:ydNz3kXOelPxSFKshjH9+iYw4OItm6QoNGuks8kSDow=,tag:TCHyMXc+gT+fxVyd7HexMQ==,type:str]
-        form: ENC[AES256_GCM,data:lykxrVPMWz1sBk5GoMRHfHhsVxcT7txvLJ9GM48Jyff5HXh1z4IWuZzOu8HkrELkJrA=,iv:QGV8vqor+wByS9z37sF/iPfrNaL/0jU/yUGiphEl4Fw=,tag:Mg/Oz5hI+oDnp58aQF6Rew==,type:str]
-        signing-key: ENC[AES256_GCM,data:Ov+ly2t3abRunse65ccPpQgqKzDrF8B2wMaCJt3Bxa+QDu6WwD8DD4E+pcQK5/HaTdsQte8Z/3f2Kw==,iv:SSMjSTrhgHt6iz+oyHe0sHm3Eb82ks5z8DR1Puc1raE=,tag:9X+T4n/6Vl4tUbVM0LJySA==,type:str]
-    matrix:
-        coturn: ENC[AES256_GCM,data:BmnF4oyUdbESzOwlqQ5SXYgeUnWgyFE0pdBox33JmaMcOvRPtckD9p38UeMTxp8Pccarmx6f83rdHsifeoiWaw==,iv:1bb3Tn67HTHVNR9ohH1HtqS8wh6t7qtTEl5MNbwn7h8=,tag:xlxMZtqew4pTc9ztY74cHg==,type:str]
-        registration: ENC[AES256_GCM,data:LB5tWjoAsftqszYZGOXtqLFXa0HyU1b6lVUrBup5SJJdB2ZOnPsNtcgEkZLtMUlQ//M=,iv:jvLEwPv4iKuKfOPV08sPb9Z2XMnN+074DCQX+ARDPf4=,tag:4QxCLcOSQ30dU2Z+0OzGYg==,type:str]
-        macaroon: ENC[AES256_GCM,data:JSlovYowIe0C2jEFsIJci6+M1GYgbINdp0XkY58oOk1/ztyMnABSXcgZ73pEpLeUCvY=,iv:r2d5COTXL3gz9pb4GxuFQjM5DHsmwAfDy/eqlZyZJoM=,tag:yRn/OBcy1IqMvJQYD9sA6Q==,type:str]
-        form: ENC[AES256_GCM,data:sN24Yj5miXmUsvEmeSDOxFJxAetQdEJw+kEPNq+iMXyEexqEgoYBseH6kbFZwZAVrBo=,iv:ZtRkme3U1ofUBzT2J9SeRov1+rN5CrSi/ExKX7S5DNY=,tag:gGj8l5JXlzX+2sdHsLfQAg==,type:str]
-        signing-key: ENC[AES256_GCM,data:nmP8lwTAYGHc0LYcEj2AJE1XwSJBfA/NK+K6/0KGsufxwS1VhCXUWX9s3oEUPwuteTGZesaDVep1Qg==,iv:NcJEhlz6WgorViN2oiUG7kLy8N5kUzr5cD7Z4PRGdTg=,tag:WiWhIKaE5UQwEXunUokaNQ==,type:str]
-vaultwarden:
-    #ENC[AES256_GCM,data:rD0YOnSNf23ZjJhRWWia3+Zbpl6/cynCKlQQFhzaWIclHBk7YU3Z4E9J+YuWzlO8BM0bbp+zMxFGEFvbMrSHEHQ=,iv:PzQOCpSrjFb/aYn70oKrpb3jDy8rtZKPkLQ8qv0GMyE=,tag:wRfa4oHzAKD3BNYghIjZKA==,type:comment]
-    admin_token: ENC[AES256_GCM,data:oEIaHRqRIVQh+lSv+4p6G26bIKCtAQiw3t/C24C465THrwVa05D2Sax1IZ1JaHKgOmLzo8vxteBmJarARyC4kAnw2vb5bDPT1KCO/6u99mXhQyF3NY3FjmDwWHqTHHZT29dwAmtdFRz7rJQowLVqhBVQzNePdQ==,iv:QVAZ9JwwebqD7zxS8+Ai3K5V60bQbe+ewDc+JBXDMuM=,tag:vUYNlVf7ccooiBIXQWQC0g==,type:str]
-mariadb:
-    photoprism: ENC[AES256_GCM,data:JWeUPE1mb79IzyIsJime2yaBH+/yno2vbXAXO5E6Tx+al7bUlEH5JzYqz8+g8Jkiz3HhRNI4tcGUcVE7kkLgfA==,iv:ZJlIUGbEL/mGLWzjNEwgvzuzZZZrTy5D7e0eZ5+Ouvg=,tag:WY7/sUd2p2viKKDKsj1TLg==,type:str]
-    freshrss: ENC[AES256_GCM,data:/qt890Ly7zvuZB4Zn5xHLflc3L6Ex9JDa1BAinbG7OOkPGpnC83g8ivaQA3xL/CU1FRsm9V1OW4Bv2eN7VDhrQ==,iv:xQG5j3e4C7HWGct6gAET9uVUhGFv0BYVMLdL/1sj664=,tag:YaqjUNk7ybjfitrRpreQwQ==,type:str]
-    huginn: ENC[AES256_GCM,data:vbXI6k3IvTDgQNtKNX9VVJmanO6l+mLoOTq6djEuKfSQAO5UKMq9Xec2rsAibq4reKh503C4too3n2GU1Wo+FA==,iv:rSHmytVa2QWiZ1HH+8AOTOgimYcmPwo4fXgSSq7o+fQ=,tag:5DkdG0TarAs3cSsgPfFNJw==,type:str]
-photoprism:
-    adminPassword: ENC[AES256_GCM,data:X9af31Z4xGu8XJjMfsf3+whEdx96KHMyfJKO+5Q4q1nlnZD+cLjO8Lza2soO1fFndXcowRYsReUAzmXjH8Ffvg==,iv:LmH+JDA3YwydSNr8KbePPDga5ukGFol/BGrHNOZUxPg=,tag:T2HbUNcHnYD5c3GR5rnRmA==,type:str]
-nextcloud:
-    admin: ENC[AES256_GCM,data:mhTb6UPo3fIGlKPpER+Lcr2Jyv1nMk5jbQtxoN4txGJAFaJIhK+iAiZDZXBtOiysYqatcC2orJdgt9je8BAVWQ==,iv:G/uDlOGUt/F1GgxpIMGvVuFjcagVnHBudSGXZi3rrXY=,tag:hdE3Pf3G/xrnKaUkYO1WsA==,type:str]
-freshrss:
-    chn: ENC[AES256_GCM,data:Z4UmsXv1KiVfZMIQOEHH,iv:pF5lQLggkxm9y7taDVcp366JKp8U+8akNEdPA+Nf9Uo=,tag:0TajgUI/VgM3FxG1j6c/jA==,type:str]
-huginn:
-    invitationCode: ENC[AES256_GCM,data:JDN913i+zf6+obWxrNAbgx1NJGPyewRm,iv:lqnjbSk46J0ZJN6ccbbiCiOK92W8fj2mWRwQHKqy2dc=,tag:UYZesryRlfAMo7xhKQ7zgw==,type:str]
-grafana:
-    secret: ENC[AES256_GCM,data:1Wfq8QmhzKBObdktheFPySzXYlOJzHWbYYQXgn3beLOwSlW9f7bUn+wIrRoj1e8WlFJkAU2xywzjzzy/UwpSYA==,iv:/0YoHTs54O+cT6VVt1U5CYXr2qEdY2kijOlnMZMW4d0=,tag:SD/IELlcgfS7p9NBEa6D/g==,type:str]
-    chn: ENC[AES256_GCM,data:8R92k7RH1491u6lfQdM0U3SG8TPi3vWhZyj810XSjnA=,iv:8v6ijLHgoTPT6MGoP/lWB+UEZCCgOpvfskWCJJ63Udo=,tag:k9SHzJ9d54Rny3n8EbksOw==,type:str]
-xray-server:
-    clients:
-        #ENC[AES256_GCM,data:RIih,iv:1KQsPDpbG1A0NFT72tO6sSuQ84vfW07DST+/XzpNZvY=,tag:D3AHUPlCJGyVBbDalTHobQ==,type:comment]
-        user0: ENC[AES256_GCM,data:n6gIZGYdT6wEfKgizFvIE802AkpR8BpSPSZrQ5WP/aZWzLUL,iv:AxnwFOzmIRm3nTLpi8/4lkv+TjO4y4RZQtHO0GriD8o=,tag:nllDCaLZd6JNS2JqwvgVyg==,type:str]
-        #ENC[AES256_GCM,data:uhAauqQ1oQ==,iv:0Sr6YjarjkLmBq5H1ELb3SYBzrTVhqIE6qPxc9HYeKY=,tag:NvGGSY99Y7d3OTnpOr2p2g==,type:comment]
-        user1: ENC[AES256_GCM,data:EcEySx/n52rN5REPEWNjCuWywokvOetadbljqPpDPADTeeSk,iv:7r3CdvHJT1iZvx1Xn53It1ZxIkdLVIeQ+Q03zISm94k=,tag:8cIGZUlIhVgRc2FeU931kQ==,type:str]
-        #ENC[AES256_GCM,data:KuuPQQ==,iv:LGGqLFV4CnUMLWaNbHj6bRseetvdMdSOefV1FeYlJSA=,tag:wXlqKM2BuoMRZAwYbv5eOg==,type:comment]
-        user5: ENC[AES256_GCM,data:T5p0POx9Cnqdlp0blEYvAnRNIDOCNVdpOBR4rVQ1/07/rOCX,iv:EZx6ToeORzHoG+aEPi9oiTcwp4bOIAJpPUvemhYM96Q=,tag:aSS+RY5rEzr62mbE+JDanw==,type:str]
-    private-key: ENC[AES256_GCM,data:xz7xFt/g++E79bIl6AeBWATHDB+gHBIoXo5vdWTeyrAT1RtllgYie9k3Fg==,iv:x7fdmSINQA+F7a08jpuvCAg7vIZpsYaoX+EnitJMUCk=,tag:GAb/RRdAOlteIQPxeIMAXQ==,type:str]
-peertube:
-    secrets: ENC[AES256_GCM,data:OR3OA8qJsq1gAYiv1rShNa8eODzIxPOpVbqbnseSCMUNx4+FeOgReTLl7cXHPxbBkrJbsfEq5XYm1QtRtxotdw==,iv:6vz0ezsFuCNsBduNhm4VQ+it6oEJF/eMxktVFhdXgug=,tag:hmW7BwF9C53SAHhu2HBLYg==,type:str]
-    password: ENC[AES256_GCM,data:OaoqvUzWZz4LvVwZMbOSeq0mZyTqWT/E1Dt/N0XwEGwn9LLtarG/LrzV24BMS503N7NIxePVBK0jJCdbO7sI3Q==,iv:aaInNy3UmdF+aOu+Lzo7F0FvEVRbsn2XDwmYLNtYaFE=,tag:l/ONyeZJtZjS6IqwQgMs7A==,type:str]
-open-webui:
-    openai: ENC[AES256_GCM,data:5B1wPAOx3GsLDoYBKHWFzoyXFmn93fdcq6UC2rCt/P5zYLA4VNzfsp0=,iv:Y2gTLCmwB5wY4dhN73HRvTqSMVXbAEd+RjRbgUEuTeE=,tag:vcfNhXpG0C3twFBsm7PHwA==,type:str]
-    webui: ENC[AES256_GCM,data:Lg32DZ5GC+AYzWc4WloNMQlnpsqW67s5/kXzYwE=,iv:ECncgdYoLkX9GUOX26MXFSO8JOZahUDjTdKV87IRNJ8=,tag:J/5tTR3MI0iGIVDrlacYEg==,type:str]
+    pen: ENC[AES256_GCM,data:zNgfLhDSGJ0=,iv:sqKCIF5pzrkn2EnLjNwVWsEsFIK16UQjLzZTrxUIDZ0=,tag:KpBfjf7C/y9gChybN01zXw==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -104,7 +26,8 @@ sops:
            d0h3aDh5QXFZYWJFdmNVYnJxQ3pBeVUKTl0XVvtwJcz+RpSylgDPl/R8msInxvWX
            eQGmrDHibeE1V+KSDiuNzC4MVRIrOnh1beHrhnVQ86HwPVgJqs2FoQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T01:35:04Z"
-    mac: ENC[AES256_GCM,data:q2BolEBB6Ik8yx6NHnnE3Wcl2rGVZN86dpfLJrrFOxWd8fZyfBQ/00v4dUZSZw0aQoMj1V2RBDyVtScuRiH0NVb6+RfX+0t3zTEf6guuJdurczLBz9+D51+Th3KE1uk+UjI7J+Q/TOWTvoGMj8P4XZCXQsCDIct/vbLGqNB9CgM=,iv:/6xR7KXXLejm9Iuqcxc/7IqLEckNhmaJTKzJGonSrng=,tag:XdeCoEkHefw2HqTGSchUJA==,type:str]
+    lastmodified: "2025-05-06T13:20:38Z"
+    mac: ENC[AES256_GCM,data:frYs0/zRzbcbeWZjO60Ozhm7sxOhNPKQx1n1v92/vN1oCWfuR72sfABShSlDED6rE7CLkA94/aHd/6JBMcYbvYaNoCMAlQgCy7iIf/GnEXXPR3nadmEn8xtfycuqV7AcYQNny0k1cs0ULlwq9vOmxBKi1oKQ1VA9VnqR8vsWStM=,iv:2i/S+oHNJowT14DTPukMBdEDvuGLeKNQnHuRyo1BHsM=,tag:+PWW2Z/O0oCDc1cbBaRkhw==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -1,34 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            btrfs =
-            {
-              "/dev/disk/by-uuid/403fe853-8648-4c16-b2b5-3dfa88aee351"."/boot" = "/boot";
-              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-            };
-          };
-          swap = [ "/nix/swap/swap" ];
-        };
-        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
-        nixpkgs.march = "znver2";
-        initrd.sshd = {};
-        network = {};
-      };
-      services =
-      {
-        sshd = {};
-        fail2ban = {};
-        xray.server = {};
-      };
-    };
-  };
-}
--- a/devices/vps4/secrets.yaml
+++ b/devices/vps4/secrets.yaml
@@ -1,66 +0,0 @@
-xray-server:
-    clients:
-        #ENC[AES256_GCM,data:d7cv,iv:RHzGIDLuuKejCTQ5YlNNITkCS3VoprsqH/kHckdpAv0=,tag:3cYw7uyUmXALo3v7SiqLJA==,type:comment]
-        user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
-        #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
-        user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
-        #ENC[AES256_GCM,data:4Y00hDJ+8Hjq3Q==,iv:XWZYNC1T5B55B43tcuzzvOOFtHqZJ9XDuEaYQOO5cR4=,tag:5oNFsqUtSiv8CY6aHyGjNQ==,type:comment]
-        user2: ENC[AES256_GCM,data:MRMdc7LRYqgRsfKKW6LnP14g3JoFT6g7jzkXW8gIAeqypyoc,iv:tfPBD2FkIljz3xasYNJsj3vh2lEObrvSZ95FyCgWcTs=,tag:B1PQpyX24DqrPscL/pjZmQ==,type:str]
-        #ENC[AES256_GCM,data:gGd3kkNcyIwOXg4=,iv:vILDvtdvopPM8lZDDpedvtXYHpoPvPn1A8AJca41r9A=,tag:2LMImcmdyPKsQDloq7041Q==,type:comment]
-        user3: ENC[AES256_GCM,data:+KUVcqy18t6Fd+QNgB5DeZkNSA6lsjebO+xnzxzIjWuZ9UmS,iv:qugbmBv9jk1yfH2s0A0jla0DR3jkdXLVUeWGcj6v68U=,tag:4FUf/guDzPqgDcb1086WTA==,type:str]
-        #ENC[AES256_GCM,data:jCgKe0t2xQ==,iv:UE48L/JpobN6LUd6Z9RlsUGSJ1sHHgiL6xj8lPztwJc=,tag:xnwWLQm+GIUzsfBO/TXhrg==,type:comment]
-        user4: ENC[AES256_GCM,data:3yrdvbcH/ToAQpTLppSVp2FNGjatyBInKP85bAY9OrEtzhhQ,iv:4zvb1nzKjrCNWWKelOnDhsNBAC7Ak6ZpJlvQKqGJrgc=,tag:dBOTBJDJhJsKHKg/vGmpxQ==,type:str]
-        #ENC[AES256_GCM,data:2ptsDQ==,iv:dEzyk6NQcFZQPx8h/ViCqtRaQ/8dfMTVKBq+iguk6nU=,tag:11SLIAhtcHja4G9HUXr9Ng==,type:comment]
-        user5: ENC[AES256_GCM,data:NO9rpzFkySistf9++oXpo1tBaa4XtPtcCGR+2IWmhQYEH/l1,iv:OG+U0avgo9mjmU3soxRNL71ZC7Ee4ijpsJMRn3jYvhw=,tag:QuBFX2KHgNJ+f3RwqEH4+Q==,type:str]
-        #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
-        user7: ENC[AES256_GCM,data:Ie8M385wtRx8bWIdCupnda799kL0OLBsWdk9pHTY7IxxaZbn,iv:OrRYOkaC9uI9E1Eb8GYqmYr9VAUM895oO8NSdvxUPCQ=,tag:NZTUE4KnUjhg/auoALavTA==,type:str]
-        #ENC[AES256_GCM,data:Wwq+ypJgx6OcXA==,iv:dSvFz4I5tFx+ZVClxNGKwcbIQe7OY43OzAhqRiDK2TQ=,tag:CYUs1cJ/zqc+Y0yFec7Upw==,type:comment]
-        user8: ENC[AES256_GCM,data:2GyFDXIiAN3mTobwnY4czV2Egoin3B5Ih+aet3yT+krPTkPq,iv:NwrzO//HXwKMudgD+yK1hsj9o71RG6BfBle3logvuLE=,tag:WWpioPsnhHvVSrzAmN16Sg==,type:str]
-        #ENC[AES256_GCM,data:vVz6E2juGqXS1Q==,iv:9itEkwMsW8cqSzwV2EZtgJVgaW7aJJ5fw1rLuKFwiKM=,tag:9hRADkot8kELoYAgd6Dz7Q==,type:comment]
-        user9: ENC[AES256_GCM,data:HgSVrry+nKGW9X9N6h8hsI9VETKtSEi+/ZC9QvNZW4zETQxt,iv:ERgmCDPBpboA/+Sxeq6BvWoMxsv3Kkczqb/mbXz9pOk=,tag:bklzRg9toKy//6T8xdtbRw==,type:str]
-        #ENC[AES256_GCM,data:2sHxXec=,iv:aA61+cmDw4rHab7RuRRK3eUDx5d6gpmfw4RpQ6Nd0mc=,tag:H9kovJyn3Te3ir9X234VGA==,type:comment]
-        user10: ENC[AES256_GCM,data:CqrwaZp1fHd/WEGQH3xWI8DZ2/AavCqwTtwZeHmnrct5yoD3,iv:IBOHGQlw+uQt8Ryp/mCDcglfSPNXvvHOjNnrT+7nOHQ=,tag:tEkGEtPaOBK+P3LrQzOLsQ==,type:str]
-        #ENC[AES256_GCM,data:Rw4BWXZutQ==,iv:rXe2i1G/xQkpBl0wh6VIzaNoidCc3JL4sy6v5hcOF/M=,tag:2tZyH8B0ZL7XptKHk6TcAQ==,type:comment]
-        user12: ENC[AES256_GCM,data:CsbquwEn+iOKCzda8z26FYk2i5aPk2xzqGIYORiD4lotvnFE,iv:zHPmlT4LAc6NDjXrExze23dZZFIj0c1eR4WW74cu+qs=,tag:5MDFrZNgv54mK05ImSvpkw==,type:str]
-        #ENC[AES256_GCM,data:vqYkwGVcQ8yZbA==,iv:1ckVSiAgjuT/K0MuVHe8D2hHE7X2qxCHpb+y6nrFCsI=,tag:so9oFl6bXlJT2O+prplazw==,type:comment]
-        user13: ENC[AES256_GCM,data:KUraqncs8iPr7z+COfJ1z0TLNLlgctxy8FCav95+kkVXtStx,iv:Uv90bnVmmQh6f9pKOWmEKCul5VPxF7rrQ9GYrsCGPp8=,tag:I0r5o8xIYuq5/MIXSOHT3Q==,type:str]
-        #ENC[AES256_GCM,data:F2x+2zrePYDkCA==,iv:aTMeqvGVI43xLsN9submgciiJEjY4hYypJ9RJLIBYTE=,tag:quKW+MATVzRw1bda2jGjdg==,type:comment]
-        user16: ENC[AES256_GCM,data:BjnUUnNyqUvvPbfa1CeYvcVbMOwz6/Em4YhxRgmlicOSwro+,iv:LULwzjV5PRihTHNZFJ21IrDG3rW3qX4CYwF4Xu1KdZg=,tag:pZAI4OEx24d6h/h9JyQ/hA==,type:str]
-        #ENC[AES256_GCM,data:aka1O9hn/dZX3Q==,iv:rWik4cYtHY/Z3xQ0p/i49zTXVmKEQDV4OMn12UaQr3Q=,tag:hPm4bugH9RAtsykj0BJ0Pw==,type:comment]
-        user17: ENC[AES256_GCM,data:URZqRUDtG5FDrZDsmI7CFn4ilp97GJtgaVVB+j0dRUdtVGoq,iv:iUkcr6Oo29y5PIGF/GJRltn5DD19yEcBIsJAaYs43AI=,tag:gzSsjeQxvjvfFVkDHPkfvQ==,type:str]
-        #ENC[AES256_GCM,data:JkMniTrakuonAA==,iv:V5KmQL+C5O2mb3ktlm1ITjLaa1NxToQlyToqYbGme9U=,tag:UTZm05uyb5j0Pf9vuxyIxg==,type:comment]
-        user18: ENC[AES256_GCM,data:fFtnkBnaOktHaIfk7dN2U73UkloToiLvP3Pg2VAqPzvTE49h,iv:DZrba7RWmaeOQsqh3Kq/IuFS9so5u5ItK5WwV/65FYE=,tag:v+pOozYvrJJIsj7A/a3S/g==,type:str]
-        #ENC[AES256_GCM,data:gR0WsUYdBZBWjA==,iv:rnXZQaDNu+cEzneEa6/2pO+qUXl/fut8FJ3n90A6ATs=,tag:azNGPfWv+ZgOU/B5PMCVZg==,type:comment]
-        user19: ENC[AES256_GCM,data:S8VSoBIR/RqwctgYPtyIPEK2hXLr4LZ/jJvvFHA6CGgp9/Ff,iv:8eLCZEaiquwZyswwLkLoJcl7UPWTVYmQqZ2egAGFWWM=,tag:VgJiSt8eRcRhppMXkAkmKg==,type:str]
-        #ENC[AES256_GCM,data:vWW1bNyENgcspxI=,iv:xXCrjHyxVtodkVu/wgy1OrHGGm20nEd1iyparWcycYE=,tag:FRu132btquzXkiLXlnq1Iw==,type:comment]
-        user20: ENC[AES256_GCM,data:Wux6pzwor0B1A9d1y0QEpcNnYn1pObloHxghSONHcsQ266/7,iv:jWSuswV6vTQdL764I/zxFC5gkFOa5Qwj54rggmmZX7I=,tag:4hmqBTn0T3a6Sjt9lofwbg==,type:str]
-        #ENC[AES256_GCM,data:IJWHWxbhy+gxhxk=,iv:HzMi211JiVfHUhEJm+q/K0tCjUEXDhollUf8Bm+HVA0=,tag:P22Q/h+DUhhJayZftcvVfg==,type:comment]
-        user21: ENC[AES256_GCM,data:0X5x3SATZm25kVf8cu7TGm2t95DneLAqhP16fRQCtROzyZyg,iv:dmlwRmubnRq2fNdNz3lVlAVYpPjVHkFm60IvPcajjds=,tag:eDJYYf3eRw+FxfaHiRDk5Q==,type:str]
-        #ENC[AES256_GCM,data:O3ovvRYzFrQY,iv:/Zs8e6u7wdp18AacZ3WWBvn5PDtXDnQ6ZyqLiyYmvAY=,tag:HmhKBI3aRCIR34vOEnv1iA==,type:comment]
-        user22: ENC[AES256_GCM,data:ee0naewdOjIxA0QEpmUyOSu++sUJQneEufhJBHiyOR7jAPTU,iv:09fZ0dLUZHp9wM2lCiIcTzFey2AkWBmnUCfq8W3FM6Y=,tag:dHBVo/Ok3Q9vy1pIbWC1Kw==,type:str]
-    private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
-wireguard: ENC[AES256_GCM,data:3h+cpSHULgwlI/zOI0IL4t4diDzm7qWW1sOWZqkFRWCB0CAfGyydGNlZkqA=,iv:pVpmw0aEDssQSr724h9NvJqFMHu0NupDfCSt1RWVnUk=,tag:fonuszujTzeo2HqO1OokEw==,type:str]
-sops:
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNamN1TytweDd3blJsR2ZH
-            ZmlocFZjT3ZaUjlVbG1vVSt4a2s2SjJIaGtRCjRneDV6cHYwdGJOY1BDVS9DeDVC
-            cDdNbUdtSGRHNU1yZFpPc1MzRS92ME0KLS0tIFpmamNmTFYrRGRqbTFVSzBhUlNa
-            VllXdzZ3bEc3UFY0YjZRKzBUcGgyVkUKqI1ojiLbF87alAkEwyrm8wuW2fLbmj8d
-            YBIpoDCZ7AwR5uHWQAtl7BWJV1zab+rA3zvaf2BsrVA1A+RWOtYT/Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yvrl4y0r6yzcxzzkgfwshlrtsjt8uuya6rfwks09pnft7esfcyvqmrtm5q
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWitsSnRVSzJDZG9ZSE5I
-            bmt2NEFDanR3aFJyYVNnU1NlUldRb2RUVXhNClQrTkgzR1dPNWp3endZTUl5SmRs
-            dEtkSWk4aWJEc2hhbWlXZkxpNGhacFUKLS0tIGZNSG43R0NKYmdFMzdXbmJjSExJ
-            Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
-            1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T07:42:38Z"
-    mac: ENC[AES256_GCM,data:fQm8aI6KdoJVxcl4MQP7Q6EZVqmmLFo9A3Hjo/tKZA+VOYvQWFBxIKwy5Cj0SBi4pWsSjwG6pJZ7m6Wh/dDK4KlgkoaXgAYj+efHtScOH5Gkb0sTpAkHNL+/CJ/cO1doXiXRGj47fn1QB9o9WBaomtOWQbzDts4eFs9pdm8TAq4=,iv:91Ilig4j0ELHEatTY7ALKwwr8AzYnRwhKbdWDcufZF4=,tag:UfwaudQTNKu+uryCZjo3mw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -17,16 +17,19 @@ inputs:
            };
          };
          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
        };
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
        nixpkgs.march = "znver2";
        initrd.sshd = {};
-        network = {};
+        networking = {};
+        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
      };
      services =
      {
        sshd = {};
-        xray.server = {};
+        xray.server.serverName = "vps6.xserver.chn.moe";
+        frpServer = { enable = true; serverName = "frp.chn.moe"; };
        nginx =
        {
          streamProxy.map =
@@ -39,14 +42,14 @@ inputs:
            (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.pc.chn.moe"; })
            [ "xn--qbtm095lrg0bfka60z" ]))
          // (builtins.listToAttrs (builtins.map
-            (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.srv3.chn.moe"; })
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wg0.vps7.chn.moe"; })
            [ "xn--s8w913fdga" "misskey" "synapse" "matrix" "send" "api" "git" "grafana" "peertube" ]));
          applications =
          {
            element.instances."element.chn.moe" = {};
            synapse-admin.instances."synapse-admin.chn.moe" = {};
            catalog.enable = true;
-            main = {};
+            main.enable = true;
            nekomia.enable = true;
            blog = {};
            sticker = {};
@@ -55,31 +58,15 @@ inputs:
        };
        coturn = {};
        httpua = {};
-        mirism = {};
+        mirism.enable = true;
        fail2ban = {};
        beesd."/" = {};
      };
    };
-    networking.nftables.tables.forward =
+    specialisation.generic.configuration =
    {
-      family = "inet";
-      content = let srv2 = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg0.srv2-node0"; in
-      ''
-        chain prerouting {
-          type nat hook prerouting priority dstnat; policy accept;
-          tcp dport 7011 fib daddr type local counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-        }
-        chain output {
-          type nat hook output priority dstnat; policy accept;
-          # 需要忽略透明代理发出的流量（gid 不是 nginx）
-          meta skgid != ${builtins.toString inputs.config.users.groups.nginx.gid} tcp dport 7011 fib daddr type local \
-            counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-        }
-        chain postrouting {
-          type nat hook postrouting priority srcnat; policy accept;
-          oifname wg0 meta mark & 4 == 4 counter masquerade
-        }
-      '';
+      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
+      system.nixos.tags = [ "generic" ];
    };
  };
 }
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -1,3 +1,5 @@
+frp:
+    token: ENC[AES256_GCM,data:T8b1ku4HNCNSJ+33QgIt1GILFA4wTu3Qd0rDqHPVgdqsGo0R90k0u8z+dElSO7q9PapTqUbZ,iv:hwnMu6JxfYLgw4TyhujX5dI2IAytgZh+Bexhgta6ATQ=,tag:lqgwvXlS/jGPxasmk5Vh3w==,type:str]
 xray-server:
    clients:
        #ENC[AES256_GCM,data:DXEC,iv:SZ1AhmK6fWQ/HGDk97kDUcRN84zQMp99eiz4SpRhig8=,tag:Fkdf28ZvB8XKCxSYdjuuHw==,type:comment]
@@ -5,39 +7,47 @@ xray-server:
        #ENC[AES256_GCM,data:OVgDU+zqcQ==,iv:8KuEqBuL5Ca6pUOFFA+vySJx/h3BhGAAC0CgnxiW46o=,tag:TY1MajSSy2RjKVI2SSAAFw==,type:comment]
        user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
        #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
-        user2: ENC[AES256_GCM,data:+MKTpaA8hO8q0kyY0V1csedLOtIf760Vr0+WllGe9lgMJ5da,iv:5txOM3sFOhKVX4EVozb8XHWLU0fUNxCF9YAwTYaTL6c=,tag:jkgOVgiEc5phY1XNETsdpA==,type:str]
-        #ENC[AES256_GCM,data:m0iCqLI8ELaPb9g=,iv:bsh7JHILbOZJ+bgGr0U0rDanjUVGgDzYGhboezspEjE=,tag:o7A4SXoCXk5LXmZ1bidg/w==,type:comment]
+        user2: ENC[AES256_GCM,data:e7ITe2ZouKr8dXT7SYATyzbzHaVeu6AKt1OcQKk3U0nsQgoa,iv:UbOOuojy6OAFEH8lGhKe5Hs+2K6FX5MZ8Br9AB007gs=,tag:5XeB4YngzTcHZvCpXe/ZXA==,type:str]
+        #ENC[AES256_GCM,data:93BxR0AEdQ==,iv:rf69GWpuxYt7fu1Fyv55pynuQDhi+TA5CwZK3cc3yBo=,tag:/hLy6atNMxLw6G3/qgMM4g==,type:comment]
        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
-        user4: ENC[AES256_GCM,data:/kBaGAqbewLav+WCJPHm1py3pvb7bA/YO2DeBP2FTCZv44wA,iv:iwxV6KHu00oITH/58kBFmf43lkgTU3BHJ/kb9FPnRSE=,tag:ns+6Dvhf/D15bZc0fd6zLA==,type:str]
+        user4: ENC[AES256_GCM,data:ujiml/r4aFiKOkSJkaD/KE8rKuBtLSnpZREBH3vRJUzDT0QM,iv:a3VFlXpMLNFihvFa7gloANtHmBLg4szTL5LTm8E2kNs=,tag:W9KZ1GAVx9IBKfda7Zedng==,type:str]
        #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
+        #ENC[AES256_GCM,data:D5xiJW0Oyg==,iv:9a/6myiT9Crf/fff6ZkXj/obW2k95cABUNqQdPmcwcc=,tag:chs8BA8YtVkM9m3Ey9ETlA==,type:comment]
+        user6: ENC[AES256_GCM,data:YzLlf37SxKmU1/QA7gUIJsGid3KZNoAGOew8xR7cmw5l8ZmX,iv:SfKubo2jfjtxKn9odDiokMEZyPFfYZ/wwyYtBrgvgmM=,tag:+hxwIU5uBhzQyrKX4r3oiw==,type:str]
        #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
        user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
        #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
-        user8: ENC[AES256_GCM,data:AnZb12dioiCamubOb6fsGWoM55zfPMeRbu+j8bRRcMfSQFJf,iv:rB+4B11JFC0oS2ExUW18f5WvhnE4EuHh3IiEyxWeY3A=,tag:jt+3yxDvhusvB8ppbdAwzw==,type:str]
+        user8: ENC[AES256_GCM,data:H1gPtqF8vryD0rVH7HYzpMuZ3lufOBYczKwaTr4PidQtTyQK,iv:wh7NwFc/1ogNrnTTpm5L9dBqDVkvWiIsJZelR2mtR4Q=,tag:oEFdMFZJ9UYhsSVdefJ4rg==,type:str]
        #ENC[AES256_GCM,data:aYWIiLxs1UvupQ==,iv:AisokHuAzD5B6fEF6ak8WfAe151CM3a8MsaWC4uJPnw=,tag:cdk5S4n9ulyWrqsD+jcqYg==,type:comment]
-        user9: ENC[AES256_GCM,data:+SA+VcZcy5ckuS/46Dn093VvuqxrIACuqMAMx6Ko5yw0DVdW,iv:TeLXb1WI7uhcPDkXYSlKIxdE6Kz+nCnlB+ZYpWcaF4I=,tag:YB0sPD9yHMARhiMJs7JKcA==,type:str]
+        user9: ENC[AES256_GCM,data:HVK9KvGfOcwn1joc3VrkjBjE6hrxQPOBD5RTtQUgBPepToh6,iv:VK9aQ64L/GajpledBxC8PNB1BdNYEqwcdL3GKttgxvs=,tag:O/piztCYBARtAFxTMNXGaA==,type:str]
        #ENC[AES256_GCM,data:eCl1bK4=,iv:oYA2CFW6OGGrRYx6OHRYJpbEyFh575UjztvHaXA8UG8=,tag:Pw7xsisQB2Dd0KJeWFq6bQ==,type:comment]
-        user10: ENC[AES256_GCM,data:Pec0CVGia/ZIaq7WerZlr0/waJ/Ev1OKwt7V3PBxBSFMLi7p,iv:wYTdhv4Xoe58KBIwV1vk/V4IcdVzQrBgmzGaRD7qHQs=,tag:IZVt5LmjTUge8XntujJlTA==,type:str]
+        user10: ENC[AES256_GCM,data:xjVkr/wy7OxRuNZKfQagfNxdVxTEyQP1ZhnR6jHy2gjBQ0RD,iv:G6iOBCHOqlvfEENY/ega/TUm81wgT2OOdZKZ6bPfg9o=,tag:p8AMa3bGsIl0hWQ09lSzgA==,type:str]
+        #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
+        user11: ENC[AES256_GCM,data:BIZ2zRgGv5/9AexiZZvu+m4A62YUWtAkjWWMu89GteqpWMBq,iv:13IJcDf18LjoxJk7uoKnuFZT6Ihxrxsy7DBaAaiFqus=,tag:RN7wj+uPneCkqNlMRyYrXw==,type:str]
        #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
-        user12: ENC[AES256_GCM,data:iTZViWyKkCU1y6mvB0NzkXf3I98U/+nCs21ZD6M285YKaU6q,iv:vFgA3sv/7ENcw3gyJLiiHLwroXtVJjAxZXViqjXF3mQ=,tag:u3b9Uu6TIPPYX0TW5X5Sjg==,type:str]
+        user12: ENC[AES256_GCM,data:FAF9lXOzXW9CrZgnQ1a2+E8snZj2+JHqP5Gny92k09o/Wzga,iv:/qZuAtFmUQE7A9lMzJUoCvGx+3Sv9Ioh2ahch3puaC4=,tag:urwbLwGkSX3e85NCjyPhhg==,type:str]
        #ENC[AES256_GCM,data:HueqiREBet2bxQ==,iv:WCjTAGg2gXgBSvY3zc/YyB/1X0XjvphPduVXLsjOwH8=,tag:wC+On6lyyYQ1Dt/BHDvONw==,type:comment]
-        user13: ENC[AES256_GCM,data:ID/A7yCWQIWRoU7Emhel2ASZfTweqXYmpC5q6Fm6ptD0XfCu,iv:YrFjIilO4pH+QxVVDTqwkufj2VSC38y9lAJfD8w522I=,tag:1v/T7vWeh0LMi0OL0FVs9g==,type:str]
+        user13: ENC[AES256_GCM,data:ExbnvWDIBqga5+k2mpoT8AKBOXAvUNMjBTPXUKrmtWzz4l+L,iv:UI7CvSx2FHYGf6BEHS4e3iwHZZWkl2Zt5xg2WdKbLvY=,tag:ad0c7YW2Bxo+Dn+BoSZ0Ng==,type:str]
+        #ENC[AES256_GCM,data:R8lN5T0=,iv:FXLf8Vtjg+PkwNhxXWDViMKqwn7tFMaPhio9zhnudZw=,tag:34gxRH+P9lmkUxlOPKcYMg==,type:comment]
+        user14: ENC[AES256_GCM,data:dgNPPlJD5JOFPbKhlvlRHBLmUNKeDm/JAiawUVpBE7H07Box,iv:w+t9BkqYvlxVKr+x0MwtBz0/YSR/7z1OnZLIoPdW4gc=,tag:CR3GLbaO0jSQgA2HuwzRqg==,type:str]
+        #ENC[AES256_GCM,data:X80nhW5a/JQ1IQ==,iv:2UTsNLLDr4uBAEcPyvmep1fqH43JLUiHc/zqQWChfDk=,tag:DJEArs1nVnlcJgqM2uy17A==,type:comment]
+        user15: ENC[AES256_GCM,data:6AskiMLLl0HV6tm2rYpV46XW0jePQy+wme2oi3M7He7WsgVM,iv:lGfnFn69Vnjv5J3rp5sRazD5/B+8Nk8MNG7HIyf4HKA=,tag:Vbg82tdn3noOfhKVVx0Phg==,type:str]
        #ENC[AES256_GCM,data:4jJkbMD9Psxrag==,iv:arRtRaNrqnYcT7vE3wqgl/y8/65ORaxqTdGw55AKDP8=,tag:pRpta6mXfy0XCyzMA4+cEQ==,type:comment]
-        user16: ENC[AES256_GCM,data:esInSvj+a90TAl+b/n9m2iJsH7e6tlQRwSsoLBCy8KA9a0Z3,iv:U4c0pZzqS1s5H6XW3YRSCvDhtxnwCnyKR/tObefX2Rw=,tag:YtY/t4xsmZaj4lC39XQ5SA==,type:str]
+        user16: ENC[AES256_GCM,data:fo6KJXlPDn7+FmxjEJQo9d79rDYemLFx6LanYZcJpKJR7Gxq,iv:yEUKPNZ9idrSqyVO9fhksP/7bjPMT/LzNK2VSq503/c=,tag:M87D44SIo9JzDB3ZyKu7fA==,type:str]
        #ENC[AES256_GCM,data:/Kec+CdtnT11EA==,iv:DnmbWfgriaE6XAnMqq2UXhHhN+Rd/3YRodKVUCJo6p4=,tag:NimqZpbslKxwzoljaZqEdw==,type:comment]
-        user17: ENC[AES256_GCM,data:6h343SreoMqz5ZHkdyDI/je4v10r5zBV7cWc6Pj4x5sI2cvE,iv:7WSikMxAZJUnv3+GPq40d8r9JkKRRH/SPW5F5fy5HHY=,tag:6h5Z7+WXT/dLNeEIrC0UGw==,type:str]
+        user17: ENC[AES256_GCM,data:gQInIcNFxJuCSsMDGq4yTp5JdMMmJRy1tY3PGLoLuuIXWV0a,iv:ya4n9Z7T9/bxeHqi5QqwJprEzDMsT6X0BuEXRS67wWk=,tag:RcjQfAHv8uc3PgN5c4bySA==,type:str]
        #ENC[AES256_GCM,data:h7E4P6BiGjktYg==,iv:DhkK3NNppBqo3sXt9U7kbgfaBPYcSEX2hu6VOAesDiE=,tag:XoVbZklwCmU1EBhv0ujcSw==,type:comment]
-        user18: ENC[AES256_GCM,data:HJj0e6EHXEYmDXlZcS8UlfEQo/4y47w3sYKgb2Ojq6E4vMdE,iv:xThlGl/DDLLgoY5VkBSCx9HIvxy2ZlO5Q987vIMu0lA=,tag:gB07jP6Do4/6RmVaLB3Ecg==,type:str]
+        user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
        #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
-        user19: ENC[AES256_GCM,data:unW8dOhNbPNLWd7X2prpD82tcqUua7msq8nX3ykFs8STsuto,iv:OLaZ9XQDFGaA1VENgsSn/3HQXp957Zf9MD9GPZ4KLE8=,tag:UK27LK+De3AzbI2mEIsQpw==,type:str]
+        user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
        #ENC[AES256_GCM,data:1g2gohLbiixMes8=,iv:E3HA6cAdv3BdLMcrrcWW4Zsc2KLtW7L8Xrk9Z57l49o=,tag:rZ7W9ckf7lzJ23u5zwQiwg==,type:comment]
        user20: ENC[AES256_GCM,data:3UbVnn9oMRc0zZR46tWxwM9VFOvMOYm690csUomEVBcS3xPm,iv:KHuPXttLAFr7WT/qa/UYLY8GRsPWYZPyKNmdUh4iFQQ=,tag:jN8rQ0Gv+qnhwOWGH+CwlA==,type:str]
        #ENC[AES256_GCM,data:GzxXsTbEvdHV7A0=,iv:uxUG4hnYEsmJtnqbEwamwhtLt3UClt7ktmkGyAFdxsc=,tag:sF8YQ2cejAezI3Bbp9qKIw==,type:comment]
        user21: ENC[AES256_GCM,data:hgDJ11crZaWcKrc+ZDQklXwpnvt/sMbARkx3sLZfQGZqQZeA,iv:2Re+hdJuT5yg/qTymfpN+KdU3criOmwuqqg+SHb8iAo=,tag:s16N6u5cRDaoWxnrCkamuw==,type:str]
        #ENC[AES256_GCM,data:U0CcBBJraJj9,iv:9kuHsHkSDdDT0Gi/3Oy608RArrg+4cgeii5zWbsGuPA=,tag:EvqqMNvNcWBwie28t0+52w==,type:comment]
-        user22: ENC[AES256_GCM,data:LClSrxtBzuJUD4J4QaYXHUr8XSi+N7Zh193j/YeBZRm9sjgf,iv:djiq3+iVnuKK2HveoCm/j8FezzrHRGnjbyoO6iGm6eA=,tag:N5hqYyvJGxnwT8wbxdnjiA==,type:str]
+        user22: ENC[AES256_GCM,data:G+Ls2+bbcP4RmeYhPF44STdbqNiw0UZVxac6GQXJUyCehgjm,iv:vXbwtGWgBINUauS4rsDj+4yoropzZ4IHOZxF9/jLPTY=,tag:SN1BZbQTOfcAF6krXEXtjA==,type:str]
    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 send:
    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
@@ -45,6 +55,10 @@ coturn:
    auth-secret: ENC[AES256_GCM,data:50KqO4GQ1ERbCnK4IjYu6aywT+IPMtVlTzh/TE4MwWApU4pO9yqz25ENGUAKRLi4p+Ecug+Rn3InRl1b+q6bAQ==,iv:SgHkHvHg/+yA1Z5E9effgCnZMVXv5amGNUsVKErai54=,tag:PoYLV9Xr0IXXsA39n7wiTQ==,type:str]
 wireguard: ENC[AES256_GCM,data:5M7EAy/6+2UASWkjxE0Jrxwl0aNdAVZaUjQnD1wU3YvOAQ/c2DSL8hVtKf8=,iv:a2tXFf1+aP0JhdNtzP8e82KJ71m2o8nx+G0wIx4VMig=,tag:l4TS4QBz2fIkC9/GnZgHnQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -64,7 +78,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-12T23:51:02Z"
-    mac: ENC[AES256_GCM,data:3QxWxinb3a7jvmHJO1kcePNwd/igurjFWVJw/sGKBuZpo47LU+W8132b9GpKs79AedDa5BM5yu0XN+CPrkviMcNuX5a3lLy8oI22a1N8fuKjEehld1Jq/boitGIsgJgb/M0Hn6yIq1ytuWuxoj2cOvmkEfNuyWRew+htI4DhJ/E=,iv:OyCWfcn218oaA970T9miIWIGSwOFeUbtWI0xO/02Hrw=,tag:c8riJplInFN1ZSPH3ze0QQ==,type:str]
+    lastmodified: "2025-04-16T14:15:31Z"
+    mac: ENC[AES256_GCM,data:XOG+e115arZG1uvFoLxCfAqr2pLI2ndS6bZKRyQlWaJK0Gti8RpQt1jVZ+Q3y5Ga8tpAvd7k5MYgRL0/H400ENCleM3vsh5s3VXjlSSxq4mfdkwhUH2E0t8OQyf8VXvs0SXZKhTOljETPu1pggB6iFUfEZ5e0kKRLRYWI4Tt94Y=,iv:mt60iMiKTcQP4b/f684j2IyFSWYzmq3XGK19CfZB53c=,tag:NyhQ0Lptv2E4jHuYAxcelA==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/vps7/default.nix
+++ b/devices/vps7/default.nix
@@ -0,0 +1,58 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount =
+          {
+            btrfs =
+            {
+              "/dev/disk/by-uuid/e36287f7-7321-45fa-ba1e-d126717a65f0"."/boot" = "/boot";
+              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+            };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
+        nixpkgs.march = "znver2";
+        initrd.sshd = {};
+        networking = {};
+      };
+      services =
+      {
+        sshd = {};
+        rsshub = {};
+        misskey.instances =
+          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
+        synapse.instances =
+        {
+          synapse.matrixHostname = "synapse.chn.moe";
+          matrix = { port = 8009; redisPort = 6380; };
+        };
+        vaultwarden.enable = true;
+        beesd."/".hashTableSizeMB = 128;
+        photoprism.enable = true;
+        nextcloud = {};
+        freshrss.enable = true;
+        send = {};
+        huginn = {};
+        fz-new-order = {};
+        httpapi.enable = true;
+        gitea = { enable = true; ssh = {}; };
+        grafana = {};
+        fail2ban = {};
+        xray.server.serverName = "xserver.vps7.chn.moe";
+        docker = {};
+        peertube = {};
+        nginx.applications.webdav.instances."webdav.chn.moe" = {};
+        open-webui.ollamaHost = "192.168.83.3";
+      };
+    };
+  };
+}
--- a/devices/vps7/secrets.yaml
+++ b/devices/vps7/secrets.yaml
@@ -0,0 +1,133 @@
+nginx:
+    detectAuth:
+        chn: ENC[AES256_GCM,data:Gk0TTbnFcsvIgoDcen6B8w==,iv:kvyvygw9zDwaiTQ2vPFTHQex0EWDFg8M8U22AConQFM=,tag:ewAZ/nXxmTOhDAjW/A2OnA==,type:str]
+        led: ENC[AES256_GCM,data:Vb2p9v7U,iv:xJcKgvbc0KAP31uTpFiYlpvPoEHMWH3VkEqqyINKcyk=,tag:X2R+CHFj4N4i7cAK88IoSA==,type:str]
+redis:
+    rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
+    misskey-misskey: ENC[AES256_GCM,data:OHjt9o+m++NT5aaFbwBT/wSMdUdgf4zscd/JxjCo5HDhC3WeWMJV7z//kATI5Dg4BWAhvPlL02Vrly4RraIzLw==,iv:sQB4/D2SsOuDR3bTrmlNg7o+6ehFznDsqVc3BX9pK20=,tag:tcwTBt/JhyW8ZTAIWIkWBA==,type:str]
+    misskey-misskey-old: ENC[AES256_GCM,data:amUqMycdXUFvjg66pXKnlZqiESBYMci0k8iYzj824SaEqHl3Nq/I0TjYX++xEUg+RGYyTIcSaj96HUANTKpc1A==,iv:ND1mQLHxltRlOdpJ80ywheGo6hkl7OgRyk9TguJMuTw=,tag:dhCCwnCOnyT2iXdEMK0szg==,type:str]
+    nextcloud: ENC[AES256_GCM,data:jwN/CqwkU/5Rd6w75/bV2Yej9b0CoxZaiJEcZXFx+9XUPY3Xg1tQdEr1SALG8xzOEdoL6WBVs14NvrrL25GeTQ==,iv:p5+0AB52QqScJwMhNIrM/7HAcRPdD9Z8xV6uwIDOwIg=,tag:f1XbNDDRXvGl/dkV9Wp2Ug==,type:str]
+    send: ENC[AES256_GCM,data:IGxj3cgp+fQBdupfK+IgPEQSPuXdM9LRSLGSATNIkzUWC6sQw1aaKTDuRc8cU2BG6quthRwuWnK/F7k3KrUi8Q==,iv:LI9MkaF4e47FPUyL7AXZpO+CdgF91ScdiqjrE8PZjJ4=,tag:eNugln5M0AhU1xmVWFN7Aw==,type:str]
+    synapse-synapse: ENC[AES256_GCM,data:8CVbcN2FG4mRT4PnlOGsS7tDfS+6ojIJFvq2EwItxn1gg2Ghd/Bmx+5tS/Do2FrYp/Xiv1EqucomM50r5bXnmg==,iv:TT7zBKQ4M10XYVCn5aeSu9IqjrIEHHazPUCOTmgRAU0=,tag:0+Q9hZMBVDj1TnHj3xoTBA==,type:str]
+    synapse-matrix: ENC[AES256_GCM,data:eJ9GXDVLPg1C+Zjpj3NnWUyZxDbOZ61f+gs/bkZgdWjeu61MEMtU/Hh+p/ceAn3y0aPi0ZTcd+zSgIPIkcj+qg==,iv:uTdS4uguNJErc+DDW4H6dsRFkqlkHtaCfR8LR/d9nvY=,tag:UhY9xbe1r7FUpyid2nSt5Q==,type:str]
+    peertube: ENC[AES256_GCM,data:cN+cClNV1JD+Z1Wlp07MY7BmLr/EZYZZt04mxKKKN8RG1ZSMGykbc3hd00E14ubhCittJXSPbIWyO63lCGGEPg==,iv:3z1BR0j26LGfXwDDPYU/i8Qx/7529KKoar+xGZanirI=,tag:g/NSGDE1iEYJ1MStrV3rpg==,type:str]
+postgresql:
+    misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
+    misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
+    synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
+    vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
+    nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
+    gitea: ENC[AES256_GCM,data:EAuFPlUFvtARh4wbevoIUwZ886nS+3O9Jy7q/SkaTDx7PkQKGhZcPPxY45AG0QQrjSaI3cGLzDBMutFMXP0BMA==,iv:0cLOsopAfyMLHJDowyZirVR5nqLrjSLHYtnPC8GXReE=,tag:BwG5UibGLS16rwJbH/0ZyQ==,type:str]
+    grafana: ENC[AES256_GCM,data:ZLtDIZ3oKasE4r1WNllNe/rkXxqRS+QAJI7EGPKhiFF1BtAxD46UpGQnUag3yg0gP/8+3COQs6camVSxcKFL1A==,iv:wMj3keVjNpVwNMwlt4E3ds1EYjLNIZ/S3RydhOlmYWU=,tag:ZRn7NWaUPbf2rHYLoLYw+w==,type:str]
+    synapse_matrix: ENC[AES256_GCM,data:5j+TYJ3vYUqu6CdRDYAT558DsTWbX4Rh+HuukPog5HGXlhneL3RnxVeGBR9CV1rlCP1NY99Nm8roBG+BcyPYHQ==,iv:CboB6lzqxAE/8ZlzaTU3bxw94N6OAhrq8pZ0AfxQiUc=,tag:z6cM3ufgbMn5n5PzgqdRjw==,type:str]
+    peertube: ENC[AES256_GCM,data:dLzOez3dTy0NqHED1Oc43Ox2AFuH196kxwOSuR6RejUw3iJuzEQCdmA/i+70zHoveAYBdPCGpM8cz0y2M+usjw==,iv:KxDqmbNBkJ6Nw0M3060L9ESDf2qAur7umlejcDyRmwA=,tag:RScP7Cny8b1Z1/REpk+daA==,type:str]
+rsshub:
+    pixiv-refreshtoken: ENC[AES256_GCM,data:EeSOTSAAh+1Dc8+a/AaPJ0aBK5DTa3pdS6DrIMQmRw/n0SRu2QoynIF76w==,iv:dnZxi8jM1I4w3C2duYielpP/8wOAdHDjcqDIrowM0dM=,tag:8irGvLEbRJHV9TB8Jibs9g==,type:str]
+    youtube-key: ENC[AES256_GCM,data:OEm/ynOUPUq7ZEVzL2jgs9d+utkLTIdNq0MHE0JDujb9ndAwyJJI,iv:RRae6Cg6GdDnXAQOdtBYmcA7ZNuu70VpIg2MEezBn5k=,tag:gX4ZG345cT3Jh3ovUxtLGw==,type:str]
+    youtube-client-id: ENC[AES256_GCM,data:dPo4+HsfXHdxrgF9F0qJmOGcSHDCn2KIkHx3ZYZU94iv8ImiPI9dTRfoz0zq8UIN7rwIKidQu9GxCRrg9aXk34pc35SXzEh8JQ==,iv:ROVHb0QjVsNae9eJevG6qc5dc4gkrGt+Y7S2QYrzmQ4=,tag:Advoh75OKPC7CnIeL4GFbA==,type:str]
+    youtube-client-secret: ENC[AES256_GCM,data:c/ALpo/4qJdccMgYiSLg9ZgG7ddaMYxHwJYZ/ogJN2ED21k=,iv:CkrIq+Vpuq28CsRNwdKRLnBq6L8NF37y4xhhnmHQHqQ=,tag:SKtHpm/QZWnGViDtSKlUUQ==,type:str]
+    youtube-refresh-token: ENC[AES256_GCM,data:pnXQ1euCdix2H7IxudmUUcpxc2OUhciKT8OcGV89c/EpoXHgx1+eLxwY5rRszroWwjge9M001RGHngvD/ny3phfWAwYmIzMJxun2f7JCPe7ybMesWmPSkiqVBss1Zfic1uB8mNM/yw==,iv:8p8/vATY8F3YuGA1TtjekiuaKOMnQyTMjrwDBJaK4VU=,tag:/jVg9FDOuLMNrupgrywpBQ==,type:str]
+    twitter-auth-token: ENC[AES256_GCM,data:65SbHggbYtfSfaaxJxRgD6+HpOX4vIfjnVZmOAZ9illPMYOu9MIchQ==,iv:49UuC8n6AGj1skuHzQX39Q/QuKlB9IxogIfiiy1GBnw=,tag:Rq6b0H9UFVZ19tU8ZeelRg==,type:str]
+    bilibili-cookie: ENC[AES256_GCM,data:58nO7ADu2oH/OgLJNYrEEzhf1J0zt8EpuygnSANkGXJju5oSmtM7WLnaMEjC96q14OTTA9QLiFVsbxiFY1eUnraA5W7g7+6CYRXVRZaxz91D/dhKzHGTMjB/LynnNqEIc6liONlcHbyjZNQ+WIqPtjVpCKMN7Mi8cv81/cFX/1GqAwncgDD2oXh1hMPOVY4dYcGKuOG0GjlY6RgOgTPqU3HawQjnoWQjPF+lq2rnWD5HP9ZTxOYa7hm2GgPrxkq1fkRrq+kKYeDh+6M7VLDcm5Fpf+biq6F8fZWzmw4NlVZT9BG0vJFa,iv:vxYXg9Yg9qIWFQXtwTYa4Ds0KSxZYg3M6xdtXKbdaig=,tag:TzCPehk9w+BL4wwgDc1CPg==,type:str]
+    zhihu-cookies: ENC[AES256_GCM,data:DgpvRB7IuRe1KuPFqhCbtyFrC02AUlaA9UWS+d8ix0nweItXwZrkqC03lXQY7nJr54H3SfKXNhtUp4nJmV2hqNQOqekrXVsKrG++UmcAr5Ciw1lTmilqM220igJ9YwiHxtsZrWgp4sTPlTTQIFu5xrGnvlSntBjXAjzStTk1R4XRmLV427QuKbNNQ5MjPXS1PYrtN0d4/qXLx74pNd9ZsNd9F4V0E75Zt6vKE8F7aA==,iv:5Lu/HD8Iw655pg84eFs2eEQS68QqA99uMBHlgelZvrI=,tag:Pnd7VWIAgNt+1vo+vyWDpQ==,type:str]
+mail:
+    bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
+synapse:
+    synapse:
+        coturn: ENC[AES256_GCM,data:9MDq0eXLHjJ8Cd2d1iogS1lnjI0A2+0ZK8OtLKRLqT16BVzQQJyhbkAYwkn1+9ppfrazsHFGrk7DVsA7PWjdmA==,iv:SOjwZIyzkMK9Q1fGkmBSr6nSIarNe/WeD91GPJRuZjg=,tag:1GljmXdK80NKTPSg6xJz0A==,type:str]
+        registration: ENC[AES256_GCM,data:MmRJ3el59XaTwFImuCsiAm2zXeGhgvyUyw9AIv7FvxR4N3YWnHKALcQJtG52N4bmLXU=,iv:vm2R7XGzGET0eTcD2trl3xD2I09NzYmx5NPIY4KK4xM=,tag:exm8/ehPufeqtp6j61ap0Q==,type:str]
+        macaroon: ENC[AES256_GCM,data:2/8GuF/a+ocVtLN0PU17JDvXw/RoXX/CXFHPlI9THl5bY8lBm6tEawijnOKVoFLovfU=,iv:GPAr3ZjqLf9ixevsZoQgs4cPkv0VL4WJoFfQZOdThlw=,tag:HRt/igDEfUJ3K39mG7b9Fg==,type:str]
+        form: ENC[AES256_GCM,data:Z9cYL9ibRWmOhAYtB269n0cWZSvL4zGgc03ZRag0m8cz2j0god/Fn/w6kx3cyGK1C70=,iv:Yst6WSV63IvbMF5nnicIoBj77eSwVMnAHtHrKo2UcDk=,tag:4qf6F2rdctcCf4J9vECvYg==,type:str]
+        signing-key: ENC[AES256_GCM,data:BbPJiNcVTqMAL2XG3K3CIbsb8EM4r8ct/WxPK10FHRwAnqChKy3CAviYU9gewO/tNZXHvUYUAUbPww==,iv:IZB/40EE3DIxAqagdH/a4kcSmiec5l24XLCQKCQNaRo=,tag:/1t0WAPBYmYrPTx4V4wgkw==,type:str]
+    matrix:
+        coturn: ENC[AES256_GCM,data:MwZKkYMefshuk46Cne4wn9ooFH8RCDbrxp+MbLJWli9iPHuzJJzUuQNU9EDL0aNbzyYEMt/7DErw42z6KrpGww==,iv:u/SVVTgfJO2FakiYU+uLHXjA4tHU/W6ASsR3S31+pWs=,tag:VTeKNOKwm2bsiZAOVXeBOQ==,type:str]
+        registration: ENC[AES256_GCM,data:+pA61vTg12lYUyXjLrHSY7y/ExfTQffLlGUI4HBOSFFPTck7bu68FrCaHOIBTtEMfjU=,iv:Ex/phkBZxglG8HiRz+m7h2HNanpq2Pxwbm08vdM3xFc=,tag:mM3YEa70FnCeYIUthK4TeA==,type:str]
+        macaroon: ENC[AES256_GCM,data:/+RaayKiPPpVV7OWWdaSkSSRHMjb8d58lZcpvltN9cYkN1btvMViEgdLSlfqzRRlPUE=,iv:pg9GXgNsrVWKlUAiCKZ2pYXugRH6MsBIMpHKoYWYLik=,tag:/mj5Ak7XAX/FH7sNPEVALw==,type:str]
+        form: ENC[AES256_GCM,data:7HF7HMUH1BTJgXXP6cpUiVj0jCwGW57bx9wKTJu7PnRsNuAam/+nKX7Zfg7WD+gSBlA=,iv:SYeUsuFVgAA6U6STCtKT5c5E8Kglh3x7hy6+Op4n0W8=,tag:eICmHTwwn0KcgNhdDGnusA==,type:str]
+        signing-key: ENC[AES256_GCM,data:hzxxDbGp1L09O7+ueUSa5lJOY/QvF2zvHdpueEHjaPQEToQt9mr2loeTQHC7ObTegfLb9UHrI1jn4A==,iv:KngfahwYZZmDQ5LeOUPWptTMGAC8TZm1G0FWcrwCwsw=,tag:U9pW6/boBIpiswn67Ezrfw==,type:str]
+vaultwarden:
+    #ENC[AES256_GCM,data:yFDD8GHjZWHN/Yh53DseevKAhDVwrHX60e8sGZnF4BUsUuPA/4S2PRzj7CtlpFzUH3kb0i+HkLKRvbchg93U3as=,iv:JGG7daEKs0oMKTNVi9GS7PrXn/8rFtVkHknACsEQR+g=,tag:RSN6fojLsI4dcuPu2eTiWA==,type:comment]
+    admin_token: ENC[AES256_GCM,data:OpjREmxJSRj+aGVoP8KKRE7ClNqRtaV8va4WLVmpl1AO6D0q/GapJvhORHQb5s5ZjIAgvWTz1w+fh050Q9sPwRsNUke3FIcyeNy7k0PHgnnVIdxnU1Vn9KMz/SovjQ0/qEQ7tArvW/EXtKfwnP9lsz9m94VBvA==,iv:9AvDqMa2PeQOSrP2th3YBgA2RxPl3oKZTyUzi/yjRTM=,tag:HYFTQDgWvBsHQk8IZxWkfw==,type:str]
+mariadb:
+    photoprism: ENC[AES256_GCM,data:TF1SZVFnvzyE+7vrHYYUS4Juqhbiw9QcJx7p3Xj88xyBFcTqS1YjzAKs/9GQ1PuzdBrt6hXm/XtJILHiuktnSg==,iv:sd9sQEuIePL6LzUYbFtmdecJ57sMrkF0coalBf8KFqQ=,tag:P/knaKYTJ+aXu4l6IixISA==,type:str]
+    freshrss: ENC[AES256_GCM,data:ydqCbj3UbsLC1e++p5ixb5Kpmk2BsYd0urcfw8T51Is5N1/gQ7P0zgR33AOteAxw2oj85WQZhxu3eAN7BCXV5A==,iv:1oiMo1wwFNXiTZLsf4UPZSJfKFIWLI3h947TC06CVy4=,tag:Otq1oeKBnWXhqNilfsywPQ==,type:str]
+    huginn: ENC[AES256_GCM,data:1Tdg1WDwGgFSXdChgif8knWS24BIFYnmaiSjJXxs5uj/v/5fJ1alb4K4XHW/kFRjQbuAOFfJiJ9ogJ1KAyk17A==,iv:qLMaQpVaKrjP7g2lWzhaNLghxwiV4YJmyYY1hrpu5I8=,tag:566JCENvOxgwD7tM3aQBiw==,type:str]
+photoprism:
+    adminPassword: ENC[AES256_GCM,data:gB81joOfS8h05BNy2YmD/N0cpLPa/vAduDcQBeHiY/WkcnvqSXnXsOfnvbP74KQfoP4W35oFkfyGVPUBSB83tg==,iv:AkN2NoqMXVHQA9fHTTR7xbEapEqy/D61mHn7O23hyYk=,tag:WV+siDA3VnRkOYnP4Z9Qhw==,type:str]
+nextcloud:
+    admin: ENC[AES256_GCM,data:1rglLrLtRf3yXQwfHDMZLewk8ueIbMFOC+1mtoAyLKnDmcQAoEQZ1vHw/hpKkFXJQ+QyX3sP8eUjRXuBEIVl3A==,iv:lfEGPEw9ybSdOYLDdaGCLXKgCvgRxn3k9eIy2DJHDYU=,tag:j4qRexbEAgK5HAGhr/wxfA==,type:str]
+freshrss:
+    chn: ENC[AES256_GCM,data:XGcgfuRozJ/xowtmFPSW,iv:yZ9LTuVE8dGyrtE3vxLA2jLErvmt67XC0jefl1njiOM=,tag:J5d+oGFWhfXEFwVOnsJ2iA==,type:str]
+huginn:
+    invitationCode: ENC[AES256_GCM,data:+m2AabRzUiCFy3MAKTB8d1IE05WHTcmZ,iv:ccdIPHl9N+bvPR/QCwZUwZOfWTeW6gWhhBjOpL85JRg=,tag:Ir2085K04XUGkAuoCG+7VQ==,type:str]
+fz-new-order:
+    token: ENC[AES256_GCM,data:qhwWRflJbW1QMOhiPfbTIrEdQJyVtfZ1QycCgstdKD1Nh40=,iv:GvZ8MJig64l34jkvuJbMMjyNaPT5yz0/pFCc6KEPTvA=,tag:cMXo/6F9thl8k2iAhT507Q==,type:str]
+    uids:
+        #ENC[AES256_GCM,data:O3DOE3jFCg==,iv:9shUoHCLXsJPKHELlyWdreouEcyOqhsfVI2KaqwC4CU=,tag:tYKVv+/DuesSijZwWGdrig==,type:comment]
+        user0: ENC[AES256_GCM,data:2sieulGmi7mCYrJH24djrrmHArrFbOHZ9wUuKvY4f2k=,iv:lb5ODFOeQQ+D9HZnMw48n/DGRB7L51U4frBVcPx1mvk=,tag:MwZua6u+G478uGOwtGu4fQ==,type:str]
+        #ENC[AES256_GCM,data:yeA9zF8Tug==,iv:VZuWLZnt1RBmkBWudKVvgJkYfqxIj/umEHVCfR6IG3k=,tag:1kj7HyjVT59n05VYJ1uP+w==,type:comment]
+        user1: ENC[AES256_GCM,data:Aw0ydspmf+PXKU27Pdzn4q/nY4sxXCADL1WGB7vm3eo=,iv:uTmVvGlW1HfdvoNbupSw3GyShsWTGVCoNrvVJ5BPUy0=,tag:k9KIoCWM6bSprwR8dmN+Hg==,type:str]
+        #ENC[AES256_GCM,data:4G7DyLVVgQ==,iv:Ht/exln1QtL2BxjCaOTIXHRPDiSFYP4zIa7VaeMCuhE=,tag:btVLXf+WS/YgzRFbVFoAfQ==,type:comment]
+        user2: ENC[AES256_GCM,data:P5gmhaQ+VOWVOjTrsx34zUS8dsqIkzCwOImIE8TIfUc=,iv:IoJIUcNJmaBTyr0Ut6R7BN/UqyK8p4HtiwbXUl171pE=,tag:k99PGSL1cEALTmFVWH1uSg==,type:str]
+        #ENC[AES256_GCM,data:TGrZBuCRgQ==,iv:9IOJ3Bkw9udS/y93TTtZ9o79aDq3Bb+DMEogJG77iqA=,tag:S/XcPX1f89IyfZnMoR9s/A==,type:comment]
+        user3: ENC[AES256_GCM,data:cAzf2X20rtQYyz1rLK6b4jo8utuUOdUHVYfCWdfPTDY=,iv:L5cg7aNdfnLTH2dKl4bWCqaujJ9tIvBJrJIoDIaBLwk=,tag:9Al6Wig4lz1my6hgozSsIA==,type:str]
+        #ENC[AES256_GCM,data:b4iJ73sUoQ==,iv:A2hmi7lCR15E5jVR8E71GQuHgF4TdjDuQadXOtBon6k=,tag:eopTJdjN16u7PtpZdhKymQ==,type:comment]
+        user4: ENC[AES256_GCM,data:nUJ0lPuFOUVGCtq0IRSh5dAkAna7hoow1YOtFEgSoZc=,iv:D8phoZxdbQ2/Zaeq8498eRb0a7SZD5WnVdKv+u2pBak=,tag:Obu01n34JjyAVnF0f3uKzg==,type:str]
+    config0:
+        username: ENC[AES256_GCM,data:p8+q8u1A,iv:9s52kS5yLB4vQuGVXNtA4amZqT3eHTTybsbsQZRiFnk=,tag:7SA4SEzMHpP9H/rwoE+UJQ==,type:str]
+        password: ENC[AES256_GCM,data:58+gFodT,iv:ohZlT1BwnzCYv84xHgFsLRkiPMpE8lB8QVHwr0QtDWc=,tag:XF047RnXs6IbKsTnsm0D6g==,type:str]
+        comment: ENC[AES256_GCM,data:T4XcbF1c,iv:hHdsMjU8rzPiduhT05v98pgDqxRW/Km5zmXCEZaT2AI=,tag:LWvwIEfbW2IuDELr4fEXKg==,type:str]
+    config1:
+        username: ENC[AES256_GCM,data:xWP1cesh,iv:11KFZ/J9PScz/oW2+H5BWgw0+ETkCXlcYOMuPpgjEs0=,tag:HswEVzm6ElRjIDsZyEfZcA==,type:str]
+        password: ENC[AES256_GCM,data:Da/E7ZeZ,iv:gIoheXeTErV3+CtZSEDsX7pGzRahHWlKYQ6QZ6W2eu8=,tag:0oQzQ5DJiS2hqMQfU6JRWw==,type:str]
+        comment: ENC[AES256_GCM,data:etfZKwbh,iv:XqqF3D0PpCPd2Q/CCu/PAH4SrvXAOu+lIXvSht/KfKk=,tag:7jyG33foxneRK2wvI/5uBg==,type:str]
+grafana:
+    secret: ENC[AES256_GCM,data:QYhopqGcHGr+24qYlfaTdMtnyzmIZYG4PcvS9KYqC24W3M+HmloCkPHh7Y3ZTVg8MnrDGOcbA9YPLdY7eh/u4g==,iv:dh7egVIem2bgDbmWJ1sqH9fLdIYbAIQjnjNvyuEjVq0=,tag:DbIRVHbCcpKGcNc6sDTasA==,type:str]
+    chn: ENC[AES256_GCM,data:0bbjggWS1MdcUIQiQyPlBTULm+faKDpJbmZmV6vSw8k=,iv:am65WQzUE+AvQrQV+NSF5u6RCWn7EetyPsdy4Cuvyyw=,tag:lxNUM1cIYVSXVgwEnS1Hdw==,type:str]
+wireguard: ENC[AES256_GCM,data:rPZxIQ18KILFsCsriD0z649UqWPAl8M+49GI7bsEHr0t10rlYS8RiZFeKHk=,iv:rfS/PsX7y3ZBCs9YYPM4VoK9i7S2ShGHzcpBATx8Ots=,tag:i0spG0ZxB2Jm6XZwe19VDQ==,type:str]
+xray-server:
+    clients:
+        #ENC[AES256_GCM,data:aAZS,iv:Z+iJG7yC6HJeNdKCCpsZSc9Ny7kAt6GYfXUtZozMb4A=,tag:iMfwjqqmLvu5a8YpF7a0zQ==,type:comment]
+        user0: ENC[AES256_GCM,data:Q8MFrN/3SRgzSlwTx2GmpP/gvG1vpYiVgjsESzUoomsJaigP,iv:oLsf7AX3FE0tFOkJAbqrZVrCa6UxKjp450Sl1rs2Vs0=,tag:5w+AX0p4Or1GAQsEU3NxOQ==,type:str]
+        #ENC[AES256_GCM,data:j3zVwqHmag==,iv:8+ol60wNlbV2RzMBe47VxIrZuec8aXDUNcQvHcxKuiA=,tag:1AgCMfZf9vzWiWDS6hkw2Q==,type:comment]
+        user1: ENC[AES256_GCM,data:ucCiL7uoSafFUP9IiwKOjJqgwNxNLmuHxYXsLYl0fBgbCT3F,iv:RbNPwvSWibODQqySRc+YW65nUvRwaeXT0eDh02sfrwM=,tag:iE7GGrkBxljBT9HdPzDOfA==,type:str]
+        #ENC[AES256_GCM,data:x7dwVDe22M8=,iv:+fT7VUxZGd8SgS0PnEBqHLPLDuywu4s01iWB6TA/BKQ=,tag:CxfP7xSd4L9RBulSfViHaQ==,type:comment]
+        user2: ENC[AES256_GCM,data:e6PbRg30dzOJSXNmU6TML4AaFsSWEvZwN7MHAEX6fEW2p3hW,iv:Y+YYAO6hY9e/T8LSCr34M7riGmSzFIocmWwAwWjnZQs=,tag:LTkdGcRyrx7HqvbSYSsv4A==,type:str]
+        #ENC[AES256_GCM,data:j83rYg==,iv:3oEdAoVz7aMcezcy2chTO0LQTtKpTrJJoQZx3PC03BU=,tag:ABteEIyr2Y6MbGQhmrQySQ==,type:comment]
+        user3: ENC[AES256_GCM,data:Uk0Ax9FVzmmYs+ggWy7z6FEkuj2tppGlvnQdoW6PDI1VA9oI,iv:wSxigXleRUalQR1/TzKfdUVrdyEUuq+Wg42gSv1QMAI=,tag:qn6nBWv6MlGhMarCfI13BA==,type:str]
+    private-key: ENC[AES256_GCM,data:TarrinCFzWkB5zCc7i7f3B3tFfxrF+cGnrg4bw9CAGKWBazSJHCviY8Imw==,iv:azHdrc6AlgS9RPwGVsYRb8bBeC/askCdut1rnv9TA3I=,tag:AT2lLraKVgbp9GmlLJiI+w==,type:str]
+peertube:
+    secrets: ENC[AES256_GCM,data:DAlig4wYCridlfS00YOqH++/4Rkssq2bkJ1bhERrsgeqdccwwnk6ADKpN2UBGANNYiTj2VUHsHT6mIWxPRcJvQ==,iv:kOedA1gAD7el6JbP8MujSCSfkkHM6CDDMSs2LwPmsGU=,tag:ZDS+LGX2hNXHw15Js2sBkQ==,type:str]
+    password: ENC[AES256_GCM,data:jmKmQlFqHSmImfym2M3/+ItbPxx1GwgrLRZwk7KxqXGHFvqZ1ybCnfZCN8jmA1gVJLuPLTrYA9ggHwdKgVrknw==,iv:cBSb5PJsjHBAMgrxlZaVtw1aP39AXMtdk5pnnCyyZbQ=,tag:6TLoDRY6305lm4HVapT4yQ==,type:str]
+open-webui:
+    openai: ENC[AES256_GCM,data:wMSmoEMLcjbMkEOdzCt1CGbmGZ/iMOWk7PR4m452K+/gEQy00wa6B98=,iv:2hKpB1F0a/fz85RY2YNFXrw1Njbzd2pZ68ITp6b7mzA=,tag:0xUjiHszVXv8qfzV8z3Zhg==,type:str]
+    webui: ENC[AES256_GCM,data:+oEpNIyDEA1gH+Ax5P+ujKgXF8qleepYWwIVCuk=,iv:wmGy4T//UDAR8EC1w/j2vsCqi8dHOBnENLetp9+Ii/8=,tag:8OsFLn6xizQiTVJAEGPwWg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWb0FWUkoxeWZ4K1lOb2k5
+            cUZXQktjSTY3djFZOEJyL1dWd0dmWHV4Y3dzClMvSWNiNk9YSzFoRmhQSG9wb1NG
+            ejRUeStyKy9qYWFwWHJraXFWREdhZFkKLS0tIExMb3VCWm13ZkJ3UXcrM3IrRGQv
+            ZjhMWlAyRUpUYkVjb2lidHZPNkg4SUEKctTzocxhVXJ56sHH4BO6QkS5Rn9k/y2U
+            IrZHT9b3nyyyZxhctOArjBXohwt1asNeAe7qsTypTtAMgKTRwggX9Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Vi8vRTFFTW5tNW9OdnNQ
+            MEpxeXY5MnRzTE9GUkRLMVl1cTRBcU1FSmhnCkdmY3RCcy9oS2lZOVJ0Ni9RL041
+            UWo0TkxMblRqSkZoaDVYZm9xRFBCeDgKLS0tIEFVVkl0bUdoN3FVcThVRHpmVEJk
+            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
+            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-12T09:08:37Z"
+    mac: ENC[AES256_GCM,data:cpstZVTMKxbUmB6UbkbaE8sUGVOuqWZre488eYv/7fR5si8amQ5rZ2S+F2UZNFpl598N8EQLPcHxxZYk12cOKB8rQxQsQeBu1N3AIfd/AmTAirYBqErzRVjGuR981PP1KoKi0O+8nMl0N6hnlFCUYrKD7mBF+l3TS4Fv98XFhZk=,iv:S7Kx5TszFPEWPQ3DY/rcDVkmcgFZr9GtmmiyHc/vWOg=,tag:7LuXtywrVNTvqmy1tWFI0Q==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
--- a/devices/xmuhk/README.md
+++ b/devices/xmuhk/README.md
@@ -1,13 +0,0 @@
-# install nix
-
-1. Build nix using `nix build github:NixOS/nixpkgs/nixos-24.11#nixStatic`, upload, create symlink `nix-store` `nix-build` etc. pointing to it.
-2. Upload `.config/nix/nix.conf`.
-
-# install or update packages
-
-1. On nixos, make sure `/public/home/xmuhk/.nix` is mounted correctly.
-2. Build using `sudo nix build --store 'local?store=/public/home/xmuhk/.nix/store&state=/public/home/xmuhk/.nix/state&log=/public/home/xmuhk/.nix/log' .#xmuhk` .
-3. Diff store using `sudo nix-store --store 'local?store=/public/home/xmuhk/.nix/store&state=/public/home/xmuhk/.nix/state&log=/public/home/xmuhk/.nix/log' -qR ./result | grep -Fxv -f <(ssh xmuhk find .nix/store -maxdepth 1 -exec realpath '{}' '\;') | sudo xargs nix-store --store 'local?store=/public/home/xmuhk/.nix/store&state=/public/home/xmuhk/.nix/state&log=/public/home/xmuhk/.nix/log' --export | xz -T0 | pv > xmuhk.nar.xz` .
-4. Upload `xmuhk.nar.xz` to hpc.
-5. On hpc, `pv xmuhk.nar.xz | xz -d | nix-store --import` .
-6. Create gcroot using `nix build /xxx-xmuhk -o .nix/state/gcroots/current`, where `/xxx-xmuhk` is the last path printed by `nix-store --import` .
--- a/devices/xmuhk/default.nix
+++ b/devices/xmuhk/default.nix
@@ -1,69 +0,0 @@
-{ inputs, localLib }:
-let
-  pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
-  {
-    inputs = { inherit (inputs.nixpkgs) lib; topInputs = inputs; };
-    nixpkgs = { march = null; cuda = null; nixRoot = "/public/home/xmuhk/.nix"; };
-  });
-  lumericalLicenseManager = 
-    let
-      ip = "${pkgs.iproute2}/bin/ip";
-      awk = "${pkgs.gawk}/bin/awk";
-      sed = "${pkgs.gnused}/bin/sed";
-      chmod = "${pkgs.coreutils}/bin/chmod";
-      sing = "/public/software/singularity/singularity-3.8.3/bin/singularity";
-    in pkgs.writeShellScriptBin "lumericalLicenseManager"
-    ''
-      echo "Cleaning up..."
-      ${sing} instance stop lumericalLicenseManager || true
-      [ -d /tmp/lumerical ] && chmod -R u+w /tmp/lumerical && rm -rf /tmp/lumerical || true
-      mkdir -p /tmp/lumerical
-      while true; do
-        if ! ss -tan | grep -q ".*TIME-WAIT .*:1084 "; then break; fi
-        sleep 10
-      done
-
-      echo "Extracting image..."
-      ${sing} build --sandbox /tmp/lumerical/lumericalLicenseManager \
-        ${inputs.self.src.lumerical.licenseManager.sifImageFile}
-      mkdir /tmp/lumerical/lumericalLicenseManager/public
-
-      echo 'Searching for en* interface...'
-      iface=$(${ip} -o link show | ${awk} -F': ' '/^[0-9]+: en/ {print $2; exit}')
-      if [ -n "$iface" ]; then
-        echo "Found interface: $iface"
-        echo 'Extracting MAC address...'
-        mac=$(${ip} link show "$iface" | ${awk} '/link\/ether/ {print $2}' | ${sed} 's/://g')
-        echo "Extracted MAC address: $mac"
-      else
-        echo "No interface starting with 'en' found." >&2
-        exit 1
-      fi
-
-      echo 'Creating license file...'
-      ${sed} -i "s|xxxxxxxxxxxxx|$mac|" \
-        /tmp/lumerical/lumericalLicenseManager/home/ansys_inc/shared_files/licensing/license_files/ansyslmd.lic
-      ${sed} -i 's|2022.1231|2035.1231|g' \
-        /tmp/lumerical/lumericalLicenseManager/home/ansys_inc/shared_files/licensing/license_files/ansyslmd.lic
-
-      echo "Starting license manager..."
-      ${sing} instance start --writable /tmp/lumerical/lumericalLicenseManager lumericalLicenseManager
-      ${sing} exec instance://lumericalLicenseManager /bin/sh -c \
-        "pushd /home/ansys_inc/shared_files/licensing; (./start_ansysli &); (./start_lmcenter &); tail -f /dev/null"
-
-      cleanup() {
-        echo "Stopping license manager..."
-        ${sing} instance stop lumericalLicenseManager
-        chmod -R u+w /tmp/lumerical && rm -rf /tmp/lumerical
-      }
-      trap cleanup SIGINT SIGTERM SIGHUP EXIT
-      tail -f /dev/null
-    '';
-in pkgs.symlinkJoin
-{
-  name = "xmuhk";
-  paths = (with pkgs; [ hello btop htop iotop pv localPackages.lumerical.lumerical.cmd ])
-    ++ [ lumericalLicenseManager ];
-  postBuild = "echo ${inputs.self.rev or "dirty"} > $out/.version";
-  passthru = { inherit pkgs; };
-}
--- a/devices/xmuhk/files/.config/nix/nix.conf
+++ b/devices/xmuhk/files/.config/nix/nix.conf
@@ -1,2 +0,0 @@
-store = local?store=/public/home/xmuhk/.nix/store&state=/public/home/xmuhk/.nix/state&log=/public/home/xmuhk/.nix/log
-experimental-features = flakes nix-command
--- a/doc/todo.md
+++ b/doc/todo.md
@@ -1,14 +1,6 @@
-* 测试 huggin rsshub
-* 打包 intel 编译器
-* 切换到 niri，清理 plasma
-* 调整其它用户的 zsh 配置
-* 调整 motd
-* 找到 wg1 不能稳定工作的原因；确定 persistentKeepalive 发包的协议、是否会被正确 NAT。
-* 备份系统
-* 备份数据
-* 清理 mariadb，移动到 persistent
-* 清理多余文件
-* 移动日志到 persistent
-* 更新 srv1
-* 告知将代理改到 xserver2
-* 准备单独一个的 archive
+* 使用 wrap 好的 intel 编译器。
+* 在挂载根目录前（创建 rootfs 时），按用户复制需要的文件
+* 挑选一个好看的主题
+* 尝试一些别的计算软件
+* 解决 vscode 中的英语语法检查插件，尝试 valentjn.vscode-ltex
+* 调整 xmupc1 xmupc2 启动分区
--- a/doc/upgrade.md
+++ b/doc/upgrade.md
@@ -1,12 +0,0 @@
-* merge upstream, update flake
-* update src
-* fix all build errors
-* update modules (synapse)
-* update postgresql nextcloud
-* update stateVersion
-* switch
-* fix disabled packages
-* upstream patches
-* merge upstream again
-* switch
-* build all
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@@ -3,34 +3,42 @@

  inputs =
  {
-    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-25.05";
-    nixpkgs-2411.url = "github:CHN-beta/nixpkgs/nixos-24.11";
-    nixpkgs-2311.url = "github:CHN-beta/nixpkgs/nixos-23.11";
-    nixpkgs-2305.url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    self.lfs = true;
+    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-24.11";
+    "nixpkgs-23.11".url = "github:CHN-beta/nixpkgs/nixos-23.11";
+    "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
-    home-manager = { url = "github:CHN-beta/home-manager/release-25.05"; inputs.nixpkgs.follows = "nixpkgs"; };
+    home-manager = { url = "github:CHN-beta/home-manager/release-24.11"; inputs.nixpkgs.follows = "nixpkgs"; };
    sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
    nur-xddxdd = { url = "github:xddxdd/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-vscode-extensions =
    {
-      url = "github:nix-community/nix-vscode-extensions?ref=4a7f92bdabb365936a8e8958948536cc2ceac7ba";
+      url = "github:nix-community/nix-vscode-extensions?rev=7aa26ebccf778efe880fda1290db9c1da56ffa4f";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    impermanence.url = "github:CHN-beta/impermanence";
+    qchem = { url = "github:Nix-QChem/NixOS-QChem/master"; inputs.nixpkgs.follows = "nixpkgs"; };
    plasma-manager =
    {
      url = "github:pjones/plasma-manager";
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
    nur-linyinfeng = { url = "github:linyinfeng/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };
+    envfs = { url = "github:Mic92/envfs"; inputs.nixpkgs.follows = "nixpkgs"; };
    nix-flatpak.url = "github:gmodena/nix-flatpak";
-    catppuccin = { url = "github:catppuccin/nix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    bscpkgs = { url = "github:CHN-beta/bscpkgs"; inputs.nixpkgs.follows = "nixpkgs"; };
-    aagl = { url = "github:ezKEa/aagl-gtk-on-nix/release-25.05"; inputs.nixpkgs.follows = "nixpkgs"; };
+    chaotic =
+    {
+      url = "github:chaotic-cx/nyx";
+      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
+    };
+    gricad = { url = "github:Gricad/nur-packages"; flake = false; };
+    catppuccin.url = "github:catppuccin/nix";
+    bscpkgs = { url = "git+https://git.chn.moe/chn/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
    winapps = { url = "github:winapps-org/winapps/feat-nix-packaging"; inputs.nixpkgs.follows = "nixpkgs"; };
+    aagl = { url = "github:ezKEa/aagl-gtk-on-nix/release-24.11"; inputs.nixpkgs.follows = "nixpkgs"; };
+    cachyos-lts.url = "github:drakon64/nixos-cachyos-kernel";
    nixvirt = { url = "github:CHN-beta/NixVirt"; inputs.nixpkgs.follows = "nixpkgs"; };
-    buildproxy = { url = "github:polygon/nix-buildproxy"; inputs.nixpkgs.follows = "nixpkgs"; };

    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -43,10 +51,14 @@
    tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
    v-sim = { url = "gitlab:l_sim/v_sim/master"; flake = false; };
    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
+    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
+    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
    openxlsx = { url = "github:troldal/OpenXLSX?rev=f85f7f1bd632094b5d78d4d1f575955fc3801886"; flake = false; };
    sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
+    sockpp = { url = "github:fpagliughi/sockpp"; flake = false; };
+    git-lfs-transfer = { url = "github:charmbracelet/git-lfs-transfer"; flake = false; };
    nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
    hextra = { url = "github:imfing/hextra"; flake = false; };
    nu-scripts = { url = "github:nushell/nu_scripts"; flake = false; };
@@ -54,16 +66,18 @@
    pocketfft = { url = "github:mreineck/pocketfft"; flake = false; };
    blog = { url = "git+https://git.chn.moe/chn/blog-public.git?lfs=1"; flake = false; };
    nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git?lfs=1"; flake = false; };
+    spectroscopy = { url = "github:skelton-group/Phonopy-Spectroscopy"; flake = false; };
    vaspberry = { url = "github:Infant83/VASPBERRY"; flake = false; };
    ufo = { url = "git+https://git.chn.moe/chn/ufo.git?lfs=1"; flake = false; };
+    highfive = { url = "git+https://github.com/CHN-beta/HighFive?submodules=1"; flake = false; };
    stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
    fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
+    octodns-cloudflare = { url = "github:octodns/octodns-cloudflare"; flake = false; };
    mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme?lfs=1"; flake = false; };
-    phono3py = { url = "github:phonopy/phono3py"; flake = false; };
-    sticker = { url = "git+https://git.chn.moe/chn/sticker.git?lfs=1"; flake = false; };
+    phono3py = { url = "github:phonopy/phono3py/v3.14.1"; flake = false; };
  };

-  outputs = inputs: let localLib = import ./flake/lib inputs.nixpkgs.lib; in
+  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
  {
    packages.x86_64-linux = import ./flake/packages.nix { inherit inputs localLib; };
    nixosConfigurations = import ./flake/nixos.nix { inherit inputs localLib; };
--- a/flake/dev.nix
+++ b/flake/dev.nix
@@ -34,6 +34,20 @@
    packages = [ pkgs.clang-tools_18 ];
    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
  };
+  winjob =
+    let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
+    in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+    {
+      inputsFrom = [ winjob ];
+      packages = [ clang-tools_18 ];
+      CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+    };
+  mirism = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.mirism ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
  info = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
  {
    inputsFrom = [ pkgs.localPackages.info ];
--- a/flake/dns/config/chn.moe.nix
+++ b/flake/dns/config/chn.moe.nix
@@ -2,37 +2,36 @@ localLib:
 let
  cname =
  {
-    autoroute = [ "api" "git" "grafana" "matrix" "peertube" "send" "synapse" "vikunja" "铜锣湾" ];
+    autoroute = [ "api" "git" "grafana" "matrix" "peertube" "send" "synapse" "vikunja" "铜锣湾" "铜锣湾实验室" ];
    nas = [ "initrd.nas" ];
-    office = [ "srv2-node0" "xserverxmu" ];
-    vps4 = [ "initrd.vps4" "xserver2.vps4" ];
+    office = [ "srv2-node0" ];
    vps6 =
    [
-      "blog" "catalog" "coturn" "element" "initrd.vps6" "misskey" "sticker" "synapse-admin" "tgapi"
-      "ua" "xserver2" "xserver2.vps6" "铜锣湾实验室"
+      "blog" "catalog" "coturn" "element" "frp" "initrd.vps6" "misskey" "sticker" "synapse-admin" "tgapi"
+      "ua" "vps6.xserver"
+    ];
+    vps7 =
+    [
+      "chat" "freshrss" "huginn" "initrd.vps7" "nextcloud" "photoprism" "rsshub" "ssh.git" "vaultwarden" "webdav"
+      "xsession.vps7"
    ];
    "xlog.autoroute" = [ "xlog" ];
    "wg0.srv1-node0" = [ "wg0.srv1" ];
    "wg0.srv2-node0" = [ "wg0.srv2" ];
-    srv3 =
-    [
-      "chat" "freshrss" "huginn" "initrd.srv3" "nextcloud" "photoprism" "rsshub" "ssh.git" "vaultwarden" "webdav"
-      "xserver2.srv3" "example"
-    ];
+    srv3 = [ "initrd.srv3" ];
    srv1-node0 = [ "srv1" ];
    srv2-node0 = [ "srv2" ];
    "wg1.pc" = [ "nix-store" ];
-    "wg1.nas" = [ "nix-store.nas" ];
  };
  a =
  {
    nas = "192.168.1.2";
    pc = "192.168.1.3";
    one = "192.168.1.4";
-    office = "210.34.16.20";
+    office = "210.34.16.60";
    srv1-node0 = "59.77.36.250";
-    vps4 = "104.234.37.61";
    vps6 = "144.34.225.59";
+    vps7 = "144.126.144.62";
    search = "127.0.0.1";
    srv3 = "23.135.236.216";
    srv1-node1 = "192.168.178.2";
--- a/flake/dns/config/wireguard.nix
+++ b/flake/dns/config/wireguard.nix
@@ -2,8 +2,8 @@
  net = { wg0 = 83; wg1 = 84; };
  peer =
  {
-    vps4 = 2;
    vps6 = 1;
+    vps7 = 2;
    pc = 3;
    nas = 4;
    one = 5;
--- a/flake/lib/default.nix
+++ b/flake/lib/default.nix
@@ -1,6 +1,6 @@
 lib: rec
 {
-  inherit (lib) attrsToList;
+  attrsToList = attrs: builtins.map (name: { inherit name; value = attrs.${name}; }) (builtins.attrNames attrs);
  mkConditional = condition: trueResult: falseResult: let inherit (lib) mkMerge mkIf; in
    mkMerge [ ( mkIf condition trueResult ) ( mkIf (!condition) falseResult ) ];

@@ -86,6 +86,4 @@ lib: rec
      if (builtins.typeOf pattern) != "list" then throw "pattern should be a list"
      else if pattern == [] then origin
      else deepReplace (builtins.tail pattern) (replace ((builtins.head pattern) // { content = origin; }));
-  
-  buildNixpkgsConfig = import ./buildNixpkgsConfig;
 }
--- a/flake/lib/buildNixpkgsConfig/default.nix
+++ b/flake/lib/buildNixpkgsConfig/default.nix
@@ -1,143 +0,0 @@
-# inputs = { lib, topInputs, ...}; nixpkgs = { march, cuda, nixRoot };
-{ inputs, nixpkgs }:
-let
-  platformConfig =
-    if nixpkgs.march == null then { system = "x86_64-linux"; }
-    else { hostPlatform = { system = "x86_64-linux"; gcc = { arch = nixpkgs.march; tune = nixpkgs.march; }; }; };
-  cudaConfig = inputs.lib.optionalAttrs (nixpkgs.cuda != null)
-  (
-    { cudaSupport = true; }
-    // (inputs.lib.optionalAttrs (nixpkgs.cuda.capabilities != null)
-      { cudaCapabilities = nixpkgs.cuda.capabilities; })
-    // (inputs.lib.optionalAttrs (nixpkgs.cuda.forwardCompat != null)
-      { cudaForwardCompat = nixpkgs.cuda.forwardCompat; })
-  );
-  allowInsecurePredicate = p: inputs.lib.warn "Allowing insecure package ${p.name or "${p.pname}-${p.version}"}" true;
-  config = cudaConfig
-    // {
-      inherit allowInsecurePredicate;
-      allowUnfree = true;
-      android_sdk.accept_license = true;
-      allowBroken = true;
-    }
-    // (inputs.lib.optionalAttrs (nixpkgs.march != null)
-    {
-      oneapiArch = let match = {}; in match.${nixpkgs.march} or nixpkgs.march;
-      nvhpcArch = nixpkgs.march;
-      # contentAddressedByDefault = true;
-    })
-    // (inputs.lib.optionalAttrs (nixpkgs.nixRoot != null)
-      { nix = { storeDir = "${nixpkgs.nixRoot}/store"; stateDir = "${nixpkgs.nixRoot}/state"; }; });
-in platformConfig //
-{
-  inherit config;
-  overlays =
-  [
-    inputs.topInputs.aagl.overlays.default
-    inputs.topInputs.nur-xddxdd.overlays.inSubTree
-    inputs.topInputs.nix-vscode-extensions.overlays.default
-    inputs.topInputs.buildproxy.overlays.default
-    (final: prev:
-    {
-      inherit (inputs.topInputs.nix-vscode-extensions.overlays.default final prev) nix-vscode-extensions;
-      nur-linyinfeng = (inputs.topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
-      firefox-addons = (import "${inputs.topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
-    })
-    inputs.topInputs.self.overlays.default
-    (final: prev:
-      let
-        inherit (final) system;
-        genericPackages = import inputs.topInputs.nixpkgs
-          { inherit system; config = { allowUnfree = true; inherit allowInsecurePredicate; }; };
-      in
-      {
-        inherit genericPackages;
-        telegram-desktop = prev.telegram-desktop.override
-        {
-          unwrapped = prev.telegram-desktop.unwrapped.overrideAttrs
-            (prev: { patches = prev.patches or [] ++ [ ./telegram.patch ]; });
-        };
-        libvirt = (prev.libvirt.override { iptables = final.nftables; }).overrideAttrs
-          (prev: { patches = prev.patches or [] ++ [ ./libvirt.patch ]; });
-        podman = prev.podman.override { iptables = final.nftables; };
-        root = (prev.root.override { stdenv = final.gcc13Stdenv; }).overrideAttrs (prev:
-        {
-          patches = prev.patches or [] ++ [ ./root.patch ];
-          cmakeFlags = prev.cmakeFlags ++ [ "-DCMAKE_CXX_STANDARD=23" ];
-        });
-        inherit (final.pkgs-2411) iio-sensor-proxy;
-      }
-      // (
-        let
-          source =
-          {
-            pkgs-2305 = "nixpkgs-2305";
-            pkgs-2311 = "nixpkgs-2311";
-            pkgs-2411 = { source = "nixpkgs-2411"; overlay = inputs.topInputs.bscpkgs.overlays.default; };
-            pkgs-unstable =
-            {
-              source = "nixpkgs-unstable";
-              overlay = inputs.topInputs.self.overlays.default;
-            };
-          };
-          packages = name: import inputs.topInputs.${source.${name}.source or source.${name}}
-          {
-            localSystem = platformConfig.hostPlatform or { inherit (platformConfig) system; };
-            inherit config;
-            overlays = [(source.${name}.overlay or (_: _: {}))];
-          };
-        in builtins.listToAttrs (builtins.map
-          (name: { inherit name; value = packages name; }) (builtins.attrNames source))
-      )
-      // (inputs.lib.optionalAttrs (prev.stdenv.hostPlatform.avx512Support)
-        { gsl = prev.gsl.overrideAttrs { doCheck = false; }; })
-      // (inputs.lib.optionalAttrs (nixpkgs.march != null && !prev.stdenv.hostPlatform.avx512Support)
-        { libhwy = prev.libhwy.override { stdenv = final.genericPackages.stdenv; }; })
-      // (inputs.lib.optionalAttrs (nixpkgs.march != null)
-      {
-        libinsane = prev.libinsane.overrideAttrs (prev:
-          { nativeCheckInputs = builtins.filter (p: p.pname != "valgrind") prev.nativeCheckInputs; });
-        lib2geom = prev.lib2geom.overrideAttrs (prev: { doCheck = false; });
-        libreoffice-qt6-fresh = prev.libreoffice-qt6-fresh.override (prev:
-          { unwrapped = prev.unwrapped.overrideAttrs (prev: { postPatch = prev.postPatch or "" +
-          ''
-            sed -i '/CPPUNIT_TEST.testDubiousArrayFormulasFODS/d' sc/qa/unit/functions_array.cxx
-          '';});});
-        libreoffice-still = prev.libreoffice-still.override (prev:
-          { unwrapped = prev.unwrapped.overrideAttrs (prev: { postPatch = prev.postPatch or "" +
-          ''
-            sed -i '/CPPUNIT_TEST.testDubiousArrayFormulasFODS/d' sc/qa/unit/functions_array.cxx
-          '';});});
-        opencolorio = prev.opencolorio.overrideAttrs (prev: { doCheck = false; });
-        openvswitch = prev.openvswitch.overrideAttrs (prev: { doCheck = false; });
-        rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
-        valkey = prev.valkey.overrideAttrs { doCheck = false; };
-        # -march=xxx cause embree build failed
-        # https://github.com/embree/embree/issues/115
-        embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
-        simde = prev.simde.override { stdenv = final.genericPackages.stdenv; };
-        ctranslate2 = prev.ctranslate2.overrideAttrs (prev:
-          { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
-        pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
-        (
-          {
-            scipy = prev.scipy.overridePythonAttrs (prev:
-              { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
-            rich = prev.rich.overridePythonAttrs (prev:
-              { disabledTests = prev.disabledTests or [] ++ [ "test_brokenpipeerror" ]; });
-          }
-          // (inputs.lib.optionalAttrs (nixpkgs.march != null && !prev.stdenv.hostPlatform.avx2Support)
-          {
-            numcodecs = prev.numcodecs.overridePythonAttrs (prev:
-            {
-              disabledTests = prev.disabledTests or []
-                ++ [ "test_encode_decode" "test_partial_decode" "test_blosc" ];
-            });
-          })
-        ))];
-        inherit (final.pkgs-2411) intelPackages_2023;
-      })
-      // (inputs.lib.optionalAttrs (nixpkgs.march == "silvermont")
-        { c-blosc = prev.c-blosc.overrideAttrs { doCheck = false; }; })
-  )];
-}
--- a/flake/lib/buildNixpkgsConfig/libvirt.patch
+++ b/flake/lib/buildNixpkgsConfig/libvirt.patch
@@ -1,634 +0,0 @@
-diff --git a/src/network/network_iptables.c b/src/network/network_iptables.c
-index e8da15426e..7b5080ae5f 100644
--- a/src/network/network_iptables.c
-+++ b/src/network/network_iptables.c
-@@ -744,13 +744,6 @@ iptablesForwardRejectIn(virFirewall *fw,
-                         const char *iface,
-                         iptablesAction action)
- {
-    virFirewallAddCmd(fw, layer,
-                      "--table", "filter",
-                      iptablesActionTypeToString(action),
-                      VIR_IPTABLES_FWD_IN_CHAIN,
-                      "--out-interface", iface,
-                      "--jump", "REJECT",
-                      NULL);
- }
- 
- /**
-diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
-index f8b5ab665d..54ed0c6f29 100644
--- a/src/network/network_nftables.c
-+++ b/src/network/network_nftables.c
-@@ -504,13 +504,6 @@ nftablesAddForwardRejectIn(virFirewall *fw,
-                            virFirewallLayer layer,
-                            const char *iface)
- {
-    virFirewallAddCmd(fw, layer, "insert", "rule",
-                      nftablesLayerTypeToString(layer),
-                      VIR_NFTABLES_PRIVATE_TABLE,
-                      VIR_NFTABLES_FWD_IN_CHAIN,
-                      "oif", iface,
-                      "counter", "reject",
-                      NULL);
- }
- 
- 
-diff --git a/tests/networkxml2firewalldata/forward-dev-linux.iptables b/tests/networkxml2firewalldata/forward-dev-linux.iptables
-index bc483c4512..98be4b76ad 100644
--- a/tests/networkxml2firewalldata/forward-dev-linux.iptables
-+++ b/tests/networkxml2firewalldata/forward-dev-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/forward-dev-linux.nftables b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-index 8badb74beb..78c0110a32 100644
--- a/tests/networkxml2firewalldata/forward-dev-linux.nftables
-+++ b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/isolated-linux.iptables b/tests/networkxml2firewalldata/isolated-linux.iptables
-index 135189ce41..d2d29933aa 100644
--- a/tests/networkxml2firewalldata/isolated-linux.iptables
-+++ b/tests/networkxml2firewalldata/isolated-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/isolated-linux.nftables b/tests/networkxml2firewalldata/isolated-linux.nftables
-index d1b4dac178..3d72c1fb09 100644
--- a/tests/networkxml2firewalldata/isolated-linux.nftables
-+++ b/tests/networkxml2firewalldata/isolated-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-default-linux.iptables b/tests/networkxml2firewalldata/nat-default-linux.iptables
-index 3cfa61333c..5f401194ed 100644
--- a/tests/networkxml2firewalldata/nat-default-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-default-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-default-linux.nftables b/tests/networkxml2firewalldata/nat-default-linux.nftables
-index 28508292f9..ef7b2b1bc8 100644
--- a/tests/networkxml2firewalldata/nat-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-default-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.iptables b/tests/networkxml2firewalldata/nat-ipv6-linux.iptables
-index ce295cbc6d..127ed35826 100644
--- a/tests/networkxml2firewalldata/nat-ipv6-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-index d8a9ba706d..20e51e203c 100644
--- a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.iptables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.iptables
-index d78537dc5c..a87fe47480 100644
--- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-index a7f09cda59..816a4a8cac 100644
--- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.iptables b/tests/networkxml2firewalldata/nat-many-ips-linux.iptables
-index ba7f234b82..9244705322 100644
--- a/tests/networkxml2firewalldata/nat-many-ips-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-index b826fe6134..904f515f3d 100644
--- a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.iptables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.iptables
-index 1e5aa05231..b4f86a256f 100644
--- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-index d8a9ba706d..20e51e203c 100644
--- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.iptables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.iptables
-index c2e845cc4f..139110d068 100644
--- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-index ceaed6fa40..6db8eddf6c 100644
--- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.iptables b/tests/networkxml2firewalldata/nat-port-range-linux.iptables
-index 8e5c2c8193..0e7686359d 100644
--- a/tests/networkxml2firewalldata/nat-port-range-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-port-range-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-@@ -90,12 +84,6 @@ ip6tables \
- ip6tables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-ip6tables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-index 1dc37a26ec..1d65869876 100644
--- a/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-@@ -45,16 +35,6 @@ nft \
- rule \
- ip6 \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip6 \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.iptables b/tests/networkxml2firewalldata/nat-tftp-linux.iptables
-index 565fff737c..3f2d1ccf5a 100644
--- a/tests/networkxml2firewalldata/nat-tftp-linux.iptables
-+++ b/tests/networkxml2firewalldata/nat-tftp-linux.iptables
-@@ -87,12 +87,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.nftables b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-index 28508292f9..ef7b2b1bc8 100644
--- a/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
-diff --git a/tests/networkxml2firewalldata/route-default-linux.iptables b/tests/networkxml2firewalldata/route-default-linux.iptables
-index a7b969c077..866d65014e 100644
--- a/tests/networkxml2firewalldata/route-default-linux.iptables
-+++ b/tests/networkxml2firewalldata/route-default-linux.iptables
-@@ -71,12 +71,6 @@ iptables \
- iptables \
- -w \
- --table filter \
---insert LIBVIRT_FWI \
---out-interface virbr0 \
---jump REJECT
-iptables \
--w \
---table filter \
- --insert LIBVIRT_FWX \
- --in-interface virbr0 \
- --out-interface virbr0 \
-diff --git a/tests/networkxml2firewalldata/route-default-linux.nftables b/tests/networkxml2firewalldata/route-default-linux.nftables
-index 282c9542a5..fc742c9fea 100644
--- a/tests/networkxml2firewalldata/route-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/route-default-linux.nftables
-@@ -13,16 +13,6 @@ nft \
- rule \
- ip \
- libvirt_network \
-guest_input \
-oif \
-virbr0 \
-counter \
-reject
-nft \
--ae insert \
-rule \
-ip \
-libvirt_network \
- guest_cross \
- iif \
- virbr0 \
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -1,6 +1,6 @@
 { inputs, localLib }:
 let
-  singles = [ "nas" "pc" "vps4" "vps6" "one" "srv3" "test" "test-pc" "test-pc-vm" ];
+  singles = [ "nas" "pc" "vps6" "vps7" "one" "srv3" ];
  cluster = { srv1 = 3; srv2 = 2; };
  deviceModules = builtins.listToAttrs
  (
--- a/flake/packages.nix
+++ b/flake/packages.nix
@@ -1,16 +1,17 @@
 { inputs, localLib }: rec
 {
-  pkgs = import inputs.nixpkgs (localLib.buildNixpkgsConfig
+  pkgs = (import inputs.nixpkgs
  {
-    inputs = { inherit (inputs.nixpkgs) lib; topInputs = inputs; };
-    nixpkgs = { march = null; cuda = null; nixRoot = null; };
+    system = "x86_64-linux";
+    config.allowUnfree = true;
+    overlays = [ inputs.self.overlays.default ];
  });
  hpcstat =
    let
      openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
        (prev: { doCheck = false; patches = prev.patches ++ [ ../packages/hpcstat/openssh.patch ];});
      duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
-      glaze = pkgs.pkgs-2411.pkgsStatic.glaze.overrideAttrs
+      glaze = pkgs.pkgsStatic.glaze.overrideAttrs
        (prev: { cmakeFlags = prev.cmakeFlags ++ [ "-Dglaze_ENABLE_FUZZING=OFF" ]; });
      # pkgsStatic.clangStdenv have a bug
      # https://github.com/NixOS/nixpkgs/issues/177129
@@ -22,32 +23,27 @@
      version = inputs.self.rev or "dirty";
      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
    };
+  inherit (pkgs.localPackages) blog;
  inherit (pkgs.localPackages.pkgsStatic) chn-bsub;
  vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
  {
    gfortran = pkgs.pkgsStatic.gfortran;
    lapack = pkgs.pkgsStatic.openblas;
  };
-  jykang = import ../devices/jykang.xmuhpc { inherit inputs localLib; };
-  xmuhk = import ../devices/xmuhk { inherit inputs localLib; };
+  jykang = import ../devices/jykang.xmuhpc inputs;
  src =
    let getDrv = x:
      if pkgs.lib.isDerivation x then [ x ]
      else if builtins.isAttrs x then builtins.concatMap getDrv (builtins.attrValues x)
      else if builtins.isList x then builtins.concatMap getDrv x
      else [];
-    in pkgs.concatText "src" (getDrv (inputs.self.outputs.src));
+    in pkgs.writeClosure (getDrv (inputs.self.outputs.src));
  dns-push = pkgs.callPackage ./dns
  {
    inherit localLib;
-    tokenPath = inputs.self.nixosConfigurations.pc.config.nixos.system.sops.secrets."acme/token".path;
-    octodns = pkgs.octodns.withProviders (_: with pkgs.octodns-providers; [ cloudflare ]);
+    tokenPath = inputs.self.nixosConfigurations.pc.config.sops.secrets."acme/token".path;
+    octodns = pkgs.octodns.withProviders (_: [ pkgs.localPackages.octodns-cloudflare ]);
  };
-  archive =
-    let devices =
-      [ "nas" "one" "pc" "srv1-node0" "srv1-node1" "srv1-node2" "srv2-node0" "srv2-node1" "srv3" "vps4" "vps6" ];
-    in pkgs.writeText "archive" (builtins.concatStringsSep "\n" (builtins.map
-      (d: "${inputs.self.outputs.nixosConfigurations.${d}.config.system.build.toplevel}") devices));
 }
 // (builtins.listToAttrs (builtins.map
  (system: { inherit (system) name; value = system.value.config.system.build.toplevel; })
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -1,22 +1,23 @@
 { inputs }: let inherit (inputs.self.packages.x86_64-linux) pkgs; in
 {
+  git-lfs-transfer = "sha256-qHQeBI2b8EmUinowixqEuR6iGwNYQy3pSc8iPVfJemE=";
  nvhpc =
  {
    src = pkgs.fetchurl
    {
-      url = "https://developer.download.nvidia.com/hpc-sdk/25.3/nvhpc_2025_253_Linux_x86_64_cuda_12.8.tar.gz";
-      sha256 = "11gxb099yxrsxg9i6vydi7znxqiwqqkhgmg90s74qwpjyriqpbsp";
+      url = "https://developer.download.nvidia.com/hpc-sdk/24.11/nvhpc_2024_2411_Linux_x86_64_cuda_12.6.tar.gz";
+      sha256 = "080rb89p2z98b75wqssvp3s8x6b5n0556d0zskh3cfapcb08lh1r";
    };
    mpi = pkgs.requireFile
    {
      name = "openmpi-gitclone.tar.gz";
-      # download from https://content.mellanox.com/hpc/hpc-x/v2.23/hpcx-v2.23-gcc-doca_ofed-ubuntu24.04-cuda12-x86_64.tbz
+      # download from https://developer.nvidia.com/networking/hpc-x/eula?mrequest=downloads&mtype=hpc&mver=hpc-x&mname=v2.22/hpcx-v2.22-gcc-doca_ofed-ubuntu24.04-cuda12-x86_64.tbz
      # nix-prefetch-url file://$(pwd)/openmpi-gitclone.tar.gz
-      sha256 = "1lx5gld4ay9p327hdlqsi72911cfm6s5v3yabjlmwr7sb27y8151";
+      sha256 = "05r5x6mgw2f2kcq9vhdkfj42panchzlbpns8qy57y4jsbmabwabi";
      message = "Source file not found.";
    };
-    version = "25.3";
-    cudaVersion = "12.8";
+    version = "24.11";
+    cudaVersion = "12.6";
  };
  iso =
  {
@@ -32,6 +33,12 @@
      sha256 = "01hlslbi2i3jkzjwn24drhd2lriaqiwr9hb83r0nib9y1jvr3k5p";
    };
  };
+  nglview = pkgs.fetchPypi
+  {
+    pname = "nglview";
+    version = "3.1.2";
+    hash = "sha256-f2cu+itsoNs03paOW1dmsUsbPa3iEtL4oIPGAKETRc4=";
+  };
  vasp =
  {
    vasp = pkgs.requireFile
@@ -51,7 +58,7 @@
      script = pkgs.fetchzip
      {
        url = "http://theory.cm.utexas.edu/code/vtstscripts.tgz";
-        sha256 = "0wz9sw72w5gydvavm6sbcfssvvdiw8gh8hs0d0p0b23839dw4w6j";
+        sha256 = "18gsw2850ig1mg4spp39i0ygfcwx0lqnamysn5whiax22m8d5z67";
      };
    };
  };
@@ -63,7 +70,19 @@
    finalImageName = "ghcr.io/huginn/huginn";
    finalImageTag = "latest";
  };
-  misskey = {};
+  misskey =
+  {
+    "https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.6/aiscript-dev-aiscript-languageserver-0.1.6.tgz" = "0092d5r67bhf4xkvrdn4a2rm1drjzy7b5sw8mi7hp4pqvpc20ylr";
+    "https://github.com/misskey-dev/tabler-icons/archive/refs/tags/3.30.0-mi.1932+ab127beee.tar.gz" = "09aa34a02rdpcvrhl6xddzy173pg7pi9i551s692ggc3pq7fmdhw";
+  };
+  xmuvpn = pkgs.dockerTools.pullImage
+  {
+    imageName = "hagb/docker-easyconnect";
+    imageDigest = "sha256:1c3a86e41c1d2425a4fd555d279deaec6ff1e3c2287853eb16d23c9cb6dc3409";
+    sha256 = "1jpk2y46lnk0mi6ir7hdx0p6378p0v6qjbh6jm9a4cv5abw0mb2k";
+    finalImageName = "hagb/docker-easyconnec";
+    finalImageTag = "7.6.7";
+  };
  lumerical =
  {
    lumerical = pkgs.requireFile
@@ -73,50 +92,20 @@
      hashMode = "recursive";
      message = "Source not found.";
    };
-    licenseManager =
+    licenseManagerImage = pkgs.requireFile
    {
-      crack = pkgs.requireFile
-      {
-        name = "crack";
-        sha256 = "1a1k3nlaidi0kk2xxamb4pm46iiz6k3sxynhd65y8riylrkck3md";
-        hashMode = "recursive";
-        message = "Source file not found.";
-      };
-      src = pkgs.requireFile
-      {
-        name = "src";
-        sha256 = "1h93r0bb37279dzghi3k2axf0b8g0mgacw0lcww5j3sx0sqjbg4l";
-        hashMode = "recursive";
-        message = "Source file not found.";
-      };
-      image = "7bb3a43bd1ad6103a57f700b13d11d486b6ea117838201e4a29d79b33ac72e3a";
-      imageFile = pkgs.requireFile
-      {
-        name = "lumericalLicenseManager.tar";
-        sha256 = "ftEZADv8Mgo5coNKs+gxPZPl/YTV3FMMgrF3wUIBEiQ=";
-        message = "Source not found.";
-      };
-      license = pkgs.requireFile
-      {
-        name = "license";
-        sha256 = "07rwin14py6pl1brka7krz7k2g9x41h7ks7dmp1lxdassan86484";
-        message = "Source file not found.";
-      };
-      sifImageFile = pkgs.requireFile
-      {
-        name = "lumericalLicenseManager.sif";
-        sha256 = "i0HGLiRWoKuQYYx44GBkDBbyUvFLbfFShi/hx7KBSuU=";
-        message = "Source file not found.";
-      };
+      name = "lumericalLicenseManager.tar";
+      sha256 = "VOtYMnDRUP74O2lAqMqBDLnXtNS8AhbBhyZBj/2aVoE=";
+      message = "Source not found.";
    };
  };
  vesta =
  {
-    version = "3.90.5a";
+    version = "3.90.0a";
    src = pkgs.fetchurl
    {
      url = "https://jp-minerals.org/vesta/archives/testing/VESTA-gtk3-x86_64.tar.bz2";
-      sha256 = "0y277m2xvjyzx8hncc3ka73lir8x6x2xckjac9fdzg03z0jnpqzf";
+      sha256 = "0bsvfr3409g2v1wgnfixpkjz1yzl2j1nlrk5a5rkdfs94rrvxzaa";
    };
    desktopFile = pkgs.fetchurl
    {
@@ -137,7 +126,7 @@
    version = "1.4.0";
    src = pkgs.fetchzip
    {
-      url = "https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/pslist/1.4.0-6/pslist_1.4.0.orig.tar.xz";
+      url = "https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/pslist/1.4.0-4/pslist_1.4.0.orig.tar.xz";
      sha256 = "1sp1h7ccniz658ms331npffpa9iz8llig43d9mlysll420nb3xqv";
    };
  };
@@ -158,34 +147,4 @@
    };
  };
  mathematica = pkgs.mathematica.src;
-  oneapi =
-  {
-    src = pkgs.fetchurl
-    {
-      url = "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/2cf9c083-82b5-4a8f-a515-c599b09dcefc/"
-        + "intel-oneapi-hpc-toolkit-2025.1.1.40_offline.sh";
-      sha256 = "1qjy9dsnskwqsk66fm99b3cch1wp3rl9dx7y884p3x5kwiqdma2x";
-    };
-    version = "2025.1";
-    fullVersion = "2025.1.1.40";
-    components =
-    [
-      "intel.oneapi.lin.dpcpp-cpp-common,v=2025.1.1+10"
-      "intel.oneapi.lin.dpcpp-cpp-common.runtime,v=2025.1.1+10"
-      "intel.oneapi.lin.ifort-compiler,v=2025.1.1+10"
-      "intel.oneapi.lin.compilers-common.runtime,v=2025.1.1+10"
-      "intel.oneapi.lin.mpi.runtime,v=2021.15.0+493"
-      "intel.oneapi.lin.umf,v=0.10.0+355"
-      "intel.oneapi.lin.tbb.runtime,v=2022.1.0+425"
-      "intel.oneapi.lin.compilers-common,v=2025.1.1+10"
-    ];
-  };
-  rsshub =  pkgs.dockerTools.pullImage
-  {
-    imageName = "diygod/rsshub";
-    imageDigest = "sha256:1f9d97263033752bf5e20c66a75e134e6045b6d69ae843c1f6610add696f8c22";
-    hash = "sha256-zN47lhQc3EX28LmGF4N3rDUPqumwmhfGn1OpvBYd2Vw=";
-    finalImageName = "rsshub";
-    finalImageTag = "latest";
-  };
 }
--- a/modules/bugs/default.nix
+++ b/modules/bugs/default.nix
@@ -12,12 +12,8 @@ let bugs =
    (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
  backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
  amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
-  iwlwifi.boot.extraModprobeConfig =
-  ''
-    options iwlwifi power_save=0
-    options iwlmvm power_scheme=1
-    options iwlwifi uapsd_disable=1
-  '';
+  iwlwifi.nixos.system.kernel.modules.modprobeConfig =
+    [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
 };
 in
 {
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -7,11 +7,11 @@ inputs: let inherit (inputs) topInputs; in
    topInputs.nix-index-database.nixosModules.nix-index
    topInputs.impermanence.nixosModules.impermanence
    topInputs.nix-flatpak.nixosModules.nix-flatpak
+    topInputs.chaotic.nixosModules.default
+    { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
    topInputs.catppuccin.nixosModules.catppuccin
    topInputs.aagl.nixosModules.default
    topInputs.nixvirt.nixosModules.default
-    # TODO: Remove after next release
-    "${topInputs.nixpkgs-unstable}/nixos/modules/services/hardware/lact.nix"
    (inputs:
    {
      config =
@@ -19,7 +19,7 @@ inputs: let inherit (inputs) topInputs; in
        home-manager.sharedModules =
        [
          topInputs.plasma-manager.homeManagerModules.plasma-manager
-          topInputs.catppuccin.homeModules.catppuccin
+          topInputs.catppuccin.homeManagerModules.catppuccin
        ];
      };
    })
--- a/modules/hardware/cpu.nix
+++ b/modules/hardware/cpu.nix
@@ -1,29 +0,0 @@
-inputs:
-{
-  options.nixos.hardware.cpu = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.enum [ "intel" "amd" ];
-    default = let inherit (inputs.config.nixos.system.nixpkgs) march; in
-      if march == null then null
-      else if inputs.lib.hasPrefix "znver" march then "amd"
-      else if (inputs.lib.hasSuffix "lake" march)
-        || (builtins.elem march [ "sandybridge" "silvermont" "haswell" "broadwell" ])
-        then "intel"
-      else null;
-  };
-  config = let inherit (inputs.config.nixos.hardware) cpu; in inputs.lib.mkIf (cpu != null) (inputs.lib.mkMerge
-  [
-    (inputs.lib.mkIf (cpu == "intel")
-    {
-      hardware.cpu.intel.updateMicrocode = true;
-      boot.initrd.availableKernelModules =
-        [ "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp" ];
-    })
-    (inputs.lib.mkIf (cpu == "amd")
-    {
-      hardware.cpu.amd = { updateMicrocode = true; ryzen-smu.enable = true; };
-      environment.systemPackages = with inputs.pkgs; [ zenmonitor ];
-      programs.ryzen-monitor-ng.enable = true;
-    })
-  ]);
-}
--- a/modules/hardware/cpus.nix
+++ b/modules/hardware/cpus.nix
@@ -0,0 +1,26 @@
+inputs:
+{
+  options.nixos.hardware.cpus = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.listOf (types.enum [ "intel" "amd" ]); default = []; };
+  config = let inherit (inputs.config.nixos.hardware) cpus; in inputs.lib.mkIf (cpus != [])
+  {
+    hardware.cpu = builtins.listToAttrs
+      (builtins.map (name: { inherit name; value = { updateMicrocode = true; }; }) cpus);
+    boot =
+    {
+      initrd.availableKernelModules =
+        let modules =
+        {
+          intel =
+          [
+            "intel_cstate" "aesni_intel" "intel_cstate" "intel_uncore" "intel_uncore_frequency" "intel_powerclamp"
+          ];
+          amd = [];
+        };
+        in builtins.concatLists (builtins.map (cpu: modules.${cpu}) cpus);
+    };
+    environment.systemPackages =
+      let packages = with inputs.pkgs; { intel = []; amd = [ zenmonitor ]; };
+      in builtins.concatLists (builtins.map (cpu: packages.${cpu}) cpus);
+  };
+}
--- a/modules/hardware/default.nix
+++ b/modules/hardware/default.nix
@@ -21,7 +21,13 @@ inputs:
      {
        services =
        {
-          printing = { enable = true; drivers = [ inputs.pkgs.cnijfilter2 ]; };
+          printing =
+          {
+            enable = true;
+            drivers = [ inputs.pkgs.cnijfilter2 ];
+            # TODO: remove in next update
+            browsed.enable = false;
+          };
          avahi = { enable = true; nssmdns4 = true; openFirewall = true; };
        };
      }
@@ -30,7 +36,7 @@ inputs:
    (
      inputs.lib.mkIf (hardware.sound != null)
      {
-        services.pulseaudio.enable = false;
+        hardware.pulseaudio.enable = false;
        services.pipewire = { enable = true; alsa = { enable = true; support32Bit = true; }; pulse.enable = true; };
        security.rtkit.enable = true;
      }
--- a/modules/hardware/gpu.nix
+++ b/modules/hardware/gpu.nix
@@ -100,7 +100,7 @@ inputs:
      inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
      {
        opencl.enable = true;
-        initrd.enable = true;
+        initrd.enable = true; # needed for waydroid
        legacySupport.enable = true;
        amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
      };}
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.model = let inherit (inputs.lib) mkOption types; in
  {
    hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
+    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
    private = mkOption { type = types.bool; default = false; };
    cluster = mkOption
    {
--- a/modules/packages/android-studio.nix
+++ b/modules/packages/android-studio.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.android-studio = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
  config = let inherit (inputs.config.nixos.packages) android-studio; in inputs.lib.mkIf (android-studio != null)
  {
    nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ];
--- a/modules/packages/bash.nix
+++ b/modules/packages/bash.nix
@@ -1,17 +0,0 @@
-inputs:
-{
-  options.nixos.packages.bash = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) bash; in inputs.lib.mkIf (bash != null)
-  {
-    nixos.user.sharedModules = [(homeInputs:
-    {
-      config =
-      {
-        # set bash history file path, avoid overwriting zsh history
-        programs.bash = { enable = true; historyFile =  "${homeInputs.config.xdg.dataHome}/bash/bash_history"; };
-        home.shell.enableBashIntegration = true;
-      };
-    })];
-  };
-}
--- a/modules/packages/desktop.nix
+++ b/modules/packages/desktop.nix
@@ -27,16 +27,20 @@ inputs:
          # color management
          argyllcms xcalib
          # networking
-          remmina putty mtr-gui
+          pkgs-unstable.remmina putty mtr-gui
          # media
-          mpv nomacs simplescreenrecorder imagemagick gimp-with-plugins netease-cloud-music-gtk qcm
+          mpv nomacs yesplaymusic simplescreenrecorder imagemagick gimp-with-plugins netease-cloud-music-gtk qcm
          waifu2x-converter-cpp blender paraview vlc whalebird spotify obs-studio
          (inkscape-with-extensions.override { inkscapeExtensions = null; })
+          # themes
+          klassy localPackages.slate localPackages.blurred-wallpaper tela-circle-icon-theme
+          catppuccin catppuccin-sddm catppuccin-cursors catppuccinifier-gui catppuccinifier-cli catppuccin-plymouth
+          (catppuccin-kde.override { flavour = [ "latte" ]; }) (catppuccin-kvantum.override { variant = "latte"; })
          # terminal
          warp-terminal
          # development
          adb-sync scrcpy dbeaver-bin cling aircrack-ng
-          weston cage openbox krita fprettify # jetbrains.clion 
+          weston cage openbox krita jetbrains.clion fprettify
          # desktop sharing
          rustdesk-flutter
          # password and key management
@@ -45,63 +49,55 @@ inputs:
          # download
          qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
          # editor
-          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq obsidian code-cursor
+          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq obsidian pkgs-unstable.code-cursor
          # news
          fluent-reader rssguard newsflash newsboat follow
          # nix tools
          nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
-          nix-template nil bundix
+          nix-template nil pnpm-lock-export bundix
          # instant messager
-          element-desktop telegram-desktop discord zoom-us slack nheko hexchat halloy
+          element-desktop telegram-desktop discord zoom-us slack nur-linyinfeng.wemeet nheko
          fluffychat signal-desktop qq nur-xddxdd.wechat-uos-sandboxed cinny-desktop
          # browser
-          google-chrome tor-browser
+          google-chrome tor-browser microsoft-edge
          # office
          crow-translate zotero pandoc texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply pspp libreoffice-qt6-fresh ocrmypdf typst # paperwork
+          ydict texstudio panoply pspp paperwork libreoffice-qt6-fresh ocrmypdf typst
          # required by ltex-plus.vscode-ltex-plus
-          ltex-ls ltex-ls-plus
+          pkgs-unstable.ltex-ls pkgs-unstable.ltex-ls-plus
          # matplot++ needs old gnuplot
-          pkgs-2311.gnuplot
+          inputs.pkgs."pkgs-23.11".gnuplot
          # math, physics and chemistry
          octaveFull ovito localPackages.vesta localPackages.v-sim jmol mpi geogebra6 localPackages.ufo
-          (quantum-espresso.override
-          {
-            stdenv = gcc14Stdenv;
-            gfortran = gfortran14;
-            wannier90 = wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; };
-          })
-          pkgs-2311.hdfview numbat qalculate-qt
-          (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.mumax else emptyDirectory)
-          (if inputs.config.nixos.system.nixpkgs.cuda != null
-            then (lammps.override { stdenv = cudaPackages.backendStdenv; }).overrideAttrs (prev:
-            {
-              cmakeFlags = prev.cmakeFlags ++
-                [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
-              nativeBuildInputs = prev.nativeBuildInputs ++ [ cudaPackages.cudatoolkit ];
-              buildInputs = prev.buildInputs ++ [ mpi ];
-            })
-            else lammps-mpi)
+          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14;
+            wannier90 = inputs.pkgs.wannier90.overrideAttrs { buildFlags = [ "dynlib" ]; }; })
+          inputs.pkgs."pkgs-23.11".hdfview numbat qalculate-qt
          # virtualization
          virt-viewer bottles wineWowPackages.stagingFull genymotion playonlinux
          # media
          nur-xddxdd.svp
          # for kdenlive auto subtitle
          openai-whisper
+          # TODO: remove on next release
+          # phonopy have some bug, we use the version from nixpkgs-unstable
+          (inputs.lib.hiPrio pkgs-unstable.python3Packages.phonopy)
+          (inputs.lib.hiPrio pkgs-unstable.localPackages.phono3py)
        ]
          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
        _pythonPackages = [(pythonPackages: with pythonPackages;
        [
-          phonopy scipy scikit-learn jupyterlab autograd inputs.pkgs.localPackages.phono3py
-          tensorflow keras numpy
+          phonopy scipy scikit-learn jupyterlab autograd
+          # TODO: broken on python 3.12 tensorflow keras
+          # for phonopy
+          inputs.pkgs.localPackages.spectroscopy numpy
        ])];
      };
      user.sharedModules =
      [{
        config.programs =
        {
-          plasma = inputs.lib.mkIf (inputs.config.nixos.system.gui.implementation == "kde")
+          plasma =
          {
            enable = true;
            configFile =
@@ -113,15 +109,9 @@ inputs:
                  inherit (inputs.topInputs) nixos-wallpaper;
                  isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
                    [ "png" "jpg" "jpeg" "webp" ];
-                  listDirRecursive =
-                    let listDir = dir:
-                      if dir.value == "directory" then builtins.concatLists
-                        (builtins.map (f: listDir f) (inputs.localLib.attrsToList (builtins.readDir dir.name)))
-                      else [ dir ];
-                    in dir: listDir { name = dir; value = "directory"; };
                in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
                  (builtins.filter (f: (isPicture f.name) && (f.value == "regular"))
-                    (listDirRecursive nixos-wallpaper)));
+                    (inputs.localLib.attrsToList (builtins.readDir nixos-wallpaper))));
            };
            powerdevil =
              let config =
@@ -137,7 +127,7 @@ inputs:
          obs-studio =
          {
            enable = true;
-            plugins = with inputs.pkgs.obs-studio-plugins; [ wlrobs obs-vaapi droidcam-obs obs-vkcapture ];
+            plugins = with inputs.pkgs.obs-studio-plugins; [ wlrobs obs-vaapi obs-nvfbc droidcam-obs obs-vkcapture ];
          };
        };
      }];
@@ -147,20 +137,11 @@ inputs:
      adb.enable = true;
      wireshark = { enable = true; package = inputs.pkgs.wireshark; };
      yubikey-touch-detector.enable = true;
-      kdeconnect.enable = inputs.lib.mkIf (inputs.config.nixos.system.gui.implementation == "kde") true;
-      kde-pim = inputs.lib.mkIf (inputs.config.nixos.system.gui.implementation == "kde")
-        { enable = true; kmail = true; };
-      coolercontrol =
-      {
-        enable = true;
-        nvidiaSupport = if inputs.config.nixos.hardware.gpu.type == null then false
-          else inputs.lib.hasSuffix "nvidia" inputs.config.nixos.hardware.gpu.type;
-      };
+      kdeconnect.enable = true;
      anime-game-launcher = { enable = true; package = inputs.pkgs.anime-game-launcher; };
      honkers-railway-launcher = { enable = true; package = inputs.pkgs.honkers-railway-launcher; };
      sleepy-launcher = { enable = true; package = inputs.pkgs.sleepy-launcher; };
-      alvr = { enable = true; openFirewall = true; };
    };
-    services = { pcscd.enable = true; lact.enable = true; };
+    services.pcscd.enable = true;
  };
 }
--- a/modules/packages/firefox.nix
+++ b/modules/packages/firefox.nix
@@ -12,10 +12,11 @@ inputs:
    {
      enable = true;
      languagePacks = [ "zh-CN" "en-US" ];
-      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator ];
+      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator firefoxpwa ];
    };
    nixos =
    {
+      packages.packages._packages = [ inputs.pkgs.firefoxpwa ];
      user.sharedModules =
      [{
        config =
@@ -24,23 +25,18 @@ inputs:
          {
            enable = true;
            nativeMessagingHosts = with inputs.pkgs;
-            (
-              [ uget-integrator ]
-              ++ (inputs.lib.optionals (inputs.config.nixos.system.gui.implementation == "kde")
-                [ kdePackages.plasma-browser-integration ])
-            );
+              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
            # TODO: use fixed-version of plugins
            policies.DefaultDownloadDirectory = "\${home}/Downloads";
            profiles.default =
            {
-              extensions.packages = with inputs.pkgs.firefox-addons;
+              extensions = with inputs.pkgs.firefox-addons;
              [
                tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
-                metamask pakkujs rsshub-radar rsspreview tabliss tree-style-tab ublock-origin
-                wappalyzer grammarly zotero-connector smartproxy kiss-translator
-              ] ++ (inputs.lib.optionals (inputs.config.nixos.system.gui.implementation == "kde")
-                [ plasma-integration ]);
-              search = { default = "google"; force = true; };
+                metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
+                wappalyzer grammarly plasma-integration zotero-connector pwas-for-firefox smartproxy kiss-translator
+              ];
+              search = { default = "Google"; force = true; };
              userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";
              userContent = builtins.readFile "${inputs.topInputs.lepton}/userContent.css";
              extraConfig = builtins.readFile "${inputs.topInputs.lepton}/user.js";
--- a/modules/packages/git.nix
+++ b/modules/packages/git.nix
@@ -8,7 +8,7 @@ inputs:
    {
      enable = true;
      package = inputs.pkgs.gitFull;
-      lfs = { enable = true; enablePureSSHTransfer = true; };
+      lfs.enable = true;
      config =
      {
        init.defaultBranch = "main";
@@ -18,5 +18,6 @@ inputs:
        merge.ours.driver = true; # 允许 .gitattributes 中设置的 merge=ours 生效
      };
    };
+    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.git-lfs-transfer ]; # make pure ssh lfs work
  };
 }
--- a/modules/packages/lammps.nix
+++ b/modules/packages/lammps.nix
@@ -0,0 +1,22 @@
+inputs:
+{
+  options.nixos.packages.lammps = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
+  {
+    nixos.packages.packages._packages =
+      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
+      in
+        if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
+          .overrideAttrs (prev:
+          {
+            cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
+            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
+            buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
+          }))]
+        else [ inputs.pkgs.lammps-mpi ];
+  };
+}
--- a/modules/packages/lumerical.nix
+++ b/modules/packages/lumerical.nix
@@ -1,13 +0,0 @@
-inputs:
-{
-  options.nixos.packages.lumerical = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.packages) lumerical; in inputs.lib.mkIf (lumerical != null)
-  {
-    nixos =
-    {
-      packages.packages._packages = [ inputs.pkgs.localPackages.lumerical.lumerical.cmd ];
-      services.lumericalLicenseManager = {};
-    };
-  };
-}
--- a/modules/packages/mathematica.nix
+++ b/modules/packages/mathematica.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
  config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
    { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; };
 }
--- a/modules/packages/mumax.nix
+++ b/modules/packages/mumax.nix
@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default =
+      if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+      then {}
+      else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
+  {
+    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];
+  };
+}
--- a/modules/packages/nushell.nix
+++ b/modules/packages/nushell.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.nushell = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = {}; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = {};
+  };
  config = let inherit (inputs.config.nixos.packages) nushell; in inputs.lib.mkIf (nushell != null)
  {
    nixos =
--- a/modules/packages/root/17253.patch
+++ b/modules/packages/root/17253.patch
@@ -0,0 +1,151 @@
+From 1d2acc921853825af02059183b683c35f5075302 Mon Sep 17 00:00:00 2001
+From: chn <chn@chn.moe>
+Date: Wed, 11 Dec 2024 22:33:40 +0800
+Subject: [PATCH] add C++23 support
+
+---
+ graf3d/eve7/inc/ROOT/REveCaloData.hxx             |  4 ++--
+ graf3d/eve7/src/REveCaloData.cxx                  |  3 +++
+ interpreter/cling/lib/Interpreter/CIFactory.cpp   | 15 +++++++++++----
+ .../Interpreter/IncrementalCUDADeviceCompiler.cpp |  2 ++
+ .../cling/tools/Jupyter/kernel/clingkernel.py     |  4 ++--
+ .../inc/RooStats/HistFactory/HistRef.h            |  3 +--
+ .../inc/RooFit/Detail/NormalizationHelpers.h      |  3 +--
+ 7 files changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/graf3d/eve7/inc/ROOT/REveCaloData.hxx b/graf3d/eve7/inc/ROOT/REveCaloData.hxx
+index 79d2e7069504c..33152334730f4 100644
+--- a/graf3d/eve7/inc/ROOT/REveCaloData.hxx
+++ b/graf3d/eve7/inc/ROOT/REveCaloData.hxx
+@@ -174,7 +174,7 @@ protected:
+ 
+ public:
+    REveCaloData(const char* n="REveCaloData", const char* t="");
+-   ~REveCaloData() override {}
+   ~REveCaloData() override;
+ 
+    void    FillImpliedSelectedSet(Set_t& impSelSet, const std::set<int>& sec_idcs) override;
+ 
+@@ -220,7 +220,7 @@ public:
+    Bool_t   GetWrapTwoPi() const { return fWrapTwoPi; }
+    void     SetWrapTwoPi(Bool_t w) { fWrapTwoPi=w; }
+ 
+-   void     SetSelector(REveCaloDataSelector* iSelector) { fSelector.reset(iSelector); }
+   void     SetSelector(REveCaloDataSelector* iSelector);
+    REveCaloDataSelector* GetSelector() { return fSelector.get(); }
+ 
+    Int_t WriteCoreJson(nlohmann::json &j, Int_t rnr_offset) override;
+diff --git a/graf3d/eve7/src/REveCaloData.cxx b/graf3d/eve7/src/REveCaloData.cxx
+index a5248f3c51d39..dc19d7d1be4a4 100644
+--- a/graf3d/eve7/src/REveCaloData.cxx
+++ b/graf3d/eve7/src/REveCaloData.cxx
+@@ -129,6 +129,9 @@ REveCaloData::REveCaloData(const char* n, const char* t):
+    // Constructor.
+ }
+ 
+REveCaloData::~REveCaloData() {}
+void REveCaloData::SetSelector(REveCaloDataSelector* iSelector) { fSelector.reset(iSelector); }
+
+ ////////////////////////////////////////////////////////////////////////////////
+ /// Process newly selected cells with given select-record.
+ 
+diff --git a/interpreter/cling/lib/Interpreter/CIFactory.cpp b/interpreter/cling/lib/Interpreter/CIFactory.cpp
+index 385c03682575d..d33ce3a0039c5 100644
+--- a/interpreter/cling/lib/Interpreter/CIFactory.cpp
+++ b/interpreter/cling/lib/Interpreter/CIFactory.cpp
+@@ -61,14 +61,18 @@ using namespace cling;
+ 
+ namespace {
+   static constexpr unsigned CxxStdCompiledWith() {
+    // The value of __cplusplus in GCC < 14 is 202100L when -std=c++2b or
+    // -std=c++23 is specified, thus we relax the check to 202100L.
+#if __cplusplus >= 202100L
+    return 23;
+#elif __cplusplus >  201703L
+    return 20;
+#elif __cplusplus > 201402L
+    return 17;
+     // The value of __cplusplus in GCC < 5.0 (e.g. 4.9.3) when
+     // either -std=c++1y or -std=c++14 is specified is 201300L, which fails
+     // the test for C++14 or more (201402L) as previously specified.
+     // I would claim that the check should be relaxed to:
+-#if __cplusplus >  201703L
+-    return 20;
+-#elif __cplusplus > 201402L
+-    return 17;
+ #elif __cplusplus > 201103L || (defined(_WIN32) && _MSC_VER >= 1900)
+     return 14;
+ #elif __cplusplus >= 201103L
+@@ -941,6 +945,8 @@ namespace {
+     // Sanity check that clang delivered the language standard requested
+     if (CompilerOpts.DefaultLanguage(&LangOpts)) {
+       switch (CxxStdCompiledWith()) {
+        case 23: assert(LangOpts.CPlusPlus23 && "Language version mismatch");
+          LLVM_FALLTHROUGH;
+         case 20: assert(LangOpts.CPlusPlus20 && "Language version mismatch");
+           LLVM_FALLTHROUGH;
+         case 17: assert(LangOpts.CPlusPlus17 && "Language version mismatch");
+@@ -1343,6 +1349,7 @@ namespace {
+       // and by enforcing the std version now cling is telling clang what to
+       // do, rather than after clang has dedcuded a default.
+       switch (CxxStdCompiledWith()) {
+        case 23: argvCompile.emplace_back("-std=c++23"); break;
+         case 20: argvCompile.emplace_back("-std=c++20"); break;
+         case 17: argvCompile.emplace_back("-std=c++17"); break;
+         case 14: argvCompile.emplace_back("-std=c++14"); break;
+diff --git a/interpreter/cling/lib/Interpreter/IncrementalCUDADeviceCompiler.cpp b/interpreter/cling/lib/Interpreter/IncrementalCUDADeviceCompiler.cpp
+index ac6bd0e89444e..a492add8a01fc 100644
+--- a/interpreter/cling/lib/Interpreter/IncrementalCUDADeviceCompiler.cpp
+++ b/interpreter/cling/lib/Interpreter/IncrementalCUDADeviceCompiler.cpp
+@@ -117,6 +117,8 @@ namespace cling {
+       cppStdVersion = "-std=c++1z";
+     if (langOpts.CPlusPlus20)
+       cppStdVersion = "-std=c++20";
+    if (langOpts.CPlusPlus23)
+      cppStdVersion = "-std=c++23";
+ 
+     if (cppStdVersion.empty())
+       llvm::errs()
+diff --git a/interpreter/cling/tools/Jupyter/kernel/clingkernel.py b/interpreter/cling/tools/Jupyter/kernel/clingkernel.py
+index 17fcbd116ecc6..17b4d24f23d86 100644
+--- a/interpreter/cling/tools/Jupyter/kernel/clingkernel.py
+++ b/interpreter/cling/tools/Jupyter/kernel/clingkernel.py
+@@ -90,8 +90,8 @@ def _banner_default(self):
+     flush_interval = Float(0.25, config=True)
+ 
+     std = CaselessStrEnum(default_value='c++11',
+-            values = ['c++11', 'c++14', 'c++1z', 'c++17', 'c++20', 'c++2b'],
+-            help="C++ standard to use, either c++2b, c++20, c++17, c++1z, c++14 or c++11").tag(config=True);
+            values = ['c++11', 'c++14', 'c++1z', 'c++17', 'c++20', 'c++2b', 'c++23' ],
+            help="C++ standard to use, either c++23, c++2b, c++20, c++17, c++1z, c++14 or c++11").tag(config=True);
+ 
+     def __init__(self, **kwargs):
+         super(ClingKernel, self).__init__(**kwargs)
+diff --git a/roofit/histfactory/inc/RooStats/HistFactory/HistRef.h b/roofit/histfactory/inc/RooStats/HistFactory/HistRef.h
+index 7db9765004e0d..5b37542e6bdea 100644
+--- a/roofit/histfactory/inc/RooStats/HistFactory/HistRef.h
+++ b/roofit/histfactory/inc/RooStats/HistFactory/HistRef.h
+@@ -12,8 +12,7 @@
+ #define HISTFACTORY_HISTREF_H
+ 
+ #include <memory>
+-
+-class TH1;
+#include <TH1.h>
+ 
+ namespace RooStats{
+ namespace HistFactory {
+diff --git a/roofit/roofitcore/inc/RooFit/Detail/NormalizationHelpers.h b/roofit/roofitcore/inc/RooFit/Detail/NormalizationHelpers.h
+index c66954d0f0549..a849d7c2c8b4b 100644
+--- a/roofit/roofitcore/inc/RooFit/Detail/NormalizationHelpers.h
+++ b/roofit/roofitcore/inc/RooFit/Detail/NormalizationHelpers.h
+@@ -70,8 +70,7 @@ template <class T>
+ std::unique_ptr<T> compileForNormSet(T const &arg, RooArgSet const &normSet)
+ {
+    RooFit::Detail::CompileContext ctx{normSet};
+-   std::unique_ptr<RooAbsArg> head = arg.compileForNormSet(normSet, ctx);
+-   return std::unique_ptr<T>{static_cast<T *>(head.release())};
+   return std::unique_ptr<T>{static_cast<T *>(arg.compileForNormSet(normSet, ctx).release())};
+ }
+ 
+ } // namespace Detail
--- a/flake/lib/buildNixpkgsConfig/root.patch
+++ b/flake/lib/buildNixpkgsConfig/root.patch
--- a/modules/packages/root/default.nix
+++ b/modules/packages/root/default.nix
@@ -6,7 +6,11 @@ inputs:
  {
    nixos.packages.packages =
      let
-        inherit (inputs.pkgs) root;
+        root = inputs.pkgs.root.overrideAttrs (prev:
+        {
+          patches = prev.patches or [] ++ [ ./17253.patch ./17273.patch ];
+          cmakeFlags = prev.cmakeFlags ++ [ "-DCMAKE_CXX_STANDARD=23" ];
+        });
        jupyterPath = inputs.pkgs.jupyter-kernel.create { definitions.root = rec
        {
          displayName = "ROOT";
--- a/modules/packages/minimal.nix
+++ b/modules/packages/minimal.nix
@@ -1,16 +1,16 @@
 inputs:
 {
-  options.nixos.packages.minimal = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.packages.server = let inherit (inputs.lib) mkOption types; in mkOption
    { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) minimal; in inputs.lib.mkIf (minimal != null)
+  config = let inherit (inputs.config.nixos.packages) server; in inputs.lib.mkIf (server != null)
  {
    nixos.packages.packages =
    {
      _packages = with inputs.pkgs;
      [
        # basic tools
-        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq ipfetch localPackages.pslist
-        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty glib
+        beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq zellij ipfetch localPackages.pslist
+        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty
        # lsxx
        pciutils usbutils lshw util-linux lsof dmidecode lm_sensors hwloc acpica-tools
        # top
@@ -24,33 +24,28 @@ inputs:
        # compress
        pigz upx unzip zip lzip p7zip rar
        # file system management
-        sshfs e2fsprogs compsize exfatprogs
+        sshfs e2fsprogs duperemove compsize exfatprogs
        # disk management
        smartmontools hdparm gptfdisk megacli
        # encryption and authentication
        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool libfido2
        # networking
-        ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools openvpn
-        parted
+        ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
        # nix tools
-        nix-output-monitor nix-tree ssh-to-age nix-inspect
+        pkgs-unstable.nix-output-monitor nix-tree ssh-to-age nix-inspect
        # development
-        gdb try rr hexo-cli gh nix-init hugo
-        (octodns.withProviders (_: with octodns-providers; [ cloudflare ]))
+        gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
+        (octodns.withProviders (_: [ localPackages.octodns-cloudflare ]))
        # stupid things
        toilet lolcat localPackages.stickerpicker graph-easy
        # office
-        pdfgrep ffmpeg-full hdf5
+        pdfgrep ffmpeg-full hdf5 # todo-txt-cli 
      ]
-        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ])
-        ++ (inputs.lib.optionals (inputs.config.nixos.system.gui.implementation == "kde")
-          [ inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix ]);
+        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
      _pythonPackages = [(pythonPackages: with pythonPackages;
      [
-        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2 certifi 
-        charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus
-        # allow pandas read odf
-        odfpy
+        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus odfpy
        # for vasp plot-workfunc.py
        ase
      ])];
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -1,16 +1,22 @@
 inputs:
 {
  options.nixos.packages.vasp = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
+  # TODO: add more options to correctly configure VASP
  config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
  {
    nixos.packages.packages = with inputs.pkgs;
    {
      _packages =
-      [
-        localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90
-        (if inputs.config.nixos.system.nixpkgs.cuda != null then localPackages.vasp.nvidia else emptyDirectory)
-      ];
+      (
+        [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
+          ++ (inputs.lib.optional
+            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+            localPackages.vasp.nvidia)
+      );
      _pythonPackages = [(_: [ localPackages.py4vasp ])];
    };
  };
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -18,15 +18,9 @@ inputs:
              (set:
              {
                name = set;
-                value =
-                  # provided by nixpkgs
-                  vscode-extensions.${set} or {}
-                  # provided by nix-vscode-extensions, including pre-release versions, but prefer stable version
-                  // nix-vscode-extensions.vscode-marketplace.${set} or {}
-                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {}
-                  # some versions are too high for the current vscode, use old version from here to override it
-                  // (nix-vscode-extensions.forVSCodeVersion inputs.pkgs.vscode.version)
-                    .vscode-marketplace-release.${set} or {};
+                value = vscode-extensions.${set} or {}
+                  // nix-vscode-extensions.vscode-marketplace.${set}
+                  // nix-vscode-extensions.vscode-marketplace-release.${set} or {};
              })
              (inputs.lib.unique
              (
@@ -35,7 +29,7 @@ inputs:
                  ++ (builtins.attrNames nix-vscode-extensions.vscode-marketplace-release)
              )));
            in with extensions;
-              (with github; [ copilot copilot-chat github-vscode-theme ])
+              (with github; [ copilot github-vscode-theme ])
              ++ (with intellsmi; [ comment-translate ])
              ++ (with ms-vscode; [ cmake-tools cpptools-extension-pack hexeditor remote-explorer ])
              ++ (with ms-vscode-remote; [ remote-ssh ])
@@ -69,15 +63,12 @@ inputs:
                # typst
                myriad-dreamin.tinymist
                # grammaly alternative
-                ltex-plus.vscode-ltex-plus
+                pkgs-unstable.vscode-extensions.ltex-plus.vscode-ltex-plus
              ]
              # jupyter
-              # TODO: pick all extensions from nixpkgs or nix-vscode-extensions, explicitly
+              # TODO: use last release
              ++ (with vscode-extensions.ms-toolsai;
-              [
-                jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
-                datawrangler
-              ]);
+                [ jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow ]);
          extraFlags = builtins.concatStringsSep " " inputs.config.nixos.packages.packages._vscodeEnvFlags;
        }
      )];
--- a/modules/packages/winapps/default.nix
+++ b/modules/packages/winapps/default.nix
@@ -13,7 +13,7 @@ inputs:
      (inputs.pkgs.runCommand "winapps-windows" {}
      ''
        mkdir -p $out/share/applications
-        cp ${inputs.pkgs.replaceVars ./windows.desktop { path = inputs.topInputs.winapps; }} \
+        cp ${inputs.pkgs.substituteAll { src = ./windows.desktop; path = inputs.topInputs.winapps; }} \
          $out/share/applications/windows.desktop
      '')
    ]
--- a/modules/packages/zellij.nix
+++ b/modules/packages/zellij.nix
@@ -1,17 +0,0 @@
-inputs:
-{
-  options.nixos.packages.zellij = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) zellij; in inputs.lib.mkIf (zellij != null)
-  {
-    nixos =
-    {
-      packages.packages._packages = [ inputs.pkgs.zellij ];
-      user.sharedModules =
-      [{
-        config.programs.zellij =
-          { enable = true; settings = { show_startup_tips = false; show_release_notes = false; }; };
-      }];
-    };
-  };
-}
--- a/modules/packages/zsh/default.nix
+++ b/modules/packages/zsh/default.nix
@@ -4,72 +4,85 @@ inputs:
    { type = types.nullOr (types.submodule {}); default = {}; };
  config = let inherit (inputs.config.nixos.packages) zsh; in inputs.lib.mkIf (zsh != null)
  {
-    nixos.user.sharedModules = [(home-inputs:
-    {
-      config = inputs.lib.mkMerge
-      [
+    nixos.user.sharedModules = [(home-inputs: { config.programs = inputs.lib.mkMerge
+    [
+      # general config
+      {
+        zsh =
        {
-          programs.zsh =
+          enable = true;
+          history =
+          {
+            path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
+            extended = true;
+            save = 100000000;
+            size = 100000000;
+          };
+          syntaxHighlighting.enable = true;
+          autosuggestion.enable = true;
+          enableCompletion = true;
+          oh-my-zsh =
          {
            enable = true;
-            history =
-            {
-              path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
-              extended = true;
-              save = 100000000;
-              size = 100000000;
-            };
-            syntaxHighlighting.enable = true;
-            autosuggestion.enable = true;
-            enableCompletion = true;
-            oh-my-zsh =
-            {
-              enable = true;
-              plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
-              theme = inputs.lib.mkDefault "clean";
-            };
-            # ensure ~/.zlogin exists
-            loginExtra = " ";
+            plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
+            theme = inputs.lib.mkDefault "clean";
          };
-          home.shell.enableZshIntegration = true;
-        }
+          # ensure ~/.zlogin exists
+          loginExtra = " ";
+        };
+        # set bash history file path, avoid overwriting zsh history
+        bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
+      }
+      # config for root and chn
+      {
+        zsh = inputs.lib.mkIf (builtins.elem home-inputs.config.home.username [ "chn" "root" "aleksana" "alikia" ])
        {
-          programs.zsh = inputs.lib.mkIf
-            (builtins.elem home-inputs.config.home.username [ "chn" "root" "aleksana" "alikia" ])
+          plugins =
+          [
            {
-              plugins =
-              [
-                {
-                  file = "powerlevel10k.zsh-theme";
-                  name = "powerlevel10k";
-                  src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
-                }
-                { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
-                {
-                  name = "zsh-lsd";
-                  src = inputs.pkgs.fetchFromGitHub
-                  {
-                    owner = "z-shell";
-                    repo = "zsh-lsd";
-                    rev = "65bb5ac49190beda263aae552a9369127961632d";
-                    hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
-                  };
-                }
-              ];
-              initContent = inputs.lib.mkOrder 550
-              ''
-                # p10k instant prompt
-                P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
-                [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
-                HYPHEN_INSENSITIVE="true"
-                export PATH=~/bin:$PATH
-                zstyle ':vcs_info:*' disable-patterns "/nix/remote/*"
-              '';
-              oh-my-zsh.theme = "";
-            };
-        }
-      ];
-    })];
+              file = "powerlevel10k.zsh-theme";
+              name = "powerlevel10k";
+              src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
+            }
+            { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
+            {
+              name = "zsh-lsd";
+              src = inputs.pkgs.fetchFromGitHub
+              {
+                owner = "z-shell";
+                repo = "zsh-lsd";
+                rev = "65bb5ac49190beda263aae552a9369127961632d";
+                hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
+              };
+            }
+          ];
+          initExtraBeforeCompInit =
+          ''
+            # p10k instant prompt
+            P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
+            [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
+            HYPHEN_INSENSITIVE="true"
+            export PATH=~/bin:$PATH
+            function br
+            {
+              local cmd cmd_file code
+              cmd_file=$(mktemp)
+              if broot --outcmd "$cmd_file" "$@"; then
+                cmd=$(<"$cmd_file")
+                command rm -f "$cmd_file"
+                eval "$cmd"
+              else
+                code=$?
+                command rm -f "$cmd_file"
+                return "$code"
+              fi
+            }
+            alias todo="todo.sh"
+          '';
+          oh-my-zsh.theme = "";
+        };
+      }
+    ];})];
    environment.pathsToLink = [ "/share/zsh" ];
    programs.zsh.enable = true;
  };
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -34,21 +34,21 @@ inputs:
          name = builtins.elemAt cert.value.domains 0;
          value =
          {
-            credentialsFile = inputs.config.nixos.system.sops.templates."acme/cloudflare.ini".path;
+            credentialsFile = inputs.config.sops.templates."acme/cloudflare.ini".path;
            extraDomainNames = builtins.tail cert.value.domains;
            group = inputs.lib.mkIf (cert.value.group != null) cert.value.group;
          };
        })
        (inputs.localLib.attrsToList acme.cert));
    };
-    nixos.system.sops =
+    sops =
    {
      templates."acme/cloudflare.ini".content =
      ''
-        CLOUDFLARE_DNS_API_TOKEN=${inputs.config.nixos.system.sops.placeholder."acme/token"}
+        CLOUDFLARE_DNS_API_TOKEN=${inputs.config.sops.placeholder."acme/token"}
        CLOUDFLARE_PROPAGATION_TIMEOUT=300
      '';
-      secrets."acme/token" = {};
+      secrets."acme/token".sopsFile = "${inputs.config.nixos.system.sops.crossSopsDir}/default.yaml";
    };
  };
 }
--- a/modules/services/beesd.nix
+++ b/modules/services/beesd.nix
@@ -15,24 +15,21 @@ inputs:
  };
  config = let inherit (inputs.config.nixos.services) beesd; in inputs.lib.mkIf (beesd != null)
  {
-    services.beesd.filesystems = builtins.listToAttrs (builtins.map
-      (fs:
+    services.beesd.filesystems = builtins.mapAttrs
+      (n: v:
      {
-        name = inputs.utils.escapeSystemdPath fs.name;
-        value =
-        {
-          spec = fs.name;
-          inherit (fs.value) hashTableSizeMB;
-          extraOptions =
-          [
-            "--thread-count" "${builtins.toString fs.value.threads}"
-            "--loadavg-target" "${builtins.toString fs.value.loadAverage}"
-            "--scan-mode" "3"
-            "--verbose" "4"
-          ];
-        };
+        spec = n;
+        inherit (v) hashTableSizeMB;
+        extraOptions =
+        [
+          "--workaround-btrfs-send"
+          "--thread-count" "${builtins.toString v.threads}"
+          "--loadavg-target" "${builtins.toString v.loadAverage}"
+          "--scan-mode" "3"
+          "--verbose" "4"
+        ];
      })
-      (inputs.localLib.attrsToList beesd));
+      beesd;
    nixos.packages.packages._packages = [ inputs.pkgs.bees ];
  };
 }
--- a/modules/services/coturn.nix
+++ b/modules/services/coturn.nix
@@ -14,17 +14,14 @@ inputs:
    {
      enable = true;
      use-auth-secret = true;
-      static-auth-secret-file = inputs.config.nixos.system.sops.secrets."coturn/auth-secret".path;
+      static-auth-secret-file = inputs.config.sops.secrets."coturn/auth-secret".path;
      realm = coturn.hostname;
      cert = "${keydir}/full.pem";
      pkey = "${keydir}/key.pem";
      no-cli = true;
    };
-    nixos =
-    {
-      system.sops.secrets."coturn/auth-secret".owner = inputs.config.systemd.services.coturn.serviceConfig.User;
-      services.acme.cert.${coturn.hostname}.group = inputs.config.systemd.services.coturn.serviceConfig.Group;
-    };
+    sops.secrets."coturn/auth-secret".owner = inputs.config.systemd.services.coturn.serviceConfig.User;
+    nixos.services.acme.cert.${coturn.hostname}.group = inputs.config.systemd.services.coturn.serviceConfig.Group;
    networking.firewall = with inputs.config.services.coturn;
    {
      allowedUDPPorts = [ listening-port tls-listening-port ];
--- a/modules/services/docker.nix
+++ b/modules/services/docker.nix
@@ -0,0 +1,30 @@
+inputs:
+{
+  options.nixos.services.docker = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkIf (docker != null)
+  {
+    virtualisation.docker =
+    {
+      enable = true;
+      # prevent create btrfs subvol
+      storageDriver = "overlay2";
+      daemon.settings.dns = [ "1.1.1.1" ];
+      rootless =
+      {
+        enable = true;
+        setSocketVariable = true;
+        daemon.settings =
+        {
+          features.buildkit = true;
+          # dns 127.0.0.1 make docker not work
+          dns = [ "1.1.1.1" ];
+          # prevent create btrfs subvol
+          storage-driver = "overlay2";
+        };
+      };
+    };
+    hardware.nvidia-container-toolkit.enable = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.cuda != null) true;
+    networking.firewall.trustedInterfaces = [ "docker0" ];
+  };
+}
--- a/modules/services/freshrss.nix
+++ b/modules/services/freshrss.nix
@@ -1,32 +1,52 @@
 inputs:
 {
-  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in
  {
-    type = types.nullOr (types.submodule { options =
-    {
-      hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
-    };});
-    default = null;
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
  };
-  config = let inherit (inputs.config.nixos.services) freshrss; in inputs.lib.mkIf (freshrss != null)
-  {
-    services.freshrss =
+  config =
+    let
+      inherit (inputs.config.nixos.services) freshrss;
+      inherit (inputs.lib) mkIf;
+    in mkIf freshrss.enable
    {
-      enable = true;
-      baseUrl = "https://${freshrss.hostname}";
-      defaultUser = "chn";
-      passwordFile = inputs.config.nixos.system.sops.secrets."freshrss/chn".path;
-      database = { type = "mysql"; passFile = inputs.config.nixos.system.sops.secrets."freshrss/db".path; };
-    };
-    systemd.services.freshrss-config.after = [ "mysql.service" ];
-    nixos =
-    {
-      services = { mariadb.instances.freshrss = {}; nginx.https.${freshrss.hostname}.global.configName = "freshrss"; };
-      system.sops.secrets =
+      services.freshrss =
+      {
+        enable = true;
+        baseUrl = "https://${freshrss.hostname}";
+        defaultUser = "chn";
+        passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
+        database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
+        virtualHost = null;
+      };
+      sops.secrets =
      {
        "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
        "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
      };
+      systemd.services.freshrss-config.after = [ "mysql.service" ];
+      nixos.services =
+      {
+        mariadb = { enable = true; instances.freshrss = {}; };
+        nginx.https.${freshrss.hostname} =
+        {
+          location =
+          {
+            "/".static =
+            {
+              root = "${inputs.pkgs.freshrss}/p";
+              index = [ "index.php" ];
+              tryFiles = [ "$uri" "$uri/" "$uri/index.php" ];
+            };
+            "~ ^.+?\.php(/.*)?$".php =
+            {
+              root = "${inputs.pkgs.freshrss}/p";
+              fastcgiPass =
+                "unix:${inputs.config.services.phpfpm.pools.${inputs.config.services.freshrss.pool}.socket}";
+            };
+          };
+        };
+      };
    };
-  };
 }
--- a/modules/services/frp.nix
+++ b/modules/services/frp.nix
@@ -0,0 +1,203 @@
+inputs:
+{
+  options.nixos.services = let inherit (inputs.lib) mkOption types; in
+  {
+    frpClient =
+    {
+      enable = mkOption { type = types.bool; default = false; };
+      serverName = mkOption { type = types.nonEmptyStr; };
+      user = mkOption { type = types.nonEmptyStr; };
+      tcp = mkOption
+      {
+        type = types.attrsOf (types.submodule (inputs:
+        {
+          options =
+          {
+            localIp = mkOption { type = types.nonEmptyStr; default = "127.0.0.1"; };
+            localPort = mkOption { type = types.ints.unsigned; };
+            remoteIp = mkOption { type = types.nonEmptyStr; default = "127.0.0.1"; };
+            remotePort = mkOption { type = types.ints.unsigned; default = inputs.config.localPort; };
+          };
+        }));
+        default = {};
+      };
+      stcp = mkOption
+      {
+        type = types.attrsOf (types.submodule (inputs:
+        {
+          options =
+          {
+            localIp = mkOption { type = types.nonEmptyStr; default = "127.0.0.1"; };
+            localPort = mkOption { type = types.ints.unsigned; };
+          };
+        }));
+        default = {};
+      };
+      stcpVisitor = mkOption
+      {
+        type = types.attrsOf (types.submodule (inputs:
+        {
+          options =
+          {
+            localIp = mkOption { type = types.nonEmptyStr; default = "127.0.0.1"; };
+            localPort = mkOption { type = types.ints.unsigned; };
+          };
+        }));
+        default = {};
+      };
+    };
+    frpServer =
+    {
+      enable = mkOption { type = types.bool; default = false; };
+      serverName = mkOption { type = types.nonEmptyStr; };
+    };
+  };
+  config =
+    let
+      inherit (inputs.lib) mkMerge mkIf;
+      inherit (inputs.lib.strings) splitString;
+      inherit (inputs.localLib) attrsToList;
+      inherit (inputs.config.nixos.services) frpClient frpServer;
+      inherit (builtins) map listToAttrs;
+    in mkMerge
+    [
+      (
+        mkIf frpClient.enable
+        {
+          systemd.services.frpc =
+            let
+              frpc = "${inputs.pkgs.frp}/bin/frpc";
+              config = inputs.config.sops.templates."frpc.json";
+            in
+            {
+              description = "Frp Client Service";
+              after = [ "network.target" ];
+              serviceConfig =
+              {
+                Type = "simple";
+                User = "frp";
+                Restart = "always";
+                RestartSec = "5s";
+                ExecStart = "${frpc} -c ${config.path}";
+                LimitNOFILE = 1048576;
+              };
+              wantedBy= [ "multi-user.target" ];
+              restartTriggers = [ config.file ];
+            };
+          sops =
+          {
+            templates."frpc.json" =
+            {
+              owner = inputs.config.users.users.frp.name;
+              group = inputs.config.users.users.frp.group;
+              content = builtins.toJSON
+              {
+                auth.token = inputs.config.sops.placeholder."frp/token";
+                user = frpClient.user;
+                serverAddr = frpClient.serverName;
+                serverPort = 7000;
+                proxies =
+                (map
+                  (tcp:
+                  {
+                    name = tcp.name;
+                    type = "tcp";
+                    transport.useCompression = true;
+                    inherit (tcp.value) localIp localPort remotePort;
+                  })
+                  (attrsToList frpClient.tcp))
+                ++ (map
+                  (stcp:
+                  {
+                    name = stcp.name;
+                    type = "stcp";
+                    transport.useCompression = true;
+                    secretKey = inputs.config.sops.placeholder."frp/stcp/${stcp.name}";
+                    allowUsers = [ "*" ];
+                    inherit (stcp.value) localIp localPort;
+                  })
+                  (attrsToList frpClient.stcp));
+                visitors = map
+                  (stcp:
+                  {
+                    name = stcp.name;
+                    type = "stcp";
+                    transport.useCompression = true;
+                    secretKey = inputs.config.sops.placeholder."frp/stcp/${stcp.name}";
+                    serverUser = builtins.elemAt (splitString "." stcp.name) 0;
+                    serverName = builtins.elemAt (splitString "." stcp.name) 1;
+                    bindAddr = stcp.value.localIp;
+                    bindPort = stcp.value.localPort;
+                  })
+                  (attrsToList frpClient.stcpVisitor);
+              };
+            };
+            secrets = listToAttrs
+            (
+              [{ name = "frp/token"; value = {}; }]
+              ++ (map
+                (stcp: { name = "frp/stcp/${stcp.name}"; value = {}; })
+                (attrsToList (with frpClient; stcp // stcpVisitor)))
+            );
+          };
+          users =
+          {
+            users.frp = { uid = inputs.config.nixos.user.uid.frp; group = "frp"; isSystemUser = true; };
+            groups.frp.gid = inputs.config.nixos.user.gid.frp;
+          };
+        }
+      )
+      (
+        mkIf frpServer.enable
+        {
+          systemd.services.frps =
+            let
+              frps = "${inputs.pkgs.frp}/bin/frps";
+              config = inputs.config.sops.templates."frps.json";
+            in
+            {
+              description = "Frp Server Service";
+              after = [ "network.target" ];
+              serviceConfig =
+              {
+                Type = "simple";
+                User = "frp";
+                Restart = "on-failure";
+                RestartSec = "5s";
+                ExecStart = "${frps} -c ${config.path}";
+                LimitNOFILE = 1048576;
+              };
+              wantedBy= [ "multi-user.target" ];
+              restartTriggers = [ config.file ];
+            };
+          sops =
+          {
+            templates."frps.json" =
+            {
+              owner = inputs.config.users.users.frp.name;
+              group = inputs.config.users.users.frp.group;
+              content = builtins.toJSON
+              {
+                auth.token = inputs.config.sops.placeholder."frp/token";
+                transport.tls = let cert = inputs.config.security.acme.certs.${frpServer.serverName}.directory; in
+                {
+                  force = true;
+                  certFile = "${cert}/full.pem";
+                  keyFile = "${cert}/key.pem";
+                  serverName = frpServer.serverName;
+                };
+              };
+            };
+            secrets."frp/token" = {};
+          };
+          nixos.services.acme.cert.${frpServer.serverName}.group = "frp";
+          users =
+          {
+            users.frp = { uid = inputs.config.nixos.user.uid.frp; group = "frp"; isSystemUser = true; };
+            groups.frp.gid = inputs.config.nixos.user.gid.frp;
+          };
+          networking.firewall.allowedTCPPorts = [ 7000 ];
+        }
+      )
+    ];
+}
--- a/modules/services/fz-new-order/default.nix
+++ b/modules/services/fz-new-order/default.nix
@@ -0,0 +1,102 @@
+inputs:
+{
+  options.nixos.services.fz-new-order = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) fz-new-order; in inputs.lib.mkIf (fz-new-order != null)
+  {
+    users =
+    {
+      users.fz-new-order =
+      {
+        uid = inputs.config.nixos.user.uid.fz-new-order;
+        group = "fz-new-order";
+        home = "/var/lib/fz-new-order";
+        createHome = true;
+        isSystemUser = true;
+      };
+      groups.fz-new-order.gid = inputs.config.nixos.user.gid.fz-new-order;
+    };
+    systemd =
+    {
+      timers.fz-new-order =
+      {
+        wantedBy = [ "timers.target" ];
+        timerConfig = { OnBootSec = "10m"; OnUnitActiveSec = "10m"; Unit = "fz-new-order.service"; };
+      };
+      services.fz-new-order = rec
+      {
+        description = "fz-new-order";
+        after = [ "network.target" ];
+        requires = after;
+        serviceConfig =
+        {
+          User = inputs.config.users.users."fz-new-order".name;
+          Group = inputs.config.users.users."fz-new-order".group;
+          WorkingDirectory = "/var/lib/fz-new-order";
+          ExecStart =
+            let
+              src = inputs.pkgs.substituteAll
+              {
+                src = ./main.cpp;
+                config_file = inputs.config.sops.templates."fz-new-order/config.json".path;
+              };
+              binary = inputs.pkgs.stdenv.mkDerivation
+              {
+                name = "fz-new-order";
+                inherit src;
+                buildInputs = with inputs.pkgs; [ jsoncpp.dev cereal fmt httplib ];
+                dontUnpack = true;
+                buildPhase =
+                ''
+                  runHook preBuild
+                  g++ -std=c++20 -O2 -o fz-new-order ${src} -ljsoncpp -lfmt
+                  runHook postBuild
+                '';
+                installPhase =
+                ''
+                  runHook preInstall
+                  mkdir -p $out/bin
+                  cp fz-new-order $out/bin/fz-new-order
+                  runHook postInstall
+                '';
+              };
+            in "${binary}/bin/fz-new-order";
+        };
+      };
+      tmpfiles.rules =
+      [
+        "d /var/lib/fz-new-order 0700 fz-new-order fz-new-order"
+        "Z /var/lib/fz-new-order - fz-new-order fz-new-order"
+      ];
+    };
+    sops = let userNum = 5; configNum = 2; in
+    {
+      templates."fz-new-order/config.json" =
+      {
+        owner = inputs.config.users.users."fz-new-order".name;
+        group = inputs.config.users.users."fz-new-order".group;
+        content = let placeholder = inputs.config.sops.placeholder; in builtins.toJSON
+        {
+          token = placeholder."fz-new-order/token";
+          uids = builtins.map (j: placeholder."fz-new-order/uids/user${builtins.toString j}")
+            (builtins.genList (n: n) userNum);
+          config = builtins.map
+            (i: builtins.listToAttrs (builtins.map
+              (attrName: { name = attrName; value = placeholder."fz-new-order/config${toString i}/${attrName}"; })
+              [ "username" "password" "comment" ]))
+            (builtins.genList (n: n) configNum);
+        };
+      };
+      secrets =
+        { "fz-new-order/token" = {}; }
+        // (builtins.listToAttrs (builtins.map
+          (i: { name = "fz-new-order/uids/user${toString i}"; value = {}; })
+          (builtins.genList (n: n) userNum)))
+        // (builtins.listToAttrs (builtins.concatLists (builtins.map
+          (i: builtins.map
+            (attrName: { name = "fz-new-order/config${builtins.toString i}/${attrName}"; value = {}; })
+            [ "username" "password" "comment" ])
+          (builtins.genList (n: n) configNum))));
+    };
+  };
+}
--- a/modules/services/fz-new-order/main.cpp
+++ b/modules/services/fz-new-order/main.cpp
@@ -0,0 +1,244 @@
+# include <iostream>
+# include <set>
+# include <sstream>
+# include <filesystem>
+# include <cereal/types/set.hpp>
+# include <cereal/archives/json.hpp>
+# include <fmt/format.h>
+# include <fmt/ranges.h>
+# include <httplib.h>
+# include <json/json.h>
+
+std::string urlencode(std::string s)
+{
+  auto hexchar = [](unsigned char c, unsigned char &hex1, unsigned char &hex2)
+  {
+    hex1 = c / 16;
+    hex2 = c % 16;
+    hex1 += hex1 <= 9 ? '0' : 'a' - 10;
+    hex2 += hex2 <= 9 ? '0' : 'a' - 10;
+  };
+  const char *str = s.c_str();
+  std::vector<char> v(s.size());
+  v.clear();
+  for (std::size_t i = 0, l = s.size(); i < l; i++)
+  {
+    char c = str[i];
+    if
+    (
+      (c >= '0' && c <= '9')
+        || (c >= 'a' && c <= 'z')
+        || (c >= 'A' && c <= 'Z')
+        || c == '-' || c == '_' || c == '.' || c == '!' || c == '~'
+        || c == '*' || c == '\'' || c == '(' || c == ')'
+    )
+      v.push_back(c);
+    else
+    {
+      v.push_back('%');
+      unsigned char d1, d2;
+      hexchar(c, d1, d2);
+      v.push_back(d1);
+      v.push_back(d2);
+    }
+  }
+  return std::string(v.cbegin(), v.cend());
+}
+
+void oneshot
+(
+  const std::string& username, const std::string& password, const std::string& comment,
+  const std::set<std::string>& wxuser, const std::string& token
+)
+{
+  httplib::Client fzclient("http://scmv9.fengzhansy.com:8882");
+  httplib::Client wxclient("http://wxpusher.zjiecode.com");
+  auto& log = std::clog;
+
+  try
+  {
+    // get JSESSIONID
+    auto cookie_jsessionid = [&]() -> std::string
+    {
+      log << "get /scmv9/login.jsp\n";
+      auto result = fzclient.Get("/scmv9/login.jsp");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      auto it = result.value().headers.find("Set-Cookie");
+      if (it == result.value().headers.end() || it->first != "Set-Cookie")
+        throw std::runtime_error("find cookie failed");
+      log << fmt::format("set_cookie JSESSIONID {}\n", it->second.substr(0, it->second.find(';')));
+      return it->second.substr(0, it->second.find(';'));
+    }();
+
+    // login
+    auto cookie_pppp = [&]() -> std::string
+    {
+      auto body = fmt::format("method=dologinajax&rand=1234&userc={}&mdid=P&passw={}", username, password);
+      httplib::Headers headers =
+      {
+        { "X-Requested-With", "XMLHttpRequest" },
+        {
+          "User-Agent",
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+        },
+        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+        { "Origin", "http://scmv9.fengzhansy.com:8882" },
+        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/login.jsp" },
+        { "Cookie", cookie_jsessionid }
+      };
+      log << "post /scmv9/data.jsp\n";
+      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      log << fmt::format("set_cookie pppp {}\n", fmt::format("pppp={}%40{}", username, password));
+      return fmt::format("pppp={}%40{}", username, password);
+    }();
+
+    // get order list
+    auto order_list = [&]() -> std::map<std::string, std::pair<std::string, std::string>>
+    {
+      auto body = fmt::format("method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=dd_qry&nv%5B%5D=bill&nv%5B%5D=&nv%5B%5D=storeid&nv%5B%5D=&nv%5B%5D=vendorid&nv%5B%5D={}&nv%5B%5D=qr_status&nv%5B%5D=&nv%5B%5D=ddprt&nv%5B%5D=%25&nv%5B%5D=fdate&nv%5B%5D=&nv%5B%5D=tdate&nv%5B%5D=&nv%5B%5D=shfdate&nv%5B%5D=&nv%5B%5D=shtdate&nv%5B%5D=&nv%5B%5D=fy_pno&nv%5B%5D=1&nv%5B%5D=fy_psize&nv%5B%5D=10", username);
+      httplib::Headers headers =
+      {
+        { "X-Requested-With", "XMLHttpRequest" },
+        {
+          "User-Agent",
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+        },
+        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+        { "Origin", "http://scmv9.fengzhansy.com:8882"
+        },
+        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
+        { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
+      };
+      log << "post /scmv9/data.jsp\n";
+      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      log << fmt::format("get result {}\n", result.value().body);
+      std::stringstream result_body(result.value().body);
+      Json::Value root;
+      result_body >> root;
+      std::map<std::string, std::pair<std::string, std::string>> orders;
+      for (unsigned i = 0; i < root["dt"][1].size(); i++)
+      {
+        log << fmt::format
+        (
+          "insert order {} {} {}\n", root["dt"][1][i].asString(), root["dt"][2][i].asString(),
+          root["dt"][4][i].asString()
+        );
+        orders.insert({root["dt"][1][i].asString(), {root["dt"][2][i].asString(), root["dt"][4][i].asString()}});
+      }
+      return orders;
+    }();
+
+    // read order old
+    auto order_old = [&]() -> std::set<std::string>
+    {
+      if (!std::filesystem::exists("orders.json"))
+        return {};
+      else
+      {
+        std::ifstream ins("orders.json");
+        cereal::JSONInputArchive ina(ins);
+        std::set<std::string> data;
+        cereal::load(ina, data);
+        return data;
+      }
+    }();
+
+    // push new order info
+    for (const auto& order : order_list)
+      if (!order_old.contains(order.first))
+      {
+        auto body = fmt::format
+        (
+          "method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=ddsp_qry&nv%5B%5D=bill&nv%5B%5D={}",
+          order.first
+        );
+        httplib::Headers headers =
+        {
+          { "X-Requested-With", "XMLHttpRequest" },
+          {
+            "User-Agent",
+            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+          },
+          { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+          { "Origin", "http://scmv9.fengzhansy.com:8882" },
+          { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
+          { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
+        };
+        log << "post /scmv9/data.jsp\n";
+        auto result = fzclient.Post
+          ("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+        if (result.error() != httplib::Error::Success)
+          throw std::runtime_error("request failed");
+        log << fmt::format("get result {}\n", result.value().body);
+        std::stringstream result_body(result.value().body);
+        Json::Value root;
+        result_body >> root;
+
+        std::stringstream push_body;
+        double all_cost = 0;
+        push_body << fmt::format
+        (
+          "{} {} {}店\n", comment, order.second.second.substr(order.second.second.find('-') + 1),
+          order.second.first.substr(1, 2)
+        );
+        for (unsigned i = 0; i < root["dt"][6].size(); i++)
+        {
+          push_body << fmt::format
+          (
+            "{} {}{}\n", root["dt"][6][i].asString().substr(root["dt"][6][i].asString().length() - 4),
+            root["dt"][7][i].asString(), root["dt"][5][i].asString()
+          );
+          // 订货金额 maybe empty ???
+          if (root["dt"][10][i].asString() != "")
+            all_cost += std::stod(root["dt"][10][i].asString());
+        }
+        push_body << fmt::format("共{:.2f}元\n", all_cost);
+        log << fmt::format("push to wx {}\n", push_body.str());
+        auto encoded = urlencode(push_body.str());
+            
+        for (const auto& wxu : wxuser)
+        {
+          auto path = fmt::format
+            ("/api/send/message/?appToken={}&content={}&uid={}", token, encoded, wxu);
+          auto wxresult = wxclient.Get(path.c_str());
+        }
+      }
+
+    // save data
+    {
+      for (const auto& order : order_list)
+        if (!order_old.contains(order.first))
+          order_old.insert(order.first);
+      std::ofstream os("orders.json");
+      cereal::JSONOutputArchive oa(os);
+      cereal::save(oa, order_old);
+    }
+  }
+  catch (const std::exception& ex)
+  {
+    log << ex.what() << "\n" << std::flush;
+    std::terminate();
+  }
+}
+
+int main(int argc, char** argv)
+{
+  Json::Value configs;
+  std::ifstream("@config_file@") >> configs;
+  auto config_uids = configs["uids"];
+  std::set<std::string> uids;
+  for (auto& uid : config_uids)
+    uids.insert(uid.asString());
+  for (auto& config : configs["config"])
+    oneshot
+    (
+      config["username"].asString(), config["password"].asString(), config["comment"].asString(),
+      uids, configs["token"].asString()
+    );
+}
+
--- a/modules/services/gamemode.nix
+++ b/modules/services/gamemode.nix
@@ -0,0 +1,30 @@
+inputs:
+{
+  options.nixos.services.gamemode = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    drmDevice = mkOption { type = types.int; };
+  };
+  config = let inherit (inputs.config.nixos.services) gamemode; in inputs.lib.mkIf gamemode.enable
+  {
+    programs.gamemode =
+    {
+      enable = true;
+      settings =
+      {
+        general.renice = 10;
+        gpu =
+        {
+          apply_gpu_optimisations = "accept-responsibility";
+          nv_powermizer_mode = 1;
+          gpu_device = builtins.toString gamemode.drmDevice;
+        };
+        custom = let notify-send = "${inputs.pkgs.libnotify}/bin/notify-send"; in
+        {
+          start = "${notify-send} 'GameMode started'";
+          end = "${notify-send} 'GameMode ended'";
+        };
+      };
+    };
+  };
+}
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -1,31 +1,28 @@
 inputs:
 {
-  options.nixos.services.gitea = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.services.gitea = let inherit (inputs.lib) mkOption types; in
  {
-    type = types.nullOr (types.submodule { options =
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.str; default = "git.chn.moe"; };
+    ssh = mkOption
    {
-      hostname = mkOption { type = types.str; default = "git.chn.moe"; };
-      ssh =
+      type = types.nullOr (types.submodule { options =
      {
        hostname = mkOption { type = types.str; default = "ssh.${inputs.config.nixos.services.gitea.hostname}"; };
        port = mkOption { type = types.nullOr types.ints.unsigned; default = null; };
-      };
-    };});
-    default = null;
+      };});
+      default = null;
+    };
  };
-  config = let inherit (inputs.config.nixos.services) gitea; in inputs.lib.mkIf (gitea != null)
+  config = let inherit (inputs.config.nixos.services) gitea; in inputs.lib.mkIf gitea.enable
  {
    services.gitea =
    {
      enable = true;
      lfs.enable = true;
-      mailerPasswordFile = inputs.config.nixos.system.sops.secrets."gitea/mail".path;
+      mailerPasswordFile = inputs.config.sops.secrets."gitea/mail".path;
      database =
-      {
-        createDatabase = false;
-        type = "postgres";
-        passwordFile = inputs.config.nixos.system.sops.secrets."gitea/db".path;
-      };
+        { createDatabase = false; type = "postgres"; passwordFile = inputs.config.sops.secrets."gitea/db".path; };
      settings =
      {
        session.COOKIE_SECURE = true;
@@ -34,8 +31,8 @@ inputs:
          ROOT_URL = "https://${gitea.hostname}";
          DOMAIN = gitea.hostname;
          HTTP_PORT = 3002;
-          SSH_DOMAIN = gitea.ssh.hostname;
-          SSH_PORT = inputs.lib.mkIf (gitea.ssh.port != null) gitea.ssh.port;
+          SSH_DOMAIN = inputs.lib.mkIf (gitea.ssh != null) gitea.ssh.hostname;
+          SSH_PORT = inputs.lib.mkIf ((gitea.ssh.port or null) != null) gitea.ssh.port;
        };
        mailer =
        {
@@ -48,21 +45,14 @@ inputs:
        };
        service.DISABLE_REGISTRATION = true;
        security.LOGIN_REMEMBER_DAYS = 365;
-        "git.timeout" = builtins.listToAttrs (builtins.map (n: { name = n; value = 1800; })
-          [ "DEFAULT" "MIGRATE" "MIRROR" "CLONE" "PULL" "GC" ]);
      };
    };
-    nixos =
+    nixos.services =
    {
-      system.sops.secrets =
+      nginx =
      {
-        "gitea/mail" = { owner = "gitea"; key = "mail/bot"; };
-        "gitea/db" = { owner = "gitea"; key = "postgresql/gitea"; };
-        "mail/bot" = {};
-      };
-      services =
-      {
-        nginx.https.${gitea.hostname}.location =
+        enable = true;
+        https.${gitea.hostname}.location =
        {
          "/".proxy.upstream = "http://127.0.0.1:3002";
          "/robots.txt".static.root =
@@ -73,8 +63,14 @@ inputs:
            };
            in "${inputs.pkgs.runCommand "robots.txt" {} "mkdir -p $out; cp ${robotsFile} $out/robots.txt"}";
        };
-        postgresql.instances.gitea = {};
      };
+      postgresql.instances.gitea = {};
+    };
+    sops.secrets =
+    {
+      "gitea/mail" = { owner = "gitea"; key = "mail/bot"; };
+      "gitea/db" = { owner = "gitea"; key = "postgresql/gitea"; };
+      "mail/bot" = {};
    };
  };
 }
--- a/modules/services/grafana.nix
+++ b/modules/services/grafana.nix
@@ -24,7 +24,7 @@ inputs:
            enabled = true;
            host = "mail.chn.moe";
            user = "bot@chn.moe";
-            password = "$__file{${inputs.config.nixos.system.sops.secrets."grafana/mail".path}}";
+            password = "$__file{${inputs.config.sops.secrets."grafana/mail".path}}";
            from_address = "bot@chn.moe";
            ehlo_identity = grafana.hostname;
            startTLS_policy = "MandatoryStartTLS";
@@ -32,9 +32,9 @@ inputs:
          server = { root_url = "https://${grafana.hostname}"; http_port = 3001; enable_gzip = true; };
          security =
          {
-            secret_key = "$__file{${inputs.config.nixos.system.sops.secrets."grafana/secret".path}}";
+            secret_key = "$__file{${inputs.config.sops.secrets."grafana/secret".path}}";
            admin_user = "chn";
-            admin_password = "$__file{${inputs.config.nixos.system.sops.secrets."grafana/chn".path}}";
+            admin_password = "$__file{${inputs.config.sops.secrets."grafana/chn".path}}";
            admin_email = "chn@chn.moe";
          };
          database =
@@ -42,7 +42,7 @@ inputs:
            type = "postgres";
            host = "127.0.0.1:5432";
            user = "grafana";
-            password = "$__file{${inputs.config.nixos.system.sops.secrets."grafana/db".path}}";
+            password = "$__file{${inputs.config.sops.secrets."grafana/db".path}}";
          };
        };
        provision =
@@ -78,21 +78,23 @@ inputs:
        extraFlags = [ "--storage.tsdb.max-block-chunk-segment-size=16MB" ];
      };
    };
-    nixos =
+    nixos.services =
    {
-      services =
+      nginx =
      {
-        nginx.https.${grafana.hostname}.location."/".proxy = { upstream = "http://127.0.0.1:3001"; websocket = true; };
-        postgresql.instances.grafana = {};
-      };
-      system.sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
-      {
-        "grafana/mail" = { owner = owner; key = "mail/bot"; };
-        "grafana/secret".owner = owner;
-        "grafana/chn".owner = owner;
-        "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
-        "mail/bot" = {};
+        enable = true;
+        https.${grafana.hostname}.location."/".proxy =
+          { upstream = "http://127.0.0.1:3001"; websocket = true; };
      };
+      postgresql.instances.grafana = {};
+    };
+    sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
+    {
+      "grafana/mail" = { owner = owner; key = "mail/bot"; };
+      "grafana/secret".owner = owner;
+      "grafana/chn".owner = owner;
+      "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
+      "mail/bot" = {};
    };
    environment.persistence."/nix/nodatacow".directories =
      [{ directory = "/var/lib/prometheus2"; user = "prometheus"; group = "prometheus"; mode = "0700"; }];
--- a/modules/services/hpcstat.nix
+++ b/modules/services/hpcstat.nix
@@ -15,13 +15,13 @@ inputs:
            grep = "${inputs.pkgs.gnugrep}/bin/grep";
            curl = "${inputs.pkgs.curl}/bin/curl";
            cat = "${inputs.pkgs.coreutils}/bin/cat";
-            token = inputs.config.nixos.system.sops.secrets."telegram/token".path;
-            chat = inputs.config.nixos.system.sops.secrets."telegram/user/chn".path;
+            token = inputs.config.sops.secrets."telegram/token".path;
+            chat = inputs.config.sops.secrets."telegram/user/chn".path;
            date = "${inputs.pkgs.coreutils}/bin/date";
            hpcstat = "${inputs.pkgs.localPackages.hpcstat}/bin/hpcstat";
            ssh = "${inputs.pkgs.openssh}/bin/ssh -i ${key} -o StrictHostKeyChecking=no"
              + " -o ForwardAgent=yes -o AddKeysToAgent=yes";
-            key = inputs.config.nixos.system.sops.secrets."hpcstat/key".path;
+            key = inputs.config.sops.secrets."hpcstat/key".path;
            jykang = "${inputs.topInputs.self}/devices/jykang.xmuhpc/files";
            ssh-agent = "${inputs.pkgs.openssh}/bin/ssh-agent";
          in
@@ -105,10 +105,10 @@ inputs:
          (inputs.localLib.attrsToList calenders));
        tmpfiles.rules = [ "d /var/lib/hpcstat 0700 hpcstat hpcstat" ];
      };
-    nixos.system.sops.secrets =
+    sops.secrets = let sopsFile = "${inputs.config.nixos.system.sops.crossSopsDir}/default.yaml"; in
    {
-      "telegram/token" = { group = "telegram"; mode = "0440"; };
-      "telegram/user/chn" = { group = "telegram"; mode = "0440"; };
+      "telegram/token" = { group = "telegram"; mode = "0440"; inherit sopsFile; };
+      "telegram/user/chn" = { group = "telegram"; mode = "0440"; inherit sopsFile; };
      "hpcstat/key" = { owner = "hpcstat"; group = "hpcstat"; };
    };
    users =
--- a/modules/services/httpapi.nix
+++ b/modules/services/httpapi.nix
@@ -1,18 +1,18 @@
 inputs:
 {
-  options.nixos.services.httpapi = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.services.httpapi = let inherit (inputs.lib) mkOption types; in
  {
-    type = types.nullOr (types.submodule { options =
-    {
-      hostname = mkOption { type = types.nonEmptyStr; default = "api.chn.moe"; };
-    };});
-    default = null;
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.nonEmptyStr; default = "api.chn.moe"; };
  };
-  config = let inherit (inputs.config.nixos.services) httpapi; in inputs.lib.mkIf (httpapi != null)
-  {
-    nixos =
+  config =
+    let
+      inherit (inputs.config.nixos.services) httpapi;
+      inherit (inputs.lib) mkIf;
+      inherit (builtins) toString map;
+    in mkIf httpapi.enable
    {
-      services =
+      nixos.services =
      {
        phpfpm.instances.httpapi = {};
        nginx.https.${httpapi.hostname}.location =
@@ -21,12 +21,12 @@ inputs:
          "/led".static = { root = "/srv/api"; detectAuth.users = [ "led" ]; };
          "/notify.php".php =
          {
-            root = builtins.dirOf inputs.config.nixos.system.sops.templates."httpapi/notify.php".path;
+            root = builtins.dirOf inputs.config.sops.templates."httpapi/notify.php".path;
            fastcgiPass = inputs.config.nixos.services.phpfpm.instances.httpapi.fastcgi;
          };
        };
      };
-      system.sops =
+      sops =
      {
        templates."httpapi/notify.php" =
        {
@@ -34,14 +34,14 @@ inputs:
          group = inputs.config.users.users.httpapi.group;
          content =
            let
-              inherit (inputs.config.sops) placeholder;
+              placeholder = inputs.config.sops.placeholder;
              request = "https://api.telegram.org/bot${placeholder."telegram/token"}"
                + "/sendMessage?chat_id=${placeholder."telegram/user/chn"}&text=";
            in ''<?php print file_get_contents("${request}".urlencode($_GET["message"])); ?>'';
        };
-        secrets = { "telegram/token" = {}; "telegram/user/chn" = {}; };
+        secrets = let sopsFile = "${inputs.config.nixos.system.sops.crossSopsDir}/default.yaml"; in
+          { "telegram/token" = { inherit sopsFile; }; "telegram/user/chn" = { inherit sopsFile; }; };
      };
+      systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" "Z /srv/api - nginx nginx" ];
    };
-    systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" "Z /srv/api - nginx nginx" ];
-  };
 }
--- a/modules/services/httpua/default.nix
+++ b/modules/services/httpua/default.nix
@@ -14,10 +14,7 @@ inputs:
    {
      phpfpm.instances.httpua = {};
      nginx.http.${httpua.hostname}.php =
-      {
-        root = builtins.toString (inputs.pkgs.writeTextDir "index.php" "<?php echo $_SERVER['HTTP_USER_AGENT']; ?>");
-        fastcgiPass = inputs.config.nixos.services.phpfpm.instances.httpua.fastcgi;
-      };
+        { root = "${./.}"; fastcgiPass = inputs.config.nixos.services.phpfpm.instances.httpua.fastcgi; };
    };
  };
 }
--- a/modules/services/httpua/index.php
+++ b/modules/services/httpua/index.php
@@ -0,0 +1 @@
+<?php echo $_SERVER['HTTP_USER_AGENT']; ?>
--- a/Show More
+++ b/Show More