Revert "remove wallpaper desktopeffect theme etc"

This reverts commit 5b6a2623bc.
remove wallpaper desktopeffect theme etc
2026-01-12 23:39:22 +08:00 · 2025-05-25 14:03:57 +08:00 · 2025-05-25 13:55:48 +08:00 · 2025-05-25 13:51:59 +08:00
103 changed files with 1698 additions and 1248 deletions
--- a/devices/cross/secrets/default.yaml
+++ b/devices/cross/secrets/default.yaml
@@ -28,9 +28,6 @@ users:
    pen: ENC[AES256_GCM,data:XOKXV0YSFbHC3I3xO8fpWvYerNfVFg2afs+CUp2MZB+yt9KR5bTJdVOfUGldLbWH5CR4v5FxTrTujv24wJ710Rfyugxh9aFJ/w==,iv:tHLoO+XpdUk8S56QUiJQOpVO9C5epam9PMubMN+8fHw=,tag:H0srWRigNUedQMIAfJlfjg==,type:str]
    #ENC[AES256_GCM,data:K6O0TIYYGZmM8iOwsQ==,iv:xtT8Psnoy51V9gsRo335+VT56FXTcMQ3d4/tnuWouew=,tag:k8irtZ33G3UFK++rzcmyiw==,type:comment]
    reonokiy: ENC[AES256_GCM,data:fPKdOPAKbXUvK5Jj08T0iSD23mhhkTXCexgB5q3v5JS4c6V4S+W14WOkS4UHrMQls/rHslw0NyMzS5G27A+5vN+EN+xJZfuRGg==,iv:tSdNOgs61tyt7/hUKt8bfKvpq9qOQU14ligdxBs/ATs=,tag:6IoS/p2StKtFREIpxsWkdg==,type:str]
-    #ENC[AES256_GCM,data:cZznknXjlWF6eoEaTA==,iv:tdw/54W2evO1o5sq1syz3k0DZrm/rjflxqJpB9LZgvg=,tag:d60Ctc5YeSmhZJUURUmeSg==,type:comment]
-    zqq: ENC[AES256_GCM,data:iFtM0pxIvXPHBnLEfHdmYGVWXuroDLgUaAKF+DmuBdq1NY+pr33oXNJzckFZfWgpIOuCm4cNg5j5R6nsG+zk2VWdi2vuITT4jA==,iv:qfBC/D1gJYXOZ0Fy2DkAb+ImDgXZWU6R/Z50hbVDR98=,tag:eCr6lbSieWDCNaTYzoQ0qQ==,type:str]
-    zgq: ENC[AES256_GCM,data:cHYFToQ5ulEcb741Gg3X4lKj8ZJy1zcLHpkVQjQXt5hRAQtPsiPlegi2a1nUIAUb6sI//4ffcytlXpdK2sXewFe3ZiIXy3UVjQ==,iv:fKaPxpfh5ssOwAbmEsAPaQ45KrNtkHZb96IzWc6pD9s=,tag:Vt91B77SjxYaZ/HvWVBufA==,type:str]
 telegram:
    token: ENC[AES256_GCM,data:zfMATU2E6cwoiyfszV35vkQG6JSk00y589wmGEf4wQNncPhNsvh+NcSfnTwHTQ==,iv:Q46mUquhUZLGQsCDYitk4IPu24MpVnYmi7aHyZL/b1E=,tag:QVbrwAA9mWK/ToJfGIs9ug==,type:str]
    user:
@@ -177,7 +174,7 @@ sops:
            UnR5Y24rSTk3WUV1VUgvQUFCVUxPZUEKv/lTy02gZYn4jF1uGtm+LhJd0m59Xe99
            +unmqUDh0ZqAhJU8o0jrBiWs1lXOHU7CkIom7tGEMHGUxHkS+Z/6GQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-05T04:25:07Z"
-    mac: ENC[AES256_GCM,data:x7wXcdExnf3grO9uS90dQMCSTgJiCyz5sdiek4EnYPsb/EVXfbzYnOo05T3ns8nNfQb6jCKBr/TZO6ZhOneaa/b8uZrG3c4EtDRVptm6+8PydgG5pv5ZiVLb83XR/t11xLWyzc8livLiTPb2RT0UglznOWCGPz20ULoI+JphGGc=,iv:iE7sRIyY2Espmaushcb0VJMjUZYhSGAqRdhmQRMkndU=,tag:0qsijRFyFshIKZTwVbvntw==,type:str]
+    lastmodified: "2025-05-14T01:17:28Z"
+    mac: ENC[AES256_GCM,data:r1FWYKz9aJtmhH7MLPqwZjG0W7LULScGd63CnIqsm2AbFIs6DgW33zDsgwrl1oblx/zYGda3irB5s1+otR38DU0VE7jqLYzHpb3eLsE986ZTwe9Tujy6BJm2Pyng60BJTTBwKU8awS2WpbTUivK1aVivNfBffQIL5Scv/qkyH3U=,iv:1USu0hh8IM2T/w1Fm/udGswPJcxKmvcG6XwlS2ku6iY=,tag:F/rZiGc3KTaNA0YtrWF3+w==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.2
--- a/devices/cross/wireguard.nix
+++ b/devices/cross/wireguard.nix
@@ -2,7 +2,6 @@ inputs:
 let
  publicKey =
  {
-    vps4 = "sUB97q3lPyGkFqPmjETzDP71J69ZVfaUTWs85+HA12g=";
    vps6 = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
    pc = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
    nas = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
@@ -62,7 +61,7 @@ let
          # 所有设备都可以连接到公网，但只有有公网 ip 的设备可以接受连接
          (builtins.listToAttrs
          (
-            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps4" "vps6" "srv3" ])
+            (builtins.map (n: { name = n; value = getAddress n; }) [ "vps6" "srv3" ])
              ++ (builtins.map (n: { name = n; value = null; }) [ "pc" "nas" "one" "srv1-node0" "srv2-node0" ])
          ))
          # 校内网络
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -4,7 +4,7 @@ inputs:
  {
    nixos =
    {
-      model.private = true;
+      model = { type = "desktop"; private = true; };
      system =
      {
        fileSystems =
@@ -19,13 +19,23 @@ inputs:
        };
        initrd.sshd = {};
        nixpkgs.march = "silvermont";
-        network = {};
+        networking = {};
      };
      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
      {
        sshd = {};
-        xray.client.dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1";
+        xray.client =
+        {
+          enable = true;
+          # TODO: remove on next month
+          xray =
+          {
+            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
+            serverName = "xserver.srv3.chn.moe";
+          };
+          dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1";
+        };
        beesd."/".hashTableSizeMB = 10 * 128;
        nfs."/" = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc";
      };
--- a/devices/nas/secrets.yaml
+++ b/devices/nas/secrets.yaml
@@ -21,7 +21,7 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T01:22:01Z"
-    mac: ENC[AES256_GCM,data:OxRUW3e2SXTTdb7Iwvsf/UaHsTIVxohJwRIFExh5N/dJhU9Ui8omKBjkooiGaysrZEVEZNAWSp2zvTPXUdZrtW2fikyhF6Fsg7jUFFTqhV/sjYMy7gISbfkcGF9SuYGByuuySyXPqsfg+ESeBmMVZiqDSEPYJWu+q8OwThdhsAM=,iv:UnSfmuxcV+tr7wd59Xg0MG2QbP2uOshVhN5C++9ZSzA=,tag:cWiG85xv2OuiBOoAlvVBGw==,type:str]
+    lastmodified: "2025-05-19T01:47:25Z"
+    mac: ENC[AES256_GCM,data:J79zVjfGgptSjh+ShPBOd+lJ9i+NuS2Uw7P4ZvF7xeahn7fbT8bercsBv1F1USwW2ituTBMZFmxaspGjAD+azEM2X7zSJnVtbKr+T9FY6i2N+kPIxdseyw93JLZ1pPTy9bQeXRAJYlJHyEw4zHEpMBbWSI88I+i43s2xkScwEuU=,iv:4Ge0dHPxa4zF++0eeHy8fH7t5ndFznhFAKnrV7WOOXs=,tag:+UG3b93zFo/EfOfCQrPoBg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/devices/one/default.nix
+++ b/devices/one/default.nix
@@ -24,9 +24,19 @@ inputs:
      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
      {
-        xray.client = {};
+        xray.client =
+        {
+          enable = true;
+          # TODO: remove on next month
+          xray =
+          {
+            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
+            serverName = "xserver.srv3.chn.moe";
+          };
+        };
        beesd."/".hashTableSizeMB = 64;
        sshd = {};
+        kvm = {};
      };
      bugs = [ "xmunet" ];
    };
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -52,6 +52,7 @@ inputs:
          "alderlake"
        ];
        nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
+        kernel.variant = "cachyos-lts";
        sysctl.laptop-mode = 5;
      };
      hardware =
@@ -74,13 +75,29 @@ inputs:
          };
        };
        sshd = {};
-        xray.client.dnsmasq.hosts = builtins.listToAttrs
-        (
-          (builtins.map
-            (name: { inherit name; value = "144.34.225.59"; })
-            [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
-        )
-        // { "4006024680.com" = "192.168.199.1"; };
+        xray.client =
+        {
+          enable = true;
+          # TODO: remove on next month
+          xray =
+          {
+            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
+            serverName = "xserver.srv3.chn.moe";
+          };
+          dnsmasq.hosts = builtins.listToAttrs
+          (
+            (builtins.map
+              (name: { inherit name; value = "144.34.225.59"; })
+              [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
+            ++ (builtins.map
+              (name: { inherit name; value = "0.0.0.0"; })
+              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
+          )
+          // {
+            "4006024680.com" = "192.168.199.1";
+            "hpc.xmu.edu.cn" = "121.192.191.11";
+          };
+        };
        acme.cert."debug.mirism.one" = {};
        nix-serve = {};
        misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
@@ -113,7 +130,7 @@ inputs:
        nfs."/" = "192.168.84.0/24";
      };
      bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
-      packages = { android-studio = {}; mathematica = {}; vasp = {}; lammps = {}; };
+      packages = { android-studio = {}; mathematica = {}; };
      user.users = [ "chn" "test" ];
    };
    boot.loader.grub =
@@ -148,6 +165,7 @@ inputs:
    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
    # 允许kvm读取物理硬盘
    users.users.qemu-libvirtd.extraGroups = [ "disk" ];
+    networking.extraHosts = "144.34.225.59 mirism.one beta.mirism.one ng01.mirism.one";
    services.colord.enable = true;
  };
 }
--- a/devices/srv1/default.nix
+++ b/devices/srv1/default.nix
@@ -62,8 +62,7 @@ inputs:
          ];
        };
      };
-      packages.vasp = {};
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" "zgq" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" ];
    };
  };
 }
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -8,26 +8,26 @@ inputs:
      system =
      {
        nixpkgs.march = "cascadelake";
-        network =
+        networking.static =
        {
-          static =
-          {
-            eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
-            eno146 = { ip = "192.168.178.1"; mask = 24; };
-          };
-          masquerade = [ "eno146" ];
-          trust = [ "eno146" ];
+          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+          eno146 = { ip = "192.168.178.1"; mask = 24; };
        };
      };
      services =
      {
-        sshd.motd = true;
-        xray.client.dnsmasq.extraInterfaces = [ "eno146" ];
+        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
        beesd."/" = { hashTableSizeMB = 128; threads = 4; };
+        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
      };
      packages.packages._prebuildPackages =
        [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
    };
+    # allow other machine access network by this machine
+    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
+    # without this, tproxy does not work
+    # TODO: why?
+    networking.firewall.trustedInterfaces = [ "eno146" ];
  };
 }
--- a/devices/srv1/node1/default.nix
+++ b/devices/srv1/node1/default.nix
@@ -7,14 +7,13 @@ inputs:
      system =
      {
        nixpkgs.march = "broadwell";
-        network =
-        {
-          static.eno2 =
-            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-          trust = [ "eno2" ];
-        };
+        networking.static.eno2 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd."/".threads = 4;
    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
  };
 }
--- a/devices/srv1/node2/default.nix
+++ b/devices/srv1/node2/default.nix
@@ -7,25 +7,26 @@ inputs:
      system =
      {
        nixpkgs.march = "broadwell";
-        network =
+        networking.static =
        {
-          static =
-          {
-            br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
-            eno2 = { ip = "192.168.178.3"; mask = 24; };
-          };
-          trust = [ "eno2" ];
-          bridge.br0.interfaces = [ "eno1" ];
+          br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
+          eno2 = { ip = "192.168.178.3"; mask = 24; };
        };
        fileSystems.mount.btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
          { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
      };
      services =
      {
-        xray.client = {};
+        xray.client.enable = true;
        beesd."/".threads = 4;
        kvm.nodatacow = true;
      };
    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+    # add a bridge for kvm
+    # 设置桥接之后，不能再给eno1配置ip，需要转而给 br0 配置ip
+    networking.bridges.br0.interfaces = [ "eno1" ];
  };
 }
--- a/devices/srv2/default.nix
+++ b/devices/srv2/default.nix
@@ -35,7 +35,7 @@ inputs:
      hardware.gpu.type = "nvidia";
      services =
      {
-        sshd = {};
+        sshd = { passwordAuthentication = true; groupBanner = true; };
        slurm =
        {
          enable = true;
@@ -80,8 +80,7 @@ inputs:
          };
        };
      };
-      packages = { vasp = {}; mumax = {}; lammps = {}; };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" "zqq" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
    };
  };
 }
--- a/devices/srv2/node0/default.nix
+++ b/devices/srv2/node0/default.nix
@@ -9,24 +9,30 @@ inputs:
      system =
      {
        nixpkgs.march = "skylake";
-        network =
+        networking =
        {
          static.eno2 = { ip = "192.168.178.1"; mask = 24; };
          wireless = [ "457的5G" ];
-          masquerade = [ "eno2" ];
-          trust = [ "eno2" ];
        };
      };
      services =
      {
-        xray.client = { dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; }; };
+        xray.client =
+        {
+          enable = true;
+          dnsmasq = { extraInterfaces = [ "eno2" ]; hosts."hpc.xmu.edu.cn" = "121.192.191.11"; };
+        };
        beesd."/" = { hashTableSizeMB = 16 * 128; loadAverage = 8; };
+        xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
        samba = { hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
        groupshare = {};
        hpcstat = {};
        ollama = {};
-        sshd = { groupBanner = true; motd = true; };
      };
    };
+    # allow other machine access network by this machine
+    systemd.network.networks."10-eno2".networkConfig.IPMasquerade = "both";
+    # without this, tproxy does not work
+    networking.firewall.trustedInterfaces = [ "eno2" ];
  };
 }
--- a/devices/srv2/node1/default.nix
+++ b/devices/srv2/node1/default.nix
@@ -8,15 +8,14 @@ inputs:
      system =
      {
        nixpkgs.march = "znver3";
-        network =
-        {
-          static.enp58s0 =
-            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-          trust = [ "enp58s0" ];
-        };
+        networking.static.enp58s0 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
      };
      services.beesd."/".hashTableSizeMB = 64;
    };
    services.hardware.bolt.enable = true;
+    boot.initrd.systemd.network.networks."10-enp58s0" = inputs.config.systemd.network.networks."10-enp58s0";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "enp58s0" ];
  };
 }
--- a/devices/srv3/default.nix
+++ b/devices/srv3/default.nix
@@ -19,16 +19,12 @@ inputs:
        };
        nixpkgs.march = "haswell";
        initrd.sshd = {};
-        network =
+        networking.static.eno1 =
        {
-          bridge.nixvirt.interfaces = [ "eno1" ];
-          static.nixvirt =
-          {
-            ip = "23.135.236.216";
-            mask = 24;
-            gateway = "23.135.236.1";
-            dns = "8.8.8.8";
-          };
+          ip = "23.135.236.216";
+          mask = 24;
+          gateway = "23.135.236.1";
+          dns = "8.8.8.8";
        };
      };
      hardware.cpus = [ "intel" ];
@@ -40,14 +36,12 @@ inputs:
        {
          alikia =
          {
-            memory.sizeMB = 1024;
-            cpu.count = 1;
+            hardware = { memoryMB = 1024; cpus = 1; };
            network = { address = 2; portForward.tcp = [{ host = 5689; guest = 22; }]; };
          };
          pen =
          {
-            memory.sizeMB = 512;
-            cpu.count = 1;
+            hardware = { memoryMB = 512; cpus = 1; };
            network =
            {
              address = 3;
@@ -68,8 +62,7 @@ inputs:
          test =
          {
            owner = "chn";
-            memory.sizeMB = 512;
-            cpu.count = 1;
+            hardware = { memoryMB = 512; cpus = 1; };
            network =
            {
              address = 4;
@@ -79,8 +72,7 @@ inputs:
          };
          reonokiy =
          {
-            memory.sizeMB = 4 * 1024;
-            cpu.count = 4;
+            hardware = { memoryMB = 4 * 1024; cpus = 4; };
            network = { address = 5; portForward.tcp = [{ host = 5694; guest = 22; }]; };
          };
        };
@@ -95,14 +87,15 @@ inputs:
        vaultwarden.enable = true;
        photoprism.enable = true;
        nextcloud = {};
-        freshrss = {};
+        freshrss.enable = true;
        send = {};
        huginn = {};
+        fz-new-order = {};
        httpapi.enable = true;
        gitea = { enable = true; ssh = {}; };
        grafana = {};
        fail2ban = {};
-        xray.server = {};
+        xray.server.serverName = "xserver.srv3.chn.moe";
        docker = {};
        peertube = {};
        nginx.applications.webdav.instances."webdav.chn.moe" = {};
@@ -110,5 +103,7 @@ inputs:
      };
      user.users = [ "chn" "aleksana" "alikia" "pen" "reonokiy" ];
    };
+    # TODO: use a generic way
+    boot.initrd.systemd.network.networks."10-eno1" = inputs.config.systemd.network.networks."10-eno1";
  };
 }
--- a/devices/srv3/secrets.yaml
+++ b/devices/srv3/secrets.yaml
@@ -66,6 +66,27 @@ freshrss:
    chn: ENC[AES256_GCM,data:Z4UmsXv1KiVfZMIQOEHH,iv:pF5lQLggkxm9y7taDVcp366JKp8U+8akNEdPA+Nf9Uo=,tag:0TajgUI/VgM3FxG1j6c/jA==,type:str]
 huginn:
    invitationCode: ENC[AES256_GCM,data:JDN913i+zf6+obWxrNAbgx1NJGPyewRm,iv:lqnjbSk46J0ZJN6ccbbiCiOK92W8fj2mWRwQHKqy2dc=,tag:UYZesryRlfAMo7xhKQ7zgw==,type:str]
+fz-new-order:
+    token: ENC[AES256_GCM,data:JdMiu4du4S4fLg7b8LATG4g8NlahIFPvilGd1MsXNeMtnQs=,iv:fWBFYAVlfzi1dD/TpiA5N0JMY/LHTYPZGSh4sbK1BZc=,tag:LQTZe3DNk8xoy2+G4zld9A==,type:str]
+    uids:
+        #ENC[AES256_GCM,data:btt80rJcGg==,iv:DCBo36NMFiQO+dXom+AYTrSMYEAGCNXdMTJDIQVRlFA=,tag:LzoynD0J9surdmcFvVf/NQ==,type:comment]
+        user0: ENC[AES256_GCM,data:53ag/e8f4aVEkUVszd7MzxNpDBBIkqGMneASW9/m5xU=,iv:LEZoitbzvTFAiXKZAPPOok/WaKsuTWgvd41Rq4/FMP4=,tag:opV15bhvDF1FR0UURsm+Iw==,type:str]
+        #ENC[AES256_GCM,data:jXeZGm4rrw==,iv:hxZ6AU6FLzoUSJIeUh4zjuR6kvDfDhJCpvG47M+jRdc=,tag:AqMF7SJ96OEh0G8cgqvvuA==,type:comment]
+        user1: ENC[AES256_GCM,data:emM3ffDBmymM9367YJG0lvYpw7iRl24fHSd5G4C4g6U=,iv:sJ9zLlgU2zZGFpeuIZXtL0Dqvd8RwbKU/a6HFdZTnvU=,tag:L6M7H24DXMvV55pYRiX8WA==,type:str]
+        #ENC[AES256_GCM,data:gMDlZq2HXQ==,iv:hyJ2gkzrt0BZ3rO5rmz1tiS3jbrrA3VjpqjgPXQymjQ=,tag:aOWFyhuTjV9umsWJ0VjJDg==,type:comment]
+        user2: ENC[AES256_GCM,data:b4jqm4Xm9dU2tYqqddKcHYcOh0Ol9W309fpQPcG2cQo=,iv:EKUDKnbYX8MTqd/G4NaQUVZ4mZAw3GvAlDe7XIVvVZQ=,tag:+oO6MaA6PFVbnP2ahfAArw==,type:str]
+        #ENC[AES256_GCM,data:L0wkMIIuSA==,iv:j0LGq9Xe+Dru8bCwt93T51ZaK0ex/7CZJdBDn6jhq7w=,tag:EU4/62fe3p7QjpfSMAYHCQ==,type:comment]
+        user3: ENC[AES256_GCM,data:dWJzu6S6T598TiKqX48LUcT1BAc0/gVy1tAknkvmg8k=,iv:KWl/av7a3hj27p+S2hhe2QpcNMFGJPsnnCjcaqzjOqc=,tag:HQbtRPxO8OnfKIBqTDjKlA==,type:str]
+        #ENC[AES256_GCM,data:8/kYjPRSEA==,iv:etABb0TqNHhEs3/HGuRixEJUGhyXSTXI3cvhTTAUlXA=,tag:IfPzvdSamLcY1dRJls74GQ==,type:comment]
+        user4: ENC[AES256_GCM,data:F6tbn2WBo9HrM+fmtf70GrNJyZ6qJ2HrNdJG788zMKM=,iv:Dx/7MUJVZO61u/DqwrrqmWIVpx4Qpi88SMflCRvj7Wc=,tag:WH6tsk/69+EEz2DS1srrNw==,type:str]
+    config0:
+        username: ENC[AES256_GCM,data:DDGErXyt,iv:7Z3U++o930QhngC+NzNna32F2AKSWjEFnJYXY00rCM4=,tag:L83e1KTQkVwSWSwhTwTzYQ==,type:str]
+        password: ENC[AES256_GCM,data:Jy9Gbo0i,iv:ZthlQ0x5At9TUbh6MUiLkZUoVdCG0gp0SEyMtxKhnjM=,tag:fKmnopQ/sVFQsmb2ISOk0A==,type:str]
+        comment: ENC[AES256_GCM,data:lb51oO8l,iv:4Iac4P+zfa7/T+aq5429VbdHoK7+WZkj1nC+yPOoIy0=,tag:NRl5GjjKn4OHfIGDNh+3MA==,type:str]
+    config1:
+        username: ENC[AES256_GCM,data:/QlSea1D,iv:0gMEI2JJudtKHE9J7IlI8Hsfo0jQwCy2Ap8EXxVqUVo=,tag:2DnWRv1b2VhtV5wSnnOzqg==,type:str]
+        password: ENC[AES256_GCM,data:FHd4UPV2,iv:jI5BwcfxTBj2igdFUQtKS4LGnt5O96Kp3RPvnpXxFR8=,tag:Lfe8paHNQ44nRb/gk0oUbg==,type:str]
+        comment: ENC[AES256_GCM,data:QILd5mRa,iv:mmM6h721UIXTuRL7k9TDOPdRrqMuq5M8krz5yWR20Mw=,tag:ALpQZjR6W0X44rST8U74NQ==,type:str]
 grafana:
    secret: ENC[AES256_GCM,data:1Wfq8QmhzKBObdktheFPySzXYlOJzHWbYYQXgn3beLOwSlW9f7bUn+wIrRoj1e8WlFJkAU2xywzjzzy/UwpSYA==,iv:/0YoHTs54O+cT6VVt1U5CYXr2qEdY2kijOlnMZMW4d0=,tag:SD/IELlcgfS7p9NBEa6D/g==,type:str]
    chn: ENC[AES256_GCM,data:8R92k7RH1491u6lfQdM0U3SG8TPi3vWhZyj810XSjnA=,iv:8v6ijLHgoTPT6MGoP/lWB+UEZCCgOpvfskWCJJ63Udo=,tag:k9SHzJ9d54Rny3n8EbksOw==,type:str]
@@ -75,8 +96,48 @@ xray-server:
        user0: ENC[AES256_GCM,data:n6gIZGYdT6wEfKgizFvIE802AkpR8BpSPSZrQ5WP/aZWzLUL,iv:AxnwFOzmIRm3nTLpi8/4lkv+TjO4y4RZQtHO0GriD8o=,tag:nllDCaLZd6JNS2JqwvgVyg==,type:str]
        #ENC[AES256_GCM,data:uhAauqQ1oQ==,iv:0Sr6YjarjkLmBq5H1ELb3SYBzrTVhqIE6qPxc9HYeKY=,tag:NvGGSY99Y7d3OTnpOr2p2g==,type:comment]
        user1: ENC[AES256_GCM,data:EcEySx/n52rN5REPEWNjCuWywokvOetadbljqPpDPADTeeSk,iv:7r3CdvHJT1iZvx1Xn53It1ZxIkdLVIeQ+Q03zISm94k=,tag:8cIGZUlIhVgRc2FeU931kQ==,type:str]
+        #ENC[AES256_GCM,data:qbXmxTn+Mwk3zw==,iv:8F/0ELOwXMrKaigfRmwvGREujqNwM6XjIeaPyr6JS5U=,tag:PF/PAQCwzH7uOj+xgM0rKw==,type:comment]
+        user2: ENC[AES256_GCM,data:cA2oKqGsKuZyydMQspbSrWqsQIAde/VtGIPybC2gr3Bg355H,iv:YOj+6f6YR3Ze3x5IrqdqzXp9e3v1jdAu8re1Is6Q4eQ=,tag:n/CV6+PX/y+okpJwRraSDA==,type:str]
+        #ENC[AES256_GCM,data:VcLtO+6YWg==,iv:TWM3IY00V+LaJzk+E8ji/v7Ol4TCvSP/FHzFsV5MGIE=,tag:CijsW2O/AKpWgQUm6ipPeg==,type:comment]
+        user3: ENC[AES256_GCM,data:F3HK6znDEsN8UO7B9vBs03jyjqoQ+MGCcNJuOeglSBzLD2Hy,iv:TKBRe8Qmn9DL4AEilX20YcKbz6bydKsQUuUd5lyM2jE=,tag:nAyrTD4zkJ6CjLuj29zuJQ==,type:str]
+        #ENC[AES256_GCM,data:UFE3pg02VA==,iv:thT5OYPIHLIjKB7uiAk5vff8rtsgwncdo+U0KmW3uTE=,tag:qGWmSsI1mzg8ZbpunxBuyw==,type:comment]
+        user4: ENC[AES256_GCM,data:FYMQFFTCue+umBl5OwJvlZ+NyocsRbkycr+y1L6d6LPdR9px,iv:ZX9Z0dqmBvvXlz+oEYd7vQ5rW5lvmlc+bneDguQld30=,tag:y3d7aDWOtO0T3Yf5pGnffQ==,type:str]
        #ENC[AES256_GCM,data:KuuPQQ==,iv:LGGqLFV4CnUMLWaNbHj6bRseetvdMdSOefV1FeYlJSA=,tag:wXlqKM2BuoMRZAwYbv5eOg==,type:comment]
        user5: ENC[AES256_GCM,data:T5p0POx9Cnqdlp0blEYvAnRNIDOCNVdpOBR4rVQ1/07/rOCX,iv:EZx6ToeORzHoG+aEPi9oiTcwp4bOIAJpPUvemhYM96Q=,tag:aSS+RY5rEzr62mbE+JDanw==,type:str]
+        #ENC[AES256_GCM,data:tmlMaaDT4Q==,iv:zDBCjdBioiXGbJve03VcwCt81hiFxyKqql9rp6zW25g=,tag:cxedo8U2FICH5yMoPXwQMg==,type:comment]
+        user6: ENC[AES256_GCM,data:LzYfIXgZP0q9FpxDM6skSTiwOxEO+N5wuFq86KAazqe8zS/h,iv:Jh7bWMVr5U69L1uARLMUciWvv/aRjJJeEXvU5bo8e3A=,tag:PxesHErVSlkbuNeeRpQfEA==,type:str]
+        #ENC[AES256_GCM,data:boB2Ug==,iv:echGnXhoj2wX7GDj302nbirmzQFCqql2jtY0JaNyla4=,tag:7YnhNwCFZ9rOstanr0wGcw==,type:comment]
+        user7: ENC[AES256_GCM,data:s1O6GRn/9T9DWKlcXJTnOoAPZnPgHGBpZZcEDAKRtiYAI/5p,iv:JyaGsolN5WgQekPYxJiJbniuxLPf3+elHHbd3+ZrLtc=,tag:32wNUTqyyaKoPRQdB4U0SA==,type:str]
+        #ENC[AES256_GCM,data:cvG7WQcnwj+u9A==,iv:ui40+u9yE/Prksmiqed1NjuHyNP2RGtgSMazfI8ultc=,tag:he2F4i71Z8gFdW3fmRdhUA==,type:comment]
+        user8: ENC[AES256_GCM,data:roCYRvszJo7weozfIRoGgUhIs1f2a5/a2d1b/Iy6WEbbehOS,iv:tcOsL0SE4qMRPZIGOlzRIaMJvcapx2H9HK4D8qmSbIs=,tag:Z0skFdgtpjSR7jli3dwd5A==,type:str]
+        #ENC[AES256_GCM,data:IFXAXr0RVg/DCA==,iv:pKdnsUFX4XXJIZleA71fAfua1ibSa/2tgjdqnhbt/Rg=,tag:2Fv397j/uJDFZ/uvBxtrQw==,type:comment]
+        user9: ENC[AES256_GCM,data:5HP+OVmf+dsS8sDHakC7Yx1HVutMoTbITONHQiSvHw+17M9J,iv:TYDf7lx04pHohbGBbPJvOAoIGUKqil59k4Pt405/9kA=,tag:HUxT/uSR8sYCXQ8uX69Fqg==,type:str]
+        #ENC[AES256_GCM,data:7TJeKZM=,iv:FKcgDOtV417n1xmufqB3WENrbZ0V93sI5/XhiDYouMw=,tag:TchW2jgxZAXHvvMYY089dA==,type:comment]
+        user10: ENC[AES256_GCM,data:+u1KwJo3Y4enFM2RVr379GF7O6r9bWofUEZ2994IIC+Ce2NV,iv:ssKA5y3JM4tm+JdVznQFUAYmlrHaWd8hQXs6R/aEXN8=,tag:Q5uuM1sBZJRYBe4XXTL3ZQ==,type:str]
+        #ENC[AES256_GCM,data:O3qEWI+vFA==,iv:R7HLFRNszV6yXwciNfk/rTbDQYLmKsTCQFCfWIpJdfY=,tag:DjuM2a48/lDF11aLIf3Fgw==,type:comment]
+        user11: ENC[AES256_GCM,data:4HDGJq9nl8oGeQEo0XBEUiJweAaZ9yWc9Ib1TM91Djj2jH8d,iv:1i9/bZhHkhc8dP9Pg4gIRnCms61AP9VYxAG4acV3gpQ=,tag:vID9DEXZu3wGbXDqsLVEAg==,type:str]
+        #ENC[AES256_GCM,data:CdJubErTSg==,iv:UKn0lvbCzJnE241Tg3yjSx4xZNbp5sa/NfgIlRNU5z8=,tag:6FMGY6hbMQQFoN31z4e4uw==,type:comment]
+        user12: ENC[AES256_GCM,data:U+ynUYI+l6McI9oWF4PNiLUwvNowdseZ5gO8o73cX8MsXS2+,iv:r0KIBXczRkubZqyM/LUBPp/x9Zb/rvDJIKGGKkR3EfY=,tag:yn7806HD7ei57UtpuPjlkg==,type:str]
+        #ENC[AES256_GCM,data:3trgclrgDXhKUg==,iv:qyLmCBaB5ql950diUj7YlPi6P3a0hYH8adADEI0AGrU=,tag:Oleq79giA9/gYBO8Carznw==,type:comment]
+        user13: ENC[AES256_GCM,data:M6JXRrqnKrdihAA1aUg9zzJfhCK5TLLRf4wZkemnlHyaXnLL,iv:OA6i+BGYTr9gILE3jzFILLZvPRZeAvmSbXEStihN3aw=,tag:WcpTKRC8crDhzKHcxjtICQ==,type:str]
+        #ENC[AES256_GCM,data:VryB1AM=,iv:6FdWfpQ53bdpkXZ22gpy8GxKb1X7bak0K/Oa56mP7Uw=,tag:VBg7u7MSMl4Pr72W6ugYEg==,type:comment]
+        user14: ENC[AES256_GCM,data:g8y07VaxsuTs74L5xF/XDlmYetOfXFwHEr+FCHRtFLKwTAVq,iv:TjT49pTk97l3u1wGG7BmqZr/LAMC2765er3HGarOANw=,tag:zt1ojulNjWcuKIdix6NFJw==,type:str]
+        #ENC[AES256_GCM,data:Bawjfo3ubW1eXA==,iv:m2/ViC9AIZUV3Wl9EBYV5L0QQDw7QgXPpQ7WX22XpQ8=,tag:1wqpie9BuDi7BiDCvRIWog==,type:comment]
+        user15: ENC[AES256_GCM,data:2Ylnb7ZJgr3ha0rXrjkscPX9zJI2L9aydfL5Ndl2b9cJmVUC,iv:mu0GlGGXH4njmi4KzsvFSJN2zC5IcXVQ6oqVv2ClWpM=,tag:AIhnDqQehLyJY+wh7RWTYg==,type:str]
+        #ENC[AES256_GCM,data:uORLUE+excPAuw==,iv:K1Qch9qkg5T59+lcMC7vHWu1mnOv2dH5cOAZHX8HhgQ=,tag:chVMn/kb3Rr3f2igjbsAUA==,type:comment]
+        user16: ENC[AES256_GCM,data:D4lPjTb2kaYfUSCCRaMpGNtzLIfvPvfiJK+kkTQtSMOBglpN,iv:FCpHHBSKDYA+H6fgabNggXJlenzg5am5excBknpD1uU=,tag:FPQaBfLiZ5PBJa8gCpBfTA==,type:str]
+        #ENC[AES256_GCM,data:Cfs0Ul9BHWW/oQ==,iv:OOcRWmc7fy2RnE7+TtSBauKa1k1/unC1nFJ2SJ3yWqk=,tag:q6MjcXEYuep1eRw5BJspqw==,type:comment]
+        user17: ENC[AES256_GCM,data:2mzbUcGRye0cdgQxoTzSeKaM+m1dUPvKq61uBnGvZDFXrqQ7,iv:hxkruf0Xo1ZNJ/ym5YdLGJF5aK5nXZMJ46XC18Aksmc=,tag:KrUCTgDgYndxhi8QSYpGwA==,type:str]
+        #ENC[AES256_GCM,data:vHvpcqJaH2hPTg==,iv:S1WbgLU+15FMJr699YGY4f9r8wIg880tjJo6W6APhx0=,tag:F7fbA83eco8/Qd6u4vUMbA==,type:comment]
+        user18: ENC[AES256_GCM,data:LwZKy71ecB/E2EMIaUuFV0a7j+16EWo8LA9/0Gc8lpXAQpaT,iv:+cjrRDSvW7KFGDlpI6W+eDi3bux+eQl6NXNjnUoj7L0=,tag:PurtN+Vede0DNTQqbea1Ig==,type:str]
+        #ENC[AES256_GCM,data:rhbv9bL/0d7pGA==,iv:XvKiQWO72BfHhVRyti5ST9+f9tPUne2IcMNC08kD9r8=,tag:qhA6q4MrX3lAELrrGM8LCQ==,type:comment]
+        user19: ENC[AES256_GCM,data:jOyA913cS21eGwjUPY/XrQUBofoHwsCHghpmjzGx7cBzk/K0,iv:wXAnuSUhJ+gwGvMF7/YsfgeTHOvQC+S6rM5DzypvOuo=,tag:b/FsoypjkVYLSfyowNL2Nw==,type:str]
+        #ENC[AES256_GCM,data:Q48F7+SNdz7duKY=,iv:KIb6lIJWAVXKekBhwPztkySYDA7IP4jMjDsWy+waeFQ=,tag:s8hEz2zrh1ZXNKi/IuVV4Q==,type:comment]
+        user20: ENC[AES256_GCM,data:D6+eQdWO/W4P1ul9zQLpUQxqNA+kytz5ZHH6HmU/jwSuq3hU,iv:U4H7Ez0P3gWBLVeQ6O4PN4AmVP7Ij3oArhMmfT1BWic=,tag:l6TNsJFXXH/+yMcszkVRrQ==,type:str]
+        #ENC[AES256_GCM,data:F8qJksiC3Z8GbJc=,iv:yDBYQLUFFSXMn5Vo69rXzGBWzA+GkYw1qHS/ShisH7w=,tag:mnxj03thlYN5KhKDUO7hug==,type:comment]
+        user21: ENC[AES256_GCM,data:QeSxzBR6fLAyoUsA4aGKilYHcF42SNdkwjdwWZbxNvqZU6bf,iv:ocZGB4i8M7qM9Ypp3BUlGIdGL0AQx8NdO5yBZFLB6fk=,tag:WMFmljoJSnCU8BL/GfiZMg==,type:str]
+        #ENC[AES256_GCM,data:LxUne7UMT32f,iv:AyVaLB7Ni6HB5BE+InEG99TQsEzdQG7EXoHXC8PLGlQ=,tag:j5GoVfDsqoHypkxYFNPjyg==,type:comment]
+        user22: ENC[AES256_GCM,data:lzFvCb/zbTZs2jmYUfl3onGeWjBCdjxcIzAIff/fm6Qre+HZ,iv:eSiosE3eOrl7iLnOV41w+pwdtcske/4R1Bf1D1qxsOo=,tag:r69jFKp/FlxN3MEL5E6EXA==,type:str]
    private-key: ENC[AES256_GCM,data:xz7xFt/g++E79bIl6AeBWATHDB+gHBIoXo5vdWTeyrAT1RtllgYie9k3Fg==,iv:x7fdmSINQA+F7a08jpuvCAg7vIZpsYaoX+EnitJMUCk=,tag:GAb/RRdAOlteIQPxeIMAXQ==,type:str]
 peertube:
    secrets: ENC[AES256_GCM,data:OR3OA8qJsq1gAYiv1rShNa8eODzIxPOpVbqbnseSCMUNx4+FeOgReTLl7cXHPxbBkrJbsfEq5XYm1QtRtxotdw==,iv:6vz0ezsFuCNsBduNhm4VQ+it6oEJF/eMxktVFhdXgug=,tag:hmW7BwF9C53SAHhu2HBLYg==,type:str]
@@ -104,7 +165,7 @@ sops:
            d0h3aDh5QXFZYWJFdmNVYnJxQ3pBeVUKTl0XVvtwJcz+RpSylgDPl/R8msInxvWX
            eQGmrDHibeE1V+KSDiuNzC4MVRIrOnh1beHrhnVQ86HwPVgJqs2FoQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T01:35:04Z"
-    mac: ENC[AES256_GCM,data:q2BolEBB6Ik8yx6NHnnE3Wcl2rGVZN86dpfLJrrFOxWd8fZyfBQ/00v4dUZSZw0aQoMj1V2RBDyVtScuRiH0NVb6+RfX+0t3zTEf6guuJdurczLBz9+D51+Th3KE1uk+UjI7J+Q/TOWTvoGMj8P4XZCXQsCDIct/vbLGqNB9CgM=,iv:/6xR7KXXLejm9Iuqcxc/7IqLEckNhmaJTKzJGonSrng=,tag:XdeCoEkHefw2HqTGSchUJA==,type:str]
+    lastmodified: "2025-05-16T02:55:19Z"
+    mac: ENC[AES256_GCM,data:fsqb3NvXwyoGWfcJEV04XcWiifB/zEW+LU8twQ2sY3cZWR5KHAWgVXCXrCunYiSy/Q5nf+ldTgoXKdmNu1pVOJQQXRCY1q1y9MV36msAfIUc1hdkDlo2ka5+d4aBcpqr5nPo5ZU6GJ5by1p8WIPSOWCGfsqMMlKhIWJ+8YaqokU=,iv:cfveyxa/0/qKRHc6wsjAC9stZSkgF85khnp3LTtF+K0=,tag:5vVFg0isyJcg3Twhq5Ouaw==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/devices/test-pc-vm/default.nix
+++ b/devices/test-pc-vm/default.nix
@@ -16,7 +16,7 @@ inputs:
          rollingRootfs = {};
        };
        nixpkgs.march = "znver4";
-        network = {};
+        networking = {};
      };
      hardware.cpus = [ "amd" ];
      services.sshd = {};
--- a/devices/test-pc/default.nix
+++ b/devices/test-pc/default.nix
@@ -16,7 +16,7 @@ inputs:
          rollingRootfs = {};
        };
        nixpkgs.march = "znver4";
-        network = { dhcp = [ "nixvirt" ]; bridge.nixvirt.interfaces = [ "enp1s0" ]; };
+        networking = {};
      };
      hardware.cpus = [ "amd" ];
      services =
@@ -29,19 +29,17 @@ inputs:
          {
            chn =
            {
-              memory = { sizeMB = 2048; dedicated = true; };
-              cpu = { count = 4; set = builtins.genList builtins.toString 4; };
+              hardware = { memoryMB = 2048; cpus = 4; };
              network =
              {
-                bridge = true;
-                vnc.port = 15901;
+                address = 2;
+                portForward = { tcp = [{ host = 5693; guest = 22; }]; web = [ "example.chn.moe" ]; };
              };
            };
            chn2 =
            {
              owner = "chn";
-              memory.sizeMB = 2048;
-              cpu.count = 4;
+              hardware = { memoryMB = 2048; cpus = 4; };
              network = { address = 3; portForward.tcp = [{ host = 5694; guest = 22; }]; };
            };
          };
--- a/devices/test/default.nix
+++ b/devices/test/default.nix
@@ -16,7 +16,7 @@ inputs:
          rollingRootfs = {};
        };
        nixpkgs.march = "haswell";
-        network = {};
+        networking = {};
      };
      hardware.cpus = [ "intel" ];
      services =
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -22,13 +22,14 @@ inputs:
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
        nixpkgs.march = "znver2";
        initrd.sshd = {};
-        network = {};
+        networking = {};
      };
      services =
      {
        sshd = {};
        fail2ban = {};
-        xray.server = {};
+        beesd."/".hashTableSizeMB = 64;
+        xray.server.serverName = "xserver.vps4.chn.moe";
      };
    };
  };
--- a/devices/vps4/secrets.yaml
+++ b/devices/vps4/secrets.yaml
@@ -4,45 +4,27 @@ xray-server:
        user0: ENC[AES256_GCM,data:o2wxpSzoqsPxs6grgYRLtPutMVwSqtzUWBrj7+7QuWWd1a1z,iv:2/5SxXq8Iw4J/LzBeclHbkrZXHitguip0WN+MINym8s=,tag:v/3oly53ORM9XAwbOzp06g==,type:str]
        #ENC[AES256_GCM,data:0nHZmEPPaw==,iv:BtOZ8/U0yg3fthHrwerNQX3+KD/H9+fcUylYGnZqiIM=,tag:DkFGSFfq//LmWfg6DGm1aA==,type:comment]
        user1: ENC[AES256_GCM,data:7ev7GuKLeJbPReMy0FnX02fLv5nNCpxdzfnQyAA+/IviwDMQ,iv:YbESsyIAiEAyvrHnj9A4lITX7NtRkuRhCrTv6hoG9Qs=,tag:8uledxLXqpXXLBh+cczm4g==,type:str]
-        #ENC[AES256_GCM,data:4Y00hDJ+8Hjq3Q==,iv:XWZYNC1T5B55B43tcuzzvOOFtHqZJ9XDuEaYQOO5cR4=,tag:5oNFsqUtSiv8CY6aHyGjNQ==,type:comment]
-        user2: ENC[AES256_GCM,data:MRMdc7LRYqgRsfKKW6LnP14g3JoFT6g7jzkXW8gIAeqypyoc,iv:tfPBD2FkIljz3xasYNJsj3vh2lEObrvSZ95FyCgWcTs=,tag:B1PQpyX24DqrPscL/pjZmQ==,type:str]
-        #ENC[AES256_GCM,data:gGd3kkNcyIwOXg4=,iv:vILDvtdvopPM8lZDDpedvtXYHpoPvPn1A8AJca41r9A=,tag:2LMImcmdyPKsQDloq7041Q==,type:comment]
-        user3: ENC[AES256_GCM,data:+KUVcqy18t6Fd+QNgB5DeZkNSA6lsjebO+xnzxzIjWuZ9UmS,iv:qugbmBv9jk1yfH2s0A0jla0DR3jkdXLVUeWGcj6v68U=,tag:4FUf/guDzPqgDcb1086WTA==,type:str]
-        #ENC[AES256_GCM,data:jCgKe0t2xQ==,iv:UE48L/JpobN6LUd6Z9RlsUGSJ1sHHgiL6xj8lPztwJc=,tag:xnwWLQm+GIUzsfBO/TXhrg==,type:comment]
-        user4: ENC[AES256_GCM,data:3yrdvbcH/ToAQpTLppSVp2FNGjatyBInKP85bAY9OrEtzhhQ,iv:4zvb1nzKjrCNWWKelOnDhsNBAC7Ak6ZpJlvQKqGJrgc=,tag:dBOTBJDJhJsKHKg/vGmpxQ==,type:str]
-        #ENC[AES256_GCM,data:2ptsDQ==,iv:dEzyk6NQcFZQPx8h/ViCqtRaQ/8dfMTVKBq+iguk6nU=,tag:11SLIAhtcHja4G9HUXr9Ng==,type:comment]
-        user5: ENC[AES256_GCM,data:NO9rpzFkySistf9++oXpo1tBaa4XtPtcCGR+2IWmhQYEH/l1,iv:OG+U0avgo9mjmU3soxRNL71ZC7Ee4ijpsJMRn3jYvhw=,tag:QuBFX2KHgNJ+f3RwqEH4+Q==,type:str]
+        #ENC[AES256_GCM,data:3KN/1hzeR2I=,iv:iaqJJD6iURTUlIL8e8P7fsAzJYo+y3NGZXgWmPX+4ao=,tag:e8g/JgVrMrWJamUMpiv2pQ==,type:comment]
+        user2: ENC[AES256_GCM,data:58PnLCwDayOYinsPCYPeMvuKiF7b4tZtbmEJFWEl+2Nu6HL2,iv:hSv3jCtkLm4rrm/4+ot10CBhobGwtnK5db5wR1S/XrU=,tag:SQbynYp8pDSqj4tAK6JBMQ==,type:str]
        #ENC[AES256_GCM,data:uTZDsA==,iv:6cxvQycfji/x+DW1CnO45r+yNTLwkhYkiJwDaSpUCwo=,tag:8pMw+sYeOyZBN1idHoM9+g==,type:comment]
-        user7: ENC[AES256_GCM,data:Ie8M385wtRx8bWIdCupnda799kL0OLBsWdk9pHTY7IxxaZbn,iv:OrRYOkaC9uI9E1Eb8GYqmYr9VAUM895oO8NSdvxUPCQ=,tag:NZTUE4KnUjhg/auoALavTA==,type:str]
-        #ENC[AES256_GCM,data:Wwq+ypJgx6OcXA==,iv:dSvFz4I5tFx+ZVClxNGKwcbIQe7OY43OzAhqRiDK2TQ=,tag:CYUs1cJ/zqc+Y0yFec7Upw==,type:comment]
-        user8: ENC[AES256_GCM,data:2GyFDXIiAN3mTobwnY4czV2Egoin3B5Ih+aet3yT+krPTkPq,iv:NwrzO//HXwKMudgD+yK1hsj9o71RG6BfBle3logvuLE=,tag:WWpioPsnhHvVSrzAmN16Sg==,type:str]
-        #ENC[AES256_GCM,data:vVz6E2juGqXS1Q==,iv:9itEkwMsW8cqSzwV2EZtgJVgaW7aJJ5fw1rLuKFwiKM=,tag:9hRADkot8kELoYAgd6Dz7Q==,type:comment]
-        user9: ENC[AES256_GCM,data:HgSVrry+nKGW9X9N6h8hsI9VETKtSEi+/ZC9QvNZW4zETQxt,iv:ERgmCDPBpboA/+Sxeq6BvWoMxsv3Kkczqb/mbXz9pOk=,tag:bklzRg9toKy//6T8xdtbRw==,type:str]
-        #ENC[AES256_GCM,data:2sHxXec=,iv:aA61+cmDw4rHab7RuRRK3eUDx5d6gpmfw4RpQ6Nd0mc=,tag:H9kovJyn3Te3ir9X234VGA==,type:comment]
-        user10: ENC[AES256_GCM,data:CqrwaZp1fHd/WEGQH3xWI8DZ2/AavCqwTtwZeHmnrct5yoD3,iv:IBOHGQlw+uQt8Ryp/mCDcglfSPNXvvHOjNnrT+7nOHQ=,tag:tEkGEtPaOBK+P3LrQzOLsQ==,type:str]
-        #ENC[AES256_GCM,data:oB64XheVxA==,iv:Ci9apSqTHQ02IFhqVvlC3hO8yWRKELVtJE3H/CUgFyY=,tag:4uV2aYzzZAUW+OZf7QEVPg==,type:comment]
-        user11: ENC[AES256_GCM,data:pk9b5lFhuAfhKMcTUIdlx6eQHn+MJaPQEs6flmUhhHA2ygj/,iv:UGuPrxJPh+V7vSFjmgmBc9vhg7qye5SrNCFiiTcnDk0=,tag:D/B4PTafZe4r/W/dVWC2CA==,type:str]
-        #ENC[AES256_GCM,data:Rw4BWXZutQ==,iv:rXe2i1G/xQkpBl0wh6VIzaNoidCc3JL4sy6v5hcOF/M=,tag:2tZyH8B0ZL7XptKHk6TcAQ==,type:comment]
-        user12: ENC[AES256_GCM,data:CsbquwEn+iOKCzda8z26FYk2i5aPk2xzqGIYORiD4lotvnFE,iv:zHPmlT4LAc6NDjXrExze23dZZFIj0c1eR4WW74cu+qs=,tag:5MDFrZNgv54mK05ImSvpkw==,type:str]
-        #ENC[AES256_GCM,data:vqYkwGVcQ8yZbA==,iv:1ckVSiAgjuT/K0MuVHe8D2hHE7X2qxCHpb+y6nrFCsI=,tag:so9oFl6bXlJT2O+prplazw==,type:comment]
-        user13: ENC[AES256_GCM,data:KUraqncs8iPr7z+COfJ1z0TLNLlgctxy8FCav95+kkVXtStx,iv:Uv90bnVmmQh6f9pKOWmEKCul5VPxF7rrQ9GYrsCGPp8=,tag:I0r5o8xIYuq5/MIXSOHT3Q==,type:str]
-        #ENC[AES256_GCM,data:F2x+2zrePYDkCA==,iv:aTMeqvGVI43xLsN9submgciiJEjY4hYypJ9RJLIBYTE=,tag:quKW+MATVzRw1bda2jGjdg==,type:comment]
-        user16: ENC[AES256_GCM,data:BjnUUnNyqUvvPbfa1CeYvcVbMOwz6/Em4YhxRgmlicOSwro+,iv:LULwzjV5PRihTHNZFJ21IrDG3rW3qX4CYwF4Xu1KdZg=,tag:pZAI4OEx24d6h/h9JyQ/hA==,type:str]
-        #ENC[AES256_GCM,data:aka1O9hn/dZX3Q==,iv:rWik4cYtHY/Z3xQ0p/i49zTXVmKEQDV4OMn12UaQr3Q=,tag:hPm4bugH9RAtsykj0BJ0Pw==,type:comment]
-        user17: ENC[AES256_GCM,data:URZqRUDtG5FDrZDsmI7CFn4ilp97GJtgaVVB+j0dRUdtVGoq,iv:iUkcr6Oo29y5PIGF/GJRltn5DD19yEcBIsJAaYs43AI=,tag:gzSsjeQxvjvfFVkDHPkfvQ==,type:str]
-        #ENC[AES256_GCM,data:JkMniTrakuonAA==,iv:V5KmQL+C5O2mb3ktlm1ITjLaa1NxToQlyToqYbGme9U=,tag:UTZm05uyb5j0Pf9vuxyIxg==,type:comment]
-        user18: ENC[AES256_GCM,data:fFtnkBnaOktHaIfk7dN2U73UkloToiLvP3Pg2VAqPzvTE49h,iv:DZrba7RWmaeOQsqh3Kq/IuFS9so5u5ItK5WwV/65FYE=,tag:v+pOozYvrJJIsj7A/a3S/g==,type:str]
-        #ENC[AES256_GCM,data:gR0WsUYdBZBWjA==,iv:rnXZQaDNu+cEzneEa6/2pO+qUXl/fut8FJ3n90A6ATs=,tag:azNGPfWv+ZgOU/B5PMCVZg==,type:comment]
-        user19: ENC[AES256_GCM,data:S8VSoBIR/RqwctgYPtyIPEK2hXLr4LZ/jJvvFHA6CGgp9/Ff,iv:8eLCZEaiquwZyswwLkLoJcl7UPWTVYmQqZ2egAGFWWM=,tag:VgJiSt8eRcRhppMXkAkmKg==,type:str]
-        #ENC[AES256_GCM,data:vWW1bNyENgcspxI=,iv:xXCrjHyxVtodkVu/wgy1OrHGGm20nEd1iyparWcycYE=,tag:FRu132btquzXkiLXlnq1Iw==,type:comment]
-        user20: ENC[AES256_GCM,data:Wux6pzwor0B1A9d1y0QEpcNnYn1pObloHxghSONHcsQ266/7,iv:jWSuswV6vTQdL764I/zxFC5gkFOa5Qwj54rggmmZX7I=,tag:4hmqBTn0T3a6Sjt9lofwbg==,type:str]
-        #ENC[AES256_GCM,data:IJWHWxbhy+gxhxk=,iv:HzMi211JiVfHUhEJm+q/K0tCjUEXDhollUf8Bm+HVA0=,tag:P22Q/h+DUhhJayZftcvVfg==,type:comment]
-        user21: ENC[AES256_GCM,data:0X5x3SATZm25kVf8cu7TGm2t95DneLAqhP16fRQCtROzyZyg,iv:dmlwRmubnRq2fNdNz3lVlAVYpPjVHkFm60IvPcajjds=,tag:eDJYYf3eRw+FxfaHiRDk5Q==,type:str]
-        #ENC[AES256_GCM,data:O3ovvRYzFrQY,iv:/Zs8e6u7wdp18AacZ3WWBvn5PDtXDnQ6ZyqLiyYmvAY=,tag:HmhKBI3aRCIR34vOEnv1iA==,type:comment]
-        user22: ENC[AES256_GCM,data:ee0naewdOjIxA0QEpmUyOSu++sUJQneEufhJBHiyOR7jAPTU,iv:09fZ0dLUZHp9wM2lCiIcTzFey2AkWBmnUCfq8W3FM6Y=,tag:dHBVo/Ok3Q9vy1pIbWC1Kw==,type:str]
+        user3: ENC[AES256_GCM,data:WCVr0ylGm2SHtOGulb8TD/cI2xJXrbvY1d6+STXGxf0d0izb,iv:vhNshb38AVpwKCFRwUVruCQ0SxhHrOmwQ+IoQZeUj1k=,tag:OfdIjRrTAuVZBOEXTtnrQQ==,type:str]
    private-key: ENC[AES256_GCM,data:akNIeVp2bfKvnzlS6KLAdqAo7qsGfPatzCZpN1tNRLhRVXmJCcUDVSmVoA==,iv:2Rny8ioDJ2x+NR+n7/Aluv7JZ+Om3MuJKsXiwONYntg=,tag:a3xubIr7hpVjRiHjFL/q5Q==,type:str]
-wireguard: ENC[AES256_GCM,data:3h+cpSHULgwlI/zOI0IL4t4diDzm7qWW1sOWZqkFRWCB0CAfGyydGNlZkqA=,iv:pVpmw0aEDssQSr724h9NvJqFMHu0NupDfCSt1RWVnUk=,tag:fonuszujTzeo2HqO1OokEw==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:JBeN7SVxKGOe6er0eS7/v8YrXdv0nCK/KZc8Ygq0G7FIGu4hO662kg==,iv:rf59MgUCYlAA5h18wtdWoUyb2VPB13OPuJjz1VsI2dU=,tag:ViPrwduD8aWf8i8vmBG78A==,type:str]
+nginx:
+    detectAuth:
+        chn: ENC[AES256_GCM,data:lQHDpv8/Yl5/nycHoeTnCw==,iv:ernNxRpcTOSAllDpqRFVFg3qEw/slEEPPXDFq1AhNL0=,tag:2AVALUf9cDyOgCqI9wwgQQ==,type:str]
+        led: ENC[AES256_GCM,data:zyCiiH21,iv:iEYyNClDsCpWE2oNjt2NqQZ88xOOlMr0yycjKTPdmlw=,tag:kQfbshXfTBA5PtUAgpgCcA==,type:str]
+        chat: ENC[AES256_GCM,data:pXu0WPWmvUzvl2expDpQPqWwi1A4abg72npsaYXDXRcg6aVU0Ec+tgM2+uz2hT9rh3mNoBxadYXDc/zeOL1UCg==,iv:iln5UGGBK2s5pGS03PtolWTkx6KrnYBAWCFnI0V2Bag=,tag:EahTDoPIBkgWnp4MOoTCmw==,type:str]
+    maxmind-license: ENC[AES256_GCM,data:8OioibcXQ9IZ0OQhJ/zHSBQjfdHzkoqwUx5zR8Zq0atNw6SSf7vKrg==,iv:z6WTI2yeqP0h7EqKG114nRQpFVJlNzZspgS6gIFtpt4=,tag:a0dBt9pXJnncBiSKt9dsAQ==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:Si6yTh48HpA8OkkkvgHwtJYFhF8tW3oaQbldjwBc09QJxp9AoKgASMnZtbDZYA==,iv:GrNyZXjaZMviSjy/LGHHrYTr5PFvDkCXmT3MU4+SLpc=,tag:YifB1tKFLqsgXB/YLqYK4w==,type:str]
+    chat: ENC[AES256_GCM,data:ydPky0W4ZWqn,iv:uWQrZDz2GCxiKRaijM89Npt0fQeSNHbQzDefkZCkUAE=,tag:OJQwV/889Vp2/4wjbN41JA==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
          enc: |
@@ -62,7 +44,8 @@ sops:
            Ri9hM3NRTkM4Q1lDdmdPemEweEFBUmcKNLL5qH+JeFWX0GovkPFVVAnz+4tmfG6/
            1jN8YqbMIxf5/L8tauXPf0iIiHa6pUcjtDZPr/OEmeXebmF6Bh9u9Q==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T01:35:34Z"
-    mac: ENC[AES256_GCM,data:40uhvaJNu1ELo6xHYECEOTE0lVcrcMmZKJpLmE28D2pyXnl6UQza0j9O7944+Ii+VroSvm7juB86gR8/x6URabQF0l2HTiYtBvyPicxdobB209i5JSULiCUe1zlfz8WyQ4VnPAJ9SJny59ucMYxMh8RM4UPtXWLs5whcqt5ooSk=,iv:5odm078cRXnwTA233NV7edcYTfMmTLFLrGRhE/oi8SU=,tag:2t06LMMrRkmbAQbCad6URA==,type:str]
+    lastmodified: "2024-08-25T03:19:55Z"
+    mac: ENC[AES256_GCM,data:v6yb7ZYcnPw/8SqEJnSWzmlE17PenjnBH2X8HZp+kIDXzNFyNvD19FcbCBZjwyjBLvN1ZF4M9FS7Y4+CvvMrN/4JcFufcY/V1NrOd8IZisfAT5N3WuopPee4IN9WEyPVOsbFnesZo6/wJKuqlV1UR8UZxCd3/wHXob9Lkz45cBw=,iv:XKIUiRfP0lj8V/Z1HbvhBankdcAjQqM8Way6TWjJJMY=,tag:PLYsVj6BmR132oWsxEKnfg==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.9.0
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -22,12 +22,13 @@ inputs:
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
        nixpkgs.march = "znver2";
        initrd.sshd = {};
-        network = {};
+        networking = {};
+        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
      };
      services =
      {
        sshd = {};
-        xray.server = {};
+        xray.server.serverName = "vps6.xserver.chn.moe";
        frpServer = { enable = true; serverName = "frp.chn.moe"; };
        nginx =
        {
@@ -62,26 +63,10 @@ inputs:
        beesd."/" = {};
      };
    };
-    networking.nftables.tables.forward =
+    specialisation.generic.configuration =
    {
-      family = "inet";
-      content = let srv2 = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg0.srv2-node0"; in
-      ''
-        chain prerouting {
-          type nat hook prerouting priority dstnat; policy accept;
-          tcp dport 7011 fib daddr type local counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-        }
-        chain output {
-          type nat hook output priority dstnat; policy accept;
-          # 需要忽略透明代理发出的流量（gid 不是 nginx）
-          meta skgid != ${builtins.toString inputs.config.users.groups.nginx.gid} tcp dport 7011 fib daddr type local \
-            counter meta mark set meta mark | 4 dnat ip to ${srv2}:22
-        }
-        chain postrouting {
-          type nat hook postrouting priority srcnat; policy accept;
-          oifname wg0 meta mark & 4 == 4 counter masquerade
-        }
-      '';
+      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
+      system.nixos.tags = [ "generic" ];
    };
  };
 }
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -7,41 +7,44 @@ xray-server:
        #ENC[AES256_GCM,data:OVgDU+zqcQ==,iv:8KuEqBuL5Ca6pUOFFA+vySJx/h3BhGAAC0CgnxiW46o=,tag:TY1MajSSy2RjKVI2SSAAFw==,type:comment]
        user1: ENC[AES256_GCM,data:S3IHO9FcVHTJOsRxjSohM9MgnrEwLdDpFU+efLkQaXT2jNJG,iv:KOesvPzjDfm1EDLFiegbk0wgjp7di5mUwUuuY2hwvOQ=,tag:ZsYyUyyEhO5S3weCw/gPMw==,type:str]
        #ENC[AES256_GCM,data:OQOPobpbbhajgA==,iv:4jG3bHKzWcR+JnvSlJsc0Qlv5kywqVN5UE96J31CP7Q=,tag:P+jJkRxPu99tLXyO5k6dRA==,type:comment]
-        user2: ENC[AES256_GCM,data:+MKTpaA8hO8q0kyY0V1csedLOtIf760Vr0+WllGe9lgMJ5da,iv:5txOM3sFOhKVX4EVozb8XHWLU0fUNxCF9YAwTYaTL6c=,tag:jkgOVgiEc5phY1XNETsdpA==,type:str]
+        #ENC[AES256_GCM,data:s6BwbmIwmC1J+vA27pPGh0Q+Rmowkd8ES3hYOny3vX+tjWtW+qiWBz2A9M4=,iv:XXPPaVyP7fEUhNJay2mjjC2f3Vg3wYtBUDoSYQt1Iew=,tag:B2WAfg2Oqwp0t0gE7Jdq6w==,type:comment]
        #ENC[AES256_GCM,data:m0iCqLI8ELaPb9g=,iv:bsh7JHILbOZJ+bgGr0U0rDanjUVGgDzYGhboezspEjE=,tag:o7A4SXoCXk5LXmZ1bidg/w==,type:comment]
        user3: ENC[AES256_GCM,data:r+6jXaIj4HJoYLnJcnjJB+WEZlGaoSy/ktc1Aw77hFtNrrGp,iv:P+YUKns1yaOZokH5WkDB0jssGyHg3ncc54tF1PyA7Oc=,tag:/pxMEr7l4ye5EDAOsllxJA==,type:str]
        #ENC[AES256_GCM,data:4gqZh391hg==,iv:No22DrD6EBs2FA4/qH8msWEjs20fc+ZpEeZep+HIv+c=,tag:aHrYNbI83POI4PRj1nd+Yw==,type:comment]
-        user4: ENC[AES256_GCM,data:/kBaGAqbewLav+WCJPHm1py3pvb7bA/YO2DeBP2FTCZv44wA,iv:iwxV6KHu00oITH/58kBFmf43lkgTU3BHJ/kb9FPnRSE=,tag:ns+6Dvhf/D15bZc0fd6zLA==,type:str]
+        #ENC[AES256_GCM,data:RVChRrOl3R8DiKPS7yduAu5RG7d4VkOZ5akRTp18mK7Hz/xQ7FpxlNqGJcQ=,iv:j7naYq9tD+G5dDB8+hyUVosA3p2O4wlkcxIBlO7hRdo=,tag:TvlSmZwTDGLCX7qOR5Clhg==,type:comment]
        #ENC[AES256_GCM,data:AzzKMw==,iv:Z73ISOLhPWP40wTy8PucY3KaB9nS7WQECK3tZFYC1ao=,tag:KJuiCODhHyDl5bXInUSI5g==,type:comment]
        user5: ENC[AES256_GCM,data:iDuLRb4dhLUOjpamioMwoTYrn7Cy+Ln4SaedVXkwVD05rjJ0,iv:AqzBBvLpJuIJCUJq0IyDcHrlqb0e84nQC0c94Rj85uw=,tag:0xou1i/iwAxGngO74OIMXg==,type:str]
+        #ENC[AES256_GCM,data:nTsDaAIVIP28YBCw0XONqWoYziAYhszJhLBlJfbFM6w2NB0nQcYWAanhkkA=,iv:rezGcsfxcAUjTtBFd099TDrV+K59cb0gbJCCVqH+nCA=,tag:5g2Zl82MNuHTf12Tb0GWcg==,type:comment]
        #ENC[AES256_GCM,data:8FxApg==,iv:vPa5p3QVHAvw+ECusWGqx1ugTcHh42CVFDQcMhG59wM=,tag:lHiZtydcYFBQiXnWh8pCrw==,type:comment]
        user7: ENC[AES256_GCM,data:H/jje9ONEY6XuBXTZmTVGIcWUgGSMf5OB1NNRPtqGCgRP1ei,iv:xew+0BkRqz3nfOoBXTPbBv5hRczy/3tgYSKq432q4iw=,tag:da2ljcffiCVJCsMZaNPZyQ==,type:str]
        #ENC[AES256_GCM,data:QdaYYH3RGJ4qIg==,iv:79NBTEKCPtgVVv3G7wg+vdoLOWxc+bdqT1lF4HJpTC8=,tag:8mRFGjy7lBrdyGyX9vaSOQ==,type:comment]
-        user8: ENC[AES256_GCM,data:AnZb12dioiCamubOb6fsGWoM55zfPMeRbu+j8bRRcMfSQFJf,iv:rB+4B11JFC0oS2ExUW18f5WvhnE4EuHh3IiEyxWeY3A=,tag:jt+3yxDvhusvB8ppbdAwzw==,type:str]
+        #ENC[AES256_GCM,data:hG7EUK7V9QObh7rHKtgTESwNLOf16WXoQrCAAEiK8Nzsr7atwh9DqNIJAww=,iv:3zAY7CImCzvNmsVK/OG3VgYSUL1wdt+keYtuskGO7Gg=,tag:7JeGHrlVkAUOX7bhd8UJaA==,type:comment]
        #ENC[AES256_GCM,data:aYWIiLxs1UvupQ==,iv:AisokHuAzD5B6fEF6ak8WfAe151CM3a8MsaWC4uJPnw=,tag:cdk5S4n9ulyWrqsD+jcqYg==,type:comment]
-        user9: ENC[AES256_GCM,data:+SA+VcZcy5ckuS/46Dn093VvuqxrIACuqMAMx6Ko5yw0DVdW,iv:TeLXb1WI7uhcPDkXYSlKIxdE6Kz+nCnlB+ZYpWcaF4I=,tag:YB0sPD9yHMARhiMJs7JKcA==,type:str]
+        #ENC[AES256_GCM,data:C6ri4a3iCXf7I3PWSoPk1y4143TTFugot1MMxdawWxGyfg/P7SYUBMs+T0U=,iv:v2lCOw+p0hJhXNsUpTSCvqNSBtPaPJGMrk6ukJYtB+w=,tag:WXq9rUYDQKN/cZzZ7CFQvA==,type:comment]
        #ENC[AES256_GCM,data:eCl1bK4=,iv:oYA2CFW6OGGrRYx6OHRYJpbEyFh575UjztvHaXA8UG8=,tag:Pw7xsisQB2Dd0KJeWFq6bQ==,type:comment]
-        user10: ENC[AES256_GCM,data:Pec0CVGia/ZIaq7WerZlr0/waJ/Ev1OKwt7V3PBxBSFMLi7p,iv:wYTdhv4Xoe58KBIwV1vk/V4IcdVzQrBgmzGaRD7qHQs=,tag:IZVt5LmjTUge8XntujJlTA==,type:str]
+        #ENC[AES256_GCM,data:Gs2pJl4YMPRBDZCmd/1ycXJcArdIb8cUAQ+09OuRm7z/x1ATc9xVr7dE+C4b,iv:JYf4sTzJh7PoQe5yFAC60mJ5zKUIof7QKm5jMfiF5xE=,tag:/CJPT/OmblQvzqkQ1VCP/Q==,type:comment]
        #ENC[AES256_GCM,data:+s3MMeNU5Q==,iv:CUrg+nNxCpJFbHQmMNXmSE+JcZK6Dfu8cGwtznx3CFY=,tag:G5CYMtao+hz3hs0fPVPmcw==,type:comment]
-        user11: ENC[AES256_GCM,data:IFIVzbnZCyn0j7AG0ClBT4byyZyVtRk1JqlWsojqPIVenek2,iv:ONdq1qIXG2kbAjuM/tHSPxce7oD/MHcBw1pBYm9DlEk=,tag:OuzeX0K+fSO7jWadb1uSRQ==,type:str]
+        #ENC[AES256_GCM,data:JOabknMamJFImHErEcsrAMuYBXzJkw/Gm0+6rWrer2ePsoOakN/A3ByCPzwQ,iv:wnUFMeGfkUMkkpJBrFswy1SwJzVBDehEoilnzb43MgY=,tag:sXCKkiwtDp9v7ptpuAfOhQ==,type:comment]
        #ENC[AES256_GCM,data:spyQkQIHwg==,iv:7+0DUK95MPH7lpr+GMbbLu4/5yA11/4gTuLhQKlStfE=,tag:G/gIXML8UhYoCi9FfoTvSA==,type:comment]
-        user12: ENC[AES256_GCM,data:iTZViWyKkCU1y6mvB0NzkXf3I98U/+nCs21ZD6M285YKaU6q,iv:vFgA3sv/7ENcw3gyJLiiHLwroXtVJjAxZXViqjXF3mQ=,tag:u3b9Uu6TIPPYX0TW5X5Sjg==,type:str]
+        #ENC[AES256_GCM,data:LRRsL6u+FH3jHa8UAhEXrb3UTQss9piBle2aH2xuuFw0cupmRd5PlSOBIbvQ,iv:0cccpn4bWkrla6COI5g6pDDW1JoVK4UULYteXoJp38s=,tag:+EFlWxGIw7k85Q2RIL/YHg==,type:comment]
        #ENC[AES256_GCM,data:HueqiREBet2bxQ==,iv:WCjTAGg2gXgBSvY3zc/YyB/1X0XjvphPduVXLsjOwH8=,tag:wC+On6lyyYQ1Dt/BHDvONw==,type:comment]
-        user13: ENC[AES256_GCM,data:ID/A7yCWQIWRoU7Emhel2ASZfTweqXYmpC5q6Fm6ptD0XfCu,iv:YrFjIilO4pH+QxVVDTqwkufj2VSC38y9lAJfD8w522I=,tag:1v/T7vWeh0LMi0OL0FVs9g==,type:str]
+        #ENC[AES256_GCM,data:JFKeeVBSBO8pWttZy/fTX1YaVV69Et1GmHVDLZ1E5vUY3BvajjjS04t7V5TG,iv:rZJQTe5+YgJ6X6uPoQcpTw4AF+gQCVSMe7maFetLEPg=,tag:H4ravqgOgQYgVXMayv7tXw==,type:comment]
+        #ENC[AES256_GCM,data:R8lN5T0=,iv:FXLf8Vtjg+PkwNhxXWDViMKqwn7tFMaPhio9zhnudZw=,tag:34gxRH+P9lmkUxlOPKcYMg==,type:comment]
+        #ENC[AES256_GCM,data:dpOaSMuXhIiwb+yD3TgOIKkeWBusQvqHbj4PuvH/anF5/P8JagplDpBSIimJ,iv:PkVIthbA21sFC4J4VmwZ/1HZqA6qbjVPnJoRszmeVbs=,tag:PcXPRYLzuC9F0YfNT4mi3A==,type:comment]
        #ENC[AES256_GCM,data:4jJkbMD9Psxrag==,iv:arRtRaNrqnYcT7vE3wqgl/y8/65ORaxqTdGw55AKDP8=,tag:pRpta6mXfy0XCyzMA4+cEQ==,type:comment]
-        user16: ENC[AES256_GCM,data:esInSvj+a90TAl+b/n9m2iJsH7e6tlQRwSsoLBCy8KA9a0Z3,iv:U4c0pZzqS1s5H6XW3YRSCvDhtxnwCnyKR/tObefX2Rw=,tag:YtY/t4xsmZaj4lC39XQ5SA==,type:str]
+        #ENC[AES256_GCM,data:DeWybZ68gAH4cukohO+OQqeNrnRlUdclGHFeH8aBcn0aq1iWh1UCgtiT5xXd,iv:HYq+CiPWCswr+7+uwUblN8N6T38WU/qu9F5VzaLp4Gg=,tag:YKunlBxH4H71FRSuPxR8Uw==,type:comment]
        #ENC[AES256_GCM,data:/Kec+CdtnT11EA==,iv:DnmbWfgriaE6XAnMqq2UXhHhN+Rd/3YRodKVUCJo6p4=,tag:NimqZpbslKxwzoljaZqEdw==,type:comment]
-        user17: ENC[AES256_GCM,data:6h343SreoMqz5ZHkdyDI/je4v10r5zBV7cWc6Pj4x5sI2cvE,iv:7WSikMxAZJUnv3+GPq40d8r9JkKRRH/SPW5F5fy5HHY=,tag:6h5Z7+WXT/dLNeEIrC0UGw==,type:str]
+        #ENC[AES256_GCM,data:tkJTZZjJfQdU0EDQw9mmc1GRlSpqdwOdsE/QCw4BedDbixjElKqUC5MPRR/b,iv:/3obljBcGiXJfzlTQivkVcaWWcsiqokuU/DmUTchpwg=,tag:E80OLtqoM5XuGk2/xYBYKw==,type:comment]
        #ENC[AES256_GCM,data:h7E4P6BiGjktYg==,iv:DhkK3NNppBqo3sXt9U7kbgfaBPYcSEX2hu6VOAesDiE=,tag:XoVbZklwCmU1EBhv0ujcSw==,type:comment]
-        user18: ENC[AES256_GCM,data:HJj0e6EHXEYmDXlZcS8UlfEQo/4y47w3sYKgb2Ojq6E4vMdE,iv:xThlGl/DDLLgoY5VkBSCx9HIvxy2ZlO5Q987vIMu0lA=,tag:gB07jP6Do4/6RmVaLB3Ecg==,type:str]
+        #ENC[AES256_GCM,data:LXBBph+nPScs6CSHPKwMSvcgFtWrmcOHEhhDZUNClb/7ixJFno82QnRwrnTp,iv:00I8csKFj65qeK8RPbbQ18oQZBrYKeFV3eGwfFXyGDc=,tag:uWUPNfu5Tmqr2LDkijc5cA==,type:comment]
        #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
-        user19: ENC[AES256_GCM,data:unW8dOhNbPNLWd7X2prpD82tcqUua7msq8nX3ykFs8STsuto,iv:OLaZ9XQDFGaA1VENgsSn/3HQXp957Zf9MD9GPZ4KLE8=,tag:UK27LK+De3AzbI2mEIsQpw==,type:str]
+        #ENC[AES256_GCM,data:ttTvPgRtQ4tYmYBSNaO+Bbs/Kz85vuNX+2Od4cOG6yD9yqrSdfLRwVvedVol,iv:ZWZX5rytwefvte/NgNlmmp9FN9vuZ62KVhVgVwX+g7s=,tag:uXx87i/ly6GkLgXA4+QULw==,type:comment]
        #ENC[AES256_GCM,data:1g2gohLbiixMes8=,iv:E3HA6cAdv3BdLMcrrcWW4Zsc2KLtW7L8Xrk9Z57l49o=,tag:rZ7W9ckf7lzJ23u5zwQiwg==,type:comment]
        user20: ENC[AES256_GCM,data:3UbVnn9oMRc0zZR46tWxwM9VFOvMOYm690csUomEVBcS3xPm,iv:KHuPXttLAFr7WT/qa/UYLY8GRsPWYZPyKNmdUh4iFQQ=,tag:jN8rQ0Gv+qnhwOWGH+CwlA==,type:str]
        #ENC[AES256_GCM,data:GzxXsTbEvdHV7A0=,iv:uxUG4hnYEsmJtnqbEwamwhtLt3UClt7ktmkGyAFdxsc=,tag:sF8YQ2cejAezI3Bbp9qKIw==,type:comment]
        user21: ENC[AES256_GCM,data:hgDJ11crZaWcKrc+ZDQklXwpnvt/sMbARkx3sLZfQGZqQZeA,iv:2Re+hdJuT5yg/qTymfpN+KdU3criOmwuqqg+SHb8iAo=,tag:s16N6u5cRDaoWxnrCkamuw==,type:str]
        #ENC[AES256_GCM,data:U0CcBBJraJj9,iv:9kuHsHkSDdDT0Gi/3Oy608RArrg+4cgeii5zWbsGuPA=,tag:EvqqMNvNcWBwie28t0+52w==,type:comment]
-        user22: ENC[AES256_GCM,data:LClSrxtBzuJUD4J4QaYXHUr8XSi+N7Zh193j/YeBZRm9sjgf,iv:djiq3+iVnuKK2HveoCm/j8FezzrHRGnjbyoO6iGm6eA=,tag:N5hqYyvJGxnwT8wbxdnjiA==,type:str]
+        #ENC[AES256_GCM,data:FnindYeqk6g6aZgajHVejfHPqeF+uSX3QzbrDS6XLZz52aQF5ZQSiJQCaDha,iv:c/mrS0jfy5EzQe4Tkm0QqBH9/okJnCsRZFGhzSjeit0=,tag:e5otDw+I2d7moybCx4jeqw==,type:comment]
    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 send:
    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
@@ -68,7 +71,7 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-09T01:33:33Z"
-    mac: ENC[AES256_GCM,data:sRZaOvmwZqoxNFKrWtY19t4As7CEu1kXNR1XWO1uo28KEWQJ2n9HLRsdinjG70j/bFyTkXXiBz6Vlhx2RkdhHURKxe/UKuv/5szuGV/aE0NUGu+jYIaSbbIZpv1FkuUYuRFbuaSJnejEyQYW9ahaJYAJgXutqMY/e4xgUJ7Ooeo=,iv:PvAvKe/23u+aPP2moiNrkEqi0CgP9VCwfzcKC8S8Z1w=,tag:YburNo3mniyi4jyUjMF8DQ==,type:str]
+    lastmodified: "2025-05-18T07:37:52Z"
+    mac: ENC[AES256_GCM,data:nfUU2BsDuErJGm8sVB9shRv4N+cIFZmAF1vWF4iZmcJwjP2PekVWcp4COPAlapy5oVhMutr39oW6VsltTR27jVxhI4+dueurMU7KRLD5Bwpk5hQmMAfZxvl4GaP50zehJbCwfApiX9CcjwCUxUjraTs4rG6LK2+8d5Z0PYosm2A=,iv:TR63cpbe3z0K4bWpbEnv/DE9jnAJV1Zv+Aj0HXoA16Y=,tag:fS78JUapMvBtZCFtM1z07A==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.10.2
--- a/doc/todo.md
+++ b/doc/todo.md
@@ -1,14 +1,6 @@
-* 测试 huggin rsshub
-* 打包 intel 编译器
-* 切换到 niri，清理 plasma
-* 调整其它用户的 zsh 配置
-* 调整 motd
-* 找到 wg1 不能稳定工作的原因；确定 persistentKeepalive 发包的协议、是否会被正确 NAT。
-* 备份系统
-* 备份数据
-* 清理 mariadb，移动到 persistent
-* 清理多余文件
-* 移动日志到 persistent
-* 更新 srv1
-* 告知将代理改到 xserver2
-* 准备单独一个的 archive
+* 使用 wrap 好的 intel 编译器。
+* 在挂载根目录前（创建 rootfs 时），按用户复制需要的文件
+* 挑选一个好看的主题
+* 尝试一些别的计算软件
+* 解决 vscode 中的英语语法检查插件，尝试 valentjn.vscode-ltex
+* 调整 xmupc1 xmupc2 启动分区
--- a/flake.lock
+++ b/flake.lock
@@ -3,12 +3,12 @@
    "blog": {
      "flake": false,
      "locked": {
-        "lastModified": 1748787595,
+        "lastModified": 1742891194,
        "lfs": true,
-        "narHash": "sha256-FFkwHb9DEdBjBaaH6JuhlmpP7ReSEWTy79P3i/eH708=",
+        "narHash": "sha256-MTP/2zAh8VUft3mlgLOWYRuYslDKDu+YRM6BM8r9L9w=",
        "ref": "refs/heads/public",
-        "rev": "d9020a59f07f7ced60c854f324df8879b249e8b6",
-        "revCount": 32,
+        "rev": "99ec653eac9f8452500ee3a2d553728dd60a1a11",
+        "revCount": 27,
        "type": "git",
        "url": "https://git.chn.moe/chn/blog-public.git"
      },
@@ -18,43 +18,34 @@
        "url": "https://git.chn.moe/chn/blog-public.git"
      }
    },
-    "bscpkgs": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "blurred-wallpaper": {
+      "flake": false,
      "locked": {
-        "lastModified": 1748433430,
-        "narHash": "sha256-rTmarmlP4SplEBAD+RM0kD5cB1F5g93H8ooSodxl8XE=",
-        "owner": "CHN-beta",
-        "repo": "bscpkgs",
-        "rev": "bd7d5b02b59c4807e551a43f43489f79206e326a",
+        "lastModified": 1746480265,
+        "narHash": "sha256-A1xKQy6ufGrW4yVGkYb8zBqRuQFFxtowCbao2GOP150=",
+        "owner": "bouteillerAlan",
+        "repo": "blurredwallpaper",
+        "rev": "6fa32cc6062c4852b9abb83f590314a2cab9b5ad",
        "type": "github"
      },
      "original": {
-        "owner": "CHN-beta",
-        "repo": "bscpkgs",
+        "owner": "bouteillerAlan",
+        "repo": "blurredwallpaper",
        "type": "github"
      }
    },
-    "buildproxy": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "cachyos-lts": {
      "locked": {
-        "lastModified": 1709212359,
-        "narHash": "sha256-La70ax79Hrp/Vz2G3gzI4fLgRd2z3lJrYLvCf+xcTj4=",
-        "owner": "polygon",
-        "repo": "nix-buildproxy",
-        "rev": "c26d73992ddae96812501b5ae1cc45037d8b10be",
+        "lastModified": 1743535541,
+        "narHash": "sha256-OlBtXY26w9OcAmpqrTvxaG4/rfDdavauQF2eRxb+ySs=",
+        "owner": "drakon64",
+        "repo": "nixos-cachyos-kernel",
+        "rev": "8516d89c4e0c4a25cea1be8431db3963359ee81b",
        "type": "github"
      },
      "original": {
-        "owner": "polygon",
-        "repo": "nix-buildproxy",
+        "owner": "drakon64",
+        "repo": "nixos-cachyos-kernel",
        "type": "github"
      }
    },
@@ -503,12 +494,12 @@
    "nixos-wallpaper": {
      "flake": false,
      "locked": {
-        "lastModified": 1749300029,
+        "lastModified": 1744994349,
        "lfs": true,
-        "narHash": "sha256-m5rQGDo9sogrNFtHNdf4CiUe4odqOVStj03ikUQX7NE=",
+        "narHash": "sha256-DMVWLep/yoR05kfYqjQxazjZXEUw/CRLoELajXQq3eM=",
        "ref": "refs/heads/main",
-        "rev": "8da808801224ac49758e4df095922be0c84650c8",
-        "revCount": 8,
+        "rev": "5e4d102f5da8c27589083fb90e3f6edd8383ced8",
+        "revCount": 6,
        "type": "git",
        "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
      },
@@ -520,11 +511,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1749016257,
-        "narHash": "sha256-Vi+QhXm6Kau233v7ijtdD5aNpE4RpnUjRUhXGwi7pxk=",
+        "lastModified": 1748069742,
+        "narHash": "sha256-GcfcL/c9Q696oftYwlKjTZS1UTTQR7jSzxNa+imZ+tI=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "5835771b10e3197408d3ac7d32558c8e2ae0ab8d",
+        "rev": "08e074b33507733ffb0ccb3006eb5fbad612ce6f",
        "type": "github"
      },
      "original": {
@@ -718,17 +709,16 @@
    "openxlsx": {
      "flake": false,
      "locked": {
-        "lastModified": 1716560554,
-        "narHash": "sha256-Aqn1830lG4g7BbwEeePhvGawLarmrIMnF2MXROTUBCw=",
+        "lastModified": 1745313465,
+        "narHash": "sha256-HOYgrF3eU8yZIML6Soz7MHXlHpM4TB71zM/IGzwLHRY=",
        "owner": "troldal",
        "repo": "OpenXLSX",
-        "rev": "f85f7f1bd632094b5d78d4d1f575955fc3801886",
+        "rev": "86af3b043f6b13b09e591a920a49ea1f9724d4a1",
        "type": "github"
      },
      "original": {
        "owner": "troldal",
        "repo": "OpenXLSX",
-        "rev": "f85f7f1bd632094b5d78d4d1f575955fc3801886",
        "type": "github"
      }
    },
@@ -829,8 +819,8 @@
    "root": {
      "inputs": {
        "blog": "blog",
-        "bscpkgs": "bscpkgs",
-        "buildproxy": "buildproxy",
+        "blurred-wallpaper": "blurred-wallpaper",
+        "cachyos-lts": "cachyos-lts",
        "catppuccin": "catppuccin",
        "concurrencpp": "concurrencpp",
        "cppcoro": "cppcoro",
@@ -864,9 +854,10 @@
        "py4vasp": "py4vasp",
        "rsshub": "rsshub",
        "rycee": "rycee",
+        "shadowrz": "shadowrz",
+        "slate": "slate",
        "sops-nix": "sops-nix",
        "sqlite-orm": "sqlite-orm",
-        "sticker": "sticker",
        "stickerpicker": "stickerpicker",
        "tgbot-cpp": "tgbot-cpp",
        "ufo": "ufo",
@@ -907,6 +898,42 @@
        "type": "gitlab"
      }
    },
+    "shadowrz": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748056260,
+        "narHash": "sha256-bcUxYhdC/wCw20DeU3tHgdc80JLOAIsKUULH37fdU/M=",
+        "owner": "ShadowRZ",
+        "repo": "nur-packages",
+        "rev": "0c35cdecdf6ecec27c69810ca9f0346fca7c2ee8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ShadowRZ",
+        "repo": "nur-packages",
+        "type": "github"
+      }
+    },
+    "slate": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1626631298,
+        "narHash": "sha256-3tbB16sWVUqiHAfeFc0FnFb0Cf6ZFxYWsYAyexeZVxk=",
+        "owner": "TheBigWazz",
+        "repo": "Slate",
+        "rev": "ff21b49c6e49b5a9f89497e4fea49a5a0c39bd6b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "TheBigWazz",
+        "repo": "Slate",
+        "type": "github"
+      }
+    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
@@ -943,24 +970,6 @@
        "type": "github"
      }
    },
-    "sticker": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1748842256,
-        "lfs": true,
-        "narHash": "sha256-os0NWrft+N/HFy/+WRWup4fOHZLSLHANejih7qdXPxA=",
-        "ref": "refs/heads/main",
-        "rev": "2826c739c5602c5998afdcb3d041d521a214429a",
-        "revCount": 1,
-        "type": "git",
-        "url": "https://git.chn.moe/chn/sticker.git"
-      },
-      "original": {
-        "lfs": true,
-        "type": "git",
-        "url": "https://git.chn.moe/chn/sticker.git"
-      }
-    },
    "stickerpicker": {
      "flake": false,
      "locked": {
--- a/flake.nix
+++ b/flake.nix
@@ -25,9 +25,9 @@
      inputs = { nixpkgs.follows = "nixpkgs"; home-manager.follows = "home-manager"; };
    };
    catppuccin = { url = "github:catppuccin/nix"; inputs.nixpkgs.follows = "nixpkgs"; };
-    bscpkgs = { url = "github:CHN-beta/bscpkgs"; inputs.nixpkgs.follows = "nixpkgs"; };
+    cachyos-lts.url = "github:drakon64/nixos-cachyos-kernel";
    nixvirt = { url = "github:CHN-beta/NixVirt"; inputs.nixpkgs.follows = "nixpkgs"; };
-    buildproxy = { url = "github:polygon/nix-buildproxy"; inputs.nixpkgs.follows = "nixpkgs"; };
+    shadowrz = { url = "github:ShadowRZ/nur-packages"; inputs.nixpkgs.follows = "nixpkgs"; };

    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -40,9 +40,11 @@
    tgbot-cpp = { url = "github:reo7sp/tgbot-cpp"; flake = false; };
    v-sim = { url = "gitlab:l_sim/v_sim/master"; flake = false; };
    rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
+    blurred-wallpaper = { url = "github:bouteillerAlan/blurredwallpaper"; flake = false; };
+    slate = { url = "github:TheBigWazz/Slate"; flake = false; };
    lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
    mumax = { url = "github:CHN-beta/mumax"; flake = false; };
-    openxlsx = { url = "github:troldal/OpenXLSX?rev=f85f7f1bd632094b5d78d4d1f575955fc3801886"; flake = false; };
+    openxlsx = { url = "github:troldal/OpenXLSX"; flake = false; };
    sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
    nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
    hextra = { url = "github:imfing/hextra"; flake = false; };
@@ -57,7 +59,6 @@
    fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
    mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme?lfs=1"; flake = false; };
    phono3py = { url = "github:phonopy/phono3py"; flake = false; };
-    sticker = { url = "git+https://git.chn.moe/chn/sticker.git?lfs=1"; flake = false; };
  };

  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
--- a/flake/branch.nix
+++ b/flake/branch.nix
@@ -1 +1 @@
-"archive"
+"next"
--- a/flake/dns/config/chn.moe.nix
+++ b/flake/dns/config/chn.moe.nix
@@ -5,11 +5,11 @@ let
    autoroute = [ "api" "git" "grafana" "matrix" "peertube" "send" "synapse" "vikunja" "铜锣湾" ];
    nas = [ "initrd.nas" ];
    office = [ "srv2-node0" ];
-    vps4 = [ "initrd.vps4" "xserver2.vps4" ];
+    vps4 = [ "initrd.vps4" "xserver.vps4" ];
    vps6 =
    [
      "blog" "catalog" "coturn" "element" "frp" "initrd.vps6" "misskey" "sticker" "synapse-admin" "tgapi"
-      "ua" "xserver2" "xserver2.vps6" "铜锣湾实验室"
+      "ua" "vps6.xserver" "铜锣湾实验室"
    ];
    "xlog.autoroute" = [ "xlog" ];
    "wg0.srv1-node0" = [ "wg0.srv1" ];
@@ -17,12 +17,11 @@ let
    srv3 =
    [
      "chat" "freshrss" "huginn" "initrd.srv3" "nextcloud" "photoprism" "rsshub" "ssh.git" "vaultwarden" "webdav"
-      "xserver2.srv3" "example"
+      "xserver.srv3" "example"
    ];
    srv1-node0 = [ "srv1" ];
    srv2-node0 = [ "srv2" ];
    "wg1.pc" = [ "nix-store" ];
-    "wg1.nas" = [ "nix-store.nas" ];
  };
  a =
  {
--- a/flake/packages.nix
+++ b/flake/packages.nix
@@ -23,6 +23,7 @@
      version = inputs.self.rev or "dirty";
      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
    };
+  inherit (pkgs.localPackages) blog;
  inherit (pkgs.localPackages.pkgsStatic) chn-bsub;
  vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
  {
@@ -36,18 +37,13 @@
      else if builtins.isAttrs x then builtins.concatMap getDrv (builtins.attrValues x)
      else if builtins.isList x then builtins.concatMap getDrv x
      else [];
-    in pkgs.concatText "src" (getDrv (inputs.self.outputs.src));
+    in pkgs.writeClosure (getDrv (inputs.self.outputs.src));
  dns-push = pkgs.callPackage ./dns
  {
    inherit localLib;
    tokenPath = inputs.self.nixosConfigurations.pc.config.sops.secrets."acme/token".path;
    octodns = pkgs.octodns.withProviders (_: with pkgs.octodns-providers; [ cloudflare ]);
  };
-  archive =
-    let devices =
-      [ "nas" "one" "pc" "srv1-node0" "srv1-node1" "srv1-node2" "srv2-node0" "srv2-node1" "srv3" "vps4" "vps6" ];
-    in pkgs.writeText "archive" (builtins.concatStringsSep "\n" (builtins.map
-      (d: "${inputs.self.outputs.nixosConfigurations.${d}.config.system.build.toplevel}") devices));
 }
 // (builtins.listToAttrs (builtins.map
  (system: { inherit (system) name; value = system.value.config.system.build.toplevel; })
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -114,32 +114,12 @@
  mathematica = pkgs.mathematica.src;
  oneapi =
  {
-    src = pkgs.fetchurl
+      src = pkgs.fetchurl
    {
      url = "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/2cf9c083-82b5-4a8f-a515-c599b09dcefc/"
        + "intel-oneapi-hpc-toolkit-2025.1.1.40_offline.sh";
      sha256 = "1qjy9dsnskwqsk66fm99b3cch1wp3rl9dx7y884p3x5kwiqdma2x";
    };
    version = "2025.1";
-    fullVersion = "2025.1.1.40";
-    components =
-    [
-      "intel.oneapi.lin.dpcpp-cpp-common,v=2025.1.1+10"
-      "intel.oneapi.lin.dpcpp-cpp-common.runtime,v=2025.1.1+10"
-      "intel.oneapi.lin.ifort-compiler,v=2025.1.1+10"
-      "intel.oneapi.lin.compilers-common.runtime,v=2025.1.1+10"
-      "intel.oneapi.lin.mpi.runtime,v=2021.15.0+493"
-      "intel.oneapi.lin.umf,v=0.10.0+355"
-      "intel.oneapi.lin.tbb.runtime,v=2022.1.0+425"
-      "intel.oneapi.lin.compilers-common,v=2025.1.1+10"
-    ];
-  };
-  rsshub =  pkgs.dockerTools.pullImage
-  {
-    imageName = "diygod/rsshub";
-    imageDigest = "sha256:1f9d97263033752bf5e20c66a75e134e6045b6d69ae843c1f6610add696f8c22";
-    hash = "sha256-zN47lhQc3EX28LmGF4N3rDUPqumwmhfGn1OpvBYd2Vw=";
-    finalImageName = "rsshub";
-    finalImageTag = "latest";
  };
 }
--- a/modules/model.nix
+++ b/modules/model.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.model = let inherit (inputs.lib) mkOption types; in
  {
    hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
+    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
    private = mkOption { type = types.bool; default = false; };
    cluster = mkOption
    {
--- a/modules/packages/android-studio.nix
+++ b/modules/packages/android-studio.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.android-studio = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
  config = let inherit (inputs.config.nixos.packages) android-studio; in inputs.lib.mkIf (android-studio != null)
  {
    nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ];
--- a/modules/packages/chromium.nix
+++ b/modules/packages/chromium.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.chromium = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) chromium; in inputs.lib.mkIf (chromium != null)
  {
--- a/modules/packages/desktop.nix
+++ b/modules/packages/desktop.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.desktop = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) desktop; in inputs.lib.mkIf (desktop != null)
  {
@@ -15,7 +15,8 @@ inputs:
        [
          # system management
          # TODO: module should add yubikey-touch-detector into path
-          gparted yubikey-touch-detector btrfs-assistant kdePackages.qtstyleplugin-kvantum cpu-x wl-mirror xpra
+          gparted yubikey-touch-detector btrfs-assistant
+          kdePackages.qtstyleplugin-kvantum cpu-x wl-mirror xpra
          (
            writeShellScriptBin "xclip"
            ''
@@ -24,16 +25,16 @@ inputs:
            ''
          )
          # networking
-          remmina putty kdePackages.krdc
+          remmina putty
          # media
          mpv nomacs simplescreenrecorder imagemagick gimp-with-plugins qcm waifu2x-converter-cpp blender paraview vlc
-          obs-studio (inkscape-with-extensions.override { inkscapeExtensions = null; }) kdePackages.kcolorchooser
-          kdePackages.kdenlive
+          obs-studio (inkscape-with-extensions.override { inkscapeExtensions = null; })
+          # themes
+          klassy-qt6 localPackages.slate localPackages.blurred-wallpaper
          # development
          adb-sync scrcpy dbeaver-bin aircrack-ng fprettify
          # password and key management
          yubikey-manager yubikey-manager-qt yubikey-personalization yubikey-personalization-gui bitwarden hashcat
-          kdePackages.kleopatra
          # download
          qbittorrent wgetpaste rclone
          # editor
@@ -49,24 +50,27 @@ inputs:
          # browser
          google-chrome tor-browser
          # office
-          crow-translate zotero pandoc texliveFull poppler_utils pdftk pdfchain activitywatch
+          crow-translate zotero pandoc texliveFull poppler_utils pdftk pdfchain
          ydict pspp libreoffice-qt6-fresh ocrmypdf typst
          # required by ltex-plus.vscode-ltex-plus
          ltex-ls ltex-ls-plus
          # matplot++ needs old gnuplot
          inputs.pkgs.pkgs-2311.gnuplot
          # math, physics and chemistry
-          octaveFull mpi geogebra6 qalculate-qt
+          octaveFull ovito localPackages.vesta localPackages.v-sim mpi geogebra6 localPackages.ufo
+          inputs.pkgs.pkgs-2311.hdfview qalculate-qt
          # virtualization
          bottles wineWowPackages.stagingFull
          # media
          nur-xddxdd.svp
          # for kdenlive auto subtitle
          openai-whisper
-        ];
+        ]
+          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
+            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
        _pythonPackages = [(pythonPackages: with pythonPackages;
        [
-          scipy scikit-learn jupyterlab autograd numpy 
+          phonopy scipy scikit-learn jupyterlab autograd inputs.pkgs.localPackages.phono3py numpy 
        ])];
      };
      user.sharedModules =
@@ -85,15 +89,9 @@ inputs:
                  inherit (inputs.topInputs) nixos-wallpaper;
                  isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
                    [ "png" "jpg" "jpeg" "webp" ];
-                  listDirRecursive =
-                    let listDir = dir:
-                      if dir.value == "directory" then builtins.concatLists
-                        (builtins.map (f: listDir f) (inputs.localLib.attrsToList (builtins.readDir dir.name)))
-                      else [ dir ];
-                    in dir: listDir { name = dir; value = "directory"; };
                in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
                  (builtins.filter (f: (isPicture f.name) && (f.value == "regular"))
-                    (listDirRecursive nixos-wallpaper)));
+                    (inputs.localLib.attrsToList (builtins.readDir nixos-wallpaper))));
            };
            powerdevil =
              let config =
@@ -120,7 +118,6 @@ inputs:
      wireshark = { enable = true; package = inputs.pkgs.wireshark; };
      yubikey-touch-detector.enable = true;
      kdeconnect.enable = true;
-      kde-pim = { enable = true; kmail = true; };
    };
    services.pcscd.enable = true;
  };
--- a/modules/packages/firefox.nix
+++ b/modules/packages/firefox.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.firefox = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) firefox; in inputs.lib.mkIf (firefox != null)
  {
@@ -12,10 +12,11 @@ inputs:
    {
      enable = true;
      languagePacks = [ "zh-CN" "en-US" ];
-      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator ];
+      nativeMessagingHosts.packages = with inputs.pkgs; [ uget-integrator firefoxpwa ];
    };
    nixos =
    {
+      packages.packages._packages = [ inputs.pkgs.firefoxpwa ];
      user.sharedModules =
      [{
        config =
@@ -24,7 +25,7 @@ inputs:
          {
            enable = true;
            nativeMessagingHosts = with inputs.pkgs;
-              [ kdePackages.plasma-browser-integration uget-integrator ];
+              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
            # TODO: use fixed-version of plugins
            policies.DefaultDownloadDirectory = "\${home}/Downloads";
            profiles.default =
--- a/modules/packages/lammps.nix
+++ b/modules/packages/lammps.nix
@@ -1,23 +1,22 @@
 inputs:
 {
  options.nixos.packages.lammps = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+  };
  config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
  {
-    nixos.packages =
-    {
-      molecule = {};
-      packages._packages =
-        let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
-        in
-          if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
-            .overrideAttrs (prev:
-            {
-              cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
-              nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
-              buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
-            }))]
-          else [ inputs.pkgs.lammps-mpi ];
-    };
+    nixos.packages.packages._packages =
+      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
+      in
+        if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
+          .overrideAttrs (prev:
+          {
+            cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
+            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
+            buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
+          }))]
+        else [ inputs.pkgs.lammps-mpi ];
  };
 }
--- a/modules/packages/mathematica.nix
+++ b/modules/packages/mathematica.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = null;
+  };
  config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
    { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; };
 }
--- a/modules/packages/molecule.nix
+++ b/modules/packages/molecule.nix
@@ -1,20 +0,0 @@
-inputs:
-{
-  options.nixos.packages.molecule = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
-  };
-  config = let inherit (inputs.config.nixos.packages) molecule; in inputs.lib.mkIf (molecule != null)
-  {
-    nixos.packages.packages =
-    {
-      _packages = with inputs.pkgs;
-        [ ovito localPackages.vesta localPackages.v-sim localPackages.ufo inputs.pkgs.pkgs-2311.hdfview ];
-      _pythonPackages = [(pythonPackages: with pythonPackages;
-      [
-        phonopy inputs.pkgs.localPackages.phono3py
-      ])];
-    };
-  };
-}
--- a/modules/packages/mumax.nix
+++ b/modules/packages/mumax.nix
@@ -1,7 +1,14 @@
 inputs:
 {
  options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    default =
+      if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+      then {}
+      else null;
+  };
  config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
  {
    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];
--- a/modules/packages/nushell.nix
+++ b/modules/packages/nushell.nix
@@ -1,7 +1,10 @@
 inputs:
 {
  options.nixos.packages.nushell = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = {}; };
+  {
+    type = types.nullOr (types.submodule {});
+    default = {};
+  };
  config = let inherit (inputs.config.nixos.packages) nushell; in inputs.lib.mkIf (nushell != null)
  {
    nixos =
--- a/modules/packages/minimal.nix
+++ b/modules/packages/minimal.nix
@@ -1,8 +1,8 @@
 inputs:
 {
-  options.nixos.packages.minimal = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.packages.server = let inherit (inputs.lib) mkOption types; in mkOption
    { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) minimal; in inputs.lib.mkIf (minimal != null)
+  config = let inherit (inputs.config.nixos.packages) server; in inputs.lib.mkIf (server != null)
  {
    nixos.packages.packages =
    {
@@ -42,6 +42,13 @@ inputs:
        pdfgrep ffmpeg-full hdf5
      ]
        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
+      _pythonPackages = [(pythonPackages: with pythonPackages;
+      [
+        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
+        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus odfpy
+        # for vasp plot-workfunc.py
+        ase
+      ])];
    };
    programs =
    {
--- a/modules/packages/steam.nix
+++ b/modules/packages/steam.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.steam = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) steam; in inputs.lib.mkIf (steam != null)
  {
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -1,23 +1,25 @@
 inputs:
 {
  options.nixos.packages.vasp = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+  {
+    type = types.nullOr (types.submodule {});
+    # default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    # TODO: fix vasp
+    default = null;
+  };
+  # TODO: add more options to correctly configure VASP
  config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
  {
-    nixos.packages =
+    nixos.packages.packages = with inputs.pkgs;
    {
-      molecule = {};
-      packages = with inputs.pkgs;
-      {
-        _packages =
-        (
-          [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
-            ++ (inputs.lib.optional
-              (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
-              localPackages.vasp.nvidia)
-        );
-        _pythonPackages = [(_: [ localPackages.py4vasp ])];
-      };
+      _packages =
+      (
+        [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
+          ++ (inputs.lib.optional
+            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+            localPackages.vasp.nvidia)
+      );
+      _pythonPackages = [(_: [ localPackages.py4vasp ])];
    };
  };
 }
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -3,7 +3,7 @@ inputs:
  options.nixos.packages.vscode = let inherit (inputs.lib) mkOption types; in mkOption
  {
    type = types.nullOr (types.submodule {});
-    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
  };
  config = let inherit (inputs.config.nixos.packages) vscode; in inputs.lib.mkIf (vscode != null)
  {
--- a/modules/services/freshrss.nix
+++ b/modules/services/freshrss.nix
@@ -1,33 +1,52 @@
 inputs:
 {
-  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in
  {
-    type = types.nullOr (types.submodule { options =
-    {
-      hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
-    };});
-    default = null;
+    enable = mkOption { type = types.bool; default = false; };
+    hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
  };
-  config = let inherit (inputs.config.nixos.services) freshrss; in inputs.lib.mkIf (freshrss != null)
-  {
-    services.freshrss =
+  config =
+    let
+      inherit (inputs.config.nixos.services) freshrss;
+      inherit (inputs.lib) mkIf;
+    in mkIf freshrss.enable
    {
-      enable = true;
-      baseUrl = "https://${freshrss.hostname}";
-      defaultUser = "chn";
-      passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
-      database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
+      services.freshrss =
+      {
+        enable = true;
+        baseUrl = "https://${freshrss.hostname}";
+        defaultUser = "chn";
+        passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
+        database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
+        virtualHost = null;
+      };
+      sops.secrets =
+      {
+        "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
+        "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
+      };
+      systemd.services.freshrss-config.after = [ "mysql.service" ];
+      nixos.services =
+      {
+        mariadb = { enable = true; instances.freshrss = {}; };
+        nginx.https.${freshrss.hostname} =
+        {
+          location =
+          {
+            "/".static =
+            {
+              root = "${inputs.pkgs.freshrss}/p";
+              index = [ "index.php" ];
+              tryFiles = [ "$uri" "$uri/" "$uri/index.php" ];
+            };
+            "~ ^.+?\.php(/.*)?$".php =
+            {
+              root = "${inputs.pkgs.freshrss}/p";
+              fastcgiPass =
+                "unix:${inputs.config.services.phpfpm.pools.${inputs.config.services.freshrss.pool}.socket}";
+            };
+          };
+        };
+      };
    };
-    sops.secrets =
-    {
-      "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
-      "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
-    };
-    systemd.services.freshrss-config.after = [ "mysql.service" ];
-    nixos.services =
-    {
-      mariadb = { enable = true; instances.freshrss = {}; };
-      nginx.https.${freshrss.hostname}.global.configName = "freshrss";
-    };
-  };
 }
--- a/modules/services/fz-new-order/default.nix
+++ b/modules/services/fz-new-order/default.nix
@@ -0,0 +1,99 @@
+inputs:
+{
+  options.nixos.services.fz-new-order = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) fz-new-order; in inputs.lib.mkIf (fz-new-order != null)
+  {
+    users =
+    {
+      users.fz-new-order =
+      {
+        uid = inputs.config.nixos.user.uid.fz-new-order;
+        group = "fz-new-order";
+        home = "/var/lib/fz-new-order";
+        createHome = true;
+        isSystemUser = true;
+      };
+      groups.fz-new-order.gid = inputs.config.nixos.user.gid.fz-new-order;
+    };
+    systemd =
+    {
+      timers.fz-new-order =
+      {
+        wantedBy = [ "timers.target" ];
+        timerConfig = { OnBootSec = "10m"; OnUnitActiveSec = "10m"; Unit = "fz-new-order.service"; };
+      };
+      services.fz-new-order = rec
+      {
+        description = "fz-new-order";
+        after = [ "network.target" ];
+        requires = after;
+        serviceConfig =
+        {
+          User = inputs.config.users.users."fz-new-order".name;
+          Group = inputs.config.users.users."fz-new-order".group;
+          WorkingDirectory = "/var/lib/fz-new-order";
+          ExecStart =
+            let
+              src = inputs.pkgs.replaceVars ./main.cpp
+                { config_file = inputs.config.sops.templates."fz-new-order/config.json".path; };
+              binary = inputs.pkgs.stdenv.mkDerivation
+              {
+                name = "fz-new-order";
+                inherit src;
+                buildInputs = with inputs.pkgs; [ jsoncpp.dev cereal fmt httplib ];
+                dontUnpack = true;
+                buildPhase =
+                ''
+                  runHook preBuild
+                  g++ -std=c++20 -O2 -o fz-new-order ${src} -ljsoncpp -lfmt
+                  runHook postBuild
+                '';
+                installPhase =
+                ''
+                  runHook preInstall
+                  mkdir -p $out/bin
+                  cp fz-new-order $out/bin/fz-new-order
+                  runHook postInstall
+                '';
+              };
+            in "${binary}/bin/fz-new-order";
+        };
+      };
+      tmpfiles.rules =
+      [
+        "d /var/lib/fz-new-order 0700 fz-new-order fz-new-order"
+        "Z /var/lib/fz-new-order - fz-new-order fz-new-order"
+      ];
+    };
+    sops = let userNum = 5; configNum = 2; in
+    {
+      templates."fz-new-order/config.json" =
+      {
+        owner = inputs.config.users.users."fz-new-order".name;
+        group = inputs.config.users.users."fz-new-order".group;
+        content = let placeholder = inputs.config.sops.placeholder; in builtins.toJSON
+        {
+          token = placeholder."fz-new-order/token";
+          uids = builtins.map (j: placeholder."fz-new-order/uids/user${builtins.toString j}")
+            (builtins.genList (n: n) userNum);
+          config = builtins.map
+            (i: builtins.listToAttrs (builtins.map
+              (attrName: { name = attrName; value = placeholder."fz-new-order/config${toString i}/${attrName}"; })
+              [ "username" "password" "comment" ]))
+            (builtins.genList (n: n) configNum);
+        };
+      };
+      secrets =
+        { "fz-new-order/token" = {}; }
+        // (builtins.listToAttrs (builtins.map
+          (i: { name = "fz-new-order/uids/user${toString i}"; value = {}; })
+          (builtins.genList (n: n) userNum)))
+        // (builtins.listToAttrs (builtins.concatLists (builtins.map
+          (i: builtins.map
+            (attrName: { name = "fz-new-order/config${builtins.toString i}/${attrName}"; value = {}; })
+            [ "username" "password" "comment" ])
+          (builtins.genList (n: n) configNum))));
+    };
+  };
+}
--- a/modules/services/fz-new-order/main.cpp
+++ b/modules/services/fz-new-order/main.cpp
@@ -0,0 +1,244 @@
+# include <iostream>
+# include <set>
+# include <sstream>
+# include <filesystem>
+# include <cereal/types/set.hpp>
+# include <cereal/archives/json.hpp>
+# include <fmt/format.h>
+# include <fmt/ranges.h>
+# include <httplib.h>
+# include <json/json.h>
+
+std::string urlencode(std::string s)
+{
+  auto hexchar = [](unsigned char c, unsigned char &hex1, unsigned char &hex2)
+  {
+    hex1 = c / 16;
+    hex2 = c % 16;
+    hex1 += hex1 <= 9 ? '0' : 'a' - 10;
+    hex2 += hex2 <= 9 ? '0' : 'a' - 10;
+  };
+  const char *str = s.c_str();
+  std::vector<char> v(s.size());
+  v.clear();
+  for (std::size_t i = 0, l = s.size(); i < l; i++)
+  {
+    char c = str[i];
+    if
+    (
+      (c >= '0' && c <= '9')
+        || (c >= 'a' && c <= 'z')
+        || (c >= 'A' && c <= 'Z')
+        || c == '-' || c == '_' || c == '.' || c == '!' || c == '~'
+        || c == '*' || c == '\'' || c == '(' || c == ')'
+    )
+      v.push_back(c);
+    else
+    {
+      v.push_back('%');
+      unsigned char d1, d2;
+      hexchar(c, d1, d2);
+      v.push_back(d1);
+      v.push_back(d2);
+    }
+  }
+  return std::string(v.cbegin(), v.cend());
+}
+
+void oneshot
+(
+  const std::string& username, const std::string& password, const std::string& comment,
+  const std::set<std::string>& wxuser, const std::string& token
+)
+{
+  httplib::Client fzclient("http://scmv9.fengzhansy.com:8882");
+  httplib::Client wxclient("http://wxpusher.zjiecode.com");
+  auto& log = std::clog;
+
+  try
+  {
+    // get JSESSIONID
+    auto cookie_jsessionid = [&]() -> std::string
+    {
+      log << "get /scmv9/login.jsp\n";
+      auto result = fzclient.Get("/scmv9/login.jsp");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      auto it = result.value().headers.find("Set-Cookie");
+      if (it == result.value().headers.end() || it->first != "Set-Cookie")
+        throw std::runtime_error("find cookie failed");
+      log << fmt::format("set_cookie JSESSIONID {}\n", it->second.substr(0, it->second.find(';')));
+      return it->second.substr(0, it->second.find(';'));
+    }();
+
+    // login
+    auto cookie_pppp = [&]() -> std::string
+    {
+      auto body = fmt::format("method=dologinajax&rand=1234&userc={}&mdid=P&passw={}", username, password);
+      httplib::Headers headers =
+      {
+        { "X-Requested-With", "XMLHttpRequest" },
+        {
+          "User-Agent",
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+        },
+        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+        { "Origin", "http://scmv9.fengzhansy.com:8882" },
+        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/login.jsp" },
+        { "Cookie", cookie_jsessionid }
+      };
+      log << "post /scmv9/data.jsp\n";
+      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      log << fmt::format("set_cookie pppp {}\n", fmt::format("pppp={}%40{}", username, password));
+      return fmt::format("pppp={}%40{}", username, password);
+    }();
+
+    // get order list
+    auto order_list = [&]() -> std::map<std::string, std::pair<std::string, std::string>>
+    {
+      auto body = fmt::format("method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=dd_qry&nv%5B%5D=bill&nv%5B%5D=&nv%5B%5D=storeid&nv%5B%5D=&nv%5B%5D=vendorid&nv%5B%5D={}&nv%5B%5D=qr_status&nv%5B%5D=&nv%5B%5D=ddprt&nv%5B%5D=%25&nv%5B%5D=fdate&nv%5B%5D=&nv%5B%5D=tdate&nv%5B%5D=&nv%5B%5D=shfdate&nv%5B%5D=&nv%5B%5D=shtdate&nv%5B%5D=&nv%5B%5D=fy_pno&nv%5B%5D=1&nv%5B%5D=fy_psize&nv%5B%5D=10", username);
+      httplib::Headers headers =
+      {
+        { "X-Requested-With", "XMLHttpRequest" },
+        {
+          "User-Agent",
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+        },
+        { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+        { "Origin", "http://scmv9.fengzhansy.com:8882"
+        },
+        { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
+        { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
+      };
+      log << "post /scmv9/data.jsp\n";
+      auto result = fzclient.Post("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+      if (result.error() != httplib::Error::Success)
+        throw std::runtime_error("request failed");
+      log << fmt::format("get result {}\n", result.value().body);
+      std::stringstream result_body(result.value().body);
+      Json::Value root;
+      result_body >> root;
+      std::map<std::string, std::pair<std::string, std::string>> orders;
+      for (unsigned i = 0; i < root["dt"][1].size(); i++)
+      {
+        log << fmt::format
+        (
+          "insert order {} {} {}\n", root["dt"][1][i].asString(), root["dt"][2][i].asString(),
+          root["dt"][4][i].asString()
+        );
+        orders.insert({root["dt"][1][i].asString(), {root["dt"][2][i].asString(), root["dt"][4][i].asString()}});
+      }
+      return orders;
+    }();
+
+    // read order old
+    auto order_old = [&]() -> std::set<std::string>
+    {
+      if (!std::filesystem::exists("orders.json"))
+        return {};
+      else
+      {
+        std::ifstream ins("orders.json");
+        cereal::JSONInputArchive ina(ins);
+        std::set<std::string> data;
+        cereal::load(ina, data);
+        return data;
+      }
+    }();
+
+    // push new order info
+    for (const auto& order : order_list)
+      if (!order_old.contains(order.first))
+      {
+        auto body = fmt::format
+        (
+          "method=dgate&rand=1234&op=scmmgr_pcggl&nv%5B%5D=opmode&nv%5B%5D=ddsp_qry&nv%5B%5D=bill&nv%5B%5D={}",
+          order.first
+        );
+        httplib::Headers headers =
+        {
+          { "X-Requested-With", "XMLHttpRequest" },
+          {
+            "User-Agent",
+            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
+          },
+          { "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8" },
+          { "Origin", "http://scmv9.fengzhansy.com:8882" },
+          { "Referer", "http://scmv9.fengzhansy.com:8882/scmv9/SCM/cggl_po_qry.jsp" },
+          { "Cookie", fmt::format("{}; {}", cookie_jsessionid, cookie_pppp) }
+        };
+        log << "post /scmv9/data.jsp\n";
+        auto result = fzclient.Post
+          ("/scmv9/data.jsp", headers, body, "application/x-www-form-urlencoded; charset=UTF-8");
+        if (result.error() != httplib::Error::Success)
+          throw std::runtime_error("request failed");
+        log << fmt::format("get result {}\n", result.value().body);
+        std::stringstream result_body(result.value().body);
+        Json::Value root;
+        result_body >> root;
+
+        std::stringstream push_body;
+        double all_cost = 0;
+        push_body << fmt::format
+        (
+          "{} {} {}店\n", comment, order.second.second.substr(order.second.second.find('-') + 1),
+          order.second.first.substr(1, 2)
+        );
+        for (unsigned i = 0; i < root["dt"][6].size(); i++)
+        {
+          push_body << fmt::format
+          (
+            "{} {}{}\n", root["dt"][6][i].asString().substr(root["dt"][6][i].asString().length() - 4),
+            root["dt"][7][i].asString(), root["dt"][5][i].asString()
+          );
+          // 订货金额 maybe empty ???
+          if (root["dt"][10][i].asString() != "")
+            all_cost += std::stod(root["dt"][10][i].asString());
+        }
+        push_body << fmt::format("共{:.2f}元\n", all_cost);
+        log << fmt::format("push to wx {}\n", push_body.str());
+        auto encoded = urlencode(push_body.str());
+            
+        for (const auto& wxu : wxuser)
+        {
+          auto path = fmt::format
+            ("/api/send/message/?appToken={}&content={}&uid={}", token, encoded, wxu);
+          auto wxresult = wxclient.Get(path.c_str());
+        }
+      }
+
+    // save data
+    {
+      for (const auto& order : order_list)
+        if (!order_old.contains(order.first))
+          order_old.insert(order.first);
+      std::ofstream os("orders.json");
+      cereal::JSONOutputArchive oa(os);
+      cereal::save(oa, order_old);
+    }
+  }
+  catch (const std::exception& ex)
+  {
+    log << ex.what() << "\n" << std::flush;
+    std::terminate();
+  }
+}
+
+int main(int argc, char** argv)
+{
+  Json::Value configs;
+  std::ifstream("@config_file@") >> configs;
+  auto config_uids = configs["uids"];
+  std::set<std::string> uids;
+  for (auto& uid : config_uids)
+    uids.insert(uid.asString());
+  for (auto& config : configs["config"])
+    oneshot
+    (
+      config["username"].asString(), config["password"].asString(), config["comment"].asString(),
+      uids, configs["token"].asString()
+    );
+}
+
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -45,8 +45,6 @@ inputs:
        };
        service.DISABLE_REGISTRATION = true;
        security.LOGIN_REMEMBER_DAYS = 365;
-        "git.timeout" = builtins.listToAttrs (builtins.map (n: { name = n; value = 1800; })
-          [ "DEFAULT" "MIGRATE" "MIRROR" "CLONE" "PULL" "GC" ]);
      };
    };
    nixos.services =
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -57,7 +57,7 @@ inputs:
          };
        in builtins.listToAttrs (builtins.map
          (package: { name = package; value = inputs.pkgs.fetchNextcloudApp (getInfo package); })
-          [ "phonetrack" "twofactor_webauthn" "calendar" ]);
+          [ "maps" "phonetrack" "twofactor_webauthn" "calendar" ]);
    };
    nixos.services =
    {
--- a/modules/services/nginx/applications/sticker/.gitignore
+++ b/modules/services/nginx/applications/sticker/.gitignore
@@ -0,0 +1,2 @@
+/config.json
+/sticker-import.session
--- a/modules/services/nginx/applications/sticker/default.nix
+++ b/modules/services/nginx/applications/sticker/default.nix
@@ -11,7 +11,7 @@ inputs:
        mkdir -p $out
        cp -r ${inputs.topInputs.stickerpicker}/web/* $out
        chmod -R +w $out
-        cp -r ${inputs.topInputs.sticker}/web/* $out
+        cp -r ${./web}/* $out
      '');
      index = [ "index.html" ];
    };
--- a/modules/services/nginx/applications/sticker/web/packs/LINE_nachonekodayo.json
+++ b/modules/services/nginx/applications/sticker/web/packs/LINE_nachonekodayo.json
--- a/modules/services/nginx/applications/sticker/web/packs/Mare_by_WuMingv2Bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/Mare_by_WuMingv2Bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/Sakurada_Shiro.json
+++ b/modules/services/nginx/applications/sticker/web/packs/Sakurada_Shiro.json
--- a/modules/services/nginx/applications/sticker/web/packs/TheDonaldTrump.json
+++ b/modules/services/nginx/applications/sticker/web/packs/TheDonaldTrump.json
--- a/modules/services/nginx/applications/sticker/web/packs/csaexi.json
+++ b/modules/services/nginx/applications/sticker/web/packs/csaexi.json
--- a/modules/services/nginx/applications/sticker/web/packs/index.json
+++ b/modules/services/nginx/applications/sticker/web/packs/index.json
@@ -0,0 +1,19 @@
+{
+  "packs": [
+    "Mare_by_WuMingv2Bot.json",
+    "line_191054124446_by_moe_sticker_bot.json",
+    "Sakurada_Shiro.json",
+    "loli_DaiSi_by_WuMingv2Bot.json",
+    "listentoweiwei_by_WuMingv2Bot.json",
+    "csaexi.json",
+    "wechat_transfer_zhcn.json",
+    "teamtimothy_bilibili.json",
+    "line26158619ac0d_by_moe_sticker_bot.json",
+    "LINE_nachonekodayo.json",
+    "zhehelima.json",
+    "TheDonaldTrump.json",
+    "line_173195293297_by_moe_sticker_bot.json",
+    "line261586194a0d_by_moe_sticker_bot.json"
+  ],
+  "homeserver_url": "https://matrix.chn.moe"
+}
--- a/modules/services/nginx/applications/sticker/web/packs/line261586194a0d_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line261586194a0d_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/line26158619ac0d_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line26158619ac0d_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/line_173195293297_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line_173195293297_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/line_191054124446_by_moe_sticker_bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/line_191054124446_by_moe_sticker_bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/listentoweiwei_by_WuMingv2Bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/listentoweiwei_by_WuMingv2Bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/loli_DaiSi_by_WuMingv2Bot.json
+++ b/modules/services/nginx/applications/sticker/web/packs/loli_DaiSi_by_WuMingv2Bot.json
--- a/modules/services/nginx/applications/sticker/web/packs/teamtimothy_bilibili.json
+++ b/modules/services/nginx/applications/sticker/web/packs/teamtimothy_bilibili.json
--- a/modules/services/nginx/applications/sticker/web/packs/wechat_transfer_zhcn.json
+++ b/modules/services/nginx/applications/sticker/web/packs/wechat_transfer_zhcn.json
--- a/modules/services/nginx/applications/sticker/web/packs/zhehelima.json
+++ b/modules/services/nginx/applications/sticker/web/packs/zhehelima.json
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -366,13 +366,38 @@ inputs:
        systemd.services.nginx-proxy =
          let
            ip = "${inputs.pkgs.iproute2}/bin/ip";
+            nft = "${inputs.pkgs.nftables}/bin/nft";
+            nftConfigFile = inputs.pkgs.writeText "nginx.nft"
+            ''
+              table inet nginx {
+                chain output {
+                  type route hook output priority mangle; policy accept;
+                  # 由本机发出、gid 为 nginx、但源地址不是本地监听的地址，说明是透明代理的第一个包，将这个流标记
+                  # 但这个包本身不需要处理，正常路由即可。
+                  meta skgid ${builtins.toString inputs.config.users.groups.nginx.gid} fib saddr type != local \
+                    ct state new counter ct mark set ct mark | 2
+                  # 由本机发出、作为透明代理的回复，它不能按照通常的路由，它需要被打上标记并被路由到本地
+                  # 这对应于透明代理到本地的服务的情况
+                  ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
+                  return
+                }
+                # 还需要处理透明代理到其它机器的情况，它们的回复需要在 prerouting 中标记
+                chain prerouting {
+                  type filter hook prerouting priority mangle; policy accept;
+                  ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
+                  return
+                }
+              }
+            '';
            start = inputs.pkgs.writeShellScript "nginx-proxy.start"
            ''
+              ${nft} -f ${nftConfigFile}
              ${ip} rule add fwmark 2/2 table 200
              ${ip} route add local 0.0.0.0/0 dev lo table 200
            '';
            stop = inputs.pkgs.writeShellScript "nginx-proxy.stop"
            ''
+              ${nft} delete table inet nginx
              ${ip} rule del fwmark 2/2 table 200
              ${ip} route del local 0.0.0.0/0 dev lo table 200
            '';
@@ -390,30 +415,6 @@ inputs:
            wants = [ "network.target" ];
            wantedBy= [ "multi-user.target" ];
          };
-        networking.nftables.tables.nginx =
-        {
-          family = "inet";
-          content =
-          ''
-            chain output {
-              type route hook output priority mangle; policy accept;
-              # 由本机发出、gid 为 nginx、但源地址不是本地监听的地址，说明是透明代理的第一个包，将这个流标记
-              # 但这个包本身不需要处理，正常路由即可。
-              meta skgid ${builtins.toString inputs.config.users.groups.nginx.gid} fib saddr type != local \
-                ct state new counter ct mark set ct mark | 2
-              # 由本机发出、作为透明代理的回复，它不能按照通常的路由，它需要被打上标记并被路由到本地
-              # 这对应于透明代理到本地的服务的情况
-              ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
-              return
-            }
-            # 还需要处理透明代理到其它机器的情况，它们的回复需要在 prerouting 中标记
-            chain prerouting {
-              type filter hook prerouting priority mangle; policy accept;
-              ct mark & 2 == 2 ct direction reply counter meta mark set meta mark | 2 accept
-              return
-            }
-          '';
-        };
      })
      # streamProxy
      {
--- a/modules/services/nixvirt.nix
+++ b/modules/services/nixvirt.nix
@@ -1,3 +1,4 @@
+# TODO: fix libvirtd network
 inputs:
 {
  options.nixos.services.nixvirt = let inherit (inputs.lib) mkOption types; in mkOption
@@ -18,31 +19,19 @@ inputs:
          {
            uuid = mkOption { type = types.nonEmptyStr; default = defaultUuid; };
            owner = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-            storage =
+            hardware =
            {
-              name = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-              nodatacow = mkOption { type = types.bool; default = false; };
-            };
-            memory =
-            {
-              sizeMB = mkOption { type = types.ints.unsigned; };
-              dedicated = mkOption { type = types.bool; default = false; };
-            };
-            cpu =
-            {
-              count = mkOption { type = types.ints.unsigned; };
-              hyprthread = mkOption { type = types.bool; default = false; };
-              set = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
+              storage = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
+              memoryMB = mkOption { type = types.ints.unsigned; };
+              cpus = mkOption { type = types.ints.unsigned; };
+              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
            };
            network =
            {
-              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
-              address = mkOption { type = types.nullOr types.ints.unsigned; default = null; };
-              bridge = mkOption { type = types.bool; default = false; };
+              address = mkOption { type = types.ints.unsigned; };
              vnc =
              {
-                port = mkOption
-                  { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
+                port = mkOption { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
                openFirewall = mkOption { type = types.bool; default = true; };
              };
              portForward = rec
@@ -65,13 +54,6 @@ inputs:
  };
  config = let inherit (inputs.config.nixos.services) nixvirt; in inputs.lib.mkIf (nixvirt != null)
  {
-    assertions = builtins.map
-      (vm:
-      {
-        assertion = vm.value.cpu.set != null -> builtins.length vm.value.cpu.set == vm.value.cpu.count;
-        message = "nixvirt.instance.${vm.name}.cpu.set must have the same length as cpu.count";
-      })
-      (inputs.localLib.attrsToList nixvirt.instance);
    virtualisation =
    {
      libvirt =
@@ -81,12 +63,7 @@ inputs:
        connections."qemu:///system" = let inherit (inputs.topInputs.nixvirt) lib; in
        {
          domains = builtins.map
-            (vm:
-            {
-              definition = inputs.config.sops.templates."nixvirt/${vm.name}.xml".path;
-              active = true;
-              restart = false;
-            })
+            (vm: { definition = inputs.config.sops.templates."${vm.name}.xml".path; active = true; restart = false; })
            (inputs.localLib.attrsToList nixvirt.instance);
          networks =
          [{
@@ -97,10 +74,10 @@ inputs:
                host = builtins.map
                  (vm:
                  {
-                    inherit (vm.network) mac;
+                    inherit (vm.hardware) mac;
                    ip = "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}";
                  })
-                  (builtins.filter (vm: vm.network.address != null) (builtins.attrValues nixvirt.instance));
+                  (builtins.attrValues nixvirt.instance);
              in lib.network.writeXML (base // { ip = base.ip // { dhcp = base.ip.dhcp // { inherit host; }; }; });
            active = true;
            # never restart the network
@@ -149,113 +126,50 @@ inputs:
      templates = builtins.listToAttrs (builtins.map
        (vm:
        {
-          name = "nixvirt/${vm.name}.xml";
-          value.content = inputs.topInputs.nixvirt.lib.domain.getXML
-          # port from 8bcc23e27a62297254d0e9c87281e650ff777132
-          {
-            inherit (vm) name;
-            inherit (vm.value) uuid;
-            type = "kvm";
-            vcpu = { placement = "static"; count = vm.value.cpu.count; };
-            cputune = inputs.lib.optionalAttrs (vm.value.cpu.set != null)
-            {
-              vcpupin = builtins.genList
-                (cpu: { vcpu = cpu; cpuset = builtins.elemAt vm.value.cpu.set cpu; })
-                vm.value.cpu.count;
-            };
-            memory =
-            {
-              count = vm.value.memory.sizeMB;
-              unit = "MiB";
-              nosharepages = vm.value.memory.dedicated;
-              locked = vm.value.memory.dedicated;
-            };
-            os =
-            {
-              type = "hvm";
-              arch = "x86_64";
-              machine = "q35";
-              bootmenu = { enable = true; timeout = 15000; };
-              loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
-              nvram =
+          name = "${vm.name}.xml";
+          value.content =
+            let
+              inherit (inputs.topInputs.nixvirt) lib;
+              base = lib.domain.templates.linux
              {
-                template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
-                path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
-                templateFormat = "raw";
-                format = "raw";
+                inherit (vm) name;
+                inherit (vm.value) uuid;
+                memory = { count = vm.value.hardware.memoryMB; unit = "MiB"; };
+                storage_vol = "/var/lib/libvirt/images/${vm.value.hardware.storage}.img";
+                install_vol = "${inputs.topInputs.self.src.iso.netboot}";
+                virtio_video = false;
              };
-            };
-            features = { acpi = {}; apic = {}; };
-            cpu =
+            in lib.domain.getXML (base //
            {
-              mode = "host-passthrough";
-              topology =
+              devices =
+                # remove spicevmc, which needs spice
+                (builtins.removeAttrs base.devices [ "channel" "redirdev" "sound" "audio" ])
+                // {
+                  graphics =
+                  {
+                    type = "vnc";
+                    autoport = false;
+                    port = vm.value.network.vnc.port;
+                    listen.type = "address";
+                    passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
+                  };
+                  interface = base.devices.interface // { mac.address = vm.value.hardware.mac; };
+                  disk = builtins.map (disk: disk // { driver = disk.driver // { type = "raw"; }; }) base.devices.disk;
+                };
+              cpu = base.cpu // { topology = { sockets = 1; dies = 1; cores = vm.value.hardware.cpus; threads = 1; };};
+              vcpu = { placement = "static"; count = vm.value.hardware.cpus; };
+              os = (builtins.removeAttrs base.os [ "boot" ]) //
              {
-                sockets = 1;
-                dies = 1;
-                cores = if vm.value.cpu.hyprthread then vm.value.cpu.count / 2 else vm.value.cpu.count;
-                threads = if vm.value.cpu.hyprthread then 2 else 1;
-              };
-            };
-            clock =
-            {
-              offset = "utc";
-              timer =
-              [
-                { name = "rtc"; tickpolicy = "catchup"; }
-                { name = "pit"; tickpolicy = "delay"; }
-                { name = "hpet"; present = false; }
-              ];
-            };
-            devices =
-            {
-              emulator = "${inputs.config.virtualisation.libvirtd.qemu.package}/bin/qemu-system-x86_64";
-              disk =
-              [
+                loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
+                nvram =
                {
-                  type = "file";
-                  device = "disk";
-                  driver = { name = "qemu"; type = "raw"; cache = "none"; discard = "unmap"; };
-                  source.file = "${if vm.value.storage.nodatacow then "/nix/nodatacow" else ""}/var/lib/libvirt/images/"
-                    + "${vm.value.storage.name}.img";
-                  target = { dev = "vda"; bus = "virtio"; };
-                  boot.order = 1;
-                }
-                {
-                  type = "file";
-                  device = "cdrom";
-                  driver = { name = "qemu"; type = "raw"; };
-                  source.file = "${inputs.topInputs.self.src.iso.netboot}";
-                  target = { dev = "sdc"; bus = "sata"; };
-                  readonly = true;
-                  boot.order = 10;
-                }
-              ];
-              interface =
-              {
-                type = "bridge";
-                model.type = "virtio";
-                mac.address = vm.value.network.mac;
-                source.bridge = if vm.value.network.bridge then "nixvirt" else "virbr0";
+                  template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
+                  path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
+                  templateFormat = "raw";
+                  format = "raw";
+                };
              };
-              input =
-              [
-                { type = "tablet"; bus = "usb"; }
-                { type = "mouse"; bus = "ps2"; }
-                { type = "keyboard"; bus = "ps2"; }
-              ];
-              graphics =
-              {
-                type = "vnc";
-                autoport = false;
-                port = vm.value.network.vnc.port;
-                listen.type = "address";
-                passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
-              };
-              video.model = { type = "qxl"; ram = 65536; vram = 65536; vgamem = 16384; heads = 1; primary = true; };
-              rng = { model = "virtio"; backend = { model = "random"; source = /dev/urandom; }; };
-            };
-          };
+            });
        })
        (inputs.localLib.attrsToList nixvirt.instance));
      secrets = builtins.listToAttrs (builtins.map
@@ -288,25 +202,24 @@ inputs:
      group = "root";
      setuid = true;
    };
-    networking =
-    {
-      firewall.allowedTCPPorts = builtins.map (vm: vm.network.vnc.port)
-        (builtins.filter (vm: vm.network.vnc.openFirewall) (builtins.attrValues nixvirt.instance));
-      nftables.tables.nixvirt =
-      {
-        family = "inet";
-        content =
-          let nftRules = builtins.concatLists (builtins.concatLists (builtins.map
-            (vm: builtins.map
-              (protocol: builtins.map
-                (port: "${protocol} dport ${builtins.toString port.host} fib daddr type local counter dnat ip to "
-                  + "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}"
-                  + ":${builtins.toString port.guest}")
-                vm.network.portForward.${protocol})
-              [ "tcp" "udp" ])
-            (builtins.attrValues nixvirt.instance)));
-          in
-          ''
+    networking.firewall.allowedTCPPorts = builtins.map (vm: vm.network.vnc.port)
+      (builtins.filter (vm: vm.network.vnc.openFirewall) (builtins.attrValues nixvirt.instance));
+    # TODO: use existing options
+    systemd.services.nixvirt-forward =
+      let
+        nftRules = builtins.concatLists (builtins.concatLists (builtins.map
+          (vm: builtins.map
+            (protocol: builtins.map
+              (port: "${protocol} dport ${builtins.toString port.host} fib daddr type local counter dnat ip to "
+                + "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}"
+                + ":${builtins.toString port.guest}")
+              vm.network.portForward.${protocol})
+            [ "tcp" "udp" ])
+          (builtins.attrValues nixvirt.instance)));
+        nft = "${inputs.pkgs.nftables}/bin/nft";
+        nftConfigFile = inputs.pkgs.writeText "nixvirt.nft"
+        ''
+          table inet nixvirt {
            chain prerouting {
              type nat hook prerouting priority dstnat; policy accept;
              ${builtins.concatStringsSep "\n" nftRules}
@@ -315,13 +228,22 @@ inputs:
              type nat hook output priority dstnat; policy accept;
              ${builtins.concatStringsSep "\n" nftRules}
            }
-          '';
+          }
+        '';
+        start = inputs.pkgs.writeShellScript "nixvirt.start" "${nft} -f ${nftConfigFile}";
+        stop = inputs.pkgs.writeShellScript "nixvirt.stop" "${nft} delete table inet nixvirt";
+      in
+      {
+        description = "nixvirt port forward";
+        after = [ "nftables.service" "nixvirt.service" ];
+        serviceConfig =
+        {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = start;
+          ExecStop = stop;
+        };
+        wantedBy= [ "multi-user.target" ];
      };
-    };
-    boot.kernelParams =
-      let cpusets = builtins.concatLists (builtins.map
-        (vm: vm.cpu.set)
-        (builtins.filter (vm: vm.cpu.set != null) (builtins.attrValues nixvirt.instance)));
-      in inputs.lib.mkIf (cpusets != []) [ "isolcpus=${builtins.concatStringsSep "," cpusets}" ];
  };
 }
--- a/modules/services/rsshub.nix
+++ b/modules/services/rsshub.nix
@@ -4,26 +4,41 @@ inputs:
  {
    type = types.nullOr (types.submodule { options =
    {
-      hostname = mkOption { type = types.str; default = "rsshub.chn.moe"; };
+      hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
    };});
    default = null;
  };
  config = let inherit (inputs.config.nixos.services) rsshub; in inputs.lib.mkIf (rsshub != null)
  {
-    virtualisation.oci-containers.containers.rsshub =
+    systemd =
    {
-      image = "rsshub:latest";
-      imageFile = inputs.topInputs.self.src.rsshub;
-      ports = [ "127.0.0.1:5221:5221/tcp" ];
-      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
-      environmentFiles = [ inputs.config.sops.templates."rsshub/env".path ];
+      services.rsshub =
+      {
+        description = "rsshub";
+        after = [ "network.target" "redis-rsshub.service" ];
+        requires = [ "redis-rsshub.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig =
+        {
+          User = "rsshub";
+          Group = "rsshub";
+          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
+          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
+          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        };
+        restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
+      };
+      tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
    };
    sops =
    {
      templates."rsshub/env".content = let placeholder = inputs.config.sops.placeholder; in
      ''
        PORT=5221
-        CACHE_TYPE=memory
+        CACHE_TYPE=redis
+        REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:7116'
        PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
        YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
        YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
@@ -44,7 +59,15 @@ inputs:
        "zhihu-cookies"
      ]));
    };
-    nixos.services.nginx =
-      { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
+    users =
+    {
+      users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
+      groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
+    };
+    nixos.services =
+    {
+      redis.instances.rsshub.port = 7116;
+      nginx = { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
+    };
  };
 }
--- a/modules/services/slurm.nix
+++ b/modules/services/slurm.nix
@@ -53,7 +53,7 @@ inputs:
      {
        slurm =
        {
-          package = (inputs.pkgs.slurm.override { enableX11 = false; enableNVML = false; }).overrideAttrs
+          package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
            (prev:
              let
                inherit (inputs.config.nixos.system.nixpkgs) cuda;
--- a/modules/services/sshd/default.nix
+++ b/modules/services/sshd/default.nix
@@ -6,7 +6,6 @@ inputs:
    {
      passwordAuthentication = mkOption { type = types.bool; default = false; };
      groupBanner = mkOption { type = types.bool; default = false; };
-      motd = mkOption { type = types.bool; default = false; };
    };});
    default = null;
  };
@@ -26,7 +25,8 @@ inputs:
        };
      };
    }
-    (inputs.lib.mkIf sshd.motd
+    # 如果是服务器，那么启用 motd
+    (inputs.lib.mkIf (inputs.config.nixos.model.type == "server")
    {
      nixos =
      {
@@ -34,7 +34,7 @@ inputs:
          [ (inputs.pkgs.fancy-motd.overrideAttrs { src = inputs.topInputs.fancy-motd; }) ];
        user.sharedModules = [(home-inputs: { config.programs.zsh.loginExtra =
        ''
-          [ -f /etc/fancy-motd/banner ] && (lolcat -f /etc/fancy-motd/banner 2> /dev/null)
+          [ -f /etc/fancy-motd/banner ] && lolcat -f /etc/fancy-motd/banner
          motd
        '';})];
      };
--- a/modules/services/xray.nix
+++ b/modules/services/xray.nix
@@ -2,38 +2,32 @@ inputs:
 {
  options.nixos.services.xray = let inherit (inputs.lib) mkOption types; in
  {
-    client = mkOption
+    client =
    {
-      type = types.nullOr (types.submodule (submoduleInputs: { options =
+      enable = mkOption { type = types.bool; default = false; };
+      xray =
      {
-        xray =
+        serverAddress = mkOption { type = types.nonEmptyStr; default = "144.34.225.59"; };
+        serverName = mkOption { type = types.nonEmptyStr; default = "vps6.xserver.chn.moe"; };
+      };
+      dnsmasq =
+      {
+        extraInterfaces = mkOption
        {
-          serverName = mkOption { type = types.nonEmptyStr; default = "xserver2.chn.moe"; };
-          serverAddress = mkOption
-          {
-            type = types.nonEmptyStr;
-            default = inputs.topInputs.self.config.dns."chn.moe".getAddress
-              (inputs.lib.removeSuffix ".chn.moe" submoduleInputs.config.xray.serverName);
-          };
+          type = types.listOf types.nonEmptyStr;
+          default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
        };
-        dnsmasq =
-        {
-          extraInterfaces = mkOption
-          {
-            type = types.listOf types.nonEmptyStr;
-            default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
-          };
-          hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
-        };
-        v2ray-forwarder.noproxyUsers = mkOption { type = types.listOf types.nonEmptyStr; default = [ "gb" "xll" ]; };
-      };}));
-      default = null;
+        hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
+      };
+      v2ray-forwarder.noproxyUsers = mkOption { type = types.listOf types.nonEmptyStr; default = [ "gb" "xll" ]; };
+      # 是否允许代理来自其它机器的流量（相关端口会被放行）
+      allowForward = mkOption { type = types.bool; default = true; };
    };
    server = mkOption
    {
      type = types.nullOr (types.submodule { options =
      {
-        serverName = mkOption { type = types.nonEmptyStr; default = "xserver2.chn.moe"; };
+        serverName = mkOption { type = types.nonEmptyStr; };
      };});
      default = null;
    };
@@ -43,12 +37,12 @@ inputs:
    {
      assertions =
      [{
-        assertion = !(xray.client != null && xray.server != null);
+        assertion = !(xray.client.enable && xray.server != null);
        message = "Currenty xray.client and xray.server could not be simutaniusly enabled.";
      }];
    }
    (
-      inputs.lib.mkIf (xray.client != null)
+      inputs.lib.mkIf xray.client.enable
      {
        services =
        {
@@ -63,7 +57,7 @@ inputs:
              server = [ "127.0.0.1#10853" ];
              interface = xray.client.dnsmasq.extraInterfaces ++ [ "lo" ];
              bind-dynamic = true;
-              address = builtins.map (host: "/${host.name}/${host.value}")
+              address = map (host: "/${host.name}/${host.value}")
                (inputs.localLib.attrsToList xray.client.dnsmasq.hosts);
            };
          };
@@ -75,127 +69,132 @@ inputs:
          {
            owner = inputs.config.users.users.v2ray.name;
            group = inputs.config.users.users.v2ray.group;
-            content = let chinaDns = "223.5.5.5"; foreignDns = "8.8.8.8"; in builtins.toJSON
-            {
-              log.loglevel = "warning";
-              dns =
+            content =
+              let
+                chinaDns = "223.5.5.5";
+                foreignDns = "8.8.8.8";
+              in
+              builtins.toJSON
              {
-                servers =
-                # 先尝试匹配域名列表进行查询，若匹配成功则使用前两个 dns 查询。
-                # 若匹配域名列表失败，或者匹配成功但是查询到的 IP 不在期望的 IP 列表中，则回落到使用后两个 dns 依次查询。
-                [
-                  {
-                    address = chinaDns;
-                    domains = [ "geosite:geolocation-cn" ];
-                    expectIPs = [ "geoip:cn" ];
-                    skipFallback = true;
-                  }
-                  {
-                    address = foreignDns;
-                    domains = [ "geosite:geolocation-!cn" ];
-                    expectIPs = [ "geoip:!cn" ];
-                    skipFallback = true;
-                  }
-                  { address = chinaDns; expectIPs = [ "geoip:cn" ]; }
-                  { address = foreignDns; }
-                ];
-                disableCache = true;
-                queryStrategy = "UseIPv4";
-                tag = "dns-internal";
-              };
-              inbounds =
-              [
+                log.loglevel = "warning";
+                dns =
                {
-                  port = 10853;
-                  protocol = "dokodemo-door";
-                  settings = { address = "8.8.8.8"; network = "tcp,udp"; port = 53; };
-                  tag = "dns-in";
-                }
-                {
-                  port = 10880;
-                  protocol = "dokodemo-door";
-                  settings = { network = "tcp,udp"; followRedirect = true; };
-                  streamSettings.sockopt.tproxy = "tproxy";
-                  sniffing = { enabled = true; destOverride = [ "http" "tls" "quic" ]; routeOnly = true; };
-                  tag = "common-in";
-                }
-                {
-                  port = 10881;
-                  protocol = "dokodemo-door";
-                  settings = { network = "tcp,udp"; followRedirect = true; };
-                  streamSettings.sockopt.tproxy = "tproxy";
-                  tag = "xmu-in";
-                }
-                {
-                  port = 10883;
-                  protocol = "dokodemo-door";
-                  settings = { network = "tcp,udp"; followRedirect = true; };
-                  streamSettings.sockopt.tproxy = "tproxy";
-                  tag = "proxy-in";
-                }
-                { port = 10884; protocol = "socks"; settings.udp = true; tag = "proxy-socks-in"; }
-                { port = 10882; protocol = "socks"; settings.udp = true; tag = "direct-in"; }
-              ];
-              outbounds =
-              [
-                {
-                  protocol = "vless";
-                  settings.vnext =
-                  [{
-                    address = xray.client.xray.serverAddress;
-                    port = 443;
-                    users =
-                    [{
-                      id = inputs.config.sops.placeholder."xray-client/uuid";
-                      encryption = "none";
-                      flow = "xtls-rprx-vision-udp443";
-                    }];
-                  }];
-                  streamSettings =
-                  {
-                    network = "raw";
-                    security = "reality";
-                    realitySettings =
+                  servers =
+                  # 先尝试匹配域名列表进行查询，若匹配成功则使用前两个 dns 查询。
+                  # 若匹配域名列表失败，或者匹配成功但是查询到的 IP 不在期望的 IP 列表中，则回落到使用后两个 dns 依次查询。
+                  [
                    {
-                      inherit (xray.client.xray) serverName;
-                      publicKey = "Nl0eVZoDF9d71_3dVsZGJl3UWR9LCv3B14gu7G6vhjk";
-                      fingerprint = "firefox";
-                    };
-                  };
-                  tag = "proxy-vless";
-                }
-                { protocol = "freedom"; tag = "direct"; }
-                { protocol = "dns"; tag = "dns-out"; }
-                {
-                  protocol = "socks";
-                  settings.servers = [{ address = "127.0.0.1"; port = 10069; }];
-                  tag = "xmu-out";
-                }
-                { protocol = "blackhole"; tag = "block"; }
-              ];
-              routing =
-              {
-                domainStrategy = "AsIs";
-                rules = builtins.map (rule: rule // { type = "field"; })
+                      address = chinaDns;
+                      domains = [ "geosite:geolocation-cn" ];
+                      expectIPs = [ "geoip:cn" ];
+                      skipFallback = true;
+                    }
+                    {
+                      address = foreignDns;
+                      domains = [ "geosite:geolocation-!cn" ];
+                      expectIPs = [ "geoip:!cn" ];
+                      skipFallback = true;
+                    }
+                    { address = chinaDns; expectIPs = [ "geoip:cn" ]; }
+                    { address = foreignDns; }
+                  ];
+                  disableCache = true;
+                  queryStrategy = "UseIPv4";
+                  tag = "dns-internal";
+                };
+                inbounds =
                [
-                  { inboundTag = [ "dns-in" ]; outboundTag = "dns-out"; }
-                  { inboundTag = [ "dns-internal" ]; ip = [ chinaDns ]; outboundTag = "direct"; }
-                  { inboundTag = [ "dns-internal" ]; ip = [ foreignDns ]; outboundTag = "proxy-vless"; }
-                  { inboundTag = [ "dns-internal" ]; outboundTag = "block"; }
-                  { inboundTag = [ "xmu-in" ]; outboundTag = "xmu-out"; }
-                  { inboundTag = [ "direct-in" ]; outboundTag = "direct"; }
-                  { inboundTag = [ "proxy-in" "proxy-socks-in" ]; outboundTag = "proxy-vless"; }
-                  { inboundTag = [ "common-in" ]; domain = [ "geosite:geolocation-cn" ]; outboundTag = "direct"; }
                  {
-                    inboundTag = [ "common-in" ];
-                    domain = [ "geosite:geolocation-!cn" ];
-                    outboundTag = "proxy-vless";
+                    port = 10853;
+                    protocol = "dokodemo-door";
+                    settings = { address = "8.8.8.8"; network = "tcp,udp"; port = 53; };
+                    tag = "dns-in";
                  }
-                  { inboundTag = [ "common-in" ]; ip = [ "geoip:cn" ]; outboundTag = "direct"; }
-                  { inboundTag = [ "common-in" ]; outboundTag = "proxy-vless"; }
+                  {
+                    port = 10880;
+                    protocol = "dokodemo-door";
+                    settings = { network = "tcp,udp"; followRedirect = true; };
+                    streamSettings.sockopt.tproxy = "tproxy";
+                    sniffing = { enabled = true; destOverride = [ "http" "tls" "quic" ]; routeOnly = true; };
+                    tag = "common-in";
+                  }
+                  {
+                    port = 10881;
+                    protocol = "dokodemo-door";
+                    settings = { network = "tcp,udp"; followRedirect = true; };
+                    streamSettings.sockopt.tproxy = "tproxy";
+                    tag = "xmu-in";
+                  }
+                  {
+                    port = 10883;
+                    protocol = "dokodemo-door";
+                    settings = { network = "tcp,udp"; followRedirect = true; };
+                    streamSettings.sockopt.tproxy = "tproxy";
+                    tag = "proxy-in";
+                  }
+                  { port = 10884; protocol = "socks"; settings.udp = true; tag = "proxy-socks-in"; }
+                  { port = 10882; protocol = "socks"; settings.udp = true; tag = "direct-in"; }
                ];
+                outbounds =
+                [
+                  {
+                    protocol = "vless";
+                    settings.vnext =
+                    [{
+                      address = xray.client.xray.serverAddress;
+                      port = 443;
+                      users =
+                      [{
+                        id = inputs.config.sops.placeholder."xray-client/uuid";
+                        encryption = "none";
+                        flow = "xtls-rprx-vision-udp443";
+                      }];
+                    }];
+                    streamSettings =
+                    {
+                      network = "raw";
+                      security = "reality";
+                      realitySettings =
+                      {
+                        serverName = xray.client.xray.serverName;
+                        publicKey = "Nl0eVZoDF9d71_3dVsZGJl3UWR9LCv3B14gu7G6vhjk";
+                        fingerprint = "firefox";
+                      };
+                    };
+                    tag = "proxy-vless";
+                  }
+                  { protocol = "freedom"; tag = "direct"; }
+                  { protocol = "dns"; tag = "dns-out"; }
+                  {
+                    protocol = "socks";
+                    settings.servers = [{ address = "127.0.0.1"; port = 10069; }];
+                    tag = "xmu-out";
+                  }
+                  { protocol = "blackhole"; tag = "block"; }
+                ];
+                routing =
+                {
+                  domainStrategy = "AsIs";
+                  rules = builtins.map (rule: rule // { type = "field"; })
+                  [
+                    { inboundTag = [ "dns-in" ]; outboundTag = "dns-out"; }
+                    { inboundTag = [ "dns-internal" ]; ip = [ chinaDns ]; outboundTag = "direct"; }
+                    { inboundTag = [ "dns-internal" ]; ip = [ foreignDns ]; outboundTag = "proxy-vless"; }
+                    { inboundTag = [ "dns-internal" ]; outboundTag = "block"; }
+                    { inboundTag = [ "xmu-in" ]; outboundTag = "xmu-out"; }
+                    { inboundTag = [ "direct-in" ]; outboundTag = "direct"; }
+                    { inboundTag = [ "proxy-in" "proxy-socks-in" ]; outboundTag = "proxy-vless"; }
+                    { inboundTag = [ "common-in" ]; domain = [ "geosite:geolocation-cn" ]; outboundTag = "direct"; }
+                    {
+                      inboundTag = [ "common-in" ];
+                      domain = [ "geosite:geolocation-!cn" ];
+                      outboundTag = "proxy-vless";
+                    }
+                    { inboundTag = [ "common-in" ]; ip = [ "geoip:cn" ]; outboundTag = "direct"; }
+                    { inboundTag = [ "common-in" ]; outboundTag = "proxy-vless"; }
+                  ];
+                };
              };
-            };
          };
          secrets."xray-client/uuid" = {};
        };
@@ -216,26 +215,93 @@ inputs:
            };
            restartTriggers = [ inputs.config.sops.templates."xray-client.json".file ];
          };
+          # TODO: use existing options
          v2ray-forwarder =
          {
            description = "v2ray-forwarder Daemon";
            after = [ "network.target" ];
            wantedBy = [ "multi-user.target" ];
-            serviceConfig = let ip = "${inputs.pkgs.iproute2}/bin/ip"; in
-            {
-              Type = "oneshot";
-              RemainAfterExit = true;
-              ExecStart = inputs.pkgs.writeShellScript "v2ray-forwarder.start"
-              ''
-                ${ip} rule add fwmark 1/1 table 100
-                ${ip} route add local 0.0.0.0/0 dev lo table 100
-              '';
-              ExecStop = inputs.pkgs.writeShellScript "v2ray-forwarder.stop"
-              ''
-                ${ip} rule del fwmark 1/1 table 100
-                ${ip} route del local 0.0.0.0/0 dev lo table 100
-              '';
-            };
+            serviceConfig =
+              let
+                ip = "${inputs.pkgs.iproute2}/bin/ip";
+                nft = "${inputs.pkgs.nftables}/bin/nft";
+                autoPort = "10880";
+                xmuPort = "10881";
+                proxyPort = "10883";
+              in
+              {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart =
+                  let
+                    loNet =
+                    [
+                      "0.0.0.0/8" "10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12"
+                      "192.0.0.0/24" "192.88.99.0/24" "192.168.0.0/16" "59.77.0.143" "198.18.0.0/15"
+                      "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "240.0.0.0/4"
+                    ];
+                    loNetStr = builtins.concatStringsSep ", " loNet;
+                    noproxyUserStr = builtins.concatStringsSep ", " (builtins.map
+                      (user: builtins.toString inputs.config.nixos.user.uid.${user})
+                      (xray.client.v2ray-forwarder.noproxyUsers ++ [ "v2ray" ]));
+                    nftConfigFile = inputs.pkgs.writeText "v2ray.nft"
+                    ''
+                      table inet v2ray {
+                        set lo_net { type ipv4_addr; flags interval; elements = { ${loNetStr} }; }
+                        set xmu_net { type ipv4_addr; flags interval; }
+                        set noproxy_net { type ipv4_addr; flags interval; elements = { 223.5.5.5 }; }
+                        set noproxy_src_net { type ipv4_addr; flags interval; }
+                        set proxy_net { type ipv4_addr; flags interval; elements = { 8.8.8.8 }; }
+
+                        chain prerouting {
+                          type filter hook prerouting priority mangle; policy accept;
+                          meta l4proto != { tcp, udp } counter return
+
+                          # 对于目标地址为本机的新建的流，标记并永不代理
+                          fib daddr type local ct state new counter ct mark set ct mark | 1 return
+                          ct mark & 1 == 1 counter return
+
+                          ip saddr @noproxy_src_net return
+                          ip daddr @noproxy_net return
+                          ip saddr != 172.16.0.0/12 ip daddr @xmu_net meta l4proto { tcp, udp } \
+                            tproxy ip to :${xmuPort} meta mark set meta mark | 1
+                          ip daddr @proxy_net meta l4proto { tcp, udp } tproxy ip to :${proxyPort} \
+                            meta mark set meta mark | 1
+                          ip daddr @lo_net return
+                          meta l4proto { tcp, udp } tproxy ip to :${autoPort} meta mark set meta mark | 1
+
+                          return
+                        }
+
+                        chain output {
+                          type route hook output priority mangle; policy accept;
+                          ct mark & 1 == 1 counter return
+                          meta skuid { ${noproxyUserStr} } return
+
+                          ip saddr @noproxy_src_net return
+                          ip daddr @noproxy_net return
+                          ip daddr @xmu_net meta mark set meta mark | 1
+                          ip daddr @proxy_net meta mark set meta mark | 1
+                          ip daddr @lo_net return
+                          meta l4proto { tcp, udp } meta mark set meta mark | 1
+
+                          return
+                        }
+                      }
+                    '';
+                  in inputs.pkgs.writeShellScript "v2ray-forwarder.start"
+                  ''
+                    ${nft} -f ${nftConfigFile}
+                    ${ip} rule add fwmark 1/1 table 100
+                    ${ip} route add local 0.0.0.0/0 dev lo table 100
+                  '';
+                ExecStop = inputs.pkgs.writeShellScript "v2ray-forwarder.stop"
+                ''
+                  ${nft} delete table inet v2ray
+                  ${ip} rule del fwmark 1/1 table 100
+                  ${ip} route del local 0.0.0.0/0 dev lo table 100
+                '';
+              };
          };
        };
        users =
@@ -244,77 +310,12 @@ inputs:
          groups.v2ray.gid = inputs.config.nixos.user.gid.v2ray;
        };
        environment.etc."resolv.conf".text = "nameserver 127.0.0.1";
-        networking =
+        networking.firewall =
        {
-          nftables.tables.v2ray =
-          {
-            family = "inet";
-            content =
-              let
-                autoPort = "10880";
-                xmuPort = "10881";
-                proxyPort = "10883";
-                loNet =
-                [
-                  "0.0.0.0/8" "10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12"
-                  "192.0.0.0/24" "192.88.99.0/24" "192.168.0.0/16" "59.77.0.143" "198.18.0.0/15"
-                  "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "240.0.0.0/4"
-                ];
-                loNetStr = builtins.concatStringsSep ", " loNet;
-                noproxyUserStr = builtins.concatStringsSep ", " (builtins.map
-                  (user: builtins.toString inputs.config.nixos.user.uid.${user})
-                  (xray.client.v2ray-forwarder.noproxyUsers ++ [ "v2ray" ]));
-              in
-              ''
-                set lo_net { type ipv4_addr; flags interval; elements = { ${loNetStr} }; }
-                set xmu_net { type ipv4_addr; flags interval; }
-                set noproxy_net { type ipv4_addr; flags interval; elements = { 223.5.5.5 }; }
-                set noproxy_src_net { type ipv4_addr; flags interval; }
-                set proxy_net { type ipv4_addr; flags interval; elements = { 8.8.8.8 }; }
-
-                chain prerouting {
-                  type filter hook prerouting priority mangle; policy accept;
-                  meta l4proto != { tcp, udp } counter return
-
-                  # 对于目标地址为本机的新建的流，标记并永不代理
-                  fib daddr type local ct state new counter ct mark set ct mark | 1 return
-                  ct mark & 1 == 1 counter return
-
-                  ip saddr @noproxy_src_net return
-                  ip daddr @noproxy_net return
-                  ip saddr != 172.16.0.0/12 ip daddr @xmu_net meta l4proto { tcp, udp } \
-                    tproxy ip to :${xmuPort} meta mark set meta mark | 1
-                  ip daddr @proxy_net meta l4proto { tcp, udp } tproxy ip to :${proxyPort} \
-                    meta mark set meta mark | 1
-                  ip daddr @lo_net return
-                  meta l4proto { tcp, udp } tproxy ip to :${autoPort} meta mark set meta mark | 1
-
-                  return
-                }
-
-                chain output {
-                  type route hook output priority mangle; policy accept;
-                  ct mark & 1 == 1 counter return
-                  meta skuid { ${noproxyUserStr} } return
-
-                  ip saddr @noproxy_src_net return
-                  ip daddr @noproxy_net return
-                  ip daddr @xmu_net meta mark set meta mark | 1
-                  ip daddr @proxy_net meta mark set meta mark | 1
-                  ip daddr @lo_net return
-                  meta l4proto { tcp, udp } meta mark set meta mark | 1
-
-                  return
-                }
-              '';
-          };
-          firewall =
-          {
-            allowedTCPPorts = [ 53 ];
-            allowedUDPPorts = [ 53 ];
-            allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
-            allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
-          };
+          allowedTCPPorts = [ 53 ];
+          allowedUDPPorts = [ 53 ];
+          allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
+          allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
        };
      }
    )
@@ -326,7 +327,11 @@ inputs:
            .xray-server.clients;
        in
        {
-          services.xray = { enable = true; settingsFile = inputs.config.sops.templates."xray-server.json".path; };
+          services.xray =
+          {
+            enable = true;
+            settingsFile = inputs.config.sops.templates."xray-server.json".path;
+          };
          sops =
          {
            templates."xray-server.json" =
@@ -348,7 +353,7 @@ inputs:
                      protocol = "vless";
                      settings =
                      {
-                        clients = builtins.map
+                        clients = map
                          (n:
                          {
                            id = inputs.config.sops.placeholder."xray-server/clients/${n}";
--- a/modules/services/xrdp.nix
+++ b/modules/services/xrdp.nix
@@ -0,0 +1,36 @@
+inputs:
+{
+  options.nixos.services.xrdp = let inherit (inputs.lib) mkOption types; in
+  {
+    enable = mkOption { type = types.bool; default = false; };
+    port = mkOption { type = types.ints.unsigned; default = 3389; };
+    hostname = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
+  };
+  config = let inherit (inputs.config.nixos.services) xrdp;
+    in inputs.lib.mkIf xrdp.enable (inputs.lib.mkMerge
+    [
+      {
+        services.xrdp =
+        {
+          enable = true;
+          port = xrdp.port;
+          openFirewall = true;
+          defaultWindowManager = "${inputs.pkgs.plasma-workspace}/bin/startplasma-x11";
+        };
+      }
+      (
+        inputs.lib.mkIf (xrdp.hostname != null)
+        (
+          let mainDomain = builtins.elemAt xrdp.hostname 0;
+          in
+          {
+            services.xrdp =
+              let keydir = inputs.config.security.acme.certs.${mainDomain}.directory;
+              in { sslCert = "${keydir}/full.pem"; sslKey = "${keydir}/key.pem"; };
+            nixos.services.acme.cert.${mainDomain} =
+              { domains = xrdp.hostname; group = inputs.config.systemd.services.xrdp.serviceConfig.Group; };
+          }
+        )
+      )
+    ]);
+}
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -5,7 +5,6 @@ inputs:
  {
    services =
    {
-      dbus.implementation = "broker";
      fstrim.enable = true;
      acpid.enable = true;
      # TODO: set ipfs as separate service
@@ -16,6 +15,9 @@ inputs:
    {
      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
      # consoleLogLevel = 7;
+      kernelParams = inputs.lib.mkIf
+        (builtins.elem inputs.config.nixos.system.grub.installDevice [ "efi" "efiRemovable" ])
+        [ "plymouth.use-simpledrm" ];
    };
    hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
    environment =
--- a/modules/system/fileSystems/nfs.nix
+++ b/modules/system/fileSystems/nfs.nix
@@ -13,45 +13,41 @@ inputs:
    ]);
    default = {};
  };
-  config =
-    let inherit (inputs.config.nixos.system.fileSystems.mount) nfs;
-    in inputs.lib.mkIf (nfs != {}) (inputs.lib.mkMerge
-    [
+  config = let inherit (inputs.config.nixos.system.fileSystems.mount) nfs; in inputs.lib.mkIf (nfs != {})
+  {
+    fileSystems = builtins.listToAttrs (builtins.map
+      (device:
      {
-        fileSystems = builtins.listToAttrs (builtins.map
-          (device:
-          {
-            name = device.value.mountPoint or device.value;
-            value =
-            {
-              device = device.name;
-              fsType = "nfs4";
-              neededForBoot = device.value.hard or true;
-              options = builtins.concatLists
-              [
-                # sync every seconds
-                [ "actimeo=1" "noatime" ]
-                # when try to mount at startup, wait 15 minutes before giving up
-                (inputs.lib.optionals (device.value.hard or true) [ "retry=15" "x-systemd.device-timeout=15min" ])
-                # do not fail, just try continuously in background
-                # nfs4 use tcp, tcp itself will retransmit several times, which is enough
-                (inputs.lib.optionals (!(device.value.hard or true))
-                  [ "bg" "soft" "retrans=1" "timeo=20" "softreval" "x-systemd.requires=network-online.target" ])
-              ];
-            };
-          })
-          (inputs.localLib.attrsToList nfs));
-        services.rpcbind.enable = true;
-      }
-      (inputs.lib.mkIf (builtins.any (mount: mount.hard or true) (builtins.attrValues nfs))
-      {
-        boot.initrd.systemd.extraBin =
+        name = device.value.mountPoint or device.value;
+        value =
        {
-          "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
-          "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
-          "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+          device = device.name;
+          fsType = "nfs4";
+          neededForBoot = device.value.hard or true;
+          options = builtins.concatLists
+          [
+            # sync every seconds
+            [ "actimeo=1" "noatime" ]
+            # when try to mount at startup, wait 15 minutes before giving up
+            (inputs.lib.optionals (device.value.hard or true) [ "retry=15" "x-systemd.device-timeout=15min" ])
+            # do not fail, just try continuously in background
+            # nfs4 use tcp, tcp itself will retransmit several times, which is enough
+            (inputs.lib.optionals (!(device.value.hard or true))
+              [ "bg" "soft" "retrans=1" "timeo=20" "softreval" "x-systemd.requires=network-online.target" ])
+          ];
        };
-        nixos.system.initrd.network = {};
      })
-    ]);
+      (inputs.localLib.attrsToList nfs));
+    boot.initrd = inputs.lib.mkIf (builtins.any (mount: mount.hard or true) (builtins.attrValues nfs))
+    {
+      network.enable = true;
+      systemd.extraBin =
+      {
+        "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+        "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+        "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+      };
+    };
+    services.rpcbind.enable = true;
+  };
 }
--- a/modules/system/font.nix
+++ b/modules/system/font.nix
@@ -1,6 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
+  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
  {
    fonts =
    {
--- a/modules/system/gui.nix
+++ b/modules/system/gui.nix
@@ -3,7 +3,7 @@ inputs:
  config = inputs.lib.mkMerge
  [
    # enable gui
-    (inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
+    (inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
    {
      services =
      {
--- a/modules/system/initrd.nix
+++ b/modules/system/initrd.nix
@@ -3,15 +3,6 @@ inputs:
  options.nixos.system.initrd = let inherit (inputs.lib) mkOption types; in
  {
    sshd = mkOption { type = types.nullOr (types.submodule {}); default = null; };
-    network = mkOption
-    {
-      type = types.nullOr (types.submodule { options =
-      {
-        # null: enable all interfaces configured in systemd.network
-        interfaces = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
-      };});
-      default = null;
-    };
  };
  config = let inherit (inputs.config.nixos.system) initrd; in inputs.lib.mkMerge
  [
@@ -25,54 +16,17 @@ inputs:
    (
      inputs.lib.mkIf (initrd.sshd != null)
      {
-        boot.initrd.network.ssh =
-          { enable = true; hostKeys = [ "/nix/persistent/etc/ssh/initrd_ssh_host_ed25519_key" ]; };
-        nixos.system.initrd.network = {};
-      }
-    )
-    (
-      inputs.lib.mkIf (initrd.network != null)
-      {
-        assertions =
-        [{
-          assertion = inputs.config.nixos.system.network != null;
-          message = "initrd network requires systemd networkd.";
-        }];
        boot =
        {
          initrd =
          {
-            network.enable = true;
+            network =
+            {
+              enable = true;
+              ssh = { enable = true; hostKeys = [ "/nix/persistent/etc/ssh/initrd_ssh_host_ed25519_key" ]; };
+            };
            # resolved does not work in initrd, causing network.target to fail
            services.resolved.enable = false;
-            systemd.network =
-              let inherit (inputs.config.nixos.system.network) dhcp static bridge; in
-              let
-                networks = inputs.lib.unique
-                (
-                  dhcp ++ (builtins.attrNames static) ++ (builtins.attrNames bridge)
-                  ++ (builtins.concatLists (builtins.map (network: network.interfaces) (builtins.attrValues bridge)))
-                );
-                netdevs = builtins.attrNames bridge;
-              in
-              {
-                networks = builtins.listToAttrs (builtins.map
-                  (network: { name = "10-${network}"; value = inputs.config.systemd.network.networks."10-${network}"; })
-                  (builtins.filter
-                    (network:
-                      if initrd.network.interfaces == null then true
-                      else builtins.elem network initrd.network.interfaces
-                    )
-                    networks));
-                netdevs = builtins.listToAttrs (builtins.map
-                  (netdev: { name = "10-${netdev}"; value = inputs.config.systemd.network.netdevs."10-${netdev}"; })
-                  (builtins.filter
-                    (netdev:
-                      if initrd.network.interfaces == null then true
-                      else builtins.elem netdev initrd.network.interfaces
-                    )
-                    netdevs));
-              };
          };
          # do not use ip=xxx, as it will override systemd-networkd configurations
          # kernelParams = [ "ip=on" ];
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -4,66 +4,72 @@ inputs:
  {
    variant = mkOption
    {
-      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" ]);
+      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lts" ]);
      default = "xanmod-lts";
    };
    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
    modules.modprobeConfig = mkOption { type = types.listOf types.str; default = []; };
  };
-  config = let inherit (inputs.config.nixos.system) kernel; in
-  {
-    boot =
+  config = let inherit (inputs.config.nixos.system) kernel; in inputs.lib.mkMerge
+  [
    {
-      kernelModules = [ "br_netfilter" ];
-      # modprobe --show-depends
-      initrd.availableKernelModules =
-      [
-        "bfq" "failover" "net_failover" "nls_cp437" "nls_iso8859-1" "sd_mod"
-        "sr_mod" "usbcore" "usbhid" "usbip-core" "usb-common" "usb_storage" "vhci-hcd" "virtio" "virtio_blk"
-        "virtio_net" "virtio_ring" "virtio_scsi" "cryptd" "libaes"
-        "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
-        # network for nas
-        "igb"
-        # disk for srv1
-        "megaraid_sas"
-        # disks for cluster
-        "nfs" "nfsv4"
-        # netowrk for srv1
-        "bnx2x" "tg3"
-        # network for srv2
-        "e1000e" "igb" "atlantic" "igc"
-        # temp wireless for nas
-        "r8712u"
-        # network for srv3
-        "igb"
-        # touchscreen for one
-        "pinctrl-tigerlake"
-        # bridge network
-        "bridge"
-      ]
-        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
-      extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
-      extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
-      kernelParams = [ "delayacct" ];
-      kernelPackages = inputs.lib.mkIf (kernel.variant != null)
+      boot =
      {
-        nixos = inputs.pkgs.linuxPackages;
-        xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
-        xanmod-latest = inputs.pkgs.linuxPackages_xanmod_latest;
-      }.${kernel.variant};
-      kernelPatches =
-        let
-          patches =
-          {
-            hibernate-progress =
-            [{
-              name = "hibernate-progress";
-              patch =
-                let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
-                in ./hibernate-progress-${version}.patch;
-            }];
-          };
-        in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
-    };
-  };
+        kernelModules = [ "br_netfilter" ];
+        # modprobe --show-depends
+        initrd.availableKernelModules =
+        [
+          "bfq" "failover" "net_failover" "nls_cp437" "nls_iso8859-1" "sd_mod"
+          "sr_mod" "usbcore" "usbhid" "usbip-core" "usb-common" "usb_storage" "vhci-hcd" "virtio" "virtio_blk"
+          "virtio_net" "virtio_ring" "virtio_scsi" "cryptd" "libaes"
+          "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
+          # networking for nas
+          "igb"
+          # disk for srv1
+          "megaraid_sas"
+          # disks for cluster
+          "nfs" "nfsv4"
+          # netowrk for srv1
+          "bnx2x" "tg3"
+          # network for srv2
+          "e1000e" "igb" "atlantic" "igc"
+          # temp wireless for nas
+          "r8712u"
+          # network for srv3
+          "igb"
+        ]
+          ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
+        extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
+        extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
+        kernelParams = [ "delayacct" ];
+        kernelPackages = inputs.lib.mkIf (kernel.variant != null)
+        {
+          nixos = inputs.pkgs.linuxPackages;
+          xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
+          xanmod-latest = inputs.pkgs.linuxPackages_xanmod_latest;
+          cachyos = inputs.pkgs.linuxPackages_cachyos;
+          # TODO: package cachyos-lts
+          cachyos-lts = inputs.pkgs.linuxPackages_cachyos_lts;
+        }.${kernel.variant};
+        kernelPatches =
+          let
+            patches =
+            {
+              hibernate-progress =
+              [{
+                name = "hibernate-progress";
+                patch =
+                  let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
+                  in ./hibernate-progress-${version}.patch;
+              }];
+            };
+          in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
+      };
+    }
+    # enable scx when using cachyos
+    (
+      inputs.lib.mkIf (builtins.elem kernel.variant [ "cachyos" "cachyos-lts" ])
+        { services.scx = { enable = true; scheduler = "scx_rustland"; }; }
+    )
+  ];
 }
--- a/modules/system/networking.nix
+++ b/modules/system/networking.nix
@@ -1,6 +1,6 @@
 inputs:
 {
-  options.nixos.system.network = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.system.networking = let inherit (inputs.lib) mkOption types; in mkOption
  {
    # null: use network-manager; otherwise use networkd
    type = types.nullOr (types.submodule { options =
@@ -17,22 +17,12 @@ inputs:
        };});
        default = {};
      };
-      bridge = mkOption
-      {
-        type = types.attrsOf (types.submodule { options =
-        {
-          interfaces = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-        };});
-        default = {};
-      };
      # wpa_passphrase SSID(wifi name) PSK(password)
      wireless = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
-      trust = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-      masquerade = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
    };});
    default = null;
  };
-  config = let inherit (inputs.config.nixos.system) network; in inputs.lib.mkMerge
+  config = let inherit (inputs.config.nixos.system) networking; in inputs.lib.mkMerge
  [
    # general config
    {
@@ -61,7 +51,7 @@ inputs:
      };
      networking.nftables = { enable = true; flushRuleset = false; };
    }
-    (inputs.localLib.mkConditional (network == null)
+    (inputs.localLib.mkConditional (networking == null)
      {
        networking.networkmanager =
        {
@@ -75,9 +65,9 @@ inputs:
        systemd.network =
        {
          enable = true;
-          networks = inputs.lib.mkMerge
-          [
-            (builtins.listToAttrs (builtins.map
+          networks = builtins.listToAttrs
+          (
+            (builtins.map
              (network:
              {
                name = "10-${network}";
@@ -88,8 +78,8 @@ inputs:
                  linkConfig.RequiredForOnline = "routable";
                };
              })
-              network.dhcp))
-            (builtins.listToAttrs (builtins.map
+              networking.dhcp)
+            ++ (builtins.map
              (network:
              {
                name = "10-${network.name}";
@@ -103,63 +93,31 @@ inputs:
                  dns = inputs.lib.mkIf (network.value.dns != null) [ network.value.dns ];
                };
              })
-              (inputs.localLib.attrsToList network.static)))
-            (builtins.listToAttrs (builtins.map
-              (network:
-              {
-                name = "10-${network.name}";
-                value =
-                {
-                  matchConfig.Name = network.name;
-                  bridgeConfig = {};
-                  linkConfig.RequiredForOnline = "routable";
-                };
-              })
-              (inputs.localLib.attrsToList network.bridge)))
-            (builtins.listToAttrs (builtins.concatLists (builtins.map
-              (bridge: builtins.map
-                (network:
-                {
-                  name = "10-${network}";
-                  value =
-                  {
-                    matchConfig.Name = network;
-                    networkConfig.Bridge = bridge.name;
-                    linkConfig.RequiredForOnline = "enslaved";
-                  };
-                }) bridge.value.interfaces)
-              (inputs.localLib.attrsToList network.bridge))))
-            (builtins.listToAttrs (builtins.map
-              (network: { name = "10-${network}"; value.networkConfig.IPMasquerade = "both"; })
-              network.masquerade))
-          ];
-          netdevs = builtins.listToAttrs (builtins.map
-            (network: { name = "10-${network}"; value.netdevConfig = { Name = network; Kind = "bridge"; }; })
-            (builtins.attrNames network.bridge));
+              (inputs.localLib.attrsToList networking.static))
+          );
        };
        networking =
        {
          useNetworkd = true;
-          wireless = inputs.lib.mkIf (network.wireless != null)
+          wireless = inputs.lib.mkIf (networking.wireless != null)
          {
            enable = true;
            networks = builtins.listToAttrs (builtins.map
              (network: { name = network; value.pskRaw = "ext:${network}"; })
-              network.wireless);
+              networking.wireless);
            secretsFile = inputs.config.sops.templates."wireless.env".path;
          };
-          firewall.trustedInterfaces = network.trust;
        };
        # dnsable dns fallback, use provided dns servers or no dns
        services.resolved.fallbackDns = [];
-        sops = inputs.lib.mkIf (network.wireless != null)
+        sops = inputs.lib.mkIf (networking.wireless != null)
        {
          templates."wireless.env".content = builtins.concatStringsSep "\n" (builtins.map
            (network: "${network}=${inputs.config.sops.placeholder."wireless/${network}"}")
-            network.wireless);
+            networking.wireless);
          secrets = builtins.listToAttrs (builtins.map
            (network: { name = "wireless/${network}"; value = {}; })
-            network.wireless);
+            networking.wireless);
        };
    })
  ];
--- a/modules/system/nixpkgs/buildNixpkgsConfig.nix
+++ b/modules/system/nixpkgs/buildNixpkgsConfig.nix
@@ -13,33 +13,34 @@ let
      { cudaForwardCompat = nixpkgs.cuda.forwardCompat; })
  );
  allowInsecurePredicate = p: inputs.lib.warn "Allowing insecure package ${p.name or "${p.pname}-${p.version}"}" true;
-  config = cudaConfig
-    // {
-      inherit allowInsecurePredicate;
-      allowUnfree = true;
-      android_sdk.accept_license = true;
-      allowBroken = true;
-    }
-    // (inputs.lib.optionalAttrs (nixpkgs.march != null)
-    {
-      oneapiArch = let match = {}; in match.${nixpkgs.march} or nixpkgs.march;
-      nvhpcArch = nixpkgs.march;
-      # contentAddressedByDefault = true;
-    })
-    // (inputs.lib.optionalAttrs (nixpkgs.nixRoot != null)
-      { nix = { storeDir = "${nixpkgs.nixRoot}/store"; stateDir = "${nixpkgs.nixRoot}/var"; }; });
 in platformConfig //
 {
-  inherit config;
+  config = cudaConfig //
+  {
+    inherit allowInsecurePredicate;
+    allowUnfree = true;
+    android_sdk.accept_license = true;
+  }
+  // (inputs.lib.optionalAttrs (nixpkgs.march != null)
+  {
+    # TODO: test znver3 do use AVX
+    oneapiArch = let match = {}; in match.${nixpkgs.march} or nixpkgs.march;
+    nvhpcArch = nixpkgs.march;
+    # contentAddressedByDefault = true;
+  })
+  // (inputs.lib.optionalAttrs (nixpkgs.nixRoot != null)
+    { nix = { storeDir = "${nixpkgs.nixRoot}/store"; stateDir = "${nixpkgs.nixRoot}/var"; }; });
  overlays =
  [
    inputs.topInputs.nur-xddxdd.overlays.inSubTree
+    inputs.topInputs.shadowrz.overlays.default
    inputs.topInputs.nix-vscode-extensions.overlays.default
-    inputs.topInputs.buildproxy.overlays.default
    (final: prev:
    {
      inherit (inputs.topInputs.nix-vscode-extensions.overlays.default final prev) nix-vscode-extensions;
      firefox-addons = (import "${inputs.topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
+      linuxPackages_cachyos_lts =
+        final.linuxPackagesFor (inputs.topInputs.cachyos-lts.overlays.default final prev).linuxPackages_cachyos;
    })
    inputs.topInputs.self.overlays.default
    (final: prev:
@@ -57,12 +58,11 @@ in platformConfig //
        };
        libvirt = (prev.libvirt.override { iptables = final.nftables; }).overrideAttrs
          (prev: { patches = prev.patches or [] ++ [ ./libvirt.patch ]; });
-        root = (prev.root.override { stdenv = final.gcc13Stdenv; }).overrideAttrs (prev:
+        root = prev.root.overrideAttrs (prev:
        {
          patches = prev.patches or [] ++ [ ./root.patch ];
          cmakeFlags = prev.cmakeFlags ++ [ "-DCMAKE_CXX_STANDARD=23" ];
        });
-        inherit (final.pkgs-2411) iio-sensor-proxy;
      }
      // (
        let
@@ -70,26 +70,64 @@ in platformConfig //
          {
            pkgs-2305 = "nixpkgs-2305";
            pkgs-2311 = "nixpkgs-2311";
-            pkgs-2411 = { source = "nixpkgs-2411"; overlay = inputs.topInputs.bscpkgs.overlays.default; };
+            pkgs-2411 = "nixpkgs-2411";
            pkgs-unstable =
            {
              source = "nixpkgs-unstable";
-              overlay = inputs.topInputs.self.overlays.default;
+              overlay = final: prev:
+                (inputs.topInputs.self.overlays.default final prev);
+                # {
+                #   ollama = prev.ollama.override { cudaPackages = final.cudaPackages_12_8; };
+                # }
+                # // inputs.lib.optionalAttrs (nixpkgs.march != null)
+                # {
+                #   pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
+                #   {
+                #     scipy = prev.scipy.overridePythonAttrs (prev:
+                #       { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
+                #     rapidocr-onnxruntime = prev.rapidocr-onnxruntime.overridePythonAttrs { doCheck = false; };
+                #     cfn-lint = prev.cfn-lint.overridePythonAttrs { doCheck = false; };
+                #   })];
+                #   rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
+                #   ctranslate2 = (prev.ctranslate2.override { withCUDA = false; withCuDNN = false; })
+                #     .overrideAttrs (prev:
+                #       { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
+                #   valkey = prev.valkey.overrideAttrs { doCheck = false; };
+                # }
+                # // inputs.lib.optionalAttrs
+                #   (builtins.elem nixpkgs.march [ "skylake" "silvermont" "broadwell" "znver3" ])
+                #   { redis = prev.redis.overrideAttrs { doCheck = false; }; }
+                # // inputs.lib.optionalAttrs (prev.stdenv.hostPlatform.avx2Support)
+                # {
+                #   haskellPackages = prev.haskellPackages.override
+                #   {
+                #     overrides = final: prev:
+                #     {
+                #       crypton = prev.crypton.overrideAttrs
+                #         (prev: { configureFlags = prev.configureFlags or [] ++ [ "--ghc-option=-optc-mno-avx2" ]; });
+                #     };
+                #   };
+                # }
+                #   // (inputs.topInputs.self.overlays.default final prev);
            };
          };
          packages = name: import inputs.topInputs.${source.${name}.source or source.${name}}
          {
            localSystem = platformConfig.hostPlatform or { inherit (platformConfig) system; };
-            inherit config;
+            config = cudaConfig //
+            {
+              allowUnfree = true;
+              # contentAddressedByDefault = true;
+              inherit allowInsecurePredicate;
+            };
            overlays = [(source.${name}.overlay or (_: _: {}))];
          };
        in builtins.listToAttrs (builtins.map
          (name: { inherit name; value = packages name; }) (builtins.attrNames source))
      )
+      # TODO: bring patch to upstream
      // (inputs.lib.optionalAttrs (prev.stdenv.hostPlatform.avx512Support)
        { gsl = prev.gsl.overrideAttrs { doCheck = false; }; })
-      // (inputs.lib.optionalAttrs (nixpkgs.march != null && !prev.stdenv.hostPlatform.avx512Support)
-        { libhwy = prev.libhwy.override { stdenv = final.genericPackages.stdenv; }; })
      // (inputs.lib.optionalAttrs (nixpkgs.march != null)
      {
        libinsane = prev.libinsane.overrideAttrs (prev:
@@ -106,6 +144,7 @@ in platformConfig //
            sed -i '/CPPUNIT_TEST.testDubiousArrayFormulasFODS/d' sc/qa/unit/functions_array.cxx
          '';});});
        opencolorio = prev.opencolorio.overrideAttrs (prev: { doCheck = false; });
+        # TODO: maybe something really broken?
        openvswitch = prev.openvswitch.overrideAttrs (prev: { doCheck = false; });
        rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
        valkey = prev.valkey.overrideAttrs { doCheck = false; };
@@ -113,18 +152,14 @@ in platformConfig //
        # https://github.com/embree/embree/issues/115
        embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
        simde = prev.simde.override { stdenv = final.genericPackages.stdenv; };
-        ctranslate2 = prev.ctranslate2.overrideAttrs (prev:
-          { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
        pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
-        (
-          {
-            scipy = prev.scipy.overridePythonAttrs (prev:
-              { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
-            rich = prev.rich.overridePythonAttrs (prev:
-              { disabledTests = prev.disabledTests or [] ++ [ "test_brokenpipeerror" ]; });
-          }
-        ))];
-        inherit (final.pkgs-2411) intelPackages_2023;
+        {
+          scipy = prev.scipy.overridePythonAttrs (prev:
+            { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
+          # paperwork-backend = prev.paperwork-backend.overrideAttrs (prev: { doCheck = false; });
+        })];
      })
+      # // (inputs.lib.optionalAttrs (nixpkgs.march == "silvermont")
+      #   { c-blosc = prev.c-blosc.overrideAttrs { doCheck = false; }; })
  )];
 }
--- a/modules/system/sysctl.nix
+++ b/modules/system/sysctl.nix
@@ -16,8 +16,6 @@ inputs:
        "kernel.sysrq" = 1;
        # set to larger value, otherwise the system will be very slow on low memory machines
        "vm.vfs_cache_pressure" = 100;
-        # when building archive, nix need more than 100k mounts
-        "fs.mount-max" = 1000000;
      };
    }
    (inputs.lib.mkIf (sysctl.laptop-mode != null) { boot.kernel.sysctl."vm.laptop_mode" = sysctl.laptop-mode; })
--- a/modules/user/chn/default.nix
+++ b/modules/user/chn/default.nix
@@ -57,6 +57,7 @@ inputs:
            )
          ];
        };
+        gtk.iconTheme.name = "klassy";
      };
    };
  };
--- a/modules/user/chn/plasma/autostart.nix
+++ b/modules/user/chn/plasma/autostart.nix
@@ -1,60 +0,0 @@
-inputs:
-{
-  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
-  {
-    home-manager.users.chn.config.home.file =
-      let
-        programs =
-        {
-          nheko = rec
-          {
-            fileName = "nheko.desktop";
-            path = "${inputs.pkgs.nheko}/share/applications/${fileName}";
-          };
-          telegram = rec
-          {
-            fileName = "org.telegram.desktop.desktop";
-            path = inputs.pkgs.writeText fileName (builtins.replaceStrings
-                [ "Exec=telegram-desktop -- %u" ] [ "Exec=telegram-desktop -autostart" ]
-                (builtins.readFile "${inputs.pkgs.telegram-desktop}/share/applications/${fileName}"));
-          };
-          element = rec
-          {
-            fileName = "element-desktop.desktop";
-            path = inputs.pkgs.writeText fileName (builtins.replaceStrings
-                [ "Exec=element-desktop %u" ] [ "Exec=element-desktop --hidden" ]
-                (builtins.readFile "${inputs.pkgs.element-desktop.desktopItem}/share/applications/${fileName}"));
-          };
-          kmail = rec
-          {
-            fileName = "org.kde.kmail2.desktop";
-            path = "${inputs.pkgs.kdePackages.kmail}/share/applications/${fileName}";
-          };
-          discord = rec
-          {
-            fileName = "discord.desktop";
-            path = inputs.pkgs.writeText fileName (builtins.replaceStrings
-                [ "Exec=Discord" ] [ "Exec=Discord --start-minimized" ]
-                (builtins.readFile "${inputs.pkgs.discord.desktopItem}/share/applications/${fileName}"));
-          };
-          crow-translate = rec
-          {
-            fileName = "org.kde.CrowTranslate.desktop";
-            path = "${inputs.pkgs.crow-translate}/share/applications/${fileName}";
-          };
-        };
-        devices =
-        {
-          pc = [ "nheko" "telegram" "element" "kmail" "discord" "crow-translate" ];
-          one = [ "telegram" "element" "kmail" "crow-translate" ];
-        };
-      in builtins.listToAttrs (builtins.map
-        (file:
-        {
-          name = ".config/autostart/${programs.${file}.fileName}";
-          value.source = programs.${file}.path;
-        })
-        (devices.${inputs.config.nixos.model.hostname} or []));
-    environment.persistence."/nix/rootfs/current".users.chn.directories = [ ".config/autostart" ];
-  };
-}
--- a/modules/user/chn/plasma/konsole.nix
+++ b/modules/user/chn/plasma/konsole.nix
@@ -0,0 +1,73 @@
+inputs:
+{
+  config = inputs.lib.mkIf (inputs.config.nixos.packages.desktop != null)
+  {
+    home-manager.users.chn.config =
+    {
+      programs.plasma =
+      {
+        overrideConfig = true;
+        resetFiles = [ "konsolerc" "yakuakerc" ];
+        configFile =
+        {
+          yakuakerc =
+          {
+            Appearance =
+            {
+              HideSkinBorders.value = true;
+              Skin.value = "Slate";
+              Translucency.value = true;
+            };
+            "Desktop Entry".DefaultProfile.value = "plasma-manager.profile";
+            Dialogs.FirstRun.value = false;
+            Window =
+            {
+              KeepOpen.value = false;
+              KeepOpenAfterLastSessionCloses.value = true;
+              ShowSystrayIcon.value = false;
+            };
+          };
+          konsolerc =
+          {
+            "Desktop Entry".DefaultProfile.value = "plasma-manager.profile";
+            "MainWindow.Toolbar sessionToolbar".ToolButtonStyle.value = "IconOnly";
+          };
+        };
+        dataFile."konsole/plasma-manager.profile" =
+        {
+          Appearance =
+          {
+            AntiAliasFonts.value = true;
+            BoldIntense.value = true;
+            ColorScheme.value = "Breeze";
+            Font.value = "FiraCode Nerd Font Mono,10,-1,5,50,0,0,0,0,0";
+            UseFontLineChararacters.value = true;
+            WordModeAttr.value = false;
+          };
+          "Cursor Options".CursorShape.value = 1;
+          General =
+          {
+            Name.value = "plasma-manager";
+            Parent.value = "FALLBACK/";
+            TerminalCenter.value = true;
+            TerminalMargin.value = 1;
+          };
+          "Interaction Options" =
+          {
+            AutoCopySelectedText.value = true;
+            TrimLeadingSpacesInSelectedText.value = true;
+            TrimTrailingSpacesInSelectedText.value = true;
+            UnderlineFilesEnabled.value = true;
+          };
+          Scrolling = { HistoryMode.value = 2; ReflowLines.value = false; };
+          "Terminal Features".BlinkingCursorEnabled.value = true;
+        };
+      };
+      home.file.".local/share/konsole/Breeze.colorscheme".text = builtins.replaceStrings
+        [ "Opacity=1" ] [ "Opacity=0.9\nBlur=true" ]
+        (builtins.readFile "${inputs.pkgs.libsForQt5.konsole}/share/konsole/Breeze.colorscheme");
+    };
+    environment.persistence."/nix/rootfs/current".users.chn.directories =
+      [ ".local/share/konsole" ".local/share/yakuake" ];
+  };
+}
--- a/modules/user/chn/plasma/shortcuts.nix
+++ b/modules/user/chn/plasma/shortcuts.nix
@@ -1,6 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
+  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
  {
    home-manager.users.chn.config.programs.plasma =
    {
@@ -88,6 +88,8 @@ inputs:
        { "org.kde.krunner.desktop"._launch = "Alt+Space"; }
        # settings
        { "systemsettings.desktop"._launch = "Meta+I"; }
+        # yakuake
+        { yakuake.toggle-window-state = "Meta+Space"; }
        # virt-manager
        { "virt-manager.desktop"._launch = "Meta+V"; }
        # system monitor
--- a/modules/user/chn/plasma/theme.nix
+++ b/modules/user/chn/plasma/theme.nix
@@ -0,0 +1,45 @@
+inputs:
+{
+  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+  {
+    home-manager.users.chn.config =
+    {
+      programs.plasma =
+      {
+        workspace =
+        {
+          theme = "breeze-light";
+          colorScheme = "BreezeLight";
+          cursor.theme = "breeze_cursors";
+          lookAndFeel = "org.kde.klassylighttraditional.desktop";
+          # ~/.config/kdeglobals [Icons]
+          iconTheme = "klassy";
+        };
+        configFile =
+        {
+          kwinrc =
+          {
+            Effect-blur.BlurStrength.value = 10;
+            Effect-kwin4_effect_translucency.MoveResize.value = 75;
+            Effect-wobblywindows =
+            {
+              AdvancedMode.value = true;
+              Drag.value = 85;
+              Stiffness.value = 10;
+              WobblynessLevel.value = 1;
+              ResizeWobble.value = false;
+            };
+            Plugins =
+            {
+              blurEnabled.value = true;
+              kwin4_effect_dimscreenEnabled.value = true;
+              kwin4_effect_translucencyEnabled.value = true;
+              padding.value = 4;
+              wobblywindowsEnabled.value = true;
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/modules/user/chn/plasma/wallpaper.nix
+++ b/modules/user/chn/plasma/wallpaper.nix
@@ -1,5 +1,21 @@
 inputs:
 {
-  config.home-manager.users.chn.config.programs.plasma.configFile.kdeglobals.General.accentColorFromWallpaper.value
-    = true;
+  config.home-manager.users.chn.config.programs.plasma.configFile =
+    let
+      inherit (inputs.topInputs) nixos-wallpaper;
+      wallpaper =
+      {
+        pc = "${nixos-wallpaper}/pixiv-117612023.png";
+      }.${inputs.config.nixos.model.hostname} or "${nixos-wallpaper}/pixiv-96734339-x2.png";
+    in
+    {
+      # "plasma-org.kde.plasma.desktop-appletsrc" =
+      # {
+      #   "Containments/1".wallpaperplugin.value = "a2n.blur";
+      #   "Containments/1/Wallpaper/a2n.blur/General".Image.value = wallpaper;
+      # };
+      kscreenlockerrc."Greeter/Wallpaper/org.kde.image/General" =
+        { Image.value = wallpaper; PreviewImage.value = wallpaper; };
+      kdeglobals.General.accentColorFromWallpaper.value = true;
+    };
 }
--- a/modules/user/default.nix
+++ b/modules/user/default.nix
@@ -32,8 +32,6 @@ inputs:
        alikia = 1018;
        pen = 1019;
        reonokiy = 1020;
-        zqq = 1021;
-        zgq = 1022;
        misskey-misskey = 2000;
        misskey-misskey-old = 2001;
        frp = 2002;
@@ -119,12 +117,7 @@ inputs:
      users.users.root =
      {
        shell = inputs.pkgs.zsh;
-        openssh.authorizedKeys.keys = inputs.lib.mkMerge
-        [
-          [(builtins.readFile ./chn/id_ed25519_sk.pub)]
-          (inputs.lib.mkIf (inputs.config.nixos.model.cluster.clusterName or null == "srv1")
-            [(builtins.readFile ./zgq/id_ed25519.pub)])
-        ];
+        openssh.authorizedKeys.keys = [(builtins.readFile ./chn/id_ed25519_sk.pub)];
        hashedPassword = "$y$j9T$.UyKKvDnmlJaYZAh6./rf/$65dRqishAiqxCE6LEMjqruwJPZte7uiyYLVKpzdZNH5";
      };
      home-manager.users.root = homeInputs:
--- a/modules/user/hjp/default.nix
+++ b/modules/user/hjp/default.nix
@@ -2,7 +2,7 @@ inputs:
 {
  config = let inherit (inputs.config.nixos) user; in inputs.lib.mkIf (builtins.elem "hjp" user.users)
  {
-    home-manager.users.hjp.config.programs.zsh.initContent =
+    home-manager.users.hjp.config.programs.zsh.initExtra =
    ''
      export PATH=$PATH:/home/hjp/software/intel/oneapi/compiler/latest/bin
      export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/home/hjp/software/intel/oneapi/compiler/latest/lib
--- a/modules/user/zgq/default.nix
+++ b/modules/user/zgq/default.nix
@@ -1,8 +0,0 @@
-inputs:
-{
-  config = let inherit (inputs.config.nixos) user; in inputs.lib.mkIf (builtins.elem "zgq" user.users)
-  {
-    users.users.zgq.extraGroups = inputs.lib.mkIf (inputs.config.nixos.model.cluster.clusterName or null == "srv1")
-      [ "wheel" ];
-  };
-}
--- a/modules/user/zgq/id_ed25519.pub
+++ b/modules/user/zgq/id_ed25519.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHnhPmiGpuK0OlMPLM9QFYpjcr5/WoG8IFoC9EDLSqc zgq
--- a/modules/user/zqq/id_ed25519.pub
+++ b/modules/user/zqq/id_ed25519.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM+Hi3Jo/xb7vDm5L75jybjjrE6z7quveuKd0mTeXDP zqq@xmupc1
--- a/packages/blog-buildproxy.nix
+++ b/packages/blog-buildproxy.nix
@@ -1,17 +0,0 @@
-{ fetchurl }:
-[
-  {
-    url = "https://cdn.jsdelivr.net/npm/flexsearch@0.8.143/dist/flexsearch.bundle.min.js";
-    file = fetchurl
-    {
-      url = "https://cdn.jsdelivr.net/npm/flexsearch@0.8.143/dist/flexsearch.bundle.min.js";
-      sha256 = "0k3g87h84s667m7zphlsaqzvkdka4rszq5pw66cvngjpi8d98gj3";
-    };
-    status_code = 200;
-    headers =
-    {
-      "content-type" = "application/javascript; charset=utf-8";
-      "content-length" = "46087";
-    };
-  }
-]
--- a/packages/blurred-wallpaper.nix
+++ b/packages/blurred-wallpaper.nix
@@ -0,0 +1,11 @@
+{ stdenv, src }: stdenv.mkDerivation
+{
+  name = "blurred-wallpaper";
+  inherit src;
+  phases = [ "installPhase" ];
+  installPhase =
+  ''
+    mkdir -p $out/share/plasma/wallpapers
+    cp -r $src/a2n.blur $out/share/plasma/wallpapers
+  '';
+}
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -1,6 +1,7 @@
 inputs: rec
 {
  vesta = inputs.pkgs.callPackage ./vesta.nix { src = inputs.topInputs.self.src.vesta; };
+  rsshub = inputs.pkgs.callPackage ./rsshub.nix { inherit mkPnpmPackage; src = inputs.topInputs.rsshub; };
  misskey = inputs.pkgs.callPackage ./misskey.nix
  {
    inherit mkPnpmPackage;
@@ -25,15 +26,16 @@ inputs: rec
  tgbot-cpp = inputs.pkgs.callPackage ./tgbot-cpp.nix { src = inputs.topInputs.tgbot-cpp; };
  mirism-old = inputs.pkgs.callPackage ./mirism-old.nix
  {
-    inherit cppcoro nameof date;
-    inherit (inputs.pkgs.pkgs-2305) boost;
+    inherit cppcoro nameof tgbot-cpp date;
    src = inputs.topInputs.self.src.mirism-old;
-    nghttp2 = inputs.pkgs.pkgs-2305.nghttp2.override { enableAsioLib = true; };
+    nghttp2 = inputs.pkgs.callPackage "${inputs.topInputs.nixpkgs-2305}/pkgs/development/libraries/nghttp2"
+      { enableAsioLib = true; stdenv = inputs.pkgs.gcc12Stdenv; };
    stdenv = inputs.pkgs.gcc12Stdenv;
-    tgbot-cpp = tgbot-cpp.override { stdenv = inputs.pkgs.gcc12Stdenv; };
  };
  cppcoro = inputs.pkgs.callPackage ./cppcoro { src = inputs.topInputs.cppcoro; };
  date = inputs.pkgs.callPackage ./date.nix { src = inputs.topInputs.date; };
+  blurred-wallpaper = inputs.pkgs.callPackage ./blurred-wallpaper.nix { src = inputs.topInputs.blurred-wallpaper; };
+  slate = inputs.pkgs.callPackage ./slate.nix { src = inputs.topInputs.slate; };
  vasp =
  {
    gnu = inputs.pkgs.callPackage ./vasp/gnu
@@ -120,18 +122,13 @@ inputs: rec
  };
  stickerpicker = inputs.pkgs.python3Packages.callPackage ./stickerpicker.nix { src = inputs.topInputs.stickerpicker; };
  info = inputs.pkgs.callPackage ./info { inherit biu; stdenv = inputs.pkgs.clang18Stdenv; };
-  blog = inputs.pkgs.callPackage inputs.topInputs.blog
-  {
-    inherit (inputs.topInputs) hextra;
-    buildProxy = inputs.pkgs.lib.mkBuildproxy ./blog-buildproxy.nix;
-  };
+  blog = inputs.pkgs.callPackage inputs.topInputs.blog { inherit (inputs.topInputs) hextra; };
  phono3py = inputs.pkgs.python3Packages.callPackage ./phono3py.nix { src = inputs.topInputs.phono3py; };
  vm = inputs.pkgs.callPackage ./vm { inherit biu; stdenv = inputs.pkgs.clang18Stdenv; };
-  oneapiPackages = inputs.pkgs.lib.makeScope inputs.pkgs.newScope (final:
+  oneapiPackages =
  {
-    stdenv = inputs.pkgs.callPackage ./oneapi/stdenv.nix { src = inputs.topInputs.self.src.oneapi; inherit gccFull; };
-    fmt = (inputs.pkgs.fmt.override { inherit (final) stdenv; }).overrideAttrs { doCheck = false; env.VERBOSE = "1"; };
-  });
+    stdenv = inputs.pkgs.callPackage ./oneapi/stdenv.nix { src = inputs.topInputs.self.src.oneapi; };
+  };

  fromYaml = content: builtins.fromJSON (builtins.readFile
    (inputs.pkgs.runCommand "toJSON" {}
--- a/packages/oneapi/stdenv.nix
+++ b/packages/oneapi/stdenv.nix
@@ -1,87 +1,70 @@
 {
  src, stdenv, autoPatchelfHook, wrapCCWith, config, overrideCC, makeSetupHook, writeScript, overrideInStdenv,
-  runCommand, lib, gccFull,
-  gcc, glibc, zlib, zstd, libxml2, flock, numactl, ncurses, openssl, gmp, kdePackages,
-  libxcrypt-legacy, libfabric, rdma-core, xorg, bash, p7zip, hwloc
+  runCommand,
+  gcc, glibc, libz, zstd, libxml2, flock, numactl, ncurses, openssl, gmp, kdePackages,
+  libxcrypt-legacy, libfabric, rdma-core, xorg, bash
 }:
 let
  oneapi = stdenv.mkDerivation
  {
    pname = "oneapi";
    inherit (src) src version;
-    buildInputs = [ zlib stdenv.cc.cc hwloc ];
-    nativeBuildInputs = [ autoPatchelfHook p7zip ];
+    buildInputs = [];
+    nativeBuildInputs = [ ncurses stdenv.cc.cc autoPatchelfHook ];
    langFortran = true;
-    dontUnpack = true;
    dontConfigure = true;
    dontBuild = true;
-    installPhase =
-      let installComponents = builtins.concatStringsSep "\n" (builtins.map
-        (component:
-        ''
-          pushd ${component}
-            7za x cupPayload.cup
-            cp -r _installdir/* ../../../../install
-          popd
-        '')
-        src.components);
-      in
+    unpackPhase =
    ''
-      mkdir -p installer install $out
+      mkdir installer
      sh ${src.src} --extract-only --extract-folder installer
-      pushd installer/intel-oneapi-hpc-toolkit-${src.fullVersion}_offline/packages
-        ${installComponents}
-      popd
-      cp -r install/compiler/${src.version}/{bin,include,lib,share} $out
-      cp -r install/{mpi,tbb,umf}/*/lib $out
-
-      # mv $out/bin/compiler/* $out/bin
-      # rm -r $out/bin/compiler
-      # mv $out/bin/clang%2B%2B $out/bin/clang++
-      mv $out/bin/compiler/clang%2B%2B $out/bin/compiler/clang++
-
-      # mv $out/lib/crt/* $out/lib
-      # rm -r $out/lib/crt
+      addAutoPatchelfSearchPath installer/intel*/lib
+      autoPatchelf installer/intel*/bootstrapper
    '';
-    autoPatchelfIgnoreMissingDeps = [ "libze_loader.so.1" "libcuda.so.1" "libhwloc.so.5" ];
+    installPhase =
+    ''
+      mkdir -p $out/install
+      export HOME=$out
+      echo "will install to $out/install"
+      sh installer/intel*/install.sh --silent --eula accept --install-dir $out/install
+      mv $out/install/compiler/${src.version}/{bin,include,lib,share,opt/compiler/include} $out
+      mv $out/bin/compiler/* $out/bin
+      rm -rf $out/install
+      # addAutoPatchelfSearchPath
+    '';
+    autoPatchelfIgnoreMissingDeps = [];
    passthru = { inherit src; };
  };
  wrapper = (wrapCCWith
  {
    cc = oneapi;
    extraBuildCommands =
-      let
-        gcc = stdenv.cc.cc;
-        gccVersion = builtins.concatStringsSep "." (lib.take 3 (builtins.splitVersion gcc.version));
-      in
-      ''
-        echo "-isystem ${oneapi}/include" >> $out/nix-support/cc-cflags
-        echo "-isystem ${oneapi}/include/intel64" >> $out/nix-support/cc-cflags
-        echo "-isystem ${oneapi}/include/icx" >> $out/nix-support/cc-cflags
-        echo "-isystem ${gcc}/include/c++/${gcc.version}/${stdenv.targetPlatform.config}" >> $out/nix-support/cc-cflags
-        echo "-isystem ${gcc}/include/c++/${gcc.version}" >> $out/nix-support/cc-cflags
-        echo "--gcc-toolchain=${stdenv.cc}/lib/gcc/x86_64-unknown-linux-gnu/14.2.1" >> $out/nix-support/cc-cflags
-        echo "-march=${config.oneapiArch}" >> $out/nix-support/cc-cflags-before
+    ''
+      # provide libgcc_s.so but not libgomp.so
+      echo "-L${gcc.cc.libgcc}/lib" >> $out/nix-support/cc-ldflags

-        echo "-L${gcc.lib}/lib" >> $out/nix-support/cc-ldflags
-        echo "-L${gcc}/lib/gcc/${stdenv.targetPlatform.config}/${gccVersion}" >> $out/nix-support/cc-ldflags
-        echo "-L${oneapi}/lib" >> $out/nix-support/cc-ldflags
-        echo "-Lsome_path_does_not_exist" >> $out/nix-support/cc-ldflags
+      echo "-tp=${config.nvhpcArch}" >> $out/nix-support/cc-cflags-before

-        # echo 'export "PATH=${gcc}/bin:$PATH"' >> $out/nix-support/cc-wrapper-hook
+      echo "-noswitcherror" >> $out/nix-support/cc-cflags

-        echo "" > $out/nix-support/add-hardening.sh
+      # print verbose output for debugging
+      # echo "-v" >> $out/nix-support/cc-cflags

-        echo "-v" >> $out/nix-support/cc-cflags
+      # echo "" > $out/nix-support/add-hardening.sh

-        for i in icx icpx ifx; do
-          wrap $i $wrapper ${oneapi}/bin/$i
-        done
-      '';
+      # substitute -idirafter in libc-cflags
+      # somehow -isystem does not work
+      sed -i 's/-idirafter/-I/g' $out/nix-support/libc-cflags
+
+      for i in nvc nvc++ nvcc nvfortran; do
+        wrap $i $wrapper ${oneapi}/bin/$i
+      done
+    '';
  }).overrideAttrs (prev: { installPhase = prev.installPhase +
  ''
-    export named_cc=icx
-    export named_cxx=icpx
-    export named_fc=ifx
+    export named_cc=nvc
+    export named_cxx=nvc++
+    export named_fc=nvfortran
  '';});
-in overrideInStdenv (overrideCC stdenv wrapper) [ ]
+# in overrideInStdenv (overrideCC stdenv wrapper) [ ]
+in oneapi
--- a/packages/rsshub.nix
+++ b/packages/rsshub.nix
@@ -0,0 +1,25 @@
+{
+  lib, mkPnpmPackage, nodejs, writeShellScript,
+  bash, chromium, src, git
+}: (mkPnpmPackage.override { inherit nodejs; })
+  {
+    inherit src;
+    extraNativeBuildInputs = [ bash git ];
+    extraAttrs =
+    {
+      PUPPETEER_SKIP_DOWNLOAD = true;
+      postInstall =
+        let startScript = writeShellScript "rsshub"
+        ''
+          export PATH=${lib.makeBinPath [ bash nodejs nodejs.pkgs.pnpm chromium git ]}:$PATH
+          export CHROMIUM_EXECUTABLE_PATH=chromium
+          export COREPACK_ENABLE_STRICT=0
+          pnpm start
+        '';
+        in
+        ''
+          mkdir -p $out/bin
+          cp ${startScript} $out/bin/rsshub
+        '';
+    };
+  }
--- a/packages/sbatch-tui/src/main.cpp
+++ b/packages/sbatch-tui/src/main.cpp
@@ -17,9 +17,6 @@ int main()
    std::string UserCommand;
    std::string SubmitCommand;
    std::string CurrentInterface = "Program";
-    std::string JobName = std::filesystem::current_path().filename().string();
-    std::string OutputFile = "output.txt";
-    bool LowPriority = false;
  } State;
  std::vector<std::unique_ptr<Program>> Programs;
  auto ConfigFile = YAML::LoadFile(SBATCH_CONFIG);
@@ -67,9 +64,6 @@ int main()
    return ftxui::Container::Vertical
    ({
      Programs[State.ProgramSelected]->get_interface() | with_bottom_heavy,
-      input(&State.JobName, "Job name: "),
-      input(&State.OutputFile, "Output file: "),
-      checkbox("Low priority", &State.LowPriority),
      // 操作按钮
      ftxui::Container::Horizontal
      ({
@@ -117,9 +111,7 @@ int main()
      else if (State.UserCommand == "Continue")
      {
        State.CurrentInterface = "Confirm";
-        State.SubmitCommand = Programs[State.ProgramSelected]->get_submit_command()
-          + "\n--job-name='{}' --output='{}'{}"_f
-            (State.JobName, State.OutputFile, State.LowPriority ? " --nice=10000" : "");
+        State.SubmitCommand = Programs[State.ProgramSelected]->get_submit_command();
      }
      else std::unreachable();
    }
--- a/packages/sbatch-tui/src/mumax3.cpp
+++ b/packages/sbatch-tui/src/mumax3.cpp
@@ -16,6 +16,8 @@ namespace sbatch
      int MemorySchemeSelected = 0;
      std::vector<std::string> MemorySchemeEntries = { "Default", "All", "Custom" };
      std::string Memory = "1";
+      std::string JobName = std::filesystem::current_path().filename().string();
+      std::string OutputFile = "output.txt";
      std::string InputFile = "input.txt";
    };
    protected: StateType State_;
@@ -45,6 +47,7 @@ namespace sbatch
        if (saved_state.MemorySchemeSelected < State_.MemorySchemeEntries.size())
          State_.MemorySchemeSelected = saved_state.MemorySchemeSelected;
        State_.Memory = saved_state.Memory;
+        State_.OutputFile = saved_state.OutputFile;
        State_.InputFile = saved_state.InputFile;
      }
      catch (...) {}
@@ -87,8 +90,12 @@ namespace sbatch
          }) | with_title("Memory:", ftxui::Color::GrayDark) | with_separator
        }) | with_title("Resource allocation:") | with_bottom,
        // 第三行：任务名和输入输出文件
-        ftxui::Container::Vertical({input(&State_.InputFile, "Input file: ")})
-          | with_title("Misc:")
+        ftxui::Container::Vertical
+        ({
+          input(&State_.JobName, "Job name: "),
+          input(&State_.InputFile, "Input file: "),
+          input(&State_.OutputFile, "Output file: "),
+        }) | with_title("Misc:")
      });
    }
    public: virtual std::string get_submit_command() const override
@@ -109,8 +116,11 @@ namespace sbatch
        else if (State_.MemorySchemeSelected == 2) return "--mem={}G"_f(State_.Memory);
        else std::unreachable();
      }();
-      return "sbatch --partition={}\n{}{} {}\n--wrap=\"mumax3 {}\""_f
-        (State_.QueueEntries[State_.QueueSelected], gpu_string, cpu_string, mem_string, State_.InputFile);
+      return "sbatch --partition={}\n{}{} {}\n--job-name='{}' --output='{}'\n--wrap=\"mumax3 {}\""_f
+      (
+        State_.QueueEntries[State_.QueueSelected], gpu_string, cpu_string, mem_string,
+        State_.JobName, State_.OutputFile, State_.InputFile
+      );
    }
  };
  template void Program::register_child_<Mumax3>();
--- a/packages/sbatch-tui/src/vasp_cpu.cpp
+++ b/packages/sbatch-tui/src/vasp_cpu.cpp
@@ -18,6 +18,8 @@ namespace sbatch
      int MemorySchemeSelected = 0;
      std::vector<std::string> MemorySchemeEntries = { "Default", "All", "Custom" };
      std::string Memory = "1";
+      std::string JobName = std::filesystem::current_path().filename().string();
+      std::string OutputFile = "output.txt";
      bool OptcellEnable = false;
      int OptcellSelected = 0;
      std::vector<std::string> OptcellEntries = { "fix ab", "fix c" };
@@ -94,7 +96,8 @@ namespace sbatch
        // 第三行：任务名和输出文件
        ftxui::Container::Vertical
        ({
-
+          input(&State_.JobName, "Job name: "),
+          input(&State_.OutputFile, "Output file: "),
          ftxui::Container::Horizontal
          ({
            checkbox("Generate OPTCELL", &State_.OptcellEnable),
@@ -138,11 +141,11 @@ namespace sbatch
        else return ""s;
      }();
      return
-        "{}sbatch --partition={} --nodes=1-1\n{}{}\n"
+        "{}sbatch --partition={} --nodes=1-1\n{}{}\n--job-name='{}' --output='{}'\n"
          "--wrap=\"srun{} vasp-intel vasp-{}\""_f
        (
          optcell_string, State_.QueueEntries[State_.QueueSelected], cpu_string, mem_string,
-          srun_string, State_.VaspEntries[State_.VaspSelected]
+          State_.JobName, State_.OutputFile, srun_string, State_.VaspEntries[State_.VaspSelected]
        );
    }
  };
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chn	bf223cf347	Revert "remove wallpaper desktopeffect theme etc" This reverts commit `5b6a2623bc`.	2025-05-25 14:03:57 +08:00
chn	5b6a2623bc	remove wallpaper desktopeffect theme etc	2025-05-25 13:55:48 +08:00
chn	dec023fcaa	remove autostart programs	2025-05-25 13:51:59 +08:00
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHnhPmiGpuK0OlMPLM9QFYpjcr5/WoG8IFoC9EDLSqc zgq`
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM+Hi3Jo/xb7vDm5L75jybjjrE6z7quveuKd0mTeXDP zqq@xmupc1`