disable masquerade

This reverts commit 8babcc5185.

devices/nas/default.nix

@@ -4,7 +4,7 @@ inputs:
   {
     nixos =
     {
-      model = { type = "desktop"; private = true; };
+      model.private = true;
       system =
       {
         fileSystems =
@@ -19,7 +19,7 @@ inputs:
         };
         initrd.sshd = {};
         nixpkgs.march = "silvermont";
-        networking = {};
+        network = {};
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =
@@ -38,6 +38,7 @@ inputs:
         };
         beesd."/".hashTableSizeMB = 10 * 128;
         nfs."/" = inputs.topInputs.self.config.dns."chn.moe".getAddress "wg1.pc";
+        nix-serve.hostname = "nix-store.nas.chn.moe";
       };
     };
   };

devices/nas/secrets.yaml

@@ -1,6 +1,8 @@
 xray-client:
     uuid: ENC[AES256_GCM,data:97aX07G5FPumdWcDxnYOs6fRgljXWuwyNXGg1d7zdbUUfNnb,iv:+wAC/DZXsg+evYFA4DMfLw5Ut3ExQl1RgZ/2AsNQDpo=,tag:ebD77muITHof+FQMydWobg==,type:str]
 wireguard: ENC[AES256_GCM,data:JaOSq474mGOoQQcdJ/j9fYo2e1vjXMPxJ69TOd079FrSkbzbIteWww5f8Xo=,iv:uy/NC2+tibL61XJDZK/spKjV9u0oXK4YzjFjYmCAL0k=,tag:en+c8cHaPvDqJL+EpQjr0g==,type:str]
+store:
+    signingKey: ENC[AES256_GCM,data:P6N53f5LQObXW63yciSB11XMFtUlJsp1ZhPs/Wqt5iMR9pxI6CNa92CKWzGJFHvBGQ0ORjY9Qz928lEp9AOSpOsGwUhUFfm1QTKVIg8DTzcBuojIwCHUQAxPbVw=,iv:3RVKj7JZLWDyEjup4UgDj/9OT1Mxs5ouu+kFicBFhDY=,tag:EfwoT/2NfGu9sJbmRylSRQ==,type:str]
 sops:
     age:
         - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
@@ -21,7 +23,7 @@ sops:
             by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
             kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-19T01:47:25Z"
-    mac: ENC[AES256_GCM,data:J79zVjfGgptSjh+ShPBOd+lJ9i+NuS2Uw7P4ZvF7xeahn7fbT8bercsBv1F1USwW2ituTBMZFmxaspGjAD+azEM2X7zSJnVtbKr+T9FY6i2N+kPIxdseyw93JLZ1pPTy9bQeXRAJYlJHyEw4zHEpMBbWSI88I+i43s2xkScwEuU=,iv:4Ge0dHPxa4zF++0eeHy8fH7t5ndFznhFAKnrV7WOOXs=,tag:+UG3b93zFo/EfOfCQrPoBg==,type:str]
+    lastmodified: "2025-06-02T06:24:12Z"
+    mac: ENC[AES256_GCM,data:slnXbWsxKYIh0nocX+yjVlCNJ97ieeNF9IRSsUZ3XiSQJEmhW9TQ3Eb8TpvcTYpEkyXrb3b8Z3Lw79VTe3L64/TA+DYzpxfzo0E5CWQBRNSbHoL46FLLjc7sEmW+IiGdzoLUeOPDbYPKYIGfGxymPfuO+Wp3t42kxfWuXs3KiMQ=,iv:I1kRJ8SUQaFNIPFjcCGKvkyr2t7G8TN+WJOksP8Onbs=,tag:m1qMyGWpBwJ8yxyuxLHVJQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

devices/one/default.nix

@@ -20,7 +20,6 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "tigerlake";
-        kernel.variant = "cachyos-lts";
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =

devices/pc/default.nix

@@ -80,22 +80,16 @@ inputs:
           # TODO: remove on next month
           xray =
           {
-            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.srv3";
-            serverName = "xserver.srv3.chn.moe";
+            serverAddress = inputs.topInputs.self.config.dns."chn.moe".getAddress "xserver.vps4";
+            serverName = "xserver.vps4.chn.moe";
           };
           dnsmasq.hosts = builtins.listToAttrs
           (
             (builtins.map
               (name: { inherit name; value = "144.34.225.59"; })
               [ "mirism.one" "beta.mirism.one" "ng01.mirism.one" "initrd.vps6.chn.moe" ])
-            ++ (builtins.map
-              (name: { inherit name; value = "0.0.0.0"; })
-              [ "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com" ])
           )
-          // {
-            "4006024680.com" = "192.168.199.1";
-            "hpc.xmu.edu.cn" = "121.192.191.11";
-          };
+          // { "4006024680.com" = "192.168.199.1"; };
         };
         acme.cert."debug.mirism.one" = {};
         nix-serve = {};
@@ -129,7 +123,7 @@ inputs:
         nfs."/" = "192.168.84.0/24";
       };
       bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
-      packages = { android-studio = {}; mathematica = {}; vasp = {}; };
+      packages = { android-studio = {}; mathematica = {}; vasp = {}; lammps = {}; };
       user.users = [ "chn" "test" ];
     };
     boot.loader.grub =
@@ -164,7 +158,6 @@ inputs:
     services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
     # 允许kvm读取物理硬盘
     users.users.qemu-libvirtd.extraGroups = [ "disk" ];
-    networking.extraHosts = "144.34.225.59 mirism.one beta.mirism.one ng01.mirism.one";
     services.colord.enable = true;
   };
 }

devices/srv1/node0/default.nix

@@ -8,10 +8,15 @@ inputs:
       system =
       {
         nixpkgs.march = "cascadelake";
-        networking.static =
+        network =
         {
-          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
-          eno146 = { ip = "192.168.178.1"; mask = 24; };
+          static =
+          {
+            eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+            eno146 = { ip = "192.168.178.1"; mask = 24; };
+          };
+          masquerade = [ "eno146" ];
+          trust = [ "eno146" ];
         };
       };
       services =
@@ -23,10 +28,5 @@ inputs:
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
     };
-    # allow other machine access network by this machine
-    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
-    # without this, tproxy does not work
-    # TODO: why?
-    networking.firewall.trustedInterfaces = [ "eno146" ];
   };
 }

devices/srv1/node1/default.nix

@@ -7,13 +7,14 @@ inputs:
       system =
       {
         nixpkgs.march = "broadwell";
-        networking.static.eno2 =
-          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        network =
+        {
+          static.eno2 =
+            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+          trust = [ "eno2" ];
+        };
       };
       services.beesd."/".threads = 4;
     };
-    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv1/node2/default.nix

@@ -7,10 +7,15 @@ inputs:
       system =
       {
         nixpkgs.march = "broadwell";
-        networking.static =
+        network =
         {
-          br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
-          eno2 = { ip = "192.168.178.3"; mask = 24; };
+          static =
+          {
+            br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
+            eno2 = { ip = "192.168.178.3"; mask = 24; };
+          };
+          trust = [ "eno2" ];
+          bridge.br0.interfaces = [ "eno1" ];
         };
         fileSystems.mount.btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
           { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
@@ -22,11 +27,5 @@ inputs:
         kvm.nodatacow = true;
       };
     };
-    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "eno2" ];
-    # add a bridge for kvm
-    # 设置桥接之后，不能再给eno1配置ip，需要转而给 br0 配置ip
-    networking.bridges.br0.interfaces = [ "eno1" ];
   };
 }

devices/srv2/default.nix

@@ -80,7 +80,7 @@ inputs:
           };
         };
       };
-      packages.vasp = {};
+      packages = { vasp = {}; mumax = {}; lammps = {}; };
       user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
     };
   };

devices/srv2/node0/default.nix

@@ -9,10 +9,12 @@ inputs:
       system =
       {
         nixpkgs.march = "skylake";
-        networking =
+        network =
         {
           static.eno2 = { ip = "192.168.178.1"; mask = 24; };
           wireless = [ "457的5G" ];
+          # masquerade = [ "eno2" ];
+          trust = [ "eno2" ];
         };
       };
       services =
@@ -29,9 +31,5 @@ inputs:
         ollama = {};
       };
     };
-    # allow other machine access network by this machine
-    systemd.network.networks."10-eno2".networkConfig.IPMasquerade = "both";
-    # without this, tproxy does not work
-    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv2/node1/default.nix

@@ -8,14 +8,15 @@ inputs:
       system =
       {
         nixpkgs.march = "znver3";
-        networking.static.enp58s0 =
-          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        network =
+        {
+          static.enp58s0 =
+            { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+          trust = [ "enp58s0" ];
+        };
       };
       services.beesd."/".hashTableSizeMB = 64;
     };
     services.hardware.bolt.enable = true;
-    boot.initrd.systemd.network.networks."10-enp58s0" = inputs.config.systemd.network.networks."10-enp58s0";
-    # make slurm sub process to be able to communicate with the master
-    networking.firewall.trustedInterfaces = [ "enp58s0" ];
   };
 }

devices/srv3/default.nix

@@ -19,12 +19,16 @@ inputs:
         };
         nixpkgs.march = "haswell";
         initrd.sshd = {};
-        networking.static.eno1 =
+        network =
         {
-          ip = "23.135.236.216";
-          mask = 24;
-          gateway = "23.135.236.1";
-          dns = "8.8.8.8";
+          bridge.nixvirt.interfaces = [ "eno1" ];
+          static.nixvirt =
+          {
+            ip = "23.135.236.216";
+            mask = 24;
+            gateway = "23.135.236.1";
+            dns = "8.8.8.8";
+          };
         };
       };
       hardware.cpus = [ "intel" ];
@@ -36,12 +40,14 @@ inputs:
         {
           alikia =
           {
-            hardware = { memoryMB = 1024; cpus = 1; };
+            memory.sizeMB = 1024;
+            cpu.count = 1;
             network = { address = 2; portForward.tcp = [{ host = 5689; guest = 22; }]; };
           };
           pen =
           {
-            hardware = { memoryMB = 512; cpus = 1; };
+            memory.sizeMB = 512;
+            cpu.count = 1;
             network =
             {
               address = 3;
@@ -62,7 +68,8 @@ inputs:
           test =
           {
             owner = "chn";
-            hardware = { memoryMB = 512; cpus = 1; };
+            memory.sizeMB = 512;
+            cpu.count = 1;
             network =
             {
               address = 4;
@@ -72,7 +79,8 @@ inputs:
           };
           reonokiy =
           {
-            hardware = { memoryMB = 4 * 1024; cpus = 4; };
+            memory.sizeMB = 4 * 1024;
+            cpu.count = 4;
             network = { address = 5; portForward.tcp = [{ host = 5694; guest = 22; }]; };
           };
         };
@@ -87,7 +95,7 @@ inputs:
         vaultwarden.enable = true;
         photoprism.enable = true;
         nextcloud = {};
-        freshrss.enable = true;
+        freshrss = {};
         send = {};
         huginn = {};
         httpapi.enable = true;
@@ -102,7 +110,5 @@ inputs:
       };
       user.users = [ "chn" "aleksana" "alikia" "pen" "reonokiy" ];
     };
-    # TODO: use a generic way
-    boot.initrd.systemd.network.networks."10-eno1" = inputs.config.systemd.network.networks."10-eno1";
   };
 }

devices/test-pc-vm/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "znver4";
-        networking = {};
+        network = {};
       };
       hardware.cpus = [ "amd" ];
       services.sshd = {};

devices/test-pc/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "znver4";
-        networking = {};
+        network = { dhcp = [ "nixvirt" ]; bridge.nixvirt.interfaces = [ "enp1s0" ]; };
       };
       hardware.cpus = [ "amd" ];
       services =
@@ -29,17 +29,19 @@ inputs:
           {
             chn =
             {
-              hardware = { memoryMB = 2048; cpus = 4; };
+              memory = { sizeMB = 2048; dedicated = true; };
+              cpu = { count = 4; set = builtins.genList builtins.toString 4; };
               network =
               {
-                address = 2;
-                portForward = { tcp = [{ host = 5693; guest = 22; }]; web = [ "example.chn.moe" ]; };
+                bridge = true;
+                vnc.port = 15901;
               };
             };
             chn2 =
             {
               owner = "chn";
-              hardware = { memoryMB = 2048; cpus = 4; };
+              memory.sizeMB = 2048;
+              cpu.count = 4;
               network = { address = 3; portForward.tcp = [{ host = 5694; guest = 22; }]; };
             };
           };

devices/test/default.nix

@@ -16,7 +16,7 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "haswell";
-        networking = {};
+        network = {};
       };
       hardware.cpus = [ "intel" ];
       services =

devices/vps4/default.nix

@@ -22,13 +22,12 @@ inputs:
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
         nixpkgs.march = "znver2";
         initrd.sshd = {};
-        networking = {};
+        network = {};
       };
       services =
       {
         sshd = {};
         fail2ban = {};
-        beesd."/".hashTableSizeMB = 64;
         xray.server.serverName = "xserver.vps4.chn.moe";
       };
     };

devices/vps6/default.nix

@@ -22,8 +22,7 @@ inputs:
         grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
         nixpkgs.march = "znver2";
         initrd.sshd = {};
-        networking = {};
-        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
+        network = {};
       };
       services =
       {
@@ -63,10 +62,5 @@ inputs:
         beesd."/" = {};
       };
     };
-    specialisation.generic.configuration =
-    {
-      nixos.system.nixpkgs.march = inputs.lib.mkForce null;
-      system.nixos.tags = [ "generic" ];
-    };
   };
 }

doc/todo.md

@@ -1,6 +1,5 @@
-* 完善 slurm 文档，调整 slurm 设置：内存，nice
-* 调整 sbatch-tui 选项
-* 打包 cachyos
+* 测试 vasp
+* 测试 huggin rsshub
 * 打包 intel 编译器
 * 切换到 niri，清理 plasma
 * 调整其它用户的 zsh 配置

flake.lock

@@ -3,12 +3,12 @@
     "blog": {
       "flake": false,
       "locked": {
-        "lastModified": 1748496213,
+        "lastModified": 1748787595,
         "lfs": true,
-        "narHash": "sha256-yoJ8G3ZmYu/qdDBckj/qz5ErOtpBlqHBqxMaL3ZTKuI=",
+        "narHash": "sha256-FFkwHb9DEdBjBaaH6JuhlmpP7ReSEWTy79P3i/eH708=",
         "ref": "refs/heads/public",
-        "rev": "005a0715053936815c5e4be26236915d915d81c2",
-        "revCount": 29,
+        "rev": "d9020a59f07f7ced60c854f324df8879b249e8b6",
+        "revCount": 32,
         "type": "git",
         "url": "https://git.chn.moe/chn/blog-public.git"
       },
@@ -38,18 +38,23 @@
         "type": "github"
       }
     },
-    "cachyos-lts": {
+    "buildproxy": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1743535541,
-        "narHash": "sha256-OlBtXY26w9OcAmpqrTvxaG4/rfDdavauQF2eRxb+ySs=",
-        "owner": "drakon64",
-        "repo": "nixos-cachyos-kernel",
-        "rev": "8516d89c4e0c4a25cea1be8431db3963359ee81b",
+        "lastModified": 1709212359,
+        "narHash": "sha256-La70ax79Hrp/Vz2G3gzI4fLgRd2z3lJrYLvCf+xcTj4=",
+        "owner": "polygon",
+        "repo": "nix-buildproxy",
+        "rev": "c26d73992ddae96812501b5ae1cc45037d8b10be",
         "type": "github"
       },
       "original": {
-        "owner": "drakon64",
-        "repo": "nixos-cachyos-kernel",
+        "owner": "polygon",
+        "repo": "nix-buildproxy",
         "type": "github"
       }
     },
@@ -713,16 +718,17 @@
     "openxlsx": {
       "flake": false,
       "locked": {
-        "lastModified": 1745313465,
-        "narHash": "sha256-HOYgrF3eU8yZIML6Soz7MHXlHpM4TB71zM/IGzwLHRY=",
+        "lastModified": 1716560554,
+        "narHash": "sha256-Aqn1830lG4g7BbwEeePhvGawLarmrIMnF2MXROTUBCw=",
         "owner": "troldal",
         "repo": "OpenXLSX",
-        "rev": "86af3b043f6b13b09e591a920a49ea1f9724d4a1",
+        "rev": "f85f7f1bd632094b5d78d4d1f575955fc3801886",
         "type": "github"
       },
       "original": {
         "owner": "troldal",
         "repo": "OpenXLSX",
+        "rev": "f85f7f1bd632094b5d78d4d1f575955fc3801886",
         "type": "github"
       }
     },
@@ -824,7 +830,7 @@
       "inputs": {
         "blog": "blog",
         "bscpkgs": "bscpkgs",
-        "cachyos-lts": "cachyos-lts",
+        "buildproxy": "buildproxy",
         "catppuccin": "catppuccin",
         "concurrencpp": "concurrencpp",
         "cppcoro": "cppcoro",
@@ -860,6 +866,7 @@
         "rycee": "rycee",
         "sops-nix": "sops-nix",
         "sqlite-orm": "sqlite-orm",
+        "sticker": "sticker",
         "stickerpicker": "stickerpicker",
         "tgbot-cpp": "tgbot-cpp",
         "ufo": "ufo",
@@ -936,6 +943,24 @@
         "type": "github"
       }
     },
+    "sticker": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1748842256,
+        "lfs": true,
+        "narHash": "sha256-os0NWrft+N/HFy/+WRWup4fOHZLSLHANejih7qdXPxA=",
+        "ref": "refs/heads/main",
+        "rev": "2826c739c5602c5998afdcb3d041d521a214429a",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://git.chn.moe/chn/sticker.git"
+      },
+      "original": {
+        "lfs": true,
+        "type": "git",
+        "url": "https://git.chn.moe/chn/sticker.git"
+      }
+    },
     "stickerpicker": {
       "flake": false,
       "locked": {

flake.nix

@@ -26,8 +26,8 @@
     };
     catppuccin = { url = "github:catppuccin/nix"; inputs.nixpkgs.follows = "nixpkgs"; };
     bscpkgs = { url = "github:CHN-beta/bscpkgs"; inputs.nixpkgs.follows = "nixpkgs"; };
-    cachyos-lts.url = "github:drakon64/nixos-cachyos-kernel";
     nixvirt = { url = "github:CHN-beta/NixVirt"; inputs.nixpkgs.follows = "nixpkgs"; };
+    buildproxy = { url = "github:polygon/nix-buildproxy"; inputs.nixpkgs.follows = "nixpkgs"; };
 
     misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
     rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -42,7 +42,7 @@
     rycee = { url = "gitlab:rycee/nur-expressions"; flake = false; };
     lepton = { url = "github:black7375/Firefox-UI-Fix"; flake = false; };
     mumax = { url = "github:CHN-beta/mumax"; flake = false; };
-    openxlsx = { url = "github:troldal/OpenXLSX"; flake = false; };
+    openxlsx = { url = "github:troldal/OpenXLSX?rev=f85f7f1bd632094b5d78d4d1f575955fc3801886"; flake = false; };
     sqlite-orm = { url = "github:fnc12/sqlite_orm"; flake = false; };
     nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
     hextra = { url = "github:imfing/hextra"; flake = false; };
@@ -57,6 +57,7 @@
     fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
     mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme?lfs=1"; flake = false; };
     phono3py = { url = "github:phonopy/phono3py"; flake = false; };
+    sticker = { url = "git+https://git.chn.moe/chn/sticker.git?lfs=1"; flake = false; };
   };
 
   outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in

flake/branch.nix

@@ -1 +1 @@
-"next"
+"production"

flake/dns/config/chn.moe.nix

@@ -22,6 +22,7 @@ let
     srv1-node0 = [ "srv1" ];
     srv2-node0 = [ "srv2" ];
     "wg1.pc" = [ "nix-store" ];
+    "wg1.nas" = [ "nix-store.nas" ];
   };
   a =
   {

flake/packages.nix

@@ -23,7 +23,6 @@
       version = inputs.self.rev or "dirty";
       stdenv = pkgs.pkgsStatic.gcc14Stdenv;
     };
-  inherit (pkgs.localPackages) blog;
   inherit (pkgs.localPackages.pkgsStatic) chn-bsub;
   vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
   {

flake/src.nix

@@ -134,4 +134,12 @@
       "intel.oneapi.lin.compilers-common,v=2025.1.1+10"
     ];
   };
+  rsshub =  pkgs.dockerTools.pullImage
+  {
+    imageName = "diygod/rsshub";
+    imageDigest = "sha256:1f9d97263033752bf5e20c66a75e134e6045b6d69ae843c1f6610add696f8c22";
+    hash = "sha256-zN47lhQc3EX28LmGF4N3rDUPqumwmhfGn1OpvBYd2Vw=";
+    finalImageName = "rsshub";
+    finalImageTag = "latest";
+  };
 }

modules/model.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.model = let inherit (inputs.lib) mkOption types; in
   {
     hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
+    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
     private = mkOption { type = types.bool; default = false; };
     cluster = mkOption
     {

modules/packages/android-studio.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.android-studio = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) android-studio; in inputs.lib.mkIf (android-studio != null)
   {
     nixos.packages.packages._packages = with inputs.pkgs; [ androidStudioPackages.stable.full ];

modules/packages/chromium.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.chromium = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) chromium; in inputs.lib.mkIf (chromium != null)
   {

modules/packages/desktop.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.desktop = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) desktop; in inputs.lib.mkIf (desktop != null)
   {
@@ -56,8 +56,7 @@ inputs:
           # matplot++ needs old gnuplot
           inputs.pkgs.pkgs-2311.gnuplot
           # math, physics and chemistry
-          octaveFull ovito localPackages.vesta localPackages.v-sim mpi geogebra6 localPackages.ufo
-          inputs.pkgs.pkgs-2311.hdfview qalculate-qt
+          octaveFull mpi geogebra6 qalculate-qt
           # virtualization
           bottles wineWowPackages.stagingFull
           # media
@@ -67,7 +66,7 @@ inputs:
         ];
         _pythonPackages = [(pythonPackages: with pythonPackages;
         [
-          phonopy scipy scikit-learn jupyterlab autograd inputs.pkgs.localPackages.phono3py numpy 
+          scipy scikit-learn jupyterlab autograd numpy 
         ])];
       };
       user.sharedModules =
@@ -86,9 +85,15 @@ inputs:
                   inherit (inputs.topInputs) nixos-wallpaper;
                   isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
                     [ "png" "jpg" "jpeg" "webp" ];
+                  listDirRecursive =
+                    let listDir = dir:
+                      if dir.value == "directory" then builtins.concatLists
+                        (builtins.map (f: listDir f) (inputs.localLib.attrsToList (builtins.readDir dir.name)))
+                      else [ dir ];
+                    in dir: listDir { name = dir; value = "directory"; };
                 in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
                   (builtins.filter (f: (isPicture f.name) && (f.value == "regular"))
-                    (inputs.localLib.attrsToList (builtins.readDir nixos-wallpaper))));
+                    (listDirRecursive nixos-wallpaper)));
             };
             powerdevil =
               let config =

modules/packages/firefox.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.firefox = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) firefox; in inputs.lib.mkIf (firefox != null)
   {

modules/packages/lammps.nix

@@ -1,22 +1,23 @@
 inputs:
 {
   options.nixos.packages.lammps = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
   {
-    nixos.packages.packages._packages =
-      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
-      in
-        if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
-          .overrideAttrs (prev:
-          {
-            cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
-            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
-            buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
-          }))]
-        else [ inputs.pkgs.lammps-mpi ];
+    nixos.packages =
+    {
+      molecule = {};
+      packages._packages =
+        let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
+        in
+          if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
+            .overrideAttrs (prev:
+            {
+              cmakeFlags = prev.cmakeFlags ++ [ "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD" ];
+              nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.cudaPackages.cudatoolkit ];
+              buildInputs = prev.buildInputs ++ [ inputs.pkgs.mpi ];
+            }))]
+          else [ inputs.pkgs.lammps-mpi ];
+    };
   };
 }

modules/packages/mathematica.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.mathematica = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) mathematica; in inputs.lib.mkIf (mathematica != null)
     { nixos.packages.packages._packages = [ inputs.pkgs.mathematica ]; };
 }

modules/packages/minimal.nix

@@ -1,8 +1,8 @@
 inputs:
 {
-  options.nixos.packages.server = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.packages.minimal = let inherit (inputs.lib) mkOption types; in mkOption
     { type = types.nullOr (types.submodule {}); default = {}; };
-  config = let inherit (inputs.config.nixos.packages) server; in inputs.lib.mkIf (server != null)
+  config = let inherit (inputs.config.nixos.packages) minimal; in inputs.lib.mkIf (minimal != null)
   {
     nixos.packages.packages =
     {
@@ -42,13 +42,6 @@ inputs:
         pdfgrep ffmpeg-full hdf5
       ]
         ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
-      _pythonPackages = [(pythonPackages: with pythonPackages;
-      [
-        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
-        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus odfpy
-        # for vasp plot-workfunc.py
-        ase
-      ])];
     };
     programs =
     {

modules/packages/molecule.nix

@@ -0,0 +1,20 @@
+inputs:
+{
+  options.nixos.packages.molecule = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) molecule; in inputs.lib.mkIf (molecule != null)
+  {
+    nixos.packages.packages =
+    {
+      _packages = with inputs.pkgs;
+        [ ovito localPackages.vesta localPackages.v-sim localPackages.ufo inputs.pkgs.pkgs-2311.hdfview ];
+      _pythonPackages = [(pythonPackages: with pythonPackages;
+      [
+        phonopy inputs.pkgs.localPackages.phono3py
+      ])];
+    };
+  };
+}

modules/packages/mumax.nix

@@ -1,14 +1,7 @@
 inputs:
 {
   options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default =
-      if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
-        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
-      then {}
-      else null;
-  };
+    { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
   {
     nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];

modules/packages/nushell.nix

@@ -1,10 +1,7 @@
 inputs:
 {
   options.nixos.packages.nushell = let inherit (inputs.lib) mkOption types; in mkOption
-  {
-    type = types.nullOr (types.submodule {});
-    default = {};
-  };
+    { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.packages) nushell; in inputs.lib.mkIf (nushell != null)
   {
     nixos =

modules/packages/steam.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.steam = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) steam; in inputs.lib.mkIf (steam != null)
   {

modules/packages/vasp.nix

@@ -4,16 +4,20 @@ inputs:
     { type = types.nullOr (types.submodule {}); default = null; };
   config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
   {
-    nixos.packages.packages = with inputs.pkgs;
+    nixos.packages =
     {
-      _packages =
-      (
-        [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
-          ++ (inputs.lib.optional
-            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
-            localPackages.vasp.nvidia)
-      );
-      _pythonPackages = [(_: [ localPackages.py4vasp ])];
+      molecule = {};
+      packages = with inputs.pkgs;
+      {
+        _packages =
+        (
+          [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
+            ++ (inputs.lib.optional
+              (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
+              localPackages.vasp.nvidia)
+        );
+        _pythonPackages = [(_: [ localPackages.py4vasp ])];
+      };
     };
   };
 }

modules/packages/vscode.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.packages.vscode = let inherit (inputs.lib) mkOption types; in mkOption
   {
     type = types.nullOr (types.submodule {});
-    default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    default = if inputs.config.nixos.model.type == "desktop" then {} else null;
   };
   config = let inherit (inputs.config.nixos.packages) vscode; in inputs.lib.mkIf (vscode != null)
   {

modules/services/freshrss.nix

@@ -1,52 +1,33 @@
 inputs:
 {
-  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.freshrss = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) freshrss;
-      inherit (inputs.lib) mkIf;
-    in mkIf freshrss.enable
+    type = types.nullOr (types.submodule { options =
     {
-      services.freshrss =
-      {
-        enable = true;
-        baseUrl = "https://${freshrss.hostname}";
-        defaultUser = "chn";
-        passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
-        database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
-        virtualHost = null;
-      };
-      sops.secrets =
-      {
-        "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
-        "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
-      };
-      systemd.services.freshrss-config.after = [ "mysql.service" ];
-      nixos.services =
-      {
-        mariadb = { enable = true; instances.freshrss = {}; };
-        nginx.https.${freshrss.hostname} =
-        {
-          location =
-          {
-            "/".static =
-            {
-              root = "${inputs.pkgs.freshrss}/p";
-              index = [ "index.php" ];
-              tryFiles = [ "$uri" "$uri/" "$uri/index.php" ];
-            };
-            "~ ^.+?\.php(/.*)?$".php =
-            {
-              root = "${inputs.pkgs.freshrss}/p";
-              fastcgiPass =
-                "unix:${inputs.config.services.phpfpm.pools.${inputs.config.services.freshrss.pool}.socket}";
-            };
-          };
-        };
-      };
+      hostname = mkOption { type = types.str; default = "freshrss.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) freshrss; in inputs.lib.mkIf (freshrss != null)
+  {
+    services.freshrss =
+    {
+      enable = true;
+      baseUrl = "https://${freshrss.hostname}";
+      defaultUser = "chn";
+      passwordFile = inputs.config.sops.secrets."freshrss/chn".path;
+      database = { type = "mysql"; passFile = inputs.config.sops.secrets."freshrss/db".path; };
     };
+    sops.secrets =
+    {
+      "freshrss/chn".owner = inputs.config.users.users.freshrss.name;
+      "freshrss/db" = { owner = inputs.config.users.users.freshrss.name; key = "mariadb/freshrss"; };
+    };
+    systemd.services.freshrss-config.after = [ "mysql.service" ];
+    nixos.services =
+    {
+      mariadb = { enable = true; instances.freshrss = {}; };
+      nginx.https.${freshrss.hostname}.global.configName = "freshrss";
+    };
+  };
 }

modules/services/nextcloud.nix

@@ -57,7 +57,7 @@ inputs:
           };
         in builtins.listToAttrs (builtins.map
           (package: { name = package; value = inputs.pkgs.fetchNextcloudApp (getInfo package); })
-          [ "maps" "phonetrack" "twofactor_webauthn" "calendar" ]);
+          [ "phonetrack" "twofactor_webauthn" "calendar" ]);
     };
     nixos.services =
     {

modules/services/nginx/applications/sticker.nix

@@ -11,7 +11,7 @@ inputs:
         mkdir -p $out
         cp -r ${inputs.topInputs.stickerpicker}/web/* $out
         chmod -R +w $out
-        cp -r ${./web}/* $out
+        cp -r ${inputs.topInputs.sticker}/web/* $out
       '');
       index = [ "index.html" ];
     };

modules/services/nginx/applications/sticker/.gitignore

@@ -1,2 +0,0 @@
-/config.json
-/sticker-import.session

modules/services/nginx/applications/sticker/web/packs/index.json

@@ -1,19 +0,0 @@
-{
-  "packs": [
-    "Mare_by_WuMingv2Bot.json",
-    "line_191054124446_by_moe_sticker_bot.json",
-    "Sakurada_Shiro.json",
-    "loli_DaiSi_by_WuMingv2Bot.json",
-    "listentoweiwei_by_WuMingv2Bot.json",
-    "csaexi.json",
-    "wechat_transfer_zhcn.json",
-    "teamtimothy_bilibili.json",
-    "line26158619ac0d_by_moe_sticker_bot.json",
-    "LINE_nachonekodayo.json",
-    "zhehelima.json",
-    "TheDonaldTrump.json",
-    "line_173195293297_by_moe_sticker_bot.json",
-    "line261586194a0d_by_moe_sticker_bot.json"
-  ],
-  "homeserver_url": "https://matrix.chn.moe"
-}

modules/services/nixvirt.nix

@@ -1,4 +1,3 @@
-# TODO: fix libvirtd network
 inputs:
 {
   options.nixos.services.nixvirt = let inherit (inputs.lib) mkOption types; in mkOption
@@ -19,19 +18,31 @@ inputs:
           {
             uuid = mkOption { type = types.nonEmptyStr; default = defaultUuid; };
             owner = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-            hardware =
+            storage =
             {
-              storage = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
-              memoryMB = mkOption { type = types.ints.unsigned; };
-              cpus = mkOption { type = types.ints.unsigned; };
-              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
+              name = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
+              nodatacow = mkOption { type = types.bool; default = false; };
+            };
+            memory =
+            {
+              sizeMB = mkOption { type = types.ints.unsigned; };
+              dedicated = mkOption { type = types.bool; default = false; };
+            };
+            cpu =
+            {
+              count = mkOption { type = types.ints.unsigned; };
+              hyprthread = mkOption { type = types.bool; default = false; };
+              set = mkOption { type = types.nullOr (types.nonEmptyListOf types.nonEmptyStr); default = null; };
             };
             network =
             {
-              address = mkOption { type = types.ints.unsigned; };
+              mac = mkOption { type = types.nonEmptyStr; default = defaultMac; };
+              address = mkOption { type = types.nullOr types.ints.unsigned; default = null; };
+              bridge = mkOption { type = types.bool; default = false; };
               vnc =
               {
-                port = mkOption { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
+                port = mkOption
+                  { type = types.ints.unsigned; default = 15900 + submoduleInputs.config.network.address; };
                 openFirewall = mkOption { type = types.bool; default = true; };
               };
               portForward = rec
@@ -54,6 +65,13 @@ inputs:
   };
   config = let inherit (inputs.config.nixos.services) nixvirt; in inputs.lib.mkIf (nixvirt != null)
   {
+    assertions = builtins.map
+      (vm:
+      {
+        assertion = vm.value.cpu.set != null -> builtins.length vm.value.cpu.set == vm.value.cpu.count;
+        message = "nixvirt.instance.${vm.name}.cpu.set must have the same length as cpu.count";
+      })
+      (inputs.localLib.attrsToList nixvirt.instance);
     virtualisation =
     {
       libvirt =
@@ -63,7 +81,12 @@ inputs:
         connections."qemu:///system" = let inherit (inputs.topInputs.nixvirt) lib; in
         {
           domains = builtins.map
-            (vm: { definition = inputs.config.sops.templates."${vm.name}.xml".path; active = true; restart = false; })
+            (vm:
+            {
+              definition = inputs.config.sops.templates."nixvirt/${vm.name}.xml".path;
+              active = true;
+              restart = false;
+            })
             (inputs.localLib.attrsToList nixvirt.instance);
           networks =
           [{
@@ -74,10 +97,10 @@ inputs:
                 host = builtins.map
                   (vm:
                   {
-                    inherit (vm.hardware) mac;
+                    inherit (vm.network) mac;
                     ip = "192.168.${builtins.toString nixvirt.subnet}.${builtins.toString vm.network.address}";
                   })
-                  (builtins.attrValues nixvirt.instance);
+                  (builtins.filter (vm: vm.network.address != null) (builtins.attrValues nixvirt.instance));
               in lib.network.writeXML (base // { ip = base.ip // { dhcp = base.ip.dhcp // { inherit host; }; }; });
             active = true;
             # never restart the network
@@ -126,50 +149,113 @@ inputs:
       templates = builtins.listToAttrs (builtins.map
         (vm:
         {
-          name = "${vm.name}.xml";
-          value.content =
-            let
-              inherit (inputs.topInputs.nixvirt) lib;
-              base = lib.domain.templates.linux
-              {
-                inherit (vm) name;
-                inherit (vm.value) uuid;
-                memory = { count = vm.value.hardware.memoryMB; unit = "MiB"; };
-                storage_vol = "/var/lib/libvirt/images/${vm.value.hardware.storage}.img";
-                install_vol = "${inputs.topInputs.self.src.iso.netboot}";
-                virtio_video = false;
-              };
-            in lib.domain.getXML (base //
+          name = "nixvirt/${vm.name}.xml";
+          value.content = inputs.topInputs.nixvirt.lib.domain.getXML
+          # port from 8bcc23e27a62297254d0e9c87281e650ff777132
+          {
+            inherit (vm) name;
+            inherit (vm.value) uuid;
+            type = "kvm";
+            vcpu = { placement = "static"; count = vm.value.cpu.count; };
+            cputune = inputs.lib.optionalAttrs (vm.value.cpu.set != null)
             {
-              devices =
-                # remove spicevmc, which needs spice
-                (builtins.removeAttrs base.devices [ "channel" "redirdev" "sound" "audio" ])
-                // {
-                  graphics =
-                  {
-                    type = "vnc";
-                    autoport = false;
-                    port = vm.value.network.vnc.port;
-                    listen.type = "address";
-                    passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
-                  };
-                  interface = base.devices.interface // { mac.address = vm.value.hardware.mac; };
-                  disk = builtins.map (disk: disk // { driver = disk.driver // { type = "raw"; }; }) base.devices.disk;
-                };
-              cpu = base.cpu // { topology = { sockets = 1; dies = 1; cores = vm.value.hardware.cpus; threads = 1; };};
-              vcpu = { placement = "static"; count = vm.value.hardware.cpus; };
-              os = (builtins.removeAttrs base.os [ "boot" ]) //
+              vcpupin = builtins.genList
+                (cpu: { vcpu = cpu; cpuset = builtins.elemAt vm.value.cpu.set cpu; })
+                vm.value.cpu.count;
+            };
+            memory =
+            {
+              count = vm.value.memory.sizeMB;
+              unit = "MiB";
+              nosharepages = vm.value.memory.dedicated;
+              locked = vm.value.memory.dedicated;
+            };
+            os =
+            {
+              type = "hvm";
+              arch = "x86_64";
+              machine = "q35";
+              bootmenu = { enable = true; timeout = 15000; };
+              loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
+              nvram =
               {
-                loader = { readonly = true; type = "pflash"; path = "/run/libvirt/nix-ovmf/OVMF_CODE.fd"; };
-                nvram =
-                {
-                  template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
-                  path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
-                  templateFormat = "raw";
-                  format = "raw";
-                };
+                template = "/run/libvirt/nix-ovmf/OVMF_VARS.fd";
+                path = "/var/lib/libvirt/qemu/nvram/${vm.name}_VARS.fd";
+                templateFormat = "raw";
+                format = "raw";
               };
-            });
+            };
+            features = { acpi = {}; apic = {}; };
+            cpu =
+            {
+              mode = "host-passthrough";
+              topology =
+              {
+                sockets = 1;
+                dies = 1;
+                cores = if vm.value.cpu.hyprthread then vm.value.cpu.count / 2 else vm.value.cpu.count;
+                threads = if vm.value.cpu.hyprthread then 2 else 1;
+              };
+            };
+            clock =
+            {
+              offset = "utc";
+              timer =
+              [
+                { name = "rtc"; tickpolicy = "catchup"; }
+                { name = "pit"; tickpolicy = "delay"; }
+                { name = "hpet"; present = false; }
+              ];
+            };
+            devices =
+            {
+              emulator = "${inputs.config.virtualisation.libvirtd.qemu.package}/bin/qemu-system-x86_64";
+              disk =
+              [
+                {
+                  type = "file";
+                  device = "disk";
+                  driver = { name = "qemu"; type = "raw"; cache = "none"; discard = "unmap"; };
+                  source.file = "${if vm.value.storage.nodatacow then "/nix/nodatacow" else ""}/var/lib/libvirt/images/"
+                    + "${vm.value.storage.name}.img";
+                  target = { dev = "vda"; bus = "virtio"; };
+                  boot.order = 1;
+                }
+                {
+                  type = "file";
+                  device = "cdrom";
+                  driver = { name = "qemu"; type = "raw"; };
+                  source.file = "${inputs.topInputs.self.src.iso.netboot}";
+                  target = { dev = "sdc"; bus = "sata"; };
+                  readonly = true;
+                  boot.order = 10;
+                }
+              ];
+              interface =
+              {
+                type = "bridge";
+                model.type = "virtio";
+                mac.address = vm.value.network.mac;
+                source.bridge = if vm.value.network.bridge then "nixvirt" else "virbr0";
+              };
+              input =
+              [
+                { type = "tablet"; bus = "usb"; }
+                { type = "mouse"; bus = "ps2"; }
+                { type = "keyboard"; bus = "ps2"; }
+              ];
+              graphics =
+              {
+                type = "vnc";
+                autoport = false;
+                port = vm.value.network.vnc.port;
+                listen.type = "address";
+                passwd = inputs.config.sops.placeholder."nixvirt/${vm.name}";
+              };
+              video.model = { type = "qxl"; ram = 65536; vram = 65536; vgamem = 16384; heads = 1; primary = true; };
+              rng = { model = "virtio"; backend = { model = "random"; source = /dev/urandom; }; };
+            };
+          };
         })
         (inputs.localLib.attrsToList nixvirt.instance));
       secrets = builtins.listToAttrs (builtins.map
@@ -245,5 +331,10 @@ inputs:
         };
         wantedBy= [ "multi-user.target" ];
       };
+    boot.kernelParams =
+      let cpusets = builtins.concatLists (builtins.map
+        (vm: vm.cpu.set)
+        (builtins.filter (vm: vm.cpu.set != null) (builtins.attrValues nixvirt.instance)));
+      in inputs.lib.mkIf (cpusets != []) [ "isolcpus=${builtins.concatStringsSep "," cpusets}" ];
   };
 }

modules/services/rsshub.nix

@@ -4,41 +4,26 @@ inputs:
   {
     type = types.nullOr (types.submodule { options =
     {
-      hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
+      hostname = mkOption { type = types.str; default = "rsshub.chn.moe"; };
     };});
     default = null;
   };
   config = let inherit (inputs.config.nixos.services) rsshub; in inputs.lib.mkIf (rsshub != null)
   {
-    systemd =
+    virtualisation.oci-containers.containers.rsshub =
     {
-      services.rsshub =
-      {
-        description = "rsshub";
-        after = [ "network.target" "redis-rsshub.service" ];
-        requires = [ "redis-rsshub.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig =
-        {
-          User = "rsshub";
-          Group = "rsshub";
-          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
-          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
-          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
-          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        };
-        restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
-      };
-      tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
+      image = "rsshub:latest";
+      imageFile = inputs.topInputs.self.src.rsshub;
+      ports = [ "127.0.0.1:5221:5221/tcp" ];
+      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
+      environmentFiles = [ inputs.config.sops.templates."rsshub/env".path ];
     };
     sops =
     {
       templates."rsshub/env".content = let placeholder = inputs.config.sops.placeholder; in
       ''
         PORT=5221
-        CACHE_TYPE=redis
-        REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:7116'
+        CACHE_TYPE=memory
         PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
         YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
         YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
@@ -59,15 +44,7 @@ inputs:
         "zhihu-cookies"
       ]));
     };
-    users =
-    {
-      users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
-      groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
-    };
-    nixos.services =
-    {
-      redis.instances.rsshub.port = 7116;
-      nginx = { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
-    };
+    nixos.services.nginx =
+      { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
   };
 }

modules/system/fileSystems/nfs.nix

@@ -13,41 +13,45 @@ inputs:
     ]);
     default = {};
   };
-  config = let inherit (inputs.config.nixos.system.fileSystems.mount) nfs; in inputs.lib.mkIf (nfs != {})
-  {
-    fileSystems = builtins.listToAttrs (builtins.map
-      (device:
+  config =
+    let inherit (inputs.config.nixos.system.fileSystems.mount) nfs;
+    in inputs.lib.mkIf (nfs != {}) (inputs.lib.mkMerge
+    [
       {
-        name = device.value.mountPoint or device.value;
-        value =
+        fileSystems = builtins.listToAttrs (builtins.map
+          (device:
+          {
+            name = device.value.mountPoint or device.value;
+            value =
+            {
+              device = device.name;
+              fsType = "nfs4";
+              neededForBoot = device.value.hard or true;
+              options = builtins.concatLists
+              [
+                # sync every seconds
+                [ "actimeo=1" "noatime" ]
+                # when try to mount at startup, wait 15 minutes before giving up
+                (inputs.lib.optionals (device.value.hard or true) [ "retry=15" "x-systemd.device-timeout=15min" ])
+                # do not fail, just try continuously in background
+                # nfs4 use tcp, tcp itself will retransmit several times, which is enough
+                (inputs.lib.optionals (!(device.value.hard or true))
+                  [ "bg" "soft" "retrans=1" "timeo=20" "softreval" "x-systemd.requires=network-online.target" ])
+              ];
+            };
+          })
+          (inputs.localLib.attrsToList nfs));
+        services.rpcbind.enable = true;
+      }
+      (inputs.lib.mkIf (builtins.any (mount: mount.hard or true) (builtins.attrValues nfs))
+      {
+        boot.initrd.systemd.extraBin =
         {
-          device = device.name;
-          fsType = "nfs4";
-          neededForBoot = device.value.hard or true;
-          options = builtins.concatLists
-          [
-            # sync every seconds
-            [ "actimeo=1" "noatime" ]
-            # when try to mount at startup, wait 15 minutes before giving up
-            (inputs.lib.optionals (device.value.hard or true) [ "retry=15" "x-systemd.device-timeout=15min" ])
-            # do not fail, just try continuously in background
-            # nfs4 use tcp, tcp itself will retransmit several times, which is enough
-            (inputs.lib.optionals (!(device.value.hard or true))
-              [ "bg" "soft" "retrans=1" "timeo=20" "softreval" "x-systemd.requires=network-online.target" ])
-          ];
+          "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+          "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+          "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
         };
+        nixos.system.initrd.network = {};
       })
-      (inputs.localLib.attrsToList nfs));
-    boot.initrd = inputs.lib.mkIf (builtins.any (mount: mount.hard or true) (builtins.attrValues nfs))
-    {
-      network.enable = true;
-      systemd.extraBin =
-      {
-        "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
-        "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
-        "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
-      };
-    };
-    services.rpcbind.enable = true;
-  };
+    ]);
 }

modules/system/font.nix

@@ -1,6 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
   {
     fonts =
     {

modules/system/gui.nix

@@ -3,7 +3,7 @@ inputs:
   config = inputs.lib.mkMerge
   [
     # enable gui
-    (inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+    (inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
     {
       services =
       {

modules/system/initrd.nix

@@ -3,6 +3,15 @@ inputs:
   options.nixos.system.initrd = let inherit (inputs.lib) mkOption types; in
   {
     sshd = mkOption { type = types.nullOr (types.submodule {}); default = null; };
+    network = mkOption
+    {
+      type = types.nullOr (types.submodule { options =
+      {
+        # null: enable all interfaces configured in systemd.network
+        interfaces = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+      };});
+      default = null;
+    };
   };
   config = let inherit (inputs.config.nixos.system) initrd; in inputs.lib.mkMerge
   [
@@ -16,17 +25,54 @@ inputs:
     (
       inputs.lib.mkIf (initrd.sshd != null)
       {
+        boot.initrd.network.ssh =
+          { enable = true; hostKeys = [ "/nix/persistent/etc/ssh/initrd_ssh_host_ed25519_key" ]; };
+        nixos.system.initrd.network = {};
+      }
+    )
+    (
+      inputs.lib.mkIf (initrd.network != null)
+      {
+        assertions =
+        [{
+          assertion = inputs.config.nixos.system.network != null;
+          message = "initrd network requires systemd networkd.";
+        }];
         boot =
         {
           initrd =
           {
-            network =
-            {
-              enable = true;
-              ssh = { enable = true; hostKeys = [ "/nix/persistent/etc/ssh/initrd_ssh_host_ed25519_key" ]; };
-            };
+            network.enable = true;
             # resolved does not work in initrd, causing network.target to fail
             services.resolved.enable = false;
+            systemd.network =
+              let inherit (inputs.config.nixos.system.network) dhcp static bridge; in
+              let
+                networks = inputs.lib.unique
+                (
+                  dhcp ++ (builtins.attrNames static) ++ (builtins.attrNames bridge)
+                  ++ (builtins.concatLists (builtins.map (network: network.interfaces) (builtins.attrValues bridge)))
+                );
+                netdevs = builtins.attrNames bridge;
+              in
+              {
+                networks = builtins.listToAttrs (builtins.map
+                  (network: { name = "10-${network}"; value = inputs.config.systemd.network.networks."10-${network}"; })
+                  (builtins.filter
+                    (network:
+                      if initrd.network.interfaces == null then true
+                      else builtins.elem network initrd.network.interfaces
+                    )
+                    networks));
+                netdevs = builtins.listToAttrs (builtins.map
+                  (netdev: { name = "10-${netdev}"; value = inputs.config.systemd.network.netdevs."10-${netdev}"; })
+                  (builtins.filter
+                    (netdev:
+                      if initrd.network.interfaces == null then true
+                      else builtins.elem netdev initrd.network.interfaces
+                    )
+                    netdevs));
+              };
           };
           # do not use ip=xxx, as it will override systemd-networkd configurations
           # kernelParams = [ "ip=on" ];

modules/system/kernel/default.nix

@@ -4,74 +4,66 @@ inputs:
   {
     variant = mkOption
     {
-      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lts" ]);
+      type = types.nullOr (types.enum [ "nixos" "xanmod-lts" "xanmod-latest" ]);
       default = "xanmod-lts";
     };
     patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
     modules.modprobeConfig = mkOption { type = types.listOf types.str; default = []; };
   };
-  config = let inherit (inputs.config.nixos.system) kernel; in inputs.lib.mkMerge
-  [
+  config = let inherit (inputs.config.nixos.system) kernel; in
+  {
+    boot =
     {
-      boot =
+      kernelModules = [ "br_netfilter" ];
+      # modprobe --show-depends
+      initrd.availableKernelModules =
+      [
+        "bfq" "failover" "net_failover" "nls_cp437" "nls_iso8859-1" "sd_mod"
+        "sr_mod" "usbcore" "usbhid" "usbip-core" "usb-common" "usb_storage" "vhci-hcd" "virtio" "virtio_blk"
+        "virtio_net" "virtio_ring" "virtio_scsi" "cryptd" "libaes"
+        "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
+        # network for nas
+        "igb"
+        # disk for srv1
+        "megaraid_sas"
+        # disks for cluster
+        "nfs" "nfsv4"
+        # netowrk for srv1
+        "bnx2x" "tg3"
+        # network for srv2
+        "e1000e" "igb" "atlantic" "igc"
+        # temp wireless for nas
+        "r8712u"
+        # network for srv3
+        "igb"
+        # touchscreen for one
+        "pinctrl-tigerlake"
+        # bridge network
+        "bridge"
+      ]
+        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
+      extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
+      extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
+      kernelParams = [ "delayacct" ];
+      kernelPackages = inputs.lib.mkIf (kernel.variant != null)
       {
-        kernelModules = [ "br_netfilter" ];
-        # modprobe --show-depends
-        initrd.availableKernelModules =
-        [
-          "bfq" "failover" "net_failover" "nls_cp437" "nls_iso8859-1" "sd_mod"
-          "sr_mod" "usbcore" "usbhid" "usbip-core" "usb-common" "usb_storage" "vhci-hcd" "virtio" "virtio_blk"
-          "virtio_net" "virtio_ring" "virtio_scsi" "cryptd" "libaes"
-          "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
-          # networking for nas
-          "igb"
-          # disk for srv1
-          "megaraid_sas"
-          # disks for cluster
-          "nfs" "nfsv4"
-          # netowrk for srv1
-          "bnx2x" "tg3"
-          # network for srv2
-          "e1000e" "igb" "atlantic" "igc"
-          # temp wireless for nas
-          "r8712u"
-          # network for srv3
-          "igb"
-          # touchscreen for one
-          "pinctrl-tigerlake"
-        ]
-          ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ]);
-        extraModulePackages = with inputs.config.boot.kernelPackages; [ v4l2loopback zenpower ];
-        extraModprobeConfig = builtins.concatStringsSep "\n" kernel.modules.modprobeConfig;
-        kernelParams = [ "delayacct" ];
-        kernelPackages = inputs.lib.mkIf (kernel.variant != null)
-        {
-          nixos = inputs.pkgs.linuxPackages;
-          xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
-          xanmod-latest = inputs.pkgs.linuxPackages_xanmod_latest;
-          cachyos = inputs.pkgs.linuxPackages_cachyos;
-          # TODO: package cachyos-lts
-          cachyos-lts = inputs.pkgs.linuxPackages_cachyos_lts;
-        }.${kernel.variant};
-        kernelPatches =
-          let
-            patches =
-            {
-              hibernate-progress =
-              [{
-                name = "hibernate-progress";
-                patch =
-                  let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
-                  in ./hibernate-progress-${version}.patch;
-              }];
-            };
-          in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
-      };
-    }
-    # enable scx when using cachyos
-    (
-      inputs.lib.mkIf (builtins.elem kernel.variant [ "cachyos" "cachyos-lts" ])
-        { services.scx = { enable = true; scheduler = "scx_rustland"; }; }
-    )
-  ];
+        nixos = inputs.pkgs.linuxPackages;
+        xanmod-lts = inputs.pkgs.linuxPackages_xanmod;
+        xanmod-latest = inputs.pkgs.linuxPackages_xanmod_latest;
+      }.${kernel.variant};
+      kernelPatches =
+        let
+          patches =
+          {
+            hibernate-progress =
+            [{
+              name = "hibernate-progress";
+              patch =
+                let version = inputs.lib.versions.majorMinor inputs.config.boot.kernelPackages.kernel.version;
+                in ./hibernate-progress-${version}.patch;
+            }];
+          };
+        in builtins.concatLists (builtins.map (name: patches.${name}) kernel.patches);
+    };
+  };
 }

modules/system/network.nix

@@ -1,6 +1,6 @@
 inputs:
 {
-  options.nixos.system.networking = let inherit (inputs.lib) mkOption types; in mkOption
+  options.nixos.system.network = let inherit (inputs.lib) mkOption types; in mkOption
   {
     # null: use network-manager; otherwise use networkd
     type = types.nullOr (types.submodule { options =
@@ -17,12 +17,22 @@ inputs:
         };});
         default = {};
       };
+      bridge = mkOption
+      {
+        type = types.attrsOf (types.submodule { options =
+        {
+          interfaces = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+        };});
+        default = {};
+      };
       # wpa_passphrase SSID(wifi name) PSK(password)
       wireless = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+      trust = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+      masquerade = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
     };});
     default = null;
   };
-  config = let inherit (inputs.config.nixos.system) networking; in inputs.lib.mkMerge
+  config = let inherit (inputs.config.nixos.system) network; in inputs.lib.mkMerge
   [
     # general config
     {
@@ -51,7 +61,7 @@ inputs:
       };
       networking.nftables = { enable = true; flushRuleset = false; };
     }
-    (inputs.localLib.mkConditional (networking == null)
+    (inputs.localLib.mkConditional (network == null)
       {
         networking.networkmanager =
         {
@@ -65,9 +75,9 @@ inputs:
         systemd.network =
         {
           enable = true;
-          networks = builtins.listToAttrs
-          (
-            (builtins.map
+          networks = inputs.lib.mkMerge
+          [
+            (builtins.listToAttrs (builtins.map
               (network:
               {
                 name = "10-${network}";
@@ -78,8 +88,8 @@ inputs:
                   linkConfig.RequiredForOnline = "routable";
                 };
               })
-              networking.dhcp)
-            ++ (builtins.map
+              network.dhcp))
+            (builtins.listToAttrs (builtins.map
               (network:
               {
                 name = "10-${network.name}";
@@ -93,31 +103,63 @@ inputs:
                   dns = inputs.lib.mkIf (network.value.dns != null) [ network.value.dns ];
                 };
               })
-              (inputs.localLib.attrsToList networking.static))
-          );
+              (inputs.localLib.attrsToList network.static)))
+            (builtins.listToAttrs (builtins.map
+              (network:
+              {
+                name = "10-${network.name}";
+                value =
+                {
+                  matchConfig.Name = network.name;
+                  bridgeConfig = {};
+                  linkConfig.RequiredForOnline = "routable";
+                };
+              })
+              (inputs.localLib.attrsToList network.bridge)))
+            (builtins.listToAttrs (builtins.concatLists (builtins.map
+              (bridge: builtins.map
+                (network:
+                {
+                  name = "10-${network}";
+                  value =
+                  {
+                    matchConfig.Name = network;
+                    networkConfig.Bridge = bridge.name;
+                    linkConfig.RequiredForOnline = "enslaved";
+                  };
+                }) bridge.value.interfaces)
+              (inputs.localLib.attrsToList network.bridge))))
+            (builtins.listToAttrs (builtins.map
+              (network: { name = "10-${network}"; value.networkConfig.IPMasquerade = "both"; })
+              network.masquerade))
+          ];
+          netdevs = builtins.listToAttrs (builtins.map
+            (network: { name = "10-${network}"; value.netdevConfig = { Name = network; Kind = "bridge"; }; })
+            (builtins.attrNames network.bridge));
         };
         networking =
         {
           useNetworkd = true;
-          wireless = inputs.lib.mkIf (networking.wireless != null)
+          wireless = inputs.lib.mkIf (network.wireless != null)
           {
             enable = true;
             networks = builtins.listToAttrs (builtins.map
               (network: { name = network; value.pskRaw = "ext:${network}"; })
-              networking.wireless);
+              network.wireless);
             secretsFile = inputs.config.sops.templates."wireless.env".path;
           };
+          firewall.trustedInterfaces = network.trust;
         };
         # dnsable dns fallback, use provided dns servers or no dns
         services.resolved.fallbackDns = [];
-        sops = inputs.lib.mkIf (networking.wireless != null)
+        sops = inputs.lib.mkIf (network.wireless != null)
         {
           templates."wireless.env".content = builtins.concatStringsSep "\n" (builtins.map
             (network: "${network}=${inputs.config.sops.placeholder."wireless/${network}"}")
-            networking.wireless);
+            network.wireless);
           secrets = builtins.listToAttrs (builtins.map
             (network: { name = "wireless/${network}"; value = {}; })
-            networking.wireless);
+            network.wireless);
         };
     })
   ];

modules/system/nixpkgs/buildNixpkgsConfig.nix

@@ -18,6 +18,7 @@ let
       inherit allowInsecurePredicate;
       allowUnfree = true;
       android_sdk.accept_license = true;
+      allowBroken = true;
     }
     // (inputs.lib.optionalAttrs (nixpkgs.march != null)
     {
@@ -35,12 +36,11 @@ in platformConfig //
   [
     inputs.topInputs.nur-xddxdd.overlays.inSubTree
     inputs.topInputs.nix-vscode-extensions.overlays.default
+    inputs.topInputs.buildproxy.overlays.default
     (final: prev:
     {
       inherit (inputs.topInputs.nix-vscode-extensions.overlays.default final prev) nix-vscode-extensions;
       firefox-addons = (import "${inputs.topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
-      linuxPackages_cachyos_lts =
-        final.linuxPackagesFor (inputs.topInputs.cachyos-lts.overlays.default final prev).linuxPackages_cachyos;
     })
     inputs.topInputs.self.overlays.default
     (final: prev:
@@ -90,9 +90,6 @@ in platformConfig //
                 #     cfn-lint = prev.cfn-lint.overridePythonAttrs { doCheck = false; };
                 #   })];
                 #   rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
-                #   ctranslate2 = (prev.ctranslate2.override { withCUDA = false; withCuDNN = false; })
-                #     .overrideAttrs (prev:
-                #       { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
                 #   valkey = prev.valkey.overrideAttrs { doCheck = false; };
                 # }
                 # // inputs.lib.optionalAttrs
@@ -123,6 +120,8 @@ in platformConfig //
       )
       // (inputs.lib.optionalAttrs (prev.stdenv.hostPlatform.avx512Support)
         { gsl = prev.gsl.overrideAttrs { doCheck = false; }; })
+      // (inputs.lib.optionalAttrs (nixpkgs.march != null && !prev.stdenv.hostPlatform.avx512Support)
+        { libhwy = prev.libhwy.override { stdenv = final.genericPackages.stdenv; }; })
       // (inputs.lib.optionalAttrs (nixpkgs.march != null)
       {
         libinsane = prev.libinsane.overrideAttrs (prev:
@@ -139,7 +138,6 @@ in platformConfig //
             sed -i '/CPPUNIT_TEST.testDubiousArrayFormulasFODS/d' sc/qa/unit/functions_array.cxx
           '';});});
         opencolorio = prev.opencolorio.overrideAttrs (prev: { doCheck = false; });
-        # TODO: maybe something really broken?
         openvswitch = prev.openvswitch.overrideAttrs (prev: { doCheck = false; });
         rapidjson = prev.rapidjson.overrideAttrs { doCheck = false; };
         valkey = prev.valkey.overrideAttrs { doCheck = false; };
@@ -147,14 +145,23 @@ in platformConfig //
         # https://github.com/embree/embree/issues/115
         embree = prev.embree.override { stdenv = final.genericPackages.stdenv; };
         simde = prev.simde.override { stdenv = final.genericPackages.stdenv; };
+        ctranslate2 = prev.ctranslate2.overrideAttrs (prev:
+          { cmakeFlags = prev.cmakeFlags or [] ++ [ "-DENABLE_CPU_DISPATCH=OFF" ]; });
         pythonPackagesExtensions = prev.pythonPackagesExtensions or [] ++ [(final: prev:
-        {
-          scipy = prev.scipy.overridePythonAttrs (prev:
-            { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
-          rich = prev.rich.overridePythonAttrs (prev:
-            { disabledTests = prev.disabledTests or [] ++ [ "test_brokenpipeerror" ]; });
-          # paperwork-backend = prev.paperwork-backend.overrideAttrs (prev: { doCheck = false; });
-        })];
+        (
+          {
+            scipy = prev.scipy.overridePythonAttrs (prev:
+              { disabledTests = prev.disabledTests or [] ++ [ "test_hyp2f1" ]; });
+            rich = prev.rich.overridePythonAttrs (prev:
+              { disabledTests = prev.disabledTests or [] ++ [ "test_brokenpipeerror" ]; });
+            # paperwork-backend = prev.paperwork-backend.overrideAttrs (prev: { doCheck = false; });
+          }
+          # // (inputs.lib.optionalAttrs (nixpkgs.march != null && !prev.stdenv.hostPlatform.avx2Support)
+          #   {
+          #     numcodecs = prev.numcodecs.overridePythonAttrs (prev:
+          #       { disabledTests = prev.disabledTests or [] ++ [ "test_encode_decode" "test_partial_decode" ]; });
+          #   })
+        ))];
         inherit (final.pkgs-2411) intelPackages_2023;
       })
       # // (inputs.lib.optionalAttrs (nixpkgs.march == "silvermont")

modules/user/chn/plasma/autostart.nix

@@ -1,6 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
   {
     home-manager.users.chn.config.home.file =
       let

modules/user/chn/plasma/shortcuts.nix

@@ -1,6 +1,6 @@
 inputs:
 {
-  config = inputs.lib.mkIf (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
+  config = inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
   {
     home-manager.users.chn.config.programs.plasma =
     {

modules/user/hjp/default.nix

@@ -2,7 +2,7 @@ inputs:
 {
   config = let inherit (inputs.config.nixos) user; in inputs.lib.mkIf (builtins.elem "hjp" user.users)
   {
-    home-manager.users.hjp.config.programs.zsh.initExtra =
+    home-manager.users.hjp.config.programs.zsh.initContent =
     ''
       export PATH=$PATH:/home/hjp/software/intel/oneapi/compiler/latest/bin
       export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/home/hjp/software/intel/oneapi/compiler/latest/lib

packages/blog-buildproxy.nix

@@ -0,0 +1,17 @@
+{ fetchurl }:
+[
+  {
+    url = "https://cdn.jsdelivr.net/npm/flexsearch@0.8.143/dist/flexsearch.bundle.min.js";
+    file = fetchurl
+    {
+      url = "https://cdn.jsdelivr.net/npm/flexsearch@0.8.143/dist/flexsearch.bundle.min.js";
+      sha256 = "0k3g87h84s667m7zphlsaqzvkdka4rszq5pw66cvngjpi8d98gj3";
+    };
+    status_code = 200;
+    headers =
+    {
+      "content-type" = "application/javascript; charset=utf-8";
+      "content-length" = "46087";
+    };
+  }
+]

packages/default.nix

@@ -1,7 +1,6 @@
 inputs: rec
 {
   vesta = inputs.pkgs.callPackage ./vesta.nix { src = inputs.topInputs.self.src.vesta; };
-  rsshub = inputs.pkgs.callPackage ./rsshub.nix { inherit mkPnpmPackage; src = inputs.topInputs.rsshub; };
   misskey = inputs.pkgs.callPackage ./misskey.nix
   {
     inherit mkPnpmPackage;
@@ -26,11 +25,12 @@ inputs: rec
   tgbot-cpp = inputs.pkgs.callPackage ./tgbot-cpp.nix { src = inputs.topInputs.tgbot-cpp; };
   mirism-old = inputs.pkgs.callPackage ./mirism-old.nix
   {
-    inherit cppcoro nameof tgbot-cpp date;
+    inherit cppcoro nameof date;
+    inherit (inputs.pkgs.pkgs-2305) boost;
     src = inputs.topInputs.self.src.mirism-old;
-    nghttp2 = inputs.pkgs.callPackage "${inputs.topInputs.nixpkgs-2305}/pkgs/development/libraries/nghttp2"
-      { enableAsioLib = true; stdenv = inputs.pkgs.gcc12Stdenv; };
+    nghttp2 = inputs.pkgs.pkgs-2305.nghttp2.override { enableAsioLib = true; };
     stdenv = inputs.pkgs.gcc12Stdenv;
+    tgbot-cpp = tgbot-cpp.override { stdenv = inputs.pkgs.gcc12Stdenv; };
   };
   cppcoro = inputs.pkgs.callPackage ./cppcoro { src = inputs.topInputs.cppcoro; };
   date = inputs.pkgs.callPackage ./date.nix { src = inputs.topInputs.date; };
@@ -120,7 +120,11 @@ inputs: rec
   };
   stickerpicker = inputs.pkgs.python3Packages.callPackage ./stickerpicker.nix { src = inputs.topInputs.stickerpicker; };
   info = inputs.pkgs.callPackage ./info { inherit biu; stdenv = inputs.pkgs.clang18Stdenv; };
-  blog = inputs.pkgs.callPackage inputs.topInputs.blog { inherit (inputs.topInputs) hextra; };
+  blog = inputs.pkgs.callPackage inputs.topInputs.blog
+  {
+    inherit (inputs.topInputs) hextra;
+    buildProxy = inputs.pkgs.lib.mkBuildproxy ./blog-buildproxy.nix;
+  };
   phono3py = inputs.pkgs.python3Packages.callPackage ./phono3py.nix { src = inputs.topInputs.phono3py; };
   vm = inputs.pkgs.callPackage ./vm { inherit biu; stdenv = inputs.pkgs.clang18Stdenv; };
   oneapiPackages = inputs.pkgs.lib.makeScope inputs.pkgs.newScope (final:

packages/rsshub.nix

@@ -1,25 +0,0 @@
-{
-  lib, mkPnpmPackage, nodejs, writeShellScript,
-  bash, chromium, src, git
-}: (mkPnpmPackage.override { inherit nodejs; })
-  {
-    inherit src;
-    extraNativeBuildInputs = [ bash git ];
-    extraAttrs =
-    {
-      PUPPETEER_SKIP_DOWNLOAD = true;
-      postInstall =
-        let startScript = writeShellScript "rsshub"
-        ''
-          export PATH=${lib.makeBinPath [ bash nodejs nodejs.pkgs.pnpm chromium git ]}:$PATH
-          export CHROMIUM_EXECUTABLE_PATH=chromium
-          export COREPACK_ENABLE_STRICT=0
-          pnpm start
-        '';
-        in
-        ''
-          mkdir -p $out/bin
-          cp ${startScript} $out/bin/rsshub
-        '';
-    };
-  }

packages/tgbot-cpp.nix

@@ -4,5 +4,6 @@
   inherit src;
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ boost openssl zlib curl ];
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
   propagatedBuildInputs = buildInputs;
 }