modules.services.slurm: enable task plugins

update blog
packages.sbatch-tui: fix
2026-01-12 04:19:22 +08:00 · 2024-10-11 19:42:37 +08:00 · 2024-10-10 16:33:50 +08:00 · 2024-10-10 16:17:18 +08:00 · 2024-10-10 13:15:49 +08:00 · 2024-10-10 12:49:45 +08:00
180 changed files with 3271 additions and 2807 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -9,7 +9,10 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &xmupc1 age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg
  - &xmupc2 age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-  - &pcvm age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
+  - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
+  - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
+  - &srv1-node2 age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+  - &srv1-node3 age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5
 creation_rules:
  - path_regex: devices/pc/.*$
    key_groups:
@@ -56,8 +59,23 @@ creation_rules:
    - age:
      - *chn
      - *pi3b
-  - path_regex: devices/pcvm/.*$
+  - path_regex: devices/srv1/node0/.*$
    key_groups:
    - age:
      - *chn
-      - *pcvm
+      - *srv1-node0
+  - path_regex: devices/srv1/node1/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node1
+  - path_regex: devices/srv1/node2/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node2
+  - path_regex: devices/srv1/node3/.*$
+    key_groups:
+    - age:
+      - *chn
+      - *srv1-node3
--- a/blog/.gitignore
+++ b/blog/.gitignore
@@ -1,4 +0,0 @@
-/themes
-/public
-/.hugo_build.lock
-/resources/_gen
--- a/blog/archetypes/default.md
+++ b/blog/archetypes/default.md
@@ -1,5 +0,0 @@
-+++
-title = '{{ replace .File.ContentBaseName "-" " " | title }}'
-date = {{ .Date }}
-draft = true
-+++
--- a/blog/content/_index.md
+++ b/blog/content/_index.md
@@ -1,19 +0,0 @@
---
-type: docs
---
-
-嗨，我的朋友，欢迎你！我想我会喜欢你的（如果我们之前没有仇的话）。
-
-左侧是这个网站的目录，你可以看到这个网站上有哪些文章。
-点进某一篇文章后，右侧会出现当前文章的目录。
-上方还有搜索框和一些外部网站的链接。
-
-本站的主要内容被分为“文档”和“博客”两个部分。
-文档部分是一些比较系统化的内容，比如某些教程，
-  会随着时间的推移而更新，并会翻译成英语（如果我觉得有必要的话）。
-博客部分是一些随手写的东西，大概写好之后就再也不会更新，其中的技术性内容也不保证完全正确，
-  往往充满了我自己的主观猜测。
-
-{{< callout emoji="🏗️" >}}
-  早期施工中，请戴好安全帽小心前行，谨防突然出现的 404。
-{{< /callout >}}
--- a/blog/content/about.md
+++ b/blog/content/about.md
@@ -1,19 +0,0 @@
---
-title: 关于本站
---
-
-嗨，我的朋友，欢迎你！我想我会喜欢你的（如果我们之前没有仇的话）。
-
-左侧是这个网站的目录，你可以看到这个网站上有哪些文章。
-点进某一篇文章后，右侧会出现当前文章的目录。
-上方还有搜索框和一些外部网站的链接。
-
-本站的主要内容被分为“文档”和“博客”两个部分。
-文档部分是一些比较系统化的内容，比如某些教程，
-  会随着时间的推移而更新，并会翻译成英语（如果我觉得有必要的话）。
-博客部分是一些随手写的东西，大概写好之后就再也不会更新，其中的技术性内容也不保证完全正确，
-  往往充满了我自己的主观猜测。
-
-{{< callout emoji="🏗️" >}}
-  早期施工中，请戴好安全帽小心前行，谨防突然出现的 404。
-{{< /callout >}}
--- a/blog/content/docs/example/_index.md
+++ b/blog/content/docs/example/_index.md
@@ -1,7 +0,0 @@
---
-weight: 1
-bookFlatSection: true
-title: "Example Site"
---
-
-{{< callout emoji="🏗️" >}} 施工中 {{< /callout >}}
--- a/blog/content/posts/_index.md
+++ b/blog/content/posts/_index.md
@@ -1,5 +0,0 @@
---
-title: Blog
---
-
-我得在这里写点什么
--- a/blog/content/posts/helloworld.md
+++ b/blog/content/posts/helloworld.md
@@ -1,49 +0,0 @@
---
-title: Helloworld
-date: 2024-08-24T20:13:59+08:00
-draft: false
-summary: 为什么不问问神奇海螺呢？
-math: true
---
-
-# 一级标题
-
-## 二级标题
-
-### 三级标题
-
-hello world!
-
-* 无序列表1
-* 无序列表2
-* 无序列表3
-
-1. 有序列表1
-2. 有序列表2
-3. 有序列表3
-
-> 这是一个引用
-> 写了两行
-
-如果段与段之间
-没有空行
-会怎样？
-
-```c++
-#include <iostream>
-using namespace std;
-int main() {
-    cout << "Hello, World!" << endl;
-    return 0;
-}
-```
-
-这是一个行内代码`printf("Hello, World!\n");`，和行内公式 $E=mc^2$。
-
-$$
-\int_{-\infty}^{+\infty} e^{-x^2} \dd x = \sqrt{\pi}
-$$
-
-**这是粗体文本**，*这是斜体文本*。
-
-[这是一个链接](https://www.example.com)
--- a/blog/data/icons.yaml
+++ b/blog/data/icons.yaml
@@ -1,6 +0,0 @@
-misskey: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 1 24 22"><path fill="currentColor" d="M8.91 16.892c-1.039.003-1.931-.63-2.352-1.366c-.225-.322-.67-.437-.676 0v2.014q0 1.215-.876 2.1q-.85.86-2.078.86q-1.2 0-2.077-.86A2.93 2.93 0 0 1 0 17.54V6.46q0-.936.526-1.695a2.86 2.86 0 0 1 1.402-1.088a2.9 2.9 0 0 1 1-.177q1.353 0 2.253 1.063l2.997 3.515c.067.05.263.437.732.437c.47 0 .692-.386.758-.437l2.972-3.515Q13.567 3.5 14.918 3.5q.501 0 1.001.177a2.73 2.73 0 0 1 1.377 1.088q.55.758.55 1.695v11.08q0 1.215-.875 2.1q-.852.86-2.078.86q-1.201 0-2.078-.86a2.93 2.93 0 0 1-.85-2.1v-2.014c-.05-.55-.531-.204-.702 0c-.45.843-1.313 1.361-2.352 1.366M21.448 8.61q-1.05 0-1.802-.733q-.726-.759-.726-1.822c0-1.063.242-1.307.726-1.796a2.44 2.44 0 0 1 1.802-.758q1.05 0 1.803.758q.75.735.75 1.796q0 1.063-.75 1.822q-.751.732-1.803.733m.025.507q1.05 0 1.777.758q.75.759.751 1.822v6.248q0 1.064-.75 1.821a2.4 2.4 0 0 1-1.778.734q-1.05 0-1.802-.733a2.5 2.5 0 0 1-.75-1.822v-6.248a2.5 2.5 0 0 1 .75-1.822a2.44 2.44 0 0 1 1.802-.758"/></svg>
-fediverse: <svg xmlns="http://www.w3.org/2000/svg" viewBox="20 20 216 216"><g fill="none"><path fill="#a730b8" d="M61.39 100.77a22.47 22.47 0 0 1-9.605 9.569l52.727 52.981l12.712-6.448zm69.548 69.882l-12.712 6.448l26.717 26.846a22.47 22.47 0 0 1 9.606-9.57z"/><path fill="#5496be" d="m191.943 121.734l-29.851 15.142l2.201 14.091l33.775-17.133a22.5 22.5 0 0 1-6.125-12.1m-47.18 23.932l-70.579 35.802a22.5 22.5 0 0 1 6.127 12.101l66.653-33.812z"/><path fill="#ce3d1a" d="m122.066 57.476l-34.057 66.548l10.055 10.103l36.059-70.459a22.45 22.45 0 0 1-12.057-6.192m-42.915 83.856l-17.25 33.708c4.56.772 8.77 2.934 12.056 6.192l15.249-29.797z"/><path fill="#d0188f" d="M51.492 110.487a22.44 22.44 0 0 1-11.218 2.347a23 23 0 0 1-2.168-.226l10.073 64.489a22.44 22.44 0 0 1 11.218-2.347q1.09.06 2.167.227z"/><path fill="#5b36e9" d="M80.364 193.888c.23 1.498.31 3.014.235 4.528a22.5 22.5 0 0 1-2.369 8.867l64.42 10.347a22.5 22.5 0 0 1-.236-4.528a22.5 22.5 0 0 1 2.37-8.867z"/><path fill="#30b873" d="m198.294 134.069l-29.733 58.102a22.45 22.45 0 0 1 12.058 6.193l29.734-58.101a22.45 22.45 0 0 1-12.059-6.194"/><path fill="#ebe305" d="M157.741 51.894a22.47 22.47 0 0 1-9.606 9.57l46.047 46.267a22.47 22.47 0 0 1 9.606-9.57z"/><path fill="#f47601" d="m115.713 45.14l-58.21 29.527a22.5 22.5 0 0 1 6.127 12.1l58.208-29.528a22.5 22.5 0 0 1-6.125-12.098"/><path fill="#57c115" d="M148.029 61.518a22.44 22.44 0 0 1-11.403 2.44a22 22 0 0 1-1.966-.206l5.157 33.048l14.069 2.26zm-5.216 54.494l12.191 78.134a22.45 22.45 0 0 1 11.055-2.265a23 23 0 0 1 2.349.258l-11.525-73.868z"/><path fill="#dbb210" d="M63.671 87.014a22.5 22.5 0 0 1 .247 4.6a22.5 22.5 0 0 1-2.334 8.803l33.043 5.312l6.494-12.695zm56.632 9.103l-6.495 12.696l78.072 12.55c-.224-1.481-.3-2.98-.226-4.476a22.5 22.5 0 0 1 2.395-8.915z"/><path fill="#ffca00" fill-opacity="0.996" d="M136.737 61.918c11.258.614 20.881-8.023 21.495-19.292c.613-11.268-8.016-20.9-19.275-21.515c-11.258-.613-20.881 8.024-21.495 19.292c-.613 11.269 8.017 20.901 19.275 21.515"/><path fill="#64ff00" fill-opacity="0.996" d="M212.966 138.513c11.259.614 20.882-8.023 21.495-19.292c.614-11.268-8.016-20.9-19.274-21.514s-20.882 8.023-21.495 19.292c-.613 11.268 8.016 20.901 19.274 21.514"/><path fill="#00a3ff" fill-opacity="0.996" d="M163.727 234.728c11.258.614 20.882-8.024 21.495-19.292s-8.016-20.901-19.274-21.515s-20.882 8.024-21.495 19.292c-.614 11.269 8.016 20.901 19.274 21.515"/><path fill="#9500ff" fill-opacity="0.996" d="M57.066 217.597c11.258.613 20.881-8.024 21.495-19.292c.613-11.269-8.017-20.901-19.275-21.515s-20.882 8.023-21.495 19.292c-.613 11.268 8.016 20.901 19.275 21.515"/><path fill="#f00" fill-opacity="0.996" d="M40.385 110.794c11.258.614 20.881-8.023 21.495-19.292c.613-11.268-8.017-20.9-19.275-21.514S21.724 78.01 21.11 89.28c-.613 11.268 8.017 20.901 19.275 21.514"/></g></svg>
-matrix: <svg xmlns="http://www.w3.org/2000/svg" viewBox="30 20 196 216"><path fill="currentColor" d="M72 216a8 8 0 0 1-8 8H40a8 8 0 0 1-8-8V40a8 8 0 0 1 8-8h24a8 8 0 0 1 0 16H48v160h16a8 8 0 0 1 8 8M216 32h-24a8 8 0 0 0 0 16h16v160h-16a8 8 0 0 0 0 16h24a8 8 0 0 0 8-8V40a8 8 0 0 0-8-8m-32 88a32 32 0 0 0-56-21.13a31.93 31.93 0 0 0-40.71-6.15A8 8 0 0 0 72 96v64a8 8 0 0 0 16 0v-40a16 16 0 0 1 32 0v40a8 8 0 0 0 16 0v-40a16 16 0 0 1 32 0v40a8 8 0 0 0 16 0Z"/></svg>
-wechat: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="currentColor" d="M15.85 8.14c.39 0 .77.03 1.14.08C16.31 5.25 13.19 3 9.44 3c-4.25 0-7.7 2.88-7.7 6.43c0 2.05 1.15 3.86 2.94 5.04L3.67 16.5l2.76-1.19c.59.21 1.21.38 1.87.47c-.09-.39-.14-.79-.14-1.21c-.01-3.54 3.44-6.43 7.69-6.43M12 5.89a.96.96 0 1 1 0 1.92a.96.96 0 0 1 0-1.92M6.87 7.82a.96.96 0 1 1 0-1.92a.96.96 0 0 1 0 1.92"/><path fill="currentColor" d="M22.26 14.57c0-2.84-2.87-5.14-6.41-5.14s-6.41 2.3-6.41 5.14s2.87 5.14 6.41 5.14c.58 0 1.14-.08 1.67-.2L20.98 21l-1.2-2.4c1.5-.94 2.48-2.38 2.48-4.03m-8.34-.32a.96.96 0 1 1 .96-.96c.01.53-.43.96-.96.96m3.85 0a.96.96 0 1 1 0-1.92a.96.96 0 0 1 0 1.92"/></svg>
-qq: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g fill="none"><path d="m12.593 23.258l-.011.002l-.071.035l-.02.004l-.014-.004l-.071-.035q-.016-.005-.024.005l-.004.01l-.017.428l.005.02l.01.013l.104.074l.015.004l.012-.004l.104-.074l.012-.016l.004-.017l-.017-.427q-.004-.016-.017-.018m.265-.113l-.013.002l-.185.093l-.01.01l-.003.011l.018.43l.005.012l.008.007l.201.093q.019.005.029-.008l.004-.014l-.034-.614q-.005-.018-.02-.022m-.715.002a.02.02 0 0 0-.027.006l-.006.014l-.034.614q.001.018.017.024l.015-.002l.201-.093l.01-.008l.004-.011l.017-.43l-.003-.012l-.01-.01z"/><path fill="currentColor" d="M12 2a6.285 6.285 0 0 0-6.276 5.937l-.146 2.63a28 28 0 0 0-.615 1.41c-1.24 3.073-1.728 5.773-1.088 6.032c.335.135.913-.426 1.566-1.432a6.67 6.67 0 0 0 1.968 3.593c-1.027.35-1.91.828-1.91 1.33c0 .509 2.48.503 4.239.5h.001c.549-.002 1.01-.008 1.38-.057a6.7 6.7 0 0 0 1.76 0c.37.05.833.055 1.382.056c1.76.004 4.239.01 4.239-.499c0-.502-.883-.979-1.909-1.33a6.67 6.67 0 0 0 1.967-3.586c.65 1.002 1.227 1.56 1.56 1.425c.64-.259.154-2.96-1.088-6.032a28 28 0 0 0-.607-1.395l-.147-2.645A6.285 6.285 0 0 0 12 2"/></g></svg>
-gitea: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill="currentColor" fill-rule="evenodd" d="M15.46 3.206s.14-.003.245.102l.01.01c.064.06.258.244.285 1.074c0 2.902-1.405 5.882-1.405 5.882a9 9 0 0 1-.359.713c-.458.802-.786 1.153-.786 1.153s-.318.379-.675.595c-.415.265-.72.263-.72.263L7.247 13c-.636-.079-1.29-.736-1.927-1.578c-.47-.677-.779-1.413-.779-1.413s-2.51.034-3.675-1.394C.235 7.895.103 7.067.06 6.769q0-.012-.004-.029c-.05-.324-.285-1.873.821-2.86c.517-.496 1.148-.638 1.37-.684c.371-.081.667-.06.903-.044l.09.006c.391.035 3.99.216 3.99.216s1.532.066 2.27.056c0 0 .003 1.853.003 2.78q.105.048.211.1l.212.1V3.427q.494-.005.996-.017h.011c1.545-.036 4.528-.204 4.528-.204ZM2.113 8.026s.28.26.94.477c.43.152 1.094.231 1.094.231S3.699 7.5 3.516 6.757c-.22-.886-.4-2.398-.4-2.398s-.438-.015-.789.079c-.766.19-.98.763-.98.763s-.384.688.036 1.813c.244.672.73 1.013.73 1.013Zm8.084 3.607c.344-.023.499-.392.499-.392s1.24-2.486 1.4-2.878a.7.7 0 0 0 .046-.438c-.07-.267-.39-.412-.39-.412l-1.926-.935l-.165.339l-.18.369a.46.46 0 0 1 .128.341s.433.186.743.387c0 0 .257.135.32.425c.075.273-.04.488-.066.539l-.002.003s-.216.51-.343.774l-.004.007q-.07.144-.139.28a.454.454 0 1 1-.32-.15s.41-.84.468-1.033c0 0 .096-.24.048-.38a.47.47 0 0 0-.19-.188a6 6 0 0 0-.678-.34s-.076.068-.18.09a.5.5 0 0 1-.158.014l-.611 1.25a.46.46 0 0 1 .046.587a.46.46 0 0 1-.578.138a.46.46 0 0 1-.232-.51a.46.46 0 0 1 .44-.35L8.8 7.886a.457.457 0 0 1 .361-.744l.185-.375l.167-.341l-.579-.281s-.251-.125-.458-.072a.6.6 0 0 0-.114.039c-.189.084-.31.33-.31.33L6.668 9.293s-.124.254-.068.46c.048.252.325.397.325.397l2.874 1.4l.135.054s.114.04.262.03Z" clip-rule="evenodd"/></svg>
--- a/blog/default.nix
+++ b/blog/default.nix
@@ -1,13 +0,0 @@
-{ stdenv, hextra, hugo }: stdenv.mkDerivation
-{
-  name = "blog";
-  src = ./.;
-  nativeBuildInputs = [ hugo ];
-  configurePhase =
-  ''
-    mkdir themes
-    ln -s ${hextra} themes/hextra
-  '';
-  buildPhase = "hugo";
-  installPhase = "cp -r public $out";
-}
--- a/blog/hugo.yaml
+++ b/blog/hugo.yaml
@@ -1,132 +0,0 @@
-baseURL: https://blog.chn.moe/
-theme: hextra
-
-enableRobotsTXT: true
-enableGitInfo: false
-enableEmoji: true
-hasCJKLanguage: true
-
-# services:
-#   googleAnalytics:
-#     ID: G-MEASUREMENT_ID
-
-outputs:
-  home: [ html ]
-  page: [ html ]
-  section: [ html, rss ]
-
-defaultContentLanguage: zh-cn
-languages:
-  zh-cn:
-    languageName: 简体中文
-    languageCode: zh-CN
-    weight: 1
-    title: My New Hugo Site
-  en:
-    languageName: English
-    weight: 2
-    title: My New Hugo Site
-    contentDir: content/en
-
-# Needed for mermaid/katex shortcodes
-markup:
-  goldmark:
-    renderer:
-      unsafe: true
-  highlight:
-    noClasses: false
-
-enableInlineShortcodes: true
-
-menu:
-  main:
-    - name: Search
-      weight: 1
-      params:
-        type: search
-
-  sidebar:
-    - identifier: more
-      name: More
-      params:
-        type: separator
-      weight: 1
-    - identifier: welcome
-      name: 欢迎页
-      pageRef: /
-      weight: 2
-    - identifier: about
-      name: 关于本站
-      pageRef: /about
-      weight: 3
-    - identifier: contact
-      name: 联系我
-      pageRef: /contact
-      weight: 4
-
-params:
-  description: Modern, responsive, batteries-included Hugo theme for creating beautiful static websites.
-  navbar:
-    displayTitle: true
-    displayLogo: true
-    logo:
-      path: images/logo.svg
-      dark: images/logo-dark.svg
-      # width: 40
-      # height: 20
-      # link: /
-    width: wide
-  page:
-    # full (100%), wide (90rem), normal (1280px)
-    width: normal
-  theme:
-    # light | dark | system
-    default: system
-    displayToggle: true
-  footer:
-    enable: true
-    displayCopyright: true
-    displayPoweredBy: true
-    width: normal
-  displayUpdatedDate: true
-  dateFormat: "January 2, 2006"
-  search:
-    enable: true
-    type: flexsearch
-    flexsearch:
-      # index page by: content | summary | heading | title
-      index: content
-      # full | forward | reverse | strict
-      # https://github.com/nextapps-de/flexsearch/#tokenizer-prefix-search
-      tokenize: forward
-  editURL:
-    enable: true
-    base: "https://github.com/imfing/hextra/edit/main/exampleSite/content"
-  blog:
-    list:
-      displayTags: true
-      # date | lastmod | publishDate | title | weight
-      sortBy: date
-      sortOrder: desc # or "asc"
-  highlight:
-    copy:
-      enable: true
-      # hover | always
-      display: hover
-  comments:
-    # TODO: enable cusdis
-    enable: false
-    type: giscus
-    # https://giscus.app/
-    giscus:
-      repo: imfing/hextra
-      repoId: R_kgDOJ9fJag
-      category: General
-      categoryId: DIC_kwDOJ9fJas4CY7gW
-      # mapping: pathname
-      # strict: 0
-      # reactionsEnabled: 1
-      # emitMetadata: 0
-      # inputPosition: top
-      # lang: en
-  math: true
--- a/devices/jykang.xmuhpc/.ssh/authorized_keys
+++ b/devices/jykang.xmuhpc/.ssh/authorized_keys
@@ -6,6 +6,7 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDn1pfGen7kjPTHsbb8AgrUJWOeFPHK5S4M97Lcj3tv
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCW2fx1Sim7X2i/e/RBPEl1q/XbV7wa9pmZfnRINHIv24MCUgtNZ5GHEEW7dvzrQBeRj3I7CAyK8fbuhv/l8HuDtjxJJ1fmcBp9UG5vfpb/UTxayJxHBRrwokp2JL7HKVviI6d8FcNa/T0CMoUNYXnel6dE3B78k9Q0dDxlOGS1MzgsP3Pn66lm0ww9FRAVHe+KkhFmwyQ1VHUxHgK4QjCIt7+9+PJE7fK0aVWBsR309pui7Pbm6mgd4d6mwiBeVvxsNGnI4DsO1hz4N2GapuQy19PDiG7A4H41Z5RYQnv/3XTy4TBXOFQm77v6pyGkCmG6BGnRdvMB6C0hWPJvudbsA/BNp4ApL7/CrwTdLp1z6ToAOLvKrUQAM+hcbJimnFVMXqz7iSYg99XTnzue7ncecp19XiaDJbM47bGXcT4nTO5XaiMYi2xGAHIrij5GIuFF5ymKYSp5ejb1VucMdKlaaAmS10+wdUcuT7tzX/IuVr5aqg2dsxT5aJCRhZ1k2V0= xly@xmuhpc
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRpyIU8ZuYTa0LvsVHmJZ1FA7Lbp4PObjkwo+UcpCP8 wp@xmupc1
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGRZp8xp9hVO7e/6eflQsnFZj853IRVywc97cTevnWbg hjp@xmupc1
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwUhEAFHjkbUfOf0ng8I80YbKisbSeY4lq/byinV7lh wm

 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmJoiGO5YD3lbbIOJ99Al2xxm6QS9q+dTCTtlALjYI5f9ICGZJT8PEGlV9BBNCRQdgb3i2LBzQi90Tq1oG6/PcTV3Mto2TawLz5+2+ym29eIq1QIhVTLmZskK815FpawWqxY6+xpGU3vP1WjrFBbhGtl+CCaN+P2TWNkrR8FjG2144hdAlFfEEqfQC+TXbsyJCYoExuxGDJo8ae0JGbz9w1A1UbjnHwKnoxvirTFEbw9IHJIcTdUwuQKOrwydboCOqeaHt74+BnnCOZhpYqMDacrknHITN4GfFFzbs6FsE8NAwFk6yvkNXXzoe60iveNXtCIYuWjG517LQgHAC5BdaPgqzYNg+eqSul72e+jjRs+KDioNqvprw+TcBBO1lXZ2VQFyWyAdV2Foyaz3Wk5qYlOpX/9JLEp6H3cU0XCFR25FdXmjQ4oXN1QEe+2akV8MQ9cWhFhDcbY8Q1EiMWpBVC1xbt4FwE8VCTByZOZsQ0wPVe/vkjANOo+brS3tsR18= 00@xmuhpc
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxcIWDQxVyIRqCGR4uWtrh4tLc025+q6du2GVsox8IzmBFkjNY8Au5GIMP5BKRstxFdg3f/wam8krckUN9rv5+OHB9U8HGz77Xs0FktqRVNMaDPdptePZQJ9A9eW3kkFDfQnORJtiVcEWfUBS3pi0QFOHylnG27YyC/Vjx9tjvtJWKsQEVTFJbFHPdi+G7lHTpqIGx+/a2JN9O6uVujXXYvjSVXsd+CWB9VMZMvYCIz2Ecb6RqR3brj4FhRRl8zyCj+J4ACYFdGWL98fTab2uPHbpVeKrefFFA43JOD/4zwBx/uw7MAQAq0GunTV3FpBfIAQHWgftf2fSlbz20oPjCwdYn9ZuGJOBUroryex7AKZmnSYM3biLHcctQfZtxqVPEU3W/62MUsI/kZb9RcF24JRksMoS2XWTiv2HFf5ijQGLXXOjqiTlGncwiKf65DwkDBsSxzgbXk5Uo86viq6UITFXPx/RytU+SUiN4Wb7wcBTjt/+tyQd1uqc7+3DCDXk= 01@xmuhpc
--- a/devices/nas/default.nix
+++ b/devices/nas/default.nix
@@ -24,7 +24,7 @@ inputs:
              };
            };
          };
-          decrypt.manual =
+          luks.manual =
          {
            enable = true;
            devices =
@@ -40,8 +40,8 @@ inputs:
        };
        initrd.sshd.enable = true;
        nixpkgs.march = "silvermont";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
-        networking = { hostname = "nas"; networkd = {}; };
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
+        networking.networkd = {};
      };
      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
      services =
@@ -62,6 +62,7 @@ inputs:
          publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
          wireguardIp = "192.168.83.4";
        };
+        misskey.instances.misskey = {};
      };
    };
  };
--- a/devices/nas/secrets.yaml
+++ b/devices/nas/secrets.yaml
@@ -4,6 +4,12 @@ acme:
    token: ENC[AES256_GCM,data:OrYgBRU1VPpkpDzYMFHINfPSHsXEKABdZOcgiAiBJKcreBoaSVHUvg==,iv:XIeZPJhzmUi5ZHKBCYN5UA9HWH1K+26SvcIWVrHAYDA=,tag:3F93syLBZjcHwnRRkUEjlw==,type:str]
 wireguard:
    privateKey: ENC[AES256_GCM,data:VPlB4wSbWqSYw3rYRwfAMa39xrPcPZfz7sV2Cq3rmOhifnUPwggxnA+51do=,iv:utnyrB6Yfe5O94Oq4HDVFm/lQ9ZBoyvUT68r2G2PdwA=,tag:snm01vA+z2yKK8d2i5i2ig==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:ezBawTyn+oPKKy6sQuj2BQXhnO4PTbxYWRpQR9URCxqD7bFlnmWU1Q==,iv:eD4yLDA209x6HFtDaqyj8kRxTImdyZCgOminHWb9vt4=,tag:mx+qPp4L9jHRvL90XH1RwA==,type:str]
+redis:
+    misskey-misskey: ENC[AES256_GCM,data:daHnurnqW0MI2uHd3gNT+ZczmytRdwBSsHGkCwNH9hJFMJW/U56HtjG5ivOQzYprWJ5uzgN98ivocbwzJEAGfg==,iv:aE9kvEErN06FNPPFQNchbmg/+SJCKT3QzCN/JTlZovk=,tag:iMo3MTssxKKT02zi8gCZPA==,type:str]
+postgresql:
+    misskey_misskey: ENC[AES256_GCM,data:QhsmKzYmAV0kGPhtRjTK7npt/Nop5JM9EFPpD8K6KfUJ48w+r+4vTORmERu7D2+fE3XDXxNZeSJg//bGxMmhfg==,iv:qkjkrqepjQ4kbwoaceQSzEP5TjLsiY7ih/ESj5RFpHw=,tag:UtZVW30xcsbGUjU2HjoUvw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -28,8 +34,8 @@ sops:
            by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
            kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-24T05:14:57Z"
-    mac: ENC[AES256_GCM,data:9xKBuoVeotcZfiqsKg+iXxOc5BV9kGVvR5f9Anu6DauBceYIBxgeVCDU3dRUPz67MkOK/n2w9+gLchQxUyK8G4ECRTESL+GKpZslNVThb2j6vswLXNBHqsQCoQBlYOiKw5ZM1gpdYJPni8qpsdGvTwc5JkW+FH6v1BdZWaUhc3U=,iv:SyLiMXsQhS+8FFlSMXiD9ETD+mIsz6mePXnJzBODK5g=,tag:YpiU58lJ5Nb78EMyEmJdbw==,type:str]
+    lastmodified: "2024-10-05T02:43:05Z"
+    mac: ENC[AES256_GCM,data:NyXFwcVCCRfU+QSJVwov38SzRag1vhgfyQ0xtOheKtK/UaA+2Vqiqatp/lKWeri9ltpw5xWBYQnmE6aBHEkrj5RvoXeho3CUWiSqsB/3COn3FSfXGGJ2M642dnCtWqHfTrGNW7bhq/lBisODvtv+SAs108R5yYXhXWotUs/p+W0=,iv:Wsel2unj5X/dBCwt5sLzHmUIqm9c0uqzzpfnUkxq5cc=,tag:a5/I8GWuUOy4F4lOx9TH+w==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0
--- a/devices/pc/default.nix
+++ b/devices/pc/default.nix
@@ -13,7 +13,7 @@ inputs:
            vfat."/dev/disk/by-uuid/7A60-4232" = "/boot";
            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
          };
-          decrypt.auto =
+          luks.auto =
          {
            "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root1"; ssd = true; };
            "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =
@@ -23,7 +23,7 @@ inputs:
          resume = "/dev/mapper/swap";
          rollingRootfs = {};
        };
-        grub.windowsEntries."7AF0-D2F2" = "Windows";
+        grub.windowsEntries."645C-284C" = "Windows";
        nix =
        {
          marches =
@@ -36,7 +36,7 @@ inputs:
            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
            "broadwell"
            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-            "skylake"
+            "skylake" "cascadelake"
            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
            "alderlake"
@@ -53,7 +53,6 @@ inputs:
          modules.modprobeConfig =
            [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
        };
-        networking.hostname = "pc";
        sysctl.laptop-mode = 5;
        gui.enable = true;
      };
@@ -63,14 +62,12 @@ inputs:
        gpu =
        {
          type = "amd+nvidia";
-          nvidia = { prime.busId = { amd = "5:0:0"; nvidia = "1:0:0"; }; dynamicBoost = true; driver = "latest"; };
+          nvidia = { prime.busId = { amd = "6:0:0"; nvidia = "1:0:0"; }; dynamicBoost = true; driver = "latest"; };
        };
        legion = {};
      };
      virtualization =
      {
-        waydroid.enable = true;
-        docker.enable = true;
        kvmHost = { enable = true; gui = true; };
        nspawn = [ "arch" "ubuntu-22.04" "fedora" ];
      };
@@ -80,7 +77,6 @@ inputs:
        samba =
        {
          enable = true;
-          private = true;
          hostsAllowed = "192.168. 127.";
          shares =
          {
@@ -105,9 +101,9 @@ inputs:
                "log-upload.mihoyo.com" "uspider.yuanshen.com" "ys-log-upload.mihoyo.com"
                "dispatchcnglobal.yuanshen.com"
              ])
+            ++ [{ name = "4006024680.com"; value = "192.168.199.1"; }]
          );
        };
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
        acme.cert."debug.mirism.one" = {};
        frpClient =
        {
@@ -131,13 +127,22 @@ inputs:
        slurm =
        {
          enable = true;
-          cpu = { cores = 16; threads = 2; mpiThreads = 2; openmpThreads = 4; };
-          memoryMB = 90112;
-          gpus."4060" = 1;
+          master = "pc";
+          node.pc =
+          {
+            name = "pc"; address = "127.0.0.1";
+            cpu = { cores = 16; threads = 2; };
+            memoryMB = 90112;
+            gpus."4060" = 1;
+          };
+          partitions.localhost = [ "pc" ];
+          tui = { cpuMpiThreads = 4; cpuOpenmpThreads = 4; gpus = [ "4060" ]; };
        };
        ollama = {};
+        waydroid = {};
+        docker = {};
      };
-      bugs = [ "xmunet" "backlight" "amdpstate" ];
+      bugs = [ "xmunet" "backlight" "amdpstate" "bluetooth" ];
    };
    boot =
    {
@@ -163,6 +168,8 @@ inputs:
    };
    # 禁止鼠标等在睡眠时唤醒
    services.udev.extraRules = ''ACTION=="add", ATTR{power/wakeup}="disabled"'';
+    # 允许kvm读取物理硬盘
+    users.users.qemu-libvirtd.extraGroups = [ "disk" ];
    networking.extraHosts = "74.211.99.69 mirism.one beta.mirism.one ng01.mirism.one";
    services.colord.enable = true;
    environment.persistence."/nix/archive" =
--- a/devices/pc/secrets/default.yaml
+++ b/devices/pc/secrets/default.yaml
@@ -23,6 +23,9 @@ nix:
 github:
    token: ENC[AES256_GCM,data:59z1zSofzUyv2Qfn8oS7dZplzJDtOD/zxhPm07MLbVLHt8mE57IGcw==,iv:nZ4JmIE1h496RN6BChvqo7XWHjur76jP4HMgqGBbMJQ=,tag:pUSGsofG7hvkvJxCRwkg1Q==,type:str]
 age: ENC[AES256_GCM,data:EPjip4/tz50e+blPko9NpzDamLRO6BVy64kDnGAhUJJ/bMw6V9Of8RzuiqUupIjEmFiUcgWf9ZsV5RZO3Ai9udq0W7mYS1Y/zn4=,iv:TBs/o6mp8t+S3Ma5/QhnLhzgl852HB3sEzKy9SvKJjU=,tag:2yMUVWPua2g0VOkaXpJzKQ==,type:str]
+user:
+    #ENC[AES256_GCM,data:a4mHxr7bn7BV,iv:FYQk3yv3XgxNO9CnrQefo3WqhO0Sf8Mihfp+Iw4AcWM=,tag:jebxvG+xUidghf5dOlvDYA==,type:comment]
+    zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -47,8 +50,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-01T15:21:26Z"
-    mac: ENC[AES256_GCM,data:eigkz85LgrpqqKTw5obgc14e9jtnmZJnjkD1iTOdXkluaqQyHC8qO2mgOfzKTM3dqusDA/hij+DR8nQbFzsBCFtvVdwb9chCqZLGo/fiJKvN8xt7Ccev8K5gS9nDnVmA7aUDgu1YWjZd3f/JpILlp2rsc5cozfcEAJoGFoSeWh0=,iv:FdzSdD6K8/6X39KcpcX+FEjkoiDWp7K4LWIN2ZdqXGM=,tag:vN1VD238pLcFm4s8KJsakA==,type:str]
+    lastmodified: "2024-09-04T01:39:48Z"
+    mac: ENC[AES256_GCM,data:VkpF9zTWRLMriukAif6lfp8uy6+IcPDYUnXCQ5XLUtSstEyUoaVBjn+VVAoKkLX3MnyR6gyiYVWDDJmXrsyNoQpjRVQR0yu0p6p7sB3voGKiNxhw5qGwZj4IIXnHFWvktgWiawCiUkmSTUUHxe0XjAh7AWxjGqgAs/oyWGq/YfE=,iv:IQbJAhW/y18s57CAwRPeypQreBqQb0KkJAgIZ90QXJU=,tag:a0AB3l83j31Ex6PH9ziHRg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.0
--- a/devices/pcarm/default.nix
+++ b/devices/pcarm/default.nix
@@ -1,28 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/CE84-E0D8" = "/boot";
-            btrfs."/dev/disk/by-uuid/61f51d93-d3e5-4028-a903-332fafbfd365" =
-              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
-          };
-          rollingRootfs = {};
-        };
-        networking = { hostname = "pcarm"; networkd = {}; };
-        nixpkgs.arch = "aarch64";
-        kernel.variant = "nixos";
-        sops.enable = false;
-      };
-      services.sshd = {};
-    };
-  };
-}
--- a/devices/pcvm/default.nix
+++ b/devices/pcvm/default.nix
@@ -1,28 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/AE90-1DD1" = "/boot";
-            btrfs."/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
-          };
-          decrypt.auto."/dev/disk/by-uuid/a9e4a508-3f0b-492e-b932-e2019be28615" = { mapper = "root"; ssd = true; };
-          rollingRootfs = {};
-        };
-        kernel.variant = "xanmod-latest";
-        networking.hostname = "pcvm";
-        initrd.sshd.enable = true;
-      };
-      hardware.cpus = [ "amd" ];
-      services.sshd = {};
-    };
-  };
-}
--- a/devices/pcvm/secrets.yaml
+++ b/devices/pcvm/secrets.yaml
@@ -1,39 +0,0 @@
-hello: ENC[AES256_GCM,data:7xCy5PqPVdUNIdzqaGQLsPA88mAfRt6T57LjFDwOaTlhdejLPrBdyN4=,iv:dM0QWDpylPjnbtdNrjV8LHISNi/U718+xooFm0qTcbI=,tag:d5HbLG7yF3QRz7nP+4aeiA==,type:str]
-example_key: ENC[AES256_GCM,data:K5SD4k9jL5r4ZSUwNQ==,iv:mJrZshT0PKmT7OJE/ZBUWzq1Gc6xXymFbypxwQtQJq8=,tag:I4+AyMh+AVpmWa1fdIJpyA==,type:str]
-#ENC[AES256_GCM,data:vHj6+kNand8d1AzgXTaOMQ==,iv:j6b3SDqzVgY8U/puEm9UcpJYGK84gF/YIXzRbG0radQ=,tag:yzfXKHReJ0++3fhk2ztbBA==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:vRjjfVSy8g5mBZVM/oU=,iv:C+HE4Q157eNhEmcDJSMJINfMgztf6XfELCjotg8q3XU=,tag:JSQDItdYbCCs65tmbeR6tg==,type:str]
-    - ENC[AES256_GCM,data:xzfN6WiT8r8YcWtS+H4=,iv:btlOvqrn0pITT3rCTIjgS2b5TrfNKym0yPEnE7bJDqg=,tag:Wf40b8zBhrv452OKodkU+w==,type:str]
-example_number: ENC[AES256_GCM,data:akqZ12u1wl4Zww==,iv:hS3NBWI7o6dZLtsIsoVHYdtyqpUmbQrpMHPhRRzEd18=,tag:1voFm4LuupWJMGP3xd0k4A==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:wWEU8w==,iv:rf8uwo+sP9YFyPmoxROVVmrx+q6Yr0PIOWznM96w9XY=,tag:nVJdD1Z7U8zVRBxs8gLvQQ==,type:bool]
-    - ENC[AES256_GCM,data:gVe51tg=,iv:eOJ2TOWStHpckNyYx2UdLcipshFpjcWtEids5c+Q8bs=,tag:0iSjlC/TgNfl7ZtXmttgaQ==,type:bool]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTGliaUlvOVlxejZhSDZi
-            YU96S0VPOE5Ldk56WlJjTzBSRm9oYnBoQ0NBCnhJWmg3KzUrT1VyemRiSWtQeklS
-            UFFFTjdod0g1d1EvYWJoOElJSjIrWTgKLS0tIDlaQnJOMTZRUms4am1mQjV5MzFJ
-            QlhKL1ltY2lGZGU0clhIRTRsSW5BOTgK4gKbhvF1bV/YdKOxzqrecHPDAKPOd81V
-            YnWgLpP6h+zycx80iqwsfqiQJdPyDrfhB43ksn2oxsX0qXtLI9j9TQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jmu4jym0e0xkq5shx2g7ef4xzre94vaxy2n4fcn0kp94dtlupdxqkzyyp7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRU1IRXZkbFQ4elgydTlv
-            VlRVKzJIWDVCZk5xaTd0Y2JXS2l0Mi85Zm1jCnNkS0NETm5SaG9WUE9Mb3RtbE5B
-            YTRmWHNXTk9hZHNBT0FxT1RNNnFMNEkKLS0tIGRWNWpLcDVtOEdGZHFPT3paeVo2
-            QWsreTlaVW5Bd2lZb3JZeTdjcG9WQlEKy3p4QnjPrJtfaueLKBzMz7VZ9QfrTer1
-            lEP8mInFprR65LtpoKabsTWQwkzURzB/OdbKSYG2o6Rlqy9L3d5eBw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-02T23:46:35Z"
-    mac: ENC[AES256_GCM,data:OncqYSgPSoge5Nw6eh0A4cm0KXSQhmSpGIu5WSv38LdMto5fNLIK2VRIwaXfq9nyf10bxNN7xSADj2GPhMiwlHM8nIQXtxdlWsZfEOc/qOWM8nz+9DPKtKGD6RZcDLDRhNTDxzPXGWIuY1tDKQpUlt/iDlymSskcqSrdTfBqCGk=,iv:NesxRr6FXXApE8aafnAV3x6hwCoAxoEly/QkcyAQ8Pw=,tag:3o37dr4vKLqEENIdj8RHXw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/devices/pi3b/default.nix
+++ b/devices/pi3b/default.nix
@@ -18,7 +18,7 @@ inputs:
          swap = [ "/nix/swap/swap" ];
          rollingRootfs = {};
        };
-        networking = { hostname = "pi3b"; networkd = {}; };
+        networking.networkd = {};
        nixpkgs.arch = "aarch64";
        kernel.variant = "nixos";
      };
--- a/devices/srv1/default.nix
+++ b/devices/srv1/default.nix
@@ -0,0 +1,73 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        fileSystems =
+        {
+          mount = let inherit (inputs.config.nixos.system.cluster) clusterName nodeName; in
+          {
+            vfat."/dev/disk/by-partlabel/${clusterName}-${nodeName}-boot" = "/boot";
+            btrfs."/dev/disk/by-partlabel/${clusterName}-${nodeName}-root" =
+              { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
+          };
+          swap = [ "/nix/swap/swap" ];
+          rollingRootfs = {};
+        };
+        gui.enable = true;
+      };
+      hardware.cpus = [ "intel" ];
+      services =
+      {
+        snapper.enable = true;
+        sshd.passwordAuthentication = true;
+        smartd.enable = true;
+        slurm =
+        {
+          enable = true;
+          master = "srv1-node0";
+          node =
+          {
+            srv1-node0 =
+            {
+              name = "n0"; address = "192.168.178.1";
+              cpu = { sockets = 4; cores = 20; threads = 2; };
+              memoryMB = 122880;
+            };
+            srv1-node1 =
+            {
+              name = "n1"; address = "192.168.178.2";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 30720;
+            };
+            srv1-node2 =
+            {
+              name = "n2"; address = "192.168.178.3";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 61440;
+            };
+            srv1-node3 =
+            {
+              name = "n3"; address = "192.168.178.4";
+              cpu = { sockets = 4; cores = 8; threads = 2; };
+              memoryMB = 38912;
+            };
+          };
+          partitions =
+          {
+            localhost = [ "srv1-node0" ];
+            old = [ "srv1-node1" "srv1-node3" ];
+            fdtd = [ "srv1-node2" ];
+            all = [ "srv1-node0" "srv1-node1" "srv1-node2" "srv1-node3" ];
+          };
+          tui = { cpuMpiThreads = 8; cpuOpenmpThreads = 10; };
+          setupFirewall = true;
+        };
+      };
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "GROUPIII-1" "GROUPIII-2" "GROUPIII-3" ];
+    };
+  };
+}
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -0,0 +1,46 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "cascadelake";
+        networking.networkd.static =
+        {
+          eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
+          eno146 = { ip = "192.168.178.1"; mask = 24; };
+        };
+        cluster.nodeType = "master";
+      };
+      services =
+      {
+        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; threads = 4; };
+        wireguard =
+        {
+          enable = true;
+          peers = [ "vps6" ];
+          publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
+          wireguardIp = "192.168.83.9";
+        };
+        nfs = { root = "/"; exports = [ "/home" ]; accessLimit = "192.168.178.0/24"; };
+        xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
+        samba =
+        {
+          enable = true;
+          hostsAllowed = "";
+          shares = { home.path = "/home"; root.path = "/"; };
+        };
+      };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
+    };
+    # allow other machine access network by this machine
+    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
+    # without this, tproxy does not work
+    # TODO: why?
+    networking.firewall.trustedInterfaces = [ "eno146" ];
+  };
+}
--- a/devices/srv1/node0/secrets/default.yaml
+++ b/devices/srv1/node0/secrets/default.yaml
@@ -0,0 +1,56 @@
+wireguard:
+    privateKey: ENC[AES256_GCM,data:egNwovz+DTKoaGs/QQXR3MD7AImGlMlBnYsAZ1nuYnlgTVPM28aiLJ4iLGM=,iv:cFcf/sjqTmGqceNwHnzrhs1IvhDPRJi5YkyFVpjrsrs=,tag:yUwvNYCHjK+7+xkM2cuQNQ==,type:str]
+xray-client:
+    uuid: ENC[AES256_GCM,data:6JzTyJ+GVzLd0jWfvCc2dBdBVWz6RFH/8Gr73TNz6dNCyQjG,iv:ddGpYbIHN9PV3w6Oh65vEvv82jTChxgMdltIRPz++DY=,tag:nbFFk3S/y0hS3NFWGLPVJQ==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:IoRiruMV+bdf4qTSQBy9Npoyf1R0HkTdvxZShcSlvxlz7uKujWnlH4fc5eR6yytHcEZ9uPLib9XbGojUQOFERA==,iv:E0ac0DyhplaHEc2WmcXY0Fjpkt/pnY9PaATe0idqCRA=,tag:Vo/DBIUO6DBFCXQ1RLrchg==,type:str]
+acme:
+    token: ENC[AES256_GCM,data:k5QU1aHvd/hSG4yncffSwnxQvhULHd0I8wtrXD2FcOH3SWswkmzMOA==,iv:WB18Wsl0nxUQ6Om3SXP5+0BtFbNZ8fCXTyPJqj6a9Ik=,tag:dKpr52W7Wdwws87r3hQxqw==,type:str]
+users:
+    #ENC[AES256_GCM,data:rNA32tcCmriP,iv:No3Hyee58jDzZaXOD8SJYzgQXXs58oAddwC5Q9mo55E=,tag:RgZO7fgZkAr3Pawqt0dwmQ==,type:comment]
+    xll: ENC[AES256_GCM,data:kq6gpuxBRbDP7Yi16WJrrsumnSfersI2kP5pT5efn5CjbL65JaW/Bff9P4OM6b3J21ObT0uRSmParBqW4OvN/UA4KXDhibqwRg==,iv:GvpNgy8kREgxp9v0cyIobgg2ZrrxylMmwq1hRaAoNA8=,tag:RpD/1FjWVglzt8sIAjjpsg==,type:str]
+    #ENC[AES256_GCM,data:nl+uNO7GVV4r,iv:8hUmN4uWOqJE0g1aYA5dqQq+0oCpYGKe//yuECpmyBM=,tag:79XibRYMadJNE5Uy1O+4Jw==,type:comment]
+    zem: ENC[AES256_GCM,data:t6zd/9ZoJWEkPhKyfaUXWQM2Y2unpUUq79SEKSt8nmWCQxlBk4PzMX031CwNde/0A4G3ARyIoU8vcFqp8NaBMA64INccKccrGQ==,iv:QOKpu7lm6uiPACNGa0QvHP81PP/4doS3r95h8/nexcs=,tag:J85l6pYh9WT/LyMbTrw+vA==,type:str]
+    #ENC[AES256_GCM,data:7SGmLzQyXKWo,iv:lr7nM0r7eMc+sCNO8OgwwELH41zTk3W/1i+0rnTc+9s=,tag:ZOkLRhEsFXX6bODu6wUyiQ==,type:comment]
+    yjq: ENC[AES256_GCM,data:8TF316O4M3UDoSA7rjBn12vUdHOcWXtrvuhqa6K65NaMhHU9rMrPHEikr0tqe5B5ojhh8PRRe+X/Dq19L4rJXThRfzdhALZzsA==,iv:2plZ2m0JuuUMQqYnyETCPH9x5jnLtNl396zvv7ay++s=,tag:X7YSLQOE9xnC63RWCht3GA==,type:str]
+    #ENC[AES256_GCM,data:yclOn8oHwLYQ,iv:Ba7Q84z6e9/3lv43wdN+bd/aqO/y5qR5I6Z5O6o7U6E=,tag:ecaNN9MgZqDYBCbTlsOZtw==,type:comment]
+    gb: ENC[AES256_GCM,data:piD2eh5iUXnCEkEyDULPkjbEG4Uc4izoVAuscbb9TPr7Q9WhCJX3FGRYrQp/wmZQ6UETR1jTejtbT9j/kI96BcN2onlwO/lqvw==,iv:oFWeoDp3GQA8aR+/AcJnhkovOWx7MgHoCKy5xdPIJMo=,tag:n2E+zuKckNAU7mOCJW+f1Q==,type:str]
+    #ENC[AES256_GCM,data:hfcOjdrvK+YD,iv:8rUsS1exsOx+2YEgdATNcWGKqmaCNbpY1EEq1Gv1utE=,tag:Z0lq2ctHBWDtx2tyxOSIBw==,type:comment]
+    wp: ENC[AES256_GCM,data:DUfGQpSg79W8KD/SWC2B4FqoPGoCrd1miczAQR5YApD00QopMmeDR28uTmHru2KU9DsjkdnWEbgfM49CwXt5FFJennqW36oYbg==,iv:D9+3CMZlJIHm+u14rAEikQoBM3jBQN8Lnx22DN2EIg4=,tag:ZegZmI1kf7Whcw3EE9dwPQ==,type:str]
+    #ENC[AES256_GCM,data:6pwUu43Lu5/h,iv:lZQ5F8v9VZRGuUoEMH15JLvx40N08ahTEbdEoKEuvsg=,tag:zPMQy6d9/RcukBO1cyeM4A==,type:comment]
+    hjp: ENC[AES256_GCM,data:dqoQ9hUbptm0//mlcFRrqLh1NpjxFPH+4jeyMG/x9Zvkszw7d71jvkO8KEPBfKnXpPBP2lvFyEqooIMWQJPYiIszHt2f0qSC7A==,iv:5nRcsaylcx74tQR1KddEpZUhmcynMvdHCcJYA7wfJnE=,tag:bGVKD1aDZJUlFg/zagP/eg==,type:str]
+    #ENC[AES256_GCM,data:Idordi28++/e,iv:5TR6Z14yluxPhrD7ye2mXEQpD53qS9/ZJIZ+S1sTqco=,tag:IkmLWXdxDmFQxtpJxL61pg==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:JuNtb5SRUrxfyjWFn3Be7EU51j/HlwiOpuN0m+Picf/2Bs97kflGnqGKstVRIjWEn4WzqscSaLRsbP9uFfSBHeJ152xfyOqkww==,iv:mQvIC6v+1fziRDYHYSFMOKof1ZcoFskpQDiCAF35sa0=,tag:0IL2VvdMorgE6oziscAB8Q==,type:str]
+    #ENC[AES256_GCM,data:kyJP952K5atd,iv:TLMUPKshuWqbQ6koiZ9eTXcoDS3jLXYy/gCZbMGrRl4=,tag:M2tLLogovoG2PCojt9CJ9Q==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:ifWnLx1YEewdviqHK8fdesM3c1m1T4g6twnz1cGv1yc4jit68pQWLrRMivdsM4tUcyU9GKwCaElVlvh+dgyy8EZQPKCbvJX6GA==,iv:T5FWReeZ0QOkGJiNfrVrUBhAhbXxlFQJKqQV2tzw9AQ=,tag:XClXGZDWGuoGxzPW7ne2Pg==,type:str]
+    #ENC[AES256_GCM,data:t8QUVYG4v7fE,iv:N8hDAV7wulPHcfnYTXuZRhb9dQPZqKpfMKK1+ITaZTA=,tag:eKMJDOmqoWWQbv/mm3LaAw==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:VlAA+g7SRZyhPSl0Gd1KS7dCwNgRA/o+d8anN88A7E8bSE1ckeTSp+J4YrbbUlLasLhliOZ/nDC0rti+hckGCrjMwweMorSIWg==,iv:7u1yNrN7uxHCF1MsJ2qt1jyQ0ZYYCYKUHwRff50P9oI=,tag:3raCWjdButfmcdy8mH25Jw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQUpac093NWh3bnZqWkFY
+            WGorTlk3WWJRb0RYVWVQc1JacU9GZDhFN0RnCkJkQnJoTkZtYkFEQ1JDZXA1Qzdp
+            dWxtc3RFbUd4TEZobXBQVWVlL3VETVEKLS0tIExoMUNidEZob2dtTWhmS0VHbDJn
+            RFNiU0xMOG1UNVY5TTYrcW1GTnIwb0kKyCl+eqpGtqN047+t1C/c1prIaP3tm1jk
+            1ObtsmGwCxDyIkayqB3WF9DWhNHipXHZXrWT+JQJTD30BABBex+ufg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WXJ0dmh3RTBMci9pVVh6
+            cWsyNHVub2U1RFhLSnJPSFI1S2lGV21nYm1ZCll2TUQybmtaaTdYd0dGSXVNV1Y3
+            TC9zbWJQOENsQm1Nc1ZwUTMvczJGK0UKLS0tIHJRemNhdWpRa1pkRnhTZjhCODNM
+            OThDMWRsWnVTbzRGTTZqSDBkNWZJMlEKdQ/ipO7O5OvaGa81c2P7fi1ncufueSzX
+            2njlHHz1gJCtjpktYaVvS6KSYtJoI9oNrF0YN5D/3kKW8TicsSGKaA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:23Z"
+    mac: ENC[AES256_GCM,data:n7MVBKCUW4xpIiVO4ysBqlG89LjzpDBx9GJWQTrSenLWV/YrIGUxA6QDlRg7yhqV9ldF9Q7hDve1KHw7OxKRx5ot5OZiD3Bq3TwJfS2DarJ2vi9oc1J+CXXach8gp3m4C4RkPJ/y1i3jB2nRfSw5Z/TtdPMbvGXlHh+hhriAqxM=,iv:tyBcXMZzgeUOgYJtU1XkptPOlNoFwH+4z6xTD89aKOw=,tag:apXU989ZL+D8WhWKFTdXTg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/srv1/node0/secrets/munge.key
+++ b/devices/srv1/node0/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:ul1xMmQ5FZVIKct4KbgnTStsT5cH3sRvmaApZez4WZ36zF3q3M4o0dcwuWXxl9Ay8+Kd1zzUCZy26FRj85IwAel6POkmIlXl51Awou3iWuGBqUlS6IL9MIERMR6lTlisOK2l2PJ7IJBichFwwDrxImnt06B68Z7JWOyrLMfQhwg=,iv:nHePsGpRWMj4CdZ8wxr4xCJAcSndHsRju+AMyK54vNw=,tag:+CC0EJbTmIjRijr1SZpF3g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRTJCOTJqclZqV2ZTb3NG\nSUV1VVNnUVpqZGVCc2hlTVBkQUVtVGlQdEhVCk1aNjhhbDZuajhQL1l1allHOXV1\naGRoWEpTZ2haTFFqRDhlclEySjVmMXMKLS0tIFpPdHZvekhDaS9yam5GSEVhZFlw\nZGN1QTVYQjZuUXd0NklqdytYRjRSNWcKC+AmUlZiefdfnP1l/sbQHBUaZGN6ciT8\n/yI2ed25uFGwCo0h+yLywbuNQTv7AiBFM3R+KBSjNDkFSgiGfblVNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0VHhFMi9RZ2VjeUxqTHAz\nZklRbkRGVkg3NDR2elYwbXRHZ1dSQTEwNXl3CkdidmwwVUZJWDllRVdYRWM0WEtX\ncXlHbnlZd1h1Ni9UTEtHK0Z2YzNHcWMKLS0tIHl5ME9UaDBFSkRXeEh4OWNRajZu\nOUdGcHA4Q1I4dS9RMUV0YUZBYmZyK3cKSxvVdG+P9+esK3miJdW9BqgJdEMEq4iS\njWgh5lmSQaat3UzjkOVPPp9Xu3DRpzTFq+dM8bdGDTbzAdrUhxj87w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-15T11:11:36Z",
+		"mac": "ENC[AES256_GCM,data:bV7T1HfvM2n8+Vus9oDO5yoWDGtWYOd6d/zJ86/sXB4psg7aXVNedYSn+98SJdpYKHRcSuMJ9D4h62nAawERB6u8EmW8kxh8fuVLb6tj+9fWF1iVqinL4LE3916+XzMqGzGVZZEXaVtPHqOue/D1sYtBrBCOEMMyq0cmLFY2JrE=,iv:eSrtmJLARmwuAQ1//x4XqCKDZybJmMtyefWyLPk+1j0=,tag:M5W+vO4RjVwS18C9wTIe2w==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}
--- a/devices/srv1/node1/default.nix
+++ b/devices/srv1/node1/default.nix
@@ -0,0 +1,28 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static.eno2 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        cluster.nodeType = "worker";
+        fileSystems.mount.nfs."192.168.178.1:/home" = "/home";
+      };
+      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+    };
+    specialisation.no-share-home.configuration =
+    {
+      nixos.system.fileSystems.mount.nfs = inputs.lib.mkForce null;
+      system.nixos.tags = [ "no-share-home" ];
+    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+  };
+}
--- a/devices/srv1/node1/secrets/default.yaml
+++ b/devices/srv1/node1/secrets/default.yaml
@@ -0,0 +1,50 @@
+users:
+    #ENC[AES256_GCM,data:dgM035YLtZfl,iv:h7pHQ6YFa4hxcHMihQTegHmkaCMlfPtqdCqvJxSsXt8=,tag:V2v9C2TfErIOAihtTQpnSw==,type:comment]
+    xll: ENC[AES256_GCM,data:/YL4vowFLFbbYv06yaKWZH5UNBKs0L6LQ+6O0IsiUZpgW5fGfp2A5JTlH6ne7RGyyTE4GNId0MC7byQbTHHwO+5zVYWpzjDCfQ==,iv:5/VKGsIohoutZf3F4Qj8PruAXSivQ0zsg1pwLwZbCLs=,tag:/vsrCISEbgQ7HnubWOtKow==,type:str]
+    #ENC[AES256_GCM,data:oT8PFxQdwEt6,iv:eD/wF2toUAT991S0aO7NklpKSnMDH40+73IhU83H9t4=,tag:mxxAUdfHgC/hlvmLc2MlAA==,type:comment]
+    zem: ENC[AES256_GCM,data:RpmSTr2ZKfUNWg5vYbKB00AG18GNQs+kgx82E9Mg5hoc3HKmbAyIzjxloMn/Bw3MOTnof6Cf1ZzVCs53Wz8YbZFClLEVdKhMKA==,iv:NQJQOxQa/RaGzvGgarq5kWL8ojB1bejEiqJUCJLxgyU=,tag:8cFFQ5kKpZji4YvEYOyzOg==,type:str]
+    #ENC[AES256_GCM,data:keNqy5SdClQT,iv:N5LX7VJEwLHQ5HsFINs6LupP3rv/XAWFR2e/S52N+Oc=,tag:cqBh1bL1jAEk3mT0pLDd5A==,type:comment]
+    yjq: ENC[AES256_GCM,data:TagWplgUyhaEAuFpup0TRIxWXIEGwsG/V+gOo/pXSGor30B/BF7+wVozYTZ/iSN7OJJw8I7IZGvxvh0v01BGz1RQO6MEEpSj5A==,iv:TeXXYlhfae78cJFdZk0Nnm24sP43wi9UM80vHwKfXFU=,tag:lhae9Ona5OMlTBAJg3PiIA==,type:str]
+    #ENC[AES256_GCM,data:jmRMNpJLMqEo,iv:UOfzRSPDFsJ52sa2FVaQsVcU2P2bOYPzh4JLZ/8+hCg=,tag:8rCEYFELB2geXhfUjfZ18A==,type:comment]
+    gb: ENC[AES256_GCM,data:RneeGyzmdxCceKPzOHaTtS1l6NzuS07NYBxYrLICMLWHPog08FTINWEZx1JmqbAloVna3wE43kPPa9s1w3VbtPBhzRpTVZfUtA==,iv:1vu79FhPiWQ2/G5xzzBdyc790yv/aYKIQFPhaDpBmoA=,tag:vkpT1bDfVufBkDmOs7RomQ==,type:str]
+    #ENC[AES256_GCM,data:swW/4Fii+fHz,iv:9UZ8W6RY+n3XZkDCxSP/CQQn1Ji+mo2aqgmG9wTF/I4=,tag:2ifOyc0oGzM1iM3rouvvMw==,type:comment]
+    wp: ENC[AES256_GCM,data:/cIBL7orNYqu6Ybahdd1UVdTbS1SHr3GGb3ib4FDxPUlp/Xr4ARMX+01N6pOahVYwE8Hwp6nr4TdvwFpe2/AE6v2rbyclSzJgA==,iv:ZGwmAgwiC15K5NhajLCTiuW2mLT2gt0KUicDFmMY+JE=,tag:8rcoY6/weOkML90FyDfiSw==,type:str]
+    #ENC[AES256_GCM,data:6KbDgRf0Lmsh,iv:2vhLHgIzhCrdvQ7w6lCPKOmLlOVRJ5gJ+Pw5NSiMVVc=,tag:E6PwWCsUn3tZwV95zFbwhA==,type:comment]
+    hjp: ENC[AES256_GCM,data:0hzP2t4ck/0GVa2OoZxETCSQvp0QYN+0MJYl5aJ5hzSOXbwBPlTcIbjckpWDacx4iKGw+skhv1Nhz9lGrhgvddzqb/o1GWkKUw==,iv:OzKTIxDm+AgDAy4rP31kts0PKHuNqBZWc0Vsvh6X8CY=,tag:7Y/6qP+TJd1o0a96gKq5JQ==,type:str]
+    #ENC[AES256_GCM,data:PQmtt6/8T8Nm,iv:ZDUkaQts3hUQ1nncynoGw8gNV9jYvnXz9rOaqRC6yLE=,tag:jN8sUWnqoWbMlkLEqVKNkg==,type:comment]
+    zzn: ENC[AES256_GCM,data:YNB9leH/qgXpApA+bnsZiBlfbQSEiOoqhDgKCbwz33zPVc8KRShSS4kWEseiMlYLv7Kfbfy94cEKLOaWBjuRmMrODmC3HZ+rtQ==,iv:Ju02Sz0PHoBftz2W818hmXQ3J/fzLacWv+gy4eGXvjU=,tag:B6mvgWUclyHXgno07jhXQw==,type:str]
+    #ENC[AES256_GCM,data:UVi9/5NV0ySV,iv:E7ZZvvf6lNJdT4esykilJxhpTu7gqmu9w4w8rII/RSk=,tag:pnl3G0qt7ZzXlA9YWo7LiA==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:M4LHqgN/WYk9Nh7Pawft1tplh/FiADu6GoyImyLGBk8rbNNLT5AXuNYGj97tVYxI0Hwek+zhnmcjAWdDtmkVzE7TcD1WAZbkTA==,iv:GN/jHnEikITXkLRR/tXnhYiTE5bIDOg1d9DrYeASoY4=,tag:hkoAHHYX+q1topjXkRyK2g==,type:str]
+    #ENC[AES256_GCM,data:EVL/9hYcFl4F,iv:EZ8PMqklNEky0i940vwyQFXrgBoQRwwGDjBgRB18KGg=,tag:cnQzCU7XZ0EO6ojGaEk4Dg==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:7HOyyFtPjhxtvz3cG561aslZ1Ct+DmR290XOxz34sA/vyA+gjvHTWoIpKPGVzSU8vGfaLLV4ta/nOUsK/VfUj00ngwTdkEDkrg==,iv:rkDAE24gaE7MzOcIUX87oMyK6ra0Pt/vUNrIV9p7aFY=,tag:24NTkSu8Fd785uC2Lwr2XQ==,type:str]
+    #ENC[AES256_GCM,data:sa3uVs8+996Q,iv:eN3S4x/UROkZWV3U2pZpvULgoPdh42lM/Q+jZ13ohsk=,tag:IG0q/+ti4tthAejVp7MCPw==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:jfeQWLGUWK4xfgRtS9RjjN76D+JLqTF526SI0XeYnUXtCsKhJYE88hgVnn7m/Af9g1OCj08+UDsM8cyKOJj3+m6h+IZQzCS4bg==,iv:Syf3SYAFvOtfOy4PeA/PcYbuUnABk6f5A+OmZYtdwv8=,tag:cib1RuKxGffjB7R5GSxotA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaHcyMnpWRTAwRzJ0MTFi
+            elk3QXNqdXQ2MEttNXhBOGF1Vlk5cW12YTM4ClRkUm5zUUo5NjVrNnBlSFFPOVVR
+            V3VxVWZQQ0VvTm9KZ2Y1L3BpRkFDTjgKLS0tIDJadStsQ1Vya0FMa21Da3ZhUDVN
+            RVVTQXY2NkdzbVFLY1pYYTRLSGM5WDgKbFabN/iH2YDJaSXdm+7EebKS/As1zH43
+            HjUp2LHN85/WQEx3VheZRGJBwpNn/Tdunhm0yTdNA1jpzQnO9bIMXg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1TTlxNWhMS0dJbkZRSWsv
+            MitoM1NicmJzbVJBZnhUbnlJejBWVzU1TmpnCkxrVEs2eEE5VnVDN0NNaFZ0b3M0
+            SXFmc2JxblAvN29Eb2ZrR1llZkp6cmMKLS0tIGdQMjNIRXY2UGIxdGk2Q2V1MXJO
+            R1BkT1hoSWo1RlJnU0pCdTFYbDFoZmMKKF7cND1jSo+neTTJ+GwW4T0RTOX9mbME
+            58wjAtkrKSD2vDFMQ/vtPNiohAt6RMdClLVm50yh7Oh961YmvJYnbA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:35Z"
+    mac: ENC[AES256_GCM,data:UWDwXUfk4R9CfgU2gv1NZsusLq5+VTsvjGQNst99MuxLz4sox8CZuuYsDLB2dobKrJua107yqhbM8Ps42JJVHZEf3WHqP08tRbdIWNVoakYR6UJlNS3WZVR+LlheQI5PfJqPqa7VFgZeSVm7weIPCHqvHt+ak76oyJK1VsI0f+k=,iv:VL9s+LUA/TrOsJNQWC0/v0Yh+hT8uh2vitc9h1xHBEY=,tag:iA8yMpm+0ANAC+2BLN9Agw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/srv1/node1/secrets/munge.key
+++ b/devices/srv1/node1/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:GHsftJ/b50XSTy3wCX/ms8iGhs7oQMrqw5R+7PxrjAm/VzcYJbAQjYButIeNYB2/r87IGKDEMAskowocqyuhamTZS9n6eElDBZrEoUXc9J/lZvXrNqBa2pDsR5a58X6Paj2kMn8Ke9M3vwHcgniEgZtC2h5u6VwbgPMZniqYT5w=,iv:KhGKrf0tXdLb0sWc6kB9lXjj9jOU+wsy76xGFRmwdz8=,tag:s+NBphi1n00GflKqujZcfA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPYWdxSzIrQzRaVnh3K292\nVGkwdWUxanpQbEllWlNvaHBoQ2VYR2pXcVZVCk14ZmxlK1pSWnpCZC8yaE84b1Ew\nNTJUTDErTUVxZzBqdGFORDc1TEo0REkKLS0tIFZJeFIvd3BDOGkwenMrWlAyVHdh\nTzRHNU02RWY4clJ4dk1IV3R4c0VTd2cKeX/tLKOnkbcAhkgCY+T4XWBgc7eUFecn\nfqd6Kxfg6P75OT6Z4ACKsHDGznGk8fYk+Ms67MSCGzr1HXaR14/eVQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxODlXSGpsYk5BZ1piSUhX\nUnlTQXpycmV3YlhLM01SMXZ2ZzFXWEU5MVNZCnVUNFRUTTVNaWVUZWY4dklFMmhW\nWUc1azJFNGJTZFVlRkdSZEd0eUozbk0KLS0tIDhUTFE3cHpFblZTa056R0lscHR4\nSXpoT2QrOU9mcDV2ZjR1bjV4cHZCdXMKyVyxBRY9oyhfj0ZMVRtjf8TT0qRJULwN\nosghj6bPqOFl3C9zBne1Xn/2mOj5lkMZP6MAMPtaW8nvsf/LkZx/Hg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-16T03:08:59Z",
+		"mac": "ENC[AES256_GCM,data:SjmuJVeJsamHE7Yv5Lvoyjp0CysTo3K1nyJgPI7KKp21H8Xq59g9/zbth4pCdIMHyt43MNUXFkhYD/Ox9ySoDEi2pr7H2kM9fcFM0W/ObM/gm/lt5jTLzzS+OkKys+Yw/WA2nIStSNq7rAb/SKFbHvj1P9YBsJxlOnBzTW7uu8g=,iv:tNjnqRX1D+vY8w7RxZzo+HdfjK9pXJpB5MKnb7EyUXk=,tag:PuLU5zmUH14ZxuTUPIz20Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}
--- a/devices/srv1/node2/default.nix
+++ b/devices/srv1/node2/default.nix
@@ -0,0 +1,44 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static =
+        {
+          br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
+          eno2 = { ip = "192.168.178.3"; mask = 24; };
+        };
+        cluster.nodeType = "worker";
+        fileSystems.mount =
+        {
+          nfs."192.168.178.1:/home" = "/home";
+          btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
+            { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
+        };
+      };
+      services =
+      {
+        xray.client.enable = true;
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+      virtualization.kvmHost = { enable = true; gui = true; };
+    };
+    specialisation.no-share-home.configuration =
+    {
+      nixos.system.fileSystems.mount.nfs = inputs.lib.mkForce null;
+      system.nixos.tags = [ "no-share-home" ];
+    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+    # add a bridge for kvm
+    # 设置桥接之后，不能再给eno1配置ip，需要转而给 br0 配置ip
+    networking.bridges.br0.interfaces = [ "eno1" ];
+  };
+}
--- a/devices/srv1/node2/secrets/default.yaml
+++ b/devices/srv1/node2/secrets/default.yaml
@@ -0,0 +1,52 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:U+unsiKt9vNo/EXEpLHR0Ny3DxQEwx7a40KmwZDZki7RQEuM,iv:7w90HNM5lfh2VY20AcUEVdu5X2uxqXxR0hARncmMR60=,tag:xIbKc+9SF5LP/tY/XoGYxA==,type:str]
+users:
+    #ENC[AES256_GCM,data:bAA1+Mx9xsFr,iv:5GWh+DyuRydCKm8K1kaiTJIt4ReEugHFnKYfan6RAE4=,tag:VqcWjIMIYhkSj6f/ZclTVw==,type:comment]
+    xll: ENC[AES256_GCM,data:lqzwlETuKuKa2wh+ickMFiWyprcnIBfRBjri+NWoltxib/LWzEEbyetRc4AKyVaBiDhsOTw6MazPNy2mhcAFwb6pM+QKce5ntA==,iv:VaGQux8MJNPZeHwDpM+yJ47XvOul0qRE8xVdSWjYRhY=,tag:rBWdTPmJX9YsP0l1FtVbJw==,type:str]
+    #ENC[AES256_GCM,data:AgppEXaJcXhQ,iv:gI4nUzfy7w9yqaWlT1NYk1cHdErCJsrlilwYSGxxCdw=,tag:/A6zwbvQdhX9MLfAdXIVqw==,type:comment]
+    zem: ENC[AES256_GCM,data:t0rCwed8EzXbEuwTabzSLUd/Gln3YD9IT56JNVHwlodAvFYwtTDJe3cy7K17TmIkL1Nk/hAGzQ2BIZJxaKq7A5pSNIUO1zqMUQ==,iv:jSKCoNKQ5a91kK19w5mE0lJ9lh391ACq64UtLvJ4kLI=,tag:d6+IrgLyCw05vvLcCF5+yQ==,type:str]
+    #ENC[AES256_GCM,data:s39KO3hHcrOK,iv:ICtP2r9JMjcieHZdyHpj5Z1DympJUcHq2jPpjUwSOzM=,tag:Es3YS+mEg5I3SIujfs50jQ==,type:comment]
+    yjq: ENC[AES256_GCM,data:gOc59J2eiND+qJJRwLYvTymfrjWNRWw8IwLxDdS2cSu0yTN5SWF1eEg+tYmDqqhPmXkIlenL8VyIZD2P+Qi+Vi7l1pZMnneRCw==,iv:TsWOmHlClMgpXbNsCyvs+wkTvvKViAooA36+O4eQesk=,tag:jp5ZO9tlCPNTNZXWXCUEeg==,type:str]
+    #ENC[AES256_GCM,data:JmmZl+8nta5Q,iv:qWGS5i+ntmJ9x3HFClVdfypQKqSTUx827OFu/wxx3HQ=,tag:SzvgJtIQb1Z02GDwkAhveQ==,type:comment]
+    gb: ENC[AES256_GCM,data:pgwGyp/QC+h05grD345pJrJefm4NWd0e6mQEzrsqCbjMi9Ak2nUD+K09mIKQJ39NttC+NQZezRmKUJjDBH50s0O69nBlPOJtgA==,iv:ZLm6KUzD8fTq4YpxhdYjtp7bbDjP7Sy+0fnDO0W5GY0=,tag:H2mNHIQvHe+3YzZ9ITVdOg==,type:str]
+    #ENC[AES256_GCM,data:94hwxSaMkbIB,iv:4Xjukoo7rxeu4SWjwFeLo5fwSX6a8mpkTOIpnOnR/Io=,tag:XOjY6ziyDdMNo53NFSjcJQ==,type:comment]
+    wp: ENC[AES256_GCM,data:9/aVAQskZyQrfhVFVHfpdTWDLdoP2ZO7gG6bNcRpOJEBle3V9XqVSwmLViIIysy4XxoR3cym/7WXB96O3C8feK7sbihaRpT+Dg==,iv:WPnDArVKqV7u3EIQ0CMectK1W6gXKOo37oOybyob3As=,tag:1R/0qjRzif4/sTFSs55NuQ==,type:str]
+    #ENC[AES256_GCM,data:RluXnmnn8CAI,iv:OqzKfed5CARE/KKur0GXDpLBqStEva7YVoQMQX4+FnU=,tag:prOaqWk6ARxEKvnhOnCZhw==,type:comment]
+    hjp: ENC[AES256_GCM,data:Tb9vCi68B88UZc/ZVSxEI+esKOLlFcAPAaMk9FDmkBycZmzDjHfkUKCxVcOMtqeNSluVZ/5IFgowaYbk9ncK6yoYTjXjj1Z0lA==,iv:COs+ijt0h+UygyhWDQV23NRd/xBcfeqz6CO7D+xw7t8=,tag:RaIMaGrgHkidB9vqLR6cNw==,type:str]
+    #ENC[AES256_GCM,data:pymPvP+KjTd2,iv:g5tmBMQevuzES9FVlRten8Vzy5nvgamDNPo6Vy018T4=,tag:sMYZAyyAzEyS5CsAyC7xtw==,type:comment]
+    zzn: ENC[AES256_GCM,data:CJ8cOBjblYIc0GoiPnIbbWfYDfpQW5u31R9T/P0/aVuxi6P44wYYH0posVGthR1laqHIlu8bzgeRyTbBYir/Mw1AGokAnFLEPQ==,iv:dJXFcZ9f3xe3rcPzOLd6AMFh6EyJXlv3/+uR2x9XYsw=,tag:4I1WqtloUSXNeQ6AlVPY5g==,type:str]
+    #ENC[AES256_GCM,data:r1Rl1+lfgMad,iv:9RGwiYlePcXZFDxw5uc1yEwZ4N3lStmE1cGmsj5dPls=,tag:yGChsxZtIzDjMUgIkd+PdA==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:IIZpTdr5jpidbxYCQ+fODOHdoWI51upPI3yxYlrAAd+RE62t6PzAvHKFmKPivbHmQS5RZrJXE7zm9JtwiodRmPl0pYLxYNBpFQ==,iv:WQc1pOungm1gEqYPk/MITbjs1l83ikcys47CARRgoFk=,tag:sS2mXDIWl32ZZzDtictv9g==,type:str]
+    #ENC[AES256_GCM,data:VtrWQKVtCHtA,iv:ap/n2HxQ7dgKOA8rIfenv9LOwwAh1na8+I9O/k/wMxs=,tag:Vl03ortuZ5OS2qcBMnc59g==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:fkxYmHEQnCjx/srKBgjreIR0S7mcXyl1h3H80PFsH3A/yCGnJbFCGK1GW1++Q+tziOnEWCTLZ/l9dlPuB5BFSK7iHiVXtkOfVQ==,iv:z6duWl+LFpS5RJnCGxb3yvgHp96uJYoSsAThWrbGYfg=,tag:AKWisEg506eOgdp/4tLU7g==,type:str]
+    #ENC[AES256_GCM,data:e8HuWaLrvHx5,iv:ZKvfRQtOMV6v3MSCDVoPEsxldI+ZRYJBwrKAD8YZzPc=,tag:tPL3IyjC8f+S+6MoMJSd0A==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:if1S/3AxNLkWvDQJom+4EPRBOpkAPNTkEcqHHLAuEJATSNLlIhVLOPgt10cM4LWx2TdG8V2TcZip9qnr4ABHMsPF5vm6Y53r9Q==,iv:Rba0So8DXJrSC88mjwT8j2AVy84TPm0R6AVf2ZmXNBg=,tag:qiSeYLrw/6QJ7vMiPEZ66A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WlJNWmp2VUxpcXR3NE92
+            TnNuLzg0SVZKdmt1cEVZU2FodXZPdmt6Rm5rClhrbDh3SzFlMU9LVFpEZDFLUGZZ
+            d2RBTVNCamNBWFVEVW9FMjYxcUE4Rm8KLS0tIHBwYjlMU2tnUTZweDBYcmZXUC9l
+            OWFUeE9xdldpTUQ3cDFENjU4YUVwSkUKp7yZGpvKMSm6rvsoPbcaqVznL3wzGEXB
+            OGzrmgY083Gyjb5P/0wPY0ShGMWfWQW6vGchoqVuwr4oHKT3APcrIg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRjBjdGFEMjR6QnQ0a3Nz
+            c2lmVWE0bFh3amRULytZOVhYS3dkL2JmRVhVClVQalh1WjJqcWcxT3ZXMWduN3Nl
+            UzdFNXNQUmtaaTVIVVFVYXkyZEFPUncKLS0tIExrTDA0OEJzQklQOHNJZzBJdzJP
+            MVU1UW9lWFJnSTE2aC9ZL0huYURUK3MK5U4cLWRMm+FFo8ATE/OoAcHzYHFMpOtV
+            Q5kbq5PDMdp4qvoM3T4kLsB34oU55HjFvac0pilOhNRrz4xRMQgvoQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:42Z"
+    mac: ENC[AES256_GCM,data:tb6UXalJcNqd1bCJ4pdWQ5lctAXMrwAJsGagNIjtAklVx/0vibEBTvtVdI3CSNA3OuDguyXc/ECGEqlPNpoRq/F5JINfnirEbaBL6KhNkFxaSLVP7mu1u0KH93qhzA2j4jofderpxj+FvOOMVZNuZkrcSPDoufPA/ypY+YaKuu8=,iv:KPyXi7AD6FSmoZKYUDh2zLZnArvdcHau5XZHk8CbwI4=,tag:7T1jUJ7eNkY9VYt2eP+brg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/srv1/node2/secrets/munge.key
+++ b/devices/srv1/node2/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:04fSLZEkne1LqLZNYpy1tFlKTVUgQNuX9L3cL66FVHD+LqGAyWJGlAnduY+fQMZdDhbBdeEnJKXjyQ2jdDCttuqbPRiJQChtD7ztf+oiP877N143iSY2G245aCjIrAzmFORkGZaQT7nD5oxgCPiLqJzkNPzgjN4HIDsVoYz6jtw=,iv:gTbiJmdXN/62/t53ddfDrYlNLe3AoujT4G03eFQXyZs=,tag:eAYfhXPERqsVKFSkcm+Abw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBb3JtVi92M2JUc3dKVzRt\na1kzNU8ycE1LTmdVZVNFNDNJZmpsTEdCK3hZCjNXajNpcGxXMDJxRjhPMmhFd2la\nZy8xUFZNZXhiVHFtbG9xVmJ3Q2d0NE0KLS0tIDlNWEJqcSsvQTFzc2FxL2F2bVVs\neS9UenMrYXNKbGJVTnZzN3VscWlrRk0K24RHbcTz56GV6AbQt7Yy9+1NClMpQFtk\nf/NO2RYuS0ciHwkJQEw7M48iJuwTSiv1pflXXkNvkl6/I7wPgS/eXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjFQbWd4SUhoOExTdnFk\nd3dVVytZaDAyc1F2eUowdmY0azFKbWJ2Z2pZCnhYQWJtVXVjTTRvTlI4SlVyVHh1\nZlBZTlFheVNKdzN5a0RHM3RkTDhzQncKLS0tIFlpbjRUSzdzS3ZuMW8welNRODdR\nWis0ajQrdUNqVWcwMWF4bVlUaWsrc00KfL/zF2RiAanljrNhRT99i2jPvLySMWXx\nEyzYRuTH8ZGXsX4T2VAPjreBt1ahJ/EgBWmCLibEVK62zWfdquAZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T05:31:41Z",
+		"mac": "ENC[AES256_GCM,data:7kp2KNU4O1yuBdu7cxzg8BytPWiP8hQ0/mWVKPPn4BXjFleyo8KzLC3XZn9Ovt2fHWiF/4hMreOPIDW1W+8n/DedLa2G+zkHiQDVBCyiLJ+FCELvNPdDwR37RvOJ0Oo3RtQaSK2xBhNwS2Qs1G7DemEGFrWXrZ/SeCG5H6bI4X4=,iv:zGG9jcC3McICjeYZd1aGud+VaUhLXg3J/demAqM4vUM=,tag:RINzMA36WfaTRuEy0cTQKQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}
--- a/devices/srv1/node3/default.nix
+++ b/devices/srv1/node3/default.nix
@@ -0,0 +1,28 @@
+inputs:
+{
+  config =
+  {
+    nixos =
+    {
+      system =
+      {
+        nixpkgs.march = "broadwell";
+        networking.networkd.static.eno2 =
+          { ip = "192.168.178.4"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
+        cluster.nodeType = "worker";
+        fileSystems.mount.nfs."192.168.178.1:/home" = "/home";
+      };
+      services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
+      packages.packages._prebuildPackages =
+        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
+    };
+    specialisation.no-share-home.configuration =
+    {
+      nixos.system.fileSystems.mount.nfs = inputs.lib.mkForce null;
+      system.nixos.tags = [ "no-share-home" ];
+    };
+    boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
+  };
+}
--- a/devices/srv1/node3/secrets/default.yaml
+++ b/devices/srv1/node3/secrets/default.yaml
@@ -0,0 +1,50 @@
+users:
+    #ENC[AES256_GCM,data:uBjvj5Y6SIk8,iv:WxYu6Xkh2T7kb3uLqgkJJtHvCmWyvntcGfCKJfSfSmo=,tag:ueHbPNX3KOVO9RdQnw/nog==,type:comment]
+    xll: ENC[AES256_GCM,data:Cp2wBFygUBlZnf0oAAxB5L8/qD/LwKksp0YG4Ic7nay8E8kXJGSYDyTK5AdeVh8/MxLgVVY6LMWtUOzFe3WU1u71pgBGF4x+yw==,iv:wXfcHuJzqWmm++vysZW3z4TLEOkgWTUF/pqFDfgwny8=,tag:k9o2yp1AksTGOgREOLlprQ==,type:str]
+    #ENC[AES256_GCM,data:4CsCDEg/UChs,iv:ENErjaF65B1dCuD56/DCqe37WSCu1q28s2khMyF7I8E=,tag:q9mxHCAsuDGygseYU0pRDg==,type:comment]
+    zem: ENC[AES256_GCM,data:cPDlicY4vrQ5VTyfCVN0zH5EIV8kH2xqlFEUkmwO3TmKV69Qx0nE+6yiUhENKR72zY3p5w4ZFEtF7maqqklWvThkeSs059aFpA==,iv:g+nASIzOUZuyX5MCFcKOJKsKTQhcpSY4sIKArlVZh8o=,tag:WaAYcxHmFs6/EG3oy56xJA==,type:str]
+    #ENC[AES256_GCM,data:fu6KBkGEtzD/,iv:OzClxptcUbrbgmYYoQYcInG5Tl6HrjSRVrt3iIaSrqI=,tag:kc+AxJ7UI45j6eW69CiBkA==,type:comment]
+    yjq: ENC[AES256_GCM,data:QGpjtIrtio3Jc4kGam5cjqCHZJl2c0wWQAD8BXXhiWfwbQF+sQSTk2V3FbvOlHjqcT92ab8qWCCFjIqBH4DJUq+z/eleX6Y4wQ==,iv:aky2Q2kpEf2EhcR9UXIAyf+BSW9CIZCGbyZCp0l3X4c=,tag:RHLILdrK3duFA2iZDDigEw==,type:str]
+    #ENC[AES256_GCM,data:YUQ73+HZk69O,iv:wY5da+RRnPpXOD5+HdKkyYZ04ZpB3NBtRjRq5Utzlvw=,tag:BE8MhvbxTkn3rG4Pe/zitw==,type:comment]
+    gb: ENC[AES256_GCM,data:AkPFt/GGyeKdYtY/cW774Yi4rrxhTFRzXe/hf0rbwFESwf4pwgfdcr9e3bp6mfmNy86CCDMsUVPtg49q+DV+9CwHU1ETe1vIbg==,iv:L/kLfEjt3WEQmgAXjOAsnE2Sp45DQP9LLKcZe1FjnVs=,tag:HluImuMHEhiE8yAw3fjNQg==,type:str]
+    #ENC[AES256_GCM,data:WCkGncBugE2H,iv:ZN3edJuEDKrHo9OZs0jbU1ATI5+WpfVul5i7SK51ME0=,tag:rgxwqwPJcdDNMnRFlxNplA==,type:comment]
+    wp: ENC[AES256_GCM,data:n7S4got9Q/7s7rZQldnB1wJlB36uqjremc1UDeUmzs6I9Gp9YPj7dJBDAHBNzWruo83ciP6PygHcCmHzBojISgW/HdD5j9cgJw==,iv:ymjB5YWxJJXBA80a2MPYHXBV+bNxUhroPWu+1GJo4XY=,tag:GGVz7kzBrSomBityyZBdvg==,type:str]
+    #ENC[AES256_GCM,data:2aKW2wBhF2oG,iv:wXRX5ZAr5O0c/H1WvzK1+kG1NbZU92h89NgXB8lHfMk=,tag:gAW2oQxz2dUthyNvMlmxcA==,type:comment]
+    hjp: ENC[AES256_GCM,data:+9MKYP96nBdLFVcTkpSS/hiTLdTOf5+Rs3dpUus/ym7gl2+aA2rGtlGS+ozALeUV1seNlVAuyhclZG2dH9uhaudlQvQw5ntAzQ==,iv:eobXw5ahEl9I2HlXD+y3NtGFOlPulk+aKVFxuCRe2+g=,tag:zt6MveyltO2xxThG9grZqQ==,type:str]
+    #ENC[AES256_GCM,data:WLU7JBd7ZNES,iv:GkmmM1n0Squ0rundsz4Q+1dkF9BcCaV1hID8bt/gmxI=,tag:MMukyZlOeE0CcnI51VYPWg==,type:comment]
+    zzn: ENC[AES256_GCM,data:5uNrzv43K/TQlGDldxqUYscDoEduTJdRz0jgd5dBh3N3bMNHulZbD95IVAj87OkLgdOtlDPZz3DfB5oxKBVcV0XE/E7GwJKILg==,iv:SB/uOB1SdhC5zGCY/OzBRY6wgGQLwKYuFgekxZpX1Y4=,tag:ckOxmdXvhQjGMPssoLeMPQ==,type:str]
+    #ENC[AES256_GCM,data:xLPmYdIcIUz7,iv:NqaKJJgyMwfVfAYgEAMHXo1qLYfyOHhIcV++lseKcNQ=,tag:qXDuROf4A9T2H61KtrQUpQ==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:izqFF2JD0ZEeNlqrQ9sJcEcrnp/WmyJL46jszmR4fLwrFGcMoekSfOTkzjO8upogY5fIDsn02dwh4mLX74vA8DjeRTaDKZyyfw==,iv:lknYrGgDFQen2w8mtLNHewQXara1ikWvGdvVA8a6Fyg=,tag:EiiMBUhF6YOafD7MCIMA5A==,type:str]
+    #ENC[AES256_GCM,data:Zt6KCQ3chnLi,iv:RpMBGf2zDVWN13PpTr0Zj18ORdIZT2u34BestCjyLsU=,tag:aBuN2QGhxgnOXPC1NOoROQ==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:fAczfnHue47oHJm/8Hcu8iC+scxUQRNZlJWSCFnmtn8PzbOtPXGVLYaZJs3SRE0F7yYsOUZlHnEPaK5bFjCHioindbS0oimBfQ==,iv:F14TVM+UxXm0UbAgLmQpkI4v+jhQ84a4G8IuWRw1k/o=,tag:R+r0be31nLC0T6Isl9/sdA==,type:str]
+    #ENC[AES256_GCM,data:xccChTyxO80R,iv:tSxhbmVwhwD1IbXRNglS+WWMXfzUDaoJfCNqfKWqVko=,tag:XrFTahck6EKRf79NNeMRfg==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:LQAAYOKBVKRsVfwRJOr4jBCqnHKG60euQMngfuI82Dewwtnt4fKZ/iDg6otJIXwdMdiYI4ytr573GaAPyadt/UdDv+EqrLQ3qA==,iv:dD7djoiEBjrZCQCKkjzsVD+IK7T9sL02zxRG3b1uwQ8=,tag:sqJ0Q665aXVnPHWlTS0Rag==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQy8reUxHUm5leVk4dzhx
+            L0h2ZVVONnlEWlBXWlhKa082aXJGRlhIaUhZCkQxSFV3SHcyQjNCN3NyK3h0V1hN
+            SHVZYXJjenlPR2lrL1J0ZkpoTlQ3S1kKLS0tIEZPU2c4VHpzdEwzWTVTUk9OdDFI
+            em9JMjA0VFk3Q0NKSWt4YllkWHpYNWMKJxCl3tXFHSUfawt8pB21WLKvUWwTn+Jl
+            gz52soH0P/k7bg6Lx4gs5WywIIIOWnHg7p0BJS9BCmFWvXR442c2XQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaG1ZdERieVMzM2JjY3Zt
+            KzRTVCt6eVRsSmJXT3FKL0pSVHF0L25SSGlRCkg5bGVHcEhBam56bHdBcUZHRWF0
+            ODVkamc0RlJxNk5hRjMzTVRkYVNsam8KLS0tICsrTXdGMzZ2UmE1VmNyK3pwME1u
+            bHQzK1EvVEhvZFI5MjVxL0Q5UVZYdGsKJl2M3eOB0lRyu2VO1qDjW1pNJ9HhwAS6
+            g5yOa2fxLJn4bvmQAJYeNJ1Wi6sYaBvkbeOegjaKjW4ZvwhP5kWqRA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:50Z"
+    mac: ENC[AES256_GCM,data:pQDphBruG5s5trIOY1fvcCAnLDx+NcVJ6cEP48u92JRnM5cojYXbiFt6Mlq+bYLxkXb2PoKMBoohRbsNdYLRgz3BGAY//Kc5OHGWzi7r9t4/iuhcouZsV/6wHGnrJ0yECS2+LPkT+/JXnYv1ZJTpUR0TSmTvnCgJI6xpWt8HDSA=,iv:Oyn7UESWVDqh3kDFAX3opbC/XEYOa1s3wmGolc1uhTM=,tag:aasXTc9+bgLgCaLDNfbJGA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0
--- a/devices/srv1/node3/secrets/munge.key
+++ b/devices/srv1/node3/secrets/munge.key
@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:9uBZv+GmpEqEbpE1E4szW3EPA6AJPUprWMQs2XwXq/VfrOfVG+Dz6PsAfPgOgii9KMPZb+358lfdhXbKF2cjflMw9Iz1wc2eU8vrbbU7toisLnuYBm2676wKzatQVbL0SHvlyScVIEwNphTJdIPJuMD0JrFMfDV7J/jdgwdpPRE=,iv:fk1YA7IXX/9/jU9jqAg4YrFZrprm9zoBw5avnKtvBnw=,tag:rfsCsir2C4UsUTgfvbRCVg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRm9wakd5Z2cwblM4a3c3\nVURGS3prTHJ5R1RzOGpXaXFOcFlNWGJCTGtjCmt3Q2M1Z0FaTGRscDlOamI2L2Yy\nQUlaNWJMcHdEVVIzMzdYVXdVZVpHd3MKLS0tIGlscllCSnJCS1JDNEVXWXhJVUNa\naFlPSU9lZnpPbFY3VkI3NkNtVlNTWHcKfRcjJroaUVDePl+mg22NndJfFciAuolg\nsOEaEZCH/cIJg0XTXfM18ZRUl4IuMmR3D2L4KAhzbfADNmC81mpMLw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1lee0kl24f0ntss6m69zu2s2e7njdpkv9nl7rlf4nn7rvv0mlgvfqrte2y5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZeDBPMWZnRXRPbkRXQVpm\nL0pwWDE4blRuYUV6QVJyOHBITUJjU1ViR25rCjRJTmF0MDhjNEhFQVNHZ3M4QUJ4\nQ05DbTlVbjhMMDhTdGlZN01tRUxOZE0KLS0tIEExMXZTSzJjeEdqcHBNWjhGSFIx\nQmJaSHh4dHdUTjRmWUZIUFdmVkI3YncKvCunmgurC7YO0Y5FssulaJ/VDvuiR5Y+\nOxfMe34ilsF+k8bTBAuYLlDCl8uQ14cPiOLAhAw1vdFgs9o8cs9MUg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T06:03:27Z",
+		"mac": "ENC[AES256_GCM,data:sEMEYJDZhhza1HvtmQ9maK9gXgBNfNGDhvSySoz/GuiTrs2Hhae/YI+o6DvYHPDUoOJGVwLjHVhfoIYw9CvoCZNm8Gn3fUSeP372x2kRAjFJYJ56qovU5hz7H/m1Mm9CQ38PvnsWMgc+dB1q0h01g4x7/URfjJDlU+Rq4n3f6B4=,iv:v/P0xSTBjGrmhzeAiS0eaQ4Y7pls9xCKPq9gysLuINY=,tag:SsCPc1av/pGpZS5AqzJdxA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}
--- a/devices/surface/default.nix
+++ b/devices/surface/default.nix
@@ -14,7 +14,7 @@ inputs:
            vfat."/dev/disk/by-uuid/4596-D670" = "/boot";
            btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
          };
-          decrypt.auto =
+          luks.auto =
          {
            "/dev/disk/by-uuid/eda0042b-ffd5-47d1-b828-4cf99d744c9f" = { mapper = "root1"; ssd = true; };
            "/dev/disk/by-uuid/41d83848-f3dd-4b2f-946f-de1d2ae1cbd4" = { mapper = "swap"; ssd = true; };
@@ -24,13 +24,11 @@ inputs:
          rollingRootfs = {};
        };
        nixpkgs.march = "skylake";
-        nix = { substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ]; githubToken.enable = true; };
-        kernel = { variant = "xanmod-lts"; patches = [ "surface" "hibernate-progress" ]; };
-        networking.hostname = "surface";
+        nix = { substituters = [ "https://nix-store.chn.moe?priority=100" ]; githubToken.enable = true; };
+        kernel.patches = [ "surface" "hibernate-progress" ];
        gui.enable = true;
      };
      hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
-      virtualization = { docker.enable = true; waydroid.enable = true; };
      services =
      {
        snapper.enable = true;
@@ -45,7 +43,6 @@ inputs:
              "dispatchcnglobal.yuanshen.com"
            ]);
        };
-        firewall.trustedInterfaces = [ "virbr0" ];
        wireguard =
        {
          enable = true;
@@ -54,8 +51,10 @@ inputs:
          wireguardIp = "192.168.83.5";
        };
        beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
+        waydroid = {};
+        docker = {};
      };
-      bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
+      bugs = [ "xmunet" "suspend-hibernate-no-platform" "bluetooth" ];
      packages.vasp = null;
    };
    powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';
--- a/devices/vps4/default.nix
+++ b/devices/vps4/default.nix
@@ -16,7 +16,7 @@ inputs:
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          decrypt.manual =
+          luks.manual =
          {
            enable = true;
            devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };
@@ -27,10 +27,11 @@ inputs:
        };
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:04.0";
        nixpkgs.march = "znver2";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
        initrd.sshd.enable = true;
-        networking = { hostname = "vps4"; networkd = {}; };
-        kernel.variant = "xanmod-latest";
+        networking.networkd = {};
+        nix-ld = null;
+        binfmt = null;
      };
      services =
      {
--- a/devices/vps6/default.nix
+++ b/devices/vps6/default.nix
@@ -16,7 +16,7 @@ inputs:
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          decrypt.manual =
+          luks.manual =
          {
            enable = true;
            devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
@@ -27,16 +27,16 @@ inputs:
        };
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
        nixpkgs.march = "sandybridge";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
        initrd.sshd.enable = true;
-        networking = { hostname = "vps6"; networkd = {}; };
+        networking.networkd = {};
        # do not use cachyos kernel, beesd + cachyos kernel + heavy io = system freeze, not sure why
      };
      services =
      {
        snapper.enable = true;
        sshd = {};
-        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 20; };
+        xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 22; };
        frpServer = { enable = true; serverName = "frp.chn.moe"; };
        nginx =
        {
@@ -52,8 +52,13 @@ inputs:
          // (builtins.listToAttrs (builtins.map
            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
            [
-              "xn--s8w913fdga" "misskey" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
-              "send" "kkmeeting" "api" "git" "grafana" "vikunja" "write" "blog"
+              "xn--s8w913fdga" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
+              "send" "kkmeeting" "api" "git" "grafana" "vikunja" "write" "peertube"
+            ]))
+          // (builtins.listToAttrs (builtins.map
+            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.nas.chn.moe"; })
+            [
+              "misskey"
            ]));
          applications =
          {
@@ -62,6 +67,7 @@ inputs:
            catalog.enable = true;
            main.enable = true;
            nekomia.enable = true;
+            blog = {};
          };
        };
        coturn = {};
@@ -71,7 +77,7 @@ inputs:
        wireguard =
        {
          enable = true;
-          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" ];
+          peers = [ "pc" "nas" "vps7" "surface" "xmupc1" "xmupc2" "pi3b" "srv1-node0" ];
          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
          wireguardIp = "192.168.83.1";
          listenIp = "74.211.99.69";
--- a/devices/vps6/secrets.yaml
+++ b/devices/vps6/secrets.yaml
@@ -44,6 +44,10 @@ xray-server:
        user18: ENC[AES256_GCM,data:dssxPEv8srXydunolaaDAYYo+BOXhp2PoqidOWH3z6NYBpyB,iv:WCLcMMwQJiHZBwreQpaOZp2saXvjBwgYUqSf7HQhMgA=,tag:5jsAVcgAgO+7JhBINz6tzQ==,type:str]
        #ENC[AES256_GCM,data:qGsMmWrUIzVdHw==,iv:DXayEA5zquwOzm+TqECYNHM98r0WSzcP3gA8zkzdPy4=,tag:OKTx12RqP9VxJQOnrBLkmw==,type:comment]
        user19: ENC[AES256_GCM,data:+Mh15DR9xvFAwks86iuHEA9FpObKWTSuVOEzUDpBUS/h0hOz,iv:zYIkic2bibvwCBpomnJ9465mda1rbm3RERBZY9twXuc=,tag:bwdL6DAGgkGYhYFI2C4A+A==,type:str]
+        #ENC[AES256_GCM,data:1g2gohLbiixMes8=,iv:E3HA6cAdv3BdLMcrrcWW4Zsc2KLtW7L8Xrk9Z57l49o=,tag:rZ7W9ckf7lzJ23u5zwQiwg==,type:comment]
+        user20: ENC[AES256_GCM,data:3UbVnn9oMRc0zZR46tWxwM9VFOvMOYm690csUomEVBcS3xPm,iv:KHuPXttLAFr7WT/qa/UYLY8GRsPWYZPyKNmdUh4iFQQ=,tag:jN8rQ0Gv+qnhwOWGH+CwlA==,type:str]
+        #ENC[AES256_GCM,data:GzxXsTbEvdHV7A0=,iv:uxUG4hnYEsmJtnqbEwamwhtLt3UClt7ktmkGyAFdxsc=,tag:sF8YQ2cejAezI3Bbp9qKIw==,type:comment]
+        user21: ENC[AES256_GCM,data:hgDJ11crZaWcKrc+ZDQklXwpnvt/sMbARkx3sLZfQGZqQZeA,iv:2Re+hdJuT5yg/qTymfpN+KdU3criOmwuqqg+SHb8iAo=,tag:s16N6u5cRDaoWxnrCkamuw==,type:str]
    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 nginx:
    #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
@@ -87,8 +91,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-30T10:43:57Z"
-    mac: ENC[AES256_GCM,data:Mg/DZghIkaWM5KEjk5zg3S0L5qPa8/rkc2ooSjA1ewzbDhTKls2tzv7fQqLx2WQtcJiKkoVx22UkiL0AzBwJdCr3473vx93ajTVK9HNu3jqXmuzSiv2iVS21EX9tyBNiL6uWlVAtlVfMMs69PEUF+EJIYY5TkVVPaQjzEebwo5w=,iv:tFON7RVSnNNHo5U4dRuMGDhH5iPGShW9uoda+apiIjI=,tag:3nG/u7vaChFBHoDsLLb23w==,type:str]
+    lastmodified: "2024-09-26T04:24:17Z"
+    mac: ENC[AES256_GCM,data:AXhLmyZWGD6KvMkyHqmCERE6eNE3pD5Pa/9mRBWZe4hiXL4mKTzCn5C/ODGQ1ZeQjDdP+awjJRvLRjMiYFhVlU8rKpg/f2G1gDr4cIbr61sCdzXKX8wFW0G7bJWxxpAC4X59+u9EJ3sNcyf7bJrMdkTzTYpgXh29mtl2bprcdJQ=,iv:pK4hYexcWng3GwOmWGqgyMsmATnXgcwR3NH4UxCwpvE=,tag:zpv64JWoXc5cDCukDuW51g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0
--- a/devices/vps7/default.nix
+++ b/devices/vps7/default.nix
@@ -16,7 +16,7 @@ inputs:
              "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
            };
          };
-          decrypt.manual =
+          luks.manual =
          {
            enable = true;
            devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
@@ -27,9 +27,9 @@ inputs:
        };
        grub.installDevice = "/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0";
        nixpkgs.march = "znver2";
-        nix.substituters = [ "https://cache.nixos.org/" "https://nix-store.chn.moe" ];
+        nix.substituters = [ "https://nix-store.chn.moe?priority=100" ];
        initrd.sshd.enable = true;
-        networking = { hostname = "vps7"; networkd = {}; };
+        networking.networkd = {};
      };
      services =
      {
@@ -37,8 +37,7 @@ inputs:
        sshd = {};
        rsshub.enable = true;
        wallabag.enable = true;
-        misskey.instances =
-          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
+        misskey.instances.misskey.hostname = "xn--s8w913fdga.chn.moe";
        synapse.instances =
        {
          synapse.matrixHostname = "synapse.chn.moe";
@@ -52,7 +51,7 @@ inputs:
        send.enable = true;
        huginn.enable = true;
        fz-new-order = {};
-        nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; blog = {}; };
+        nginx.applications = { kkmeeting.enable = true; webdav.instances."webdav.chn.moe" = {}; };
        httpapi.enable = true;
        gitea = { enable = true; ssh = {}; };
        grafana.enable = true;
@@ -69,6 +68,8 @@ inputs:
        chatgpt = {};
        xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
        writefreely = {};
+        docker = {};
+        peertube = {};
      };
    };
    specialisation.generic.configuration =
--- a/devices/vps7/secrets.yaml
+++ b/devices/vps7/secrets.yaml
@@ -10,16 +10,15 @@ redis:
    rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
    wallabag: ENC[AES256_GCM,data:WkiqS9TOHxYalDp7Ssgg2x7vj4D58psQ5au4a0e3LZBecERwzUKmrhbVKRuDvNTwWbYxSds9SAca0wN+pWmrmA==,iv:QqHlzSXG1I4+p8wd58lcQs8TqAF3foxiYVdgL8L3IpA=,tag:CPtFgIeFL5W25gtd6NFkrg==,type:str]
    misskey-misskey: ENC[AES256_GCM,data:OHjt9o+m++NT5aaFbwBT/wSMdUdgf4zscd/JxjCo5HDhC3WeWMJV7z//kATI5Dg4BWAhvPlL02Vrly4RraIzLw==,iv:sQB4/D2SsOuDR3bTrmlNg7o+6ehFznDsqVc3BX9pK20=,tag:tcwTBt/JhyW8ZTAIWIkWBA==,type:str]
-    misskey-misskey-old: ENC[AES256_GCM,data:amUqMycdXUFvjg66pXKnlZqiESBYMci0k8iYzj824SaEqHl3Nq/I0TjYX++xEUg+RGYyTIcSaj96HUANTKpc1A==,iv:ND1mQLHxltRlOdpJ80ywheGo6hkl7OgRyk9TguJMuTw=,tag:dhCCwnCOnyT2iXdEMK0szg==,type:str]
    nextcloud: ENC[AES256_GCM,data:jwN/CqwkU/5Rd6w75/bV2Yej9b0CoxZaiJEcZXFx+9XUPY3Xg1tQdEr1SALG8xzOEdoL6WBVs14NvrrL25GeTQ==,iv:p5+0AB52QqScJwMhNIrM/7HAcRPdD9Z8xV6uwIDOwIg=,tag:f1XbNDDRXvGl/dkV9Wp2Ug==,type:str]
    send: ENC[AES256_GCM,data:IGxj3cgp+fQBdupfK+IgPEQSPuXdM9LRSLGSATNIkzUWC6sQw1aaKTDuRc8cU2BG6quthRwuWnK/F7k3KrUi8Q==,iv:LI9MkaF4e47FPUyL7AXZpO+CdgF91ScdiqjrE8PZjJ4=,tag:eNugln5M0AhU1xmVWFN7Aw==,type:str]
    mastodon: ENC[AES256_GCM,data:E5aMRzqd1dqcw66uZwWoT+LDH30mg1vZjk3lhKIXKPd36MANE6z04aBPcAHyHT71jEYsect9JXagC4MUJBuSSQ==,iv:4IjTTNSTraL33fInlTkB2ZylcEaaKi5pgvugZIk24e0=,tag:32JSTNpF2cxYh/NEAS6jZQ==,type:str]
    synapse-synapse: ENC[AES256_GCM,data:8CVbcN2FG4mRT4PnlOGsS7tDfS+6ojIJFvq2EwItxn1gg2Ghd/Bmx+5tS/Do2FrYp/Xiv1EqucomM50r5bXnmg==,iv:TT7zBKQ4M10XYVCn5aeSu9IqjrIEHHazPUCOTmgRAU0=,tag:0+Q9hZMBVDj1TnHj3xoTBA==,type:str]
    synapse-matrix: ENC[AES256_GCM,data:eJ9GXDVLPg1C+Zjpj3NnWUyZxDbOZ61f+gs/bkZgdWjeu61MEMtU/Hh+p/ceAn3y0aPi0ZTcd+zSgIPIkcj+qg==,iv:uTdS4uguNJErc+DDW4H6dsRFkqlkHtaCfR8LR/d9nvY=,tag:UhY9xbe1r7FUpyid2nSt5Q==,type:str]
+    peertube: ENC[AES256_GCM,data:cN+cClNV1JD+Z1Wlp07MY7BmLr/EZYZZt04mxKKKN8RG1ZSMGykbc3hd00E14ubhCittJXSPbIWyO63lCGGEPg==,iv:3z1BR0j26LGfXwDDPYU/i8Qx/7529KKoar+xGZanirI=,tag:g/NSGDE1iEYJ1MStrV3rpg==,type:str]
 postgresql:
    wallabag: ENC[AES256_GCM,data:ANwvEE3K/W/hU34Y7RvlbUuJNo2bOaRfeusYM9pRxXQOdG4XpwYfd/DprsrVjlkrMFuTurUR5j6UNHWh+ILDbQ==,iv:K8doqhVosz+OosMrLJXrSxairr84EeGs3EWgVQjpkS8=,tag:WjDzy7ubm/GVlBkW0O3znQ==,type:str]
    misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
-    misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
    synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
    vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
    nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
@@ -29,6 +28,7 @@ postgresql:
    akkoma: ENC[AES256_GCM,data:6piRt7BbMBLVGdot+VyoJN3/S8DoPNTYHFh/1coHSLNmiA6kU/6sca4Bts1Up/Vu164oTsFAr1JsKx6tzNzAPg==,iv:qplA1GXHwzVrmjm7eagCk3PFa7DRdwaf+p7N1HLb6mw=,tag:W6WedSK3R1IgZVo/0Hr9vA==,type:str]
    synapse_matrix: ENC[AES256_GCM,data:5j+TYJ3vYUqu6CdRDYAT558DsTWbX4Rh+HuukPog5HGXlhneL3RnxVeGBR9CV1rlCP1NY99Nm8roBG+BcyPYHQ==,iv:CboB6lzqxAE/8ZlzaTU3bxw94N6OAhrq8pZ0AfxQiUc=,tag:z6cM3ufgbMn5n5PzgqdRjw==,type:str]
    vikunja: ENC[AES256_GCM,data:syb4NYBxL3DdmZmcC+em0klmm6bkkIL/DH/gnzShYRiaezRFskT+yay9govn++SpbuvkoCJq/GYAFxNL+hcVtw==,iv:TQUgdzYQ0gqsAmux9v3BAQFNzHnCTZ+X/OC0b9Bfya8=,tag:b1AsiAW5XzA3DzGdf8J03g==,type:str]
+    peertube: ENC[AES256_GCM,data:dLzOez3dTy0NqHED1Oc43Ox2AFuH196kxwOSuR6RejUw3iJuzEQCdmA/i+70zHoveAYBdPCGpM8cz0y2M+usjw==,iv:KxDqmbNBkJ6Nw0M3060L9ESDf2qAur7umlejcDyRmwA=,tag:RScP7Cny8b1Z1/REpk+daA==,type:str]
 rsshub:
    pixiv-refreshtoken: ENC[AES256_GCM,data:EeSOTSAAh+1Dc8+a/AaPJ0aBK5DTa3pdS6DrIMQmRw/n0SRu2QoynIF76w==,iv:dnZxi8jM1I4w3C2duYielpP/8wOAdHDjcqDIrowM0dM=,tag:8irGvLEbRJHV9TB8Jibs9g==,type:str]
    youtube-key: ENC[AES256_GCM,data:OEm/ynOUPUq7ZEVzL2jgs9d+utkLTIdNq0MHE0JDujb9ndAwyJJI,iv:RRae6Cg6GdDnXAQOdtBYmcA7ZNuu70VpIg2MEezBn5k=,tag:gX4ZG345cT3Jh3ovUxtLGw==,type:str]
@@ -122,6 +122,9 @@ xray-server:
    private-key: ENC[AES256_GCM,data:TarrinCFzWkB5zCc7i7f3B3tFfxrF+cGnrg4bw9CAGKWBazSJHCviY8Imw==,iv:azHdrc6AlgS9RPwGVsYRb8bBeC/askCdut1rnv9TA3I=,tag:AT2lLraKVgbp9GmlLJiI+w==,type:str]
 writefreely:
    chn: ENC[AES256_GCM,data:YvhPa69sVdiljm9Ix6yQh6YCEpFvC9iw5Yx72MBcGr7+swdbvWDAfMmGFY066mAPvhpwZX/IEivKvrS0t/OSnw==,iv:7s2yEb30YaCAtNeevbur0HL28nXHVIqmCx6Bngh+HWk=,tag:yx0JK8RNQMVcYLBSxNj+uw==,type:str]
+peertube:
+    secrets: ENC[AES256_GCM,data:DAlig4wYCridlfS00YOqH++/4Rkssq2bkJ1bhERrsgeqdccwwnk6ADKpN2UBGANNYiTj2VUHsHT6mIWxPRcJvQ==,iv:kOedA1gAD7el6JbP8MujSCSfkkHM6CDDMSs2LwPmsGU=,tag:ZDS+LGX2hNXHw15Js2sBkQ==,type:str]
+    password: ENC[AES256_GCM,data:jmKmQlFqHSmImfym2M3/+ItbPxx1GwgrLRZwk7KxqXGHFvqZ1ybCnfZCN8jmA1gVJLuPLTrYA9ggHwdKgVrknw==,iv:cBSb5PJsjHBAMgrxlZaVtw1aP39AXMtdk5pnnCyyZbQ=,tag:6TLoDRY6305lm4HVapT4yQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -146,8 +149,8 @@ sops:
            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-02T23:57:33Z"
-    mac: ENC[AES256_GCM,data:Tp7uSF3G1WALzv7jPSXGyIJbwYLHz4sF73NUoAI6KPboLs3juhDiZjJfkBkIIv4BawWNTvvAQfBL6hbpPbn3bLpkTvU8TiHyP9yiY5kJkid37I2s8KOHHaxKSu4CXlkAeXdZX0I1iujAOsKYUd2GnN19V07K0qwCtZOVvZXvjsk=,iv:fcsE7qXrcoaRdTv0C4nmfNvIDXtTXiKyF7TCfnkvRPg=,tag:Dgdq4gT2lzhkXZ10uUCwwQ==,type:str]
+    lastmodified: "2024-10-05T02:43:01Z"
+    mac: ENC[AES256_GCM,data:frMtsfATEGOCwkR5g6sOLszwtBq1rfHvofevbzDHuKwJQtI4IXpfgyohyQ64tZ7K6YLqR0bf3yP9A7zyIxAzIvgKciIDdIYI/LUCAmOsUE9On70UiVxFj8WAL700geHfr2X+1Vzl9suMBA3E8h9O02wcuuD4gumZlLgXqzmbtZE=,iv:oB8W9+KO8jJbSnICsN5CMRCRs6uM6y8xszCyWlRCkV0=,tag:JxLLwUsE/7nxDAzMmUYdjg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.0
--- a/devices/xmupc1/README.md
+++ b/devices/xmupc1/README.md
@@ -5,7 +5,7 @@
 * 显卡：
  * 4090：24 G 显存。
  * 3090：24 G 显存。
-  * 2080Ti: 12 G 显存。
+  * P5000: 16 G 显存。
 * 硬盘：2 T。

 # 队列系统（SLURM）
--- a/devices/xmupc1/default.nix
+++ b/devices/xmupc1/default.nix
@@ -48,17 +48,15 @@ inputs:
          };
        };
        gui = { enable = true; preferred = false; autoStart = true; };
-        networking.hostname = "xmupc1";
        nix.remote.slave.enable = true;
      };
      hardware = { cpus = [ "amd" ]; gpu.type = "nvidia"; };
-      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      virtualization.kvmHost = { enable = true; gui = true; };
      services =
      {
        snapper.enable = true;
        sshd = { passwordAuthentication = true; groupBanner = true; };
        xray.client.enable = true;
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
        smartd.enable = true;
        beesd.instances =
        {
@@ -75,9 +73,16 @@ inputs:
        slurm =
        {
          enable = true;
-          cpu = { cores = 16; threads = 2; mpiThreads = 3; openmpThreads = 4; };
-          memoryMB = 94208;
-          gpus = { "2080_ti" = 1; "3090" = 1; "4090" = 1; };
+          master = "xmupc1";
+          node.xmupc1 =
+          {
+            name = "xmupc1"; address = "127.0.0.1";
+            cpu = { cores = 16; threads = 2; };
+            memoryMB = 94208;
+            gpus = { "p5000" = 1; "3090" = 1; "4090" = 1; };
+          };
+          partitions.localhost = [ "xmupc1" ];
+          tui = { cpuMpiThreads = 3; cpuOpenmpThreads = 4; gpus = [ "p5000" "3090" "4090" ]; };
        };
        xrdp = { enable = true; hostname = [ "xmupc1.chn.moe" ]; };
        samba =
@@ -88,9 +93,10 @@ inputs:
        };
        groupshare = {};
        hpcstat = {};
+        docker = {};
      };
      bugs = [ "xmunet" "amdpstate" ];
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "zzn" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" ];
    };
    services.hardware.bolt.enable = true;
  };
--- a/devices/xmupc2/default.nix
+++ b/devices/xmupc2/default.nix
@@ -41,17 +41,25 @@ inputs:
          };
        };
        gui = { enable = true; preferred = false; autoStart = true; };
-        networking.hostname = "xmupc2";
-        nix.remote.slave.enable = true;
+        nix =
+        {
+          marches =
+          [
+            "broadwell" "skylake"
+            # AVX512F CLWB AVX512VL AVX512BW AVX512DQ AVX512CD AVX512VNNI
+            # "cascadelake"
+          ];
+          remote.slave.enable = true;
+        };
+        grub.windowsEntries."8F50-83B8" = "猿神，启动！";
      };
      hardware = { cpus = [ "intel" ]; gpu.type = "nvidia"; };
-      virtualization = { waydroid.enable = true; docker.enable = true; kvmHost = { enable = true; gui = true; }; };
+      virtualization.kvmHost = { enable = true; gui = true; };
      services =
      {
        snapper.enable = true;
        sshd = { passwordAuthentication = true; groupBanner = true; };
        xray.client.enable = true;
-        firewall.trustedInterfaces = [ "virbr0" "waydroid0" ];
        smartd.enable = true;
        beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
        wireguard =
@@ -64,16 +72,24 @@ inputs:
        slurm =
        {
          enable = true;
-          cpu = { sockets = 2; cores = 22; threads = 2; mpiThreads = 4; openmpThreads = 10; };
-          memoryMB = 253952;
-          gpus."4090" = 1;
+          master = "xmupc2";
+          node.xmupc2 =
+          {
+            name = "xmupc2"; address = "127.0.0.1";
+            cpu = { sockets = 2; cores = 22; threads = 2; };
+            memoryMB = 253952;
+            gpus."4090" = 1;
+          };
+          partitions.localhost = [ "xmupc2" ];
+          tui = { cpuMpiThreads = 8; cpuOpenmpThreads = 10; gpus = [ "4090" ]; };
        };
        xrdp = { enable = true; hostname = [ "xmupc2.chn.moe" ]; };
        samba = { enable = true; hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
        groupshare = {};
+        docker = {};
      };
      bugs = [ "xmunet" ];
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" ];
    };
  };
 }
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1723815556,
-        "narHash": "sha256-TgkChEFJHqrciuI1Va7buSs5RQHCSxbWRFmuOI+e2tY=",
+        "lastModified": 1728233826,
+        "narHash": "sha256-83/OY95iYtZFvjbDXBKo7SFs2GplDvpR2E5N/DDXSRs=",
        "owner": "ezKEa",
        "repo": "aagl-gtk-on-nix",
-        "rev": "4d7fa422b50b612aa29bfb8487472f1cd9bad85b",
+        "rev": "7b8059162c32fc8a246bfb1736cd620751952fdc",
        "type": "github"
      },
      "original": {
@@ -21,6 +21,22 @@
        "type": "github"
      }
    },
+    "blog": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728549173,
+        "narHash": "sha256-j2fKbd38tPnCS9TQNneGwfC8z9tASzrdoZT9iOOpIvc=",
+        "ref": "refs/heads/main",
+        "rev": "de2438b2894cd89c1e3626a8b78566e6c2b6d497",
+        "revCount": 23,
+        "type": "git",
+        "url": "https://git.chn.moe/chn/blog.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.chn.moe/chn/blog.git"
+      }
+    },
    "blurred-wallpaper": {
      "flake": false,
      "locked": {
@@ -44,17 +60,17 @@
        ]
      },
      "locked": {
-        "lastModified": 1713974364,
-        "narHash": "sha256-ilZTVWSaNP1ibhQIIRXE+q9Lj2XOH+F9W3Co4QyY1eU=",
+        "lastModified": 1726983918,
+        "narHash": "sha256-eRGl50mhbJRT9Mk2NbePr6yzxzZRygndx4O7kObVa3g=",
        "ref": "refs/heads/master",
-        "rev": "de89197a4a7b162db7df9d41c9d07759d87c5709",
-        "revCount": 937,
+        "rev": "7370c1d1ef2421608e1355368361af92777a2c6c",
+        "revCount": 940,
        "type": "git",
-        "url": "https://pm.bsc.es/gitlab/rarias/bscpkgs.git"
+        "url": "https://git.chn.moe/chn/bscpkgs.git"
      },
      "original": {
        "type": "git",
-        "url": "https://pm.bsc.es/gitlab/rarias/bscpkgs.git"
+        "url": "https://git.chn.moe/chn/bscpkgs.git"
      }
    },
    "catppuccin": {
@@ -486,6 +502,42 @@
        "type": "github"
      }
    },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "git-lfs-transfer": {
      "flake": false,
      "locked": {
@@ -543,11 +595,11 @@
    "hextra": {
      "flake": false,
      "locked": {
-        "lastModified": 1724317530,
-        "narHash": "sha256-luENDR+fn9NbqNkn9wpLRnD41MeerFEUsrDgKRpnmg8=",
+        "lastModified": 1727602023,
+        "narHash": "sha256-fYfevapv+7x4WmYmte3vhQeOakHMchBGC7eYvOMru+0=",
        "owner": "imfing",
        "repo": "hextra",
-        "rev": "c6de4b5b6b1ec04647b0235e9c8b1158b1d58c09",
+        "rev": "94624bcac67cf587ec1006a9c2f0d72fbce9f135",
        "type": "github"
      },
      "original": {
@@ -696,11 +748,11 @@
    "misskey": {
      "flake": false,
      "locked": {
-        "lastModified": 1724207820,
-        "narHash": "sha256-tm4YTpKqI7g4ACn8vkJUIFQmKcHlcDTkoBCrHEd3fp8=",
+        "lastModified": 1727700498,
+        "narHash": "sha256-h0oJ9128xsNGLzLTssjnTT+11vW4y+jrjy6p9qq6jFE=",
        "ref": "refs/heads/chn-mod",
-        "rev": "ac5c495d437fcdba2c523308119477a750440f3d",
-        "revCount": 25947,
+        "rev": "1eeabe04311c4aed657b184666152eeb5e837df9",
+        "revCount": 26110,
        "submodules": true,
        "type": "git",
        "url": "https://github.com/CHN-beta/misskey"
@@ -819,6 +871,27 @@
        "type": "github"
      }
    },
+    "nix-github-actions_2": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703863825,
+        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
    "nix-index-database": {
      "inputs": {
        "nixpkgs": [
@@ -913,13 +986,29 @@
        "type": "github"
      }
    },
+    "nixos-wallpaper": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1715952274,
+        "narHash": "sha256-i2L4L9mV/wOl6QV+d8pyLZUHS+QIFJN5lYuQrP+CSjk=",
+        "ref": "refs/heads/main",
+        "rev": "1ad78b20b21c9f4f7ba5f4c897f74276763317eb",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1724925520,
-        "narHash": "sha256-MfvD4Ed4wCTG1V+h3rUN9j9csEi+2tgpRwhGAV4MFqw=",
+        "lastModified": 1727884105,
+        "narHash": "sha256-J4lHJFQp7AFEa+O52KgYMCXkffAgpXWGyD89AU8xeJE=",
        "owner": "CHN-beta",
        "repo": "nixpkgs",
-        "rev": "8c66b7335f2f4ab354e41d828b74d851c64c4b85",
+        "rev": "e8db202a0ba0b25d01c01b49ed3025f7b0900d59",
        "type": "github"
      },
      "original": {
@@ -1226,6 +1315,46 @@
        "type": "github"
      }
    },
+    "pocketfft": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1722531938,
+        "narHash": "sha256-1kfMW9xGHtYiiCD4Qh4rXEuAi9EIzJ4lR+YLGjqzoaU=",
+        "owner": "mreineck",
+        "repo": "pocketfft",
+        "rev": "bb87ca50df0478415a12d9011dc374eeed4e9d93",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mreineck",
+        "repo": "pocketfft",
+        "type": "github"
+      }
+    },
+    "poetry2nix": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nix-github-actions": "nix-github-actions_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_6",
+        "treefmt-nix": "treefmt-nix_5"
+      },
+      "locked": {
+        "lastModified": 1725358301,
+        "narHash": "sha256-clY4INR7RjOVKya3FGNYvOhyFyUhd3dGQsnV2Za3rz0=",
+        "owner": "CHN-beta",
+        "repo": "poetry2nix",
+        "rev": "1f803d2b2faa5b785dfd2fafe99b2411731bf08c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "repo": "poetry2nix",
+        "type": "github"
+      }
+    },
    "pre-commit-hooks-nix": {
      "inputs": {
        "flake-compat": "flake-compat_5",
@@ -1250,6 +1379,22 @@
        "type": "github"
      }
    },
+    "py4vasp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1718736886,
+        "narHash": "sha256-uAKhxPwiI3glSKMfynDIUrXQ7s2sfKw/PGVNoP40y00=",
+        "owner": "vasp-dev",
+        "repo": "py4vasp",
+        "rev": "661b9efed3824b36e67c559f4120b5ecfd231bce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vasp-dev",
+        "repo": "py4vasp",
+        "type": "github"
+      }
+    },
    "qchem": {
      "inputs": {
        "nixpkgs": [
@@ -1274,6 +1419,7 @@
    "root": {
      "inputs": {
        "aagl": "aagl",
+        "blog": "blog",
        "blurred-wallpaper": "blurred-wallpaper",
        "bscpkgs": "bscpkgs",
        "catppuccin": "catppuccin",
@@ -1303,6 +1449,7 @@
        "nix-index-database": "nix-index-database",
        "nix-vscode-extensions": "nix-vscode-extensions",
        "nixos-hardware": "nixos-hardware",
+        "nixos-wallpaper": "nixos-wallpaper",
        "nixpkgs": "nixpkgs",
        "nixpkgs-22.05": "nixpkgs-22.05",
        "nixpkgs-22.11": "nixpkgs-22.11",
@@ -1314,15 +1461,20 @@
        "nur-xddxdd": "nur-xddxdd",
        "openxlsx": "openxlsx",
        "plasma-manager": "plasma-manager",
+        "pocketfft": "pocketfft",
+        "poetry2nix": "poetry2nix",
+        "py4vasp": "py4vasp",
        "qchem": "qchem",
        "rsshub": "rsshub",
        "rycee": "rycee",
        "slate": "slate",
        "sockpp": "sockpp",
        "sops-nix": "sops-nix",
+        "spectroscopy": "spectroscopy",
        "sqlite-orm": "sqlite-orm",
        "tgbot-cpp": "tgbot-cpp",
        "v-sim": "v-sim",
+        "winapps": "winapps",
        "zpp-bits": "zpp-bits",
        "zxorm": "zxorm"
      }
@@ -1363,11 +1515,11 @@
    "rycee": {
      "flake": false,
      "locked": {
-        "lastModified": 1724645012,
-        "narHash": "sha256-XJ8B9ecksgZBlWV9pnDgBWVePyHDg/cLYJ/6YF/RdRA=",
+        "lastModified": 1725783932,
+        "narHash": "sha256-ZrDE5yqkgiv0F34w1QFz1oZnNnReW0PEA6vjO6gx4Uc=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "70645c904b41b9ddf70f7218898c48df93e8254f",
+        "rev": "58ac93a2ade218ea5e4dae38246030c7342b1eb4",
        "type": "gitlab"
      },
      "original": {
@@ -1431,6 +1583,22 @@
        "type": "github"
      }
    },
+    "spectroscopy": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1709899498,
+        "narHash": "sha256-xZ3AzNqrL73SPyUtVKGE+GDppou/GoatBrRCYVfiv0s=",
+        "owner": "skelton-group",
+        "repo": "Phonopy-Spectroscopy",
+        "rev": "316fbf4f45e2f8d134acf67374de905c705d7db7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "skelton-group",
+        "repo": "Phonopy-Spectroscopy",
+        "type": "github"
+      }
+    },
    "sqlite-orm": {
      "flake": false,
      "locked": {
@@ -1507,6 +1675,50 @@
        "type": "github"
      }
    },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "id": "systems",
+        "type": "indirect"
+      }
+    },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "tgbot-cpp": {
      "flake": false,
      "locked": {
@@ -1607,6 +1819,27 @@
        "type": "github"
      }
    },
+    "treefmt-nix_5": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1719749022,
+        "narHash": "sha256-ddPKHcqaKCIFSFc/cvxS14goUhCOAwsM1PbMr0ZtHMg=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "8df5ff62195d4e67e2264df0b7f5e8c9995fd0bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
    "v-sim": {
      "flake": false,
      "locked": {
@@ -1623,6 +1856,28 @@
        "type": "gitlab"
      }
    },
+    "winapps": {
+      "inputs": {
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1728108519,
+        "narHash": "sha256-JnRyiNR1O79n90TPjDBNpqd/Qh6jnP4t92rCgK/s6qU=",
+        "owner": "CHN-beta",
+        "repo": "winapps",
+        "rev": "64478a87a49d6093f4d4f3a281bf0eecd2e6f977",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "ref": "feat-nix-packaging",
+        "repo": "winapps",
+        "type": "github"
+      }
+    },
    "yafas": {
      "inputs": {
        "flake-schemas": [
--- a/flake.nix
+++ b/flake.nix
@@ -37,7 +37,9 @@
    };
    gricad = { url = "github:Gricad/nur-packages"; flake = false; };
    catppuccin.url = "github:catppuccin/nix";
-    bscpkgs = { url = "git+https://pm.bsc.es/gitlab/rarias/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
+    bscpkgs = { url = "git+https://git.chn.moe/chn/bscpkgs.git"; inputs.nixpkgs.follows = "nixpkgs"; };
+    poetry2nix = { url = "github:CHN-beta/poetry2nix"; inputs.nixpkgs.follows = "nixpkgs"; };
+    winapps = { url = "github:CHN-beta/winapps/feat-nix-packaging"; inputs.nixpkgs.follows = "nixpkgs"; };

    misskey = { url = "git+https://github.com/CHN-beta/misskey?submodules=1"; flake = false; };
    rsshub = { url = "github:DIYgod/RSSHub"; flake = false; };
@@ -68,151 +70,21 @@
    nc4nix = { url = "github:helsinki-systems/nc4nix"; flake = false; };
    hextra = { url = "github:imfing/hextra"; flake = false; };
    nu-scripts = { url = "github:nushell/nu_scripts"; flake = false; };
-
-    # does not support lfs yet
-    # nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git"; flake = false; };
+    py4vasp = { url = "github:vasp-dev/py4vasp"; flake = false; };
+    pocketfft = { url = "github:mreineck/pocketfft"; flake = false; };
+    blog = { url = "git+https://git.chn.moe/chn/blog.git"; flake = false; };
+    nixos-wallpaper = { url = "git+https://git.chn.moe/chn/nixos-wallpaper.git"; flake = false; };
+    spectroscopy = { url = "github:skelton-group/Phonopy-Spectroscopy"; flake = false; };
  };

-  outputs = inputs:
-    let
-      localLib = import ./lib.nix inputs.nixpkgs.lib;
-      devices = builtins.filter (dir: (builtins.readDir ./devices/${dir})."default.nix" or null == "regular" )
-        (builtins.attrNames (builtins.readDir ./devices));
-    in
-    {
-      packages.x86_64-linux = rec
-      {
-        pkgs = (import inputs.nixpkgs
-        {
-          system = "x86_64-linux";
-          config.allowUnfree = true;
-          overlays = [ inputs.self.overlays.default ];
-        });
-        default = inputs.nixpkgs.legacyPackages.x86_64-linux.writeText "systems"
-          (builtins.concatStringsSep "\n" (builtins.map
-            (system: builtins.toString inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel)
-            devices));
-        hpcstat =
-          let
-            openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
-              (prev: { doCheck = false; patches = prev.patches ++ [ ./packages/hpcstat/openssh.patch ];});
-            duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
-          in pkgs.pkgsStatic.localPackages.hpcstat.override
-            { inherit openssh duc; standalone = true; version = inputs.self.rev or "dirty"; };
-        ufo =
-          let
-            range-v3 = pkgs.pkgsStatic.range-v3.overrideAttrs (prev:
-            {
-              cmakeFlags = prev.cmakeFlags or []
-                ++ [ "-DRANGE_V3_DOCS=OFF" "-DRANGE_V3_TESTS=OFF" "-DRANGE_V3_EXAMPLES=OFF" ];
-              doCheck = false;
-            });
-            tbb = pkgs.pkgsStatic.tbb_2021_11.overrideAttrs (prev: { cmakeFlags = prev.cmakeFlags or [] ++
-              [ "-DTBB_TEST=OFF" ]; });
-            biu = pkgs.pkgsStatic.localPackages.biu.override { inherit range-v3; };
-            matplotplusplus = pkgs.pkgsStatic.localPackages.matplotplusplus.override { libtiff = null; };
-          in pkgs.pkgsStatic.localPackages.ufo.override { inherit biu tbb matplotplusplus; };
-        chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
-        blog = pkgs.callPackage ./blog { inherit (inputs) hextra; };
-      }
-      // (builtins.listToAttrs (builtins.map
-        (system:
-        {
-          name = system;
-          value = inputs.self.outputs.nixosConfigurations.${system}.config.system.build.toplevel;
-        })
-        devices)
-      );
-      nixosConfigurations =
-      (
-        (builtins.listToAttrs (builtins.map
-          (system:
-          {
-            name = system;
-            value = inputs.nixpkgs.lib.nixosSystem
-            {
-              system = "x86_64-linux";
-              specialArgs = { topInputs = inputs; inherit localLib; };
-              modules = localLib.mkModules
-              [
-                (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
-                  # replace pkgs with final to avoid infinite recursion
-                  { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
-                ./modules
-                ./devices/${system}
-              ];
-            };
-          })
-          devices))
-        // {
-          pi3b = inputs.nixpkgs.lib.nixosSystem
-          {
-            system = "aarch64-linux";
-            specialArgs = { topInputs = inputs; inherit localLib; };
-            modules = localLib.mkModules
-            [
-              (moduleInputs: { config.nixpkgs.overlays = [(prev: final:
-                # replace pkgs with final to avoid infinite recursion
-                { localPackages = import ./packages (moduleInputs // { pkgs = final; }); })]; })
-              ./modules
-              ./devices/pi3b
-            ];
-          };
-        }
-      );
-      overlays.default = final: prev:
-        { localPackages = (import ./packages { inherit (inputs) lib; pkgs = final; topInputs = inputs; }); };
-      config = { archive = false; branch = "production"; };
-      devShells.x86_64-linux = let inherit (inputs.self.packages.x86_64-linux) pkgs; in
-      {
-        biu = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ pkgs.localPackages.biu ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        hpcstat = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.hpcstat.override { version = null; }) ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        sbatch-tui = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.sbatch-tui ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        ufo = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-        {
-          inputsFrom = [ (inputs.self.packages.x86_64-linux.ufo.override { version = null; }) ];
-          packages = [ pkgs.ccls ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        chn-bsub = pkgs.mkShell
-        {
-          inputsFrom = [ pkgs.localPackages.chn-bsub ];
-          packages = [ pkgs.clang-tools_18 ];
-          CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-        };
-        winjob =
-          let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
-          in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
-          {
-            inputsFrom = [ winjob ];
-            packages = [ clang-tools_18 ];
-            CMAKE_EXPORT_COMPILE_COMMANDS = "1";
-          };
-      };
-      src = let inherit (inputs.self.packages.x86_64-linux) pkgs; in
-      {
-        nixos-wallpaper = pkgs.fetchgit
-        {
-          url = "https://git.chn.moe/chn/nixos-wallpaper.git";
-          rev = "1ad78b20b21c9f4f7ba5f4c897f74276763317eb";
-          sha256 = "0faahbzsr44bjmwr6508wi5hg59dfb57fzh5x6jh7zwmv4pzhqlb";
-          fetchLFS = true;
-        };
-      };
-    };
+  outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in
+  {
+    packages.x86_64-linux = import ./flake/packages.nix { inherit inputs localLib; };
+    nixosConfigurations = import ./flake/nixos.nix { inherit inputs localLib; };
+    overlays.default = final: prev:
+      { localPackages = (import ./packages { inherit localLib; pkgs = final; topInputs = inputs; }); };
+    config = { archive = false; branch = "production"; };
+    devShells.x86_64-linux = import ./flake/dev.nix { inherit inputs; };
+    src = import ./flake/src.nix { inherit inputs; };
+  };
 }
--- a/flake/dev.nix
+++ b/flake/dev.nix
@@ -0,0 +1,41 @@
+{ inputs }: let inherit (inputs.self.nixosConfigurations.pc) pkgs; in
+{
+  biu = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.biu ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  hpcstat = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ (pkgs.localPackages.hpcstat.override { version = null; }) ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  sbatch-tui = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.sbatch-tui ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  ufo = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.ufo ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  chn-bsub = pkgs.mkShell
+  {
+    inputsFrom = [ pkgs.localPackages.chn-bsub ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+  };
+  winjob =
+    let inherit (pkgs) clang-tools_18; in let inherit (inputs.self.packages.x86_64-w64-mingw32) pkgs winjob;
+    in pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
+    {
+      inputsFrom = [ winjob ];
+      packages = [ clang-tools_18 ];
+      CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+    };
+}
--- a/flake/lib.nix
+++ b/flake/lib.nix
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -0,0 +1,51 @@
+{ inputs, localLib }:
+builtins.listToAttrs
+(
+  (builtins.map
+    (system:
+    {
+      name = system;
+      value = inputs.nixpkgs.lib.nixosSystem
+      {
+        system = let arch.pi3b = "aarch64-linux"; in arch.${system} or "x86_64-linux";
+        specialArgs = { topInputs = inputs; inherit localLib; };
+        modules = localLib.mkModules
+        [
+          {
+            config =
+            {
+              nixpkgs.overlays = [ inputs.self.overlays.default ];
+              nixos.system.networking.hostname = system;
+            };
+          }
+          ../modules
+          ../devices/${system}
+        ];
+      };
+    })
+    [ "nas" "pc" "pi3b" "surface" "vps4" "vps6" "vps7" "xmupc1" "xmupc2" ])
+  ++ (builtins.map
+    (node:
+    {
+      name = "srv1-${node}";
+      value = inputs.nixpkgs.lib.nixosSystem
+      {
+        system = "x86_64-linux";
+        specialArgs = { topInputs = inputs; inherit localLib; };
+        modules = localLib.mkModules
+        [
+          {
+            config =
+            {
+              nixpkgs.overlays = [ inputs.self.overlays.default ];
+              nixos.system.cluster = { clusterName = "srv1"; nodeName = node; };
+            };
+          }
+          ../modules
+          ../devices/srv1
+          ../devices/srv1/${node}
+        ];
+      };
+    })
+    [ "node0" "node1" "node2" "node3" ])
+)
--- a/flake/packages.nix
+++ b/flake/packages.nix
@@ -0,0 +1,29 @@
+{ inputs, localLib }: rec
+{
+  pkgs = (import inputs.nixpkgs
+  {
+    system = "x86_64-linux";
+    config.allowUnfree = true;
+    overlays = [ inputs.self.overlays.default ];
+  });
+  hpcstat =
+    let
+      openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
+        (prev: { doCheck = false; patches = prev.patches ++ [ ../packages/hpcstat/openssh.patch ];});
+      duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
+      # pkgsStatic.clangStdenv have a bug
+      # https://github.com/NixOS/nixpkgs/issues/177129
+      biu = pkgs.pkgsStatic.localPackages.biu.override { stdenv = pkgs.pkgsStatic.gcc14Stdenv; };
+    in pkgs.pkgsStatic.localPackages.hpcstat.override
+    {
+      inherit openssh duc biu;
+      standalone = true;
+      version = inputs.self.rev or "dirty";
+      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
+    };
+  chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
+  blog = pkgs.callPackage inputs.blog { inherit (inputs) hextra; };
+}
+// (builtins.listToAttrs (builtins.map
+  (system: { inherit (system) name; value = system.value.config.system.build.toplevel; })
+  (localLib.attrsToList inputs.self.outputs.nixosConfigurations)))
--- a/flake/src.nix
+++ b/flake/src.nix
@@ -0,0 +1,2 @@
+{ inputs }: let inherit (inputs.self.packages.x86_64-linux) pkgs; in
+{}
--- a/modules/bugs/default.nix
+++ b/modules/bugs/default.nix
@@ -40,6 +40,9 @@ inputs:
      amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
      hibernate-mt7921e.powerManagement.resumeCommands =
        let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in "${modprobe} -r -w 3000 mt7921e && ${modprobe} mt7921e";
+      # could not use bt keyboard
+      # https://github.com/bluez/bluez/issues/745
+      bluetooth.hardware.bluetooth.settings.General.JustWorksRepairing = "always";
    };
  in
    {
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -25,6 +25,7 @@ inputs:
            topInputs.qchem.overlays.default
            topInputs.aagl.overlays.default
            topInputs.bscpkgs.overlays.default
+            topInputs.poetry2nix.overlays.default
            (final: prev:
            {
              nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
--- a/modules/hardware/default.nix
+++ b/modules/hardware/default.nix
@@ -28,6 +28,8 @@ inputs:
          {
            enable = true;
            drivers = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") [ inputs.pkgs.cnijfilter2 ];
+            # TODO: remove in next update
+            browsed.enable = false;
          };
          avahi = { enable = true; nssmdns4 = true; openFirewall = true; };
        };
--- a/modules/hardware/gpu.nix
+++ b/modules/hardware/gpu.nix
@@ -101,8 +101,8 @@ inputs:
      inputs.lib.mkIf (inputs.lib.strings.hasPrefix "amd" gpu.type) { hardware.amdgpu =
      {
        opencl.enable = true;
+        initrd.enable = true; # needed for waydroid
        legacySupport.enable = true;
-        initrd.enable = true;
        amdvlk = { enable = true; support32Bit.enable = true; supportExperimental.enable = true; };
      };}
    )
--- a/modules/packages/default.nix
+++ b/modules/packages/default.nix
@@ -24,19 +24,9 @@ inputs:
              excludePythonPackages))
            (builtins.concatLists (builtins.map (packageFunction: packageFunction pythonPackages)
              (_pythonPackages ++ extraPythonPackages)))))
-        (inputs.pkgs.callPackage ({ stdenv }: stdenv.mkDerivation
-        {
-          name = "prebuild-packages";
-          propagateBuildInputs = inputs.lib.lists.subtractLists excludePrebuildPackages
-            (_prebuildPackages ++ extraPrebuildPackages);
-          phases = [ "installPhase" ];
-          installPhase =
-          ''
-            runHook preInstall
-            mkdir -p $out
-            runHook postInstall
-          '';
-        }) {})
+        (inputs.pkgs.writeTextDir "share/prebuild-packages"
+          (builtins.concatStringsSep "\n" (builtins.map builtins.toString
+            (inputs.lib.lists.subtractLists excludePrebuildPackages (_prebuildPackages ++ extraPrebuildPackages)))))
      ];
  };
 }
--- a/modules/packages/desktop/default.nix
+++ b/modules/packages/desktop/default.nix
@@ -16,7 +16,7 @@ inputs:
          # system management
          # TODO: module should add yubikey-touch-detector into path
          gparted wayland-utils clinfo glxinfo vulkan-tools dracut yubikey-touch-detector btrfs-assistant snapper-gui
-          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x inputs.pkgs."pkgs-23.11".etcher wl-mirror
+          kdePackages.qtstyleplugin-kvantum ventoy-full cpu-x wl-mirror # inputs.pkgs."pkgs-23.11".etcher
          (
            writeShellScriptBin "xclip"
            ''
@@ -66,16 +66,16 @@ inputs:
          # browser
          google-chrome tor-browser microsoft-edge
          # office
-          crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk gnuplot pdfchain hdfview
-          davinci-resolve
-          texliveFull
+          crow-translate zotero pandoc ydict libreoffice-qt texstudio poppler_utils pdftk pdfchain hdfview
+          davinci-resolve texliveFull
+          # matplot++ needs old gnuplot
+          inputs.pkgs."pkgs-23.11".gnuplot
          # math, physics and chemistry
-          octaveFull root ovito localPackages.vesta localPackages.vaspkit localPackages.v-sim
-          (mathematica.overrideAttrs (prev: { postInstall = prev.postInstall or "" + "ln -s ${src} $out/src"; }))
-          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; }) jmol mpi
+          octaveFull root ovito localPackages.vesta localPackages.v-sim
+          (mathematica.overrideAttrs (prev: { postInstall = (prev.postInstall or "") + "ln -s ${prev.src} $out/src"; }))
+          (quantum-espresso.override { stdenv = gcc14Stdenv; gfortran = gfortran14; }) jmol mpi localPackages.ufo
          # virtualization
-          # TODO: broken on python 3.12: playonlinux
-          wineWowPackages.stagingFull virt-viewer bottles genymotion
+          wineWowPackages.stagingFull virt-viewer bottles genymotion playonlinux
          # media
          nur-xddxdd.svp
          # for kdenlive auto subtitle
@@ -83,12 +83,12 @@ inputs:
        ]
          ++ (builtins.filter (p: !((p.meta.broken or false) || (builtins.elem p.pname or null [ "falkon" "kalzium" ])))
            (builtins.filter inputs.lib.isDerivation (builtins.attrValues kdePackages.kdeGear)));
-          # TODO: fix it
-          # ++ inputs.lib.optional (inputs.config.nixos.system.nixpkgs.march != null) localPackages.mumax;
        _pythonPackages = [(pythonPackages: with pythonPackages;
        [
          phonopy scipy scikit-learn jupyterlab autograd # localPackages.pix2tex
-          # TODO: broken on python 3.12: tensorflow keras
+          # TODO: broken on python 3.12 tensorflow keras
+          # for phonopy
+          inputs.pkgs.localPackages.spectroscopy numpy
        ])];
      };
      user.sharedModules =
@@ -104,7 +104,7 @@ inputs:
              baloofilerc."Basic Settings".Indexing-Enabled.value = false;
              plasmarc.Wallpapers.usersWallpapers.value =
                let
-                  inherit (inputs.topInputs.self.src) nixos-wallpaper;
+                  inherit (inputs.topInputs) nixos-wallpaper;
                  isPicture = f: builtins.elem (inputs.lib.last (inputs.lib.splitString "." f))
                    [ "png" "jpg" "jpeg" "webp" ];
                in builtins.concatStringsSep "," (builtins.map (f: "${nixos-wallpaper}/${f.name}")
--- a/modules/packages/firefox.nix
+++ b/modules/packages/firefox.nix
@@ -24,25 +24,17 @@ inputs:
          programs.firefox =
          {
            enable = true;
-            nativeMessagingHosts = with inputs.pkgs; [ plasma-browser-integration uget-integrator firefoxpwa ];
+            nativeMessagingHosts = with inputs.pkgs;
+              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
            # TODO: use fixed-version of plugins
            policies.DefaultDownloadDirectory = "\${home}/Downloads";
            profiles.default =
            {
              extensions = with inputs.pkgs.firefox-addons;
              [
-                immersive-translate tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
+                tampermonkey bitwarden cookies-txt dualsub firefox-color i-dont-care-about-cookies
                metamask pakkujs switchyomega rsshub-radar rsspreview tabliss tree-style-tab ublock-origin wallabagger
-                wappalyzer grammarly plasma-integration zotero-connector 
-                (buildFirefoxXpiAddon
-                {
-                  pname = "pwas-for-firefox";
-                  version = "2.12.1";
-                  addonId = "firefoxpwa@filips.si";
-                  url = "https://addons.mozilla.org/firefox/downloads/file/4293028/pwas_for_firefox-2.12.1.xpi";
-                  sha256 = "sha256-m8BCAlQt37RxVnWw+2hIPnmofTicNa5OWkwXp/IXdWY=";
-                  meta = {};
-                })
+                wappalyzer grammarly plasma-integration zotero-connector pwas-for-firefox smartproxy kiss-translator
              ];
              search = { default = "Google"; force = true; };
              userChrome = builtins.readFile "${inputs.topInputs.lepton}/userChrome.css";
--- a/modules/packages/lammps.nix
+++ b/modules/packages/lammps.nix
@@ -0,0 +1,25 @@
+inputs:
+{
+  options.nixos.packages.lammps = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
+  {
+    nixos.packages.packages._packages =
+      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null;
+      in
+        if cuda then [((inputs.pkgs.lammps-mpi.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
+          .overrideAttrs (prev:
+          {
+            cmakeFlags = prev.cmakeFlags ++ inputs.lib.optionals cuda
+            [
+              "-DPKG_GPU=on" "-DGPU_API=cuda" "-DCMAKE_POLICY_DEFAULT_CMP0146=OLD"
+            ];
+            nativeBuildInputs = prev.nativeBuildInputs ++ inputs.lib.optionals cuda
+              [ inputs.pkgs.cudaPackages.cudatoolkit ];
+          }))]
+        else [ inputs.pkgs.lammps-mpi ];
+  };
+}
--- a/modules/packages/mumax.nix
+++ b/modules/packages/mumax.nix
@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.packages.mumax = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default =
+      if inputs.config.nixos.system.gui.enable
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+      then {}
+      else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) mumax; in inputs.lib.mkIf (mumax != null)
+  {
+    nixos.packages.packages._packages = [ inputs.pkgs.localPackages.mumax ];
+  };
+}
--- a/modules/packages/server.nix
+++ b/modules/packages/server.nix
@@ -26,7 +26,7 @@ inputs:
        # file system management
        sshfs e2fsprogs duperemove compsize exfatprogs
        # disk management
-        smartmontools hdparm
+        smartmontools hdparm megacli gptfdisk
        # encryption and authentication
        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
        # networking
@@ -46,6 +46,8 @@ inputs:
      [
        openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2
        certifi charset-normalizer idna orjson psycopg2 inquirerpy requests tqdm pydbus
+        # for vasp plot-workfunc.py
+        ase
      ])];
    };
    programs =
@@ -61,7 +63,12 @@ inputs:
    services =
    {
      udev.packages = with inputs.pkgs; [ yubikey-personalization libfido2 ];
-      fwupd.enable = true;
+      fwupd =
+      {
+        enable = true;
+        # allow fwupd install firmware from any source (e.g. manually extracted from msi)
+        daemonSettings.OnlyTrusted = false;
+      };
    };
    home-manager = { useGlobalPkgs = true; useUserPackages = true; };
    # allow everyone run compsize
--- a/modules/packages/ssh.nix
+++ b/modules/packages/ssh.nix
@@ -77,6 +77,26 @@ inputs:
          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIJZ/+divGnDr0x+UlknA84Tfu6TPD+zBGmxWZY4Z38P6";
          hostnames = [ "[xmupc2.chn.moe]:6394" "wireguard.xmupc2.chn.moe" "192.168.83.7" ];
        };
+        srv1-node0 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIDm6M1D7dBVhjjZtXYuzMj2P1fXNWN3O9wmwNssxEeDs";
+          hostnames = [ "srv1.chn.moe" "node0.srv1.chn.moe" "wireguard.node0.srv1.chn.moe" ];
+        };
+        srv1-node1 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIIFmG/ZzLDm23NeYa3SSI0a0uEyQWRFkaNRE9nB8egl7";
+          hostnames = [ "192.168.178.2" ];
+        };
+        srv1-node2 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIDhgEApzHhVPDvdVFPRuJ/zCDiR1K+rD4sZzH77imKPE";
+          hostnames = [ "192.168.178.3" ];
+        };
+        srv1-node3 =
+        {
+          ed25519 = "AAAAC3NzaC1lZDI1NTE5AAAAIO/4xbQNz6KNcEdjtBMGY8wUoFK1sCgamKl/r+kVjd7O";
+          hostnames = [ "192.168.178.4" ];
+        };
      };
      in builtins.listToAttrs (builtins.map
        (server:
@@ -112,7 +132,7 @@ inputs:
            [ "vps4" "vps6" "wireguard.vps6" "vps7" "wireguard.vps7" "wireguard.nas" ])
          ++ (builtins.map
            (host: { name = host; value = { inherit host; hostname = "${host}.chn.moe"; forwardX11 = true; }; })
-            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" ])
+            [ "wireguard.pc" "wireguard.surface" "wireguard.xmupc1" "wireguard.xmupc2" "srv1" "wireguard.srv1" ])
          ++ (builtins.map
            (host:
            {
@@ -142,7 +162,10 @@ inputs:
            forwardAgent = true;
            extraOptions.AddKeysToAgent = "yes";
          };
-          "wireguard.jykang" = jykang // { host = "internal.jykang"; proxyJump = "wireguard.xmupc1"; };
+          "wireguard.jykang" = jykang // { host = "wireguard.jykang"; proxyJump = "wireguard.xmupc1"; };
+          srv1-node1 = { host = "srv1-node1"; hostname = "192.168.178.2"; proxyJump = "srv1"; };
+          srv1-node2 = { host = "srv1-node2"; hostname = "192.168.178.3"; proxyJump = "srv1"; };
+          srv1-node3 = { host = "srv1-node3"; hostname = "192.168.178.4"; proxyJump = "srv1"; };
        };
      };
    })];
--- a/modules/packages/vasp.nix
+++ b/modules/packages/vasp.nix
@@ -8,7 +8,12 @@ inputs:
  # TODO: add more options to correctly configure VASP
  config = let inherit (inputs.config.nixos.packages) vasp; in inputs.lib.mkIf (vasp != null)
  {
-    nixos.packages.packages._packages = inputs.lib.optionals (inputs.config.nixos.system.nixpkgs.march != null)
-      (with inputs.pkgs.localPackages.vasp; [ intel nvidia vtstscripts ]);
+    nixos.packages.packages._packages = with inputs.pkgs;
+    (
+      [ localPackages.vasp.intel localPackages.vasp.vtstscripts localPackages.py4vasp localPackages.vaspkit ]
+        ++ (inputs.lib.optional
+          (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+          localPackages.vasp.nvidia)
+    );
  };
 }
--- a/modules/packages/vscode.nix
+++ b/modules/packages/vscode.nix
@@ -26,53 +26,34 @@ inputs:
                ++ (builtins.attrNames vscode-extensions)
              )));
            in with extensions;
-              (with equinusocio; [ vsc-material-theme vsc-material-theme-icons ])
-              ++ (with github; [ copilot copilot-chat github-vscode-theme ])
-              ++ (with intellsmi; [ comment-translate deepl-translate ])
-              ++ (with ms-python; [ isort python vscode-pylance ])
-              ++ (with ms-toolsai;
-              [
-                jupyter jupyter-keymap jupyter-renderers vscode-jupyter-cell-tags vscode-jupyter-slideshow
-              ])
-              ++ (with ms-vscode;
-              [
-                (cmake-tools.overrideAttrs { sourceRoot = "extension"; }) cpptools cpptools-extension-pack cpptools-themes hexeditor remote-explorer
-                test-adapter-converter
-              ])
-              ++ (with ms-vscode-remote; [ remote-ssh remote-containers remote-ssh-edit ])
+              (with github; [ copilot github-vscode-theme ])
+              ++ (with intellsmi; [ comment-translate ])
+              ++ (with ms-vscode; [ cmake-tools cpptools cpptools-extension-pack hexeditor remote-explorer ])
+              ++ (with ms-vscode-remote; [ remote-ssh ])
              ++ [
-                donjayamanne.githistory genieai.chatgpt-vscode fabiospampinato.vscode-diff cschlosser.doxdocgen
+                donjayamanne.githistory fabiospampinato.vscode-diff
                llvm-vs-code-extensions.vscode-clangd ms-ceintl.vscode-language-pack-zh-hans
                oderwat.indent-rainbow
                twxs.cmake guyutongxue.cpp-reference thfriedrich.lammps leetcode.vscode-leetcode # znck.grammarly
-                james-yu.latex-workshop gimly81.matlab affenwiesel.matlab-formatter ckolkman.vscode-postgres
-                yzhang.markdown-all-in-one pkief.material-icon-theme bbenoist.nix ms-ossdata.vscode-postgresql
-                redhat.vscode-xml dotjoshjohnson.xml jnoortheen.nix-ide xdebug.php-debug
-                hbenl.vscode-test-explorer
-                jeff-hykin.better-cpp-syntax fredericbonnet.cmake-test-adapter mesonbuild.mesonbuild
-                hirse.vscode-ungit fortran-lang.linter-gfortran tboox.xmake-vscode ccls-project.ccls
-                feiskyer.chatgpt-copilot yukiuuh2936.vscode-modern-fortran-formatter wolframresearch.wolfram
-                njpipeorgan.wolfram-language-notebook brettm12345.nixfmt-vscode webfreak.debug
+                james-yu.latex-workshop bbenoist.nix jnoortheen.nix-ide ccls-project.ccls
+                brettm12345.nixfmt-vscode
                gruntfuggly.todo-tree
                # restrctured text
-                lextudio.restructuredtext trond-snekvik.simple-rst
+                lextudio.restructuredtext trond-snekvik.simple-rst swyddfa.esbonio chrisjsewell.myst-tml-syntax
                # markdown
-                shd101wyy.markdown-preview-enhanced
+                yzhang.markdown-all-in-one shd101wyy.markdown-preview-enhanced
                # vasp
                mystery.vasp-support
                yutengjing.open-in-external-app
-                # ChatGPT-like plugin
-                codeium.codeium
                # git graph
                mhutchie.git-graph
+                # python
+                ms-python.python
+                # theme
+                pkief.material-icon-theme
              ];
        }
      )];
-      _pythonPackages = [(pythonPackages: with pythonPackages;
-      [
-        # required by vscode extensions restrucuredtext
-        localPackages.esbonio
-      ])];
    };
  };
 }
--- a/modules/packages/winapps/default.nix
+++ b/modules/packages/winapps/default.nix
@@ -0,0 +1,47 @@
+inputs:
+{
+  options.nixos.packages.winapps = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule {});
+    default = if inputs.config.nixos.system.gui.enable then {} else null;
+  };
+  config = let inherit (inputs.config.nixos.packages) winapps; in inputs.lib.mkIf (winapps != null)
+  {
+    nixos.packages.packages._packages =
+    [
+      (inputs.pkgs.callPackage "${inputs.topInputs.winapps}/packages/winapps" {})
+      (inputs.pkgs.runCommand "winapps-windows" {}
+      ''
+        mkdir -p $out/share/applications
+        cp ${inputs.pkgs.substituteAll { src = ./windows.desktop; path = inputs.topInputs.winapps; }} \
+          $out/share/applications/windows.desktop
+      '')
+    ]
+      ++ builtins.map
+        (p: inputs.pkgs.runCommand "winapps-${p}" {}
+        ''
+          mkdir -p $out/share/applications
+          source ${inputs.topInputs.winapps}/apps/${p}/info
+          # replace \ with \\
+          WIN_EXECUTABLE=$(echo $WIN_EXECUTABLE | sed 's/\\/\\\\/g')
+          # replace space with \s
+          WIN_EXECUTABLE=$(echo $WIN_EXECUTABLE | sed 's/ /\\s/g')
+          cat > $out/share/applications/${p}.desktop << EOF
+          [Desktop Entry]
+          Name=$NAME
+          Exec=winapps manual "$WIN_EXECUTABLE" %F
+          Terminal=false
+          Type=Application
+          Icon=${inputs.topInputs.winapps}/apps/${p}/icon.svg
+          StartupWMClass=$FULL_NAME
+          Comment=$FULL_NAME
+          Categories=$CATEGORIES
+          MimeType=$MIME_TYPES
+          EOF
+        '')
+        [
+          "access-o365" "acrobat-x-pro" "cmd" "excel-o365" "explorer" "illustrator-cc" "powerpoint-o365"
+          "visual-studio-comm" "word-o365"
+        ];
+  };
+}
--- a/modules/packages/winapps/windows.desktop
+++ b/modules/packages/winapps/windows.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=Windows
+Exec=winapps windows %F
+Terminal=false
+Type=Application
+Icon=@path@/icons/windows.svg
+StartupWMClass=Micorosoft Windows
+Comment=Micorosoft Windows
+Categories=Windows
--- a/modules/services/chatgpt.nix
+++ b/modules/services/chatgpt.nix
@@ -34,15 +34,11 @@ inputs:
      '';
      secrets."chatgpt/key" = {};
    };
-    nixos =
+    nixos.services.nginx =
    {
-      services.nginx =
-      {
-        enable = true;
-        https."${chatgpt.hostname}".location."/".proxy =
-          { upstream = "http://127.0.0.1:6184"; detectAuth.users = [ "chat" ]; };
-      };
-      virtualization.docker.enable = true;
+      enable = true;
+      https."${chatgpt.hostname}".location."/".proxy =
+        { upstream = "http://127.0.0.1:6184"; detectAuth.users = [ "chat" ]; };
    };
  };
 }
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -3,7 +3,6 @@ inputs:
  imports = inputs.localLib.findModules ./.;
  options.nixos.services = let inherit (inputs.lib) mkOption types; in
  {
-    firewall.trustedInterfaces = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
    smartd.enable = mkOption { type = types.bool; default = false; };
    wallabag.enable = mkOption { type = types.bool; default = false; };
    noisetorch.enable = mkOption { type = types.bool; default = inputs.config.nixos.system.gui.preferred; };
@@ -16,7 +15,6 @@ inputs:
      inherit (builtins) map listToAttrs toString;
    in mkMerge
    [
-      { networking.firewall.trustedInterfaces = services.firewall.trustedInterfaces; }
      (mkIf services.smartd.enable { services.smartd.enable = true; })
      (
        mkIf services.wallabag.enable
@@ -61,19 +59,15 @@ inputs:
              # SYMFONY__ENV__TWOFACTOR_SENDER=bot@chn.moe
            secrets."mail/bot-encoded" = {};
          };
-          nixos =
+          nixos.services =
          {
-            services =
+            nginx =
            {
-              nginx =
-              {
-                enable = true;
-                https."wallabag.chn.moe".location."/".proxy.upstream = "http://127.0.0.1:4398";
-              };
-              postgresql.instances.wallabag = {};
-              redis.instances.wallabag = { user = "root"; port = 8790; };
+              enable = true;
+              https."wallabag.chn.moe".location."/".proxy.upstream = "http://127.0.0.1:4398";
            };
-            virtualization.docker.enable = true;
+            postgresql.instances.wallabag = {};
+            redis.instances.wallabag = { user = "root"; port = 8790; };
          };
        }
      )
--- a/modules/services/docker.nix
+++ b/modules/services/docker.nix
@@ -0,0 +1,38 @@
+inputs:
+{
+  options.nixos.services.docker = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkMerge
+  [
+    (
+      inputs.lib.mkIf (docker != null)
+      {
+        # system-wide docker is not needed
+        # virtualisation.docker.enable = true;
+        virtualisation.docker.rootless =
+        {
+          enable = true;
+          setSocketVariable = true;
+          daemon.settings =
+          {
+            features.buildkit = true;
+            # dns 127.0.0.1 make docker not work
+            dns = [ "1.1.1.1" ];
+            # prevent create btrfs subvol
+            storage-driver = "overlay2";
+          };
+        };
+      }
+    )
+    # some docker settings should be set unconditionally, as some services depend on them
+    {
+      virtualisation.docker =
+      {
+        enableNvidia = inputs.lib.mkIf inputs.config.nixos.system.nixpkgs.cuda.enable true;
+        # prevent create btrfs subvol
+        storageDriver = "overlay2";
+        daemon.settings.dns = [ "1.1.1.1" ];
+      };
+    }
+  ];
+}
--- a/modules/services/huginn.nix
+++ b/modules/services/huginn.nix
@@ -60,7 +60,6 @@ inputs:
          };
          mariadb.instances.huginn = {};
        };
-        virtualization.docker.enable = true;
      };
    };
 }
--- a/modules/services/nfs.nix
+++ b/modules/services/nfs.nix
@@ -0,0 +1,29 @@
+inputs:
+{
+  options.nixos.services.nfs = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      root = mkOption { type = types.nonEmptyStr; };
+      exports = mkOption { type = types.listOf types.nonEmptyStr; };
+      accessLimit = mkOption { type = types.nonEmptyStr; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) nfs; in inputs.lib.mkIf (nfs != null)
+  {
+    services =
+    {
+      rpcbind.enable = true;
+      nfs.server =
+      {
+        enable = true;
+        exports = "${nfs.root} ${nfs.accessLimit}(rw,no_root_squash,fsid=0,sync,crossmnt)\n"
+          + builtins.concatStringsSep "\n" (builtins.map
+            (export: "${export} ${nfs.accessLimit}(rw,no_root_squash,sync,crossmnt)")
+            nfs.exports);
+      };
+    };
+    networking.firewall.allowedTCPPorts = [ 2049 ];
+  };
+}
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -247,6 +247,9 @@ inputs:
              proxy_ssl_server_name on;
              proxy_ssl_session_reuse off;
              send_timeout 1d;
+              # nginx will try to redirect https://blog.chn.moe/docs to https://blog.chn.moe:3068/docs/ in default
+              # this make it redirect to /docs/ without hostname
+              absolute_redirect off;
            '';
            proxyTimeout = "1d";
            recommendedZstdSettings = true;
--- a/modules/services/ollama.nix
+++ b/modules/services/ollama.nix
@@ -11,7 +11,6 @@ inputs:
        { enable = true; package = inputs.pkgs.genericPackages.open-webui; environment.WEBUI_AUTH = "False"; };
      nextjs-ollama-llm-ui.enable = true;
    };
-    # TODO: broken in python 3.12
-    # nixos.packages._packages = [ inputs.pkgs.oterm ];
+    nixos.packages.packages._packages = [ inputs.pkgs.oterm ];
  };
 }
--- a/modules/services/peertube.nix
+++ b/modules/services/peertube.nix
@@ -0,0 +1,65 @@
+inputs:
+{
+  options.nixos.services.peertube = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      hostname = mkOption { type = types.nonEmptyStr; default = "peertube.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) peertube; in inputs.lib.mkIf (peertube != null)
+  {
+    services.peertube =
+    {
+      enable = true;
+      localDomain = peertube.hostname;
+      listenHttp = 5046;
+      listenWeb = 443;
+      enableWebHttps = true;
+      serviceEnvironmentFile = inputs.config.sops.templates."peertube/env".path;
+      secrets.secretsFile = inputs.config.sops.secrets."peertube/secrets".path;
+      configureNginx = true;
+      database =
+      {
+        createLocally = true;
+        host = "127.0.0.1";
+        passwordFile = inputs.config.sops.secrets."peertube/postgresql".path;
+      };
+      redis =
+      {
+        host = "127.0.0.1";
+        port = 7599;
+        passwordFile = inputs.config.sops.secrets."redis/peertube".path;
+      };
+      smtp.passwordFile = inputs.config.sops.secrets."peertube/smtp".path;
+      settings.smtp =
+      {
+        host = "mail.chn.moe";
+        username = "bot@chn.moe";
+        from_address = "bot@chn.moe";
+      };
+    };
+    sops =
+    {
+      templates."peertube/env".content =
+      ''
+        PT_INITIAL_ROOT_PASSWORD=${inputs.config.sops.placeholder."peertube/password"}
+      '';
+      secrets =
+      {
+        "peertube/postgresql" = { owner = inputs.config.services.peertube.user; key = "postgresql/peertube"; };
+        "peertube/password" = {};
+        "peertube/secrets".owner = inputs.config.services.peertube.user;
+        "peertube/smtp" = { owner = inputs.config.services.peertube.user; key = "mail/bot"; };
+      };
+    };
+    nixos.services =
+    {
+      nginx = { enable = true; https.${peertube.hostname}.global.configName = peertube.hostname; };
+      postgresql.instances.peertube = {};
+      redis.instances.peertube.port = 7599;
+    };
+    systemd.services.peertube.after = [ "redis-peertube.service" ];
+  };
+}
--- a/modules/services/send.nix
+++ b/modules/services/send.nix
@@ -38,18 +38,14 @@ inputs:
          REDIS_PASSWORD=${inputs.config.sops.placeholder."redis/send"}
        '';
      };
-      nixos =
+      nixos.services =
      {
-        services =
+        nginx =
        {
-          nginx =
-          {
-            enable = true;
-            https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
-          };
-          redis.instances.send = { user = "root"; port = 9184; };
+          enable = true;
+          https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
        };
-        virtualization.docker.enable = true;
+        redis.instances.send = { user = "root"; port = 9184; };
      };
    };
 }
--- a/modules/services/slurm.nix
+++ b/modules/services/slurm.nix
@@ -3,75 +3,110 @@ inputs:
  options.nixos.services.slurm = let inherit (inputs.lib) mkOption types; in
  {
    enable = mkOption { type = types.bool; default = false; };
-    cpu =
+    # 本机是否为控制节点，如果不是，填写控制节点的主机名
+    master = mkOption { type = types.nonEmptyStr; default = inputs.config.nixos.system.networking.hostname; };
+    node = mkOption { type = types.attrsOf (types.submodule (submoduleInputs: { options =
    {
-      sockets = mkOption { type = types.ints.unsigned; default = 1; };
-      cores = mkOption { type = types.ints.unsigned; };
-      threads = mkOption { type = types.ints.unsigned; default = 1; };
-      mpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
-      openmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
-    };
-    memoryMB = mkOption { type = types.ints.unsigned; };
-    gpus = mkOption { type = types.attrsOf types.ints.unsigned; };
-  };
-  config = let inherit (inputs.config.nixos.services) slurm; in inputs.lib.mkIf slurm.enable
-  {
-    services =
-    {
-      slurm =
+      # slurm 中使用的节点名称
+      name = mkOption { type = types.nonEmptyStr; };
+      address = mkOption { type = types.nonEmptyStr; };
+      cpu =
      {
-        server.enable = true;
-        package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
-          (prev: let inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev; in
-          {
-            buildInputs = prev.buildInputs ++ [ cuda_nvml_dev ];
-            LDFLAGS = [ "-L${cuda_nvml_dev}/lib/stubs" ];
-            nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.wrapGAppsHook ];
-          });
-        clusterName = inputs.config.nixos.system.networking.hostname;
-        dbdserver =
+        sockets = mkOption { type = types.ints.unsigned; default = 1; };
+        cores = mkOption { type = types.ints.unsigned; default = 1; };
+        threads = mkOption { type = types.ints.unsigned; default = 1; };
+        mpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
+        openmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      };
+      memoryMB = mkOption { type = types.ints.unsigned; default = 1024; };
+      gpus = mkOption { type = types.nullOr (types.attrsOf types.ints.unsigned); default = null; };
+    };}));};
+    partitions = mkOption { type = types.attrsOf (types.listOf types.nonEmptyStr); default = {}; };
+    defaultPartition = mkOption { type = types.nonEmptyStr; default = "localhost"; };
+    tui =
+    {
+      cpuMpiThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      cpuOpenmpThreads = mkOption { type = types.ints.unsigned; default = 1; };
+      gpus = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+    };
+    # 是否打开防火墙相应端口，对于多节点部署需要打开
+    setupFirewall = mkOption { type = types.bool; default = false; };
+  };
+  config = let inherit (inputs.config.nixos.services) slurm; in inputs.lib.mkIf slurm.enable (inputs.lib.mkMerge
+  [
+    # worker 配置
+    {
+      services =
+      {
+        slurm =
        {
-          enable = true;
-          dbdHost = "localhost";
-          storagePassFile = inputs.config.sops.secrets."slurm/db".path;
+          package = (inputs.pkgs.slurm.override { enableGtk2 = true; }).overrideAttrs
+            (prev:
+              let
+                inherit (inputs.config.nixos.system.nixpkgs) cuda;
+                inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev;
+                additionalInputs = inputs.lib.optionals cuda.enable [ cuda_nvml_dev cuda_nvml_dev.lib ];
+                additionalFlags = inputs.lib.optional cuda.enable "-L${cuda_nvml_dev.lib}/lib/stubs";
+              in
+              {
+                buildInputs = prev.buildInputs or [] ++ additionalInputs;
+                LDFLAGS = prev.LDFLAGS or [] ++ additionalFlags;
+                nativeBuildInputs = prev.nativeBuildInputs ++ [ inputs.pkgs.wrapGAppsHook ];
+                postInstall =
+                ''
+                  pushd contribs/pmi2
+                  make install
+                  popd
+                  pushd contribs/pmi
+                  make install
+                  popd
+                '' + prev.postInstall;
+              }
+            );
+          client.enable = true;
+          nodeName = builtins.map
+            (node:
+              let gpuString =
+                if node.value.gpus == null then ""
+                else "Gres=" + builtins.concatStringsSep "," (builtins.map
+                  (gpu: "gpu:${gpu.name}:${builtins.toString gpu.value}")
+                  (inputs.lib.attrsToList node.value.gpus));
+              in builtins.concatStringsSep " "
+              [
+                node.value.name
+                "NodeHostname=${node.name}"
+                "NodeAddr=${node.value.address}"
+                "RealMemory=${builtins.toString node.value.memoryMB}"
+                "Sockets=${builtins.toString node.value.cpu.sockets}"
+                "CoresPerSocket=${builtins.toString node.value.cpu.cores}"
+                "ThreadsPerCore=${builtins.toString node.value.cpu.threads}"
+                "${gpuString}"
+                "State=UNKNOWN"
+              ])
+            (inputs.localLib.attrsToList slurm.node);
+          partitionName = builtins.map
+            (partition:
+              let nodes = builtins.concatStringsSep "," partition.value;
+              in builtins.concatStringsSep " "
+              [
+                partition.name
+                "Nodes=${builtins.concatStringsSep "," (builtins.map (n: slurm.node.${n}.name) partition.value)}"
+                "Default=${if partition.name == slurm.defaultPartition then "YES" else "NO"}"
+                "MaxTime=INFINITE"
+                "State=UP"
+              ])
+            (inputs.localLib.attrsToList slurm.partitions);
+          procTrackType = "proctrack/cgroup";
+          controlMachine = slurm.master;
+          controlAddr = slurm.node.${slurm.master}.address;
          extraConfig =
-          ''
-            StorageHost=*
-            StorageLoc=slurm
-          '';
-        };
-        client.enable = true;
-        controlMachine = "localhost";
-        nodeName =
-          let gpuString = builtins.concatStringsSep "," (builtins.map
-            (gpu: "gpu:${gpu.name}:${builtins.toString gpu.value}")
-            (inputs.localLib.attrsToList slurm.gpus));
-          in inputs.lib.singleton (builtins.concatStringsSep " "
-          [
-            "localhost"
-            "RealMemory=${builtins.toString slurm.memoryMB}"
-            "Sockets=${builtins.toString slurm.cpu.sockets}"
-            "CoresPerSocket=${builtins.toString slurm.cpu.cores}"
-            "ThreadsPerCore=${builtins.toString slurm.cpu.threads}"
-            "Gres=${gpuString}"
-            "State=UNKNOWN"
-          ]);
-        partitionName = [ "localhost Nodes=localhost Default=YES MaxTime=INFINITE State=UP" ];
-        procTrackType = "proctrack/cgroup";
-        extraConfig =
-          let taskProlog =
-          ''
-            echo export CUDA_DEVICE_ORDER=PCI_BUS_ID
-            echo export SLURM_THREADS_PER_CPU=${builtins.toString slurm.cpu.threads}
-          '';
-          in
          ''
            SelectType=select/cons_tres
            SelectTypeParameters=CR_Core
            GresTypes=gpu
            DefCpuPerGPU=1

-            TaskProlog=${inputs.pkgs.writeShellScript "set_env" taskProlog}
+            TaskProlog=${inputs.pkgs.writeShellScript "set_env" "echo export CUDA_DEVICE_ORDER=PCI_BUS_ID"}

            AccountingStorageType=accounting_storage/slurmdbd
            AccountingStorageHost=localhost
@@ -83,60 +118,91 @@ inputs:
            SchedulerParameters=enable_user_top

            SlurmdDebug=debug2
+            DebugFlags=NO_CONF_HASH

            # automatically resume node after drain
            ReturnToService=2
+
+            # enable task plugins
+            TaskPlugin=task/affinity,task/cgroup
          '';
-        extraConfigPaths =
-          let gpuString = builtins.concatStringsSep "\n" (builtins.map
-            (gpu: "Name=gpu Type=${gpu.name} Count=${builtins.toString gpu.value}")
-            (inputs.localLib.attrsToList slurm.gpus));
-          in [(inputs.pkgs.writeTextDir "gres.conf" "AutoDetect=nvml\n${gpuString}")];
-      };
-      munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
-    };
-    systemd =
-    {
-      services.slurmd.environment =
-      {
-        CUDA_PATH = "${inputs.pkgs.cudatoolkit}";
-        LD_LIBRARY_PATH = "${inputs.config.hardware.nvidia.package}/lib";
-      };
-      tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
-    };
-    sops =
-    {
-      secrets =
-      {
-        "munge.key" =
-        {
-          format = "binary";
-          sopsFile = "${builtins.dirOf inputs.config.sops.defaultSopsFile}/munge.key";
-          owner = inputs.config.systemd.services.munged.serviceConfig.User;
+          extraConfigPaths =
+            let gpus = slurm.node.${inputs.config.nixos.system.networking.hostname}.gpus or null;
+            in inputs.lib.mkIf (gpus != null)
+            (
+              let gpuString = builtins.concatStringsSep "\n" (builtins.map
+                (gpu: "Name=gpu Type=${gpu.name} Count=${builtins.toString gpu.value}")
+                (inputs.localLib.attrsToList gpus));
+              in [(inputs.pkgs.writeTextDir "gres.conf" "AutoDetect=nvml\n${gpuString}")]
+            );
        };
-        "slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
+        munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
      };
-    };
-    nixos =
-    {
-      packages.packages._packages = [(inputs.pkgs.localPackages.sbatch-tui.override { sbatchConfig =
+      systemd =
      {
-        cpuMpiThreads = slurm.cpu.mpiThreads;
-        cpuOpenmpThreads = slurm.cpu.openmpThreads;
-        gpuIds = builtins.concatStringsSep ", " (builtins.map (gpu: ''"${gpu}"'') (builtins.attrNames slurm.gpus));
-      };})];
-      user.sharedModules = [{ home.packages =
-      [
-        (inputs.pkgs.writeShellScriptBin "sbatch"
-        ''
-          if [ "$#" -eq 0 ]; then
-            sbatch-tui
-          else
-            /run/current-system/sw/bin/sbatch "$@"
-          fi
-        '')
-      ];}];
-      services.mariadb = { enable = true; instances.slurm = {}; };
-    };
-  };
+        services.slurmd.environment =
+          let gpus = slurm.node.${inputs.config.nixos.system.networking.hostname}.gpus or null;
+          in inputs.lib.mkIf (gpus != null)
+          {
+            CUDA_PATH = "${inputs.pkgs.cudatoolkit}";
+            LD_LIBRARY_PATH = "${inputs.config.hardware.nvidia.package}/lib";
+          };
+      };
+      sops.secrets."munge.key" =
+      {
+        format = "binary";
+        sopsFile = "${builtins.dirOf inputs.config.sops.defaultSopsFile}/munge.key";
+        owner = inputs.config.systemd.services.munged.serviceConfig.User;
+      };
+      networking.firewall =
+        let config = inputs.lib.mkIf slurm.setupFirewall [ 6818 ];
+        in { allowedTCPPorts = config; allowedUDPPorts = config; };
+    }
+    # master 配置
+    (inputs.lib.mkIf (slurm.master == inputs.config.nixos.system.networking.hostname)
+    {
+      services.slurm =
+      {
+        server.enable = true;
+        dbdserver =
+        {
+          enable = true;
+          dbdHost = "localhost";
+          storagePassFile = inputs.config.sops.secrets."slurm/db".path;
+          extraConfig =
+          ''
+            StorageHost=*
+            StorageLoc=slurm
+          '';
+        };
+      };
+      systemd.tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
+      sops.secrets."slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
+      nixos =
+      {
+        packages.packages._packages = [ inputs.pkgs.localPackages.sbatch-tui ];
+        user.sharedModules = [{ home.packages =
+        [
+          (inputs.pkgs.writeShellScriptBin "sbatch"
+          ''
+            if [ "$#" -eq 0 ]; then
+              sbatch-tui
+            else
+              /run/current-system/sw/bin/sbatch "$@"
+            fi
+          '')
+        ];}];
+        services.mariadb = { enable = true; instances.slurm = {}; };
+      };
+      environment.etc."sbatch-tui.yaml".text = builtins.toJSON
+      {
+        CpuMpiThreads = slurm.tui.cpuMpiThreads;
+        CpuOpenmpThreads = slurm.tui.cpuOpenmpThreads;
+        GpuIds = slurm.tui.gpus;
+      };
+      networking.firewall =
+        let config = inputs.lib.mkIf slurm.setupFirewall [ 6817 ];
+        in { allowedTCPPorts = config; allowedUDPPorts = config; };
+    })
+  ]);
 }
--- a/modules/services/waydroid.nix
+++ b/modules/services/waydroid.nix
@@ -0,0 +1,16 @@
+inputs:
+{
+  options.nixos.services.waydroid = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) waydroid; in inputs.lib.mkIf (waydroid != null)
+    { virtualisation.waydroid.enable = true; };
+}
+
+# sudo waydroid shell wm set-fix-to-user-rotation enabled
+# /var/lib/waydroid/waydroid_base.prop
+# default:
+# ro.hardware.gralloc=gbm
+# ro.hardware.egl=mesa
+# nvidia:
+# ro.hardware.gralloc=default
+# ro.hardware.egl=swiftshader
--- a/modules/services/xray/default.nix
+++ b/modules/services/xray/default.nix
@@ -15,7 +15,7 @@ inputs:
        extraInterfaces = mkOption
        {
          type = types.listOf types.nonEmptyStr;
-          default = inputs.lib.optional inputs.config.nixos.virtualization.docker.enable "docker0";
+          default = inputs.lib.optional (inputs.config.nixos.services.docker != null) "docker0";
        };
        hosts = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
      };
@@ -25,6 +25,8 @@ inputs:
        noproxyTcpPorts = mkOption { type = types.listOf types.ints.unsigned; default = []; };
        noproxyUdpPorts = mkOption { type = types.listOf types.ints.unsigned; default = []; };
      };
+      # 是否允许代理来自其它机器的流量（相关端口会被放行）
+      allowForward = mkOption { type = types.bool; default = true; };
    };
    server = mkOption
    {
@@ -329,6 +331,13 @@ inputs:
          groups.v2ray.gid = inputs.config.nixos.user.gid.v2ray;
        };
        environment.etc."resolv.conf".text = "nameserver 127.0.0.1";
+        networking.firewall =
+        {
+          allowedTCPPorts = [ 53 ];
+          allowedUDPPorts = [ 53 ];
+          allowedTCPPortRanges = [{ from = 10880; to = 10884; }];
+          allowedUDPPortRanges = [{ from = 10880; to = 10884; }];
+        };
      }
    )
    (
--- a/modules/system/binfmt.nix
+++ b/modules/system/binfmt.nix
@@ -1,7 +1,7 @@
 inputs:
 {
  options.nixos.system.binfmt = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+    { type = types.nullOr (types.submodule {}); default = {}; };
  config = let inherit (inputs.config.nixos.system) binfmt; in inputs.lib.mkIf (binfmt != null)
  {
    programs.java = { enable = true; binfmt = true; };
--- a/modules/system/cluster.nix
+++ b/modules/system/cluster.nix
@@ -0,0 +1,21 @@
+inputs:
+{
+  options.nixos.system.cluster = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      clusterName = mkOption { type = types.nonEmptyStr; };
+      nodeName = mkOption { type = types.nonEmptyStr; };
+      nodeType = mkOption { type = types.enum [ "master" "worker" ]; default = "worker"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.system) cluster; in inputs.lib.mkIf (cluster != null)
+  {
+    nixos.system.networking.hostname = "${cluster.clusterName}-${cluster.nodeName}";
+    # 作为从机时，home-manager 需要被禁用
+    systemd.services = inputs.lib.mkIf (cluster.nodeType == "worker") (builtins.listToAttrs (builtins.map
+      (user: { name = "home-manager-${inputs.utils.escapeSystemdPath user}"; value.enable = false; })
+      inputs.config.nixos.user.users));
+  };
+}
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -14,7 +14,7 @@ inputs:
    time.timeZone = "Asia/Shanghai";
    boot =
    {
-      supportedFilesystems = [ "ntfs" ];
+      supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
      # consoleLogLevel = 7;
    };
    hardware.enableAllFirmware = true;
--- a/modules/system/envfs.nix
+++ b/modules/system/envfs.nix
@@ -1,10 +1,10 @@
 inputs:
 {
  options.nixos.system.envfs = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.system) envfs; in inputs.lib.mkIf (envfs != null) (inputs.lib.mkMerge
-  [
-    (builtins.elemAt inputs.topInputs.envfs.nixosModules.envfs.imports 0 inputs)
-    { environment.variables.ENVFS_RESOLVE_ALWAYS = "1"; }
-  ]);
+    { type = types.nullOr (types.submodule {}); default = {}; };
+  config = let inherit (inputs.config.nixos.system) envfs; in inputs.lib.mkIf (envfs != null)
+  {
+    services.envfs.enable = true;
+    environment.variables.ENVFS_RESOLVE_ALWAYS = "1";
+  };
 }
--- a/modules/system/fileSystems/default.nix
+++ b/modules/system/fileSystems/default.nix
@@ -1,5 +1,6 @@
 inputs:
 {
+  imports = inputs.localLib.findModules ./.;
  options.nixos.system.fileSystems = let inherit (inputs.lib) mkOption types; in
  {
    mount =
@@ -9,41 +10,6 @@ inputs:
      # device.subvol = mountPoint;
      btrfs = mkOption { type = types.attrsOf (types.attrsOf types.nonEmptyStr); default = {}; };
    };
-    decrypt =
-    {
-      auto = mkOption
-      {
-        type = types.attrsOf (types.submodule
-        {
-          options =
-          {
-            mapper = mkOption { type = types.nonEmptyStr; };
-            ssd = mkOption { type = types.bool; default = false; };
-            before = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
-          };
-        });
-        default = {};
-      };
-      manual =
-      {
-        enable = mkOption { type = types.bool; default = false; };
-        devices = mkOption
-        {
-          type = types.attrsOf (types.submodule
-          {
-            options =
-            {
-              mapper = mkOption { type = types.nonEmptyStr; };
-              ssd = mkOption { type = types.bool; default = false; };
-            };
-          });
-          default = {};
-        };
-        keyFile = mkOption
-          { type = types.path; default = ./. + "/${inputs.config.nixos.system.networking.hostname}.key"; };
-        delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-      };
-    };
    # generate using: sudo mdadm --examine --scan
    mdadm = mkOption { type = types.nullOr types.lines; default = null; };
    swap = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
@@ -66,205 +32,112 @@ inputs:
      default = null;
    };
  };
-  config =
-    let
-      inherit (builtins) listToAttrs map concatLists concatStringsSep;
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (inputs.localLib) attrsToList;
-      inherit (inputs.config.nixos.system) fileSystems;
-    in mkMerge
-    [
-      # mount.vfat
-      {
-        fileSystems = listToAttrs (map
-          (device:
-          {
-            name = device.value;
-            value = { device = device.name; fsType = "vfat"; neededForBoot = true; options = [ "noatime" ]; };
-          })
-          (attrsToList fileSystems.mount.vfat));
-      }
-      # mount.btrfs
-      # Disable CoW for VM image and database: sudo chattr +C images
-      # resize btrfs:
-      # sudo btrfs filesystem resize -50G /nix
-      # sudo cryptsetup status root
-      # sudo cryptsetup -b 3787456512 resize root
-      # sudo cfdisk /dev/nvme1n1p3
-      {
-        fileSystems = listToAttrs (concatLists (map
+  config = let inherit (inputs.config.nixos.system) fileSystems; in inputs.lib.mkMerge
+  [
+    # mount.vfat
+    {
+      fileSystems = builtins.listToAttrs (builtins.map
+        (device:
+        {
+          name = device.value;
+          value = { device = device.name; fsType = "vfat"; neededForBoot = true; options = [ "noatime" ]; };
+        })
+        (inputs.localLib.attrsToList fileSystems.mount.vfat));
+    }
+    # mount.btrfs
+    # Disable CoW for VM image and database: sudo chattr +C images
+    # resize btrfs:
+    # sudo btrfs filesystem resize -50G /nix
+    # sudo cryptsetup status root
+    # sudo cryptsetup -b 3787456512 resize root
+    # sudo cfdisk /dev/nvme1n1p3
+    {
+      fileSystems =  builtins.listToAttrs (builtins.concatLists (builtins.map
+        (device: builtins.map
          (
-            device: map
-              (
-                subvol:
-                {
-                  name = subvol.value;
-                  value =
-                  {
-                    device = device.name;
-                    fsType = "btrfs";
-                    # zstd:15 cause sound stuttering
-                    # test on e20dae7d8b317f95718b5f4175bd4246c09735de mathematica ~15G
-                    # zstd:15 5m33s 7.16G
-                    # zstd:8 54s 7.32G
-                    # zstd:3 17s 7.52G
-                    options = [ "compress-force=zstd" "subvol=${subvol.name}" "acl" "noatime" ];
-                    neededForBoot = true;
-                  };
-                }
-              )
-              (attrsToList device.value)
+            subvol:
+            {
+              name = subvol.value;
+              value =
+              {
+                device = device.name;
+                fsType = "btrfs";
+                # zstd:15 cause sound stuttering
+                # test on e20dae7d8b317f95718b5f4175bd4246c09735de mathematica ~15G
+                # zstd:15 5m33s 7.16G
+                # zstd:8 54s 7.32G
+                # zstd:3 17s 7.52G
+                options = [ "compress-force=zstd" "subvol=${subvol.name}" "acl" "noatime" ];
+                neededForBoot = true;
+              };
+            }
          )
-          (attrsToList fileSystems.mount.btrfs)));
+          (inputs.localLib.attrsToList device.value)
+        )
+        (inputs.localLib.attrsToList fileSystems.mount.btrfs)));
+    }
+    # mdadm
+    (inputs.lib.mkIf (fileSystems.mdadm != null)
+      { boot.initrd.services.swraid = { enable = true; mdadmConf = fileSystems.mdadm; }; }
+    )
+    # swap
+    { swapDevices = builtins.map (device: { device = device; }) fileSystems.swap; }
+    # resume
+    (inputs.lib.mkIf (fileSystems.resume != null) { boot =
+    (
+      if builtins.typeOf fileSystems.resume == "string" then
+        { resumeDevice = fileSystems.resume; }
+      else
+      {
+        resumeDevice = fileSystems.resume.device;
+        kernelModules = [ "resume_offset=${builtins.toString fileSystems.resume.offset}" ];
      }
-      # decrypt.auto
-      (
-        mkIf (fileSystems.decrypt.auto != null)
+    );})
+    # rollingRootfs
+    (inputs.lib.mkIf (fileSystems.rollingRootfs != null)
+    {
+      boot.initrd.systemd =
+      {
+        extraBin =
        {
-          boot.initrd =
-          {
-            luks.devices = (listToAttrs (map
-              (
-                device:
-                {
-                  name = device.value.mapper;
-                  value =
-                  {
-                    device = device.name;
-                    allowDiscards = device.value.ssd;
-                    bypassWorkqueues = device.value.ssd;
-                    crypttabExtraOpts = [ "fido2-device=auto" "x-initrd.attach" ];
-                  };
-                }
-              )
-              (attrsToList fileSystems.decrypt.auto)));
-            systemd.services =
-              let
-                createService = device:
-                {
-                  name = "systemd-cryptsetup@${device.value.mapper}";
-                  value =
-                  {
-                    before = map (device: "systemd-cryptsetup@${device}.service") device.value.before;
-                    overrideStrategy = "asDropin";
-                  };
-                };
-              in
-                listToAttrs (map createService
-                  (builtins.filter (device: device.value.before != null) (attrsToList fileSystems.decrypt.auto)));
-          };
-        }
-      )
-      # decrypt.manual
-      (
-        mkIf (fileSystems.decrypt.manual.enable)
+          grep = "${inputs.pkgs.gnugrep}/bin/grep";
+          awk = "${inputs.pkgs.gawk}/bin/awk";
+          chattr = "${inputs.pkgs.e2fsprogs}/bin/chattr";
+          lsmod = "${inputs.pkgs.kmod}/bin/lsmod";
+        };
+        services.roll-rootfs =
        {
-          boot.initrd =
-          {
-            luks.forceLuksSupportInInitrd = true;
-            systemd =
-            {
-              extraBin =
-              {
-                cryptsetup = "${inputs.pkgs.cryptsetup.bin}/bin/cryptsetup";
-                usbip = "${inputs.config.boot.kernelPackages.usbip}/bin/usbip";
-                sed = "${inputs.pkgs.gnused}/bin/sed";
-                awk = "${inputs.pkgs.gawk}/bin/awk";
-                decrypt = inputs.pkgs.writeShellScript "decrypt"
-                ''
-                  modprobe vhci-hcd
-                  busid=$(usbip list -r 127.0.0.1 | head -n4 | tail -n1 | awk '{print $1}' | sed 's/://')
-                  usbip attach -r 127.0.0.1 -b $busid
-                  ${concatStringsSep "\n" (map
-                    (device: ''systemd-cryptsetup attach ${device.value.mapper} ${device.name} "" fido2-device=auto''
-                      + (if device.value.ssd then ",discard" else ""))
-                    (attrsToList fileSystems.decrypt.manual.devices))}
-                '';
-              };
-              services.wait-manual-decrypt =
-              {
-                wantedBy = [ "initrd-root-fs.target" ];
-                before = [ "roll-rootfs.service" ];
-                unitConfig.DefaultDependencies = false;
-                serviceConfig.Type = "oneshot";
-                script = concatStringsSep "\n" (map
-                  (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
-                  (attrsToList fileSystems.decrypt.manual.devices));
-              };
-            };
-          };
-          fileSystems = listToAttrs (map
-            (mount: { name = mount; value.options = [ "x-systemd.device-timeout=48h" ]; })
-            fileSystems.decrypt.manual.delayedMount);
-        }
-      )
-      # mdadm
-      (
-        mkIf (fileSystems.mdadm != null)
-          { boot.initrd.services.swraid = { enable = true; mdadmConf = fileSystems.mdadm; }; }
-      )
-      # swap
-      { swapDevices = map (device: { device = device; }) fileSystems.swap; }
-      # resume
-      (
-        mkIf (fileSystems.resume != null) { boot =
-        (
-          if builtins.typeOf fileSystems.resume == "string" then
-            { resumeDevice = fileSystems.resume; }
-          else
-          {
-            resumeDevice = fileSystems.resume.device;
-            kernelModules = [ "resume_offset=${builtins.toString fileSystems.resume.offset}" ];
-          }
-        );}
-      )
-      # rollingRootfs
-      (
-        mkIf (fileSystems.rollingRootfs != null)
-        {
-          boot.initrd.systemd =
-          {
-            extraBin =
-            {
-              grep = "${inputs.pkgs.gnugrep}/bin/grep";
-              awk = "${inputs.pkgs.gawk}/bin/awk";
-              chattr = "${inputs.pkgs.e2fsprogs}/bin/chattr";
-              lsmod = "${inputs.pkgs.kmod}/bin/lsmod";
-            };
-            services.roll-rootfs =
-            {
-              wantedBy = [ "initrd.target" ];
-              after = [ "cryptsetup.target" "systemd-hibernate-resume.service" ];
-              before = [ "local-fs-pre.target" "sysroot.mount" ];
-              unitConfig.DefaultDependencies = false;
-              serviceConfig.Type = "oneshot";
-              script =
-                let
-                  inherit (fileSystems.rollingRootfs) device path waitDevices;
-                  waitDevice = concatStringsSep "\n" (builtins.map
-                    (device: "while ! [ -e ${device} ]; do sleep 1; done") (waitDevices ++ [ device ]));
-                in
-                ''
-                  while ! lsmod | grep -q btrfs; do sleep 1; done
-                  ${waitDevice}
-                  mount ${device} /mnt -m
-                  if [ -f /mnt${path}/current/.timestamp ]
-                  then
-                    timestamp=$(cat /mnt${path}/current/.timestamp)
-                    subvolid=$(btrfs subvolume show /mnt${path}/current | grep 'Subvolume ID:' | awk '{print $NF}')
-                    mv /mnt${path}/current /mnt${path}/$timestamp-$subvolid
-                    btrfs property set -ts /mnt${path}/$timestamp-$subvolid ro true
-                  fi
-                  btrfs subvolume create /mnt${path}/current
-                  chattr +C /mnt${path}/current
-                  echo $(date '+%Y%m%d%H%M%S') > /mnt${path}/current/.timestamp
-                  umount /mnt
-                '';
-            };
-          };
-        }
-      )
-    ];
+          wantedBy = [ "initrd.target" ];
+          after = [ "cryptsetup.target" "systemd-hibernate-resume.service" ];
+          before = [ "local-fs-pre.target" "sysroot.mount" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          script =
+            let
+              inherit (fileSystems.rollingRootfs) device path waitDevices;
+              waitDevice = builtins.concatStringsSep "\n" (builtins.map
+                (device: "while ! [ -e ${device} ]; do sleep 1; done") (waitDevices ++ [ device ]));
+            in
+            ''
+              while ! lsmod | grep -q btrfs; do sleep 1; done
+              ${waitDevice}
+              mount ${device} /mnt -m
+              if [ -f /mnt${path}/current/.timestamp ]
+              then
+                timestamp=$(cat /mnt${path}/current/.timestamp)
+                subvolid=$(btrfs subvolume show /mnt${path}/current | grep 'Subvolume ID:' | awk '{print $NF}')
+                mv /mnt${path}/current /mnt${path}/$timestamp-$subvolid
+                btrfs property set -ts /mnt${path}/$timestamp-$subvolid ro true
+              fi
+              btrfs subvolume create /mnt${path}/current
+              chattr +C /mnt${path}/current
+              echo $(date '+%Y%m%d%H%M%S') > /mnt${path}/current/.timestamp
+              umount /mnt
+            '';
+        };
+      };
+    })
+  ];
 }


--- a/modules/system/fileSystems/luks/default.nix
+++ b/modules/system/fileSystems/luks/default.nix
@@ -0,0 +1,81 @@
+inputs:
+{
+  options.nixos.system.fileSystems.luks = let inherit (inputs.lib) mkOption types; in
+  {
+    auto = mkOption
+    {
+      type = types.attrsOf (types.submodule { options =
+      {
+        mapper = mkOption { type = types.nonEmptyStr; };
+        ssd = mkOption { type = types.bool; default = false; };
+        before = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+      };});
+      default = {};
+    };
+    manual =
+    {
+      enable = mkOption { type = types.bool; default = false; };
+      devices = mkOption
+      {
+        type = types.attrsOf (types.submodule { options =
+        {
+          mapper = mkOption { type = types.nonEmptyStr; };
+          ssd = mkOption { type = types.bool; default = false; };
+        };});
+        default = {};
+      };
+      delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+    };
+  };
+  config = let inherit (inputs.config.nixos.system.fileSystems) luks; in inputs.lib.mkMerge
+  [
+    (inputs.lib.mkIf (luks.auto != null) { boot.initrd =
+    {
+      luks.devices = (builtins.listToAttrs (builtins.map
+        (device:
+        {
+          name = device.value.mapper;
+          value =
+          {
+            device = device.name;
+            allowDiscards = device.value.ssd;
+            bypassWorkqueues = device.value.ssd;
+            crypttabExtraOpts = [ "fido2-device=auto" "x-initrd.attach" ];
+          };
+        })
+        (inputs.localLib.attrsToList luks.auto)));
+      systemd.services = builtins.listToAttrs (builtins.map
+        (device:
+        {
+          name = "systemd-cryptsetup@${device.value.mapper}";
+          value =
+          {
+            before = map (device: "systemd-cryptsetup@${device}.service") device.value.before;
+            overrideStrategy = "asDropin";
+          };
+        })
+        (builtins.filter (device: device.value.before != null) (inputs.localLib.attrsToList luks.auto)));
+    };})
+    (inputs.lib.mkIf luks.manual.enable
+    {
+      boot.initrd =
+      {
+        luks.forceLuksSupportInInitrd = true;
+        systemd =
+        {
+          services.wait-manual-decrypt =
+          {
+            wantedBy = [ "initrd-root-fs.target" ];
+            before = [ "roll-rootfs.service" ];
+            unitConfig.DefaultDependencies = false;
+            serviceConfig.Type = "oneshot";
+            script = builtins.concatStringsSep "\n" (builtins.map
+              (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
+              (inputs.localLib.attrsToList luks.manual.devices));
+          };
+          extraBin.cryptsetup = "${inputs.pkgs.cryptsetup}/bin/cryptsetup";
+        };
+      };
+    })
+  ];
+}
--- a/modules/system/fileSystems/luks/nas.key
+++ b/modules/system/fileSystems/luks/nas.key
--- a/modules/system/fileSystems/luks/vps4.key
+++ b/modules/system/fileSystems/luks/vps4.key
--- a/modules/system/fileSystems/luks/vps6.key
+++ b/modules/system/fileSystems/luks/vps6.key
--- a/modules/system/fileSystems/luks/vps7.key
+++ b/modules/system/fileSystems/luks/vps7.key
--- a/modules/system/fileSystems/nfs.nix
+++ b/modules/system/fileSystems/nfs.nix
@@ -0,0 +1,28 @@
+inputs:
+{
+  options.nixos.system.fileSystems.mount.nfs = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.attrsOf types.nonEmptyStr); default = null;
+  };
+  config = let inherit (inputs.config.nixos.system.fileSystems.mount) nfs; in inputs.lib.mkIf (nfs != null)
+  {
+    fileSystems = builtins.listToAttrs (builtins.map
+      (device:
+      {
+        name = device.value;
+        value = { device = device.name; fsType = "nfs"; neededForBoot = true; };
+      })
+      (inputs.localLib.attrsToList nfs));
+    boot.initrd =
+    {
+      network.enable = true;
+      systemd.extraBin =
+      {
+        "ifconfig" = "${inputs.pkgs.nettools}/bin/ifconfig";
+        "mount.nfs" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs";
+        "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
+      };
+    };
+    services.rpcbind.enable = true;
+  };
+}
--- a/modules/system/initrd.nix
+++ b/modules/system/initrd.nix
@@ -34,7 +34,8 @@ inputs:
            services.resolved.enable = false;
          };
          # ip=dhcp only attain ipv4
-          kernelParams = [ "ip=on" ];
+          # ip=on will reset systemd-networkd configs
+          # kernelParams = [ "ip=on" ];
        };
      }
    )
--- a/modules/system/kernel/default.nix
+++ b/modules/system/kernel/default.nix
@@ -5,7 +5,7 @@ inputs:
    variant = mkOption
    {
      type = types.enum [ "nixos" "xanmod-lts" "xanmod-latest" "cachyos" "cachyos-lto" "cachyos-server" "zen" ];
-      default = "xanmod-latest";
+      default = "xanmod-lts";
    };
    patches = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
    modules =
@@ -31,6 +31,12 @@ inputs:
          "ahci" "ata_piix" "nvme" "sdhci_acpi" "virtio_pci" "xhci_pci"
          # networking for nas
          "igb"
+          # disk for srv1
+          "megaraid_sas"
+          # disks for cluster
+          "nfs" "nfsv4"
+          # netowrk for srv1
+          "bnx2x" "tg3"
        ]
        ++ (inputs.lib.optionals (kernel.variant != "nixos") [ "crypto_simd" ])
        # for pi3b to show message over hdmi while boot
--- a/modules/system/networking.nix
+++ b/modules/system/networking.nix
@@ -16,8 +16,8 @@ inputs:
          {
            ip = mkOption { type = types.nonEmptyStr; };
            mask = mkOption { type = types.ints.unsigned; };
-            gateway = mkOption { type = types.nonEmptyStr; };
-            dns = mkOption { type = types.nonEmptyStr; default = null; };
+            gateway = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+            dns = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
          };});
          default = {};
        };
@@ -75,10 +75,10 @@ inputs:
          (builtins.map
            (network:
            {
-              name = "10-${network.ssid}";
+              name = "10-${network}";
              value =
              {
-                matchConfig.Name = network.ssid;
+                matchConfig.Name = network;
                networkConfig = { DHCP = "yes"; IPv6AcceptRA = true; };
                linkConfig.RequiredForOnline = "routable";
              };
@@ -91,9 +91,11 @@ inputs:
              value =
              {
                matchConfig.Name = network.name;
-                address = [ "${network.ip}/${builtins.toString network.mask}" ];
-                routes = [{ routeConfig.Gateway = network.gateway; }];
+                address = [ "${network.value.ip}/${builtins.toString network.value.mask}" ];
+                routes = inputs.lib.mkIf (network.value.gateway != null)
+                  [{ Gateway = network.value.gateway; Destination = "0.0.0.0/0"; }];
                linkConfig.RequiredForOnline = "routable";
+                dns = inputs.lib.mkIf (network.value.dns != null) [ network.value.dns ];
              };
            })
            (inputs.localLib.attrsToList networking.networkd.static))
--- a/modules/system/nix-ld.nix
+++ b/modules/system/nix-ld.nix
@@ -1,7 +1,7 @@
 inputs:
 {
  options.nixos.system.nix-ld = let inherit (inputs.lib) mkOption types; in mkOption
-    { type = types.nullOr (types.submodule {}); default = null; };
+    { type = types.nullOr (types.submodule {}); default = {}; };
  config = let inherit (inputs.config.nixos.system) nix-ld; in inputs.lib.mkIf (nix-ld != null)
  {
    programs.nix-ld = { enable = true; libraries = [ inputs.pkgs.steam-run.fhsenv ]; };
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -15,7 +15,7 @@ inputs:
        mandatoryFeatures = mkOption
        {
          type = types.listOf types.nonEmptyStr;
-          default = [ "gccarch-exact-${inputs.config.nixos.system.nixpkgs.march}" ];
+          default = [ "big-parallel" ];
        };
      };
      master =
@@ -88,7 +88,7 @@ inputs:
    })
    # substituters
    {
-      nix.settings.substituters = if nix.substituters == null then [ "https://cache.nixos.org/" ] else nix.substituters;
+      nix.settings.substituters = inputs.lib.mkIf (nix.substituters != null) nix.substituters;
    }
    # autoOptimiseStore
    (inputs.lib.mkIf nix.autoOptimiseStore
--- a/modules/system/nixpkgs.nix
+++ b/modules/system/nixpkgs.nix
@@ -46,7 +46,9 @@ inputs:
          }
          // (if nixpkgs.march == null then {} else
          {
-            oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "CORE-AVX512"; };
+            # TODO: change znver4 after update oneapi
+            # TODO: test znver3 do use AVX
+            oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "core-avx2"; };
              in match.${nixpkgs.march} or nixpkgs.march;
            nvhpcArch = nixpkgs.march;
            # contentAddressedByDefault = true;
@@ -115,6 +117,7 @@ inputs:
                  scalapack = prev.scalapack.overrideAttrs { doCheck = false; };
                  xdg-desktop-portal = prev.xdg-desktop-portal.overrideAttrs (prev:
                    { doCheck = false; nativeBuildInputs = prev.nativeBuildInputs ++ prev.nativeCheckInputs; });
+                  gsl = prev.gsl.overrideAttrs { doCheck = false; };
                }
              )
              // (
@@ -133,19 +136,12 @@ inputs:
        name = "native kernel";
        patch = null;
        extraStructuredConfig =
-          let
-            kernelConfig =
-            {
-              alderlake = "MALDERLAKE";
-              sandybridge = "MSANDYBRIDGE";
-              silvermont = "MSILVERMONT";
-              broadwell = "MBROADWELL";
-              skylake = "MSKYLAKE";
-              znver2 = "MZEN2";
-              znver3 = "MZEN3";
-              znver4 = "MZEN4";
-            };
-          in { GENERIC_CPU = inputs.lib.kernel.no; ${kernelConfig.${nixpkgs.march}} = inputs.lib.kernel.yes; };
+          let kernelConfig = { znver2 = "MZEN2"; znver3 = "MZEN3"; znver4 = "MZEN4"; };
+          in
+          {
+            GENERIC_CPU = inputs.lib.kernel.no;
+            ${kernelConfig.${nixpkgs.march} or "M${inputs.lib.toUpper nixpkgs.march}"} = inputs.lib.kernel.yes;
+          };
      }];
    };
 }
--- a/modules/system/security.nix
+++ b/modules/system/security.nix
@@ -43,5 +43,7 @@ inputs:
      sudo.extraConfig = "Defaults pwfeedback";
    };
    systemd.user.extraConfig = "DefaultLimitNOFILE=65536:524288";
+    # needed by xray tproxy if we want to forward traffic from other machine
+    networking.firewall.checkReversePath = false;
  };
 }
--- a/modules/system/sops.nix
+++ b/modules/system/sops.nix
@@ -5,28 +5,26 @@ inputs:
    enable = mkOption { type = types.bool; default = true; };
    keyPathPrefix = mkOption { type = types.str; default = "/nix/persistent"; };
  };
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (inputs.config.nixos.system) sops;
-    in mkIf sops.enable
+  config = let inherit (inputs.config.nixos.system) sops; in inputs.lib.mkIf sops.enable
+  {
+    sops =
    {
-      sops =
-      {
-        defaultSopsFile =
-          let deviceDir = "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.networking.hostname}";
-          in mkIf
-            (
-              builtins.pathExists "${deviceDir}/secrets.yaml"
-              || builtins.pathExists "${deviceDir}/secrets/default.yaml"
-            )
-            (
-              if builtins.pathExists "${deviceDir}/secrets.yaml" then "${deviceDir}/secrets.yaml"
-              else "${deviceDir}/secrets/default.yaml"
-            );
-        # sops start before impermanence, so we need to use the absolute path
-        age.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_ed25519_key" ];
-        gnupg.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_rsa_key" ];
-      };
+      defaultSopsFile =
+        let deviceDir =
+          if (inputs.config.nixos.system.cluster == null) then
+            "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.networking.hostname}"
+          else
+            "${inputs.topInputs.self}/devices/${inputs.config.nixos.system.cluster.clusterName}"
+              + "/${inputs.config.nixos.system.cluster.nodeName}";
+        in inputs.lib.mkMerge
+        [
+          (inputs.lib.mkIf (builtins.pathExists "${deviceDir}/secrets.yaml") "${deviceDir}/secrets.yaml")
+          (inputs.lib.mkIf (builtins.pathExists "${deviceDir}/secrets/default.yaml")
+            "${deviceDir}/secrets/default.yaml")
+        ];
+      # sops start before impermanence, so we need to use the absolute path
+      age.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_ed25519_key" ];
+      gnupg.sshKeyPaths = [ "${sops.keyPathPrefix}/etc/ssh/ssh_host_rsa_key" ];
    };
+  };
 }
--- a/modules/system/sysctl.nix
+++ b/modules/system/sysctl.nix
@@ -13,6 +13,8 @@ inputs:
        "vm.oom_dump_tasks" = false;
        "vm.overcommit_memory" = inputs.lib.mkDefault 1;
        "kernel.sysrq" = 438;
+        # set to larger value, otherwise the system will be very slow on low memory machines
+        "vm.vfs_cache_pressure" = 100;
      };
    }
    (inputs.lib.mkIf (sysctl.laptop-mode != null) { boot.kernel.sysctl."vm.laptop_mode" = sysctl.laptop-mode; })
--- a/modules/user/chn/default.nix
+++ b/modules/user/chn/default.nix
@@ -56,7 +56,7 @@ inputs:
                    (system:
                    {
                      name = system.config.nixos.system.networking.hostname;
-                      value = system.config.nixos.system.fileSystems.decrypt.manual;
+                      value = system.config.nixos.system.fileSystems.luks.manual;
                    })
                    (builtins.attrValues inputs.topInputs.self.nixosConfigurations));
                cat = "${inputs.pkgs.coreutils}/bin/cat";
@@ -68,7 +68,8 @@ inputs:
                  (builtins.map (system: builtins.concatStringsSep "\n"
                    [
                      "decrypt-${system.name}() {"
-                      "  key=$(${cat} ${system.value.keyFile} | ${gpg} --decrypt)"
+                      "  key=$(${cat} ${inputs.topInputs.self}/modules/system/fileSystems/luks/${system.name}.key \\"
+                      "    | ${gpg} --decrypt)"
                      (builtins.concatStringsSep "\n" (builtins.map
                        (device: "  echo $key | ${ssh} root@initrd.${system.name}.chn.moe cryptsetup luksOpen "
                          + (if device.value.ssd then "--allow-discards " else "")
@@ -86,7 +87,8 @@ inputs:
      };
    };
    environment.persistence =
-      let inherit (inputs.config.nixos.system) impermanence; in inputs.lib.mkIf impermanence.enable
+      let inherit (inputs.config.nixos.system) impermanence;
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
      {
        # TODO: make copy or soft link of files
        "${impermanence.persistence}".users.chn =
--- a/modules/user/chn/plasma/autostart.nix
+++ b/modules/user/chn/plasma/autostart.nix
@@ -67,7 +67,7 @@ inputs:
        (devices.${inputs.config.nixos.system.networking.hostname} or []));
    environment.persistence =
      let impermanence = inputs.config.nixos.system.impermanence;
-      in inputs.lib.mkIf impermanence.enable
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
      {
        "${impermanence.root}".users.chn.directories = [ ".config/autostart" ];
      };
--- a/modules/user/chn/plasma/konsole.nix
+++ b/modules/user/chn/plasma/konsole.nix
@@ -68,7 +68,8 @@ inputs:
        (builtins.readFile "${inputs.pkgs.konsole}/share/konsole/Breeze.colorscheme");
    };
    environment.persistence =
-      let impermanence = inputs.config.nixos.system.impermanence; in inputs.lib.mkIf impermanence.enable
+      let impermanence = inputs.config.nixos.system.impermanence;
+      in inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType or null != "worker" && impermanence.enable)
        { "${impermanence.root}".users.chn.directories = [ ".local/share/konsole" ".local/share/yakuake" ]; };
  };
 }
--- a/modules/user/chn/plasma/wallpaper.nix
+++ b/modules/user/chn/plasma/wallpaper.nix
@@ -2,7 +2,7 @@ inputs:
 {
  config.home-manager.users.chn.config.programs.plasma.configFile =
    let
-      inherit (inputs.topInputs.self.src) nixos-wallpaper;
+      inherit (inputs.topInputs) nixos-wallpaper;
      wallpaper =
      {
        pc = "${nixos-wallpaper}/pixiv-117612023.png";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chn	b84367f6b4	modules.services.slurm: enable task plugins	2024-10-11 19:42:37 +08:00
chn	e2073802f1	update blog	2024-10-10 16:33:50 +08:00
chn	fda4d2e864	packages.sbatch-tui: fix	2024-10-10 16:17:18 +08:00
chn	7b3e855e21	update blog	2024-10-10 13:15:49 +08:00
chn	cc6e6148ba	packages.vasp.intel: fix	2024-10-10 12:49:45 +08:00
chn	5fb6cb0184	modules.packages.desktop: install numpy	2024-10-10 01:27:24 +08:00
chn	0fca3c517f	update aagl	2024-10-10 01:07:12 +08:00
chn	a6252ee320	packages.spectroscopy: init	2024-10-10 00:21:43 +08:00
chn	dc354dd6f4	modules.packages.lammps: init	2024-10-08 13:23:47 +08:00
chn	0709454a21	update blog	2024-10-07 00:12:49 +08:00
chn	0d6bb32e12	modules.packages.winapps: fix windows	2024-10-06 11:17:44 +08:00
chn	c325474822	modules.packages.winapps: add acrobat-x-pro	2024-10-06 11:08:02 +08:00
chn	b788e792b3	modules.packages.winapps: add windows	2024-10-06 10:55:24 +08:00
chn	dfc8f433f5	modules.packages.winapps: add applications	2024-10-05 23:28:44 +08:00
chn	f7c4cb4b62	devices.vps6: move blog to vps6	2024-10-05 21:51:19 +08:00
chn	ae563d12fe	update blog	2024-10-05 21:45:56 +08:00
chn	95ad9352a7	modules.packages.winapps: init	2024-10-05 14:14:33 +08:00
chn	a420681cfc	devices.nas: move old misskey to nas	2024-10-05 12:08:51 +08:00
chn	791d3fa06c	modules.system.sysctl: set vfs_cache_pressure	2024-10-04 22:38:22 +08:00
chn	3ff3285708	update blog	2024-10-04 22:22:45 +08:00
chn	2096a8e2e4	update blog	2024-10-03 01:02:21 +08:00
chn	7e47019aea	modules.hardware: fix printer security issue	2024-10-02 23:50:07 +08:00
chn	24e4420a57	devices.pc: set windows boot entry	2024-10-02 20:29:32 +08:00
chn	76383ad9cb	devices.pc: allow kvm to read physical disk	2024-10-02 13:13:43 +08:00
chn	4fb4df63cc	devices.pc: add a disk	2024-10-02 13:09:52 +08:00
chn	5cff64305d	update blog	2024-10-02 01:24:00 +08:00
chn	71715cc16c	modules.system.cluster: fix	2024-10-01 23:34:43 +08:00
chn	7dac9a2668	devices.srv1: enable password authentication	2024-10-01 13:18:31 +08:00
chn	1770f8752c	modules.packages.server: fix fwupd	2024-10-01 12:13:40 +08:00
chn	43ba59d390	update misskey	2024-10-01 12:12:14 +08:00
chn	16fd1b23a2	modules.system.kernel: use xanmod-lts as default	2024-10-01 10:35:34 +08:00
chn	7cc3319c1c	devices.surface: fix bluetooth	2024-09-30 00:48:19 +08:00
chn	bec274441b	modules.bugs: fix bluetooth	2024-09-30 00:27:21 +08:00
chn	55b62460f6	modules.services.wireguard: fix	2024-09-29 17:30:09 +08:00
chn	3f81e70297	Revert "devices.vps6: move blog" This reverts commit `61b9c4a45a`.	2024-09-29 17:29:05 +08:00
chn	d9c9ecad39	modules.system.fileSystems.luks: fix manula decryption	2024-09-29 16:59:48 +08:00
chn	61b9c4a45a	devices.vps6: move blog	2024-09-29 16:42:14 +08:00
chn	1fed97e2a1	update blog	2024-09-29 16:22:19 +08:00
chn	65ad4ec686	devices.srv1: set srv1-node2 memory	2024-09-29 15:21:46 +08:00
chn	ab76703044	devices.srv1: add user	2024-09-29 14:56:31 +08:00
chn	5ee94c9bb8	update blog	2024-09-29 14:32:42 +08:00
chn	909ae871e0	fix peertube	2024-09-28 21:38:57 +08:00
chn	ee98d3bf21	modules.services.peertube: init	2024-09-28 21:17:29 +08:00
chn	327a7918aa	devices.srv1: change partitions	2024-09-28 17:58:15 +08:00
chn	c0cda4ecd4	Revert "blog: fix" This reverts commit `68f209b6d3`.	2024-09-28 17:50:48 +08:00
chn	c101334c9e	modules.services.nginx: fix	2024-09-28 17:50:30 +08:00
chn	68f209b6d3	blog: fix	2024-09-28 17:39:39 +08:00
chn	7aedd71136	Revert "modules.services.nginx.applications.blog: fix" This reverts commit `bc18c3d293`.	2024-09-28 17:38:18 +08:00
chn	bc18c3d293	modules.services.nginx.applications.blog: fix	2024-09-28 17:34:06 +08:00
chn	47ab23c4e1	devices.srv1.node1: enable samba and xrdp	2024-09-28 17:07:58 +08:00
chn	17725727bc	flake: nixos-wallpaper use flake input	2024-09-28 17:04:55 +08:00
chn	024598227a	devices.srv1.node2: fix network	2024-09-27 13:57:39 +08:00
chn	52b9ed4441	devices.srv1.node2: add bridge interface	2024-09-27 12:54:07 +08:00
chn	7d27bad072	devices.srv1.node2: enable kvm	2024-09-26 20:41:26 +08:00
chn	5944409604	devices.srv1: add users	2024-09-26 15:31:59 +08:00
chn	198fccc7bf	packages.sbatch-tui: fix	2024-09-26 15:23:59 +08:00
chn	cf3882becc	modules.packages: fix prebuild-packages	2024-09-26 13:51:57 +08:00
chn	c80617c6c0	modules.services.nfs: fix	2024-09-26 13:27:16 +08:00
chn	4fea6edcad	fix build	2024-09-26 12:47:46 +08:00
chn	e574916fd0	devices.srv1: fix network	2024-09-26 12:24:57 +08:00
chn	e72bec278e	modules.system.fileSystems.nfs: init	2024-09-26 12:16:15 +08:00
chn	515b6eedc1	modules.system.fileSystems: 整理	2024-09-26 12:00:26 +08:00
chn	bab49afeb3	modules.system.fileSystems.luks: split	2024-09-26 11:54:34 +08:00
chn	8faa50a427	modules.services.nfs: init	2024-09-26 11:23:07 +08:00
chn	72912c67cf	packages.hpcstat: remove front color for disk usage	2024-09-25 11:18:30 +08:00
chn	7bf49c8180	modules.packages.firefox: fix nativeMessagingHosts	2024-09-24 22:53:33 +08:00
chn	a175f0b361	devices.srv1: fix	2024-09-24 15:25:19 +08:00
chn	53d250fb17	devices.srv1: install broadwell vasp on node0	2024-09-24 11:55:57 +08:00
chn	a9722a6205	packages.vasp.intel: use openmpi	2024-09-24 11:44:17 +08:00
chn	d8d6592253	Revert "modules.services.misskey: use more threads" This reverts commit `03e205d93f`.	2024-09-23 23:55:18 +08:00
chn	03e205d93f	modules.services.misskey: use more threads	2024-09-23 23:12:14 +08:00
chn	4546316f22	devices.pc: samba open firewall	2024-09-23 15:04:52 +08:00
chn	5a0bf76710	modules.services.slurm: fix gpu string	2024-09-23 14:16:29 +08:00
chn	4600e2e3f1	packages.vasp.intel: fix	2024-09-22 17:46:11 +08:00
chn	575943c869	devices.pc: disable user zzn	2024-09-22 17:45:55 +08:00
chn	93fc9897da	devices.pc: fix sbatch-tui	2024-09-22 17:33:37 +08:00
chn	adb1b2a560	packages.sbatch-tui: fix	2024-09-22 17:28:21 +08:00
chn	7e38ee602e	packages.vasp.intel: fix	2024-09-22 17:21:12 +08:00
chn	3a7668549c	packages.oneapi: drop	2024-09-22 13:49:11 +08:00
chn	cc16d961c5	packages.vasp.intel: run without fhs	2024-09-22 13:46:09 +08:00
chn	b275b831c0	flake: change bscpkgs	2024-09-21 03:42:10 +08:00
chn	4ed6473503	modules.services.slurm: disable config check	2024-09-21 02:23:54 +08:00
chn	c9cf5e42ea	modules.services.slurm: fix firewall	2024-09-21 02:22:38 +08:00
chn	5048ca87b8	modules.services.slurm: enable tui	2024-09-21 01:51:51 +08:00
chn	62fd62d1f5	modules.packages.ssh: add hosts	2024-09-21 01:14:50 +08:00
chn	2904080ee8	modules.services.slurm: fix	2024-09-20 16:56:59 +08:00
chn	198882ee87	modules.services.slurm: fix default partitions	2024-09-20 16:22:14 +08:00
chn	5df233c831	devices.srv1.node3: fix	2024-09-20 16:11:33 +08:00
chn	3c02cb54c5	devices.srv1-node0: fix network	2024-09-20 14:47:49 +08:00
chn	9b00bbfb20	devices.srv1: fix	2024-09-20 14:24:48 +08:00
chn	a1659ae7fc	devices.srv1.node3: init	2024-09-20 14:09:17 +08:00
chn	aad3164e11	devices.srv1.node2: init	2024-09-20 13:33:14 +08:00
chn	992970e9bc	modules.packages.server: add gptfdisk	2024-09-20 12:57:06 +08:00
chn	e403148132	modules.packages.server: add megacli	2024-09-20 12:53:45 +08:00
chn	58bd1dd0b9	modules.services.xray: fix firewall	2024-09-20 01:43:27 +08:00
chn	17a5e27a49	modules.system.networking: fix dns	2024-09-20 00:13:35 +08:00
chn	141e5e99f9	devices.xmupc1: change gpu	2024-09-19 23:05:33 +08:00
chn	f4344b8b31	Reapply "devices.srv1.node1: enable vasp" This reverts commit `e9639a44c8`.	2024-09-19 22:25:09 +08:00
chn	e9639a44c8	Revert "devices.srv1.node1: enable vasp" This reverts commit `6a52b3d636`.	2024-09-19 22:12:15 +08:00
chn	48bbca8b7b	devices: enable remote build for srv1	2024-09-19 22:06:24 +08:00
chn	7553028f62	modules.packages.ssh: add srv1	2024-09-19 22:04:28 +08:00
chn	6a52b3d636	devices.srv1.node1: enable vasp	2024-09-19 21:26:36 +08:00
chn	8f5f6e476a	devices.srv1: fix network	2024-09-19 21:17:04 +08:00
chn	247f205a44	packages.ufo: add OutputRawDataFile	2024-09-19 01:35:40 +08:00
chn	7614f54302	packages.ufo: fix plot	2024-09-18 16:43:20 +08:00
chn	82f2e9e880	packages.ufo: fix	2024-09-18 16:10:33 +08:00
chn	b73e6617e3	packages.ufo: fix	2024-09-18 15:12:58 +08:00
chn	fa3ef015f0	packages.ufo: change plot style	2024-09-18 12:29:03 +08:00
chn	45635a522e	flake: move blog to another repo	2024-09-17 16:55:15 +08:00
chn	72431bc8f2	Merge branch 'blog' into production	2024-09-17 14:37:27 +08:00
chn	ec8b3ec720	devices.pcvm/pcarm: remove	2024-09-17 14:33:13 +08:00
chn	be471d011f	modules.services.docker: 整理	2024-09-17 14:12:06 +08:00
chn	51301788fc	modules.services.waydroid: 整理	2024-09-17 12:00:55 +08:00
chn	8880af591c	modules.hardware.gpu: enable initrd for amdgpu	2024-09-17 11:01:42 +08:00
chn	91db634820	devices.srv1.node1: fix nfs	2024-09-17 10:06:56 +08:00
chn	9fff0e1b4b	devices.srv1: fix nfs	2024-09-16 19:38:59 +08:00
chn	ddcaffaff1	devices.srv1.node1: fix nfs	2024-09-16 18:28:03 +08:00
chn	080c64f635	devices.srv1.node0: fix nfs	2024-09-16 18:26:15 +08:00
chn	40878a01b2	modules.system: fix nfs support	2024-09-16 17:56:59 +08:00
chn	a3e9cbbc9f	devices.srv1.node0: enable IP masquerading	2024-09-16 17:38:31 +08:00
chn	29c6a2b929	modules.services.slurm: rewrite	2024-09-16 17:04:09 +08:00
chn	c972d44c42	devices.srv1.node1: enable nfs	2024-09-16 14:13:47 +08:00
chn	375dd507fc	devices.vps6: add wireguard peer	2024-09-16 12:42:30 +08:00
chn	d2594617a9	devices.srv1.node0: enable nfs server	2024-09-16 12:00:04 +08:00
chn	f589beb956	devices.srv1.node1: add no-share-home specialisation	2024-09-16 11:49:30 +08:00
chn	b01efa89cd	modules.users.chn: disable persistence for worker node	2024-09-16 11:43:03 +08:00
chn	7e0e363b48	devices.srv1-node1: install	2024-09-16 11:18:02 +08:00
chn	217a4790b1	devices.srv1.node0: fix	2024-09-15 19:11:40 +08:00
chn	433429434d	devices.srv1.node0: fix	2024-09-15 18:53:55 +08:00
chn	ec8c6c9652	devices.srv1.node0: fix network	2024-09-15 18:47:23 +08:00
chn	4c1ba53fb6	devices.srv1.node0: support broadwell	2024-09-15 18:47:06 +08:00
chn	cd7599d775	modules.packages.vasp: fix	2024-09-15 18:42:02 +08:00
chn	718ff1780a	devices.srv1.node0: fix	2024-09-15 18:33:02 +08:00
chn	2fe8ba88f7	devices.srv1.node0: enable vasp	2024-09-15 18:27:01 +08:00
chn	19efe4a295	devices.srv1.node0: enable slurm	2024-09-15 18:26:26 +08:00
chn	22bf73faeb	devices.vps6: fix	2024-09-15 18:16:16 +08:00
chn	8d8f4633b5	devices.srv1.node0: set network	2024-09-15 18:01:28 +08:00
chn	7900d593da	Revert "modules.users.chn: 使用来自 home-manager 的 impermanence" This reverts commit `e3fe00a53d`.	2024-09-15 15:57:54 +08:00
chn	4b15bf8043	Revert "modules.system.impermanence: fix" This reverts commit `9e77fd172f`.	2024-09-15 15:56:41 +08:00
chn	d026c2c06a	devices.pc: add 极路由ip	2024-09-15 15:35:30 +08:00
chn	9e77fd172f	modules.system.impermanence: fix	2024-09-15 15:10:09 +08:00
chn	0d264ba30b	devices.srv1.node0: set as master	2024-09-15 13:17:08 +08:00
chn	0dc5e659d4	modules.system.kernel: fix	2024-09-15 13:15:48 +08:00
chn	a722dc17c4	devices.srv1.node0: install	2024-09-15 11:50:38 +08:00
chn	e441395c36	fix build	2024-09-14 22:42:26 +08:00
chn	35856d9293	Merge branch 'debug' into production	2024-09-14 22:30:31 +08:00
chn	36190b5e93	flake: 整理 srv1	2024-09-14 22:30:15 +08:00
chn	14c86412a1	modules.packages.desktop: remove etcher	2024-09-14 22:19:46 +08:00
chn	8d3e516c62	modules.user.chn: fix	2024-09-14 22:16:38 +08:00
chn	e3fe00a53d	modules.users.chn: 使用来自 home-manager 的 impermanence	2024-09-14 19:12:22 +08:00
chn	feb5a5b952	split flake	2024-09-14 18:49:12 +08:00
chn	59c3b98223	packages.ufo: fix	2024-09-14 18:01:29 +08:00
chn	14fdf5a1f6	packages.ufo: fix	2024-09-14 13:16:44 +08:00
chn	1a7137fda7	packages.ufo: fix	2024-09-14 12:15:39 +08:00
chn	66e3d95ac4	modules.packages.desktop: fix mathematica	2024-09-14 11:04:43 +08:00
chn	e8f6eac862	devices.pc: add zzn	2024-09-14 10:40:42 +08:00
chn	18ca59c546	devices.xmupc2: remove substituters	2024-09-13 22:16:51 +08:00
chn	e006d791a2	modules.nix: fix substituters	2024-09-13 20:01:00 +08:00
chn	fe7313b39a	packages.ufo: fix	2024-09-13 19:13:04 +08:00
chn	d1125b8800	packages.ufo: fix	2024-09-13 19:05:15 +08:00
chn	ef49835273	packages.ufo: fix	2024-09-13 18:51:35 +08:00
chn	bab902da3e	packages.ufo: add more data to unfold output	2024-09-13 18:23:54 +08:00
chn	56adb93265	devices.xmupc2: add substituters	2024-09-13 15:14:00 +08:00
chn	c94a19025d	devices.srv1-node3: init	2024-09-13 15:09:19 +08:00
chn	3a28659e3d	system.nixpkgs: fix	2024-09-13 15:07:14 +08:00
chn	0b1647d46f	devices.xmupc2: add more march support	2024-09-13 15:02:46 +08:00
chn	44254c33fa	modules.system.nix: set remote default mandatoryFeatures as big-parallel	2024-09-13 14:57:07 +08:00
chn	317f94a875	packages.ufo: fix	2024-09-13 14:56:51 +08:00
chn	9baa47e5b0	modules.system.nixpkgs: fix	2024-09-13 10:06:39 +08:00
chn	c85811e38e	modules.services.slurm: allow no gpu	2024-09-13 10:01:46 +08:00
chn	be0dc54797	devices.pc: add cascadelake support	2024-09-13 09:56:34 +08:00
chn	9b7f95ae78	devices.srv1-node0: init	2024-09-12 23:36:17 +08:00
chn	f3aff1e2a6	packages.biu: enable logger by default	2024-09-12 23:26:04 +08:00
chn	0da4f31d13	packages.ufo: fix	2024-09-12 18:02:14 +08:00
chn	352e38eb63	modules.hardware.gpu.amd: disable initrd	2024-09-12 12:55:30 +08:00
chn	1aee212aef	modules.packages.desktop: add ufo	2024-09-12 07:30:09 +08:00
chn	45ed2cb251	packages.ufo: use gnuplot backend	2024-09-12 06:05:27 +08:00
chn	f3b02a78b1	modules.packages.desktop: use old gnuplot	2024-09-12 05:47:15 +08:00
chn	1fcb165622	packages.ufo: fix	2024-09-12 05:44:37 +08:00
chn	16c14aacef	packages.biu: fix	2024-09-12 04:32:33 +08:00
chn	cca2feb57f	packages.ufo: fix	2024-09-12 04:27:57 +08:00
chn	347c213214	packages.ufo: fix	2024-09-12 02:51:44 +08:00
chn	ffc80f1cca	packages.ufo: 重构	2024-09-12 02:21:20 +08:00
chn	0e0a0a4a57	modules.packages.server: add python-ase	2024-09-10 11:35:24 +08:00
chn	73572b0964	modules.system.envfs: use module from nixpkgs	2024-09-09 23:12:00 +08:00
chn	00a45fa97c	packages.sbatch-tui: default manually select GPU	2024-09-08 19:22:26 +08:00
chn	43e9cd48d7	devices.xmupc1: remove zzn	2024-09-08 19:20:53 +08:00
chn	2327f74248	devices.pc: remove zzn	2024-09-08 19:20:40 +08:00
chn	b47a1d2a14	modules.packages.firefox: use addons from rycee	2024-09-08 19:19:07 +08:00
chn	bb527460c3	packages.biu: fix	2024-09-07 17:53:16 +08:00
chn	c85574a81a	packages.pocketfft: init	2024-09-07 17:21:11 +08:00
chn	346895d26a	packages.biu: include full range-v3 library	2024-09-07 12:53:53 +08:00
chn	3cba0619d8	packages.matplotplusplus: restore opengl support	2024-09-06 15:49:44 +08:00
chn	4fd2a7973d	packages.biu: add read file	2024-09-06 15:18:45 +08:00
chn	0aacc62638	devices.xmupc2: add windows entry	2024-09-06 13:36:15 +08:00
chn	c8affd5e15	devices.vps4: disable nix-ld and binfmt	2024-09-06 13:30:54 +08:00
chn	2888107398	packages.ufo: move example to another dir	2024-09-06 13:04:20 +08:00
chn	55cc1de138	packages: switch to clang	2024-09-04 18:45:06 +08:00
chn	301df4f58c	modules.packages.vscode: remove some extensions	2024-09-04 17:46:35 +08:00
chn	98068be0a3	packages.ufo: add lost file	2024-09-04 15:19:49 +08:00
chn	846000e973	Merge branch 'ufo' into production	2024-09-04 15:14:39 +08:00
chn	5c993072da	packages.biu: fix	2024-09-04 12:48:43 +08:00
chn	8722d03c4c	modules.user: add wm	2024-09-04 12:42:20 +08:00
chn	2f1d23655c	modules.packages.firefox: add plugin	2024-09-04 12:18:20 +08:00
chn	f301b3945f	modules.services.slurm: fix	2024-09-04 10:58:22 +08:00
chn	89f4c653d5	packages.biu: fix werid hdf5 issue	2024-09-04 10:39:12 +08:00
chn	df0a662ebd	devices.pc: add user	2024-09-04 09:40:26 +08:00
chn	2a0969b630	devices.vps7: use xanmod-lts	2024-09-04 09:24:44 +08:00
chn	58daeb41dc	packages.vasp: update	2024-09-04 09:21:33 +08:00
chn	1114101c57	devices.vps7: enable docker	2024-09-03 20:33:49 +08:00
chn	c6e0012f42	modules: enable envfs binfmt nix-ld as default	2024-09-03 20:32:57 +08:00
chn	1727008f7c	enable previously broken packages	2024-09-03 20:21:47 +08:00
chn	76dc92352b	packages.py4vasp: init	2024-09-03 20:04:26 +08:00
chn	80c58c8bf9	暂存	2024-08-26 23:00:11 +08:00